File name:

2025-07-18_1a3306b3b59a1daf9790238edebcfe65_amadey_elex_rhadamanthys_smoke-loader_stop.exe

Full analysis: https://app.any.run/tasks/47c0cf75-47e1-4fbe-b831-51cefa7fb390
Verdict: Malicious activity
Analysis date: July 18, 2025, 08:58:49
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
auto-reg
upx
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 4 sections
MD5:

1A3306B3B59A1DAF9790238EDEBCFE65

SHA1:

4561C565C2E288180956B752B85E69F420182C3E

SHA256:

5F4A5D7EE03CE3E93EDDC167372ED2ADFF48A387F4958CE7C2C111D3EA93AAEA

SSDEEP:

49152:5Os7B/A9AQk9pfFOam32PcOdX47Mitu4PRljCM/0HawMC0IFy7/Kkedo+A3euNJ:5Os7B/A9AQ2pXm3hOdoI6GM8HawMBKyv

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • 2025-07-18_1a3306b3b59a1daf9790238edebcfe65_amadey_elex_rhadamanthys_smoke-loader_stop.exe (PID: 5768)

    • Connects to the CnC server

      • 2025-07-18_1a3306b3b59a1daf9790238edebcfe65_amadey_elex_rhadamanthys_smoke-loader_stop.exe (PID: 5768)

  • SUSPICIOUS

    • Contacting a server suspected of hosting an CnC

      • 2025-07-18_1a3306b3b59a1daf9790238edebcfe65_amadey_elex_rhadamanthys_smoke-loader_stop.exe (PID: 5768)

  • INFO

    • Checks supported languages

      • 2025-07-18_1a3306b3b59a1daf9790238edebcfe65_amadey_elex_rhadamanthys_smoke-loader_stop.exe (PID: 5768)
      • 2025-07-18_1a3306b3b59a1daf9790238edebcfe65_amadey_elex_rhadamanthys_smoke-loader_stop.exe (PID: 4412)

    • Reads the computer name

      • 2025-07-18_1a3306b3b59a1daf9790238edebcfe65_amadey_elex_rhadamanthys_smoke-loader_stop.exe (PID: 5768)
      • 2025-07-18_1a3306b3b59a1daf9790238edebcfe65_amadey_elex_rhadamanthys_smoke-loader_stop.exe (PID: 4412)

    • The sample compiled with english language support

      • 2025-07-18_1a3306b3b59a1daf9790238edebcfe65_amadey_elex_rhadamanthys_smoke-loader_stop.exe (PID: 5768)

    • Reads the machine GUID from the registry

      • 2025-07-18_1a3306b3b59a1daf9790238edebcfe65_amadey_elex_rhadamanthys_smoke-loader_stop.exe (PID: 5768)

    • Launching a file from a Registry key

      • 2025-07-18_1a3306b3b59a1daf9790238edebcfe65_amadey_elex_rhadamanthys_smoke-loader_stop.exe (PID: 5768)

    • Manual execution by a user

      • 2025-07-18_1a3306b3b59a1daf9790238edebcfe65_amadey_elex_rhadamanthys_smoke-loader_stop.exe (PID: 4412)

    • UPX packer has been detected

      • 2025-07-18_1a3306b3b59a1daf9790238edebcfe65_amadey_elex_rhadamanthys_smoke-loader_stop.exe (PID: 5768)

    • Checks proxy server information

      • slui.exe (PID: 6748)

    • Reads the software policy settings

      • slui.exe (PID: 6748)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (76.4)
.exe | Win32 Executable (generic) (12.4)
.exe | Generic Win/DOS Executable (5.5)
.exe | DOS Executable Generic (5.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2015:01:28 19:12:18+00:00
ImageFileCharacteristics: No relocs, Executable, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 63488
InitializedDataSize: 1431040
UninitializedDataSize: -
EntryPoint: 0x56ba
OSVersion: 1
ImageVersion: -
SubsystemVersion: 5
Subsystem: Windows GUI
FileVersionNumber: 5.0.0.0
ProductVersionNumber: 5.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
Comments: -
CompanyName: EFD Software
FileDescription: HD Tune Pro
FileVersion: 5, 0, 0, 0
InternalName: HD Tune Pro
LegalCopyright: Copyright (C) 2011
LegalTrademarks: -
OriginalFileName: HDTunePro.EXE
PrivateBuild: -
ProductName: HD Tune Pro
ProductVersion: 5, 0, 0, 0
SpecialBuild: -
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
136
Monitored processes
3
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start 2025-07-18_1a3306b3b59a1daf9790238edebcfe65_amadey_elex_rhadamanthys_smoke-loader_stop.exe 2025-07-18_1a3306b3b59a1daf9790238edebcfe65_amadey_elex_rhadamanthys_smoke-loader_stop.exe no specs slui.exe

Process information

PID
CMD
Path
Indicators
Parent process
4412C:\Users\admin\Desktop\2025-07-18_1a3306b3b59a1daf9790238edebcfe65_amadey_elex_rhadamanthys_smoke-loader_stop.exeC:\Users\admin\Desktop\2025-07-18_1a3306b3b59a1daf9790238edebcfe65_amadey_elex_rhadamanthys_smoke-loader_stop.exe—explorer.exe
User:
admin
Company:
EFD Software
Integrity Level:
MEDIUM
Description:
HD Tune Pro
Exit code:
1701024
Version:
5, 0, 0, 0
Modules
Images
c:\users\admin\desktop\2025-07-18_1a3306b3b59a1daf9790238edebcfe65_amadey_elex_rhadamanthys_smoke-loader_stop.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\user32.dll
c:\windows\syswow64\win32u.dll
5768"C:\Users\admin\Desktop\2025-07-18_1a3306b3b59a1daf9790238edebcfe65_amadey_elex_rhadamanthys_smoke-loader_stop.exe" C:\Users\admin\Desktop\2025-07-18_1a3306b3b59a1daf9790238edebcfe65_amadey_elex_rhadamanthys_smoke-loader_stop.exe
explorer.exe
User:
admin
Company:
EFD Software
Integrity Level:
MEDIUM
Description:
HD Tune Pro
Version:
5, 0, 0, 0
Modules
Images
c:\users\admin\desktop\2025-07-18_1a3306b3b59a1daf9790238edebcfe65_amadey_elex_rhadamanthys_smoke-loader_stop.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
6748C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
Total events
3 964
Read events
3 953
Write events
11
Delete events
0

