File name:

2025-05-29_2642fa53627640e526a0c36f772f9956_elex_icedid_stop

Full analysis: https://app.any.run/tasks/a833389b-225f-4011-8342-ce9d6705cab9
Verdict: Malicious activity
Threats:

BlackMoon also known as KrBanker is a trojan aimed at stealing payment credentials. It specializes in man-in-the-browser (MitB) attacks, web injection, and credential theft to compromise users' online banking accounts. It was first noticed in early 2014 attacking banks in South Korea and has impressively evolved since by adding a number of new infiltration techniques and information stealing methods.

Malware Trends Tracker     >>>
Analysis date: May 29, 2025, 10:51:58
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
blackmoon
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 4 sections
MD5:

2642FA53627640E526A0C36F772F9956

SHA1:

2BF90CFFF140016D82C4275CBB4B9A8B6272C46E

SHA256:

C144D9490BF8749637878661B9661FE59F613CB59A1D1E5B71B631C36675B844

SSDEEP:

49152:XFxUhnky7BM7W88988Nt5KBBDhzsf9hS1Sx5F2b35tZOP3E/4VhH3QLBf8XcHZ8m:3Uhnkyi8qDpsVhS1Sx5HPznWnNHqc

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • BLACKMOON has been detected (YARA)

      • 2025-05-29_2642fa53627640e526a0c36f772f9956_elex_icedid_stop.exe (PID: 6032)
      • gmiomp.exe (PID: 660)

  • SUSPICIOUS

    • Uses WMI to retrieve WMI-managed resources (SCRIPT)

      • 2025-05-29_2642fa53627640e526a0c36f772f9956_elex_icedid_stop.exe (PID: 6032)

    • Starts itself from another location

      • 2025-05-29_2642fa53627640e526a0c36f772f9956_elex_icedid_stop.exe (PID: 6032)
      • gmiomp.exe (PID: 660)

    • Reads security settings of Internet Explorer

      • gmiomp.exe (PID: 3900)
      • 545516.exe (PID: 4056)
      • 2025-05-29_2642fa53627640e526a0c36f772f9956_elex_icedid_stop.exe (PID: 6032)
      • gmiomp.exe (PID: 660)
      • 242385.exe (PID: 2984)
      • 742009.exe (PID: 8032)
      • 277948.exe (PID: 7832)
      • 246510.exe (PID: 2600)
      • 617222.exe (PID: 7624)
      • 323828.exe (PID: 6560)
      • 968264.exe (PID: 3020)
      • 314247.exe (PID: 7940)
      • 704941.exe (PID: 6004)
      • 934738.exe (PID: 1184)
      • 493538.exe (PID: 1196)
      • 036983.exe (PID: 7492)
      • 385761.exe (PID: 6228)
      • 135572.exe (PID: 6156)
      • 928107.exe (PID: 7896)
      • 659169.exe (PID: 1852)
      • 259873.exe (PID: 5640)
      • 280455.exe (PID: 1184)
      • 499989.exe (PID: 736)
      • 654833.exe (PID: 8020)
      • 395736.exe (PID: 5592)

    • Executable content was dropped or overwritten

      • 2025-05-29_2642fa53627640e526a0c36f772f9956_elex_icedid_stop.exe (PID: 6032)
      • gmiomp.exe (PID: 660)

