File name:

random.exe

Full analysis: https://app.any.run/tasks/445a9266-f011-4737-988d-7e93288be458
Verdict: Malicious activity
Threats:

Amadey is a formidable Windows infostealer threat, characterized by its persistence mechanisms, modular design, and ability to execute various malicious tasks.

Malware Trends Tracker     >>>
Analysis date: April 27, 2025, 08:09:23
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
lumma
stealer
themida
loader
amadey
botnet
telegram
putty
rmm-tool
phishing
rdp
auto
generic
gcleaner
delphi
inno
installer
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 7 sections
MD5:

613939AC7D1C2450647E5BEF686CD8C5

SHA1:

C86C74266C0E769377718E2B9D7A0CC5A3F1B0BF

SHA256:

6079D2EB70643620D26F4BB73B6F57E8BC254052A4F1849074D9AB38B1127435

SSDEEP:

98304:9wop8aOzjJHqUAg6VxRdw3htKHSw+YSv7QySast3ai476YlOhnK6jjwJwFeeQP9i:zUi

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • LUMMA mutex has been found

      • random.exe (PID: 7264)
      • MSBuild.exe (PID: 5352)

    • Steals credentials from Web Browsers

      • random.exe (PID: 7264)
      • MSBuild.exe (PID: 5352)

    • LUMMA has been detected (SURICATA)

      • random.exe (PID: 7264)
      • svchost.exe (PID: 2196)

    • Connects to the CnC server

      • svchost.exe (PID: 2196)
      • saved.exe (PID: 8096)

    • LUMMA has been detected (YARA)

      • random.exe (PID: 7264)
      • MSBuild.exe (PID: 5352)

    • Actions looks like stealing of personal data

      • random.exe (PID: 7264)
      • MSBuild.exe (PID: 5352)

    • AMADEY has been detected (SURICATA)

      • saved.exe (PID: 8096)

    • AMADEY has been detected (YARA)

      • saved.exe (PID: 8096)

    • Executing a file with an untrusted certificate

      • core.exe (PID: 1052)

    • PHISHING has been detected (SURICATA)

      • svchost.exe (PID: 2196)

    • GENERIC has been found (auto)

      • 1dddb3ac21.exe (PID: 4892)
      • svchost015.exe (PID: 7804)

    • GCLEANER has been detected (SURICATA)

      • svchost015.exe (PID: 7804)

  • SUSPICIOUS

    • Reads the BIOS version

      • random.exe (PID: 7264)
      • 1dddb3ac21.exe (PID: 4892)

    • Searches for installed software

      • random.exe (PID: 7264)
      • MSBuild.exe (PID: 5352)

    • Contacting a server suspected of hosting an CnC

      • random.exe (PID: 7264)
      • svchost.exe (PID: 2196)
      • saved.exe (PID: 8096)

    • Multiple wallet extension IDs have been found

      • random.exe (PID: 7264)

    • Potential Corporate Privacy Violation

      • random.exe (PID: 7264)
      • saved.exe (PID: 8096)
      • svchost015.exe (PID: 7804)

    • Executable content was dropped or overwritten

      • random.exe (PID: 7264)
      • TMR8BI8BXPP5B75RSYEJSXBGDO.exe (PID: 8020)
      • saved.exe (PID: 8096)
      • 374ac2e04b.exe (PID: 5680)
      • 374ac2e04b.tmp (PID: 5008)
      • 1dddb3ac21.exe (PID: 4892)
      • svchost015.exe (PID: 7804)

    • Connects to the server without a host name

      • random.exe (PID: 7264)
      • saved.exe (PID: 8096)
      • svchost015.exe (PID: 7804)

    • Process requests binary or script from the Internet

      • random.exe (PID: 7264)
      • saved.exe (PID: 8096)

    • Starts itself from another location

      • TMR8BI8BXPP5B75RSYEJSXBGDO.exe (PID: 8020)

