URL:

https://google.com

Full analysis: https://app.any.run/tasks/ff3b9034-dcaf-4747-b1c8-e0c850e22ba5
Verdict: Malicious activity
Threats:

Amadey is a formidable Windows infostealer threat, characterized by its persistence mechanisms, modular design, and ability to execute various malicious tasks.

Analysis date: May 27, 2025, 09:51:35
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
loader
amadey
botnet
stealer
rdp
themida
lumma
telegram
evasion
hijackloader
miner
gcleaner
rat
asyncrat
remote
auto
generic
antivm
rust
Indicators:
MD5:

99999EBCFDB78DF077AD2727FD00969F

SHA1:

72FE95C5576EC634E214814A32AB785568EDA76A

SHA256:

05046F26C83E8C88B3DDAB2EAB63D0D16224AC1E564535FC75CDCEEE47A0938D

SSDEEP:

3:N8r3uK:2LuK

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • AMADEY mutex has been found

      • random.exe (PID: 5720)
      • ramez.exe (PID: 7624)
      • TempJFKETFLNTSPLUMUNLRXPRTYLSPTYXTGN.EXE (PID: 7404)
    • Connects to the CnC server

      • ramez.exe (PID: 7624)
      • svchost.exe (PID: 2196)
      • cmd.exe (PID: 6840)
    • AMADEY has been detected (SURICATA)

      • ramez.exe (PID: 7624)
    • Uses Task Scheduler to run other applications

      • cmd.exe (PID: 760)
    • Run PowerShell with an invisible window

      • powershell.exe (PID: 1180)
    • Script downloads file (POWERSHELL)

      • powershell.exe (PID: 1180)
    • Request from PowerShell that ran from MSHTA.EXE

      • powershell.exe (PID: 1180)
    • AMADEY has been detected (YARA)

      • ramez.exe (PID: 7624)
    • Executing a file with an untrusted certificate

      • m9wPaPW.exe (PID: 1184)
      • m9wPaPW.exe (PID: 4896)
      • m9wPaPW.exe (PID: 8080)
      • m9wPaPW.exe (PID: 8016)
      • 10731ddb90.exe (PID: 8288)
      • sGe7ljJ.exe (PID: 11160)
      • sGe7ljJ.exe (PID: 10356)
    • Registers / Runs the DLL via REGSVR32.EXE

      • m9wPaPW.tmp (PID: 2552)
      • m9wPaPW.tmp (PID: 7000)
      • rundll32.exe (PID: 1040)
    • HIJACKLOADER has been detected (YARA)

      • USilv.exe (PID: 1120)
    • LUMMA has been detected (SURICATA)

      • svchost.exe (PID: 2196)
      • MSBuild.exe (PID: 1512)
    • Changes Windows Defender settings

      • oxDU0MW.exe (PID: 4336)
      • NSudoLG.exe (PID: 4608)
      • NSudoLG.exe (PID: 9588)
    • Adds process to the Windows Defender exclusion list

      • oxDU0MW.exe (PID: 4336)
    • Uses Task Scheduler to autorun other applications

      • oxDU0MW.exe (PID: 4336)
    • Starts REAGENTC.EXE to disable the Windows Recovery Environment

      • ReAgentc.exe (PID: 5892)
    • Adds path to the Windows Defender exclusion list

      • cmd.exe (PID: 3028)
      • NSudoLG.exe (PID: 4608)
      • cmd.exe (PID: 8948)
      • NSudoLG.exe (PID: 9588)
    • MINER has been detected (SURICATA)

      • cmd.exe (PID: 6840)
    • Starts SC.EXE for service management

      • cmd.exe (PID: 3028)
    • GCLEANER has been detected (SURICATA)

      • 10731ddb90.exe (PID: 8288)
    • ASYNCRAT has been detected (SURICATA)

      • rundll32.exe (PID: 9248)
    • GENERIC has been found (auto)

      • 10731ddb90.exe (PID: 8288)
  • SUSPICIOUS

    • Potential Corporate Privacy Violation

      • msedge.exe (PID: 7340)
      • ramez.exe (PID: 7624)
      • powershell.exe (PID: 1180)
      • ab29c609bc.exe (PID: 3676)
      • cmd.exe (PID: 6840)
      • 10731ddb90.exe (PID: 8288)
    • Reads the BIOS version

      • random.exe (PID: 5720)
      • ramez.exe (PID: 7624)
    • Executable content was dropped or overwritten