Modification events

(PID) Process:(5768) 2025-07-18_1a3306b3b59a1daf9790238edebcfe65_amadey_elex_rhadamanthys_smoke-loader_stop.exeKey:HKEY_CURRENT_USER\SOFTWARE\Safer-Networking Ltd.\Spybot 3\Anti-Beacon
Operation:writeName:PersistentLocalizedName
Value:
C880F97F7A06238997E5D9216991F94577ECDABF240851D72D600F109DC437373210AED18C0BE37ECB37F5CE19F5F4750FB9B54D99B0E70BF449CB263BB46CA7205538CB8BFFAB6F4BB671D6DA0789064A1C3DEDBC677F715C989D33D45A1815F5933FAB2BE7F5
(PID) Process:(5768) 2025-07-18_1a3306b3b59a1daf9790238edebcfe65_amadey_elex_rhadamanthys_smoke-loader_stop.exeKey:HKEY_CLASSES_ROOT\Local Settings\ImmutableMuiCache\Strings\52C64B7E
Operation:writeName:activeModifiedTheme
Value:
C880F97F87F73A3D5773015B7AFD0189D038EFEB408A7BB29AB9EFEF1EFFF3BDABBC9CB8B67CF1911BDEF1F4BE6BC803B74047FF69663D516779EC866DB70C195F33415CE624754D84801F7E339B571ABEDCA10B24677F30A14CB72E915D47D7920246F93A87C9
(PID) Process:(5768) 2025-07-18_1a3306b3b59a1daf9790238edebcfe65_amadey_elex_rhadamanthys_smoke-loader_stop.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\ime\IMTC70
Operation:writeName:DefaultCompressedRecord
Value:
C880F97F7316EE08E318E76FF45D31B0EB7097A5A890BF10D285A0CDEB117A5AF5DA19B001F21C0F1B68FF14A5027E17CC8C4EF42B03AC75BD1B91E684FD7A3CEAE73F42D505A336B7A01F705893453E34366320B5677FD8581A9CCA8F94EEC3F346411299D0EB
(PID) Process:(5768) 2025-07-18_1a3306b3b59a1daf9790238edebcfe65_amadey_elex_rhadamanthys_smoke-loader_stop.exeKey:HKEY_CURRENT_USER\SOFTWARE\Safer-Networking Ltd.\Spybot 3\Anti-Beacon
Operation:writeName:LineLoadedQuick
Value:
DIWEXBBzX7+uMerxaU1os5v+gOknOqGd7knBtwogJ/9Hptyod4x/lIYA+fl9oRJl/g==
(PID) Process:(5768) 2025-07-18_1a3306b3b59a1daf9790238edebcfe65_amadey_elex_rhadamanthys_smoke-loader_stop.exeKey:HKEY_CLASSES_ROOT\Local Settings\ImmutableMuiCache\Strings\52C64B7E
Operation:writeName:sizeCompletedValid
Value:
DIWEXBBzX7+uMerxaU1os5v+gOknOqGd7knBtwogJ/9Hptyod4x/lIYA+fl9oRJl/g==
(PID) Process:(5768) 2025-07-18_1a3306b3b59a1daf9790238edebcfe65_amadey_elex_rhadamanthys_smoke-loader_stop.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\ime\IMTC70
Operation:writeName:RecordModifiedMax
Value:
DIWEXBBzX7+uMerxaU1os5v+gOknOqGd7knBtwogJ/9Hptyod4x/lIYA+fl9oRJl/g==
(PID) Process:(5768) 2025-07-18_1a3306b3b59a1daf9790238edebcfe65_amadey_elex_rhadamanthys_smoke-loader_stop.exeKey:HKEY_CURRENT_USER\SOFTWARE\Safer-Networking Ltd.\Spybot 3\Anti-Beacon
Operation:writeName:PlatformCompressedValid
Value:
0000000000000000
(PID) Process:(5768) 2025-07-18_1a3306b3b59a1daf9790238edebcfe65_amadey_elex_rhadamanthys_smoke-loader_stop.exeKey:HKEY_CLASSES_ROOT\Local Settings\ImmutableMuiCache\Strings\52C64B7E
Operation:writeName:infoPlayedCurrent
Value:
0000000000000000
(PID) Process:(5768) 2025-07-18_1a3306b3b59a1daf9790238edebcfe65_amadey_elex_rhadamanthys_smoke-loader_stop.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\ime\IMTC70
Operation:writeName:FlagsModifiedValid
Value:
0000000000000000
(PID) Process:(5768) 2025-07-18_1a3306b3b59a1daf9790238edebcfe65_amadey_elex_rhadamanthys_smoke-loader_stop.exeKey:HKEY_CURRENT_USER\SOFTWARE\Safer-Networking Ltd.\Spybot 3\Anti-Beacon
Operation:writeName:DBSavedUse
Value:
A2494DF3D91E9F880101086A00032504011462000201102E964A046400020110500000006700020120000000000000000070000201400000000000000000000000000000000078000201200000000000000000011462000201105BD3D6056400020110500000006700020120000000000000000070000201400000000000000000000000000000000078000201200000000000000000011462000201106D57F1056400020110500000006700020120000000000000000070000201400000000000000000000000000000000078000201200000000000000000011462000201105D7C1F0764000201105000000067000201200000000000000000700002014000000000000000000000000000000000780002012000000000000000000114620002011025E533076400020110500000006700020120000000000000000070000201400000000000000000000000000000000078000201200000000000000000011462000201103BA1580764000201105000000067000201200000000000000000700002014000000000000000000000000000000000780002012000000000000000000114620002011032A6700864000201105000000067000201200000000000000000700002014000000000000000000000000000000000780002012000000000000000000114620002011018878508640002011050000000670002012000000000000000007000020140000000000000000000000000000000007800020120000000000000000001146200020110B02659096400020110500000006700020120000000000000000070000201400000000000000000000000000000000078000201200000000000000000011462000201106D57F209640002011050000000670002012000000000000000007000020140000000000000000000000000000000007800020120000000000000000001146200020110CBC8750A64000201105000000067000201200000000000000000700002014000000000000000000000000000000000780002012000000000000000000114620002011051A38A0B64000201105000000067000201200000000000000000700002014000000000000000000000000000000000780002012000000000000000000114620002011005698B0B64000201105000000067000201200000000000000000700002014000000000000000000000000000000000780002012000000000000000000114620002011005F8C30B6400020110500000006700020120000000000000000070000201400000000000000000000000000000000078000201200000000000000000011462000201104DF3D30B6400020110500000006700020120000000000000000070000201400000000000000000000000000000000078000201200000000000000000011462000201102E31160C6400020110500000006700020120000000000000000070000201400000000000000000000000000000000078000201200000000000000000011462000201102E37430D6400020110500000006700020120000000000000000070000201400000000000000000000000000000000078000201200000000000000000011462000201104D7AC30D64000201105000000067000201200000000000000000700002014000000000000000000000000000000000780002012000000000000000000114620002011086F9220E6400020110500000006700020120000000000000000070000201400000000000000000000000000000000078000201200000000000000000011462000201105C7329106400020110500000006700020120000000000000000070000201400000000000000000000000000000000078000201200000000000000000011462000201101F2ABD106400020110500000006700020120000000000000000070000201400000000000000000000000000000000078000201200000000000000000011462000201106DA22E116400020110500000006700020120000000000000000070000201400000000000000000000000000000000078000201200000000000000000011462000201105926F41164000201105000000067000201200000000000000000700002014000000000000000000000000000000000780002012000000000000000000114620002011018460612640002011050000000670002012000000000000000007000020140000000000000000000000000000000007800020120000000000000000001146200020110B025D9136400020110500000006700020120000000000000000070000201400000000000000000000000000000000078000201200000000000000000011462000201105EF4B314640002011050000000670002012000000000000000007000020140000000000000000000000000000000007800020120000000000000000001146200020110BC0044156400020110500000006700020120000000000000000070000201400000000000000000000000000000000078000201200000000000000000011462000201102EAD451564000201105000000067000201200000000000000000700002014000000000000000000000000000000000780002012000000000000000000114620002011049A469186400020110500000006700020120000000000000000070000201400000000000000000000000000000000078000201200000000000000000011462000201102ED815196400020110500000006700020120000000000000000070000201400000000000000000000000000000000078000201200000000000000000011462000201102EA04519640002011050000000670002012000000000000000007000020140000000000000000000000000000000007800020120000000000000000001146200020110BC81B719640002011050000000670002012000000000000000007000020140000000000000000000000000000000007800020120000000000000000001146200020110B0080C1B6400020110500000006700020120000000000000000070000201400000000000000000000000000000000078000201200000000000000000011462000201105923CE1B640002011050000000670002012000000000000000007000020140000000000000000000000000000000007800020120000000000000000001