File name:

37d87bfc0008f2a3dca742aac12a4b97.exe

Full analysis: https://app.any.run/tasks/b6cca2ba-9367-48c5-aa7c-27fe2720e8ae
Verdict: Malicious activity
Threats:

Amadey is a formidable Windows infostealer threat, characterized by its persistence mechanisms, modular design, and ability to execute various malicious tasks.

Malware Trends Tracker     >>>
Analysis date: April 29, 2025, 07:00:12
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
lumma
stealer
loader
auto
botnet
amadey
putty
rmm-tool
phishing
pastebin
rdp
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 7 sections
MD5:

37D87BFC0008F2A3DCA742AAC12A4B97

SHA1:

79C5DC86C0ECE1486550F91456564BC369C1C8DF

SHA256:

1AE0E18E2B5021AC1F5A8A2AE0041BF33FB46ECB2FF465F1A96807634A3ACAE3

SSDEEP:

98304:P++Mfmz4F6zxOmKkN2lrr+gEz7a/peiSYCzh5n0pdQwc4rr8kORxiypkHsjBnfbn:xBst/

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • LUMMA mutex has been found

      • 37d87bfc0008f2a3dca742aac12a4b97.exe (PID: 7424)
      • core.exe (PID: 2392)

    • LUMMA has been detected (SURICATA)

      • svchost.exe (PID: 2196)

    • Actions looks like stealing of personal data

      • 37d87bfc0008f2a3dca742aac12a4b97.exe (PID: 7424)
      • core.exe (PID: 2392)

    • Connects to the CnC server

      • svchost.exe (PID: 2196)
      • saved.exe (PID: 8160)

    • AMADEY has been found (auto)

      • 37d87bfc0008f2a3dca742aac12a4b97.exe (PID: 7424)
      • M3XFTEIYY864TK16FZ2P2TCNL.exe (PID: 8068)

    • AMADEY has been detected (SURICATA)

      • saved.exe (PID: 8160)

    • AMADEY has been detected (YARA)

      • saved.exe (PID: 8160)

    • Executing a file with an untrusted certificate

      • core.exe (PID: 2392)

    • PHISHING has been detected (SURICATA)

      • svchost.exe (PID: 2196)

    • Bypass execution policy to execute commands

      • powershell.exe (PID: 6132)

    • Changes powershell execution policy (Bypass)

      • core.exe (PID: 2392)

  • SUSPICIOUS

    • Reads the BIOS version

      • 37d87bfc0008f2a3dca742aac12a4b97.exe (PID: 7424)

    • Contacting a server suspected of hosting an CnC

      • svchost.exe (PID: 2196)
      • saved.exe (PID: 8160)

    • Executable content was dropped or overwritten

      • 37d87bfc0008f2a3dca742aac12a4b97.exe (PID: 7424)
      • M3XFTEIYY864TK16FZ2P2TCNL.exe (PID: 8068)
      • saved.exe (PID: 8160)
      • d6c9f0483b.tmp (PID: 2384)
      • d6c9f0483b.exe (PID: 5428)

    • Searches for installed software

      • 37d87bfc0008f2a3dca742aac12a4b97.exe (PID: 7424)
      • core.exe (PID: 2392)

    • Potential Corporate Privacy Violation

      • 37d87bfc0008f2a3dca742aac12a4b97.exe (PID: 7424)
      • saved.exe (PID: 8160)

    • Process requests binary or script from the Internet

      • 37d87bfc0008f2a3dca742aac12a4b97.exe (PID: 7424)
      • saved.exe (PID: 8160)

    • Connects to the server without a host name

      • 37d87bfc0008f2a3dca742aac12a4b97.exe (PID: 7424)
      • saved.exe (PID: 8160)

    • Reads security settings of Internet Explorer

      • M3XFTEIYY864TK16FZ2P2TCNL.exe (PID: 8068)
      • saved.exe (PID: 8160)
      • d6c9f0483b.tmp (PID: 2384)

    • Starts itself from another location

      • M3XFTEIYY864TK16FZ2P2TCNL.exe (PID: 8068)

    • Reads the Windows owner or organization settings

      • d6c9f0483b.tmp (PID: 2384)

    • There is functionality for taking screenshot (YARA)

