URL:

https://officialkmspico.net/windows-loader/

Full analysis: https://app.any.run/tasks/44076fc7-6a1d-429f-856e-7a04727b3903
Verdict: Malicious activity
Threats:

Amadey is a formidable Windows infostealer threat, characterized by its persistence mechanisms, modular design, and ability to execute various malicious tasks.

Malware Trends Tracker     >>>
Analysis date: April 25, 2022, 07:15:15
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
trojan
amadey
loader
stealer
Indicators:
MD5:

D1255438C0AB6A53196124A9639B7ACC

SHA1:

40B3BB9DBD3B8A1891D950E7666B6F6E4A1A3E01

SHA256:

9E7CF7EDED4C0E8D251881247B4E27F730264EBDC9F976AF165715244C5AC5CE

SSDEEP:

3:N8KQGMR5CryK:2KQGMe

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops executable file immediately after starts

      • WinRAR.exe (PID: 2720)
      • WinRAR.exe (PID: 1972)
      • Windows Loader.exe (PID: 1836)
      • system32.exe (PID: 736)
      • ftewk.exe (PID: 3480)
      • windows loader.exe (PID: 3608)

    • Application was dropped or rewritten from another process

      • Windows Loader.exe (PID: 1836)
      • services32.exe (PID: 3060)
      • services32.exe (PID: 2244)
      • svchost32.exe (PID: 2364)
      • system32.exe (PID: 736)
      • windows loader.exe (PID: 4036)
      • windows loader.exe (PID: 3608)
      • ftewk.exe (PID: 3480)
      • ftewk.exe (PID: 3348)
      • ftewk.exe (PID: 3844)
      • Windows Loader.exe (PID: 1948)
      • ftewk.exe (PID: 452)
      • services32.exe (PID: 2184)
      • svchost32.exe (PID: 4088)
      • windows loader.exe (PID: 3216)
      • system32.exe (PID: 3088)
      • bootsect.exe (PID: 3088)

    • Changes the autorun value in the registry

      • svchost32.exe (PID: 2364)

    • Uses Task Scheduler to run other applications

      • ftewk.exe (PID: 3480)
      • cmd.exe (PID: 3552)

    • Changes the Startup folder

      • reg.exe (PID: 1928)

    • Loads the Task Scheduler COM API

      • schtasks.exe (PID: 3892)
      • schtasks.exe (PID: 1284)
      • schtasks.exe (PID: 1388)
      • schtasks.exe (PID: 3296)
      • schtasks.exe (PID: 1564)
      • schtasks.exe (PID: 3396)

    • Executes PowerShell scripts

      • cmd.exe (PID: 3552)

    • Starts NET.EXE for service management

      • cmd.exe (PID: 1968)

    • AMADEY was detected

      • ftewk.exe (PID: 3480)

    • Connects to CnC server

      • ftewk.exe (PID: 3480)
      • rundll32.exe (PID: 4044)

    • Turns off the firewall via NETSH.EXE

      • powershell.exe (PID: 2424)

    • Actions looks like stealing of personal data

      • rundll32.exe (PID: 4044)

    • Loads dropped or rewritten executable

      • rundll32.exe (PID: 4044)

  • SUSPICIOUS

    • Reads Microsoft Outlook installation path

      • iexplore.exe (PID: 2176)
      • iexplore.exe (PID: 3336)

