File name:

0142d9338d2d603340d4494a2476b15e9a186a23f3b6effbdb8dcc56d7d6e9de

Full analysis: https://app.any.run/tasks/e9408a81-e6a0-454e-9667-4cf1d601a464
Verdict: Malicious activity
Threats:

Amadey is a formidable Windows infostealer threat, characterized by its persistence mechanisms, modular design, and ability to execute various malicious tasks.

Malware Trends Tracker     >>>
Analysis date: May 19, 2025, 14:37:02
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
amadey
smoke
loader
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:

3B4D9C0958B0A08CD744C8504075CE54

SHA1:

FC32D174DB827B4CF69B73DAEA8C863CA5BB65F1

SHA256:

0142D9338D2D603340D4494A2476B15E9A186A23F3B6EFFBDB8DCC56D7D6E9DE

SSDEEP:

49152:ZLnemI4niudOT+Qec9ueGWAdAHXeYZjmShoywddKbc032Q/ZacqyH72Ba6kM7J2p:Fn24nbdR5r5iXeY9dwLgSQBa8b2gMNiB

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was injected by another process

      • explorer.exe (PID: 5492)

    • Runs injected code in another process

      • 3sA31tA.exe (PID: 7424)

    • AMADEY mutex has been found

      • explothe.exe (PID: 7788)
      • explothe.exe (PID: 7652)

    • Uses Task Scheduler to run other applications

      • explothe.exe (PID: 7788)

    • Changes the autorun value in the registry

      • explothe.exe (PID: 7788)

    • SMOKE mutex has been found

      • explorer.exe (PID: 5492)

  • SUSPICIOUS

    • Starts a Microsoft application from unusual location

      • 0142d9338d2d603340d4494a2476b15e9a186a23f3b6effbdb8dcc56d7d6e9de.exe (PID: 6964)
      • ak4yw02.exe (PID: 4812)
      • Wi0vM57.exe (PID: 1280)
      • sK8JP39.exe (PID: 7180)
      • ZU1hd54.exe (PID: 7200)
      • sE5dh59.exe (PID: 6132)

    • Process drops legitimate windows executable

      • 0142d9338d2d603340d4494a2476b15e9a186a23f3b6effbdb8dcc56d7d6e9de.exe (PID: 6964)
      • ak4yw02.exe (PID: 4812)
      • sK8JP39.exe (PID: 7180)
      • Wi0vM57.exe (PID: 1280)
      • sE5dh59.exe (PID: 6132)

    • Executable content was dropped or overwritten

      • 0142d9338d2d603340d4494a2476b15e9a186a23f3b6effbdb8dcc56d7d6e9de.exe (PID: 6964)
      • ak4yw02.exe (PID: 4812)
      • sE5dh59.exe (PID: 6132)
      • sK8JP39.exe (PID: 7180)
      • Wi0vM57.exe (PID: 1280)
      • 5RR0oS0.exe (PID: 7724)
      • ZU1hd54.exe (PID: 7200)

    • Reads security settings of Internet Explorer

      • 5RR0oS0.exe (PID: 7724)
      • explothe.exe (PID: 7788)

    • Starts itself from another location

      • 5RR0oS0.exe (PID: 7724)

    • Starts CMD.EXE for commands execution

      • 7uT2wf49.exe (PID: 7836)
      • cmd.exe (PID: 7964)
      • explothe.exe (PID: 7788)

    • Executing commands from a ".bat" file

      • 7uT2wf49.exe (PID: 7836)

    • Application launched itself

      • cmd.exe (PID: 7964)

    • Uses ICACLS.EXE to modify access control lists

      • cmd.exe (PID: 7964)

    • The process executes via Task Scheduler

      • explothe.exe (PID: 7652)

    • Connects to unusual port

      • AppLaunch.exe (PID: 7704)

