File name:

samples-downloader.zip

Full analysis: https://app.any.run/tasks/a7a11f32-10b8-42e9-a9ae-412d95881692
Verdict: Malicious activity
Threats:

Amadey is a formidable Windows infostealer threat, characterized by its persistence mechanisms, modular design, and ability to execute various malicious tasks.

Analysis date: May 22, 2025, 02:26:37
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
arch-exec
arch-doc
loader
amadey
botnet
stealer
lumma
rdp
themida
telegram
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract, compression method=deflate
MD5:

F58686141EB7738CFCC9A5664623D78A

SHA1:

BFCB6A5F3C72D151F653BD5CB7657052699D8119

SHA256:

0CDB7E138B0CB45BB651C3BE720FF172CD88FCAEADCF685D6549BB0EC4C118A9

SSDEEP:

98304:rTz0G8Sus6HRNAdvvtSppO6D5fBJWys8AGzBaOaRr9H953PDN43MF0q8338exMP+:OD8d8

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Generic archive extractor

      • WinRAR.exe (PID: 4776)
    • Uses Task Scheduler to run other applications

      • cmd.exe (PID: 3156)
      • cmd.exe (PID: 6572)
      • cmd.exe (PID: 8404)
      • cmd.exe (PID: 6124)
    • Run PowerShell with an invisible window

      • powershell.exe (PID: 7724)
      • powershell.exe (PID: 3020)
      • powershell.exe (PID: 8556)
      • powershell.exe (PID: 4120)
    • Request from PowerShell that ran from MSHTA.EXE

      • powershell.exe (PID: 7724)
      • powershell.exe (PID: 3020)
      • powershell.exe (PID: 4120)
    • Connects to the CnC server

      • svchost.exe (PID: 2196)
      • ramez.exe (PID: 208)
    • LUMMA has been detected (SURICATA)

      • svchost.exe (PID: 2196)
      • bc6b73b926.exe (PID: 7608)
    • AMADEY has been detected (SURICATA)

      • ramez.exe (PID: 208)
    • AMADEY has been detected (YARA)

      • ramez.exe (PID: 208)
    • Adds path to the Windows Defender exclusion list

      • cmd.exe (PID: 5008)
      • NSudoLG.exe (PID: 1020)
    • Changes Windows Defender settings

      • NSudoLG.exe (PID: 1020)
    • LUMMA has been detected (YARA)

      • bc6b73b926.exe (PID: 7608)
    • Starts SC.EXE for service management

      • cmd.exe (PID: 5008)
  • SUSPICIOUS

    • Potential Corporate Privacy Violation

      • aria2c.exe (PID: 8172)
      • powershell.exe (PID: 7724)
      • ramez.exe (PID: 208)
      • bc6b73b926.exe (PID: 7608)
      • powershell.exe (PID: 3020)
      • powershell.exe (PID: 4120)
    • Connects to the server without a host name

      • aria2c.exe (PID: 8172)
      • powershell.exe (PID: 7724)
      • ramez.exe (PID: 208)
      • powershell.exe (PID: 3020)
      • bc6b73b926.exe (PID: 7608)
      • powershell.exe (PID: 4120)
    • Executable content was dropped or overwritten

      • aria2c.exe (PID: 8172)
      • powershell.exe (PID: 7724)
      • TempTIVJ3W20YZKRC2DBUFW5MPXHKJI9UJO6.EXE (PID: 5164)
      • ramez.exe (PID: 208)
      • fa517635b3.exe (PID: 2644)
      • bc6b73b926.exe (PID: 7608)
      • powershell.exe (PID: 3020)
      • 7z.exe (PID: 6824)
      • Unlocker.exe (PID: 8076)
      • cmd.exe (PID: 5008)
      • powershell.exe (PID: 4120)
    • Process requests binary or script from the Internet

      • aria2c.exe (PID: 8172)
      • powershell.exe (PID: 7724)
      • ramez.exe (PID: 208)
      • powershell.exe (PID: 3020)
      • bc6b73b926.exe (PID: 7608)
      • powershell.exe (PID: 4120)
    • Starts CMD.EXE for commands execution