    • Reads the computer name

      • WinRAR.exe (PID: 2720)
      • WinRAR.exe (PID: 1972)
      • Windows Loader.exe (PID: 1836)
      • services32.exe (PID: 2244)
      • windows loader.exe (PID: 3608)
      • system32.exe (PID: 736)
      • ftewk.exe (PID: 3480)
      • ftewk.exe (PID: 3348)
      • powershell.exe (PID: 3380)
      • powershell.exe (PID: 2300)
      • powershell.exe (PID: 2528)
      • ftewk.exe (PID: 3844)
      • powershell.exe (PID: 2244)
      • powershell.exe (PID: 1928)
      • powershell.exe (PID: 2268)
      • powershell.exe (PID: 3964)
      • powershell.exe (PID: 1068)
      • powershell.exe (PID: 2556)
      • powershell.exe (PID: 452)
      • powershell.exe (PID: 3332)
      • powershell.exe (PID: 3496)
      • powershell.exe (PID: 4084)
      • powershell.exe (PID: 2620)
      • powershell.exe (PID: 3572)
      • powershell.exe (PID: 2424)
      • Windows Loader.exe (PID: 1948)
      • ftewk.exe (PID: 452)
      • services32.exe (PID: 2184)
      • cscript.exe (PID: 1884)
      • cscript.exe (PID: 268)

    • Checks supported languages

      • WinRAR.exe (PID: 2720)
      • WinRAR.exe (PID: 1972)
      • svchost32.exe (PID: 2364)
      • services32.exe (PID: 2244)
      • system32.exe (PID: 736)
      • windows loader.exe (PID: 3608)
      • cmd.exe (PID: 2996)
      • ftewk.exe (PID: 3480)
      • ftewk.exe (PID: 3348)
      • powershell.exe (PID: 3380)
      • ftewk.exe (PID: 3844)
      • Windows Loader.exe (PID: 1836)
      • cmd.exe (PID: 3552)
      • cmd.exe (PID: 1968)
      • powershell.exe (PID: 2300)
      • powershell.exe (PID: 2244)
      • powershell.exe (PID: 1928)
      • powershell.exe (PID: 2528)
      • powershell.exe (PID: 3964)
      • powershell.exe (PID: 2268)
      • powershell.exe (PID: 1068)
      • powershell.exe (PID: 2556)
      • powershell.exe (PID: 3332)
      • powershell.exe (PID: 452)
      • powershell.exe (PID: 3496)
      • powershell.exe (PID: 4084)
      • powershell.exe (PID: 2620)
      • powershell.exe (PID: 3572)
      • powershell.exe (PID: 2424)
      • ftewk.exe (PID: 452)
      • Windows Loader.exe (PID: 1948)
      • services32.exe (PID: 2184)
      • system32.exe (PID: 3088)
      • windows loader.exe (PID: 3216)
      • cmd.exe (PID: 1492)
      • cmd.exe (PID: 2792)
      • cmd.exe (PID: 3032)
      • svchost32.exe (PID: 4088)
      • cmd.exe (PID: 3084)
      • cmd.exe (PID: 2140)
      • cscript.exe (PID: 1884)
      • cmd.exe (PID: 3284)
      • cmd.exe (PID: 2408)
      • cmd.exe (PID: 3416)
      • cmd.exe (PID: 2568)
      • cmd.exe (PID: 2184)
      • cscript.exe (PID: 268)
      • bootsect.exe (PID: 3088)
      • cmd.exe (PID: 2804)

    • Drops a file with a compile date too recent

      • WinRAR.exe (PID: 2720)
      • Windows Loader.exe (PID: 1836)
      • WinRAR.exe (PID: 1972)
      • system32.exe (PID: 736)
      • ftewk.exe (PID: 3480)
      • windows loader.exe (PID: 3608)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 1972)
      • Windows Loader.exe (PID: 1836)
      • WinRAR.exe (PID: 2720)
      • system32.exe (PID: 736)
      • ftewk.exe (PID: 3480)
      • windows loader.exe (PID: 3608)

    • Reads the date of Windows installation

      • Windows Loader.exe (PID: 1836)
      • Windows Loader.exe (PID: 1948)

    • Reads Environment values

      • windows loader.exe (PID: 3608)
      • netsh.exe (PID: 3156)
      • netsh.exe (PID: 2672)

    • Starts itself from another location

      • system32.exe (PID: 736)

    • Starts CMD.EXE for commands execution

      • ftewk.exe (PID: 3480)
      • ftewk.exe (PID: 3348)
      • ftewk.exe (PID: 3844)
      • windows loader.exe (PID: 3608)
      • cmd.exe (PID: 2792)
      • cmd.exe (PID: 3084)

