File name:

6cbbc0f1be8e61da11cec2e930d8e0a9.exe

Full analysis: https://app.any.run/tasks/0cdbc055-ab7b-4795-8cef-da96fdc8cbb6
Verdict: Malicious activity
Threats:

Amadey is a formidable Windows infostealer threat, characterized by its persistence mechanisms, modular design, and ability to execute various malicious tasks.

Malware Trends Tracker     >>>
Analysis date: April 29, 2025, 05:54:46
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
lumma
stealer
loader
themida
amadey
botnet
auto
auto-reg
telegram
credentialflusher
auto-sch
putty
rmm-tool
phishing
rdp
upatre
evasion
generic
gcleaner
pastebin
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 7 sections
MD5:

6CBBC0F1BE8E61DA11CEC2E930D8E0A9

SHA1:

89A6ABF9D1CFAB1FA39FB8C65A124E39A24DB1AE

SHA256:

90EDEE3419127E0724CB8B9EA5FEF8466FAC1D29AF4D32B182E0068E2570EAAA

SSDEEP:

98304:U0IvQc2IEi0OcoTxtN2IRYN3WqJMTAFuEGLrXNTR0K2uQTkClpH7ESsJGgWQc/fR:22c

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • LUMMA mutex has been found

      • 6cbbc0f1be8e61da11cec2e930d8e0a9.exe (PID: 6048)
      • 5511ade474.exe (PID: 3304)
      • 5511ade474.exe (PID: 2092)
      • MSBuild.exe (PID: 5352)
      • MSBuild.exe (PID: 4528)
      • MSBuild.exe (PID: 872)

    • Actions looks like stealing of personal data

      • 6cbbc0f1be8e61da11cec2e930d8e0a9.exe (PID: 6048)
      • 5511ade474.exe (PID: 3304)
      • 5511ade474.exe (PID: 2092)
      • MSBuild.exe (PID: 5352)
      • MSBuild.exe (PID: 4528)
      • MSBuild.exe (PID: 872)

    • LUMMA has been detected (YARA)

      • 6cbbc0f1be8e61da11cec2e930d8e0a9.exe (PID: 6048)

    • LUMMA has been detected (SURICATA)

      • svchost.exe (PID: 2196)
      • MSBuild.exe (PID: 5352)
      • MSBuild.exe (PID: 6760)
      • MSBuild.exe (PID: 496)
      • zb7jDew.exe (PID: 9124)

    • Connects to the CnC server

      • svchost.exe (PID: 2196)
      • saved.exe (PID: 2148)
      • laren.exe (PID: 6068)

    • AMADEY has been found (auto)

      • 6cbbc0f1be8e61da11cec2e930d8e0a9.exe (PID: 6048)
      • VOWFGO964SM4LIK16O5FG.exe (PID: 6424)
      • 5511ade474.exe (PID: 3304)
      • 5511ade474.exe (PID: 2092)
      • powershell.exe (PID: 3156)
      • powershell.exe (PID: 7504)

    • AMADEY has been detected (SURICATA)

      • saved.exe (PID: 2148)
      • laren.exe (PID: 6068)

    • AMADEY mutex has been found

      • amnew.exe (PID: 4120)
      • laren.exe (PID: 6068)

    • AMADEY has been detected (YARA)

      • saved.exe (PID: 2148)
      • laren.exe (PID: 6068)

    • Changes the autorun value in the registry

      • saved.exe (PID: 2148)

    • Changes the login/logoff helper path in the registry

      • reg.exe (PID: 4120)

    • Possible tool for stealing has been detected

      • de2bc57ed4.exe (PID: 2088)
      • firefox.exe (PID: 3396)
      • de2bc57ed4.exe (PID: 6708)
      • firefox.exe (PID: 3968)
      • firefox.exe (PID: 7688)

    • Uses Task Scheduler to run other applications

      • cmd.exe (PID: 6816)
      • cmd.exe (PID: 616)

    • Run PowerShell with an invisible window

      • powershell.exe (PID: 3156)
      • powershell.exe (PID: 2416)
      • powershell.exe (PID: 7504)
      • powershell.exe (PID: 7896)
      • powershell.exe (PID: 6488)
      • powershell.exe (PID: 4980)
      • powershell.exe (PID: 8300)

    • Request from PowerShell that ran from MSHTA.EXE

      • powershell.exe (PID: 7504)

    • Executing a file with an untrusted certificate

      • WireGuard.exe (PID: 7396)
      • WireGuard.exe (PID: 7840)
      • WireGuard.exe (PID: 5044)
      • core.exe (PID: 7144)

    • PHISHING has been detected (SURICATA)

      • svchost.exe (PID: 2196)

    • Changes powershell execution policy (Bypass)

      • cmd.exe (PID: 2152)
      • powershell.exe (PID: 4980)
      • core.exe (PID: 7144)

    • Bypass execution policy to execute commands

      • powershell.exe (PID: 6488)
      • powershell.exe (PID: 7684)
      • powershell.exe (PID: 4980)
      • powershell.exe (PID: 8300)
      • powershell.exe (PID: 4560)