    • Reads security settings of Internet Explorer

      • saved.exe (PID: 8096)
      • TMR8BI8BXPP5B75RSYEJSXBGDO.exe (PID: 8020)
      • 374ac2e04b.tmp (PID: 5008)
      • svchost015.exe (PID: 7804)

    • Starts a Microsoft application from unusual location

      • 6cc4d409e5.exe (PID: 8172)

    • Process drops legitimate windows executable

      • saved.exe (PID: 8096)

    • There is functionality for taking screenshot (YARA)

      • saved.exe (PID: 8096)
      • MSBuild.exe (PID: 5352)

    • There is functionality for enable RDP (YARA)

      • saved.exe (PID: 8096)

    • Process communicates with Telegram (possibly using it as an attacker's C2 server)

      • MSBuild.exe (PID: 5352)

    • Reads the Windows owner or organization settings

      • 374ac2e04b.tmp (PID: 5008)

    • The process executes via Task Scheduler

      • saved.exe (PID: 5244)
      • saved.exe (PID: 1512)

    • PUTTY has been detected

      • putty.exe (PID: 1228)

  • INFO

    • Checks supported languages

      • random.exe (PID: 7264)
      • TMR8BI8BXPP5B75RSYEJSXBGDO.exe (PID: 8020)
      • saved.exe (PID: 8096)
      • 6cc4d409e5.exe (PID: 8172)
      • MSBuild.exe (PID: 5352)
      • saved.exe (PID: 5244)
      • 374ac2e04b.exe (PID: 5680)
      • 374ac2e04b.tmp (PID: 5008)
      • 1dddb3ac21.exe (PID: 4892)
      • info.exe (PID: 3240)
      • putty.exe (PID: 1228)
      • core.exe (PID: 1052)
      • svchost015.exe (PID: 7804)
      • saved.exe (PID: 1512)

    • Reads the computer name

      • random.exe (PID: 7264)
      • TMR8BI8BXPP5B75RSYEJSXBGDO.exe (PID: 8020)
      • saved.exe (PID: 8096)
      • MSBuild.exe (PID: 5352)
      • 374ac2e04b.tmp (PID: 5008)
      • putty.exe (PID: 1228)
      • info.exe (PID: 3240)
      • core.exe (PID: 1052)
      • 1dddb3ac21.exe (PID: 4892)
      • svchost015.exe (PID: 7804)

    • Reads the software policy settings

      • random.exe (PID: 7264)
      • MSBuild.exe (PID: 5352)
      • core.exe (PID: 1052)
      • slui.exe (PID: 7596)
      • svchost015.exe (PID: 7804)

    • Themida protector has been detected

      • random.exe (PID: 7264)
      • 1dddb3ac21.exe (PID: 4892)

    • Create files in a temporary directory

      • random.exe (PID: 7264)
      • TMR8BI8BXPP5B75RSYEJSXBGDO.exe (PID: 8020)
      • saved.exe (PID: 8096)
      • 374ac2e04b.exe (PID: 5680)
      • 374ac2e04b.tmp (PID: 5008)
      • 1dddb3ac21.exe (PID: 4892)
      • svchost015.exe (PID: 7804)

    • Process checks computer location settings

      • TMR8BI8BXPP5B75RSYEJSXBGDO.exe (PID: 8020)
      • saved.exe (PID: 8096)
      • 374ac2e04b.tmp (PID: 5008)

    • Checks proxy server information

      • saved.exe (PID: 8096)
      • svchost015.exe (PID: 7804)

    • Creates files or folders in the user directory

      • saved.exe (PID: 8096)
      • 374ac2e04b.tmp (PID: 5008)
      • svchost015.exe (PID: 7804)

    • The sample compiled with english language support

      • saved.exe (PID: 8096)
      • 374ac2e04b.tmp (PID: 5008)
      • 1dddb3ac21.exe (PID: 4892)

    • Attempting to use instant messaging service

      • MSBuild.exe (PID: 5352)

    • Detects InnoSetup installer (YARA)