      • saved.exe (PID: 8160)

    • There is functionality for enable RDP (YARA)

      • saved.exe (PID: 8160)

    • PUTTY has been detected

      • putty.exe (PID: 5988)

    • The process executes via Task Scheduler

      • saved.exe (PID: 2236)
      • saved.exe (PID: 7816)

    • Starts POWERSHELL.EXE for commands execution

      • core.exe (PID: 2392)

  • INFO

    • Reads the computer name

      • 37d87bfc0008f2a3dca742aac12a4b97.exe (PID: 7424)
      • M3XFTEIYY864TK16FZ2P2TCNL.exe (PID: 8068)
      • saved.exe (PID: 8160)
      • d6c9f0483b.tmp (PID: 2384)
      • putty.exe (PID: 5988)
      • core.exe (PID: 2392)
      • info.exe (PID: 6708)

    • Checks supported languages

      • 37d87bfc0008f2a3dca742aac12a4b97.exe (PID: 7424)
      • M3XFTEIYY864TK16FZ2P2TCNL.exe (PID: 8068)
      • saved.exe (PID: 8160)
      • d6c9f0483b.exe (PID: 5428)
      • d6c9f0483b.tmp (PID: 2384)
      • core.exe (PID: 2392)
      • putty.exe (PID: 5988)
      • info.exe (PID: 6708)
      • saved.exe (PID: 2236)
      • saved.exe (PID: 7816)

    • Reads the software policy settings

      • 37d87bfc0008f2a3dca742aac12a4b97.exe (PID: 7424)
      • core.exe (PID: 2392)
      • powershell.exe (PID: 6132)
      • slui.exe (PID: 6004)

    • Create files in a temporary directory

      • 37d87bfc0008f2a3dca742aac12a4b97.exe (PID: 7424)
      • M3XFTEIYY864TK16FZ2P2TCNL.exe (PID: 8068)
      • saved.exe (PID: 8160)
      • d6c9f0483b.exe (PID: 5428)
      • d6c9f0483b.tmp (PID: 2384)
      • powershell.exe (PID: 6132)

    • Process checks computer location settings

      • M3XFTEIYY864TK16FZ2P2TCNL.exe (PID: 8068)
      • saved.exe (PID: 8160)
      • d6c9f0483b.tmp (PID: 2384)

    • Checks proxy server information

      • saved.exe (PID: 8160)
      • slui.exe (PID: 6004)

    • Creates files or folders in the user directory

      • saved.exe (PID: 8160)
      • d6c9f0483b.tmp (PID: 2384)

    • The sample compiled with english language support

      • d6c9f0483b.tmp (PID: 2384)

    • Creates a software uninstall entry

      • d6c9f0483b.tmp (PID: 2384)

    • Reads security settings of Internet Explorer

      • powershell.exe (PID: 6132)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 6132)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Amadey

(PID) Process(8160) saved.exe
C2185.39.17.163
URLhttp://185.39.17.163/Su8kud7i/index.php
Version5.34
Options
Drop directoryc13dbdc4fa
Drop namesaved.exe
Strings (125)S-%lu-
og:
clip.dll
ProgramData\
shell32.dll
<c>
vs:
Programs
&&
VideoID
ESET
av:
\App
0000043f
Doctor Web
:::
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
------
rundll32.exe
00000422
185.39.17.163
0123456789
st=s
00000419
Content-Type: application/x-www-form-urlencoded
/Plugins/
msi
ar:
GetNativeSystemInfo
Norton
-%lu
Sophos
zip
SOFTWARE\Microsoft\Windows NT\CurrentVersion
" Content-Type: application/octet-stream
|
+++
" && ren
pc:
#
d1
cmd /C RMDIR /s/q
Bitdefender
Comodo
<d>
Kaspersky Lab
DefaultSettings.YResolution
Main
c13dbdc4fa
-executionpolicy remotesigned -File "
&& Exit"
ProductName
&unit=
2022
Panda Security
=
Rem
cmd
\0000
id:
sd:
--
/quiet
rundll32
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
%-lu
random
GET
"taskkill /f /im "
Content-Disposition: form-data; name="data"; filename="
00000423
5.34
2016
?scr=1
ComputerName
Keyboard Layout\Preload
Powershell.exe
POST
http://
AVAST Software
SYSTEM\CurrentControlSet\Control\UnitedVideo\CONTROL\VIDEO\
ps1
DefaultSettings.XResolution
Startup
CurrentBuild
e3
cred.dll|clip.dll|
------
WinDefender
wb
https://
Avira
2025
" && timeout 1 && del
cred.dll
un:
SYSTEM\ControlSet001\Services\BasicDisplay\Video
rb
SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName
360TotalSecurity
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
saved.exe
e1
lv:
/Su8kud7i/index.php
shutdown -s -t 0
/k
e2
SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
exe
%USERPROFILE%
-unicode-
r=
.jpg
dll
Content-Type: multipart/form-data; boundary=----
2019
bi:
\
"
kernel32.dll
os:
abcdefghijklmnopqrstuvwxyz0123456789-_
dm:
AVG
No Malware configuration.

