File name:

2025-07-06_3e689e6f97d9a9f93a8f1a2088229ebd_amadey_coinminer_elex_gcleaner_smoke-loader

Full analysis: https://app.any.run/tasks/92165dd3-2317-447b-a176-27fd0672fe68
Verdict: Malicious activity
Analysis date: July 06, 2025, 02:32:33
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
auto-reg
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 7 sections
MD5:

3E689E6F97D9A9F93A8F1A2088229EBD

SHA1:

1157C0F29154C16E2179CD9865E0718A76A16028

SHA256:

93CC5F6D6FC673CECE73C773779D7EBA6E9529AC2FD78C620D7F7546A6D373B6

SSDEEP:

98304:usR/sQUKg9QZbJVNKLGI+NwfqRtmV0IGafd6INejeBdpxAB0XVM/MGrKfQS8y/c8:JvwuCiM3

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executing a file with an untrusted certificate

      • 2025-07-06_3e689e6f97d9a9f93a8f1a2088229ebd_amadey_coinminer_elex_gcleaner_smoke-loader.exe (PID: 2120)
      • SetupChipset.exe (PID: 3844)
      • SetupChipset.exe (PID: 5928)
      • SetupChipset.exe (PID: 4664)
      • MsiDb.exe (PID: 3740)

    • Changes the autorun value in the registry

      • SetupChipset.exe (PID: 3844)

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • 2025-07-06_3e689e6f97d9a9f93a8f1a2088229ebd_amadey_coinminer_elex_gcleaner_smoke-loader.exe (PID: 2120)
      • msiexec.exe (PID: 5416)
      • SetupChipset.exe (PID: 3844)
      • SetupChipset.exe (PID: 5928)
      • SetupChipset.exe (PID: 4664)

    • The process creates files with name similar to system file names

      • 2025-07-06_3e689e6f97d9a9f93a8f1a2088229ebd_amadey_coinminer_elex_gcleaner_smoke-loader.exe (PID: 2120)
      • SetupChipset.exe (PID: 5928)
      • SetupChipset.exe (PID: 4664)

    • Executable content was dropped or overwritten

      • 2025-07-06_3e689e6f97d9a9f93a8f1a2088229ebd_amadey_coinminer_elex_gcleaner_smoke-loader.exe (PID: 2120)
      • SetupChipset.exe (PID: 3844)
      • rundll32.exe (PID: 2704)
      • rundll32.exe (PID: 2124)
      • rundll32.exe (PID: 4264)
      • rundll32.exe (PID: 424)
      • SetupChipset.exe (PID: 5928)
      • rundll32.exe (PID: 3048)
      • SetupChipset.exe (PID: 4664)
      • rundll32.exe (PID: 5528)

    • Reads security settings of Internet Explorer

      • 2025-07-06_3e689e6f97d9a9f93a8f1a2088229ebd_amadey_coinminer_elex_gcleaner_smoke-loader.exe (PID: 2120)

    • Creates a software uninstall entry

      • SetupChipset.exe (PID: 3844)

    • Reads the Windows owner or organization settings

      • msiexec.exe (PID: 5416)

    • Uses RUNDLL32.EXE to load library

      • msiexec.exe (PID: 684)
      • msiexec.exe (PID: 2876)
      • msiexec.exe (PID: 6380)

    • Starts a Microsoft application from unusual location

      • MsiDb.exe (PID: 3740)

    • Application launched itself

      • msiexec.exe (PID: 5416)
      • SetupChipset.exe (PID: 5928)

    • Searches for installed software

      • SetupChipset.exe (PID: 4664)

  • INFO

    • The sample compiled with english language support

      • 2025-07-06_3e689e6f97d9a9f93a8f1a2088229ebd_amadey_coinminer_elex_gcleaner_smoke-loader.exe (PID: 2120)
      • SetupChipset.exe (PID: 3844)
      • msiexec.exe (PID: 5416)
      • rundll32.exe (PID: 2704)
      • SetupChipset.exe (PID: 5928)
      • SetupChipset.exe (PID: 4664)

    • Create files in a temporary directory

      • 2025-07-06_3e689e6f97d9a9f93a8f1a2088229ebd_amadey_coinminer_elex_gcleaner_smoke-loader.exe (PID: 2120)
      • SetupChipset.exe (PID: 3844)
      • SetupChipset.exe (PID: 5928)
      • MsiDb.exe (PID: 3740)
      • rundll32.exe (PID: 2704)
      • SetupChipset.exe (PID: 4664)

