URL:

https://iplogger.ru/25cHm6

Full analysis: https://app.any.run/tasks/76fdac01-df50-4d45-96c5-0a4a572b829a
Verdict: Malicious activity
Threats:

Amadey is a formidable Windows infostealer threat, characterized by its persistence mechanisms, modular design, and ability to execute various malicious tasks.

Malware Trends Tracker     >>>
Analysis date: November 01, 2024, 19:47:06
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
evasion
phishing
lumma
stealer
arch-exec
amadey
botnet
autoit-loader
golang
crypto-regex
rdp
Indicators:
MD5:

76C205C077633ED75708EDF080ABD696

SHA1:

E46FD8919945628BD1AF4EEACCFAC96850773A9E

SHA256:

A71D0FD84F579D10D4673E42C9533E4BDBE551957F058B2872B8390473F87F16

SSDEEP:

3:N8FCCAbXhun:2FCCAbXM

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • PHISHING has been detected (SURICATA)

      • chrome.exe (PID: 6824)

    • LUMMA has been detected (SURICATA)

      • svchost.exe (PID: 2172)

    • AutoIt loader has been detected (YARA)

      • Jewelry.pif (PID: 1184)

    • Bypass execution policy to execute commands

      • powershell.exe (PID: 608)

    • Changes powershell execution policy (Bypass)

      • Jewelry.pif (PID: 1184)

    • Stealers network behavior

      • svchost.exe (PID: 2172)

    • LUMMA has been detected (YARA)

      • Jewelry.pif (PID: 1184)

    • AMADEY has been detected (SURICATA)

      • explorer.exe (PID: 7056)

    • Connects to the CnC server

      • explorer.exe (PID: 7056)

    • AMADEY has been detected (YARA)

      • explorer.exe (PID: 7056)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • powershell.exe (PID: 8052)
      • Jewelry.pif (PID: 1184)
      • AutoIt3.exe (PID: 5444)
      • cmd.exe (PID: 6280)

    • Starts CMD.EXE for commands execution

      • EnhanceAntiques.exe (PID: 7788)
      • cmd.exe (PID: 6280)

    • Stealers network behavior

      • svchost.exe (PID: 2172)

    • Get information on the list of running processes

      • cmd.exe (PID: 6280)

    • Executing commands from a ".bat" file

      • EnhanceAntiques.exe (PID: 7788)

    • The process executes Powershell scripts

      • Jewelry.pif (PID: 1184)

    • Using 'findstr.exe' to search for text patterns in files and output

      • cmd.exe (PID: 6280)

    • Starts application with an unusual extension

      • cmd.exe (PID: 6280)

    • Application launched itself

      • cmd.exe (PID: 6280)

    • The executable file from the user directory is run by the CMD process

      • Jewelry.pif (PID: 1184)

    • Contacting a server suspected of hosting an CnC

      • svchost.exe (PID: 2172)
      • explorer.exe (PID: 7056)

    • Node.exe was dropped

      • Jewelry.pif (PID: 1184)

    • Starts POWERSHELL.EXE for commands execution

      • Jewelry.pif (PID: 1184)

    • Found regular expressions for crypto-addresses (YARA)

      • MicrosoftEdgeUpdateCore.exe (PID: 4348)

    • Connects to unusual port

      • MicrosoftEdgeUpdateCore.exe (PID: 4348)

    • There is functionality for enable RDP (YARA)

      • explorer.exe (PID: 7056)

  • INFO

    • Manual execution by a user

      • powershell.exe (PID: 8052)
      • notepad++.exe (PID: 3024)

    • Creates a new folder

      • cmd.exe (PID: 7676)

    • Application launched itself

      • chrome.exe (PID: 6708)

    • Executable content was dropped or overwritten

      • chrome.exe (PID: 1112)

    • Application based on Golang

      • MicrosoftEdgeUpdateCore.exe (PID: 4348)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Amadey

