File name:

webview2.exe

Full analysis: https://app.any.run/tasks/81b03316-25f3-42b6-8409-3f67971610a3
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: October 24, 2023, 00:35:10
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
loader
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

85A1FFBBA981E63DD419EC1020B23C47

SHA1:

D63C3D196CEF714F9335C6162283650F4ED959C4

SHA256:

ED544BB542723F729E9873F37F9AE440A57136D0C429D47F83FF494164EF42D9

SSDEEP:

24576:WwyG3tQW0pzMxwTLN0M94AdqACcnU2VGeoMKV8vxf14bPPFVFm/n6aDJFU1:HyG3tQ7ZMxg0K/th7KV8gbXHA/nTJFA

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • MicrosoftEdgeUpdate.exe (PID: 3716)
      • webview2.exe (PID: 3248)
      • MicrosoftEdge_X86_109.0.1518.140.exe (PID: 1628)
      • setup.exe (PID: 2480)

    • Loads dropped or rewritten executable

      • MicrosoftEdgeUpdate.exe (PID: 3716)
      • MicrosoftEdgeUpdate.exe (PID: 3848)
      • MicrosoftEdgeUpdate.exe (PID: 2504)
      • MicrosoftEdgeUpdate.exe (PID: 3152)
      • MicrosoftEdgeUpdate.exe (PID: 1980)
      • MicrosoftEdgeUpdate.exe (PID: 2232)

    • Application was dropped or rewritten from another process

      • MicrosoftEdgeUpdate.exe (PID: 3152)
      • MicrosoftEdgeUpdate.exe (PID: 2504)
      • MicrosoftEdgeUpdate.exe (PID: 3716)
      • MicrosoftEdgeUpdate.exe (PID: 1980)
      • MicrosoftEdgeUpdate.exe (PID: 3848)
      • MicrosoftEdgeUpdate.exe (PID: 2232)
      • setup.exe (PID: 2480)

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • webview2.exe (PID: 3248)
      • MicrosoftEdgeUpdate.exe (PID: 3716)
      • MicrosoftEdge_X86_109.0.1518.140.exe (PID: 1628)
      • setup.exe (PID: 2480)

    • Starts itself from another location

      • MicrosoftEdgeUpdate.exe (PID: 3716)

    • Creates/Modifies COM task schedule object

      • MicrosoftEdgeUpdate.exe (PID: 1980)

    • Reads settings of System Certificates

      • MicrosoftEdgeUpdate.exe (PID: 3848)
      • MicrosoftEdgeUpdate.exe (PID: 2504)
      • MicrosoftEdgeUpdate.exe (PID: 2232)

    • Reads security settings of Internet Explorer

      • MicrosoftEdgeUpdate.exe (PID: 2504)
      • MicrosoftEdgeUpdate.exe (PID: 3848)
      • MicrosoftEdgeUpdate.exe (PID: 2232)

    • Reads the Internet Settings

      • MicrosoftEdgeUpdate.exe (PID: 3848)
      • MicrosoftEdgeUpdate.exe (PID: 2504)
      • MicrosoftEdgeUpdate.exe (PID: 2232)

    • Checks Windows Trust Settings

      • MicrosoftEdgeUpdate.exe (PID: 2504)
      • MicrosoftEdgeUpdate.exe (PID: 3848)
      • MicrosoftEdgeUpdate.exe (PID: 2232)

    • Application launched itself

      • MicrosoftEdgeUpdate.exe (PID: 3848)

  • INFO

    • Reads the computer name

      • wmpnscfg.exe (PID: 3184)
      • MicrosoftEdgeUpdate.exe (PID: 3716)
      • MicrosoftEdgeUpdate.exe (PID: 1980)
      • MicrosoftEdgeUpdate.exe (PID: 2504)
      • MicrosoftEdgeUpdate.exe (PID: 3152)
      • MicrosoftEdgeUpdate.exe (PID: 3848)
      • setup.exe (PID: 2480)
      • MicrosoftEdge_X86_109.0.1518.140.exe (PID: 1628)
      • MicrosoftEdgeUpdate.exe (PID: 2232)

    • Checks supported languages

      • webview2.exe (PID: 3248)
      • wmpnscfg.exe (PID: 3184)
      • MicrosoftEdgeUpdate.exe (PID: 3716)
      • MicrosoftEdgeUpdate.exe (PID: 1980)
      • MicrosoftEdgeUpdate.exe (PID: 2504)
      • MicrosoftEdgeUpdate.exe (PID: 3152)
      • MicrosoftEdgeUpdate.exe (PID: 3848)
      • setup.exe (PID: 2480)
      • MicrosoftEdge_X86_109.0.1518.140.exe (PID: 1628)
      • MicrosoftEdgeUpdate.exe (PID: 2232)

