File name:

tmp.exe

Full analysis: https://app.any.run/tasks/ccf28aef-0303-4eb7-bcbf-cd145ea69222
Verdict: Malicious activity
Threats:

Amadey is a formidable Windows infostealer threat, characterized by its persistence mechanisms, modular design, and ability to execute various malicious tasks.

Malware Trends Tracker     >>>
Analysis date: October 28, 2023, 01:40:18
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
sinkhole
stealc
stealer
redline
amadey
botnet
trojan
opendir
loader
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

3B278EFBADBD0E64CE830B424360EBD0

SHA1:

64534BD1635D66229BAB1FA9EC7B1BEA1FC6E8C9

SHA256:

40C358C5F62AB4F90A21F957834E0D3C1FA1780E7DD6BD700628108A85B1BC7A

SSDEEP:

49152:lLnemID+PdosjpSSvZDMyNBcwt78cyccOeSzzCMlWVyan5XPrQZjKs5x6966e0hW:hn2DuqOvZDzNawtAcyccOVzzNoVyan5K

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • fw4jF86.exe (PID: 1632)
      • tmp.exe (PID: 3416)
      • eQ5cT10.exe (PID: 1860)
      • VW5pA01.exe (PID: 3372)
      • tT4tE93.exe (PID: 3120)
      • he4Ch77.exe (PID: 2808)
      • 5Lw5as3.exe (PID: 3104)
      • explothe.exe (PID: 1840)
      • foto1661.exe (PID: 3916)
      • Et0zg3ed.exe (PID: 5164)
      • Vx5zT4JM.exe (PID: 5420)
      • xi3VO0Xk.exe (PID: 5764)
      • wU7jg9ZG.exe (PID: 3160)

    • Application was dropped or rewritten from another process

      • 2Pf4350.exe (PID: 2692)
      • eQ5cT10.exe (PID: 1860)
      • 3hp87pF.exe (PID: 2480)
      • 1Hd91qy3.exe (PID: 2540)
      • fw4jF86.exe (PID: 1632)
      • tT4tE93.exe (PID: 3120)
      • he4Ch77.exe (PID: 2808)
      • VW5pA01.exe (PID: 3372)
      • 4wk962qN.exe (PID: 1912)
      • 5Lw5as3.exe (PID: 3104)
      • explothe.exe (PID: 1840)
      • 7Wr1Ef14.exe (PID: 3028)
      • 6qY8nQ0.exe (PID: 1592)
      • tus.exe (PID: 2916)
      • foto1661.exe (PID: 3916)
      • Et0zg3ed.exe (PID: 5164)
      • Vx5zT4JM.exe (PID: 5420)
      • xi3VO0Xk.exe (PID: 5764)
      • salo.exe (PID: 3004)
      • wU7jg9ZG.exe (PID: 3160)
      • 1OA06ma9.exe (PID: 5064)
      • explothe.exe (PID: 2372)
      • 2zK087Yw.exe (PID: 5964)
      • 4AZ877ts.exe (PID: 3976)
      • 3LU4VS65.exe (PID: 5104)
      • explothe.exe (PID: 5280)
      • explothe.exe (PID: 5088)
      • explothe.exe (PID: 4244)
      • explothe.exe (PID: 3056)

    • Changes the autorun value in the registry

      • explothe.exe (PID: 1840)

    • Uses Task Scheduler to run other applications

      • explothe.exe (PID: 1840)

    • Changes powershell execution policy (RemoteSigned)

      • explothe.exe (PID: 1840)

    • STEALC has been detected (SURICATA)

      • AppLaunch.exe (PID: 1616)

    • Connects to the CnC server

      • AppLaunch.exe (PID: 1616)
      • explothe.exe (PID: 1840)
      • AppLaunch.exe (PID: 3656)
      • 2zK087Yw.exe (PID: 5964)
      • AppLaunch.exe (PID: 5032)

    • AMADEY has been detected (SURICATA)

      • explothe.exe (PID: 1840)

    • REDLINE has been detected (SURICATA)

