File name:

WEXTRACT.exe

Full analysis: https://app.any.run/tasks/d76ffeee-f373-4582-848b-16aa1acae8c3
Verdict: Malicious activity
Threats:

Amadey is a formidable Windows infostealer threat, characterized by its persistence mechanisms, modular design, and ability to execute various malicious tasks.

Malware Trends Tracker     >>>
Analysis date: January 05, 2024, 05:59:56
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
risepro
stealer
rhadamanthys
evasion
amadey
botnet
loader
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

328FD7982434A7461238A8D884C3CF4C

SHA1:

56DD9E9F55888F4B866C5F72DAC7693C4C43A922

SHA256:

0BC90706DEFE0F5DEFBC5BE90EA4D4C14EC01AD3B85AC35BAA4DB1B9906BCAD6

SSDEEP:

98304:5n27M28jC8s6vt30MLljvpTMZNX1ivfpotJ4KUHy7MNNhwQWKAs9RIeQchI4VllA:jdnsmAeR

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Create files in the Startup directory

      • 3rm15HU.exe (PID: 3272)

    • Risepro uses scheduled tasks to run itself

      • cmd.exe (PID: 3664)
      • cmd.exe (PID: 4088)

    • Uses Task Scheduler to autorun other applications

      • cmd.exe (PID: 4088)

    • Uses Task Scheduler to run other applications

      • cmd.exe (PID: 3664)
      • explorhe.exe (PID: 956)

    • Changes the autorun value in the registry

      • explorhe.exe (PID: 956)

    • Actions looks like stealing of personal data

      • dialer.exe (PID: 3336)
      • dialer.exe (PID: 3192)

  • SUSPICIOUS

    • Reads the Internet Settings

      • 1OJ96lj2.exe (PID: 1356)
      • 7Mw7yx12.exe (PID: 2380)
      • 3rm15HU.exe (PID: 3272)
      • explorhe.exe (PID: 956)
      • rundll32.exe (PID: 3068)
      • 1OJ96lj2.exe (PID: 3484)
      • 3rm15HU.exe (PID: 3036)

    • The process checks if it is being run in the virtual environment

      • dialer.exe (PID: 3336)
      • dialer.exe (PID: 3192)

    • Starts CMD.EXE for commands execution

      • 3rm15HU.exe (PID: 3272)

    • Reads settings of System Certificates

      • 3rm15HU.exe (PID: 3272)
      • 3rm15HU.exe (PID: 3036)

    • Accesses Microsoft Outlook profiles

      • dialer.exe (PID: 3336)
      • dialer.exe (PID: 3192)

    • Loads DLL from Mozilla Firefox

      • dialer.exe (PID: 3336)
      • dialer.exe (PID: 3192)

    • Reads browser cookies

      • dialer.exe (PID: 3336)

    • Searches for installed software

      • dialer.exe (PID: 3336)
      • dialer.exe (PID: 3192)

    • Adds/modifies Windows certificates

      • 3rm15HU.exe (PID: 3272)
      • 3rm15HU.exe (PID: 3036)

    • Uses RUNDLL32.EXE to load library

      • explorhe.exe (PID: 956)

  • INFO

    • Drops the executable file immediately after the start

      • WEXTRACT.exe (PID: 128)
      • zy9NP42.exe (PID: 1776)
      • MY6Wi92.exe (PID: 1432)
      • 3rm15HU.exe (PID: 3272)
      • 7Mw7yx12.exe (PID: 2380)
      • explorhe.exe (PID: 956)
      • WEXTRACT.exe (PID: 2160)
      • zy9NP42.exe (PID: 2256)
      • MY6Wi92.exe (PID: 864)
      • 3rm15HU.exe (PID: 3036)

    • Checks supported languages

      • zy9NP42.exe (PID: 1776)
      • WEXTRACT.exe (PID: 128)
      • MY6Wi92.exe (PID: 1432)
      • 1OJ96lj2.exe (PID: 1356)
      • 2al3504.exe (PID: 2416)
      • 3rm15HU.exe (PID: 3272)
      • 7Mw7yx12.exe (PID: 2380)
      • explorhe.exe (PID: 956)
      • WMPDMC.exe (PID: 2268)
      • WEXTRACT.exe (PID: 2160)
      • explorhe.exe (PID: 3668)
      • explorhe.exe (PID: 3888)
      • zy9NP42.exe (PID: 2256)
      • explorhe.exe (PID: 1628)
      • MY6Wi92.exe (PID: 864)
      • 1OJ96lj2.exe (PID: 3484)
      • 2al3504.exe (PID: 3504)
      • 3rm15HU.exe (PID: 3036)
      • 7Mw7yx12.exe (PID: 3720)
      • explorhe.exe (PID: 3952)
      • explorhe.exe (PID: 1432)

