File name:

2025-05-18_60c0867e88de1261640d9f30bab5b9d2_amadey_black-basta_cobalt-strike_elex_luca-stealer

Full analysis: https://app.any.run/tasks/15d78e45-1711-4549-81d5-71e3b0195a4f
Verdict: Malicious activity
Threats:

Amadey is a formidable Windows infostealer threat, characterized by its persistence mechanisms, modular design, and ability to execute various malicious tasks.

Analysis date: May 18, 2025, 21:44:33
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
auto-reg
amadey
botnet
stealer
loader
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:

60C0867E88DE1261640D9F30BAB5B9D2

SHA1:

13CA201F8CD63BF3C952392812D84D32314F8A48

SHA256:

3ED3615C1C73B0F9BF84AC5AEBA9C557EFEE4DA63609B2779379DBDAF4FB4285

SSDEEP:

3072:kHGIxvLxlvLhsw9IAt/NyKrGAQ+JMtDhKlS/L5hEberewx8MnnrpV2HwtZY:Q1dlds4I4/y+JMVhK6rrZwQn

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Uses Task Scheduler to run other applications

      • pdates.exe (PID: 7792)
    • AMADEY mutex has been found

      • pdates.exe (PID: 7792)
      • pdates.exe (PID: 7204)
      • pdates.exe (PID: 2108)
      • pdates.exe (PID: 616)
    • Changes the autorun value in the registry

      • pdates.exe (PID: 7792)
    • AMADEY has been detected (YARA)

      • pdates.exe (PID: 7792)
    • Connects to the CnC server

      • pdates.exe (PID: 7792)
    • AMADEY has been detected (SURICATA)

      • pdates.exe (PID: 7792)
  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • 2025-05-18_60c0867e88de1261640d9f30bab5b9d2_amadey_black-basta_cobalt-strike_elex_luca-stealer.exe (PID: 7736)
    • Starts itself from another location

      • 2025-05-18_60c0867e88de1261640d9f30bab5b9d2_amadey_black-basta_cobalt-strike_elex_luca-stealer.exe (PID: 7736)
    • Reads security settings of Internet Explorer

      • 2025-05-18_60c0867e88de1261640d9f30bab5b9d2_amadey_black-basta_cobalt-strike_elex_luca-stealer.exe (PID: 7736)
      • pdates.exe (PID: 7792)
    • Starts CMD.EXE for commands execution

      • cmd.exe (PID: 7888)
      • pdates.exe (PID: 7792)
    • Application launched itself

      • cmd.exe (PID: 7888)
    • Process requests binary or script from the Internet

      • pdates.exe (PID: 7792)
    • The process executes via Task Scheduler

      • pdates.exe (PID: 2108)
      • pdates.exe (PID: 7204)
      • pdates.exe (PID: 616)
    • Contacting a server suspected of hosting an CnC

      • pdates.exe (PID: 7792)
    • Connects to the server without a host name

      • pdates.exe (PID: 7792)
    • Uses ICACLS.EXE to modify access control lists

      • cmd.exe (PID: 7888)
  • INFO

    • Reads the computer name

      • 2025-05-18_60c0867e88de1261640d9f30bab5b9d2_amadey_black-basta_cobalt-strike_elex_luca-stealer.exe (PID: 7736)
      • pdates.exe (PID: 7792)
    • Create files in a temporary directory

      • 2025-05-18_60c0867e88de1261640d9f30bab5b9d2_amadey_black-basta_cobalt-strike_elex_luca-stealer.exe (PID: 7736)
    • Checks supported languages

      • 2025-05-18_60c0867e88de1261640d9f30bab5b9d2_amadey_black-basta_cobalt-strike_elex_luca-stealer.exe (PID: 7736)
      • pdates.exe (PID: 7792)
      • pdates.exe (PID: 616)
      • pdates.exe (PID: 2108)
      • pdates.exe (PID: 7204)
    • Process checks computer location settings

      • pdates.exe (PID: 7792)
      • 2025-05-18_60c0867e88de1261640d9f30bab5b9d2_amadey_black-basta_cobalt-strike_elex_luca-stealer.exe (PID: 7736)
    • Auto-launch of the file from Registry key

