File name:

2025-05-15_a405964beb1cfaca126d6e509845fd67_agent-tesla_amadey_black-basta_cobalt-strike_darkgate_elex_luca-stealer

Full analysis: https://app.any.run/tasks/c9f66a08-fef1-46c6-9e5c-b708c473fea5
Verdict: Malicious activity
Threats:

Amadey is a formidable Windows infostealer threat, characterized by its persistence mechanisms, modular design, and ability to execute various malicious tasks.

Analysis date: May 15, 2025, 21:19:11
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
auto-sch
loader
amadey
botnet
stealer
auto-reg
lumma
rdp
evasion
gcleaner
telegram
stealc
vidar
arch-exec
auto
generic
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:

A405964BEB1CFACA126D6E509845FD67

SHA1:

6A0DE57BEECEFF4F7177ABCB11E07BB8597387CC

SHA256:

A73AC127EB2D6708AFC25BBCC9C3BDD19B607E0E1F7A03B48FC361611A9FB61A

SSDEEP:

49152:KPPkzemqoSut3Jh4+QQ/btosJwIA4hHmZlKH2Tw/Pq83zw0bCjvk9G661QGtBHXo:AP/mp7t3T4+B/btosJwIA4hHmZlKH2Tb

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Uses Task Scheduler to run other applications

      • cmd.exe (PID: 7736)
    • Run PowerShell with an invisible window

      • powershell.exe (PID: 7900)
      • powershell.exe (PID: 8144)
    • Request from PowerShell that ran from MSHTA.EXE

      • powershell.exe (PID: 7900)
    • Script downloads file (POWERSHELL)

      • powershell.exe (PID: 8144)
      • powershell.exe (PID: 7900)
    • AMADEY mutex has been found

      • TempXP6IRX3FJXH9MJA1DO1JF5HSCXCJSZGD.EXE (PID: 7356)
      • ramez.exe (PID: 7388)
    • AMADEY has been detected (SURICATA)

      • ramez.exe (PID: 7388)
    • Connects to the CnC server

      • ramez.exe (PID: 7388)
      • svchost.exe (PID: 2196)
    • AMADEY has been detected (YARA)

      • ramez.exe (PID: 7388)
    • Changes the autorun value in the registry

      • ramez.exe (PID: 7388)
    • Adds path to the Windows Defender exclusion list

      • cmd.exe (PID: 7984)
      • NSudoLG.exe (PID: 5728)
      • cmd.exe (PID: 5380)
      • NSudoLG.exe (PID: 6080)
    • Changes Windows Defender settings

      • NSudoLG.exe (PID: 5728)
      • NSudoLG.exe (PID: 6080)
    • LUMMA has been detected (SURICATA)

      • svchost.exe (PID: 2196)
      • MSBuild.exe (PID: 2236)
      • MSBuild.exe (PID: 5048)
    • Starts SC.EXE for service management

      • cmd.exe (PID: 7984)
    • Executing a file with an untrusted certificate

      • ra02W4S.exe (PID: 2984)
      • j6J70wm.exe (PID: 7648)
    • GCLEANER has been detected (SURICATA)

      • 0568e64901.exe (PID: 5008)
      • ra02W4S.exe (PID: 2984)
    • Stealers network behavior

      • svchost.exe (PID: 2196)
    • GENERIC has been found (auto)

      • 0568e64901.exe (PID: 5008)
  • SUSPICIOUS

    • Starts CMD.EXE for commands execution

      • 2025-05-15_a405964beb1cfaca126d6e509845fd67_agent-tesla_amadey_black-basta_cobalt-strike_darkgate_elex_luca-stealer.exe (PID: 7716)
      • 019642107b.exe (PID: 2236)
      • cmd.exe (PID: 7224)
      • nircmd.exe (PID: 7148)
      • cmd.exe (PID: 7672)
      • NSudoLG.exe (PID: 7740)
      • cmd.exe (PID: 7840)
      • cmd.exe (PID: 7984)
      • 019642107b.exe (PID: 1628)
      • cmd.exe (PID: 7588)
      • nircmd.exe (PID: 7660)
      • cmd.exe (PID: 7848)
      • NSudoLG.exe (PID: 1012)
      • Unlocker.exe (PID: 8112)
      • cmd.exe (PID: 2040)
      • cmd.exe (PID: 5380)
      • Unlocker.exe (PID: 7632)
      • Unlocker.exe (PID: 3884)
      • svchost.exe (PID: 2332)
      • Unlocker.exe (PID: 7992)
      • 3rrAdmR.exe (PID: 7548)
    • Starts process via Powershell

      • powershell.exe (PID: 7900)
      • powershell.exe (PID: 8144)
    • Starts POWERSHELL.EXE for commands execution