    • Uses REG.EXE to modify Windows registry

      • cmd.exe (PID: 2996)
      • cmd.exe (PID: 3552)

    • Application launched itself

      • ftewk.exe (PID: 3480)
      • cmd.exe (PID: 2792)
      • cmd.exe (PID: 3084)

    • Uses NETSH.EXE for network configuration

      • cmd.exe (PID: 1968)
      • powershell.exe (PID: 2424)

    • Reads Windows Product ID

      • windows loader.exe (PID: 3608)

    • Executed via Task Scheduler

      • ftewk.exe (PID: 452)

    • Uses ICACLS.EXE to modify access control list

      • cmd.exe (PID: 1492)
      • cmd.exe (PID: 2140)

    • Executes scripts

      • cmd.exe (PID: 3416)
      • cmd.exe (PID: 3284)

    • Creates files in the user directory

      • ftewk.exe (PID: 3480)

    • Uses RUNDLL32.EXE to load library

      • ftewk.exe (PID: 3480)

  • INFO

    • Checks supported languages

      • iexplore.exe (PID: 1332)
      • iexplore.exe (PID: 3336)
      • NOTEPAD.EXE (PID: 3044)
      • iexplore.exe (PID: 2176)
      • reg.exe (PID: 1928)
      • schtasks.exe (PID: 3892)
      • net.exe (PID: 2912)
      • tskill.exe (PID: 2120)
      • netsh.exe (PID: 3156)
      • tskill.exe (PID: 1020)
      • tskill.exe (PID: 3488)
      • tskill.exe (PID: 2532)
      • tskill.exe (PID: 3220)
      • tskill.exe (PID: 2800)
      • tskill.exe (PID: 2368)
      • tskill.exe (PID: 3868)
      • tskill.exe (PID: 2740)
      • tskill.exe (PID: 2832)
      • tskill.exe (PID: 1760)
      • tskill.exe (PID: 3316)
      • tskill.exe (PID: 3472)
      • tskill.exe (PID: 2528)
      • tskill.exe (PID: 752)
      • tskill.exe (PID: 1836)
      • tskill.exe (PID: 2880)
      • tskill.exe (PID: 4092)
      • tskill.exe (PID: 2120)
      • tskill.exe (PID: 2548)
      • tskill.exe (PID: 1584)
      • tskill.exe (PID: 3088)
      • tskill.exe (PID: 1900)
      • tskill.exe (PID: 3584)
      • tskill.exe (PID: 3484)
      • tskill.exe (PID: 3468)
      • tskill.exe (PID: 288)
      • tskill.exe (PID: 2188)
      • tskill.exe (PID: 672)
      • tskill.exe (PID: 3884)
      • tskill.exe (PID: 892)
      • tskill.exe (PID: 3684)
      • tskill.exe (PID: 2432)
      • tskill.exe (PID: 3148)
      • tskill.exe (PID: 2620)
      • tskill.exe (PID: 2140)
      • tskill.exe (PID: 1600)
      • tskill.exe (PID: 2932)
      • tskill.exe (PID: 2996)
      • tskill.exe (PID: 2988)
      • tskill.exe (PID: 2032)
      • tskill.exe (PID: 2436)
      • tskill.exe (PID: 2804)
      • tskill.exe (PID: 3764)
      • tskill.exe (PID: 2428)
      • tskill.exe (PID: 3776)
      • tskill.exe (PID: 3376)
      • tskill.exe (PID: 1644)
      • tskill.exe (PID: 2336)
      • tskill.exe (PID: 2092)
      • tskill.exe (PID: 3952)
      • tskill.exe (PID: 3884)
      • tskill.exe (PID: 2340)
      • tskill.exe (PID: 3808)
      • tskill.exe (PID: 2476)
      • tskill.exe (PID: 2480)
      • tskill.exe (PID: 116)
      • tskill.exe (PID: 3708)
      • tskill.exe (PID: 3812)
      • net1.exe (PID: 3060)
      • tskill.exe (PID: 3908)
      • tskill.exe (PID: 2924)
      • tskill.exe (PID: 3120)
      • tskill.exe (PID: 588)
      • tskill.exe (PID: 2280)
      • tskill.exe (PID: 3376)
      • tskill.exe (PID: 2432)
      • tskill.exe (PID: 2604)
      • tskill.exe (PID: 3516)
      • tskill.exe (PID: 2168)
      • tskill.exe (PID: 3412)
      • netsh.exe (PID: 2672)
      • reg.exe (PID: 2888)
      • reg.exe (PID: 2856)
      • reg.exe (PID: 3284)
      • reg.exe (PID: 3956)
      • reg.exe (PID: 2776)
      • reg.exe (PID: 116)
      • reg.exe (PID: 2396)
      • reg.exe (PID: 2896)
      • reg.exe (PID: 3244)
      • reg.exe (PID: 3760)
      • reg.exe (PID: 2496)
      • reg.exe (PID: 2920)
      • reg.exe (PID: 2948)
      • reg.exe (PID: 3428)
      • schtasks.exe (PID: 3396)
      • reg.exe (PID: 1652)
      • schtasks.exe (PID: 1388)
      • schtasks.exe (PID: 3296)
      • schtasks.exe (PID: 1564)
      • reg.exe (PID: 780)
      • reg.exe (PID: 3376)
      • reg.exe (PID: 3976)
      • reg.exe (PID: 1312)
      • tskill.exe (PID: 1832)
      • schtasks.exe (PID: 1284)
      • reg.exe (PID: 3544)
      • reg.exe (PID: 3072)
      • reg.exe (PID: 2492)
      • reg.exe (PID: 3364)
      • reg.exe (PID: 1980)
      • reg.exe (PID: 2448)
      • takeown.exe (PID: 3008)
      • icacls.exe (PID: 4024)
      • icacls.exe (PID: 2184)
      • takeown.exe (PID: 3080)
      • rundll32.exe (PID: 4044)
      • compact.exe (PID: 3624)
      • shutdown.exe (PID: 2976)

