download:

/test/exe/random.exe

Full analysis: https://app.any.run/tasks/f427a757-7d57-40be-875b-9e7393f488e8
Verdict: Malicious activity
Threats:

Amadey is a formidable Windows infostealer threat, characterized by its persistence mechanisms, modular design, and ability to execute various malicious tasks.

Malware Trends Tracker     >>>
Analysis date: May 18, 2025, 21:34:45
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
loader
amadey
botnet
stealer
pastebin
connectwise
rmm-tool
lumma
rdp
xworm
gcleaner
telegram
credentialflusher
remote
auto
generic
screenconnect
antivm
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:

A8DE3F79795F630984A4235C8FED8D6A

SHA1:

55A01083A51E1E87EE681D5F6B9F986A6735C199

SHA256:

446B2602121CCE17C0894E40C768918102D347E1A166E40909D4947BE3EF3E81

SSDEEP:

49152:jPPkzemqoSut3Jh4+QQ/btosJwIA4hHmZlKH2Tw/Pq83zw0bCjvk9G661QGtBCXo:zP/mp7t3T4+B/btosJwIA4hHmZlKH2TO

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Script downloads file (POWERSHELL)

      • powershell.exe (PID: 7424)

    • AMADEY mutex has been found

      • ramez.exe (PID: 7180)
      • TempLG06VGGZ4VKVFL9ZWQT9K0SN0QZUPH24.EXE (PID: 8120)

    • AMADEY has been detected (SURICATA)

      • ramez.exe (PID: 7180)
      • saren.exe (PID: 4572)

    • Connects to the CnC server

      • ramez.exe (PID: 7180)
      • svchost.exe (PID: 2196)
      • saren.exe (PID: 4572)

    • AMADEY has been detected (YARA)

      • ramez.exe (PID: 7180)

    • Uses Task Scheduler to run other applications

      • 9gDAOjO.exe (PID: 7272)
      • cmd.exe (PID: 10428)

    • Changes the autorun value in the registry

      • 9gDAOjO.exe (PID: 7272)

    • Adds path to the Windows Defender exclusion list

      • cmd.exe (PID: 976)
      • NSudoLG.exe (PID: 3900)

    • Changes Windows Defender settings

      • NSudoLG.exe (PID: 3900)
      • WinTemp-v4.exe (PID: 8156)

    • XWORM has been detected (YARA)

      • 9gDAOjO.exe (PID: 7272)

    • Known privilege escalation attack

      • dllhost.exe (PID: 5556)

    • Adds process to the Windows Defender exclusion list

      • WinTemp-v4.exe (PID: 8156)

    • Starts SC.EXE for service management

      • cmd.exe (PID: 976)
      • cmd.exe (PID: 8716)

    • LUMMA has been detected (SURICATA)

      • svchost.exe (PID: 2196)
      • MSBuild.exe (PID: 3176)
      • MSBuild.exe (PID: 2144)
      • 6b5f14d5f8.exe (PID: 8968)

    • Uses Task Scheduler to autorun other applications

      • WinTemp-v4.exe (PID: 8156)

    • Starts REAGENTC.EXE to disable the Windows Recovery Environment

      • ReAgentc.exe (PID: 7576)

    • Executing a file with an untrusted certificate

      • 12daa228da.exe (PID: 8648)

    • GCLEANER has been detected (SURICATA)

      • cvtres.exe (PID: 8232)

    • Possible tool for stealing has been detected

      • dd9b563bff.exe (PID: 2960)
      • firefox.exe (PID: 10844)

    • Run PowerShell with an invisible window

      • powershell.exe (PID: 10972)

    • Request from PowerShell that ran from MSHTA.EXE

      • powershell.exe (PID: 10972)

    • XWORM has been detected (SURICATA)

      • 9gDAOjO.exe (PID: 7272)

    • GENERIC has been found (auto)

      • cvtres.exe (PID: 8232)

    • SCREENCONNECT has been detected (SURICATA)

      • ScreenConnect.ClientService.exe (PID: 8560)

  • SUSPICIOUS

    • Potential Corporate Privacy Violation

      • powershell.exe (PID: 7424)
      • ramez.exe (PID: 7180)
      • powershell.exe (PID: 10972)
      • cvtres.exe (PID: 8232)
      • ScreenConnect.ClientService.exe (PID: 8560)

    • Process requests binary or script from the Internet

      • powershell.exe (PID: 7424)
      • ramez.exe (PID: 7180)
      • powershell.exe (PID: 10972)

    • Reads security settings of Internet Explorer

      • TempLG06VGGZ4VKVFL9ZWQT9K0SN0QZUPH24.EXE (PID: 8120)
      • ramez.exe (PID: 7180)
      • 9gDAOjO.exe (PID: 7272)
      • 67575765cd.exe (PID: 6744)
      • nircmd.exe (PID: 4400)
      • wdGu2fq.exe (PID: 7412)
      • Unlocker.exe (PID: 7724)
      • Unlocker.exe (PID: 7560)

    • Connects to the server without a host name

      • powershell.exe (PID: 7424)
      • ramez.exe (PID: 7180)
      • saren.exe (PID: 4572)
      • cvtres.exe (PID: 8232)
      • powershell.exe (PID: 10972)

    • Executable content was dropped or overwritten

      • TempLG06VGGZ4VKVFL9ZWQT9K0SN0QZUPH24.EXE (PID: 8120)
      • ramez.exe (PID: 7180)
      • powershell.exe (PID: 7424)
      • 9gDAOjO.exe (PID: 7272)
      • 67575765cd.exe (PID: 6744)
      • 7z.exe (PID: 6132)
      • Unlocker.exe (PID: 7560)
      • oxDU0MW.exe (PID: 2692)
      • rundll32.exe (PID: 7240)
      • cmd.exe (PID: 976)
      • WinTemp-v4.exe (PID: 8156)
      • amnew.exe (PID: 7372)
      • 39fbc65fb7.exe (PID: 9184)
      • 39fbc65fb7.tmp (PID: 8212)
      • 7z.exe (PID: 6072)
      • csc.exe (PID: 11788)
      • powershell.exe (PID: 10972)
      • csc.exe (PID: 11220)
      • csc.exe (PID: 14072)
      • csc.exe (PID: 14136)
      • csc.exe (PID: 14284)
      • csc.exe (PID: 14224)
      • csc.exe (PID: 14292)
      • csc.exe (PID: 11272)
      • csc.exe (PID: 13652)
      • csc.exe (PID: 13952)
      • csc.exe (PID: 13332)
      • csc.exe (PID: 14056)
      • csc.exe (PID: 13556)
      • csc.exe (PID: 10176)
      • csc.exe (PID: 11400)
      • cvtres.exe (PID: 8232)

    • Starts itself from another location

      • TempLG06VGGZ4VKVFL9ZWQT9K0SN0QZUPH24.EXE (PID: 8120)
      • amnew.exe (PID: 7372)

