File name:

2025-07-05_01fa0ba9caa55973206143e048cfe1b7_amadey_elex_gcleaner_rhadamanthys_smoke-loader_stop

Full analysis: https://app.any.run/tasks/c67329c8-3ba4-4656-9630-72ac2147c39f
Verdict: Malicious activity
Analysis date: July 05, 2025, 23:25:08
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
auto-reg
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 3 sections
MD5:

01FA0BA9CAA55973206143E048CFE1B7

SHA1:

5E6D4B2DC09F4C9782974AF431EB8687248F41C5

SHA256:

D3B404E54077F1BFD519177530A22D00D428CC14C31E09627C87AACA16A13C3B

SSDEEP:

6144:eMWQOONqU4oCP4OzRvXcDqpEKigVNEsK6uwfQNOWjnCTF629WxplHymhWub9fcNw:elqN7OlvXtJ7VoCTBilHjdb9oG6Oew

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • backgroundTaskHost.exe (PID: 436)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • 2025-07-05_01fa0ba9caa55973206143e048cfe1b7_amadey_elex_gcleaner_rhadamanthys_smoke-loader_stop.exe (PID: 1044)

    • Reads security settings of Internet Explorer

      • 2025-07-05_01fa0ba9caa55973206143e048cfe1b7_amadey_elex_gcleaner_rhadamanthys_smoke-loader_stop.exe (PID: 1044)

    • Executing commands from a ".bat" file

      • 2025-07-05_01fa0ba9caa55973206143e048cfe1b7_amadey_elex_gcleaner_rhadamanthys_smoke-loader_stop.exe (PID: 1044)

    • Starts CMD.EXE for commands execution

      • 2025-07-05_01fa0ba9caa55973206143e048cfe1b7_amadey_elex_gcleaner_rhadamanthys_smoke-loader_stop.exe (PID: 1044)

    • Uses ATTRIB.EXE to modify file attributes

      • cmd.exe (PID: 6384)

    • Executes application which crashes

      • 2025-07-05_01fa0ba9caa55973206143e048cfe1b7_amadey_elex_gcleaner_rhadamanthys_smoke-loader_stop.exe (PID: 1044)

    • Process run an executable payload

      • rundll32.exe (PID: 1324)

    • Application launched itself

      • updater.exe (PID: 2072)

    • The process executes via Task Scheduler

      • updater.exe (PID: 2072)

  • INFO

    • Reads the computer name

      • 2025-07-05_01fa0ba9caa55973206143e048cfe1b7_amadey_elex_gcleaner_rhadamanthys_smoke-loader_stop.exe (PID: 1044)
      • updater.exe (PID: 2072)

    • Checks supported languages

      • 2025-07-05_01fa0ba9caa55973206143e048cfe1b7_amadey_elex_gcleaner_rhadamanthys_smoke-loader_stop.exe (PID: 1044)
      • updater.exe (PID: 2072)
      • updater.exe (PID: 416)

    • Creates files in the program directory

      • 2025-07-05_01fa0ba9caa55973206143e048cfe1b7_amadey_elex_gcleaner_rhadamanthys_smoke-loader_stop.exe (PID: 1044)

    • Reads the software policy settings

      • 2025-07-05_01fa0ba9caa55973206143e048cfe1b7_amadey_elex_gcleaner_rhadamanthys_smoke-loader_stop.exe (PID: 1044)
      • slui.exe (PID: 3476)

    • Create files in a temporary directory

      • 2025-07-05_01fa0ba9caa55973206143e048cfe1b7_amadey_elex_gcleaner_rhadamanthys_smoke-loader_stop.exe (PID: 1044)

    • Creates files or folders in the user directory

      • 2025-07-05_01fa0ba9caa55973206143e048cfe1b7_amadey_elex_gcleaner_rhadamanthys_smoke-loader_stop.exe (PID: 1044)

