File name:

4ef8c35a2b15849e46afa1a0ae8c0f86.exe

Full analysis: https://app.any.run/tasks/e146fe44-c240-4624-a54f-0d79151f5311
Verdict: Malicious activity
Threats:

Amadey is a formidable Windows infostealer threat, characterized by its persistence mechanisms, modular design, and ability to execute various malicious tasks.

Analysis date: April 21, 2025, 21:08:28
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
amadey
botnet
stealer
auto-reg
loader
confuser
redline
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:

4EF8C35A2B15849E46AFA1A0AE8C0F86

SHA1:

82E1E3A3066487546D8C5EB8EA1D9033D599DFE3

SHA256:

8EC4090935DE015F46E08416F184677B909B2A7CF1D20DC5E5093448E52EBB63

SSDEEP:

24576:sya9ZGM6E12s6XLPp6o6Pi8EEAxNRvtc/kqC8TAUtvD1j:baacgs6bhp6+EINRv6/kpmtvDB

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • AMADEY mutex has been found

      • explonde.exe (PID: 6108)
      • explonde.exe (PID: 6988)
      • explonde.exe (PID: 1568)
      • explonde.exe (PID: 4740)
    • Changes the autorun value in the registry

      • explonde.exe (PID: 6108)
    • Uses Task Scheduler to run other applications

      • explonde.exe (PID: 6108)
    • AMADEY has been detected (SURICATA)

      • explonde.exe (PID: 6108)
    • AMADEY has been detected (YARA)

      • explonde.exe (PID: 6108)
    • Connects to the CnC server

      • explonde.exe (PID: 6108)
    • REDLINE has been detected (YARA)

      • n5201710.exe (PID: 4400)
  • SUSPICIOUS

    • Process drops legitimate windows executable

      • 4ef8c35a2b15849e46afa1a0ae8c0f86.exe (PID: 5416)
      • y6218145.exe (PID: 3240)
      • y0372651.exe (PID: 1324)
    • Starts a Microsoft application from unusual location

      • 4ef8c35a2b15849e46afa1a0ae8c0f86.exe (PID: 5416)
      • y6218145.exe (PID: 3240)
      • y0372651.exe (PID: 1324)
      • y3144302.exe (PID: 5392)
    • Executable content was dropped or overwritten

      • 4ef8c35a2b15849e46afa1a0ae8c0f86.exe (PID: 5416)
      • y6218145.exe (PID: 3240)
      • y0372651.exe (PID: 1324)
      • y3144302.exe (PID: 5392)
      • l4906456.exe (PID: 6112)
    • Reads security settings of Internet Explorer

      • l4906456.exe (PID: 6112)
      • explonde.exe (PID: 6108)
    • Starts itself from another location

      • l4906456.exe (PID: 6112)
    • Starts CMD.EXE for commands execution

      • explonde.exe (PID: 6108)
      • cmd.exe (PID: 6656)
    • Uses ICACLS.EXE to modify access control lists

      • cmd.exe (PID: 6656)
    • Application launched itself

      • cmd.exe (PID: 6656)
    • Contacting a server suspected of hosting an CnC

      • explonde.exe (PID: 6108)
    • Connects to unusual port

      • n5201710.exe (PID: 4400)
    • The process executes via Task Scheduler

      • explonde.exe (PID: 6988)
      • explonde.exe (PID: 1568)
      • explonde.exe (PID: 4740)
    • Process requests binary or script from the Internet

      • explonde.exe (PID: 6108)
    • Connects to the server without a host name

      • explonde.exe (PID: 6108)
  • INFO

    • Checks supported languages

      • 4ef8c35a2b15849e46afa1a0ae8c0f86.exe (PID: 5416)
      • y6218145.exe (PID: 3240)
      • y0372651.exe (PID: 1324)
      • y3144302.exe (PID: 5392)
      • l4906456.exe (PID: 6112)
      • m9886759.exe (PID: 5332)
      • explonde.exe (PID: 6108)
      • n5201710.exe (PID: 4400)
      • explonde.exe (PID: 6988)
      • explonde.exe (PID: 4740)
      • explonde.exe (PID: 1568)
    • The sample compiled with english language support

      • 4ef8c35a2b15849e46afa1a0ae8c0f86.exe (PID: 5416)
      • y6218145.exe (PID: 3240)
      • y0372651.exe (PID: 1324)
    • Create files in a temporary directory

      • 4ef8c35a2b15849e46afa1a0ae8c0f86.exe (PID: 5416)
      • y6218145.exe (PID: 3240)
      • y0372651.exe (PID: 1324)
      • y3144302.exe (PID: 5392)
      • l4906456.exe (PID: 6112)
    • Reads the computer name