      • AppLaunch.exe (PID: 3656)
      • 2zK087Yw.exe (PID: 5964)
      • AppLaunch.exe (PID: 5032)

    • Steals credentials from Web Browsers

      • AppLaunch.exe (PID: 3656)
      • 2zK087Yw.exe (PID: 5964)
      • AppLaunch.exe (PID: 5032)

    • AMADEY has been detected (YARA)

      • explothe.exe (PID: 1840)

    • Loads dropped or rewritten executable

      • rundll32.exe (PID: 2416)

    • Actions looks like stealing of personal data

      • AppLaunch.exe (PID: 3656)
      • 2zK087Yw.exe (PID: 5964)
      • AppLaunch.exe (PID: 5032)

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • tmp.exe (PID: 3416)
      • tT4tE93.exe (PID: 3120)
      • VW5pA01.exe (PID: 3372)
      • eQ5cT10.exe (PID: 1860)
      • explothe.exe (PID: 1840)
      • foto1661.exe (PID: 3916)
      • Et0zg3ed.exe (PID: 5164)
      • Vx5zT4JM.exe (PID: 5420)
      • xi3VO0Xk.exe (PID: 5764)
      • fw4jF86.exe (PID: 1632)

    • Reads the Internet Settings

      • AppLaunch.exe (PID: 1616)
      • 5Lw5as3.exe (PID: 3104)
      • 6qY8nQ0.exe (PID: 1592)
      • explothe.exe (PID: 1840)
      • cmd.exe (PID: 2420)
      • powershell.exe (PID: 1980)
      • AppLaunch.exe (PID: 5828)
      • AppLaunch.exe (PID: 3656)
      • 2zK087Yw.exe (PID: 5964)
      • 3LU4VS65.exe (PID: 5104)
      • AppLaunch.exe (PID: 5032)

    • Starts itself from another location

      • 5Lw5as3.exe (PID: 3104)

    • Starts CMD.EXE for commands execution

      • explothe.exe (PID: 1840)
      • cmd.exe (PID: 1280)
      • 7Wr1Ef14.exe (PID: 3028)

    • Application launched itself

      • cmd.exe (PID: 1280)

    • Uses ICACLS.EXE to modify access control lists

      • cmd.exe (PID: 1280)

    • Executing commands from a ".bat" file

      • 7Wr1Ef14.exe (PID: 3028)

    • The process executes Powershell scripts

      • explothe.exe (PID: 1840)

    • Starts POWERSHELL.EXE for commands execution

      • explothe.exe (PID: 1840)

    • Powershell version downgrade attack

      • powershell.exe (PID: 1980)

    • Connects to the server without a host name

      • AppLaunch.exe (PID: 1616)
      • explothe.exe (PID: 1840)
      • 6qY8nQ0.exe (PID: 1592)
      • AppLaunch.exe (PID: 5828)
      • 3LU4VS65.exe (PID: 5104)

    • Process requests binary or script from the Internet

      • explothe.exe (PID: 1840)

    • Connects to unusual port

      • AppLaunch.exe (PID: 3656)
      • 2zK087Yw.exe (PID: 5964)
      • AppLaunch.exe (PID: 5032)

    • Reads browser cookies

      • AppLaunch.exe (PID: 3656)
      • 2zK087Yw.exe (PID: 5964)
      • AppLaunch.exe (PID: 5032)

    • Searches for installed software

      • AppLaunch.exe (PID: 3656)
      • 2zK087Yw.exe (PID: 5964)
      • AppLaunch.exe (PID: 5032)

    • The process executes via Task Scheduler

      • explothe.exe (PID: 2372)
      • explothe.exe (PID: 5088)
      • explothe.exe (PID: 4244)
      • explothe.exe (PID: 5280)
      • explothe.exe (PID: 3056)

    • Uses RUNDLL32.EXE to load library

      • explothe.exe (PID: 1840)