    • Reads the machine GUID from the registry

      • wmpnscfg.exe (PID: 3184)
      • MicrosoftEdgeUpdate.exe (PID: 3716)
      • MicrosoftEdgeUpdate.exe (PID: 3152)
      • MicrosoftEdgeUpdate.exe (PID: 3848)
      • MicrosoftEdgeUpdate.exe (PID: 2504)
      • MicrosoftEdgeUpdate.exe (PID: 2232)

    • Create files in a temporary directory

      • webview2.exe (PID: 3248)
      • MicrosoftEdgeUpdate.exe (PID: 2504)
      • MicrosoftEdgeUpdate.exe (PID: 2232)

    • Creates files or folders in the user directory

      • MicrosoftEdgeUpdate.exe (PID: 3716)
      • MicrosoftEdgeUpdate.exe (PID: 2504)
      • MicrosoftEdgeUpdate.exe (PID: 3848)
      • MicrosoftEdge_X86_109.0.1518.140.exe (PID: 1628)
      • setup.exe (PID: 2480)
      • MicrosoftEdgeUpdate.exe (PID: 2232)

    • Reads Environment values

      • MicrosoftEdgeUpdate.exe (PID: 2504)
      • MicrosoftEdgeUpdate.exe (PID: 2232)

    • Checks proxy server information

      • MicrosoftEdgeUpdate.exe (PID: 2504)
      • MicrosoftEdgeUpdate.exe (PID: 2232)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (64.6)
.dll | Win32 Dynamic Link Library (generic) (15.4)
.exe | Win32 Executable (generic) (10.5)
.exe | Generic Win/DOS Executable (4.6)
.exe | DOS Executable Generic (4.6)

EXIF

EXE

LanguageId: en
UpstreamVersion: 1.3.99.0
ProductVersion: 1.3.173.55
ProductName: Microsoft Edge Update
OriginalFileName: MicrosoftEdgeUpdateSetup.exe
LegalCopyright: Copyright Microsoft Corporation
InternalName: Microsoft Edge Update Setup
FileVersion: 1.3.173.55
FileDescription: Microsoft Edge Update Setup
CompanyName: Microsoft Corporation
CharacterSet: Unicode
LanguageCode: English (U.S.)
FileSubtype: -
ObjectFileType: Executable application
FileOS: Windows NT 32-bit
FileFlags: (none)
FileFlagsMask: 0x003f
ProductVersionNumber: 1.3.173.55
FileVersionNumber: 1.3.173.55
Subsystem: Windows GUI
SubsystemVersion: 5.1
ImageVersion: -
OSVersion: 5.1
EntryPoint: 0x7d20
UninitializedDataSize: -
InitializedDataSize: 1490944
CodeSize: 108032
LinkerVersion: 14.31
PEType: PE32
ImageFileCharacteristics: Executable, 32-bit
TimeStamp: 2023:03:29 00:08:02+00:00
MachineType: Intel 386 or later, and compatibles
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
47
Monitored processes
10
Malicious processes
9
Suspicious processes
0

