File name:

TempSFX0J90DAFQGZBXSPFL99PNIHBSLJB8Z.EXE

Full analysis: https://app.any.run/tasks/7fcdd9ab-934d-47a3-bb94-2f397ba1b926
Verdict: Malicious activity
Threats:

Amadey is a formidable Windows infostealer threat, characterized by its persistence mechanisms, modular design, and ability to execute various malicious tasks.

Malware Trends Tracker     >>>
Analysis date: June 10, 2025, 17:25:33
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
amadey
botnet
stealer
rdp
loader
pyinstaller
python
screenconnect
rmm-tool
evasion
telegram
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:

26CC5A6CFD8E8ECC433337413C14CDDB

SHA1:

FFC2D03477D5EAF6E111A72B89EC9A4654F96FE9

SHA256:

2D904D576B46236BAF504DBA21775F6EBBBD0F65272A9C2FCA1C6798184FA4E8

SSDEEP:

6144:mJEGTYya7Ad20rxuTwKEA2lLlB1HM6TSg6MJYmHWthx:lyyALQkKEAQxB1s6+g6qyx

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • AMADEY mutex has been found

      • TempSFX0J90DAFQGZBXSPFL99PNIHBSLJB8Z.EXE.exe (PID: 3656)
      • ramez.exe (PID: 5616)
      • ramez.exe (PID: 6224)

    • AMADEY has been detected (SURICATA)

      • ramez.exe (PID: 5616)

    • Connects to the CnC server

      • ramez.exe (PID: 5616)

    • AMADEY has been detected (YARA)

      • ramez.exe (PID: 5616)

    • Run PowerShell with an invisible window

      • powershell.exe (PID: 5124)
      • powershell.exe (PID: 5496)
      • powershell.exe (PID: 1200)
      • powershell.exe (PID: 3148)

    • Adds path to the Windows Defender exclusion list

      • 4GeyKOG.exe (PID: 2864)
      • downloaded_app.exe (PID: 3476)

    • Changes Windows Defender settings

      • 4GeyKOG.exe (PID: 2864)
      • downloaded_app.exe (PID: 3476)

    • Bypass execution policy to execute commands

      • powershell.exe (PID: 5496)
      • powershell.exe (PID: 1200)

    • Changes powershell execution policy (Bypass)

      • downloaded_app.exe (PID: 3476)

    • COINMINER has been found (auto)

      • ramez.exe (PID: 5616)

    • Executing a file with an untrusted certificate

      • sGe7ljJ.exe (PID: 6892)

    • Adds process to the Windows Defender exclusion list

      • downloaded_app.exe (PID: 3476)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • TempSFX0J90DAFQGZBXSPFL99PNIHBSLJB8Z.EXE.exe (PID: 3656)
      • ramez.exe (PID: 5616)
      • wKNvchW.exe (PID: 5720)
      • wKNvchW.exe (PID: 3836)
      • MetaSkins.exe (PID: 1688)
      • cmd.exe (PID: 4804)
      • MetaSkins.exe (PID: 2292)
      • 4GeyKOG.exe (PID: 2864)
      • rundll32.exe (PID: 6304)

    • Reads the date of Windows installation

      • TempSFX0J90DAFQGZBXSPFL99PNIHBSLJB8Z.EXE.exe (PID: 3656)
      • MetaSkins.exe (PID: 1688)
      • 4GeyKOG.exe (PID: 6532)
      • wKNvchW.exe (PID: 4960)
      • 4GeyKOG.exe (PID: 2864)

    • Reads security settings of Internet Explorer

      • TempSFX0J90DAFQGZBXSPFL99PNIHBSLJB8Z.EXE.exe (PID: 3656)
      • ramez.exe (PID: 5616)
      • MetaSkins.exe (PID: 1688)
      • 4GeyKOG.exe (PID: 6532)
      • 4GeyKOG.exe (PID: 2864)

    • Starts itself from another location

      • TempSFX0J90DAFQGZBXSPFL99PNIHBSLJB8Z.EXE.exe (PID: 3656)