      • mshta.exe (PID: 7752)
      • mshta.exe (PID: 8068)
      • NSudoLG.exe (PID: 5728)
      • NSudoLG.exe (PID: 6080)
      • globalsynapse297.exe (PID: 4000)
      • globalsynapse297.exe (PID: 4652)
      • globalsynapse297.exe (PID: 6264)
      • ZAGgtuYDN.exe (PID: 7304)
    • Manipulates environment variables

      • powershell.exe (PID: 7900)
      • powershell.exe (PID: 8144)
    • Probably download files using WebClient

      • mshta.exe (PID: 7752)
      • mshta.exe (PID: 8068)
    • Found IP address in command line

      • powershell.exe (PID: 7900)
      • powershell.exe (PID: 8144)
    • Executable content was dropped or overwritten

      • powershell.exe (PID: 8144)
      • TempXP6IRX3FJXH9MJA1DO1JF5HSCXCJSZGD.EXE (PID: 7356)
      • ramez.exe (PID: 7388)
      • 019642107b.exe (PID: 2236)
      • 7z.exe (PID: 7792)
      • Unlocker.exe (PID: 7632)
      • cmd.exe (PID: 7984)
      • 0568e64901.exe (PID: 5008)
      • LcDRMzImqI.exe (PID: 7656)
      • LcDRMzImqI.tmp (PID: 7856)
      • globalsynapse297.exe (PID: 4000)
      • ra02W4S.exe (PID: 2984)
      • HHhpSdwZgwqUX.exe (PID: 7348)
      • HHhpSdwZgwqUX.tmp (PID: 8052)
      • lBskrrKCq.exe (PID: 4692)
      • lBskrrKCq.tmp (PID: 7364)
      • 2fdaf168.exe (PID: 6324)
      • 3rrAdmR.exe (PID: 7548)
      • csc.exe (PID: 8792)
      • 1aa5281f28.exe (PID: 9000)
      • 1aa5281f28.tmp (PID: 9092)
      • csc.exe (PID: 10384)
      • csc.exe (PID: 10528)
      • csc.exe (PID: 10712)
      • csc.exe (PID: 10748)
      • csc.exe (PID: 8460)
      • csc.exe (PID: 11036)
    • Process requests binary or script from the Internet

      • powershell.exe (PID: 7900)
      • ramez.exe (PID: 7388)
    • Connects to the server without a host name

      • powershell.exe (PID: 7900)
      • ramez.exe (PID: 7388)
      • svchost.exe (PID: 2332)
      • 0568e64901.exe (PID: 5008)
      • ra02W4S.exe (PID: 2984)
    • Potential Corporate Privacy Violation

      • powershell.exe (PID: 7900)
      • ramez.exe (PID: 7388)
      • 0568e64901.exe (PID: 5008)
      • ra02W4S.exe (PID: 2984)
    • Reads security settings of Internet Explorer

      • TempXP6IRX3FJXH9MJA1DO1JF5HSCXCJSZGD.EXE (PID: 7356)
      • ramez.exe (PID: 7388)
      • 019642107b.exe (PID: 2236)
      • nircmd.exe (PID: 7148)
      • 019642107b.exe (PID: 1628)
      • nircmd.exe (PID: 7660)
      • Unlocker.exe (PID: 8112)
      • Unlocker.exe (PID: 7632)
      • Unlocker.exe (PID: 3884)
    • Contacting a server suspected of hosting an CnC

      • ramez.exe (PID: 7388)
      • svchost.exe (PID: 2196)
      • MSBuild.exe (PID: 2236)
      • MSBuild.exe (PID: 5048)
    • There is functionality for taking screenshot (YARA)

      • ramez.exe (PID: 7388)
    • There is functionality for enable RDP (YARA)

      • ramez.exe (PID: 7388)
    • Starts itself from another location

      • TempXP6IRX3FJXH9MJA1DO1JF5HSCXCJSZGD.EXE (PID: 7356)
    • Drops 7-zip archiver for unpacking

      • 019642107b.exe (PID: 2236)
    • Executing commands from a ".bat" file

      • 019642107b.exe (PID: 2236)
      • cmd.exe (PID: 7224)
      • nircmd.exe (PID: 7148)
      • cmd.exe (PID: 7672)
      • NSudoLG.exe (PID: 7740)
      • cmd.exe (PID: 7840)
      • cmd.exe (PID: 7588)
      • 019642107b.exe (PID: 1628)
      • nircmd.exe (PID: 7660)
      • cmd.exe (PID: 7848)
      • cmd.exe (PID: 2040)
      • NSudoLG.exe (PID: 1012)
    • The process creates files with name similar to system file names

      • 019642107b.exe (PID: 2236)
    • The executable file from the user directory is run by the CMD process