      • random.exe (PID: 7496)
      • fa517635b3.exe (PID: 2644)
      • cmd.exe (PID: 4112)
      • NSudoLG.exe (PID: 7436)
      • cmd.exe (PID: 5008)
      • cmd.exe (PID: 2192)
      • dc734431a4.exe (PID: 7912)
      • Unlocker.exe (PID: 7572)
      • Unlocker.exe (PID: 8076)
      • Unlocker.exe (PID: 8176)
      • random.exe (PID: 4408)
      • random.exe (PID: 6476)
    • Manipulates environment variables

      • powershell.exe (PID: 7724)
      • powershell.exe (PID: 3020)
      • powershell.exe (PID: 4120)
      • powershell.exe (PID: 8556)
    • Starts POWERSHELL.EXE for commands execution

      • mshta.exe (PID: 3396)
      • mshta.exe (PID: 6240)
      • NSudoLG.exe (PID: 1020)
      • mshta.exe (PID: 4376)
      • mshta.exe (PID: 6644)
    • Probably download files using WebClient

      • mshta.exe (PID: 3396)
      • mshta.exe (PID: 6240)
      • mshta.exe (PID: 4376)
      • mshta.exe (PID: 6644)
    • Found IP address in command line

      • powershell.exe (PID: 7724)
      • powershell.exe (PID: 3020)
      • powershell.exe (PID: 4120)
      • powershell.exe (PID: 8556)
    • Starts process via Powershell

      • powershell.exe (PID: 7724)
      • powershell.exe (PID: 3020)
      • powershell.exe (PID: 8556)
      • powershell.exe (PID: 4120)
    • Contacting a server suspected of hosting an CnC

      • svchost.exe (PID: 2196)
      • bc6b73b926.exe (PID: 7608)
      • ramez.exe (PID: 208)
    • Starts itself from another location

      • TempTIVJ3W20YZKRC2DBUFW5MPXHKJI9UJO6.EXE (PID: 5164)
    • Application launched itself

      • cmd.exe (PID: 4112)
      • cmd.exe (PID: 2192)
      • cmd.exe (PID: 5008)
      • ie4uinit.exe (PID: 6264)
      • setup.exe (PID: 8036)
      • setup.exe (PID: 7448)
      • setup.exe (PID: 3800)
    • Starts application with an unusual extension

      • cmd.exe (PID: 4688)
      • cmd.exe (PID: 5008)
    • Executing commands from a ".bat" file

      • cmd.exe (PID: 4112)
      • NSudoLG.exe (PID: 7436)
      • fa517635b3.exe (PID: 2644)
      • cmd.exe (PID: 2192)
    • Uses REG/REGEDIT.EXE to modify registry

      • cmd.exe (PID: 4688)
      • cmd.exe (PID: 5008)
    • The executable file from the user directory is run by the CMD process

      • NSudoLG.exe (PID: 7436)
      • NSudoLG.exe (PID: 1020)
      • 7z.exe (PID: 6824)
      • Unlocker.exe (PID: 7572)
      • Unlocker.exe (PID: 8076)
      • Unlocker.exe (PID: 8176)
    • There is functionality for enable RDP (YARA)

      • ramez.exe (PID: 208)
    • There is functionality for taking screenshot (YARA)

      • ramez.exe (PID: 208)
    • Drops 7-zip archiver for unpacking

      • fa517635b3.exe (PID: 2644)
    • Get information on the list of running processes

      • cmd.exe (PID: 5008)
      • cmd.exe (PID: 8076)
    • PowerShell delay command usage (probably sleep evasion)

      • powershell.exe (PID: 8164)
    • Script adds exclusion path to Windows Defender

      • NSudoLG.exe (PID: 1020)
    • Using 'findstr.exe' to search for text patterns in files and output