    • Contacting a server suspected of hosting an CnC

      • ramez.exe (PID: 5616)

    • Connects to the server without a host name

      • ramez.exe (PID: 5616)
      • net.exe (PID: 3588)

    • The process executes via Task Scheduler

      • updater.exe (PID: 5432)
      • ramez.exe (PID: 6224)

    • Potential Corporate Privacy Violation

      • ramez.exe (PID: 5616)
      • 4GeyKOG.exe (PID: 2864)
      • wKNvchW.exe (PID: 4960)
      • wKNvchW.exe (PID: 7120)

    • Application launched itself

      • updater.exe (PID: 5432)
      • 4GeyKOG.exe (PID: 6532)
      • wKNvchW.exe (PID: 5720)
      • wKNvchW.exe (PID: 3836)

    • There is functionality for taking screenshot (YARA)

      • ramez.exe (PID: 5616)
      • wKNvchW.exe (PID: 5720)
      • wKNvchW.exe (PID: 3836)

    • There is functionality for enable RDP (YARA)

      • ramez.exe (PID: 5616)

    • Process requests binary or script from the Internet

      • ramez.exe (PID: 5616)
      • 4GeyKOG.exe (PID: 2864)

    • The process drops C-runtime libraries

      • wKNvchW.exe (PID: 5720)
      • wKNvchW.exe (PID: 3836)

    • Process drops legitimate windows executable

      • wKNvchW.exe (PID: 5720)
      • wKNvchW.exe (PID: 3836)
      • MetaSkins.exe (PID: 2292)
      • ramez.exe (PID: 5616)

    • Process drops python dynamic module

      • wKNvchW.exe (PID: 5720)
      • wKNvchW.exe (PID: 3836)

    • Uses TIMEOUT.EXE to delay execution

      • cmd.exe (PID: 4804)

    • Starts CMD.EXE for commands execution

      • MetaSkins.exe (PID: 1688)
      • wKNvchW.exe (PID: 4960)
      • wKNvchW.exe (PID: 7120)

    • Executing commands from a ".bat" file

      • MetaSkins.exe (PID: 1688)

    • The executable file from the user directory is run by the CMD process

      • MetaSkins.exe (PID: 2292)

    • Connects to unusual port

      • 4GeyKOG.exe (PID: 2864)

    • Script adds exclusion path to Windows Defender

      • downloaded_app.exe (PID: 3476)
      • 4GeyKOG.exe (PID: 2864)

    • Starts POWERSHELL.EXE for commands execution

      • downloaded_app.exe (PID: 3476)
      • 4GeyKOG.exe (PID: 2864)

    • The process bypasses the loading of PowerShell profile settings

      • downloaded_app.exe (PID: 3476)

    • Script adds exclusion process to Windows Defender

      • downloaded_app.exe (PID: 3476)

    • Loads Python modules

      • wKNvchW.exe (PID: 4960)

    • Checks for external IP

      • svchost.exe (PID: 2200)
      • wKNvchW.exe (PID: 4960)
      • wKNvchW.exe (PID: 7120)

    • Start notepad (likely ransomware note)

      • wKNvchW.exe (PID: 4960)
      • wKNvchW.exe (PID: 7120)

    • Starts a Microsoft application from unusual location

      • DgO51N6.exe (PID: 5444)
      • sGe7ljJ.exe (PID: 6892)

    • Process communicates with Telegram (possibly using it as an attacker's C2 server)

      • wKNvchW.exe (PID: 7120)
      • wKNvchW.exe (PID: 4960)

  • INFO

    • Checks supported languages

      • TempSFX0J90DAFQGZBXSPFL99PNIHBSLJB8Z.EXE.exe (PID: 3656)
      • ramez.exe (PID: 5616)
      • updater.exe (PID: 5432)
      • updater.exe (PID: 6900)
      • wKNvchW.exe (PID: 5720)
      • wKNvchW.exe (PID: 3836)
      • ramez.exe (PID: 6224)
      • MelonityV2.exe (PID: 1944)
      • MetaSkins.exe (PID: 1688)
      • MetaSkins.exe (PID: 2292)
      • 4GeyKOG.exe (PID: 6532)
      • 4GeyKOG.exe (PID: 2864)
      • downloaded_app.exe (PID: 3476)
      • msiexec.exe (PID: 2732)
      • wKNvchW.exe (PID: 4960)