Behavior graph

Click at the process to see the details
drop and start start drop and start drop and start drop and start drop and start webview2.exe no specs microsoftedgeupdate.exe no specs microsoftedgeupdate.exe no specs microsoftedgeupdate.exe microsoftedgeupdate.exe no specs microsoftedgeupdate.exe microsoftedge_x86_109.0.1518.140.exe no specs setup.exe no specs microsoftedgeupdate.exe wmpnscfg.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1628"C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\Install\{98505EBE-6AE6-4A17-A1AB-8BD3982492F9}\MicrosoftEdge_X86_109.0.1518.140.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --user-levelC:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\Install\{98505EBE-6AE6-4A17-A1AB-8BD3982492F9}\MicrosoftEdge_X86_109.0.1518.140.exe—MicrosoftEdgeUpdate.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge Installer
Exit code:
0
Version:
109.0.1518.140
Modules
Images
c:\users\admin\appdata\local\microsoft\edgeupdate\install\{98505ebe-6ae6-4a17-a1ab-8bd3982492f9}\microsoftedge_x86_109.0.1518.140.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\shell32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\usp10.dll
1980"C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserverC:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe—MicrosoftEdgeUpdate.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge Update
Exit code:
0
Version:
1.3.173.55
Modules
Images
c:\users\admin\appdata\local\microsoft\edgeupdate\microsoftedgeupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\rpcrt4.dll
2232"C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzMuNTUiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzMuNTUiIGlzbWFjaGluZT0iMCIgc2Vzc2lvbmlkPSJ7NENEQjZBRTEtOTY3QS00NjhFLTgzOEEtQ0UwODgzOUJENUY2fSIgaW5zdGFsbHNvdXJjZT0idGFnZ2VkbWkiIHJlcXVlc3RpZD0iezRCNzYxQUYxLUQwQUEtNDMzMC05NDUxLTRBRkUyQTk5RTY1Rn0iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgbG9naWNhbF9jcHVzPSI0IiBwaHlzbWVtb3J5PSIzIiBkaXNrX3R5cGU9IjAiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjEiIHNzZTQxPSIxIiBzc2U0Mj0iMSIgYXZ4PSIxIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjYuMS43NjAxLjI0NTQ2IiBzcD0iU2VydmljZSBQYWNrIDEiIGFyY2g9Ing4NiIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iREVMTCIgcHJvZHVjdF9uYW1lPSJERUxMIi8-PGV4cCBldGFnPSImcXVvdDtyNDUydDErazJUZ3EvSFh6anZGTkJSaG9wQldSOXNialh4cWVVREg5dVgwPSZxdW90OyIvPjxhcHAgYXBwaWQ9IntGMzAxNzIyNi1GRTJBLTQyOTUtOEJERi0wMEMzQTlBN0U0QzV9IiB2ZXJzaW9uPSIiIG5leHR2ZXJzaW9uPSIxMDkuMC4xNTE4LjE0MCIgbGFuZz0iZW4iIGJyYW5kPSIiIGNsaWVudD0iIiBleHBlcmltZW50cz0iY29uc2VudD1mYWxzZSIgaW5zdGFsbGFnZT0iLTEiIGluc3RhbGxkYXRlPSItMSI-PHVwZGF0ZWNoZWNrLz48ZXZlbnQgZXZlbnR0eXBlPSI5IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIyMDE3NDM0NTcwMyIvPjxldmVudCBldmVudHR5cGU9IjUiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjIwMTc0MzQ1NzAzIi8-PGV2ZW50IGV2ZW50dHlwZT0iMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMjA5NTA5MDgyMDMiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvd25sb2FkZXI9ImJpdHMiIHVybD0iaHR0cDovL21zZWRnZS5mLnRsdS5kbC5kZWxpdmVyeS5tcC5taWNyb3NvZnQuY29tL2ZpbGVzdHJlYW1pbmdzZXJ2aWNlL2ZpbGVzL2Q4N2EzYmJkLTdmZTUtNGVjMy1iODA2LTI5M2NjYTc4YjM2Mz9QMT0xNjk4NzEyNTIyJmFtcDtQMj00MDQmYW1wO1AzPTImYW1wO1A0PWRzNFkwaUsxJTJibmZWbXBOZjNCaklia1JYa1JFZ0o2dEdDbmIzb1J5N1UwbkVvNFJYMiUyYnFPREFmYnZpVmtqN0FZSTB0WURoa0VzcnZjJTJmdGZ3aCUyZnMyZHclM2QlM2QiIHNlcnZlcl9pcF9oaW50PSIiIGNkbl9jaWQ9Ii0xIiBjZG5fY2NjPSIiIGNkbl9tc2VkZ2VfcmVmPSIiIGNkbl9henVyZV9yZWZfb3JpZ2luX3NoaWVsZD0iIiBjZG5fY2FjaGU9IiIgY2RuX3AzcD0iIiBkb3dubG9hZGVkPSIxMjg1MTI5NjgiIHRvdGFsPSIxMjg1MTI5NjgiIGRvd25sb2FkX3RpbWVfbXM9Ijc1MzEzIi8-PGV2ZW50IGV2ZW50dHlwZT0iMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMjA5NTEwNjQ0NTMiIHNvdXJjZV91cmxfaW5kZXg9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSI2IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIyMDk2ODcyMDcwMyIvPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjE5NjYwOCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMjExNTI5Mzk0NTMiIHNvdXJjZV91cmxfaW5kZXg9IjAiIHVwZGF0ZV9jaGVja190aW1lX21zPSI5MjIiIGRvd25sb2FkX3RpbWVfbXM9Ijc3NjcxIiBkb3dubG9hZGVkPSIxMjg1MTI5NjgiIHRvdGFsPSIxMjg1MTI5NjgiIHBhY2thZ2VfY2FjaGVfcmVzdWx0PSIwIiBpbnN0YWxsX3RpbWVfbXM9IjE4NDIyIi8-PC9hcHA-PC9yZXF1ZXN0PgC:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
