File name:

amnew.exe

Full analysis: https://app.any.run/tasks/a0fff4a5-773d-446f-8360-dc73bd11415d
Verdict: Malicious activity
Threats:

Amadey is a formidable Windows infostealer threat, characterized by its persistence mechanisms, modular design, and ability to execute various malicious tasks.

Malware Trends Tracker     >>>
Analysis date: May 02, 2025, 18:54:44
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
amadey
botnet
stealer
loader
rdp
auto
generic
gcleaner
delphi
themida
telegram
lumma
inno
installer
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:

5757874C90B7195E09BE379B05AC125F

SHA1:

8F41598BA889721A139C29061B4ED8096B1C87C2

SHA256:

9577478999AD808AB89FB15792B31FCFA58A658882328D218470534AD9C99E98

SSDEEP:

6144:GS1FBY5lPBd20rxuTwKEA2lLlB1HM6bSXikW3Gtht:c5RBLQkKEAQxB1s6GXiFyt

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • AMADEY mutex has been found

      • amnew.exe (PID: 2192)
      • taren.exe (PID: 7184)
      • taren.exe (PID: 7828)
      • taren.exe (PID: 5868)

    • AMADEY has been detected (SURICATA)

      • taren.exe (PID: 7184)

    • Connects to the CnC server

      • taren.exe (PID: 7184)

    • AMADEY has been detected (YARA)

      • taren.exe (PID: 7184)

    • GCLEANER has been detected (SURICATA)

      • svchost015.exe (PID: 8188)

    • GENERIC has been found (auto)

      • faee5ff2f9.exe (PID: 7704)
      • svchost015.exe (PID: 8188)

    • LUMMA mutex has been found

      • xySq07xzq2.exe (PID: 6740)

    • Steals credentials from Web Browsers

      • xySq07xzq2.exe (PID: 6740)

    • Actions looks like stealing of personal data

      • xySq07xzq2.exe (PID: 6740)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • amnew.exe (PID: 2192)
      • taren.exe (PID: 7184)
      • svchost015.exe (PID: 8188)
      • duplicatefilefinder1316.exe (PID: 4008)

    • Executable content was dropped or overwritten

      • amnew.exe (PID: 2192)
      • taren.exe (PID: 7184)
      • faee5ff2f9.exe (PID: 7704)
      • TJDs17wv89.tmp (PID: 1672)
      • duplicatefilefinder1316.exe (PID: 4008)
      • svchost015.exe (PID: 8188)
      • TJDs17wv89.exe (PID: 720)

    • Starts itself from another location

      • amnew.exe (PID: 2192)

    • Contacting a server suspected of hosting an CnC

      • taren.exe (PID: 7184)

    • Potential Corporate Privacy Violation

      • taren.exe (PID: 7184)
      • svchost015.exe (PID: 8188)

    • Connects to the server without a host name

      • taren.exe (PID: 7184)
      • svchost015.exe (PID: 8188)

    • Process requests binary or script from the Internet

      • taren.exe (PID: 7184)

    • Reads the BIOS version

      • faee5ff2f9.exe (PID: 7704)

    • The process executes via Task Scheduler

      • taren.exe (PID: 7828)
      • taren.exe (PID: 5868)

    • There is functionality for enable RDP (YARA)

      • taren.exe (PID: 7184)

    • There is functionality for taking screenshot (YARA)

      • taren.exe (PID: 7184)

    • Reads the Windows owner or organization settings

      • TJDs17wv89.tmp (PID: 1672)

    • The process drops C-runtime libraries

      • TJDs17wv89.tmp (PID: 1672)

    • Process drops legitimate windows executable

      • TJDs17wv89.tmp (PID: 1672)

    • Process communicates with Telegram (possibly using it as an attacker's C2 server)

      • xySq07xzq2.exe (PID: 6740)

    • Starts POWERSHELL.EXE for commands execution

      • duplicatefilefinder1316.exe (PID: 4008)

    • Searches for installed software

      • xySq07xzq2.exe (PID: 6740)