    • Reads the machine GUID from the registry

      • 2025-07-05_01fa0ba9caa55973206143e048cfe1b7_amadey_elex_gcleaner_rhadamanthys_smoke-loader_stop.exe (PID: 1044)

    • Checks proxy server information

      • 2025-07-05_01fa0ba9caa55973206143e048cfe1b7_amadey_elex_gcleaner_rhadamanthys_smoke-loader_stop.exe (PID: 1044)
      • backgroundTaskHost.exe (PID: 436)
      • slui.exe (PID: 3476)

    • Launching a file from a Registry key

      • backgroundTaskHost.exe (PID: 436)

    • Process checks computer location settings

      • 2025-07-05_01fa0ba9caa55973206143e048cfe1b7_amadey_elex_gcleaner_rhadamanthys_smoke-loader_stop.exe (PID: 1044)

    • Reads security settings of Internet Explorer

      • backgroundTaskHost.exe (PID: 436)
      • rundll32.exe (PID: 1324)

    • Manual execution by a user

      • rundll32.exe (PID: 1324)

    • Process checks whether UAC notifications are on

      • updater.exe (PID: 2072)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (76.4)
.exe | Win32 Executable (generic) (12.4)
.exe | Generic Win/DOS Executable (5.5)
.exe | DOS Executable Generic (5.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2015:08:06 10:25:55+00:00
ImageFileCharacteristics: No relocs, Executable, 32-bit
PEType: PE32
LinkerVersion: 8
CodeSize: 221184
InitializedDataSize: 192512
UninitializedDataSize: -
EntryPoint: 0x3aa3
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
144
Monitored processes
11
Malicious processes
0
Suspicious processes
2

Behavior graph

Click at the process to see the details
start 2025-07-05_01fa0ba9caa55973206143e048cfe1b7_amadey_elex_gcleaner_rhadamanthys_smoke-loader_stop.exe backgroundtaskhost.exe cmd.exe no specs conhost.exe no specs attrib.exe no specs werfault.exe no specs werfault.exe no specs rundll32.exe no specs updater.exe no specs updater.exe no specs slui.exe

Process information

PID
CMD
Path
Indicators
Parent process
416"C:\Program Files (x86)\Google\GoogleUpdater\134.0.6985.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\134.0.6985.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=134.0.6985.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x2a0,0x2a4,0x2a8,0x27c,0x2ac,0x111c460,0x111c46c,0x111c478C:\Program Files (x86)\Google\GoogleUpdater\134.0.6985.0\updater.exe—updater.exe
User:
SYSTEM
Company:
Google LLC
Integrity Level:
SYSTEM
Description:
Google Updater
Exit code:
0
Version:
134.0.6985.0
Modules
Images
c:\program files (x86)\google\googleupdater\134.0.6985.0\updater.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
c:\windows\syswow64\msvcrt.dll
436"backgroundTaskHost.exe"C:\Windows\SysWOW64\backgroundTaskHost.exe
2025-07-05_01fa0ba9caa55973206143e048cfe1b7_amadey_elex_gcleaner_rhadamanthys_smoke-loader_stop.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Background Task Host
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\backgroundtaskhost.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
1044"C:\Users\admin\Desktop\2025-07-05_01fa0ba9caa55973206143e048cfe1b7_amadey_elex_gcleaner_rhadamanthys_smoke-loader_stop.exe" C:\Users\admin\Desktop\2025-07-05_01fa0ba9caa55973206143e048cfe1b7_amadey_elex_gcleaner_rhadamanthys_smoke-loader_stop.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221225477
Modules
Images
c:\users\admin\desktop\2025-07-05_01fa0ba9caa55973206143e048cfe1b7_amadey_elex_gcleaner_rhadamanthys_smoke-loader_stop.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\ws2_32.dll
1324rundll32.exe shell32.dll, ShellExec_RunDLL C:\PROGRA~3\DBD2HF~1.EXEC:\Windows\System32\rundll32.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
1223
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shcore.dll
c:\windows\system32\imagehlp.dll
2072"C:\Program Files (x86)\Google\GoogleUpdater\134.0.6985.0\updater.exe" --wake --systemC:\Program Files (x86)\Google\GoogleUpdater\134.0.6985.0\updater.exe—svchost.exe
User:
SYSTEM
Company:
Google LLC
Integrity Level:
SYSTEM
Description:
Google Updater
Exit code:
0
Version:
134.0.6985.0
Modules
Images
c:\program files (x86)\google\googleupdater\134.0.6985.0\updater.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
c:\windows\syswow64\msvcrt.dll
2144attrib -r -s -h "C:\Users\admin\Desktop\2025-07-05_01fa0ba9caa55973206143e048cfe1b7_amadey_elex_gcleaner_rhadamanthys_smoke-loader_stop.exe"C:\Windows\SysWOW64\attrib.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Attribute Utility
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\attrib.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
2280\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2668C:\WINDOWS\SysWOW64\WerFault.exe -u -p 1044 -s 1380C:\Windows\SysWOW64\WerFault.exe—2025-07-05_01fa0ba9caa55973206143e048cfe1b7_amadey_elex_gcleaner_rhadamanthys_smoke-loader_stop.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
2147942405
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
3476C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
5628C:\WINDOWS\SysWOW64\WerFault.exe -u -p 1044 -s 1992C:\Windows\SysWOW64\WerFault.exe—2025-07-05_01fa0ba9caa55973206143e048cfe1b7_amadey_elex_gcleaner_rhadamanthys_smoke-loader_stop.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
2147942405
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
Total events
14 430
Read events
14 424
Write events
6
Delete events
0

