File name:

random.exe

Full analysis: https://app.any.run/tasks/9bceb21c-8c84-4812-a86e-b20001984fed
Verdict: Malicious activity
Threats:

Amadey is a formidable Windows infostealer threat, characterized by its persistence mechanisms, modular design, and ability to execute various malicious tasks.

Malware Trends Tracker     >>>
Analysis date: April 29, 2025, 06:42:00
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
lumma
stealer
loader
themida
auto
botnet
amadey
auto-reg
credentialflusher
auto-sch
telegram
putty
rmm-tool
phishing
purecrypter
purelogs
exfiltration
generic
rdp
gcleaner
pastebin
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 7 sections
MD5:

D11CF343C0DE369B13E0D211B1B8515A

SHA1:

582FD69230E2C019DBBF75B2486C86A293920C08

SHA256:

A81578DC4ABCB969E52CF378881349487B046B70181DDDE99E6B87E4646683ED

SSDEEP:

98304:uwWxaePI5E9FJB//tXiggI15pPTZBLCxtffeaMXrGmFW3F9/jgkZ4WX1aHU9HnC3:

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • LUMMA mutex has been found

      • random.exe (PID: 4880)
      • b6785b010c.exe (PID: 616)
      • b6785b010c.exe (PID: 4448)
      • MSBuild.exe (PID: 3140)

    • Actions looks like stealing of personal data

      • random.exe (PID: 4880)
      • b6785b010c.exe (PID: 616)
      • b6785b010c.exe (PID: 4448)
      • MSBuild.exe (PID: 3140)

    • LUMMA has been detected (SURICATA)

      • svchost.exe (PID: 2196)
      • MSBuild.exe (PID: 3140)

    • Connects to the CnC server

      • svchost.exe (PID: 2196)
      • saved.exe (PID: 3300)

    • AMADEY has been found (auto)

      • NBJM8VJSQ4LW3RFOXWXQTIW4F4Q.exe (PID: 3132)
      • random.exe (PID: 4880)
      • b6785b010c.exe (PID: 616)
      • b6785b010c.exe (PID: 4448)
      • powershell.exe (PID: 5408)
      • powershell.exe (PID: 7312)
      • powershell.exe (PID: 3332)

    • AMADEY has been detected (SURICATA)

      • saved.exe (PID: 3300)

    • LUMMA has been detected (YARA)

      • random.exe (PID: 4880)

    • Changes the autorun value in the registry

      • saved.exe (PID: 3300)

    • AMADEY has been detected (YARA)

      • saved.exe (PID: 3300)

    • Disables Windows Defender

      • c0ea85d9ba.exe (PID: 4996)

    • Possible tool for stealing has been detected

      • 5060b22d8f.exe (PID: 5400)
      • firefox.exe (PID: 5576)
      • 5060b22d8f.exe (PID: 5176)
      • firefox.exe (PID: 2420)

    • Uses Task Scheduler to run other applications

      • cmd.exe (PID: 6576)
      • cmd.exe (PID: 3132)

    • Changes the Windows auto-update feature

      • c0ea85d9ba.exe (PID: 4996)

    • Run PowerShell with an invisible window

      • powershell.exe (PID: 7456)
      • powershell.exe (PID: 7312)
      • powershell.exe (PID: 5408)
      • powershell.exe (PID: 3332)

    • Request from PowerShell that ran from MSHTA.EXE

      • powershell.exe (PID: 5408)
      • powershell.exe (PID: 7312)

    • Script downloads file (POWERSHELL)

      • powershell.exe (PID: 5408)
      • powershell.exe (PID: 7456)

    • Executing a file with an untrusted certificate

      • core.exe (PID: 7760)

    • PHISHING has been detected (SURICATA)

      • svchost.exe (PID: 2196)

    • PURECRYPTER has been detected (SURICATA)

      • MSBuild.exe (PID: 7628)
      • MSBuild.exe (PID: 7528)

    • PURELOGS has been detected (SURICATA)

      • MSBuild.exe (PID: 7528)

    • GENERIC has been found (auto)

      • 4ae65c23f5.exe (PID: 7900)

    • GCLEANER has been detected (SURICATA)

      • svchost015.exe (PID: 7232)