  • INFO

    • The sample compiled with english language support

      • 0142d9338d2d603340d4494a2476b15e9a186a23f3b6effbdb8dcc56d7d6e9de.exe (PID: 6964)
      • ak4yw02.exe (PID: 4812)
      • sE5dh59.exe (PID: 6132)
      • sK8JP39.exe (PID: 7180)
      • Wi0vM57.exe (PID: 1280)

    • Create files in a temporary directory

      • 0142d9338d2d603340d4494a2476b15e9a186a23f3b6effbdb8dcc56d7d6e9de.exe (PID: 6964)
      • ak4yw02.exe (PID: 4812)
      • Wi0vM57.exe (PID: 1280)
      • sE5dh59.exe (PID: 6132)
      • sK8JP39.exe (PID: 7180)
      • 5RR0oS0.exe (PID: 7724)
      • ZU1hd54.exe (PID: 7200)
      • 7uT2wf49.exe (PID: 7836)

    • Checks supported languages

      • 0142d9338d2d603340d4494a2476b15e9a186a23f3b6effbdb8dcc56d7d6e9de.exe (PID: 6964)
      • ak4yw02.exe (PID: 4812)
      • Wi0vM57.exe (PID: 1280)
      • sK8JP39.exe (PID: 7180)
      • sE5dh59.exe (PID: 6132)
      • 2Ww9025.exe (PID: 7280)
      • AppLaunch.exe (PID: 7704)
      • 3sA31tA.exe (PID: 7424)
      • 5RR0oS0.exe (PID: 7724)
      • 4gg964ph.exe (PID: 7680)
      • ZU1hd54.exe (PID: 7200)
      • 1pn00eo1.exe (PID: 7224)
      • AppLaunch.exe (PID: 7404)
      • AppLaunch.exe (PID: 7264)
      • 6pv8ap7.exe (PID: 7804)
      • 7uT2wf49.exe (PID: 7836)
      • explothe.exe (PID: 7788)
      • identity_helper.exe (PID: 976)
      • explothe.exe (PID: 7652)

    • Reads the computer name

      • AppLaunch.exe (PID: 7264)
      • 5RR0oS0.exe (PID: 7724)
      • AppLaunch.exe (PID: 7704)
      • explothe.exe (PID: 7788)
      • identity_helper.exe (PID: 976)

    • Process checks computer location settings

      • 5RR0oS0.exe (PID: 7724)
      • explothe.exe (PID: 7788)

    • Reads the machine GUID from the registry

      • AppLaunch.exe (PID: 7704)

    • Reads security settings of Internet Explorer

      • cmd.exe (PID: 7920)

    • Application launched itself

      • msedge.exe (PID: 5968)

    • Reads Environment values

      • identity_helper.exe (PID: 976)

    • Connects to unusual port

      • msedge.exe (PID: 1052)

    • Checks proxy server information

      • explorer.exe (PID: 5492)
      • explothe.exe (PID: 7788)

    • Creates files or folders in the user directory

      • explothe.exe (PID: 7788)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2022:05:24 22:49:06+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14.13
CodeSize: 25600
InitializedDataSize: 1593344
UninitializedDataSize: -
EntryPoint: 0x6a60
OSVersion: 10
ImageVersion: 10
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 11.0.17763.1
ProductVersionNumber: 11.0.17763.1
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: Microsoft Corporation
FileDescription: Win32 Cabinet Self-Extractor
FileVersion: 11.00.17763.1 (WinBuild.160101.0800)
InternalName: Wextract
LegalCopyright: © Microsoft Corporation. All rights reserved.
OriginalFileName: WEXTRACT.EXE .MUI
ProductName: Internet Explorer
ProductVersion: 11.00.17763.1
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
221
Monitored processes
92
Malicious processes
7
Suspicious processes
4