    • Checks supported languages

      • 2025-07-06_3e689e6f97d9a9f93a8f1a2088229ebd_amadey_coinminer_elex_gcleaner_smoke-loader.exe (PID: 2120)
      • SetupChipset.exe (PID: 3844)
      • msiexec.exe (PID: 5416)
      • msiexec.exe (PID: 684)
      • msiexec.exe (PID: 2876)
      • SetupChipset.exe (PID: 5928)
      • MsiDb.exe (PID: 3740)
      • msiexec.exe (PID: 6380)
      • SetupChipset.exe (PID: 4664)

    • Reads the computer name

      • 2025-07-06_3e689e6f97d9a9f93a8f1a2088229ebd_amadey_coinminer_elex_gcleaner_smoke-loader.exe (PID: 2120)
      • SetupChipset.exe (PID: 3844)
      • msiexec.exe (PID: 684)
      • msiexec.exe (PID: 5416)
      • msiexec.exe (PID: 2876)
      • msiexec.exe (PID: 6380)
      • SetupChipset.exe (PID: 4664)

    • Reads the machine GUID from the registry

      • 2025-07-06_3e689e6f97d9a9f93a8f1a2088229ebd_amadey_coinminer_elex_gcleaner_smoke-loader.exe (PID: 2120)
      • SetupChipset.exe (PID: 3844)
      • SetupChipset.exe (PID: 4664)

    • Process checks computer location settings

      • 2025-07-06_3e689e6f97d9a9f93a8f1a2088229ebd_amadey_coinminer_elex_gcleaner_smoke-loader.exe (PID: 2120)

    • Creates files in the program directory

      • SetupChipset.exe (PID: 3844)

    • Launching a file from a Registry key

      • SetupChipset.exe (PID: 3844)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 5416)

    • Manual execution by a user

      • SetupChipset.exe (PID: 5928)

    • Creates a software uninstall entry

      • msiexec.exe (PID: 5416)

    • Checks proxy server information

      • slui.exe (PID: 1096)

    • Reads the software policy settings

      • slui.exe (PID: 1096)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2012:12:24 21:43:11+00:00
ImageFileCharacteristics: No relocs, Executable, 32-bit
PEType: PE32
LinkerVersion: 10
CodeSize: 223232
InitializedDataSize: 135680
UninitializedDataSize: -
EntryPoint: 0x25d1c
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
FileVersionNumber: 10.1.1.35
ProductVersionNumber: 10.1.1.35
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Windows, Latin1
CompanyName: Intel(R) Corporation
FileDescription: Intel(R) Chipset Device Software
FileVersion: 10.1.1.35
InternalName: setup
LegalCopyright: Copyright (c) Intel(R) Corporation. All rights reserved.
OriginalFileName: SetupChipset.exe
ProductName: Intel(R) Chipset Device Software
ProductVersion: 10.1.1.35
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
152
Monitored processes
16
Malicious processes
6
Suspicious processes
3

Behavior graph

Click at the process to see the details
start 2025-07-06_3e689e6f97d9a9f93a8f1a2088229ebd_amadey_coinminer_elex_gcleaner_smoke-loader.exe setupchipset.exe msiexec.exe msiexec.exe no specs rundll32.exe rundll32.exe msidb.exe no specs msiexec.exe no specs rundll32.exe rundll32.exe setupchipset.exe setupchipset.exe msiexec.exe no specs rundll32.exe rundll32.exe slui.exe

