URL:

https://otx.alienvault.com/pulse/680921a957ac68aefe81797f

Full analysis: https://app.any.run/tasks/842b19f6-ae24-4504-a69b-154745002317
Verdict: Malicious activity
Threats:

Amadey is a formidable Windows infostealer threat, characterized by its persistence mechanisms, modular design, and ability to execute various malicious tasks.

Malware Trends Tracker     >>>
Analysis date: April 29, 2025, 18:19:18
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
python
hijackloader
loader
stealer
lumma
amadey
botnet
delphi
rdp
Indicators:
MD5:

8DD310B82D0D02908C70BCE4ECDD67D7

SHA1:

0971F6385B78571B54BC067B2137099E57D012EB

SHA256:

42C9D897CAD79C588547106387E57729915E5364E0E91394B410DA931F126ECF

SSDEEP:

3:N8Y/1c0KI/JAVRJpsUS/n:2Y/+KJAza

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • HIJACKLOADER has been detected (YARA)

      • Setup.exe (PID: 7612)
      • Clus-Blue.exe (PID: 5556)

    • Actions looks like stealing of personal data

      • Pergolesi.com (PID: 7508)

    • LUMMA mutex has been found

      • Pergolesi.com (PID: 7508)

    • Steals credentials from Web Browsers

      • Pergolesi.com (PID: 7508)

    • Known privilege escalation attack

      • dllhost.exe (PID: 8180)

    • Executing a file with an untrusted certificate

      • M6RGZ4AY57Y5KLO98Y8LUYO3LRK.exe (PID: 1132)

    • AMADEY has been detected (YARA)

      • Clus-Blue.exe (PID: 5556)
      • ping.com (PID: 2104)

    • AMADEY has been detected (SURICATA)

      • ping.com (PID: 2104)

  • SUSPICIOUS

    • Application launched itself

      • WinRAR.exe (PID: 7940)
      • WinRAR.exe (PID: 1452)

    • Reads security settings of Internet Explorer

      • WinRAR.exe (PID: 7940)
      • WinRAR.exe (PID: 1452)

    • Process drops legitimate windows executable

      • WinRAR.exe (PID: 7688)
      • Setup.exe (PID: 7612)
      • Pergolesi.com (PID: 7508)
      • Clus-Blue.exe (PID: 6036)

    • Executable content was dropped or overwritten

      • Setup.exe (PID: 7612)
      • Pergolesi.com (PID: 7508)
      • Clus-Blue.exe (PID: 8160)
      • Clus-Blue.exe (PID: 6036)
      • M6RGZ4AY57Y5KLO98Y8LUYO3LRK.exe (PID: 1132)
      • Clus-Blue.exe (PID: 5556)

    • The process drops C-runtime libraries

      • Setup.exe (PID: 7612)
      • Pergolesi.com (PID: 7508)
      • Clus-Blue.exe (PID: 6036)

    • Starts application with an unusual extension

      • Setup.exe (PID: 7612)
      • Clus-Blue.exe (PID: 5556)

    • Executes application which crashes

      • M6RGZ4AY57Y5KLO98Y8LUYO3LRK.exe (PID: 1132)

    • There is functionality for taking screenshot (YARA)

      • Clus-Blue.exe (PID: 5556)
      • ping.com (PID: 2104)

    • Starts CMD.EXE for commands execution

      • M6RGZ4AY57Y5KLO98Y8LUYO3LRK.exe (PID: 1132)

    • Uses REG/REGEDIT.EXE to modify registry

      • cmd.exe (PID: 7144)

    • Connects to unusual port

      • M6RGZ4AY57Y5KLO98Y8LUYO3LRK.exe (PID: 1132)

    • There is functionality for enable RDP (YARA)

      • ping.com (PID: 2104)

    • Contacting a server suspected of hosting an CnC

      • ping.com (PID: 2104)

    • Starts itself from another location

      • Clus-Blue.exe (PID: 6036)

  • INFO

    • Checks supported languages

      • identity_helper.exe (PID: 4920)
      • identity_helper.exe (PID: 7848)
      • Setup.exe (PID: 7612)
      • Pergolesi.com (PID: 7508)

    • Reads the computer name

      • identity_helper.exe (PID: 4920)
      • identity_helper.exe (PID: 7848)
      • Setup.exe (PID: 7612)
      • Pergolesi.com (PID: 7508)

    • Reads Environment values

      • identity_helper.exe (PID: 4920)
      • identity_helper.exe (PID: 7848)