MicrosoftEdgeUpdate.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge Update
Exit code:
0
Version:
1.3.173.55
Modules
Images
c:\users\admin\appdata\local\microsoft\edgeupdate\microsoftedgeupdate.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\user32.dll
2480"C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\Install\{98505EBE-6AE6-4A17-A1AB-8BD3982492F9}\EDGEMITMP_B7CF5.tmp\setup.exe" --install-archive="C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\Install\{98505EBE-6AE6-4A17-A1AB-8BD3982492F9}\MicrosoftEdge_X86_109.0.1518.140.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --user-levelC:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\Install\{98505EBE-6AE6-4A17-A1AB-8BD3982492F9}\EDGEMITMP_B7CF5.tmp\setup.exe—MicrosoftEdge_X86_109.0.1518.140.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge Installer
Exit code:
0
Version:
109.0.1518.140
Modules
Images
c:\users\admin\appdata\local\microsoft\edgeupdate\install\{98505ebe-6ae6-4a17-a1ab-8bd3982492f9}\edgemitmp_b7cf5.tmp\setup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ncrypt.dll
c:\windows\system32\msasn1.dll
c:\windows\system32\apphelp.dll
c:\windows\apppatch\acgenral.dll
2504"C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzMuNTUiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzMuNTUiIGlzbWFjaGluZT0iMCIgc2Vzc2lvbmlkPSJ7NENEQjZBRTEtOTY3QS00NjhFLTgzOEEtQ0UwODgzOUJENUY2fSIgaW5zdGFsbHNvdXJjZT0idGFnZ2VkbWkiIHJlcXVlc3RpZD0ie0MyOTdEMDUzLUMxNUQtNERDNi1COEEyLUNGN0RDNzczNTMwMH0iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgbG9naWNhbF9jcHVzPSI0IiBwaHlzbWVtb3J5PSIzIiBkaXNrX3R5cGU9IjAiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjEiIHNzZTQxPSIxIiBzc2U0Mj0iMSIgYXZ4PSIxIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjYuMS43NjAxLjI0NTQ2IiBzcD0iU2VydmljZSBQYWNrIDEiIGFyY2g9Ing4NiIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iREVMTCIgcHJvZHVjdF9uYW1lPSJERUxMIi8-PGV4cCBldGFnPSIiLz48YXBwIGFwcGlkPSJ7RjNDNEZFMDAtRUZENS00MDNCLTk1NjktMzk4QTIwRjFCQTRBfSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iMS4zLjE3My41NSIgbGFuZz0iIiBicmFuZD0iIiBjbGllbnQ9IiI-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMjAxNjIwMDE5NTMiIGluc3RhbGxfdGltZV9tcz0iNDY5Ii8-PC9hcHA-PC9yZXF1ZXN0PgC:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
MicrosoftEdgeUpdate.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge Update
Exit code:
0
Version:
1.3.173.55
Modules
Images
c:\users\admin\appdata\local\microsoft\edgeupdate\microsoftedgeupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\lpk.dll
3152"C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=false" /installsource taggedmi /sessionid "{4CDB6AE1-967A-468E-838A-CE08839BD5F6}"C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe—MicrosoftEdgeUpdate.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge Update
Exit code:
0
Version:
1.3.173.55
Modules
Images
c:\users\admin\appdata\local\microsoft\edgeupdate\microsoftedgeupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
3184"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\ole32.dll
3248"C:\Users\admin\AppData\Local\Temp\webview2.exe" C:\Users\admin\AppData\Local\Temp\webview2.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge Update Setup
Exit code:
0
Version:
1.3.173.55
Modules
Images
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
3716C:\Users\admin\AppData\Local\Temp\EUBE0E.tmp\MicrosoftEdgeUpdate.exe /installsource taggedmi /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers"C:\Users\admin\AppData\Local\Temp\EUBE0E.tmp\MicrosoftEdgeUpdate.exe—webview2.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge Update
Exit code:
0
Version:
1.3.173.55
Modules
Images
c:\users\admin\appdata\local\temp\eube0e.tmp\microsoftedgeupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
3848"C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" -EmbeddingC:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge Update
Exit code:
0
Version:
1.3.173.55
Modules
Images
c:\users\admin\appdata\local\microsoft\edgeupdate\microsoftedgeupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
Total events
16 174
Read events
13 588
Write events
2 563
Delete events
23