TRiD

.exe | Generic Win/DOS Executable (50)
.exe | DOS Executable Generic (49.9)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2025:04:26 14:47:23+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14
CodeSize: 312320
InitializedDataSize: 38400
UninitializedDataSize: -
EntryPoint: 0x49b000
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
147
Monitored processes
15
Malicious processes
7
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #LUMMA 37d87bfc0008f2a3dca742aac12a4b97.exe #LUMMA svchost.exe #AMADEY m3xfteiyy864tk16fz2p2tcnl.exe #AMADEY saved.exe d6c9f0483b.exe d6c9f0483b.tmp THREAT putty.exe no specs #LUMMA core.exe info.exe conhost.exe no specs saved.exe no specs slui.exe powershell.exe no specs conhost.exe no specs saved.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2196C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2236"C:\Users\admin\AppData\Local\Temp\c13dbdc4fa\saved.exe"C:\Users\admin\AppData\Local\Temp\c13dbdc4fa\saved.exe—svchost.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\c13dbdc4fa\saved.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\user32.dll
c:\windows\syswow64\win32u.dll
2384"C:\Users\admin\AppData\Local\Temp\is-VKA3Q.tmp\d6c9f0483b.tmp" /SL5="$8029A,19201947,844800,C:\Users\admin\AppData\Local\Temp\10053730101\d6c9f0483b.exe" C:\Users\admin\AppData\Local\Temp\is-VKA3Q.tmp\d6c9f0483b.tmp
d6c9f0483b.exe
User:
admin
Company:
Integrity Level:
MEDIUM
Description:
Setup/Uninstall
Exit code:
0
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-vka3q.tmp\d6c9f0483b.tmp
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\comdlg32.dll
2392"C:\Users\admin\AppData\Roaming\MyApp\core.exe"C:\Users\admin\AppData\Roaming\MyApp\core.exe
d6c9f0483b.tmp
User:
admin
Company:
Node.js
Integrity Level:
MEDIUM
Description:
Stremio Server JavaScript Runtime
Version:
14.15.0
Modules
Images
c:\users\admin\appdata\roaming\myapp\core.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\ws2_32.dll
5056\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—info.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
5428"C:\Users\admin\AppData\Local\Temp\10053730101\d6c9f0483b.exe" C:\Users\admin\AppData\Local\Temp\10053730101\d6c9f0483b.exe
saved.exe
User:
admin
Company:
Integrity Level:
MEDIUM
Description:
MyApp Setup
Exit code:
0
Version:
Modules
Images
c:\users\admin\appdata\local\temp\10053730101\d6c9f0483b.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\comctl32.dll
5988"C:\Users\admin\AppData\Roaming\MyApp\data\putty.exe" C:\Users\admin\AppData\Roaming\MyApp\data\putty.exe
d6c9f0483b.tmp
User:
admin
Company:
Simon Tatham
Integrity Level:
MEDIUM
Description:
SSH, Telnet, Rlogin, and SUPDUP client
Version:
Release 0.83 (with embedded help)
Modules
Images
c:\users\admin\appdata\roaming\myapp\data\putty.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
6004C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
6132powershell -exec bypass <!DOCTYPE html> <html lang="en"> <head> <meta name="viewport" content="width=device-width, initial-scale=0.75, maximum-scale=1.0, user-scalable=yes" /> <meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> <title>Pastebin.com - Not Found (#404)</title> </head> <body> <h1>Not Found (#404)</h1> <p>This page is no longer available. It has either expired, been removed by its creator, or removed by one of the Pastebin staff.</p> </body> </html>Ip^VH[C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe—core.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
6708"C:\Users\admin\AppData\Roaming\MyApp\info.exe"C:\Users\admin\AppData\Roaming\MyApp\info.exe
d6c9f0483b.tmp
User:
admin
Integrity Level:
MEDIUM
Exit code:
2
Modules
Images
c:\users\admin\appdata\roaming\myapp\info.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\powrprof.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\umpdc.dll
Total events
7 138
Read events
7 115
Write events
23
Delete events
0