    • Contacting a server suspected of hosting an CnC

      • ramez.exe (PID: 7180)
      • svchost.exe (PID: 2196)
      • MSBuild.exe (PID: 3176)
      • MSBuild.exe (PID: 2144)
      • saren.exe (PID: 4572)
      • 6b5f14d5f8.exe (PID: 8968)
      • 9gDAOjO.exe (PID: 7272)

    • There is functionality for enable RDP (YARA)

      • ramez.exe (PID: 7180)

    • Reads the date of Windows installation

      • 9gDAOjO.exe (PID: 7272)
      • nircmd.exe (PID: 4400)
      • Unlocker.exe (PID: 7724)
      • Unlocker.exe (PID: 7560)

    • Drops 7-zip archiver for unpacking

      • 67575765cd.exe (PID: 6744)

    • The process creates files with name similar to system file names

      • 67575765cd.exe (PID: 6744)

    • Executing commands from a ".bat" file

      • 67575765cd.exe (PID: 6744)
      • cmd.exe (PID: 5380)
      • cmd.exe (PID: 6740)
      • NSudoLG.exe (PID: 7864)
      • cmd.exe (PID: 7228)
      • nircmd.exe (PID: 4400)
      • a0f8faacee.exe (PID: 7304)
      • cmd.exe (PID: 8768)
      • nircmd.exe (PID: 9132)
      • NSudoLG.exe (PID: 4932)
      • cmd.exe (PID: 8616)
      • cmd.exe (PID: 8364)

    • There is functionality for taking screenshot (YARA)

      • ramez.exe (PID: 7180)

    • Starts CMD.EXE for commands execution

      • cmd.exe (PID: 5380)
      • nircmd.exe (PID: 4400)
      • cmd.exe (PID: 6740)
      • NSudoLG.exe (PID: 7864)
      • cmd.exe (PID: 7228)
      • 67575765cd.exe (PID: 6744)
      • cmd.exe (PID: 976)
      • Unlocker.exe (PID: 7724)
      • Unlocker.exe (PID: 7560)
      • Unlocker.exe (PID: 6724)
      • WinTemp-v4.exe (PID: 8156)
      • cmd.exe (PID: 8768)
      • a0f8faacee.exe (PID: 7304)
      • NSudoLG.exe (PID: 4932)
      • cmd.exe (PID: 8616)
      • cmd.exe (PID: 8716)
      • nircmd.exe (PID: 9132)
      • cmd.exe (PID: 8364)
      • Unlocker.exe (PID: 1040)
      • Unlocker.exe (PID: 9868)
      • 58af8478ab.exe (PID: 10360)
      • MSBuild.exe (PID: 8024)

    • Application launched itself

      • cmd.exe (PID: 5380)
      • cmd.exe (PID: 6740)
      • cmd.exe (PID: 7228)
      • cmd.exe (PID: 976)
      • cmd.exe (PID: 8768)
      • cmd.exe (PID: 8616)
      • cmd.exe (PID: 8364)
      • cmd.exe (PID: 8716)

    • Starts application with an unusual extension

      • cmd.exe (PID: 2392)
      • cmd.exe (PID: 7484)
      • cmd.exe (PID: 976)
      • cmd.exe (PID: 8808)
      • cmd.exe (PID: 8660)
      • cmd.exe (PID: 8716)

    • The executable file from the user directory is run by the CMD process

      • nircmd.exe (PID: 4400)
      • NSudoLG.exe (PID: 7864)
      • NSudoLG.exe (PID: 3900)
      • Unlocker.exe (PID: 7724)
      • 7z.exe (PID: 6132)
      • Unlocker.exe (PID: 7560)
      • Unlocker.exe (PID: 6724)
      • nircmd.exe (PID: 9132)
      • NSudoLG.exe (PID: 4932)
      • 7z.exe (PID: 6072)
      • Unlocker.exe (PID: 1040)
      • Unlocker.exe (PID: 9868)

    • Uses REG/REGEDIT.EXE to modify registry

      • cmd.exe (PID: 7484)
      • cmd.exe (PID: 976)
      • cmd.exe (PID: 8660)
      • cmd.exe (PID: 8716)

    • Get information on the list of running processes

      • cmd.exe (PID: 976)
      • cmd.exe (PID: 8028)
      • cmd.exe (PID: 8716)
      • cmd.exe (PID: 7356)

    • Starts POWERSHELL.EXE for commands execution

      • NSudoLG.exe (PID: 3900)
      • WinTemp-v4.exe (PID: 8156)
      • MSBuild.exe (PID: 8024)
      • mshta.exe (PID: 10436)

    • Script adds exclusion path to Windows Defender

      • NSudoLG.exe (PID: 3900)
      • WinTemp-v4.exe (PID: 8156)

    • PowerShell delay command usage (probably sleep evasion)

      • powershell.exe (PID: 5176)

    • Using 'findstr.exe' to search for text patterns in files and output

      • cmd.exe (PID: 976)
      • cmd.exe (PID: 8716)

    • Windows service management via SC.EXE

      • sc.exe (PID: 7976)
      • sc.exe (PID: 8040)
      • sc.exe (PID: 7568)
      • sc.exe (PID: 7452)
      • sc.exe (PID: 1128)
      • sc.exe (PID: 6240)
      • sc.exe (PID: 2400)
      • sc.exe (PID: 3848)
      • sc.exe (PID: 5720)
      • sc.exe (PID: 3364)
      • sc.exe (PID: 2340)
      • sc.exe (PID: 2860)
      • sc.exe (PID: 6036)
      • sc.exe (PID: 5304)
      • sc.exe (PID: 6660)
      • sc.exe (PID: 7444)
      • sc.exe (PID: 7696)
      • sc.exe (PID: 7528)
      • sc.exe (PID: 664)
      • sc.exe (PID: 7220)
      • sc.exe (PID: 4300)
      • sc.exe (PID: 2384)
      • sc.exe (PID: 7764)
      • sc.exe (PID: 7472)
      • sc.exe (PID: 3096)
      • sc.exe (PID: 7468)
      • sc.exe (PID: 1188)
      • sc.exe (PID: 7796)
      • sc.exe (PID: 4432)
      • sc.exe (PID: 5056)
      • sc.exe (PID: 7852)
      • sc.exe (PID: 1180)
      • sc.exe (PID: 7228)
      • sc.exe (PID: 136)
      • sc.exe (PID: 1164)
      • sc.exe (PID: 1300)
      • sc.exe (PID: 6828)
      • sc.exe (PID: 7716)
      • sc.exe (PID: 6468)
      • sc.exe (PID: 3956)
      • sc.exe (PID: 7692)
      • sc.exe (PID: 9460)
      • sc.exe (PID: 9324)
      • sc.exe (PID: 9660)
      • sc.exe (PID: 9704)
      • sc.exe (PID: 9744)
      • sc.exe (PID: 9784)
      • sc.exe (PID: 9824)
      • sc.exe (PID: 9864)
      • sc.exe (PID: 9904)
      • sc.exe (PID: 9540)
      • sc.exe (PID: 9500)
      • sc.exe (PID: 9580)
      • sc.exe (PID: 9620)
      • sc.exe (PID: 9944)
      • sc.exe (PID: 10028)
      • sc.exe (PID: 10068)
      • sc.exe (PID: 10104)
      • sc.exe (PID: 10144)
      • sc.exe (PID: 10184)
      • sc.exe (PID: 10224)
      • sc.exe (PID: 9992)
      • sc.exe (PID: 9252)
      • sc.exe (PID: 9392)
      • sc.exe (PID: 9536)
      • sc.exe (PID: 9592)
      • sc.exe (PID: 9648)
      • sc.exe (PID: 5256)
      • sc.exe (PID: 9036)
      • sc.exe (PID: 9292)
      • sc.exe (PID: 9444)
      • sc.exe (PID: 9256)
      • sc.exe (PID: 9712)
      • sc.exe (PID: 9800)
      • sc.exe (PID: 9372)
      • sc.exe (PID: 616)
      • sc.exe (PID: 9276)

