File name:

zY9sqWs.exe

Full analysis: https://app.any.run/tasks/2a5bf6c6-2844-44d7-bd6f-bdd7a73b54a2
Verdict: Malicious activity
Threats:

Amadey is a formidable Windows infostealer threat, characterized by its persistence mechanisms, modular design, and ability to execute various malicious tasks.

Malware Trends Tracker     >>>
Analysis date: March 08, 2025, 15:22:32
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
amadey
botnet
stealer
rdp
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:

D8A7D8E3FFE307714099D74E7CCAAC01

SHA1:

D2BA12C64F0349083B49E43E8DE7A586D049F292

SHA256:

5BEE3F1D88D6870469C170BC00E78F793247F7DD8AC46726B26820721C2B66ED

SSDEEP:

6144:TNim4U9GVJd9P3kM3rDfF8kSt5Pw05b6DsPl7vPPJ:NYDPDbDfFZs5PD5OKbJ

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • AMADEY has been detected (SURICATA)

      • Gxtuum.exe (PID: 6028)

    • AMADEY has been detected (YARA)

      • Gxtuum.exe (PID: 6028)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • zY9sqWs.exe (PID: 660)

    • Starts itself from another location

      • zY9sqWs.exe (PID: 660)

    • Reads security settings of Internet Explorer

      • Gxtuum.exe (PID: 6028)
      • zY9sqWs.exe (PID: 660)

    • Connects to the server without a host name

      • Gxtuum.exe (PID: 6028)

    • Contacting a server suspected of hosting an CnC

      • Gxtuum.exe (PID: 6028)

    • There is functionality for enable RDP (YARA)

      • Gxtuum.exe (PID: 6028)

    • There is functionality for taking screenshot (YARA)

      • Gxtuum.exe (PID: 6028)

    • The process executes via Task Scheduler

      • Gxtuum.exe (PID: 5544)
      • Gxtuum.exe (PID: 3300)

  • INFO

    • Reads the computer name

      • zY9sqWs.exe (PID: 660)
      • Gxtuum.exe (PID: 6028)

    • Process checks computer location settings

      • zY9sqWs.exe (PID: 660)

    • Create files in a temporary directory

      • zY9sqWs.exe (PID: 660)

    • Checks supported languages

      • zY9sqWs.exe (PID: 660)
      • Gxtuum.exe (PID: 6028)
      • Gxtuum.exe (PID: 5544)
      • Gxtuum.exe (PID: 3300)

    • Checks proxy server information

      • Gxtuum.exe (PID: 6028)
      • BackgroundTransferHost.exe (PID: 728)

    • Reads security settings of Internet Explorer

      • BackgroundTransferHost.exe (PID: 616)
      • BackgroundTransferHost.exe (PID: 728)
      • BackgroundTransferHost.exe (PID: 1056)
      • BackgroundTransferHost.exe (PID: 6640)
      • BackgroundTransferHost.exe (PID: 6944)

    • Creates files or folders in the user directory

      • BackgroundTransferHost.exe (PID: 728)

    • Reads the software policy settings

      • BackgroundTransferHost.exe (PID: 728)
      • slui.exe (PID: 976)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Amadey

