File name:

amnew.exe

Full analysis: https://app.any.run/tasks/a0fff4a5-773d-446f-8360-dc73bd11415d
Verdict: Malicious activity
Threats:

Amadey is a formidable Windows infostealer threat, characterized by its persistence mechanisms, modular design, and ability to execute various malicious tasks.

Malware Trends Tracker     >>>
Analysis date: May 02, 2025, 18:54:44
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
amadey
botnet
stealer
loader
rdp
auto
generic
gcleaner
delphi
themida
telegram
lumma
inno
installer
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:

5757874C90B7195E09BE379B05AC125F

SHA1:

8F41598BA889721A139C29061B4ED8096B1C87C2

SHA256:

9577478999AD808AB89FB15792B31FCFA58A658882328D218470534AD9C99E98

SSDEEP:

6144:GS1FBY5lPBd20rxuTwKEA2lLlB1HM6bSXikW3Gtht:c5RBLQkKEAQxB1s6GXiFyt

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • AMADEY mutex has been found

      • amnew.exe (PID: 2192)
      • taren.exe (PID: 7184)
      • taren.exe (PID: 7828)
      • taren.exe (PID: 5868)

    • AMADEY has been detected (SURICATA)

      • taren.exe (PID: 7184)

    • Connects to the CnC server

      • taren.exe (PID: 7184)

    • AMADEY has been detected (YARA)

      • taren.exe (PID: 7184)

    • GENERIC has been found (auto)

      • faee5ff2f9.exe (PID: 7704)
      • svchost015.exe (PID: 8188)

    • GCLEANER has been detected (SURICATA)

      • svchost015.exe (PID: 8188)

    • LUMMA mutex has been found

      • xySq07xzq2.exe (PID: 6740)

    • Actions looks like stealing of personal data

      • xySq07xzq2.exe (PID: 6740)

    • Steals credentials from Web Browsers

      • xySq07xzq2.exe (PID: 6740)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • amnew.exe (PID: 2192)
      • taren.exe (PID: 7184)
      • svchost015.exe (PID: 8188)
      • duplicatefilefinder1316.exe (PID: 4008)

    • Starts itself from another location

      • amnew.exe (PID: 2192)

    • Executable content was dropped or overwritten

      • amnew.exe (PID: 2192)
      • taren.exe (PID: 7184)
      • faee5ff2f9.exe (PID: 7704)
      • svchost015.exe (PID: 8188)
      • TJDs17wv89.tmp (PID: 1672)
      • TJDs17wv89.exe (PID: 720)
      • duplicatefilefinder1316.exe (PID: 4008)

    • Contacting a server suspected of hosting an CnC

      • taren.exe (PID: 7184)

    • Connects to the server without a host name

      • taren.exe (PID: 7184)
      • svchost015.exe (PID: 8188)

    • Potential Corporate Privacy Violation

      • taren.exe (PID: 7184)
      • svchost015.exe (PID: 8188)

    • Process requests binary or script from the Internet

      • taren.exe (PID: 7184)

    • There is functionality for taking screenshot (YARA)

      • taren.exe (PID: 7184)

    • There is functionality for enable RDP (YARA)

      • taren.exe (PID: 7184)

    • Reads the BIOS version

      • faee5ff2f9.exe (PID: 7704)

    • The process executes via Task Scheduler

      • taren.exe (PID: 7828)
      • taren.exe (PID: 5868)

    • Reads the Windows owner or organization settings

      • TJDs17wv89.tmp (PID: 1672)

    • Process drops legitimate windows executable

      • TJDs17wv89.tmp (PID: 1672)

    • Starts POWERSHELL.EXE for commands execution

      • duplicatefilefinder1316.exe (PID: 4008)

    • The process drops C-runtime libraries

      • TJDs17wv89.tmp (PID: 1672)

    • Process communicates with Telegram (possibly using it as an attacker's C2 server)

      • xySq07xzq2.exe (PID: 6740)

    • Searches for installed software

      • xySq07xzq2.exe (PID: 6740)

