File name:

SafeFilter.exe

Full analysis: https://app.any.run/tasks/3cb4cb1c-c098-423f-81c1-b648d42dca56
Verdict: Malicious activity
Analysis date: April 29, 2025, 16:56:22
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
autoit
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, 11 sections
MD5:

8833BEC76CB7B47121766EF86E5A9B0D

SHA1:

38B8BBA91AE079D9A438C72698FFACE8F604F8E3

SHA256:

0E7624EED070DDAE3ED19F3012EA28CD42672AFF8633BF22B0805F98B2A64E79

SSDEEP:

98304:oqGpEbaYGk8HPSj93EGeG/Fl4aBYjPu3rOkjXJ3:XHt

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executing a file with an untrusted certificate

      • SafeFilter.exe (PID: 7588)

    • Runs injected code in another process

      • Autoit3.exe (PID: 7616)
      • MicrosoftEdgeUpdateCore.exe (PID: 8112)

    • Application was injected by another process

      • MicrosoftEdgeUpdateCore.exe (PID: 7848)
      • MicrosoftEdgeUpdateCore.exe (PID: 7532)

    • Changes the autorun value in the registry

      • MicrosoftEdgeUpdateCore.exe (PID: 7532)
      • MicrosoftEdgeUpdateCore.exe (PID: 8112)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • SafeFilter.exe (PID: 7588)
      • Autoit3.exe (PID: 7616)

    • Starts the AutoIt3 executable file

      • SafeFilter.exe (PID: 7588)

    • The process verifies whether the antivirus software is installed

      • Autoit3.exe (PID: 7616)
      • MicrosoftEdgeUpdateCore.exe (PID: 7532)

    • Starts CMD.EXE for commands execution

      • Autoit3.exe (PID: 7616)

    • Uses WMIC.EXE to obtain computer system information

      • cmd.exe (PID: 7660)

    • Accesses domain name via WMI (SCRIPT)

      • WMIC.exe (PID: 7712)

    • Executes application which crashes

      • MicrosoftEdgeUpdateCore.exe (PID: 7848)

    • Reads security settings of Internet Explorer

      • StartMenuExperienceHost.exe (PID: 5968)

    • Reads the date of Windows installation

      • StartMenuExperienceHost.exe (PID: 5968)

  • INFO

    • The sample compiled with english language support

      • SafeFilter.exe (PID: 7588)
      • Autoit3.exe (PID: 7616)

    • Checks supported languages

      • SafeFilter.exe (PID: 7588)
      • Autoit3.exe (PID: 7616)
      • MicrosoftEdgeUpdateCore.exe (PID: 7848)
      • MicrosoftEdgeUpdateCore.exe (PID: 7532)
      • StartMenuExperienceHost.exe (PID: 5968)

    • Reads mouse settings

      • Autoit3.exe (PID: 7616)

    • Reads Windows Product ID

      • Autoit3.exe (PID: 7616)
      • MicrosoftEdgeUpdateCore.exe (PID: 7532)

    • Creates files or folders in the user directory

      • Autoit3.exe (PID: 7616)

    • Reads CPU info

      • Autoit3.exe (PID: 7616)
      • MicrosoftEdgeUpdateCore.exe (PID: 7532)

    • Reads the computer name

      • Autoit3.exe (PID: 7616)
      • MicrosoftEdgeUpdateCore.exe (PID: 7532)
      • StartMenuExperienceHost.exe (PID: 5968)

    • Creates files in the program directory

      • cmd.exe (PID: 7660)
      • Autoit3.exe (PID: 7616)
      • MicrosoftEdgeUpdateCore.exe (PID: 8112)

    • Reads security settings of Internet Explorer

      • WMIC.exe (PID: 7712)

    • Process checks computer location settings

      • StartMenuExperienceHost.exe (PID: 5968)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (16.3)
.exe | Win64 Executable (generic) (14.5)
.dll | Win32 Dynamic Link Library (generic) (3.4)
.exe | Win32 Executable (generic) (2.3)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 0000:00:00 00:00:00
ImageFileCharacteristics: Executable, No line numbers, No symbols, 32-bit, No debug
PEType: PE32
LinkerVersion: 2.35
CodeSize: 2089472
InitializedDataSize: 3079680
UninitializedDataSize: 22016
EntryPoint: 0x107510
OSVersion: 4
ImageVersion: 1
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 2.5.8.38743
ProductVersionNumber: 2.5.8.38743
FileFlagsMask: 0x003f
FileFlags: Special build
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
Comments: This plugin is available under the terms of the GNU Lesser General Public License.
CompanyName: g10 Code GmbH
FileDescription: GpgOL - GnuPG plugin for Outlook
FileVersion: 2.5.8
InternalName: gpgol
LegalCopyright: Copyright © 2016 g10 Code GmbH
LegalTrademarks: -
OriginalFileName: gpgol.dll
PrivateBuild: -
ProductName: GpgOL
ProductVersion: 2.5.8
SpecialBuild: 2023-07-14T13:13+02:00
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
142
Monitored processes
11
Malicious processes
4
Suspicious processes
1