Modification events

(PID) Process:(436) backgroundTaskHost.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows
Operation:writeName:65a7ba
Value:
00000000000000000000000000000000000000000000000000000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(436) backgroundTaskHost.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows
Operation:writeName:65a7ba
Value:
00000000000000000000000000000000000000000000000000000000010000000000000000000000433A5C50726F6772616D446174615C646264326866666864302E65786500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(436) backgroundTaskHost.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:IntelPowerAgent5
Value:
rundll32.exe shell32.dll, ShellExec_RunDLL C:\PROGRA~3\DBD2HF~1.EXE
(PID) Process:(436) backgroundTaskHost.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(436) backgroundTaskHost.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(436) backgroundTaskHost.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
Executable files
1
Suspicious files
4
Text files
3
Unknown types
0

Dropped files

PID
Process
Filename
Type
10442025-07-05_01fa0ba9caa55973206143e048cfe1b7_amadey_elex_gcleaner_rhadamanthys_smoke-loader_stop.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A583E2A51BFBDC1E492A57B7C8325850binary
MD5:144D698C7F3CCD662F9460D8F443A2BB
SHA256:C5714AC85358D727F4EA913F814CCADCD7F6E063D95B54B886CCF6BFC31612C1
10442025-07-05_01fa0ba9caa55973206143e048cfe1b7_amadey_elex_gcleaner_rhadamanthys_smoke-loader_stop.exeC:\Users\admin\AppData\Local\etiE737.tmp.battext
MD5:E41CEA4F79429F11EC35B5309E5A814D
SHA256:2830F44BFD2597C0906971E692997D6EEE8894531C2A4529CA3CA4848D59926A
416updater.exeC:\Program Files (x86)\Google\GoogleUpdater\updater.logtext
MD5:FFE35DB75ED367E1A846B626C8CC276D
SHA256:A172DAF8FB73338F7CEBD3347E6EEEE1EED616148D86E59E478196C40175E285
10442025-07-05_01fa0ba9caa55973206143e048cfe1b7_amadey_elex_gcleaner_rhadamanthys_smoke-loader_stop.exeC:\ProgramData\dbd2hffhd0.exeexecutable
MD5:DE6BD517513493679F832AB9B6869B4A
SHA256:7328AEC38A919E1D5C8817B22B18E99CA000C69D594113DB0CE39B3F467BB907
10442025-07-05_01fa0ba9caa55973206143e048cfe1b7_amadey_elex_gcleaner_rhadamanthys_smoke-loader_stop.exeC:\Users\admin\AppData\Local\Temp\65a7ba9885b9ed5d98fbtext
MD5:AD230A572D79A7766D23B1FDDFFA5770
SHA256:4A34C67D61574D9542AD23752F3FB8EBBA4058A05BECA1B6DFC4BDAFFD372970
10442025-07-05_01fa0ba9caa55973206143e048cfe1b7_amadey_elex_gcleaner_rhadamanthys_smoke-loader_stop.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A583E2A51BFBDC1E492A57B7C8325850binary
MD5:F9A77F24364ED829DD4F4FF62808A4C8
SHA256:6F2CA133D262005BA823ADCCCF472A274EE11FA8AF9282B3CC217EAB400FC073
10442025-07-05_01fa0ba9caa55973206143e048cfe1b7_amadey_elex_gcleaner_rhadamanthys_smoke-loader_stop.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2CD1F910DD5DC23C234E99A91DE345C0binary