    • Application launched itself

      • msedge.exe (PID: 680)
      • msedge.exe (PID: 4244)

    • Reads Microsoft Office registry keys

      • msedge.exe (PID: 4244)

    • Reads the software policy settings

      • slui.exe (PID: 2432)
      • Pergolesi.com (PID: 7508)

    • The sample compiled with english language support

      • WinRAR.exe (PID: 7688)
      • Setup.exe (PID: 7612)
      • Pergolesi.com (PID: 7508)
      • msedge.exe (PID: 6676)
      • Clus-Blue.exe (PID: 6036)

    • Python executable

      • Setup.exe (PID: 7612)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 7688)
      • msedge.exe (PID: 6676)

    • Manual execution by a user

      • Setup.exe (PID: 7612)

    • Creates files in the program directory

      • Setup.exe (PID: 7612)

    • Create files in a temporary directory

      • Setup.exe (PID: 7612)

    • Creates files or folders in the user directory

      • Setup.exe (PID: 7612)

    • The sample compiled with chinese language support

      • Clus-Blue.exe (PID: 8160)

    • Compiled with Borland Delphi (YARA)

      • M6RGZ4AY57Y5KLO98Y8LUYO3LRK.exe (PID: 1132)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Amadey

(PID) Process(2104) ping.com
C2tackleoutplayed.com
URLhttp://tackleoutplayed.com/yLC6Ya9ut5bfTA/index.php
Version5.34
Options
Drop directoryf7d1e9b9a5
Drop namenudwee.exe
Strings (125)S-%lu-
og:
clip.dll
ProgramData\
shell32.dll
<c>
vs:
Programs
&&
VideoID
ESET
av:
\App
0000043f
Doctor Web
:::
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
------
rundll32.exe
f7d1e9b9a5
00000422
0123456789
st=s
00000419
Content-Type: application/x-www-form-urlencoded
/Plugins/
msi
ar:
GetNativeSystemInfo
Norton
-%lu
Sophos
zip
SOFTWARE\Microsoft\Windows NT\CurrentVersion
" Content-Type: application/octet-stream
|
+++
nudwee.exe
" && ren
pc:
#
d1
cmd /C RMDIR /s/q
Bitdefender
Comodo
<d>
Kaspersky Lab
DefaultSettings.YResolution
Main
-executionpolicy remotesigned -File "
&& Exit"
ProductName
&unit=
2022
Panda Security
=
Rem
cmd
\0000
id:
sd:
--
/quiet
rundll32
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
%-lu
random
GET
"taskkill /f /im "
Content-Disposition: form-data; name="data"; filename="
00000423
5.34
2016
?scr=1
ComputerName
Keyboard Layout\Preload
Powershell.exe
POST
http://
AVAST Software
SYSTEM\CurrentControlSet\Control\UnitedVideo\CONTROL\VIDEO\
ps1
DefaultSettings.XResolution
Startup
CurrentBuild
tackleoutplayed.com
e3
cred.dll|clip.dll|
------
WinDefender
wb
https://
Avira
2025
" && timeout 1 && del
cred.dll
un:
SYSTEM\ControlSet001\Services\BasicDisplay\Video
rb
SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName
360TotalSecurity
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
e1
lv:
shutdown -s -t 0
/k
/yLC6Ya9ut5bfTA/index.php
e2
SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
exe
%USERPROFILE%
-unicode-
r=
.jpg
dll
Content-Type: multipart/form-data; boundary=----
2019
bi:
\
"
kernel32.dll
os:
abcdefghijklmnopqrstuvwxyz0123456789-_
dm:
AVG
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
265
Monitored processes
118
Malicious processes
11
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs sppextcomobj.exe no specs slui.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs winrar.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs msedge.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs winrar.exe no specs winrar.exe slui.exe #HIJACKLOADER setup.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs #LUMMA pergolesi.com msedge.exe no specs svchost.exe clus-blue.exe m6rgz4ay57y5klo98y8luyo3lrk.exe msedge.exe no specs 360tray.exe no specs msedge.exe no specs CMSTPLUA clus-blue.exe #HIJACKLOADER clus-blue.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs #AMADEY ping.com werfault.exe no specs werfault.exe no specs werfault.exe no specs werfault.exe no specs msedge.exe no specs cmd.exe no specs conhost.exe no specs reg.exe no specs werfault.exe no specs werfault.exe no specs werfault.exe no specs werfault.exe no specs 360tray.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe werfault.exe no specs werfault.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
664"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3920 --field-trial-handle=2396,i,3251785164844292862,10698378618231504083,262144 --variations-seed-version /prefetch:2C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
668"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=39 --mojo-platform-channel-handle=6040 --field-trial-handle=2336,i,1480048951587440676,1648432833414826447,262144 --variations-seed-version /prefetch:1C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
680"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-windowC:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
736"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=4884 --field-trial-handle=2396,i,3251785164844292862,10698378618231504083,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
856"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --no-appcompat-clear --mojo-platform-channel-handle=5592 --field-trial-handle=2336,i,1480048951587440676,1648432833414826447,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
864"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=5812 --field-trial-handle=2336,i,1480048951587440676,1648432833414826447,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1004"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=5920 --field-trial-handle=2396,i,3251785164844292862,10698378618231504083,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1116"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=1360 --field-trial-handle=2336,i,1480048951587440676,1648432833414826447,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1132"C:\Users\admin\AppData\Local\Temp\M6RGZ4AY57Y5KLO98Y8LUYO3LRK.exe"C:\Users\admin\AppData\Local\Temp\M6RGZ4AY57Y5KLO98Y8LUYO3LRK.exe
Pergolesi.com
User:
admin
Integrity Level:
MEDIUM
Version:
5.3.0.0
Modules
Images
c:\users\admin\appdata\local\temp\m6rgz4ay57y5klo98y8luyo3lrk.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
1452"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\AppData\Local\Temp\Rar$DIa7940.13307\𝗗𝗢𝗪@𝗡𝗟𝗢𝗔𝗗$_𝗖𝗢𝗠𝗣𝗟𝗘𝗧𝗘❏⤖𝗦𝗘𝗧3𝗨𝗣✷𝗖𝗢2𝗗𝗘#$!.7zC:\Program Files\WinRAR\WinRAR.exe—WinRAR.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
Total events
24 433
Read events
24 288
Write events
127
Delete events
18

