| URL: | https://icedrive.net/s/AGufDbTFSbgAz9v9SzxYYkk3yPBP |
| Full analysis: | https://app.any.run/tasks/799a115e-f3bf-4b62-b6e5-74cffb17522f |
| Verdict: | Malicious activity |
| Threats: | Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns. |
| Analysis date: | August 08, 2025, 18:12:48 |
| OS: | Windows 10 Professional (build: 19044, 64 bit) |
| Tags: | |
| Indicators: | |
| MD5: | BE78C52CB614D1937F1A1B8EDB00699B |
| SHA1: | 0D68BBB2D58119D68299BE62514D226380158799 |
| SHA256: | 5B160600AB6600C92C06D140DC3DC2231AD5B6E634648ED2589E1B222E353EFE |
| SSDEEP: | 3:N82LmvXj2HCXbhWcHn:2LXj2HCLhWa |
MALICIOUS
Connects to the CnC server
- F1 The Movie 2025 1080p HD x264-RGB.scr (PID: 1816)
AUROTUN mutex has been found
- F1 The Movie 2025 1080p HD x264-RGB.scr (PID: 1816)
SUSPICIOUS
Starts application with an unusual extension
- msedge.exe (PID: 1652)
- dllhost.exe (PID: 5968)
Connects to unusual port
- F1 The Movie 2025 1080p HD x264-RGB.scr (PID: 1816)
Checks for external IP
- F1 The Movie 2025 1080p HD x264-RGB.scr (PID: 1816)
- svchost.exe (PID: 2200)
INFO
Reads the computer name
- identity_helper.exe (PID: 7604)
- F1 The Movie 2025 1080p HD x264-RGB.scr (PID: 4048)
- F1 The Movie 2025 1080p HD x264-RGB.scr (PID: 1816)
Reads Environment values
- identity_helper.exe (PID: 7604)
Checks supported languages
- identity_helper.exe (PID: 7604)
- F1 The Movie 2025 1080p HD x264-RGB.scr (PID: 4048)
- F1 The Movie 2025 1080p HD x264-RGB.scr (PID: 1816)
Application launched itself
- msedge.exe (PID: 1652)
Reads the software policy settings
- slui.exe (PID: 7552)
- dllhost.exe (PID: 5968)
Checks proxy server information
- slui.exe (PID: 7552)
Reads the machine GUID from the registry
- F1 The Movie 2025 1080p HD x264-RGB.scr (PID: 4048)
- F1 The Movie 2025 1080p HD x264-RGB.scr (PID: 1816)
Process checks computer location settings
- F1 The Movie 2025 1080p HD x264-RGB.scr (PID: 4048)
- F1 The Movie 2025 1080p HD x264-RGB.scr (PID: 1816)
Checks transactions between databases Windows and Oracle
- F1 The Movie 2025 1080p HD x264-RGB.scr (PID: 4048)
Reads security settings of Internet Explorer
- dllhost.exe (PID: 5968)
Executable content was dropped or overwritten
- msedge.exe (PID: 1652)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
Total processes
190
Monitored processes
43
Malicious processes
5
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 1160 | "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --disable-quic --string-annotations --always-read-main-dll --field-trial-handle=2780,i,11639557501546884146,11454386415067352149,262144 --variations-seed-version --mojo-platform-channel-handle=2588 /prefetch:8 | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Version: 133.0.3065.92 Modules
| |||||||||||||||
| 1652 | "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --from-ie-to-edge=8 -- "https://icedrive.net/s/AGufDbTFSbgAz9v9SzxYYkk3yPBP" | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | iexplore.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Edge Version: 133.0.3065.92 Modules
| |||||||||||||||
| 1816 | "C:\Users\admin\Downloads\F1 The Movie 2025 1080p HD x264-RGB.scr" /S | C:\Users\admin\Downloads\F1 The Movie 2025 1080p HD x264-RGB.scr | dllhost.exe | ||||||||||||
User: admin Company: 江苏蒸汽凡星科技有限公司 Integrity Level: HIGH Description: Watt Toolkit Version: 3.0.1620.0 Modules
| |||||||||||||||
| 1944 | "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.142 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.92 --initial-client-data=0x294,0x298,0x29c,0x28c,0x2a4,0x7ffc4340f208,0x7ffc4340f214,0x7ffc4340f220 | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Edge Version: 133.0.3065.92 Modules
| |||||||||||||||
| 2108 | "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --disable-quic --string-annotations --always-read-main-dll --field-trial-handle=2132,i,11639557501546884146,11454386415067352149,262144 --variations-seed-version --mojo-platform-channel-handle=2424 /prefetch:3 | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | msedge.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Edge Version: 133.0.3065.92 Modules
| |||||||||||||||
| 2200 | C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s Dnscache | C:\Windows\System32\svchost.exe | services.exe | ||||||||||||