    • Bypass execution policy to execute commands

      • powershell.exe (PID: 7576)

    • Changes powershell execution policy (Bypass)

      • core.exe (PID: 7760)

  • SUSPICIOUS

    • Reads the BIOS version

      • random.exe (PID: 4880)
      • b6785b010c.exe (PID: 616)
      • c0ea85d9ba.exe (PID: 4996)
      • b6785b010c.exe (PID: 4448)

    • Contacting a server suspected of hosting an CnC

      • svchost.exe (PID: 2196)
      • saved.exe (PID: 3300)
      • MSBuild.exe (PID: 3140)

    • Searches for installed software

      • random.exe (PID: 4880)
      • b6785b010c.exe (PID: 616)
      • b6785b010c.exe (PID: 4448)
      • MSBuild.exe (PID: 3140)

    • Connects to the server without a host name

      • random.exe (PID: 4880)
      • saved.exe (PID: 3300)
      • b6785b010c.exe (PID: 616)
      • b6785b010c.exe (PID: 4448)
      • powershell.exe (PID: 5408)
      • powershell.exe (PID: 7312)
      • powershell.exe (PID: 3332)
      • svchost015.exe (PID: 7232)

    • Executable content was dropped or overwritten

      • random.exe (PID: 4880)
      • NBJM8VJSQ4LW3RFOXWXQTIW4F4Q.exe (PID: 3132)
      • saved.exe (PID: 3300)
      • b6785b010c.exe (PID: 616)
      • b6785b010c.exe (PID: 4448)
      • powershell.exe (PID: 5408)
      • 97e9ac22c3.exe (PID: 7036)
      • 97e9ac22c3.tmp (PID: 7432)
      • powershell.exe (PID: 7312)
      • 4ae65c23f5.exe (PID: 7900)

    • Potential Corporate Privacy Violation

      • random.exe (PID: 4880)
      • saved.exe (PID: 3300)
      • b6785b010c.exe (PID: 4448)
      • b6785b010c.exe (PID: 616)
      • powershell.exe (PID: 5408)
      • powershell.exe (PID: 7312)
      • powershell.exe (PID: 3332)

    • Process requests binary or script from the Internet

      • random.exe (PID: 4880)
      • saved.exe (PID: 3300)
      • b6785b010c.exe (PID: 616)
      • b6785b010c.exe (PID: 4448)
      • powershell.exe (PID: 5408)
      • powershell.exe (PID: 7312)
      • powershell.exe (PID: 3332)

    • Reads security settings of Internet Explorer

      • NBJM8VJSQ4LW3RFOXWXQTIW4F4Q.exe (PID: 3132)
      • saved.exe (PID: 3300)

    • Starts itself from another location

      • NBJM8VJSQ4LW3RFOXWXQTIW4F4Q.exe (PID: 3132)

    • There is functionality for taking screenshot (YARA)

      • saved.exe (PID: 3300)

    • Uses TASKKILL.EXE to kill Browsers

      • 5060b22d8f.exe (PID: 5400)
      • 5060b22d8f.exe (PID: 5176)

    • There is functionality for enable RDP (YARA)

      • saved.exe (PID: 3300)

    • Uses TASKKILL.EXE to kill process

      • 5060b22d8f.exe (PID: 5400)
      • 5060b22d8f.exe (PID: 5176)

    • Starts CMD.EXE for commands execution

      • f69150613a.exe (PID: 4628)
      • f69150613a.exe (PID: 672)

    • Found IP address in command line

      • powershell.exe (PID: 5408)
      • powershell.exe (PID: 7456)
      • powershell.exe (PID: 3332)
      • powershell.exe (PID: 7312)

    • Probably download files using WebClient

      • mshta.exe (PID: 6248)
      • mshta.exe (PID: 6108)
      • mshta.exe (PID: 4776)
      • mshta.exe (PID: 6252)

    • Starts process via Powershell

      • powershell.exe (PID: 5408)
      • powershell.exe (PID: 7456)
      • powershell.exe (PID: 7312)
      • powershell.exe (PID: 3332)

    • Manipulates environment variables

      • powershell.exe (PID: 5408)
      • powershell.exe (PID: 7456)
      • powershell.exe (PID: 7312)
      • powershell.exe (PID: 3332)

