File name:

random.exe

Full analysis: https://app.any.run/tasks/54458c54-23e2-4c8f-a81f-6df912a31a6d
Verdict: Malicious activity
Threats:

Amadey is a formidable Windows infostealer threat, characterized by its persistence mechanisms, modular design, and ability to execute various malicious tasks.

Malware Trends Tracker     >>>
Analysis date: May 16, 2025, 18:38:23
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
auto-sch
loader
amadey
botnet
stealer
telegram
lumma
rdp
gcleaner
evasion
miner
hijackloader
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:

6A497A436F0FF474236190EDF4E2561C

SHA1:

559313D20F26F3896E494A81855F7C0FF882A92F

SHA256:

DF6E05A0551D6EFF724A1D53321DE670319EFA5AF95C75250E7431FCFEB1B92C

SSDEEP:

49152:aPPkzemqoSut3Jh4+QQ/btosJwIA4hHmZlKH2Tw/Pq83zw0bCjvk9G661QGtBWXo:wP/mp7t3T4+B/btosJwIA4hHmZlKH2TK

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Uses Task Scheduler to run other applications

      • cmd.exe (PID: 5024)

    • Run PowerShell with an invisible window

      • powershell.exe (PID: 7236)
      • powershell.exe (PID: 7624)

    • Script downloads file (POWERSHELL)

      • powershell.exe (PID: 7236)
      • powershell.exe (PID: 7624)

    • AMADEY mutex has been found

      • Temp4V61UCF0PKMDI5UFEZKRTGD4YVNOTOQM.EXE (PID: 8008)
      • ramez.exe (PID: 8160)
      • Temp4V61UCF0PKMDI5UFEZKRTGD4YVNOTOQM.EXE (PID: 5428)
      • ramez.exe (PID: 7644)

    • Connects to the CnC server

      • ramez.exe (PID: 8160)
      • svchost.exe (PID: 2196)
      • cmd.exe (PID: 2244)

    • AMADEY has been detected (YARA)

      • ramez.exe (PID: 8160)

    • Request from PowerShell that ran from MSHTA.EXE

      • powershell.exe (PID: 7236)

    • Executing a file with an untrusted certificate

      • ZGSI81i.exe (PID: 6972)
      • Hashrate_Vorte.exe (PID: 6620)
      • Hashrate_Vorte.exe (PID: 2096)
      • ra02W4S.exe (PID: 7504)
      • Hashrate_Vorte.exe (PID: 8012)

    • LUMMA has been detected (YARA)

      • MSBuild.exe (PID: 5056)

    • LUMMA has been detected (SURICATA)

      • svchost.exe (PID: 2196)
      • MSBuild.exe (PID: 5376)
      • MSBuild.exe (PID: 5056)

    • HIJACKLOADER has been detected (YARA)

      • Hashrate_Vorte.exe (PID: 2096)

    • Changes Windows Defender settings

      • WinTemp-v4.exe (PID: 8052)

    • Known privilege escalation attack

      • dllhost.exe (PID: 7872)
      • dllhost.exe (PID: 8008)

    • Adds process to the Windows Defender exclusion list

      • WinTemp-v4.exe (PID: 8052)

    • Starts REAGENTC.EXE to disable the Windows Recovery Environment

      • ReAgentc.exe (PID: 6644)

    • Uses Task Scheduler to autorun other applications

      • WinTemp-v4.exe (PID: 8052)

    • GCLEANER has been detected (SURICATA)

      • ra02W4S.exe (PID: 7504)
      • 80981760b9.exe (PID: 4776)

    • MINER has been detected (SURICATA)

      • cmd.exe (PID: 2244)

    • AMADEY has been detected (SURICATA)

      • ramez.exe (PID: 8160)

    • LUMMA mutex has been found

      • MSBuild.exe (PID: 5376)

  • SUSPICIOUS

    • Starts CMD.EXE for commands execution

      • random.exe (PID: 4300)
      • Hashrate_Vorte.exe (PID: 2096)
      • WinTemp-v4.exe (PID: 8052)
      • Hashrate_Vorte.exe (PID: 8012)

