File name:

x43750805d5a7c406ce1fbf0508916d9fa14615daf0e99536db50580b89dc73e2.exe

Full analysis: https://app.any.run/tasks/b2dd7b96-3eb4-4566-bcd3-608a2d68e402
Verdict: Malicious activity
Threats:

Amadey is a formidable Windows infostealer threat, characterized by its persistence mechanisms, modular design, and ability to execute various malicious tasks.

Analysis date: May 22, 2026, 23:28:58
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
stealc
stealer
amadey
botnet
auto-reg
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32+ executable (GUI) x86-64, for MS Windows, 7 sections
MD5:

7C5AC7E6472EC54ECE3AD71742FD1DFA

SHA1:

4E04DF49E1EEF2C538E82C1EEB19CDEFF14ACBED

SHA256:

43750805D5A7C406CE1FBF0508916D9FA14615DAF0E99536DB50580B89DC73E2

SSDEEP:

98304:/kzLPhlAQsUIco+T5QCIjGFlmk1qKE1xU0Wq86qHX827Nq610asRK52blc/E52bv:oFq

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Changes the login/logoff helper path in the registry

      • 5m3jcbdfqp.exe (PID: 5384)
    • Application was injected by another process

      • sihost.exe (PID: 4412)
      • explorer.exe (PID: 4696)
      • RuntimeBroker.exe (PID: 5232)
      • RuntimeBroker.exe (PID: 5728)
      • RuntimeBroker.exe (PID: 7308)
      • RuntimeBroker.exe (PID: 6548)
    • Runs injected code in another process

      • 5m3jcbdfqp.exe (PID: 5384)
    • STEALC has been detected

      • notepad.exe (PID: 1456)
    • Changes the autorun value in the registry

      • 9fo34yipzn.exe (PID: 2164)
    • AMADEY has been detected (SURICATA)

      • zboml.exe (PID: 2648)
    • Stealers network behavior

      • notepad.exe (PID: 1456)
    • STEALC has been detected (SURICATA)

      • notepad.exe (PID: 1456)
  • SUSPICIOUS

    • The process creates files with name similar to system file names

      • 5m3jcbdfqp.exe (PID: 5384)
    • Executable content was dropped or overwritten

      • 5m3jcbdfqp.exe (PID: 5384)
      • x43750805d5a7c406ce1fbf0508916d9fa14615daf0e99536db50580b89dc73e2.exe (PID: 4968)
      • 9fo34yipzn.exe (PID: 2164)
    • Start notepad (likely ransomware note)

      • h2kn78pg2d.exe (PID: 7664)
      • lhxy2lubbf.exe (PID: 7188)
    • Reads the date of Windows installation

      • 5m3jcbdfqp.exe (PID: 5384)
      • 9fo34yipzn.exe (PID: 2164)
    • Starts itself from another location

      • 9fo34yipzn.exe (PID: 2164)
  • INFO

    • Checks supported languages

      • x43750805d5a7c406ce1fbf0508916d9fa14615daf0e99536db50580b89dc73e2.exe (PID: 4968)
      • 5m3jcbdfqp.exe (PID: 5384)
      • h2kn78pg2d.exe (PID: 7664)
      • lhxy2lubbf.exe (PID: 7188)
      • 9fo34yipzn.exe (PID: 2164)
      • SilverBulletPro1.exe (PID: 6084)
      • zboml.exe (PID: 2648)
      • zboml.exe (PID: 6104)
    • The sample compiled with english language support

      • x43750805d5a7c406ce1fbf0508916d9fa14615daf0e99536db50580b89dc73e2.exe (PID: 4968)
      • 5m3jcbdfqp.exe (PID: 5384)
    • Creates files or folders in the user directory

      • x43750805d5a7c406ce1fbf0508916d9fa14615daf0e99536db50580b89dc73e2.exe (PID: 4968)
      • 5m3jcbdfqp.exe (PID: 5384)
    • Reads the computer name

      • 5m3jcbdfqp.exe (PID: 5384)
      • SilverBulletPro1.exe (PID: 6084)
      • 9fo34yipzn.exe (PID: 2164)
      • zboml.exe (PID: 2648)
    • Reads security settings of Internet Explorer