      • random.exe (PID: 5720)
      • ramez.exe (PID: 7624)
      • powershell.exe (PID: 1180)
      • xegYmPC.exe (PID: 8040)
      • USilv.exe (PID: 1616)
      • USilv.exe (PID: 1120)
      • m9wPaPW.exe (PID: 1184)
      • m9wPaPW.tmp (PID: 4404)
      • m9wPaPW.tmp (PID: 2552)
      • m9wPaPW.exe (PID: 4896)
      • m9wPaPW.exe (PID: 8080)
      • m9wPaPW.tmp (PID: 3176)
      • m9wPaPW.tmp (PID: 7000)
      • m9wPaPW.exe (PID: 8016)
      • xegYmPC.exe (PID: 2560)
      • release.exe (PID: 4700)
      • oxDU0MW.exe (PID: 4336)
      • BetaContro.exe (PID: 6436)
      • jRE9kd1BncC299.exe (PID: 5364)
      • Infra-Co.exe (PID: 760)
      • df0c0c211d.exe (PID: 5720)
      • 7z.exe (PID: 8584)
      • Unlocker.exe (PID: 8084)
      • cmd.exe (PID: 3028)
      • 10731ddb90.exe (PID: 8288)
    • Reads security settings of Internet Explorer

      • random.exe (PID: 5720)
      • ramez.exe (PID: 7624)
      • xegYmPC.exe (PID: 8040)
      • m9wPaPW.tmp (PID: 4404)
    • Starts itself from another location

      • random.exe (PID: 5720)
      • USilv.exe (PID: 8008)
      • USilv.exe (PID: 1616)
    • Contacting a server suspected of hosting an CnC

      • ramez.exe (PID: 7624)
      • svchost.exe (PID: 2196)
      • MSBuild.exe (PID: 1512)
      • rundll32.exe (PID: 3884)
      • rundll32.exe (PID: 9248)
    • Starts CMD.EXE for commands execution

      • f718e4cb38.exe (PID: 3676)
      • release.exe (PID: 4700)
      • oxDU0MW.exe (PID: 4336)
      • df0c0c211d.exe (PID: 5720)
      • cmd.exe (PID: 5868)
      • cmd.exe (PID: 1696)
      • NSudoLG.exe (PID: 5172)
      • cmd.exe (PID: 3028)
      • Unlocker.exe (PID: 8648)
      • ff6072db20.exe (PID: 8796)
      • cmd.exe (PID: 9028)
      • NSudoLG.exe (PID: 4212)
      • cmd.exe (PID: 8744)
      • Unlocker.exe (PID: 8084)
      • cmd.exe (PID: 8948)
      • Unlocker.exe (PID: 9768)
      • Unlocker.exe (PID: 9740)
    • Connects to the server without a host name

      • ramez.exe (PID: 7624)
      • powershell.exe (PID: 1180)
      • ab29c609bc.exe (PID: 3676)
      • 10731ddb90.exe (PID: 8288)
    • Starts POWERSHELL.EXE for commands execution

      • mshta.exe (PID: 5216)
      • m9wPaPW.tmp (PID: 2552)
      • regsvr32.exe (PID: 656)
      • m9wPaPW.tmp (PID: 7000)
      • regsvr32.exe (PID: 7216)
      • rundll32.exe (PID: 1040)
      • regsvr32.exe (PID: 4120)
      • oxDU0MW.exe (PID: 4336)
      • NSudoLG.exe (PID: 4608)
      • cmd.exe (PID: 8356)
      • NSudoLG.exe (PID: 9588)
    • Starts process via Powershell

      • powershell.exe (PID: 1180)
    • Found IP address in command line

      • powershell.exe (PID: 1180)
    • Process requests binary or script from the Internet

      • ramez.exe (PID: 7624)
      • powershell.exe (PID: 1180)
      • ab29c609bc.exe (PID: 3676)
    • Manipulates environment variables

      • powershell.exe (PID: 1180)
    • There is functionality for enable RDP (YARA)

      • ramez.exe (PID: 7624)
    • Probably download files using WebClient

      • mshta.exe (PID: 5216)
    • Reads the Windows owner or organization settings

      • m9wPaPW.tmp (PID: 2552)
      • m9wPaPW.tmp (PID: 4404)
    • Get information on the list of running processes

      • regsvr32.exe (PID: 656)
      • regsvr32.exe (PID: 7216)
      • rundll32.exe (PID: 1040)
      • regsvr32.exe (PID: 4120)
      • cmd.exe (PID: 3028)
      • cmd.exe (PID: 3900)
      • cmd.exe (PID: 8948)
      • cmd.exe (PID: 3888)
    • PowerShell delay command usage (probably sleep evasion)

      • powershell.exe (PID: 5868)
      • powershell.exe (PID: 1128)
      • powershell.exe (PID: 6740)
      • powershell.exe (PID: 9612)
    • There is functionality for taking screenshot (YARA)

      • USilv.exe (PID: 1120)
      • USilv.exe (PID: 4000)
      • jRE9kd1BncC299.exe (PID: 5364)
    • Script adds exclusion process to Windows Defender