(PID) Process(6028) Gxtuum.exe
C2185.125.50.8
URLhttp://185.125.50.8/mVsXkjvb3/index.php
Version5.30
Options
Drop directory845cfbab99
Drop nameGxtuum.exe
Strings (125)360TotalSecurity
rundll32.exe
Doctor Web
ProductName
AVAST Software
ProgramData\
sd:
/Plugins/
?scr=1
bi:
2016
rundll32
-executionpolicy remotesigned -File "
SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
.jpg
+++
%USERPROFILE%
wb
185.125.50.8
os:
00000422
&unit=
&& Exit"
ar:
Main
Kaspersky Lab
"taskkill /f /im "
ESET
Programs
/k
CurrentBuild
" Content-Type: application/octet-stream
Bitdefender
S-%lu-
SYSTEM\ControlSet001\Services\BasicDisplay\Video
------
Content-Type: application/x-www-form-urlencoded
https://
og:
SOFTWARE\Microsoft\Windows NT\CurrentVersion
" && timeout 1 && del
WinDefender
ps1
r=
GetNativeSystemInfo
Rem
<d>
Norton
shutdown -s -t 0
Avira
GET
Powershell.exe
pc:
#
cred.dll|clip.dll|
00000423
ComputerName
clip.dll
0123456789
cred.dll
http://
AVG
Content-Disposition: form-data; name="data"; filename="
Comodo
msi
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
-unicode-
DefaultSettings.YResolution
un:
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
vs:
2022
abcdefghijklmnopqrstuvwxyz0123456789-_
--
:::
dm:
SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName
|
cmd
av:
00000419
845cfbab99
e1
/quiet
0000043f
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
2019
\0000
&&
e3
5.30
zip
DefaultSettings.XResolution
=
<c>
d1
cmd /C RMDIR /s/q
exe
-%lu
VideoID
%-lu
SYSTEM\CurrentControlSet\Control\UnitedVideo\CONTROL\VIDEO\
shell32.dll
Panda Security
2025
------
Startup
POST
Gxtuum.exe
"
Content-Type: multipart/form-data; boundary=----
id:
" && ren
\
/mVsXkjvb3/index.php
lv:
Keyboard Layout\Preload
dll
rb
st=s
Sophos
e2
random
\App
kernel32.dll
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (64.6)
.dll | Win32 Dynamic Link Library (generic) (15.4)
.exe | Win32 Executable (generic) (10.5)
.exe | Generic Win/DOS Executable (4.6)
.exe | DOS Executable Generic (4.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2025:03:07 15:39:16+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14.29
CodeSize: 324096
InitializedDataSize: 131072
UninitializedDataSize: -
EntryPoint: 0x29fb7
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
147
Monitored processes
12
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start zy9sqws.exe #AMADEY gxtuum.exe sppextcomobj.exe no specs slui.exe backgroundtransferhost.exe no specs backgroundtransferhost.exe backgroundtransferhost.exe no specs backgroundtransferhost.exe no specs backgroundtransferhost.exe no specs gxtuum.exe no specs slui.exe no specs gxtuum.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
616"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
660"C:\Users\admin\AppData\Local\Temp\zY9sqWs.exe" C:\Users\admin\AppData\Local\Temp\zY9sqWs.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\zy9sqws.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
728"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
976"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
1056"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
1276C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
3300"C:\Users\admin\AppData\Local\Temp\845cfbab99\Gxtuum.exe"C:\Users\admin\AppData\Local\Temp\845cfbab99\Gxtuum.exe—svchost.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\845cfbab99\gxtuum.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\user32.dll
c:\windows\syswow64\win32u.dll
5544"C:\Users\admin\AppData\Local\Temp\845cfbab99\Gxtuum.exe"C:\Users\admin\AppData\Local\Temp\845cfbab99\Gxtuum.exe—svchost.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\845cfbab99\gxtuum.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\user32.dll
c:\windows\syswow64\win32u.dll
6028"C:\Users\admin\AppData\Local\Temp\845cfbab99\Gxtuum.exe" C:\Users\admin\AppData\Local\Temp\845cfbab99\Gxtuum.exe
zY9sqWs.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\appdata\local\temp\845cfbab99\gxtuum.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
Amadey
(PID) Process(6028) Gxtuum.exe
C2185.125.50.8
URLhttp://185.125.50.8/mVsXkjvb3/index.php
Version5.30
Options
Drop directory845cfbab99
Drop nameGxtuum.exe
Strings (125)360TotalSecurity
rundll32.exe
Doctor Web
ProductName
AVAST Software
ProgramData\
sd:
/Plugins/
?scr=1
bi:
2016
rundll32
-executionpolicy remotesigned -File "
SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
.jpg
+++
%USERPROFILE%
wb
185.125.50.8
os:
00000422
&unit=
&& Exit"
ar:
Main
Kaspersky Lab
"taskkill /f /im "
ESET
Programs
/k
CurrentBuild
" Content-Type: application/octet-stream
Bitdefender
S-%lu-
SYSTEM\ControlSet001\Services\BasicDisplay\Video
------
Content-Type: application/x-www-form-urlencoded
https://
og:
SOFTWARE\Microsoft\Windows NT\CurrentVersion
" && timeout 1 && del
WinDefender
ps1
r=
GetNativeSystemInfo
Rem
<d>
Norton
shutdown -s -t 0
Avira
GET
Powershell.exe
pc:
#
cred.dll|clip.dll|
00000423
ComputerName
clip.dll
0123456789
cred.dll
http://
AVG
Content-Disposition: form-data; name="data"; filename="
Comodo
msi
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
-unicode-
DefaultSettings.YResolution
un:
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
vs:
2022
abcdefghijklmnopqrstuvwxyz0123456789-_
--
:::
dm:
SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName
|
cmd
av:
00000419
845cfbab99
e1
/quiet
0000043f
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
2019
\0000
&&
e3
5.30
zip
DefaultSettings.XResolution
=
<c>
d1
cmd /C RMDIR /s/q
exe
-%lu
VideoID
%-lu
SYSTEM\CurrentControlSet\Control\UnitedVideo\CONTROL\VIDEO\
shell32.dll
Panda Security
2025
------
Startup
POST
Gxtuum.exe
"
Content-Type: multipart/form-data; boundary=----
id:
" && ren
\
/mVsXkjvb3/index.php
lv:
Keyboard Layout\Preload
dll
rb
st=s
Sophos
e2
random
\App
kernel32.dll
6244C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
Total events
2 812
Read events
2 794
Write events
18
Delete events
0

