File name:

#!!Se-tUp_5535_Pa$WorDss!!.zip

Full analysis: https://app.any.run/tasks/db854e69-91d3-4c93-8f43-8ab20e07cb55
Verdict: Malicious activity
Threats:

Amadey is a formidable Windows infostealer threat, characterized by its persistence mechanisms, modular design, and ability to execute various malicious tasks.

Malware Trends Tracker     >>>
Analysis date: November 10, 2024, 12:12:10
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
arch-exec
amadey
botnet
stealer
possible-phishing
rdp
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract, compression method=deflate
MD5:

4289CFF23FBEC05A14B48A348C2EAB9F

SHA1:

680ECB32DBFC418ECC6BA16009320CEB7A456820

SHA256:

3116703902837436B688D28A4235BDB037DC9305DD0956D0A38BC59E83E1E758

SSDEEP:

98304:hUifXkyp4fs59uOwtkULUizM9MK0LZ3/eCwFh+WcaXn6F6LQOPaLJRULkJB0v4C3:Y/OemLj

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Bypass execution policy to execute commands

      • powershell.exe (PID: 5400)
      • powershell.exe (PID: 6248)

    • Changes powershell execution policy (Bypass)

      • Boebera.pif (PID: 6356)
      • powershell.exe (PID: 5400)

    • Actions looks like stealing of personal data

      • Boebera.pif (PID: 6356)

    • AMADEY has been detected (YARA)

      • explorer.exe (PID: 632)

    • Connects to the CnC server

      • explorer.exe (PID: 632)

    • AMADEY has been detected (SURICATA)

      • explorer.exe (PID: 632)

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • WinRAR.exe (PID: 5532)
      • WinRAR.exe (PID: 6660)
      • Setup.exe (PID: 5832)

    • Checks for Java to be installed

      • nc.exe (PID: 6256)

    • Executable content was dropped or overwritten

      • Setup.exe (PID: 5832)
      • choice.exe (PID: 6200)
      • Boebera.pif (PID: 6356)

    • Drops a file with a rarely used extension (PIF)

      • choice.exe (PID: 6200)
      • Boebera.pif (PID: 6356)

    • Starts POWERSHELL.EXE for commands execution

      • Boebera.pif (PID: 6356)
      • powershell.exe (PID: 5400)

    • Gets or sets the security protocol (POWERSHELL)

      • powershell.exe (PID: 5400)

    • The process executes Powershell scripts

      • Boebera.pif (PID: 6356)

    • Starts application with an unusual extension

      • choice.exe (PID: 6200)
      • Boebera.pif (PID: 6356)

    • BASE64 encoded PowerShell command has been detected

      • powershell.exe (PID: 5400)

    • Base64-obfuscated command line is found

      • powershell.exe (PID: 5400)

    • The process bypasses the loading of PowerShell profile settings

      • powershell.exe (PID: 5400)

    • There is functionality for communication over UDP network (YARA)

      • G9UWOMZDMQ5S3T0CW.exe (PID: 3836)

    • Checks whether the computer is part of a domain (POWERSHELL)

      • powershell.exe (PID: 6248)

    • Starts itself from another location

      • Boebera.pif (PID: 6356)

    • Application launched itself

      • powershell.exe (PID: 5400)

    • Contacting a server suspected of hosting an CnC

      • explorer.exe (PID: 632)

    • There is functionality for enable RDP (YARA)

      • explorer.exe (PID: 632)

  • INFO

    • Manual execution by a user

      • WinRAR.exe (PID: 6660)
      • Setup.exe (PID: 5832)

    • The process uses the downloaded file

      • WinRAR.exe (PID: 6660)

    • Creates files or folders in the user directory

      • Setup.exe (PID: 5832)
      • Boebera.pif (PID: 6356)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 6660)

    • Reads the computer name

      • Setup.exe (PID: 5832)
      • G9UWOMZDMQ5S3T0CW.exe (PID: 3836)
      • Boebera.pif (PID: 6356)

    • Checks supported languages

      • Setup.exe (PID: 5832)
      • nc.exe (PID: 6256)
      • Boebera.pif (PID: 6356)
      • G9UWOMZDMQ5S3T0CW.exe (PID: 3836)
      • 75M4VU.pif (PID: 3568)

    • Create files in a temporary directory

      • nc.exe (PID: 6256)
      • Setup.exe (PID: 5832)
      • choice.exe (PID: 6200)
      • Boebera.pif (PID: 6356)
      • G9UWOMZDMQ5S3T0CW.exe (PID: 3836)
      • choice.exe (PID: 6688)

    • Creates files in the program directory

      • nc.exe (PID: 6256)
      • choice.exe (PID: 6200)

    • Reads the software policy settings

      • Boebera.pif (PID: 6356)

    • Checks proxy server information

      • powershell.exe (PID: 5400)
      • explorer.exe (PID: 632)

    • Disables trace logs

      • powershell.exe (PID: 5400)

    • Gets data length (POWERSHELL)