    • Found IP address in command line

      • powershell.exe (PID: 7236)
      • powershell.exe (PID: 7624)

    • Probably download files using WebClient

      • mshta.exe (PID: 6620)
      • mshta.exe (PID: 7544)

    • Starts process via Powershell

      • powershell.exe (PID: 7624)
      • powershell.exe (PID: 7236)

    • Starts POWERSHELL.EXE for commands execution

      • mshta.exe (PID: 7544)
      • mshta.exe (PID: 6620)
      • WinTemp-v4.exe (PID: 8052)
      • cmd.exe (PID: 7460)
      • creativedatarecovery93.exe (PID: 1272)
      • MYWeHdr2p.exe (PID: 3156)

    • Executable content was dropped or overwritten

      • powershell.exe (PID: 7236)
      • Temp4V61UCF0PKMDI5UFEZKRTGD4YVNOTOQM.EXE (PID: 8008)
      • ramez.exe (PID: 8160)
      • Hashrate_Vorte.exe (PID: 6620)
      • oxDU0MW.exe (PID: 7612)
      • WinTemp-v4.exe (PID: 8052)
      • ra02W4S.exe (PID: 7504)
      • 6ttiUpPWp8o8r.exe (PID: 2240)
      • Hashrate_Vorte.exe (PID: 8012)
      • 6ttiUpPWp8o8r.tmp (PID: 5588)
      • creativedatarecovery93.exe (PID: 1272)

    • Potential Corporate Privacy Violation

      • powershell.exe (PID: 7236)
      • ramez.exe (PID: 8160)
      • ra02W4S.exe (PID: 7504)
      • cmd.exe (PID: 2244)

    • Connects to the server without a host name

      • powershell.exe (PID: 7236)
      • ramez.exe (PID: 8160)
      • ra02W4S.exe (PID: 7504)
      • 80981760b9.exe (PID: 4776)

    • Manipulates environment variables

      • powershell.exe (PID: 7236)
      • powershell.exe (PID: 7624)

    • Reads security settings of Internet Explorer

      • Temp4V61UCF0PKMDI5UFEZKRTGD4YVNOTOQM.EXE (PID: 8008)
      • ramez.exe (PID: 8160)
      • ra02W4S.exe (PID: 7504)

    • Process requests binary or script from the Internet

      • powershell.exe (PID: 7236)
      • ramez.exe (PID: 8160)

    • Starts itself from another location

      • Temp4V61UCF0PKMDI5UFEZKRTGD4YVNOTOQM.EXE (PID: 8008)
      • Hashrate_Vorte.exe (PID: 6620)

    • Contacting a server suspected of hosting an CnC

      • ramez.exe (PID: 8160)
      • svchost.exe (PID: 2196)
      • MSBuild.exe (PID: 5376)
      • MSBuild.exe (PID: 5056)
      • SScheduler.exe (PID: 4932)

    • There is functionality for enable RDP (YARA)

      • ramez.exe (PID: 8160)

    • There is functionality for taking screenshot (YARA)

      • ramez.exe (PID: 8160)
      • MSBuild.exe (PID: 5056)

    • Process communicates with Telegram (possibly using it as an attacker's C2 server)

      • MSBuild.exe (PID: 5056)
      • MYWeHdr2p.exe (PID: 3156)

    • Reads the Windows owner or organization settings

      • msiexec.exe (PID: 7264)

    • Process drops legitimate windows executable

      • msiexec.exe (PID: 7264)
      • Hashrate_Vorte.exe (PID: 6620)
      • 6ttiUpPWp8o8r.tmp (PID: 5588)

    • The process drops C-runtime libraries

      • msiexec.exe (PID: 7264)
      • Hashrate_Vorte.exe (PID: 6620)
      • 6ttiUpPWp8o8r.tmp (PID: 5588)

    • The process executes via Task Scheduler

      • ramez.exe (PID: 7644)
      • ramez.exe (PID: 5376)

    • Searches for installed software

      • MSBuild.exe (PID: 5376)

    • Script adds exclusion process to Windows Defender

      • WinTemp-v4.exe (PID: 8052)