    • Stealers network behavior

      • svchost.exe (PID: 2196)

    • UPATRE has been detected (SURICATA)

      • svchost.exe (PID: 3828)
      • svchost.exe (PID: 8624)

    • GCLEANER has been detected (SURICATA)

      • svchost015.exe (PID: 8488)
      • svchost015.exe (PID: 8808)

    • STEALER has been found (auto)

      • saved.exe (PID: 2148)

    • GENERIC has been found (auto)

      • 595031cb1c.exe (PID: 8096)

  • SUSPICIOUS

    • Reads the BIOS version

      • 6cbbc0f1be8e61da11cec2e930d8e0a9.exe (PID: 6048)
      • 5511ade474.exe (PID: 3304)
      • 5511ade474.exe (PID: 2092)

    • Searches for installed software

      • 6cbbc0f1be8e61da11cec2e930d8e0a9.exe (PID: 6048)
      • 5511ade474.exe (PID: 3304)
      • 5511ade474.exe (PID: 2092)
      • MSBuild.exe (PID: 5352)
      • MSBuild.exe (PID: 4528)

    • Contacting a server suspected of hosting an CnC

      • svchost.exe (PID: 2196)
      • saved.exe (PID: 2148)
      • laren.exe (PID: 6068)
      • MSBuild.exe (PID: 5352)
      • MSBuild.exe (PID: 6760)
      • MSBuild.exe (PID: 496)
      • zb7jDew.exe (PID: 9124)

    • Executable content was dropped or overwritten

      • 6cbbc0f1be8e61da11cec2e930d8e0a9.exe (PID: 6048)
      • VOWFGO964SM4LIK16O5FG.exe (PID: 6424)
      • saved.exe (PID: 2148)
      • amnew.exe (PID: 4120)
      • laren.exe (PID: 6068)
      • 5511ade474.exe (PID: 3304)
      • 5511ade474.exe (PID: 2092)
      • powershell.exe (PID: 3156)
      • powershell.exe (PID: 7504)
      • cmd.exe (PID: 5384)
      • WireGuard.exe (PID: 8180)
      • 62ece15dc5.exe (PID: 7760)
      • 62ece15dc5.tmp (PID: 2268)
      • 595031cb1c.exe (PID: 8096)
      • svchost015.exe (PID: 8488)
      • FskyITkMbcq.exe (PID: 8580)
      • FskyITkMbcq.tmp (PID: 5204)
      • svchost015.exe (PID: 8808)
      • filelistcreatorassist15.exe (PID: 9276)

    • Process requests binary or script from the Internet

      • 6cbbc0f1be8e61da11cec2e930d8e0a9.exe (PID: 6048)
      • saved.exe (PID: 2148)
      • 5511ade474.exe (PID: 3304)
      • 5511ade474.exe (PID: 2092)
      • powershell.exe (PID: 7504)
      • powershell.exe (PID: 3156)
      • laren.exe (PID: 6068)

    • Potential Corporate Privacy Violation

      • 6cbbc0f1be8e61da11cec2e930d8e0a9.exe (PID: 6048)
      • saved.exe (PID: 2148)
      • 5511ade474.exe (PID: 3304)
      • 5511ade474.exe (PID: 2092)
      • powershell.exe (PID: 7504)
      • laren.exe (PID: 6068)
      • svchost015.exe (PID: 8488)

    • Connects to the server without a host name

      • 6cbbc0f1be8e61da11cec2e930d8e0a9.exe (PID: 6048)
      • saved.exe (PID: 2148)
      • laren.exe (PID: 6068)
      • 5511ade474.exe (PID: 3304)
      • 5511ade474.exe (PID: 2092)
      • powershell.exe (PID: 7504)
      • powershell.exe (PID: 3156)
      • svchost015.exe (PID: 8488)
      • svchost015.exe (PID: 8808)

    • Reads security settings of Internet Explorer

      • VOWFGO964SM4LIK16O5FG.exe (PID: 6424)
      • saved.exe (PID: 2148)
      • amnew.exe (PID: 4120)
      • laren.exe (PID: 6068)

    • Starts itself from another location

      • VOWFGO964SM4LIK16O5FG.exe (PID: 6424)
      • amnew.exe (PID: 4120)

    • Starts CMD.EXE for commands execution

      • JSEVGJV.exe (PID: 536)
      • b938f7a239.exe (PID: 2236)
      • b938f7a239.exe (PID: 3024)
      • WireGuard.exe (PID: 8180)
      • WireGuard.exe (PID: 7396)
      • WireGuard.exe (PID: 5044)
      • WireGuard.exe (PID: 7840)
      • saved.exe (PID: 2148)
      • JSEVGJV.exe (PID: 8240)

    • Hides command output

      • cmd.exe (PID: 6724)
      • cmd.exe (PID: 5384)
      • cmd.exe (PID: 8888)

    • Runs PING.EXE to delay simulation

      • cmd.exe (PID: 6724)
      • cmd.exe (PID: 5384)
      • cmd.exe (PID: 8888)

    • There is functionality for enable RDP (YARA)

      • saved.exe (PID: 2148)
      • laren.exe (PID: 6068)