146200020110B289491C6400020110500000006700020120000000000000000070000201400000000000000000000000000000000078000201200000000000000000011462000201102E95BC1C6400020110500000006700020120000000000000000070000201400000000000000000000000000000000078000201200000000000000000011462000201100569C51C6400020110500000006700020120000000000000000070000201400000000000000000000000000000000078000201200000000000000000011462000201104742E81D64000201105000000067000201200000000000000000700002014000000000000000000000000000000000780002012000000000000000000114620002011059E6C31E640002011050000000670002012000000000000000007000020140000000000000000000000000000000007800020120000000000000000001146200020110B0F18D246400020110500000006700020120000000000000000070000201400000000000000000000000000000000078000201200000000000000000011462000201102E779E26640002011050000000670002012000000000000000007000020140000000000000000000000000000000007800020120000000000000000001146200020110576E57276400020110500000006700020120000000000000000070000201400000000000000000000000000000000078000201200000000000000000011462000201104D7B2C286400020110500000006700020120000000000000000070000201400000000000000000000000000000000078000201200000000000000000011462000201102EA064296400020110500000006700020120000000000000000070000201400000000000000000000000000000000078000201200000000000000000011462000201102EED7929640002011050000000670002012000000000000000007000020140000000000000000000000000000000007800020120000000000000000001146200020110B077532A640002011050000000670002012000000000000000007000020140000000000000000000000000000000007800020120000000000000000001146200020110BCBFEC2B640002011050000000670002012000000000000000007000020140000000000000000000000000000000007800020120000000000000000001146200020110D56FF02B6400020110500000006700020120000000000000000070000201400000000000000000000000000000000078000201200000000000000000011462000201105DB7F02E6400020110500000006700020120000000000000000070000201400000000000000000000000000000000078000201200000000000000000011462000201105DAA77316400020110500000006700020120000000000000000070000201400000000000000000000000000000000078000201200000000000000000011462000201102E664832640002011050000000670002012000000000000000007000020140000000000000000000000000000000007800020120000000000000000001146200020110B06B593264000201105000000067000201200000000000000000700002014000000000000000000000000000000000780002012000000000000000000114620002011001A337336400020110500000006700020120000000000000000070000201400000000000000000000000000000000078000201200000000000000000011462000201102E7647346400020110500000006700020120000000000000000070000201400000000000000000000000000000000078000201200000000000000000011462000201105D7E72346400020110500000006700020120000000000000000070000201400000000000000000000000000000000078000201200000000000000000011462000201104C4986356400020110500000006700020120000000000000000070000201400000000000000000000000000000000078000201200000000000000000011462000201101FAA9E37640002011050000000670002012000000000000000007000020140000000000000000000000000000000007800020120000000000000000001146200020110592941396400020110500000006700020120000000000000000070000201400000000000000000000000000000000078000201200000000000000000011462000201105D4D6B396400020110500000006700020120000000000000000070000201400000000000000000000000000000000078000201200000000000000000011462000201102ED376396400020110500000006700020120000000000000000070000201400000000000000000000000000000000078000201200000000000000000011462000201105EF8203A6400020110500000006700020120000000000000000070000201400000000000000000000000000000000078000201200000000000000000011462000201105669003B6400020110500000006700020120000000000000000070000201400000000000000000000000000000000078000201200000000000000000011462000201106D567B3C6400020110500000006700020120000000000000000070000201400000000000000000000000000000000078000201200000000000000000011462000201105BFA0E3D640002011050000000670002012000000000000000007000020140000000000000000000000000000000007800020120000000000000000001146200020110B25F463D6400020110500000006700020120000000000000000070000201400000000000000000000000000000000078000201200000000000000000011462000201105C2633406400020110500000006700020120000000000000000070000201400000000000000000000000000000000078000201200000000000000000011462000201102ED6A4416400020110500000006700020120000000000000000070000201400000000000000000000000000000000078000201200000000000000000011462000201101F297642640002011050000000670002012000000000000000007000020140000000000000000000000000000000007800020120000000000000000001146200020110B024FA42640002011050000000670002012000000000000000007000020140000000000000000000000000000000007800020120000000000000000001146200020110D9085044640002011050000000670002012000000000000000007000020140000000000000000000000000000000007800020120000000000000000001146200020110BE342E456400020110500000006700020120000000000000000070000201400000000000000000000000000000000078000201200000000000000000011462000201102EFA7345640002011050000000670002012000000000000000007000020140000000000000000000000000000000007800020120000000000000000001146200020110BCBED346640002011050000000670002012000000000000000007000020140000000000000000000000000000000007800020120000000000000000001146200020110C33CAE476400020110500000006700020120000000000000000070000201400000000000000000000000000000000078000201200000000000000000011462000201101FCCBC486400020110500000006700020120000000000000000070000201400000000000000000000000000000000078000201200000000000000000011462000201106D564F4B640002011050000000670002012000000000000000007000020140000000000000000000000000000000007800020120000000000000000001146200020110C8BC824B64000201105000000067000201200000000000000000700002014000000000000000000000000000000000780002012000000000000000000114620002011005691B4E6400020110500000006700020120000000000000000070000201400000000000000000000000000000000078000201200000000000000000011462000201102E31004F6400020110500000006700020120000000000000000070000201400000000000000000000000000000000078000201200000000000000000011462000201102E82555264000201105000000067000201200000000000000000700002014000000000000000000000000000000000780002012000000000000000000114620002011054EDB2526400020110500000006700020120000000000000000070000201400000000000000000000000000000000078000201200000000000000000011462000201102E3135536400020110500000006700020120000000000000000070000201400000000000000000000000000000000078000201200000000000000000011462000201105D4F3554640002011050000000670002012000000000000000007000020140000000000000000000000000000000007800020120000000000000000001146200020110D9AF52556400020110500000006700020120000000000000000070000201400000000000000000000000000000000078000201200000000000000000011462000201106DB9E2566400020110500000006700020120000000000000000070000201400000000000000000000000000000000078000201200000000000000000011462000201108613F8566400020110500000006700020120000000000000000070000201400000000000000000000000000000000078000201200000000000000000011462000201102E9609586400020110500000006700020120000000000000000070000201400000000000000000000000000000000078000201200000000000000000011462000201104BE70C58640002011050000000670002012000000000000000007000020140000000000000000000000000000000007800020120000000000000000001146200020110B008345864000201105000000067000201200000000000000000700002014000000000000000000000000000000000780002012000000000000000000114620002011025E57F586400020110500000006700020120000000000000000070000201400000000000000000000000000000000078000201200000000000000000011462000201105D4EB9596400020110500000006700020120000000000000000070000201400000000000000000000000000000000078000201200000000000000000011462000201105E993F5A640002011050000000670002012000000000000000007000020140000000000000000000000000000000007800020120000000000