      • l4906456.exe (PID: 6112)
      • explonde.exe (PID: 6108)
      • n5201710.exe (PID: 4400)
    • Process checks computer location settings

      • l4906456.exe (PID: 6112)
      • explonde.exe (PID: 6108)
    • Auto-launch of the file from Registry key

      • explonde.exe (PID: 6108)
    • Reads the machine GUID from the registry

      • n5201710.exe (PID: 4400)
      • explonde.exe (PID: 6108)
    • Checks proxy server information

      • explonde.exe (PID: 6108)
      • slui.exe (PID: 5756)
    • Confuser has been detected (YARA)

      • n5201710.exe (PID: 4400)
    • Reads the software policy settings

      • explonde.exe (PID: 6108)
      • slui.exe (PID: 5756)
    • Creates files or folders in the user directory

      • explonde.exe (PID: 6108)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Amadey

(PID) Process(6108) explonde.exe
C277.91.68.52
URLhttp://77.91.68.52/mac/index.php
Version3.89
Options
Drop directoryfefffe8cea
Drop nameexplonde.exe
Strings (124)Norton
2022
Programs
ComputerName
abcdefghijklmnopqrstuvwxyz0123456789-_
Panda Security
&dm=
:::
dll
SOFTWARE\Microsoft\Windows NT\CurrentVersion
" /F
0123456789
Bitdefender
&&
shell32.dll
SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName
&os=
CACLS "
rundll32.exe
------
&pc=
wb
rb
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
\0000
AVG
\
Rem
rundll32
#
=
GetNativeSystemInfo
.jpg
SCHTASKS
ESET
&sd=
Main
"
SYSTEM\CurrentControlSet\Control\UnitedVideo\CONTROL\VIDEO\
SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
S-%lu-
&vs=
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
&ar=
Content-Type: multipart/form-data; boundary=----
ps1
&bi=
360TotalSecurity
+++
echo Y|CACLS "
POST
Powershell.exe
shutdown -s -t 0
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
DefaultSettings.YResolution
d1
3.89
&un=
cred.dll|clip.dll|
/TR "
" /P "
2019
77.91.68.52
cmd /C RMDIR /s/q
2016
Content-Disposition: form-data; name="data"; filename="
-executionpolicy remotesigned -File "
"taskkill /f /im "
Kaspersky Lab
&&
/Delete /TN "
------
&lv=
e1
SYSTEM\ControlSet001\Services\BasicDisplay\Video
%-lu
<c>
ProgramData\
Plugins/
:F" /E
/k
exe
CurrentBuild
..\
&&Exit
id=
&unit=
fefffe8cea
&av=
Sophos
" Content-Type: application/octet-stream
Content-Type: application/x-www-form-urlencoded
VideoID
e0
-%lu
|
https://
\App
--
-unicode-
cmd
ProductName
kernel32.dll
explonde.exe
<d>
/mac/index.php
" && ren
Avira
%USERPROFILE%
AVAST Software
:R" /E
?scr=1
/Create /SC MINUTE /MO 1 /TN
http://
&& Exit"
Comodo
" && timeout 1 && del
GET
WinDefender
:N"
&og=
DefaultSettings.XResolution
Startup
Doctor Web
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2022:05:24 22:49:06+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14.13
CodeSize: 25600
InitializedDataSize: 1328128
UninitializedDataSize: -
EntryPoint: 0x6a60
OSVersion: 10
ImageVersion: 10
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 11.0.17763.1
ProductVersionNumber: 11.0.17763.1
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: Microsoft Corporation
FileDescription: Win32 Cabinet Self-Extractor
FileVersion: 11.00.17763.1 (WinBuild.160101.0800)
InternalName: Wextract
LegalCopyright: © Microsoft Corporation. All rights reserved.
OriginalFileName: WEXTRACT.EXE .MUI
ProductName: Internet Explorer
ProductVersion: 11.00.17763.1
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
144
Monitored processes
22
Malicious processes
10
Suspicious processes
1

