Find similar analyses in TI Lookup
Analysis date (UTC): 21 July 2025, 23:46Analysis environment: Windows 10 Pro, build 19044, x64

hdhub4u.football

MD5:4DD6F37AE7594F2BD258DEE580A23BE9
SHA1:FC09B518BB0BDA4CAFEDDA9933E569846DC5010B
SHA256:8829A39FC50E499B8D84C42A51A53E92EF0DBD9D65DAC69E129761DC77DE1C68

Analysis result

Threat level:Malicious activity
Tags:
qrcodestealer
Full analysis:Analysis hdhub4u.football Malicious activity - Interactive analysis ANY.RUN

Behavior activities

MALICIOUS

Actions looks like stealing of personal data

  • PixelSee_id3282776id.exe (PID: 4936)

SUSPICIOUS

Reads security settings of Internet Explorer

  • PixelSee_id3282776id.exe (PID: 4936)

Reads Internet Explorer settings

  • PixelSee_id3282776id.exe (PID: 4936)

Reads Microsoft Outlook installation path

  • PixelSee_id3282776id.exe (PID: 4936)

INFO

Application launched itself

  • msedge.exe (PID: 6948)

Reads the computer name

  • identity_helper.exe (PID: 7760)
  • PixelSee_id3282776id.exe (PID: 4936)

Checks supported languages

  • identity_helper.exe (PID: 7760)
  • PixelSee_id3282776id.exe (PID: 4936)

Reads Environment values

  • identity_helper.exe (PID: 7760)

The sample compiled with english language support

  • msedge.exe (PID: 5468)
  • msedge.exe (PID: 6948)

Executable content was dropped or overwritten

  • msedge.exe (PID: 5468)
  • msedge.exe (PID: 6948)

Create files in a temporary directory

  • PixelSee_id3282776id.exe (PID: 4936)

Checks proxy server information

  • PixelSee_id3282776id.exe (PID: 4936)

Threats

PIDProcessClassMessage
5468msedge.exeNot Suspicious TrafficINFO [ANY.RUN] BootstrapCDN (stackpath .bootstrapcdn .com)
5468msedge.exeNot Suspicious TrafficINFO [ANY.RUN] BootstrapCDN (maxcdn .bootstrapcdn .com)
5468msedge.exeNot Suspicious TrafficINFO [ANY.RUN] Google Hosted Libraries (ajax .googleapis .com)
5468msedge.exeNot Suspicious TrafficINFO [ANY.RUN] BootstrapCDN (stackpath .bootstrapcdn .com)
5468msedge.exeNot Suspicious TrafficINFO [ANY.RUN] Google Tag Manager analytics (googletagmanager .com)
5468msedge.exeNot Suspicious TrafficINFO [ANY.RUN] Google Tag Manager analytics (googletagmanager .com)
5468msedge.exeNot Suspicious TrafficINFO [ANY.RUN] Google Hosted Libraries (ajax .googleapis .com)
5468msedge.exeNot Suspicious TrafficINFO [ANY.RUN] BootstrapCDN (maxcdn .bootstrapcdn .com)
5468msedge.exeNot Suspicious TrafficINFO [ANY.RUN] Google Tag Manager analytics (googletagmanager .com)
5468msedge.exeNot Suspicious TrafficINFO [ANY.RUN] Google Hosted Libraries (ajax .googleapis .com)

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Interactive malware hunting service ANY.RUN

© 2017-2026 ANY.RUN LLC. ALL RIGHTS RESERVED