File name:

2025-05-17_e7f6fb543474044f923d845d4fd3115e_amadey_elex_floxif_gcleaner_rhadamanthys_smoke-loader

Full analysis: https://app.any.run/tasks/6618933e-567a-4b2d-b7e3-20874ebcd5c7
Verdict: Malicious activity
Threats:

A backdoor is a type of cybersecurity threat that allows attackers to secretly compromise a system and conduct malicious activities, such as stealing data and modifying files. Backdoors can be difficult to detect, as they often use legitimate system applications to evade defense mechanisms. Threat actors often utilize special malware, such as PlugX, to establish backdoors on target devices.

Analysis date: May 17, 2025, 10:36:56
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
auto-reg
floxif
backdoor
spyware
loader
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 4 sections
MD5:

E7F6FB543474044F923D845D4FD3115E

SHA1:

55F6AB9F9AF96198CC3BBADBACC7448E8D1E77F9

SHA256:

D25B8FB2FA7F933402D24B6EE9EE2A3CFDD01FBDCA2A2CBE84B6A76D36EF9685

SSDEEP:

12288:B8SYRaxc7uz+YA8mPRGCA5bM1gChTUPyEGLBGg5nT9LhpL/9:2OcDh2M1hTlZLUg5NhpL/9

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Changes the autorun value in the registry

      • svchost.exe (PID: 7640)
    • Connects to the CnC server

      • 2025-05-17_e7f6fb543474044f923d845d4fd3115e_amadey_elex_floxif_gcleaner_rhadamanthys_smoke-loader.exe (PID: 7360)
      • svchost.exe (PID: 7640)
    • FLOXIF has been detected (YARA)

      • svchost.exe (PID: 7640)
  • SUSPICIOUS

    • Process drops legitimate windows executable

      • 2025-05-17_e7f6fb543474044f923d845d4fd3115e_amadey_elex_floxif_gcleaner_rhadamanthys_smoke-loader.exe (PID: 7360)
    • Executable content was dropped or overwritten

      • 2025-05-17_e7f6fb543474044f923d845d4fd3115e_amadey_elex_floxif_gcleaner_rhadamanthys_smoke-loader.exe (PID: 7360)
      • svchost.exe (PID: 7640)
      • 801274.exe (PID: 6816)
    • Application launched itself

      • 2025-05-17_e7f6fb543474044f923d845d4fd3115e_amadey_elex_floxif_gcleaner_rhadamanthys_smoke-loader.exe (PID: 7360)
      • 801274.exe (PID: 960)
      • uyfushuu.exe (PID: 5256)
      • uyfushuu.exe (PID: 536)
    • Reads security settings of Internet Explorer

      • 2025-05-17_e7f6fb543474044f923d845d4fd3115e_amadey_elex_floxif_gcleaner_rhadamanthys_smoke-loader.exe (PID: 7360)
    • Reads the date of Windows installation

      • 2025-05-17_e7f6fb543474044f923d845d4fd3115e_amadey_elex_floxif_gcleaner_rhadamanthys_smoke-loader.exe (PID: 7608)
    • Contacting a server suspected of hosting an CnC

      • 2025-05-17_e7f6fb543474044f923d845d4fd3115e_amadey_elex_floxif_gcleaner_rhadamanthys_smoke-loader.exe (PID: 7360)
      • svchost.exe (PID: 7640)
    • Connects to unusual port

      • svchost.exe (PID: 7640)
    • Connects to the server without a host name

      • svchost.exe (PID: 7640)
    • Potential Corporate Privacy Violation

      • svchost.exe (PID: 7640)
    • The process checks if it is being run in the virtual environment

      • 801274.exe (PID: 6816)
      • uyfushuu.exe (PID: 4776)
      • uyfushuu.exe (PID: 7532)
    • Starts itself from another location

      • 801274.exe (PID: 6816)
    • Starts CMD.EXE for commands execution

      • uyfushuu.exe (PID: 4776)
  • INFO

    • Create files in a temporary directory

      • 2025-05-17_e7f6fb543474044f923d845d4fd3115e_amadey_elex_floxif_gcleaner_rhadamanthys_smoke-loader.exe (PID: 7360)
    • Reads the computer name

      • 2025-05-17_e7f6fb543474044f923d845d4fd3115e_amadey_elex_floxif_gcleaner_rhadamanthys_smoke-loader.exe (PID: 7360)
      • 2025-05-17_e7f6fb543474044f923d845d4fd3115e_amadey_elex_floxif_gcleaner_rhadamanthys_smoke-loader.exe (PID: 7608)
      • 801274.exe (PID: 6816)
      • uyfushuu.exe (PID: 4776)
      • uyfushuu.exe (PID: 7532)
    • Failed to create an executable file in Windows directory