    • Starts POWERSHELL.EXE for commands execution

      • mshta.exe (PID: 6248)
      • mshta.exe (PID: 6108)
      • mshta.exe (PID: 4776)
      • mshta.exe (PID: 6252)
      • core.exe (PID: 7760)

    • Process drops legitimate windows executable

      • saved.exe (PID: 3300)

    • Starts a Microsoft application from unusual location

      • ebc37b4f82.exe (PID: 8160)
      • AJ2naPd.exe (PID: 8148)
      • AJ2naPd.exe (PID: 6824)

    • Process communicates with Telegram (possibly using it as an attacker's C2 server)

      • MSBuild.exe (PID: 3140)

    • Reads the Windows owner or organization settings

      • 97e9ac22c3.tmp (PID: 7432)

    • PUTTY has been detected

      • putty.exe (PID: 8180)

    • The process executes via Task Scheduler

      • saved.exe (PID: 8008)
      • saved.exe (PID: 7100)

    • Connects to unusual port

      • MSBuild.exe (PID: 7528)
      • MSBuild.exe (PID: 7628)

  • INFO

    • Checks supported languages

      • random.exe (PID: 4880)
      • NBJM8VJSQ4LW3RFOXWXQTIW4F4Q.exe (PID: 3132)
      • saved.exe (PID: 3300)
      • b6785b010c.exe (PID: 616)
      • c0ea85d9ba.exe (PID: 4996)
      • b6785b010c.exe (PID: 4448)
      • 1C7F0T4QE5A65UCODVM4G.exe (PID: 1676)
      • 5060b22d8f.exe (PID: 5400)
      • f69150613a.exe (PID: 4628)
      • AUFSV5XGFH1Y5E4Q35FA.exe (PID: 4464)
      • ebc37b4f82.exe (PID: 8160)
      • MSBuild.exe (PID: 3140)
      • 5060b22d8f.exe (PID: 5176)
      • f69150613a.exe (PID: 672)
      • TempVKG2HC8FEJJPRHDIYPZ3TETUWXGGEOGX.EXE (PID: 2332)
      • 97e9ac22c3.exe (PID: 7036)
      • 97e9ac22c3.tmp (PID: 7432)

    • Reads the computer name

      • random.exe (PID: 4880)
      • NBJM8VJSQ4LW3RFOXWXQTIW4F4Q.exe (PID: 3132)
      • saved.exe (PID: 3300)
      • b6785b010c.exe (PID: 616)
      • c0ea85d9ba.exe (PID: 4996)
      • b6785b010c.exe (PID: 4448)
      • 5060b22d8f.exe (PID: 5400)
      • f69150613a.exe (PID: 4628)
      • MSBuild.exe (PID: 3140)
      • 5060b22d8f.exe (PID: 5176)
      • 97e9ac22c3.tmp (PID: 7432)
      • f69150613a.exe (PID: 672)

    • Reads the software policy settings

      • random.exe (PID: 4880)
      • b6785b010c.exe (PID: 616)
      • b6785b010c.exe (PID: 4448)
      • MSBuild.exe (PID: 3140)

    • Create files in a temporary directory

      • NBJM8VJSQ4LW3RFOXWXQTIW4F4Q.exe (PID: 3132)
      • random.exe (PID: 4880)
      • saved.exe (PID: 3300)
      • b6785b010c.exe (PID: 616)
      • f69150613a.exe (PID: 4628)
      • b6785b010c.exe (PID: 4448)
      • f69150613a.exe (PID: 672)
      • 97e9ac22c3.exe (PID: 7036)
      • 97e9ac22c3.tmp (PID: 7432)

    • Process checks computer location settings

      • NBJM8VJSQ4LW3RFOXWXQTIW4F4Q.exe (PID: 3132)
      • saved.exe (PID: 3300)

    • Checks proxy server information

      • saved.exe (PID: 3300)
      • powershell.exe (PID: 5408)

    • Themida protector has been detected

      • random.exe (PID: 4880)

    • Creates files or folders in the user directory

      • saved.exe (PID: 3300)

    • Auto-launch of the file from Registry key

      • saved.exe (PID: 3300)