Behavior graph

Click at the process to see the details
start 0142d9338d2d603340d4494a2476b15e9a186a23f3b6effbdb8dcc56d7d6e9de.exe ak4yw02.exe wi0vm57.exe se5dh59.exe sk8jp39.exe zu1hd54.exe 1pn00eo1.exe no specs applaunch.exe no specs applaunch.exe no specs 2ww9025.exe no specs applaunch.exe no specs 3sa31ta.exe no specs 4gg964ph.exe no specs applaunch.exe 5rr0os0.exe explothe.exe 6pv8ap7.exe no specs 7ut2wf49.exe no specs conhost.exe no specs cmd.exe no specs schtasks.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs cacls.exe no specs cacls.exe no specs cmd.exe no specs cacls.exe no specs cacls.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs #SMOKE explorer.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs explothe.exe no specs svchost.exe

Process information

PID
CMD
Path
Indicators
Parent process
976"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.59\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=6020 --field-trial-handle=2024,i,6114394294520463508,3845597734024788615,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.59\identity_helper.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
PWA Identity Proxy Host
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\identity_helper.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
1052"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=2412 --field-trial-handle=2024,i,6114394294520463508,3845597734024788615,262144 --variations-seed-version /prefetch:3C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
1280C:\Users\admin\AppData\Local\Temp\IXP001.TMP\Wi0vM57.exeC:\Users\admin\AppData\Local\Temp\IXP001.TMP\Wi0vM57.exe
ak4yw02.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Win32 Cabinet Self-Extractor
Exit code:
0
Version:
11.00.17763.1 (WinBuild.160101.0800)
Modules
Images
c:\users\admin\appdata\local\temp\ixp001.tmp\wi0vm57.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
1568"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=4504 --field-trial-handle=2024,i,6114394294520463508,3845597734024788615,262144 --variations-seed-version /prefetch:1C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2196C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2564"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=10120 --field-trial-handle=2024,i,6114394294520463508,3845597734024788615,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
3332"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://store.steampowered.com/login/C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
3332"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --no-appcompat-clear --mojo-platform-channel-handle=7304 --field-trial-handle=2024,i,6114394294520463508,3845597734024788615,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
4040"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/loginC:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
4120"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2016 --field-trial-handle=2024,i,6114394294520463508,3845597734024788615,262144 --variations-seed-version /prefetch:2C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
Total events
10 347
Read events
10 252
Write events
95
Delete events
0

Modification events

(PID) Process:(7788) explothe.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
Operation:writeName:Startup
Value:
C:\Users\admin\AppData\Local\Temp\fefffe8cea\
(PID) Process:(7920) cmd.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
Operation:writeName:SlowContextMenuEntries
Value:
6024B221EA3A6910A2DC08002B30309D0A010000BD0E0C47735D584D9CEDE91E22E23282770100000114020000000000C0000000000000468D0000006078A409B011A54DAFA526D86198A780390100009AD298B2EDA6DE11BA8CA68E55D895936E000000
(PID) Process:(7920) cmd.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(7920) cmd.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(7920) cmd.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(7244) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:failed_count
Value:
0
(PID) Process:(7244) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:state
Value:
2
(PID) Process:(7244) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:state
Value:
1
(PID) Process:(4040) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:failed_count
Value:
0
(PID) Process:(4040) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:state
Value:
2
Executable files
18
Suspicious files
628
Text files
48
Unknown types
0