000000001146200020110BCF06F5A6400020110500000006700020120000000000000000070000201400000000000000000000000000000000078000201200000000000000000011462000201108D885C5B640002011050000000670002012000000000000000007000020140000000000000000000000000000000007800020120000000000000000001146200020110C21C075C6400020110500000006700020120000000000000000070000201400000000000000000000000000000000078000201200000000000000000011462000201105ECAC55E6400020110500000006700020120000000000000000070000201400000000000000000000000000000000078000201200000000000000000011462000201105ECD01616400020110500000006700020120000000000000000070000201400000000000000000000000000000000078000201200000000000000000011462000201104E081764640002011050000000670002012000000000000000007000020140000000000000000000000000000000007800020120000000000000000001146200020110B289596464000201105000000067000201200000000000000000700002014000000000000000000000000000000000780002012000000000000000000114620002011059FE8464640002011050000000670002012000000000000000007000020140000000000000000000000000000000007800020120000000000000000001146200020110B024C56464000201105000000067000201200000000000000000700002014000000000000000000000000000000000780002012000000000000000000114620002011001E8F06464000201105000000067000201200000000000000000700002014000000000000000000000000000000000780002012000000000000000000114620002011025FC536564000201105000000067000201200000000000000000700002014000000000000000000000000000000000780002012000000000000000000114620002011055789165640002011050000000670002012000000000000000007000020140000000000000000000000000000000007800020120000000000000000001146200020110BC8AB96864000201105000000067000201200000000000000000700002014000000000000000000000000000000000780002012000000000000000000114620002011005692B696400020110500000006700020120000000000000000070000201400000000000000000000000000000000078000201200000000000000000011462000201106025E56964000201105000000067000201200000000000000000700002014000000000000000000000000000000000780002012000000000000000000114620002011005F8356A6400020110500000006700020120000000000000000070000201400000000000000000000000000000000078000201200000000000000000011462000201102E626D6A6400020110500000006700020120000000000000000070000201400000000000000000000000000000000078000201200000000000000000011462000201105FAA676B640002011050000000670002012000000000000000007000020140000000000000000000000000000000007800020120000000000000000001146200020110D402806C6400020110500000006700020120000000000000000070000201400000000000000000000000000000000078000201200000000000000000011462000201101FC02A6E64000201105000000067000201200000000000000000700002014000000000000000000000000000000000780002012000000000000000000114620002011005B28C6E64000201105000000067000201200000000000000000700002014000000000000000000000000000000000780002012000000000000000000114620002011055111F6F6400020110500000006700020120000000000000000070000201400000000000000000000000000000000078000201200000000000000000011462000201105D4DB86F6400020110500000006700020120000000000000000070000201400000000000000000000000000000000078000201200000000000000000011462000201104E8352706400020110500000006700020120000000000000000070000201400000000000000000000000000000000078000201200000000000000000011462000201102ED82C756400020110500000006700020120000000000000000070000201400000000000000000000000000000000078000201200000000000000000011462000201108D8A69756400020110500000006700020120000000000000000070000201400000000000000000000000000000000078000201200000000000000000011462000201104FAB7B766400020110500000006700020120000000000000000070000201400000000000000000000000000000000078000201200000000000000000011462000201103DEA20776400020110500000006700020120000000000000000070000201400000000000000000000000000000000078000201200000000000000000011462000201102E76A4776400020110500000006700020120000000000000000070000201400000000000000000000000000000000078000201200000000000000000011462000201105D4F41786400020110500000006700020120000000000000000070000201400000000000000000000000000000000078000201200000000000000000011462000201105D4D577964000201105000000067000201200000000000000000700002014000000000000000000000000000000000780002012000000000000000000114620002011050FC3C7B640002011050000000670002012000000000000000007000020140000000000000000000000000000000007800020120000000000000000001146200020110B297BC7B6400020110500000006700020120000000000000000070000201400000000000000000000000000000000078000201200000000000000000011462000201104D34127D6400020110500000006700020120000000000000000070000201400000000000000000000000000000000078000201200000000000000000011462000201102EACD47E6400020110500000006700020120000000000000000070000201400000000000000000000000000000000078000201200000000000000000011462000201106DF1B0806400020110500000006700020120000000000000000070000201400000000000000000000000000000000078000201200000000000000000011462000201105BE04581640002011050000000670002012000000000000000007000020140000000000000000000000000000000007800020120000000000000000001146200020110BE729F826400020110500000006700020120000000000000000070000201400000000000000000000000000000000078000201200000000000000000011462000201106FB83E846400020110500000006700020120000000000000000070000201400000000000000000000000000000000078000201200000000000000000011462000201106DB911866400020110500000006700020120000000000000000070000201400000000000000000000000000000000078000201200000000000000000011462000201105B7C148664000201105000000067000201200000000000000000700002014000000000000000000000000000000000780002012000000000000000000114620002011025E55787640002011050000000670002012000000000000000007000020140000000000000000000000000000000007800020120000000000000000001146200020110B049CA876400020110500000006700020120000000000000000070000201400000000000000000000000000000000078000201200000000000000000011462000201104395EA88640002011050000000670002012000000000000000007000020140000000000000000000000000000000007800020120000000000000000001146200020110B2D2D98B6400020110500000006700020120000000000000000070000201400000000000000000000000000000000078000201200000000000000000011462000201101FCAD28E6400020110500000006700020120000000000000000070000201400000000000000000000000000000000078000201200000000000000000011462000201105D744E8F640002011050000000670002012000000000000000007000020140000000000000000000000000000000007800020120000000000000000001146200020110B065728F6400020110500000006700020120000000000000000070000201400000000000000000000000000000000078000201200000000000000000011462000201101F067F8F6400020110500000006700020120000000000000000070000201400000000000000000000000000000000078000201200000000000000000011462000201102ECB78916400020110500000006700020120000000000000000070000201400000000000000000000000000000000078000201200000000000000000011462000201106D568C91640002011050000000670002012000000000000000007000020140000000000000000000000000000000007800020120000000000000000001146200020110BCD1E3926400020110500000006700020120000000000000000070000201400000000000000000000000000000000078000201200000000000000000011462000201104D7B3F956400020110500000006700020120000000000000000070000201400000000000000000000000000000000078000201200000000000000000011462000201106D57429664000201105000000067000201200000000000000000700002014000000000000000000000000000000000780002012000000000000000000114620002011005F87F966400020110500000006700020120000000000000000070000201400000000000000000000000000000000078000201200000000000000000011462000201102E77CB9664000201105000000067000201200000000000000000700002014000000000000000000000000000000000780002012000000000000000000114620002011005F8F896640002011050000000670002012000000000000000007000020140000000000000000000000000000000007800020120000000000000000001146200020110B07014976400020110500000006700020120000000000000000070000201400000000000000000000000000000000078000201