    • There is functionality for taking screenshot (YARA)

      • saved.exe (PID: 2148)
      • laren.exe (PID: 6068)

    • Process drops legitimate windows executable

      • laren.exe (PID: 6068)
      • saved.exe (PID: 2148)
      • FskyITkMbcq.tmp (PID: 5204)

    • Starts a Microsoft application from unusual location

      • Alex1234.exe (PID: 4300)
      • Cron1.exe (PID: 1388)
      • Cron2.exe (PID: 3024)
      • 45c51f175f.exe (PID: 7632)
      • 47Q6wZM.exe (PID: 2268)
      • VisualCode.exe (PID: 8756)

    • Uses REG/REGEDIT.EXE to modify registry

      • cmd.exe (PID: 6724)

    • Process communicates with Telegram (possibly using it as an attacker's C2 server)

      • MSBuild.exe (PID: 5352)
      • MSBuild.exe (PID: 6760)
      • powershell.exe (PID: 6488)
      • MSBuild.exe (PID: 8880)

    • Uses TASKKILL.EXE to kill Browsers

      • de2bc57ed4.exe (PID: 2088)
      • de2bc57ed4.exe (PID: 6708)

    • Uses TASKKILL.EXE to kill process

      • de2bc57ed4.exe (PID: 2088)
      • de2bc57ed4.exe (PID: 6708)

    • Starts process via Powershell

      • powershell.exe (PID: 3156)
      • powershell.exe (PID: 2416)
      • powershell.exe (PID: 7504)
      • powershell.exe (PID: 7896)
      • powershell.exe (PID: 4980)

    • Found IP address in command line

      • powershell.exe (PID: 3156)
      • powershell.exe (PID: 2416)
      • powershell.exe (PID: 7504)
      • powershell.exe (PID: 7896)

    • Manipulates environment variables

      • powershell.exe (PID: 3156)
      • powershell.exe (PID: 2416)
      • powershell.exe (PID: 7504)
      • powershell.exe (PID: 7896)
      • powershell.exe (PID: 6488)

    • Probably download files using WebClient

      • mshta.exe (PID: 680)
      • mshta.exe (PID: 6760)
      • mshta.exe (PID: 6676)
      • mshta.exe (PID: 7788)

    • Starts POWERSHELL.EXE for commands execution

      • mshta.exe (PID: 680)
      • mshta.exe (PID: 6760)
      • mshta.exe (PID: 6676)
      • mshta.exe (PID: 7788)
      • cmd.exe (PID: 2152)
      • powershell.exe (PID: 4980)
      • core.exe (PID: 7144)
      • filelistcreatorassist15.exe (PID: 9276)

    • Uses WMIC.EXE to obtain BIOS management information

      • cmd.exe (PID: 732)
      • cmd.exe (PID: 2100)
      • cmd.exe (PID: 5600)
      • cmd.exe (PID: 7284)

    • Uses WMIC.EXE to obtain physical disk drive information

      • cmd.exe (PID: 7456)
      • cmd.exe (PID: 7544)
      • cmd.exe (PID: 4812)
      • cmd.exe (PID: 720)

    • Uses WMIC.EXE to obtain CPU information

      • cmd.exe (PID: 4528)
      • cmd.exe (PID: 7852)
      • cmd.exe (PID: 4756)
      • cmd.exe (PID: 4728)

    • Application launched itself

      • WireGuard.exe (PID: 8180)
      • powershell.exe (PID: 4980)

    • The process executes via Task Scheduler

      • laren.exe (PID: 5164)
      • saved.exe (PID: 7476)
      • laren.exe (PID: 5172)
      • saved.exe (PID: 9784)

    • PUTTY has been detected

      • putty.exe (PID: 3020)

    • Executing commands from ".cmd" file

      • saved.exe (PID: 2148)

    • The process checks if current user has admin rights

      • cmd.exe (PID: 2152)

    • The process executes Powershell scripts

      • cmd.exe (PID: 2152)
      • powershell.exe (PID: 4980)

    • Uses ATTRIB.EXE to modify file attributes

      • cmd.exe (PID: 2152)

    • Uses TIMEOUT.EXE to delay execution

      • cmd.exe (PID: 2152)

    • Executes application which crashes

      • 5bf43363e1.exe (PID: 236)

    • Connects to unusual port

      • svchost.exe (PID: 3828)
      • svchost.exe (PID: 8624)

    • Checks for external IP

      • powershell.exe (PID: 8300)
      • svchost.exe (PID: 2196)

    • The process drops C-runtime libraries

      • FskyITkMbcq.tmp (PID: 5204)