  • INFO

    • Checks supported languages

      • tT4tE93.exe (PID: 3120)
      • tmp.exe (PID: 3416)
      • eQ5cT10.exe (PID: 1860)
      • VW5pA01.exe (PID: 3372)
      • AppLaunch.exe (PID: 2700)
      • 1Hd91qy3.exe (PID: 2540)
      • 2Pf4350.exe (PID: 2692)
      • AppLaunch.exe (PID: 1616)
      • he4Ch77.exe (PID: 2808)
      • 3hp87pF.exe (PID: 2480)
      • 4wk962qN.exe (PID: 1912)
      • AppLaunch.exe (PID: 3656)
      • explothe.exe (PID: 1840)
      • 5Lw5as3.exe (PID: 3104)
      • 7Wr1Ef14.exe (PID: 3028)
      • 6qY8nQ0.exe (PID: 1592)
      • tus.exe (PID: 2916)
      • AppLaunch.exe (PID: 3528)
      • foto1661.exe (PID: 3916)
      • Et0zg3ed.exe (PID: 5164)
      • Vx5zT4JM.exe (PID: 5420)
      • xi3VO0Xk.exe (PID: 5764)
      • salo.exe (PID: 3004)
      • wU7jg9ZG.exe (PID: 3160)
      • fw4jF86.exe (PID: 1632)
      • 1OA06ma9.exe (PID: 5064)
      • AppLaunch.exe (PID: 5828)
      • explothe.exe (PID: 2372)
      • AppLaunch.exe (PID: 3044)
      • 2zK087Yw.exe (PID: 5964)
      • 4AZ877ts.exe (PID: 3976)
      • AppLaunch.exe (PID: 5032)
      • explothe.exe (PID: 5280)
      • explothe.exe (PID: 5088)
      • explothe.exe (PID: 4244)
      • explothe.exe (PID: 3056)
      • 3LU4VS65.exe (PID: 5104)

    • Create files in a temporary directory

      • tmp.exe (PID: 3416)
      • tT4tE93.exe (PID: 3120)
      • eQ5cT10.exe (PID: 1860)
      • VW5pA01.exe (PID: 3372)
      • fw4jF86.exe (PID: 1632)
      • he4Ch77.exe (PID: 2808)
      • 5Lw5as3.exe (PID: 3104)
      • 7Wr1Ef14.exe (PID: 3028)
      • explothe.exe (PID: 1840)
      • foto1661.exe (PID: 3916)
      • Et0zg3ed.exe (PID: 5164)
      • Vx5zT4JM.exe (PID: 5420)
      • xi3VO0Xk.exe (PID: 5764)
      • wU7jg9ZG.exe (PID: 3160)

    • Reads the computer name

      • AppLaunch.exe (PID: 2700)
      • AppLaunch.exe (PID: 1616)
      • AppLaunch.exe (PID: 3656)
      • 5Lw5as3.exe (PID: 3104)
      • explothe.exe (PID: 1840)
      • 6qY8nQ0.exe (PID: 1592)
      • AppLaunch.exe (PID: 5828)
      • 2zK087Yw.exe (PID: 5964)
      • 3LU4VS65.exe (PID: 5104)
      • AppLaunch.exe (PID: 5032)

    • Checks proxy server information

      • AppLaunch.exe (PID: 1616)
      • 6qY8nQ0.exe (PID: 1592)
      • explothe.exe (PID: 1840)
      • AppLaunch.exe (PID: 5828)
      • 3LU4VS65.exe (PID: 5104)

    • Reads the machine GUID from the registry

      • AppLaunch.exe (PID: 1616)
      • AppLaunch.exe (PID: 3656)
      • 6qY8nQ0.exe (PID: 1592)
      • explothe.exe (PID: 1840)
      • AppLaunch.exe (PID: 5828)
      • 2zK087Yw.exe (PID: 5964)
      • 3LU4VS65.exe (PID: 5104)
      • AppLaunch.exe (PID: 5032)