Behavior graph

Click at the process to see the details
start 4ef8c35a2b15849e46afa1a0ae8c0f86.exe y6218145.exe y0372651.exe y3144302.exe l4906456.exe #AMADEY explonde.exe m9886759.exe no specs #REDLINE n5201710.exe schtasks.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs cacls.exe no specs cacls.exe no specs cmd.exe no specs cacls.exe no specs cacls.exe no specs explonde.exe no specs slui.exe explonde.exe no specs explonde.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1196CACLS "explonde.exe" /P "admin:R" /EC:\Windows\SysWOW64\cacls.execmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Control ACLs Program
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cacls.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
1276\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exeschtasks.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1324C:\Users\admin\AppData\Local\Temp\IXP001.TMP\y0372651.exeC:\Users\admin\AppData\Local\Temp\IXP001.TMP\y0372651.exe
y6218145.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Win32 Cabinet Self-Extractor
Version:
11.00.17763.1 (WinBuild.160101.0800)
Modules
Images
c:\users\admin\appdata\local\temp\ixp001.tmp\y0372651.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
1568"C:\Users\admin\AppData\Local\Temp\fefffe8cea\explonde.exe"C:\Users\admin\AppData\Local\Temp\fefffe8cea\explonde.exesvchost.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\fefffe8cea\explonde.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
c:\windows\syswow64\msvcrt.dll
2136"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explonde.exe /TR "C:\Users\admin\AppData\Local\Temp\fefffe8cea\explonde.exe" /FC:\Windows\SysWOW64\schtasks.exeexplonde.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Task Scheduler Configuration Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
2236C:\WINDOWS\system32\cmd.exe /S /D /c" echo Y"C:\Windows\SysWOW64\cmd.execmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
2516CACLS "..\fefffe8cea" /P "admin:N"C:\Windows\SysWOW64\cacls.execmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Control ACLs Program
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cacls.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
3240C:\Users\admin\AppData\Local\Temp\IXP000.TMP\y6218145.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\y6218145.exe
4ef8c35a2b15849e46afa1a0ae8c0f86.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Win32 Cabinet Self-Extractor
Version:
11.00.17763.1 (WinBuild.160101.0800)
Modules
Images
c:\users\admin\appdata\local\temp\ixp000.tmp\y6218145.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
4400C:\Users\admin\AppData\Local\Temp\IXP002.TMP\n5201710.exeC:\Users\admin\AppData\Local\Temp\IXP002.TMP\n5201710.exe
y0372651.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Nirtro CPU
Version:
15.9.1.22
Modules
Images
c:\users\admin\appdata\local\temp\ixp002.tmp\n5201710.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
4740"C:\Users\admin\AppData\Local\Temp\fefffe8cea\explonde.exe"C:\Users\admin\AppData\Local\Temp\fefffe8cea\explonde.exesvchost.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\fefffe8cea\explonde.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
c:\windows\syswow64\msvcrt.dll
Total events
9 167
Read events
9 163
Write events
4
Delete events
0

Modification events

(PID) Process:(6108) explonde.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(6108) explonde.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(6108) explonde.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(6108) explonde.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
Operation:writeName:Startup
Value:
C:\Users\admin\AppData\Local\Temp\fefffe8cea\
Executable files
9
Suspicious files
0
Text files
2
Unknown types
0

Dropped files

PID
Process
Filename
Type
3240y6218145.exeC:\Users\admin\AppData\Local\Temp\IXP001.TMP\o9944988.exeexecutable
MD5:AEEA100B781F51B08F3606C656BB1BCD
SHA256:262BB4320591D11F5A332E9613AF7B16070E928A1F8FDE460A98F9B8F0368B4B
1324y0372651.exeC:\Users\admin\AppData\Local\Temp\IXP002.TMP\y3144302.exeexecutable
MD5:4F7998524EA53D1206883289448DFF4A
SHA256:49800C26AA45DEDFC2A25E1A4D86289E5077C901D6C268AE09C241098A3807A6
1324y0372651.exeC:\Users\admin\AppData\Local\Temp\IXP002.TMP\n5201710.exeexecutable
MD5:8EAC42D01E3BF1649F16F973867C757B
SHA256:582C10B86C88E3FA1D9592A3B5A98EBAAA12617FCC4B71C5547EB1E298373146
5392y3144302.exeC:\Users\admin\AppData\Local\Temp\IXP003.TMP\l4906456.exeexecutable
MD5:DC24E7B910C18590F133099C38415488
SHA256:7194821FFFB8FBA0008B0312BBCE6AE69612924B06826622A9AB6774D2BE0BA6
5392y3144302.exeC:\Users\admin\AppData\Local\Temp\IXP003.TMP\m9886759.exeexecutable
MD5:A4C12584CDB25AA2FE9383C5B8B17075
SHA256:142DC624A0D096B23A56C885983FFB8E2B65C3D8BEF290FD6E18DDD0312B0C44
3240y6218145.exeC:\Users\admin\AppData\Local\Temp\IXP001.TMP\y0372651.exeexecutable
MD5:4AC11FB5BE023F4183599C50F86B95B9
SHA256:C89B662C9F649B92009AEB3C0D5AA9E7FEE1BBA9D892A1725EF4254BFB8168CE
54164ef8c35a2b15849e46afa1a0ae8c0f86.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\p9391921.exeexecutable
MD5:D89B0BF012ADC625D3E7F20A7A3EEAAD
SHA256:2307AA651DB455BDE39421EABBA6FC27395EE82A4927EDEB908BD91C6E1B7258
54164ef8c35a2b15849e46afa1a0ae8c0f86.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\y6218145.exeexecutable
MD5:5BBCC4D3BB23C6EF6773069E33A211BB
SHA256:6D0098818987F19CF8F8AC1182B0DE5CBB2EB20A01587968F1C0D49DDA2C6783
6112l4906456.exeC:\Users\admin\AppData\Local\Temp\fefffe8cea\explonde.exeexecutable
MD5:DC24E7B910C18590F133099C38415488
SHA256:7194821FFFB8FBA0008B0312BBCE6AE69612924B06826622A9AB6774D2BE0BA6
6108explonde.exeC:\Users\admin\AppData\Roaming\006700e5a2ab05\cred64.dlltext
MD5:595E88012A6521AAE3E12CBEBE76EB9E
SHA256:B16E15764B8BC06C5C3F9F19BC8B99FA48E7894AA5A6CCDAD65DA49BBF564793
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
28
TCP/UDP connections
46
DNS requests
13
Threats
9

