File name:

2025-04-06_19457e39c266a4e7ced4b9d8e39f24de_amadey_rhadamanthys_smoke-loader_swisyn

Full analysis: https://app.any.run/tasks/b4d166ea-3bea-4f67-8755-a9a4560cffa9
Verdict: Malicious activity
Analysis date: April 06, 2025, 05:29:39
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
jeefo
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 3 sections
MD5:

19457E39C266A4E7CED4B9D8E39F24DE

SHA1:

1440DF91466366AF603FAF06A466AC82A219A5F5

SHA256:

50955988ADDE2D55E09BF4D773596CC9C3FA5CA6DE09A082D6424C51383B777D

SSDEEP:

98304:5c928pqN1GsLCgGdZNvExjz1H9DH6wIRFm5WUlXFnqKHQuAxiu8fWWIZ9NypOsCj:2xIJOi00lcjicDEA

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • JEEFO has been detected

      • 2025-04-06_19457e39c266a4e7ced4b9d8e39f24de_amadey_rhadamanthys_smoke-loader_swisyn.exe (PID: 4696)
      • icsys.icn.exe (PID: 960)
      • svchost.exe (PID: 7020)
      • explorer.exe (PID: 6872)

    • Changes the autorun value in the registry

      • svchost.exe (PID: 7020)
      • 2025-04-06_19457e39c266a4e7ced4b9d8e39f24de_amadey_rhadamanthys_smoke-loader_swisyn.exe  (PID: 900)
      • explorer.exe (PID: 6872)

  • SUSPICIOUS

    • Starts application with an unusual extension

      • 2025-04-06_19457e39c266a4e7ced4b9d8e39f24de_amadey_rhadamanthys_smoke-loader_swisyn.exe (PID: 4696)
      • 2025-04-06_19457e39c266a4e7ced4b9d8e39f24de_amadey_rhadamanthys_smoke-loader_swisyn.exe  (PID: 900)

    • Executable content was dropped or overwritten

      • 2025-04-06_19457e39c266a4e7ced4b9d8e39f24de_amadey_rhadamanthys_smoke-loader_swisyn.exe (PID: 4696)
      • 2025-04-06_19457e39c266a4e7ced4b9d8e39f24de_amadey_rhadamanthys_smoke-loader_swisyn.exe  (PID: 744)
      • icsys.icn.exe (PID: 960)
      • explorer.exe (PID: 6872)
      • spoolsv.exe (PID: 6572)
      • 2025-04-06_19457e39c266a4e7ced4b9d8e39f24de_amadey_rhadamanthys_smoke-loader_swisyn.exe  (PID: 900)

    • Process drops legitimate windows executable

      • 2025-04-06_19457e39c266a4e7ced4b9d8e39f24de_amadey_rhadamanthys_smoke-loader_swisyn.exe (PID: 4696)
      • 2025-04-06_19457e39c266a4e7ced4b9d8e39f24de_amadey_rhadamanthys_smoke-loader_swisyn.exe  (PID: 744)
      • 2025-04-06_19457e39c266a4e7ced4b9d8e39f24de_amadey_rhadamanthys_smoke-loader_swisyn.exe  (PID: 900)
      • msiexec.exe (PID: 7232)

    • Starts a Microsoft application from unusual location

      • 2025-04-06_19457e39c266a4e7ced4b9d8e39f24de_amadey_rhadamanthys_smoke-loader_swisyn.exe  (PID: 900)
      • 2025-04-06_19457e39c266a4e7ced4b9d8e39f24de_amadey_rhadamanthys_smoke-loader_swisyn.exe  (PID: 744)

    • Application launched itself

      • 2025-04-06_19457e39c266a4e7ced4b9d8e39f24de_amadey_rhadamanthys_smoke-loader_swisyn.exe  (PID: 900)

    • Starts itself from another location

      • 2025-04-06_19457e39c266a4e7ced4b9d8e39f24de_amadey_rhadamanthys_smoke-loader_swisyn.exe (PID: 4696)
      • icsys.icn.exe (PID: 960)
      • explorer.exe (PID: 6872)
      • spoolsv.exe (PID: 6572)
      • svchost.exe (PID: 7020)

