File name:

2025-06-04_da695e371e7745fa03e26976caed3e70_amadey_black-basta_elex_luca-stealer_remcos_smoke-loader

Full analysis: https://app.any.run/tasks/42f2d9ca-65e3-413e-bda3-a8810ceaf4f7
Verdict: Malicious activity
Analysis date: June 04, 2025, 15:40:01
OS: Windows 10 Professional (build: 19044, 64 bit)
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:

DA695E371E7745FA03E26976CAED3E70

SHA1:

445EBC1568A5C0B976884FD2F0103792BAF91ACC

SHA256:

3E5EF05E4FD67A1892A9B8FAE1066E226BBF2444A5ECA5E1AE3E0C1A642B8C2B

SSDEEP:

12288:JandlRrADiU4WoXDcccfYpsTj2i/MApVEwcBc8lLVYjBEMDCb/oZW:J31KFSTjH/MkCjLVYjBEMDCc

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Changes the title of the Internet Explorer window

      • 2025-06-04_da695e371e7745fa03e26976caed3e70_amadey_black-basta_elex_luca-stealer_remcos_smoke-loader.exe (PID: 6040)

    • Reads security settings of Internet Explorer

      • 2025-06-04_da695e371e7745fa03e26976caed3e70_amadey_black-basta_elex_luca-stealer_remcos_smoke-loader.exe (PID: 6040)

    • Executable content was dropped or overwritten

      • 2025-06-04_da695e371e7745fa03e26976caed3e70_amadey_black-basta_elex_luca-stealer_remcos_smoke-loader.exe (PID: 6040)

    • There is functionality for taking screenshot (YARA)

      • 2025-06-04_da695e371e7745fa03e26976caed3e70_amadey_black-basta_elex_luca-stealer_remcos_smoke-loader.exe (PID: 6040)

    • Changes the Home page of Internet Explorer

      • 2025-06-04_da695e371e7745fa03e26976caed3e70_amadey_black-basta_elex_luca-stealer_remcos_smoke-loader.exe (PID: 6040)

    • Hides command output

      • cmd.exe (PID: 8112)

    • Starts CMD.EXE for commands execution

      • 2025-06-04_da695e371e7745fa03e26976caed3e70_amadey_black-basta_elex_luca-stealer_remcos_smoke-loader.exe (PID: 6040)

    • Runs PING.EXE to delay simulation

      • cmd.exe (PID: 8112)

    • Creates a software uninstall entry

      • 2025-06-04_da695e371e7745fa03e26976caed3e70_amadey_black-basta_elex_luca-stealer_remcos_smoke-loader.exe (PID: 6040)

  • INFO

    • Reads the machine GUID from the registry

      • 2025-06-04_da695e371e7745fa03e26976caed3e70_amadey_black-basta_elex_luca-stealer_remcos_smoke-loader.exe (PID: 6040)

    • The sample compiled with english language support

      • 2025-06-04_da695e371e7745fa03e26976caed3e70_amadey_black-basta_elex_luca-stealer_remcos_smoke-loader.exe (PID: 6040)

    • Checks supported languages

      • 2025-06-04_da695e371e7745fa03e26976caed3e70_amadey_black-basta_elex_luca-stealer_remcos_smoke-loader.exe (PID: 6040)
      • identity_helper.exe (PID: 472)

    • Creates files or folders in the user directory

      • 2025-06-04_da695e371e7745fa03e26976caed3e70_amadey_black-basta_elex_luca-stealer_remcos_smoke-loader.exe (PID: 6040)

    • Reads the computer name

      • 2025-06-04_da695e371e7745fa03e26976caed3e70_amadey_black-basta_elex_luca-stealer_remcos_smoke-loader.exe (PID: 6040)
      • identity_helper.exe (PID: 472)

    • Application launched itself

      • msedge.exe (PID: 4120)

    • Checks proxy server information

      • 2025-06-04_da695e371e7745fa03e26976caed3e70_amadey_black-basta_elex_luca-stealer_remcos_smoke-loader.exe (PID: 6040)
      • slui.exe (PID: 772)

    • Process checks computer location settings

      • 2025-06-04_da695e371e7745fa03e26976caed3e70_amadey_black-basta_elex_luca-stealer_remcos_smoke-loader.exe (PID: 6040)

    • Reads Environment values

      • identity_helper.exe (PID: 472)