  • INFO

    • Checks supported languages

      • 6cbbc0f1be8e61da11cec2e930d8e0a9.exe (PID: 6048)
      • VOWFGO964SM4LIK16O5FG.exe (PID: 6424)
      • saved.exe (PID: 2148)
      • JSEVGJV.exe (PID: 536)
      • amnew.exe (PID: 4120)
      • laren.exe (PID: 6068)
      • 5511ade474.exe (PID: 3304)
      • Alex1234.exe (PID: 4300)
      • 5511ade474.exe (PID: 2092)
      • MSBuild.exe (PID: 5352)
      • Cron1.exe (PID: 1388)
      • T6ZW7OQL5SIDMPNRPM.exe (PID: 2152)
      • de2bc57ed4.exe (PID: 2088)
      • MSBuild.exe (PID: 4528)
      • HZU3NS1S9ZFTPR5M8ODZBVPMGIYB1K.exe (PID: 6752)
      • Cron2.exe (PID: 3024)
      • de2bc57ed4.exe (PID: 6708)
      • b938f7a239.exe (PID: 2236)
      • MSBuild.exe (PID: 872)
      • b938f7a239.exe (PID: 3024)
      • 45c51f175f.exe (PID: 7632)
      • WireGuard.exe (PID: 8180)

    • Reads the software policy settings

      • 6cbbc0f1be8e61da11cec2e930d8e0a9.exe (PID: 6048)
      • 5511ade474.exe (PID: 3304)
      • laren.exe (PID: 6068)
      • 5511ade474.exe (PID: 2092)
      • MSBuild.exe (PID: 5352)
      • MSBuild.exe (PID: 4528)
      • MSBuild.exe (PID: 872)

    • Reads the computer name

      • 6cbbc0f1be8e61da11cec2e930d8e0a9.exe (PID: 6048)
      • VOWFGO964SM4LIK16O5FG.exe (PID: 6424)
      • saved.exe (PID: 2148)
      • JSEVGJV.exe (PID: 536)
      • amnew.exe (PID: 4120)
      • laren.exe (PID: 6068)
      • 5511ade474.exe (PID: 3304)
      • 5511ade474.exe (PID: 2092)
      • MSBuild.exe (PID: 5352)
      • de2bc57ed4.exe (PID: 2088)
      • MSBuild.exe (PID: 4528)
      • de2bc57ed4.exe (PID: 6708)
      • b938f7a239.exe (PID: 2236)
      • MSBuild.exe (PID: 872)
      • b938f7a239.exe (PID: 3024)

    • Themida protector has been detected

      • 6cbbc0f1be8e61da11cec2e930d8e0a9.exe (PID: 6048)

    • Create files in a temporary directory

      • 6cbbc0f1be8e61da11cec2e930d8e0a9.exe (PID: 6048)
      • VOWFGO964SM4LIK16O5FG.exe (PID: 6424)
      • saved.exe (PID: 2148)
      • amnew.exe (PID: 4120)
      • laren.exe (PID: 6068)
      • 5511ade474.exe (PID: 3304)
      • 5511ade474.exe (PID: 2092)
      • b938f7a239.exe (PID: 2236)
      • b938f7a239.exe (PID: 3024)

    • Process checks computer location settings

      • VOWFGO964SM4LIK16O5FG.exe (PID: 6424)
      • saved.exe (PID: 2148)
      • amnew.exe (PID: 4120)
      • laren.exe (PID: 6068)

    • Checks proxy server information

      • saved.exe (PID: 2148)
      • laren.exe (PID: 6068)

    • The sample compiled with english language support

      • saved.exe (PID: 2148)
      • laren.exe (PID: 6068)
      • cmd.exe (PID: 5384)
      • WireGuard.exe (PID: 8180)
      • 62ece15dc5.tmp (PID: 2268)
      • 595031cb1c.exe (PID: 8096)
      • FskyITkMbcq.tmp (PID: 5204)

    • Creates files or folders in the user directory

      • saved.exe (PID: 2148)
      • laren.exe (PID: 6068)

    • NirSoft software is detected

      • JSEVGJV.exe (PID: 536)
      • DNS.exe (PID: 6852)
      • JSEVGJV.exe (PID: 8240)

    • Reads the machine GUID from the registry

      • JSEVGJV.exe (PID: 536)
      • laren.exe (PID: 6068)

    • Auto-launch of the file from Registry key

      • saved.exe (PID: 2148)

    • Manual execution by a user

      • 5511ade474.exe (PID: 2092)
      • de2bc57ed4.exe (PID: 6708)
      • mshta.exe (PID: 6760)
      • b938f7a239.exe (PID: 3024)
      • mshta.exe (PID: 7788)
      • svchost.exe (PID: 3828)
      • svchost.exe (PID: 8624)

    • Reads mouse settings

      • de2bc57ed4.exe (PID: 2088)
      • de2bc57ed4.exe (PID: 6708)
      • b938f7a239.exe (PID: 2236)
      • b938f7a239.exe (PID: 3024)

    • Application launched itself

      • firefox.exe (PID: 3396)
      • firefox.exe (PID: 3968)
      • firefox.exe (PID: 6436)
      • firefox.exe (PID: 7688)
      • firefox.exe (PID: 6252)
      • chrome.exe (PID: 9864)
      • chrome.exe (PID: 8272)
      • msedge.exe (PID: 8248)

    • Auto-launch of the file from Task Scheduler

      • cmd.exe (PID: 6816)
      • cmd.exe (PID: 616)

    • Reads Internet Explorer settings

      • mshta.exe (PID: 680)
      • mshta.exe (PID: 6760)
      • mshta.exe (PID: 6676)
      • mshta.exe (PID: 7788)