  • INFO

    • Reads the computer name

      • amnew.exe (PID: 2192)
      • taren.exe (PID: 7184)
      • faee5ff2f9.exe (PID: 7704)
      • svchost015.exe (PID: 8188)
      • duplicatefilefinder1316.exe (PID: 4008)
      • TJDs17wv89.tmp (PID: 1672)
      • DuplicateFileFinder.exe (PID: 960)
      • rQUuzFUCDwSwU.exe (PID: 4776)
      • xySq07xzq2.exe (PID: 6740)

    • Checks supported languages

      • amnew.exe (PID: 2192)
      • taren.exe (PID: 7184)
      • faee5ff2f9.exe (PID: 7704)
      • taren.exe (PID: 7828)
      • TJDs17wv89.exe (PID: 720)
      • svchost015.exe (PID: 8188)
      • duplicatefilefinder1316.exe (PID: 4008)
      • TJDs17wv89.tmp (PID: 1672)
      • DuplicateFileFinder.exe (PID: 960)
      • rQUuzFUCDwSwU.exe (PID: 4776)
      • taren.exe (PID: 5868)
      • xySq07xzq2.exe (PID: 6740)

    • Create files in a temporary directory

      • amnew.exe (PID: 2192)
      • taren.exe (PID: 7184)
      • faee5ff2f9.exe (PID: 7704)
      • TJDs17wv89.tmp (PID: 1672)
      • TJDs17wv89.exe (PID: 720)
      • svchost015.exe (PID: 8188)

    • Process checks computer location settings

      • amnew.exe (PID: 2192)
      • taren.exe (PID: 7184)
      • duplicatefilefinder1316.exe (PID: 4008)

    • Checks proxy server information

      • taren.exe (PID: 7184)
      • svchost015.exe (PID: 8188)

    • Creates files or folders in the user directory

      • taren.exe (PID: 7184)
      • svchost015.exe (PID: 8188)
      • TJDs17wv89.tmp (PID: 1672)

    • Compiled with Borland Delphi (YARA)

      • faee5ff2f9.exe (PID: 7704)

    • Themida protector has been detected

      • faee5ff2f9.exe (PID: 7704)

    • Reads the machine GUID from the registry

      • svchost015.exe (PID: 8188)

    • Reads the software policy settings

      • svchost015.exe (PID: 8188)
      • xySq07xzq2.exe (PID: 6740)
      • slui.exe (PID: 7440)

    • The sample compiled with english language support

      • faee5ff2f9.exe (PID: 7704)
      • TJDs17wv89.tmp (PID: 1672)
      • svchost015.exe (PID: 8188)

    • Creates a software uninstall entry

      • TJDs17wv89.tmp (PID: 1672)

    • Creates files in the program directory

      • duplicatefilefinder1316.exe (PID: 4008)

    • Detects InnoSetup installer (YARA)

      • TJDs17wv89.exe (PID: 720)

    • Manual execution by a user

      • DuplicateFileFinder.exe (PID: 960)

    • Attempting to use instant messaging service

      • xySq07xzq2.exe (PID: 6740)

    • Changes the registry key values via Powershell

      • duplicatefilefinder1316.exe (PID: 4008)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Amadey