      • cmd.exe (PID: 5008)
    • Windows service management via SC.EXE

      • sc.exe (PID: 7796)
      • sc.exe (PID: 7400)
      • sc.exe (PID: 8088)
      • sc.exe (PID: 7408)
      • sc.exe (PID: 7240)
      • sc.exe (PID: 7468)
      • sc.exe (PID: 776)
      • sc.exe (PID: 6624)
      • sc.exe (PID: 3836)
      • sc.exe (PID: 4624)
      • sc.exe (PID: 4420)
      • sc.exe (PID: 4716)
      • sc.exe (PID: 4460)
      • sc.exe (PID: 8064)
      • sc.exe (PID: 4804)
      • sc.exe (PID: 5300)
      • sc.exe (PID: 6712)
      • sc.exe (PID: 7324)
      • sc.exe (PID: 2740)
      • sc.exe (PID: 7140)
      • sc.exe (PID: 6844)
      • sc.exe (PID: 2336)
      • sc.exe (PID: 6756)
      • sc.exe (PID: 8184)
      • sc.exe (PID: 2096)
      • sc.exe (PID: 8056)
      • sc.exe (PID: 240)
      • sc.exe (PID: 2504)
      • sc.exe (PID: 7936)
      • sc.exe (PID: 7380)
      • sc.exe (PID: 7972)
      • sc.exe (PID: 6820)
      • sc.exe (PID: 7608)
      • sc.exe (PID: 2896)
      • sc.exe (PID: 4056)
      • sc.exe (PID: 6708)
      • sc.exe (PID: 5988)
      • sc.exe (PID: 7736)
      • sc.exe (PID: 7060)
      • sc.exe (PID: 6652)
      • sc.exe (PID: 7952)
    • Starts SC.EXE for service management

      • cmd.exe (PID: 7568)
      • cmd.exe (PID: 5008)
      • cmd.exe (PID: 4652)
      • cmd.exe (PID: 6824)
      • cmd.exe (PID: 5240)
    • Uses TASKKILL.EXE to kill process

      • cmd.exe (PID: 6676)
      • cmd.exe (PID: 7696)
      • cmd.exe (PID: 6976)
    • Drops a system driver (possible attempt to evade defenses)

      • Unlocker.exe (PID: 8076)
    • Uses RUNDLL32.EXE to load library

      • ie4uinit.exe (PID: 8032)
    • Stops a currently running service

      • sc.exe (PID: 3676)
      • sc.exe (PID: 7708)
      • sc.exe (PID: 5696)
      • sc.exe (PID: 3144)
      • sc.exe (PID: 4692)
      • sc.exe (PID: 5896)
      • sc.exe (PID: 2316)
      • sc.exe (PID: 1708)
      • sc.exe (PID: 7120)
      • sc.exe (PID: 7620)
      • sc.exe (PID: 4464)
      • sc.exe (PID: 7780)
      • sc.exe (PID: 5504)
      • sc.exe (PID: 4608)
      • sc.exe (PID: 7940)
      • sc.exe (PID: 5364)
      • sc.exe (PID: 7748)
    • Process drops legitimate windows executable

      • cmd.exe (PID: 5008)
    • Deletes scheduled task without confirmation

      • schtasks.exe (PID: 7012)
      • schtasks.exe (PID: 5576)
      • schtasks.exe (PID: 4812)
      • schtasks.exe (PID: 720)
      • schtasks.exe (PID: 7776)
    • Executes application which crashes

      • explorer.exe (PID: 7336)
    • The process executes via Task Scheduler

      • ramez.exe (PID: 9172)
      • ramez.exe (PID: 10136)
      • ramez.exe (PID: 3796)
    • Process communicates with Telegram (possibly using it as an attacker's C2 server)

      • MSBuild.exe (PID: 9320)
  • INFO

    • Manual execution by a user

      • WinRAR.exe (PID: 7684)
      • notepad.exe (PID: 7728)
      • cmd.exe (PID: 8108)
      • firefox.exe (PID: 1452)
      • random.exe (PID: 7496)
      • random.exe (PID: 4408)
      • random.exe (PID: 6476)
    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 7684)
    • Reads security settings of Internet Explorer