    • Script adds exclusion path to Windows Defender

      • WinTemp-v4.exe (PID: 8052)

    • Takes ownership (TAKEOWN.EXE)

      • cmd.exe (PID: 7308)

    • Executes application which crashes

      • Win-v42.exe (PID: 5308)
      • Win-v41.exe (PID: 4380)

    • Uses ICACLS.EXE to modify access control lists

      • cmd.exe (PID: 6740)
      • cmd.exe (PID: 680)

    • Hides command output

      • cmd.exe (PID: 7796)

    • Uses powercfg.exe to modify the power settings

      • WinTemp-v4.exe (PID: 8052)

    • Checks for external IP

      • svchost.exe (PID: 2196)
      • WinTemp-v4.exe (PID: 8052)

    • Connects to unusual port

      • WinTemp-v4.exe (PID: 8052)
      • cmd.exe (PID: 2244)
      • SScheduler.exe (PID: 4932)

    • Executes as Windows Service

      • cmd.exe (PID: 7460)

    • Probably obfuscated PowerShell command line is found

      • cmd.exe (PID: 7460)

    • Invokes assembly entry point (POWERSHELL)

      • powershell.exe (PID: 4056)

    • Base64-obfuscated command line is found

      • MYWeHdr2p.exe (PID: 3156)

    • The process bypasses the loading of PowerShell profile settings

      • MYWeHdr2p.exe (PID: 3156)

    • BASE64 encoded PowerShell command has been detected

      • MYWeHdr2p.exe (PID: 3156)

    • The process hide an interactive prompt from the user

      • MYWeHdr2p.exe (PID: 3156)

  • INFO

    • Checks supported languages

      • random.exe (PID: 4300)
      • Temp4V61UCF0PKMDI5UFEZKRTGD4YVNOTOQM.EXE (PID: 8008)
      • ramez.exe (PID: 8160)
      • Temp4V61UCF0PKMDI5UFEZKRTGD4YVNOTOQM.EXE (PID: 5428)
      • ZGSI81i.exe (PID: 6972)
      • MSBuild.exe (PID: 5056)
      • msiexec.exe (PID: 7264)
      • Hashrate_Vorte.exe (PID: 6620)
      • ramez.exe (PID: 7644)
      • 08IyOOF.exe (PID: 7544)
      • MSBuild.exe (PID: 5376)
      • ra02W4S.exe (PID: 7504)
      • oxDU0MW.exe (PID: 7612)
      • WinTemp-v4.exe (PID: 8052)
      • Hashrate_Vorte.exe (PID: 2096)

    • The sample compiled with english language support

      • random.exe (PID: 4300)
      • msiexec.exe (PID: 7264)
      • Hashrate_Vorte.exe (PID: 6620)
      • ramez.exe (PID: 8160)
      • Hashrate_Vorte.exe (PID: 8012)
      • 6ttiUpPWp8o8r.tmp (PID: 5588)
      • ra02W4S.exe (PID: 7504)

    • Reads the computer name

      • random.exe (PID: 4300)
      • Temp4V61UCF0PKMDI5UFEZKRTGD4YVNOTOQM.EXE (PID: 8008)
      • ramez.exe (PID: 8160)
      • MSBuild.exe (PID: 5056)
      • msiexec.exe (PID: 7264)
      • Hashrate_Vorte.exe (PID: 6620)
      • Hashrate_Vorte.exe (PID: 2096)
      • MSBuild.exe (PID: 5376)
      • oxDU0MW.exe (PID: 7612)
      • ra02W4S.exe (PID: 7504)

    • Reads mouse settings

      • random.exe (PID: 4300)

    • Create files in a temporary directory

      • random.exe (PID: 4300)
      • Temp4V61UCF0PKMDI5UFEZKRTGD4YVNOTOQM.EXE (PID: 8008)
      • ramez.exe (PID: 8160)
      • Hashrate_Vorte.exe (PID: 2096)
      • oxDU0MW.exe (PID: 7612)

    • Manual execution by a user

      • mshta.exe (PID: 7544)
      • Win-v42.exe (PID: 5308)

    • Reads Internet Explorer settings

      • mshta.exe (PID: 6620)
      • mshta.exe (PID: 7544)

