File name:

2025-05-15_a405964beb1cfaca126d6e509845fd67_agent-tesla_amadey_black-basta_cobalt-strike_darkgate_elex_luca-stealer

Full analysis: https://app.any.run/tasks/c9f66a08-fef1-46c6-9e5c-b708c473fea5
Verdict: Malicious activity
Threats:

Amadey is a formidable Windows infostealer threat, characterized by its persistence mechanisms, modular design, and ability to execute various malicious tasks.

Analysis date: May 15, 2025, 21:19:11
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
auto-sch
loader
amadey
botnet
stealer
auto-reg
lumma
rdp
evasion
gcleaner
telegram
stealc
vidar
arch-exec
auto
generic
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:

A405964BEB1CFACA126D6E509845FD67

SHA1:

6A0DE57BEECEFF4F7177ABCB11E07BB8597387CC

SHA256:

A73AC127EB2D6708AFC25BBCC9C3BDD19B607E0E1F7A03B48FC361611A9FB61A

SSDEEP:

49152:KPPkzemqoSut3Jh4+QQ/btosJwIA4hHmZlKH2Tw/Pq83zw0bCjvk9G661QGtBHXo:AP/mp7t3T4+B/btosJwIA4hHmZlKH2Tb

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Uses Task Scheduler to run other applications

      • cmd.exe (PID: 7736)
    • Run PowerShell with an invisible window

      • powershell.exe (PID: 7900)
      • powershell.exe (PID: 8144)
    • Request from PowerShell that ran from MSHTA.EXE

      • powershell.exe (PID: 7900)
    • Script downloads file (POWERSHELL)

      • powershell.exe (PID: 8144)
      • powershell.exe (PID: 7900)
    • AMADEY mutex has been found

      • TempXP6IRX3FJXH9MJA1DO1JF5HSCXCJSZGD.EXE (PID: 7356)
      • ramez.exe (PID: 7388)
    • AMADEY has been detected (SURICATA)

      • ramez.exe (PID: 7388)
    • Connects to the CnC server

      • ramez.exe (PID: 7388)
      • svchost.exe (PID: 2196)
    • AMADEY has been detected (YARA)

      • ramez.exe (PID: 7388)
    • Changes the autorun value in the registry

      • ramez.exe (PID: 7388)
    • Adds path to the Windows Defender exclusion list

      • cmd.exe (PID: 7984)
      • NSudoLG.exe (PID: 5728)
      • cmd.exe (PID: 5380)
      • NSudoLG.exe (PID: 6080)
    • Changes Windows Defender settings

      • NSudoLG.exe (PID: 5728)
      • NSudoLG.exe (PID: 6080)
    • Starts SC.EXE for service management

      • cmd.exe (PID: 7984)
    • LUMMA has been detected (SURICATA)

      • svchost.exe (PID: 2196)
      • MSBuild.exe (PID: 2236)
      • MSBuild.exe (PID: 5048)
    • Executing a file with an untrusted certificate

      • ra02W4S.exe (PID: 2984)
      • j6J70wm.exe (PID: 7648)
    • GCLEANER has been detected (SURICATA)

      • 0568e64901.exe (PID: 5008)
      • ra02W4S.exe (PID: 2984)
    • Stealers network behavior

      • svchost.exe (PID: 2196)
    • GENERIC has been found (auto)

      • 0568e64901.exe (PID: 5008)
  • SUSPICIOUS

    • Manipulates environment variables

      • powershell.exe (PID: 7900)
      • powershell.exe (PID: 8144)
    • Starts CMD.EXE for commands execution

      • 2025-05-15_a405964beb1cfaca126d6e509845fd67_agent-tesla_amadey_black-basta_cobalt-strike_darkgate_elex_luca-stealer.exe (PID: 7716)
      • 019642107b.exe (PID: 2236)
      • cmd.exe (PID: 7224)
      • cmd.exe (PID: 7672)
      • nircmd.exe (PID: 7148)
      • NSudoLG.exe (PID: 7740)
      • cmd.exe (PID: 7840)
      • cmd.exe (PID: 7984)
      • 019642107b.exe (PID: 1628)
      • cmd.exe (PID: 7588)
      • nircmd.exe (PID: 7660)
      • cmd.exe (PID: 7848)
      • Unlocker.exe (PID: 8112)
      • NSudoLG.exe (PID: 1012)
      • cmd.exe (PID: 2040)
      • cmd.exe (PID: 5380)
      • Unlocker.exe (PID: 7632)
      • Unlocker.exe (PID: 3884)
      • Unlocker.exe (PID: 7992)
      • svchost.exe (PID: 2332)
      • 3rrAdmR.exe (PID: 7548)
    • Starts process via Powershell

      • powershell.exe (PID: 7900)
      • powershell.exe (PID: 8144)
    • Found IP address in command line

      • powershell.exe (PID: 7900)
      • powershell.exe (PID: 8144)
    • Starts POWERSHELL.EXE for commands execution