    • Reads the software policy settings

      • slui.exe (PID: 772)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (76.4)
.exe | Win32 Executable (generic) (12.4)
.exe | Generic Win/DOS Executable (5.5)
.exe | DOS Executable Generic (5.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2017:11:22 08:45:43+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14.11
CodeSize: 262144
InitializedDataSize: 866816
UninitializedDataSize: -
EntryPoint: 0x2068c
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
FileVersionNumber: 4.2.0.8
ProductVersionNumber: 4.2.0.8
FileFlagsMask: 0x0017
FileFlags: (none)
FileOS: Win32
ObjectFileType: Unknown
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: Cloud Installer
FileDescription: IESettings
FileVersion: 4, 2, 0, 8
InternalName: IESettings
LegalCopyright: Copyright (C) 2017 Cloud Installer
OriginalFileName: IESettings
ProductName: IESettings
ProductVersion: 4, 2, 0, 8
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
173
Monitored processes
42
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start 2025-06-04_da695e371e7745fa03e26976caed3e70_amadey_black-basta_elex_luca-stealer_remcos_smoke-loader.exe iexplore.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs cmd.exe no specs conhost.exe no specs ping.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs slui.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
472"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.59\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --disable-quic --no-appcompat-clear --mojo-platform-channel-handle=5608 --field-trial-handle=2392,i,3839328021787499074,11336170941570233299,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.59\identity_helper.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
PWA Identity Proxy Host
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\identity_helper.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
656"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --disable-quic --no-appcompat-clear --mojo-platform-channel-handle=6424 --field-trial-handle=2392,i,3839328021787499074,11336170941570233299,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
772C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
1052"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --disable-quic --no-appcompat-clear --mojo-platform-channel-handle=4524 --field-trial-handle=2392,i,3839328021787499074,11336170941570233299,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
1312"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --disable-quic --no-appcompat-clear --mojo-platform-channel-handle=1724 --field-trial-handle=2392,i,3839328021787499074,11336170941570233299,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
2088"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --disable-quic --no-appcompat-clear --mojo-platform-channel-handle=5960 --field-trial-handle=2392,i,3839328021787499074,11336170941570233299,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
2140"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --disable-quic --no-appcompat-clear --mojo-platform-channel-handle=4412 --field-trial-handle=2392,i,3839328021787499074,11336170941570233299,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
2660"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --disable-quic --no-appcompat-clear --mojo-platform-channel-handle=5384 --field-trial-handle=2392,i,3839328021787499074,11336170941570233299,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
3096"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.70 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=122.0.2365.59 --initial-client-data=0x2b8,0x2bc,0x2c0,0x2b0,0x2c8,0x7ffc88525fd8,0x7ffc88525fe4,0x7ffc88525ff0C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
3100"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --disable-quic --no-appcompat-clear --mojo-platform-channel-handle=6664 --field-trial-handle=2392,i,3839328021787499074,11336170941570233299,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
Total events
9 202
Read events
9 169
Write events
33
Delete events
0

Modification events

(PID) Process:(6040) 2025-06-04_da695e371e7745fa03e26976caed3e70_amadey_black-basta_elex_luca-stealer_remcos_smoke-loader.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{63A0D037-77CB-4EE6-AA85-237FA70CFBBC}
Operation:writeName:DisplayName
Value:
Search
(PID) Process:(6040) 2025-06-04_da695e371e7745fa03e26976caed3e70_amadey_black-basta_elex_luca-stealer_remcos_smoke-loader.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{63A0D037-77CB-4EE6-AA85-237FA70CFBBC}
Operation:writeName:URL
Value:
http://search.hemailaccessonline.com/s?source=googledisplay%2Cd-v3&uid=76c637d4-45cb-45ef-8787-8d4125cf939e&uc=20180201&ap=appfocus1&i_id=email__1.30&query={searchTerms}
(PID) Process:(6040) 2025-06-04_da695e371e7745fa03e26976caed3e70_amadey_black-basta_elex_luca-stealer_remcos_smoke-loader.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{63A0D037-77CB-4EE6-AA85-237FA70CFBBC}
Operation:writeName:SuggestionsURL
Value:
https://ie.search.yahoo.com/os?appid=ie8&command={searchTerms}
(PID) Process:(6040) 2025-06-04_da695e371e7745fa03e26976caed3e70_amadey_black-basta_elex_luca-stealer_remcos_smoke-loader.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes
Operation:writeName:DefaultScope
Value:
{63A0D037-77CB-4EE6-AA85-237FA70CFBBC}
(PID) Process:(6040) 2025-06-04_da695e371e7745fa03e26976caed3e70_amadey_black-basta_elex_luca-stealer_remcos_smoke-loader.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
Operation:writeName:Start Page
Value:
http://search.hemailaccessonline.com/?source=googledisplay%2Cd-v3&uid=76c637d4-45cb-45ef-8787-8d4125cf939e&uc=20180201&ap=appfocus1&i_id=email__1.30
(PID) Process:(6040) 2025-06-04_da695e371e7745fa03e26976caed3e70_amadey_black-basta_elex_luca-stealer_remcos_smoke-loader.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\ContinuousBrowsing
Operation:writeName:Enabled
Value:
0
(PID) Process:(6040) 2025-06-04_da695e371e7745fa03e26976caed3e70_amadey_black-basta_elex_luca-stealer_remcos_smoke-loader.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{28e56cfb-e30e-4f66-85d8-339885b726b8}
Operation:writeName:DisplayName
Value:
Email Access Online
(PID) Process:(6040) 2025-06-04_da695e371e7745fa03e26976caed3e70_amadey_black-basta_elex_luca-stealer_remcos_smoke-loader.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{28e56cfb-e30e-4f66-85d8-339885b726b8}
Operation:writeName:DisplayVersion
Value:
4.2.0.8
(PID) Process:(6040) 2025-06-04_da695e371e7745fa03e26976caed3e70_amadey_black-basta_elex_luca-stealer_remcos_smoke-loader.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{28e56cfb-e30e-4f66-85d8-339885b726b8}
Operation:writeName:Publisher
Value:
Cloud Installer
(PID) Process:(6040) 2025-06-04_da695e371e7745fa03e26976caed3e70_amadey_black-basta_elex_luca-stealer_remcos_smoke-loader.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{28e56cfb-e30e-4f66-85d8-339885b726b8}
Operation:writeName:InstallLocation
Value:
C:\Users\admin\AppData\Roaming\{28e56cfb-e30e-4f66-85d8-339885b726b8}\
Executable files
1
Suspicious files
380
Text files
56
Unknown types
27