    • Manual execution by a user

      • b6785b010c.exe (PID: 4448)
      • c0ea85d9ba.exe (PID: 6004)
      • mshta.exe (PID: 6108)
      • 5060b22d8f.exe (PID: 5176)
      • f69150613a.exe (PID: 672)
      • mshta.exe (PID: 6252)

    • Reads mouse settings

      • 5060b22d8f.exe (PID: 5400)
      • f69150613a.exe (PID: 4628)
      • 5060b22d8f.exe (PID: 5176)
      • f69150613a.exe (PID: 672)

    • Application launched itself

      • firefox.exe (PID: 5576)
      • firefox.exe (PID: 6468)
      • firefox.exe (PID: 2420)
      • firefox.exe (PID: 5360)

    • Auto-launch of the file from Task Scheduler

      • cmd.exe (PID: 6576)
      • cmd.exe (PID: 3132)

    • Reads Internet Explorer settings

      • mshta.exe (PID: 6248)
      • mshta.exe (PID: 6108)
      • mshta.exe (PID: 4776)
      • mshta.exe (PID: 6252)

    • The sample compiled with english language support

      • saved.exe (PID: 3300)
      • 97e9ac22c3.tmp (PID: 7432)
      • 4ae65c23f5.exe (PID: 7900)

    • Attempting to use instant messaging service

      • MSBuild.exe (PID: 3140)

    • Disables trace logs

      • powershell.exe (PID: 5408)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 7456)

    • The executable file from the user directory is run by the Powershell process

      • TempVKG2HC8FEJJPRHDIYPZ3TETUWXGGEOGX.EXE (PID: 2332)
      • TempVKG2HC8FEJJPRHDIYPZ3TETUWXGGEOGX.EXE (PID: 7548)
      • TempV5NYT5I5KGWB8W6RFKN8RNX2XPHVIADO.EXE (PID: 2084)
      • TempV5NYT5I5KGWB8W6RFKN8RNX2XPHVIADO.EXE (PID: 7944)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Lumma

(PID) Process(4880) random.exe
C2 (9)parakehjet.run/kewk
buzzarddf.live/ktnt
zenithcorde.top/auid
bearjk.live/benj
techguidet.digital/apdo
techsyncq.run/riid
btcgeared.live/lbak
clarmodq.top/qoxo
fishgh.digital/tequ

Amadey

(PID) Process(3300) saved.exe
C2185.39.17.163
URLhttp://185.39.17.163/Su8kud7i/index.php
Version5.34
Options
Drop directoryc13dbdc4fa
Drop namesaved.exe
Strings (125)S-%lu-
og:
clip.dll
ProgramData\
shell32.dll
<c>
vs:
Programs
&&
VideoID
ESET
av:
\App
0000043f
Doctor Web
:::
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
------
rundll32.exe
00000422
185.39.17.163
0123456789
st=s
00000419
Content-Type: application/x-www-form-urlencoded
/Plugins/
msi
ar:
GetNativeSystemInfo
Norton
-%lu
Sophos
zip
SOFTWARE\Microsoft\Windows NT\CurrentVersion
" Content-Type: application/octet-stream
|
+++
" && ren
pc:
#
d1
cmd /C RMDIR /s/q
Bitdefender
Comodo
<d>
Kaspersky Lab
DefaultSettings.YResolution
Main
c13dbdc4fa
-executionpolicy remotesigned -File "
&& Exit"
ProductName
&unit=
2022
Panda Security
=
Rem
cmd
\0000
id:
sd:
--
/quiet
rundll32
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
%-lu
random
GET
"taskkill /f /im "
Content-Disposition: form-data; name="data"; filename="
00000423
5.34
2016
?scr=1
ComputerName
Keyboard Layout\Preload
Powershell.exe
POST
http://
AVAST Software
SYSTEM\CurrentControlSet\Control\UnitedVideo\CONTROL\VIDEO\
ps1
DefaultSettings.XResolution
Startup
CurrentBuild
e3
cred.dll|clip.dll|
------
WinDefender
wb
https://
Avira
2025
" && timeout 1 && del
cred.dll
un:
SYSTEM\ControlSet001\Services\BasicDisplay\Video
rb
SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName
360TotalSecurity
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
saved.exe
e1
lv:
/Su8kud7i/index.php
shutdown -s -t 0
/k
e2
SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
exe
%USERPROFILE%
-unicode-
r=
.jpg
dll
Content-Type: multipart/form-data; boundary=----
2019
bi:
\
"
kernel32.dll
os:
abcdefghijklmnopqrstuvwxyz0123456789-_
dm:
AVG
No Malware configuration.