      • nircmd.exe (PID: 7148)
      • NSudoLG.exe (PID: 7740)
      • NSudoLG.exe (PID: 5728)
      • nircmd.exe (PID: 7660)
      • 7z.exe (PID: 7792)
      • NSudoLG.exe (PID: 1012)
      • Unlocker.exe (PID: 8112)
      • Unlocker.exe (PID: 7632)
      • NSudoLG.exe (PID: 6080)
      • 7z.exe (PID: 8048)
      • Unlocker.exe (PID: 3884)
      • Unlocker.exe (PID: 7992)
    • Application launched itself

      • cmd.exe (PID: 7224)
      • cmd.exe (PID: 7672)
      • cmd.exe (PID: 7840)
      • cmd.exe (PID: 7984)
      • cmd.exe (PID: 7588)
      • cmd.exe (PID: 7848)
      • cmd.exe (PID: 2040)
      • cmd.exe (PID: 5380)
    • Starts application with an unusual extension

      • cmd.exe (PID: 3956)
      • cmd.exe (PID: 6964)
      • cmd.exe (PID: 7984)
      • cmd.exe (PID: 7600)
      • cmd.exe (PID: 7784)
      • cmd.exe (PID: 5380)
    • Reads the date of Windows installation

      • nircmd.exe (PID: 7148)
      • Unlocker.exe (PID: 8112)
      • nircmd.exe (PID: 7660)
      • Unlocker.exe (PID: 7632)
      • Unlocker.exe (PID: 3884)
    • Uses REG/REGEDIT.EXE to modify registry

      • cmd.exe (PID: 6964)
      • cmd.exe (PID: 7984)
      • cmd.exe (PID: 7784)
      • cmd.exe (PID: 5380)
    • Get information on the list of running processes

      • cmd.exe (PID: 5436)
      • cmd.exe (PID: 7984)
      • cmd.exe (PID: 5380)
      • cmd.exe (PID: 644)
    • PowerShell delay command usage (probably sleep evasion)

      • powershell.exe (PID: 4452)
      • powershell.exe (PID: 5360)
    • Script adds exclusion path to Windows Defender

      • NSudoLG.exe (PID: 5728)
      • NSudoLG.exe (PID: 6080)
    • Using 'findstr.exe' to search for text patterns in files and output

      • cmd.exe (PID: 7984)
      • cmd.exe (PID: 5380)
    • Windows service management via SC.EXE

      • sc.exe (PID: 8008)
      • sc.exe (PID: 7236)
      • sc.exe (PID: 732)
      • sc.exe (PID: 2504)
      • sc.exe (PID: 7680)
      • sc.exe (PID: 5592)
      • sc.exe (PID: 4784)
      • sc.exe (PID: 6036)
      • sc.exe (PID: 7412)
      • sc.exe (PID: 7840)
      • sc.exe (PID: 7864)
      • sc.exe (PID: 2268)
      • sc.exe (PID: 5036)
      • sc.exe (PID: 5072)
      • sc.exe (PID: 7872)
      • sc.exe (PID: 1040)
      • sc.exe (PID: 4868)
      • sc.exe (PID: 2804)
      • sc.exe (PID: 2428)
      • sc.exe (PID: 2228)
      • sc.exe (PID: 7736)
      • sc.exe (PID: 7844)
      • sc.exe (PID: 7188)
      • sc.exe (PID: 7948)
      • sc.exe (PID: 8056)
      • sc.exe (PID: 8048)
      • sc.exe (PID: 3180)
      • sc.exe (PID: 7952)
      • sc.exe (PID: 1184)
      • sc.exe (PID: 1324)
      • sc.exe (PID: 7668)
      • sc.exe (PID: 1676)
      • sc.exe (PID: 2516)
      • sc.exe (PID: 7928)
      • sc.exe (PID: 7396)
      • sc.exe (PID: 7528)
      • sc.exe (PID: 896)
      • sc.exe (PID: 7832)
      • sc.exe (PID: 7340)
      • sc.exe (PID: 6228)
      • sc.exe (PID: 8032)
      • sc.exe (PID: 7520)
      • sc.exe (PID: 5176)
    • Starts SC.EXE for service management

      • cmd.exe (PID: 4380)
      • cmd.exe (PID: 7984)
      • cmd.exe (PID: 7296)
      • cmd.exe (PID: 968)
      • cmd.exe (PID: 4272)
      • cmd.exe (PID: 7544)
      • cmd.exe (PID: 2140)
    • Uses TASKKILL.EXE to kill process

      • cmd.exe (PID: 8012)
      • cmd.exe (PID: 7576)
    • Reads the BIOS version

      • bqxUv7C.exe (PID: 7788)
    • Drops a system driver (possible attempt to evade defenses)

      • Unlocker.exe (PID: 7632)
      • 2fdaf168.exe (PID: 6324)
    • Stops a currently running service