Modification events

(PID) Process:(3184) wmpnscfg.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Media Player NSS\3.0\Events\{A669BABB-CE2D-456E-97F0-713A9FB51765}\{C01382C4-863B-4286-A8C6-D214DA5DE7AC}
Operation:delete keyName:(default)
Value:
(PID) Process:(3184) wmpnscfg.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Media Player NSS\3.0\Events\{A669BABB-CE2D-456E-97F0-713A9FB51765}
Operation:delete keyName:(default)
Value:
(PID) Process:(3184) wmpnscfg.exeKey:HKEY_CURRENT_USER\Software\Microsoft\MediaPlayer\Health\{AF2396DE-971E-41CB-9579-5E7196A31577}
Operation:delete keyName:(default)
Value:
(PID) Process:(3716) MicrosoftEdgeUpdate.exeKey:HKEY_CURRENT_USER\Software\Microsoft\EdgeUpdate\PersistedPings\{C297D053-C15D-4DC6-B8A2-CF7DC7735300}
Operation:delete keyName:(default)
Value:
(PID) Process:(1980) MicrosoftEdgeUpdate.exeKey:HKEY_CLASSES_ROOT\CLSID\{81093D63-7825-417B-BFC8-ADC63FA4E53D}\InprocServer32
Operation:delete keyName:(default)
Value:
(PID) Process:(1980) MicrosoftEdgeUpdate.exeKey:HKEY_CLASSES_ROOT\CLSID\{81093D63-7825-417B-BFC8-ADC63FA4E53D}
Operation:delete keyName:(default)
Value:
(PID) Process:(1980) MicrosoftEdgeUpdate.exeKey:HKEY_CLASSES_ROOT\CLSID\{5EA43877-C6D8-4885-B77A-C0BB27E94372}\InprocServer32
Operation:delete keyName:(default)
Value:
(PID) Process:(1980) MicrosoftEdgeUpdate.exeKey:HKEY_CLASSES_ROOT\CLSID\{5EA43877-C6D8-4885-B77A-C0BB27E94372}
Operation:delete keyName:(default)
Value:
(PID) Process:(1980) MicrosoftEdgeUpdate.exeKey:HKEY_CLASSES_ROOT\CLSID\{104551AA-F675-4497-8EE1-F5ECD609DB97}\InprocHandler32
Operation:delete keyName:(default)
Value:
(PID) Process:(1980) MicrosoftEdgeUpdate.exeKey:HKEY_CLASSES_ROOT\CLSID\{104551AA-F675-4497-8EE1-F5ECD609DB97}
Operation:delete keyName:(default)
Value:
Executable files
203
Suspicious files
12
Text files
5
Unknown types
0