      • mshta.exe (PID: 7752)
      • mshta.exe (PID: 8068)
      • NSudoLG.exe (PID: 5728)
      • NSudoLG.exe (PID: 6080)
      • globalsynapse297.exe (PID: 4000)
      • globalsynapse297.exe (PID: 4652)
      • globalsynapse297.exe (PID: 6264)
      • ZAGgtuYDN.exe (PID: 7304)
    • Probably download files using WebClient

      • mshta.exe (PID: 7752)
      • mshta.exe (PID: 8068)
    • Connects to the server without a host name

      • powershell.exe (PID: 7900)
      • ramez.exe (PID: 7388)
      • svchost.exe (PID: 2332)
      • 0568e64901.exe (PID: 5008)
      • ra02W4S.exe (PID: 2984)
    • Process requests binary or script from the Internet

      • powershell.exe (PID: 7900)
      • ramez.exe (PID: 7388)
    • Potential Corporate Privacy Violation

      • powershell.exe (PID: 7900)
      • ramez.exe (PID: 7388)
      • 0568e64901.exe (PID: 5008)
      • ra02W4S.exe (PID: 2984)
    • Executable content was dropped or overwritten

      • powershell.exe (PID: 8144)
      • TempXP6IRX3FJXH9MJA1DO1JF5HSCXCJSZGD.EXE (PID: 7356)
      • ramez.exe (PID: 7388)
      • 019642107b.exe (PID: 2236)
      • 7z.exe (PID: 7792)
      • Unlocker.exe (PID: 7632)
      • cmd.exe (PID: 7984)
      • LcDRMzImqI.exe (PID: 7656)
      • 0568e64901.exe (PID: 5008)
      • LcDRMzImqI.tmp (PID: 7856)
      • globalsynapse297.exe (PID: 4000)
      • HHhpSdwZgwqUX.tmp (PID: 8052)
      • HHhpSdwZgwqUX.exe (PID: 7348)
      • ra02W4S.exe (PID: 2984)
      • lBskrrKCq.tmp (PID: 7364)
      • lBskrrKCq.exe (PID: 4692)
      • 2fdaf168.exe (PID: 6324)
      • 3rrAdmR.exe (PID: 7548)
      • csc.exe (PID: 8792)
      • 1aa5281f28.exe (PID: 9000)
      • 1aa5281f28.tmp (PID: 9092)
      • csc.exe (PID: 10384)
      • csc.exe (PID: 10712)
      • csc.exe (PID: 10748)
      • csc.exe (PID: 10528)
      • csc.exe (PID: 11036)
      • csc.exe (PID: 8460)
    • Reads security settings of Internet Explorer

      • TempXP6IRX3FJXH9MJA1DO1JF5HSCXCJSZGD.EXE (PID: 7356)
      • ramez.exe (PID: 7388)
      • 019642107b.exe (PID: 2236)
      • nircmd.exe (PID: 7148)
      • 019642107b.exe (PID: 1628)
      • nircmd.exe (PID: 7660)
      • Unlocker.exe (PID: 8112)
      • Unlocker.exe (PID: 7632)
      • Unlocker.exe (PID: 3884)
    • Starts itself from another location

      • TempXP6IRX3FJXH9MJA1DO1JF5HSCXCJSZGD.EXE (PID: 7356)
    • Contacting a server suspected of hosting an CnC

      • ramez.exe (PID: 7388)
      • svchost.exe (PID: 2196)
      • MSBuild.exe (PID: 2236)
      • MSBuild.exe (PID: 5048)
    • There is functionality for taking screenshot (YARA)

      • ramez.exe (PID: 7388)
    • There is functionality for enable RDP (YARA)

      • ramez.exe (PID: 7388)
    • Drops 7-zip archiver for unpacking

      • 019642107b.exe (PID: 2236)
    • The process creates files with name similar to system file names

      • 019642107b.exe (PID: 2236)
    • Executing commands from a ".bat" file

      • 019642107b.exe (PID: 2236)
      • cmd.exe (PID: 7224)
      • nircmd.exe (PID: 7148)
      • cmd.exe (PID: 7672)
      • NSudoLG.exe (PID: 7740)
      • cmd.exe (PID: 7840)
      • 019642107b.exe (PID: 1628)
      • cmd.exe (PID: 7588)
      • nircmd.exe (PID: 7660)
      • cmd.exe (PID: 7848)
      • NSudoLG.exe (PID: 1012)
      • cmd.exe (PID: 2040)
    • Application launched itself

      • cmd.exe (PID: 7224)
      • cmd.exe (PID: 7672)
      • cmd.exe (PID: 7840)
      • cmd.exe (PID: 7984)
      • cmd.exe (PID: 7588)
      • cmd.exe (PID: 7848)
      • cmd.exe (PID: 2040)
      • cmd.exe (PID: 5380)
    • Starts application with an unusual extension