      • sc.exe (PID: 1184)
      • sc.exe (PID: 2600)
      • sc.exe (PID: 4528)
      • sc.exe (PID: 8068)
      • sc.exe (PID: 780)
      • sc.exe (PID: 7232)
      • sc.exe (PID: 6736)
      • sc.exe (PID: 6828)
      • sc.exe (PID: 2632)
      • sc.exe (PID: 6712)
      • sc.exe (PID: 7944)
      • sc.exe (PID: 1132)
      • sc.exe (PID: 7608)
      • sc.exe (PID: 7436)
      • sc.exe (PID: 2960)
      • sc.exe (PID: 1116)
      • sc.exe (PID: 3176)
      • sc.exe (PID: 7824)
    • Creates or modifies Windows services

      • Unlocker.exe (PID: 7632)
      • Unlocker.exe (PID: 3884)
    • Process drops legitimate windows executable

      • cmd.exe (PID: 7984)
      • ramez.exe (PID: 7388)
      • LcDRMzImqI.tmp (PID: 7856)
      • HHhpSdwZgwqUX.tmp (PID: 8052)
      • lBskrrKCq.tmp (PID: 7364)
    • Deletes scheduled task without confirmation

      • schtasks.exe (PID: 140)
      • schtasks.exe (PID: 7588)
      • schtasks.exe (PID: 7408)
      • schtasks.exe (PID: 6564)
      • schtasks.exe (PID: 7620)
    • The process executes via Task Scheduler

      • ramez.exe (PID: 7180)
      • ramez.exe (PID: 4304)
    • Executes application which crashes

      • Unlocker.exe (PID: 7992)
      • core.exe (PID: 8400)
      • f5919a7505.exe (PID: 10792)
    • Checks for external IP

      • svchost.exe (PID: 2196)
      • svchost.exe (PID: 2332)
    • Starts a Microsoft application from unusual location

      • j6J70wm.exe (PID: 7648)
      • 08IyOOF.exe (PID: 7556)
    • The process drops C-runtime libraries

      • LcDRMzImqI.tmp (PID: 7856)
    • Process communicates with Telegram (possibly using it as an attacker's C2 server)

      • ZAGgtuYDN.exe (PID: 7304)
    • Base64-obfuscated command line is found

      • ZAGgtuYDN.exe (PID: 7304)
    • Connects to unusual port

      • 3rrAdmR.exe (PID: 7548)
    • CSC.EXE is used to compile C# code

      • csc.exe (PID: 8792)
      • csc.exe (PID: 10384)
      • csc.exe (PID: 10528)
      • csc.exe (PID: 10712)
      • csc.exe (PID: 10748)
      • csc.exe (PID: 11036)
      • csc.exe (PID: 8460)
      • csc.exe (PID: 10668)
      • csc.exe (PID: 4276)
      • csc.exe (PID: 10852)
      • csc.exe (PID: 7816)
    • BASE64 encoded PowerShell command has been detected

      • ZAGgtuYDN.exe (PID: 7304)
    • The process bypasses the loading of PowerShell profile settings

      • ZAGgtuYDN.exe (PID: 7304)
    • The process hide an interactive prompt from the user

      • ZAGgtuYDN.exe (PID: 7304)
  • INFO

    • The sample compiled with english language support

      • 2025-05-15_a405964beb1cfaca126d6e509845fd67_agent-tesla_amadey_black-basta_cobalt-strike_darkgate_elex_luca-stealer.exe (PID: 7716)
      • 019642107b.exe (PID: 2236)
      • Unlocker.exe (PID: 7632)
      • cmd.exe (PID: 7984)
      • ramez.exe (PID: 7388)
      • LcDRMzImqI.tmp (PID: 7856)
      • HHhpSdwZgwqUX.tmp (PID: 8052)
      • ra02W4S.exe (PID: 2984)
      • lBskrrKCq.tmp (PID: 7364)
      • 2fdaf168.exe (PID: 6324)
      • 0568e64901.exe (PID: 5008)
    • Checks supported languages

      • 2025-05-15_a405964beb1cfaca126d6e509845fd67_agent-tesla_amadey_black-basta_cobalt-strike_darkgate_elex_luca-stealer.exe (PID: 7716)
      • TempXP6IRX3FJXH9MJA1DO1JF5HSCXCJSZGD.EXE (PID: 7356)
      • ramez.exe (PID: 7388)
      • 019642107b.exe (PID: 2236)
      • chcp.com (PID: 7596)
      • nircmd.exe (PID: 7148)
      • NSudoLG.exe (PID: 7740)
      • chcp.com (PID: 7764)
      • chcp.com (PID: 8104)
      • mode.com (PID: 6512)
      • NSudoLG.exe (PID: 5728)
      • 019642107b.exe (PID: 1628)
      • nircmd.exe (PID: 7660)
      • chcp.com (PID: 7572)
      • 7z.exe (PID: 7792)
      • bqxUv7C.exe (PID: 7788)
      • Unlocker.exe (PID: 8112)
      • chcp.com (PID: 5984)
      • NSudoLG.exe (PID: 1012)
      • chcp.com (PID: 8152)
      • mode.com (PID: 7904)
      • NSudoLG.exe (PID: 6080)
      • Unlocker.exe (PID: 7632)
      • IObitUnlocker.exe (PID: 4688)
      • 7z.exe (PID: 8048)
      • Unlocker.exe (PID: 3884)
      • IObitUnlocker.exe (PID: 7640)
    • Reads mouse settings