Process information

PID
CMD
Path
Indicators
Parent process
424rundll32.exe "C:\WINDOWS\Installer\MSI87E1.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_1542125 258 ChipsetWiX.CustomAction!Intel.Deployment.ChipsetWiX.CustomActions.InstallDriversCheckRebootC:\Windows\System32\rundll32.exe
msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shcore.dll
c:\windows\system32\imagehlp.dll
684C:\Windows\System32\MsiExec.exe -Embedding 73B0E45AF7EF9F39A8640B1AD4C20542C:\Windows\System32\msiexec.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
1096C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
2120"C:\Users\admin\Desktop\2025-07-06_3e689e6f97d9a9f93a8f1a2088229ebd_amadey_coinminer_elex_gcleaner_smoke-loader.exe" C:\Users\admin\Desktop\2025-07-06_3e689e6f97d9a9f93a8f1a2088229ebd_amadey_coinminer_elex_gcleaner_smoke-loader.exe
explorer.exe
User:
admin
Company:
Intel(R) Corporation
Integrity Level:
MEDIUM
Description:
Intel(R) Chipset Device Software
Exit code:
1603
Version:
10.1.1.35
Modules
Images
c:\users\admin\desktop\2025-07-06_3e689e6f97d9a9f93a8f1a2088229ebd_amadey_coinminer_elex_gcleaner_smoke-loader.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
2124rundll32.exe "C:\WINDOWS\Installer\MSI81D3.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_1540609 2 ChipsetWiX.CustomAction!Intel.Deployment.ChipsetWiX.CustomActions.SetTargetPathC:\Windows\System32\rundll32.exe
msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shcore.dll
c:\windows\system32\imagehlp.dll
2704rundll32.exe "C:\WINDOWS\Installer\MSI82AF.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_1540796 8 ChipsetWiX.CustomAction!Intel.Deployment.ChipsetWiX.CustomActions.PrepareInstallC:\Windows\System32\rundll32.exe
msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shcore.dll
c:\windows\system32\imagehlp.dll
2876C:\Windows\System32\MsiExec.exe -Embedding 2A1E179D135723EBEBBC86DFC835476B E Global\MSI0000C:\Windows\System32\msiexec.exe—msiexec.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
3048rundll32.exe "C:\WINDOWS\Installer\MSI89E7.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_1542687 263 ChipsetWiX.CustomAction!Intel.Deployment.ChipsetWiX.CustomActions.SetTargetPathC:\Windows\System32\rundll32.exe
msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shcore.dll
c:\windows\system32\imagehlp.dll
3740"C:\Users\admin\AppData\Local\Temp\{3A86092C-3E9F-4184-821F-FBDED23A917F}\Binaries\MsiDb.exe" -d "C:\WINDOWS\Installer\1780b9.msi" -x "NullDrivers.cab"C:\Users\admin\AppData\Local\Temp\{3A86092C-3E9F-4184-821F-FBDED23A917F}\Binaries\MsiDb.exe—rundll32.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows® Installer Table Creator
Exit code:
0
Version:
5.0.9600.17298 (winblue.141024-1500)
Modules
Images
c:\users\admin\appdata\local\temp\{3a86092c-3e9f-4184-821f-fbded23a917f}\binaries\msidb.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
3844"C:\Users\admin\AppData\Local\Temp\{5f5c7829-a6ba-4fc6-9f47-d068f51ed99b}\.be\SetupChipset.exe" -q -burn.elevated BurnPipe.{0E984709-30C8-4126-B825-A680434D022D} {6E7C00A1-B9D4-4199-B96D-8441CEF7BF78} 2120C:\Users\admin\AppData\Local\Temp\{5f5c7829-a6ba-4fc6-9f47-d068f51ed99b}\.be\SetupChipset.exe
2025-07-06_3e689e6f97d9a9f93a8f1a2088229ebd_amadey_coinminer_elex_gcleaner_smoke-loader.exe
User:
admin
Company:
Intel(R) Corporation
Integrity Level:
HIGH
Description:
Intel(R) Chipset Device Software
Exit code:
1603
Version:
10.1.1.35
Modules
Images
c:\users\admin\appdata\local\temp\{5f5c7829-a6ba-4fc6-9f47-d068f51ed99b}\.be\setupchipset.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
Total events
8 483
Read events
8 124
Write events
160
Delete events
199