200000000000000000011462000201105C34AE97640002011050000000670002012000000000000000007000020140000000000000000000000000000000007800020120000000000000000001146200020110D5E731996400020110500000006700020120000000000000000070000201400000000000000000000000000000000078000201200000000000000000011462000201104E9F259A6400020110500000006700020120000000000000000070000201400000000000000000000000000000000078000201200000000000000000011462000201107E421D9B640002011050000000670002012000000000000000007000020140000000000000000000000000000000007800020120000000000000000001146200020110BCBE459B6400020110500000006700020120000000000000000070000201400000000000000000000000000000000078000201200000000000000000011462000201101FAA8F9C64000201105000000067000201200000000000000000700002014000000000000000000000000000000000780002012000000000000000000114620002011005F8059D6400020110500000006700020120000000000000000070000201400000000000000000000000000000000078000201200000000000000000011462000201105D4E219E6400020110500000006700020120000000000000000070000201400000000000000000000000000000000078000201200000000000000000011462000201105D4F149F6400020110500000006700020120000000000000000070000201400000000000000000000000000000000078000201200000000000000000011462000201104D78A7A064000201105000000067000201200000000000000000700002014000000000000000000000000000000000780002012000000000000000000114620002011051A38FA16400020110500000006700020120000000000000000070000201400000000000000000000000000000000078000201200000000000000000011462000201102E76C8A164000201105000000067000201200000000000000000700002014000000000000000000000000000000000780002012000000000000000000114620002011086F9DAA2640002011050000000670002012000000000000000007000020140000000000000000000000000000000007800020120000000000000000001146200020110A10AE4A26400020110500000006700020120000000000000000070000201400000000000000000000000000000000078000201200000000000000000011462000201105EF49DA3640002011050000000670002012000000000000000007000020140000000000000000000000000000000007800020120000000000000000001146200020110C23291A46400020110500000006700020120000000000000000070000201400000000000000000000000000000000078000201200000000000000000011462000201105F6879A5640002011050000000670002012000000000000000007000020140000000000000000000000000000000007800020120000000000000000001146200020110B296C0A56400020110500000006700020120000000000000000070000201400000000000000000000000000000000078000201200000000000000000011462000201102EA221A8640002011050000000670002012000000000000000007000020140000000000000000000000000000000007800020120000000000000000001146200020110B2967AA8640002011050000000670002012000000000000000007000020140000000000000000000000000000000007800020120000000000000000001146200020110B297E0A8640002011050000000670002012000000000000000007000020140000000000000000000000000000000007800020120000000000000000001146200020110B00873A96400020110500000006700020120000000000000000070000201400000000000000000000000000000000078000201200000000000000000011462000201105D4F87A9640002011050000000670002012000000000000000007000020140000000000000000000000000000000007800020120000000000000000001146200020110B00838AA6400020110500000006700020120000000000000000070000201400000000000000000000000000000000078000201200000000000000000011462000201102E7670AA64000201105000000067000201200000000000000000700002014000000000000000000000000000000000780002012000000000000000000114620002011086F953AB6400020110500000006700020120000000000000000070000201400000000000000000000000000000000078000201200000000000000000011462000201105C349BAB64000201105000000067000201200000000000000000700002014000000000000000000000000000000000780002012000000000000000000114620002011057CCA1AB640002011050000000670002012000000000000000007000020140000000000000000000000000000000007800020120000000000000000001146200020110B06718AD6400020110500000006700020120000000000000000070000201400000000000000000000000000000000078000201200000000000000000011462000201102E7761AD6400020110500000006700020120000000000000000070000201400000000000000000000000000000000078000201200000000000000000011462000201106DE356AF6400020110500000006700020120000000000000000070000201400000000000000000000000000000000078000201200000000000000000011462000201106D6CFFAF64000201105000000067000201200000000000000000700002014000000000000000000000000000000000780002012000000000000000000114620002011052D387B06400020110500000006700020120000000000000000070000201400000000000000000000000000000000078000201200000000000000000011462000201105969F9B0640002011050000000670002012000000000000000007000020140000000000000000000000000000000007800020120000000000000000001146200020110B29719B16400020110500000006700020120000000000000000070000201400000000000000000000000000000000078000201200000000000000000011462000201104D7999B16400020110500000006700020120000000000000000070000201400000000000000000000000000000000078000201200000000000000000011462000201102EACCDB3640002011050000000670002012000000000000000007000020140000000000000000000000000000000007800020120000000000000000001146200020110BC005AB46400020110500000006700020120000000000000000070000201400000000000000000000000000000000078000201200000000000000000011462000201105EF418B66400020110500000006700020120000000000000000070000201400000000000000000000000000000000078000201200000000000000000011462000201104D79B1B66400020110500000006700020120000000000000000070000201400000000000000000000000000000000078000201200000000000000000011462000201106DFBF5B76400020110500000006700020120000000000000000070000201400000000000000000000000000000000078000201200000000000000000011462000201105D4DEABA640002011050000000670002012000000000000000007000020140000000000000000000000000000000007800020120000000000000000001146200020110056944BB64000201105000000067000201200000000000000000700002014000000000000000000000000000000000780002012000000000000000000114620002011005F8ADBC6400020110500000006700020120000000000000000070000201400000000000000000000000000000000078000201200000000000000000011462000201102ED809BD6400020110500000006700020120000000000000000070000201400000000000000000000000000000000078000201200000000000000000011462000201104E8917BD640002011050000000670002012000000000000000007000020140000000000000000000000000000000007800020120000000000000000001146200020110B6BD1CBD640002011050000000670002012000000000000000007000020140000000000000000000000000000000007800020120000000000000000001146200020110B066C4BD6400020110500000006700020120000000000000000070000201400000000000000000000000000000000078000201200000000000000000011462000201102E311FBE6400020110500000006700020120000000000000000070000201400000000000000000000000000000000078000201200000000000000000011462000201102E771EBF640002011050000000670002012000000000000000007000020140000000000000000000000000000000007800020120000000000000000001146200020110B24AD6C06400020110500000006700020120000000000000000070000201400000000000000000000000000000000078000201200000000000000000011462000201105D4DE7C1640002011050000000670002012000000000000000007000020140000000000000000000000000000000007800020120000000000000000001146200020110B2A503C264000201105000000067000201200000000000000000700002014000000000000000000000000000000000780002012000000000000000000114620002011005F889C26400020110500000006700020120000000000000000070000201400000000000000000000000000000000078000201200000000000000000011462000201105B7C44C46400020110500000006700020120000000000000000070000201400000000000000000000000000000000078000201200000000000000000011462000201105D4E82C66400020110500000006700020120000000000000000070000201400000000000000000000000000000000078000201200000000000000000011462000201101F940EC76400020110500000006700020120000000000000000070000201400000000000000000000000000000000078000201200000000000000000011462000201105DB18FC8640002011050000000670002012000000000000000007000020140000000000000000000000000000000