      • oxDU0MW.exe (PID: 4336)
    • Uses RUNDLL32.EXE to load library

      • rundll32.exe (PID: 5576)
      • rundll32.exe (PID: 1040)
      • rundll32.exe (PID: 3796)
    • Executes as Windows Service

      • rundll32.exe (PID: 1040)
      • cmd.exe (PID: 8356)
    • Filtering the input of cmdlet (POWERSHELL)

      • powershell.exe (PID: 6208)
    • Hides errors and continues executing the command without stopping

      • powershell.exe (PID: 6208)
    • Script adds exclusion path to Windows Defender

      • oxDU0MW.exe (PID: 4336)
      • NSudoLG.exe (PID: 4608)
      • NSudoLG.exe (PID: 9588)
    • The process executes via Task Scheduler

      • ramez.exe (PID: 4376)
      • ramez.exe (PID: 10828)
      • ramez.exe (PID: 8816)
      • ramez.exe (PID: 8644)
    • Application launched itself

      • rundll32.exe (PID: 1040)
      • cmd.exe (PID: 5868)
      • cmd.exe (PID: 3028)
      • cmd.exe (PID: 1696)
      • cmd.exe (PID: 9028)
      • cmd.exe (PID: 8744)
      • cmd.exe (PID: 8948)
    • Drops a system driver (possible attempt to evade defenses)

      • release.exe (PID: 4700)
      • Unlocker.exe (PID: 8084)
    • Stops a currently running service

      • sc.exe (PID: 1532)
      • sc.exe (PID: 6352)
      • sc.exe (PID: 8360)
      • sc.exe (PID: 9696)
      • sc.exe (PID: 9880)
      • sc.exe (PID: 10004)
      • sc.exe (PID: 5236)
      • sc.exe (PID: 9312)
      • sc.exe (PID: 9488)
      • sc.exe (PID: 9836)
      • sc.exe (PID: 10212)
      • sc.exe (PID: 4556)
      • sc.exe (PID: 9496)
      • sc.exe (PID: 3140)
      • sc.exe (PID: 10036)
      • sc.exe (PID: 9244)
      • sc.exe (PID: 10064)
      • sc.exe (PID: 9904)
      • sc.exe (PID: 9448)
    • Starts SC.EXE for service management

      • cmd.exe (PID: 4892)
      • cmd.exe (PID: 4452)
      • cmd.exe (PID: 8084)
      • cmd.exe (PID: 8048)
      • cmd.exe (PID: 8828)
      • cmd.exe (PID: 3028)
      • cmd.exe (PID: 9144)
      • cmd.exe (PID: 1756)
      • cmd.exe (PID: 5176)
      • cmd.exe (PID: 5224)
      • cmd.exe (PID: 6832)
      • cmd.exe (PID: 5640)
      • cmd.exe (PID: 10192)
      • cmd.exe (PID: 10244)
    • Hides command output

      • cmd.exe (PID: 4452)
      • cmd.exe (PID: 8084)
      • cmd.exe (PID: 4892)
      • cmd.exe (PID: 4020)
      • cmd.exe (PID: 8048)
      • cmd.exe (PID: 1756)
      • cmd.exe (PID: 5176)
      • cmd.exe (PID: 5224)
      • cmd.exe (PID: 6832)
    • Windows service management via SC.EXE

      • sc.exe (PID: 7212)
      • sc.exe (PID: 3016)
      • sc.exe (PID: 5756)
      • sc.exe (PID: 9104)
      • sc.exe (PID: 8840)
      • sc.exe (PID: 8844)
      • sc.exe (PID: 9192)
      • sc.exe (PID: 9016)
      • sc.exe (PID: 4192)
      • sc.exe (PID: 9660)
      • sc.exe (PID: 9776)
      • sc.exe (PID: 9848)
      • sc.exe (PID: 6480)
      • sc.exe (PID: 9972)
      • sc.exe (PID: 10112)
      • sc.exe (PID: 10216)
      • sc.exe (PID: 2616)
      • sc.exe (PID: 8088)
      • sc.exe (PID: 9332)
      • sc.exe (PID: 9468)
      • sc.exe (PID: 9560)
      • sc.exe (PID: 9808)
      • sc.exe (PID: 9876)
      • sc.exe (PID: 9944)
      • sc.exe (PID: 9912)
      • sc.exe (PID: 10176)
      • sc.exe (PID: 9536)
      • sc.exe (PID: 10220)
      • sc.exe (PID: 9844)
      • sc.exe (PID: 9268)
      • sc.exe (PID: 7104)
      • sc.exe (PID: 9788)
      • sc.exe (PID: 9884)
      • sc.exe (PID: 9968)
      • sc.exe (PID: 10228)
      • sc.exe (PID: 10172)
      • sc.exe (PID: 10072)
      • sc.exe (PID: 8164)
      • sc.exe (PID: 9932)
      • sc.exe (PID: 8136)
      • sc.exe (PID: 6512)
      • sc.exe (PID: 9516)
      • sc.exe (PID: 10584)
      • sc.exe (PID: 10392)
      • sc.exe (PID: 10556)
      • sc.exe (PID: 9372)
    • Creates a new Windows service