Dropped files

PID
Process
Filename
Type
4120msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Local State~RF121c4a.TMP —
MD5:—
SHA256:—
4120msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG.old~RF121c5a.TMP —
MD5:—
SHA256:—
4120msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG.old —
MD5:—
SHA256:—
4120msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG.old~RF121c5a.TMP —
MD5:—
SHA256:—
4120msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG.old —
MD5:—
SHA256:—
4120msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG.old~RF121c5a.TMP —
MD5:—
SHA256:—
4120msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG.old —
MD5:—
SHA256:—
4120msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\discounts_db\LOG.old~RF121c69.TMP —
MD5:—
SHA256:—
4120msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\discounts_db\LOG.old —
MD5:—
SHA256:—
4120msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey\LOG.old~RF121c79.TMP —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
82
TCP/UDP connections
84
DNS requests
52
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
POST
200
20.190.160.2:443
https://login.live.com/RST2.srf
unknown
xml
10.3 Kb
whitelisted
—
—
POST
200
20.190.160.20:443
https://login.live.com/RST2.srf
unknown
xml
11.0 Kb
whitelisted
—
—
POST
200
20.190.160.20:443
https://login.live.com/RST2.srf
unknown
xml
11.0 Kb
whitelisted
—
—
POST
200
20.190.160.14:443
https://login.live.com/RST2.srf
unknown
xml
10.3 Kb
whitelisted
6544
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6208
svchost.exe
GET
200
2.19.126.146:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6208
svchost.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
150.171.27.11:443
https://edge.microsoft.com/serviceexperimentation/v3/?osname=win&channel=stable&osver=10.0.19045&devicefamily=desktop&installdate=1661339457&clientversion=122.0.2365.59&experimentationmode=2&scpguard=0&scpfull=0&scpver=0
unknown
binary
446 b
whitelisted
—
—
GET
200
13.107.42.16:443
https://config.edge.skype.com/config/v1/Edge/122.0.2365.59?clientId=4489578223053569932&agents=EdgeFirstRun%2CEdgeFirstRunConfig&osname=win&client=edge&channel=stable&scpfre=0&osarch=x86_64&osver=10.0.19045&wu=1&devicefamily=desktop&uma=0&sessionid=47&mngd=0&installdate=1661339457&edu=0&bphint=2&soobedate=1504771245&fg=1
unknown
binary
839 b
whitelisted
—
—
GET
200
13.107.246.45:443
https://edge-mobile-static.azureedge.net/eccp/get?settenant=edge-config&setplatform=win&setmkt=en-US&setchannel=stable
unknown
binary
16.0 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
51.104.136.2:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
20.190.159.73:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
6544
svchost.exe
2.23.77.188:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
6208
svchost.exe
2.19.126.146:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
6208
svchost.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
6544
svchost.exe
20.190.159.73:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5496
MoUsoCoreWorker.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.185.78
whitelisted
ocsp.digicert.com
  • 2.23.77.188
whitelisted
crl.microsoft.com
  • 2.19.126.146
  • 2.19.126.133
  • 23.216.77.8
  • 23.216.77.42
  • 23.216.77.29
  • 23.216.77.13
  • 23.216.77.20
  • 23.216.77.32
  • 23.216.77.37
  • 23.216.77.26
  • 23.216.77.19
whitelisted
www.microsoft.com
  • 95.101.149.131
  • 23.35.229.160
whitelisted
settings-win.data.microsoft.com
  • 20.73.194.208
  • 4.231.128.59
whitelisted
client.wns.windows.com
  • 172.211.123.250
  • 172.211.123.249
whitelisted
search.hemailaccessonline.com
  • 23.21.7.172
  • 34.233.76.61
whitelisted
config.edge.skype.com
  • 13.107.42.16
whitelisted
edge.microsoft.com
  • 150.171.27.11
  • 150.171.28.11
whitelisted
edge-mobile-static.azureedge.net
  • 13.107.253.44
whitelisted

Threats

PID
Process
Class
Message
—
—
Potentially Bad Traffic
ET INFO Possible Chrome Plugin install
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
2025-06-04_da695e371e7745fa03e26976caed3e70_amadey_black-basta_elex_luca-stealer_remcos_smoke-loader