    • Reads Environment values

      • TempSFX0J90DAFQGZBXSPFL99PNIHBSLJB8Z.EXE.exe (PID: 3656)
      • ramez.exe (PID: 5616)

    • Reads the computer name

      • TempSFX0J90DAFQGZBXSPFL99PNIHBSLJB8Z.EXE.exe (PID: 3656)
      • ramez.exe (PID: 5616)
      • updater.exe (PID: 5432)
      • wKNvchW.exe (PID: 5720)
      • wKNvchW.exe (PID: 3836)
      • MetaSkins.exe (PID: 1688)
      • MetaSkins.exe (PID: 2292)
      • 4GeyKOG.exe (PID: 6532)
      • 4GeyKOG.exe (PID: 2864)
      • msiexec.exe (PID: 2732)
      • wKNvchW.exe (PID: 4960)

    • Create files in a temporary directory

      • TempSFX0J90DAFQGZBXSPFL99PNIHBSLJB8Z.EXE.exe (PID: 3656)
      • ramez.exe (PID: 5616)
      • wKNvchW.exe (PID: 5720)
      • wKNvchW.exe (PID: 3836)
      • MetaSkins.exe (PID: 1688)
      • rundll32.exe (PID: 6304)

    • Process checks computer location settings

      • TempSFX0J90DAFQGZBXSPFL99PNIHBSLJB8Z.EXE.exe (PID: 3656)
      • ramez.exe (PID: 5616)
      • MetaSkins.exe (PID: 1688)
      • 4GeyKOG.exe (PID: 6532)
      • wKNvchW.exe (PID: 4960)
      • 4GeyKOG.exe (PID: 2864)

    • Checks proxy server information

      • ramez.exe (PID: 5616)
      • wKNvchW.exe (PID: 4960)

    • Creates files or folders in the user directory

      • ramez.exe (PID: 5616)
      • MelonityV2.exe (PID: 1944)
      • 4GeyKOG.exe (PID: 2864)

    • Process checks whether UAC notifications are on

      • updater.exe (PID: 5432)

    • The sample compiled with english language support

      • wKNvchW.exe (PID: 5720)
      • wKNvchW.exe (PID: 3836)
      • ramez.exe (PID: 5616)
      • MetaSkins.exe (PID: 2292)

    • Reads the software policy settings

      • ramez.exe (PID: 5616)

    • Reads the machine GUID from the registry

      • ramez.exe (PID: 5616)

    • PyInstaller has been detected (YARA)

      • wKNvchW.exe (PID: 5720)
      • wKNvchW.exe (PID: 3836)

    • Checks if a key exists in the options dictionary (POWERSHELL)

      • powershell.exe (PID: 3148)
      • powershell.exe (PID: 5124)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 3148)
      • powershell.exe (PID: 5124)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 2732)

    • Reads security settings of Internet Explorer

      • notepad.exe (PID: 4412)

    • CONNECTWISE has been detected

      • msiexec.exe (PID: 2732)

    • Checks operating system version

      • wKNvchW.exe (PID: 4960)
      • wKNvchW.exe (PID: 7120)

    • Reads Microsoft Office registry keys

      • wKNvchW.exe (PID: 4960)

    • Attempting to use instant messaging service

      • wKNvchW.exe (PID: 7120)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (64.6)
.dll | Win32 Dynamic Link Library (generic) (15.4)
.exe | Win32 Executable (generic) (10.5)
.exe | Generic Win/DOS Executable (4.6)
.exe | DOS Executable Generic (4.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2025:05:01 04:57:19+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14.29
CodeSize: 317952
InitializedDataSize: 123392
UninitializedDataSize: -
EntryPoint: 0x28c3a
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
186
Monitored processes
47
Malicious processes
10
Suspicious processes
5