    • Application launched itself

      • gmiomp.exe (PID: 3900)
      • 242385.exe (PID: 2984)
      • 545516.exe (PID: 4056)
      • 742009.exe (PID: 8032)
      • 617222.exe (PID: 7624)
      • 246510.exe (PID: 2600)
      • 323828.exe (PID: 6560)
      • 968264.exe (PID: 3020)
      • 314247.exe (PID: 7940)
      • 277948.exe (PID: 7832)
      • 704941.exe (PID: 6004)
      • 934738.exe (PID: 1184)
      • 493538.exe (PID: 1196)
      • 036983.exe (PID: 7492)
      • 928107.exe (PID: 7896)
      • 135572.exe (PID: 6156)
      • 385761.exe (PID: 6228)
      • 280455.exe (PID: 1184)
      • 659169.exe (PID: 1852)
      • 259873.exe (PID: 5640)
      • 654833.exe (PID: 8020)
      • 395736.exe (PID: 5592)
      • 017124.exe (PID: 5244)
      • 526402.exe (PID: 1056)
      • 417939.exe (PID: 7932)
      • 676052.exe (PID: 4996)
      • 543991.exe (PID: 2340)
      • 931605.exe (PID: 4164)
      • 387588.exe (PID: 2268)
      • 260039.exe (PID: 6828)
      • 569741.exe (PID: 7904)
      • 159365.exe (PID: 1512)
      • 540079.exe (PID: 5512)
      • 266866.exe (PID: 7856)
      • 525743.exe (PID: 7804)
      • 499989.exe (PID: 736)
      • 525161.exe (PID: 7536)
      • 786235.exe (PID: 1276)
      • 792372.exe (PID: 6852)
      • 432822.exe (PID: 7876)
      • 263864.exe (PID: 4696)
      • 658804.exe (PID: 6988)
      • 662150.exe (PID: 5216)
      • 430652.exe (PID: 3016)
      • 789451.exe (PID: 7700)
      • 379175.exe (PID: 8048)
      • 678787.exe (PID: 5776)
      • 671626.exe (PID: 7860)
      • 261330.exe (PID: 7472)
      • 397313.exe (PID: 240)

    • Searches for installed software

      • 2025-05-29_2642fa53627640e526a0c36f772f9956_elex_icedid_stop.exe (PID: 6032)

    • Explorer used for Indirect Command Execution

      • explorer.exe (PID: 5452)

    • There is functionality for taking screenshot (YARA)

      • 2025-05-29_2642fa53627640e526a0c36f772f9956_elex_icedid_stop.exe (PID: 6032)
      • gmiomp.exe (PID: 660)

    • Starts CMD.EXE for commands execution

      • explorer.exe (PID: 4920)

    • Executing commands from a ".bat" file

      • explorer.exe (PID: 4920)

  • INFO

    • Checks supported languages

      • 2025-05-29_2642fa53627640e526a0c36f772f9956_elex_icedid_stop.exe (PID: 6032)
      • gmiomp.exe (PID: 3900)
      • 545516.exe (PID: 4056)
      • gmiomp.exe (PID: 660)
      • 545516.exe (PID: 6240)
      • 242385.exe (PID: 2984)
      • 242385.exe (PID: 3240)
      • 742009.exe (PID: 2960)
      • 246510.exe (PID: 2600)
      • 742009.exe (PID: 8032)
      • 617222.exe (PID: 7624)
      • 617222.exe (PID: 5132)
      • 277948.exe (PID: 7832)
      • 246510.exe (PID: 7596)
      • identity_helper.exe (PID: 7464)
      • 277948.exe (PID: 4228)
      • 323828.exe (PID: 6560)
      • 323828.exe (PID: 5392)
      • 968264.exe (PID: 3020)
      • 968264.exe (PID: 7332)
      • 314247.exe (PID: 7940)
      • 314247.exe (PID: 7852)
      • 704941.exe (PID: 6004)
      • 934738.exe (PID: 1184)
      • 704941.exe (PID: 7484)
      • 934738.exe (PID: 7680)
      • 493538.exe (PID: 1196)
      • 385761.exe (PID: 6228)
      • 493538.exe (PID: 728)
      • 036983.exe (PID: 7492)
      • 036983.exe (PID: 5364)
      • 385761.exe (PID: 5124)
      • 928107.exe (PID: 7896)
      • 928107.exe (PID: 2980)
      • 135572.exe (PID: 6156)
      • 135572.exe (PID: 5176)
      • 280455.exe (PID: 7620)
      • 659169.exe (PID: 1852)
      • 659169.exe (PID: 7728)
      • 259873.exe (PID: 5640)
      • 280455.exe (PID: 1184)
      • 654833.exe (PID: 8020)
      • 499989.exe (PID: 736)
      • 654833.exe (PID: 3828)
      • 259873.exe (PID: 8040)
      • 395736.exe (PID: 5592)
      • 395736.exe (PID: 536)
      • 499989.exe (PID: 3884)

    • Checks proxy server information

      • 2025-05-29_2642fa53627640e526a0c36f772f9956_elex_icedid_stop.exe (PID: 6032)