(PID) Process(7056) explorer.exe
C2moviecentral-petparade.com
Strings (129)e2
2016
/Plugins/
msi
vs:
-executionpolicy remotesigned -File "
0123456789
AVAST Software
Panda Security
\0000
cmd /C RMDIR /s/q
%USERPROFILE%
SYSTEM\CurrentControlSet\Control\UnitedVideo\CONTROL\VIDEO\
lv:
wb
bi:
abcdefghijklmnopqrstuvwxyz0123456789-_
0000043f
Sophos
ComputerName
Startup
360TotalSecurity
2019
&unit=
zip
sd:
------
2022
r=
5.03
/g9jvjfd73/index.php
=
http://
2025
" && timeout 1 && del
&&
VideoID
WinDefender
d1
:::
SYSTEM\ControlSet001\Services\BasicDisplay\Video
kernel32.dll
" && ren
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
00000422
POST
00000423
%-lu
cred.dll
GET
st=s
Gxtuum.exe
dll
cmd
Avira
rb
DefaultSettings.XResolution
exe
Comodo
"taskkill /f /im "
ps1
un:
/g9jvjfd74/index.php
Bitdefender
ar:
Programs
ESET
moviecentral-petparade3.com
-unicode-
00000419
<d>
Main
e1
pc:
AVG
SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName
\App
og:
#
.jpg
?scr=1
DefaultSettings.YResolution
dm:
Doctor Web
https://
/k
shell32.dll
Norton
GetNativeSystemInfo
SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
av:
moviecentral-petparade2.com
shutdown -s -t 0
/8bkjdSdfjCe/index.php
------
clip.dll
ProductName
os:
&& Exit"
rundll32
cred.dll|clip.dll|
-%lu
Content-Disposition: form-data; name="data"; filename="
\
|
/quiet
Content-Type: multipart/form-data; boundary=----
a6c6395115
Rem
<c>
SOFTWARE\Microsoft\Windows NT\CurrentVersion
--
+++
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
Content-Type: application/x-www-form-urlencoded
CurrentBuild
"
Kaspersky Lab
" Content-Type: application/octet-stream
Keyboard Layout\Preload
id:
e3
rundll32.exe
Powershell.exe
random
S-%lu-
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
ProgramData\
moviecentral-petparade.com
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
176
Monitored processes
43
Malicious processes
12
Suspicious processes
0

Behavior graph

Click at the process to see the details
start chrome.exe chrome.exe no specs chrome.exe no specs #PHISHING chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs powershell.exe conhost.exe no specs #LUMMA svchost.exe enhanceantiques.exe no specs cmd.exe conhost.exe no specs tasklist.exe no specs findstr.exe no specs tasklist.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs #LUMMA jewelry.pif choice.exe no specs chrome.exe chrome.exe wkxfcc38ucw6mox9cc9t1jzd.exe no specs powershell.exe no specs conhost.exe no specs comp.exe no specs conhost.exe no specs autoit3.exe THREAT microsoftedgeupdatecore.exe chrome.exe no specs chrome.exe no specs #AMADEY explorer.exe chrome.exe no specs rundll32.exe no specs chrome.exe no specs chrome.exe no specs notepad++.exe chrome.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
608powershell -exec bypass -f "C:\Users\admin\AppData\Local\Temp\MQKPIGRNAFIH50K9OT28LM88SHWEW.ps1"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe—Jewelry.pif
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\oleaut32.dll
700"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --disable-quic --no-appcompat-clear --mojo-platform-channel-handle=2224 --field-trial-handle=1912,i,9968577059357502609,16921026098974614658,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
948"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3092 --field-trial-handle=1912,i,9968577059357502609,16921026098974614658,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
1112"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --disable-quic --no-appcompat-clear --mojo-platform-channel-handle=3680 --field-trial-handle=1912,i,9968577059357502609,16921026098974614658,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe
chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
1184Jewelry.pif B C:\Users\admin\AppData\Local\Temp\44041\Jewelry.pif
cmd.exe
User:
admin
Company:
AutoIt Team
Integrity Level:
HIGH
Description:
AutoIt v3 Script
Exit code:
0
Version:
3, 3, 14, 3
Modules
Images
c:\users\admin\appdata\local\temp\44041\jewelry.pif
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\psapi.dll
c:\windows\syswow64\user32.dll
1748choice /d y /t 5C:\Windows\SysWOW64\choice.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Offers the user a choice
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\choice.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\user32.dll
1764C:\WINDOWS\SysWOW64\comp.exeC:\Windows\SysWOW64\comp.exe—WKXFCC38UCW6MOX9CC9T1JZD.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
File Compare Utility
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\comp.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\ulib.dll
2172C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2196"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --disable-quic --no-appcompat-clear --mojo-platform-channel-handle=5136 --field-trial-handle=1912,i,9968577059357502609,16921026098974614658,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
2660\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—comp.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
24 502
Read events
24 474
Write events
22
Delete events
6

