File name:

SimpleChecker.exe

Full analysis: https://app.any.run/tasks/25e6eb88-7e97-433f-95d0-e24975b49292
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: August 12, 2024, 19:11:58
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
ip-check
themida
discordgrabber
generic
stealer
loader
Indicators:
MIME: application/x-dosexec
File info: PE32+ executable (GUI) x86-64, for MS Windows
MD5:

FE8ABC5D08ADF8D31FA50637238818D7

SHA1:

A9271DAE35422B7A4693382EBA0F628A650AA931

SHA256:

F76F288BD17822671664DD19B39BC02DEE672E991FC14F0CF97F8175C9C7BF61

SSDEEP:

98304:jI6tH6Z/VXcsvkXSpc59h28YcPlCbd8JEtCjrZifKdo4U/S/YXz1mG+gEdgn8Ew1:WEYtj/tSxSZNcIaMyV8SRodz

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • DISCORDGRABBER has been detected (YARA)

      • SimpleChecker.exe (PID: 6448)

    • Changes the autorun value in the registry

      • MicrosoftEdgeUpdate.exe (PID: 7164)

  • SUSPICIOUS

    • Drops the executable file immediately after the start

      • SimpleChecker.exe (PID: 6448)
      • MicrosoftEdgeWebview2Setup.exe (PID: 7140)
      • MicrosoftEdgeUpdate.exe (PID: 7164)

    • Process drops legitimate windows executable

      • SimpleChecker.exe (PID: 6448)
      • MicrosoftEdgeWebview2Setup.exe (PID: 7140)
      • MicrosoftEdgeUpdate.exe (PID: 7164)

    • There is functionality for capture public ip (YARA)

      • SimpleChecker.exe (PID: 6448)

    • Reads the BIOS version

      • SimpleChecker.exe (PID: 6448)

    • Executable content was dropped or overwritten

      • SimpleChecker.exe (PID: 6448)
      • MicrosoftEdgeWebview2Setup.exe (PID: 7140)
      • MicrosoftEdgeUpdate.exe (PID: 7164)

    • Starts a Microsoft application from unusual location

      • MicrosoftEdgeWebview2Setup.exe (PID: 7140)
      • MicrosoftEdgeUpdate.exe (PID: 7164)

    • Creates/Modifies COM task schedule object

      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 6376)
      • MicrosoftEdgeUpdate.exe (PID: 6260)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 6384)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 6320)

    • Starts itself from another location

      • MicrosoftEdgeUpdate.exe (PID: 7164)

    • Reads security settings of Internet Explorer

      • MicrosoftEdgeUpdate.exe (PID: 7164)

    • Reads the date of Windows installation

      • MicrosoftEdgeUpdate.exe (PID: 7164)

    • Potential Corporate Privacy Violation

      • svchost.exe (PID: 3908)

  • INFO

    • Reads the machine GUID from the registry

      • SimpleChecker.exe (PID: 6448)
      • MicrosoftEdgeUpdate.exe (PID: 6124)
      • MicrosoftEdgeUpdate.exe (PID: 188)

    • Checks supported languages

      • SimpleChecker.exe (PID: 6448)
      • MicrosoftEdgeWebview2Setup.exe (PID: 7140)
      • MicrosoftEdgeUpdate.exe (PID: 6260)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 6376)
      • MicrosoftEdgeUpdate.exe (PID: 7164)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 6384)
      • MicrosoftEdgeUpdate.exe (PID: 6124)
      • MicrosoftEdgeUpdate.exe (PID: 4824)
      • MicrosoftEdgeUpdate.exe (PID: 188)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 6320)

    • Reads Environment values

      • SimpleChecker.exe (PID: 6448)
      • MicrosoftEdgeUpdate.exe (PID: 6124)

    • Reads the software policy settings

      • SimpleChecker.exe (PID: 6448)
      • MicrosoftEdgeUpdate.exe (PID: 6124)
      • MicrosoftEdgeUpdate.exe (PID: 188)

    • Create files in a temporary directory

      • SimpleChecker.exe (PID: 6448)
      • MicrosoftEdgeWebview2Setup.exe (PID: 7140)
      • MicrosoftEdgeUpdate.exe (PID: 7164)
      • svchost.exe (PID: 3908)

    • Themida protector has been detected

      • SimpleChecker.exe (PID: 6448)

    • Reads the computer name

      • MicrosoftEdgeUpdate.exe (PID: 7164)
      • MicrosoftEdgeUpdate.exe (PID: 6260)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 6376)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 6384)
      • MicrosoftEdgeUpdate.exe (PID: 6124)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 6320)
      • MicrosoftEdgeUpdate.exe (PID: 4824)
      • MicrosoftEdgeUpdate.exe (PID: 188)
      • SimpleChecker.exe (PID: 6448)

