File name:

!~!SetUp_2025_Pa$W0rd$s!!%!~.zip

Full analysis: https://app.any.run/tasks/25cbd245-9d30-41c1-b38a-1c55db6ce739
Verdict: Malicious activity
Threats:

Amadey is a formidable Windows infostealer threat, characterized by its persistence mechanisms, modular design, and ability to execute various malicious tasks.

Analysis date: July 10, 2024, 23:27:43
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
lumma
stealer
hijackloader
loader
amadey
botnet
Indicators:
MIME: application/zip
File info: Zip archive data, at least v1.0 to extract, compression method=store
MD5:

0BCEB88AED8C6BB2F5D20C050AF530B3

SHA1:

6EC563E2CC84BD115CA4C325F25860D9C7A57149

SHA256:

EDEF6777BE8DBB15748BCF1332C0A7E49E5D8B8793FF23CCFB41DA2D3FF1C0CC

SSDEEP:

98304:cDHO/pJ5SiENUUiB1YHbpYieHWSOQsEZbOq8fvNpF0aC3N3DMIh+JA1TzCBgbT9D:zg6

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 4164)
      • Setup.exe (PID: 2704)
      • more.com (PID: 752)
    • LUMMA has been detected (SURICATA)

      • SearchIndexer.exe (PID: 6392)
    • LUMMA has been detected (YARA)

      • SearchIndexer.exe (PID: 6392)
    • HIJACKLOADER has been detected (YARA)

      • SearchIndexer.exe (PID: 6392)
      • more.com (PID: 752)
      • TraceFmt.exe (PID: 6172)
      • SearchIndexer.exe (PID: 4372)
    • Actions looks like stealing of personal data

      • SearchIndexer.exe (PID: 6392)
    • AMADEY has been detected (YARA)

      • SearchIndexer.exe (PID: 4372)
    • Connects to the CnC server

      • SearchIndexer.exe (PID: 4372)
    • AMADEY has been detected (SURICATA)

      • SearchIndexer.exe (PID: 4372)
  • SUSPICIOUS

    • Process drops legitimate windows executable

      • WinRAR.exe (PID: 4164)
      • Setup.exe (PID: 2704)
      • more.com (PID: 752)
    • Executable content was dropped or overwritten

      • Setup.exe (PID: 2704)
      • SearchIndexer.exe (PID: 6392)
      • more.com (PID: 752)
    • Starts application with an unusual extension

      • Setup.exe (PID: 2704)
      • 5D57C09NDIXS9EN7C9D3P.exe (PID: 6824)
      • 69KCWI9GAC9GWBGP6YQVF78T9XC8A94.exe (PID: 5236)
    • Searches for installed software

      • SearchIndexer.exe (PID: 6392)
    • Starts a Microsoft application from unusual location

      • TraceFmt.exe (PID: 6172)
    • Contacting a server suspected of hosting an CnC

      • SearchIndexer.exe (PID: 4372)
  • INFO

    • Checks supported languages

      • Setup.exe (PID: 2704)
      • more.com (PID: 6380)
      • more.com (PID: 752)
      • 5D57C09NDIXS9EN7C9D3P.exe (PID: 6824)
      • more.com (PID: 3624)
      • TraceFmt.exe (PID: 6172)
      • 69KCWI9GAC9GWBGP6YQVF78T9XC8A94.exe (PID: 5236)
    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 4164)
    • Reads the computer name

      • Setup.exe (PID: 2704)
      • more.com (PID: 6380)
      • 69KCWI9GAC9GWBGP6YQVF78T9XC8A94.exe (PID: 5236)
      • 5D57C09NDIXS9EN7C9D3P.exe (PID: 6824)
      • more.com (PID: 3624)
      • more.com (PID: 752)
      • TraceFmt.exe (PID: 6172)
    • Manual execution by a user