Behavior graph

Click at the process to see the details
start tempsfx0j90dafqgzbxspfl99pnihbsljb8z.exe.exe #AMADEY ramez.exe updater.exe no specs updater.exe no specs wknvchw.exe wknvchw.exe ramez.exe no specs melonityv2.exe no specs melonityv2.exe metaskins.exe no specs metaskins.exe cmd.exe conhost.exe no specs timeout.exe no specs metaskins.exe 4geykog.exe no specs conhost.exe no specs 4geykog.exe conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs msiexec.exe no specs msiexec.exe downloaded_app.exe no specs powershell.exe no specs powershell.exe no specs conhost.exe no specs conhost.exe no specs wknvchw.exe msiexec.exe no specs rundll32.exe cmd.exe no specs conhost.exe no specs svchost.exe notepad.exe no specs dgo51n6.exe no specs wknvchw.exe net.exe slui.exe no specs cmd.exe no specs conhost.exe no specs notepad.exe no specs sge7ljj.exe no specs conhost.exe no specs msbuild.exe

Process information

PID
CMD
Path
Indicators
Parent process
1080\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1200powershell -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionProcess ''"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe—downloaded_app.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
1204"C:\WINDOWS\system32\NOTEPAD.EXE" C:\Users\admin\Desktop\read1.txtC:\Windows\System32\notepad.exe—wKNvchW.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Notepad
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\notepad.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
1688"C:\Users\admin\AppData\Local\Temp\10355390101\MetaSkins.exe" C:\Users\admin\AppData\Local\Temp\10355390101\MetaSkins.exe
ramez.exe
User:
admin
Integrity Level:
HIGH
Exit code:
4294967295
Modules
Images
c:\users\admin\appdata\local\temp\10355390101\metaskins.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
1812"C:\Users\admin\AppData\Local\Temp\10355390101\MetaSkins.exe" C:\Users\admin\AppData\Local\Temp\10355390101\MetaSkins.exe—ramez.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\appdata\local\temp\10355390101\metaskins.exe
c:\windows\system32\ntdll.dll
1944"C:\Users\admin\AppData\Local\Temp\10355370101\MelonityV2.exe" C:\Users\admin\AppData\Local\Temp\10355370101\MelonityV2.exe
ramez.exe
User:
admin
Company:
Melonity
Integrity Level:
HIGH
Description:
Melonity Launcher
Version:
1.1.0.0
Modules
Images
c:\users\admin\appdata\local\temp\10355370101\melonityv2.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\imm32.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\d3d11.dll
c:\windows\system32\gdi32.dll
2200C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2276C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
2292"C:\Users\admin\AppData\Local\Temp\10355390101\MetaSkins.exe" C:\Users\admin\AppData\Local\Temp\10355390101\MetaSkins.exe
cmd.exe
User:
admin
Integrity Level:
HIGH
Modules
Images
c:\users\admin\appdata\local\temp\10355390101\metaskins.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
2552C:\Windows\syswow64\MsiExec.exe -Embedding 730CF7B01571F4ADF3CAE2EF416A8CD2C:\Windows\SysWOW64\msiexec.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
Total events
32 734
Read events
32 705
Write events
20
Delete events
9

Modification events

(PID) Process:(3656) TempSFX0J90DAFQGZBXSPFL99PNIHBSLJB8Z.EXE.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(3656) TempSFX0J90DAFQGZBXSPFL99PNIHBSLJB8Z.EXE.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(3656) TempSFX0J90DAFQGZBXSPFL99PNIHBSLJB8Z.EXE.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(3656) TempSFX0J90DAFQGZBXSPFL99PNIHBSLJB8Z.EXE.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(5616) ramez.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(5616) ramez.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(5616) ramez.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(5616) ramez.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.msi\OpenWithProgids
Operation:writeName:Msi.Package
Value:
(PID) Process:(2732) msiexec.exeKey:HKEY_USERS\S-1-5-21-1693682860-607145093-2874071422-1001\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:writeName:Owner
Value:
AC0A0000A8C956CA2CDADB01
(PID) Process:(2732) msiexec.exeKey:HKEY_USERS\S-1-5-21-1693682860-607145093-2874071422-1001\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:writeName:SessionHash
Value:
172BC66E6C02F4F830EE22EFFD08E3D9A2C87210309D8B73C3A7B5E3AAF57C48
Executable files
82
Suspicious files
18
Text files
1 904
Unknown types
14