Dropped files

PID
Process
Filename
Type
3248webview2.exeC:\Users\admin\AppData\Local\Temp\EUBE0E.tmp\MicrosoftEdgeUpdate.exeexecutable
MD5:D7DEC1752172A55A855DA132E6B685CB
SHA256:5DFC43333A2360AD916F67BF783D8260A32D811A738B3D2E58427B1B384FF9A3
3248webview2.exeC:\Users\admin\AppData\Local\Temp\EUBE0E.tmp\MicrosoftEdgeComRegisterShellARM64.exeexecutable
MD5:2EA2A38EEEC085CCCCE81EFCF0AAA935
SHA256:C4392D342E0957AEC69EA4CF61EE529CA33184F64682E6DFF13908197E47DE1D
3248webview2.exeC:\Users\admin\AppData\Local\Temp\EUBE0E.tmp\MicrosoftEdgeUpdateOnDemand.exeexecutable
MD5:C5EFBDB4F35AF8B4CA971597AF010F55
SHA256:6485FEB6292960A51EFA87014686B6168D1C8A66CD7B5DEFFC587C506AB31505
3248webview2.exeC:\Users\admin\AppData\Local\Temp\EUBE0E.tmp\psmachine.dllexecutable
MD5:F3BF9D3AA283FD89700ABE5DFD09762D
SHA256:A0870F23E8B43308C5D9647A9A4AAC12F67C231331D5C73EF6BA8B00EFA21399
3248webview2.exeC:\Users\admin\AppData\Local\Temp\EUBE0E.tmp\msedgeupdate.dllexecutable
MD5:FA3AB8067D5CA8429D04C00D2640A654
SHA256:35E5DC8C698A118017EF4FBC81FB78215B940450E1C5090429483E78ED51D8AC
3248webview2.exeC:\Users\admin\AppData\Local\Temp\EUBE0E.tmp\MicrosoftEdgeUpdateBroker.exeexecutable
MD5:EF5236483BAB3D91CADA43F965916E36
SHA256:9890D163D04E29650F040896D93C788D748837E3D11C274784E695E1BF942CFD
3248webview2.exeC:\Users\admin\AppData\Local\Temp\EUBE0E.tmp\MicrosoftEdgeUpdateComRegisterShell64.exeexecutable
MD5:43935BE0F50FF815501A998039E29E08
SHA256:A7081BD1B6F55F357CB75F5174555081DCD4C207CCC954F53FD97776A36BF099
3248webview2.exeC:\Users\admin\AppData\Local\Temp\EUBE0E.tmp\psmachine_64.dllexecutable
MD5:478369FE11C658D640A7FDA5329B135F
SHA256:5BAF446601A041BDB43969DABE685DCD7FE84D07A8D19427D3239517BFACE8FF
3248webview2.exeC:\Users\admin\AppData\Local\Temp\EUBE0E.tmp\psuser_arm64.dllexecutable
MD5:10A1AF177EFCD33E98F6DB3BFCAE5FDA
SHA256:A8CFFAF62A7FB1D1B3156B09E710FD04B92A8690EB168B9290FF8915CF3302B6
3248webview2.exeC:\Users\admin\AppData\Local\Temp\EUBE0E.tmp\psmachine_arm64.dllexecutable
MD5:7528259C9E959041195BB0E330127D73
SHA256:B7EBE51733F7684770A2BED1B5B179D253147578514970AAB619D6AA06617EE9
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
12
DNS requests
9
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
864
svchost.exe
HEAD
200
152.199.19.161:80
http://msedge.f.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/d87a3bbd-7fe5-4ec3-b806-293cca78b363?P1=1698712522&P2=404&P3=2&P4=ds4Y0iK1%2bnfVmpNf3BjIbkRXkREgJ6tGCnb3oRy7U0nEo4RX2%2bqODAfbviVkj7AYI0tYDhkEsrvc%2ftfwh%2fs2dw%3d%3d
unknown
—
—
unknown
2504
MicrosoftEdgeUpdate.exe
GET
200
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?033fa0d04ac573b7
unknown
compressed
4.66 Kb
unknown
864
svchost.exe
GET
200
152.199.19.161:80
http://msedge.f.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/d87a3bbd-7fe5-4ec3-b806-293cca78b363?P1=1698712522&P2=404&P3=2&P4=ds4Y0iK1%2bnfVmpNf3BjIbkRXkREgJ6tGCnb3oRy7U0nEo4RX2%2bqODAfbviVkj7AYI0tYDhkEsrvc%2ftfwh%2fs2dw%3d%3d
unknown
executable
122 Mb
unknown
2504
MicrosoftEdgeUpdate.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEApDqVCbATUviZV57HIIulA%3D
unknown
binary
471 b
unknown
2232
MicrosoftEdgeUpdate.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
der
471 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
2656
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
2504
MicrosoftEdgeUpdate.exe
13.107.42.16:443
config.edge.skype.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
3848
MicrosoftEdgeUpdate.exe
13.67.191.143:443
msedge.api.cdp.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
2504
MicrosoftEdgeUpdate.exe
20.189.173.16:443
self.events.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
2504
MicrosoftEdgeUpdate.exe
93.184.221.240:80
ctldl.windowsupdate.com
EDGECAST
GB
whitelisted
2504
MicrosoftEdgeUpdate.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
864
svchost.exe
152.199.19.161:80
msedge.f.tlu.dl.delivery.mp.microsoft.com
EDGECAST
US
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2232
MicrosoftEdgeUpdate.exe
13.107.42.16:443
config.edge.skype.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
config.edge.skype.com
  • 13.107.42.16
whitelisted
msedge.api.cdp.microsoft.com
  • 13.67.191.143
whitelisted
self.events.data.microsoft.com
  • 20.189.173.16
  • 52.182.143.209
whitelisted
ctldl.windowsupdate.com
  • 93.184.221.240
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
msedge.f.tlu.dl.delivery.mp.microsoft.com
  • 152.199.19.161
whitelisted

Threats

PID
Process
Class
Message
864
svchost.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
webview2.exe