File name:

2025-06-13_f66f7a30945acfeaa7c933e12ac827d2_elex_icedid_stop

Full analysis: https://app.any.run/tasks/4af80836-b134-472c-bd74-56b9bf2438f2
Verdict: Malicious activity
Threats:

BlackMoon also known as KrBanker is a trojan aimed at stealing payment credentials. It specializes in man-in-the-browser (MitB) attacks, web injection, and credential theft to compromise users' online banking accounts. It was first noticed in early 2014 attacking banks in South Korea and has impressively evolved since by adding a number of new infiltration techniques and information stealing methods.

Malware Trends Tracker     >>>
Analysis date: June 13, 2025, 20:33:29
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
blackmoon
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 4 sections
MD5:

F66F7A30945ACFEAA7C933E12AC827D2

SHA1:

8A0C56B40D702F8D0F6A7013EEE61C55E064E110

SHA256:

056245C348EFEF767F2B110A2ADB5141E616AAF4E6BDEAAD909096D6D64FAB57

SSDEEP:

49152:XFxUhnky7BM7W88988Nt5KBBDhzsf9hS1Sx5F2b35tZOP3E/4VhH3QLBf8XcHZ83:3Uhnkyi8qDpsVhS1Sx5HPznWnNHqJ

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • BLACKMOON has been detected (YARA)

      • 2025-06-13_f66f7a30945acfeaa7c933e12ac827d2_elex_icedid_stop.exe (PID: 516)
      • rbjxsv.exe (PID: 7020)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • 2025-06-13_f66f7a30945acfeaa7c933e12ac827d2_elex_icedid_stop.exe (PID: 516)
      • rbjxsv.exe (PID: 6260)
      • 781909.exe (PID: 6680)
      • rbjxsv.exe (PID: 7020)
      • 267060.exe (PID: 5532)
      • 357710.exe (PID: 2356)
      • 399897.exe (PID: 7432)
      • 725758.exe (PID: 7716)
      • 074857.exe (PID: 7788)
      • 120730.exe (PID: 7872)
      • 710444.exe (PID: 7948)
      • 592667.exe (PID: 8168)
      • 353898.exe (PID: 8096)
      • 339362.exe (PID: 420)
      • 948640.exe (PID: 2808)
      • 351620.exe (PID: 2460)
      • 462079.exe (PID: 7796)
      • 649868.exe (PID: 7104)
      • 875849.exe (PID: 7912)

    • Uses WMI to retrieve WMI-managed resources (SCRIPT)

      • 2025-06-13_f66f7a30945acfeaa7c933e12ac827d2_elex_icedid_stop.exe (PID: 516)

    • Starts itself from another location

      • 2025-06-13_f66f7a30945acfeaa7c933e12ac827d2_elex_icedid_stop.exe (PID: 516)
      • rbjxsv.exe (PID: 7020)

    • Application launched itself

      • rbjxsv.exe (PID: 6260)
      • 781909.exe (PID: 6680)
      • 267060.exe (PID: 5532)
      • 357710.exe (PID: 2356)
      • 399897.exe (PID: 7432)
      • 725758.exe (PID: 7716)
      • 074857.exe (PID: 7788)
      • 120730.exe (PID: 7872)
      • 710444.exe (PID: 7948)
      • 353898.exe (PID: 8096)
      • 592667.exe (PID: 8168)
      • 948640.exe (PID: 2808)
      • 339362.exe (PID: 420)
      • 351620.exe (PID: 2460)
      • 462079.exe (PID: 7796)
      • 649868.exe (PID: 7104)
      • 149783.exe (PID: 7116)
      • 317022.exe (PID: 1700)
      • 416571.exe (PID: 2620)
      • 944147.exe (PID: 7500)
      • 743002.exe (PID: 7464)
      • 898965.exe (PID: 7732)
      • 583434.exe (PID: 7932)
      • 308048.exe (PID: 7820)
      • 454221.exe (PID: 2680)
      • 337552.exe (PID: 7308)
      • 875849.exe (PID: 7912)
      • 921021.exe (PID: 7988)
      • 658179.exe (PID: 8168)
      • 357904.exe (PID: 5848)
      • 647628.exe (PID: 8160)
      • 229911.exe (PID: 4680)
      • 642991.exe (PID: 7052)
      • 751461.exe (PID: 8128)
      • 143057.exe (PID: 7324)
      • 232606.exe (PID: 4476)
      • 269037.exe (PID: 5628)
      • 756837.exe (PID: 2552)
      • 802017.exe (PID: 316)
      • 184972.exe (PID: 7744)
      • 800869.exe (PID: 7852)
      • 950422.exe (PID: 504)
      • 851773.exe (PID: 7204)
      • 148770.exe (PID: 7980)
      • 179805.exe (PID: 3936)
      • 519155.exe (PID: 7108)
      • 290471.exe (PID: 3028)
      • 443549.exe (PID: 7880)
      • 424060.exe (PID: 1056)
      • 611888.exe (PID: 7912)

