File name:

2025-05-18_b09ff10ef5be3cdfba5372e5a4d78e11_amadey_elex_gcleaner_rhadamanthys_smoke-loader_stealc_tofsee

Full analysis: https://app.any.run/tasks/d6e0714c-b859-44a1-a0ea-0f7c3508f624
Verdict: Malicious activity
Analysis date: May 18, 2025, 21:57:17
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
auto-reg
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 3 sections
MD5:

B09FF10EF5BE3CDFBA5372E5A4D78E11

SHA1:

85868AB26A395EBE86D65A1B38ECFAB002005E59

SHA256:

E3F8A9B549C5A8BDD157E166FFD936C0F2FCF291EC985AD9DBCB423BC659BFE1

SSDEEP:

6144:6Y60nsDE8niEdxccFBtFH/zTUTnLoSSxO+2:6FE8iEbccJ9/z0Ul2

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • 2025-05-18_b09ff10ef5be3cdfba5372e5a4d78e11_amadey_elex_gcleaner_rhadamanthys_smoke-loader_stealc_tofsee.exe (PID: 7264)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • 2025-05-18_b09ff10ef5be3cdfba5372e5a4d78e11_amadey_elex_gcleaner_rhadamanthys_smoke-loader_stealc_tofsee.exe (PID: 7264)

    • Executable content was dropped or overwritten

      • 2025-05-18_b09ff10ef5be3cdfba5372e5a4d78e11_amadey_elex_gcleaner_rhadamanthys_smoke-loader_stealc_tofsee.exe (PID: 7264)

    • Executes application which crashes

      • 2025-05-18_b09ff10ef5be3cdfba5372e5a4d78e11_amadey_elex_gcleaner_rhadamanthys_smoke-loader_stealc_tofsee.exe (PID: 7264)
      • qkkcfptf.exe (PID: 7460)
      • qkkcfptf.exe (PID: 7696)

    • Detected use of alternative data streams (AltDS)

      • svchost.exe (PID: 7588)
      • svchost.exe (PID: 7716)

  • INFO

    • Create files in a temporary directory

      • 2025-05-18_b09ff10ef5be3cdfba5372e5a4d78e11_amadey_elex_gcleaner_rhadamanthys_smoke-loader_stealc_tofsee.exe (PID: 7264)

    • Process checks computer location settings

      • 2025-05-18_b09ff10ef5be3cdfba5372e5a4d78e11_amadey_elex_gcleaner_rhadamanthys_smoke-loader_stealc_tofsee.exe (PID: 7264)

    • Reads the computer name

      • 2025-05-18_b09ff10ef5be3cdfba5372e5a4d78e11_amadey_elex_gcleaner_rhadamanthys_smoke-loader_stealc_tofsee.exe (PID: 7264)
      • qkkcfptf.exe (PID: 7460)
      • qkkcfptf.exe (PID: 7696)

    • Checks supported languages

      • 2025-05-18_b09ff10ef5be3cdfba5372e5a4d78e11_amadey_elex_gcleaner_rhadamanthys_smoke-loader_stealc_tofsee.exe (PID: 7264)
      • qkkcfptf.exe (PID: 7460)
      • qkkcfptf.exe (PID: 7696)

    • Auto-launch of the file from Registry key

      • 2025-05-18_b09ff10ef5be3cdfba5372e5a4d78e11_amadey_elex_gcleaner_rhadamanthys_smoke-loader_stealc_tofsee.exe (PID: 7264)

    • Manual execution by a user

      • qkkcfptf.exe (PID: 7696)

    • Checks proxy server information

      • slui.exe (PID: 536)