    • Drops encrypted JS script (Microsoft Script Encoder)

      • WireGuard.exe (PID: 8180)

    • The executable file from the user directory is run by the Powershell process

      • Temp6HMNGSQO8MHWKL6XCKKYW8EHVPFMIAEC.EXE (PID: 5156)
      • TempZAMMOGFF0ACQCO1GTJELYXLOXXH6KVZM.EXE (PID: 2908)
      • Temp6HMNGSQO8MHWKL6XCKKYW8EHVPFMIAEC.EXE (PID: 7704)
      • TempZAMMOGFF0ACQCO1GTJELYXLOXXH6KVZM.EXE (PID: 4740)

    • Creates files in the program directory

      • cmd.exe (PID: 5384)

    • Attempting to use instant messaging service

      • MSBuild.exe (PID: 6760)
      • powershell.exe (PID: 6488)

    • Changes the registry key values via Powershell

      • filelistcreatorassist15.exe (PID: 9276)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Lumma

(PID) Process(6048) 6cbbc0f1be8e61da11cec2e930d8e0a9.exe
C2 (9)parakehjet.run/kewk
buzzarddf.live/ktnt
zenithcorde.top/auid
bearjk.live/benj
techguidet.digital/apdo
techsyncq.run/riid
btcgeared.live/lbak
clarmodq.top/qoxo
fishgh.digital/tequ

Amadey

(PID) Process(2148) saved.exe
C2185.39.17.163
URLhttp://185.39.17.163/Su8kud7i/index.php
Version5.34
Options
Drop directoryc13dbdc4fa
Drop namesaved.exe
Strings (125)S-%lu-
og:
clip.dll
ProgramData\
shell32.dll
<c>
vs:
Programs
&&
VideoID
ESET
av:
\App
0000043f
Doctor Web
:::
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
------
rundll32.exe
00000422
185.39.17.163
0123456789
st=s
00000419
Content-Type: application/x-www-form-urlencoded
/Plugins/
msi
ar:
GetNativeSystemInfo
Norton
-%lu
Sophos
zip
SOFTWARE\Microsoft\Windows NT\CurrentVersion
" Content-Type: application/octet-stream
|
+++
" && ren
pc:
#
d1
cmd /C RMDIR /s/q
Bitdefender
Comodo
<d>
Kaspersky Lab
DefaultSettings.YResolution
Main
c13dbdc4fa
-executionpolicy remotesigned -File "
&& Exit"
ProductName
&unit=
2022
Panda Security
=
Rem
cmd
\0000
id:
sd:
--
/quiet
rundll32
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
%-lu
random
GET
"taskkill /f /im "
Content-Disposition: form-data; name="data"; filename="
00000423
5.34
2016
?scr=1
ComputerName
Keyboard Layout\Preload
Powershell.exe
POST
http://
AVAST Software
SYSTEM\CurrentControlSet\Control\UnitedVideo\CONTROL\VIDEO\
ps1
DefaultSettings.XResolution
Startup
CurrentBuild
e3
cred.dll|clip.dll|
------
WinDefender
wb
https://
Avira
2025
" && timeout 1 && del
cred.dll
un:
SYSTEM\ControlSet001\Services\BasicDisplay\Video
rb
SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName
360TotalSecurity
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
saved.exe
e1
lv:
/Su8kud7i/index.php
shutdown -s -t 0
/k
e2
SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
exe
%USERPROFILE%
-unicode-
r=
.jpg
dll
Content-Type: multipart/form-data; boundary=----
2019
bi:
\
"
kernel32.dll
os:
abcdefghijklmnopqrstuvwxyz0123456789-_
dm:
AVG
(PID) Process(6068) laren.exe
C2185.39.17.122
URLhttp://185.39.17.122/som9unr/index.php
Version5.34
Options
Drop directory6f7406a7fa
Drop namelaren.exe
Strings (125)S-%lu-
og:
clip.dll
ProgramData\
shell32.dll
<c>
vs:
Programs
&&
VideoID
ESET
av:
\App
0000043f
Doctor Web
:::
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
------
rundll32.exe
00000422
0123456789
st=s
00000419
Content-Type: application/x-www-form-urlencoded
/Plugins/
msi
ar:
GetNativeSystemInfo
Norton
-%lu
Sophos
zip
SOFTWARE\Microsoft\Windows NT\CurrentVersion
185.39.17.122
" Content-Type: application/octet-stream
|
+++
" && ren
pc:
#
d1
cmd /C RMDIR /s/q
Bitdefender
Comodo
<d>
Kaspersky Lab
DefaultSettings.YResolution
Main
-executionpolicy remotesigned -File "
&& Exit"
ProductName
&unit=
2022
Panda Security
=
Rem
cmd
\0000
id:
sd:
--
/quiet
rundll32
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
6f7406a7fa
%-lu
random
GET
"taskkill /f /im "
Content-Disposition: form-data; name="data"; filename="
00000423
5.34
/som9unr/index.php
2016
?scr=1
ComputerName
Keyboard Layout\Preload
Powershell.exe
POST
http://
AVAST Software
SYSTEM\CurrentControlSet\Control\UnitedVideo\CONTROL\VIDEO\
ps1
DefaultSettings.XResolution
Startup
CurrentBuild
e3
cred.dll|clip.dll|
------
WinDefender
wb
https://
Avira
2025
" && timeout 1 && del
cred.dll
un:
SYSTEM\ControlSet001\Services\BasicDisplay\Video
rb
SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName
360TotalSecurity
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
laren.exe
e1
lv:
shutdown -s -t 0
/k
e2
SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
exe
%USERPROFILE%
-unicode-
r=
.jpg
dll
Content-Type: multipart/form-data; boundary=----
2019
bi:
\
"
kernel32.dll
os:
abcdefghijklmnopqrstuvwxyz0123456789-_
dm:
AVG
No Malware configuration.