    • Application launched itself

      • msedge.exe (PID: 556)
      • msedge.exe (PID: 3480)
      • chrome.exe (PID: 3540)
      • iexplore.exe (PID: 2568)
      • msedge.exe (PID: 2820)
      • chrome.exe (PID: 4328)
      • chrome.exe (PID: 1764)
      • chrome.exe (PID: 3484)
      • chrome.exe (PID: 4564)
      • chrome.exe (PID: 4876)
      • chrome.exe (PID: 1612)
      • chrome.exe (PID: 5148)
      • chrome.exe (PID: 396)
      • chrome.exe (PID: 2404)

    • Creates files or folders in the user directory

      • explothe.exe (PID: 1840)

    • Reads Environment values

      • AppLaunch.exe (PID: 3656)
      • 2zK087Yw.exe (PID: 5964)
      • AppLaunch.exe (PID: 5032)

    • Reads product name

      • AppLaunch.exe (PID: 3656)
      • 2zK087Yw.exe (PID: 5964)
      • AppLaunch.exe (PID: 5032)

    • The process uses the downloaded file

      • chrome.exe (PID: 5156)
      • chrome.exe (PID: 1536)
      • chrome.exe (PID: 4500)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Amadey

(PID) Process(1840) explothe.exe
C2 (1)http://77.91.124.1
Version3.89
Options
Drop directoryS-%lu-
Drop name%-lu
Strings (120)-%lu
fefffe8cea
explothe.exe
SCHTASKS
/Create /SC MINUTE /MO 1 /TN
/TR "
" /F
SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
Startup
Rem
cmd /C RMDIR /s/q
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
rundll32
/Delete /TN "
Programs
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
%USERPROFILE%
\App
POST
GET
id=
&vs=
&sd=
&os=
&bi=
&ar=
&pc=
&un=
&dm=
&av=
&lv=
&og=
cred.dll|clip.dll|
d1
e1
e0
Main
http://
https://
exe
dll
cmd
ps1
<c>
<d>
Plugins/
+++
#
|
&unit=
=
shell32.dll
kernel32.dll
GetNativeSystemInfo
ProgramData\
AVAST Software
Avira
Kaspersky Lab
ESET
Panda Security
Doctor Web
AVG
360TotalSecurity
Bitdefender
Norton
Sophos
Comodo
WinDefender
0123456789
rb
wb
Content-Type: multipart/form-data; boundary=----
------
Content-Disposition: form-data; name="data"; filename="
" Content-Type: application/octet-stream
------
--
?scr=1
.jpg
Content-Type: application/x-www-form-urlencoded
SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName
ComputerName
abcdefghijklmnopqrstuvwxyz0123456789-_
-unicode-
SYSTEM\CurrentControlSet\Control\UnitedVideo\CONTROL\VIDEO\
SYSTEM\ControlSet001\Services\BasicDisplay\Video
VideoID
\0000
DefaultSettings.XResolution
DefaultSettings.YResolution
SOFTWARE\Microsoft\Windows NT\CurrentVersion
ProductName
2019
2022
2016
CurrentBuild
&&
echo Y|CACLS "
" /P "
:N"
CACLS "
" /P "
:R" /E
:F" /E
&&Exit
..\
\
:::
rundll32.exe
/k
"taskkill /f /im "
" && timeout 1 && del
&& Exit"
" && ren
&&
Powershell.exe
-executionpolicy remotesigned -File "
"
shutdown -s -t 0
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2022:05:25 00:49:06+02:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14.13
CodeSize: 25600
InitializedDataSize: 1601536
UninitializedDataSize: -
EntryPoint: 0x6a60
OSVersion: 10
ImageVersion: 10
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 11.0.17763.1
ProductVersionNumber: 11.0.17763.1
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: Microsoft Corporation
FileDescription: Win32 Cabinet Self-Extractor
FileVersion: 11.00.17763.1 (WinBuild.160101.0800)
InternalName: Wextract
LegalCopyright: © Microsoft Corporation. All rights reserved.
OriginalFileName: WEXTRACT.EXE .MUI
ProductName: Internet Explorer
ProductVersion: 11.00.17763.1
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
196
Monitored processes
147
Malicious processes
27
Suspicious processes
9