      • pdates.exe (PID: 7792)
    • Checks proxy server information

      • pdates.exe (PID: 7792)
      • slui.exe (PID: 5544)
    • Creates files or folders in the user directory

      • pdates.exe (PID: 7792)
    • Reads the software policy settings

      • slui.exe (PID: 5544)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Amadey

(PID) Process(7792) pdates.exe
C277.91.68.61
URLhttp://77.91.68.61/rock/index.php
Version3.86
Options
Drop directory925e7e99c5
Drop namepdates.exe
Strings (123)Kaspersky Lab
Plugins/
|
#
&bi=
"
\App
Powershell.exe
ProgramData\
ps1
rundll32
http://
..\
Content-Disposition: form-data; name="data"; filename="
SOFTWARE\Microsoft\Windows NT\CurrentVersion
dll
:R" /E
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
VideoID
" /F
cred.dll|clip.dll|
id=
cmd
SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName
-executionpolicy remotesigned -File "
2022
SCHTASKS
------
2016
\0000
&lv=
&dm=
CurrentBuild
2019
:::
S-%lu-
" && timeout 1 && del
ProductName
Panda Security
ESET
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
/k
925e7e99c5
+++
77.91.68.61
?scr=1
Doctor Web
GET
SYSTEM\ControlSet001\Services\BasicDisplay\Video
.jpg
/Delete /TN "
rundll32.exe
"taskkill /f /im "
=
360TotalSecurity
&&
&ar=
<d>
wb
Content-Type: multipart/form-data; boundary=----
Startup
Norton
&& Exit"
https://
/rock/index.php
SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
Avira
&og=
%-lu
POST
/TR "
" Content-Type: application/octet-stream
/Create /SC MINUTE /MO 1 /TN
Rem
------
<c>
&sd=
&os=
:F" /E
AVAST Software
\
shell32.dll
e0
3.86
" && ren
CACLS "
kernel32.dll
DefaultSettings.XResolution
&&Exit
d1
DefaultSettings.YResolution
&un=
--
GetNativeSystemInfo
" /P "
-%lu
ComputerName
&unit=
:N"
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
Sophos
%USERPROFILE%
exe
e1
Programs
pdates.exe
&av=
0123456789
rb
&vs=
SYSTEM\CurrentControlSet\Control\UnitedVideo\CONTROL\VIDEO\
abcdefghijklmnopqrstuvwxyz0123456789-_
cmd /C RMDIR /s/q
Bitdefender
echo Y|CACLS "
&pc=
-unicode-
AVG
WinDefender
&&
Comodo
Content-Type: application/x-www-form-urlencoded
Main
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (64.6)
.dll | Win32 Dynamic Link Library (generic) (15.4)
.exe | Win32 Executable (generic) (10.5)
.exe | Generic Win/DOS Executable (4.6)
.exe | DOS Executable Generic (4.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2023:07:24 12:21:28+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14.24
CodeSize: 177664
InitializedDataSize: 53760
UninitializedDataSize: -
EntryPoint: 0x1563f
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
137
Monitored processes
16
Malicious processes
5
Suspicious processes
1