TRiD

.exe | Generic Win/DOS Executable (50)
.exe | DOS Executable Generic (49.9)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2025:04:26 14:47:23+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14
CodeSize: 312320
InitializedDataSize: 38400
UninitializedDataSize: -
EntryPoint: 0x49e000
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
373
Monitored processes
233
Malicious processes
43
Suspicious processes
13

Behavior graph

Click at the process to see the details
start #LUMMA 6cbbc0f1be8e61da11cec2e930d8e0a9.exe #LUMMA svchost.exe sppextcomobj.exe no specs slui.exe #AMADEY vowfgo964sm4lik16o5fg.exe #AMADEY saved.exe jsevgjv.exe no specs amnew.exe #AMADEY laren.exe cmd.exe no specs conhost.exe no specs ping.exe no specs cmd.exe conhost.exe no specs ping.exe no specs #LUMMA 5511ade474.exe alex1234.exe no specs #LUMMA 5511ade474.exe #LUMMA msbuild.exe reg.exe cron1.exe no specs t6zw7oql5sidmpnrpm.exe no specs #CREDENTIALFLUSHER de2bc57ed4.exe no specs msbuild.exe no specs #LUMMA msbuild.exe taskkill.exe no specs conhost.exe no specs hzu3ns1s9zftpr5m8odzbvpmgiyb1k.exe no specs cron2.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs #CREDENTIALFLUSHER de2bc57ed4.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs #CREDENTIALFLUSHER firefox.exe no specs taskkill.exe no specs conhost.exe no specs firefox.exe no specs b938f7a239.exe no specs cmd.exe no specs conhost.exe no specs mshta.exe no specs schtasks.exe no specs #LUMMA msbuild.exe #AMADEY powershell.exe conhost.exe no specs mshta.exe no specs powershell.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs #CREDENTIALFLUSHER firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs b938f7a239.exe no specs cmd.exe no specs mshta.exe no specs conhost.exe no specs schtasks.exe no specs #AMADEY powershell.exe conhost.exe no specs 45c51f175f.exe no specs firefox.exe no specs mshta.exe no specs taskkill.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs ping.exe no specs wireguard.exe #LUMMA msbuild.exe cmd.exe no specs conhost.exe no specs wmic.exe no specs cmd.exe no specs taskkill.exe no specs conhost.exe no specs conhost.exe no specs wmic.exe no specs taskkill.exe no specs conhost.exe no specs temp6hmngsqo8mhwkl6xckkyw8ehvpfmiaec.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs wmic.exe no specs tempzammogff0acqco1gtjelyxloxxh6kvzm.exe no specs taskkill.exe no specs conhost.exe no specs #CREDENTIALFLUSHER firefox.exe no specs firefox.exe temp6hmngsqo8mhwkl6xckkyw8ehvpfmiaec.exe no specs firefox.exe no specs firefox.exe no specs tempzammogff0acqco1gtjelyxloxxh6kvzm.exe no specs wireguard.exe cmd.exe no specs conhost.exe no specs wmic.exe no specs firefox.exe no specs cmd.exe no specs conhost.exe no specs wmic.exe no specs firefox.exe no specs cmd.exe no specs conhost.exe no specs wmic.exe no specs wireguard.exe cmd.exe no specs conhost.exe no specs wmic.exe no specs firefox.exe no specs cmd.exe no specs conhost.exe no specs wmic.exe no specs firefox.exe no specs firefox.exe no specs #GENERIC 595031cb1c.exe firefox.exe no specs firefox.exe no specs wireguard.exe cmd.exe no specs conhost.exe no specs wmic.exe no specs cmd.exe no specs conhost.exe no specs wmic.exe no specs cmd.exe no specs conhost.exe no specs wmic.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs wmic.exe no specs cmd.exe no specs conhost.exe no specs laren.exe no specs saved.exe no specs 62ece15dc5.exe 62ece15dc5.tmp THREAT putty.exe no specs 601f30b268.exe no specs slui.exe no specs core.exe info.exe conhost.exe no specs dns.exe no specs cmd.exe conhost.exe no specs powershell.exe 47q6wzm.exe no specs powershell.exe no specs #LUMMA msbuild.exe installutil.exe no specs 5bf43363e1.exe attrib.exe no specs timeout.exe no specs powershell.exe no specs #UPATRE svchost.exe werfault.exe no specs jsevgjv.exe no specs powershell.exe conhost.exe no specs #GCLEANER svchost015.exe amnew.exe no specs #UPATRE svchost.exe visualcode.exe no specs #GCLEANER svchost015.exe msbuild.exe cmd.exe no specs conhost.exe no specs ping.exe no specs #LUMMA zb7jdew.exe chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs fskyitkmbcq.exe fskyitkmbcq.tmp chrome.exe no specs ping.exe no specs wmwitsfbc2vt.exe no specs wmwitsfbc2vt.exe no specs powershell.exe no specs conhost.exe no specs filelistcreatorassist15.exe powershell.exe no specs conhost.exe no specs wmlaunch.exe no specs laren.exe no specs saved.exe no specs dllhost.exe