Dropped files

PID
Process
Filename
Type
4812ak4yw02.exeC:\Users\admin\AppData\Local\Temp\IXP001.TMP\Wi0vM57.exeexecutable
MD5:3D21FCEBB4A16C246F7557CB358F8DF9
SHA256:903F70907D80CF736D195CF8E09F01A672FC0E2BA44CF19610748C41BE9BBEB0
1280Wi0vM57.exeC:\Users\admin\AppData\Local\Temp\IXP002.TMP\sE5dh59.exeexecutable
MD5:5943F2C4AF3AB82BEC86D9704FCDCDD6
SHA256:41C1CE609B22AE0B9F500F412085F91B28804C15BFA7184D589DC1D19D54F39F
1280Wi0vM57.exeC:\Users\admin\AppData\Local\Temp\IXP002.TMP\5RR0oS0.exeexecutable
MD5:E8992DA4CFF4640B9F7BB1B6A2440D64
SHA256:5994AD6592E4E1BB18E3ED75AED50C17C203DFF0CA4AFCBB71FB7158ED4CD5F7
6132sE5dh59.exeC:\Users\admin\AppData\Local\Temp\IXP003.TMP\sK8JP39.exeexecutable
MD5:6282563A585A48B3BACE12246A40A5E1
SHA256:5760C4E3A77368916ACAF3B6ABCADA0F80E91BCBD19995C1A9055EE1F38F2940
69640142d9338d2d603340d4494a2476b15e9a186a23f3b6effbdb8dcc56d7d6e9de.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\7uT2wf49.exeexecutable
MD5:DC4EA30E8457743EC398E1C10F554E94
SHA256:07CC8E35AEA7E10DB8B5D3794DCD663C8914C4F184D89DBAC9E4E28669B211D3
4812ak4yw02.exeC:\Users\admin\AppData\Local\Temp\IXP001.TMP\6pv8ap7.exeexecutable
MD5:938B67A796A23673B23A6F44CD33A68D
SHA256:60C0506DA4BCF8D9D5CB82DEE2A1ABF82E0B246DB751D58A4AC6464F9553850D
69640142d9338d2d603340d4494a2476b15e9a186a23f3b6effbdb8dcc56d7d6e9de.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\ak4yw02.exeexecutable
MD5:12707C140E9891D8267FB2682EAE286F
SHA256:A4FF4F377D5C091135241006F7D89B4F9D966560DC924858820B16497BE0EBB7
5968msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old~RF10eea7.TMP —
MD5:—
SHA256:—
5968msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old —
MD5:—
SHA256:—
5968msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\discounts_db\LOG.old~RF10eeb7.TMP —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
235
DNS requests
224
Threats
4

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
23.216.77.21:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
—
—
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
8808
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
8808
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
23.216.77.21:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
2104
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3216
svchost.exe
172.211.123.249:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
40.126.31.2:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
2112
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
7788
explothe.exe
77.91.124.1:80
—
Foton Telecom CJSC
RU
malicious

DNS requests

Domain
IP
Reputation
crl.microsoft.com
  • 23.216.77.21
  • 23.216.77.10
  • 23.216.77.20
  • 23.216.77.28
  • 23.216.77.18
  • 23.216.77.13
  • 23.216.77.23
  • 23.216.77.36
  • 23.216.77.27
whitelisted
www.microsoft.com
  • 23.35.229.160
whitelisted
google.com
  • 142.250.186.46
whitelisted
settings-win.data.microsoft.com
  • 51.104.136.2
whitelisted
client.wns.windows.com
  • 172.211.123.249
whitelisted
login.live.com
  • 40.126.31.2
  • 20.190.159.128
  • 20.190.159.0
  • 20.190.159.23
  • 40.126.31.67
  • 40.126.31.3
  • 20.190.159.75
  • 40.126.31.73
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
config.edge.skype.com
  • 13.107.42.16
whitelisted
edge.microsoft.com
  • 150.171.29.11
  • 150.171.30.11
whitelisted
edge-mobile-static.azureedge.net
  • 13.107.246.45
whitelisted

Threats

PID
Process
Class
Message
1052
msedge.exe
Misc activity
INFO [ANY.RUN] Possible short link service (t .co)
1052
msedge.exe
Misc activity
INFO [ANY.RUN] Possible short link service (t .co)
1052
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] hCaptcha Enterprise Challenge
1052
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] hCaptcha Enterprise Challenge
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
0142d9338d2d603340d4494a2476b15e9a186a23f3b6effbdb8dcc56d7d6e9de