    • Creates files or folders in the user directory

      • MicrosoftEdgeUpdate.exe (PID: 7164)

    • Checks proxy server information

      • MicrosoftEdgeUpdate.exe (PID: 6124)
      • MicrosoftEdgeUpdate.exe (PID: 188)

    • Process checks computer location settings

      • MicrosoftEdgeUpdate.exe (PID: 7164)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic Win/DOS Executable (50)
.exe | DOS Executable Generic (49.9)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 0000:00:00 00:00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 3
CodeSize: 7028736
InitializedDataSize: 1286144
UninitializedDataSize: -
EntryPoint: 0x1e69058
OSVersion: 6.1
ImageVersion: 1
SubsystemVersion: 6.1
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.0
ProductVersionNumber: 0.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: Built using Wails (https://wails.io)
CompanyName: Simple Checker
FileDescription: Simple Checker
LegalCopyright: Copyright.........
ProductName: Simple Checker
ProductVersion: 1.0.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
128
Monitored processes
11
Malicious processes
4
Suspicious processes
1

Behavior graph

Click at the process to see the details
start THREAT simplechecker.exe microsoftedgewebview2setup.exe microsoftedgeupdate.exe microsoftedgeupdate.exe no specs microsoftedgeupdatecomregistershell64.exe no specs microsoftedgeupdatecomregistershell64.exe no specs microsoftedgeupdatecomregistershell64.exe no specs microsoftedgeupdate.exe microsoftedgeupdate.exe no specs microsoftedgeupdate.exe svchost.exe

Process information

PID
CMD
Path
Indicators
Parent process
188"C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" -EmbeddingC:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge Update
Version:
1.3.195.15
Modules
Images
c:\users\admin\appdata\local\microsoft\edgeupdate\microsoftedgeupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\ole32.dll
3908C:\WINDOWS\System32\svchost.exe -k netsvcs -p -s BITSC:\Windows\System32\svchost.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
4824"C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=false" /installsource taggedmi /sessionid "{5F84C764-6CEF-4A2A-906A-966468BC1339}"C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe—MicrosoftEdgeUpdate.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge Update
Version:
1.3.195.15
Modules
Images
c:\users\admin\appdata\local\microsoft\edgeupdate\microsoftedgeupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\ole32.dll
6124"C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuMTUiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuMTUiIGlzbWFjaGluZT0iMCIgc2Vzc2lvbmlkPSJ7NUY4NEM3NjQtNkNFRi00QTJBLTkwNkEtOTY2NDY4QkMxMzM5fSIgdXNlcmlkPSJ7OEI1NkY3N0UtMzk1RS00RTk0LUJERTYtNDE0RDQxOEQ4ODk3fSIgaW5zdGFsbHNvdXJjZT0idGFnZ2VkbWkiIHJlcXVlc3RpZD0iezJFNTdBMDdGLUM4OTctNEU3QS05QzE1LTkxNjVCQ0ZDRDMyNX0iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgbG9naWNhbF9jcHVzPSI0IiBwaHlzbWVtb3J5PSI0IiBkaXNrX3R5cGU9IjIiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjEiIHNzZTQxPSIxIiBzc2U0Mj0iMSIgYXZ4PSIxIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjEwLjAuMTkwNDUuNDA0NiIgc3A9IiIgYXJjaD0ieDY0IiBwcm9kdWN0X3R5cGU9IjQ4IiBpc193aXA9IjAiIGlzX2luX2xvY2tkb3duX21vZGU9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSJERUxMIiBwcm9kdWN0X25hbWU9IkRFTEwiLz48ZXhwIGV0YWc9IiIvPjxhcHAgYXBwaWQ9IntGM0M0RkUwMC1FRkQ1LTQwM0ItOTU2OS0zOThBMjBGMUJBNEF9IiB2ZXJzaW9uPSIiIG5leHR2ZXJzaW9uPSIxLjMuMTk1LjE1IiBsYW5nPSIiIGJyYW5kPSIiIGNsaWVudD0iIj48ZXZlbnQgZXZlbnR0eXBlPSIyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIxMDI2ODgyNjg3OCIgaW5zdGFsbF90aW1lX21zPSI2NzIiLz48L2FwcD48L3JlcXVlc3Q-C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
MicrosoftEdgeUpdate.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge Update
Exit code:
0
Version:
1.3.195.15
Modules
Images
c:\users\admin\appdata\local\microsoft\edgeupdate\microsoftedgeupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\ole32.dll
6260"C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserverC:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe—MicrosoftEdgeUpdate.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge Update
Exit code:
0
Version:
1.3.195.15
Modules
Images
c:\users\admin\appdata\local\microsoft\edgeupdate\microsoftedgeupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\ole32.dll
6320"C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\1.3.195.15\MicrosoftEdgeUpdateComRegisterShell64.exe" /user C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\1.3.195.15\MicrosoftEdgeUpdateComRegisterShell64.exe—MicrosoftEdgeUpdate.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge Update COM Registration Helper
Exit code:
0
Version:
1.3.195.15
Modules
Images
c:\users\admin\appdata\local\microsoft\edgeupdate\1.3.195.15\microsoftedgeupdatecomregistershell64.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
6376"C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\1.3.195.15\MicrosoftEdgeUpdateComRegisterShell64.exe" /user C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\1.3.195.15\MicrosoftEdgeUpdateComRegisterShell64.exe—MicrosoftEdgeUpdate.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge Update COM Registration Helper
Exit code:
0
Version:
1.3.195.15
Modules
Images
c:\users\admin\appdata\local\microsoft\edgeupdate\1.3.195.15\microsoftedgeupdatecomregistershell64.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
6384"C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\1.3.195.15\MicrosoftEdgeUpdateComRegisterShell64.exe" /user C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\1.3.195.15\MicrosoftEdgeUpdateComRegisterShell64.exe—MicrosoftEdgeUpdate.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge Update COM Registration Helper
Exit code:
0
Version:
1.3.195.15
Modules
Images
c:\users\admin\appdata\local\microsoft\edgeupdate\1.3.195.15\microsoftedgeupdatecomregistershell64.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
6448"C:\Users\admin\Desktop\SimpleChecker.exe" C:\Users\admin\Desktop\SimpleChecker.exe
explorer.exe
User:
admin
Company:
Simple Checker
Integrity Level:
MEDIUM
Description:
Simple Checker
Modules
Images
c:\users\admin\desktop\simplechecker.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
7140C:\Users\admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exeC:\Users\admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe
SimpleChecker.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge Update Setup
Version:
1.3.195.15
Modules
Images
c:\users\admin\appdata\local\temp\microsoftedgewebview2setup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
Total events
18 332
Read events
17 215
Write events
1 083
Delete events
34