007800020120000000000000000001146200020110C292C7C86400020110500000006700020120000000000000000070000201400000000000000000000000000000000078000201200000000000000000011462000201105EF0E1C86400020110500000006700020120000000000000000070000201400000000000000000000000000000000078000201200000000000000000011462000201106D5772CA640002011050000000670002012000000000000000007000020140000000000000000000000000000000007800020120000000000000000001146200020110BC8AE2CA6400020110500000006700020120000000000000000070000201400000000000000000000000000000000078000201200000000000000000011462000201102E953CCD640002011050000000670002012000000000000000007000020140000000000000000000000000000000007800020120000000000000000001146200020110B06FB2CD6400020110500000006700020120000000000000000070000201400000000000000000000000000000000078000201200000000000000000011462000201101FCAB3D06400020110500000006700020120000000000000000070000201400000000000000000000000000000000078000201200000000000000000011462000201102ED3D3D064000201105000000067000201200000000000000000700002014000000000000000000000000000000000780002012000000000000000000114620002011086F94FD2640002011050000000670002012000000000000000007000020140000000000000000000000000000000007800020120000000000000000001146200020110B288F4D26400020110500000006700020120000000000000000070000201400000000000000000000000000000000078000201200000000000000000011462000201102573FDD3640002011050000000670002012000000000000000007000020140000000000000000000000000000000007800020120000000000000000001146200020110B02412D46400020110500000006700020120000000000000000070000201400000000000000000000000000000000078000201200000000000000000011462000201102ED31BD56400020110500000006700020120000000000000000070000201400000000000000000000000000000000078000201200000000000000000011462000201102E7728D86400020110500000006700020120000000000000000070000201400000000000000000000000000000000078000201200000000000000000011462000201105D5C22DA6400020110500000006700020120000000000000000070000201400000000000000000000000000000000078000201200000000000000000011462000201104B70D8DA6400020110500000006700020120000000000000000070000201400000000000000000000000000000000078000201200000000000000000011462000201107B00F3DA6400020110500000006700020120000000000000000070000201400000000000000000000000000000000078000201200000000000000000011462000201105EF413DC640002011050000000670002012000000000000000007000020140000000000000000000000000000000007800020120000000000000000001146200020110B07C0FDD640002011050000000670002012000000000000000007000020140000000000000000000000000000000007800020120000000000000000001146200020110B0083EDD640002011050000000670002012000000000000000007000020140000000000000000000000000000000007800020120000000000000000001146200020110256369DD6400020110500000006700020120000000000000000070000201400000000000000000000000000000000078000201200000000000000000011462000201104D7A97DD6400020110500000006700020120000000000000000070000201400000000000000000000000000000000078000201200000000000000000011462000201105D4F0EDE6400020110500000006700020120000000000000000070000201400000000000000000000000000000000078000201200000000000000000011462000201105E9970DE640002011050000000670002012000000000000000007000020140000000000000000000000000000000007800020120000000000000000001146200020110B2D5AEDF6400020110500000006700020120000000000000000070000201400000000000000000000000000000000078000201200000000000000000011462000201102EACD2DF6400020110500000006700020120000000000000000070000201400000000000000000000000000000000078000201200000000000000000011462000201104E1AB2E064000201105000000067000201200000000000000000700002014000000000000000000000000000000000780002012000000000000000000114620002011059B917E16400020110500000006700020120000000000000000070000201400000000000000000000000000000000078000201200000000000000000011462000201102E7739E16400020110500000006700020120000000000000000070000201400000000000000000000000000000000078000201200000000000000000011462000201101FCAE6E2640002011050000000670002012000000000000000007000020140000000000000000000000000000000007800020120000000000000000001146200020110B25838E3640002011050000000670002012000000000000000007000020140000000000000000000000000000000007800020120000000000000000001146200020110567AD8E3640002011050000000670002012000000000000000007000020140000000000000000000000000000000007800020120000000000000000001146200020110D56E8EE464000201105000000067000201200000000000000000700002014000000000000000000000000000000000780002012000000000000000000114620002011059B467E6640002011050000000670002012000000000000000007000020140000000000000000000000000000000007800020120000000000000000001146200020110BCE7CBE6640002011050000000670002012000000000000000007000020140000000000000000000000000000000007800020120000000000000000001146200020110B06909E8640002011050000000670002012000000000000000007000020140000000000000000000000000000000007800020120000000000000000001146200020110505A12E86400020110500000006700020120000000000000000070000201400000000000000000000000000000000078000201200000000000000000011462000201102539CCE8640002011050000000670002012000000000000000007000020140000000000000000000000000000000007800020120000000000000000001146200020110DA67C4E96400020110500000006700020120000000000000000070000201400000000000000000000000000000000078000201200000000000000000011462000201103EDD2DEA6400020110500000006700020120000000000000000070000201400000000000000000000000000000000078000201200000000000000000011462000201102EB948ED64000201105000000067000201200000000000000000700002014000000000000000000000000000000000780002012000000000000000000114620002011025E57AED640002011050000000670002012000000000000000007000020140000000000000000000000000000000007800020120000000000000000001146200020110C22C02F064000201105000000067000201200000000000000000700002014000000000000000000000000000000000780002012000000000000000000114620002011025735CF06400020110500000006700020120000000000000000070000201400000000000000000000000000000000078000201200000000000000000011462000201102EF1DBF06400020110500000006700020120000000000000000070000201400000000000000000000000000000000078000201200000000000000000011462000201105275E9F06400020110500000006700020120000000000000000070000201400000000000000000000000000000000078000201200000000000000000011462000201105E994BF16400020110500000006700020120000000000000000070000201400000000000000000000000000000000078000201200000000000000000011462000201106DFE73F164000201105000000067000201200000000000000000700002014000000000000000000000000000000000780002012000000000000000000114620002011055417EF3640002011050000000670002012000000000000000007000020140000000000000000000000000000000007800020120000000000000000001146200020110B0613AF564000201105000000067000201200000000000000000700002014000000000000000000000000000000000780002012000000000000000000114620002011005F8BFF56400020110500000006700020120000000000000000070000201400000000000000000000000000000000078000201200000000000000000011462000201105BDAB6F66400020110500000006700020120000000000000000070000201400000000000000000000000000000000078000201200000000000000000011462000201104D7BC4F76400020110500000006700020120000000000000000070000201400000000000000000000000000000000078000201200000000000000000011462000201101F8774F9640002011050000000670002012000000000000000007000020140000000000000000000000000000000007800020120000000000000000001146200020110966BBEFB6400020110500000006700020120000000000000000070000201400000000000000000000000000000000078000201200000000000000000011462000201105C2737FC64000201105000000067000201200000000000000000700002014000000000000000000000000000000000780002012000000000000000000114620002011058D21EFD6400020110500000006700020120000000000000000070000201400000000000000000000000000000000078000201200000000000000000610002011070000000
Executable files
0
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