    • Starts SC.EXE for service management

      • cmd.exe (PID: 7488)
      • cmd.exe (PID: 976)
      • cmd.exe (PID: 8188)
      • cmd.exe (PID: 7268)
      • cmd.exe (PID: 6516)
      • cmd.exe (PID: 9260)
      • cmd.exe (PID: 8716)
      • cmd.exe (PID: 10196)

    • Uses TASKKILL.EXE to kill process

      • cmd.exe (PID: 7984)
      • cmd.exe (PID: 7980)
      • cmd.exe (PID: 7752)
      • cmd.exe (PID: 9352)
      • dd9b563bff.exe (PID: 2960)
      • cmd.exe (PID: 9228)

    • Drops a system driver (possible attempt to evade defenses)

      • Unlocker.exe (PID: 7560)

    • Executes as Windows Service

      • VSSVC.exe (PID: 4408)
      • VSSVC.exe (PID: 4560)
      • ScreenConnect.ClientService.exe (PID: 8560)

    • Stops a currently running service

      • sc.exe (PID: 4756)
      • sc.exe (PID: 1240)
      • sc.exe (PID: 2580)
      • sc.exe (PID: 8052)
      • sc.exe (PID: 4400)
      • sc.exe (PID: 4728)
      • sc.exe (PID: 7344)
      • sc.exe (PID: 8072)
      • sc.exe (PID: 2064)
      • sc.exe (PID: 1452)
      • sc.exe (PID: 7880)
      • sc.exe (PID: 2108)
      • sc.exe (PID: 1616)
      • sc.exe (PID: 2980)
      • sc.exe (PID: 5308)
      • sc.exe (PID: 7856)
      • sc.exe (PID: 4428)
      • sc.exe (PID: 9640)
      • sc.exe (PID: 9804)
      • sc.exe (PID: 9724)
      • sc.exe (PID: 9884)
      • sc.exe (PID: 9480)
      • sc.exe (PID: 9560)
      • sc.exe (PID: 10048)
      • sc.exe (PID: 10124)
      • sc.exe (PID: 10204)
      • sc.exe (PID: 9972)
      • sc.exe (PID: 9492)
      • sc.exe (PID: 9636)
      • sc.exe (PID: 4740)
      • sc.exe (PID: 9364)
      • sc.exe (PID: 9448)
      • sc.exe (PID: 9756)

    • Script adds exclusion process to Windows Defender

      • WinTemp-v4.exe (PID: 8156)

    • Creates or modifies Windows services

      • Unlocker.exe (PID: 7560)

    • Deletes scheduled task without confirmation

      • schtasks.exe (PID: 2092)
      • schtasks.exe (PID: 7144)
      • schtasks.exe (PID: 7236)
      • schtasks.exe (PID: 7864)
      • schtasks.exe (PID: 140)
      • schtasks.exe (PID: 9928)
      • schtasks.exe (PID: 9900)
      • schtasks.exe (PID: 9948)
      • schtasks.exe (PID: 10004)
      • schtasks.exe (PID: 9860)

    • Process drops legitimate windows executable

      • cmd.exe (PID: 976)

    • Uses ICACLS.EXE to modify access control lists

      • cmd.exe (PID: 2664)
      • cmd.exe (PID: 8020)

    • Takes ownership (TAKEOWN.EXE)

      • cmd.exe (PID: 5020)

    • Hides command output

      • cmd.exe (PID: 8672)
      • cmd.exe (PID: 8588)
      • cmd.exe (PID: 2404)
      • cmd.exe (PID: 8892)
      • cmd.exe (PID: 8824)
      • cmd.exe (PID: 8992)
      • cmd.exe (PID: 6708)
      • cmd.exe (PID: 6584)
      • cmd.exe (PID: 8624)
      • cmd.exe (PID: 5124)
      • cmd.exe (PID: 9160)
      • cmd.exe (PID: 7596)
      • cmd.exe (PID: 8948)
      • cmd.exe (PID: 10016)
      • cmd.exe (PID: 8752)
      • cmd.exe (PID: 8776)
      • cmd.exe (PID: 9332)
      • cmd.exe (PID: 10032)
      • cmd.exe (PID: 10964)
      • cmd.exe (PID: 10488)
      • cmd.exe (PID: 11200)
      • cmd.exe (PID: 12856)
      • cmd.exe (PID: 10328)
      • cmd.exe (PID: 13416)
      • cmd.exe (PID: 9476)
      • cmd.exe (PID: 9908)
      • cmd.exe (PID: 11452)
      • cmd.exe (PID: 13700)
      • cmd.exe (PID: 5608)
      • cmd.exe (PID: 10604)
      • cmd.exe (PID: 10932)
      • cmd.exe (PID: 12700)
      • cmd.exe (PID: 8004)
      • cmd.exe (PID: 13272)
      • cmd.exe (PID: 10864)
      • cmd.exe (PID: 11148)
      • cmd.exe (PID: 8836)
      • cmd.exe (PID: 13756)
      • cmd.exe (PID: 13896)
      • cmd.exe (PID: 13564)
      • cmd.exe (PID: 13476)
      • cmd.exe (PID: 13968)
      • cmd.exe (PID: 11868)
      • cmd.exe (PID: 13628)
      • cmd.exe (PID: 13296)
      • cmd.exe (PID: 8812)
      • cmd.exe (PID: 10872)
      • cmd.exe (PID: 6480)
      • cmd.exe (PID: 13816)
      • cmd.exe (PID: 12800)
      • cmd.exe (PID: 7896)
      • cmd.exe (PID: 4208)
      • cmd.exe (PID: 10928)
      • cmd.exe (PID: 9072)
      • cmd.exe (PID: 11504)
      • cmd.exe (PID: 11584)
      • cmd.exe (PID: 13428)
      • cmd.exe (PID: 13504)
      • cmd.exe (PID: 13316)
      • cmd.exe (PID: 12068)
      • cmd.exe (PID: 6900)
      • cmd.exe (PID: 10408)
      • cmd.exe (PID: 2968)
      • cmd.exe (PID: 11444)
      • cmd.exe (PID: 12884)
      • cmd.exe (PID: 13708)
      • cmd.exe (PID: 12160)
      • cmd.exe (PID: 10524)
      • cmd.exe (PID: 7260)
      • cmd.exe (PID: 10712)
      • cmd.exe (PID: 11392)
      • cmd.exe (PID: 14208)
      • cmd.exe (PID: 13348)
      • cmd.exe (PID: 11620)
      • cmd.exe (PID: 14156)
      • cmd.exe (PID: 12360)
      • cmd.exe (PID: 6908)
      • cmd.exe (PID: 12708)
      • cmd.exe (PID: 12448)
      • cmd.exe (PID: 7772)
      • cmd.exe (PID: 8308)
      • cmd.exe (PID: 9576)
      • cmd.exe (PID: 13876)
      • cmd.exe (PID: 13108)
      • cmd.exe (PID: 2476)
      • cmd.exe (PID: 10556)
      • cmd.exe (PID: 8288)
      • cmd.exe (PID: 5484)
      • cmd.exe (PID: 1540)
      • cmd.exe (PID: 960)
      • cmd.exe (PID: 10540)
      • cmd.exe (PID: 13860)
      • cmd.exe (PID: 13900)
      • cmd.exe (PID: 10424)
      • cmd.exe (PID: 11164)
      • cmd.exe (PID: 1152)
      • cmd.exe (PID: 1520)
      • cmd.exe (PID: 908)
      • cmd.exe (PID: 8572)
      • cmd.exe (PID: 11932)
      • cmd.exe (PID: 8804)
      • cmd.exe (PID: 3904)
      • cmd.exe (PID: 4052)
      • cmd.exe (PID: 10704)
      • cmd.exe (PID: 12832)
      • cmd.exe (PID: 11384)
      • cmd.exe (PID: 14220)
      • cmd.exe (PID: 11104)
      • cmd.exe (PID: 14192)

