File name:

rl_13e3efd933af3efc00a35ffba413f479ad754ebba398d4eff88f1cbb785adfd3

Full analysis: https://app.any.run/tasks/fcc63368-0430-476b-a1b8-9a4e4d6b064b
Verdict: Malicious activity
Threats:

Amadey is a formidable Windows infostealer threat, characterized by its persistence mechanisms, modular design, and ability to execute various malicious tasks.

Analysis date: June 22, 2025, 10:21:48
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
lumma
stealer
themida
loader
amadey
botnet
rdp
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 7 sections
MD5:

49FE5CA07D907A7B6F5BA0AF206ADB3C

SHA1:

F0CA0E59F0CD9B4C4CC235D9F696240065A37A5A

SHA256:

13E3EFD933AF3EFC00A35FFBA413F479AD754EBBA398D4EFF88F1CBB785ADFD3

SSDEEP:

98304:WFNyzrtzP5KRE71SRkkBlWooD3JOCKNgI4bege2AjgO+YMPSkLaVZDmrOoRAD8Xm:c

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • LUMMA has been detected (YARA)

      • rl_13e3efd933af3efc00a35ffba413f479ad754ebba398d4eff88f1cbb785adfd3.exe (PID: 864)
    • LUMMA mutex has been found

      • rl_13e3efd933af3efc00a35ffba413f479ad754ebba398d4eff88f1cbb785adfd3.exe (PID: 864)
    • Steals credentials from Web Browsers

      • rl_13e3efd933af3efc00a35ffba413f479ad754ebba398d4eff88f1cbb785adfd3.exe (PID: 864)
    • Actions looks like stealing of personal data

      • rl_13e3efd933af3efc00a35ffba413f479ad754ebba398d4eff88f1cbb785adfd3.exe (PID: 864)
    • AMADEY has been detected (SURICATA)

      • ramez.exe (PID: 4920)
    • AMADEY mutex has been found

      • 64DOKIXOB03XN3ZPEO7L3ARDUQH.exe (PID: 4836)
      • ramez.exe (PID: 4920)
      • ramez.exe (PID: 3608)
    • AMADEY has been detected (YARA)

      • ramez.exe (PID: 4920)
    • Connects to the CnC server

      • ramez.exe (PID: 4920)
  • SUSPICIOUS

    • Reads the BIOS version

      • rl_13e3efd933af3efc00a35ffba413f479ad754ebba398d4eff88f1cbb785adfd3.exe (PID: 864)
      • ramez.exe (PID: 4920)
      • 64DOKIXOB03XN3ZPEO7L3ARDUQH.exe (PID: 4836)
      • ramez.exe (PID: 3608)
    • Connects to the server without a host name

      • rl_13e3efd933af3efc00a35ffba413f479ad754ebba398d4eff88f1cbb785adfd3.exe (PID: 864)
      • ramez.exe (PID: 4920)
    • Process requests binary or script from the Internet

      • rl_13e3efd933af3efc00a35ffba413f479ad754ebba398d4eff88f1cbb785adfd3.exe (PID: 864)
    • Potential Corporate Privacy Violation

      • rl_13e3efd933af3efc00a35ffba413f479ad754ebba398d4eff88f1cbb785adfd3.exe (PID: 864)
    • Executable content was dropped or overwritten

      • rl_13e3efd933af3efc00a35ffba413f479ad754ebba398d4eff88f1cbb785adfd3.exe (PID: 864)
      • 64DOKIXOB03XN3ZPEO7L3ARDUQH.exe (PID: 4836)
    • Searches for installed software

      • rl_13e3efd933af3efc00a35ffba413f479ad754ebba398d4eff88f1cbb785adfd3.exe (PID: 864)
    • Reads security settings of Internet Explorer

      • 64DOKIXOB03XN3ZPEO7L3ARDUQH.exe (PID: 4836)
      • ramez.exe (PID: 4920)
    • Starts itself from another location

      • 64DOKIXOB03XN3ZPEO7L3ARDUQH.exe (PID: 4836)
    • Contacting a server suspected of hosting an CnC

      • ramez.exe (PID: 4920)
    • There is functionality for enable RDP (YARA)

      • ramez.exe (PID: 4920)
    • The process executes via Task Scheduler

      • ramez.exe (PID: 3608)
    • There is functionality for taking screenshot (YARA)

      • ramez.exe (PID: 4920)
  • INFO

    • Checks supported languages

      • rl_13e3efd933af3efc00a35ffba413f479ad754ebba398d4eff88f1cbb785adfd3.exe (PID: 864)
      • 64DOKIXOB03XN3ZPEO7L3ARDUQH.exe (PID: 4836)
      • ramez.exe (PID: 4920)
      • ramez.exe (PID: 3608)
    • Reads the machine GUID from the registry

