File name:

random.exe

Full analysis: https://app.any.run/tasks/9bceb21c-8c84-4812-a86e-b20001984fed
Verdict: Malicious activity
Threats:

Amadey is a formidable Windows infostealer threat, characterized by its persistence mechanisms, modular design, and ability to execute various malicious tasks.

Malware Trends Tracker     >>>
Analysis date: April 29, 2025, 06:42:00
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
lumma
stealer
loader
themida
auto
botnet
amadey
auto-reg
credentialflusher
auto-sch
telegram
putty
rmm-tool
phishing
purecrypter
purelogs
exfiltration
generic
rdp
gcleaner
pastebin
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 7 sections
MD5:

D11CF343C0DE369B13E0D211B1B8515A

SHA1:

582FD69230E2C019DBBF75B2486C86A293920C08

SHA256:

A81578DC4ABCB969E52CF378881349487B046B70181DDDE99E6B87E4646683ED

SSDEEP:

98304:uwWxaePI5E9FJB//tXiggI15pPTZBLCxtffeaMXrGmFW3F9/jgkZ4WX1aHU9HnC3:

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • LUMMA mutex has been found

      • random.exe (PID: 4880)
      • b6785b010c.exe (PID: 616)
      • b6785b010c.exe (PID: 4448)
      • MSBuild.exe (PID: 3140)

    • Actions looks like stealing of personal data

      • random.exe (PID: 4880)
      • b6785b010c.exe (PID: 616)
      • b6785b010c.exe (PID: 4448)
      • MSBuild.exe (PID: 3140)

    • LUMMA has been detected (YARA)

      • random.exe (PID: 4880)

    • AMADEY has been found (auto)

      • random.exe (PID: 4880)
      • NBJM8VJSQ4LW3RFOXWXQTIW4F4Q.exe (PID: 3132)
      • b6785b010c.exe (PID: 616)
      • b6785b010c.exe (PID: 4448)
      • powershell.exe (PID: 5408)
      • powershell.exe (PID: 7312)
      • powershell.exe (PID: 3332)

    • LUMMA has been detected (SURICATA)

      • svchost.exe (PID: 2196)
      • MSBuild.exe (PID: 3140)

    • Connects to the CnC server

      • svchost.exe (PID: 2196)
      • saved.exe (PID: 3300)

    • AMADEY has been detected (SURICATA)

      • saved.exe (PID: 3300)

    • Changes the autorun value in the registry

      • saved.exe (PID: 3300)

    • AMADEY has been detected (YARA)

      • saved.exe (PID: 3300)

    • Disables Windows Defender

      • c0ea85d9ba.exe (PID: 4996)

    • Possible tool for stealing has been detected

      • firefox.exe (PID: 5576)
      • 5060b22d8f.exe (PID: 5400)
      • firefox.exe (PID: 2420)
      • 5060b22d8f.exe (PID: 5176)

    • Uses Task Scheduler to run other applications

      • cmd.exe (PID: 6576)
      • cmd.exe (PID: 3132)

    • Run PowerShell with an invisible window

      • powershell.exe (PID: 5408)
      • powershell.exe (PID: 7456)
      • powershell.exe (PID: 7312)
      • powershell.exe (PID: 3332)

    • Changes the Windows auto-update feature

      • c0ea85d9ba.exe (PID: 4996)

    • Script downloads file (POWERSHELL)

      • powershell.exe (PID: 7456)
      • powershell.exe (PID: 5408)

    • Request from PowerShell that ran from MSHTA.EXE

      • powershell.exe (PID: 5408)
      • powershell.exe (PID: 7312)

    • Executing a file with an untrusted certificate

      • core.exe (PID: 7760)

    • PHISHING has been detected (SURICATA)

      • svchost.exe (PID: 2196)

    • PURECRYPTER has been detected (SURICATA)

      • MSBuild.exe (PID: 7528)
      • MSBuild.exe (PID: 7628)

    • GENERIC has been found (auto)

      • 4ae65c23f5.exe (PID: 7900)

    • GCLEANER has been detected (SURICATA)

      • svchost015.exe (PID: 7232)

    • Bypass execution policy to execute commands

      • powershell.exe (PID: 7576)

    • Changes powershell execution policy (Bypass)