      • powershell.exe (PID: 6248)

    • Reads mouse settings

      • 75M4VU.pif (PID: 3568)

    • Reads security settings of Internet Explorer

      • explorer.exe (PID: 632)

    • Reads CPU info

      • 75M4VU.pif (PID: 3568)

    • Reads Windows Product ID

      • 75M4VU.pif (PID: 3568)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: Deflated
ZipModifyDate: 2024:11:08 15:40:50
ZipCRC: 0x0356bb1d
ZipCompressedSize: 893381
ZipUncompressedSize: 1998168
ZipFileName: d3dx9_43.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
152
Monitored processes
19
Malicious processes
8
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe no specs winrar.exe rundll32.exe no specs setup.exe nc.exe no specs icacls.exe no specs conhost.exe no specs choice.exe conhost.exe no specs boebera.pif THREAT g9uwomzdmq5s3t0cw.exe no specs powershell.exe conhost.exe no specs choice.exe no specs conhost.exe no specs powershell.exe no specs 75m4vu.pif no specs #AMADEY explorer.exe svchost.exe

Process information

PID
CMD
Path
Indicators
Parent process
632C:\WINDOWS\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe
choice.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Version:
10.0.19041.3758 (WinBuild.160101.0800)
Modules
Images
c:\users\admin\appdata\local\temp\oqvsalqw
c:\windows\syswow64\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\user32.dll
1792\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2172C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
3568"C:\Users\admin\AppData\Roaming\75M4VU.pif" "C:\Users\admin\AppData\Roaming\CSFES7.rar"C:\Users\admin\AppData\Roaming\75M4VU.pif—Boebera.pif
User:
admin
Company:
AutoIt Team
Integrity Level:
MEDIUM
Description:
AutoIt v3 Script (Beta)
Exit code:
0
Version:
3, 3, 15, 1
Modules
Images
c:\users\admin\appdata\roaming\75m4vu.pif
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\psapi.dll
c:\windows\syswow64\user32.dll
3836"C:\Users\admin\AppData\Local\Temp\G9UWOMZDMQ5S3T0CW.exe"C:\Users\admin\AppData\Local\Temp\G9UWOMZDMQ5S3T0CW.exe
Boebera.pif
User:
admin
Integrity Level:
MEDIUM
Exit code:
1
Modules
Images
c:\users\admin\appdata\local\temp\g9uwomzdmq5s3t0cw.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\shlwapi.dll
c:\windows\syswow64\msvcrt.dll
4032\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—icacls.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4224C:\WINDOWS\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)MC:\Windows\System32\icacls.exe—nc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\icacls.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
4448C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -EmbeddingC:\Windows\System32\rundll32.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shcore.dll
c:\windows\system32\imagehlp.dll
5400powershell -exec bypass -f "C:\Users\admin\AppData\Local\Temp\SJAZAAMTYRDCYKK6ACGJ1SB.ps1"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Boebera.pif
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\oleaut32.dll
5532"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\Desktop\#!!Se-tUp_5535_Pa$WorDss!!.zipC:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
1
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
Total events
13 339
Read events
13 294
Write events
32
Delete events
13

Modification events

(PID) Process:(5532) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(5532) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(5532) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(5532) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(5532) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\General\Toolbar\Layout
Operation:writeName:Band76_0
Value:
4C000000730100000402000000000000F0F0F00000000000000000000000000000000000000000009E02050000000000000000003B000000B402000000000000000000000000000001000000
(PID) Process:(5532) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\General\Toolbar\Layout
Operation:writeName:Band76_1
Value:
4C000000730100000500000000000000F0F0F0000000000000000000000000000000000000000000880204000000000000000000180000002A00000000000000000000000000000002000000
(PID) Process:(5532) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\General\Toolbar\Layout
Operation:writeName:Band76_2
Value:
4C000000730100000400000000000000F0F0F0000000000000000000000000000000000000000000700205000000000000000000180000006400000000000000000000000000000003000000
(PID) Process:(6660) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\DialogEditHistory\ExtrPath
Operation:delete valueName:15
Value:
(PID) Process:(6660) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\DialogEditHistory\ExtrPath
Operation:delete valueName:14
Value:
(PID) Process:(6660) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\DialogEditHistory\ExtrPath
Operation:delete valueName:13
Value:
Executable files
9
Suspicious files
8
Text files
7
Unknown types
0