Behavior graph

Click at the process to see the details
start 2025-05-18_60c0867e88de1261640d9f30bab5b9d2_amadey_black-basta_cobalt-strike_elex_luca-stealer.exe #AMADEY pdates.exe schtasks.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs cacls.exe no specs cacls.exe no specs cmd.exe no specs cacls.exe no specs cacls.exe no specs pdates.exe no specs slui.exe pdates.exe no specs pdates.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
616"C:\Users\admin\AppData\Local\Temp\925e7e99c5\pdates.exe"C:\Users\admin\AppData\Local\Temp\925e7e99c5\pdates.exesvchost.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\925e7e99c5\pdates.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
c:\windows\syswow64\msvcrt.dll
2108"C:\Users\admin\AppData\Local\Temp\925e7e99c5\pdates.exe"C:\Users\admin\AppData\Local\Temp\925e7e99c5\pdates.exesvchost.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\925e7e99c5\pdates.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
c:\windows\syswow64\msvcrt.dll
5544C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
7204"C:\Users\admin\AppData\Local\Temp\925e7e99c5\pdates.exe"C:\Users\admin\AppData\Local\Temp\925e7e99c5\pdates.exesvchost.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\925e7e99c5\pdates.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
c:\windows\syswow64\msvcrt.dll
7736"C:\Users\admin\Desktop\2025-05-18_60c0867e88de1261640d9f30bab5b9d2_amadey_black-basta_cobalt-strike_elex_luca-stealer.exe" C:\Users\admin\Desktop\2025-05-18_60c0867e88de1261640d9f30bab5b9d2_amadey_black-basta_cobalt-strike_elex_luca-stealer.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\2025-05-18_60c0867e88de1261640d9f30bab5b9d2_amadey_black-basta_cobalt-strike_elex_luca-stealer.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
7792"C:\Users\admin\AppData\Local\Temp\925e7e99c5\pdates.exe" C:\Users\admin\AppData\Local\Temp\925e7e99c5\pdates.exe
2025-05-18_60c0867e88de1261640d9f30bab5b9d2_amadey_black-basta_cobalt-strike_elex_luca-stealer.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\appdata\local\temp\925e7e99c5\pdates.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
Amadey
(PID) Process(7792) pdates.exe
C277.91.68.61
URLhttp://77.91.68.61/rock/index.php
Version3.86
Options
Drop directory925e7e99c5
Drop namepdates.exe
Strings (123)Kaspersky Lab
Plugins/
|
#
&bi=
"
\App
Powershell.exe
ProgramData\
ps1
rundll32
http://
..\
Content-Disposition: form-data; name="data"; filename="
SOFTWARE\Microsoft\Windows NT\CurrentVersion
dll
:R" /E
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
VideoID
" /F
cred.dll|clip.dll|
id=
cmd
SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName
-executionpolicy remotesigned -File "
2022
SCHTASKS
------
2016
\0000
&lv=
&dm=
CurrentBuild
2019
:::
S-%lu-
" && timeout 1 && del
ProductName
Panda Security
ESET
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
/k
925e7e99c5
+++
77.91.68.61
?scr=1
Doctor Web
GET
SYSTEM\ControlSet001\Services\BasicDisplay\Video
.jpg
/Delete /TN "
rundll32.exe
"taskkill /f /im "
=
360TotalSecurity
&&
&ar=
<d>
wb
Content-Type: multipart/form-data; boundary=----
Startup
Norton
&& Exit"
https://
/rock/index.php
SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
Avira
&og=
%-lu
POST
/TR "
" Content-Type: application/octet-stream
/Create /SC MINUTE /MO 1 /TN
Rem
------
<c>
&sd=
&os=
:F" /E
AVAST Software
\
shell32.dll
e0
3.86
" && ren
CACLS "
kernel32.dll
DefaultSettings.XResolution
&&Exit
d1
DefaultSettings.YResolution
&un=
--
GetNativeSystemInfo
" /P "
-%lu
ComputerName
&unit=
:N"
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
Sophos
%USERPROFILE%
exe
e1
Programs
pdates.exe
&av=
0123456789
rb
&vs=
SYSTEM\CurrentControlSet\Control\UnitedVideo\CONTROL\VIDEO\
abcdefghijklmnopqrstuvwxyz0123456789-_
cmd /C RMDIR /s/q
Bitdefender
echo Y|CACLS "
&pc=
-unicode-
AVG
WinDefender
&&
Comodo
Content-Type: application/x-www-form-urlencoded
Main
7844"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN pdates.exe /TR "C:\Users\admin\AppData\Local\Temp\925e7e99c5\pdates.exe" /FC:\Windows\SysWOW64\schtasks.exepdates.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Task Scheduler Configuration Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
7856\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exeschtasks.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
7888"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "pdates.exe" /P "admin:N"&&CACLS "pdates.exe" /P "admin:R" /E&&echo Y|CACLS "..\925e7e99c5" /P "admin:N"&&CACLS "..\925e7e99c5" /P "admin:R" /E&&ExitC:\Windows\SysWOW64\cmd.exepdates.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
7904\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.execmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
4 540
Read events
4 536
Write events
4
Delete events
0