(PID) Process(7184) taren.exe
C280.64.18.63
URLhttp://80.64.18.63/tom4ku9v/index.php
Version5.34
Options
Drop directory4d0ca3b476
Drop nametaren.exe
Strings (125)ESET
0123456789
cmd
id:
https://
/tom4ku9v/index.php
Panda Security
5.34
Content-Type: application/x-www-form-urlencoded
?scr=1
Main
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
AVG
Programs
|
random
abcdefghijklmnopqrstuvwxyz0123456789-_
Rem
\0000
"taskkill /f /im "
" Content-Type: application/octet-stream
"
-executionpolicy remotesigned -File "
------
cred.dll|clip.dll|
taren.exe
sd:
&&
exe
r=
CurrentBuild
av:
\
2025
00000422
#
clip.dll
<c>
Keyboard Layout\Preload
ar:
e3
shutdown -s -t 0
%USERPROFILE%
2019
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
Powershell.exe
Bitdefender
Doctor Web
00000423
&& Exit"
ProductName
--
ComputerName
SYSTEM\ControlSet001\Services\BasicDisplay\Video
=
GET
og:
d1
pc:
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
Content-Type: multipart/form-data; boundary=----
SYSTEM\CurrentControlSet\Control\UnitedVideo\CONTROL\VIDEO\
S-%lu-
e1
SOFTWARE\Microsoft\Windows NT\CurrentVersion
" && ren
Avira
Norton
-%lu
e2
cred.dll
dm:
bi:
kernel32.dll
<d>
http://
SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName
shell32.dll
msi
st=s
4d0ca3b476
POST
rundll32
0000043f
" && timeout 1 && del
Content-Disposition: form-data; name="data"; filename="
\App
Kaspersky Lab
ps1
GetNativeSystemInfo
wb
00000419
2016
Startup
zip
rb
.jpg
ProgramData\
2022
/k
80.64.18.63
360TotalSecurity
Comodo
%-lu
/quiet
VideoID
-unicode-
un:
DefaultSettings.YResolution
Sophos
rundll32.exe
:::
------
/Plugins/
+++
dll
cmd /C RMDIR /s/q
vs:
os:
lv:
AVAST Software
WinDefender
&unit=
DefaultSettings.XResolution
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (64.6)
.dll | Win32 Dynamic Link Library (generic) (15.4)
.exe | Win32 Executable (generic) (10.5)
.exe | Generic Win/DOS Executable (4.6)
.exe | DOS Executable Generic (4.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2025:05:02 15:17:11+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14.29
CodeSize: 317952
InitializedDataSize: 123392
UninitializedDataSize: -
EntryPoint: 0x28c3a
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
150
Monitored processes
17
Malicious processes
9
Suspicious processes
1

Behavior graph

Click at the process to see the details
start amnew.exe #AMADEY taren.exe sppextcomobj.exe no specs slui.exe #GENERIC faee5ff2f9.exe taren.exe no specs #GCLEANER svchost015.exe tjds17wv89.exe tjds17wv89.tmp duplicatefilefinder1316.exe powershell.exe no specs conhost.exe no specs #LUMMA xysq07xzq2.exe rquuzfucdwswu.exe no specs duplicatefilefinder.exe no specs slui.exe no specs taren.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
668"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -c Set-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run" -Name "dupFinder" -Value "C:\ProgramData\DuplicateFileFinder\DuplicateFileFinder.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe—duplicatefilefinder1316.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
720"C:\Users\admin\AppData\Roaming\Ajup4uKM75\TJDs17wv89.exe"C:\Users\admin\AppData\Roaming\Ajup4uKM75\TJDs17wv89.exe
svchost015.exe
User:
admin
Company:
Integrity Level:
MEDIUM
Description:
Duplicate File Finder Setup
Version:
Modules
Images
c:\users\admin\appdata\roaming\ajup4ukm75\tjds17wv89.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
960C:\ProgramData\DuplicateFileFinder\DuplicateFileFinder.exeC:\ProgramData\DuplicateFileFinder\DuplicateFileFinder.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Version:
1.3.1.6
Modules
Images
c:\programdata\duplicatefilefinder\duplicatefilefinder.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\user32.dll
c:\windows\syswow64\win32u.dll
1672"C:\Users\admin\AppData\Local\Temp\is-E8OUN.tmp\TJDs17wv89.tmp" /SL5="$B02CC,3579964,54272,C:\Users\admin\AppData\Roaming\Ajup4uKM75\TJDs17wv89.exe" C:\Users\admin\AppData\Local\Temp\is-E8OUN.tmp\TJDs17wv89.tmp
TJDs17wv89.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Setup/Uninstall
Version:
51.52.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-e8oun.tmp\tjds17wv89.tmp
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
2192"C:\Users\admin\AppData\Local\Temp\amnew.exe" C:\Users\admin\AppData\Local\Temp\amnew.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\amnew.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
4008"C:\Users\admin\AppData\Local\Duplicate File Finder 1.3.1.6\duplicatefilefinder1316.exe" -iC:\Users\admin\AppData\Local\Duplicate File Finder 1.3.1.6\duplicatefilefinder1316.exe
TJDs17wv89.tmp
User:
admin
Integrity Level:
MEDIUM
Version:
1.3.1.6
Modules
Images
c:\users\admin\appdata\local\duplicate file finder 1.3.1.6\duplicatefilefinder1316.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
4776"C:\Users\admin\AppData\Roaming\JyMvO\rQUuzFUCDwSwU.exe"C:\Users\admin\AppData\Roaming\JyMvO\rQUuzFUCDwSwU.exe—svchost015.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Gcleanerapp
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\roaming\jymvo\rquuzfucdwswu.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
5416C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
5868"C:\Users\admin\AppData\Local\Temp\4d0ca3b476\taren.exe"C:\Users\admin\AppData\Local\Temp\4d0ca3b476\taren.exe—svchost.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\4d0ca3b476\taren.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\user32.dll
c:\windows\syswow64\win32u.dll
6468\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
7 787
Read events
7 767
Write events
20
Delete events
0