      • cmd.exe (PID: 3956)
      • cmd.exe (PID: 6964)
      • cmd.exe (PID: 7984)
      • cmd.exe (PID: 7600)
      • cmd.exe (PID: 7784)
      • cmd.exe (PID: 5380)
    • The executable file from the user directory is run by the CMD process

      • nircmd.exe (PID: 7148)
      • NSudoLG.exe (PID: 7740)
      • NSudoLG.exe (PID: 5728)
      • nircmd.exe (PID: 7660)
      • 7z.exe (PID: 7792)
      • Unlocker.exe (PID: 8112)
      • NSudoLG.exe (PID: 1012)
      • Unlocker.exe (PID: 7632)
      • NSudoLG.exe (PID: 6080)
      • 7z.exe (PID: 8048)
      • Unlocker.exe (PID: 3884)
      • Unlocker.exe (PID: 7992)
    • Reads the date of Windows installation

      • nircmd.exe (PID: 7148)
      • nircmd.exe (PID: 7660)
      • Unlocker.exe (PID: 8112)
      • Unlocker.exe (PID: 7632)
      • Unlocker.exe (PID: 3884)
    • Uses REG/REGEDIT.EXE to modify registry

      • cmd.exe (PID: 6964)
      • cmd.exe (PID: 7984)
      • cmd.exe (PID: 7784)
      • cmd.exe (PID: 5380)
    • Get information on the list of running processes

      • cmd.exe (PID: 5436)
      • cmd.exe (PID: 7984)
      • cmd.exe (PID: 5380)
      • cmd.exe (PID: 644)
    • PowerShell delay command usage (probably sleep evasion)

      • powershell.exe (PID: 4452)
      • powershell.exe (PID: 5360)
    • Script adds exclusion path to Windows Defender

      • NSudoLG.exe (PID: 5728)
      • NSudoLG.exe (PID: 6080)
    • Using 'findstr.exe' to search for text patterns in files and output

      • cmd.exe (PID: 7984)
      • cmd.exe (PID: 5380)
    • Windows service management via SC.EXE

      • sc.exe (PID: 8008)
      • sc.exe (PID: 732)
      • sc.exe (PID: 7236)
      • sc.exe (PID: 2504)
      • sc.exe (PID: 7680)
      • sc.exe (PID: 5592)
      • sc.exe (PID: 4784)
      • sc.exe (PID: 7412)
      • sc.exe (PID: 6036)
      • sc.exe (PID: 7844)
      • sc.exe (PID: 7736)
      • sc.exe (PID: 7864)
      • sc.exe (PID: 7840)
      • sc.exe (PID: 2268)
      • sc.exe (PID: 5072)
      • sc.exe (PID: 5036)
      • sc.exe (PID: 7872)
      • sc.exe (PID: 1040)
      • sc.exe (PID: 4868)
      • sc.exe (PID: 2804)
      • sc.exe (PID: 2428)
      • sc.exe (PID: 2228)
      • sc.exe (PID: 7928)
      • sc.exe (PID: 7188)
      • sc.exe (PID: 7948)
      • sc.exe (PID: 8056)
      • sc.exe (PID: 3180)
      • sc.exe (PID: 8048)
      • sc.exe (PID: 1184)
      • sc.exe (PID: 1324)
      • sc.exe (PID: 7952)
      • sc.exe (PID: 7668)
      • sc.exe (PID: 1676)
      • sc.exe (PID: 2516)
      • sc.exe (PID: 6228)
      • sc.exe (PID: 7396)
      • sc.exe (PID: 896)
      • sc.exe (PID: 7528)
      • sc.exe (PID: 7832)
      • sc.exe (PID: 7340)
      • sc.exe (PID: 5176)
      • sc.exe (PID: 8032)
      • sc.exe (PID: 7520)
    • Starts SC.EXE for service management

      • cmd.exe (PID: 4380)
      • cmd.exe (PID: 7984)
      • cmd.exe (PID: 7296)
      • cmd.exe (PID: 4272)
      • cmd.exe (PID: 7544)
      • cmd.exe (PID: 2140)
      • cmd.exe (PID: 968)
    • Uses TASKKILL.EXE to kill process

      • cmd.exe (PID: 8012)
      • cmd.exe (PID: 7576)
    • Reads the BIOS version

      • bqxUv7C.exe (PID: 7788)
    • Drops a system driver (possible attempt to evade defenses)

      • Unlocker.exe (PID: 7632)
      • 2fdaf168.exe (PID: 6324)
    • Creates or modifies Windows services

      • Unlocker.exe (PID: 3884)
      • Unlocker.exe (PID: 7632)
    • Stops a currently running service

      • sc.exe (PID: 1184)
      • sc.exe (PID: 2600)
      • sc.exe (PID: 4528)
      • sc.exe (PID: 6828)
      • sc.exe (PID: 8068)
      • sc.exe (PID: 780)
      • sc.exe (PID: 7232)
      • sc.exe (PID: 2632)
      • sc.exe (PID: 6736)
      • sc.exe (PID: 6712)
      • sc.exe (PID: 7436)
      • sc.exe (PID: 1132)
      • sc.exe (PID: 7944)
      • sc.exe (PID: 7608)
      • sc.exe (PID: 2960)
      • sc.exe (PID: 7824)
      • sc.exe (PID: 3176)
      • sc.exe (PID: 1116)
    • Process drops legitimate windows executable

