URL:

http://d16gahbjye4tb2.cloudfront.net/LaunchBrowserBarSetup-v1.10.25.17139.msi

Full analysis: https://app.any.run/tasks/be8d42c4-158a-41d7-8797-1ddeb0517875
Verdict: Malicious activity
Analysis date: October 31, 2023, 19:21:56
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
UxCryptor
Indicators:
SHA1:

EBE3463FB861D9852706EF9825188A327BD7AAF4

SHA256:

E54A90BD50E2DEC211154CA0E3920273A60C53DAAFF7DE3E563303945654FDA0

SSDEEP:

3:N1KaUT1fkEQB+l/0ysjAyMFvYn:CakkEQBn4XFvYn

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Bypass execution policy to execute commands

      • powershell.exe (PID: 2876)
      • powershell.exe (PID: 1228)

    • Changes powershell execution policy (Bypass)

      • msiexec.exe (PID: 3728)

    • Drops the executable file immediately after the start

      • msiexec.exe (PID: 1876)

  • SUSPICIOUS

    • Executes as Windows Service

      • VSSVC.exe (PID: 856)

    • Checks Windows Trust Settings

      • msiexec.exe (PID: 1876)

    • The process bypasses the loading of PowerShell profile settings

      • msiexec.exe (PID: 3728)

    • Starts POWERSHELL.EXE for commands execution

      • msiexec.exe (PID: 3728)

    • The process hide an interactive prompt from the user

      • msiexec.exe (PID: 3728)

    • The process executes Powershell scripts

      • msiexec.exe (PID: 3728)

    • Powershell version downgrade attack

      • powershell.exe (PID: 2876)
      • powershell.exe (PID: 1228)

    • Reads the Internet Settings

      • powershell.exe (PID: 2876)
      • powershell.exe (PID: 1228)
      • DBar.exe (PID: 2472)

    • Unusual connection from system programs

      • powershell.exe (PID: 2876)
      • powershell.exe (PID: 1228)

    • Process drops legitimate windows executable

      • msiexec.exe (PID: 1876)

    • The process creates files with name similar to system file names

      • msiexec.exe (PID: 1876)

    • The process drops C-runtime libraries

      • msiexec.exe (PID: 1876)

  • INFO

    • Reads security settings of Internet Explorer

      • msiexec.exe (PID: 3776)

    • Checks supported languages

      • msiexec.exe (PID: 1876)
      • msiexec.exe (PID: 3728)
      • DBar.exe (PID: 2472)

    • Application launched itself

      • iexplore.exe (PID: 2648)
      • msiexec.exe (PID: 1876)
      • msedge.exe (PID: 1796)

    • Reads the computer name

      • msiexec.exe (PID: 1876)
      • msiexec.exe (PID: 3728)
      • DBar.exe (PID: 2472)

    • Reads the machine GUID from the registry

      • msiexec.exe (PID: 1876)
      • msiexec.exe (PID: 3728)

    • The process uses the downloaded file

      • iexplore.exe (PID: 2648)

    • Create files in a temporary directory

      • msiexec.exe (PID: 3728)
      • msiexec.exe (PID: 1876)
      • msiexec.exe (PID: 3776)

    • Reads Environment values

      • msiexec.exe (PID: 3728)

    • Creates files or folders in the user directory

      • msiexec.exe (PID: 1876)

    • Drops the executable file immediately after the start

      • msedge.exe (PID: 1796)

    • Manual execution by a user

      • verclsid.exe (PID: 1360)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
70
Monitored processes
28
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe msiexec.exe no specs msiexec.exe no specs vssvc.exe no specs msiexec.exe no specs powershell.exe powershell.exe dbar.exe no specs msedge.exe msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs verclsid.exe no specs msedge.exe no specs msedge.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
856C:\Windows\system32\vssvc.exeC:\Windows\System32\VSSVC.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Volume Shadow Copy Service
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\vssvc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1036"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4180 --field-trial-handle=1348,i,17073768936784329014,6011521191617916519,131072 /prefetch:8C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1192"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1428 --field-trial-handle=1348,i,17073768936784329014,6011521191617916519,131072 /prefetch:3C:\Program Files\Microsoft\Edge\Application\msedge.exe
msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1228 -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\admin\AppData\Local\Temp\pss7058.tmp.ps1" C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
1360"C:\Windows\system32\verclsid.exe" /S /C {0B2C9183-C9FA-4C53-AE21-C900B0C39965} /I {0C733A8A-2A1C-11CE-ADE5-00AA0044773D} /X 0x401C:\Windows\System32\verclsid.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Extension CLSID Verification Host
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\verclsid.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1796"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch&plcid=0x409&o1=.NETFramework,Version=v4.8&processName=DBar.exe&platform=0000&osver=5&isServer=0&shimver=4.0.30319.34209C:\Program Files\Microsoft\Edge\Application\msedge.exe
DBar.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1876C:\Windows\system32\msiexec.exe /VC:\Windows\System32\msiexec.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2064"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4100 --field-trial-handle=1348,i,17073768936784329014,6011521191617916519,131072 /prefetch:8C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
2124"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=renderer --first-renderer-process --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2300 --field-trial-handle=1348,i,17073768936784329014,6011521191617916519,131072 /prefetch:1C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
2268"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=3676 --field-trial-handle=1348,i,17073768936784329014,6011521191617916519,131072 /prefetch:8C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
Total events
22 592
Read events
22 352
Write events
227
Delete events
13