Modification events

(PID) Process:(7184) taren.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(7184) taren.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(7184) taren.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(8188) svchost015.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(8188) svchost015.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(8188) svchost015.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(1672) TJDs17wv89.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Duplicate File Finder_is1
Operation:writeName:Inno Setup: Setup Version
Value:
5.5.0 (a)
(PID) Process:(1672) TJDs17wv89.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Duplicate File Finder_is1
Operation:writeName:Inno Setup: App Path
Value:
C:\Users\admin\AppData\Local\Duplicate File Finder 1.3.1.6
(PID) Process:(1672) TJDs17wv89.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Duplicate File Finder_is1
Operation:writeName:InstallLocation
Value:
C:\Users\admin\AppData\Local\Duplicate File Finder 1.3.1.6\
(PID) Process:(1672) TJDs17wv89.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Duplicate File Finder_is1
Operation:writeName:Inno Setup: Icon Group
Value:
(Default)
Executable files
41
Suspicious files
15
Text files
6
Unknown types
0

Dropped files

PID
Process
Filename
Type
2192amnew.exeC:\Windows\Tasks\taren.jobbinary
MD5:2BC281D64E3F9B63013158C71489AE52
SHA256:367DB7F1D2DBC49EE13BEEA29036B1B0F1D2F38EB8761CF26292E6555055EB27
8188svchost015.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\AH8CR9J5\fuckingdllENCR[1].dllbinary
MD5:4BC1EF6688690AF3DD8D3D70906A9F98
SHA256:7703A6B77C0B0935F5900A2D846CFA3AB59B46D03A1A0844F6BCB5CF9496B2FE
7184taren.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\RR3E01RZ\random[1].exeexecutable
MD5:0D1AA62E309EA6C460A67398BD13B083
SHA256:4D0A5DDCAF86FE9AB13639DFA588563B0E5CED5D1910D098BF208DB2F20EC250
8188svchost015.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8binary
MD5:1FBB37F79B317A9A248E7C4CE4F5BAC5
SHA256:9BF639C595FE335B6F694EE35990BEFD2123F5E07FD1973FF619E3FC88F5F49F
8188svchost015.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2A42127F349D54E7AA939366FF86F74E_7F7B9AAAFF465D18D58C254B044E2800binary
MD5:56309E57DC56B26E8BE6545732196292
SHA256:6C40710D557FBF975BFF7D15365EFC28E45791BA64A74FE53F36FDF0F0256399
8188svchost015.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\KCV3KQBA\text[1]text
MD5:5E847B1CC501E8A09997640FED7DB52F
SHA256:C06903CB5A25E63794907092B488A8580074C872272A9FC51CEF5E76EEECF7A2
8188svchost015.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\E4DJRUXW\success[1].htmbinary
MD5:C4CA4238A0B923820DCC509A6F75849B
SHA256:—
8188svchost015.exeC:\Users\admin\AppData\Roaming\Ajup4uKM75\TJDs17wv89.exeexecutable
MD5:37E7C0E9EB8AD27D8DBE4394583F5EE7
SHA256:0EAA6ABC9B1C70A26E35F81276424DBA393E027E6A22E832A83B6F68D564D427
8188svchost015.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\KCV3KQBA\ONE[1].fileexecutable
MD5:37E7C0E9EB8AD27D8DBE4394583F5EE7
SHA256:0EAA6ABC9B1C70A26E35F81276424DBA393E027E6A22E832A83B6F68D564D427
8188svchost015.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\RR3E01RZ\info[1].htmtext
MD5:FE9B08252F126DDFCB87FB82F9CC7677
SHA256:E63E7EBE4C2DB7E61FFC71AF0675E870BCDE0A9D8916E5B3BE0CB252478030BF
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
21
TCP/UDP connections
37
DNS requests
20
Threats
25