      • sc.exe (PID: 7000)
      • sc.exe (PID: 976)
    • Checks for external IP

      • oxDU0MW.exe (PID: 4336)
      • svchost.exe (PID: 2196)
    • Process drops legitimate windows executable

      • jRE9kd1BncC299.exe (PID: 5364)
      • cmd.exe (PID: 3028)
    • Starts a Microsoft application from unusual location

      • Infra-Co.exe (PID: 760)
    • Process communicates with Telegram (possibly using it as an attacker's C2 server)

      • MSBuild.exe (PID: 5216)
    • Takes ownership (TAKEOWN.EXE)

      • cmd.exe (PID: 5548)
    • Uses powercfg.exe to modify the power settings

      • oxDU0MW.exe (PID: 4336)
    • Uses ICACLS.EXE to modify access control lists

      • cmd.exe (PID: 4428)
      • cmd.exe (PID: 7976)
    • Drops 7-zip archiver for unpacking

      • df0c0c211d.exe (PID: 5720)
    • Executing commands from a ".bat" file

      • df0c0c211d.exe (PID: 5720)
      • cmd.exe (PID: 5868)
      • NSudoLG.exe (PID: 5172)
      • cmd.exe (PID: 1696)
      • ff6072db20.exe (PID: 8796)
      • cmd.exe (PID: 9028)
      • NSudoLG.exe (PID: 4212)
      • cmd.exe (PID: 8744)
    • Starts application with an unusual extension

      • cmd.exe (PID: 5232)
      • cmd.exe (PID: 3028)
      • cmd.exe (PID: 3176)
      • cmd.exe (PID: 8948)
    • The executable file from the user directory is run by the CMD process

      • NSudoLG.exe (PID: 5172)
      • NSudoLG.exe (PID: 4608)
      • 7z.exe (PID: 8584)
      • Unlocker.exe (PID: 8648)
      • NSudoLG.exe (PID: 4212)
      • Unlocker.exe (PID: 8084)
      • NSudoLG.exe (PID: 9588)
      • Unlocker.exe (PID: 9768)
      • 7z.exe (PID: 8128)
      • Unlocker.exe (PID: 9740)
    • Connects to unusual port

      • oxDU0MW.exe (PID: 4336)
      • rundll32.exe (PID: 3884)
      • cmd.exe (PID: 6840)
      • rundll32.exe (PID: 9248)
    • Uses REG/REGEDIT.EXE to modify registry

      • cmd.exe (PID: 5232)
      • cmd.exe (PID: 3028)
      • cmd.exe (PID: 3176)
      • cmd.exe (PID: 8948)
    • Executes application which crashes

      • ab29c609bc.exe (PID: 3676)
      • Win-v41.exe (PID: 8876)
      • ramez.exe (PID: 8816)
    • There is functionality for VM detection VirtualBox (YARA)

      • oxDU0MW.exe (PID: 4336)
    • There is functionality for VM detection VMWare (YARA)

      • oxDU0MW.exe (PID: 4336)
    • Invokes assembly entry point (POWERSHELL)

      • powershell.exe (PID: 8372)
    • Probably obfuscated PowerShell command line is found

      • cmd.exe (PID: 8356)
    • Using 'findstr.exe' to search for text patterns in files and output

      • cmd.exe (PID: 3028)
      • cmd.exe (PID: 8948)
    • Uses TASKKILL.EXE to kill process

      • cmd.exe (PID: 2088)
      • cmd.exe (PID: 8608)
      • cmd.exe (PID: 9640)
    • Deletes scheduled task without confirmation

      • schtasks.exe (PID: 8992)
      • schtasks.exe (PID: 10108)
      • schtasks.exe (PID: 10200)
      • schtasks.exe (PID: 1244)
      • schtasks.exe (PID: 9340)
  • INFO

    • Checks supported languages

      • identity_helper.exe (PID: 5428)
      • random.exe (PID: 5720)
      • ramez.exe (PID: 7624)
      • f718e4cb38.exe (PID: 3676)
      • TempJFKETFLNTSPLUMUNLRXPRTYLSPTYXTGN.EXE (PID: 7404)
      • xegYmPC.exe (PID: 8040)
      • USilv.exe (PID: 1616)
      • USilv.exe (PID: 1120)
      • m9wPaPW.exe (PID: 1184)
      • m9wPaPW.exe (PID: 4896)
      • m9wPaPW.tmp (PID: 4404)
      • m9wPaPW.tmp (PID: 2552)
    • Application launched itself