Modification events

(PID) Process:(6028) Gxtuum.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(6028) Gxtuum.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(6028) Gxtuum.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(616) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(616) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(616) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(6640) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(6640) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(6640) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(728) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content
Operation:writeName:CachePrefix
Value:
Executable files
1
Suspicious files
6
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
728BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\2cdbf7c7-1703-439e-89ad-e91c4ffe0641.down_data —
MD5:—
SHA256:—
660zY9sqWs.exeC:\Windows\Tasks\Gxtuum.jobbinary
MD5:752349CBBDE492AA7D6936FB29ECAE30
SHA256:E0EE9CE7DE07B9281ECB10A3DD0903D2A2AEABF6491D613D20523F893592158F
660zY9sqWs.exeC:\Users\admin\AppData\Local\Temp\845cfbab99\Gxtuum.exeexecutable
MD5:D8A7D8E3FFE307714099D74E7CCAAC01
SHA256:5BEE3F1D88D6870469C170BC00E78F793247F7DD8AC46726B26820721C2B66ED
728BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\MetaData\26C212D9399727259664BDFCA073966E_F9F7D6A7ECE73106D2A8C63168CDA10Dbinary
MD5:F3AF31A19CBD205393A0EA590C120807
SHA256:676C632F13AFD68518B93EBDE7A19DF8DD640F0287E6EAD1EBA924CE7E4CA94C
728BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\4c0278fb-651b-4f72-a017-e80725e6f130.94973fd7-6209-4bed-85b1-bea36c8317d1.down_metabinary
MD5:C40FF55203CF0AB8AA948074FF6D3460
SHA256:FCA24EB7F3CD49CC98BA2BDD5BFDF71C17684A704CE2A7B6C0CF787DE91C603D
728BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\4c0278fb-651b-4f72-a017-e80725e6f130.up_meta_securebinary
MD5:EBBEB982832D312AB0956A3EB9BD6A02
SHA256:9C376AA643D4769F24F3D211BDDE01DCC22BDC64216E16FF9008317A7E8DC427
728BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\Content\26C212D9399727259664BDFCA073966E_F9F7D6A7ECE73106D2A8C63168CDA10Dbinary
MD5:AD7A7F2CD8F6B61032EE00693F5E9D43
SHA256:A4E66657A4625D0CF6407A5655E107A3DC9020F083CF764B184526C09442854F
728BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\2cdbf7c7-1703-439e-89ad-e91c4ffe0641.94973fd7-6209-4bed-85b1-bea36c8317d1.down_metabinary
MD5:C40FF55203CF0AB8AA948074FF6D3460
SHA256:FCA24EB7F3CD49CC98BA2BDD5BFDF71C17684A704CE2A7B6C0CF787DE91C603D
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
31
DNS requests
16
Threats
2

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6028
Gxtuum.exe
POST
200
185.125.50.8:80
http://185.125.50.8/mVsXkjvb3/index.php
RU
text
8 b
malicious
6028
Gxtuum.exe
POST
200
185.125.50.8:80
http://185.125.50.8/mVsXkjvb3/index.php
RU
text
7 b
malicious
728
BackgroundTransferHost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
DE
binary
313 b
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
DE
binary
471 b
whitelisted
5164
backgroundTaskHost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
DE
binary
471 b
whitelisted
4040
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
DE
binary
408 b
whitelisted
4040
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
DE
binary
419 b
whitelisted
6028
Gxtuum.exe
POST
200
185.125.50.8:80
http://185.125.50.8/mVsXkjvb3/index.php
RU
text
7 b
malicious
6028
Gxtuum.exe
POST
200
185.125.50.8:80
http://185.125.50.8/mVsXkjvb3/index.php
RU
text
8 b
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2104
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
192.168.100.255:137
—
—
—
whitelisted
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
6028
Gxtuum.exe
185.125.50.8:80
—
—
RU
malicious
2112
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3216
svchost.exe
40.113.110.67:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
40.126.31.73:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
5164
backgroundTaskHost.exe
20.103.156.88:443
arc.msn.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
  • 40.127.240.158
whitelisted
google.com
  • 142.250.185.206
whitelisted
client.wns.windows.com
  • 40.113.110.67
whitelisted
login.live.com
  • 40.126.31.73
  • 20.190.159.0
  • 40.126.31.131
  • 20.190.159.130
  • 40.126.31.71
  • 20.190.159.73
  • 20.190.159.4
  • 20.190.159.71
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
arc.msn.com
  • 20.103.156.88
whitelisted
www.bing.com
  • 104.126.37.153
  • 104.126.37.163
  • 104.126.37.154
  • 104.126.37.155
  • 104.126.37.160
  • 104.126.37.147
  • 104.126.37.168
  • 104.126.37.137
  • 104.126.37.152
whitelisted
slscr.update.microsoft.com
  • 20.12.23.50
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.85.23.206
whitelisted

Threats

PID
Process
Class
Message
6028
Gxtuum.exe
Malware Command and Control Activity Detected
BOTNET [ANY.RUN] Amadey HTTP POST Request (st=s)
6028
Gxtuum.exe
Malware Command and Control Activity Detected
BOTNET [ANY.RUN] Amadey HTTP POST Request (st=s)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
zY9sqWs.exe