      • rl_13e3efd933af3efc00a35ffba413f479ad754ebba398d4eff88f1cbb785adfd3.exe (PID: 864)
    • Reads the computer name

      • rl_13e3efd933af3efc00a35ffba413f479ad754ebba398d4eff88f1cbb785adfd3.exe (PID: 864)
      • ramez.exe (PID: 4920)
      • 64DOKIXOB03XN3ZPEO7L3ARDUQH.exe (PID: 4836)
    • Application launched itself

      • chrome.exe (PID: 4920)
      • chrome.exe (PID: 3108)
      • chrome.exe (PID: 3844)
      • msedge.exe (PID: 3644)
      • chrome.exe (PID: 3488)
      • msedge.exe (PID: 3108)
      • msedge.exe (PID: 3936)
      • msedge.exe (PID: 728)
      • msedge.exe (PID: 1896)
      • msedge.exe (PID: 3668)
    • Themida protector has been detected

      • rl_13e3efd933af3efc00a35ffba413f479ad754ebba398d4eff88f1cbb785adfd3.exe (PID: 864)
      • ramez.exe (PID: 4920)
    • Reads the software policy settings

      • rl_13e3efd933af3efc00a35ffba413f479ad754ebba398d4eff88f1cbb785adfd3.exe (PID: 864)
      • slui.exe (PID: 2460)
    • Create files in a temporary directory

      • rl_13e3efd933af3efc00a35ffba413f479ad754ebba398d4eff88f1cbb785adfd3.exe (PID: 864)
      • 64DOKIXOB03XN3ZPEO7L3ARDUQH.exe (PID: 4836)
    • Process checks computer location settings

      • 64DOKIXOB03XN3ZPEO7L3ARDUQH.exe (PID: 4836)
    • Checks proxy server information

      • ramez.exe (PID: 4920)
      • slui.exe (PID: 2460)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Lumma

(PID) Process(864) rl_13e3efd933af3efc00a35ffba413f479ad754ebba398d4eff88f1cbb785adfd3.exe
C2 (9)ropyi.xyz/zadf
skjgx.xyz/riuw
gewgb.xyz/axgh
baviip.xyz/twiw
equidn.xyz/xapq
spjeo.xyz/axka
firddy.xyz/yhbc
shaeb.xyz/ikxz
trqqe.xyz/xudu

Amadey

(PID) Process(4920) ramez.exe
C2185.156.72.96
URLhttp://185.156.72.96/te4h2nus/index.php
Version5.34
Options
Drop directoryd610cf342e
Drop nameramez.exe
Strings (125)Powershell.exe
/te4h2nus/index.php
ramez.exe
bi:
185.156.72.96
AVAST Software
/Plugins/
------
id:
\0000
wb
Programs
-%lu
.jpg
AVG
r=
dm:
-executionpolicy remotesigned -File "
SOFTWARE\Microsoft\Windows NT\CurrentVersion
\
ProgramData\
Avira
e2
os:
http://
vs:
<c>
2025
ComputerName
og:
00000419
rb
2022
Content-Type: application/x-www-form-urlencoded
shell32.dll
https://
Main
Sophos
Norton
GET
#
S-%lu-
st=s
cmd /C RMDIR /s/q
lv:
msi
Content-Disposition: form-data; name="data"; filename="
5.34
d1
2016
ar:
cred.dll|clip.dll|
rundll32
WinDefender
Content-Type: multipart/form-data; boundary=----
Rem
CurrentBuild
0123456789
&& Exit"
un:
Kaspersky Lab
d610cf342e
Bitdefender
+++
av:
rundll32.exe
random
<d>
Keyboard Layout\Preload
shutdown -s -t 0
DefaultSettings.XResolution
/quiet
--
0000043f
Startup
e1
Doctor Web
2019
GetNativeSystemInfo
VideoID
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
SYSTEM\CurrentControlSet\Control\UnitedVideo\CONTROL\VIDEO\
:::
ESET
DefaultSettings.YResolution
SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
" && ren
abcdefghijklmnopqrstuvwxyz0123456789-_
cmd
"taskkill /f /im "
00000423
-unicode-
SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName
cred.dll
360TotalSecurity
"
exe
00000422
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
&&
Comodo
" Content-Type: application/octet-stream
------
?scr=1
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
zip
dll
/k
&unit=
ps1
" && timeout 1 && del
kernel32.dll
ProductName
%-lu
clip.dll
%USERPROFILE%
\App
SYSTEM\ControlSet001\Services\BasicDisplay\Video
pc:
sd:
POST
Panda Security
e3
|
=
No Malware configuration.