    • Executable content was dropped or overwritten

      • 2025-06-13_f66f7a30945acfeaa7c933e12ac827d2_elex_icedid_stop.exe (PID: 516)
      • rbjxsv.exe (PID: 7020)

    • Searches for installed software

      • 2025-06-13_f66f7a30945acfeaa7c933e12ac827d2_elex_icedid_stop.exe (PID: 516)

    • Starts CMD.EXE for commands execution

      • explorer.exe (PID: 2188)

    • Explorer used for Indirect Command Execution

      • explorer.exe (PID: 188)

    • Executing commands from a ".bat" file

      • explorer.exe (PID: 2188)

    • There is functionality for taking screenshot (YARA)

      • 2025-06-13_f66f7a30945acfeaa7c933e12ac827d2_elex_icedid_stop.exe (PID: 516)
      • rbjxsv.exe (PID: 7020)

  • INFO

    • Checks supported languages

      • 2025-06-13_f66f7a30945acfeaa7c933e12ac827d2_elex_icedid_stop.exe (PID: 516)
      • rbjxsv.exe (PID: 6260)
      • 781909.exe (PID: 5600)
      • rbjxsv.exe (PID: 7020)
      • 267060.exe (PID: 2380)
      • 357710.exe (PID: 2356)
      • 267060.exe (PID: 5532)
      • 357710.exe (PID: 6680)
      • 399897.exe (PID: 7432)
      • 399897.exe (PID: 7572)
      • identity_helper.exe (PID: 7616)
      • 725758.exe (PID: 7716)
      • 725758.exe (PID: 7760)
      • 074857.exe (PID: 7788)
      • 120730.exe (PID: 7872)
      • 120730.exe (PID: 7916)
      • 710444.exe (PID: 7948)
      • 353898.exe (PID: 8096)
      • 710444.exe (PID: 8028)
      • 074857.exe (PID: 7832)
      • 353898.exe (PID: 8140)
      • 592667.exe (PID: 8168)
      • 592667.exe (PID: 4768)
      • 948640.exe (PID: 2808)
      • 781909.exe (PID: 6680)
      • 948640.exe (PID: 5184)
      • 339362.exe (PID: 420)
      • 339362.exe (PID: 6344)
      • 351620.exe (PID: 2460)
      • 351620.exe (PID: 7716)
      • 462079.exe (PID: 7796)
      • 462079.exe (PID: 7856)
      • 649868.exe (PID: 7104)
      • 649868.exe (PID: 7900)
      • 875849.exe (PID: 7912)
      • 875849.exe (PID: 7656)

    • The sample compiled with chinese language support

      • 2025-06-13_f66f7a30945acfeaa7c933e12ac827d2_elex_icedid_stop.exe (PID: 516)
      • rbjxsv.exe (PID: 7020)