TRiD

.exe | Generic Win/DOS Executable (50)
.exe | DOS Executable Generic (49.9)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2025:04:26 14:47:23+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14
CodeSize: 312320
InitializedDataSize: 38400
UninitializedDataSize: -
EntryPoint: 0x4aa000
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
232
Monitored processes
102
Malicious processes
27
Suspicious processes
7

Behavior graph

Click at the process to see the details
start #LUMMA random.exe #LUMMA svchost.exe sppextcomobj.exe no specs slui.exe #AMADEY nbjm8vjsq4lw3rfoxwxqtiw4f4q.exe #AMADEY saved.exe #LUMMA b6785b010c.exe c0ea85d9ba.exe no specs c0ea85d9ba.exe #LUMMA b6785b010c.exe c0ea85d9ba.exe no specs 1c7f0t4qe5a65ucodvm4g.exe no specs #CREDENTIALFLUSHER 5060b22d8f.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs #CREDENTIALFLUSHER firefox.exe no specs firefox.exe f69150613a.exe no specs cmd.exe no specs mshta.exe no specs conhost.exe no specs aufsv5xgfh1y5e4q35fa.exe no specs schtasks.exe no specs firefox.exe no specs firefox.exe no specs #AMADEY powershell.exe conhost.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs ebc37b4f82.exe no specs #LUMMA msbuild.exe mshta.exe no specs powershell.exe no specs conhost.exe no specs #CREDENTIALFLUSHER 5060b22d8f.exe no specs f69150613a.exe no specs cmd.exe no specs mshta.exe no specs conhost.exe no specs schtasks.exe no specs #AMADEY powershell.exe conhost.exe no specs taskkill.exe no specs conhost.exe no specs firefox.exe no specs tempvkg2hc8fejjprhdiypz3tetuwxggeogx.exe no specs firefox.exe no specs mshta.exe no specs 97e9ac22c3.exe #AMADEY powershell.exe conhost.exe no specs 97e9ac22c3.tmp taskkill.exe no specs conhost.exe no specs tempvkg2hc8fejjprhdiypz3tetuwxggeogx.exe no specs taskkill.exe no specs conhost.exe no specs tempv5nyt5i5kgwb8w6rfkn8rnx2xphviado.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs #CREDENTIALFLUSHER firefox.exe no specs firefox.exe firefox.exe no specs firefox.exe no specs THREAT putty.exe no specs firefox.exe no specs core.exe #GENERIC 4ae65c23f5.exe tempv5nyt5i5kgwb8w6rfkn8rnx2xphviado.exe no specs info.exe conhost.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs saved.exe no specs firefox.exe no specs aj2napd.exe no specs #PURECRYPTER msbuild.exe aj2napd.exe no specs #PURECRYPTER msbuild.exe slui.exe no specs #GCLEANER svchost015.exe powershell.exe no specs conhost.exe no specs saved.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
208\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—taskkill.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
496\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
616"C:\Users\admin\AppData\Local\Temp\10053590101\b6785b010c.exe" C:\Users\admin\AppData\Local\Temp\10053590101\b6785b010c.exe
saved.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\10053590101\b6785b010c.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
672C:\Users\admin\AppData\Local\Temp\10053620101\f69150613a.exeC:\Users\admin\AppData\Local\Temp\10053620101\f69150613a.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\10053620101\f69150613a.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\psapi.dll
c:\windows\syswow64\user32.dll
736"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1852 -parentBuildID 20240213221259 -prefsHandle 1780 -prefMapHandle 1772 -prefsLen 31031 -prefMapSize 244583 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8edecc4d-b348-4dfa-bec4-9024cf2cf3b3} 6468 "\\.\pipe\gecko-crash-server-pipe.6468" 245f85efb10 gpuC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
1
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\vcruntime140.dll
1052C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
1240taskkill /F /IM opera.exe /TC:\Windows\SysWOW64\taskkill.exe—5060b22d8f.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Terminates Processes
Exit code:
128
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\taskkill.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
1676"C:\Users\admin\AppData\Local\Temp\1C7F0T4QE5A65UCODVM4G.exe"C:\Users\admin\AppData\Local\Temp\1C7F0T4QE5A65UCODVM4G.exe—b6785b010c.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\1c7f0t4qe5a65ucodvm4g.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
2084"C:\Users\admin\AppData\Local\TempV5NYT5I5KGWB8W6RFKN8RNX2XPHVIADO.EXE" C:\Users\admin\AppData\Local\TempV5NYT5I5KGWB8W6RFKN8RNX2XPHVIADO.EXE—powershell.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\tempv5nyt5i5kgwb8w6rfkn8rnx2xphviado.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
2104\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
67 377
Read events
67 305
Write events
72
Delete events
0