      • notepad.exe (PID: 7728)
    • Reads the computer name

      • aria2c.exe (PID: 8172)
    • Reads the machine GUID from the registry

      • aria2c.exe (PID: 8172)
    • Checks supported languages

      • aria2c.exe (PID: 8172)
    • The sample compiled with english language support

      • aria2c.exe (PID: 8172)
      • fa517635b3.exe (PID: 2644)
      • ramez.exe (PID: 208)
      • Unlocker.exe (PID: 8076)
      • cmd.exe (PID: 5008)
    • Application launched itself

      • firefox.exe (PID: 1452)
      • firefox.exe (PID: 5736)
      • chrmstp.exe (PID: 6800)
      • chrmstp.exe (PID: 6768)
      • chrmstp.exe (PID: 8572)
      • chrmstp.exe (PID: 8672)
      • chrome.exe (PID: 516)
    • Reads the software policy settings

      • slui.exe (PID: 7276)
    • The executable file from the user directory is run by the Powershell process

      • TempTIVJ3W20YZKRC2DBUFW5MPXHKJI9UJO6.EXE (PID: 5164)
      • TempZBH81QHAKUMLJ3PNXFQXZKZRUBRSF6SG.EXE (PID: 1912)
      • TempXZ9VWWHSRIEMBWJN9BKL4QLVSBQVJLQJ.EXE (PID: 8276)
      • TempXZ9VWWHSRIEMBWJN9BKL4QLVSBQVJLQJ.EXE (PID: 9952)
    • Changes the display of characters in the console

      • cmd.exe (PID: 4688)
      • cmd.exe (PID: 5008)
    • Starts MODE.COM to configure console settings

      • mode.com (PID: 7012)
    • Checks operating system version

      • cmd.exe (PID: 5008)
    • Themida protector has been detected

      • bc6b73b926.exe (PID: 7608)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Amadey

(PID) Process(208) ramez.exe
C2185.156.72.96
URLhttp://185.156.72.96/te4h2nus/index.php
Version5.34
Options
Drop directoryd610cf342e
Drop nameramez.exe
Strings (125)lv:
msi
Kaspersky Lab
av:
|
#
"
\App
00000422
dm:
Powershell.exe
ProgramData\
ps1
rundll32
http://
Content-Disposition: form-data; name="data"; filename="
SOFTWARE\Microsoft\Windows NT\CurrentVersion
dll
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
id:
VideoID
cred.dll|clip.dll|
0000043f
cmd
00000423
SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName
-executionpolicy remotesigned -File "
2022
------
2016
og:
\0000
CurrentBuild
2019
:::
S-%lu-
" && timeout 1 && del
ProductName
Panda Security
ESET
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
/k
+++
?scr=1
Doctor Web
GET
SYSTEM\ControlSet001\Services\BasicDisplay\Video
/quiet
.jpg
d610cf342e
vs:
sd:
rundll32.exe
"taskkill /f /im "
pc:
random
=
360TotalSecurity
<d>
wb
Content-Type: multipart/form-data; boundary=----
Startup
Norton
&& Exit"
os:
https://
SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
2025
Avira
%-lu
zip
POST
" Content-Type: application/octet-stream
Rem
/te4h2nus/index.php
------
5.34
<c>
clip.dll
AVAST Software
\
shell32.dll
" && ren
e3
ramez.exe
kernel32.dll
DefaultSettings.XResolution
d1
DefaultSettings.YResolution
185.156.72.96
r=
cred.dll
--
GetNativeSystemInfo
-%lu
ComputerName
&unit=
Keyboard Layout\Preload
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
ar:
Sophos
%USERPROFILE%
exe
e1
e2
st=s
Programs
0123456789
un:
rb
bi:
abcdefghijklmnopqrstuvwxyz0123456789-_
SYSTEM\CurrentControlSet\Control\UnitedVideo\CONTROL\VIDEO\
cmd /C RMDIR /s/q
Bitdefender
-unicode-
AVG
WinDefender
&&
shutdown -s -t 0
Comodo
00000419
Content-Type: application/x-www-form-urlencoded
/Plugins/
Main