      • notepad.exe (PID: 1456)
      • 9fo34yipzn.exe (PID: 2164)
      • zboml.exe (PID: 2648)
    • Launching a file from a Registry key

      • 9fo34yipzn.exe (PID: 2164)
    • Reads the machine GUID from the registry

      • 9fo34yipzn.exe (PID: 2164)
    • Process checks computer location settings

      • 9fo34yipzn.exe (PID: 2164)
    • Manual execution by a user

      • zboml.exe (PID: 6104)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (87.3)
.exe | Generic Win/DOS Executable (6.3)
.exe | DOS Executable Generic (6.3)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2026:05:22 12:03:59+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 14.5
CodeSize: 50176
InitializedDataSize: 2610176
UninitializedDataSize: -
EntryPoint: 0x17cc
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
145
Monitored processes
17
Malicious processes
6
Suspicious processes
2

Behavior graph

Click at the process to see the details
start x43750805d5a7c406ce1fbf0508916d9fa14615daf0e99536db50580b89dc73e2.exe 5m3jcbdfqp.exe h2kn78pg2d.exe no specs #STEALC notepad.exe lhxy2lubbf.exe no specs notepad.exe no specs 9fo34yipzn.exe silverbulletpro1.exe slui.exe #AMADEY zboml.exe zboml.exe no specs sihost.exe explorer.exe runtimebroker.exe runtimebroker.exe runtimebroker.exe runtimebroker.exe

Process information

PID
CMD
Path
Indicators
Parent process
1456C:\WINDOWS\system32\notepad.exeC:\Windows\System32\notepad.exe
h2kn78pg2d.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Notepad
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\notepad.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
2164"C:\Users\admin\AppData\Roaming\9fo34yipzn.exe"C:\Users\admin\AppData\Roaming\9fo34yipzn.exe
x43750805d5a7c406ce1fbf0508916d9fa14615daf0e99536db50580b89dc73e2.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\roaming\9fo34yipzn.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\wininet.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
2396C:\WINDOWS\system32\notepad.exeC:\Windows\System32\notepad.exelhxy2lubbf.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Notepad
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\notepad.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
2648"C:\ProgramData\zboml.exe" C:\ProgramData\zboml.exe
9fo34yipzn.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\programdata\zboml.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\wininet.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
4172C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
4412sihost.exeC:\Windows\System32\sihost.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Shell Infrastructure Host
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sihost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
4696C:\WINDOWS\Explorer.EXEC:\Windows\explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Version:
10.0.19041.3758 (WinBuild.160101.0800)
Modules
Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\twinapi.dll
c:\windows\system32\oleaut32.dll
4968"C:\Users\admin\Desktop\x43750805d5a7c406ce1fbf0508916d9fa14615daf0e99536db50580b89dc73e2.exe" C:\Users\admin\Desktop\x43750805d5a7c406ce1fbf0508916d9fa14615daf0e99536db50580b89dc73e2.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\x43750805d5a7c406ce1fbf0508916d9fa14615daf0e99536db50580b89dc73e2.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\shell32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
5232C:\Windows\System32\RuntimeBroker.exe -EmbeddingC:\Windows\System32\RuntimeBroker.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Runtime Broker
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\runtimebroker.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\powrprof.dll
5384"C:\Users\admin\AppData\Roaming\5m3jcbdfqp.exe"C:\Users\admin\AppData\Roaming\5m3jcbdfqp.exe
x43750805d5a7c406ce1fbf0508916d9fa14615daf0e99536db50580b89dc73e2.exe
User:
admin
Company:
Synaptics Incorporated
Integrity Level:
MEDIUM
Description:
Windows Explorer
Version:
8.8.6790.64
Modules
Images
c:\users\admin\appdata\roaming\5m3jcbdfqp.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
Total events
5 833
Read events
5 823
Write events
10
Delete events
0