    • Reads the computer name

      • 2025-06-13_f66f7a30945acfeaa7c933e12ac827d2_elex_icedid_stop.exe (PID: 516)
      • rbjxsv.exe (PID: 6260)
      • 781909.exe (PID: 6680)
      • 267060.exe (PID: 5532)
      • 357710.exe (PID: 2356)
      • 399897.exe (PID: 7432)
      • 725758.exe (PID: 7716)
      • identity_helper.exe (PID: 7616)
      • 074857.exe (PID: 7788)
      • 120730.exe (PID: 7872)
      • 710444.exe (PID: 7948)
      • 353898.exe (PID: 8096)
      • 948640.exe (PID: 2808)
      • 592667.exe (PID: 8168)
      • rbjxsv.exe (PID: 7020)
      • 339362.exe (PID: 420)
      • 351620.exe (PID: 2460)
      • 462079.exe (PID: 7796)
      • 649868.exe (PID: 7104)
      • 875849.exe (PID: 7912)

    • Checks proxy server information

      • 2025-06-13_f66f7a30945acfeaa7c933e12ac827d2_elex_icedid_stop.exe (PID: 516)

    • Process checks computer location settings

      • 2025-06-13_f66f7a30945acfeaa7c933e12ac827d2_elex_icedid_stop.exe (PID: 516)
      • rbjxsv.exe (PID: 6260)
      • 781909.exe (PID: 6680)
      • 267060.exe (PID: 5532)
      • rbjxsv.exe (PID: 7020)
      • 357710.exe (PID: 2356)
      • 399897.exe (PID: 7432)
      • 725758.exe (PID: 7716)
      • 074857.exe (PID: 7788)
      • 120730.exe (PID: 7872)
      • 710444.exe (PID: 7948)
      • 353898.exe (PID: 8096)
      • 592667.exe (PID: 8168)
      • 948640.exe (PID: 2808)
      • 339362.exe (PID: 420)
      • 351620.exe (PID: 2460)
      • 462079.exe (PID: 7796)
      • 649868.exe (PID: 7104)
      • 875849.exe (PID: 7912)

    • Creates files or folders in the user directory

      • rbjxsv.exe (PID: 7020)

    • Reads the machine GUID from the registry

      • rbjxsv.exe (PID: 7020)

    • Create files in a temporary directory

      • 2025-06-13_f66f7a30945acfeaa7c933e12ac827d2_elex_icedid_stop.exe (PID: 516)
      • rbjxsv.exe (PID: 7020)

    • Application launched itself

      • msedge.exe (PID: 2216)
      • msedge.exe (PID: 4868)

    • Reads security settings of Internet Explorer

      • explorer.exe (PID: 2188)