    • Reads the computer name

      • 2025-05-29_2642fa53627640e526a0c36f772f9956_elex_icedid_stop.exe (PID: 6032)
      • gmiomp.exe (PID: 3900)
      • 545516.exe (PID: 4056)
      • gmiomp.exe (PID: 660)
      • 242385.exe (PID: 2984)
      • 742009.exe (PID: 8032)
      • 277948.exe (PID: 7832)
      • 246510.exe (PID: 2600)
      • identity_helper.exe (PID: 7464)
      • 617222.exe (PID: 7624)
      • 968264.exe (PID: 3020)
      • 934738.exe (PID: 1184)
      • 704941.exe (PID: 6004)
      • 493538.exe (PID: 1196)
      • 036983.exe (PID: 7492)
      • 928107.exe (PID: 7896)
      • 135572.exe (PID: 6156)
      • 280455.exe (PID: 1184)
      • 385761.exe (PID: 6228)
      • 659169.exe (PID: 1852)
      • 259873.exe (PID: 5640)
      • 395736.exe (PID: 5592)
      • 654833.exe (PID: 8020)
      • 323828.exe (PID: 6560)
      • 314247.exe (PID: 7940)
      • 499989.exe (PID: 736)

    • The sample compiled with chinese language support

      • 2025-05-29_2642fa53627640e526a0c36f772f9956_elex_icedid_stop.exe (PID: 6032)
      • gmiomp.exe (PID: 660)

    • Process checks computer location settings

      • gmiomp.exe (PID: 660)
      • gmiomp.exe (PID: 3900)
      • 242385.exe (PID: 2984)
      • 2025-05-29_2642fa53627640e526a0c36f772f9956_elex_icedid_stop.exe (PID: 6032)
      • 545516.exe (PID: 4056)
      • 742009.exe (PID: 8032)
      • 617222.exe (PID: 7624)
      • 246510.exe (PID: 2600)
      • 277948.exe (PID: 7832)
      • 323828.exe (PID: 6560)
      • 968264.exe (PID: 3020)
      • 314247.exe (PID: 7940)
      • 704941.exe (PID: 6004)
      • 036983.exe (PID: 7492)
      • 934738.exe (PID: 1184)
      • 493538.exe (PID: 1196)
      • 385761.exe (PID: 6228)
      • 928107.exe (PID: 7896)
      • 135572.exe (PID: 6156)
      • 280455.exe (PID: 1184)
      • 659169.exe (PID: 1852)
      • 259873.exe (PID: 5640)
      • 395736.exe (PID: 5592)
      • 654833.exe (PID: 8020)
      • 499989.exe (PID: 736)

    • Create files in a temporary directory

      • gmiomp.exe (PID: 660)
      • 2025-05-29_2642fa53627640e526a0c36f772f9956_elex_icedid_stop.exe (PID: 6032)

    • Reads the machine GUID from the registry

      • gmiomp.exe (PID: 660)

    • Application launched itself

      • msedge.exe (PID: 2420)

    • Reads security settings of Internet Explorer

      • explorer.exe (PID: 4920)

    • Creates files or folders in the user directory

      • gmiomp.exe (PID: 660)

    • Manual execution by a user

      • msedge.exe (PID: 7696)