Lumma

(PID) Process(7608) bc6b73b926.exe
C2 (9)escczlv.top/bufi
korxddl.top/qidz
cornerdurv.top/adwq
localixbiw.top/zlpa
diecam.top/laur
citellcagt.top/gjtu
bogtkr.top/zhyk
narrathfpt.top/tekq
ordntx.top/pxla
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: 0x0008
ZipCompression: Deflated
ZipModifyDate: 2025:05:21 20:58:48
ZipCRC: 0xaad87668
ZipCompressedSize: 27422
ZipUncompressedSize: 123390
ZipFileName: mallinksmay212025.txt
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
475
Monitored processes
311
Malicious processes
23
Suspicious processes
12

Behavior graph

Click at the process to see the details
start winrar.exe no specs sppextcomobj.exe no specs slui.exe winrar.exe notepad.exe no specs cmd.exe conhost.exe no specs aria2c.exe firefox.exe no specs firefox.exe firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs slui.exe rundll32.exe no specs random.exe cmd.exe no specs mshta.exe no specs conhost.exe no specs schtasks.exe no specs powershell.exe conhost.exe no specs temptivj3w20yzkrc2dbufw5mpxhkji9ujo6.exe #AMADEY ramez.exe #LUMMA bc6b73b926.exe #LUMMA svchost.exe fa517635b3.exe cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs chcp.com no specs reg.exe no specs reg.exe no specs nsudolg.exe no specs cmd.exe conhost.exe no specs cmd.exe conhost.exe no specs chcp.com no specs reg.exe no specs reg.exe no specs mode.com no specs cmd.exe no specs reg.exe no specs find.exe no specs cmd.exe no specs tasklist.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs find.exe no specs nsudolg.exe no specs powershell.exe no specs conhost.exe no specs dc734431a4.exe no specs cmd.exe no specs mshta.exe no specs conhost.exe no specs schtasks.exe no specs powershell.exe conhost.exe no specs jf3uh04pm5ptk96k1wk8onw9rfg5gu.exe no specs tempzbh81qhakumlj3pnxfqxzkzrubrsf6sg.exe no specs reg.exe no specs find.exe no specs cmd.exe no specs findstr.exe no specs 7z.exe unlocker.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs sc.exe no specs find.exe no specs sc.exe no specs sc.exe no specs unlocker.exe cmd.exe no specs conhost.exe no specs sc.exe no specs iobitunlocker.exe no specs explorer.exe unregmp2.exe no specs ie4uinit.exe no specs ie4uinit.exe no specs rundll32.exe no specs rundll32.exe no specs searchapp.exe no specs unregmp2.exe no specs iobitunlocker.exe no specs chrmstp.exe no specs chrmstp.exe no specs chrmstp.exe no specs chrmstp.exe no specs setup.exe no specs setup.exe no specs setup.exe no specs setup.exe no specs setup.exe no specs setup.exe no specs msedge.exe no specs User OOBE Create Elevated Object Server no specs cmd.exe no specs conhost.exe no specs sc.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs explorer.exe no specs rundll32.exe no specs rundll32.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs unlocker.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs sc.exe no specs sc.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrmstp.exe no specs chrmstp.exe no specs chrmstp.exe no specs chrmstp.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs settingsynchost.exe no specs chrome.exe no specs werfault.exe no specs chrome.exe no specs chrome.exe no specs searchapp.exe textinputhost.exe no specs startmenuexperiencehost.exe no specs tiworker.exe no specs ramez.exe no specs chrome.exe no specs mobsync.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs ramez.exe no specs chrome.exe no specs chrome.exe no specs rundll32.exe no specs random.exe no specs random.exe no specs cmd.exe no specs cmd.exe no specs mshta.exe no specs conhost.exe no specs mshta.exe no specs conhost.exe no specs schtasks.exe no specs schtasks.exe no specs powershell.exe no specs powershell.exe conhost.exe no specs conhost.exe no specs tempxz9vwwhsriembwjn9bkl4qlvsbqvjlqj.exe no specs tempxz9vwwhsriembwjn9bkl4qlvsbqvjlqj.exe no specs ramez.exe no specs shellexperiencehost.exe no specs df81061fcb.exe no specs conhost.exe no specs msbuild.exe