    • Reads Environment values

      • identity_helper.exe (PID: 7616)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2016:08:17 08:34:04+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 368640
InitializedDataSize: 1241088
UninitializedDataSize: -
EntryPoint: 0x4fd00
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 5.6.1.1
ProductVersionNumber: 5.6.1.1
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Chinese (Simplified)
CharacterSet: Unicode
FileVersion: 5.6.1.1
FileDescription:
ProductName:
ProductVersion: 5.6.1.1
CompanyName:
LegalCopyright:
Comments: 本程序使用易语言编写(http://www.dywt.com.cn)
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
260
Monitored processes
125
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #BLACKMOON 2025-06-13_f66f7a30945acfeaa7c933e12ac827d2_elex_icedid_stop.exe rbjxsv.exe no specs #BLACKMOON rbjxsv.exe 781909.exe no specs 781909.exe no specs 267060.exe no specs 267060.exe no specs msedge.exe no specs explorer.exe no specs msedge.exe explorer.exe no specs cmd.exe no specs conhost.exe no specs 357710.exe no specs 357710.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs 399897.exe no specs msedge.exe no specs msedge.exe no specs 399897.exe no specs identity_helper.exe no specs identity_helper.exe no specs 725758.exe no specs 725758.exe no specs 074857.exe no specs 074857.exe no specs 120730.exe no specs 120730.exe no specs 710444.exe no specs 710444.exe no specs 353898.exe no specs 353898.exe no specs 592667.exe no specs 592667.exe no specs 948640.exe no specs 948640.exe no specs 339362.exe no specs 339362.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs 351620.exe no specs 351620.exe no specs 462079.exe no specs 462079.exe no specs 649868.exe no specs 649868.exe no specs 875849.exe no specs 875849.exe no specs slui.exe 921021.exe no specs 921021.exe no specs 357904.exe no specs 357904.exe no specs 647628.exe no specs 647628.exe no specs 658179.exe no specs 658179.exe no specs 149783.exe no specs 149783.exe no specs 416571.exe no specs 416571.exe no specs msedge.exe no specs 317022.exe no specs 317022.exe no specs 743002.exe no specs 743002.exe no specs 898965.exe no specs 898965.exe no specs 944147.exe no specs 944147.exe no specs 308048.exe no specs 308048.exe no specs 454221.exe no specs 454221.exe no specs 337552.exe no specs 337552.exe no specs 583434.exe no specs 583434.exe no specs 950422.exe no specs 950422.exe no specs 851773.exe no specs 851773.exe no specs 148770.exe no specs 148770.exe no specs 229911.exe no specs 229911.exe no specs 751461.exe no specs 751461.exe no specs 642991.exe no specs 642991.exe no specs 232606.exe no specs 232606.exe no specs 143057.exe no specs 143057.exe no specs 269037.exe no specs 269037.exe no specs 756837.exe no specs 756837.exe no specs 802017.exe no specs 802017.exe no specs 179805.exe no specs 179805.exe no specs msedge.exe no specs 184972.exe no specs 184972.exe no specs 519155.exe no specs 519155.exe no specs 800869.exe no specs 800869.exe no specs 290471.exe no specs 290471.exe no specs 443549.exe no specs 443549.exe no specs 424060.exe no specs 424060.exe no specs 611888.exe no specs 611888.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
188"C:\Windows\explorer.exe" C:\Users\admin\AppData\Local\Temp\ldsajdklsajdlkjsalkda.batC:\Windows\explorer.exe—2025-06-13_f66f7a30945acfeaa7c933e12ac827d2_elex_icedid_stop.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
1
Version:
10.0.19041.3758 (WinBuild.160101.0800)
Modules
Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\oleaut32.dll
316"C:\Users\admin\AppData\Roaming\Download\802017.exe" /ShorttailedrestartC:\Users\admin\AppData\Roaming\Download\802017.exe—rbjxsv.exe
User:
admin
Company:
Integrity Level:
MEDIUM
Description:
Exit code:
0
Version:
5.6.1.1
Modules
Images
c:\users\admin\appdata\roaming\download\802017.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shlwapi.dll
420"C:\Users\admin\AppData\Roaming\Download\339362.exe" /ShorttailedrestartC:\Users\admin\AppData\Roaming\Download\339362.exe—rbjxsv.exe
User:
admin
Company:
Integrity Level:
MEDIUM
Description:
Exit code:
0
Version:
5.6.1.1
Modules
Images
c:\users\admin\appdata\roaming\download\339362.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shlwapi.dll
504"C:\Users\admin\AppData\Roaming\Download\950422.exe" /ShorttailedrestartC:\Users\admin\AppData\Roaming\Download\950422.exe—rbjxsv.exe
User:
admin
Company:
Integrity Level:
MEDIUM
Description:
Exit code:
0
Version:
5.6.1.1
Modules
Images
c:\users\admin\appdata\roaming\download\950422.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shlwapi.dll
516"C:\Users\admin\Desktop\2025-06-13_f66f7a30945acfeaa7c933e12ac827d2_elex_icedid_stop.exe" C:\Users\admin\Desktop\2025-06-13_f66f7a30945acfeaa7c933e12ac827d2_elex_icedid_stop.exe
explorer.exe
User:
admin
Company:
Integrity Level:
MEDIUM
Description:
Version:
5.6.1.1
Modules
Images
c:\users\admin\desktop\2025-06-13_f66f7a30945acfeaa7c933e12ac827d2_elex_icedid_stop.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shlwapi.dll
984"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --disable-quic --message-loop-type-ui --string-annotations --always-read-main-dll --field-trial-handle=4816,i,18296388524849512509,4967648791814083686,262144 --variations-seed-version --mojo-platform-channel-handle=4232 /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1056"C:\Users\admin\AppData\Roaming\Download\424060.exe" /ShorttailedrestartC:\Users\admin\AppData\Roaming\Download\424060.exe—rbjxsv.exe
User:
admin
Company:
Integrity Level:
MEDIUM
Description:
Exit code:
0
Version:
5.6.1.1
Modules
Images
c:\users\admin\appdata\roaming\download\424060.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shlwapi.dll
1096"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3628,i,18296388524849512509,4967648791814083686,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:1C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1232C:\WINDOWS\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\ldsajdklsajdlkjsalkda.bat" "C:\Windows\System32\cmd.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cmdext.dll
c:\windows\system32\advapi32.dll
1352"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --disable-quic --string-annotations --always-read-main-dll --field-trial-handle=2644,i,18296388524849512509,4967648791814083686,262144 --variations-seed-version --mojo-platform-channel-handle=2844 /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
26 611
Read events
26 592
Write events
19
Delete events
0