      • core.exe (PID: 7760)

    • PURELOGS has been detected (SURICATA)

      • MSBuild.exe (PID: 7528)

  • SUSPICIOUS

    • Reads the BIOS version

      • random.exe (PID: 4880)
      • c0ea85d9ba.exe (PID: 4996)
      • b6785b010c.exe (PID: 616)
      • b6785b010c.exe (PID: 4448)

    • Searches for installed software

      • random.exe (PID: 4880)
      • b6785b010c.exe (PID: 616)
      • b6785b010c.exe (PID: 4448)
      • MSBuild.exe (PID: 3140)

    • Executable content was dropped or overwritten

      • random.exe (PID: 4880)
      • NBJM8VJSQ4LW3RFOXWXQTIW4F4Q.exe (PID: 3132)
      • saved.exe (PID: 3300)
      • b6785b010c.exe (PID: 616)
      • b6785b010c.exe (PID: 4448)
      • powershell.exe (PID: 5408)
      • 97e9ac22c3.tmp (PID: 7432)
      • 97e9ac22c3.exe (PID: 7036)
      • powershell.exe (PID: 7312)
      • 4ae65c23f5.exe (PID: 7900)

    • Potential Corporate Privacy Violation

      • random.exe (PID: 4880)
      • saved.exe (PID: 3300)
      • b6785b010c.exe (PID: 616)
      • b6785b010c.exe (PID: 4448)
      • powershell.exe (PID: 5408)
      • powershell.exe (PID: 7312)
      • powershell.exe (PID: 3332)

    • Connects to the server without a host name

      • random.exe (PID: 4880)
      • saved.exe (PID: 3300)
      • b6785b010c.exe (PID: 616)
      • b6785b010c.exe (PID: 4448)
      • powershell.exe (PID: 5408)
      • powershell.exe (PID: 7312)
      • powershell.exe (PID: 3332)
      • svchost015.exe (PID: 7232)

    • Contacting a server suspected of hosting an CnC

      • svchost.exe (PID: 2196)
      • saved.exe (PID: 3300)
      • MSBuild.exe (PID: 3140)

    • Process requests binary or script from the Internet

      • random.exe (PID: 4880)
      • saved.exe (PID: 3300)
      • b6785b010c.exe (PID: 616)
      • b6785b010c.exe (PID: 4448)
      • powershell.exe (PID: 5408)
      • powershell.exe (PID: 7312)
      • powershell.exe (PID: 3332)

    • Reads security settings of Internet Explorer

      • NBJM8VJSQ4LW3RFOXWXQTIW4F4Q.exe (PID: 3132)
      • saved.exe (PID: 3300)

    • Starts itself from another location

      • NBJM8VJSQ4LW3RFOXWXQTIW4F4Q.exe (PID: 3132)

    • There is functionality for enable RDP (YARA)

      • saved.exe (PID: 3300)

    • There is functionality for taking screenshot (YARA)

      • saved.exe (PID: 3300)

    • Uses TASKKILL.EXE to kill Browsers

      • 5060b22d8f.exe (PID: 5400)
      • 5060b22d8f.exe (PID: 5176)

    • Uses TASKKILL.EXE to kill process

      • 5060b22d8f.exe (PID: 5400)
      • 5060b22d8f.exe (PID: 5176)

    • Starts CMD.EXE for commands execution

      • f69150613a.exe (PID: 4628)
      • f69150613a.exe (PID: 672)

    • Probably download files using WebClient

      • mshta.exe (PID: 6248)
      • mshta.exe (PID: 6108)
      • mshta.exe (PID: 4776)
      • mshta.exe (PID: 6252)

    • Found IP address in command line

      • powershell.exe (PID: 5408)
      • powershell.exe (PID: 7456)
      • powershell.exe (PID: 7312)
      • powershell.exe (PID: 3332)

    • Starts POWERSHELL.EXE for commands execution

      • mshta.exe (PID: 6248)
      • mshta.exe (PID: 6108)
      • mshta.exe (PID: 4776)
      • mshta.exe (PID: 6252)
      • core.exe (PID: 7760)

    • Starts process via Powershell

      • powershell.exe (PID: 5408)
      • powershell.exe (PID: 7456)
      • powershell.exe (PID: 7312)
      • powershell.exe (PID: 3332)