    • Reads the software policy settings

      • slui.exe (PID: 536)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (76.4)
.exe | Win32 Executable (generic) (12.4)
.exe | Generic Win/DOS Executable (5.5)
.exe | DOS Executable Generic (5.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2023:02:07 03:57:51+00:00
ImageFileCharacteristics: No relocs, Executable, 32-bit
PEType: PE32
LinkerVersion: 10
CodeSize: 136704
InitializedDataSize: 32315904
UninitializedDataSize: -
EntryPoint: 0x80cd
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
FileVersionNumber: 35.0.0.0
ProductVersionNumber: 13.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Unknown (0293)
CharacterSet: Unknown (85B1)
CompanyName: Siply
FileDescriptions: PlasticFantastic
FileVersion: 46.76.13.71
InternalName: Literally.exe
LegalCopyrights: Challangers kenia
ProductName: Game
ProductVersion: 9.54.3.76
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
140
Monitored processes
11
Malicious processes
3
Suspicious processes
2

Behavior graph

Click at the process to see the details
start 2025-05-18_b09ff10ef5be3cdfba5372e5a4d78e11_amadey_elex_gcleaner_rhadamanthys_smoke-loader_stealc_tofsee.exe wusa.exe no specs wusa.exe qkkcfptf.exe werfault.exe no specs svchost.exe no specs werfault.exe no specs qkkcfptf.exe svchost.exe no specs werfault.exe no specs slui.exe

Process information

PID
CMD
Path
Indicators
Parent process
536C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
7264"C:\Users\admin\Desktop\2025-05-18_b09ff10ef5be3cdfba5372e5a4d78e11_amadey_elex_gcleaner_rhadamanthys_smoke-loader_stealc_tofsee.exe" C:\Users\admin\Desktop\2025-05-18_b09ff10ef5be3cdfba5372e5a4d78e11_amadey_elex_gcleaner_rhadamanthys_smoke-loader_stealc_tofsee.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221225477
Modules
Images
c:\users\admin\desktop\2025-05-18_b09ff10ef5be3cdfba5372e5a4d78e11_amadey_elex_gcleaner_rhadamanthys_smoke-loader_stealc_tofsee.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\gdi32.dll
7312"C:\Windows\System32\wusa.exe" C:\Windows\SysWOW64\wusa.exe—2025-05-18_b09ff10ef5be3cdfba5372e5a4d78e11_amadey_elex_gcleaner_rhadamanthys_smoke-loader_stealc_tofsee.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Update Standalone Installer
Exit code:
3221226540
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\wusa.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
7416"C:\WINDOWS\SysWOW64\wusa.exe" C:\Windows\SysWOW64\wusa.exe
2025-05-18_b09ff10ef5be3cdfba5372e5a4d78e11_amadey_elex_gcleaner_rhadamanthys_smoke-loader_stealc_tofsee.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Update Standalone Installer
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\wusa.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
7460"C:\Users\admin\qkkcfptf.exe" /d"C:\Users\admin\Desktop\2025-05-18_b09ff10ef5be3cdfba5372e5a4d78e11_amadey_elex_gcleaner_rhadamanthys_smoke-loader_stealc_tofsee.exe" /e5E0402100000007FC:\Users\admin\qkkcfptf.exe
2025-05-18_b09ff10ef5be3cdfba5372e5a4d78e11_amadey_elex_gcleaner_rhadamanthys_smoke-loader_stealc_tofsee.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221225477
Modules
Images
c:\users\admin\qkkcfptf.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\gdi32.dll
7556C:\WINDOWS\SysWOW64\WerFault.exe -u -p 7264 -s 1336C:\Windows\SysWOW64\WerFault.exe—2025-05-18_b09ff10ef5be3cdfba5372e5a4d78e11_amadey_elex_gcleaner_rhadamanthys_smoke-loader_stealc_tofsee.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
7588svchost.exeC:\Windows\SysWOW64\svchost.exe—qkkcfptf.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Host Process for Windows Services
Exit code:
3221225501
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\ws2_32.dll
7640C:\WINDOWS\SysWOW64\WerFault.exe -u -p 7460 -s 560C:\Windows\SysWOW64\WerFault.exe—qkkcfptf.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
7696"C:\Users\admin\qkkcfptf.exe"C:\Users\admin\qkkcfptf.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221225477
Modules
Images
c:\users\admin\qkkcfptf.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\gdi32.dll
c:\windows\syswow64\win32u.dll
7716svchost.exeC:\Windows\SysWOW64\svchost.exe—qkkcfptf.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Host Process for Windows Services
Exit code:
3221225501
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\ws2_32.dll
c:\windows\syswow64\rpcrt4.dll
Total events
5 248
Read events
5 243
Write events
3
Delete events
2

