File name:

2025-06-21_00566757e3e124f12524f56963a486c6_amadey_black-basta_elex_luca-stealer_remcos_smoke-loader

Full analysis: https://app.any.run/tasks/55215a2f-314e-4e0a-ac45-52360bd7e308
Verdict: Malicious activity
Analysis date: June 21, 2025, 12:10:34
OS: Windows 10 Professional (build: 19044, 64 bit)
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:

00566757E3E124F12524F56963A486C6

SHA1:

44FDE12225DA2573B4DCD3607A30CAD7F61B1ED9

SHA256:

2C3237BF57D724483625DE7E785C3A9C8EA9FF34B32967C117C24DD692815712

SSDEEP:

12288:AandlRrADiU4WoXDcccfYpsTj2i/MApVEwcBc8lLVYjBEMDCb/oZWQ:A31KFSTjH/MkCjLVYjBEMDCcv

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • 2025-06-21_00566757e3e124f12524f56963a486c6_amadey_black-basta_elex_luca-stealer_remcos_smoke-loader.exe (PID: 2732)

    • Changes the Home page of Internet Explorer

      • 2025-06-21_00566757e3e124f12524f56963a486c6_amadey_black-basta_elex_luca-stealer_remcos_smoke-loader.exe (PID: 2732)

    • Changes the title of the Internet Explorer window

      • 2025-06-21_00566757e3e124f12524f56963a486c6_amadey_black-basta_elex_luca-stealer_remcos_smoke-loader.exe (PID: 2732)

    • Creates a software uninstall entry

      • 2025-06-21_00566757e3e124f12524f56963a486c6_amadey_black-basta_elex_luca-stealer_remcos_smoke-loader.exe (PID: 2732)

    • Reads security settings of Internet Explorer

      • 2025-06-21_00566757e3e124f12524f56963a486c6_amadey_black-basta_elex_luca-stealer_remcos_smoke-loader.exe (PID: 2732)

    • There is functionality for taking screenshot (YARA)

      • 2025-06-21_00566757e3e124f12524f56963a486c6_amadey_black-basta_elex_luca-stealer_remcos_smoke-loader.exe (PID: 2732)

    • Starts CMD.EXE for commands execution

      • 2025-06-21_00566757e3e124f12524f56963a486c6_amadey_black-basta_elex_luca-stealer_remcos_smoke-loader.exe (PID: 2732)

    • Hides command output

      • cmd.exe (PID: 7312)

    • Runs PING.EXE to delay simulation

      • cmd.exe (PID: 7312)

  • INFO

    • The sample compiled with english language support

      • 2025-06-21_00566757e3e124f12524f56963a486c6_amadey_black-basta_elex_luca-stealer_remcos_smoke-loader.exe (PID: 2732)

    • Reads the machine GUID from the registry

      • 2025-06-21_00566757e3e124f12524f56963a486c6_amadey_black-basta_elex_luca-stealer_remcos_smoke-loader.exe (PID: 2732)

    • Creates files or folders in the user directory

      • 2025-06-21_00566757e3e124f12524f56963a486c6_amadey_black-basta_elex_luca-stealer_remcos_smoke-loader.exe (PID: 2732)

    • Checks supported languages

      • 2025-06-21_00566757e3e124f12524f56963a486c6_amadey_black-basta_elex_luca-stealer_remcos_smoke-loader.exe (PID: 2732)
      • identity_helper.exe (PID: 3652)

    • Reads the computer name

      • 2025-06-21_00566757e3e124f12524f56963a486c6_amadey_black-basta_elex_luca-stealer_remcos_smoke-loader.exe (PID: 2732)
      • identity_helper.exe (PID: 3652)

    • Process checks computer location settings

      • 2025-06-21_00566757e3e124f12524f56963a486c6_amadey_black-basta_elex_luca-stealer_remcos_smoke-loader.exe (PID: 2732)

    • Application launched itself

      • msedge.exe (PID: 6656)
      • msedge.exe (PID: 3588)