Dropped files

PID
Process
Filename
Type
3656TempSFX0J90DAFQGZBXSPFL99PNIHBSLJB8Z.EXE.exeC:\Windows\Tasks\ramez.jobbinary
MD5:537DE6FD2403C5E43B8D97AA3D0F768D
SHA256:26F477216B68DD449AF08CD65502BB302D351E1BA111309EBA76C15D9DF42918
5720wKNvchW.exeC:\Users\admin\AppData\Local\Temp\_MEI57202\VCRUNTIME140.dllexecutable
MD5:32DA96115C9D783A0769312C0482A62D
SHA256:8B10C53241726B0ACC9F513157E67FCB01C166FEC69E5E38CA6AADA8F9A3619F
3656TempSFX0J90DAFQGZBXSPFL99PNIHBSLJB8Z.EXE.exeC:\Users\admin\AppData\Local\Temp\d610cf342e\ramez.exeexecutable
MD5:26CC5A6CFD8E8ECC433337413C14CDDB
SHA256:2D904D576B46236BAF504DBA21775F6EBBBD0F65272A9C2FCA1C6798184FA4E8
6900updater.exeC:\Program Files (x86)\Google\GoogleUpdater\updater.logtext
MD5:8803675FEAAAD95F659B7F9A28327F8C
SHA256:7CBDEC376A0ECCE6DE1526301D60B2ED84649A66EB3F6D8E61763C604AE4ED27
5720wKNvchW.exeC:\Users\admin\AppData\Local\Temp\_MEI57202\_bz2.pydexecutable
MD5:51CA0713F8FD5F142625A44DF7ED7100
SHA256:8768315B1E0E81CCD0D96C3D6A863803F5DD1DE6AF849285C439D61ABD32B647
5720wKNvchW.exeC:\Users\admin\AppData\Local\Temp\_MEI57202\_ctypes.pydexecutable
MD5:429CB0177D5AB205F289D0CC830549FF
SHA256:6E804ED42CCA2EB401A896FE9542201D4D77DF22ACBD935A3C56DC68530DAE33
5720wKNvchW.exeC:\Users\admin\AppData\Local\Temp\_MEI57202\_asyncio.pydexecutable
MD5:91B746B47E04935988A7BA64A50D7C1A
SHA256:7F3812F601CC764457A82E695E60590AE69AC2831016ED0682FCB38760EA75E4
5720wKNvchW.exeC:\Users\admin\AppData\Local\Temp\_MEI57202\_lzma.pydexecutable
MD5:0D549F688E0B2424B549AFCAC58D5FA7
SHA256:80DF30ED0F2C532C07EA7FDC44836E40A8EBD9E7611365A1A26989147E1A4210
5720wKNvchW.exeC:\Users\admin\AppData\Local\Temp\_MEI57202\_decimal.pydexecutable
MD5:584652F877074FE71D7B1F8EEA1F849E
SHA256:E0F93185CD64F1DB3B9D1D20D620A691C5C453094B14D3B2BA2837F908F13304
5616ramez.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\RR3E01RZ\wKNvchW[1].exeexecutable
MD5:A23972D050F2341751EE924A72BDDF04
SHA256:BAF319904FB0782C288387C37831A97AB6517C49EE4868E222CE6C633EB02D83
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
31
TCP/UDP connections
40
DNS requests
23
Threats
28