    • Disables trace logs

      • powershell.exe (PID: 7236)

    • Checks proxy server information

      • powershell.exe (PID: 7236)
      • ramez.exe (PID: 8160)
      • ra02W4S.exe (PID: 7504)

    • Auto-launch of the file from Task Scheduler

      • cmd.exe (PID: 5024)

    • The executable file from the user directory is run by the Powershell process

      • Temp4V61UCF0PKMDI5UFEZKRTGD4YVNOTOQM.EXE (PID: 8008)
      • Temp4V61UCF0PKMDI5UFEZKRTGD4YVNOTOQM.EXE (PID: 5428)

    • Process checks computer location settings

      • Temp4V61UCF0PKMDI5UFEZKRTGD4YVNOTOQM.EXE (PID: 8008)
      • ramez.exe (PID: 8160)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 7624)
      • powershell.exe (PID: 8068)
      • powershell.exe (PID: 8020)

    • Creates files or folders in the user directory

      • ramez.exe (PID: 8160)
      • msiexec.exe (PID: 7264)

    • Reads the machine GUID from the registry

      • ramez.exe (PID: 8160)
      • oxDU0MW.exe (PID: 7612)

    • Reads the software policy settings

      • ramez.exe (PID: 8160)
      • MSBuild.exe (PID: 5056)
      • MSBuild.exe (PID: 5376)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 7264)

    • Creates a software uninstall entry

      • msiexec.exe (PID: 7264)

    • Creates files in the program directory

      • Hashrate_Vorte.exe (PID: 6620)

    • Attempting to use instant messaging service

      • MSBuild.exe (PID: 5056)
      • MYWeHdr2p.exe (PID: 3156)

    • Checks transactions between databases Windows and Oracle

      • oxDU0MW.exe (PID: 7612)

    • Reads security settings of Internet Explorer

      • dllhost.exe (PID: 7872)

    • Checks if a key exists in the options dictionary (POWERSHELL)

      • powershell.exe (PID: 8068)
      • powershell.exe (PID: 8020)

    • Creates or changes the value of an item property via Powershell

      • cmd.exe (PID: 7460)

    • Changes the registry key values via Powershell

      • creativedatarecovery93.exe (PID: 1272)

    • Application launched itself

      • chrome.exe (PID: 7256)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Amadey

(PID) Process(8160) ramez.exe
C2185.156.72.96
URLhttp://185.156.72.96/te4h2nus/index.php
Version5.34
Options
Drop directoryd610cf342e
Drop nameramez.exe
Strings (125)lv:
msi
Kaspersky Lab
av:
|
#
"
\App
00000422
dm:
Powershell.exe
ProgramData\
ps1
rundll32
http://
Content-Disposition: form-data; name="data"; filename="
SOFTWARE\Microsoft\Windows NT\CurrentVersion
dll
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
id:
VideoID
cred.dll|clip.dll|
0000043f
cmd
00000423
SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName
-executionpolicy remotesigned -File "
2022
------
2016
og:
\0000
CurrentBuild
2019
:::
S-%lu-
" && timeout 1 && del
ProductName
Panda Security
ESET
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
/k
+++
?scr=1
Doctor Web
GET
SYSTEM\ControlSet001\Services\BasicDisplay\Video
/quiet
.jpg
d610cf342e
vs:
sd:
rundll32.exe
"taskkill /f /im "
pc:
random
=
360TotalSecurity
<d>
wb
Content-Type: multipart/form-data; boundary=----
Startup
Norton
&& Exit"
os:
https://
SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
2025
Avira
%-lu
zip
POST
" Content-Type: application/octet-stream
Rem
/te4h2nus/index.php
------
5.34
<c>
clip.dll
AVAST Software
\
shell32.dll
" && ren
e3
ramez.exe
kernel32.dll
DefaultSettings.XResolution
d1
DefaultSettings.YResolution
185.156.72.96
r=
cred.dll
--
GetNativeSystemInfo
-%lu
ComputerName
&unit=
Keyboard Layout\Preload
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
ar:
Sophos
%USERPROFILE%
exe
e1
e2
st=s
Programs
0123456789
un:
rb
bi:
abcdefghijklmnopqrstuvwxyz0123456789-_
SYSTEM\CurrentControlSet\Control\UnitedVideo\CONTROL\VIDEO\
cmd /C RMDIR /s/q
Bitdefender
-unicode-
AVG
WinDefender
&&
shutdown -s -t 0
Comodo
00000419
Content-Type: application/x-www-form-urlencoded
/Plugins/
Main