    • Reads Environment values

      • identity_helper.exe (PID: 3652)

    • Checks proxy server information

      • 2025-06-21_00566757e3e124f12524f56963a486c6_amadey_black-basta_elex_luca-stealer_remcos_smoke-loader.exe (PID: 2732)
      • slui.exe (PID: 7728)

    • Reads the software policy settings

      • slui.exe (PID: 7728)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (76.4)
.exe | Win32 Executable (generic) (12.4)
.exe | Generic Win/DOS Executable (5.5)
.exe | DOS Executable Generic (5.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2017:11:22 08:45:43+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14.11
CodeSize: 262144
InitializedDataSize: 866816
UninitializedDataSize: -
EntryPoint: 0x2068c
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
FileVersionNumber: 4.2.0.8
ProductVersionNumber: 4.2.0.8
FileFlagsMask: 0x0017
FileFlags: (none)
FileOS: Win32
ObjectFileType: Unknown
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: Cloud Installer
FileDescription: IESettings
FileVersion: 4, 2, 0, 8
InternalName: IESettings
LegalCopyright: Copyright (C) 2017 Cloud Installer
OriginalFileName: IESettings
ProductName: IESettings
ProductVersion: 4, 2, 0, 8
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
167
Monitored processes
31
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start 2025-06-21_00566757e3e124f12524f56963a486c6_amadey_black-basta_elex_luca-stealer_remcos_smoke-loader.exe iexplore.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs identity_helper.exe no specs msedge.exe no specs cmd.exe no specs conhost.exe no specs ping.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs slui.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1352"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1400,i,10826642296676489146,17756114146127057951,262144 --variations-seed-version --mojo-platform-channel-handle=2248 /prefetch:2C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2620"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3572,i,10826642296676489146,17756114146127057951,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:1C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2732"C:\Users\admin\Desktop\2025-06-21_00566757e3e124f12524f56963a486c6_amadey_black-basta_elex_luca-stealer_remcos_smoke-loader.exe" C:\Users\admin\Desktop\2025-06-21_00566757e3e124f12524f56963a486c6_amadey_black-basta_elex_luca-stealer_remcos_smoke-loader.exe
explorer.exe
User:
admin
Company:
Cloud Installer
Integrity Level:
MEDIUM
Description:
IESettings
Exit code:
0
Version:
4, 2, 0, 8
Modules
Images
c:\users\admin\desktop\2025-06-21_00566757e3e124f12524f56963a486c6_amadey_black-basta_elex_luca-stealer_remcos_smoke-loader.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
2976"C:\Program Files\Internet Explorer\IEXPLORE.EXE" -noframemerging C:\Program Files\Internet Explorer\iexplore.exe—2025-06-21_00566757e3e124f12524f56963a486c6_amadey_black-basta_elex_luca-stealer_remcos_smoke-loader.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
3100"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.142 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.92 --initial-client-data=0x290,0x294,0x298,0x288,0x2a0,0x7ffc4431f208,0x7ffc4431f214,0x7ffc4431f220C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
3588"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --from-ie-to-edge=8 --edge-skip-compat-layer-relaunch -- about:blankC:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
3652"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.92\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --disable-quic --string-annotations --always-read-main-dll --field-trial-handle=5964,i,10826642296676489146,17756114146127057951,262144 --variations-seed-version --mojo-platform-channel-handle=5992 /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.92\identity_helper.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
PWA Identity Proxy Host
Exit code:
0
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\identity_helper.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
3652"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --disable-quic --string-annotations --always-read-main-dll --field-trial-handle=6484,i,10826642296676489146,17756114146127057951,262144 --variations-seed-version --mojo-platform-channel-handle=1524 /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
3736"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3584,i,10826642296676489146,17756114146127057951,262144 --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:1C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
3908"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --disable-quic --string-annotations --always-read-main-dll --field-trial-handle=2700,i,10826642296676489146,17756114146127057951,262144 --variations-seed-version --mojo-platform-channel-handle=2664 /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
9 345
Read events
9 310
Write events
35
Delete events
0