Modification events

(PID) Process:(7164) MicrosoftEdgeUpdate.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeUpdate
Operation:delete valueName:eulaaccepted
Value:
(PID) Process:(7164) MicrosoftEdgeUpdate.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeUpdate
Operation:writeName:path
Value:
C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
(PID) Process:(7164) MicrosoftEdgeUpdate.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeUpdate
Operation:writeName:UninstallCmdLine
Value:
"C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /uninstall
(PID) Process:(7164) MicrosoftEdgeUpdate.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeUpdate\Clients\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}
Operation:writeName:pv
Value:
1.3.195.15
(PID) Process:(7164) MicrosoftEdgeUpdate.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeUpdate\Clients\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}
Operation:writeName:name
Value:
Microsoft Edge Update
(PID) Process:(7164) MicrosoftEdgeUpdate.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeUpdate\ClientState\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}
Operation:writeName:pv
Value:
1.3.195.15
(PID) Process:(7164) MicrosoftEdgeUpdate.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:Microsoft Edge Update
Value:
"C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\1.3.195.15\MicrosoftEdgeUpdateCore.exe"
(PID) Process:(7164) MicrosoftEdgeUpdate.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeUpdate
Operation:writeName:edgeupdate_task_name_c
Value:
MicrosoftEdgeUpdateTaskUserS-1-5-21-1693682860-607145093-2874071422-1001Core{19C84890-0905-4354-9A21-6196DBAEA207}
(PID) Process:(7164) MicrosoftEdgeUpdate.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeUpdate
Operation:writeName:edgeupdate_task_name_ua
Value:
MicrosoftEdgeUpdateTaskUserS-1-5-21-1693682860-607145093-2874071422-1001UA{E4042EA9-CBA4-4395-87F6-D637E7A892CF}
(PID) Process:(6376) MicrosoftEdgeUpdateComRegisterShell64.exeKey:HKEY_CLASSES_ROOT\CLSID\{81093D63-7825-417B-BFC8-ADC63FA4E53D}\InprocServer32
Operation:writeName:ThreadingModel
Value:
Both
Executable files
202
Suspicious files
0
Text files
3
Unknown types
2