Lumma

(PID) Process(5056) MSBuild.exe
C2 (10)emphatakpn.bet/ladk
featurlyin.top/pdal
overcovtcg.top/juhd
laminaflbx.shop/twoq
https://t.me/wermnjgk34
posseswsnc.top/akds
testcawepr.run/dsap
saxecocnak.live/manj
venaetdqfn.run/gjud
blackswmxc.top/bgry
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (76.4)
.exe | Win32 Executable (generic) (12.4)
.exe | Generic Win/DOS Executable (5.5)
.exe | DOS Executable Generic (5.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2025:05:16 16:46:26+00:00
ImageFileCharacteristics: Executable, Large address aware, 32-bit
PEType: PE32
LinkerVersion: 14.16
CodeSize: 633856
InitializedDataSize: 326144
UninitializedDataSize: -
EntryPoint: 0x20577
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
FileVersionNumber: 0.0.0.0
ProductVersionNumber: 0.0.0.0
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (British)
CharacterSet: Unicode
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
236
Monitored processes
98
Malicious processes
24
Suspicious processes
4

Behavior graph

Click at the process to see the details
start random.exe no specs cmd.exe no specs conhost.exe no specs mshta.exe no specs schtasks.exe no specs powershell.exe conhost.exe no specs sppextcomobj.exe no specs slui.exe mshta.exe no specs powershell.exe no specs conhost.exe no specs temp4v61ucf0pkmdi5ufezkrtgd4yvnotoqm.exe #AMADEY ramez.exe temp4v61ucf0pkmdi5ufezkrtgd4yvnotoqm.exe no specs zgsi81i.exe no specs conhost.exe no specs #LUMMA msbuild.exe msiexec.exe no specs msiexec.exe hashrate_vorte.exe #HIJACKLOADER hashrate_vorte.exe no specs ramez.exe no specs cmd.exe no specs conhost.exe no specs 08iyoof.exe no specs conhost.exe no specs #LUMMA msbuild.exe #LUMMA svchost.exe #GCLEANER ra02w4s.exe oxdu0mw.exe CMSTPLUA wintemp-v4.exe powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs reagentc.exe no specs win-v42.exe werfault.exe no specs slui.exe no specs cmd.exe no specs conhost.exe no specs takeown.exe no specs cmd.exe no specs conhost.exe no specs icacls.exe no specs cmd.exe no specs conhost.exe no specs icacls.exe no specs powercfg.exe no specs conhost.exe no specs powercfg.exe no specs conhost.exe no specs powercfg.exe no specs conhost.exe no specs powercfg.exe no specs conhost.exe no specs powercfg.exe no specs conhost.exe no specs powercfg.exe no specs conhost.exe no specs powercfg.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs ping.exe no specs CMSTPLUA hashrate_vorte.exe #GCLEANER 80981760b9.exe #MINER cmd.exe svchost.exe no specs cmd.exe no specs powershell.exe no specs conhost.exe no specs sscheduler.exe 6ttiuppwp8o8r.exe 6ttiuppwp8o8r.tmp creativedatarecovery93.exe powershell.exe no specs conhost.exe no specs win-v41.exe no specs werfault.exe no specs ramez.exe no specs mywehdr2p.exe cmd.exe no specs conhost.exe no specs a9khrwvhl.exe no specs chrome.exe no specs powershell.exe no specs conhost.exe no specs chrome.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
680cmd.exe /C icacls "%SystemRoot%\System32\reagentc.exe" /deny Everyone:RXC:\Windows\System32\cmd.exe—WinTemp-v4.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
1072powercfg /change monitor-timeout-dc 0C:\Windows\System32\powercfg.exe—WinTemp-v4.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Power Settings Command-Line Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\powercfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
1272"C:\Users\admin\AppData\Local\Creative Data Recovery 7.4.0.93\creativedatarecovery93.exe" -iC:\Users\admin\AppData\Local\Creative Data Recovery 7.4.0.93\creativedatarecovery93.exe
6ttiUpPWp8o8r.tmp
User:
admin
Integrity Level:
MEDIUM
Version:
7.4.0.93
Modules
Images
c:\users\admin\appdata\local\creative data recovery 7.4.0.93\creativedatarecovery93.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\user32.dll
c:\windows\syswow64\win32u.dll
1660C:\WINDOWS\system32\WerFault.exe -u -p 4380 -s 448C:\Windows\System32\WerFault.exe—Win-v41.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
1748powercfg /change monitor-timeout-ac 0C:\Windows\System32\powercfg.exe—WinTemp-v4.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Power Settings Command-Line Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\powercfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
2096C:\ProgramData\WBFSystem_test\Hashrate_Vorte.exeC:\ProgramData\WBFSystem_test\Hashrate_Vorte.exe
Hashrate_Vorte.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft OneNote
Exit code:
0
Version:
14.0.4763.1000
Modules
Images
c:\programdata\wbfsystem_test\hashrate_vorte.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
2196C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2240\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2240"C:\Users\admin\AppData\Roaming\MxNGPv2sT9\6ttiUpPWp8o8r.exe"C:\Users\admin\AppData\Roaming\MxNGPv2sT9\6ttiUpPWp8o8r.exe
ra02W4S.exe
User:
admin
Company:
Integrity Level:
MEDIUM
Description:
Creative Data Recovery Setup
Version:
Modules
Images
c:\users\admin\appdata\roaming\mxngpv2st9\6ttiuppwp8o8r.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
2244schtasks /create /tn o8HlXmajqwO /tr "mshta C:\Users\admin\AppData\Local\Temp\BokD1bPCh.hta" /sc minute /mo 25 /ru "admin" /fC:\Windows\SysWOW64\schtasks.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Task Scheduler Configuration Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
Total events
56 590
Read events
56 344
Write events
174
Delete events
72