Modification events

(PID) Process:(6708) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon
Operation:writeName:failed_count
Value:
0
(PID) Process:(6708) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
2
(PID) Process:(6708) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
1
(PID) Process:(6708) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\StabilityMetrics
Operation:writeName:user_experience_metrics.stability.exited_cleanly
Value:
0
(PID) Process:(6708) chrome.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Google\Update\ClientStateMedium\{8A69D345-D564-463C-AFF1-A69D9E530F96}
Operation:writeName:usagestats
Value:
0
(PID) Process:(6708) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Common\Rlz\Events\C
Operation:writeName:C1I
Value:
1
(PID) Process:(6708) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Common\Rlz\Events\C
Operation:writeName:C2I
Value:
1
(PID) Process:(6708) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Common\Rlz\Events\C
Operation:writeName:C7I
Value:
1
(PID) Process:(6708) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Common\Rlz\Events\C
Operation:writeName:C1S
Value:
1
(PID) Process:(6708) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Common\Rlz\Events\C
Operation:writeName:C7S
Value:
1
Executable files
7
Suspicious files
218
Text files
49
Unknown types
3

Dropped files

PID
Process
Filename
Type
6708chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\chrome_cart_db\LOG.old~RF8ca2e.TMP —
MD5:—
SHA256:—
6708chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\discounts_db\LOG.old~RF8ca2e.TMP —
MD5:—
SHA256:—
6708chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\chrome_cart_db\LOG.old —
MD5:—
SHA256:—
6708chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\discounts_db\LOG.old —
MD5:—
SHA256:—
6708chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\parcel_tracking_db\LOG.old~RF8ca2e.TMP —
MD5:—
SHA256:—
6708chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\parcel_tracking_db\LOG.old —
MD5:—
SHA256:—
6708chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db\LOG.old~RF8ca2e.TMP —
MD5:—
SHA256:—
6708chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db\LOG.old —
MD5:—
SHA256:—
6708chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\coupon_db\LOG.old~RF8ca3e.TMP —
MD5:—
SHA256:—
6708chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\coupon_db\LOG.old —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
41
TCP/UDP connections
74
DNS requests
52
Threats
15