TRiD

.exe | Generic Win/DOS Executable (50)
.exe | DOS Executable Generic (49.9)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2025:06:16 14:51:43+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14
CodeSize: 311296
InitializedDataSize: 37888
UninitializedDataSize: -
EntryPoint: 0x4b6000
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
202
Monitored processes
67
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #LUMMA rl_13e3efd933af3efc00a35ffba413f479ad754ebba398d4eff88f1cbb785adfd3.exe chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs slui.exe 64dokixob03xn3zpeo7l3arduqh.exe #AMADEY ramez.exe ramez.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
592"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.127 --initial-client-data=0x234,0x238,0x23c,0x210,0x240,0x7ffc44f0fff8,0x7ffc44f10004,0x7ffc44f10010C:\Program Files\Google\Chrome\Application\chrome.exechrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
133.0.6943.127
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
728"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunchC:\Program Files (x86)\Microsoft\Edge\Application\msedge.exemsedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
864"C:\Users\admin\Desktop\rl_13e3efd933af3efc00a35ffba413f479ad754ebba398d4eff88f1cbb785adfd3.exe" C:\Users\admin\Desktop\rl_13e3efd933af3efc00a35ffba413f479ad754ebba398d4eff88f1cbb785adfd3.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\rl_13e3efd933af3efc00a35ffba413f479ad754ebba398d4eff88f1cbb785adfd3.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
Lumma
(PID) Process(864) rl_13e3efd933af3efc00a35ffba413f479ad754ebba398d4eff88f1cbb785adfd3.exe
C2 (9)ropyi.xyz/zadf
skjgx.xyz/riuw
gewgb.xyz/axgh
baviip.xyz/twiw
equidn.xyz/xapq
spjeo.xyz/axka
firddy.xyz/yhbc
shaeb.xyz/ikxz
trqqe.xyz/xudu
1136"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4648,i,18270090802590048559,17865916847612247802,262144 --variations-seed-version=20250221-144540.991000 --mojo-platform-channel-handle=4712 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exechrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
133.0.6943.127
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\133.0.6943.127\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
1216"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3188,i,4126811899477667910,14564036208062767686,262144 --variations-seed-version --mojo-platform-channel-handle=2544 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exechrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
133.0.6943.127
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\133.0.6943.127\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
1508"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --disable-quic --string-annotations --field-trial-handle=4816,i,4126811899477667910,14564036208062767686,262144 --variations-seed-version --mojo-platform-channel-handle=4680 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exechrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
133.0.6943.127
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
1812"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3608,i,14390570254682188976,17579784994732007732,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:1C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exemsedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1896"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exerl_13e3efd933af3efc00a35ffba413f479ad754ebba398d4eff88f1cbb785adfd3.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
1984"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1976,i,17367127698799342004,15357510119410952672,262144 --variations-seed-version=20250221-144540.991000 --mojo-platform-channel-handle=2004 /prefetch:2C:\Program Files\Google\Chrome\Application\chrome.exechrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
133.0.6943.127
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
2072"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=3720,i,17367127698799342004,15357510119410952672,262144 --variations-seed-version=20250221-144540.991000 --mojo-platform-channel-handle=4428 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exechrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
133.0.6943.127
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\133.0.6943.127\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
Total events
22 769
Read events
22 722
Write events
47
Delete events
0

Modification events

(PID) Process:(4920) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
1
(PID) Process:(4920) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon
Operation:writeName:failed_count
Value:
0
(PID) Process:(4920) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
2
(PID) Process:(4920) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\StabilityMetrics
Operation:writeName:user_experience_metrics.stability.exited_cleanly
Value:
0
(PID) Process:(4920) chrome.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Google\Update\ClientStateMedium\{8A69D345-D564-463C-AFF1-A69D9E530F96}
Operation:writeName:usagestats
Value:
0
(PID) Process:(3844) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\StabilityMetrics
Operation:writeName:user_experience_metrics.stability.exited_cleanly
Value:
0
(PID) Process:(3844) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon
Operation:writeName:failed_count
Value:
0
(PID) Process:(3844) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
2
(PID) Process:(3844) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
1
(PID) Process:(3844) chrome.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Google\Update\ClientStateMedium\{8A69D345-D564-463C-AFF1-A69D9E530F96}
Operation:writeName:usagestats
Value:
0
Executable files
12
Suspicious files
90
Text files
158
Unknown types
0

