File name:

Game_Setup.zip

Full analysis: https://app.any.run/tasks/7c2b42a3-885d-467b-80d6-919a1fd919cf
Verdict: Malicious activity
Threats:

Amadey is a formidable Windows infostealer threat, characterized by its persistence mechanisms, modular design, and ability to execute various malicious tasks.

Malware Trends Tracker     >>>
Analysis date: June 21, 2025, 16:05:50
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
arch-exec
arch-doc
themida
miner
winring0x64-sys
vuln-driver
amadey
botnet
stealer
xmrig
xor-url
upx
generic
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract, compression method=deflate
MD5:

95A6838ADE68096DDC7969F54F4FDDC7

SHA1:

3A3D8B521224595D5AB60307263393C80ABAEBFB

SHA256:

A03B1F38FD828330FFA3FDD97E54F063F6E735A6C15A4B906B09FB1B1AF707F2

SSDEEP:

98304:Jx7JVqdi6TmmHD3xNyX6duuadHEfFA0mdVlqDkywx2ESaptrYgHh9lc0shKVgGtm:szXuYZPRGjJERl

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Generic archive extractor

      • WinRAR.exe (PID: 5644)

    • Changes Windows Defender settings

      • Setup.exe (PID: 6384)
      • install.exe (PID: 3852)

    • Adds extension to the Windows Defender exclusion list

      • Setup.exe (PID: 6384)
      • install.exe (PID: 3852)

    • Uninstalls Malicious Software Removal Tool (MRT)

      • cmd.exe (PID: 4960)
      • cmd.exe (PID: 4664)

    • Vulnerable driver has been detected

      • install.exe (PID: 3852)

    • MINER has been detected (SURICATA)

      • svchost.exe (PID: 2200)

    • XMRIG has been detected (YARA)

      • explorer.exe (PID: 7124)

    • XORed URL has been found (YARA)

      • explorer.exe (PID: 7124)

  • SUSPICIOUS

    • Starts process via Powershell

      • powershell.exe (PID: 4552)

    • Reads the BIOS version

      • Setup.exe (PID: 4648)
      • Setup.exe (PID: 6384)
      • install.exe (PID: 3852)

    • Starts POWERSHELL.EXE for commands execution

      • Setup.exe (PID: 4648)
      • Setup.exe (PID: 6384)
      • install.exe (PID: 3852)

    • Script adds exclusion extension to Windows Defender

      • Setup.exe (PID: 6384)
      • install.exe (PID: 3852)

    • Script adds exclusion path to Windows Defender

      • Setup.exe (PID: 6384)
      • install.exe (PID: 3852)

    • Manipulates environment variables

      • powershell.exe (PID: 5008)
      • powershell.exe (PID: 3504)

    • Starts CMD.EXE for commands execution

      • Setup.exe (PID: 6384)
      • install.exe (PID: 3852)

    • Process uninstalls Windows update

      • wusa.exe (PID: 5348)
      • wusa.exe (PID: 5896)

    • Stops a currently running service

      • sc.exe (PID: 3876)
      • sc.exe (PID: 6004)
      • sc.exe (PID: 6404)
      • sc.exe (PID: 4764)
      • sc.exe (PID: 1488)
      • sc.exe (PID: 6512)
      • sc.exe (PID: 6368)
      • sc.exe (PID: 856)
      • sc.exe (PID: 416)
      • sc.exe (PID: 2356)
      • sc.exe (PID: 1336)

    • Starts SC.EXE for service management

      • Setup.exe (PID: 6384)
      • install.exe (PID: 3852)

    • Creates a new Windows service

      • sc.exe (PID: 6836)

    • Executable content was dropped or overwritten

      • Setup.exe (PID: 6384)
      • install.exe (PID: 3852)

    • Modifies hosts file to alter network resolution

      • Setup.exe (PID: 6384)
      • install.exe (PID: 3852)

    • Windows service management via SC.EXE

      • sc.exe (PID: 5708)
      • sc.exe (PID: 3948)

    • Executes as Windows Service

      • install.exe (PID: 3852)

    • Uses powercfg.exe to modify the power settings

      • Setup.exe (PID: 6384)
      • install.exe (PID: 3852)

    • Connects to unusual port

      • explorer.exe (PID: 7124)

    • Drops a system driver (possible attempt to evade defenses)

      • install.exe (PID: 3852)