    • The process creates files with name similar to system file names

      • icsys.icn.exe (PID: 960)
      • spoolsv.exe (PID: 6572)

    • Searches for installed software

      • 2025-04-06_19457e39c266a4e7ced4b9d8e39f24de_amadey_rhadamanthys_smoke-loader_swisyn.exe  (PID: 744)
      • dllhost.exe (PID: 7148)

    • Executes as Windows Service

      • VSSVC.exe (PID: 7000)

    • Creates a software uninstall entry

      • 2025-04-06_19457e39c266a4e7ced4b9d8e39f24de_amadey_rhadamanthys_smoke-loader_swisyn.exe  (PID: 900)

    • Reads the Windows owner or organization settings

      • msiexec.exe (PID: 7232)

    • Reads security settings of Internet Explorer

      • 2025-04-06_19457e39c266a4e7ced4b9d8e39f24de_amadey_rhadamanthys_smoke-loader_swisyn.exe  (PID: 900)

    • Creates or modifies Windows services

      • svchost.exe (PID: 7020)

  • INFO

    • Checks supported languages

      • 2025-04-06_19457e39c266a4e7ced4b9d8e39f24de_amadey_rhadamanthys_smoke-loader_swisyn.exe (PID: 4696)
      • 2025-04-06_19457e39c266a4e7ced4b9d8e39f24de_amadey_rhadamanthys_smoke-loader_swisyn.exe  (PID: 900)
      • 2025-04-06_19457e39c266a4e7ced4b9d8e39f24de_amadey_rhadamanthys_smoke-loader_swisyn.exe  (PID: 744)
      • icsys.icn.exe (PID: 960)
      • explorer.exe (PID: 6872)
      • spoolsv.exe (PID: 6572)
      • svchost.exe (PID: 7020)
      • spoolsv.exe (PID: 1188)
      • msiexec.exe (PID: 7232)

    • The sample compiled with english language support

      • 2025-04-06_19457e39c266a4e7ced4b9d8e39f24de_amadey_rhadamanthys_smoke-loader_swisyn.exe (PID: 4696)
      • 2025-04-06_19457e39c266a4e7ced4b9d8e39f24de_amadey_rhadamanthys_smoke-loader_swisyn.exe  (PID: 744)
      • 2025-04-06_19457e39c266a4e7ced4b9d8e39f24de_amadey_rhadamanthys_smoke-loader_swisyn.exe  (PID: 900)
      • msiexec.exe (PID: 7232)

    • Create files in a temporary directory

      • 2025-04-06_19457e39c266a4e7ced4b9d8e39f24de_amadey_rhadamanthys_smoke-loader_swisyn.exe (PID: 4696)
      • icsys.icn.exe (PID: 960)
      • explorer.exe (PID: 6872)
      • svchost.exe (PID: 7020)
      • spoolsv.exe (PID: 6572)
      • 2025-04-06_19457e39c266a4e7ced4b9d8e39f24de_amadey_rhadamanthys_smoke-loader_swisyn.exe  (PID: 744)
      • spoolsv.exe (PID: 1188)
      • 2025-04-06_19457e39c266a4e7ced4b9d8e39f24de_amadey_rhadamanthys_smoke-loader_swisyn.exe  (PID: 900)

    • Reads the computer name

      • 2025-04-06_19457e39c266a4e7ced4b9d8e39f24de_amadey_rhadamanthys_smoke-loader_swisyn.exe  (PID: 744)
      • 2025-04-06_19457e39c266a4e7ced4b9d8e39f24de_amadey_rhadamanthys_smoke-loader_swisyn.exe  (PID: 900)
      • svchost.exe (PID: 7020)
      • msiexec.exe (PID: 7232)

    • Manages system restore points

      • SrTasks.exe (PID: 3096)