      • msedge.exe (PID: 208)
    • Manual execution by a user

      • random.exe (PID: 5720)
    • Reads Environment values

      • identity_helper.exe (PID: 5428)
    • Launch of the file from Downloads directory

      • msedge.exe (PID: 208)
      • msedge.exe (PID: 1328)
    • Process checks computer location settings

      • random.exe (PID: 5720)
      • ramez.exe (PID: 7624)
      • xegYmPC.exe (PID: 8040)
      • m9wPaPW.tmp (PID: 4404)
    • Create files in a temporary directory

      • random.exe (PID: 5720)
      • ramez.exe (PID: 7624)
      • xegYmPC.exe (PID: 8040)
      • USilv.exe (PID: 1120)
      • f718e4cb38.exe (PID: 3676)
      • m9wPaPW.tmp (PID: 4404)
      • m9wPaPW.exe (PID: 4896)
      • m9wPaPW.exe (PID: 1184)
    • Reads the machine GUID from the registry

      • random.exe (PID: 5720)
    • Reads the computer name

      • random.exe (PID: 5720)
      • identity_helper.exe (PID: 5428)
      • ramez.exe (PID: 7624)
      • f718e4cb38.exe (PID: 3676)
      • xegYmPC.exe (PID: 8040)
      • USilv.exe (PID: 1616)
      • USilv.exe (PID: 1120)
      • m9wPaPW.exe (PID: 1184)
      • m9wPaPW.tmp (PID: 4404)
      • m9wPaPW.exe (PID: 4896)
      • m9wPaPW.tmp (PID: 2552)
    • Executable content was dropped or overwritten

      • msedge.exe (PID: 208)
      • msedge.exe (PID: 7340)
      • msedge.exe (PID: 2088)
    • Checks proxy server information

      • ramez.exe (PID: 7624)
      • powershell.exe (PID: 1180)
    • The sample compiled with english language support

      • ramez.exe (PID: 7624)
      • xegYmPC.exe (PID: 8040)
      • USilv.exe (PID: 1616)
      • USilv.exe (PID: 1120)
      • xegYmPC.exe (PID: 2560)
      • jRE9kd1BncC299.exe (PID: 5364)
      • Infra-Co.exe (PID: 760)
      • df0c0c211d.exe (PID: 5720)
      • msedge.exe (PID: 2088)
      • release.exe (PID: 4700)
      • Unlocker.exe (PID: 8084)
      • cmd.exe (PID: 3028)
    • Creates files or folders in the user directory

      • ramez.exe (PID: 7624)
      • USilv.exe (PID: 1120)
      • m9wPaPW.tmp (PID: 2552)
    • Reads mouse settings

      • f718e4cb38.exe (PID: 3676)
    • Reads Internet Explorer settings

      • mshta.exe (PID: 5216)
    • Launch of the file from Task Scheduler

      • cmd.exe (PID: 760)
    • Disables trace logs

      • powershell.exe (PID: 1180)
    • The executable file from the user directory is run by the Powershell process

      • TempJFKETFLNTSPLUMUNLRXPRTYLSPTYXTGN.EXE (PID: 7404)
    • Themida protector has been detected

      • ramez.exe (PID: 7624)
    • Creates files in the program directory

      • USilv.exe (PID: 1616)
      • USilv.exe (PID: 1120)
      • m9wPaPW.tmp (PID: 2552)
    • Creates a software uninstall entry

      • m9wPaPW.tmp (PID: 2552)
    • The sample compiled with chinese language support

      • m9wPaPW.tmp (PID: 2552)
      • USilv.exe (PID: 1120)
    • Changes the display of characters in the console

      • cmd.exe (PID: 5232)
      • cmd.exe (PID: 3028)
      • cmd.exe (PID: 3176)
      • cmd.exe (PID: 8948)
    • Starts MODE.COM to configure console settings

      • mode.com (PID: 5156)
      • mode.com (PID: 8744)
    • Checks operating system version

      • cmd.exe (PID: 3028)
      • cmd.exe (PID: 8948)
    • Application based on Rust

      • rundll32.exe (PID: 1040)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
595
Monitored processes
438
Malicious processes
39
Suspicious processes
21