    • Reads Environment values

      • identity_helper.exe (PID: 7464)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2016:08:17 08:34:04+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 368640
InitializedDataSize: 1241088
UninitializedDataSize: -
EntryPoint: 0x4fd00
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 5.6.1.1
ProductVersionNumber: 5.6.1.1
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Chinese (Simplified)
CharacterSet: Unicode
FileVersion: 5.6.1.1
FileDescription:
ProductName:
ProductVersion: 5.6.1.1
CompanyName:
LegalCopyright:
Comments: 本程序使用易语言编写(http://www.dywt.com.cn)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
267
Monitored processes
144
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #BLACKMOON 2025-05-29_2642fa53627640e526a0c36f772f9956_elex_icedid_stop.exe gmiomp.exe no specs #BLACKMOON gmiomp.exe 545516.exe no specs 545516.exe no specs 242385.exe no specs 242385.exe no specs msedge.exe explorer.exe no specs msedge.exe no specs explorer.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs cmd.exe no specs conhost.exe no specs 742009.exe no specs 742009.exe no specs 246510.exe no specs 246510.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs msedge.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs 617222.exe no specs 617222.exe no specs msedge.exe no specs 277948.exe no specs 277948.exe no specs msedge.exe no specs 323828.exe no specs 323828.exe no specs 968264.exe no specs 968264.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs 314247.exe no specs 314247.exe no specs msedge.exe no specs msedge.exe no specs 704941.exe no specs 704941.exe no specs msedge.exe no specs 934738.exe no specs 934738.exe no specs 493538.exe no specs msedge.exe no specs msedge.exe no specs 493538.exe no specs msedge.exe no specs 036983.exe no specs 036983.exe no specs 385761.exe no specs 385761.exe no specs 928107.exe no specs 928107.exe no specs msedge.exe no specs 135572.exe no specs 135572.exe no specs 280455.exe no specs 280455.exe no specs 659169.exe no specs 659169.exe no specs slui.exe 259873.exe no specs 259873.exe no specs 395736.exe no specs 395736.exe no specs 654833.exe no specs 654833.exe no specs msedge.exe no specs 499989.exe no specs 499989.exe no specs msedge.exe no specs 525161.exe no specs 525161.exe no specs 526402.exe no specs 526402.exe no specs 017124.exe no specs 017124.exe no specs 417939.exe no specs 417939.exe no specs msedge.exe no specs 543991.exe no specs 543991.exe no specs 931605.exe no specs 931605.exe no specs 387588.exe no specs 387588.exe no specs 260039.exe no specs 260039.exe no specs 569741.exe no specs 569741.exe no specs 159365.exe no specs 159365.exe no specs 540079.exe no specs 540079.exe no specs 676052.exe no specs 676052.exe no specs msedge.exe no specs 266866.exe no specs 266866.exe no specs 525743.exe no specs 525743.exe no specs 671626.exe no specs 671626.exe no specs 261330.exe no specs 261330.exe no specs 397313.exe no specs 397313.exe no specs 786235.exe no specs 786235.exe no specs 792372.exe no specs 792372.exe no specs msedge.exe no specs 432822.exe no specs 432822.exe no specs 658804.exe no specs 658804.exe no specs 662150.exe no specs msedge.exe no specs 662150.exe no specs 263864.exe no specs 263864.exe no specs 430652.exe no specs 430652.exe no specs 789451.exe no specs 789451.exe no specs 379175.exe no specs 379175.exe no specs 678787.exe no specs 678787.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
236"C:\Users\admin\AppData\Roaming\Download\543991.exe" C:\Users\admin\AppData\Roaming\Download\543991.exe—543991.exe
User:
admin
Company:
Integrity Level:
MEDIUM
Description:
Exit code:
0
Version:
5.6.1.1
Modules
Images
c:\users\admin\appdata\roaming\download\543991.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shlwapi.dll
240"C:\Users\admin\AppData\Roaming\Download\397313.exe" /ShorttailedrestartC:\Users\admin\AppData\Roaming\Download\397313.exe—gmiomp.exe
User:
admin
Company:
Integrity Level:
MEDIUM
Description:
Exit code:
0
Version:
5.6.1.1
Modules
Images
c:\users\admin\appdata\roaming\download\397313.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shlwapi.dll
536"C:\Users\admin\AppData\Roaming\Download\395736.exe" C:\Users\admin\AppData\Roaming\Download\395736.exe—395736.exe
User:
admin
Company:
Integrity Level:
MEDIUM
Description:
Exit code:
0
Version:
5.6.1.1
Modules
Images
c:\users\admin\appdata\roaming\download\395736.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shlwapi.dll
660"C:\Users\admin\AppData\Local\Temp\gmiomp.exe" /jsjczxztcqC:\Users\admin\AppData\Local\Temp\gmiomp.exe
gmiomp.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\appdata\local\temp\gmiomp.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shlwapi.dll
720"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --disable-quic --no-appcompat-clear --mojo-platform-channel-handle=6124 --field-trial-handle=2408,i,2726218995822703184,15422718113945543343,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
720"C:\Users\admin\AppData\Roaming\Download\159365.exe" C:\Users\admin\AppData\Roaming\Download\159365.exe—159365.exe
User:
admin
Company:
Integrity Level:
MEDIUM
Description:
Exit code:
0
Version:
5.6.1.1
Modules
Images
c:\users\admin\appdata\roaming\download\159365.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shlwapi.dll
728"C:\Users\admin\AppData\Roaming\Download\493538.exe" C:\Users\admin\AppData\Roaming\Download\493538.exe—493538.exe
User:
admin
Company:
Integrity Level:
MEDIUM
Description:
Exit code:
0
Version:
5.6.1.1
Modules
Images
c:\users\admin\appdata\roaming\download\493538.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shlwapi.dll
728"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --disable-quic --no-appcompat-clear --mojo-platform-channel-handle=5512 --field-trial-handle=2408,i,2726218995822703184,15422718113945543343,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
736"C:\Users\admin\AppData\Roaming\Download\499989.exe" /ShorttailedrestartC:\Users\admin\AppData\Roaming\Download\499989.exe—gmiomp.exe
User:
admin
Company:
Integrity Level:
MEDIUM
Description:
Exit code:
0
Version:
5.6.1.1
Modules
Images
c:\users\admin\appdata\roaming\download\499989.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shlwapi.dll
864"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --disable-quic --no-appcompat-clear --mojo-platform-channel-handle=5948 --field-trial-handle=2408,i,2726218995822703184,15422718113945543343,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
Total events
26 544
Read events
26 516
Write events
28
Delete events
0