Process information

PID
CMD
Path
Indicators
Parent process
208"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5348 -childID 4 -isForBrowser -prefsHandle 5356 -prefMapHandle 5200 -prefsLen 31243 -prefMapSize 244583 -jsInitHandle 1536 -jsInitLen 235124 -parentBuildID 20240213221259 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {642df636-4eec-44f4-8312-9d732f71bca6} 5736 "\\.\pipe\gecko-crash-server-pipe.5736" 224cb2dc4d0 tabC:\Program Files\Mozilla Firefox\firefox.exefirefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
0
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\vcruntime140.dll
208"C:\Users\admin\AppData\Local\Temp\d610cf342e\ramez.exe" C:\Users\admin\AppData\Local\Temp\d610cf342e\ramez.exe
TempTIVJ3W20YZKRC2DBUFW5MPXHKJI9UJO6.EXE
User:
admin
Integrity Level:
HIGH
Modules
Images
c:\users\admin\appdata\local\temp\d610cf342e\ramez.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
Amadey
(PID) Process(208) ramez.exe
C2185.156.72.96
URLhttp://185.156.72.96/te4h2nus/index.php
Version5.34
Options
Drop directoryd610cf342e
Drop nameramez.exe
Strings (125)lv:
msi
Kaspersky Lab
av:
|
#
"
\App
00000422
dm:
Powershell.exe
ProgramData\
ps1
rundll32
http://
Content-Disposition: form-data; name="data"; filename="
SOFTWARE\Microsoft\Windows NT\CurrentVersion
dll
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
id:
VideoID
cred.dll|clip.dll|
0000043f
cmd
00000423
SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName
-executionpolicy remotesigned -File "
2022
------
2016
og:
\0000
CurrentBuild
2019
:::
S-%lu-
" && timeout 1 && del
ProductName
Panda Security
ESET
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
/k
+++
?scr=1
Doctor Web
GET
SYSTEM\ControlSet001\Services\BasicDisplay\Video
/quiet
.jpg
d610cf342e
vs:
sd:
rundll32.exe
"taskkill /f /im "
pc:
random
=
360TotalSecurity
<d>
wb
Content-Type: multipart/form-data; boundary=----
Startup
Norton
&& Exit"
os:
https://
SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
2025
Avira
%-lu
zip
POST
" Content-Type: application/octet-stream
Rem
/te4h2nus/index.php
------
5.34
<c>
clip.dll
AVAST Software
\
shell32.dll
" && ren
e3
ramez.exe
kernel32.dll
DefaultSettings.XResolution
d1
DefaultSettings.YResolution
185.156.72.96
r=
cred.dll
--
GetNativeSystemInfo
-%lu
ComputerName
&unit=
Keyboard Layout\Preload
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
ar:
Sophos
%USERPROFILE%
exe
e1
e2
st=s
Programs
0123456789
un:
rb
bi:
abcdefghijklmnopqrstuvwxyz0123456789-_
SYSTEM\CurrentControlSet\Control\UnitedVideo\CONTROL\VIDEO\
cmd /C RMDIR /s/q
Bitdefender
-unicode-
AVG
WinDefender
&&
shutdown -s -t 0
Comodo
00000419
Content-Type: application/x-www-form-urlencoded
/Plugins/
Main
240sc config "WdBoot" start= disabled C:\Windows\System32\sc.execmd.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Service Control Manager Configuration Tool
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
300"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1972 --field-trial-handle=1976,i,12655325639753308215,3419553263359017474,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version /prefetch:2C:\Program Files\Google\Chrome\Application\chrome.exechrome.exe
User:
SYSTEM
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
456"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2720 -childID 1 -isForBrowser -prefsHandle 2808 -prefMapHandle 2804 -prefsLen 31447 -prefMapSize 244583 -jsInitHandle 1536 -jsInitLen 235124 -parentBuildID 20240213221259 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {740c5b7a-296a-4871-a50f-774ff1e9992b} 5736 "\\.\pipe\gecko-crash-server-pipe.5736" 224c8ea2f50 tabC:\Program Files\Mozilla Firefox\firefox.exefirefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
0
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\vcruntime140.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\vcruntime140_1.dll
456reg add "HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize" /v "AppsUseLightTheme" /t reg_dword /d 0 /f C:\Windows\System32\reg.execmd.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Registry Console Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ws2_32.dll
456taskkill /f /pid "8076"C:\Windows\System32\taskkill.execmd.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Terminates Processes
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\taskkill.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
516"C:\Program Files\Google\Chrome\Application\chrome.exe" "--disable-features=OptimizationGuideModelDownloading,OptimizationHintsFetching,OptimizationTargetPrediction,OptimizationHints"C:\Program Files\Google\Chrome\Application\chrome.exe
explorer.exe
User:
SYSTEM
Company:
Google LLC
Integrity Level:
SYSTEM
Description:
Google Chrome
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
672C:\WINDOWS\system32\RunDll32.exe C:\WINDOWS\system32\migration\WininetPlugin.dll,MigrateCacheForUser /m /0C:\Windows\System32\rundll32.exeie4uinit.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shcore.dll
c:\windows\system32\imagehlp.dll
680reg query "HKLM\System\CurrentControlSet\Services\MsSecCore" C:\Windows\System32\reg.execmd.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Registry Console Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ws2_32.dll
Total events
146 506
Read events
144 580
Write events
1 719
Delete events
207