      • 2025-05-15_a405964beb1cfaca126d6e509845fd67_agent-tesla_amadey_black-basta_cobalt-strike_darkgate_elex_luca-stealer.exe (PID: 7716)
    • Reads the computer name

      • 2025-05-15_a405964beb1cfaca126d6e509845fd67_agent-tesla_amadey_black-basta_cobalt-strike_darkgate_elex_luca-stealer.exe (PID: 7716)
      • TempXP6IRX3FJXH9MJA1DO1JF5HSCXCJSZGD.EXE (PID: 7356)
      • ramez.exe (PID: 7388)
      • 019642107b.exe (PID: 2236)
      • nircmd.exe (PID: 7148)
      • NSudoLG.exe (PID: 7740)
      • NSudoLG.exe (PID: 5728)
      • 019642107b.exe (PID: 1628)
      • nircmd.exe (PID: 7660)
      • 7z.exe (PID: 7792)
      • Unlocker.exe (PID: 8112)
      • NSudoLG.exe (PID: 1012)
      • Unlocker.exe (PID: 7632)
      • bqxUv7C.exe (PID: 7788)
      • NSudoLG.exe (PID: 6080)
      • IObitUnlocker.exe (PID: 4688)
      • 7z.exe (PID: 8048)
      • Unlocker.exe (PID: 3884)
      • IObitUnlocker.exe (PID: 7640)
    • Auto-launch of the file from Task Scheduler

      • cmd.exe (PID: 7736)
    • Create files in a temporary directory

      • 2025-05-15_a405964beb1cfaca126d6e509845fd67_agent-tesla_amadey_black-basta_cobalt-strike_darkgate_elex_luca-stealer.exe (PID: 7716)
      • TempXP6IRX3FJXH9MJA1DO1JF5HSCXCJSZGD.EXE (PID: 7356)
      • ramez.exe (PID: 7388)
      • 019642107b.exe (PID: 2236)
      • 019642107b.exe (PID: 1628)
      • 7z.exe (PID: 7792)
    • Reads Internet Explorer settings

      • mshta.exe (PID: 7752)
      • mshta.exe (PID: 8068)
    • Manual execution by a user

      • mshta.exe (PID: 8068)
      • 019642107b.exe (PID: 1628)
      • launcherr.exe (PID: 8828)
    • Disables trace logs

      • powershell.exe (PID: 7900)
    • Checks proxy server information

      • powershell.exe (PID: 7900)
      • ramez.exe (PID: 7388)
    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 8144)
      • powershell.exe (PID: 4452)
    • The executable file from the user directory is run by the Powershell process

      • TempXP6IRX3FJXH9MJA1DO1JF5HSCXCJSZGD.EXE (PID: 7356)
    • Creates files or folders in the user directory

      • ramez.exe (PID: 7388)
    • Process checks computer location settings

      • TempXP6IRX3FJXH9MJA1DO1JF5HSCXCJSZGD.EXE (PID: 7356)
      • 019642107b.exe (PID: 2236)
      • ramez.exe (PID: 7388)
      • nircmd.exe (PID: 7148)
      • 019642107b.exe (PID: 1628)
      • nircmd.exe (PID: 7660)
    • Changes the display of characters in the console

      • cmd.exe (PID: 3956)
      • cmd.exe (PID: 6964)
      • cmd.exe (PID: 7984)
      • cmd.exe (PID: 7600)
      • cmd.exe (PID: 7784)
      • cmd.exe (PID: 5380)
    • NirSoft software is detected

      • nircmd.exe (PID: 7148)
      • nircmd.exe (PID: 7660)
    • Starts MODE.COM to configure console settings

      • mode.com (PID: 6512)
      • mode.com (PID: 7904)
    • Checks operating system version

      • cmd.exe (PID: 7984)
      • cmd.exe (PID: 5380)
    • Auto-launch of the file from Registry key

      • ramez.exe (PID: 7388)
    • Checks if a key exists in the options dictionary (POWERSHELL)

      • powershell.exe (PID: 4452)
    • Reads the machine GUID from the registry

      • Unlocker.exe (PID: 8112)
      • Unlocker.exe (PID: 7632)
      • Unlocker.exe (PID: 3884)
      • bqxUv7C.exe (PID: 7788)
    • Reads the software policy settings