  • INFO

    • Create files in a temporary directory

      • amnew.exe (PID: 2192)
      • taren.exe (PID: 7184)
      • faee5ff2f9.exe (PID: 7704)
      • TJDs17wv89.exe (PID: 720)
      • TJDs17wv89.tmp (PID: 1672)
      • svchost015.exe (PID: 8188)

    • Reads the computer name

      • amnew.exe (PID: 2192)
      • taren.exe (PID: 7184)
      • faee5ff2f9.exe (PID: 7704)
      • svchost015.exe (PID: 8188)
      • TJDs17wv89.tmp (PID: 1672)
      • duplicatefilefinder1316.exe (PID: 4008)
      • rQUuzFUCDwSwU.exe (PID: 4776)
      • DuplicateFileFinder.exe (PID: 960)
      • xySq07xzq2.exe (PID: 6740)

    • Process checks computer location settings

      • amnew.exe (PID: 2192)
      • taren.exe (PID: 7184)
      • duplicatefilefinder1316.exe (PID: 4008)

    • Checks supported languages

      • amnew.exe (PID: 2192)
      • taren.exe (PID: 7184)
      • faee5ff2f9.exe (PID: 7704)
      • svchost015.exe (PID: 8188)
      • taren.exe (PID: 7828)
      • TJDs17wv89.exe (PID: 720)
      • TJDs17wv89.tmp (PID: 1672)
      • duplicatefilefinder1316.exe (PID: 4008)
      • rQUuzFUCDwSwU.exe (PID: 4776)
      • xySq07xzq2.exe (PID: 6740)
      • taren.exe (PID: 5868)
      • DuplicateFileFinder.exe (PID: 960)

    • Checks proxy server information

      • taren.exe (PID: 7184)
      • svchost015.exe (PID: 8188)

    • Creates files or folders in the user directory

      • taren.exe (PID: 7184)
      • svchost015.exe (PID: 8188)
      • TJDs17wv89.tmp (PID: 1672)

    • The sample compiled with english language support

      • faee5ff2f9.exe (PID: 7704)
      • TJDs17wv89.tmp (PID: 1672)
      • svchost015.exe (PID: 8188)

    • Reads the machine GUID from the registry

      • svchost015.exe (PID: 8188)

    • Reads the software policy settings

      • svchost015.exe (PID: 8188)
      • xySq07xzq2.exe (PID: 6740)
      • slui.exe (PID: 7440)

    • Themida protector has been detected

      • faee5ff2f9.exe (PID: 7704)

    • Compiled with Borland Delphi (YARA)

      • faee5ff2f9.exe (PID: 7704)

    • Creates files in the program directory

      • duplicatefilefinder1316.exe (PID: 4008)

    • Creates a software uninstall entry

      • TJDs17wv89.tmp (PID: 1672)

    • Changes the registry key values via Powershell

      • duplicatefilefinder1316.exe (PID: 4008)

    • Detects InnoSetup installer (YARA)

      • TJDs17wv89.exe (PID: 720)

    • Manual execution by a user

      • DuplicateFileFinder.exe (PID: 960)

    • Attempting to use instant messaging service

      • xySq07xzq2.exe (PID: 6740)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Amadey