    • The process executes via Task Scheduler

      • AudioStereo.exe (PID: 9024)
      • ramez.exe (PID: 9116)
      • saren.exe (PID: 9004)
      • ramez.exe (PID: 14316)
      • saren.exe (PID: 11616)
      • AudioStereo.exe (PID: 11516)
      • ramez.exe (PID: 10792)
      • AudioStereo.exe (PID: 14168)
      • saren.exe (PID: 10956)
      • AudioStereo.exe (PID: 9416)
      • ramez.exe (PID: 904)
      • saren.exe (PID: 4812)

    • Uses powercfg.exe to modify the power settings

      • WinTemp-v4.exe (PID: 8156)

    • There is functionality for VM detection VirtualBox (YARA)

      • WinTemp-v4.exe (PID: 8156)

    • Executes application which crashes

      • core.exe (PID: 9120)

    • Process communicates with Telegram (possibly using it as an attacker's C2 server)

      • MSBuild.exe (PID: 8024)
      • MSBuild.exe (PID: 11588)

    • There is functionality for VM detection VMWare (YARA)

      • WinTemp-v4.exe (PID: 8156)

    • Uses TASKKILL.EXE to kill Browsers

      • dd9b563bff.exe (PID: 2960)

    • Base64-obfuscated command line is found

      • MSBuild.exe (PID: 8024)

    • Found IP address in command line

      • powershell.exe (PID: 10972)

    • The process bypasses the loading of PowerShell profile settings

      • MSBuild.exe (PID: 8024)

    • Manipulates environment variables

      • powershell.exe (PID: 10972)

    • BASE64 encoded PowerShell command has been detected

      • MSBuild.exe (PID: 8024)

    • Probably download files using WebClient

      • mshta.exe (PID: 10436)

    • Starts process via Powershell

      • powershell.exe (PID: 10972)

    • Connects to unusual port

      • 9gDAOjO.exe (PID: 7272)
      • ScreenConnect.ClientService.exe (PID: 8560)

    • CSC.EXE is used to compile C# code

      • csc.exe (PID: 11788)
      • csc.exe (PID: 11220)
      • csc.exe (PID: 13952)
      • csc.exe (PID: 14072)
      • csc.exe (PID: 14136)
      • csc.exe (PID: 14224)
      • csc.exe (PID: 14284)
      • csc.exe (PID: 14292)
      • csc.exe (PID: 13652)
      • csc.exe (PID: 13556)
      • csc.exe (PID: 11272)
      • csc.exe (PID: 14056)
      • csc.exe (PID: 13332)
      • csc.exe (PID: 10176)
      • csc.exe (PID: 11400)

    • The process hide an interactive prompt from the user

      • MSBuild.exe (PID: 8024)

    • Uses TIMEOUT.EXE to delay execution

      • cmd.exe (PID: 13844)

    • Screenconnect has been detected

      • ScreenConnect.ClientService.exe (PID: 8560)

  • INFO

    • Checks supported languages

      • random.exe (PID: 7184)
      • TempLG06VGGZ4VKVFL9ZWQT9K0SN0QZUPH24.EXE (PID: 8120)
      • ramez.exe (PID: 7180)
      • 9gDAOjO.exe (PID: 7272)
      • 67575765cd.exe (PID: 6744)
      • chcp.com (PID: 1312)
      • nircmd.exe (PID: 4400)
      • chcp.com (PID: 7512)
      • NSudoLG.exe (PID: 7864)
      • chcp.com (PID: 7828)
      • mode.com (PID: 7788)
      • NSudoLG.exe (PID: 3900)
      • wdGu2fq.exe (PID: 7412)
      • 7z.exe (PID: 6132)
      • Unlocker.exe (PID: 7724)
      • Unlocker.exe (PID: 7560)
      • msiexec.exe (PID: 7428)
      • IObitUnlocker.exe (PID: 1852)
      • msiexec.exe (PID: 2800)
      • IObitUnlocker.exe (PID: 2344)
      • oxDU0MW.exe (PID: 2692)
      • WinTemp-v4.exe (PID: 8156)

    • Reads mouse settings

      • random.exe (PID: 7184)

    • Checks proxy server information

      • powershell.exe (PID: 7424)
      • ramez.exe (PID: 7180)
      • 9gDAOjO.exe (PID: 7272)

    • Create files in a temporary directory

      • random.exe (PID: 7184)
      • TempLG06VGGZ4VKVFL9ZWQT9K0SN0QZUPH24.EXE (PID: 8120)
      • ramez.exe (PID: 7180)
      • 67575765cd.exe (PID: 6744)
      • 7z.exe (PID: 6132)
      • wdGu2fq.exe (PID: 7412)
      • rundll32.exe (PID: 7240)
      • oxDU0MW.exe (PID: 2692)