Modification events

(PID) Process:(516) 2025-06-13_f66f7a30945acfeaa7c933e12ac827d2_elex_icedid_stop.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows Script\Settings
Operation:writeName:JITDebug
Value:
0
(PID) Process:(516) 2025-06-13_f66f7a30945acfeaa7c933e12ac827d2_elex_icedid_stop.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
Operation:writeName:SlowContextMenuEntries
Value:
6024B221EA3A6910A2DC08002B30309D0A010000BD0E0C47735D584D9CEDE91E22E23282770100000114020000000000C0000000000000468D0000006078A409B011A54DAFA526D86198A780390100009AD298B2EDA6DE11BA8CA68E55D895936E000000
(PID) Process:(516) 2025-06-13_f66f7a30945acfeaa7c933e12ac827d2_elex_icedid_stop.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(516) 2025-06-13_f66f7a30945acfeaa7c933e12ac827d2_elex_icedid_stop.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(516) 2025-06-13_f66f7a30945acfeaa7c933e12ac827d2_elex_icedid_stop.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(2216) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:failed_count
Value:
0
(PID) Process:(2216) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:state
Value:
2
(PID) Process:(4868) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:failed_count
Value:
1
(PID) Process:(4868) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:state
Value:
1
(PID) Process:(4868) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\StabilityMetrics
Operation:writeName:user_experience_metrics.stability.exited_cleanly
Value:
0
Executable files
54
Suspicious files
42
Text files
38
Unknown types
9