      • 2025-05-17_e7f6fb543474044f923d845d4fd3115e_amadey_elex_floxif_gcleaner_rhadamanthys_smoke-loader.exe (PID: 7360)
    • Checks supported languages

      • 2025-05-17_e7f6fb543474044f923d845d4fd3115e_amadey_elex_floxif_gcleaner_rhadamanthys_smoke-loader.exe (PID: 7360)
      • 2025-05-17_e7f6fb543474044f923d845d4fd3115e_amadey_elex_floxif_gcleaner_rhadamanthys_smoke-loader.exe (PID: 7608)
      • 801274.exe (PID: 960)
      • 801274.exe (PID: 6816)
      • uyfushuu.exe (PID: 5256)
      • uyfushuu.exe (PID: 4776)
      • uyfushuu.exe (PID: 536)
      • uyfushuu.exe (PID: 7532)
    • Checks proxy server information

      • 2025-05-17_e7f6fb543474044f923d845d4fd3115e_amadey_elex_floxif_gcleaner_rhadamanthys_smoke-loader.exe (PID: 7360)
      • svchost.exe (PID: 7640)
      • slui.exe (PID: 2852)
    • The sample compiled with english language support

      • 2025-05-17_e7f6fb543474044f923d845d4fd3115e_amadey_elex_floxif_gcleaner_rhadamanthys_smoke-loader.exe (PID: 7360)
    • Reads the machine GUID from the registry

      • 2025-05-17_e7f6fb543474044f923d845d4fd3115e_amadey_elex_floxif_gcleaner_rhadamanthys_smoke-loader.exe (PID: 7608)
    • Creates files in the program directory

      • 2025-05-17_e7f6fb543474044f923d845d4fd3115e_amadey_elex_floxif_gcleaner_rhadamanthys_smoke-loader.exe (PID: 7608)
      • svchost.exe (PID: 7640)
    • Auto-launch of the file from Registry key

      • svchost.exe (PID: 7640)
    • Reads security settings of Internet Explorer

      • svchost.exe (PID: 7640)
    • Creates files or folders in the user directory

      • 801274.exe (PID: 6816)
      • uyfushuu.exe (PID: 4776)
    • Reads the software policy settings

      • slui.exe (PID: 2852)
    • Manual execution by a user

      • uyfushuu.exe (PID: 536)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 EXE PECompact compressed (generic) (35.3)
.exe | Win32 Executable MS Visual C++ (generic) (26.5)
.exe | Win64 Executable (generic) (23.5)
.dll | Win32 Dynamic Link Library (generic) (5.5)
.exe | Win32 Executable (generic) (3.8)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2018:05:18 20:42:14+00:00
ImageFileCharacteristics: No relocs, Executable, 32-bit
PEType: PE32
LinkerVersion: 9
CodeSize: 29696
InitializedDataSize: 294912
UninitializedDataSize: -
EntryPoint: 0x25d0
OSVersion: 5
ImageVersion: -
SubsystemVersion: 5
Subsystem: Windows GUI
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
141
Monitored processes
14
Malicious processes
3
Suspicious processes
1