(PID) Process(7184) taren.exe
C280.64.18.63
URLhttp://80.64.18.63/tom4ku9v/index.php
Version5.34
Options
Drop directory4d0ca3b476
Drop nametaren.exe
Strings (125)ESET
0123456789
cmd
id:
https://
/tom4ku9v/index.php
Panda Security
5.34
Content-Type: application/x-www-form-urlencoded
?scr=1
Main
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
AVG
Programs
|
random
abcdefghijklmnopqrstuvwxyz0123456789-_
Rem
\0000
"taskkill /f /im "
" Content-Type: application/octet-stream
"
-executionpolicy remotesigned -File "
------
cred.dll|clip.dll|
taren.exe
sd:
&&
exe
r=
CurrentBuild
av:
\
2025
00000422
#
clip.dll
<c>
Keyboard Layout\Preload
ar:
e3
shutdown -s -t 0
%USERPROFILE%
2019
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
Powershell.exe
Bitdefender
Doctor Web
00000423
&& Exit"
ProductName
--
ComputerName
SYSTEM\ControlSet001\Services\BasicDisplay\Video
=
GET
og:
d1
pc:
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
Content-Type: multipart/form-data; boundary=----
SYSTEM\CurrentControlSet\Control\UnitedVideo\CONTROL\VIDEO\
S-%lu-
e1
SOFTWARE\Microsoft\Windows NT\CurrentVersion
" && ren
Avira
Norton
-%lu
e2
cred.dll
dm:
bi:
kernel32.dll
<d>
http://
SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName
shell32.dll
msi
st=s
4d0ca3b476
POST
rundll32
0000043f
" && timeout 1 && del
Content-Disposition: form-data; name="data"; filename="
\App
Kaspersky Lab
ps1
GetNativeSystemInfo
wb
00000419
2016
Startup
zip
rb
.jpg
ProgramData\
2022
/k
80.64.18.63
360TotalSecurity
Comodo
%-lu
/quiet
VideoID
-unicode-
un:
DefaultSettings.YResolution
Sophos
rundll32.exe
:::
------
/Plugins/
+++
dll
cmd /C RMDIR /s/q
vs:
os:
lv:
AVAST Software
WinDefender
&unit=
DefaultSettings.XResolution
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (64.6)
.dll | Win32 Dynamic Link Library (generic) (15.4)
.exe | Win32 Executable (generic) (10.5)
.exe | Generic Win/DOS Executable (4.6)
.exe | DOS Executable Generic (4.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2025:05:02 15:17:11+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14.29
CodeSize: 317952
InitializedDataSize: 123392
UninitializedDataSize: -
EntryPoint: 0x28c3a
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
150
Monitored processes
17
Malicious processes
9
Suspicious processes
1

Behavior graph

Click at the process to see the details
start amnew.exe #AMADEY taren.exe sppextcomobj.exe no specs slui.exe #GENERIC faee5ff2f9.exe taren.exe no specs #GCLEANER svchost015.exe tjds17wv89.exe tjds17wv89.tmp duplicatefilefinder1316.exe powershell.exe no specs conhost.exe no specs #LUMMA xysq07xzq2.exe rquuzfucdwswu.exe no specs duplicatefilefinder.exe no specs slui.exe no specs taren.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
668"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -c Set-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run" -Name "dupFinder" -Value "C:\ProgramData\DuplicateFileFinder\DuplicateFileFinder.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe—duplicatefilefinder1316.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
720"C:\Users\admin\AppData\Roaming\Ajup4uKM75\TJDs17wv89.exe"C:\Users\admin\AppData\Roaming\Ajup4uKM75\TJDs17wv89.exe
svchost015.exe
User:
admin
Company:
Integrity Level:
MEDIUM
Description:
Duplicate File Finder Setup
Version:
Modules
Images
c:\users\admin\appdata\roaming\ajup4ukm75\tjds17wv89.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
960C:\ProgramData\DuplicateFileFinder\DuplicateFileFinder.exeC:\ProgramData\DuplicateFileFinder\DuplicateFileFinder.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Version:
1.3.1.6
Modules
Images
c:\programdata\duplicatefilefinder\duplicatefilefinder.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\user32.dll
c:\windows\syswow64\win32u.dll
1672"C:\Users\admin\AppData\Local\Temp\is-E8OUN.tmp\TJDs17wv89.tmp" /SL5="$B02CC,3579964,54272,C:\Users\admin\AppData\Roaming\Ajup4uKM75\TJDs17wv89.exe" C:\Users\admin\AppData\Local\Temp\is-E8OUN.tmp\TJDs17wv89.tmp
TJDs17wv89.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Setup/Uninstall
Version:
51.52.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-e8oun.tmp\tjds17wv89.tmp
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
2192"C:\Users\admin\AppData\Local\Temp\amnew.exe" C:\Users\admin\AppData\Local\Temp\amnew.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\amnew.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
4008"C:\Users\admin\AppData\Local\Duplicate File Finder 1.3.1.6\duplicatefilefinder1316.exe" -iC:\Users\admin\AppData\Local\Duplicate File Finder 1.3.1.6\duplicatefilefinder1316.exe
TJDs17wv89.tmp
User:
admin
Integrity Level:
MEDIUM
Version:
1.3.1.6
Modules
Images
c:\users\admin\appdata\local\duplicate file finder 1.3.1.6\duplicatefilefinder1316.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
4776"C:\Users\admin\AppData\Roaming\JyMvO\rQUuzFUCDwSwU.exe"C:\Users\admin\AppData\Roaming\JyMvO\rQUuzFUCDwSwU.exe—svchost015.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Gcleanerapp
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\roaming\jymvo\rquuzfucdwswu.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
5416C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
5868"C:\Users\admin\AppData\Local\Temp\4d0ca3b476\taren.exe"C:\Users\admin\AppData\Local\Temp\4d0ca3b476\taren.exe—svchost.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\4d0ca3b476\taren.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\user32.dll
c:\windows\syswow64\win32u.dll
6468\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
7 787
Read events
7 767
Write events
20
Delete events
0