    • Reads the computer name

      • random.exe (PID: 7184)
      • TempLG06VGGZ4VKVFL9ZWQT9K0SN0QZUPH24.EXE (PID: 8120)
      • ramez.exe (PID: 7180)
      • 9gDAOjO.exe (PID: 7272)
      • 67575765cd.exe (PID: 6744)
      • nircmd.exe (PID: 4400)
      • NSudoLG.exe (PID: 7864)
      • NSudoLG.exe (PID: 3900)
      • wdGu2fq.exe (PID: 7412)
      • 7z.exe (PID: 6132)
      • Unlocker.exe (PID: 7724)
      • Unlocker.exe (PID: 7560)
      • msiexec.exe (PID: 7428)
      • msiexec.exe (PID: 2800)
      • IObitUnlocker.exe (PID: 1852)
      • IObitUnlocker.exe (PID: 2344)
      • oxDU0MW.exe (PID: 2692)

    • The executable file from the user directory is run by the Powershell process

      • TempLG06VGGZ4VKVFL9ZWQT9K0SN0QZUPH24.EXE (PID: 8120)
      • TempBJBQ9TZW6QGVBQJFLADFNNKIWDEFREL9.EXE (PID: 10280)

    • The sample compiled with english language support

      • random.exe (PID: 7184)
      • 67575765cd.exe (PID: 6744)
      • Unlocker.exe (PID: 7560)
      • cmd.exe (PID: 976)
      • ramez.exe (PID: 7180)

    • Disables trace logs

      • powershell.exe (PID: 7424)
      • 9gDAOjO.exe (PID: 7272)

    • Process checks computer location settings

      • TempLG06VGGZ4VKVFL9ZWQT9K0SN0QZUPH24.EXE (PID: 8120)
      • ramez.exe (PID: 7180)
      • 9gDAOjO.exe (PID: 7272)
      • 67575765cd.exe (PID: 6744)
      • nircmd.exe (PID: 4400)
      • wdGu2fq.exe (PID: 7412)

    • Creates files or folders in the user directory

      • ramez.exe (PID: 7180)
      • 9gDAOjO.exe (PID: 7272)

    • Reads Environment values

      • 9gDAOjO.exe (PID: 7272)

    • Reads the software policy settings

      • 9gDAOjO.exe (PID: 7272)

    • Changes the display of characters in the console

      • cmd.exe (PID: 2392)
      • cmd.exe (PID: 7484)
      • cmd.exe (PID: 976)
      • cmd.exe (PID: 8808)
      • cmd.exe (PID: 8716)
      • cmd.exe (PID: 8660)

    • NirSoft software is detected

      • nircmd.exe (PID: 4400)
      • nircmd.exe (PID: 9132)

    • Reads the machine GUID from the registry

      • 9gDAOjO.exe (PID: 7272)
      • wdGu2fq.exe (PID: 7412)
      • Unlocker.exe (PID: 7724)
      • Unlocker.exe (PID: 7560)
      • oxDU0MW.exe (PID: 2692)

    • Starts MODE.COM to configure console settings

      • mode.com (PID: 7788)
      • mode.com (PID: 8460)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 5176)

    • Checks if a key exists in the options dictionary (POWERSHELL)

      • powershell.exe (PID: 5176)
      • powershell.exe (PID: 5776)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 7992)
      • msiexec.exe (PID: 7428)

    • CONNECTWISE has been detected

      • msiexec.exe (PID: 7992)

    • Checks transactions between databases Windows and Oracle

      • oxDU0MW.exe (PID: 2692)

    • Checks operating system version

      • cmd.exe (PID: 976)
      • cmd.exe (PID: 8716)

    • Manual execution by a user

      • cvtres.exe (PID: 8232)

    • Reads security settings of Internet Explorer

      • dllhost.exe (PID: 5556)

    • Application launched itself

      • chrome.exe (PID: 8504)
      • chrome.exe (PID: 8976)
      • firefox.exe (PID: 10844)
      • firefox.exe (PID: 11000)
      • chrome.exe (PID: 12580)
      • chrome.exe (PID: 12732)
      • chrome.exe (PID: 12888)
      • chrome.exe (PID: 13044)
      • chrome.exe (PID: 12368)
      • chrome.exe (PID: 10244)
      • chrome.exe (PID: 13156)
      • chrome.exe (PID: 13676)
      • chrome.exe (PID: 13408)
      • chrome.exe (PID: 13236)
      • chrome.exe (PID: 12336)
      • chrome.exe (PID: 12676)
      • chrome.exe (PID: 13096)
      • msedge.exe (PID: 12820)

    • Attempting to use instant messaging service

      • MSBuild.exe (PID: 11588)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Amadey

(PID) Process(7180) ramez.exe
C2185.156.72.96
URLhttp://185.156.72.96/te4h2nus/index.php
Version5.34
Options
Drop directoryd610cf342e
Drop nameramez.exe
Strings (125)lv:
msi
Kaspersky Lab
av:
|
#
"
\App
00000422
dm:
Powershell.exe
ProgramData\
ps1
rundll32
http://
Content-Disposition: form-data; name="data"; filename="
SOFTWARE\Microsoft\Windows NT\CurrentVersion
dll
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
id:
VideoID
cred.dll|clip.dll|
0000043f
cmd
00000423
SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName
-executionpolicy remotesigned -File "
2022
------
2016
og:
\0000
CurrentBuild
2019
:::
S-%lu-
" && timeout 1 && del
ProductName
Panda Security
ESET
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
/k
+++
?scr=1
Doctor Web
GET
SYSTEM\ControlSet001\Services\BasicDisplay\Video
/quiet
.jpg
d610cf342e
vs:
sd:
rundll32.exe
"taskkill /f /im "
pc:
random
=
360TotalSecurity
<d>
wb
Content-Type: multipart/form-data; boundary=----
Startup
Norton
&& Exit"
os:
https://
SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
2025
Avira
%-lu
zip
POST
" Content-Type: application/octet-stream
Rem
/te4h2nus/index.php
------
5.34
<c>
clip.dll
AVAST Software
\
shell32.dll
" && ren
e3
ramez.exe
kernel32.dll
DefaultSettings.XResolution
d1
DefaultSettings.YResolution
185.156.72.96
r=
cred.dll
--
GetNativeSystemInfo
-%lu
ComputerName
&unit=
Keyboard Layout\Preload
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
ar:
Sophos
%USERPROFILE%
exe
e1
e2
st=s
Programs
0123456789
un:
rb
bi:
abcdefghijklmnopqrstuvwxyz0123456789-_
SYSTEM\CurrentControlSet\Control\UnitedVideo\CONTROL\VIDEO\
cmd /C RMDIR /s/q
Bitdefender
-unicode-
AVG
WinDefender
&&
shutdown -s -t 0
Comodo
00000419
Content-Type: application/x-www-form-urlencoded
/Plugins/
Main

XWorm

(PID) Process(7272) 9gDAOjO.exe
C2https://pastebin.com/raw/rFcK9sdX:‎ ‎ ‎ ‎ ‎ ‎ ‎ ‎ ‎ ‎ ‎ ‎ ‎ ‎ ‎ ‎
Keys
AES<Xwormmm>
Options
Splitter3
Sleep timeXXX
USB drop nameUSB.exe
MutexXnU4hdycBkfsrLHN
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (76.4)
.exe | Win32 Executable (generic) (12.4)
.exe | Generic Win/DOS Executable (5.5)
.exe | DOS Executable Generic (5.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2025:05:18 20:32:01+00:00
ImageFileCharacteristics: Executable, Large address aware, 32-bit
PEType: PE32
LinkerVersion: 14.16
CodeSize: 633856
InitializedDataSize: 326144
UninitializedDataSize: -
EntryPoint: 0x20577
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
FileVersionNumber: 0.0.0.0
ProductVersionNumber: 0.0.0.0
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (British)
CharacterSet: Unicode
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
1 064
Monitored processes
901
Malicious processes
41
Suspicious processes
12