Modification events

(PID) Process:(6032) 2025-05-29_2642fa53627640e526a0c36f772f9956_elex_icedid_stop.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows Script\Settings
Operation:writeName:JITDebug
Value:
0
(PID) Process:(6032) 2025-05-29_2642fa53627640e526a0c36f772f9956_elex_icedid_stop.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(2420) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:state
Value:
1
(PID) Process:(6032) 2025-05-29_2642fa53627640e526a0c36f772f9956_elex_icedid_stop.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
Operation:writeName:SlowContextMenuEntries
Value:
6024B221EA3A6910A2DC08002B30309D0A010000BD0E0C47735D584D9CEDE91E22E23282770100000114020000000000C0000000000000468D0000006078A409B011A54DAFA526D86198A780390100009AD298B2EDA6DE11BA8CA68E55D895936E000000
(PID) Process:(6032) 2025-05-29_2642fa53627640e526a0c36f772f9956_elex_icedid_stop.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(6032) 2025-05-29_2642fa53627640e526a0c36f772f9956_elex_icedid_stop.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(2420) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:failed_count
Value:
0
(PID) Process:(2420) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:state
Value:
2
(PID) Process:(2420) msedge.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientStateMedium\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\LastWasDefault
Operation:writeName:S-1-5-21-1693682860-607145093-2874071422-1001
Value:
65F5B75FDA942F00
(PID) Process:(2420) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\StabilityMetrics
Operation:writeName:user_experience_metrics.stability.exited_cleanly
Value:
0
Executable files
53
Suspicious files
173
Text files
56
Unknown types
6