      • bqxUv7C.exe (PID: 7788)
    • Changes the registry key values via Powershell

      • globalsynapse297.exe (PID: 4000)
      • globalsynapse297.exe (PID: 4652)
      • globalsynapse297.exe (PID: 6264)
    • Application launched itself

      • chrome.exe (PID: 8076)
      • chrome.exe (PID: 8904)
      • chrome.exe (PID: 8780)
      • chrome.exe (PID: 9300)
      • chrome.exe (PID: 9888)
      • chrome.exe (PID: 9560)
      • chrome.exe (PID: 9732)
      • chrome.exe (PID: 10072)
      • chrome.exe (PID: 9408)
      • chrome.exe (PID: 9260)
      • chrome.exe (PID: 8404)
      • chrome.exe (PID: 9704)
      • chrome.exe (PID: 9284)
      • chrome.exe (PID: 10536)
      • chrome.exe (PID: 10784)
    • Attempting to use instant messaging service

      • MSBuild.exe (PID: 11232)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (76.4)
.exe | Win32 Executable (generic) (12.4)
.exe | Generic Win/DOS Executable (5.5)
.exe | DOS Executable Generic (5.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2025:05:15 13:17:45+00:00
ImageFileCharacteristics: Executable, Large address aware, 32-bit
PEType: PE32
LinkerVersion: 14.16
CodeSize: 633856
InitializedDataSize: 326144
UninitializedDataSize: -
EntryPoint: 0x20577
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
FileVersionNumber: 0.0.0.0
ProductVersionNumber: 0.0.0.0
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (British)
CharacterSet: Unicode
No data.
screenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
548
Monitored processes
396
Malicious processes
29
Suspicious processes
15