Behavior graph

Click at the process to see the details
start drop and start random.exe no specs sppextcomobj.exe no specs slui.exe powershell.exe templg06vggz4vkvfl9zwqt9k0sn0qzuph24.exe no specs #AMADEY ramez.exe #XWORM 9gdaojo.exe schtasks.exe no specs conhost.exe no specs 67575765cd.exe cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs chcp.com no specs reg.exe no specs nircmd.exe no specs cmd.exe conhost.exe no specs cmd.exe no specs conhost.exe no specs chcp.com no specs reg.exe no specs reg.exe no specs nsudolg.exe no specs cmd.exe conhost.exe no specs cmd.exe conhost.exe no specs chcp.com no specs reg.exe no specs reg.exe no specs mode.com no specs cmd.exe no specs reg.exe no specs find.exe no specs cmd.exe no specs tasklist.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs find.exe no specs nsudolg.exe no specs powershell.exe no specs conhost.exe no specs wdgu2fq.exe no specs wdgu2fq.exe reg.exe no specs find.exe no specs cmd.exe no specs findstr.exe no specs 7z.exe unlocker.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs msiexec.exe taskkill.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs sc.exe no specs find.exe no specs sc.exe no specs sc.exe no specs unlocker.exe msiexec.exe cmd.exe no specs conhost.exe no specs sc.exe no specs iobitunlocker.exe no specs msiexec.exe no specs rundll32.exe vssvc.exe no specs iobitunlocker.exe no specs oxdu0mw.exe vssvc.exe no specs CMSTPLUA wintemp-v4.exe powershell.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs eeteayl.exe no specs conhost.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs powershell.exe no specs conhost.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs unlocker.exe no specs cmd.exe no specs conhost.exe no specs #LUMMA msbuild.exe sc.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs sc.exe no specs sc.exe no specs powershell.exe no specs conhost.exe no specs #LUMMA svchost.exe 08iyoof.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs reagentc.exe no specs #LUMMA msbuild.exe amnew.exe cmd.exe no specs conhost.exe no specs takeown.exe no specs cmd.exe no specs conhost.exe no specs icacls.exe no specs cmd.exe no specs conhost.exe no specs icacls.exe no specs powercfg.exe no specs conhost.exe no specs powercfg.exe no specs conhost.exe no specs powercfg.exe no specs conhost.exe no specs powercfg.exe no specs conhost.exe no specs #AMADEY saren.exe powercfg.exe no specs conhost.exe no specs powercfg.exe no specs conhost.exe no specs powercfg.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs ping.exe no specs 9gdaojo.exe no specs cmd.exe no specs conhost.exe no specs ping.exe no specs cmd.exe no specs conhost.exe no specs ping.exe no specs saren.exe no specs audiostereo.exe no specs ramez.exe no specs slui.exe cmd.exe no specs conhost.exe no specs ping.exe no specs 12daa228da.exe no specs cmd.exe no specs conhost.exe no specs ping.exe no specs cmd.exe no specs conhost.exe no specs ping.exe no specs 39fbc65fb7.exe 39fbc65fb7.tmp #GCLEANER cvtres.exe info.exe conhost.exe no specs core.exe cmd.exe no specs conhost.exe no specs ping.exe no specs msbuild.exe no specs msbuild.exe cmd.exe no specs conhost.exe no specs ping.exe no specs werfault.exe no specs cmd.exe no specs conhost.exe no specs ping.exe no specs #LUMMA 6b5f14d5f8.exe cmd.exe no specs conhost.exe no specs ping.exe no specs cmd.exe no specs conhost.exe no specs ping.exe no specs cmd.exe no specs conhost.exe no specs ping.exe no specs cmd.exe no specs conhost.exe no specs ping.exe no specs a0f8faacee.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs chcp.com no specs reg.exe no specs nircmd.exe no specs cmd.exe conhost.exe no specs cmd.exe no specs conhost.exe no specs chcp.com no specs reg.exe no specs reg.exe no specs nsudolg.exe no specs cmd.exe conhost.exe no specs cmd.exe no specs conhost.exe no specs chcp.com no specs reg.exe no specs reg.exe no specs mode.com no specs cmd.exe no specs reg.exe no specs find.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs conhost.exe no specs ping.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs find.exe no specs cmd.exe no specs findstr.exe no specs 7z.exe unlocker.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs cmd.exe no specs conhost.exe no specs ping.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs unlocker.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs sc.exe no specs sc.exe no specs #CREDENTIALFLUSHER dd9b563bff.exe no specs cmd.exe no specs conhost.exe no specs ping.exe no specs taskkill.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs ping.exe no specs chrome.exe no specs powershell.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs chrome.exe no specs taskkill.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs ping.exe no specs taskkill.exe no specs chrome.exe powershell.exe no specs conhost.exe no specs chrome.exe no specs conhost.exe no specs 58af8478ab.exe no specs cmd.exe no specs mshta.exe no specs conhost.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs #CREDENTIALFLUSHER firefox.exe no specs chrome.exe no specs cmd.exe no specs powershell.exe conhost.exe no specs firefox.exe schtasks.exe no specs conhost.exe no specs ping.exe no specs csc.exe cvtres.exe no specs firefox.exe no specs firefox.exe no specs cmd.exe no specs conhost.exe no specs ping.exe no specs chrome.exe no specs firefox.exe no specs chrome.exe no specs chrome.exe no specs csc.exe firefox.exe no specs cvtres.exe no specs firefox.exe no specs firefox.exe no specs 42e5be54cf.exe no specs conhost.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs tempbjbq9tzw6qgvbqjfladfnnkiwdefrel9.exe no specs cmd.exe no specs conhost.exe no specs ping.exe no specs chrome.exe no specs msbuild.exe firefox.exe no specs cmd.exe no specs conhost.exe no specs ping.exe no specs firefox.exe no specs chrome.exe no specs powershell.exe no specs conhost.exe no specs chrome.exe no specs chrome.exe no specs powershell.exe no specs conhost.exe no specs chrome.exe no specs chrome.exe no specs powershell.exe no specs chrome.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs chrome.exe no specs powershell.exe no specs conhost.exe no specs chrome.exe no specs chrome.exe no specs powershell.exe no specs chrome.exe no specs conhost.exe no specs chrome.exe no specs powershell.exe no specs chrome.exe no specs conhost.exe no specs ping.exe no specs chrome.exe no specs powershell.exe no specs conhost.exe no specs chrome.exe no specs chrome.exe no specs powershell.exe no specs conhost.exe no specs chrome.exe no specs chrome.exe no specs powershell.exe no specs conhost.