    • Manipulates environment variables

      • powershell.exe (PID: 5408)
      • powershell.exe (PID: 7456)
      • powershell.exe (PID: 7312)
      • powershell.exe (PID: 3332)

    • Starts a Microsoft application from unusual location

      • ebc37b4f82.exe (PID: 8160)
      • AJ2naPd.exe (PID: 8148)
      • AJ2naPd.exe (PID: 6824)

    • Process drops legitimate windows executable

      • saved.exe (PID: 3300)

    • Process communicates with Telegram (possibly using it as an attacker's C2 server)

      • MSBuild.exe (PID: 3140)

    • Reads the Windows owner or organization settings

      • 97e9ac22c3.tmp (PID: 7432)

    • PUTTY has been detected

      • putty.exe (PID: 8180)

    • The process executes via Task Scheduler

      • saved.exe (PID: 8008)
      • saved.exe (PID: 7100)

    • Connects to unusual port

      • MSBuild.exe (PID: 7528)
      • MSBuild.exe (PID: 7628)

  • INFO

    • Checks supported languages

      • random.exe (PID: 4880)
      • NBJM8VJSQ4LW3RFOXWXQTIW4F4Q.exe (PID: 3132)
      • saved.exe (PID: 3300)
      • b6785b010c.exe (PID: 616)
      • c0ea85d9ba.exe (PID: 4996)
      • b6785b010c.exe (PID: 4448)
      • 1C7F0T4QE5A65UCODVM4G.exe (PID: 1676)
      • 5060b22d8f.exe (PID: 5400)
      • f69150613a.exe (PID: 4628)
      • AUFSV5XGFH1Y5E4Q35FA.exe (PID: 4464)
      • ebc37b4f82.exe (PID: 8160)
      • MSBuild.exe (PID: 3140)
      • 5060b22d8f.exe (PID: 5176)
      • f69150613a.exe (PID: 672)
      • TempVKG2HC8FEJJPRHDIYPZ3TETUWXGGEOGX.EXE (PID: 2332)
      • 97e9ac22c3.exe (PID: 7036)
      • 97e9ac22c3.tmp (PID: 7432)

    • Reads the software policy settings

      • random.exe (PID: 4880)
      • b6785b010c.exe (PID: 616)
      • b6785b010c.exe (PID: 4448)
      • MSBuild.exe (PID: 3140)

    • Reads the computer name

      • random.exe (PID: 4880)
      • NBJM8VJSQ4LW3RFOXWXQTIW4F4Q.exe (PID: 3132)
      • saved.exe (PID: 3300)
      • b6785b010c.exe (PID: 616)
      • c0ea85d9ba.exe (PID: 4996)
      • b6785b010c.exe (PID: 4448)
      • 5060b22d8f.exe (PID: 5400)
      • f69150613a.exe (PID: 4628)
      • MSBuild.exe (PID: 3140)
      • 5060b22d8f.exe (PID: 5176)
      • f69150613a.exe (PID: 672)
      • 97e9ac22c3.tmp (PID: 7432)

    • Themida protector has been detected

      • random.exe (PID: 4880)

    • Create files in a temporary directory

      • random.exe (PID: 4880)
      • NBJM8VJSQ4LW3RFOXWXQTIW4F4Q.exe (PID: 3132)
      • saved.exe (PID: 3300)
      • b6785b010c.exe (PID: 616)
      • f69150613a.exe (PID: 4628)
      • b6785b010c.exe (PID: 4448)
      • f69150613a.exe (PID: 672)
      • 97e9ac22c3.exe (PID: 7036)
      • 97e9ac22c3.tmp (PID: 7432)

    • Process checks computer location settings

      • NBJM8VJSQ4LW3RFOXWXQTIW4F4Q.exe (PID: 3132)
      • saved.exe (PID: 3300)

    • Checks proxy server information

      • saved.exe (PID: 3300)
      • powershell.exe (PID: 5408)

    • Creates files or folders in the user directory

      • saved.exe (PID: 3300)

    • Auto-launch of the file from Registry key

      • saved.exe (PID: 3300)