Modification events

(PID) Process:(7184) taren.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(7184) taren.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(7184) taren.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(8188) svchost015.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(8188) svchost015.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(8188) svchost015.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(1672) TJDs17wv89.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Duplicate File Finder_is1
Operation:writeName:Inno Setup: Setup Version
Value:
5.5.0 (a)
(PID) Process:(1672) TJDs17wv89.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Duplicate File Finder_is1
Operation:writeName:Inno Setup: App Path
Value:
C:\Users\admin\AppData\Local\Duplicate File Finder 1.3.1.6
(PID) Process:(1672) TJDs17wv89.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Duplicate File Finder_is1
Operation:writeName:InstallLocation
Value:
C:\Users\admin\AppData\Local\Duplicate File Finder 1.3.1.6\
(PID) Process:(1672) TJDs17wv89.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Duplicate File Finder_is1
Operation:writeName:Inno Setup: Icon Group
Value:
(Default)
Executable files
41
Suspicious files
15
Text files
6
Unknown types
0

Dropped files

PID
Process
Filename
Type
2192amnew.exeC:\Windows\Tasks\taren.jobbinary
MD5:2BC281D64E3F9B63013158C71489AE52
SHA256:367DB7F1D2DBC49EE13BEEA29036B1B0F1D2F38EB8761CF26292E6555055EB27
7184taren.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\RR3E01RZ\random[1].exeexecutable
MD5:0D1AA62E309EA6C460A67398BD13B083
SHA256:4D0A5DDCAF86FE9AB13639DFA588563B0E5CED5D1910D098BF208DB2F20EC250
8188svchost015.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8binary
MD5:1FBB37F79B317A9A248E7C4CE4F5BAC5
SHA256:9BF639C595FE335B6F694EE35990BEFD2123F5E07FD1973FF619E3FC88F5F49F
1672TJDs17wv89.tmpC:\Users\admin\AppData\Local\Temp\is-BPD64.tmp\_isetup\_setup64.tmpexecutable
MD5:4FF75F505FDDCC6A9AE62216446205D9
SHA256:A4C86FC4836AC728D7BD96E7915090FD59521A9E74F1D06EF8E5A47C8695FD81
2192amnew.exeC:\Users\admin\AppData\Local\Temp\4d0ca3b476\taren.exeexecutable
MD5:5757874C90B7195E09BE379B05AC125F
SHA256:9577478999AD808AB89FB15792B31FCFA58A658882328D218470534AD9C99E98
7704faee5ff2f9.exeC:\Users\admin\AppData\Local\Temp\svchost015.exeexecutable
MD5:B826DD92D78EA2526E465A34324EBEEA
SHA256:7824B50ACDD144764DAC7445A4067B35CF0FEF619E451045AB6C1F54F5653A5B
8188svchost015.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12binary
MD5:C35A44027B84D15FF9E4076851626F1A
SHA256:B3607631B98D350C36CA7788BC8EEC2FFA3A5A1FF3F67D09DACBC5A8A5BC3C0F
8188svchost015.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8binary
MD5:4F88EB21F3FC94A1BA5A5EFC4ECADE2C
SHA256:E70098C41590D7C16FEBFD2F9D30C48C7ACD4C7B2C7C8A5DFDAD101220C5A751
8188svchost015.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2A42127F349D54E7AA939366FF86F74E_7F7B9AAAFF465D18D58C254B044E2800binary
MD5:FEF944E4CB016A42948F449442720E63
SHA256:3638B75DD45D02DE8D4CC028A8013A8F39760113991C6B4AB4FE0C24A112EB2E
8188svchost015.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2A42127F349D54E7AA939366FF86F74E_7F7B9AAAFF465D18D58C254B044E2800binary
MD5:56309E57DC56B26E8BE6545732196292
SHA256:6C40710D557FBF975BFF7D15365EFC28E45791BA64A74FE53F36FDF0F0256399
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
21
TCP/UDP connections
37
DNS requests
20
Threats
25