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6108
explonde.exe
POST
405
77.91.68.52:80
http://77.91.68.52/mac/index.php
unknown
malicious
GET
304
172.202.163.200:443
https://slscr.update.microsoft.com/SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
unknown
5380
SIHClient.exe
GET
200
2.16.241.19:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
whitelisted
5380
SIHClient.exe
GET
200
2.16.241.19:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl
unknown
whitelisted
5380
SIHClient.exe
GET
200
2.16.241.19:80
http://crl.microsoft.com/pki/crl/products/MicTimStaPCA_2010-07-01.crl
unknown
whitelisted
5380
SIHClient.exe
GET
200
104.119.109.218:80
http://www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%202.2.crl
unknown
whitelisted
GET
200
13.95.31.18:443
https://fe3cr.delivery.mp.microsoft.com/clientwebservice/ping
unknown
5380
SIHClient.exe
GET
200
104.119.109.218:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Signing%20CA%202.1.crl
unknown
whitelisted
5380
SIHClient.exe
GET
200
104.119.109.218:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
whitelisted
GET
200
172.202.163.200:443
https://slscr.update.microsoft.com/sls/ping
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
whitelisted
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
whitelisted
6108
explonde.exe
77.91.68.52:80
static.52.68.91.77.ip.webhost1.net
Foton Telecom CJSC
RU
malicious
3216
svchost.exe
172.211.123.248:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
4400
n5201710.exe
77.91.124.82:19071
Foton Telecom CJSC
RU
malicious
5380
SIHClient.exe
172.202.163.200:443
slscr.update.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
GB
whitelisted
5380
SIHClient.exe
2.16.241.19:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5380
SIHClient.exe
104.119.109.218:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
5380
SIHClient.exe
20.3.187.198:443
fe3cr.delivery.mp.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
whitelisted
google.com
  • 142.250.185.174
whitelisted
client.wns.windows.com
  • 172.211.123.248
whitelisted
slscr.update.microsoft.com
  • 172.202.163.200
whitelisted
crl.microsoft.com
  • 2.16.241.19
  • 2.16.241.12
whitelisted
www.microsoft.com
  • 104.119.109.218
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.3.187.198
whitelisted
static.52.68.91.77.ip.webhost1.net
  • 77.91.68.52
unknown
activation-v2.sls.microsoft.com
  • 20.83.72.98
whitelisted
nexusrules.officeapps.live.com
  • 52.111.227.13
whitelisted

Threats

PID
Process
Class
Message
6108
explonde.exe
Misc activity
SUSPICIOUS [ANY.RUN] Sent Host Name in HTTP POST Body
6108
explonde.exe
Malware Command and Control Activity Detected
ET MALWARE Amadey CnC Check-In
6108
explonde.exe
A Network Trojan was detected
ET MALWARE Win32/Amadey Bot Activity (POST) M2
4400
n5201710.exe
Potentially Bad Traffic
ET INFO Microsoft net.tcp Connection Initialization Activity
6108
explonde.exe
Potentially Bad Traffic
ET INFO Dotted Quad Host DLL Request
6108
explonde.exe
A Network Trojan was detected
BOTNET [ANY.RUN] Amadey Stealer plugin download request
6108
explonde.exe
Potentially Bad Traffic
ET INFO Dotted Quad Host DLL Request
6108
explonde.exe
A Network Trojan was detected
BOTNET [ANY.RUN] Amadey Clipper plugin download request
4400
n5201710.exe
Potentially Bad Traffic
ET INFO Microsoft net.tcp Connection Initialization Activity
No debug info