Behavior graph

Click at the process to see the details
start safefilter.exe autoit3.exe cmd.exe no specs conhost.exe no specs wmic.exe no specs microsoftedgeupdatecore.exe sppextcomobj.exe no specs microsoftedgeupdatecore.exe microsoftedgeupdatecore.exe startmenuexperiencehost.exe no specs svchost.exe

Process information

PID
CMD
Path
Indicators
Parent process
2196C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
5968"C:\WINDOWS\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mcaC:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe—svchost.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\windows\systemapps\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\startmenuexperiencehost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\wincorlib.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
7532"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.185.17\MicrosoftEdgeUpdateCore.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.185.17\MicrosoftEdgeUpdateCore.exe
sihost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge Update
Version:
1.3.185.17
Modules
Images
c:\program files (x86)\microsoft\edgeupdate\1.3.185.17\microsoftedgeupdatecore.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\ole32.dll
7588"C:\Users\admin\AppData\Local\Temp\SafeFilter.exe" C:\Users\admin\AppData\Local\Temp\SafeFilter.exe
explorer.exe
User:
admin
Company:
g10 Code GmbH
Integrity Level:
MEDIUM
Description:
GpgOL - GnuPG plugin for Outlook
Exit code:
0
Version:
2.5.8
Modules
Images
c:\users\admin\appdata\local\temp\safefilter.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
7616"c:\temp\test\Autoit3.exe" c:\temp\test\script.a3xC:\temp\test\Autoit3.exe
SafeFilter.exe
User:
admin
Company:
AutoIt Team
Integrity Level:
MEDIUM
Description:
AutoIt v3 Script
Exit code:
0
Version:
3, 3, 14, 5
Modules
Images
c:\temp\test\autoit3.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\psapi.dll
7660"c:\windows\system32\cmd.exe" /c wmic ComputerSystem get domain > C:\ProgramData\dbfbbhc\fbaheghC:\Windows\SysWOW64\cmd.exe—Autoit3.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
7668\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
7712wmic ComputerSystem get domain C:\Windows\SysWOW64\wbem\WMIC.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
WMI Commandline Utility
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\wbem\wmic.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
7848"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.185.17\MicrosoftEdgeUpdateCore.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.185.17\MicrosoftEdgeUpdateCore.exe
StartMenuExperienceHost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge Update
Version:
1.3.185.17
Modules
Images
c:\program files (x86)\microsoft\edgeupdate\1.3.185.17\microsoftedgeupdatecore.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\ole32.dll
8036C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Total events
4 394
Read events
4 318
Write events
76
Delete events
0

Modification events

(PID) Process:(8112) MicrosoftEdgeUpdateCore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:afdhdhc
Value:
"C:\ProgramData\dbfbbhc\Autoit3.exe" C:\ProgramData\dbfbbhc\aebbdaa.a3x
(PID) Process:(5968) StartMenuExperienceHost.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\TileDataModel\Migration\StartNonLayoutProperties
Operation:writeName:Completed
Value:
1
(PID) Process:(5968) StartMenuExperienceHost.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\TileDataModel\Migration\StartNonLayoutProperties_AppUsageData
Operation:writeName:Completed
Value:
1
(PID) Process:(5968) StartMenuExperienceHost.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\TileDataModel\Migration\StartNonLayoutProperties_TargetedContentTiles
Operation:writeName:Completed
Value:
1
(PID) Process:(5968) StartMenuExperienceHost.exeKey:\REGISTRY\A\{442b195a-6750-fe95-df87-c34e02f5caa1}\LocalState\DataCorruptionRecovery
Operation:writeName:InitializationAttemptCount
Value:
00000000F1C8D7AC27B9DB01
(PID) Process:(5968) StartMenuExperienceHost.exeKey:\REGISTRY\A\{442b195a-6750-fe95-df87-c34e02f5caa1}\LocalState\DataCorruptionRecovery
Operation:writeName:InitializationAttemptCount
Value:
010000009918A8AC27B9DB01
(PID) Process:(7532) MicrosoftEdgeUpdateCore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:afdhdhc
Value:
"C:\ProgramData\dbfbbhc\Autoit3.exe" C:\ProgramData\dbfbbhc\aebbdaa.a3x
Executable files
2
Suspicious files
3
Text files
7
Unknown types
0