    • Reads the machine GUID from the registry

      • 2025-04-06_19457e39c266a4e7ced4b9d8e39f24de_amadey_rhadamanthys_smoke-loader_swisyn.exe  (PID: 900)
      • msiexec.exe (PID: 7232)

    • Reads the software policy settings

      • 2025-04-06_19457e39c266a4e7ced4b9d8e39f24de_amadey_rhadamanthys_smoke-loader_swisyn.exe  (PID: 900)
      • msiexec.exe (PID: 7232)
      • slui.exe (PID: 7504)

    • Creates files or folders in the user directory

      • 2025-04-06_19457e39c266a4e7ced4b9d8e39f24de_amadey_rhadamanthys_smoke-loader_swisyn.exe  (PID: 900)

    • Checks proxy server information

      • 2025-04-06_19457e39c266a4e7ced4b9d8e39f24de_amadey_rhadamanthys_smoke-loader_swisyn.exe  (PID: 900)
      • slui.exe (PID: 7504)

    • Creates a software uninstall entry

      • msiexec.exe (PID: 7232)

    • The sample compiled with chinese language support

      • msiexec.exe (PID: 7232)

    • The sample compiled with spanish language support

      • msiexec.exe (PID: 7232)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 7232)

    • The sample compiled with german language support

      • msiexec.exe (PID: 7232)

    • Creates files in the program directory

      • 2025-04-06_19457e39c266a4e7ced4b9d8e39f24de_amadey_rhadamanthys_smoke-loader_swisyn.exe  (PID: 900)

    • The sample compiled with korean language support

      • msiexec.exe (PID: 7232)

    • The sample compiled with russian language support

      • msiexec.exe (PID: 7232)

    • The sample compiled with french language support

      • msiexec.exe (PID: 7232)

    • The sample compiled with Italian language support

      • msiexec.exe (PID: 7232)

    • The sample compiled with japanese language support

      • msiexec.exe (PID: 7232)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (52.9)
.exe | Generic Win/DOS Executable (23.5)
.exe | DOS Executable Generic (23.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2013:04:01 07:08:22+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 106496
InitializedDataSize: 12288
UninitializedDataSize: -
EntryPoint: 0x290c
OSVersion: 4
ImageVersion: 1
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.0
ProductVersionNumber: 1.0.0.0
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
ProductName: Project1
FileVersion: 1
ProductVersion: 1
InternalName: TJprojMain
OriginalFileName: TJprojMain.exe
No data.
screenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
143
Monitored processes
15
Malicious processes
8
Suspicious processes
1