No data
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
33
TCP/UDP connections
87
DNS requests
17
Threats
8

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5944
MoUsoCoreWorker.exe
GET
200
23.216.77.6:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5944
MoUsoCoreWorker.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
4844
RUXIMICS.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
POST
400
40.126.31.3:443
https://login.live.com/ppsecure/deviceaddcredential.srf
unknown
text
203 b
whitelisted
—
—
POST
200
40.126.31.3:443
https://login.live.com/RST2.srf
unknown
xml
1.24 Kb
whitelisted
—
—
POST
400
40.126.31.2:443
https://login.live.com/ppsecure/deviceaddcredential.srf
unknown
text
203 b
whitelisted
—
—
POST
400
40.126.31.130:443
https://login.live.com/ppsecure/deviceaddcredential.srf
unknown
text
203 b
whitelisted
—
—
POST
400
20.190.159.4:443
https://login.live.com/ppsecure/deviceaddcredential.srf
unknown
text
203 b
whitelisted
—
—
POST
500
20.83.72.98:443
https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail
unknown
xml
512 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
1268
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4844
RUXIMICS.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5944
MoUsoCoreWorker.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5944
MoUsoCoreWorker.exe
23.216.77.6:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
1268
svchost.exe
23.216.77.6:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4844
RUXIMICS.exe
23.216.77.6:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
1268
svchost.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
5944
MoUsoCoreWorker.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 51.124.78.146
whitelisted
google.com
  • 142.250.184.206
whitelisted
crl.microsoft.com
  • 23.216.77.6
  • 23.216.77.28
whitelisted
www.microsoft.com
  • 23.35.229.160
whitelisted
self.events.data.microsoft.com
  • 20.189.173.4
whitelisted
login.live.com
  • 40.126.32.136
  • 40.126.32.68
  • 20.190.160.66
  • 40.126.32.74
  • 20.190.160.131
  • 40.126.32.72
  • 20.190.160.130
  • 40.126.32.138
whitelisted
activation-v2.sls.microsoft.com
  • 40.91.76.224
whitelisted
slscr.update.microsoft.com
  • 20.12.23.50
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.85.23.206
whitelisted
nexusrules.officeapps.live.com
  • 52.111.243.31
whitelisted