    • Checks Windows Trust Settings

      • iexplore.exe (PID: 3336)
      • iexplore.exe (PID: 1332)
      • iexplore.exe (PID: 2176)
      • services32.exe (PID: 2244)
      • powershell.exe (PID: 3380)
      • powershell.exe (PID: 2300)
      • powershell.exe (PID: 2244)
      • powershell.exe (PID: 1928)
      • powershell.exe (PID: 2528)
      • powershell.exe (PID: 1068)
      • powershell.exe (PID: 2268)
      • powershell.exe (PID: 3332)
      • powershell.exe (PID: 3964)
      • powershell.exe (PID: 2556)
      • powershell.exe (PID: 452)
      • powershell.exe (PID: 3496)
      • powershell.exe (PID: 4084)
      • powershell.exe (PID: 2620)
      • powershell.exe (PID: 3572)
      • powershell.exe (PID: 2424)
      • services32.exe (PID: 2184)
      • cscript.exe (PID: 1884)
      • cscript.exe (PID: 268)

    • Changes internet zones settings

      • iexplore.exe (PID: 1332)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 3336)
      • iexplore.exe (PID: 2176)
      • iexplore.exe (PID: 1332)
      • services32.exe (PID: 2244)
      • powershell.exe (PID: 3380)
      • powershell.exe (PID: 2300)
      • powershell.exe (PID: 2528)
      • powershell.exe (PID: 2244)
      • powershell.exe (PID: 1068)
      • powershell.exe (PID: 1928)
      • powershell.exe (PID: 2268)
      • powershell.exe (PID: 2556)
      • powershell.exe (PID: 3332)
      • powershell.exe (PID: 452)
      • powershell.exe (PID: 3496)
      • powershell.exe (PID: 3964)
      • powershell.exe (PID: 2620)
      • powershell.exe (PID: 4084)
      • powershell.exe (PID: 3572)
      • services32.exe (PID: 2184)