      • cmd.exe (PID: 7984)
      • ramez.exe (PID: 7388)
      • LcDRMzImqI.tmp (PID: 7856)
      • HHhpSdwZgwqUX.tmp (PID: 8052)
      • lBskrrKCq.tmp (PID: 7364)
    • Deletes scheduled task without confirmation

      • schtasks.exe (PID: 140)
      • schtasks.exe (PID: 7620)
      • schtasks.exe (PID: 7588)
      • schtasks.exe (PID: 7408)
      • schtasks.exe (PID: 6564)
    • The process executes via Task Scheduler

      • ramez.exe (PID: 7180)
      • ramez.exe (PID: 4304)
    • Executes application which crashes

      • Unlocker.exe (PID: 7992)
      • core.exe (PID: 8400)
      • f5919a7505.exe (PID: 10792)
    • Checks for external IP

      • svchost.exe (PID: 2332)
      • svchost.exe (PID: 2196)
    • Starts a Microsoft application from unusual location

      • j6J70wm.exe (PID: 7648)
      • 08IyOOF.exe (PID: 7556)
    • The process drops C-runtime libraries

      • LcDRMzImqI.tmp (PID: 7856)
    • Process communicates with Telegram (possibly using it as an attacker's C2 server)

      • ZAGgtuYDN.exe (PID: 7304)
    • Connects to unusual port

      • 3rrAdmR.exe (PID: 7548)
    • BASE64 encoded PowerShell command has been detected

      • ZAGgtuYDN.exe (PID: 7304)
    • The process hide an interactive prompt from the user

      • ZAGgtuYDN.exe (PID: 7304)
    • CSC.EXE is used to compile C# code

      • csc.exe (PID: 8792)
      • csc.exe (PID: 10384)
      • csc.exe (PID: 10528)
      • csc.exe (PID: 10712)
      • csc.exe (PID: 10748)
      • csc.exe (PID: 11036)
      • csc.exe (PID: 8460)
      • csc.exe (PID: 10668)
      • csc.exe (PID: 4276)
      • csc.exe (PID: 7816)
      • csc.exe (PID: 10852)
    • Base64-obfuscated command line is found

      • ZAGgtuYDN.exe (PID: 7304)
    • The process bypasses the loading of PowerShell profile settings

      • ZAGgtuYDN.exe (PID: 7304)
  • INFO

    • The sample compiled with english language support

      • 2025-05-15_a405964beb1cfaca126d6e509845fd67_agent-tesla_amadey_black-basta_cobalt-strike_darkgate_elex_luca-stealer.exe (PID: 7716)
      • 019642107b.exe (PID: 2236)
      • Unlocker.exe (PID: 7632)
      • cmd.exe (PID: 7984)
      • ramez.exe (PID: 7388)
      • LcDRMzImqI.tmp (PID: 7856)
      • HHhpSdwZgwqUX.tmp (PID: 8052)
      • ra02W4S.exe (PID: 2984)
      • lBskrrKCq.tmp (PID: 7364)
      • 0568e64901.exe (PID: 5008)
      • 2fdaf168.exe (PID: 6324)
    • Reads mouse settings

      • 2025-05-15_a405964beb1cfaca126d6e509845fd67_agent-tesla_amadey_black-basta_cobalt-strike_darkgate_elex_luca-stealer.exe (PID: 7716)
    • Checks supported languages

      • 2025-05-15_a405964beb1cfaca126d6e509845fd67_agent-tesla_amadey_black-basta_cobalt-strike_darkgate_elex_luca-stealer.exe (PID: 7716)
      • TempXP6IRX3FJXH9MJA1DO1JF5HSCXCJSZGD.EXE (PID: 7356)
      • ramez.exe (PID: 7388)
      • 019642107b.exe (PID: 2236)
      • nircmd.exe (PID: 7148)
      • chcp.com (PID: 7764)
      • NSudoLG.exe (PID: 7740)
      • chcp.com (PID: 8104)
      • mode.com (PID: 6512)
      • NSudoLG.exe (PID: 5728)
      • chcp.com (PID: 7596)
      • 019642107b.exe (PID: 1628)
      • nircmd.exe (PID: 7660)
      • chcp.com (PID: 7572)
      • 7z.exe (PID: 7792)
      • bqxUv7C.exe (PID: 7788)
      • Unlocker.exe (PID: 8112)
      • chcp.com (PID: 5984)
      • NSudoLG.exe (PID: 1012)
      • chcp.com (PID: 8152)
      • mode.com (PID: 7904)
      • Unlocker.exe (PID: 7632)
      • NSudoLG.exe (PID: 6080)
      • IObitUnlocker.exe (PID: 4688)
      • 7z.exe (PID: 8048)
      • Unlocker.exe (PID: 3884)
      • IObitUnlocker.exe (PID: 7640)
    • Reads the computer name