Modification events

(PID) Process:(4244) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:failed_count
Value:
0
(PID) Process:(4244) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:state
Value:
2
(PID) Process:(4244) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:state
Value:
1
(PID) Process:(4244) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\StabilityMetrics
Operation:writeName:user_experience_metrics.stability.exited_cleanly
Value:
0
(PID) Process:(4244) msedge.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientStateMedium\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\LastWasDefault
Operation:writeName:S-1-5-21-1693682860-607145093-2874071422-1001
Value:
6DA9AF1F85922F00
(PID) Process:(4244) msedge.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientStateMedium\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\LastWasDefault
Operation:writeName:S-1-5-21-1693682860-607145093-2874071422-1001
Value:
361AB61F85922F00
(PID) Process:(5176) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(5176) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(5176) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(5176) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
Executable files
61
Suspicious files
847
Text files
219
Unknown types
0

Dropped files

PID
Process
Filename
Type
4244msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\discounts_db\LOG.old~RF10b8f1.TMP —
MD5:—
SHA256:—
4244msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old~RF10b8f1.TMP —
MD5:—
SHA256:—
4244msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old —
MD5:—
SHA256:—
4244msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\parcel_tracking_db\LOG.old~RF10b8f1.TMP —
MD5:—
SHA256:—
4244msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\parcel_tracking_db\LOG.old —
MD5:—
SHA256:—
4244msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey\LOG.old~RF10b8f1.TMP —
MD5:—
SHA256:—
4244msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey\LOG.old —
MD5:—
SHA256:—
4244msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\PersistentOriginTrials\LOG.old~RF10b8f1.TMP —
MD5:—
SHA256:—
4244msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\PersistentOriginTrials\LOG.old —
MD5:—
SHA256:—
4244msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\discounts_db\LOG.old —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
52
TCP/UDP connections
182
DNS requests
189
Threats
28