Behavior graph

Click at the process to see the details
start msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs sppextcomobj.exe no specs slui.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs rundll32.exe no specs random.exe #AMADEY ramez.exe f718e4cb38.exe no specs cmd.exe no specs mshta.exe no specs conhost.exe no specs schtasks.exe no specs powershell.exe conhost.exe no specs tempjfketflntsplumunlrxprtylsptyxtgn.exe no specs xegympc.exe usilv.exe #HIJACKLOADER usilv.exe msedge.exe no specs msedge.exe no specs m9wpapw.exe m9wpapw.tmp m9wpapw.exe m9wpapw.tmp regsvr32.exe no specs powershell.exe no specs conhost.exe no specs regsvr32.exe no specs powershell.exe no specs conhost.exe no specs m9wpapw.exe m9wpapw.tmp m9wpapw.exe slui.exe m9wpapw.tmp regsvr32.exe no specs powershell.exe no specs conhost.exe no specs regsvr32.exe no specs powershell.exe no specs conhost.exe no specs betacontro.exe 08iyoof.exe no specs conhost.exe no specs msbuild.exe no specs #LUMMA msbuild.exe xegympc.exe usilv.exe no specs msedge.exe no specs usilv.exe no specs #LUMMA svchost.exe oxdu0mw.exe powershell.exe no specs conhost.exe no specs msedge.exe no specs tcpvcon.exe no specs rundll32.exe no specs rundll32.exe no specs rundll32.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs regsvr32.exe no specs powershell.exe no specs conhost.exe no specs 302d455a90.exe no specs conhost.exe no specs ramez.exe no specs powershell.exe no specs conhost.exe no specs rundll32.exe no specs rundll32.exe no specs msbuild.exe betacontro.exe release.exe rundll32.exe cmd.exe no specs conhost.exe no specs sc.exe no specs schtasks.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs reagentc.exe no specs jre9kd1bncc299.exe sc.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs infra-co.exe cmd.exe no specs conhost.exe no specs takeown.exe no specs cmd.exe no specs conhost.exe no specs icacls.exe no specs cmd.exe no specs conhost.exe no specs icacls.exe no specs powercfg.exe no specs conhost.exe no specs powercfg.exe no specs conhost.exe no specs ab29c609bc.exe powercfg.exe no specs conhost.exe no specs powercfg.exe no specs conhost.exe no specs powercfg.exe no specs conhost.exe no specs powercfg.exe no specs conhost.exe no specs powercfg.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs ping.exe no specs df0c0c211d.exe tcpvcon.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs chcp.com no specs reg.exe no specs reg.exe no specs nsudolg.exe no specs cmd.exe conhost.exe no specs cmd.exe conhost.exe no specs chcp.com no specs reg.exe no specs reg.exe no specs mode.com no specs cmd.exe no specs reg.exe no specs find.exe no specs cmd.exe no specs tasklist.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs msedge.exe reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs find.exe no specs nsudolg.exe no specs powershell.exe no specs conhost.exe no specs werfault.exe no specs #MINER cmd.exe #GCLEANER 10731ddb90.exe neurom.exe svchost.exe no specs cmd.exe no specs powershell.exe no specs conhost.exe no specs reg.exe no specs find.exe no specs cmd.exe no specs findstr.exe no specs 7z.exe unlocker.exe no specs ff6072db20.exe no specs cmd.exe no specs conhost.exe no specs win-v41.exe no specs cmd.exe no specs conhost.exe no specs werfault.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs chcp.com no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs nsudolg.exe no specs cmd.exe conhost.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs find.exe no specs chcp.com no specs sc.exe no specs sc.exe no specs unlocker.exe cmd.exe no specs conhost.exe no specs sc.exe no specs reg.exe no specs iobitunlocker.exe no specs reg.exe no specs mode.com no specs explorer.exe no specs cmd.exe no specs reg.exe no specs find.exe no specs rundll32.exe no specs cmd.exe no specs tasklist.exe no specs tcpvcon.exe no specs conhost.exe no specs iobitunlocker.exe no specs reg.exe no specs cmd.exe no specs conhost.exe no specs reg.exe no specs reg.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs reg.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs reg.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs reg.exe no specs reg.exe no specs sc.exe no specs startmenuexperiencehost.exe no specs cmd.exe no specs conhost.exe no specs tiworker.exe no specs sc.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs reg.exe no specs reg.exe no specs taskkill.exe no specs reg.exe no specs reg.exe no specs #ASYNCRAT rundll32.exe reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs find.exe no specs nsudolg.exe no specs powershell.exe no specs conhost.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs msedge.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs find.exe no specs unlocker.exe no specs cmd.exe no specs findstr.exe no specs 7z.exe no specs cmd.exe no specs conhost.exe no specs unlocker.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs searchapp.exe msedge.exe no specs mobsync.exe no specs ramez.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs ramez.exe msedge.exe no specs werfault.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs shellexperiencehost.exe no specs ramez.exe no specs msedge.exe no specs sge7ljj.exe no specs conhost.exe no specs msbuild.exe no specs sge7ljj.exe no specs conhost.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
208"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "https://google.com"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
456"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=7124 --field-trial-handle=2256,i,1704193125331948162,8468997954746332124,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exemsedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
496"C:\Users\admin\AppData\Roaming\Monmon5\tcpvcon.exe" "C:\Users\admin\AppData\Roaming\Monmon5\tcpvcon.exe" /accepteulaC:\Users\admin\AppData\Roaming\Monmon5\tcpvcon.exeUSilv.exe
User:
admin
Company:
Sysinternals - www.sysinternals.com
Integrity Level:
HIGH
Description:
Sysinternals TcpVcon
Version:
4.18
Modules
Images
c:\users\admin\appdata\roaming\monmon5\tcpvcon.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\ws2_32.dll
632"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --no-appcompat-clear --mojo-platform-channel-handle=5328 --field-trial-handle=2256,i,1704193125331948162,8468997954746332124,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exemsedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
656 /s /i:SERVICE "C:\ProgramData\738\sechost-7704b00a.p12"C:\Windows\System32\regsvr32.exeregsvr32.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft(C) Register Server
Exit code:
4
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\regsvr32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
668"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --mojo-platform-channel-handle=5008 --field-trial-handle=2256,i,1704193125331948162,8468997954746332124,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exemsedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
680"powershell" -Command "Get-Process | Select-Object -ExpandProperty ProcessName"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeregsvr32.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
744reg query "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableLUA" C:\Windows\System32\reg.execmd.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Registry Console Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
760C:\WINDOWS\system32\cmd.exe /c schtasks /create /tn qL6hsmaq1ZA /tr "mshta C:\Users\admin\AppData\Local\Temp\barseTUen.hta" /sc minute /mo 25 /ru "admin" /fC:\Windows\SysWOW64\cmd.exef718e4cb38.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
760"C:\Users\admin\AppData\Local\Temp\Infra-Co.exe" C:\Users\admin\AppData\Local\Temp\Infra-Co.exe
jRE9kd1BncC299.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Test Authoring and Execution Framework [v10.88]
Version:
10.88.2411.08001
Modules
Images
c:\users\admin\appdata\local\temp\infra-co.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\ucrtbase.dll
Total events
125 160
Read events
124 632
Write events
322
Delete events
206