      • 2025-05-15_a405964beb1cfaca126d6e509845fd67_agent-tesla_amadey_black-basta_cobalt-strike_darkgate_elex_luca-stealer.exe (PID: 7716)
      • TempXP6IRX3FJXH9MJA1DO1JF5HSCXCJSZGD.EXE (PID: 7356)
      • ramez.exe (PID: 7388)
      • 019642107b.exe (PID: 2236)
      • NSudoLG.exe (PID: 7740)
      • nircmd.exe (PID: 7148)
      • NSudoLG.exe (PID: 5728)
      • 019642107b.exe (PID: 1628)
      • nircmd.exe (PID: 7660)
      • 7z.exe (PID: 7792)
      • Unlocker.exe (PID: 8112)
      • NSudoLG.exe (PID: 1012)
      • Unlocker.exe (PID: 7632)
      • bqxUv7C.exe (PID: 7788)
      • NSudoLG.exe (PID: 6080)
      • IObitUnlocker.exe (PID: 4688)
      • 7z.exe (PID: 8048)
      • Unlocker.exe (PID: 3884)
      • IObitUnlocker.exe (PID: 7640)
    • Create files in a temporary directory

      • 2025-05-15_a405964beb1cfaca126d6e509845fd67_agent-tesla_amadey_black-basta_cobalt-strike_darkgate_elex_luca-stealer.exe (PID: 7716)
      • TempXP6IRX3FJXH9MJA1DO1JF5HSCXCJSZGD.EXE (PID: 7356)
      • ramez.exe (PID: 7388)
      • 019642107b.exe (PID: 2236)
      • 019642107b.exe (PID: 1628)
      • 7z.exe (PID: 7792)
    • Auto-launch of the file from Task Scheduler

      • cmd.exe (PID: 7736)
    • Reads Internet Explorer settings

      • mshta.exe (PID: 7752)
      • mshta.exe (PID: 8068)
    • Manual execution by a user

      • mshta.exe (PID: 8068)
      • 019642107b.exe (PID: 1628)
      • launcherr.exe (PID: 8828)
    • Checks proxy server information

      • powershell.exe (PID: 7900)
      • ramez.exe (PID: 7388)
    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 8144)
      • powershell.exe (PID: 4452)
    • The executable file from the user directory is run by the Powershell process

      • TempXP6IRX3FJXH9MJA1DO1JF5HSCXCJSZGD.EXE (PID: 7356)
    • Disables trace logs

      • powershell.exe (PID: 7900)
    • Process checks computer location settings

      • TempXP6IRX3FJXH9MJA1DO1JF5HSCXCJSZGD.EXE (PID: 7356)
      • 019642107b.exe (PID: 2236)
      • ramez.exe (PID: 7388)
      • nircmd.exe (PID: 7148)
      • 019642107b.exe (PID: 1628)
      • nircmd.exe (PID: 7660)
    • Creates files or folders in the user directory

      • ramez.exe (PID: 7388)
    • Changes the display of characters in the console

      • cmd.exe (PID: 3956)
      • cmd.exe (PID: 6964)
      • cmd.exe (PID: 7984)
      • cmd.exe (PID: 7600)
      • cmd.exe (PID: 7784)
      • cmd.exe (PID: 5380)
    • NirSoft software is detected

      • nircmd.exe (PID: 7148)
      • nircmd.exe (PID: 7660)
    • Checks operating system version

      • cmd.exe (PID: 7984)
      • cmd.exe (PID: 5380)
    • Starts MODE.COM to configure console settings

      • mode.com (PID: 6512)
      • mode.com (PID: 7904)
    • Auto-launch of the file from Registry key

      • ramez.exe (PID: 7388)
    • Checks if a key exists in the options dictionary (POWERSHELL)

      • powershell.exe (PID: 4452)
    • Reads the machine GUID from the registry

      • Unlocker.exe (PID: 8112)
      • Unlocker.exe (PID: 7632)
      • Unlocker.exe (PID: 3884)
      • bqxUv7C.exe (PID: 7788)
    • Reads the software policy settings

      • bqxUv7C.exe (PID: 7788)
    • Changes the registry key values via Powershell

      • globalsynapse297.exe (PID: 4000)
      • globalsynapse297.exe (PID: 4652)
      • globalsynapse297.exe (PID: 6264)
    • Application launched itself

      • chrome.exe (PID: 8076)
      • chrome.exe (PID: 9300)
      • chrome.exe (PID: 8780)
      • chrome.exe (PID: 9560)
      • chrome.exe (PID: 8904)
      • chrome.exe (PID: 9408)
      • chrome.exe (PID: 9888)
      • chrome.exe (PID: 9260)
      • chrome.exe (PID: 9732)
      • chrome.exe (PID: 9704)
      • chrome.exe (PID: 10072)
      • chrome.exe (PID: 9284)
      • chrome.exe (PID: 8404)
      • chrome.exe (PID: 10536)
      • chrome.exe (PID: 10784)
    • Attempting to use instant messaging service