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
23.216.77.22:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
23.216.77.22:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
2104
svchost.exe
GET
304
23.216.77.22:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
7344
svchost.exe
GET
206
208.89.74.31:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/cd4e6fbf-c0e9-4dc2-9e3d-7f538bc7435a?P1=1746053375&P2=404&P3=2&P4=bUpl%2bjZsRY1%2fnqyZyFT1pHbnWi1PAaPUslvwjiWwDeVzybC6TobhThRl4agEzh1swULbbU%2fuanGDXh2BG6nXcQ%3d%3d
unknown
—
—
whitelisted
7344
svchost.exe
GET
206
208.89.74.31:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/cd4e6fbf-c0e9-4dc2-9e3d-7f538bc7435a?P1=1746053375&P2=404&P3=2&P4=bUpl%2bjZsRY1%2fnqyZyFT1pHbnWi1PAaPUslvwjiWwDeVzybC6TobhThRl4agEzh1swULbbU%2fuanGDXh2BG6nXcQ%3d%3d
unknown
—
—
whitelisted
6644
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
7344
svchost.exe
HEAD
200
208.89.74.31:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/fb6dd03b-99d7-4cc8-a878-91c8e655c2d3?P1=1746053374&P2=404&P3=2&P4=Wzh2O91AIYVN4Lea%2bwuunr2raBqvo%2bCFBH40v%2fSU4FWVC32SxqLDFuZRn19qfNThS8WgJy0WUUymn6UuFlI%2bfw%3d%3d
unknown
—
—
whitelisted
7344
svchost.exe
GET
206
208.89.74.31:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/cd4e6fbf-c0e9-4dc2-9e3d-7f538bc7435a?P1=1746053375&P2=404&P3=2&P4=bUpl%2bjZsRY1%2fnqyZyFT1pHbnWi1PAaPUslvwjiWwDeVzybC6TobhThRl4agEzh1swULbbU%2fuanGDXh2BG6nXcQ%3d%3d
unknown
—
—
whitelisted
7344
svchost.exe
GET
206
208.89.74.31:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/cd4e6fbf-c0e9-4dc2-9e3d-7f538bc7435a?P1=1746053375&P2=404&P3=2&P4=bUpl%2bjZsRY1%2fnqyZyFT1pHbnWi1PAaPUslvwjiWwDeVzybC6TobhThRl4agEzh1swULbbU%2fuanGDXh2BG6nXcQ%3d%3d
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
5496
MoUsoCoreWorker.exe
23.216.77.22:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
23.216.77.22:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
2104
svchost.exe
23.216.77.22:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5496
MoUsoCoreWorker.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
—
—
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
2104
svchost.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
4244
msedge.exe
239.255.255.250:1900
—
—
—
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
  • 40.127.240.158
whitelisted
google.com
  • 142.250.185.110
whitelisted
crl.microsoft.com
  • 23.216.77.22
  • 23.216.77.42
  • 23.216.77.34
  • 23.216.77.41
  • 23.216.77.30
  • 23.216.77.23
  • 23.216.77.39
  • 23.216.77.36
  • 23.216.77.29
whitelisted
www.microsoft.com
  • 23.35.229.160
whitelisted
otx.alienvault.com
  • 13.32.121.8
  • 13.32.121.87
  • 13.32.121.88
  • 13.32.121.24
whitelisted
config.edge.skype.com
  • 13.107.42.16
whitelisted
edge.microsoft.com
  • 150.171.28.11
  • 150.171.27.11
whitelisted
edge-mobile-static.azureedge.net
  • 13.107.253.45
whitelisted
business.bing.com
  • 13.107.6.158
whitelisted
bzib.nelreports.net
  • 23.50.131.74
  • 23.50.131.78
whitelisted

Threats

PID
Process
Class
Message
—
—
Potentially Bad Traffic
ET DNS Query for .cc TLD
—
—
Potentially Bad Traffic
ET DNS Query for .cc TLD
—
—
Not Suspicious Traffic
INFO [ANY.RUN] Cloudflare content delivery network (cdnjs .cloudflare .com)
—
—
Not Suspicious Traffic
INFO [ANY.RUN] Cloudflare content delivery network (cdnjs .cloudflare .com)
—
—
Potentially Bad Traffic
ET DNS Query for .cc TLD
—
—
Potentially Bad Traffic
ET DNS Query for .cc TLD
—
—
Misc activity
ET FILE_SHARING File Sharing Related Domain in DNS Lookup (mega .nz)
—
—
Misc activity
ET FILE_SHARING File Sharing Related Domain in DNS Lookup (mega .nz)
—
—
Misc activity
ET FILE_SHARING Observed DNS Query to Filesharing Service (mega .co .nz)
—
—
Misc activity
ET FILE_SHARING File Sharing Domain Observed in TLS SNI (mega .nz)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
https://otx.alienvault.com/pulse/680921a957ac68aefe81797f