    • Application launched itself

      • iexplore.exe (PID: 1332)

    • Reads the computer name

      • iexplore.exe (PID: 3336)
      • iexplore.exe (PID: 1332)
      • iexplore.exe (PID: 2176)
      • schtasks.exe (PID: 3892)
      • netsh.exe (PID: 3156)
      • netsh.exe (PID: 2672)
      • schtasks.exe (PID: 3396)
      • schtasks.exe (PID: 1284)
      • schtasks.exe (PID: 3296)
      • schtasks.exe (PID: 1564)
      • schtasks.exe (PID: 1388)
      • takeown.exe (PID: 3008)
      • icacls.exe (PID: 2184)
      • icacls.exe (PID: 4024)
      • takeown.exe (PID: 3080)
      • rundll32.exe (PID: 4044)
      • shutdown.exe (PID: 2976)

    • Reads internet explorer settings

      • iexplore.exe (PID: 3336)
      • iexplore.exe (PID: 2176)

    • Modifies the phishing filter of IE

      • iexplore.exe (PID: 1332)

    • Manual execution by user

      • WinRAR.exe (PID: 1972)
      • Windows Loader.exe (PID: 1836)
      • NOTEPAD.EXE (PID: 3044)
      • Windows Loader.exe (PID: 1948)

    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 1332)

    • Creates files in the user directory

      • iexplore.exe (PID: 1332)

    • Changes settings of System certificates

      • iexplore.exe (PID: 1332)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
232
Monitored processes
169
Malicious processes
14
Suspicious processes
21

Behavior graph

Click at the process to see the details
start drop and start drop and start drop and start drop and start drop and start drop and start drop and start iexplore.exe iexplore.exe iexplore.exe winrar.exe winrar.exe notepad.exe no specs windows loader.exe services32.exe no specs services32.exe svchost32.exe system32.exe windows loader.exe no specs windows loader.exe #AMADEY ftewk.exe cmd.exe no specs reg.exe schtasks.exe no specs ftewk.exe no specs cmd.exe no specs powershell.exe no specs ftewk.exe no specs cmd.exe no specs net.exe no specs net1.exe no specs netsh.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs powershell.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs powershell.exe no specs tskill.exe no specs tskill.exe no specs powershell.exe no specs powershell.exe no specs powershell.exe no specs powershell.exe no specs powershell.exe no specs powershell.exe no specs powershell.exe no specs powershell.exe no specs powershell.exe no specs powershell.exe no specs powershell.exe no specs powershell.exe no specs powershell.exe no specs netsh.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs ftewk.exe no specs windows loader.exe services32.exe no specs svchost32.exe no specs system32.exe no specs windows loader.exe no specs cmd.exe no specs cmd.exe no specs takeown.exe no specs cmd.exe no specs icacls.exe no specs cmd.exe no specs cmd.exe no specs takeown.exe no specs cmd.exe no specs icacls.exe no specs cmd.exe no specs cscript.exe no specs cmd.exe no specs cscript.exe no specs rundll32.exe cmd.exe no specs compact.exe no specs cmd.exe no specs bootsect.exe no specs cmd.exe no specs shutdown.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
116tskill /A ad-*C:\Windows\system32\tskill.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Remote Desktop Services End Process Utility
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\tskill.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\winsta.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\usp10.dll
116reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIOAVProtection" /t REG_DWORD /d "1" /fC:\Windows\system32\reg.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Registry Console Tool
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
268C:\Windows\System32\cscript.exe //nologo C:\Windows\System32\slmgr.vbs -ipk 32KD2-K9CTF-M3DJT-4J3WC-733WD C:\Windows\System32\cscript.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft ® Console Based Script Host
Exit code:
0
Version:
5.8.7600.16385
Modules
Images
c:\windows\system32\cscript.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
288tskill /A guar*C:\Windows\system32\tskill.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Remote Desktop Services End Process Utility
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\tskill.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\winsta.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
452powershell.exe -command "Set-MpPreference -MAPSReporting 0"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
1
Version:
10.0.14409.1005 (rs1_srvoob.161208-1155)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
452C:\Users\admin\AppData\Local\Temp\b3dcf4c296\ftewk.exe C:\Users\admin\AppData\Local\Temp\b3dcf4c296\ftewk.exe—taskeng.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Host Process for Windows Services
Exit code:
0
Version:
10.0.19041.546 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\ntdll.dll
c:\users\admin\appdata\local\temp\b3dcf4c296\ftewk.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\ole32.dll
588tskill /A sweep*C:\Windows\system32\tskill.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Remote Desktop Services End Process Utility
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\tskill.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\winsta.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
672tskill /A gcasDt*C:\Windows\system32\tskill.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Remote Desktop Services End Process Utility
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\tskill.exe
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\winsta.dll
c:\windows\system32\lpk.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\usp10.dll
736"C:\Users\admin\system32.exe" C:\Users\admin\system32.exe
Windows Loader.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Host Process for Windows Services
Exit code:
0
Version:
10.0.19041.546 (WinBuild.160101.0800)
Modules
Images
c:\users\admin\system32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\ole32.dll
752tskill /A nav*C:\Windows\system32\tskill.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Remote Desktop Services End Process Utility
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\tskill.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\winsta.dll
c:\windows\system32\user32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\lpk.dll
Total events
94 301
Read events
93 108
Write events
1 190
Delete events
3