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
764
lsass.exe
GET
200
142.250.186.67:80
http://c.pki.goog/r/gsr1.crl
unknown
—
—
whitelisted
5616
ramez.exe
POST
200
185.156.72.96:80
http://185.156.72.96/te4h2nus/index.php
unknown
—
—
unknown
764
lsass.exe
GET
200
142.250.186.67:80
http://c.pki.goog/r/r4.crl
unknown
—
—
whitelisted
5616
ramez.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAz1vQYrVgL0erhQLCPM8GY%3D
unknown
—
—
whitelisted
5616
ramez.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnxLiz3Fu1WB6n1%2FE6xWn1b0jXiQQUdIWAwGbH3zfez70pN6oDHb7tzRcCEA%2FQxuG9HfBpqYhBTZSK%2BP8%3D
unknown
—
—
whitelisted
5616
ramez.exe
POST
200
185.156.72.96:80
http://185.156.72.96/te4h2nus/index.php
unknown
—
—
unknown
5616
ramez.exe
GET
200
185.156.72.2:80
http://185.156.72.2/files/7892865167/wKNvchW.exe
unknown
—
—
unknown
4168
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5616
ramez.exe
POST
200
185.156.72.96:80
http://185.156.72.96/te4h2nus/index.php
unknown
—
—
unknown
5616
ramez.exe
POST
200
185.156.72.96:80
http://185.156.72.96/te4h2nus/index.php
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
5944
MoUsoCoreWorker.exe
4.231.128.59:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1268
svchost.exe
4.231.128.59:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4172
RUXIMICS.exe
4.231.128.59:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5616
ramez.exe
185.156.72.96:80
—
Tov Vaiz Partner
RU
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
5616
ramez.exe
185.156.72.2:80
—
Tov Vaiz Partner
RU
unknown
2336
svchost.exe
172.211.123.249:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
4168
svchost.exe
20.190.160.3:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4168
svchost.exe
2.23.77.188:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.181.238
whitelisted
client.wns.windows.com
  • 172.211.123.249
whitelisted
login.live.com
  • 20.190.160.3
  • 20.190.160.67
  • 40.126.32.68
  • 20.190.160.130
  • 20.190.160.2
  • 40.126.32.133
  • 20.190.160.132
  • 20.190.160.17
whitelisted
ocsp.digicert.com
  • 2.23.77.188
whitelisted
settings-win.data.microsoft.com
  • 20.73.194.208
  • 51.124.78.146
whitelisted
crl.microsoft.com
  • 2.16.241.19
  • 2.16.241.12
whitelisted
www.microsoft.com
  • 2.23.246.101
whitelisted
nexusrules.officeapps.live.com
  • 52.111.236.23
whitelisted
melonity-cdn.fra1.cdn.digitaloceanspaces.com
  • 172.64.145.29
  • 104.18.42.227
whitelisted
ocsp.digicert.cn
  • 163.181.92.203
  • 163.181.92.207
  • 163.181.92.206
  • 163.181.92.202
  • 163.181.92.208
  • 163.181.92.201
  • 163.181.92.204
  • 163.181.92.205
whitelisted

Threats

PID
Process
Class
Message
5616
ramez.exe
Malware Command and Control Activity Detected
BOTNET [ANY.RUN] Amadey HTTP POST Request (st=s)
5616
ramez.exe
Malware Command and Control Activity Detected
ET MALWARE Amadey CnC Response
5616
ramez.exe
Potentially Bad Traffic
ET INFO Executable Download from dotted-quad Host
5616
ramez.exe
Potential Corporate Privacy Violation
ET INFO PE EXE or DLL Windows file download HTTP
5616
ramez.exe
Misc activity
ET INFO Packed Executable Download
5616
ramez.exe
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
5616
ramez.exe
Potentially Bad Traffic
ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response
5616
ramez.exe
Potentially Bad Traffic
ET INFO Executable Download from dotted-quad Host
2864
4GeyKOG.exe
Potentially Bad Traffic
ET INFO Executable Download from dotted-quad Host
2864
4GeyKOG.exe
Potentially Bad Traffic
ET HUNTING Request for EXE via WinHTTP M2
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
TempSFX0J90DAFQGZBXSPFL99PNIHBSLJB8Z.EXE