    • Manual execution by a user

      • b6785b010c.exe (PID: 4448)
      • c0ea85d9ba.exe (PID: 6004)
      • mshta.exe (PID: 6108)
      • 5060b22d8f.exe (PID: 5176)
      • f69150613a.exe (PID: 672)
      • mshta.exe (PID: 6252)

    • Reads mouse settings

      • 5060b22d8f.exe (PID: 5400)
      • f69150613a.exe (PID: 4628)
      • 5060b22d8f.exe (PID: 5176)
      • f69150613a.exe (PID: 672)

    • Application launched itself

      • firefox.exe (PID: 5576)
      • firefox.exe (PID: 6468)
      • firefox.exe (PID: 5360)
      • firefox.exe (PID: 2420)

    • Auto-launch of the file from Task Scheduler

      • cmd.exe (PID: 6576)
      • cmd.exe (PID: 3132)

    • Reads Internet Explorer settings

      • mshta.exe (PID: 6248)
      • mshta.exe (PID: 6108)
      • mshta.exe (PID: 4776)
      • mshta.exe (PID: 6252)

    • The sample compiled with english language support

      • saved.exe (PID: 3300)
      • 97e9ac22c3.tmp (PID: 7432)
      • 4ae65c23f5.exe (PID: 7900)

    • Attempting to use instant messaging service

      • MSBuild.exe (PID: 3140)

    • Disables trace logs

      • powershell.exe (PID: 5408)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 7456)

    • The executable file from the user directory is run by the Powershell process

      • TempVKG2HC8FEJJPRHDIYPZ3TETUWXGGEOGX.EXE (PID: 2332)
      • TempV5NYT5I5KGWB8W6RFKN8RNX2XPHVIADO.EXE (PID: 2084)
      • TempVKG2HC8FEJJPRHDIYPZ3TETUWXGGEOGX.EXE (PID: 7548)
      • TempV5NYT5I5KGWB8W6RFKN8RNX2XPHVIADO.EXE (PID: 7944)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Lumma

(PID) Process(4880) random.exe
C2 (9)parakehjet.run/kewk
buzzarddf.live/ktnt
zenithcorde.top/auid
bearjk.live/benj
techguidet.digital/apdo
techsyncq.run/riid
btcgeared.live/lbak
clarmodq.top/qoxo
fishgh.digital/tequ

Amadey

(PID) Process(3300) saved.exe
C2185.39.17.163
URLhttp://185.39.17.163/Su8kud7i/index.php
Version5.34
Options
Drop directoryc13dbdc4fa
Drop namesaved.exe
Strings (125)S-%lu-
og:
clip.dll
ProgramData\
shell32.dll
<c>
vs:
Programs
&&
VideoID
ESET
av:
\App
0000043f
Doctor Web
:::
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
------
rundll32.exe
00000422
185.39.17.163
0123456789
st=s
00000419
Content-Type: application/x-www-form-urlencoded
/Plugins/
msi
ar:
GetNativeSystemInfo
Norton
-%lu
Sophos
zip
SOFTWARE\Microsoft\Windows NT\CurrentVersion
" Content-Type: application/octet-stream
|
+++
" && ren
pc:
#
d1
cmd /C RMDIR /s/q
Bitdefender
Comodo
<d>
Kaspersky Lab
DefaultSettings.YResolution
Main
c13dbdc4fa
-executionpolicy remotesigned -File "
&& Exit"
ProductName
&unit=
2022
Panda Security
=
Rem
cmd
\0000
id:
sd:
--
/quiet
rundll32
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
%-lu
random
GET
"taskkill /f /im "
Content-Disposition: form-data; name="data"; filename="
00000423
5.34
2016
?scr=1
ComputerName
Keyboard Layout\Preload
Powershell.exe
POST
http://
AVAST Software
SYSTEM\CurrentControlSet\Control\UnitedVideo\CONTROL\VIDEO\
ps1
DefaultSettings.XResolution
Startup
CurrentBuild
e3
cred.dll|clip.dll|
------
WinDefender
wb
https://
Avira
2025
" && timeout 1 && del
cred.dll
un:
SYSTEM\ControlSet001\Services\BasicDisplay\Video
rb
SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName
360TotalSecurity
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
saved.exe
e1
lv:
/Su8kud7i/index.php
shutdown -s -t 0
/k
e2
SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
exe
%USERPROFILE%
-unicode-
r=
.jpg
dll
Content-Type: multipart/form-data; boundary=----
2019
bi:
\
"
kernel32.dll
os:
abcdefghijklmnopqrstuvwxyz0123456789-_
dm:
AVG
No Malware configuration.