Dropped files

PID
Process
Filename
Type
6200choice.exeC:\Users\admin\AppData\Local\Temp\nobpjfxa —
MD5:—
SHA256:—
5832Setup.exeC:\Users\admin\AppData\Roaming\IPA\olalgkwbinary
MD5:B8220007E0F79A66D341A46F19A8D82A
SHA256:9D1EB829A1E7B7C0DE093C7776C3FFB9EE355F006349FDC8830DFDF71DCF5FA9
6660WinRAR.exeC:\Users\admin\Desktop\#!!Se-tUp_5535_Pa$WorDss!!\Setup.exeexecutable
MD5:D9530ECEE42ACCCFD3871672A511BC9E
SHA256:81E04F9A131534ACC0E9DE08718C062D3D74C80C7F168EC7E699CD4B2BD0F280
6356Boebera.pifC:\Users\admin\AppData\Roaming\CSFES7.rar —
MD5:—
SHA256:—
6660WinRAR.exeC:\Users\admin\Desktop\#!!Se-tUp_5535_Pa$WorDss!!\olalgkwbinary
MD5:B8220007E0F79A66D341A46F19A8D82A
SHA256:9D1EB829A1E7B7C0DE093C7776C3FFB9EE355F006349FDC8830DFDF71DCF5FA9
5832Setup.exeC:\Users\admin\AppData\Roaming\IPA\d3dx9_43.dllexecutable
MD5:EED7D66199C8ADF3BB48AA2C991900D2
SHA256:C27998FC2F30041F8FE194141CBCB637893D6B0A83C40D769058175F8EFF014C
6660WinRAR.exeC:\Users\admin\Desktop\#!!Se-tUp_5535_Pa$WorDss!!\libvlccore.dllexecutable
MD5:8637D787B9A2EE263650AFF1D65F3711
SHA256:4EF3786E2DB61C59BF8140C497EEA43C817DA1FD5C0841D2293AEC147BE8D8D3
6688choice.exeC:\Users\admin\AppData\Local\Temp\oqvsalqw —
MD5:—
SHA256:—
6660WinRAR.exeC:\Users\admin\Desktop\#!!Se-tUp_5535_Pa$WorDss!!\ldtmabr
MD5:37DF3DE27068E21CF5D32EF328533457
SHA256:690AA6FAE4216F7A7659C725EF2E5666EBB844FD5AA3B15B1E330D39546D5A64
6356Boebera.pifC:\Users\admin\AppData\Local\Temp\G9UWOMZDMQ5S3T0CW.exeexecutable
MD5:D7D783D594300F6DDCC79989DD7CEE7F
SHA256:DA63A2D8FFFB5FCCD40785E59C3E50804456395BBA9A1B4B2BECBD8988360754
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
52
DNS requests
28
Threats
6

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4360
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
2364
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6152
SIHClient.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
6152
SIHClient.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
5196
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
5488
MoUsoCoreWorker.exe
GET
200
2.16.164.114:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5488
MoUsoCoreWorker.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
632
explorer.exe
POST
200
172.67.213.173:80
http://moviecentral-petparade.com/g9jvjfd73/index.php
unknown
—
—
malicious
632
explorer.exe
POST
200
172.67.213.173:80
http://moviecentral-petparade.com/g9jvjfd73/index.php
unknown
—
—
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
6944
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1588
RUXIMICS.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5488
MoUsoCoreWorker.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4360
SearchApp.exe
2.23.209.140:443
www.bing.com
Akamai International B.V.
GB
whitelisted
4360
SearchApp.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2364
svchost.exe
40.126.32.140:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2364
svchost.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
4360
SearchApp.exe
2.23.209.149:443
www.bing.com
Akamai International B.V.
GB
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 51.104.136.2
  • 20.73.194.208
  • 40.127.240.158
whitelisted
www.bing.com
  • 2.23.209.140
  • 2.23.209.133
  • 2.23.209.143
  • 2.23.209.189
  • 2.23.209.137
  • 2.23.209.135
  • 2.23.209.142
  • 2.23.209.131
  • 2.23.209.130
  • 2.23.209.149
  • 2.23.209.150
  • 2.23.209.156
  • 2.23.209.144
  • 2.23.209.154
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
google.com
  • 142.250.185.174
whitelisted
login.live.com
  • 40.126.32.140
  • 40.126.32.133
  • 40.126.32.134
  • 20.190.160.22
  • 40.126.32.136
  • 20.190.160.14
  • 40.126.32.68
  • 40.126.32.138
whitelisted
th.bing.com
  • 2.23.209.149
  • 2.23.209.154
  • 2.23.209.137
  • 2.23.209.143
  • 2.23.209.158
  • 2.23.209.141
  • 2.23.209.156
  • 2.23.209.150
  • 2.23.209.140
whitelisted
go.microsoft.com
  • 184.28.89.167
whitelisted
crl.microsoft.com
  • 2.16.164.114
  • 2.16.164.99
whitelisted
www.microsoft.com
  • 88.221.169.152
whitelisted
slscr.update.microsoft.com
  • 20.12.23.50
whitelisted

Threats

PID
Process
Class
Message
2172
svchost.exe
Potentially Bad Traffic
SUSPICIOUS [ANY.RUN] Suspected Malicious Domain by Cloudflare (moviecentral-petparade .com)
632
explorer.exe
Malware Command and Control Activity Detected
BOTNET [ANY.RUN] Amadey HTTP POST Request (st=s)
4 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
#!!Se-tUp_5535_Pa$WorDss!!.zip