Modification events

(PID) Process:(4776) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(4776) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(4776) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(4776) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\samples-downloader.zip
(PID) Process:(4776) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(4776) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(4776) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(4776) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(4776) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\MainWin
Operation:writeName:Placement
Value:
2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF3D0000002D000000FD03000016020000
(PID) Process:(4776) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\ArcColumnWidths
Operation:writeName:name
Value:
256
Executable files
40
Suspicious files
774
Text files
353
Unknown types
4

Dropped files

PID
Process
Filename
Type
5736firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\9kie7cg6.default-release\startupCache\scriptCache-current.bin
MD5:
SHA256:
7684WinRAR.exeC:\Users\admin\Desktop\__MACOSX\._mallinksmay212025.txtbinary
MD5:1886F36505D613B45C22F6C579CD87DF
SHA256:7F5F135B8046962AD4800489D921810BB6169E29C1ADC4F31BFA491D8F3AF29C
7684WinRAR.exeC:\Users\admin\Desktop\download-may-21.battext
MD5:D116B134920854C0D4704559D001CC40
SHA256:A55FADE1951BB8C9A3F570DDC55E32886CDC9E3C1B99CDF8FC17B732D36563C2
7684WinRAR.exeC:\Users\admin\Desktop\__MACOSX\._download-may-21.batbinary
MD5:6289D0F52DC014A8A0DD2C474BFA6C29
SHA256:BC4EE076EFA7EF86EFB000D83C4D932A89C4AFDA4E9A9089B0DDE1214F75EBC4
7684WinRAR.exeC:\Users\admin\Desktop\mallinksmay212025.txttext
MD5:FDD847CCD4F083FC18A204B85BA1B4FD
SHA256:76237DA3E136EE92F686DC310C59D8361DCDD51C114FE15E983E82BF4CB0388B
5736firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\9kie7cg6.default-release\startupCache\urlCache-current.binbinary
MD5:297E88D7CEB26E549254EC875649F4EB
SHA256:8B75D4FB1845BAA06122888D11F6B65E6A36B140C54A72CC13DF390FD7C95702
8172aria2c.exeC:\Users\admin\Desktop\malware-samples\random.exe.aria2__tempbinary
MD5:5E4A0CD6BB2A4CE7FC776EDB4D3718A5
SHA256:25C4BADCFC289AFF4E247EB3ABB293DDB1919ADDE93A4D7F6B40FE6C5A406C32
7684WinRAR.exeC:\Users\admin\Desktop\__MACOSX\._aria2c.exebinary
MD5:96B648177E7071D0D762076839547706
SHA256:3B056E59C231DED8CF301CC76EE6A493E7559D23817F9982E27FDF350766E84F
7684WinRAR.exeC:\Users\admin\Desktop\aria2c.exeexecutable
MD5:6C5EA5A82D756BCA4A9610C8D2260D2F
SHA256:B9CD71B275AF11B63C33457B0F43F2F2675937070C563E195F223EFD7FA4C74B
8172aria2c.exeC:\Users\admin\Desktop\malware-samples\random.exe.aria2binary
MD5:5E4A0CD6BB2A4CE7FC776EDB4D3718A5
SHA256:25C4BADCFC289AFF4E247EB3ABB293DDB1919ADDE93A4D7F6B40FE6C5A406C32
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
49
TCP/UDP connections
200
DNS requests
183
Threats
58