    • Process drops legitimate windows executable

      • WEXTRACT.exe (PID: 128)
      • zy9NP42.exe (PID: 1776)
      • WEXTRACT.exe (PID: 2160)
      • zy9NP42.exe (PID: 2256)

    • Create files in a temporary directory

      • zy9NP42.exe (PID: 1776)
      • WEXTRACT.exe (PID: 128)
      • MY6Wi92.exe (PID: 1432)
      • 3rm15HU.exe (PID: 3272)
      • 7Mw7yx12.exe (PID: 2380)
      • WEXTRACT.exe (PID: 2160)
      • zy9NP42.exe (PID: 2256)
      • MY6Wi92.exe (PID: 864)
      • 3rm15HU.exe (PID: 3036)

    • Reads mouse settings

      • 1OJ96lj2.exe (PID: 1356)
      • 1OJ96lj2.exe (PID: 3484)

    • Reads the computer name

      • 1OJ96lj2.exe (PID: 1356)
      • 2al3504.exe (PID: 2416)
      • 3rm15HU.exe (PID: 3272)
      • 7Mw7yx12.exe (PID: 2380)
      • explorhe.exe (PID: 956)
      • 1OJ96lj2.exe (PID: 3484)
      • 3rm15HU.exe (PID: 3036)
      • 2al3504.exe (PID: 3504)

    • Application launched itself

      • msedge.exe (PID: 2268)
      • msedge.exe (PID: 2032)
      • msedge.exe (PID: 2064)
      • msedge.exe (PID: 2512)
      • msedge.exe (PID: 1268)
      • msedge.exe (PID: 296)

    • Creates files or folders in the user directory

      • 3rm15HU.exe (PID: 3272)
      • explorhe.exe (PID: 956)

    • Reads the machine GUID from the registry

      • 3rm15HU.exe (PID: 3272)
      • 7Mw7yx12.exe (PID: 2380)
      • explorhe.exe (PID: 956)
      • WMPDMC.exe (PID: 2268)
      • 3rm15HU.exe (PID: 3036)

    • Reads Environment values

      • 3rm15HU.exe (PID: 3272)
      • 3rm15HU.exe (PID: 3036)

    • Creates files in the program directory

      • 3rm15HU.exe (PID: 3272)

    • Connects to unusual port

      • dialer.exe (PID: 3336)
      • 3rm15HU.exe (PID: 3272)
      • 3rm15HU.exe (PID: 3036)
      • dialer.exe (PID: 3192)

    • Checks for external IP

      • 3rm15HU.exe (PID: 3272)
      • 3rm15HU.exe (PID: 3036)

    • RHADAMANTHYS has been detected (SURICATA)

      • dialer.exe (PID: 3336)

    • Starts itself from another location

      • 7Mw7yx12.exe (PID: 2380)

    • RISEPRO has been detected (SURICATA)

      • 3rm15HU.exe (PID: 3272)
      • 3rm15HU.exe (PID: 3036)

    • Connects to the CnC server

      • 3rm15HU.exe (PID: 3272)
      • 3rm15HU.exe (PID: 3036)

    • Checks proxy server information

      • explorhe.exe (PID: 956)
      • rundll32.exe (PID: 3068)

    • AMADEY has been detected (SURICATA)

      • explorhe.exe (PID: 956)

    • Connects to the server without a host name

      • explorhe.exe (PID: 956)
      • rundll32.exe (PID: 3068)

    • Process requests binary or script from the Internet

      • explorhe.exe (PID: 956)

    • Unusual connection from system programs

      • rundll32.exe (PID: 3068)

    • The process executes via Task Scheduler

      • explorhe.exe (PID: 3888)
      • explorhe.exe (PID: 1628)
      • explorhe.exe (PID: 3668)
      • explorhe.exe (PID: 1432)
      • explorhe.exe (PID: 3952)