Modification events

(PID) Process:(208) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:failed_count
Value:
0
(PID) Process:(208) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:state
Value:
2
(PID) Process:(208) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:state
Value:
1
(PID) Process:(208) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\StabilityMetrics
Operation:writeName:user_experience_metrics.stability.exited_cleanly
Value:
0
(PID) Process:(208) msedge.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientStateMedium\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\LastWasDefault
Operation:writeName:S-1-5-21-1693682860-607145093-2874071422-1001
Value:
8BB6654BB1942F00
(PID) Process:(208) msedge.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientStateMedium\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\LastWasDefault
Operation:writeName:S-1-5-21-1693682860-607145093-2874071422-1001
Value:
B6C46A4BB1942F00
(PID) Process:(208) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowProperties\262990
Operation:writeName:WindowTabManagerFileMappingId
Value:
{CDA2E37B-E7A1-458A-A45D-34EC879758DC}
(PID) Process:(208) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowProperties\262990
Operation:writeName:WindowTabManagerFileMappingId
Value:
{D759EA58-A7A3-4194-8CD1-CB7D077008E6}
(PID) Process:(208) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowProperties\262990
Operation:writeName:WindowTabManagerFileMappingId
Value:
{5A98ADAF-4E11-4FA7-B44C-B85640C992FB}
(PID) Process:(208) msedge.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientStateMedium\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\LastWasDefault
Operation:writeName:S-1-5-21-1693682860-607145093-2874071422-1001
Value:
1DD39F4BB1942F00
Executable files
95
Suspicious files
261
Text files
304
Unknown types
52

Dropped files

PID
Process
Filename
Type
208msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\parcel_tracking_db\LOG.old~RF10a809.TMP
MD5:
SHA256:
208msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\parcel_tracking_db\LOG.old
MD5:
SHA256:
208msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\PersistentOriginTrials\LOG.old~RF10a809.TMP
MD5:
SHA256:
208msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\PersistentOriginTrials\LOG.old
MD5:
SHA256:
208msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\discounts_db\LOG.old~RF10a819.TMP
MD5:
SHA256:
208msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\discounts_db\LOG.old
MD5:
SHA256:
208msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old~RF10a829.TMP
MD5:
SHA256:
208msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old
MD5:
SHA256:
208msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey\LOG.old~RF10a867.TMP
MD5:
SHA256:
208msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey\LOG.old
MD5:
SHA256:
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
112
TCP/UDP connections
149
DNS requests
104
Threats
80