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5532
svchost.exe
GET
206
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/imoffpf67hel7kbknqflao2oo4_1.0.2738.0/neifaoindggfcjicffkgpmnlppeffabd_1.0.2738.0_win64_kj4dp5kifwxbdodqls7e5nzhtm.crx3
unknown
—
—
whitelisted
5532
svchost.exe
GET
206
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/imoffpf67hel7kbknqflao2oo4_1.0.2738.0/neifaoindggfcjicffkgpmnlppeffabd_1.0.2738.0_win64_kj4dp5kifwxbdodqls7e5nzhtm.crx3
unknown
—
—
whitelisted
5532
svchost.exe
GET
206
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/imoffpf67hel7kbknqflao2oo4_1.0.2738.0/neifaoindggfcjicffkgpmnlppeffabd_1.0.2738.0_win64_kj4dp5kifwxbdodqls7e5nzhtm.crx3
unknown
—
—
whitelisted
5532
svchost.exe
GET
206
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/imoffpf67hel7kbknqflao2oo4_1.0.2738.0/neifaoindggfcjicffkgpmnlppeffabd_1.0.2738.0_win64_kj4dp5kifwxbdodqls7e5nzhtm.crx3
unknown
—
—
whitelisted
5532
svchost.exe
GET
206
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/imoffpf67hel7kbknqflao2oo4_1.0.2738.0/neifaoindggfcjicffkgpmnlppeffabd_1.0.2738.0_win64_kj4dp5kifwxbdodqls7e5nzhtm.crx3
unknown
—
—
whitelisted
5532
svchost.exe
GET
206
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/imoffpf67hel7kbknqflao2oo4_1.0.2738.0/neifaoindggfcjicffkgpmnlppeffabd_1.0.2738.0_win64_kj4dp5kifwxbdodqls7e5nzhtm.crx3
unknown
—
—
whitelisted
5532
svchost.exe
GET
206
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/imoffpf67hel7kbknqflao2oo4_1.0.2738.0/neifaoindggfcjicffkgpmnlppeffabd_1.0.2738.0_win64_kj4dp5kifwxbdodqls7e5nzhtm.crx3
unknown
—
—
whitelisted
5532
svchost.exe
GET
206
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/imoffpf67hel7kbknqflao2oo4_1.0.2738.0/neifaoindggfcjicffkgpmnlppeffabd_1.0.2738.0_win64_kj4dp5kifwxbdodqls7e5nzhtm.crx3
unknown
—
—
whitelisted
5532
svchost.exe
GET
206
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/imoffpf67hel7kbknqflao2oo4_1.0.2738.0/neifaoindggfcjicffkgpmnlppeffabd_1.0.2738.0_win64_kj4dp5kifwxbdodqls7e5nzhtm.crx3
unknown
—
—
whitelisted
1184
Jewelry.pif
GET
200
142.250.186.131:80
http://c.pki.goog/r/gsr1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
6944
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5488
MoUsoCoreWorker.exe
23.48.23.147:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5488
MoUsoCoreWorker.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
—
—
104.126.37.137:443
www.bing.com
Akamai International B.V.
DE
whitelisted
4360
SearchApp.exe
104.126.37.137:443
www.bing.com
Akamai International B.V.
DE
whitelisted
4360
SearchApp.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
4020
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
  • 20.73.194.208
whitelisted
crl.microsoft.com
  • 23.48.23.147
  • 23.48.23.143
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
www.bing.com
  • 104.126.37.137
  • 104.126.37.153
  • 104.126.37.163
  • 104.126.37.155
  • 104.126.37.170
  • 104.126.37.131
  • 104.126.37.139
  • 104.126.37.130
whitelisted
google.com
  • 172.217.18.14
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
iplogger.ru
  • 188.114.97.3
  • 188.114.96.3
unknown
accounts.google.com
  • 108.177.127.84
whitelisted
mhg5.b-cdn.net
  • 169.150.247.36
whitelisted
login.live.com
  • 20.190.159.23
  • 40.126.31.69
  • 20.190.159.64
  • 20.190.159.0
  • 40.126.31.73
  • 20.190.159.4
  • 20.190.159.75
  • 20.190.159.68
whitelisted

Threats

PID
Process
Class
Message
6824
chrome.exe
Possible Social Engineering Attempted
PHISHING [ANY.RUN] Suspected Phishing Domain by CrossDomain (iplogger .ru)
6824
chrome.exe
Possible Social Engineering Attempted
PHISHING [ANY.RUN] Suspected Phishing Domain by CrossDomain (iplogger .ru)
2172
svchost.exe
Possible Social Engineering Attempted
STEALER [ANY.RUN] Lumma Domain was identified (eu2 .contabostorage .com)
8052
powershell.exe
Misc activity
ET INFO Observed ZeroSSL SSL/TLS Certificate
2172
svchost.exe
Domain Observed Used for C2 Detected
STEALER [ANY.RUN] Domain has been identified as part of Lumma Stealer's infrastructure (creative-habitat .shop)
2172
svchost.exe
Misc activity
ET INFO Pastebin Service Domain in DNS Lookup (rentry .co)
1184
Jewelry.pif
Misc activity
ET INFO Observed Pastebin Service Domain (rentry .co in TLS SNI)
2172
svchost.exe
Domain Observed Used for C2 Detected
STEALER [ANY.RUN] Domain has been identified as part of Lumma Stealer's infrastructure (creative-habitat .shop)
7056
explorer.exe
Malware Command and Control Activity Detected
BOTNET [ANY.RUN] Amadey HTTP POST Request (st=s)
6 ETPRO signatures available at the full report
Process
Message
notepad++.exe
VerifyLibrary: C:\Program Files\Notepad++\SciLexer.dll
notepad++.exe
VerifyLibrary: certificate revocation checking is disabled
notepad++.exe
ED255D9151912E40DF048A56288E969A8D0DAFA3
notepad++.exe
VerifyLibrary: error while getting certificate informations
notepad++.exe
VerifyLibrary: certificate revocation checking is disabled
notepad++.exe
VerifyLibrary: C:\Program Files\Notepad++\updater\gup.exe
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://iplogger.ru/25cHm6