Modification events

(PID) Process:(1332) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
1
(PID) Process:(1332) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchLowDateTime
Value:
950159744
(PID) Process:(1332) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
30955636
(PID) Process:(1332) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateLowDateTime
Value:
(PID) Process:(1332) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
30955636
(PID) Process:(1332) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(1332) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(1332) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(1332) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(1332) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
Executable files
13
Suspicious files
46
Text files
53
Unknown types
16

Dropped files

PID
Process
Filename
Type
3336iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\style[1].csstext
MD5:—
SHA256:—
3336iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\blocks[1].csstext
MD5:—
SHA256:—
3336iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\windows-loader[1].htmhtml
MD5:—
SHA256:—
3336iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\index[1].jshtml
MD5:CFB428C02811F0CBE515D5F3DCA61DE6
SHA256:679E44F9B4BBBC2AD0C4000C1413FD3A88627D83F1CBA8EBDAC26F81BC7EDB78
3336iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27der
MD5:—
SHA256:—
3336iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\style.min[1].csstext
MD5:7E7A1A9E3712CD16DADE7C6E811BA28B
SHA256:CDBDAA122823601390C7DCBDD1AFDE33C2F1A432B8C5FF025C6137EE99BA541A
3336iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\5IWPIAR9\styles[1].csstext
MD5:2C387107E6E612E8A2612BBBADA117F6
SHA256:FB12708D973E6B9354F367A6780E5A166B0DA7D2721D856DA7F9D57130883EAA
3336iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\email-decode.min[1].jshtml
MD5:9E8F56E8E1806253BA01A95CFC3D392C
SHA256:2595496FE48DF6FCF9B1BC57C29A744C121EB4DD11566466BC13D2E52E6BBCC8
3336iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\gtranslate-style24[1].csstext
MD5:B1B4A32633503B5F5EEB86B59602E702
SHA256:6A558670783199BB955EF7D0263B756A836CAC2B7644B263B3BA9BC43E4D21D3
3336iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\5IWPIAR9\shortcodes[1].csstext
MD5:D0787CF6613348AFC14BD7ECE8F3964C
SHA256:F6F51CDAA2F03FE8B3D665C33FCFD8E4356DEA2A13BB354EFC709B8A9C7057CA
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
20
TCP/UDP connections
49
DNS requests
15
Threats
21