Modification events

(PID) Process:(3844) SetupChipset.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Dependencies\{3A86092C-3E9F-4184-821F-FBDED23A917F}
Operation:writeName:Version
Value:
10.1.1.35
(PID) Process:(3844) SetupChipset.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Dependencies\{3A86092C-3E9F-4184-821F-FBDED23A917F}
Operation:writeName:DisplayName
Value:
Intel(R) Chipset Device Software
(PID) Process:(3844) SetupChipset.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{5f5c7829-a6ba-4fc6-9f47-d068f51ed99b}
Operation:writeName:BundleCachePath
Value:
C:\ProgramData\Package Cache\{5f5c7829-a6ba-4fc6-9f47-d068f51ed99b}\SetupChipset.exe
(PID) Process:(3844) SetupChipset.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{5f5c7829-a6ba-4fc6-9f47-d068f51ed99b}
Operation:writeName:BundleUpgradeCode
Value:
{D8CA2E7A-5763-4161-82B8-F870F2BD4F2F}
(PID) Process:(3844) SetupChipset.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{5f5c7829-a6ba-4fc6-9f47-d068f51ed99b}
Operation:writeName:BundleAddonCode
Value:
(PID) Process:(3844) SetupChipset.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{5f5c7829-a6ba-4fc6-9f47-d068f51ed99b}
Operation:writeName:BundleDetectCode
Value:
(PID) Process:(3844) SetupChipset.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{5f5c7829-a6ba-4fc6-9f47-d068f51ed99b}
Operation:writeName:BundlePatchCode
Value:
(PID) Process:(3844) SetupChipset.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{5f5c7829-a6ba-4fc6-9f47-d068f51ed99b}
Operation:writeName:BundleVersion
Value:
10.1.1.35
(PID) Process:(3844) SetupChipset.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{5f5c7829-a6ba-4fc6-9f47-d068f51ed99b}
Operation:writeName:BundleProviderKey
Value:
{5f5c7829-a6ba-4fc6-9f47-d068f51ed99b}
(PID) Process:(3844) SetupChipset.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{5f5c7829-a6ba-4fc6-9f47-d068f51ed99b}
Operation:writeName:BundleTag
Value:
Executable files
256
Suspicious files
94
Text files
95
Unknown types
0