    • Potential Corporate Privacy Violation

      • svchost.exe (PID: 2200)

  • INFO

    • Checks supported languages

      • Setup.exe (PID: 4648)
      • Setup.exe (PID: 6384)
      • install.exe (PID: 3852)

    • Manual execution by a user

      • Setup.exe (PID: 4648)
      • notepad.exe (PID: 4824)

    • Reads security settings of Internet Explorer

      • notepad.exe (PID: 4824)

    • Process checks whether UAC notifications are on

      • Setup.exe (PID: 6384)
      • install.exe (PID: 3852)

    • Themida protector has been detected

      • Setup.exe (PID: 6384)

    • Creates files in the program directory

      • Setup.exe (PID: 6384)

    • The sample compiled with english language support

      • Setup.exe (PID: 6384)

    • Checks if a key exists in the options dictionary (POWERSHELL)

      • powershell.exe (PID: 3504)
      • powershell.exe (PID: 5008)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 3504)
      • powershell.exe (PID: 5008)

    • The sample compiled with japanese language support

      • install.exe (PID: 3852)

    • UPX packer has been detected

      • explorer.exe (PID: 7124)

    • Checks proxy server information

      • slui.exe (PID: 7100)

    • Reads the software policy settings

      • slui.exe (PID: 7100)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: Deflated
ZipModifyDate: 2024:06:28 14:36:30
ZipCRC: 0xcc407c6f
ZipCompressedSize: 17363
ZipUncompressedSize: 2982144
ZipFileName: Data1.repack
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
197
Monitored processes
66
Malicious processes
6
Suspicious processes
2

Behavior graph

Click at the process to see the details
start winrar.exe no specs setup.exe no specs powershell.exe no specs conhost.exe no specs notepad.exe no specs setup.exe rundll32.exe no specs slui.exe powershell.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs wusa.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs powercfg.exe no specs powercfg.exe no specs powercfg.exe no specs powercfg.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs sc.exe no specs conhost.exe no specs conhost.exe no specs THREAT install.exe powershell.exe no specs conhost.exe no specs cmd.exe no specs sc.exe no specs conhost.exe no specs conhost.exe no specs sc.exe no specs wusa.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs powercfg.exe no specs powercfg.exe no specs powercfg.exe no specs conhost.exe no specs powercfg.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs #XOR-URL explorer.exe #MINER svchost.exe

Process information

PID
CMD
Path
Indicators
Parent process
416C:\WINDOWS\system32\sc.exe stop dosvcC:\Windows\System32\sc.exe—install.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Service Control Manager Configuration Tool
Exit code:
1062
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
684C:\WINDOWS\system32\powercfg.exe /x -standby-timeout-dc 0C:\Windows\System32\powercfg.exe—Setup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Power Settings Command-Line Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\powercfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\powrprof.dll
856C:\WINDOWS\system32\sc.exe stop bitsC:\Windows\System32\sc.exe—install.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Service Control Manager Configuration Tool
Exit code:
1062
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
984\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—sc.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1336C:\WINDOWS\system32\sc.exe stop WaaSMedicSvcC:\Windows\System32\sc.exe—install.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Service Control Manager Configuration Tool
Exit code:
1062
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
1488C:\WINDOWS\system32\sc.exe stop dosvcC:\Windows\System32\sc.exe—Setup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Service Control Manager Configuration Tool
Exit code:
1062
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
2120C:\WINDOWS\system32\powercfg.exe /x -hibernate-timeout-ac 0C:\Windows\System32\powercfg.exe—install.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Power Settings Command-Line Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\powercfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\powrprof.dll
2200C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2320\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powercfg.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2356C:\WINDOWS\system32\sc.exe stop UsoSvcC:\Windows\System32\sc.exe—install.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Service Control Manager Configuration Tool
Exit code:
1061
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
Total events
24 771
Read events
24 759
Write events
12
Delete events
0

Modification events

(PID) Process:(5644) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(5644) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(5644) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(5644) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\Game_Setup.zip
(PID) Process:(5644) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(5644) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(5644) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(5644) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(5644) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList
Operation:writeName:ArcSort
Value:
32
(PID) Process:(5644) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList
Operation:writeName:ArcSort
Value:
0
Executable files
2
Suspicious files
2
Text files
9
Unknown types
0