Dropped files

PID
Process
Filename
Type
7020rbjxsv.exeC:\Users\admin\AppData\Local\Temp\LifeAideini.initext
MD5:2C221FA3547FAACC9B191A75C0E48453
SHA256:F7531985199756F8A092F81398B64FF44D56DD9B832B2B818BBCDA5EE8ADED89
4868msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\ClientCertificates\LOG.old~RF178983.TMP —
MD5:—
SHA256:—
4868msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\ClientCertificates\LOG.old —
MD5:—
SHA256:—
4868msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\PersistentOriginTrials\LOG.old~RF178983.TMP —
MD5:—
SHA256:—
4868msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\PersistentOriginTrials\LOG.old —
MD5:—
SHA256:—
4868msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\discounts_db\LOG.old~RF178983.TMP —
MD5:—
SHA256:—
4868msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\discounts_db\LOG.old —
MD5:—
SHA256:—
4868msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\parcel_tracking_db\LOG.old~RF178992.TMP —
MD5:—
SHA256:—
4868msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\parcel_tracking_db\LOG.old —
MD5:—
SHA256:—
7020rbjxsv.exeC:\Users\admin\AppData\Roaming\Download\357710.exeexecutable
MD5:171FC8DB57A09CFCC6BB157DD28D02AD
SHA256:0B021AFFED3DE018864BB06DB78A56B56B2048ACDA01FCDB8AFE3CAA94AA4FE5
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
63
TCP/UDP connections
87
DNS requests
51
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
POST
—
20.190.159.128:443
https://login.live.com/RST2.srf
unknown
—
—
whitelisted
—
—
POST
—
20.190.159.75:443
https://login.live.com/RST2.srf
unknown
—
—
whitelisted
—
—
POST
—
20.190.159.0:443
https://login.live.com/RST2.srf
unknown
—
—
whitelisted
—
—
POST
—
20.190.159.73:443
https://login.live.com/RST2.srf
unknown
—
—
whitelisted
4804
msedge.exe
GET
—
150.171.27.11:80
http://edge.microsoft.com/browsernetworktime/time/1/current?cup2key=2:Yq6nHTfW88ILKoXqHNo2J88aUc5maeWXZY7lL-vOPkg&cup2hreq=e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
unknown
—
—
whitelisted
—
—
GET
—
150.171.28.11:443
https://edge.microsoft.com/serviceexperimentation/v3/?osname=win&channel=stable&osver=10.0.19045&devicefamily=desktop&installdate=1661339457&clientversion=133.0.3065.92&experimentationmode=2&scpguard=0&scpfull=0&scpver=0
unknown
—
—
—
—
—
GET
—
13.107.42.16:443
https://config.edge.skype.com/config/v1/Edge/133.0.3065.92?clientId=4489578223053569932&agents=EdgeFirstRun%2CEdgeFirstRunConfig&osname=win&client=edge&channel=stable&scpfre=0&osarch=x86_64&osver=10.0.19045&wu=1&devicefamily=desktop&uma=0&sessionid=51&mngd=0&installdate=1661339457&edu=0&soobedate=1504771245&bphint=2&fg=1&lbfgdate=1749846826&lafgdate=0
unknown
—
—
—
—
—
GET
—
2.16.204.153:443
https://copilot.microsoft.com/c/api/user/eligibility
unknown
—
—
—
—
—
POST
—
20.190.159.4:443
https://login.live.com/RST2.srf
unknown
—
—
whitelisted
—
—
GET
—
180.163.237.212:443
https://hao.360.cn/?src=lm&ls=n6abbbb598c
unknown
—
—
—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1268
svchost.exe
4.231.128.59:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
6368
RUXIMICS.exe
4.231.128.59:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5944
MoUsoCoreWorker.exe
4.231.128.59:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5944
MoUsoCoreWorker.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1268
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2336
svchost.exe
172.211.123.248:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
5692
svchost.exe
20.190.159.23:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6024
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.185.206
whitelisted
dt.hebchengjiu.com
  • —
unknown
settings-win.data.microsoft.com
  • 20.73.194.208
whitelisted
client.wns.windows.com
  • 172.211.123.248
whitelisted
login.live.com
  • 20.190.159.23
  • 20.190.159.64
  • 20.190.159.75
  • 40.126.31.67
  • 20.190.159.0
  • 20.190.159.130
  • 40.126.31.69
  • 40.126.31.128
whitelisted
edge.microsoft.com
  • 150.171.27.11
  • 150.171.28.11
whitelisted
config.edge.skype.com
  • 13.107.42.16
whitelisted
hao.360.cn
  • 180.163.237.169
whitelisted
copilot.microsoft.com
  • 2.16.204.153
  • 2.16.204.141
whitelisted
www.bing.com
  • 2.16.204.158
  • 2.16.204.150
  • 2.16.204.151
  • 2.16.204.156
  • 2.16.204.153
  • 2.16.204.160
  • 2.16.204.149
  • 2.16.204.138
  • 2.16.204.145
  • 92.122.215.53
  • 2.20.142.187
  • 2.20.142.180
  • 2.20.142.154
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
2025-06-13_f66f7a30945acfeaa7c933e12ac827d2_elex_icedid_stop