Analysis date (UTC): 17 September 2025, 10:25Analysis environment: Windows 10 Pro, build 19044, x64

https://leakbase.la

MD5:D6BE6D616DD52CE812C32B03E3C1E990
SHA1:C5E94FB6E924EDEDF42245D37E13807F1A443F08
SHA256:EE36B19833E6B9C5C8B19C37D32F17C356792DE498488C05349608DE7689971A

Analysis result

Threat level:Malicious activity
Tags:
websocket

Behavior activities

MALICIOUS

No malicious indicators.

SUSPICIOUS

Application launched itself

  • updater.exe (PID: 7824)

The process executes via Task Scheduler

  • updater.exe (PID: 7824)

INFO

Application launched itself

  • msedge.exe (PID: 6704)

Checks supported languages

  • updater.exe (PID: 7824)
  • identity_helper.exe (PID: 7520)
  • updater.exe (PID: 7856)

Process checks whether UAC notifications are on

  • updater.exe (PID: 7824)

Checks proxy server information

  • slui.exe (PID: 8108)

Reads the software policy settings

  • slui.exe (PID: 8108)

Threats

PIDProcessClassMessage
2728msedge.exeNot Suspicious TrafficINFO [ANY.RUN] BootstrapCDN (maxcdn .bootstrapcdn .com)
2728msedge.exeNot Suspicious TrafficINFO [ANY.RUN] BootstrapCDN (maxcdn .bootstrapcdn .com)
——Misc activityET HUNTING [TW] Likely Javascript-Obfuscator Usage Observed M1
——Potentially Bad TrafficET INFO Possible Chrome Plugin install
——Unknown TrafficET USER_AGENTS Microsoft Dr Watson User-Agent (MSDW)
2728msedge.exePotentially Bad TrafficET DNS Query for .to TLD
2728msedge.exePotentially Bad TrafficET DNS Query for .to TLD
2728msedge.exePotentially Bad TrafficET DNS Query for .to TLD
2728msedge.exePotentially Bad TrafficET DNS Query for .to TLD
2728msedge.exePotentially Bad TrafficET DNS Query for .to TLD

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Interactive malware hunting service ANY.RUN