Modification events

(PID) Process:(1456) notepad.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(1456) notepad.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(1456) notepad.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(5384) 5m3jcbdfqp.exeKey:HKEY_CURRENT_USER\Environment
Operation:writeName:UserInitMprLogonScript
Value:
"C:\WINDOWS\system32\cmd.exe" /c start /b "" "C:\Users\admin\AppData\Roaming\Microsoft\Windows\Services\winhost.exe"
(PID) Process:(4172) slui.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\3d\52C64B7E
Operation:writeName:@%SystemRoot%\System32\sppcomapi.dll,-3200
Value:
Software Licensing
(PID) Process:(2164) 9fo34yipzn.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:cjahz
Value:
C:\ProgramData\zboml.exe
(PID) Process:(2164) 9fo34yipzn.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
Operation:writeName:SlowContextMenuEntries
Value:
6024B221EA3A6910A2DC08002B30309D0A010000BD0E0C47735D584D9CEDE91E22E23282770100000114020000000000C0000000000000468D0000006078A409B011A54DAFA526D86198A780390100009AD298B2EDA6DE11BA8CA68E55D895936E000000
(PID) Process:(2648) zboml.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(2648) zboml.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(2648) zboml.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
Executable files
7
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
4968x43750805d5a7c406ce1fbf0508916d9fa14615daf0e99536db50580b89dc73e2.exeC:\Users\admin\AppData\Roaming\h2kn78pg2d.exeexecutable
MD5:E3E2E9F305F7A3032592C8F1C31C02BB
SHA256:458EC1F07DF85EB6DB2A204038D6DEE8833F77B0A6A5B8D8BE747F541E56CFE0
4968x43750805d5a7c406ce1fbf0508916d9fa14615daf0e99536db50580b89dc73e2.exeC:\Users\admin\AppData\Roaming\5m3jcbdfqp.exeexecutable
MD5:AC25FF38A0029649036CBEFD2720F4F0
SHA256:B2FB627F2AFD9009EE0B2662BE278357BD17F27F0F8F91957DB3EB956951C011
53845m3jcbdfqp.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Services\winhost.exeexecutable
MD5:AC25FF38A0029649036CBEFD2720F4F0
SHA256:B2FB627F2AFD9009EE0B2662BE278357BD17F27F0F8F91957DB3EB956951C011
4968x43750805d5a7c406ce1fbf0508916d9fa14615daf0e99536db50580b89dc73e2.exeC:\Users\admin\AppData\Roaming\lhxy2lubbf.exeexecutable
MD5:7CAC2FF04CE6C44CD955E3AB6976D6A0
SHA256:C5FA429F91A93161413C960E0CBF2ACEC608D6DF09C45A5B21F5B6ACD512B591
4968x43750805d5a7c406ce1fbf0508916d9fa14615daf0e99536db50580b89dc73e2.exeC:\Users\admin\AppData\Roaming\9fo34yipzn.exeexecutable
MD5:90D500EE74FB78CE02BAA06E890EF9AE
SHA256:E9670B3D82A74F2E4B8C8F342CED0C04E32CACEE495490C62F1B1573CDA60B52
4968x43750805d5a7c406ce1fbf0508916d9fa14615daf0e99536db50580b89dc73e2.exeC:\Users\admin\Desktop\SilverBulletPro1.exeexecutable
MD5:D3117E8306C159F218D9409843F3A9F3
SHA256:08785C9711CFF3899F8859D6E18DF36DA52776649E892CA2EA4E5318035FCE2F
21649fo34yipzn.exeC:\ProgramData\zboml.exeexecutable
MD5:90D500EE74FB78CE02BAA06E890EF9AE
SHA256:E9670B3D82A74F2E4B8C8F342CED0C04E32CACEE495490C62F1B1573CDA60B52
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
57
TCP/UDP connections
45
DNS requests
17
Threats
9