    • Manual execution by a user

      • WEXTRACT.exe (PID: 2160)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2022:05:25 00:49:06+02:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14.13
CodeSize: 25600
InitializedDataSize: 3880960
UninitializedDataSize: -
EntryPoint: 0x6a60
OSVersion: 10
ImageVersion: 10
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 11.0.17763.1
ProductVersionNumber: 11.0.17763.1
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: Microsoft Corporation
FileDescription: Win32 Cabinet Self-Extractor
FileVersion: 11.00.17763.1 (WinBuild.160101.0800)
InternalName: Wextract
LegalCopyright: © Microsoft Corporation. All rights reserved.
OriginalFileName: WEXTRACT.EXE .MUI
ProductName: Internet Explorer
ProductVersion: 11.00.17763.1
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
118
Monitored processes
77
Malicious processes
15
Suspicious processes
1

Behavior graph

Click at the process to see the details
start wextract.exe no specs zy9np42.exe no specs my6wi92.exe no specs 1oj96lj2.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs 2al3504.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs #RHADAMANTHYS dialer.exe #RISEPRO 3rm15hu.exe msedge.exe no specs msedge.exe no specs cmd.exe schtasks.exe no specs cmd.exe schtasks.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs 7mw7yx12.exe no specs #AMADEY explorhe.exe schtasks.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs wmpdmc.exe no specs dllhost.exe msedge.exe no specs msedge.exe no specs rundll32.exe explorhe.exe no specs explorhe.exe no specs explorhe.exe no specs wextract.exe no specs zy9np42.exe no specs my6wi92.exe no specs 1oj96lj2.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs 2al3504.exe no specs msedge.exe msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs dialer.exe #RISEPRO 3rm15hu.exe msedge.exe no specs msedge.exe no specs 7mw7yx12.exe no specs dllhost.exe explorhe.exe no specs explorhe.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
128"C:\Users\admin\Desktop\WEXTRACT.exe" C:\Users\admin\Desktop\WEXTRACT.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Win32 Cabinet Self-Extractor
Exit code:
0
Version:
11.00.17763.1 (WinBuild.160101.0800)
Modules
Images
c:\users\admin\desktop\wextract.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
148"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1280 --field-trial-handle=1436,i,1033024650880847443,3276340536408811224,131072 /prefetch:2C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\apphelp.dll
c:\windows\apppatch\aclayers.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
268"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=109.0.5414.149 "--annotation=exe=C:\Program Files\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win32 "--annotation=prod=Microsoft Edge" --annotation=ver=109.0.1518.115 --initial-client-data=0x178,0x17c,0x180,0x14c,0x188,0x6d8ff598,0x6d8ff5a8,0x6d8ff5b4C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\apphelp.dll
c:\windows\apppatch\aclayers.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
268"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4024 --field-trial-handle=1160,i,7665798374378951649,14546643209871200753,131072 /prefetch:8C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\apphelp.dll
c:\windows\apppatch\aclayers.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
296"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/C:\Program Files\Microsoft\Edge\Application\msedge.exe—1OJ96lj2.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\apphelp.dll
c:\windows\apppatch\aclayers.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
548"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explorhe.exe /TR "C:\Users\admin\AppData\Local\Temp\d887ceb89d\explorhe.exe" /FC:\Windows\System32\schtasks.exe—explorhe.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
668"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=109.0.5414.149 "--annotation=exe=C:\Program Files\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win32 "--annotation=prod=Microsoft Edge" --annotation=ver=109.0.1518.115 --initial-client-data=0x17c,0x180,0x184,0x150,0x18c,0x6d8ff598,0x6d8ff5a8,0x6d8ff5b4C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\apphelp.dll
c:\windows\apppatch\aclayers.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
668"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5148 --field-trial-handle=1160,i,7665798374378951649,14546643209871200753,131072 /prefetch:8C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\apphelp.dll
c:\windows\apppatch\aclayers.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
784"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=109.0.5414.149 "--annotation=exe=C:\Program Files\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win32 "--annotation=prod=Microsoft Edge" --annotation=ver=109.0.1518.115 --initial-client-data=0x178,0x17c,0x180,0x14c,0x188,0x6d8ff598,0x6d8ff5a8,0x6d8ff5b4C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\apphelp.dll
c:\windows\apppatch\aclayers.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
864C:\Users\admin\AppData\Local\Temp\IXP003.TMP\MY6Wi92.exeC:\Users\admin\AppData\Local\Temp\IXP003.TMP\MY6Wi92.exe—zy9NP42.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Win32 Cabinet Self-Extractor
Exit code:
0
Version:
11.00.17763.1 (WinBuild.160101.0800)
Modules
Images
c:\users\admin\appdata\local\temp\ixp003.tmp\my6wi92.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
Total events
20 545
Read events
20 387
Write events
152
Delete events
6