Modification events

(PID) Process:(7792) pdates.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
Operation:writeName:Startup
Value:
C:\Users\admin\AppData\Local\Temp\925e7e99c5\
(PID) Process:(7792) pdates.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(7792) pdates.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(7792) pdates.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
Executable files
1
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
77362025-05-18_60c0867e88de1261640d9f30bab5b9d2_amadey_black-basta_cobalt-strike_elex_luca-stealer.exeC:\Users\admin\AppData\Local\Temp\925e7e99c5\pdates.exeexecutable
MD5:60C0867E88DE1261640D9F30BAB5B9D2
SHA256:3ED3615C1C73B0F9BF84AC5AEBA9C557EFEE4DA63609B2779379DBDAF4FB4285
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
11
TCP/UDP connections
42
DNS requests
12
Threats
7

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
7192
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%202.1.crl
unknown
whitelisted
7792
pdates.exe
POST
77.91.68.61:80
http://77.91.68.61/rock/index.php
unknown
malicious
7192
SIHClient.exe
GET
200
2.16.168.124:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
whitelisted
7192
SIHClient.exe
GET
200
2.16.168.124:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl
unknown
whitelisted
7192
SIHClient.exe
GET
200
2.16.168.124:80
http://crl.microsoft.com/pki/crl/products/MicTimStaPCA_2010-07-01.crl
unknown
whitelisted
7192
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
whitelisted
7192
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Signing%20CA%202.2.crl
unknown
whitelisted
7792
pdates.exe
GET
77.91.68.61:80
http://77.91.68.61/rock/Plugins/clip64.dll
unknown
malicious
7192
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Signing%20CA%202.1.crl
unknown
whitelisted
7192
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%202.2.crl
unknown
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
whitelisted
4
System
192.168.100.255:138
whitelisted
3216
svchost.exe
172.211.123.248:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
7792
pdates.exe
77.91.68.61:80
Foton Telecom CJSC
RU
malicious
7192
SIHClient.exe
52.149.20.212:443
slscr.update.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
7192
SIHClient.exe
2.16.168.124:80
crl.microsoft.com
Akamai International B.V.
RU
whitelisted
7192
SIHClient.exe
2.23.246.101:80
www.microsoft.com
Ooredoo Q.S.C.
QA
whitelisted
7192
SIHClient.exe
20.242.39.171:443
fe3cr.delivery.mp.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
7396
slui.exe
40.91.76.224:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
whitelisted
google.com
  • 216.58.206.78
whitelisted
client.wns.windows.com
  • 172.211.123.248
whitelisted
slscr.update.microsoft.com
  • 52.149.20.212
whitelisted
crl.microsoft.com
  • 2.16.168.124
  • 2.16.168.114
whitelisted
www.microsoft.com
  • 2.23.246.101
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.242.39.171
whitelisted
activation-v2.sls.microsoft.com
  • 40.91.76.224
whitelisted
nexusrules.officeapps.live.com
  • 52.111.227.13
whitelisted
login.live.com
  • 20.190.160.65
  • 20.190.160.20
  • 40.126.32.140
  • 40.126.32.72
  • 20.190.160.131
  • 40.126.32.134
  • 20.190.160.4
  • 20.190.160.22
whitelisted

Threats

PID
Process
Class
Message
7792
pdates.exe
Misc activity
SUSPICIOUS [ANY.RUN] Sent Host Name in HTTP POST Body
7792
pdates.exe
Malware Command and Control Activity Detected
ET MALWARE Amadey CnC Check-In
7792
pdates.exe
A Network Trojan was detected
ET MALWARE Win32/Amadey Bot Activity (POST) M2
7792
pdates.exe
Potentially Bad Traffic
ET INFO Dotted Quad Host DLL Request
7792
pdates.exe
A Network Trojan was detected
BOTNET [ANY.RUN] Amadey Clipper plugin download request
7792
pdates.exe
Potentially Bad Traffic
ET INFO Dotted Quad Host DLL Request
7792
pdates.exe
A Network Trojan was detected
BOTNET [ANY.RUN] Amadey Stealer plugin download request
No debug info