home

AdMunch.exe

Ad Muncher

Murray Hurps Software Pty Ltd

It is set to automatically start when a user logs into Windows via the current user run registry key under the display name ‘Ad Muncher’.
Publisher:
Murray Hurps Software Pty Ltd

Product:
Ad Muncher

Version:
4.93.33707

MD5:
bc43230baa482b7ed0a27f5844ca7432

SHA-1:
034e88afd0e50aaa9c7b5ce6a83be5e044b5bfb8

SHA-256:
624764a5f10931d1e05d7a2b5e36a3358388b2932f3ea3e650dfd14b46336546

Scanner detections:
2 / 68

Status:
Clean  (2 probable false positive detections)

Explanation:
These detections are probably false positives (erroneous), the file is probably malware free.

Analysis date:
11/8/2026 1:24:20 AM UTC  (today)

Scan engine
Detection
Engine version

Bkav FE
W32.Clod671.Trojan
1.3.0.4562

Quick Heal
(Suspicious) - DNAScan
12.13.12.00

File size:
1013.5 KB (1,037,824 bytes)

Product version:
4.93.33707

Copyright:
Copyright © Murray Hurps Software Pty Ltd

Original file name:
AdMunch.exe

File type:
Executable application (Win32 EXE)

Common path:
C:\Program Files\ad muncher\admunch.exe

File PE Metadata
Compilation timestamp:
6/13/2021 9:31:25 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:TsmJBf195VHb3sb93v4f6RbvSIfwIS70v1cVbk:T9Ti3vDRLS3IJd

Entry address:
0x9B1BF

Entry point:
89, 25, 00, 50, 4A, 00, 68, CF, B1, 49, 00, E8, 69, 97, 00, 00, 41, 4D, 33, 33, 37, 30, 37, 2E, 66, 72, 65, 00, 00, C4, 24, 3D, 82, 01, 00, 00, 0F, 85, A6, 2C, FD, FF, 68, A5, 36, 40, 00, E8, 1E, 31, FF, FF, C3, 8D, 7C, 24, 28, 57, 68, 24, 99, 45, 00, 90, 90, 90, 90, E9, 68, E0, FA, FF, 90, 90, 90, 68, D6, 40, AB, 00, 90, 90, 90, 90, E9, 00, E7, FE, FF, 90, 90, 90, 80, 7C, 24, 02, 00, 75, 13, 68, 55, 63, 44, 00, 56, E8, 2F, F2, FA, FF, 85, C0, 0F, 84, B4, 1F, 00, 00, 85, FF, 74, 28, 6A, 04, 8D, 4C, 24, 10...
 
[+]

Code size:
654.5 KB (670,208 bytes)

Startup File (User Run)
Registry location:
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Name:
Ad Muncher

Command:
"C:\Program Files\ad muncher\admunch.exe" \bt


The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):
Connects to static.yandex.net  (178.154.131.216:80)

TCP (HTTP):
Connects to srv242-131.vkontakte.ru  (87.240.143.242:80)

TCP (HTTP):
Connects to srv119-131.vkontakte.ru  (87.240.131.119:80)

TCP (HTTP):
Connects to ip94.147.odnoklassniki.ru  (217.20.147.94:80)

TCP (HTTP):
Connects to ip73.156.odnoklassniki.ru  (217.20.156.73:80)

TCP (HTTP):
Connects to ip31.155.odnoklassniki.ru  (217.20.155.31:80)

TCP (HTTP):
Connects to ip239.152.odnoklassniki.ru  (217.20.152.239:80)

TCP (HTTP):
Connects to ip202.152.odnoklassniki.ru  (217.20.152.202:80)

TCP (HTTP):
Connects to ip155.156.odnoklassniki.ru  (217.20.156.155:80)

TCP (HTTP):
Connects to ip144.156.odnoklassniki.ru  (217.20.156.144:80)

TCP (HTTP):
Connects to ip119.156.odnoklassniki.ru  (217.20.156.119:80)

TCP (HTTP):
Connects to fotki.yandex.ru  (87.250.251.178:80)

Scan AdMunch.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.