      • Setup.exe (PID: 2704)
    • Creates files or folders in the user directory

      • Setup.exe (PID: 2704)
    • Create files in a temporary directory

      • Setup.exe (PID: 2704)
      • more.com (PID: 6380)
      • SearchIndexer.exe (PID: 6392)
      • 69KCWI9GAC9GWBGP6YQVF78T9XC8A94.exe (PID: 5236)
      • 5D57C09NDIXS9EN7C9D3P.exe (PID: 6824)
      • more.com (PID: 752)
      • more.com (PID: 3624)
    • Reads the software policy settings

      • SearchIndexer.exe (PID: 6392)
    • Drops the executable file immediately after the start

      • SearchIndexer.exe (PID: 6392)
    • Checks proxy server information

      • SearchIndexer.exe (PID: 4372)
    • Reads security settings of Internet Explorer

      • SearchIndexer.exe (PID: 4372)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Lumma

(PID) Process(6392) SearchIndexer.exe
C2 (9)answerrsdo.shop
bouncedgowp.shop
bittercoldzzdwu.shop
radiationnopp.shop
benchillppwo.shop
bargainnykwo.shop
bannngwko.shop
affecthorsedpo.shop
publicitttyps.shop

Amadey

(PID) Process(4372) SearchIndexer.exe
C2downloaddining.com
Strings (123)Content-Disposition: form-data; name="data"; filename="
ar:
/k
DefaultSettings.XResolution
SOFTWARE\Microsoft\Windows NT\CurrentVersion
abcdefghijklmnopqrstuvwxyz0123456789-_
random
Norton
rb
sd:
Doctor Web
2022
\0000
id:
#
kernel32.dll
.jpg
AVAST Software
"taskkill /f /im "
/h9fmdW7/index.php
lv:
S-%lu-
shutdown -s -t 0
&& Exit"
e0
ProgramData\
\
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
dm:
pc:
av:
st=s
Kaspersky Lab
SYSTEM\CurrentControlSet\Control\UnitedVideo\CONTROL\VIDEO\
Avira
Startup
exe
|
+++
http://
-unicode-
2016
Programs
\App
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
og:
vs:
/h9fmdW6/index.php
rundll32
d1
un:
AVG
Bitdefender
Content-Type: application/x-www-form-urlencoded
-%lu
" Content-Type: application/octet-stream
SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName
VideoID
cmd
cred.dll
<c>
ComputerName
Sophos
GetNativeSystemInfo
Hkbsse.exe
/h9fmdW5/index.php
------
Content-Type: multipart/form-data; boundary=----
Panda Security
" && timeout 1 && del
clip.dll
:::
https://
zip
/quiet
2019
POST
SYSTEM\ControlSet001\Services\BasicDisplay\Video
GET
CurrentBuild
------
f184b295cd
bi:
e2
ProductName
"
360TotalSecurity
Powershell.exe
ESET
DefaultSettings.YResolution
4.31
%-lu
downloaddining2.com
downloaddining3.com
cmd /C RMDIR /s/q
%USERPROFILE%
ps1
dll
/Plugins/
" && ren
<d>
SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
cred.dll|clip.dll|
downloaddining.com
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
Comodo
msi
&&
Main
wb
rundll32.exe
Rem
os:
shell32.dll
--
WinDefender
?scr=1
0123456789
e1
-executionpolicy remotesigned -File "
=
r=
&unit=
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 10
ZipBitFlag: -
ZipCompression: None
ZipModifyDate: 2024:07:11 01:20:14
ZipCRC: 0x00000000
ZipCompressedSize: -
ZipUncompressedSize: -
ZipFileName: !~!SetUp_2025_Pa$W0rd$s!!%!~/
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
149
Monitored processes
14
Malicious processes
9
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe rundll32.exe no specs setup.exe more.com no specs conhost.exe no specs #LUMMA searchindexer.exe 69kcwi9gac9gwbgp6yqvf78t9xc8a94.exe no specs #HIJACKLOADER more.com conhost.exe no specs 5d57c09ndixs9en7c9d3p.exe no specs more.com no specs conhost.exe no specs #HIJACKLOADER tracefmt.exe no specs #AMADEY searchindexer.exe