MD5:999F18B229A3BE4FE54BA752523824C3
SHA256:587759F56F4D957B57BE67BBC03A964C4813E91271E85B58F111666AA38F4F4C
10442025-07-05_01fa0ba9caa55973206143e048cfe1b7_amadey_elex_gcleaner_rhadamanthys_smoke-loader_stop.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2CD1F910DD5DC23C234E99A91DE345C0binary
MD5:BEBEBF9B9E1809DAD45D965B957AF1E4
SHA256:E4D2D1B0E8507FB3B41D8AF618A17237B674B481B6C67B8D3BA090EE2CF72DB1
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
11
TCP/UDP connections
27
DNS requests
13
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5944
MoUsoCoreWorker.exe
GET
200
23.32.238.107:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
23.32.238.107:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
23.32.238.107:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5944
MoUsoCoreWorker.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5876
RUXIMICS.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
1044
2025-07-05_01fa0ba9caa55973206143e048cfe1b7_amadey_elex_gcleaner_rhadamanthys_smoke-loader_stop.exe
GET
200
95.100.181.32:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl
unknown
—
—
whitelisted
1044
2025-07-05_01fa0ba9caa55973206143e048cfe1b7_amadey_elex_gcleaner_rhadamanthys_smoke-loader_stop.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicWinProPCA2011_2011-10-19.crl
unknown
—
—
whitelisted
—
—
POST
500
40.91.76.224:443
https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail
unknown
xml
512 b
whitelisted
2940
svchost.exe
GET
200
69.192.161.44:80
http://x1.c.lencr.org/
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
1268
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5944
MoUsoCoreWorker.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5876
RUXIMICS.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1268
svchost.exe
23.32.238.107:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5944
MoUsoCoreWorker.exe
23.32.238.107:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5876
RUXIMICS.exe
23.32.238.107:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
1268
svchost.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
5944
MoUsoCoreWorker.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
  • 51.104.136.2
whitelisted
google.com
  • 142.250.186.46
whitelisted
crl.microsoft.com
  • 23.32.238.107
  • 23.32.238.112
  • 95.100.181.32
  • 95.100.181.23
whitelisted
www.microsoft.com
  • 95.101.149.131
  • 184.30.21.171
whitelisted
download.windowsupdate.com
  • 199.232.214.172
  • 199.232.210.172
whitelisted
eboduftazce-ru.com
  • —
unknown
activation-v2.sls.microsoft.com
  • 40.91.76.224
whitelisted
x1.c.lencr.org
  • 69.192.161.44
whitelisted
self.events.data.microsoft.com
  • 20.44.10.123
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
2025-07-05_01fa0ba9caa55973206143e048cfe1b7_amadey_elex_gcleaner_rhadamanthys_smoke-loader_stop