Dropped files

PID
Process
Filename
Type
7588SafeFilter.exeC:\temp\test\Autoit3.exeexecutable
MD5:C56B5F0201A3B3DE53E561FE76912BFD
SHA256:237D1BCA6E056DF5BB16A1216A434634109478F882D3B1D58344C801D184F95D
7588SafeFilter.exeC:\temp\test\script.a3xbinary
MD5:2EA3D4504040FAF02AB6764B49B78E50
SHA256:260B59E12055551BCCAA24523BFB561D8E777651D3FCD15915EE49041E09A0A2
7660cmd.exeC:\ProgramData\dbfbbhc\fbaheghtext
MD5:C8BBAD190EAAA9755C8DFB1573984D81
SHA256:7F136265128B7175FB67024A6DDD7524586B025725A878C07D76A9D8AD3DC2AC
7616Autoit3.exeC:\ProgramData\dbfbbhc\Autoit3.exeexecutable
MD5:C56B5F0201A3B3DE53E561FE76912BFD
SHA256:237D1BCA6E056DF5BB16A1216A434634109478F882D3B1D58344C801D184F95D
7616Autoit3.exeC:\temp\fadgecktext
MD5:F49BEA000C24EECC999F4BEEEE834F07
SHA256:8F9D8A2466FFC97026D2AF65A46DF0DB898808E4F26C6468C2F10EEBA9108476
7616Autoit3.exeC:\ProgramData\dbfbbhc\aebbdaa.a3xbinary
MD5:2EA3D4504040FAF02AB6764B49B78E50
SHA256:260B59E12055551BCCAA24523BFB561D8E777651D3FCD15915EE49041E09A0A2
7616Autoit3.exeC:\temp\kdhhahgtext
MD5:77794F33D08603FA7D6EFF1FD71EE269
SHA256:F280236EFB9182784949EDFF968C9C26D1CCCB808626D20A38DE1826F10ADA27
7616Autoit3.exeC:\Users\admin\AppData\Roaming\AHdAGhhtext
MD5:ABB52CD39DB6C91533CEC155EDA92220
SHA256:25AB0FC357E72B2274DDFC807E98258091B4F50C523EE4002076107D139DA4C7
8112MicrosoftEdgeUpdateCore.exeC:\temp\ebdcbkctext
MD5:1D687E5BF24300BF93C8AA7996010D85
SHA256:E2327AA5FB473A98E97C5FAE55E92FD62FA2C86EC6E207DCFD5CFC4A0E691931
8112MicrosoftEdgeUpdateCore.exeC:\temp\fadgecktext
MD5:954EEEC23454700DCFDE72A59878DD95
SHA256:3536F86A2A9DF1FD53BECBB651C74DADFD9B0A0688DE0727B90FC65637EE97E8
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
3
TCP/UDP connections
105
DNS requests
12
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6544
svchost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
7228
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
7228
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2104
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3216
svchost.exe
172.211.123.248:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
20.190.159.129:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
184.30.131.245:80
ocsp.digicert.com
AKAMAI-AS
US
whitelisted
8112
MicrosoftEdgeUpdateCore.exe
173.255.204.62:80
harlemsupport.com
Linode, LLC
US
malicious
4
System
192.168.100.255:137
—
—
—
whitelisted
2112
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
7228
SIHClient.exe
4.245.163.56:443
slscr.update.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
client.wns.windows.com
  • 172.211.123.248
whitelisted
login.live.com
  • 20.190.159.129
  • 20.190.159.68
  • 40.126.31.2
  • 40.126.31.128
  • 40.126.31.0
  • 20.190.159.4
  • 20.190.159.131
  • 20.190.159.130
whitelisted
ocsp.digicert.com
  • 184.30.131.245
whitelisted
harlemsupport.com
  • 173.255.204.62
malicious
settings-win.data.microsoft.com
  • 51.104.136.2
  • 20.73.194.208
whitelisted
slscr.update.microsoft.com
  • 4.245.163.56
whitelisted
www.microsoft.com
  • 23.35.229.160
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 40.69.42.241
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
SafeFilter.exe