Process information

PID
CMD
Path
Indicators
Parent process
648C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -EmbeddingC:\Windows\System32\rundll32.exesvchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shcore.dll
c:\windows\system32\imagehlp.dll
752C:\WINDOWS\SysWOW64\more.comC:\Windows\SysWOW64\more.com
69KCWI9GAC9GWBGP6YQVF78T9XC8A94.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
More Utility
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\more.com
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\ulib.dll
2704"C:\Users\admin\Desktop\!~!SetUp_2025_Pa$W0rd$s!!%!~\Setup.exe" C:\Users\admin\Desktop\!~!SetUp_2025_Pa$W0rd$s!!%!~\Setup.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
1
Modules
Images
c:\users\admin\desktop\!~!setup_2025_pa$w0rd$s!!%!~\setup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\acgenral.dll
3624C:\WINDOWS\SysWOW64\more.comC:\Windows\SysWOW64\more.com5D57C09NDIXS9EN7C9D3P.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
More Utility
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\more.com
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\ulib.dll
4164"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\AppData\Local\Temp\25cbd245-9d30-41c1-b38a-1c55db6ce739.zipC:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
4180\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exemore.com
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4264\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exemore.com
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4372C:\WINDOWS\SysWOW64\SearchIndexer.exeC:\Windows\SysWOW64\SearchIndexer.exe
more.com
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Windows Search Indexer
Version:
7.0.19041.3758 (WinBuild.160101.0800)
Modules
Images
c:\users\admin\appdata\local\temp\ockuffw
c:\windows\syswow64\searchindexer.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
Amadey
(PID) Process(4372) SearchIndexer.exe
C2downloaddining.com
Strings (123)Content-Disposition: form-data; name="data"; filename="
ar:
/k
DefaultSettings.XResolution
SOFTWARE\Microsoft\Windows NT\CurrentVersion
abcdefghijklmnopqrstuvwxyz0123456789-_
random
Norton
rb
sd:
Doctor Web
2022
\0000
id:
#
kernel32.dll
.jpg
AVAST Software
"taskkill /f /im "
/h9fmdW7/index.php
lv:
S-%lu-
shutdown -s -t 0
&& Exit"
e0
ProgramData\
\
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
dm:
pc:
av:
st=s
Kaspersky Lab
SYSTEM\CurrentControlSet\Control\UnitedVideo\CONTROL\VIDEO\
Avira
Startup
exe
|
+++
http://
-unicode-
2016
Programs
\App
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
og:
vs:
/h9fmdW6/index.php
rundll32
d1
un:
AVG
Bitdefender
Content-Type: application/x-www-form-urlencoded
-%lu
" Content-Type: application/octet-stream
SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName
VideoID
cmd
cred.dll
<c>
ComputerName
Sophos
GetNativeSystemInfo
Hkbsse.exe
/h9fmdW5/index.php
------
Content-Type: multipart/form-data; boundary=----
Panda Security
" && timeout 1 && del
clip.dll
:::
https://
zip
/quiet
2019
POST
SYSTEM\ControlSet001\Services\BasicDisplay\Video
GET
CurrentBuild
------
f184b295cd
bi:
e2
ProductName
"
360TotalSecurity
Powershell.exe
ESET
DefaultSettings.YResolution
4.31
%-lu
downloaddining2.com
downloaddining3.com
cmd /C RMDIR /s/q
%USERPROFILE%
ps1
dll
/Plugins/
" && ren
<d>
SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
cred.dll|clip.dll|
downloaddining.com
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
Comodo
msi
&&
Main
wb
rundll32.exe
Rem
os:
shell32.dll
--
WinDefender
?scr=1
0123456789
e1
-executionpolicy remotesigned -File "
=
r=
&unit=
5236"C:\Users\admin\AppData\Local\Temp\69KCWI9GAC9GWBGP6YQVF78T9XC8A94.exe"C:\Users\admin\AppData\Local\Temp\69KCWI9GAC9GWBGP6YQVF78T9XC8A94.exeSearchIndexer.exe
User:
admin
Company:
Vitaliy Levchenko Software
Integrity Level:
MEDIUM
Description:
Icons from File
Exit code:
1
Version:
5.1.1.16
Modules
Images
c:\users\admin\appdata\local\temp\69kcwi9gac9gwbgp6yqvf78t9xc8a94.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\oleaut32.dll
6172C:\Users\admin\AppData\Local\Temp\TraceFmt.exeC:\Users\admin\AppData\Local\Temp\TraceFmt.exe
more.com
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Format Message traces to text
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\users\admin\appdata\local\temp\cqia
c:\users\admin\appdata\local\temp\tracefmt.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
Total events
7 057
Read events
7 027
Write events
30
Delete events
0