Modification events

(PID) Process:(2064) msedge.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Edge\BLBeacon
Operation:writeName:failed_count
Value:
0
(PID) Process:(2032) msedge.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Edge\BLBeacon
Operation:writeName:failed_count
Value:
0
(PID) Process:(2032) msedge.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Edge\BLBeacon
Operation:writeName:state
Value:
1
(PID) Process:(2032) msedge.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Edge\ThirdParty
Operation:writeName:StatusCodes
Value:
01000000
(PID) Process:(2268) msedge.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Edge\BLBeacon
Operation:writeName:failed_count
Value:
1
(PID) Process:(2268) msedge.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Edge\BLBeacon
Operation:writeName:state
Value:
2
(PID) Process:(2064) msedge.exeKey:HKEY_CURRENT_USER\Software\Microsoft\EdgeUpdate\ClientState\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}
Operation:writeName:dr
Value:
1
(PID) Process:(2032) msedge.exeKey:HKEY_CURRENT_USER\Software\Microsoft\EdgeUpdate\ClientState\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}
Operation:writeName:dr
Value:
1
(PID) Process:(2268) msedge.exeKey:HKEY_CURRENT_USER\Software\Microsoft\EdgeUpdate\ClientState\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}
Operation:writeName:dr
Value:
1
(PID) Process:(2268) msedge.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Edge\StabilityMetrics
Operation:writeName:user_experience_metrics.stability.exited_cleanly
Value:
0
Executable files
21
Suspicious files
363
Text files
45
Unknown types
0

Dropped files

PID
Process
Filename
Type
2032msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat —
MD5:—
SHA256:—
2064msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old~RFe2093.TMP —
MD5:—
SHA256:—
2064msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old —
MD5:—
SHA256:—
668msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics.pmabinary
MD5:C612E96CBFAC63232FC2062E15600FB1
SHA256:DB3C05D5EC0B6719A73E7F0BE84BCE9342772DA70567E7CE08CF6573480B38FF
2268msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\169585a2-99a7-40e9-b87f-a028a2831317.tmpbinary
MD5:E7C45F3F623E668FBE52B38DE7B88F72
SHA256:7B295294494790906EF9E598471DC26CB142F2B3E06CB6F82B7C9629F1ACE626
128WEXTRACT.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\7Mw7yx12.exeexecutable
MD5:9A0B7EE713610B8395C8F0580A3B1E3D
SHA256:6B8E428CFF996C49AA52E017213C7016880A2BC1583D051240C74992BF83C357
2064msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey\LOG.old~RFe20e1.TMP —
MD5:—
SHA256:—
2064msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey\LOG.old —
MD5:—
SHA256:—
268msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics.pmabinary
MD5:C612E96CBFAC63232FC2062E15600FB1
SHA256:DB3C05D5EC0B6719A73E7F0BE84BCE9342772DA70567E7CE08CF6573480B38FF
2064msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\LOG.old~RFe22a7.TMP —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
8
TCP/UDP connections
119
DNS requests
106
Threats
48

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3272
3rm15HU.exe
GET
200
23.32.238.208:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?37cc12b5d08174e5
unknown
compressed
65.2 Kb
unknown
956
explorhe.exe
GET
404
185.215.113.68:80
http://185.215.113.68/theme/Plugins/cred.dll
unknown
html
162 b
unknown
956
explorhe.exe
GET
200
185.215.113.68:80
http://185.215.113.68/theme/Plugins/clip.dll
unknown
executable
102 Kb
unknown
956
explorhe.exe
POST
200
185.215.113.68:80
http://185.215.113.68/theme/index.php
unknown
text
2 b
unknown
956
explorhe.exe
POST
200
185.215.113.68:80
http://185.215.113.68/theme/index.php
unknown
text
7 b
unknown
3068
rundll32.exe
POST
200
185.215.113.68:80
http://185.215.113.68/theme/index.php
unknown
text
528 b
unknown
956
explorhe.exe
POST
200
185.215.113.68:80
http://185.215.113.68/theme/index.php
unknown
text
2 b
unknown
956
explorhe.exe
POST
200
185.215.113.68:80
http://185.215.113.68/theme/index.php
unknown
text
7 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2064
msedge.exe
239.255.255.250:1900
—
—
—
whitelisted
1600
msedge.exe
13.107.42.16:443
config.edge.skype.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
1600
msedge.exe
157.240.251.35:443
facebook.com
FACEBOOK
DE
unknown
1600
msedge.exe
142.250.186.78:443
www.youtube.com
GOOGLE
US
whitelisted
1600
msedge.exe
204.79.197.239:443
edge.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
1600
msedge.exe
142.250.110.84:443
accounts.google.com
GOOGLE
US
unknown
1600
msedge.exe
20.31.251.109:443
nav-edge.smartscreen.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
unknown
1600
msedge.exe
157.240.252.35:443
www.facebook.com
FACEBOOK
DE
unknown