Threats

PID
Process
Class
Message
5768
2025-07-18_1a3306b3b59a1daf9790238edebcfe65_amadey_elex_rhadamanthys_smoke-loader_stop.exe
Malware Command and Control Activity Detected
ET MALWARE Win32/Kelihos.F Checkin
5768
2025-07-18_1a3306b3b59a1daf9790238edebcfe65_amadey_elex_rhadamanthys_smoke-loader_stop.exe
Malware Command and Control Activity Detected
ET MALWARE Win32/Kelihos.F Checkin
5768
2025-07-18_1a3306b3b59a1daf9790238edebcfe65_amadey_elex_rhadamanthys_smoke-loader_stop.exe
Malware Command and Control Activity Detected
ET MALWARE Win32/Kelihos.F Checkin
5768
2025-07-18_1a3306b3b59a1daf9790238edebcfe65_amadey_elex_rhadamanthys_smoke-loader_stop.exe
Malware Command and Control Activity Detected
ET MALWARE Win32/Kelihos.F Checkin
5768
2025-07-18_1a3306b3b59a1daf9790238edebcfe65_amadey_elex_rhadamanthys_smoke-loader_stop.exe
Malware Command and Control Activity Detected
ET MALWARE Win32/Kelihos.F Checkin
5768
2025-07-18_1a3306b3b59a1daf9790238edebcfe65_amadey_elex_rhadamanthys_smoke-loader_stop.exe
Malware Command and Control Activity Detected
ET MALWARE Win32/Kelihos.F Checkin
5768
2025-07-18_1a3306b3b59a1daf9790238edebcfe65_amadey_elex_rhadamanthys_smoke-loader_stop.exe
Malware Command and Control Activity Detected
ET MALWARE Win32/Kelihos.F Checkin
5768
2025-07-18_1a3306b3b59a1daf9790238edebcfe65_amadey_elex_rhadamanthys_smoke-loader_stop.exe
Malware Command and Control Activity Detected
ET MALWARE Win32/Kelihos.F Checkin
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
2025-07-18_1a3306b3b59a1daf9790238edebcfe65_amadey_elex_rhadamanthys_smoke-loader_stop.exe