Modification events

(PID) Process:(4164) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(4164) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(4164) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\GoogleChromeEnterpriseBundle64.zip
(PID) Process:(4164) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\25cbd245-9d30-41c1-b38a-1c55db6ce739.zip
(PID) Process:(4164) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(4164) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(4164) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(4164) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(4164) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\MainWin
Operation:writeName:Placement
Value:
2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF3D0000002D000000FD03000016020000
(PID) Process:(4164) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\General
Operation:writeName:LastFolder
Value:
C:\Users\admin\AppData\Local\Temp
Executable files
6
Suspicious files
8
Text files
2
Unknown types
0

Dropped files

PID
Process
Filename
Type
6380more.comC:\Users\admin\AppData\Local\Temp\jcbjebcwqbgfge
MD5:
SHA256:
752more.comC:\Users\admin\AppData\Local\Temp\cqia
MD5:
SHA256:
3624more.comC:\Users\admin\AppData\Local\Temp\ockuffw
MD5:
SHA256:
4164WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa4164.40707\!~!SetUp_2025_Pa$W0rd$s!!%!~\heartthrob.docbinary
MD5:42E6685956CE07BDFE900B44DFDA8555
SHA256:7F4DC10F712C2D0D4AE5F24E3DEFB4FCBEB1B38A7DD357A7473F954ABE8FAF0D
4164WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa4164.40707\!~!SetUp_2025_Pa$W0rd$s!!%!~\d3dx9_43.dllexecutable
MD5:520899C7DE9DF32FC7878EEA4DF08A72
SHA256:0820FDAFEF37CB7FA1AE83D8B1F7C3839C61B6744426831D15C4561468A2E234
523669KCWI9GAC9GWBGP6YQVF78T9XC8A94.exeC:\Users\admin\AppData\Local\Temp\a7fc8203image
MD5:75C9ACF117D5752844559D04D8ED42B0
SHA256:63F235D28E8AE6F68006132ED07A5875E18184DCB8706634B1061B28540245FD
2704Setup.exeC:\Users\admin\AppData\Roaming\Piriform\heartthrob.docbinary
MD5:42E6685956CE07BDFE900B44DFDA8555
SHA256:7F4DC10F712C2D0D4AE5F24E3DEFB4FCBEB1B38A7DD357A7473F954ABE8FAF0D
523669KCWI9GAC9GWBGP6YQVF78T9XC8A94.exeC:\Users\admin\AppData\Local\Temp\a83416bfbinary
MD5:2D89DE7201301ECF1ACB5F760831B62D
SHA256:3339E588643D3E4294C01F3E5E235B9CB3320B1B362820C0371A11D346F0DCFA
2704Setup.exeC:\Users\admin\AppData\Local\Temp\9b50bf8dbinary
MD5:E063020E582AFBA80B04F5F4536E8A94
SHA256:7FBB10638D4EB44A69DA280B5408A6B84E809CA076A57F26454AC484B43558A6
2704Setup.exeC:\Users\admin\AppData\Roaming\Piriform\d3dx9_43.dllexecutable
MD5:520899C7DE9DF32FC7878EEA4DF08A72
SHA256:0820FDAFEF37CB7FA1AE83D8B1F7C3839C61B6744426831D15C4561468A2E234
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
15
TCP/UDP connections
89
DNS requests
27
Threats
5