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
23.48.23.156:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
2.16.253.202:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
7184
taren.exe
POST
200
80.64.18.63:80
http://80.64.18.63/tom4ku9v/index.php
unknown
—
—
unknown
7184
taren.exe
POST
200
80.64.18.63:80
http://80.64.18.63/tom4ku9v/index.php
unknown
—
—
unknown
7184
taren.exe
GET
200
80.64.18.219:80
http://80.64.18.219/files/unique2/random.exe
unknown
—
—
unknown
7976
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
7976
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
8188
svchost015.exe
GET
200
172.217.16.131:80
http://c.pki.goog/r/gsr1.crl
unknown
—
—
whitelisted
8188
svchost015.exe
GET
200
142.250.185.195:80
http://o.pki.goog/we2/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTuMJxAT2trYla0jia%2F5EUSmLrk3QQUdb7Ed66J9kQ3fc%2BxaB8dGuvcNFkCEDmdiANCnbVJCTfkel4NKS0%3D
unknown
—
—
whitelisted
8188
svchost015.exe
GET
200
172.217.16.131:80
http://c.pki.goog/r/r4.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3216
svchost.exe
172.211.123.248:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
20.190.160.5:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
unknown
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5496
MoUsoCoreWorker.exe
23.48.23.156:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5496
MoUsoCoreWorker.exe
2.16.253.202:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
7184
taren.exe
80.64.18.63:80
—
Joint Stock Company Tagnet
RU
unknown
7184
taren.exe
80.64.18.219:80
—
Joint Stock Company Tagnet
RU
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
6544
svchost.exe
40.126.32.134:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
client.wns.windows.com
  • 172.211.123.248
whitelisted
google.com
  • 172.217.18.14
whitelisted
settings-win.data.microsoft.com
  • 40.127.240.158
  • 4.231.128.59
whitelisted
crl.microsoft.com
  • 23.48.23.156
  • 23.48.23.147
  • 23.48.23.143
  • 23.48.23.166
whitelisted
www.microsoft.com
  • 2.16.253.202
  • 2.23.246.101
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
slscr.update.microsoft.com
  • 20.109.210.53
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.242.39.171
whitelisted
drive.usercontent.google.com
  • 142.250.185.161
whitelisted
c.pki.goog
  • 172.217.16.131
whitelisted

Threats

PID
Process
Class
Message
7184
taren.exe
Malware Command and Control Activity Detected
BOTNET [ANY.RUN] Amadey HTTP POST Request (st=s)
7184
taren.exe
Malware Command and Control Activity Detected
ET MALWARE Amadey CnC Response
7184
taren.exe
Potentially Bad Traffic
ET INFO Executable Download from dotted-quad Host
7184
taren.exe
Potential Corporate Privacy Violation
ET INFO PE EXE or DLL Windows file download HTTP
7184
taren.exe
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
7184
taren.exe
Potentially Bad Traffic
ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response
7184
taren.exe
Misc activity
ET INFO Packed Executable Download
8188
svchost015.exe
A Network Trojan was detected
LOADER [ANY.RUN] GCleaner HTTP Header
8188
svchost015.exe
A Network Trojan was detected
LOADER [ANY.RUN] GCleaner HTTP Header
8188
svchost015.exe
A Network Trojan was detected
LOADER [ANY.RUN] GCleaner HTTP Header
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
amnew.exe