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
23.48.23.156:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
2.16.253.202:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
7184
taren.exe
POST
200
80.64.18.63:80
http://80.64.18.63/tom4ku9v/index.php
unknown
—
—
unknown
7184
taren.exe
GET
200
80.64.18.219:80
http://80.64.18.219/files/unique2/random.exe
unknown
—
—
unknown
7184
taren.exe
POST
200
80.64.18.63:80
http://80.64.18.63/tom4ku9v/index.php
unknown
—
—
unknown
7184
taren.exe
POST
200
80.64.18.63:80
http://80.64.18.63/tom4ku9v/index.php
unknown
—
—
unknown
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
7976
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
7976
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
8188
svchost015.exe
GET
200
172.217.16.131:80
http://c.pki.goog/r/gsr1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3216
svchost.exe
172.211.123.248:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
20.190.160.5:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
unknown
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5496
MoUsoCoreWorker.exe
23.48.23.156:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5496
MoUsoCoreWorker.exe
2.16.253.202:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
7184
taren.exe
80.64.18.63:80
—
Joint Stock Company Tagnet
RU
unknown
7184
taren.exe
80.64.18.219:80
—
Joint Stock Company Tagnet
RU
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
6544
svchost.exe
40.126.32.134:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
client.wns.windows.com
  • 172.211.123.248
whitelisted
google.com
  • 172.217.18.14
whitelisted
settings-win.data.microsoft.com
  • 40.127.240.158
  • 4.231.128.59
whitelisted
crl.microsoft.com
  • 23.48.23.156
  • 23.48.23.147
  • 23.48.23.143
  • 23.48.23.166
whitelisted
www.microsoft.com
  • 2.16.253.202
  • 2.23.246.101
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
slscr.update.microsoft.com
  • 20.109.210.53
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.242.39.171
whitelisted
drive.usercontent.google.com
  • 142.250.185.161
whitelisted
c.pki.goog
  • 172.217.16.131
whitelisted

Threats

PID
Process
Class
Message
7184
taren.exe
Malware Command and Control Activity Detected
BOTNET [ANY.RUN] Amadey HTTP POST Request (st=s)
7184
taren.exe
Malware Command and Control Activity Detected
ET MALWARE Amadey CnC Response
7184
taren.exe
Potentially Bad Traffic
ET INFO Executable Download from dotted-quad Host
7184
taren.exe
Potential Corporate Privacy Violation
ET INFO PE EXE or DLL Windows file download HTTP
7184
taren.exe
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
7184
taren.exe
Potentially Bad Traffic
ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response
7184
taren.exe
Misc activity
ET INFO Packed Executable Download
8188
svchost015.exe
A Network Trojan was detected
LOADER [ANY.RUN] GCleaner HTTP Header
8188
svchost015.exe
A Network Trojan was detected
LOADER [ANY.RUN] GCleaner HTTP Header
8188
svchost015.exe
A Network Trojan was detected
LOADER [ANY.RUN] GCleaner HTTP Header
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
amnew.exe