Behavior graph

Click at the process to see the details
drop and start drop and start start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start tmp.exe no specs eq5ct10.exe no specs vw5pa01.exe no specs tt4te93.exe no specs fw4jf86.exe no specs he4ch77.exe no specs 1hd91qy3.exe no specs applaunch.exe no specs 2pf4350.exe no specs #STEALC applaunch.exe 3hp87pf.exe no specs 4wk962qn.exe no specs #REDLINE applaunch.exe 5lw5as3.exe no specs #AMADEY explothe.exe 6qy8nq0.exe schtasks.exe no specs cmd.exe no specs cmd.exe no specs cacls.exe no specs cacls.exe no specs cmd.exe no specs cacls.exe no specs cacls.exe no specs 7wr1ef14.exe no specs cmd.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs powershell.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs iexplore.exe chrome.exe tus.exe chrome.exe no specs msedge.exe no specs msedge.exe no specs applaunch.exe no specs msedge.exe no specs msedge.exe no specs iexplore.exe msedge.exe no specs msedge.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs msedge.exe no specs foto1661.exe no specs chrome.exe no specs chrome.exe no specs et0zg3ed.exe no specs vx5zt4jm.exe no specs xi3vo0xk.exe no specs msedge.exe no specs salo.exe chrome.exe no specs wu7jg9zg.exe no specs msedge.exe no specs 1oa06ma9.exe msedge.exe no specs applaunch.exe chrome.exe no specs applaunch.exe no specs chrome.exe no specs msedge.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs msedge.exe no specs msedge.exe no specs explothe.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs #REDLINE 2zk087yw.exe rundll32.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs 3lu4vs65.exe 4az877ts.exe #REDLINE applaunch.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs explothe.exe no specs explothe.exe no specs explothe.exe no specs chrome.exe no specs explothe.exe no specs chrome.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
120"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1084 --field-trial-handle=1256,i,15481091646853911954,8176710097283981070,131072 /prefetch:2C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
109.0.5414.120
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
128"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2568 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
396"C:\Program Files\Google\Chrome\Application\chrome.exe" C:\Program Files\Google\Chrome\Application\chrome.exe—AppLaunch.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
4294967295
Version:
109.0.5414.120
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\apphelp.dll
c:\windows\apppatch\aclayers.dll
c:\windows\system32\sspicli.dll
556"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/C:\Program Files\Microsoft\Edge\Application\msedge.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\apppatch\aclayers.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\msvcrt.dll
1016"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explothe.exe /TR "C:\Users\admin\AppData\Local\Temp\fefffe8cea\explothe.exe" /FC:\Windows\System32\schtasks.exe—explothe.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\usp10.dll
1044"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3432 --field-trial-handle=1220,i,9743943676824673693,7638146917804911804,131072 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
109.0.5414.120
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\apphelp.dll
c:\windows\apppatch\aclayers.dll
c:\windows\system32\sspicli.dll
1192"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=1496 --field-trial-handle=1256,i,15481091646853911954,8176710097283981070,131072 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
109.0.5414.120
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1280"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explothe.exe" /P "admin:N"&&CACLS "explothe.exe" /P "admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "admin:N"&&CACLS "..\fefffe8cea" /P "admin:R" /E&&ExitC:\Windows\System32\cmd.exe—explothe.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1304"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1492 --field-trial-handle=1220,i,9743943676824673693,7638146917804911804,131072 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe
chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
109.0.5414.120
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\shlwapi.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\ole32.dll
c:\windows\system32\version.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcrt.dll
1324"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win32 --annotation=prod=Chrome --annotation=ver=109.0.5414.120 --initial-client-data=0x17c,0x180,0x184,0x150,0x188,0x50148b38,0x50148b48,0x50148b54C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
4294967295
Version:
109.0.5414.120
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\apppatch\aclayers.dll
c:\windows\system32\version.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\sspicli.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\msvcrt.dll
Total events
41 027
Read events
40 567
Write events
457
Delete events
3