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
2.20.245.137:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
whitelisted
7916
SIHClient.exe
GET
200
104.119.109.218:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
whitelisted
7916
SIHClient.exe
GET
200
104.119.109.218:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
whitelisted
8172
aria2c.exe
GET
200
185.156.72.2:80
http://185.156.72.2/test/exe/random.exe
unknown
malicious
5736
firefox.exe
GET
200
34.107.221.82:80
http://detectportal.firefox.com/canonical.html
unknown
whitelisted
5736
firefox.exe
GET
200
34.107.221.82:80
http://detectportal.firefox.com/success.txt?ipv4
unknown
whitelisted
5736
firefox.exe
POST
200
184.24.77.54:80
http://r11.o.lencr.org/
unknown
whitelisted
5736
firefox.exe
POST
200
184.24.77.54:80
http://r11.o.lencr.org/
unknown
whitelisted
5736
firefox.exe
POST
200
142.250.184.227:80
http://o.pki.goog/s/wr3/FIY
unknown
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
whitelisted
5216
RUXIMICS.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5496
MoUsoCoreWorker.exe
2.20.245.137:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
5496
MoUsoCoreWorker.exe
2.23.246.101:80
www.microsoft.com
Ooredoo Q.S.C.
QA
whitelisted
4
System
192.168.100.255:138
whitelisted
2104
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
3216
svchost.exe
172.211.123.248:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
7916
SIHClient.exe
20.109.210.53:443
slscr.update.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
7916
SIHClient.exe
104.119.109.218:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
whitelisted
google.com
  • 172.217.16.206
whitelisted
crl.microsoft.com
  • 2.20.245.137
  • 2.20.245.139
whitelisted
www.microsoft.com
  • 2.23.246.101
  • 104.119.109.218
whitelisted
client.wns.windows.com
  • 172.211.123.248
  • 172.211.123.249
whitelisted
slscr.update.microsoft.com
  • 20.109.210.53
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 52.165.164.15
whitelisted
detectportal.firefox.com
  • 34.107.221.82
  • 184.24.77.48
  • 184.24.77.54
whitelisted
prod.detectportal.prod.cloudops.mozgcp.net
  • 34.107.221.82
  • 2600:1901:0:38d7::
whitelisted
contile.services.mozilla.com
  • 34.36.137.203
whitelisted

Threats

PID
Process
Class
Message
8172
aria2c.exe
A Network Trojan was detected
ET USER_AGENTS Aria2 User-Agent
8172
aria2c.exe
Potential Corporate Privacy Violation
ET INFO PE EXE or DLL Windows file download HTTP
8172
aria2c.exe
Potentially Bad Traffic
ET INFO Executable Download from dotted-quad Host
8172
aria2c.exe
Potentially Bad Traffic
ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response
2196
svchost.exe
Not Suspicious Traffic
INFO [ANY.RUN] hCaptcha Enterprise Challenge
2196
svchost.exe
Not Suspicious Traffic
INFO [ANY.RUN] hCaptcha Enterprise Challenge
2196
svchost.exe
Not Suspicious Traffic
INFO [ANY.RUN] hCaptcha Enterprise Challenge
2196
svchost.exe
Not Suspicious Traffic
INFO [ANY.RUN] hCaptcha Enterprise Challenge
2196
svchost.exe
Not Suspicious Traffic
INFO [ANY.RUN] hCaptcha Enterprise Challenge
7724
powershell.exe
Potentially Bad Traffic
ET INFO Executable Download from dotted-quad Host
No debug info