Modification events

(PID) Process:(8160) saved.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(8160) saved.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(8160) saved.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(2384) d6c9f0483b.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MyApp_is1
Operation:writeName:Inno Setup: Setup Version
Value:
6.4.0
(PID) Process:(2384) d6c9f0483b.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MyApp_is1
Operation:writeName:Inno Setup: App Path
Value:
C:\Users\admin\AppData\Roaming\MyApp
(PID) Process:(2384) d6c9f0483b.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MyApp_is1
Operation:writeName:InstallLocation
Value:
C:\Users\admin\AppData\Roaming\MyApp\
(PID) Process:(2384) d6c9f0483b.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MyApp_is1
Operation:writeName:Inno Setup: Icon Group
Value:
MyApp
(PID) Process:(2384) d6c9f0483b.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MyApp_is1
Operation:writeName:Inno Setup: User
Value:
admin
(PID) Process:(2384) d6c9f0483b.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MyApp_is1
Operation:writeName:Inno Setup: Language
Value:
default
(PID) Process:(2384) d6c9f0483b.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MyApp_is1
Operation:writeName:DisplayName
Value:
MyApp version 1.0
Executable files
12
Suspicious files
2
Text files
2
Unknown types
1

Dropped files

PID
Process
Filename
Type
2384d6c9f0483b.tmpC:\Users\admin\AppData\Roaming\MyApp\is-B7T6I.tmp —
MD5:—
SHA256:—
2384d6c9f0483b.tmpC:\Users\admin\AppData\Roaming\MyApp\core.exe —
MD5:—
SHA256:—
8068M3XFTEIYY864TK16FZ2P2TCNL.exeC:\Users\admin\AppData\Local\Temp\c13dbdc4fa\saved.exeexecutable
MD5:F6C20A18AFEAC04964A6CCAD6BE59731
SHA256:CE75F9DEDE6D4E93549D35B816898113B6BEFAB9EF0AADF8949D4887C2C34BEA
8160saved.exeC:\Users\admin\AppData\Local\Temp\10053730101\d6c9f0483b.exeexecutable
MD5:FAF551A93829A709A7174F6AE283CBDE
SHA256:35D825988B4411C29DBF9360578872C722C58D63C8AE1967153C9A28DFE45375
8068M3XFTEIYY864TK16FZ2P2TCNL.exeC:\Windows\Tasks\saved.jobbinary
MD5:43351D4C6614A431E07DB77E9365E0F4
SHA256:9DE596AEE55C89C3AB5097DF00BA766C4DD54866889E9F108672E3CEBF7A034C
5428d6c9f0483b.exeC:\Users\admin\AppData\Local\Temp\is-VKA3Q.tmp\d6c9f0483b.tmpexecutable
MD5:E4C43138CCB8240276872FD1AEC369BE
SHA256:46BE5E3F28A5E4ED63D66B901D927C25944B4DA36EFFEA9C97FB05994360EDF5
2384d6c9f0483b.tmpC:\Users\admin\AppData\Roaming\MyApp\unins000.exeexecutable
MD5:4134EC81A9D645602B1FA265F98FBF35
SHA256:69966257CE41717F2121EA1F03F8BFA1486423ACECFCC977DD9F1E157C911AD4
2384d6c9f0483b.tmpC:\Users\admin\AppData\Roaming\MyApp\data\putty.exeexecutable
MD5:36E31F610EEF3223154E6E8FD074190F
SHA256:16CBE40FB24CE2D422AFDDB5A90A5801CED32EF52C22C2FC77B25A90837F28AD
2384d6c9f0483b.tmpC:\Users\admin\AppData\Local\Temp\is-K3U9V.tmp\_isetup\_setup64.tmpexecutable
MD5:E4211D6D009757C078A9FAC7FF4F03D4
SHA256:388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95
2384d6c9f0483b.tmpC:\Users\admin\AppData\Roaming\MyApp\info.exeexecutable
MD5:EE0334F3083FED56762CE148E23EFAAA
SHA256:5E57CD5C98F41A350D15D833494DDCF6E58D0616753D8F80E5949BB6B53E2D45
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
11
TCP/UDP connections
38
DNS requests
19
Threats
20