Behavior graph

Click at the process to see the details
start #JEEFO 2025-04-06_19457e39c266a4e7ced4b9d8e39f24de_amadey_rhadamanthys_smoke-loader_swisyn.exe 2025-04-06_19457e39c266a4e7ced4b9d8e39f24de_amadey_rhadamanthys_smoke-loader_swisyn.exe  2025-04-06_19457e39c266a4e7ced4b9d8e39f24de_amadey_rhadamanthys_smoke-loader_swisyn.exe  #JEEFO icsys.icn.exe #JEEFO explorer.exe spoolsv.exe #JEEFO svchost.exe spoolsv.exe no specs SPPSurrogate no specs vssvc.exe no specs srtasks.exe no specs conhost.exe no specs msiexec.exe slui.exe 2025-04-06_19457e39c266a4e7ced4b9d8e39f24de_amadey_rhadamanthys_smoke-loader_swisyn.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
744"c:\users\admin\desktop\2025-04-06_19457e39c266a4e7ced4b9d8e39f24de_amadey_rhadamanthys_smoke-loader_swisyn.exe " -burn.unelevated BurnPipe.{CC4F444C-961C-4633-B4EC-0F2B82321696} {BDA5AA8E-ED9D-4A1C-96BF-437D8A628A0F} 900C:\Users\admin\Desktop\2025-04-06_19457e39c266a4e7ced4b9d8e39f24de_amadey_rhadamanthys_smoke-loader_swisyn.exe 
2025-04-06_19457e39c266a4e7ced4b9d8e39f24de_amadey_rhadamanthys_smoke-loader_swisyn.exe 
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030
Exit code:
0
Version:
11.0.61030.0
Modules
Images
c:\users\admin\desktop\2025-04-06_19457e39c266a4e7ced4b9d8e39f24de_amadey_rhadamanthys_smoke-loader_swisyn.exe 
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shell32.dll
900c:\users\admin\desktop\2025-04-06_19457e39c266a4e7ced4b9d8e39f24de_amadey_rhadamanthys_smoke-loader_swisyn.exe  C:\Users\admin\Desktop\2025-04-06_19457e39c266a4e7ced4b9d8e39f24de_amadey_rhadamanthys_smoke-loader_swisyn.exe 
2025-04-06_19457e39c266a4e7ced4b9d8e39f24de_amadey_rhadamanthys_smoke-loader_swisyn.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030
Exit code:
0
Version:
11.0.61030.0
Modules
Images
c:\users\admin\desktop\2025-04-06_19457e39c266a4e7ced4b9d8e39f24de_amadey_rhadamanthys_smoke-loader_swisyn.exe 
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shell32.dll
960C:\Windows\Resources\Themes\icsys.icn.exeC:\Windows\Resources\Themes\icsys.icn.exe
2025-04-06_19457e39c266a4e7ced4b9d8e39f24de_amadey_rhadamanthys_smoke-loader_swisyn.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Version:
1.00
Modules
Images
c:\windows\resources\themes\icsys.icn.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvbvm60.dll
1188c:\windows\resources\spoolsv.exe PRC:\Windows\Resources\spoolsv.exe—svchost.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Version:
1.00
Modules
Images
c:\windows\resources\spoolsv.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvbvm60.dll
3096C:\WINDOWS\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:11C:\Windows\System32\SrTasks.exe—dllhost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft® Windows System Protection background tasks.
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\srtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
4696"C:\Users\admin\Desktop\2025-04-06_19457e39c266a4e7ced4b9d8e39f24de_amadey_rhadamanthys_smoke-loader_swisyn.exe" C:\Users\admin\Desktop\2025-04-06_19457e39c266a4e7ced4b9d8e39f24de_amadey_rhadamanthys_smoke-loader_swisyn.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Version:
1.00
Modules
Images
c:\users\admin\desktop\2025-04-06_19457e39c266a4e7ced4b9d8e39f24de_amadey_rhadamanthys_smoke-loader_swisyn.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvbvm60.dll
5364\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—SrTasks.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6272"C:\Users\admin\Desktop\2025-04-06_19457e39c266a4e7ced4b9d8e39f24de_amadey_rhadamanthys_smoke-loader_swisyn.exe" C:\Users\admin\Desktop\2025-04-06_19457e39c266a4e7ced4b9d8e39f24de_amadey_rhadamanthys_smoke-loader_swisyn.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Version:
1.00
Modules
Images
c:\users\admin\desktop\2025-04-06_19457e39c266a4e7ced4b9d8e39f24de_amadey_rhadamanthys_smoke-loader_swisyn.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
6572c:\windows\resources\spoolsv.exe SEC:\Windows\Resources\spoolsv.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Version:
1.00
Modules
Images
c:\windows\resources\spoolsv.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvbvm60.dll
6872c:\windows\resources\themes\explorer.exeC:\Windows\Resources\Themes\explorer.exe
icsys.icn.exe
User:
admin
Integrity Level:
HIGH
Version:
1.00
Modules
Images
c:\windows\resources\themes\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvbvm60.dll
Total events
14 688
Read events
14 056
Write events
593
Delete events
39