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1332
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8Ull8gIGmZT9XHrHiJQeI%3D
US
der
1.47 Kb
whitelisted
3480
ftewk.exe
POST
200
193.106.191.201:80
http://193.106.191.201/panelis/index.php
RU
executable
99.9 Kb
malicious
4044
rundll32.exe
POST
200
193.106.191.201:80
http://193.106.191.201/panelis/index.php
RU
—
—
malicious
3336
iexplore.exe
GET
200
142.250.185.131:80
http://ocsp.pki.goog/gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEGw1Yik%2BBw9wCsFmPcXqpzQ%3D
US
der
471 b
whitelisted
1332
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D
US
der
471 b
whitelisted
3336
iexplore.exe
GET
200
142.250.185.131:80
http://ocsp.pki.goog/gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D
US
der
724 b
whitelisted
1332
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
US
der
471 b
whitelisted
3336
iexplore.exe
GET
200
142.250.185.131:80
http://ocsp.pki.goog/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D
US
der
1.41 Kb
whitelisted
3480
ftewk.exe
POST
200
193.106.191.201:80
http://193.106.191.201/panelis/index.php
RU
text
115 b
malicious
3336
iexplore.exe
GET
200
142.250.185.131:80
http://ocsp.pki.goog/gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCCPD%2BmI1IjpApTbalFlJFC
US
der
472 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3336
iexplore.exe
67.27.233.126:80
ctldl.windowsupdate.com
Level 3 Communications, Inc.
US
suspicious
3336
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
3336
iexplore.exe
142.250.185.174:443
translate.google.com
Google Inc.
US
whitelisted
3336
iexplore.exe
188.114.96.7:443
officialkmspico.net
Cloudflare Inc
US
malicious
3336
iexplore.exe
142.250.185.131:80
ocsp.pki.goog
Google Inc.
US
whitelisted
1332
iexplore.exe
152.199.19.161:443
iecvlist.microsoft.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
3336
iexplore.exe
142.250.186.163:443
www.gstatic.com
Google Inc.
US
whitelisted
2176
iexplore.exe
188.114.96.7:443
officialkmspico.net
Cloudflare Inc
US
malicious
1332
iexplore.exe
204.79.197.200:443
ieonline.microsoft.com
Microsoft Corporation
US
whitelisted
1332
iexplore.exe
104.89.38.104:443
go.microsoft.com
Akamai Technologies, Inc.
NL
malicious

DNS requests

Domain
IP
Reputation
officialkmspico.net
  • 188.114.96.7
  • 188.114.97.7
malicious
ctldl.windowsupdate.com
  • 67.27.233.126
  • 8.248.145.254
  • 67.26.73.254
  • 8.253.207.120
  • 67.27.158.254
whitelisted
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 131.253.33.200
  • 13.107.22.200
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted
translate.google.com
  • 142.250.185.174
whitelisted
ocsp.pki.goog
  • 142.250.185.131
whitelisted
translate.googleapis.com
  • 216.58.212.138
whitelisted
iecvlist.microsoft.com
  • 152.199.19.161
whitelisted
r20swj13mr.microsoft.com
  • 152.199.19.161
whitelisted

Threats

PID
Process
Class
Message
3480
ftewk.exe
A Network Trojan was detected
ET TROJAN Amadey CnC Check-In
3480
ftewk.exe
A Network Trojan was detected
AV TROJAN Agent.DHOA System Info Exfiltration
3480
ftewk.exe
A Network Trojan was detected
ET INFO Executable Download from dotted-quad Host
3480
ftewk.exe
Potential Corporate Privacy Violation
AV POLICY HTTP request for .exe file with no User-Agent
3480
ftewk.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
3480
ftewk.exe
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
3480
ftewk.exe
Potentially Bad Traffic
ET INFO SUSPICIOUS Dotted Quad Host MZ Response
3480
ftewk.exe
A Network Trojan was detected
ET INFO Executable Download from dotted-quad Host
3480
ftewk.exe
Potential Corporate Privacy Violation
AV POLICY HTTP request for .exe file with no User-Agent
3480
ftewk.exe
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
6 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://officialkmspico.net/windows-loader/