Dropped files

PID
Process
Filename
Type
4920chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\ClientCertificates\LOG.old~RF17883b.TMP
MD5:
SHA256:
4920chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\ClientCertificates\LOG.old
MD5:
SHA256:
4920chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\PersistentOriginTrials\LOG.old~RF17884a.TMP
MD5:
SHA256:
4920chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\PersistentOriginTrials\LOG.old
MD5:
SHA256:
4920chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db\LOG.old~RF17884a.TMP
MD5:
SHA256:
4920chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\parcel_tracking_db\LOG.old~RF17884a.TMP
MD5:
SHA256:
4920chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db\LOG.old
MD5:
SHA256:
4920chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\parcel_tracking_db\LOG.old
MD5:
SHA256:
4920chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\LOG.old~RF17886a.TMP
MD5:
SHA256:
4920chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\LOG.old
MD5:
SHA256:
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
86
TCP/UDP connections
104
DNS requests
98
Threats
8

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
POST
200
85.90.196.155:443
https://equidn.xyz/xapq
unknown
binary
32.7 Kb
5944
MoUsoCoreWorker.exe
GET
200
23.53.40.178:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
whitelisted
1268
svchost.exe
GET
200
23.53.40.178:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
whitelisted
1488
RUXIMICS.exe
GET
200
23.53.40.178:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
whitelisted
5944
MoUsoCoreWorker.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
whitelisted
1488
RUXIMICS.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
whitelisted
1268
svchost.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
whitelisted
GET
200
172.217.16.195:443
https://clientservices.googleapis.com/chrome-variations/seed?osname=win&channel=stable&milestone=133
unknown
compressed
59.2 Kb
whitelisted
GET
200
142.250.184.202:443
https://safebrowsingohttpgateway.googleapis.com/v1/ohttp/hpkekeyconfig?key=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE
unknown
binary
41 b
whitelisted
POST
200
173.194.76.84:443
https://accounts.google.com/ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard
unknown
text
17 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
5944
MoUsoCoreWorker.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
whitelisted
1268
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1488
RUXIMICS.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
whitelisted
864
rl_13e3efd933af3efc00a35ffba413f479ad754ebba398d4eff88f1cbb785adfd3.exe
85.90.196.155:443
equidn.xyz
UA
unknown
5944
MoUsoCoreWorker.exe
23.53.40.178:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
1268
svchost.exe
23.53.40.178:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
1488
RUXIMICS.exe
23.53.40.178:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5944
MoUsoCoreWorker.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
  • 51.104.136.2
whitelisted
google.com
  • 216.58.206.78
whitelisted
equidn.xyz
  • 85.90.196.155
unknown
crl.microsoft.com
  • 23.53.40.178
  • 23.53.40.176
whitelisted
www.microsoft.com
  • 23.35.229.160
whitelisted
clients2.google.com
  • 172.217.18.110
whitelisted
safebrowsingohttpgateway.googleapis.com
  • 142.250.185.74
  • 172.217.16.202
  • 142.250.181.234
  • 142.250.185.138
  • 216.58.212.170
  • 142.250.185.202
  • 142.250.185.106
  • 142.250.186.106
  • 142.250.185.170
  • 142.250.186.170
  • 142.250.186.74
  • 142.250.184.234
  • 216.58.206.42
  • 142.250.185.234
  • 142.250.186.138
  • 142.250.186.42
whitelisted
clientservices.googleapis.com
  • 142.250.186.131
whitelisted
accounts.google.com
  • 64.233.167.84
whitelisted
www.google.com
  • 216.58.206.36
  • 142.250.185.164
whitelisted

Threats

PID
Process
Class
Message
864
rl_13e3efd933af3efc00a35ffba413f479ad754ebba398d4eff88f1cbb785adfd3.exe
Potentially Bad Traffic
ET INFO Executable Download from dotted-quad Host
864
rl_13e3efd933af3efc00a35ffba413f479ad754ebba398d4eff88f1cbb785adfd3.exe
Misc activity
ET INFO Packed Executable Download
864
rl_13e3efd933af3efc00a35ffba413f479ad754ebba398d4eff88f1cbb785adfd3.exe
Potential Corporate Privacy Violation
ET INFO PE EXE or DLL Windows file download HTTP
864
rl_13e3efd933af3efc00a35ffba413f479ad754ebba398d4eff88f1cbb785adfd3.exe
Potentially Bad Traffic
ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response
864
rl_13e3efd933af3efc00a35ffba413f479ad754ebba398d4eff88f1cbb785adfd3.exe
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
4920
ramez.exe
Malware Command and Control Activity Detected
BOTNET [ANY.RUN] Amadey HTTP POST Request (st=s)
4920
ramez.exe
Malware Command and Control Activity Detected
ET MALWARE Amadey CnC Response
4920
ramez.exe
Malware Command and Control Activity Detected
ET MALWARE Amadey CnC Response
Process
Message
rl_13e3efd933af3efc00a35ffba413f479ad754ebba398d4eff88f1cbb785adfd3.exe
%s------------------------------------------------ --- Themida Professional --- --- (c)2012 Oreans Technologies --- ------------------------------------------------