Modification events

(PID) Process:(2732) 2025-06-21_00566757e3e124f12524f56963a486c6_amadey_black-basta_elex_luca-stealer_remcos_smoke-loader.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{FCA9F962-6118-480A-B47C-44FB70FE3A28}
Operation:writeName:DisplayName
Value:
Search
(PID) Process:(2732) 2025-06-21_00566757e3e124f12524f56963a486c6_amadey_black-basta_elex_luca-stealer_remcos_smoke-loader.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{FCA9F962-6118-480A-B47C-44FB70FE3A28}
Operation:writeName:URL
Value:
http://search.searchiswt.com/s?source=Gemini&uid=d87e6a33-541f-4a88-bc14-9ecf433a4cc6&uc=20180201&ap=appfocus1&i_id=weatherly__1.30&query={searchTerms}
(PID) Process:(2732) 2025-06-21_00566757e3e124f12524f56963a486c6_amadey_black-basta_elex_luca-stealer_remcos_smoke-loader.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{FCA9F962-6118-480A-B47C-44FB70FE3A28}
Operation:writeName:SuggestionsURL
Value:
https://ie.search.yahoo.com/os?appid=ie8&command={searchTerms}
(PID) Process:(2732) 2025-06-21_00566757e3e124f12524f56963a486c6_amadey_black-basta_elex_luca-stealer_remcos_smoke-loader.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes
Operation:writeName:DefaultScope
Value:
{FCA9F962-6118-480A-B47C-44FB70FE3A28}
(PID) Process:(2732) 2025-06-21_00566757e3e124f12524f56963a486c6_amadey_black-basta_elex_luca-stealer_remcos_smoke-loader.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
Operation:writeName:Start Page
Value:
http://search.searchiswt.com/?source=Gemini&uid=d87e6a33-541f-4a88-bc14-9ecf433a4cc6&uc=20180201&ap=appfocus1&i_id=weatherly__1.30
(PID) Process:(2732) 2025-06-21_00566757e3e124f12524f56963a486c6_amadey_black-basta_elex_luca-stealer_remcos_smoke-loader.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\ContinuousBrowsing
Operation:writeName:Enabled
Value:
0
(PID) Process:(2732) 2025-06-21_00566757e3e124f12524f56963a486c6_amadey_black-basta_elex_luca-stealer_remcos_smoke-loader.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{28e56cfb-e30e-4f66-85d8-339885b726b8}
Operation:writeName:DisplayName
Value:
myweathertab
(PID) Process:(2732) 2025-06-21_00566757e3e124f12524f56963a486c6_amadey_black-basta_elex_luca-stealer_remcos_smoke-loader.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{28e56cfb-e30e-4f66-85d8-339885b726b8}
Operation:writeName:DisplayVersion
Value:
4.2.0.8
(PID) Process:(2732) 2025-06-21_00566757e3e124f12524f56963a486c6_amadey_black-basta_elex_luca-stealer_remcos_smoke-loader.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{28e56cfb-e30e-4f66-85d8-339885b726b8}
Operation:writeName:Publisher
Value:
Cloud Installer
(PID) Process:(2732) 2025-06-21_00566757e3e124f12524f56963a486c6_amadey_black-basta_elex_luca-stealer_remcos_smoke-loader.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{28e56cfb-e30e-4f66-85d8-339885b726b8}
Operation:writeName:InstallLocation
Value:
C:\Users\admin\AppData\Roaming\{28e56cfb-e30e-4f66-85d8-339885b726b8}\
Executable files
10
Suspicious files
100
Text files
38
Unknown types
0