TRiD

.exe | Generic Win/DOS Executable (50)
.exe | DOS Executable Generic (49.9)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2025:04:26 14:47:23+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14
CodeSize: 312320
InitializedDataSize: 38400
UninitializedDataSize: -
EntryPoint: 0x4aa000
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
232
Monitored processes
102
Malicious processes
27
Suspicious processes
7

Behavior graph

Click at the process to see the details
start #LUMMA random.exe #LUMMA svchost.exe sppextcomobj.exe no specs slui.exe #AMADEY nbjm8vjsq4lw3rfoxwxqtiw4f4q.exe #AMADEY saved.exe #LUMMA b6785b010c.exe c0ea85d9ba.exe no specs c0ea85d9ba.exe #LUMMA b6785b010c.exe c0ea85d9ba.exe no specs 1c7f0t4qe5a65ucodvm4g.exe no specs #CREDENTIALFLUSHER 5060b22d8f.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs #CREDENTIALFLUSHER firefox.exe no specs firefox.exe f69150613a.exe no specs cmd.exe no specs mshta.exe no specs conhost.exe no specs aufsv5xgfh1y5e4q35fa.exe no specs schtasks.exe no specs firefox.exe no specs firefox.exe no specs #AMADEY powershell.exe conhost.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs ebc37b4f82.exe no specs #LUMMA msbuild.exe mshta.exe no specs powershell.exe no specs conhost.exe no specs #CREDENTIALFLUSHER 5060b22d8f.exe no specs f69150613a.exe no specs cmd.exe no specs mshta.exe no specs conhost.exe no specs schtasks.exe no specs #AMADEY powershell.exe conhost.exe no specs taskkill.exe no specs conhost.exe no specs firefox.exe no specs tempvkg2hc8fejjprhdiypz3tetuwxggeogx.exe no specs firefox.exe no specs mshta.exe no specs 97e9ac22c3.exe #AMADEY powershell.exe conhost.exe no specs 97e9ac22c3.tmp taskkill.exe no specs conhost.exe no specs tempvkg2hc8fejjprhdiypz3tetuwxggeogx.exe no specs taskkill.exe no specs conhost.exe no specs tempv5nyt5i5kgwb8w6rfkn8rnx2xphviado.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs #CREDENTIALFLUSHER firefox.exe no specs firefox.exe firefox.exe no specs firefox.exe no specs THREAT putty.exe no specs firefox.exe no specs core.exe #GENERIC 4ae65c23f5.exe tempv5nyt5i5kgwb8w6rfkn8rnx2xphviado.exe no specs info.exe conhost.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs saved.exe no specs firefox.exe no specs aj2napd.exe no specs #PURECRYPTER msbuild.exe aj2napd.exe no specs #PURECRYPTER msbuild.exe slui.exe no specs #GCLEANER svchost015.exe powershell.exe no specs conhost.exe no specs saved.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
208\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—taskkill.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
496\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
616"C:\Users\admin\AppData\Local\Temp\10053590101\b6785b010c.exe" C:\Users\admin\AppData\Local\Temp\10053590101\b6785b010c.exe
saved.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\10053590101\b6785b010c.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
672C:\Users\admin\AppData\Local\Temp\10053620101\f69150613a.exeC:\Users\admin\AppData\Local\Temp\10053620101\f69150613a.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\10053620101\f69150613a.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\psapi.dll
c:\windows\syswow64\user32.dll
736"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1852 -parentBuildID 20240213221259 -prefsHandle 1780 -prefMapHandle 1772 -prefsLen 31031 -prefMapSize 244583 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8edecc4d-b348-4dfa-bec4-9024cf2cf3b3} 6468 "\\.\pipe\gecko-crash-server-pipe.6468" 245f85efb10 gpuC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
1
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\vcruntime140.dll
1052C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
1240taskkill /F /IM opera.exe /TC:\Windows\SysWOW64\taskkill.exe—5060b22d8f.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Terminates Processes
Exit code:
128
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\taskkill.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
1676"C:\Users\admin\AppData\Local\Temp\1C7F0T4QE5A65UCODVM4G.exe"C:\Users\admin\AppData\Local\Temp\1C7F0T4QE5A65UCODVM4G.exe—b6785b010c.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\1c7f0t4qe5a65ucodvm4g.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
2084"C:\Users\admin\AppData\Local\TempV5NYT5I5KGWB8W6RFKN8RNX2XPHVIADO.EXE" C:\Users\admin\AppData\Local\TempV5NYT5I5KGWB8W6RFKN8RNX2XPHVIADO.EXE—powershell.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\tempv5nyt5i5kgwb8w6rfkn8rnx2xphviado.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
2104\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
67 377
Read events
67 305
Write events
72
Delete events
0