Modification events

(PID) Process:(4696) 2025-04-06_19457e39c266a4e7ced4b9d8e39f24de_amadey_rhadamanthys_smoke-loader_swisyn.exeKey:HKEY_CURRENT_USER\SOFTWARE\VB and VBA Program Settings\Explorer\Process
Operation:writeName:LO
Value:
1
(PID) Process:(960) icsys.icn.exeKey:HKEY_CURRENT_USER\SOFTWARE\VB and VBA Program Settings\Explorer\Process
Operation:writeName:LO
Value:
1
(PID) Process:(6872) explorer.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce
Operation:writeName:Explorer
Value:
c:\windows\resources\themes\explorer.exe RO
(PID) Process:(6872) explorer.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce
Operation:writeName:Svchost
Value:
c:\windows\resources\svchost.exe RO
(PID) Process:(6872) explorer.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run
Operation:delete valueName:Explorer
Value:
(PID) Process:(6872) explorer.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run
Operation:delete valueName:Svchost
Value:
(PID) Process:(7020) svchost.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce
Operation:writeName:Explorer
Value:
c:\windows\resources\themes\explorer.exe RO
(PID) Process:(7020) svchost.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce
Operation:writeName:Svchost
Value:
c:\windows\resources\svchost.exe RO
(PID) Process:(7020) svchost.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run
Operation:delete valueName:Explorer
Value:
(PID) Process:(7020) svchost.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run
Operation:delete valueName:Svchost
Value:
Executable files
30
Suspicious files
50
Text files
7
Unknown types
0