Dropped files

PID
Process
Filename
Type
6384Setup.exeC:\ProgramData\LocalUpdateUpdate\install.exeexecutable
MD5:42DF176B4530E5B5434D66AE95B992A9
SHA256:94CAFF833F3196A7ADB6C25D96442F9316BF3B4044B8B1F95EE50C5CABC67EF3
3504powershell.exeC:\Windows\Temp\__PSScriptPolicyTest_btajwxms.ndp.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
4552powershell.exeC:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractivebinary
MD5:ACD29E0070F0F9065129EC287BC4DEE6
SHA256:3477591DF47C5F6C3E82F7CF98C983F115101DD6B94976357245BCB90DEDA57C
3504powershell.exeC:\Windows\Temp\__PSScriptPolicyTest_ddvepqeo.3qx.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
5008powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_cbqmmejn.kih.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
3504powershell.exeC:\Windows\Temp\__PSScriptPolicyTest_om2ix3vs.4th.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
4552powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_ynlvpubr.lns.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
3852install.exeC:\Windows\Temp\vozzhmumpjds.sysexecutable
MD5:0C0195C48B6B8582FA6F6373032118DA
SHA256:11BD2C9F9E2397C9A16E0990E4ED2CF0679498FE0FD418A3DFDAC60B5C160EE5
3504powershell.exeC:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractivebinary
MD5:51D9D9E1E51140C5232D79510394A3A0
SHA256:7DA347A38A26BA84A5882C86B971B6F5E8D74D395566489C0B98BB1500166313
6384Setup.exeC:\Windows\System32\drivers\etc\hoststext
MD5:A3FB8664A45F92A22F28880820BE3701
SHA256:A6B5ED0BC2D4E6C476A582D79F5CDCD2FB428F84B157E6BEFDB25C0FE359346C
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
27
DNS requests
9
Threats
4

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1268
svchost.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
23.55.104.172:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
POST
500
20.83.72.98:443
https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail
unknown
xml
512 b
whitelisted
—
—
POST
200
172.67.157.64:443
https://23865.fr/api/endpoint.php
unknown
binary
2 b
malicious
5944
MoUsoCoreWorker.exe
GET
200
23.55.104.172:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
3572
RUXIMICS.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
POST
200
172.67.157.64:443
https://23865.fr/api/endpoint.php
unknown
binary
17 b
malicious
5944
MoUsoCoreWorker.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
POST
500
20.83.72.98:443
https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail
unknown
xml
512 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
5944
MoUsoCoreWorker.exe
40.127.240.158:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
3572
RUXIMICS.exe
40.127.240.158:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
1268
svchost.exe
40.127.240.158:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
1268
svchost.exe
23.55.104.172:80
crl.microsoft.com
Akamai International B.V.
US
whitelisted
5944
MoUsoCoreWorker.exe
23.55.104.172:80
crl.microsoft.com
Akamai International B.V.
US
whitelisted
1268
svchost.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
3572
RUXIMICS.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
5944
MoUsoCoreWorker.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.185.238
whitelisted
crl.microsoft.com
  • 23.55.104.172
  • 23.55.104.190
whitelisted
www.microsoft.com
  • 95.101.149.131
whitelisted
settings-win.data.microsoft.com
  • 20.73.194.208
whitelisted
activation-v2.sls.microsoft.com
  • 20.83.72.98
whitelisted
xmr-eu1.nanopool.org
  • 51.38.65.123
  • 146.59.154.106
  • 163.172.154.142
  • 212.47.253.124
  • 51.15.58.224
  • 54.37.232.103
  • 51.68.213.185
  • 51.89.23.91
  • 54.37.137.114
  • 57.128.224.74
  • 51.15.193.130
  • 57.128.224.35
  • 57.128.224.17
  • 51.15.65.182
  • 162.19.224.121
  • 57.128.224.211
  • 141.94.23.83
whitelisted
23865.fr
  • 104.21.65.14
  • 172.67.157.64
malicious
self.events.data.microsoft.com
  • 20.44.10.122
whitelisted

Threats

PID
Process
Class
Message
2200
svchost.exe
Potential Corporate Privacy Violation
ET INFO Observed DNS Query to Coin Mining Domain (nanopool .org)
—
—
Misc activity
SUSPICIOUS [ANY.RUN] Sent Host Name in HTTP POST Body
—
—
A Network Trojan was detected
ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M3
—
—
A Network Trojan was detected
ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M3
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Game_Setup.zip