Modification events

(PID) Process:(7264) 2025-05-18_b09ff10ef5be3cdfba5372e5a4d78e11_amadey_elex_gcleaner_rhadamanthys_smoke-loader_stealc_tofsee.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:ksxiejwe
Value:
"C:\Users\admin\qkkcfptf.exe"
(PID) Process:(7588) svchost.exeKey:HKEY_CURRENT_USER\Control Panel\Buses
Operation:writeName:Config0
Value:
008DDD3F4DF5303D24EDB47D450DD49D084297DCE82E72BAA4C2638A0E3C781D9EAB438DD3CC945D24EDB47D470DD49D024195DAF71261ADC06D04FDA6E22673BBC9154961CDA56B16DC874A713DE0A5644490BDB57E21E4955E05C9FCBA54758DF21D5904E0A56E1DDC864F743CE59D084295D9E13F4BB4C06D00FDA1F5377894D92B546AABFB5D2E9BD10F7934E0BD004C80D8B90775B3845C07DDF6BD6525C49C460734F5AE6E16E7D740273DE4AD541DC5D9A42C29ED962C0CCAF7BE113D92CC497B34F5A51B12D881487138E1A85115B69DF12872E0945F75C5F2B8652CEEF2154539FDA46D14DD844D75048BFF1C10C48DB47D24ED945D3DA2A7F5692DD6EC417B31F4A3547B89CC40743F95A82218CDFB8D1267B4995D06BCF1CB6258D0A42B596DF0A46F65D8F2487D4BDDC2065DC98DB60C219B922B04F49BFE2420D49F350842F8A2692E9FD109793DE6DC5C15C58CB44464EC995D06BCFDBD662BD0A4040F39FDA46D14DD844D7404A4AE591DC48DB47D24ED946444C9F9BD665CD1EB430C3CC7E63850D0844F053595A9516BFDCDB57024EFE5550DBCF2CF5D6DD690440F45F5AD1C12AFBD0D7730E4AD5C1CB18DB47D1DAD905004CFF4BF642FD49F7E4F61B9A96A12D5863B074EED94141CC98DB4752598945D04F4B4BF692AD295467B478FA45454DE894D743DE4AD541DB5B4F47929EA935802CA87B8111794C1134E3EC794
(PID) Process:(7588) svchost.exeKey:HKEY_CURRENT_USER\Control Panel\Buses
Operation:delete valueName:Config1
Value:
(PID) Process:(7716) svchost.exeKey:HKEY_CURRENT_USER\Control Panel\Buses
Operation:writeName:Config0
Value:
008D363D4DF5303D24EDB47D450DD49D084297DCE82E72BAA4C2638A0E3C781DFCB4981FD3CC945D24EDB47D470DD49D024195DAF71261ADC06D04FDA6E22673BBC9154961CDA56B16DC874A713DE0A5644490BDB57E21E4955E05C9FCBA54758DF21D5904E0A56E1DDC864F743CE59D084295D9E13F4BB4C06D00FDA1F5377894D92B546AABFB5D2E9BD10F7934E0BD004C80D8B90775B3845C07DDF6BD6525C49C460734F5AE6E16E7D740273DE4AD541DC5D9A42C29ED945905CAF7BE113D92CC497B34F5A51B12D881487138E1A85115B69DF12872E0945D00CCF2B8652CEEF2154539FDA46D14DD844D75048BFF1C10C48DB47D24ED945D3DA2A7F5692DD49C307B31F4A7547B89CC40743DE5D92218CDFF8D1267B4995D04CC80CB6258D4A42B596DF0A46D15A9F2487D4FDDC2065DC98DB47C509B922877F49BFE2420D49D457942F8A26D2E9FD109793DE4A95515C58CB44464EC995D04C9F6BD662BD0A4040F39FDA46D14DD844D7404A4AE591DC48DB47D24ED946444C9F9BD642CA0EB430C30C7E63850D0844D703C95A9516BFDCDB57024ED905C0DBCF2CF5D6DD690440D30FCAD1C12AFBD0D7730E4AD5715B18DB47D1DAD905004CFF4BF642FD49F7E4F61B9A96A12D5863B074EED94141CC98DB47E2C98945D04F4B4BF692AD295467B478FA45454DE894D743C90DB2219B7B4F47929EA935802CA87B8111794C1134E3EC794
(PID) Process:(7716) svchost.exeKey:HKEY_CURRENT_USER\Control Panel\Buses
Operation:delete valueName:Config1
Value:
Executable files
2
Suspicious files
1
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
72642025-05-18_b09ff10ef5be3cdfba5372e5a4d78e11_amadey_elex_gcleaner_rhadamanthys_smoke-loader_stealc_tofsee.exeC:\Users\admin\AppData\Local\Temp\xateenoo.exeexecutable