Behavior graph

Click at the process to see the details
start 2025-05-17_e7f6fb543474044f923d845d4fd3115e_amadey_elex_floxif_gcleaner_rhadamanthys_smoke-loader.exe 2025-05-17_e7f6fb543474044f923d845d4fd3115e_amadey_elex_floxif_gcleaner_rhadamanthys_smoke-loader.exe no specs #FLOXIF svchost.exe notepad.exe no specs slui.exe 801274.exe no specs 801274.exe uyfushuu.exe no specs uyfushuu.exe no specs cmd.exe no specs conhost.exe no specs notepad.exe no specs uyfushuu.exe no specs uyfushuu.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
536C:\Users\admin\AppData\Roaming\axusquxd\uyfushuu.exeC:\Users\admin\AppData\Roaming\axusquxd\uyfushuu.exeexplorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\roaming\axusquxd\uyfushuu.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\sechost.dll
c:\windows\syswow64\rpcrt4.dll
960"C:\ProgramData\{106EDD9E-7F64-5969-C4C3-E45FFFCF4D7D}\801274.exe"C:\ProgramData\{106EDD9E-7F64-5969-C4C3-E45FFFCF4D7D}\801274.exesvchost.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\programdata\{106edd9e-7f64-5969-c4c3-e45fffcf4d7d}\801274.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\sechost.dll
2284"C:\WINDOWS\system32\cmd.exe"C:\Windows\SysWOW64\cmd.exeuyfushuu.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
2852C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
4776"C:\Users\admin\AppData\Roaming\axusquxd\uyfushuu.exe"C:\Users\admin\AppData\Roaming\axusquxd\uyfushuu.exeuyfushuu.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\roaming\axusquxd\uyfushuu.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\shlwapi.dll
c:\windows\syswow64\msvcrt.dll
5256"C:\Users\admin\AppData\Roaming\axusquxd\uyfushuu.exe"C:\Users\admin\AppData\Roaming\axusquxd\uyfushuu.exe801274.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\roaming\axusquxd\uyfushuu.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\sechost.dll
6816"C:\ProgramData\{106EDD9E-7F64-5969-C4C3-E45FFFCF4D7D}\801274.exe"C:\ProgramData\{106EDD9E-7F64-5969-C4C3-E45FFFCF4D7D}\801274.exe
801274.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\programdata\{106edd9e-7f64-5969-c4c3-e45fffcf4d7d}\801274.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\shlwapi.dll
c:\windows\syswow64\msvcrt.dll
6944"C:\WINDOWS\system32\notepad.exe"C:\Windows\SysWOW64\notepad.execmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Notepad
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\notepad.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\gdi32.dll
c:\windows\syswow64\win32u.dll
7228\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.execmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
7360"C:\Users\admin\Desktop\2025-05-17_e7f6fb543474044f923d845d4fd3115e_amadey_elex_floxif_gcleaner_rhadamanthys_smoke-loader.exe" C:\Users\admin\Desktop\2025-05-17_e7f6fb543474044f923d845d4fd3115e_amadey_elex_floxif_gcleaner_rhadamanthys_smoke-loader.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\2025-05-17_e7f6fb543474044f923d845d4fd3115e_amadey_elex_floxif_gcleaner_rhadamanthys_smoke-loader.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\users\admin\appdata\local\temp\conres.dll
Total events
5 097
Read events
5 091
Write events
5
Delete events
1

Modification events

(PID) Process:(7640) svchost.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:{8153BD7F-1F85-C854-C4C3-E45FFFCF4D7D}
Value:
c:\programdata\{1D43954F-37B5-5444-C4C3-E45FFFCF4D7D}\b0fc45d0.exe
(PID) Process:(7360) 2025-05-17_e7f6fb543474044f923d845d4fd3115e_amadey_elex_floxif_gcleaner_rhadamanthys_smoke-loader.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(7360) 2025-05-17_e7f6fb543474044f923d845d4fd3115e_amadey_elex_floxif_gcleaner_rhadamanthys_smoke-loader.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(7360) 2025-05-17_e7f6fb543474044f923d845d4fd3115e_amadey_elex_floxif_gcleaner_rhadamanthys_smoke-loader.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(7608) 2025-05-17_e7f6fb543474044f923d845d4fd3115e_amadey_elex_floxif_gcleaner_rhadamanthys_smoke-loader.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:delete valueName:MicrosoftEdgeAutoLaunch_29EBC4579851B72EE312C449CF839B1A
Value:
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
(PID) Process:(2284) cmd.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:kexvc
Value:
C:\Users\admin\AppData\Roaming\axusquxd\uyfushuu.exe
Executable files
4
Suspicious files
1
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
6816801274.exeC:\Users\admin\AppData\Roaming\axusquxd\uyfushuu.exeexecutable
MD5:871E489E879885DB39C583B5CD90BC30
SHA256:60E8E6EA05F34EA7BBEB1B05DD93A6A36EBE3968B841B948426E6EB637DEDD0B
2284cmd.exeC:\Users\admin\AppData\Local\Temp\dd.tebinary
MD5:68531D42ADB0E194AF3429D154C8AB5F
SHA256:02633C2D1D72B3B380B6932C1D5B3665DBDF40DE8C51DEF0BE60098BB812D79B
7640svchost.exeC:\ProgramData\{106EDD9E-7F64-5969-C4C3-E45FFFCF4D7D}\801274.exeexecutable
MD5:871E489E879885DB39C583B5CD90BC30
SHA256:60E8E6EA05F34EA7BBEB1B05DD93A6A36EBE3968B841B948426E6EB637DEDD0B
73602025-05-17_e7f6fb543474044f923d845d4fd3115e_amadey_elex_floxif_gcleaner_rhadamanthys_smoke-loader.exeC:\Users\admin\AppData\Local\Temp\conres.dllexecutable
MD5:7574CF2C64F35161AB1292E2F532AABF
SHA256:DE055A89DE246E629A8694BDE18AF2B1605E4B9B493C7E4AEF669DD67ACF5085
73602025-05-17_e7f6fb543474044f923d845d4fd3115e_amadey_elex_floxif_gcleaner_rhadamanthys_smoke-loader.exeC:\Users\admin\AppData\Local\Temp\conres.dll.000text
MD5:1130C911BF5DB4B8F7CF9B6F4B457623
SHA256:EBA08CC8182F379392A97F542B350EA0DBBE5E4009472F35AF20E3D857EAFDF1
7640svchost.exeC:\ProgramData\{1D43954F-37B5-5444-C4C3-E45FFFCF4D7D}\b0fc45d0.exeexecutable
MD5:E7F6FB543474044F923D845D4FD3115E
SHA256:D25B8FB2FA7F933402D24B6EE9EE2A3CFDD01FBDCA2A2CBE84B6A76D36EF9685
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
12
TCP/UDP connections
55
DNS requests
22
Threats
6