Modification events

(PID) Process:(3300) saved.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(3300) saved.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(3300) saved.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(3300) saved.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:b6785b010c.exe
Value:
C:\Users\admin\AppData\Local\Temp\10053590101\b6785b010c.exe
(PID) Process:(3300) saved.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:c0ea85d9ba.exe
Value:
C:\Users\admin\AppData\Local\Temp\10053600101\c0ea85d9ba.exe
(PID) Process:(3300) saved.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:5060b22d8f.exe
Value:
C:\Users\admin\AppData\Local\Temp\10053610101\5060b22d8f.exe
(PID) Process:(4996) c0ea85d9ba.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features
Operation:writeName:TamperProtection
Value:
0
(PID) Process:(4996) c0ea85d9ba.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender
Operation:writeName:DisableAntiSpyware
Value:
1
(PID) Process:(4996) c0ea85d9ba.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection
Operation:writeName:DisableBehaviorMonitoring
Value:
1
(PID) Process:(4996) c0ea85d9ba.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection
Operation:writeName:DisableIOAVProtection
Value:
1
Executable files
33
Suspicious files
197
Text files
44
Unknown types
0

Dropped files

PID
Process
Filename
Type
6468firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\9kie7cg6.default-release\startupCache\scriptCache-current.bin —
MD5:—
SHA256:—
4880random.exeC:\Users\admin\AppData\Local\Temp\NBJM8VJSQ4LW3RFOXWXQTIW4F4Q.exeexecutable
MD5:F6C20A18AFEAC04964A6CCAD6BE59731
SHA256:CE75F9DEDE6D4E93549D35B816898113B6BEFAB9EF0AADF8949D4887C2C34BEA
3300saved.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\E4DJRUXW\random[1].exeexecutable
MD5:14949A3C0CD364C768E9576FD1B8E28E
SHA256:B7B3E99BDD6247C35E9069B8E59CF0B51187AF03A69CD95DD924E86981D94AB0
3300saved.exeC:\Users\admin\AppData\Local\Temp\10053620101\f69150613a.exeexecutable
MD5:3AFF002CFF8A3B07DA5B879D8B538C34
SHA256:B478693A9956B214002EC220E506750214783215DDF748ADEBA9360E22AFACA7
6468firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\9kie7cg6.default-release\startupCache\urlCache-current.binbinary
MD5:297E88D7CEB26E549254EC875649F4EB
SHA256:8B75D4FB1845BAA06122888D11F6B65E6A36B140C54A72CC13DF390FD7C95702
3132NBJM8VJSQ4LW3RFOXWXQTIW4F4Q.exeC:\Windows\Tasks\saved.jobbinary
MD5:61B6308BF2D18D293AAA77E0AA540499
SHA256:B331C043A5B95D282BDE70D23CD24A95D8314E909F50189CB969D9E28CDC718B
6468firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\sessionCheckpoints.jsonbinary
MD5:EA8B62857DFDBD3D0BE7D7E4A954EC9A
SHA256:792955295AE9C382986222C6731C5870BD0E921E7F7E34CC4615F5CD67F225DA
6468firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\cookies.sqlite-shmbinary
MD5:B7C14EC6110FA820CA6B65F5AEC85911
SHA256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
4448b6785b010c.exeC:\Users\admin\AppData\Local\Temp\AUFSV5XGFH1Y5E4Q35FA.exeexecutable
MD5:F6C20A18AFEAC04964A6CCAD6BE59731
SHA256:CE75F9DEDE6D4E93549D35B816898113B6BEFAB9EF0AADF8949D4887C2C34BEA
3300saved.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\RR3E01RZ\random[1].exeexecutable
MD5:231AB4BCE5B757C4192D6EA2A00F91CD
SHA256:11AA99CC6BD19F85E4E795117373DE82E4541BAEA3B1015026113F2402E97521
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
91
TCP/UDP connections
176
DNS requests
169
Threats
82