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2104
svchost.exe
GET
200
23.216.77.20:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
2104
svchost.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
7424
37d87bfc0008f2a3dca742aac12a4b97.exe
GET
200
185.39.17.162:80
http://185.39.17.162/mine/random.exe
unknown
—
—
malicious
8160
saved.exe
POST
200
185.39.17.163:80
http://185.39.17.163/Su8kud7i/index.php
unknown
—
—
malicious
8160
saved.exe
GET
200
185.39.17.162:80
http://185.39.17.162/files/unique1/random.exe
unknown
—
—
malicious
6944
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
8160
saved.exe
POST
200
185.39.17.163:80
http://185.39.17.163/Su8kud7i/index.php
unknown
—
—
malicious
6944
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
8160
saved.exe
POST
200
185.39.17.163:80
http://185.39.17.163/Su8kud7i/index.php
unknown
—
—
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2104
svchost.exe
23.216.77.20:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
2104
svchost.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
7424
37d87bfc0008f2a3dca742aac12a4b97.exe
104.21.51.232:443
zenithcorde.top
CLOUDFLARENET
—
unknown
6544
svchost.exe
20.190.160.130:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
184.30.131.245:80
ocsp.digicert.com
AKAMAI-AS
US
whitelisted
7424
37d87bfc0008f2a3dca742aac12a4b97.exe
185.39.17.162:80
—
Joint Stock Company Tagnet
RU
malicious
2104
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 20.73.194.208
whitelisted
crl.microsoft.com
  • 23.216.77.20
  • 23.216.77.25
whitelisted
www.microsoft.com
  • 23.35.229.160
  • 2.23.246.101
whitelisted
google.com
  • 142.250.186.46
whitelisted
clarmodq.top
  • —
malicious
zenithcorde.top
  • 104.21.51.232
  • 172.67.190.162
unknown
login.live.com
  • 20.190.160.130
  • 40.126.32.134
  • 20.190.160.67
  • 20.190.160.132
  • 20.190.160.131
  • 40.126.32.138
  • 20.190.160.128
  • 20.190.160.3
whitelisted
ocsp.digicert.com
  • 184.30.131.245
whitelisted
slscr.update.microsoft.com
  • 4.245.163.56
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.95.31.18
whitelisted

Threats

PID
Process
Class
Message
2196
svchost.exe
A Network Trojan was detected
MALWARE [ANY.RUN] Suspected Domain Associated with Malware Distribution (clarmodq .top)
2196
svchost.exe
Potentially Bad Traffic
ET DNS Query to a *.top domain - Likely Hostile
2196
svchost.exe
Domain Observed Used for C2 Detected
ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (clarmodq .top)
7424
37d87bfc0008f2a3dca742aac12a4b97.exe
Potentially Bad Traffic
ET INFO Executable Download from dotted-quad Host
7424
37d87bfc0008f2a3dca742aac12a4b97.exe
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
7424
37d87bfc0008f2a3dca742aac12a4b97.exe
Potential Corporate Privacy Violation
ET INFO PE EXE or DLL Windows file download HTTP
7424
37d87bfc0008f2a3dca742aac12a4b97.exe
Misc activity
ET INFO Packed Executable Download
7424
37d87bfc0008f2a3dca742aac12a4b97.exe
Potentially Bad Traffic
ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response
8160
saved.exe
Malware Command and Control Activity Detected
BOTNET [ANY.RUN] Amadey HTTP POST Request (st=s)
8160
saved.exe
Malware Command and Control Activity Detected
ET MALWARE Amadey CnC Response
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
37d87bfc0008f2a3dca742aac12a4b97.exe