Modification events

(PID) Process:(1616) AppLaunch.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(1616) AppLaunch.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(1616) AppLaunch.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(1616) AppLaunch.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
4600000056010000090000000000000000000000000000000400000000000000C0E333BBEAB1D3010000000000000000000000000100000002000000C0A8016B000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(3104) 5Lw5as3.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(3104) 5Lw5as3.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(3104) 5Lw5as3.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(3104) 5Lw5as3.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(1840) explothe.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
Operation:writeName:Startup
Value:
%USERPROFILE%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
(PID) Process:(1840) explothe.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
Executable files
33
Suspicious files
451
Text files
166
Unknown types
0

Dropped files

PID
Process
Filename
Type
3484msedge.exe —
MD5:—
SHA256:—
3372VW5pA01.exeC:\Users\admin\AppData\Local\Temp\IXP002.TMP\tT4tE93.exeexecutable
MD5:36814A8F7E80A06C5587DE5057E4A6A3
SHA256:92A29D43802DAA57ED730049EC97FCF069EB1E9FE72A552E879AED583E51C4C4
3372VW5pA01.exeC:\Users\admin\AppData\Local\Temp\IXP002.TMP\5Lw5as3.exeexecutable
MD5:3F53326679049BE6B69D102CAC0E98D1
SHA256:D1F5C747A10411E19FE90A3E4A04E9DC31F0ECCF4B1F4048F753CF550F534F18
3416tmp.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\eQ5cT10.exeexecutable
MD5:EAAEB51B7E37CB6800CB48DB0C92D073
SHA256:3B601B4CB8ABFB7A39C8DC846EB84074013362C8A67CE7F5D58E02D177319C9C
3416tmp.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\7Wr1Ef14.exeexecutable
MD5:270FF5B2E4836532FFF367F6591B4A65
SHA256:01CC72B649B73E6B312437F9C567E8DCAA9705C31B954D85299B55D2053FCD4F
2820msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datbinary
MD5:C7352A0E98449CC8AEDC1D6954C4CCD9
SHA256:3A1591F52AD31B5B0B48F97AB5E1361D0AD0FA0F584E8FE8EFD482801DC2B9B5
3872msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics.pmabinary
MD5:C612E96CBFAC63232FC2062E15600FB1
SHA256:DB3C05D5EC0B6719A73E7F0BE84BCE9342772DA70567E7CE08CF6573480B38FF
2820msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old~RF1ec179.TMP —
MD5:—
SHA256:—
2820msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old —
MD5:—
SHA256:—
1860eQ5cT10.exeC:\Users\admin\AppData\Local\Temp\IXP001.TMP\VW5pA01.exeexecutable
MD5:7B1520990578D30B862914E846BF414F
SHA256:0D6DE93276D64BD862B713501A6310DF8CE896F3CB98972DAFC88941D0754C68
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
34
TCP/UDP connections
156
DNS requests
138
Threats
119

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1840
explothe.exe
GET
200
77.91.68.249:80
http://77.91.68.249/fuza/salo.exe
unknown
executable
1.07 Mb
unknown
1592
6qY8nQ0.exe
POST
200
193.233.255.73:80
http://193.233.255.73/loghub/master
unknown
text
8 b
unknown
1840
explothe.exe
GET
200
77.91.68.249:80
http://77.91.68.249/fuza/2.ps1
unknown
text
169 b
unknown
1616
AppLaunch.exe
POST
200
193.233.255.73:80
http://193.233.255.73/loghub/master
unknown
text
8 b
unknown
1840
explothe.exe
GET
200
77.91.68.249:80
http://77.91.68.249/fuza/tus.exe
unknown
executable
913 Kb
unknown
1840
explothe.exe
POST
200
77.91.124.1:80
http://77.91.124.1/theme/index.php
unknown
text
3 b
unknown
1840
explothe.exe
GET
200
77.91.68.249:80
http://77.91.68.249/fuza/foto1661.exe
unknown
executable
1.47 Mb
unknown
128
iexplore.exe
GET
200
142.251.140.3:80
http://ocsp.pki.goog/gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D
unknown
binary
724 b
unknown
1840
explothe.exe
POST
200
77.91.124.1:80
http://77.91.124.1/theme/index.php
unknown
text
3 b
unknown
128
iexplore.exe
GET
200
8.241.11.126:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?8dd425fd27e43b6f
unknown
compressed
4.66 Kb
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2656
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
1088
svchost.exe
224.0.0.252:5355
—
—
—
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1616
AppLaunch.exe
193.233.255.73:80
—
LLC Baxet
RU
malicious
1592
6qY8nQ0.exe
193.233.255.73:80
—
LLC Baxet
RU
malicious
3656
AppLaunch.exe
77.91.124.86:19084
—
Foton Telecom CJSC
RU
malicious
1840
explothe.exe
77.91.124.1:80
—
Foton Telecom CJSC
RU
malicious
1840
explothe.exe
77.91.68.249:80
—
Foton Telecom CJSC
RU
unknown
2820
msedge.exe
239.255.255.250:1900
—
—
—
whitelisted