Modification events

(PID) Process:(6620) mshta.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(6620) mshta.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(6620) mshta.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(7544) mshta.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(7544) mshta.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(7544) mshta.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(7236) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(7236) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(7236) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(7236) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:FileTracingMask
Value:
Executable files
59
Suspicious files
65
Text files
28
Unknown types
1

Dropped files

PID
Process
Filename
Type
8160ramez.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\KCV3KQBA\AQZYUKXC[1].msi —
MD5:—
SHA256:—
8160ramez.exeC:\Users\admin\AppData\Local\Temp\10127730271\AQZYUKXC.msi —
MD5:—
SHA256:—
7264msiexec.exeC:\Windows\Installer\112911.msi —
MD5:—
SHA256:—
8160ramez.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\RR3E01RZ\ZGSI81i[1].exeexecutable
MD5:4019F43F477B70D6C0B0D482EB7769A7
SHA256:4B49ECDAC3221F60F27BF1FC2950F86A5FF640FAB62729C4A6A84717A828BB3C
8160ramez.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850Dbinary
MD5:C7E09C7C90F49E93F9D2D48526B06ECF
SHA256:B9A7B2611DAAE08300975AECFA4A3B319491ABB4810D18DAAD64B8EF2D0583C2
8160ramez.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BF4A23BF936A851ECBACCE498A36771binary
MD5:399692276C050F2A36EE09E80645D57D
SHA256:51E3DA0ADF4F6DAA74F2046781577F03489813F309E05ACD142732C38E92D607
4300random.exeC:\Users\admin\AppData\Local\Temp\BokD1bPCh.htahtml
MD5:07CF2A10DA380CA1022CC91C070A57A5
SHA256:F26984C7D3021AC39095F82BD9BD238B2CF191DF4B39DEE1FB95B567CBB55C22
7264msiexec.exeC:\Windows\Installer\MSI2A59.tmpbinary
MD5:D4116EBCB30B30A53A1DD524199C0EDC
SHA256:92E5AAE8A65DCBCFB5F763140658E010A791609B2B62F3A78C6F5F10F6CCEDAB
7236powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_ntpcy2fj.dnd.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
8008Temp4V61UCF0PKMDI5UFEZKRTGD4YVNOTOQM.EXEC:\Users\admin\AppData\Local\Temp\d610cf342e\ramez.exeexecutable
MD5:26CC5A6CFD8E8ECC433337413C14CDDB
SHA256:2D904D576B46236BAF504DBA21775F6EBBBD0F65272A9C2FCA1C6798184FA4E8
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
46
TCP/UDP connections
60
DNS requests
36
Threats
62