User: NETWORK SERVICE Company: Microsoft Corporation Integrity Level: SYSTEM Description: Host Process for Windows Services Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 3100 | "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2320,i,11639557501546884146,11454386415067352149,262144 --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:2 | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Version: 133.0.3065.92 Modules
| |||||||||||||||
| 3652 | "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --disable-quic --string-annotations --always-read-main-dll --field-trial-handle=1328,i,11639557501546884146,11454386415067352149,262144 --variations-seed-version --mojo-platform-channel-handle=5976 /prefetch:8 | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Exit code: 0 Version: 133.0.3065.92 Modules
| |||||||||||||||
| 3940 | C:\WINDOWS\system32\DllHost.exe /Processid:{3E5FC7F9-9A51-4367-9063-A120244FBEC7} | C:\Windows\System32\dllhost.exe | — | svchost.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: COM Surrogate Exit code: 0 Version: 10.0.19041.3636 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 3964 | "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --disable-quic --string-annotations --always-read-main-dll --field-trial-handle=7928,i,11639557501546884146,11454386415067352149,262144 --variations-seed-version --mojo-platform-channel-handle=7880 /prefetch:8 | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Exit code: 0 Version: 133.0.3065.92 Modules
| |||||||||||||||
Total events
15 083
Read events
15 062
Write events
20
Delete events
1
Modification events
| (PID) Process: | (6268) iexplore.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (6268) iexplore.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (6268) iexplore.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
| (PID) Process: | (6268) iexplore.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main |
| Operation: | write | Name: | CompatibilityFlags |
Value: 0 | |||
| (PID) Process: | (6268) iexplore.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones |
| Operation: | write | Name: | SecuritySafe |
Value: 1 | |||
| (PID) Process: | (6268) iexplore.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main |
| Operation: | write | Name: | DisableFirstRunCustomize |
Value: 1 | |||
| (PID) Process: | (1652) msedge.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon |
| Operation: | write | Name: | failed_count |
Value: 0 | |||
| (PID) Process: | (1652) msedge.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon |
| Operation: | write | Name: | state |
Value: 2 | |||
| (PID) Process: | (1652) msedge.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon |
| Operation: | write | Name: | state |
Value: 1 | |||
| (PID) Process: | (1652) msedge.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\StabilityMetrics |
| Operation: | write | Name: | user_experience_metrics.stability.exited_cleanly |
Value: 0 | |||
Executable files
2
Suspicious files
295
Text files
73
Unknown types
43
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 1652 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\discounts_db\LOG.old~RF18dc32.TMP | — | |
MD5:— | SHA256:— | |||
| 1652 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\discounts_db\LOG.old | — | |
MD5:— | SHA256:— | |||
| 1652 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old~RF18dc61.TMP | — | |
MD5:— | SHA256:— | |||
| 1652 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old | — | |
MD5:— | SHA256:— | |||
| 1652 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\ClientCertificates\LOG.old~RF18dc32.TMP | — | |
MD5:— | SHA256:— | |||
| 1652 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\parcel_tracking_db\LOG.old~RF18dc70.TMP | — | |
MD5:— | SHA256:— | |||
| 1652 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\parcel_tracking_db\LOG.old | — | |
MD5:— | SHA256:— | |||
| 1652 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\PersistentOriginTrials\LOG.old~RF18dc70.TMP | — | |
MD5:— | SHA256:— | |||
| 1652 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\LOG.old~RF18dc61.TMP | — | |
MD5:— | SHA256:— | |||
| 1652 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\PersistentOriginTrials\LOG.old | — | |
MD5:— | SHA256:— | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
29
TCP/UDP connections
90
DNS requests
95
Threats
34
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