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
7624
ramez.exe
POST
200
185.156.72.96:80
http://185.156.72.96/te4h2nus/index.php
unknown
unknown
5496
MoUsoCoreWorker.exe
GET
200
2.16.168.114:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
whitelisted
6576
svchost.exe
HEAD
200
199.232.214.172:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/9b9f8fb4-8a65-41e4-bda3-5416858f0aeb?P1=1748781757&P2=404&P3=2&P4=QLF5prxQgetY%2fCJaQW%2f4%2fEzB45GTfeDmp9YNfCZ3E9ed1iHa8ac6K58ftgvx27CDZq99Kk5qZmQUz%2b98PU6miA%3d%3d
unknown
whitelisted
7624
ramez.exe
GET
200
185.156.72.2:80
http://185.156.72.2/test/exe/random.exe
unknown
malicious
7624
ramez.exe
GET
200
185.156.72.2:80
http://185.156.72.2/files/927321151/xegYmPC.exe
unknown
malicious
7624
ramez.exe
POST
200
185.156.72.96:80
http://185.156.72.96/te4h2nus/index.php
unknown
unknown
1180
powershell.exe
GET
200
185.156.72.2:80
http://185.156.72.2/testmine/random.exe
unknown
malicious
7624
ramez.exe
POST
200
185.156.72.96:80
http://185.156.72.96/te4h2nus/index.php
unknown
unknown
6576
svchost.exe
GET
206
199.232.214.172:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/9b9f8fb4-8a65-41e4-bda3-5416858f0aeb?P1=1748781757&P2=404&P3=2&P4=QLF5prxQgetY%2fCJaQW%2f4%2fEzB45GTfeDmp9YNfCZ3E9ed1iHa8ac6K58ftgvx27CDZq99Kk5qZmQUz%2b98PU6miA%3d%3d
unknown
whitelisted
7624
ramez.exe
GET
200
185.156.72.2:80
http://185.156.72.2/files/5766827736/m9wPaPW.exe
unknown
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
whitelisted
1284
RUXIMICS.exe
40.127.240.158:443
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
40.127.240.158:443
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
5496
MoUsoCoreWorker.exe
2.16.168.114:80
crl.microsoft.com
Akamai International B.V.
RU
whitelisted
5796
svchost.exe
40.127.240.158:443
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
5496
MoUsoCoreWorker.exe
2.23.246.101:80
www.microsoft.com
Ooredoo Q.S.C.
QA
whitelisted
7340
msedge.exe
142.250.186.132:443
www.google.com
whitelisted
7340
msedge.exe
142.250.185.110:443
google.com
whitelisted
208
msedge.exe
239.255.255.250:1900
whitelisted
7340
msedge.exe
2.16.241.205:443
www.bing.com
Akamai International B.V.
DE
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.185.110
whitelisted
crl.microsoft.com
  • 2.16.168.114
  • 2.16.168.124
whitelisted
www.microsoft.com
  • 2.23.246.101
  • 23.35.229.160
whitelisted
config.edge.skype.com
  • 13.107.42.16
whitelisted
edge.microsoft.com
  • 150.171.30.11
  • 150.171.29.11
  • 150.171.28.11
  • 150.171.27.11
whitelisted
business.bing.com
  • 13.107.6.158
whitelisted
edge-mobile-static.azureedge.net
  • 13.107.253.45
whitelisted
www.google.com
  • 142.250.186.132
whitelisted
www.bing.com
  • 2.16.241.205
  • 2.16.241.224
  • 2.16.241.204
  • 2.16.241.222
  • 2.16.241.201
  • 2.16.241.211
  • 2.16.241.218
  • 2.16.241.206
  • 2.16.241.219
  • 92.123.104.28
  • 92.123.104.24
  • 92.123.104.29
  • 92.123.104.26
  • 92.123.104.21
  • 92.123.104.30
  • 92.123.104.31
  • 92.123.104.20
  • 92.123.104.22
  • 2.19.96.128
  • 2.19.96.80
  • 2.19.96.107
  • 2.19.96.82
  • 2.19.96.35
  • 2.19.96.91
  • 2.19.96.83
  • 2.19.96.120
  • 2.19.96.66
whitelisted
fonts.gstatic.com
  • 142.250.186.67
whitelisted

Threats

PID
Process
Class
Message
7340
msedge.exe
Misc Attack
ET DROP Spamhaus DROP Listed Traffic Inbound group 35
7340
msedge.exe
Potentially Bad Traffic
ET INFO Executable Download from dotted-quad Host
7340
msedge.exe
Potential Corporate Privacy Violation
ET INFO PE EXE or DLL Windows file download HTTP
7340
msedge.exe
Potentially Bad Traffic
ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response
7624
ramez.exe
Misc Attack
ET DROP Spamhaus DROP Listed Traffic Inbound group 35
7624
ramez.exe
Malware Command and Control Activity Detected
BOTNET [ANY.RUN] Amadey HTTP POST Request (st=s)
7624
ramez.exe
Malware Command and Control Activity Detected
ET MALWARE Amadey CnC Response
7624
ramez.exe
Potentially Bad Traffic
ET INFO Executable Download from dotted-quad Host
7624
ramez.exe
Potential Corporate Privacy Violation
ET INFO PE EXE or DLL Windows file download HTTP
7624
ramez.exe
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
No debug info