Dropped files

PID
Process
Filename
Type
3588msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\ClientCertificates\LOG.old~RF177c25.TMP —
MD5:—
SHA256:—
3588msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\ClientCertificates\LOG.old —
MD5:—
SHA256:—
3588msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey\LOG.old~RF177c54.TMP —
MD5:—
SHA256:—
3588msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey\LOG.old —
MD5:—
SHA256:—
3588msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\LOG.old~RF177c63.TMP —
MD5:—
SHA256:—
3588msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\discounts_db\LOG.old~RF177c63.TMP —
MD5:—
SHA256:—
3588msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\LOG.old —
MD5:—
SHA256:—
3588msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\discounts_db\LOG.old —
MD5:—
SHA256:—
3588msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\PersistentOriginTrials\LOG.old~RF177c73.TMP —
MD5:—
SHA256:—
3588msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\PersistentOriginTrials\LOG.old —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
48
TCP/UDP connections
54
DNS requests
44
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1268
svchost.exe
GET
200
184.24.77.12:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
2468
RUXIMICS.exe
GET
200
184.24.77.12:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5944
MoUsoCoreWorker.exe
GET
200
184.24.77.12:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
2468
RUXIMICS.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5944
MoUsoCoreWorker.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
150.171.28.11:443
https://edge.microsoft.com/serviceexperimentation/v3/?osname=win&channel=stable&osver=10.0.19045&devicefamily=desktop&installdate=1661339457&clientversion=133.0.3065.92&experimentationmode=2&scpguard=0&scpfull=0&scpver=0
unknown
binary
715 b
whitelisted
—
—
GET
200
13.107.42.16:443
https://config.edge.skype.com/config/v1/Edge/133.0.3065.92?clientId=4489578223053569932&agents=EdgeFirstRun%2CEdgeFirstRunConfig&osname=win&client=edge&channel=stable&scpfre=0&osarch=x86_64&osver=10.0.19045&wu=1&devicefamily=desktop&uma=0&sessionid=51&mngd=0&installdate=1661339457&edu=0&soobedate=1504771245&bphint=2&fg=1&lbfgdate=1750507848&lafgdate=0
unknown
binary
1.47 Kb
whitelisted
—
—
GET
200
92.123.104.53:443
https://copilot.microsoft.com/c/api/user/eligibility
unknown
—
—
—
4580
msedge.exe
GET
200
150.171.28.11:80
http://edge.microsoft.com/browsernetworktime/time/1/current?cup2key=2:RCLjYL--nbr8qoDPw2PfEw4DIJC02jFLhL5VTis48TA&cup2hreq=e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
1268
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5944
MoUsoCoreWorker.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2468
RUXIMICS.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2468
RUXIMICS.exe
184.24.77.12:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5944
MoUsoCoreWorker.exe
184.24.77.12:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
1268
svchost.exe
184.24.77.12:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
2468
RUXIMICS.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
5944
MoUsoCoreWorker.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 51.104.136.2
whitelisted
google.com
  • 142.250.186.78
whitelisted
crl.microsoft.com
  • 184.24.77.12
  • 184.24.77.40
  • 184.24.77.17
  • 184.24.77.4
  • 184.24.77.7
  • 184.24.77.42
  • 184.24.77.14
  • 184.24.77.15
  • 184.24.77.10
whitelisted
search.searchiswt.com
  • 44.211.21.122
  • 35.168.172.179
unknown
www.microsoft.com
  • 23.35.229.160
whitelisted
edge.microsoft.com
  • 150.171.28.11
  • 150.171.27.11
whitelisted
config.edge.skype.com
  • 13.107.42.16
whitelisted
copilot.microsoft.com
  • 92.123.104.45
  • 92.123.104.53
whitelisted
update.googleapis.com
  • 172.217.18.3
whitelisted
www.bing.com
  • 92.123.104.38
  • 92.123.104.34
  • 92.123.104.33
  • 92.123.104.32
  • 92.123.104.28
  • 92.123.104.59
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
2025-06-21_00566757e3e124f12524f56963a486c6_amadey_black-basta_elex_luca-stealer_remcos_smoke-loader