DNS requests

Domain
IP
Reputation
www.facebook.com
  • 157.240.9.35
whitelisted
config.edge.skype.com
  • 13.107.42.16
whitelisted
edge.microsoft.com
  • 13.107.21.239
  • 204.79.197.239
whitelisted
accounts.google.com
  • 172.217.169.173
  • 172.217.169.141
shared
www.youtube.com
  • 216.58.212.46
  • 216.58.213.110
  • 142.251.140.14
  • 142.251.140.46
  • 142.251.140.78
  • 142.251.141.46
  • 172.217.169.142
  • 216.58.214.142
  • 142.250.184.142
  • 142.250.187.110
  • 142.250.187.142
  • 142.250.187.174
  • 172.217.17.110
  • 172.217.17.142
  • 172.217.20.78
  • 216.58.212.14
  • 172.217.169.110
whitelisted
nav-edge.smartscreen.microsoft.com
  • 168.61.21.91
whitelisted
www.bing.com
  • 104.126.37.145
  • 104.126.37.131
whitelisted
www.gstatic.com
  • 216.58.212.3
whitelisted
i.ytimg.com
  • 172.217.17.150
  • 216.58.213.118
  • 142.251.140.22
  • 142.251.140.54
  • 142.251.140.86
  • 142.251.141.54
  • 172.217.169.118
  • 172.217.169.150
  • 172.217.169.214
  • 172.217.17.246
  • 216.58.214.150
  • 142.250.184.150
  • 142.250.187.118
  • 142.250.187.150
  • 142.250.187.182
  • 172.217.17.118
whitelisted
fonts.googleapis.com
  • 172.217.17.138
whitelisted

Threats

PID
Process
Class
Message
1616
AppLaunch.exe
A Network Trojan was detected
ET MALWARE [ANY.RUN] Win32/Stealc Checkin (POST)
1616
AppLaunch.exe
A Network Trojan was detected
STEALER [ANY.RUN] Win32/Stealc (Check-In)
1616
AppLaunch.exe
Potentially Bad Traffic
ET HUNTING GENERIC SUSPICIOUS POST to Dotted Quad with Fake Browser 1
1592
6qY8nQ0.exe
Potentially Bad Traffic
ET HUNTING GENERIC SUSPICIOUS POST to Dotted Quad with Fake Browser 1
3656
AppLaunch.exe
Potentially Bad Traffic
ET INFO Microsoft net.tcp Connection Initialization Activity
3656
AppLaunch.exe
A Network Trojan was detected
ET MALWARE Redline Stealer TCP CnC Activity
3656
AppLaunch.exe
A Network Trojan was detected
ET MALWARE [ANY.RUN] RedLine Stealer Related (MC-NMF Authorization)
3656
AppLaunch.exe
A Network Trojan was detected
ET MALWARE Redline Stealer TCP CnC - Id1Response
1840
explothe.exe
Malware Command and Control Activity Detected
ET MALWARE Amadey CnC Check-In
1840
explothe.exe
A Network Trojan was detected
AV TROJAN Agent.DHOA System Info Exfiltration
1 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
tmp.exe