1268 | svchost.exe | GET | 200 | 23.216.77.37:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | DE | binary | 825 b | whitelisted |
2108 | msedge.exe | GET | 200 | 150.171.27.11:80 | http://edge.microsoft.com/browsernetworktime/time/1/current?cup2key=2:YHV_iCMxUJAbjLJ5CnS1V4Z87v8Y-T59jqoxZHVu6NM&cup2hreq=e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 | US | text | 100 b | whitelisted |
5500 | svchost.exe | GET | 200 | 184.30.131.245:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | US | binary | 471 b | whitelisted |
1268 | svchost.exe | GET | 200 | 23.32.97.216:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | SE | binary | 814 b | whitelisted |
4580 | SIHClient.exe | GET | 200 | 23.32.97.216:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | SE | binary | 420 b | whitelisted |
4744 | svchost.exe | HEAD | 200 | 217.20.57.18:80 | http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/bf8090eb-6e5c-4c51-9250-5bf9b46cf160?P1=1755196408&P2=404&P3=2&P4=D%2b1KfXQTuqKWroqAQW5anuorLgSk%2fM2c%2bHBYWS6cIOZTVeCFzuDrPPGaN1p5CdNPHEycP7ATmcyAwFcirwGm1w%3d%3d | US | — | — | whitelisted |
4580 | SIHClient.exe | GET | 200 | 23.32.97.216:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | SE | binary | 408 b | whitelisted |
4744 | svchost.exe | GET | 206 | 217.20.57.18:80 | http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/bf8090eb-6e5c-4c51-9250-5bf9b46cf160?P1=1755196408&P2=404&P3=2&P4=D%2b1KfXQTuqKWroqAQW5anuorLgSk%2fM2c%2bHBYWS6cIOZTVeCFzuDrPPGaN1p5CdNPHEycP7ATmcyAwFcirwGm1w%3d%3d | US | binary | 20 b | whitelisted |
4744 | svchost.exe | GET | 206 | 217.20.57.18:80 | http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/bf8090eb-6e5c-4c51-9250-5bf9b46cf160?P1=1755196408&P2=404&P3=2&P4=D%2b1KfXQTuqKWroqAQW5anuorLgSk%2fM2c%2bHBYWS6cIOZTVeCFzuDrPPGaN1p5CdNPHEycP7ATmcyAwFcirwGm1w%3d%3d | US | binary | 1.09 Kb | whitelisted |
4744 | svchost.exe | GET | 206 | 217.20.57.18:80 | http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/bf8090eb-6e5c-4c51-9250-5bf9b46cf160?P1=1755196408&P2=404&P3=2&P4=D%2b1KfXQTuqKWroqAQW5anuorLgSk%2fM2c%2bHBYWS6cIOZTVeCFzuDrPPGaN1p5CdNPHEycP7ATmcyAwFcirwGm1w%3d%3d | US | binary | 224 b | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
5944 | MoUsoCoreWorker.exe | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
1268 | svchost.exe | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
4196 | RUXIMICS.exe | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
2108 | msedge.exe | 150.171.27.11:80 | edge.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
2108 | msedge.exe | 150.171.22.17:443 | config.edge.skype.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
2108 | msedge.exe | 150.171.27.11:443 | edge.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
2108 | msedge.exe | 172.66.145.218:443 | icedrive.net | — | US | suspicious |
2108 | msedge.exe | 92.123.104.53:443 | copilot.microsoft.com | Akamai International B.V. | DE | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
icedrive.net |
| unknown |
edge.microsoft.com |
| whitelisted |
config.edge.skype.com |
| whitelisted |
copilot.microsoft.com |
| whitelisted |
www.bing.com |
| whitelisted |
cdn.icedrive.net |
| unknown |
xpaywalletcdn.azureedge.net |
| whitelisted |
update.googleapis.com |
| whitelisted |
Threats
PID | Process | Class | Message |
|---|---|---|---|
2200 | svchost.exe | Misc activity | ET INFO FileSharing Service in DNS Lookup (icedrive .net) |
2108 | msedge.exe | Misc activity | ET INFO FileSharing Service in DNS Lookup (icedrive .net) |
2108 | msedge.exe | Misc activity | ET INFO FileSharing Service in DNS Lookup (icedrive .net) |
2108 | msedge.exe | Misc activity | ET INFO Observed FileSharing Service Domain (icedrive .net) in TLS SNI |
2108 | msedge.exe | Misc activity | ET INFO Observed FileSharing Service Domain (icedrive .net) in TLS SNI |
2108 | msedge.exe | Misc activity | ET INFO FileSharing Service in DNS Lookup (icedrive .net) |
2108 | msedge.exe | Misc activity | ET INFO FileSharing Service in DNS Lookup (icedrive .net) |
2108 | msedge.exe | Misc activity | ET INFO FileSharing Service in DNS Lookup (icedrive .net) |
2108 | msedge.exe | Misc activity | ET INFO FileSharing Service in DNS Lookup (icedrive .net) |
2108 | msedge.exe | Misc activity | ET INFO Observed FileSharing Service Domain (icedrive .net) in TLS SNI |