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2104
svchost.exe
GET
200
23.216.77.18:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
whitelisted
2104
svchost.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
whitelisted
7360
2025-05-17_e7f6fb543474044f923d845d4fd3115e_amadey_elex_floxif_gcleaner_rhadamanthys_smoke-loader.exe
GET
403
72.14.178.174:80
http://www.aieov.com/logo.gif
unknown
malicious
8032
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%202.1.crl
unknown
whitelisted
8032
SIHClient.exe
GET
200
2.19.11.105:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl
unknown
whitelisted
8032
SIHClient.exe
GET
200
2.19.11.105:80
http://crl.microsoft.com/pki/crl/products/MicTimStaPCA_2010-07-01.crl
unknown
whitelisted
8032
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
whitelisted
8032
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Signing%20CA%202.1.crl
unknown
whitelisted
6404
RUXIMICS.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
whitelisted
8032
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%202.2.crl
unknown
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2104
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
192.168.100.255:137
whitelisted
6404
RUXIMICS.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
whitelisted
2104
svchost.exe
23.216.77.18:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
2104
svchost.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
6404
RUXIMICS.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
3216
svchost.exe
172.211.123.248:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
7360
2025-05-17_e7f6fb543474044f923d845d4fd3115e_amadey_elex_floxif_gcleaner_rhadamanthys_smoke-loader.exe
72.14.178.174:80
www.aieov.com
Linode, LLC
US
malicious

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
  • 51.124.78.146
  • 4.231.128.59
whitelisted
google.com
  • 142.250.185.174
whitelisted
crl.microsoft.com
  • 23.216.77.18
  • 23.216.77.20
  • 23.216.77.6
  • 23.216.77.13
  • 23.216.77.28
  • 23.216.77.8
  • 23.216.77.22
  • 23.216.77.15
  • 23.216.77.21
  • 2.19.11.105
  • 2.19.11.120
whitelisted
www.microsoft.com
  • 184.30.21.171
  • 2.23.246.101
whitelisted
client.wns.windows.com
  • 172.211.123.248
whitelisted
5isohu.com
whitelisted
www.aieov.com
  • 72.14.178.174
  • 45.33.20.235
  • 72.14.185.43
  • 45.33.23.183
  • 45.79.19.196
  • 198.58.118.167
  • 45.56.79.23
  • 45.33.30.197
  • 45.33.2.79
  • 96.126.123.244
  • 173.255.194.134
  • 45.33.18.44
malicious
login.live.com
  • 20.190.159.131
  • 40.126.31.130
  • 40.126.31.131
  • 20.190.159.129
  • 20.190.159.68
  • 20.190.159.0
  • 40.126.31.128
  • 40.126.31.129
whitelisted
slscr.update.microsoft.com
  • 4.175.87.197
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.3.187.198
whitelisted

Threats

PID
Process
Class
Message
7360
2025-05-17_e7f6fb543474044f923d845d4fd3115e_amadey_elex_floxif_gcleaner_rhadamanthys_smoke-loader.exe
Malware Command and Control Activity Detected
MALWARE [ANY.RUN] Possible Floxif CnC Communication
7640
svchost.exe
Malware Command and Control Activity Detected
ET MALWARE [PTsecurity] DorkBot.Downloader CnC Response
7640
svchost.exe
Malware Command and Control Activity Detected
ET MALWARE Win32/Kryptik.GSKY CnC Checkin
7640
svchost.exe
Potential Corporate Privacy Violation
ET INFO PE EXE or DLL Windows file download HTTP
7640
svchost.exe
Potentially Bad Traffic
ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response
7640
svchost.exe
Misc activity
ET INFO Packed Executable Download
No debug info