Behavior graph

Click at the process to see the details
start 2025-05-15_a405964beb1cfaca126d6e509845fd67_agent-tesla_amadey_black-basta_cobalt-strike_darkgate_elex_luca-stealer.exe no specs cmd.exe no specs conhost.exe no specs mshta.exe no specs schtasks.exe no specs powershell.exe conhost.exe no specs mshta.exe no specs powershell.exe conhost.exe no specs tempxp6irx3fjxh9mja1do1jf5hscxcjszgd.exe #AMADEY ramez.exe 019642107b.exe cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs chcp.com no specs reg.exe no specs nircmd.exe no specs cmd.exe conhost.exe no specs cmd.exe no specs conhost.exe no specs chcp.com no specs reg.exe no specs reg.exe no specs nsudolg.exe no specs cmd.exe conhost.exe no specs cmd.exe conhost.exe no specs chcp.com no specs reg.exe no specs reg.exe no specs mode.com no specs cmd.exe no specs reg.exe no specs find.exe no specs cmd.exe no specs tasklist.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs find.exe no specs nsudolg.exe no specs powershell.exe no specs conhost.exe no specs 019642107b.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs chcp.com no specs reg.exe no specs nircmd.exe no specs cmd.exe conhost.exe no specs reg.exe no specs find.exe no specs cmd.exe no specs findstr.exe no specs 7z.exe bqxuv7c.exe cmd.exe no specs conhost.exe no specs unlocker.exe no specs chcp.com no specs reg.exe no specs reg.exe no specs nsudolg.exe no specs cmd.exe conhost.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs chcp.com no specs sc.exe no specs cmd.exe no specs conhost.exe no specs reg.exe no specs reg.exe no specs mode.com no specs taskkill.exe no specs cmd.exe no specs reg.exe no specs find.exe no specs cmd.exe no specs reg.exe no specs tasklist.exe no specs reg.exe no specs reg.exe no specs sc.exe no specs find.exe no specs sc.exe no specs sc.exe no specs unlocker.exe reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs cmd.exe no specs conhost.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs sc.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs find.exe no specs nsudolg.exe no specs powershell.exe no specs conhost.exe no specs iobitunlocker.exe no specs reg.exe no specs find.exe no specs #LUMMA svchost.exe cmd.exe no specs findstr.exe no specs 7z.exe no specs unlocker.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs sc.exe no specs iobitunlocker.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs ramez.exe no specs unlocker.exe cmd.exe no specs conhost.exe no specs sc.exe no specs werfault.exe no specs sc.exe no specs sc.exe no specs #GCLEANER 0568e64901.exe e5jg7mm.exe no specs slui.exe #GCLEANER ra02w4s.exe svchost.exe j6j70wm.exe no specs #LUMMA msbuild.exe 08iyoof.exe no specs lcdrmzimqi.exe lcdrmzimqi.tmp #LUMMA msbuild.exe globalsynapse297.exe powershell.exe no specs conhost.exe no specs hhhpsdwzgwqux.exe hhhpsdwzgwqux.tmp globalsynapse297.exe no specs powershell.exe no specs conhost.exe no specs zaggtuydn.exe ramez.exe no specs 8lmt2897ri.exe no specs lbskrrkcq.exe lbskrrkcq.tmp globalsynapse297.exe no specs powershell.exe no specs conhost.exe no specs 2fdaf168.exe rnqt4xi6v.exe no specs 3rradmr.exe pxjirb2uz.exe no specs launcherr.exe no specs cmd.exe no specs conhost.exe no specs choice.exe no specs chrome.exe powershell.exe no specs conhost.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs csc.exe cvtres.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs 1aa5281f28.exe 1aa5281f28.tmp info.exe conhost.exe no specs core.exe chrome.exe no specs msbuild.exe no specs launcherr.exe no specs chrome.exe no specs powershell.exe no specs conhost.exe no specs chrome.exe no specs chrome.exe no specs powershell.exe no specs chrome.exe no specs conhost.exe no specs chrome.exe no specs powershell.exe no specs chrome.exe no specs conhost.exe no specs chrome.exe no specs powershell.exe no specs conhost.exe no specs chrome.exe no specs chrome.exe no specs powershell.exe no specs conhost.exe no specs chrome.exe no specs chrome.exe no specs powershell.exe no specs conhost.exe no specs chrome.exe no specs chrome.exe no specs powershell.exe no specs conhost.exe no specs chrome.exe no specs werfault.exe no specs chrome.exe no specs powershell.exe no specs conhost.exe no specs chrome.exe no specs chrome.exe no specs powershell.exe no specs conhost.exe no specs chrome.exe no specs chrome.exe no specs powershell.exe no specs conhost.exe no specs chrome.exe no specs chrome.exe no specs powershell.exe no specs conhost.exe no specs chrome.exe no specs chrome.exe no specs powershell.exe no specs conhost.exe no specs chrome.exe no specs csc.exe csc.exe chrome.exe no specs powershell.exe no specs cvtres.exe no specs conhost.exe no specs chrome.exe no specs csc.exe csc.exe chrome.exe no specs f5919a7505.exe powershell.exe no specs chrome.exe no specs cvtres.exe no specs conhost.exe no specs csc.exe cvtres.exe no specs cvtres.exe no specs msbuild.exe csc.exe cvtres.exe no specs cvtres.exe no specs csc.exe no specs werfault.exe no specs csc.exe no specs csc.exe no specs cvtres.exe no specs cvtres.exe no specs csc.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
136reg delete "HKLM\System\CurrentControlset\Services\WdFilter" /fC:\Windows\System32\reg.execmd.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Registry Console Tool
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ws2_32.dll
140schtasks /Delete /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /fC:\Windows\System32\schtasks.execmd.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Task Scheduler Configuration Tool
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
496reg query "HKLM\System\CurrentControlSet\Services\WdNisDrv" C:\Windows\System32\reg.execmd.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Registry Console Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ws2_32.dll
644reg query HKLM\System\CurrentControlset\Services\WdFilter C:\Windows\System32\reg.execmd.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Registry Console Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ws2_32.dll
644C:\WINDOWS\system32\cmd.exe /c tasklistC:\Windows\System32\cmd.execmd.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
684reg query "HKLM\System\CurrentControlSet\Services\SecurityHealthService" C:\Windows\System32\reg.execmd.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Registry Console Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ws2_32.dll
732sc query WinDefend C:\Windows\System32\sc.execmd.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Service Control Manager Configuration Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
776\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exepowershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
780sc stop "Sense" C:\Windows\System32\sc.execmd.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Service Control Manager Configuration Tool
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
896sc config "MsSecFlt" start= disabled C:\Windows\System32\sc.execmd.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Service Control Manager Configuration Tool
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
Total events
160 282
Read events
159 891
Write events
248
Delete events
143

Modification events

(PID) Process:(7752) mshta.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(7752) mshta.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(7752) mshta.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(8068) mshta.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(8068) mshta.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(8068) mshta.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(7900) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(7900) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(7900) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(7900) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:FileTracingMask
Value:
Executable files
131
Suspicious files
65
Text files
121
Unknown types
0