Dropped files

PID
Process
Filename
Type
2420msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\parcel_tracking_db\LOG.old~RF11eb57.TMP —
MD5:—
SHA256:—
2420msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\parcel_tracking_db\LOG.old —
MD5:—
SHA256:—
2420msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old~RF11eb67.TMP —
MD5:—
SHA256:—
2420msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old —
MD5:—
SHA256:—
60322025-05-29_2642fa53627640e526a0c36f772f9956_elex_icedid_stop.exeC:\Users\admin\AppData\Local\Temp\gmiomp.exeexecutable
MD5:2642FA53627640E526A0C36F772F9956
SHA256:C144D9490BF8749637878661B9661FE59F613CB59A1D1E5B71B631C36675B844
660gmiomp.exeC:\Users\admin\AppData\Local\Temp\6864218195\....\TemporaryFileexecutable
MD5:2642FA53627640E526A0C36F772F9956
SHA256:C144D9490BF8749637878661B9661FE59F613CB59A1D1E5B71B631C36675B844
2420msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Variationsbinary
MD5:CF51C24E444F50F86D6149814130A476
SHA256:195D5778197A31A34D0E9E4431271194C0673FE1240DF9BD7A08C409D05E3414
660gmiomp.exeC:\Users\admin\AppData\Roaming\Download\545516.exeexecutable
MD5:2976DBF7D305D1E2549F290EC95C970E
SHA256:0352EC3A0742982571EA65D56614E1B6E6448F4E112695BBA1B37219FCE188D0
2420msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG.oldtext
MD5:43177E17EA12FD833ABD2E5B4E22AD68
SHA256:BCACFDDDB8694D7266513F9769D27D54938DA8C689AD8B42986347594BAD2271
60322025-05-29_2642fa53627640e526a0c36f772f9956_elex_icedid_stop.exeC:\Users\admin\AppData\Local\Temp\ldsajdklsajdlkjsalkda.battext
MD5:8D429A42926EE993FD964B694D838812
SHA256:20CEFB599F8C1ACAED3C65CE14B8ADB23F0FFDD0EB65A511DC614AA74CEE02DD
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
281
TCP/UDP connections
232
DNS requests
169
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
503
13.107.6.158:443
https://business.bing.com/work/api/v2/tenant/my/settingswithflights?&clienttype=edge-omnibox
unknown
html
13.7 Kb
whitelisted
—
—
GET
404
13.107.6.158:443
https://business.bing.com/api/v1/user/token/microsoftgraph?&clienttype=edge-omnibox
unknown
—
—
—
—
—
GET
200
40.90.65.34:443
https://edge-mobile-static.azureedge.net/eccp/get?settenant=edge-config&setplatform=win&setmkt=en-US&setchannel=stable
unknown
binary
16.0 Kb
whitelisted
—
—
GET
200
150.171.27.11:443
https://edge.microsoft.com/serviceexperimentation/v3/?osname=win&channel=stable&osver=10.0.19045&devicefamily=desktop&installdate=1661339457&clientversion=122.0.2365.59&experimentationmode=2&scpguard=0&scpfull=0&scpver=0
unknown
binary
446 b
whitelisted
—
—
GET
200
13.107.42.16:443
https://config.edge.skype.com/config/v1/Edge/122.0.2365.59?clientId=4489578223053569932&agents=EdgeFirstRun%2CEdgeFirstRunConfig&osname=win&client=edge&channel=stable&scpfre=0&osarch=x86_64&osver=10.0.19045&wu=1&devicefamily=desktop&uma=0&sessionid=47&mngd=0&installdate=1661339457&edu=0&bphint=2&soobedate=1504771245&fg=1
unknown
binary
768 b
whitelisted
7464
RUXIMICS.exe
GET
200
23.48.23.156:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
7464
RUXIMICS.exe
GET
200
2.23.181.156:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
—
106.63.24.67:443
https://hao.360.cn/?src=lm&ls=n6abbbb598c
unknown
—
—
—
2140
msedge.exe
GET
301
101.198.2.134:80
http://hao.360.cn/?src=lm&ls=n6abbbb598c
unknown
—
—
whitelisted
—
—
GET
404
13.107.6.158:443
https://business.bing.com/work/api/v2/tenant/my/settingswithflights?&clienttype=edge-omnibox
unknown
—
—
—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
7464
RUXIMICS.exe
40.127.240.158:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
40.127.240.158:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
7464
RUXIMICS.exe
23.48.23.156:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
7464
RUXIMICS.exe
2.23.181.156:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
2140
msedge.exe
13.107.6.158:443
business.bing.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
2140
msedge.exe
150.171.28.11:443
edge.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
2140
msedge.exe
13.107.42.16:443
config.edge.skype.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
2420
msedge.exe
239.255.255.250:1900
—
—
—
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.185.142
whitelisted
dt.hebchengjiu.com
  • —
unknown
crl.microsoft.com
  • 23.48.23.156
  • 23.48.23.143
whitelisted
www.microsoft.com
  • 2.23.181.156
whitelisted
config.edge.skype.com
  • 13.107.42.16
whitelisted
hao.360.cn
  • 101.198.2.134
whitelisted
edge.microsoft.com
  • 150.171.28.11
  • 150.171.27.11
whitelisted
edge-mobile-static.azureedge.net
  • 13.107.253.45
whitelisted
business.bing.com
  • 13.107.6.158
whitelisted
hao.360.com
  • 106.63.24.67
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
2025-05-29_2642fa53627640e526a0c36f772f9956_elex_icedid_stop