DNS requests

Domain
IP
Reputation
www.youtube.com
  • 142.250.186.78
  • 142.250.186.110
  • 142.250.181.238
  • 172.217.16.142
  • 142.250.184.206
  • 142.250.184.238
  • 142.250.186.142
  • 142.250.74.206
  • 142.250.186.46
  • 172.217.18.14
  • 172.217.16.206
  • 142.250.186.174
  • 216.58.206.46
  • 172.217.18.110
  • 216.58.212.142
  • 142.250.185.78
  • 216.58.212.174
  • 172.217.23.110
  • 142.250.185.110
  • 142.250.185.142
  • 142.250.185.174
  • 142.250.185.206
  • 142.250.185.238
whitelisted
accounts.google.com
  • 142.250.110.84
  • 66.102.1.84
shared
config.edge.skype.com
  • 13.107.42.16
whitelisted
facebook.com
  • 157.240.251.35
whitelisted
edge.microsoft.com
  • 204.79.197.239
  • 13.107.21.239
whitelisted
nav-edge.smartscreen.microsoft.com
  • 20.31.251.109
whitelisted
www.facebook.com
  • 157.240.252.35
whitelisted
data-edge.smartscreen.microsoft.com
  • 20.105.95.163
whitelisted
www.bing.com
  • 92.123.104.40
  • 92.123.104.34
  • 92.123.104.21
  • 92.123.104.31
  • 92.123.104.38
  • 92.123.104.28
  • 92.123.104.19
  • 92.123.104.33
  • 92.123.104.32
  • 92.123.104.47
  • 2.19.96.120
  • 2.19.96.129
  • 2.19.96.83
  • 2.19.96.107
  • 2.19.96.128
  • 23.37.226.88
  • 23.37.226.106
  • 23.53.43.115
  • 23.53.43.121
  • 23.37.226.81
  • 23.37.226.97
whitelisted
i.ytimg.com
  • 216.58.212.150
  • 142.250.185.86
  • 142.250.185.118
  • 142.250.185.150
  • 142.250.185.182
  • 142.250.185.214
  • 142.250.185.246
  • 142.250.186.86
  • 142.250.186.118
  • 142.250.181.246
  • 172.217.16.150
  • 142.250.184.214
  • 142.250.184.246
  • 142.250.186.150
  • 142.250.74.214
  • 142.250.186.54
whitelisted

Threats

PID
Process
Class
Message
3272
3rm15HU.exe
A Network Trojan was detected
ET MALWARE RisePro TCP Heartbeat Packet
3272
3rm15HU.exe
Malware Command and Control Activity Detected
ET MALWARE [ANY.RUN] RisePro TCP (Token)
3272
3rm15HU.exe
Malware Command and Control Activity Detected
STEALER [ANY.RUN] RisePro TCP (Token)
3272
3rm15HU.exe
A Network Trojan was detected
ET MALWARE RisePro CnC Activity (Outbound)
3272
3rm15HU.exe
A Network Trojan was detected
ET MALWARE RisePro CnC Activity (Outbound)
3336
dialer.exe
Misc Attack
ET DROP Spamhaus DROP Listed Traffic Inbound group 7
3336
dialer.exe
A Network Trojan was detected
STEALER [ANY.RUN] Rhadamanthys SSL Certificate and JA3s
3272
3rm15HU.exe
Malware Command and Control Activity Detected
ET MALWARE [ANY.RUN] RisePro TCP (External IP)
3272
3rm15HU.exe
Malware Command and Control Activity Detected
STEALER [ANY.RUN] RisePro TCP (External IP Check)
3272
3rm15HU.exe
Device Retrieving External IP Address Detected
ET POLICY Possible External IP Lookup Domain Observed in SNI (ipinfo. io)
14 ETPRO signatures available at the full report
Process
Message
msedge.exe
[0105/060326.910:ERROR:exception_handler_server.cc(527)] ConnectNamedPipe: The pipe is being closed. (0xE8)
msedge.exe
[0105/060326.941:ERROR:exception_handler_server.cc(527)] ConnectNamedPipe: The pipe is being closed. (0xE8)
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
WEXTRACT.exe