MD5:DC91AEF233621CDFB16D61D34116371A
SHA256:BD241ED05371AE0EF21B16073DAD86E3A2C53BC0568019E8E206487DCACECA19
7588svchost.exeC:\Users\admin:.reposbinary
MD5:550B3B84797700F59B374915B8BDD17A
SHA256:3DD3456E3EEF69E88D6F32351380F41953A5BFE59D0006A0D9EDDCCE8A06A600
72642025-05-18_b09ff10ef5be3cdfba5372e5a4d78e11_amadey_elex_gcleaner_rhadamanthys_smoke-loader_stealc_tofsee.exeC:\Users\admin\qkkcfptf.exeexecutable
MD5:B498AD01D445652E5C97FC86787DACC4
SHA256:71E44FC30C8302D6169900B454C96B92819F8DCB65461424BB68EF4CCFBDB0A1
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
49
DNS requests
19
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2104
svchost.exe
GET
200
23.216.77.6:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
2104
svchost.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
7924
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%202.1.crl
unknown
—
—
whitelisted
7924
SIHClient.exe
GET
200
2.20.245.137:80
http://crl.microsoft.com/pki/crl/products/MicTimStaPCA_2010-07-01.crl
unknown
—
—
whitelisted
7924
SIHClient.exe
GET
200
2.20.245.137:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl
unknown
—
—
whitelisted
7924
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
7924
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Signing%20CA%202.1.crl
unknown
—
—
whitelisted
7924
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%202.2.crl
unknown
—
—
whitelisted
7924
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Signing%20CA%202.2.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2104
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3216
svchost.exe
172.211.123.248:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
2104
svchost.exe
23.216.77.6:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
2104
svchost.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
6544
svchost.exe
20.190.160.131:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
7924
SIHClient.exe
172.202.163.200:443
slscr.update.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
GB
whitelisted
7924
SIHClient.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 20.73.194.208
whitelisted
google.com
  • 172.217.18.14
whitelisted
client.wns.windows.com
  • 172.211.123.248
whitelisted
crl.microsoft.com
  • 23.216.77.6
  • 23.216.77.38
  • 23.216.77.8
  • 23.216.77.22
  • 23.216.77.30
  • 23.216.77.25
  • 23.216.77.41
  • 2.20.245.137
  • 2.20.245.139
whitelisted
www.microsoft.com
  • 184.30.21.171
  • 95.101.149.131
whitelisted
login.live.com
  • 20.190.160.131
  • 20.190.160.5
  • 20.190.160.20
  • 40.126.32.140
  • 20.190.160.67
  • 20.190.160.17
  • 40.126.32.133
  • 20.190.160.64
whitelisted
slscr.update.microsoft.com
  • 172.202.163.200
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.3.187.198
whitelisted
activation-v2.sls.microsoft.com
  • 20.83.72.98
  • 40.91.76.224
whitelisted
nexusrules.officeapps.live.com
  • 52.111.227.11
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
2025-05-18_b09ff10ef5be3cdfba5372e5a4d78e11_amadey_elex_gcleaner_rhadamanthys_smoke-loader_stealc_tofsee