Dropped files

PID
Process
Filename
Type
7140MicrosoftEdgeWebview2Setup.exeC:\Users\admin\AppData\Local\Temp\EUA3E8.tmp\MicrosoftEdgeComRegisterShellARM64.exeexecutable
MD5:B69894FC1C3F26C77B1826EF8B5A9FC5
SHA256:B91BAD4C618EB6049B19364F62827470095E30519D07F4E0F2CCC387DDD5F1BF
7140MicrosoftEdgeWebview2Setup.exeC:\Users\admin\AppData\Local\Temp\EUA3E8.tmp\MicrosoftEdgeUpdate.exeexecutable
MD5:136E8226D68856DA40A4F60E70581B72
SHA256:B4B8A2F87EE9C5F731189FE9F622CB9CD18FA3D55B0E8E0AE3C3A44A0833709F
7140MicrosoftEdgeWebview2Setup.exeC:\Users\admin\AppData\Local\Temp\EUA3E8.tmp\MicrosoftEdgeUpdateBroker.exeexecutable
MD5:31E1C773732A9CD1AB781205E39CF865
SHA256:3E90C66D0D00E294B9B51EC3ED7F846975D93736D424DA3C253A2238E63CFB33
6448SimpleChecker.exeC:\Users\admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exeexecutable
MD5:45E5CA74B9AE3C3FC6F6A63C609783B6
SHA256:B4AFD37B9087DF7E041AE749FD0FA342926D9CCE533BDE9CDC4283132C3820A9
7140MicrosoftEdgeWebview2Setup.exeC:\Users\admin\AppData\Local\Temp\EUA3E8.tmp\MicrosoftEdgeUpdateComRegisterShell64.exeexecutable
MD5:205590D4FB4B1914D2853AB7A9839CCF
SHA256:5F82471D58B6E700248D9602CE4A0A5CDA4D2E2863EF1EB9FEE4EFFCC07F3767
7140MicrosoftEdgeWebview2Setup.exeC:\Users\admin\AppData\Local\Temp\EUA3E8.tmp\MicrosoftEdgeUpdateOnDemand.exeexecutable
MD5:D0373E02A529653013865E392C417471
SHA256:D4CB47B4444BE38BB6DCADC8BC9CACC029CB73A66BC7AF152C1C4CA022446AA4
7140MicrosoftEdgeWebview2Setup.exeC:\Users\admin\AppData\Local\Temp\EUA3E8.tmp\psmachine_arm64.dllexecutable
MD5:9BD2ACEAB0205EE756B607C0449249F7
SHA256:88B9A29588C6F3D89FF417848FF7B8EC02F8301058E8F14F52F546348EB1FB6F
7140MicrosoftEdgeWebview2Setup.exeC:\Users\admin\AppData\Local\Temp\EUA3E8.tmp\psmachine.dllexecutable
MD5:F1101C00EAAC144AA67F4A9334BB6F23
SHA256:40D41C46A3E927E98BEEAD383624EFBE2FAF2CCBD0FA8F08C012DFD5FE36913A
7140MicrosoftEdgeWebview2Setup.exeC:\Users\admin\AppData\Local\Temp\EUA3E8.tmp\msedgeupdateres_am.dllexecutable
MD5:F624DE37750FD191EB29D4DE36818F8B
SHA256:E284453CD512E446FCBF9440013F8CB2348FFD6B1ACEC5366F2511CDF88B1794
7140MicrosoftEdgeWebview2Setup.exeC:\Users\admin\AppData\Local\Temp\EUA3E8.tmp\EdgeUpdate.dathiv
MD5:369BBC37CFF290ADB8963DC5E518B9B8
SHA256:3D7EC761BEF1B1AF418B909F1C81CE577C769722957713FDAFBC8131B0A0C7D3
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
8
TCP/UDP connections
20
DNS requests
8
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
301
184.30.21.171:443
https://go.microsoft.com/fwlink/p/?LinkId=2124703
unknown
—
—
—
3908
svchost.exe
HEAD
200
2.16.10.177:80
http://msedge.f.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/529a41cd-5c0c-4cd0-8061-b71feaa8a336?P1=1724094855&P2=404&P3=2&P4=kcdVq4HUto4ZIi%2f%2fzje1LWUCVa%2f1PPy8kI6OySHQN4%2f86LsinkUnx3IU0Xm%2bkpE6ZF3TYIpqO27BzPz6OikWfQ%3d%3d
unknown
—
—
whitelisted
3908
svchost.exe
GET
—
2.16.10.177:80
http://msedge.f.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/529a41cd-5c0c-4cd0-8061-b71feaa8a336?P1=1724094855&P2=404&P3=2&P4=kcdVq4HUto4ZIi%2f%2fzje1LWUCVa%2f1PPy8kI6OySHQN4%2f86LsinkUnx3IU0Xm%2bkpE6ZF3TYIpqO27BzPz6OikWfQ%3d%3d
unknown
—
—
whitelisted
—
—
GET
200
13.107.42.16:443