Modification events

(PID) Process:(2648) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
0
(PID) Process:(2648) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
30847387
(PID) Process:(2648) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
30847437
(PID) Process:(2648) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(2648) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(2648) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(2648) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(2648) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(2648) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(2648) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
Executable files
37
Suspicious files
129
Text files
61
Unknown types
2

Dropped files

PID
Process
Filename
Type
3296iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\LaunchBrowserBarSetup-v1.10.25.17139.msi.sy656al.partial —
MD5:—
SHA256:—
2648iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\LaunchBrowserBarSetup-v1.10.25.17139.msi —
MD5:—
SHA256:—
1876msiexec.exeC:\System Volume Information\SPP\metadata-2 —
MD5:—
SHA256:—
1876msiexec.exeC:\Windows\Installer\202c82.msi —
MD5:—
SHA256:—
3728msiexec.exeC:\Users\admin\AppData\Local\Temp\msi2EE4.tmp.txt —
MD5:—
SHA256:—
3728msiexec.exeC:\Users\admin\AppData\Local\Temp\pss2EE5.tmp.ps1 —
MD5:—
SHA256:—
3728msiexec.exeC:\Users\admin\AppData\Local\Temp\pss2EF5.tmp.ps1 —
MD5:—
SHA256:—
2648iexplore.exeC:\Users\admin\AppData\Local\Temp\~DF1595AD5275E7C8D8.TMPbinary
MD5:45C6550F11B283C69E2B7F2EC7813D7D
SHA256:4BDDD5600505E8217CAD9B3D32E83C411C381DC8B40E1AA6EBC76540FAD747A3
3296iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\LaunchBrowserBarSetup-v1.10.25.17139[1].msimsi
MD5:2DD13390DE734D422B44AB48869B4DA2
SHA256:EF04FD87C5ACA307A34BE264D6AB9B598DDA4ACE93526C370A2AEDBFC902B6CF
1876msiexec.exeC:\Users\admin\AppData\Roaming\LaunchBrowserBar\bar\DBar.exebinary
MD5:A8BDAB3A30AB1F9730C36C4A4DC7FA97
SHA256:66D9097D946B1A82CD561867D1467FF5AF59BB9C2D6063D16B4176C5841989D1
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
10
TCP/UDP connections
49
DNS requests
56
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1192
msedge.exe
GET
302
23.38.82.57:80
http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch&plcid=0x409&o1=.NETFramework,Version=v4.8&processName=DBar.exe&platform=0000&osver=5&isServer=0&shimver=4.0.30319.34209
unknown
—
—
unknown
2876
powershell.exe
POST
200
18.165.185.121:80
http://d1xdao0g1hqd47.cloudfront.net/
unknown
binary
19 b
unknown
2648
iexplore.exe
GET
200
67.27.235.254:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?990b108a4251045f
unknown
compressed
4.66 Kb
unknown
2648
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
der
471 b
unknown
2648
iexplore.exe
GET
200
67.27.235.254:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?f95c7c0d181ec9a7
unknown
compressed
4.66 Kb
unknown
2648
iexplore.exe
GET
200
67.27.235.254:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?7a8be6b8b90b37e8
unknown
compressed
4.66 Kb
unknown
1228
powershell.exe
POST
200
18.165.185.121:80
http://d1xdao0g1hqd47.cloudfront.net/
unknown
binary
19 b
unknown
2648
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D
unknown
binary
471 b
unknown
2648
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
binary
471 b
unknown
2648
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D
unknown
binary
471 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
1088
svchost.exe
224.0.0.252:5355
—
—
—
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
2656
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
2876
powershell.exe
18.165.185.121:80
d1xdao0g1hqd47.cloudfront.net
—
US
unknown
2648
iexplore.exe
152.199.19.161:443
iecvlist.microsoft.com
EDGECAST
US
whitelisted
2648
iexplore.exe
67.27.235.254:80
ctldl.windowsupdate.com
LEVEL3
US
unknown
2648
iexplore.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
1228
powershell.exe
18.165.185.121:80
d1xdao0g1hqd47.cloudfront.net
—
US
unknown
1192
msedge.exe
23.38.82.57:80
go.microsoft.com
AKAMAI-AS
DE
unknown

DNS requests

Domain
IP
Reputation
d1xdao0g1hqd47.cloudfront.net
  • 18.165.185.121
  • 18.165.185.160
  • 18.165.185.115
  • 18.165.185.81
unknown
iecvlist.microsoft.com
  • 152.199.19.161
whitelisted
r20swj13mr.microsoft.com
  • 152.199.19.161
whitelisted
ctldl.windowsupdate.com
  • 67.27.235.254
  • 67.27.159.126
  • 8.238.191.254
  • 8.253.95.249
  • 8.238.189.126
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
go.microsoft.com
  • 23.38.82.57
  • 2.19.246.123
  • 2.19.86.20
  • 23.213.166.81
whitelisted
config.edge.skype.com
  • 13.107.42.16
whitelisted
edge.microsoft.com
  • 13.107.21.239
  • 204.79.197.239
whitelisted
nav-edge.smartscreen.microsoft.com
  • 20.31.251.109
whitelisted
dotnet.microsoft.com
  • 13.107.246.63
  • 13.107.213.63
whitelisted

Threats

Found threats are available for the paid subscriptions
1 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
http://d16gahbjye4tb2.cloudfront.net/LaunchBrowserBarSetup-v1.10.25.17139.msi