Process information

PID
CMD
Path
Indicators
Parent process
236"C:\Users\admin\AppData\Local\Temp\10053380101\5bf43363e1.exe" C:\Users\admin\AppData\Local\Temp\10053380101\5bf43363e1.exe
saved.exe
User:
admin
Company:
FlashDevelop.org
Integrity Level:
MEDIUM
Description:
FlashDevelop
Exit code:
3221225477
Version:
5.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\10053380101\5bf43363e1.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
496"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
47Q6wZM.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
MSBuild.exe
Exit code:
0
Version:
4.8.9037.0 built by: NET481REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\msbuild.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shell32.dll
536"C:\Users\admin\AppData\Local\Temp\10051580101\JSEVGJV.exe" C:\Users\admin\AppData\Local\Temp\10051580101\JSEVGJV.exe—saved.exe
User:
admin
Company:
NirSoft
Integrity Level:
MEDIUM
Description:
AppNetworkCounter
Exit code:
0
Version:
1.48
Modules
Images
c:\users\admin\appdata\local\temp\10051580101\jsevgjv.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
616C:\WINDOWS\system32\cmd.exe /c schtasks /create /tn pUYYdmahCOa /tr "mshta C:\Users\admin\AppData\Local\Temp\BFrHcoYpx.hta" /sc minute /mo 25 /ru "admin" /fC:\Windows\SysWOW64\cmd.exe—b938f7a239.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
644taskkill /F /IM msedge.exe /TC:\Windows\SysWOW64\taskkill.exe—de2bc57ed4.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Terminates Processes
Exit code:
128
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\taskkill.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
664\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—taskkill.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
680mshta C:\Users\admin\AppData\Local\Temp\X37gwFbmO.htaC:\Windows\SysWOW64\mshta.exe—b938f7a239.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft (R) HTML Application host
Exit code:
0
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\mshta.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
720CMD /C "WMIC DISKDRIVE GET SERIALNUMBER"C:\Windows\System32\cmd.exe—WireGuard.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
720"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --no-appcompat-clear --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3736 --field-trial-handle=1996,i,12436279718547048677,15457973242183410040,262144 --variations-seed-version /prefetch:2C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
720"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=4536 --field-trial-handle=2176,i,5351142364422254196,4447234071334576365,262144 --variations-seed-version /prefetch:2C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
105 295
Read events
105 183
Write events
111
Delete events
1

Modification events

(PID) Process:(2148) saved.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(2148) saved.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(2148) saved.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(6068) laren.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(6068) laren.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(6068) laren.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(2148) saved.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:5511ade474.exe
Value:
C:\Users\admin\AppData\Local\Temp\10053290101\5511ade474.exe
(PID) Process:(4120) reg.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
Operation:writeName:Shell
Value:
explorer.exe,C:\ProgramData\DNS.exe,
(PID) Process:(2148) saved.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:de2bc57ed4.exe
Value:
C:\Users\admin\AppData\Local\Temp\10053310101\de2bc57ed4.exe
(PID) Process:(680) mshta.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
Executable files
95
Suspicious files
372
Text files
153
Unknown types
2