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4348
SIHClient.exe
GET
304
74.178.76.128:443
https://slscr.update.microsoft.com/SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
US
whitelisted
4348
SIHClient.exe
GET
200
74.178.76.54:443
https://fe3cr.delivery.mp.microsoft.com/clientwebservice/ping
US
whitelisted
7984
svchost.exe
GET
200
2.16.241.19:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
NL
binary
825 b
whitelisted
7984
svchost.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
US
binary
814 b
whitelisted
4348
SIHClient.exe
GET
200
74.178.76.128:443
https://slscr.update.microsoft.com/sls/ping
US
whitelisted
4348
SIHClient.exe
GET
304
74.178.76.128:443
https://slscr.update.microsoft.com/SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
US
whitelisted
5384
5m3jcbdfqp.exe
POST
200
62.60.226.159:80
http://62.60.226.159/api.php
GB
unknown
2648
zboml.exe
POST
200
62.60.226.159:80
http://62.60.226.159/xvzpjyddlu/getdata.php
GB
malicious
5384
5m3jcbdfqp.exe
POST
200
62.60.226.159:80
http://62.60.226.159/api.php
GB
unknown
4348
SIHClient.exe
GET
304
74.178.76.128:443
https://slscr.update.microsoft.com/SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
US
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
Not routed
whitelisted
48.209.138.168:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
5276
MoUsoCoreWorker.exe
48.209.138.168:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
7312
slui.exe
128.24.231.65:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
4
System
192.168.100.255:138
Not routed
whitelisted
7984
svchost.exe
2.16.241.19:80
crl.microsoft.com
AKAMAI-ASN1
NL
whitelisted
7984
svchost.exe
88.221.169.152:80
www.microsoft.com
AKAMAI-AS
US
whitelisted
7984
svchost.exe
48.209.6.48:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
5276
MoUsoCoreWorker.exe
48.209.6.48:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
5384
5m3jcbdfqp.exe
62.60.226.159:80
FEMOIT
GB
malicious

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 48.209.138.168
  • 48.209.6.48
whitelisted
activation-v2.sls.microsoft.com
  • 128.24.231.65
whitelisted
crl.microsoft.com
  • 2.16.241.19
  • 2.16.241.12
  • 184.24.77.37
  • 184.24.77.35
whitelisted
www.microsoft.com
  • 88.221.169.152
  • 23.58.106.108
whitelisted
google.com
  • 142.250.154.113
  • 142.250.154.101
  • 142.250.154.139
  • 142.250.154.102
  • 142.250.154.100
  • 142.250.154.138
whitelisted
client.wns.windows.com
  • 172.211.123.248
whitelisted
slscr.update.microsoft.com
  • 74.178.76.128
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 74.178.76.54
whitelisted
self.events.data.microsoft.com
  • 40.79.141.154
whitelisted
login.live.com
  • 20.190.160.65
  • 20.190.160.17
  • 20.190.160.4
  • 40.126.32.72
  • 20.190.160.131
  • 20.190.160.5
  • 20.190.160.20
  • 40.126.32.74
whitelisted

Threats

PID
Process
Class
Message
5384
5m3jcbdfqp.exe
Misc Attack
ET DROP Spamhaus DROP Listed Traffic Inbound group 9
1456
notepad.exe
Misc Attack
ET DROP Spamhaus DROP Listed Traffic Inbound group 45
2648
zboml.exe
Misc activity
INFO [ANY.RUN] USER_AGENTS Suspicious User-Agent (Mozilla/5.0)
2648
zboml.exe
A Network Trojan was detected
MALWARE [ANY.RUN] Win32/Amadey associated URI (/xvzpjyddlu/getdata.php)
1456
notepad.exe
A Network Trojan was detected
MALWARE [ANY.RUN] Win32/Stealc stealer activity observed
2648
zboml.exe
Misc activity
INFO [ANY.RUN] USER_AGENTS Suspicious User-Agent (Mozilla/5.0)
2648
zboml.exe
A Network Trojan was detected
MALWARE [ANY.RUN] Win32/Amadey associated URI (/xvzpjyddlu/getdata.php)
2648
zboml.exe
Misc activity
INFO [ANY.RUN] USER_AGENTS Suspicious User-Agent (Mozilla/5.0)
2648
zboml.exe
A Network Trojan was detected
MALWARE [ANY.RUN] Win32/Amadey associated URI (/xvzpjyddlu/getdata.php)
Process
Message
SilverBulletPro1.exe
The application to execute does not exist: 'C:\Users\admin\Desktop\SilverBulletPro.dll'.