Dropped files

PID
Process
Filename
Type
21202025-07-06_3e689e6f97d9a9f93a8f1a2088229ebd_amadey_coinminer_elex_gcleaner_smoke-loader.exeC:\Users\admin\AppData\Local\Temp\{5f5c7829-a6ba-4fc6-9f47-d068f51ed99b}\.ba1\1043\mbapreq.wxlxml
MD5:D82150BEE4CC7CEBFFA96CDF3762E320
SHA256:41D9D9363935702730A09FA9FEDF730CEBC51DB962E05FA4B05841840895C92C
21202025-07-06_3e689e6f97d9a9f93a8f1a2088229ebd_amadey_coinminer_elex_gcleaner_smoke-loader.exeC:\Users\admin\AppData\Local\Temp\{5f5c7829-a6ba-4fc6-9f47-d068f51ed99b}\.ba1\1030\mbapreq.wxlxml
MD5:AA3E13A2DAA064E8DA8CF2F4ACC25900
SHA256:90680E9500A2014137D92EA0988B92EC34648D6826F18C9646A318E26BD1A511
21202025-07-06_3e689e6f97d9a9f93a8f1a2088229ebd_amadey_coinminer_elex_gcleaner_smoke-loader.exeC:\Users\admin\AppData\Local\Temp\{5f5c7829-a6ba-4fc6-9f47-d068f51ed99b}\.ba1\BootstrapperCore.dllexecutable
MD5:86C4274A0E33EA0A53AF47E59D6F0840
SHA256:CFF83831665331462CC05DB5903F6ABC1EBF3532639A08A75A7BAFB184C8DF25
21202025-07-06_3e689e6f97d9a9f93a8f1a2088229ebd_amadey_coinminer_elex_gcleaner_smoke-loader.exeC:\Users\admin\AppData\Local\Temp\{5f5c7829-a6ba-4fc6-9f47-d068f51ed99b}\.ba1\mbahost.dllexecutable
MD5:88235CC836ABA29A0704D87401083A3D
SHA256:8DAA7598A32917F6BDD34E00C5CFC0CDF81361BFFBF5CDE5F97F33F4DE0A9598
21202025-07-06_3e689e6f97d9a9f93a8f1a2088229ebd_amadey_coinminer_elex_gcleaner_smoke-loader.exeC:\Users\admin\AppData\Local\Temp\{5f5c7829-a6ba-4fc6-9f47-d068f51ed99b}\.ba1\1042\mbapreq.wxlxml
MD5:4D530FBCD8A7CF63A60D2D2E79C7880E
SHA256:00A5F823904E2D6849BB82F2170E798EB33898317FEC7C39E2AAC2452B900667
21202025-07-06_3e689e6f97d9a9f93a8f1a2088229ebd_amadey_coinminer_elex_gcleaner_smoke-loader.exeC:\Users\admin\AppData\Local\Temp\{5f5c7829-a6ba-4fc6-9f47-d068f51ed99b}\.ba1\1044\mbapreq.wxlxml
MD5:DE3ACE5CD8E4CE57B6D3379AE9E66540
SHA256:AE7AA89299F00E43364D2627B46B78DC04F80279D8A0D905A8517C322115D21F
21202025-07-06_3e689e6f97d9a9f93a8f1a2088229ebd_amadey_coinminer_elex_gcleaner_smoke-loader.exeC:\Users\admin\AppData\Local\Temp\{5f5c7829-a6ba-4fc6-9f47-d068f51ed99b}\.ba1\1032\mbapreq.wxlxml
MD5:9C21E76357218D33613174538EEA4120
SHA256:166801EFF4A826BF1B50CD24C0BE4B51717CC2B00F793FBC8CD8AB4B9AD6730B
21202025-07-06_3e689e6f97d9a9f93a8f1a2088229ebd_amadey_coinminer_elex_gcleaner_smoke-loader.exeC:\Users\admin\AppData\Local\Temp\{5f5c7829-a6ba-4fc6-9f47-d068f51ed99b}\.ba1\1038\mbapreq.wxlxml
MD5:F40A084C4B41D752A5C518D62ABD12E2
SHA256:43E00163C060A09C66AE65BDABD5A9943C55BBE8D11F8DDF95BA20008A605075
21202025-07-06_3e689e6f97d9a9f93a8f1a2088229ebd_amadey_coinminer_elex_gcleaner_smoke-loader.exeC:\Users\admin\AppData\Local\Temp\{5f5c7829-a6ba-4fc6-9f47-d068f51ed99b}\.ba1\mbapreq.wxlxml
MD5:16D2BD521AC2ACD7BD590A9B35F843DF
SHA256:84D8C544A8E320BD4EB3472A582326142D7CA86794B930FE983C3822A6ACF263
21202025-07-06_3e689e6f97d9a9f93a8f1a2088229ebd_amadey_coinminer_elex_gcleaner_smoke-loader.exeC:\Users\admin\AppData\Local\Temp\{5f5c7829-a6ba-4fc6-9f47-d068f51ed99b}\.ba1\sk-SK\Bootstrapper.resources.dllexecutable
MD5:D41EE6024FDF4B4CF028D143AED6ACA0
SHA256:7D3BEA2AF483A87D2E2832CE2BE8564E76C266EDE6489AEDD781AE244869C6D0
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
28
TCP/UDP connections
41
DNS requests
18
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
POST
200
20.190.160.5:443
https://login.live.com/ppsecure/deviceaddcredential.srf
unknown
text
16.7 Kb
whitelisted
—
—
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5944
MoUsoCoreWorker.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
23.216.77.28:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
23.216.77.28:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5944
MoUsoCoreWorker.exe
GET
200
23.216.77.28:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
POST
200
40.126.32.76:443
https://login.live.com/RST2.srf
unknown
xml
1.24 Kb
whitelisted
—
—
POST
200
20.190.160.5:443
https://login.live.com/RST2.srf
unknown
xml
11.1 Kb
whitelisted
—
—
GET
304
20.12.23.50:443
https://slscr.update.microsoft.com/SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
unknown
—
—
—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
5944
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1268
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5944
MoUsoCoreWorker.exe
23.216.77.28:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
1268
svchost.exe
23.216.77.28:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
23.216.77.28:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5944
MoUsoCoreWorker.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
1268
svchost.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
whitelisted
google.com
  • 142.250.186.174
whitelisted
crl.microsoft.com
  • 23.216.77.28
  • 23.216.77.6
  • 2.20.245.139
  • 2.20.245.137
whitelisted
www.microsoft.com
  • 184.30.21.171
  • 95.101.149.131
whitelisted
login.live.com
  • 20.190.160.130
  • 40.126.32.134
  • 20.190.160.64
  • 20.190.160.131
  • 40.126.32.68
  • 20.190.160.20
  • 20.190.160.3
  • 20.190.160.22
whitelisted
client.wns.windows.com
  • 172.211.123.250
  • 172.211.123.249
whitelisted
nexusrules.officeapps.live.com
  • 52.111.236.21
whitelisted
slscr.update.microsoft.com
  • 172.202.163.200
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.242.39.171
whitelisted
activation-v2.sls.microsoft.com
  • 40.91.76.224
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
2025-07-06_3e689e6f97d9a9f93a8f1a2088229ebd_amadey_coinminer_elex_gcleaner_smoke-loader