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs powershell.exe no specs conhost.exe no specs chrome.exe no specs powershell.exe no specs conhost.exe no specs chrome.exe no specs chrome.exe no specs cmd.exe no specs powershell.exe no specs chrome.exe no specs conhost.exe no specs conhost.exe no specs chrome.exe no specs powershell.exe no specs conhost.exe no specs chrome.exe no specs ping.exe no specs csc.exe csc.exe cvtres.exe no specs csc.exe cvtres.exe no specs csc.exe csc.exe cvtres.exe no specs cvtres.exe no specs cvtres.exe no specs csc.exe cmd.exe no specs conhost.exe no specs csc.exe csc.exe cvtres.exe no specs cvtres.exe no specs cvtres.exe no specs ping.exe no specs saren.exe no specs audiostereo.exe no specs csc.exe csc.exe ramez.exe no specs cvtres.exe no specs cvtres.exe no specs csc.exe cvtres.exe no specs csc.exe cvtres.exe no specs csc.exe cvtres.exe no specs cmd.exe no specs conhost.exe no specs ping.exe no specs cmd.exe no specs conhost.exe no specs ping.exe no specs cmd.exe no specs conhost.exe no specs ping.exe no specs cmd.exe no specs conhost.exe no specs ping.exe no specs msedge.exe cmd.exe no specs conhost.exe no specs ping.exe no specs cmd.exe no specs conhost.exe no specs ping.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs cmd.exe no specs conhost.exe no specs ping.exe no specs cmd.exe no specs conhost.exe no specs ping.exe no specs cmd.exe no specs conhost.exe no specs ping.exe no specs cmd.exe no specs conhost.exe no specs ping.exe no specs cmd.exe no specs conhost.exe no specs ping.exe no specs cmd.exe no specs conhost.exe no specs ping.exe no specs cmd.exe no specs conhost.exe no specs ping.exe no specs cmd.exe no specs conhost.exe no specs ping.exe no specs cmd.exe no specs conhost.exe no specs ping.exe no specs cmd.exe no specs conhost.exe no specs ping.exe no specs cmd.exe no specs conhost.exe no specs ping.exe no specs cmd.exe no specs conhost.exe no specs ping.exe no specs cmd.exe no specs conhost.exe no specs ping.exe no specs cmd.exe no specs conhost.exe no specs timeout.exe no specs cmd.exe no specs conhost.exe no specs ping.exe no specs cmd.exe no specs conhost.exe no specs ping.exe no specs cmd.exe no specs conhost.exe no specs ping.exe no specs cmd.exe no specs conhost.exe no specs ping.exe no specs cmd.exe no specs conhost.exe no specs ping.exe no specs cmd.exe no specs conhost.exe no specs ping.exe no specs cmd.exe no specs conhost.exe no specs ping.exe no specs cmd.exe no specs conhost.exe no specs ping.exe no specs ramez.exe no specs audiostereo.exe no specs saren.exe no specs cmd.exe no specs conhost.exe no specs ping.exe no specs cmd.exe no specs conhost.exe no specs ping.exe no specs cmd.exe no specs conhost.exe no specs ping.exe no specs cmd.exe no specs conhost.exe no specs ping.exe no specs cmd.exe no specs conhost.exe no specs ping.exe no specs cmd.exe no specs conhost.exe no specs ping.exe no specs cmd.exe no specs conhost.exe no specs ping.exe no specs cmd.exe no specs conhost.exe no specs ping.exe no specs cmd.exe no specs conhost.exe no specs ping.exe no specs cmd.exe no specs conhost.exe no specs ping.exe no specs cmd.exe no specs conhost.exe no specs ping.exe no specs cmd.exe no specs conhost.exe no specs ping.exe no specs msiexec.exe no specs cmd.exe no specs conhost.exe no specs ping.exe no specs msiexec.exe no specs #SCREENCONNECT screenconnect.clientservice.exe screenconnect.windowsclient.exe no specs cmd.exe no specs conhost.exe no specs ping.exe no specs screenconnect.windowsclient.exe no specs cmd.exe no specs conhost.exe no specs ping.exe no specs cmd.exe no specs conhost.exe no specs ping.exe no specs cmd.exe no specs conhost.exe no specs ping.exe no specs cmd.exe no specs conhost.exe no specs ping.exe no specs cmd.exe no specs conhost.exe no specs ping.exe no specs cmd.exe no specs conhost.exe no specs ping.exe no specs cmd.exe no specs conhost.exe no specs ping.exe no specs cmd.exe no specs conhost.exe no specs ping.exe no specs cmd.exe no specs conhost.exe no specs ping.exe no specs cmd.exe no specs conhost.exe no specs ping.exe no specs cmd.exe no specs conhost.exe no specs ping.exe no specs cmd.exe no specs conhost.exe no specs ping.exe no specs cmd.exe no specs conhost.exe no specs ping.exe no specs cmd.exe no specs conhost.exe no specs ping.exe no specs cmd.exe no specs conhost.exe no specs ping.exe no specs cmd.exe no specs conhost.exe no specs ping.exe no specs ramez.exe no specs audiostereo.exe no specs saren.exe no specs cmd.exe no specs conhost.exe no specs ping.exe no specs cmd.exe no specs conhost.exe no specs ping.exe no specs cmd.exe no specs conhost.exe no specs ping.exe no specs cmd.exe no specs conhost.exe no specs ping.exe no specs cmd.exe no specs conhost.exe no specs ping.exe no specs cmd.exe no specs conhost.exe no specs ping.exe no specs cmd.exe no specs conhost.exe no specs ping.exe no specs cmd.exe no specs conhost.exe no specs ping.exe no specs cmd.exe no specs conhost.exe no specs ping.exe no specs cmd.exe no specs conhost.exe no specs ping.exe no specs cmd.exe no specs conhost.exe no specs ping.exe no specs cmd.exe no specs conhost.exe no specs ping.exe no specs cmd.exe no specs conhost.exe no specs ping.exe no specs cmd.exe no specs conhost.exe no specs ping.exe no specs cmd.exe no specs conhost.exe no specs ping.exe no specs cmd.exe no specs conhost.exe no specs ping.exe no specs cmd.exe no specs conhost.exe no specs ping.exe no specs cmd.exe no specs conhost.exe no specs ping.exe no specs cmd.exe no specs conhost.exe no specs ping.exe no specs cmd.exe no specs conhost.exe no specs ping.exe no specs cmd.exe no specs conhost.exe no specs ping.exe no specs cmd.exe no specs conhost.exe no specs ping.exe no specs cmd.exe no specs conhost.exe no specs ping.exe no specs cmd.exe no specs conhost.exe no specs ping.exe no specs cmd.exe no specs conhost.exe no specs ping.exe no specs cmd.exe no specs conhost.exe no specs ping.exe no specs cmd.exe no specs conhost.exe no specs ping.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
136sc config "MsSecCore" start= disabled C:\Windows\System32\sc.exe—cmd.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Service Control Manager Configuration Tool
Version:
10.0.19041.1 (WinBuild.160101.0800)
140schtasks /Delete /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /fC:\Windows\System32\schtasks.exe—cmd.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Task Scheduler Configuration Tool
Version:
10.0.19041.1 (WinBuild.160101.0800)
540\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
616sc start VMTools C:\Windows\System32\sc.exe—cmd.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Service Control Manager Configuration Tool
Version:
10.0.19041.1 (WinBuild.160101.0800)
664sc config "SecurityHealthService" start= disabled C:\Windows\System32\sc.exe—cmd.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Service Control Manager Configuration Tool
Version:
10.0.19041.1 (WinBuild.160101.0800)
668reg query "HKLM\System\CurrentControlSet\Services\MsSecCore" C:\Windows\System32\reg.exe—cmd.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Registry Console Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
672\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
684reg query "HKLM\System\CurrentControlSet\Services\MDCoreSvc" C:\Windows\System32\reg.exe—cmd.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Registry Console Tool
Version:
10.0.19041.1 (WinBuild.160101.0800)
728reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Windows Defender/WHC" /fC:\Windows\System32\reg.exe—cmd.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Registry Console Tool
Version:
10.0.19041.1 (WinBuild.160101.0800)
732\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Total events
0
Read events
0
Write events
0
Delete events
0