      • 374ac2e04b.exe (PID: 5680)
      • 374ac2e04b.tmp (PID: 5008)

    • Compiled with Borland Delphi (YARA)

      • 374ac2e04b.tmp (PID: 5008)
      • 374ac2e04b.exe (PID: 5680)
      • 1dddb3ac21.exe (PID: 4892)

    • Creates a software uninstall entry

      • 374ac2e04b.tmp (PID: 5008)

    • Reads the machine GUID from the registry

      • svchost015.exe (PID: 7804)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Lumma

(PID) Process(7264) random.exe
C2 (9)woodpeckersd.run/glsk
climatologfy.top/kbud
tropiscbs.live/iuwxx
topographky.top/xlak
biosphxere.digital/tqoa
clarmodq.top/qoxo
cartograhphy.top/ixau
geographys.run/eirq
vigorbridgoe.top/banb
(PID) Process(5352) MSBuild.exe
C2 (10)woodpeckersd.run/glsk
vigorbridgoe.top/banb
climatologfy.top/kbud
https://t.me/cob1488
topographky.top/xlak
techwaveg.run/oipz
biosphxere.digital/tqoa
cartograhphy.top/ixau
geographys.run/eirq
tropiscbs.live/iuwxx

Amadey

(PID) Process(8096) saved.exe
C2185.39.17.163
URLhttp://185.39.17.163/Su8kud7i/index.php
Version5.34
Options
Drop directoryc13dbdc4fa
Drop namesaved.exe
Strings (125)S-%lu-
og:
clip.dll
ProgramData\
shell32.dll
<c>
vs:
Programs
&&
VideoID
ESET
av:
\App
0000043f
Doctor Web
:::
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
------
rundll32.exe
00000422
185.39.17.163
0123456789
st=s
00000419
Content-Type: application/x-www-form-urlencoded
/Plugins/
msi
ar:
GetNativeSystemInfo
Norton
-%lu
Sophos
zip
SOFTWARE\Microsoft\Windows NT\CurrentVersion
" Content-Type: application/octet-stream
|
+++
" && ren
pc:
#
d1
cmd /C RMDIR /s/q
Bitdefender
Comodo
<d>
Kaspersky Lab
DefaultSettings.YResolution
Main
c13dbdc4fa
-executionpolicy remotesigned -File "
&& Exit"
ProductName
&unit=
2022
Panda Security
=
Rem
cmd
\0000
id:
sd:
--
/quiet
rundll32
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
%-lu
random
GET
"taskkill /f /im "
Content-Disposition: form-data; name="data"; filename="
00000423
5.34
2016
?scr=1
ComputerName
Keyboard Layout\Preload
Powershell.exe
POST
http://
AVAST Software
SYSTEM\CurrentControlSet\Control\UnitedVideo\CONTROL\VIDEO\
ps1
DefaultSettings.XResolution
Startup
CurrentBuild
e3
cred.dll|clip.dll|
------
WinDefender
wb
https://
Avira
2025
" && timeout 1 && del
cred.dll
un:
SYSTEM\ControlSet001\Services\BasicDisplay\Video
rb
SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName
360TotalSecurity
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
saved.exe
e1
lv:
/Su8kud7i/index.php
shutdown -s -t 0
/k
e2
SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
exe
%USERPROFILE%
-unicode-
r=
.jpg
dll
Content-Type: multipart/form-data; boundary=----
2019
bi:
\
"
kernel32.dll
os:
abcdefghijklmnopqrstuvwxyz0123456789-_
dm:
AVG
No Malware configuration.