https://config.edge.skype.com/config/v1/EdgeUpdate/1.3.195.15?clientId=s:BAD99146-31D3-4EC6-A1A4-BE76F32BA5D4&appChannel_edgeupdate=6&appConsentState_edgeupdate=0&appDayOfInstall_edgeupdate=0&appInactivityBadgeApplied_edgeupdate=0&appInactivityBadgeCleared_edgeupdate=0&appInactivityBadgeDuration_edgeupdate=0&appInstallTimeDiffSec_edgeupdate=0&appIsPinnedSystem_edgeupdate=false&appLastLaunchCount_edgeupdate=0&appLastLaunchTime_edgeupdate=0&appLastLaunchTimeJson_edgeupdate=0&appLastLaunchTimeDaysAgo_edgeupdate=0&appVersion_edgeupdate=1.3.195.15&appUpdateCheckIsUpdateDisabled_edgeupdate=false&appUpdatesAllowedForMeteredNetworks_edgeupdate=false&hwDiskType=2&hwHasSsse3=true&hwLogicalCpus=4&hwPhysmemory=4&isCTADevice=false&isMsftDomainJoined=false&oemProductManufacturer=DELL&oemProductName=DELL&osArch=x64&osIsDefaultNetworkConnectionMetered=false&osIsInLockdownMode=false&osIsWIP=false&osPlatform=win&osProductType=48&osVersion=10.0.19045.4046&requestCheckPeriodSec=-1&requestDomainJoined=false&requestInstallSource=taggedmi&requestIsMachine=false&requestOmahaShellVersion=1.3.195.15&requestOmahaVersion=1.3.195.15
unknown
binary
439 b
—
—
—
POST
200
13.95.26.4:443
https://msedge.api.cdp.microsoft.com/api/v2/contents/Browser/namespaces/Default/names?action=batchupdates
unknown
ini
103 b
—
—
—
POST
—
13.95.26.4:443
https://msedge.api.cdp.microsoft.com/api/v1.1/internal/contents/Browser/namespaces/Default/names/msedgewebview-stable-win-x64/versions/127.0.2651.98/files?action=GenerateDownloadInfo&foregroundPriority=true
unknown
—
—
—
—
—
GET
200
152.199.21.175:443
https://msedge.sf.dl.delivery.mp.microsoft.com/filestreamingservice/files/bfbbeee6-130c-46b7-bf66-6b8eab0e894d/MicrosoftEdgeWebview2Setup.exe
unknown
executable
1.57 Mb
—
—
—
POST
200
13.95.26.4:443
https://msedge.api.cdp.microsoft.com/api/v1.1/internal/contents/Browser/namespaces/Default/names/msedgewebview-stable-win-x64/versions/127.0.2651.98/files?action=GenerateDownloadInfo&foregroundPriority=true
unknown
ini
6.74 Kb
—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1420
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
3888
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
—
—
192.168.100.255:138
—
—
—
whitelisted
4576
RUXIMICS.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
2120
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
4324
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
6448
SimpleChecker.exe
23.35.238.131:443
go.microsoft.com
AKAMAI-AS
DE
unknown
6448
SimpleChecker.exe
152.199.21.175:443
msedge.sf.dl.delivery.mp.microsoft.com
EDGECAST
DE
whitelisted
6124
MicrosoftEdgeUpdate.exe
13.107.42.16:443
config.edge.skype.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
188
MicrosoftEdgeUpdate.exe
20.114.58.89:443
msedge.api.cdp.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
whitelisted
google.com
  • 142.250.184.206
whitelisted
go.microsoft.com
  • 23.35.238.131
whitelisted
msedge.sf.dl.delivery.mp.microsoft.com
  • 152.199.21.175
whitelisted
config.edge.skype.com
  • 13.107.42.16
whitelisted
msedge.api.cdp.microsoft.com
  • 20.114.58.89
whitelisted
msedge.f.tlu.dl.delivery.mp.microsoft.com
  • 2.16.10.177
  • 2.16.10.182
whitelisted

Threats

PID
Process
Class
Message
3908
svchost.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
SimpleChecker.exe