Modification events

(PID) Process:(3300) saved.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(3300) saved.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(3300) saved.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(3300) saved.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:b6785b010c.exe
Value:
C:\Users\admin\AppData\Local\Temp\10053590101\b6785b010c.exe
(PID) Process:(3300) saved.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:c0ea85d9ba.exe
Value:
C:\Users\admin\AppData\Local\Temp\10053600101\c0ea85d9ba.exe
(PID) Process:(3300) saved.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:5060b22d8f.exe
Value:
C:\Users\admin\AppData\Local\Temp\10053610101\5060b22d8f.exe
(PID) Process:(4996) c0ea85d9ba.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features
Operation:writeName:TamperProtection
Value:
0
(PID) Process:(4996) c0ea85d9ba.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender
Operation:writeName:DisableAntiSpyware
Value:
1
(PID) Process:(4996) c0ea85d9ba.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection
Operation:writeName:DisableBehaviorMonitoring
Value:
1
(PID) Process:(4996) c0ea85d9ba.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection
Operation:writeName:DisableIOAVProtection
Value:
1
Executable files
33
Suspicious files
197
Text files
44
Unknown types
0

Dropped files

PID
Process
Filename
Type
6468firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\9kie7cg6.default-release\startupCache\scriptCache-current.bin —
MD5:—
SHA256:—
4448b6785b010c.exeC:\Users\admin\AppData\Local\Temp\AUFSV5XGFH1Y5E4Q35FA.exeexecutable
MD5:F6C20A18AFEAC04964A6CCAD6BE59731
SHA256:CE75F9DEDE6D4E93549D35B816898113B6BEFAB9EF0AADF8949D4887C2C34BEA
3132NBJM8VJSQ4LW3RFOXWXQTIW4F4Q.exeC:\Windows\Tasks\saved.jobbinary
MD5:61B6308BF2D18D293AAA77E0AA540499
SHA256:1C98BF3572401CC494ED34B54A1562C8F1AE2366B88AE16504282E8EFFED6D3F
616b6785b010c.exeC:\Users\admin\AppData\Local\Temp\1C7F0T4QE5A65UCODVM4G.exeexecutable
MD5:F6C20A18AFEAC04964A6CCAD6BE59731
SHA256:CE75F9DEDE6D4E93549D35B816898113B6BEFAB9EF0AADF8949D4887C2C34BEA
3300saved.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\RR3E01RZ\random[1].exeexecutable
MD5:231AB4BCE5B757C4192D6EA2A00F91CD
SHA256:11AA99CC6BD19F85E4E795117373DE82E4541BAEA3B1015026113F2402E97521
3300saved.exeC:\Users\admin\AppData\Local\Temp\10053610101\5060b22d8f.exeexecutable
MD5:14949A3C0CD364C768E9576FD1B8E28E
SHA256:7E86F954CB5F80D20384F11A3743D1C1D686624AEE637C2802B3590BCCA5A12A
3300saved.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\KCV3KQBA\random[1].exeexecutable
MD5:68EA66611DE4C7EE3830D902D7ED210E
SHA256:54B878402A8010616FF92973879DB6AF8C663ADCA24EE5B2CD77D477913A34B6
3300saved.exeC:\Users\admin\AppData\Local\Temp\10053620101\f69150613a.exeexecutable
MD5:3AFF002CFF8A3B07DA5B879D8B538C34
SHA256:BFA499DE4BE23071015CB48C5BEA1A178767AD93EFD221A87B4895CF859EF414
4628f69150613a.exeC:\Users\admin\AppData\Local\Temp\JdpSgLHx0.htahtml
MD5:54EA03F60E452ED9E325A23C1C353997
SHA256:207A67F8BE526B86F162FC3ACCB685D0503D6B7E402554B5E465AF18980964A5
3300saved.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\RR3E01RZ\random[2].exeexecutable
MD5:3AFF002CFF8A3B07DA5B879D8B538C34
SHA256:BFA499DE4BE23071015CB48C5BEA1A178767AD93EFD221A87B4895CF859EF414
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
91
TCP/UDP connections
176
DNS requests
169
Threats
82