TRiD

.exe | Generic Win/DOS Executable (50)
.exe | DOS Executable Generic (49.9)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2025:04:26 14:47:23+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14
CodeSize: 312320
InitializedDataSize: 38400
UninitializedDataSize: -
EntryPoint: 0x484000
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
151
Monitored processes
19
Malicious processes
9
Suspicious processes
2

Behavior graph

Click at the process to see the details
start #LUMMA random.exe #LUMMA svchost.exe sppextcomobj.exe no specs slui.exe tmr8bi8bxpp5b75rsyejsxbgdo.exe #AMADEY saved.exe 6cc4d409e5.exe no specs #LUMMA msbuild.exe saved.exe no specs 374ac2e04b.exe 374ac2e04b.tmp #GENERIC 1dddb3ac21.exe THREAT putty.exe no specs core.exe info.exe conhost.exe no specs slui.exe no specs #GCLEANER svchost015.exe saved.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1052"C:\Users\admin\AppData\Roaming\MyApp\core.exe"C:\Users\admin\AppData\Roaming\MyApp\core.exe
374ac2e04b.tmp
User:
admin
Company:
EC Software GmbH
Integrity Level:
MEDIUM
Description:
eViewer for Windows
Exit code:
0
Version:
2.5.0.0
Modules
Images
c:\users\admin\appdata\roaming\myapp\core.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\comdlg32.dll
1228"C:\Users\admin\AppData\Roaming\MyApp\data\putty.exe" C:\Users\admin\AppData\Roaming\MyApp\data\putty.exe
374ac2e04b.tmp
User:
admin
Company:
Simon Tatham
Integrity Level:
MEDIUM
Description:
SSH, Telnet, Rlogin, and SUPDUP client
Version:
Release 0.83 (with embedded help)
Modules
Images
c:\users\admin\appdata\roaming\myapp\data\putty.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
1324\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—info.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1512"C:\Users\admin\AppData\Local\Temp\c13dbdc4fa\saved.exe"C:\Users\admin\AppData\Local\Temp\c13dbdc4fa\saved.exe—svchost.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\c13dbdc4fa\saved.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\user32.dll
c:\windows\syswow64\win32u.dll
2196C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
3240"C:\Users\admin\AppData\Roaming\MyApp\info.exe"C:\Users\admin\AppData\Roaming\MyApp\info.exe
374ac2e04b.tmp
User:
admin
Integrity Level:
MEDIUM
Exit code:
2
Modules
Images
c:\users\admin\appdata\roaming\myapp\info.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\powrprof.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\umpdc.dll
4892"C:\Users\admin\AppData\Local\Temp\10036910101\1dddb3ac21.exe" C:\Users\admin\AppData\Local\Temp\10036910101\1dddb3ac21.exe
saved.exe
User:
admin
Company:
Greenshot
Integrity Level:
MEDIUM
Description:
Greenshot
Exit code:
0
Version:
1.2.9.129
Modules
Images
c:\users\admin\appdata\local\temp\10036910101\1dddb3ac21.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
5008"C:\Users\admin\AppData\Local\Temp\is-K2U43.tmp\374ac2e04b.tmp" /SL5="$F02B4,42108046,844800,C:\Users\admin\AppData\Local\Temp\10036900101\374ac2e04b.exe" C:\Users\admin\AppData\Local\Temp\is-K2U43.tmp\374ac2e04b.tmp
374ac2e04b.exe
User:
admin
Company:
Integrity Level:
MEDIUM
Description:
Setup/Uninstall
Exit code:
0
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-k2u43.tmp\374ac2e04b.tmp
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\comdlg32.dll
5244"C:\Users\admin\AppData\Local\Temp\c13dbdc4fa\saved.exe"C:\Users\admin\AppData\Local\Temp\c13dbdc4fa\saved.exe—svchost.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\c13dbdc4fa\saved.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\user32.dll
c:\windows\syswow64\win32u.dll
5352"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
6cc4d409e5.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
MSBuild.exe
Exit code:
0
Version:
4.8.9037.0 built by: NET481REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\msbuild.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shell32.dll
Lumma
(PID) Process(5352) MSBuild.exe
C2 (10)woodpeckersd.run/glsk
vigorbridgoe.top/banb
climatologfy.top/kbud
https://t.me/cob1488
topographky.top/xlak
techwaveg.run/oipz
biosphxere.digital/tqoa
cartograhphy.top/ixau
geographys.run/eirq
tropiscbs.live/iuwxx
Total events
4 762
Read events
4 736
Write events
26
Delete events
0