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
23.48.23.144:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
8160
ramez.exe
GET
200
104.18.38.233:80
http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEDlyRDr5IrdR19NsEN0xNZU%3D
unknown
—
—
whitelisted
8160
ramez.exe
GET
200
185.156.72.2:80
http://185.156.72.2/files/5494432675/ZGSI81i.exe
unknown
—
—
unknown
7236
powershell.exe
GET
200
185.156.72.2:80
http://185.156.72.2/testmine/random.exe
unknown
—
—
unknown
8160
ramez.exe
GET
200
104.18.38.233:80
http://ocsp.sectigo.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRDC9IOTxN6GmyRjyTl2n4yTUczyAQUjYxexFStiuF36Zv5mwXhuAGNYeECEDIJNp8i8WsBCf5KFrBaGFM%3D
unknown
—
—
whitelisted
5416
SIHClient.exe
GET
—
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
8160
ramez.exe
GET
200
185.156.72.2:80
http://185.156.72.2/files/740061926/ra02W4S.exe
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
23.48.23.144:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
5496
MoUsoCoreWorker.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3216
svchost.exe
172.211.123.250:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
7236
powershell.exe
185.156.72.2:80
—
Tov Vaiz Partner
RU
unknown
6544
svchost.exe
40.126.31.0:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
whitelisted
crl.microsoft.com
  • 23.48.23.144
  • 23.48.23.147
  • 23.48.23.150
  • 23.48.23.156
  • 23.48.23.145
  • 23.48.23.146
  • 23.48.23.157
  • 23.48.23.158
  • 23.48.23.155
whitelisted
www.microsoft.com
  • 23.35.229.160
  • 2.23.246.101
whitelisted
google.com
  • 216.58.206.46
whitelisted
client.wns.windows.com
  • 172.211.123.250
whitelisted
login.live.com
  • 40.126.31.0
  • 40.126.31.131
  • 20.190.159.73
  • 40.126.31.129
  • 20.190.159.130
  • 20.190.159.0
  • 40.126.31.71
  • 20.190.159.4
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
t.me
  • 149.154.167.99
whitelisted
venaetdqfn.run
  • 104.21.96.1
  • 104.21.64.1
  • 104.21.80.1
  • 104.21.112.1
  • 104.21.48.1
  • 104.21.16.1
  • 104.21.32.1
unknown
updatefilescdn.b-cdn.net
  • 169.150.247.35
whitelisted

Threats

PID
Process
Class
Message
7236
powershell.exe
Misc Attack
ET DROP Spamhaus DROP Listed Traffic Inbound group 34
7236
powershell.exe
Potentially Bad Traffic
ET INFO Executable Download from dotted-quad Host
7236
powershell.exe
Misc activity
ET INFO Packed Executable Download
7236
powershell.exe
Potential Corporate Privacy Violation
ET INFO PE EXE or DLL Windows file download HTTP
7236
powershell.exe
Potentially Bad Traffic
ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response
7236
powershell.exe
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
8160
ramez.exe
Misc Attack
ET DROP Spamhaus DROP Listed Traffic Inbound group 34
8160
ramez.exe
Malware Command and Control Activity Detected
BOTNET [ANY.RUN] Amadey HTTP POST Request (st=s)
8160
ramez.exe
Malware Command and Control Activity Detected
ET MALWARE Amadey CnC Response
8160
ramez.exe
Potentially Bad Traffic
ET INFO Executable Download from dotted-quad Host
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
random.exe