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
23.216.77.28:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
23.54.109.203:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
4880
random.exe
GET
200
185.39.17.162:80
http://185.39.17.162/mine/random.exe
unknown
—
—
malicious
3300
saved.exe
POST
200
185.39.17.163:80
http://185.39.17.163/Su8kud7i/index.php
unknown
—
—
malicious
3300
saved.exe
POST
200
185.39.17.163:80
http://185.39.17.163/Su8kud7i/index.php
unknown
—
—
malicious
3300
saved.exe
GET
200
185.39.17.162:80
http://185.39.17.162/luma/random.exe
unknown
—
—
malicious
3300
saved.exe
POST
200
185.39.17.163:80
http://185.39.17.163/Su8kud7i/index.php
unknown
—
—
malicious
3300
saved.exe
GET
200
185.39.17.162:80
http://185.39.17.162/off/random.exe
unknown
—
—
malicious
3300
saved.exe
POST
200
185.39.17.163:80
http://185.39.17.163/Su8kud7i/index.php
unknown
—
—
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
23.216.77.28:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4880
random.exe
104.21.51.232:443
zenithcorde.top
CLOUDFLARENET
—
unknown
3216
svchost.exe
172.211.123.249:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
20.190.160.20:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
23.54.109.203:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
4880
random.exe
185.39.17.162:80
—
Joint Stock Company Tagnet
RU
malicious
3300
saved.exe
185.39.17.163:80
—
Joint Stock Company Tagnet
RU
malicious

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 40.127.240.158
whitelisted
crl.microsoft.com
  • 23.216.77.28
  • 23.216.77.6
whitelisted
www.microsoft.com
  • 23.35.229.160
whitelisted
google.com
  • 142.250.185.78
whitelisted
clarmodq.top
  • —
malicious
zenithcorde.top
  • 104.21.51.232
  • 172.67.190.162
unknown
client.wns.windows.com
  • 172.211.123.249
whitelisted
login.live.com
  • 20.190.160.20
  • 20.190.160.4
  • 20.190.160.130
  • 20.190.160.65
  • 20.190.160.67
  • 40.126.32.72
  • 20.190.160.14
  • 20.190.160.128
  • 20.190.159.23
  • 20.190.159.71
  • 40.126.31.0
  • 40.126.31.1
  • 20.190.159.128
  • 20.190.159.130
  • 40.126.31.3
  • 40.126.31.69
whitelisted
ocsp.digicert.com
  • 23.54.109.203
whitelisted
slscr.update.microsoft.com
  • 52.149.20.212
whitelisted

Threats

PID
Process
Class
Message
—
—
A Network Trojan was detected
MALWARE [ANY.RUN] Suspected Domain Associated with Malware Distribution (clarmodq .top)
—
—
Potentially Bad Traffic
ET DNS Query to a *.top domain - Likely Hostile
—
—
Domain Observed Used for C2 Detected
ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (clarmodq .top)
—
—
Potentially Bad Traffic
ET INFO Executable Download from dotted-quad Host
—
—
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
—
—
Potentially Bad Traffic
ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response
—
—
Potential Corporate Privacy Violation
ET INFO PE EXE or DLL Windows file download HTTP
—
—
Misc activity
ET INFO Packed Executable Download
—
—
Malware Command and Control Activity Detected
BOTNET [ANY.RUN] Amadey HTTP POST Request (st=s)
—
—
Malware Command and Control Activity Detected
ET MALWARE Amadey CnC Response
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
random.exe