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
23.216.77.28:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
23.54.109.203:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
4880
random.exe
GET
200
185.39.17.162:80
http://185.39.17.162/mine/random.exe
unknown
—
—
malicious
3300
saved.exe
POST
200
185.39.17.163:80
http://185.39.17.163/Su8kud7i/index.php
unknown
—
—
malicious
3300
saved.exe
GET
200
185.39.17.162:80
http://185.39.17.162/luma/random.exe
unknown
—
—
malicious
616
b6785b010c.exe
GET
200
185.39.17.162:80
http://185.39.17.162/mine/random.exe
unknown
—
—
malicious
3300
saved.exe
POST
200
185.39.17.163:80
http://185.39.17.163/Su8kud7i/index.php
unknown
—
—
malicious
1328
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
3300
saved.exe
POST
200
185.39.17.163:80
http://185.39.17.163/Su8kud7i/index.php
unknown
—
—
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
23.216.77.28:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4880
random.exe
104.21.51.232:443
zenithcorde.top
CLOUDFLARENET
—
unknown
3216
svchost.exe
172.211.123.249:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
20.190.160.20:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
23.54.109.203:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
4880
random.exe
185.39.17.162:80
—
Joint Stock Company Tagnet
RU
malicious
3300
saved.exe
185.39.17.163:80
—
Joint Stock Company Tagnet
RU
malicious

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 40.127.240.158
whitelisted
crl.microsoft.com
  • 23.216.77.28
  • 23.216.77.6
whitelisted
www.microsoft.com
  • 23.35.229.160
whitelisted
google.com
  • 142.250.185.78
whitelisted
clarmodq.top
  • —
malicious
zenithcorde.top
  • 104.21.51.232
  • 172.67.190.162
unknown
client.wns.windows.com
  • 172.211.123.249
whitelisted
login.live.com
  • 20.190.160.20
  • 20.190.160.4
  • 20.190.160.130
  • 20.190.160.65
  • 20.190.160.67
  • 40.126.32.72
  • 20.190.160.14
  • 20.190.160.128
  • 20.190.159.23
  • 20.190.159.71
  • 40.126.31.0
  • 40.126.31.1
  • 20.190.159.128
  • 20.190.159.130
  • 40.126.31.3
  • 40.126.31.69
whitelisted
ocsp.digicert.com
  • 23.54.109.203
whitelisted
slscr.update.microsoft.com
  • 52.149.20.212
whitelisted

Threats

PID
Process
Class
Message
2196
svchost.exe
A Network Trojan was detected
MALWARE [ANY.RUN] Suspected Domain Associated with Malware Distribution (clarmodq .top)
2196
svchost.exe
Potentially Bad Traffic
ET DNS Query to a *.top domain - Likely Hostile
2196
svchost.exe
Domain Observed Used for C2 Detected
ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (clarmodq .top)
4880
random.exe
Potentially Bad Traffic
ET INFO Executable Download from dotted-quad Host
4880
random.exe
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
4880
random.exe
Potentially Bad Traffic
ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response
4880
random.exe
Potential Corporate Privacy Violation
ET INFO PE EXE or DLL Windows file download HTTP
4880
random.exe
Misc activity
ET INFO Packed Executable Download
3300
saved.exe
Malware Command and Control Activity Detected
BOTNET [ANY.RUN] Amadey HTTP POST Request (st=s)
3300
saved.exe
Malware Command and Control Activity Detected
ET MALWARE Amadey CnC Response
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
random.exe