      • MSBuild.exe (PID: 11232)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (76.4)
.exe | Win32 Executable (generic) (12.4)
.exe | Generic Win/DOS Executable (5.5)
.exe | DOS Executable Generic (5.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2025:05:15 13:17:45+00:00
ImageFileCharacteristics: Executable, Large address aware, 32-bit
PEType: PE32
LinkerVersion: 14.16
CodeSize: 633856
InitializedDataSize: 326144
UninitializedDataSize: -
EntryPoint: 0x20577
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
FileVersionNumber: 0.0.0.0
ProductVersionNumber: 0.0.0.0
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (British)
CharacterSet: Unicode
No data.
screenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
548
Monitored processes
396
Malicious processes
29
Suspicious processes
15

Behavior graph

Click at the process to see the details
start 2025-05-15_a405964beb1cfaca126d6e509845fd67_agent-tesla_amadey_black-basta_cobalt-strike_darkgate_elex_luca-stealer.exe no specs cmd.exe no specs conhost.exe no specs mshta.exe no specs schtasks.exe no specs powershell.exe conhost.exe no specs mshta.exe no specs powershell.exe conhost.exe no specs tempxp6irx3fjxh9mja1do1jf5hscxcjszgd.exe #AMADEY ramez.exe 019642107b.exe cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs chcp.com no specs reg.exe no specs nircmd.exe no specs cmd.exe conhost.exe no specs cmd.exe no specs conhost.exe no specs chcp.com no specs reg.exe no specs reg.exe no specs nsudolg.exe no specs cmd.exe conhost.exe no specs cmd.exe conhost.exe no specs chcp.com no specs reg.exe no specs reg.exe no specs mode.com no specs cmd.exe no specs reg.exe no specs find.exe no specs cmd.exe no specs tasklist.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs find.exe no specs nsudolg.exe no specs powershell.exe no specs conhost.exe no specs 019642107b.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs chcp.com no specs reg.exe no specs nircmd.exe no specs cmd.exe conhost.exe no specs reg.exe no specs find.exe no specs cmd.exe no specs findstr.exe no specs 7z.exe bqxuv7c.exe cmd.exe no specs conhost.exe no specs unlocker.exe no specs chcp.com no specs reg.exe no specs reg.exe no specs nsudolg.exe no specs cmd.exe conhost.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs chcp.com no specs sc.exe no specs cmd.exe no specs conhost.exe no specs reg.exe no specs reg.exe no specs mode.com no specs taskkill.exe no specs cmd.exe no specs reg.exe no specs find.exe no specs cmd.exe no specs reg.exe no specs tasklist.exe no specs reg.exe no specs reg.exe no specs sc.exe no specs find.exe no specs sc.exe no specs sc.exe no specs unlocker.exe reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs cmd.exe no specs conhost.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs sc.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs find.exe no specs nsudolg.exe no specs powershell.exe no specs conhost.exe no specs iobitunlocker.exe no specs reg.exe no specs find.exe no specs #LUMMA svchost.exe cmd.exe no specs findstr.exe no specs 7z.exe no specs unlocker.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs sc.exe no specs iobitunlocker.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs ramez.exe no specs unlocker.exe cmd.exe no specs conhost.exe no specs sc.exe no specs werfault.exe no specs sc.exe no specs sc.exe no specs #GCLEANER 0568e64901.exe e5jg7mm.exe no specs slui.exe #GCLEANER ra02w4s.exe svchost.exe j6j70wm.exe no specs #LUMMA msbuild.exe 08iyoof.exe no specs lcdrmzimqi.exe lcdrmzimqi.tmp #LUMMA msbuild.exe globalsynapse297.exe powershell.exe no specs conhost.exe no specs hhhpsdwzgwqux.exe hhhpsdwzgwqux.tmp globalsynapse297.exe no specs powershell.exe no specs conhost.exe no specs zaggtuydn.exe ramez.exe no specs 8lmt2897ri.exe no specs lbskrrkcq.exe lbskrrkcq.tmp globalsynapse297.exe no specs powershell.exe no specs conhost.exe no specs 2fdaf168.exe rnqt4xi6v.exe no specs 3rradmr.exe pxjirb2uz.exe no specs launcherr.exe no specs cmd.exe no specs conhost.exe no specs choice.exe no specs chrome.exe powershell.exe no specs conhost.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs csc.exe cvtres.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs 1aa5281f28.exe 1aa5281f28.tmp info.exe conhost.exe no specs core.exe chrome.exe no specs msbuild.exe no specs launcherr.exe no specs chrome.exe no specs powershell.exe no specs conhost.exe no specs chrome.exe no specs chrome.exe no specs powershell.exe no specs chrome.exe no specs conhost.exe no specs chrome.exe no specs powershell.exe no specs chrome.exe no specs conhost.exe no specs chrome.exe no specs powershell.exe no specs conhost.exe no specs chrome.exe no specs chrome.exe no specs powershell.exe no specs conhost.exe no specs chrome.exe no specs chrome.exe no specs powershell.exe no specs conhost.exe no specs chrome.exe no specs chrome.exe no specs powershell.exe no specs conhost.exe no specs chrome.exe no specs werfault.exe no specs chrome.exe no specs powershell.exe no specs conhost.exe no specs chrome.exe no specs chrome.exe no specs powershell.exe no specs conhost.exe no specs chrome.exe no specs chrome.exe no specs powershell.exe no specs conhost.exe no specs chrome.exe no specs chrome.exe no specs powershell.exe no specs conhost.exe no specs chrome.exe no specs chrome.exe no specs powershell.exe no specs conhost.exe no specs chrome.exe no specs csc.exe csc.exe chrome.exe no specs powershell.exe no specs cvtres.exe no specs conhost.exe no specs chrome.exe no specs csc.exe csc.exe chrome.exe no specs f5919a7505.exe powershell.exe no specs chrome.exe no specs cvtres.exe no specs conhost.exe no specs csc.exe cvtres.exe no specs cvtres.exe no specs msbuild.exe csc.exe cvtres.exe no specs cvtres.exe no specs csc.exe no specs werfault.exe no specs csc.exe no specs csc.exe no specs cvtres.exe no specs cvtres.exe no specs csc.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
136reg delete "HKLM\System\CurrentControlset\Services\WdFilter" /fC:\Windows\System32\reg.execmd.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Registry Console Tool
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ws2_32.dll
140schtasks /Delete /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /fC:\Windows\System32\schtasks.execmd.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Task Scheduler Configuration Tool
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
496reg query "HKLM\System\CurrentControlSet\Services\WdNisDrv" C:\Windows\System32\reg.execmd.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Registry Console Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ws2_32.dll
644reg query HKLM\System\CurrentControlset\Services\WdFilter C:\Windows\System32\reg.execmd.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Registry Console Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ws2_32.dll
644C:\WINDOWS\system32\cmd.exe /c tasklistC:\Windows\System32\cmd.execmd.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
684reg query "HKLM\System\CurrentControlSet\Services\SecurityHealthService" C:\Windows\System32\reg.execmd.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Registry Console Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ws2_32.dll
732sc query WinDefend C:\Windows\System32\sc.execmd.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Service Control Manager Configuration Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
776\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exepowershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
780sc stop "Sense" C:\Windows\System32\sc.execmd.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Service Control Manager Configuration Tool
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
896sc config "MsSecFlt" start= disabled C:\Windows\System32\sc.execmd.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Service Control Manager Configuration Tool
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
Total events
160 282
Read events
159 891
Write events
248
Delete events
143