Modification events

No data
Executable files
115
Suspicious files
400
Text files
234
Unknown types
2

Dropped files

PID
Process
Filename
Type
7180ramez.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\RR3E01RZ\9gDAOjO[1].exeexecutable
MD5:AEE95160526558F87E3243E776FF9731
SHA256:23966FEC06A90D97DC38AF76DBEECCCBB64E460FAC0B8CCD00744B76FF7CE5A4
7184random.exeC:\Users\admin\AppData\Local\Temp\GQwZPYhMa.htahtml
MD5:A6F50126FA9C691219CF4B295284F000
SHA256:E8BAC3B61904A653EDB0B94CBC9B1D0C626DA9AB7E071261EEF18B71BA909A4A
7424powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_x0ehbwof.m2p.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
7424powershell.exeC:\Users\admin\AppData\Local\TempLG06VGGZ4VKVFL9ZWQT9K0SN0QZUPH24.EXEexecutable
MD5:26CC5A6CFD8E8ECC433337413C14CDDB
SHA256:2D904D576B46236BAF504DBA21775F6EBBBD0F65272A9C2FCA1C6798184FA4E8
7412wdGu2fq.exeC:\Users\admin\AppData\Local\Temp\ScreenConnect\25.2.4.9229\aef365f0605040ee\ScreenConnect.ClientSetup.msi —
MD5:—
SHA256:—
674467575765cd.exeC:\Users\admin\AppData\Local\Temp\Work\nircmd.exeexecutable
MD5:4A9DA765FD91E80DECFD2C9FE221E842
SHA256:2E81E048AB419FDC6E5F4336A951BD282ED6B740048DC38D7673678EE3490CDA
7180ramez.exeC:\Users\admin\AppData\Local\Temp\10143320101\9gDAOjO.exeexecutable
MD5:AEE95160526558F87E3243E776FF9731
SHA256:23966FEC06A90D97DC38AF76DBEECCCBB64E460FAC0B8CCD00744B76FF7CE5A4
5176powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_nwv2xtbh.xc0.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
7180ramez.exeC:\Users\admin\AppData\Local\Temp\10143480101\67575765cd.exeexecutable
MD5:141EB16DC275CAEC60E5BBBFAB3237B0
SHA256:F121EBA49C7460088D6BC2423034CA2271BAB72837EB7CAA5594F89D27B65D01
674467575765cd.exeC:\Users\admin\AppData\Local\Temp\Work\NSudoLG.exeexecutable
MD5:423129DDB24FB923F35B2DD5787B13DD
SHA256:5094AD359D8CF6DC5324598605C35F68519CC5AF9C7ED5427E02A6B28121E4C7
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
95
TCP/UDP connections
279
DNS requests
227
Threats
92

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
2.17.251.99:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
2104
svchost.exe
GET
200
2.17.251.99:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
2104
svchost.exe
GET
200
2.21.189.233:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
2.21.189.233:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
7180
ramez.exe
POST
200
185.156.72.96:80
http://185.156.72.96/te4h2nus/index.php
unknown
—
—
malicious
7180
ramez.exe
POST
200
185.156.72.96:80
http://185.156.72.96/te4h2nus/index.php
unknown
—
—
malicious
6544
svchost.exe
GET
200
23.210.252.238:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
7180
ramez.exe
GET
200
185.156.72.2:80
http://185.156.72.2/files/7119420249/9gDAOjO.exe
unknown
—
—
unknown
7180
ramez.exe
POST
200
185.156.72.96:80
http://185.156.72.96/te4h2nus/index.php
unknown
—
—
malicious
7424
powershell.exe
GET
200
185.156.72.2:80
http://185.156.72.2/testmine/random.exe
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
5496
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2568
RUXIMICS.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2104
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2568
RUXIMICS.exe
2.17.251.99:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
5496
MoUsoCoreWorker.exe
2.17.251.99:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
2104
svchost.exe
2.17.251.99:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2568
RUXIMICS.exe
2.21.189.233:80
www.microsoft.com
Akamai International B.V.
GB
whitelisted
5496
MoUsoCoreWorker.exe
2.21.189.233:80
www.microsoft.com
Akamai International B.V.
GB
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
whitelisted
google.com
  • 142.250.74.110
whitelisted
crl.microsoft.com
  • 2.17.251.99
whitelisted
www.microsoft.com
  • 2.21.189.233
whitelisted
login.live.com
  • 20.190.177.23
whitelisted
ocsp.digicert.com
  • 23.210.252.238
whitelisted
pastebin.com
  • 23.216.134.137
whitelisted
slscr.update.microsoft.com
  • 52.149.20.212
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 52.165.164.15
whitelisted
cornerdurv.top
  • 104.21.16.1
unknown

Threats

PID
Process
Class
Message
7424
powershell.exe
Potentially Bad Traffic
ET INFO Executable Download from dotted-quad Host
7424
powershell.exe
Potential Corporate Privacy Violation
ET INFO PE EXE or DLL Windows file download HTTP
7424
powershell.exe
Misc activity
ET INFO Packed Executable Download
7424
powershell.exe
Potentially Bad Traffic
ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response
7424
powershell.exe
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
7180
ramez.exe
Malware Command and Control Activity Detected
BOTNET [ANY.RUN] Amadey HTTP POST Request (st=s)
7180
ramez.exe
Malware Command and Control Activity Detected
ET MALWARE Amadey CnC Response
7180
ramez.exe
Potentially Bad Traffic
ET INFO Executable Download from dotted-quad Host
7180
ramez.exe
Potential Corporate Privacy Violation
ET INFO PE EXE or DLL Windows file download HTTP
7180
ramez.exe
Potentially Bad Traffic
ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
/test/exe/random.exe