Dropped files

PID
Process
Filename
Type
8144powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_zwxkg3nm.gto.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
7900powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_mldzcqsy.ktn.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
7900powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_c5odoqnt.zne.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
8144powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_qlwmsfce.ygg.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
2236019642107b.exeC:\Users\admin\AppData\Local\Temp\Work\cecho.exeexecutable
MD5:E783BC59D0ED6CFBD8891F94AE23D1B3
SHA256:5C1211559DDA10592CFEDD57681F18F4A702410816D36EDA95AEE6C74E3C6A47
7388ramez.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\RR3E01RZ\random[1].exeexecutable
MD5:CA5CA0BF0D0CD9DA31DAA7190D0175E7
SHA256:926BA1F8EFD8BBA4FF2AB9D1AA0B0E6D112C66DDBE58FEB2B4756C57E7433ED3
2236019642107b.exeC:\Users\admin\AppData\Local\Temp\Work\7z.exeexecutable
MD5:426CCB645E50A3143811CFA0E42E2BA6
SHA256:CF878BFBD9ED93DC551AC038AFF8A8BBA4C935DDF8D48E62122BDDFDB3E08567
2236019642107b.exeC:\Users\admin\AppData\Local\Temp\Work\DKTolz.zipcompressed
MD5:6B617C0196FE449E27C84532EC2C38E7
SHA256:E3528C57765074D5D73021F747B26EDEFA15227D0F1A3B80A6CDEF21322C99CA
4452powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_cxxdbxwg.zoj.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
2236019642107b.exeC:\Users\admin\AppData\Local\Temp\Work\nircmd.exeexecutable
MD5:4A9DA765FD91E80DECFD2C9FE221E842
SHA256:2E81E048AB419FDC6E5F4336A951BD282ED6B740048DC38D7673678EE3490CDA
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
407
TCP/UDP connections
144
DNS requests
79
Threats
103

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2104
svchost.exe
GET
200
104.124.11.58:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
whitelisted
7900
powershell.exe
GET
200
185.156.72.2:80
http://185.156.72.2/testmine/random.exe
unknown
unknown
2104
svchost.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
whitelisted
7388
ramez.exe
POST
200
185.156.72.96:80
http://185.156.72.96/te4h2nus/index.php
unknown
malicious
7388
ramez.exe
POST
200
185.156.72.96:80
http://185.156.72.96/te4h2nus/index.php
unknown
malicious
6388
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%202.1.crl
unknown
whitelisted
7388
ramez.exe
GET
200
185.156.72.2:80
http://185.156.72.2/newdef/random.exe
unknown
unknown
6388
SIHClient.exe
GET
200
23.216.77.38:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl
unknown
whitelisted
7388
ramez.exe
POST
200
185.156.72.96:80
http://185.156.72.96/te4h2nus/index.php
unknown
malicious
6388
SIHClient.exe
GET
200
23.216.77.38:80
http://crl.microsoft.com/pki/crl/products/MicTimStaPCA_2010-07-01.crl
unknown
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
whitelisted
4.231.128.59:443
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2104
svchost.exe
4.231.128.59:443
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
whitelisted
3216
svchost.exe
172.211.123.250:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
2104
svchost.exe
104.124.11.58:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
2104
svchost.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
6544
svchost.exe
40.126.32.74:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
7900
powershell.exe
185.156.72.2:80
Tov Vaiz Partner
RU
unknown
7388
ramez.exe
185.156.72.96:80
Tov Vaiz Partner
RU
malicious

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.185.142
whitelisted
client.wns.windows.com
  • 172.211.123.250
  • 172.211.123.248
whitelisted
crl.microsoft.com
  • 104.124.11.58
  • 104.124.11.17
  • 23.216.77.38
  • 23.216.77.29
  • 23.216.77.32
  • 23.216.77.31
  • 23.216.77.37
  • 23.216.77.27
  • 23.216.77.35
  • 23.216.77.28
  • 23.216.77.25
whitelisted
www.microsoft.com
  • 95.101.149.131
  • 184.30.21.171
whitelisted
login.live.com
  • 40.126.32.74
  • 20.190.160.20
  • 20.190.160.2
  • 40.126.32.133
  • 40.126.32.76
  • 20.190.160.67
  • 20.190.160.66
  • 40.126.32.134
whitelisted
settings-win.data.microsoft.com
  • 40.127.240.158
  • 51.104.136.2
whitelisted
slscr.update.microsoft.com
  • 52.149.20.212
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.3.187.198
whitelisted
tortoisgfe.top
malicious
orjinalecza.net
malicious

Threats

PID
Process
Class
Message
7900
powershell.exe
Misc Attack
ET DROP Spamhaus DROP Listed Traffic Inbound group 34
7900
powershell.exe
Potentially Bad Traffic
ET INFO Executable Download from dotted-quad Host
7900
powershell.exe
Potential Corporate Privacy Violation
ET INFO PE EXE or DLL Windows file download HTTP
7900
powershell.exe
Misc activity
ET INFO Packed Executable Download
7900
powershell.exe
Potentially Bad Traffic
ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response
7900
powershell.exe
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
7388
ramez.exe
Misc Attack
ET DROP Spamhaus DROP Listed Traffic Inbound group 34
7388
ramez.exe
Malware Command and Control Activity Detected
BOTNET [ANY.RUN] Amadey HTTP POST Request (st=s)
7388
ramez.exe
Malware Command and Control Activity Detected
ET MALWARE Amadey CnC Response
7388
ramez.exe
Potentially Bad Traffic
ET INFO Executable Download from dotted-quad Host
No debug info