Dropped files

PID
Process
Filename
Type
7148dllhost.exeC:\System Volume Information\SPP\metadata-2 —
MD5:—
SHA256:—
46962025-04-06_19457e39c266a4e7ced4b9d8e39f24de_amadey_rhadamanthys_smoke-loader_swisyn.exeC:\Users\admin\Desktop\2025-04-06_19457e39c266a4e7ced4b9d8e39f24de_amadey_rhadamanthys_smoke-loader_swisyn.exe executable
MD5:7F52A19ECAF7DB3C163DD164BE3E592E
SHA256:B924AD8062EAF4E70437C8BE50FA612162795FF0839479546CE907FFA8D6E386
7442025-04-06_19457e39c266a4e7ced4b9d8e39f24de_amadey_rhadamanthys_smoke-loader_swisyn.exe C:\Users\admin\AppData\Local\Temp\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\.ba1\logo.pngimage
MD5:D6BD210F227442B3362493D046CEA233
SHA256:335A256D4779EC5DCF283D007FB56FD8211BBCAF47DCD70FE60DED6A112744EF
7442025-04-06_19457e39c266a4e7ced4b9d8e39f24de_amadey_rhadamanthys_smoke-loader_swisyn.exe C:\Users\admin\AppData\Local\Temp\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\.ba1\thm.wxlxml
MD5:FBFCBC4DACC566A3C426F43CE10907B6
SHA256:70400F181D00E1769774FF36BCD8B1AB5FBC431418067D31B876D18CC04EF4CE
6572spoolsv.exeC:\Users\admin\AppData\Local\Temp\~DFB6A3929846772FDC.TMPbinary
MD5:8168A8893507932662535292C7A4F3F2
SHA256:71DFFBFEF195F092F2D61BCE9750199B76CF71A03E4B114D8BC28CCEBAD6A37F
7442025-04-06_19457e39c266a4e7ced4b9d8e39f24de_amadey_rhadamanthys_smoke-loader_swisyn.exe C:\Users\admin\AppData\Local\Temp\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\cabB3E1576D1FEFBB979E13B1A5379E0B16 —
MD5:—
SHA256:—
7442025-04-06_19457e39c266a4e7ced4b9d8e39f24de_amadey_rhadamanthys_smoke-loader_swisyn.exe C:\Users\admin\AppData\Local\Temp\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\.ba1\BootstrapperApplicationData.xmlxml
MD5:6182F3BB2D861DC04D0EA55F3BA4FFED
SHA256:EF0085C0476FBE4D6D170C6909F4AD35762FB05E125E9ED707B3C413AE6BBC74
7442025-04-06_19457e39c266a4e7ced4b9d8e39f24de_amadey_rhadamanthys_smoke-loader_swisyn.exe C:\Users\admin\AppData\Local\Temp\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\.ba1\license.rtftext
MD5:E9F84E5EF16D918FAA9A5425B4B041CF
SHA256:5B7BD9AD76C8DF8E2C496B3DCEFC9FE3750DCCC48FB416126605ED3FB208F55A
7148dllhost.exeC:\System Volume Information\SPP\OnlineMetadataCache\{063852a8-cf6a-4e71-9b15-1c87cb30ed16}_OnDiskSnapshotPropbinary
MD5:B9CC6C2CA9AC2B57D59226BACD898C5A
SHA256:C73B2B50E12F7FA34789E78504C56AD2895D896ED0FBA2CC6CFB063D6272CDE0
1188spoolsv.exeC:\Users\admin\AppData\Local\Temp\~DF418C1EC0F391E7A3.TMPbinary
MD5:BAE8C122B3CEAD242A5FDC56B013DC2C
SHA256:0C2D2F12AA02DBE69679E78D81DD4974FB5EFB5E116BC3E8E4B921B31CB4A8AC
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
37
TCP/UDP connections
52
DNS requests
15
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
304
20.12.23.50:443
https://slscr.update.microsoft.com/SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
unknown
—
—
—
900
2025-04-06_19457e39c266a4e7ced4b9d8e39f24de_amadey_rhadamanthys_smoke-loader_swisyn.exe 
GET
200
2.16.164.120:80
http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl
unknown
—
—
whitelisted
900
2025-04-06_19457e39c266a4e7ced4b9d8e39f24de_amadey_rhadamanthys_smoke-loader_swisyn.exe 
GET
200
2.16.164.120:80
http://crl.microsoft.com/pki/crl/products/MicCodSigPCA_08-31-2010.crl
unknown
—
—
whitelisted
900
2025-04-06_19457e39c266a4e7ced4b9d8e39f24de_amadey_rhadamanthys_smoke-loader_swisyn.exe 
GET
200
2.16.164.120:80
http://crl.microsoft.com/pki/crl/products/MicrosoftTimeStampPCA.crl
unknown
—
—
whitelisted
5084
SIHClient.exe
GET
200
2.16.164.120:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5084
SIHClient.exe
GET
200
2.16.164.120:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl
unknown
—
—
whitelisted
5084
SIHClient.exe
GET
200
2.16.164.120:80
http://crl.microsoft.com/pki/crl/products/MicTimStaPCA_2010-07-01.crl
unknown
—
—
whitelisted
5084
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%202.1.crl
unknown
—
—
whitelisted
5084
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
5084
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Signing%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
20.7.1.246:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
3216
svchost.exe
20.7.1.246:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
5452
svchost.exe
95.100.186.9:443
go.microsoft.com
AKAMAI-AS
FR
whitelisted
900
2025-04-06_19457e39c266a4e7ced4b9d8e39f24de_amadey_rhadamanthys_smoke-loader_swisyn.exe 
2.16.164.120:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
5084
SIHClient.exe
172.202.163.200:443
slscr.update.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
GB
whitelisted
5084
SIHClient.exe
2.16.164.120:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
5084
SIHClient.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
whitelisted
google.com
  • 172.217.16.142
whitelisted
client.wns.windows.com
  • 20.7.1.246
whitelisted
go.microsoft.com
  • 95.100.186.9
whitelisted
crl.microsoft.com
  • 2.16.164.120
  • 2.16.164.49
whitelisted
slscr.update.microsoft.com
  • 172.202.163.200
whitelisted
www.microsoft.com
  • 95.101.149.131
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 40.69.42.241
whitelisted
activation-v2.sls.microsoft.com
  • 40.91.76.224
whitelisted
login.live.com
  • 20.190.159.131
  • 20.190.159.71
  • 40.126.31.73
  • 40.126.31.128
  • 40.126.31.129
  • 20.190.159.75
  • 20.190.159.64
  • 20.190.159.23
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
2025-04-06_19457e39c266a4e7ced4b9d8e39f24de_amadey_rhadamanthys_smoke-loader_swisyn