Modification events

(PID) Process:(8096) saved.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(8096) saved.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(8096) saved.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(5008) 374ac2e04b.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MyApp_is1
Operation:writeName:Inno Setup: Setup Version
Value:
6.4.0
(PID) Process:(5008) 374ac2e04b.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MyApp_is1
Operation:writeName:Inno Setup: App Path
Value:
C:\Users\admin\AppData\Roaming\MyApp
(PID) Process:(5008) 374ac2e04b.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MyApp_is1
Operation:writeName:InstallLocation
Value:
C:\Users\admin\AppData\Roaming\MyApp\
(PID) Process:(5008) 374ac2e04b.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MyApp_is1
Operation:writeName:Inno Setup: Icon Group
Value:
MyApp
(PID) Process:(5008) 374ac2e04b.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MyApp_is1
Operation:writeName:Inno Setup: User
Value:
admin
(PID) Process:(5008) 374ac2e04b.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MyApp_is1
Operation:writeName:Inno Setup: Language
Value:
default
(PID) Process:(5008) 374ac2e04b.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MyApp_is1
Operation:writeName:DisplayName
Value:
MyApp version 1.0
Executable files
19
Suspicious files
12
Text files
2
Unknown types
0

Dropped files

PID
Process
Filename
Type
8096saved.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\KCV3KQBA\random[1].exe —
MD5:—
SHA256:—
8096saved.exeC:\Users\admin\AppData\Local\Temp\10036900101\374ac2e04b.exe —
MD5:—
SHA256:—
5008374ac2e04b.tmpC:\Users\admin\AppData\Roaming\MyApp\is-6ALE7.tmp —
MD5:—
SHA256:—
5008374ac2e04b.tmpC:\Users\admin\AppData\Roaming\MyApp\core.exe —
MD5:—
SHA256:—
7264random.exeC:\Users\admin\AppData\Local\Temp\TMR8BI8BXPP5B75RSYEJSXBGDO.exeexecutable
MD5:F6C20A18AFEAC04964A6CCAD6BE59731
SHA256:CE75F9DEDE6D4E93549D35B816898113B6BEFAB9EF0AADF8949D4887C2C34BEA
5680374ac2e04b.exeC:\Users\admin\AppData\Local\Temp\is-K2U43.tmp\374ac2e04b.tmpexecutable
MD5:E4C43138CCB8240276872FD1AEC369BE
SHA256:46BE5E3F28A5E4ED63D66B901D927C25944B4DA36EFFEA9C97FB05994360EDF5
8096saved.exeC:\Users\admin\AppData\Local\Temp\10036890101\6cc4d409e5.exeexecutable
MD5:3866CEA2B577ECA8451679A6175D270B
SHA256:27428A2B8E8FB847EC370B70E3B527CB75BE2524776207B1F7C9A9B994075457
5008374ac2e04b.tmpC:\Users\admin\AppData\Roaming\MyApp\is-GJGLR.tmpexecutable
MD5:4134EC81A9D645602B1FA265F98FBF35
SHA256:69966257CE41717F2121EA1F03F8BFA1486423ACECFCC977DD9F1E157C911AD4
8096saved.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\RR3E01RZ\random[1].exeexecutable
MD5:3866CEA2B577ECA8451679A6175D270B
SHA256:27428A2B8E8FB847EC370B70E3B527CB75BE2524776207B1F7C9A9B994075457
5008374ac2e04b.tmpC:\Users\admin\AppData\Roaming\MyApp\unins000.exeexecutable
MD5:4134EC81A9D645602B1FA265F98FBF35
SHA256:69966257CE41717F2121EA1F03F8BFA1486423ACECFCC977DD9F1E157C911AD4
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
35
TCP/UDP connections
45
DNS requests
34
Threats
65