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4372
SearchIndexer.exe
POST
404
188.114.96.3:80
http://downloaddining2.com/h9fmdW6/index.php
unknown
unknown
4372
SearchIndexer.exe
POST
200
45.140.19.240:80
http://downloaddining.com/h9fmdW5/index.php
unknown
unknown
4372
SearchIndexer.exe
POST
200
45.140.19.240:80
http://downloaddining.com/h9fmdW5/index.php
unknown
unknown
4372
SearchIndexer.exe
POST
404
188.114.96.3:80
http://downloaddining2.com/h9fmdW6/index.php
unknown
unknown
4372
SearchIndexer.exe
POST
404
172.67.208.139:80
http://downloaddining3.com/h9fmdW7/index.php
unknown
unknown
4372
SearchIndexer.exe
POST
404
172.67.208.139:80
http://downloaddining3.com/h9fmdW7/index.php
unknown
unknown
4392
MoUsoCoreWorker.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
unknown
4392
MoUsoCoreWorker.exe
GET
200
2.16.164.120:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
unknown
4656
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
unknown
3992
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
whitelisted
1832
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2476
RUXIMICS.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4656
SearchApp.exe
104.126.37.178:443
www.bing.com
Akamai International B.V.
DE
unknown
4392
MoUsoCoreWorker.exe
2.16.164.120:80
crl.microsoft.com
Akamai International B.V.
NL
unknown
4392
MoUsoCoreWorker.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
unknown
4656
SearchApp.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
4
System
192.168.100.255:138
whitelisted
4032
svchost.exe
239.255.255.250:1900
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
whitelisted
www.bing.com
  • 104.126.37.178
  • 104.126.37.130
  • 104.126.37.136
  • 104.126.37.129
  • 104.126.37.155
  • 104.126.37.139
  • 104.126.37.145
  • 104.126.37.177
  • 104.126.37.162
  • 104.126.37.161
  • 104.126.37.153
  • 104.126.37.170
  • 104.126.37.160
  • 104.126.37.171
  • 104.126.37.144
  • 104.126.37.123
  • 104.126.37.128
  • 104.126.37.163
  • 104.126.37.186
  • 104.126.37.131
whitelisted
crl.microsoft.com
  • 2.16.164.120
  • 2.16.164.9
whitelisted
www.microsoft.com
  • 95.101.149.131
  • 184.30.21.171
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
google.com
  • 172.217.16.142
whitelisted
login.live.com
  • 20.190.160.22
  • 40.126.32.136
  • 40.126.32.140
  • 40.126.32.138
  • 40.126.32.76
  • 20.190.160.17
  • 20.190.160.20
  • 40.126.32.72
whitelisted
go.microsoft.com
  • 184.28.89.167
whitelisted
nexusrules.officeapps.live.com
  • 52.111.227.11
whitelisted
arc.msn.com
  • 20.103.156.88
  • 20.223.36.55
whitelisted

Threats

PID
Process
Class
Message
6392
SearchIndexer.exe
A Network Trojan was detected
STEALER [ANY.RUN] Lumma Stealer TLS Connection
4372
SearchIndexer.exe
Malware Command and Control Activity Detected
BOTNET [ANY.RUN] Amadey HTTP POST Request (st=s)
4372
SearchIndexer.exe
Malware Command and Control Activity Detected
BOTNET [ANY.RUN] Amadey HTTP POST Request (st=s)
4372
SearchIndexer.exe
Malware Command and Control Activity Detected
BOTNET [ANY.RUN] Amadey HTTP POST Request (st=s)
1 ETPRO signatures available at the full report
No debug info