Modification events

(PID) Process:(7752) mshta.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(7752) mshta.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(7752) mshta.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(8068) mshta.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(8068) mshta.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(8068) mshta.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(7900) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(7900) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(7900) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(7900) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:FileTracingMask
Value:
Executable files
131
Suspicious files
65
Text files
121
Unknown types
0

Dropped files

PID
Process
Filename
Type
7900powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_mldzcqsy.ktn.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
7900powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_c5odoqnt.zne.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
77162025-05-15_a405964beb1cfaca126d6e509845fd67_agent-tesla_amadey_black-basta_cobalt-strike_darkgate_elex_luca-stealer.exeC:\Users\admin\AppData\Local\Temp\Do8p3K409.htahtml
MD5:2612A84049E89949DAB6A1BE4B1EE04C
SHA256:48AD5CC1DF5960AE4E1B6E7F043D53DED3D1DC7473A587D0E536A9AE184285B6
7388ramez.exeC:\Users\admin\AppData\Local\Temp\10120900101\019642107b.exeexecutable
MD5:CA5CA0BF0D0CD9DA31DAA7190D0175E7
SHA256:926BA1F8EFD8BBA4FF2AB9D1AA0B0E6D112C66DDBE58FEB2B4756C57E7433ED3
8144powershell.exeC:\Users\admin\AppData\Local\TempXP6IRX3FJXH9MJA1DO1JF5HSCXCJSZGD.EXEexecutable
MD5:2B69EB113E53BAD1F83CCB0860132259
SHA256:6106AD94A9BD221C90431E79F703D36F55BFEF6711D3F947870293490B68C12B
2236019642107b.exeC:\Users\admin\AppData\Local\Temp\Work\7z.exeexecutable
MD5:426CCB645E50A3143811CFA0E42E2BA6
SHA256:CF878BFBD9ED93DC551AC038AFF8A8BBA4C935DDF8D48E62122BDDFDB3E08567
7356TempXP6IRX3FJXH9MJA1DO1JF5HSCXCJSZGD.EXEC:\Windows\Tasks\ramez.jobbinary
MD5:520E0209DF6804DA870381D5FEB727D0
SHA256:A3E042B2471BB3A810F1585353A1F131AA6C3907B9471125246F2D07A7DD3C56
8144powershell.exeC:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractivebinary
MD5:BD75EC693381D1FA02058C85C20BCCAA
SHA256:A245764AB7579A784CCEDF948AEC9474CA920FDA6EA3BE8E7901DE3125B0DB54
2236019642107b.exeC:\Users\admin\AppData\Local\Temp\Work\cecho.exeexecutable
MD5:E783BC59D0ED6CFBD8891F94AE23D1B3
SHA256:5C1211559DDA10592CFEDD57681F18F4A702410816D36EDA95AEE6C74E3C6A47
7356TempXP6IRX3FJXH9MJA1DO1JF5HSCXCJSZGD.EXEC:\Users\admin\AppData\Local\Temp\d610cf342e\ramez.exeexecutable
MD5:26CC5A6CFD8E8ECC433337413C14CDDB
SHA256:2D904D576B46236BAF504DBA21775F6EBBBD0F65272A9C2FCA1C6798184FA4E8
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
407
TCP/UDP connections
144
DNS requests
79
Threats
103