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
62.115.253.40:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
184.85.144.229:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
184.85.144.229:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
2104
svchost.exe
GET
200
184.85.144.229:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
23.63.118.230:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
7264
random.exe
GET
200
185.39.17.162:80
http://185.39.17.162/mine/random.exe
unknown
—
—
malicious
8096
saved.exe
POST
200
185.39.17.163:80
http://185.39.17.163/Su8kud7i/index.php
unknown
—
—
malicious
8096
saved.exe
POST
200
185.39.17.163:80
http://185.39.17.163/Su8kud7i/index.php
unknown
—
—
malicious
8096
saved.exe
GET
200
185.39.17.162:80
http://185.39.17.162/files/fate/random.exe
unknown
—
—
malicious
8096
saved.exe
GET
200
185.39.17.162:80
http://185.39.17.162/files/unique1/random.exe
unknown
—
—
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
192.168.100.255:137
—
—
—
whitelisted
—
—
62.115.253.40:80
crl.microsoft.com
Telia Company AB
ES
whitelisted
—
—
184.85.144.229:80
www.microsoft.com
AKAMAI-AS
FI
whitelisted
5496
MoUsoCoreWorker.exe
184.85.144.229:80
www.microsoft.com
AKAMAI-AS
FI
whitelisted
2104
svchost.exe
184.85.144.229:80
www.microsoft.com
AKAMAI-AS
FI
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
7264
random.exe
104.21.85.126:443
clarmodq.top
CLOUDFLARENET
—
malicious
3216
svchost.exe
172.211.123.250:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 51.104.136.2
  • 20.73.194.208
whitelisted
crl.microsoft.com
  • 62.115.253.40
  • 62.115.253.10
whitelisted
google.com
  • 142.250.186.174
whitelisted
www.microsoft.com
  • 184.85.144.229
whitelisted
clarmodq.top
  • 104.21.85.126
  • 172.67.205.184
malicious
client.wns.windows.com
  • 172.211.123.250
whitelisted
login.live.com
  • 20.190.160.5
  • 20.190.160.14
  • 40.126.32.133
  • 20.190.160.132
  • 20.190.160.2
  • 20.190.160.130
  • 40.126.32.136
  • 20.190.160.17
whitelisted
ocsp.digicert.com
  • 23.63.118.230
whitelisted
t.me
  • 149.154.167.99
whitelisted
techwaveg.run
  • 188.114.96.3
  • 188.114.97.3
unknown

Threats

PID
Process
Class
Message
2196
svchost.exe
A Network Trojan was detected
MALWARE [ANY.RUN] Suspected Domain Associated with Malware Distribution (clarmodq .top)
2196
svchost.exe
Potentially Bad Traffic
ET DNS Query to a *.top domain - Likely Hostile
2196
svchost.exe
Domain Observed Used for C2 Detected
ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (clarmodq .top)
7264
random.exe
Domain Observed Used for C2 Detected
ET MALWARE Observed Win32/Lumma Stealer Related Domain (clarmodq .top in TLS SNI)
7264
random.exe
Domain Observed Used for C2 Detected
ET MALWARE Observed Win32/Lumma Stealer Related Domain (clarmodq .top in TLS SNI)
7264
random.exe
Domain Observed Used for C2 Detected
ET MALWARE Observed Win32/Lumma Stealer Related Domain (clarmodq .top in TLS SNI)
7264
random.exe
Domain Observed Used for C2 Detected
ET MALWARE Observed Win32/Lumma Stealer Related Domain (clarmodq .top in TLS SNI)
7264
random.exe
Domain Observed Used for C2 Detected
ET MALWARE Observed Win32/Lumma Stealer Related Domain (clarmodq .top in TLS SNI)
7264
random.exe
Domain Observed Used for C2 Detected
ET MALWARE Observed Win32/Lumma Stealer Related Domain (clarmodq .top in TLS SNI)
7264
random.exe
Potentially Bad Traffic
ET INFO Executable Download from dotted-quad Host
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
random.exe