Dropped files

PID
Process
Filename
Type
60486cbbc0f1be8e61da11cec2e930d8e0a9.exeC:\Users\admin\AppData\Local\Temp\VOWFGO964SM4LIK16O5FG.exeexecutable
MD5:F6C20A18AFEAC04964A6CCAD6BE59731
SHA256:CE75F9DEDE6D4E93549D35B816898113B6BEFAB9EF0AADF8949D4887C2C34BEA
2148saved.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\E4DJRUXW\random[1].exeexecutable
MD5:1BAE0DAB5C42DFE20D6A315C0490B513
SHA256:BB760E8484ADB256EB5EE807AD3585283E3454971AEDDBAFD02FAF816346F22C
2148saved.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\RR3E01RZ\JSEVGJV[1].exeexecutable
MD5:0A083775390677239BFB7172689A2E75
SHA256:B290AA87A5D4749E8BA7253B1D7735E5A322C7D6A9E317AD1DC8F5D5CFD8E75C
2148saved.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\KCV3KQBA\amnew[1].exeexecutable
MD5:9B4ED35663DE10326D771433E97F2B26
SHA256:3F28310487F27BC28B10C5D4DE66834FBC28C59E2AB43AF85C8014D315FE207E
2148saved.exeC:\Users\admin\AppData\Local\Temp\10051580101\JSEVGJV.exeexecutable
MD5:0A083775390677239BFB7172689A2E75
SHA256:B290AA87A5D4749E8BA7253B1D7735E5A322C7D6A9E317AD1DC8F5D5CFD8E75C
2148saved.exeC:\Users\admin\AppData\Local\Temp\10051660101\amnew.exeexecutable
MD5:9B4ED35663DE10326D771433E97F2B26
SHA256:3F28310487F27BC28B10C5D4DE66834FBC28C59E2AB43AF85C8014D315FE207E
6424VOWFGO964SM4LIK16O5FG.exeC:\Windows\Tasks\saved.jobbinary
MD5:D7871DC132657CDD7AB3174B1F6D8ED0
SHA256:1D051EA8126B120B9632BC3E77D4DD02E737F900E36D2C0BC7D501535E7A3A75
2148saved.exeC:\Users\admin\AppData\Local\Temp\10053290101\5511ade474.exeexecutable
MD5:1BAE0DAB5C42DFE20D6A315C0490B513
SHA256:BB760E8484ADB256EB5EE807AD3585283E3454971AEDDBAFD02FAF816346F22C
6424VOWFGO964SM4LIK16O5FG.exeC:\Users\admin\AppData\Local\Temp\c13dbdc4fa\saved.exeexecutable
MD5:F6C20A18AFEAC04964A6CCAD6BE59731
SHA256:CE75F9DEDE6D4E93549D35B816898113B6BEFAB9EF0AADF8949D4887C2C34BEA
4120amnew.exeC:\Windows\Tasks\laren.jobbinary
MD5:58B8034B13C3EFE457B31845D26A3E2D
SHA256:7EE16F82E2906D7E5C734BF21CB51E7A6527346B24A47FC9BF82767E5A4F8523
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
109
TCP/UDP connections
253
DNS requests
206
Threats
150

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2104
svchost.exe
GET
200
23.216.77.28:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
2104
svchost.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6048
6cbbc0f1be8e61da11cec2e930d8e0a9.exe
GET
200
185.39.17.162:80
http://185.39.17.162/mine/random.exe
unknown
—
—
malicious
2148
saved.exe
POST
200
185.39.17.163:80
http://185.39.17.163/Su8kud7i/index.php
unknown
—
—
malicious
2148
saved.exe
GET
200
185.39.17.162:80
http://185.39.17.162/files/7677226784/JSEVGJV.exe
unknown
—
—
malicious
680
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
680
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
2148
saved.exe
POST
200
185.39.17.163:80
http://185.39.17.163/Su8kud7i/index.php
unknown
—
—
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2104
svchost.exe
23.216.77.28:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
2104
svchost.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
5496
MoUsoCoreWorker.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
—
—
172.211.123.249:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
—
—
40.126.32.74:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
184.30.131.245:80
ocsp.digicert.com
AKAMAI-AS
US
whitelisted
6048
6cbbc0f1be8e61da11cec2e930d8e0a9.exe
172.67.190.162:443
zenithcorde.top
CLOUDFLARENET
US
unknown
—
—
172.67.190.162:443
zenithcorde.top
CLOUDFLARENET
US
unknown

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.186.78
whitelisted
settings-win.data.microsoft.com
  • 4.231.128.59
whitelisted
crl.microsoft.com
  • 23.216.77.28
  • 23.216.77.6
whitelisted
www.microsoft.com
  • 23.35.229.160
  • 2.23.246.101
whitelisted
client.wns.windows.com
  • 172.211.123.249
whitelisted
login.live.com
  • 40.126.32.74
  • 20.190.160.4
  • 20.190.160.5
  • 40.126.32.76
  • 20.190.160.128
  • 40.126.32.134
  • 20.190.160.130
  • 40.126.32.133
whitelisted
ocsp.digicert.com
  • 184.30.131.245
whitelisted
clarmodq.top
  • —
malicious
zenithcorde.top
  • 172.67.190.162
  • 104.21.51.232
unknown
slscr.update.microsoft.com
  • 172.202.163.200
whitelisted

Threats

PID
Process
Class
Message
—
—
A Network Trojan was detected
MALWARE [ANY.RUN] Suspected Domain Associated with Malware Distribution (clarmodq .top)
—
—
Potentially Bad Traffic
ET DNS Query to a *.top domain - Likely Hostile
—
—
Domain Observed Used for C2 Detected
ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (clarmodq .top)
—
—
Potentially Bad Traffic
ET INFO Executable Download from dotted-quad Host
—
—
Misc Attack
ET DROP Spamhaus DROP Listed Traffic Inbound group 31
—
—
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
—
—
Potentially Bad Traffic
ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response
—
—
Misc activity
ET INFO Packed Executable Download
—
—
Potential Corporate Privacy Violation
ET INFO PE EXE or DLL Windows file download HTTP
—
—
Malware Command and Control Activity Detected
BOTNET [ANY.RUN] Amadey HTTP POST Request (st=s)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
6cbbc0f1be8e61da11cec2e930d8e0a9.exe