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
7900
powershell.exe
GET
200
185.156.72.2:80
http://185.156.72.2/testmine/random.exe
unknown
unknown
2104
svchost.exe
GET
200
104.124.11.58:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
whitelisted
2104
svchost.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
whitelisted
7388
ramez.exe
POST
200
185.156.72.96:80
http://185.156.72.96/te4h2nus/index.php
unknown
malicious
7388
ramez.exe
GET
200
185.156.72.2:80
http://185.156.72.2/newdef/random.exe
unknown
unknown
7388
ramez.exe
POST
200
185.156.72.96:80
http://185.156.72.96/te4h2nus/index.php
unknown
malicious
6388
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%202.1.crl
unknown
whitelisted
7388
ramez.exe
POST
200
185.156.72.96:80
http://185.156.72.96/te4h2nus/index.php
unknown
malicious
6388
SIHClient.exe
GET
200
23.216.77.38:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl
unknown
whitelisted
6388
SIHClient.exe
GET
200
23.216.77.38:80
http://crl.microsoft.com/pki/crl/products/MicTimStaPCA_2010-07-01.crl
unknown
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
whitelisted
4.231.128.59:443
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2104
svchost.exe
4.231.128.59:443
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
whitelisted
3216
svchost.exe
172.211.123.250:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
2104
svchost.exe
104.124.11.58:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
2104
svchost.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
6544
svchost.exe
40.126.32.74:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
7900
powershell.exe
185.156.72.2:80
Tov Vaiz Partner
RU
unknown
7388
ramez.exe
185.156.72.96:80
Tov Vaiz Partner
RU
malicious

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.185.142
whitelisted
client.wns.windows.com
  • 172.211.123.250
  • 172.211.123.248
whitelisted
crl.microsoft.com
  • 104.124.11.58
  • 104.124.11.17
  • 23.216.77.38
  • 23.216.77.29
  • 23.216.77.32
  • 23.216.77.31
  • 23.216.77.37
  • 23.216.77.27
  • 23.216.77.35
  • 23.216.77.28
  • 23.216.77.25
whitelisted
www.microsoft.com
  • 95.101.149.131
  • 184.30.21.171
whitelisted
login.live.com
  • 40.126.32.74
  • 20.190.160.20
  • 20.190.160.2
  • 40.126.32.133
  • 40.126.32.76
  • 20.190.160.67
  • 20.190.160.66
  • 40.126.32.134
whitelisted
settings-win.data.microsoft.com
  • 40.127.240.158
  • 51.104.136.2
whitelisted
slscr.update.microsoft.com
  • 52.149.20.212
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.3.187.198
whitelisted
tortoisgfe.top
malicious
orjinalecza.net
malicious

Threats

PID
Process
Class
Message
7900
powershell.exe
Misc Attack
ET DROP Spamhaus DROP Listed Traffic Inbound group 34
7900
powershell.exe
Potentially Bad Traffic
ET INFO Executable Download from dotted-quad Host
7900
powershell.exe
Potential Corporate Privacy Violation
ET INFO PE EXE or DLL Windows file download HTTP
7900
powershell.exe
Misc activity
ET INFO Packed Executable Download
7900
powershell.exe
Potentially Bad Traffic
ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response
7900
powershell.exe
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
7388
ramez.exe
Misc Attack
ET DROP Spamhaus DROP Listed Traffic Inbound group 34
7388
ramez.exe
Malware Command and Control Activity Detected
BOTNET [ANY.RUN] Amadey HTTP POST Request (st=s)
7388
ramez.exe
Malware Command and Control Activity Detected
ET MALWARE Amadey CnC Response
7388
ramez.exe
Potentially Bad Traffic
ET INFO Executable Download from dotted-quad Host
No debug info