File name:

random.exe

Full analysis: https://app.any.run/tasks/3cff3cac-a7ef-408f-a242-ce903dd02dbe
Verdict: Malicious activity
Threats:

Amadey is a formidable Windows infostealer threat, characterized by its persistence mechanisms, modular design, and ability to execute various malicious tasks.

Malware Trends Tracker     >>>
Analysis date: October 06, 2025, 00:56:42
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
amadey
botnet
stealer
auto
redline
vidar
themida
unlocker-eject
tool
arch-exec
rdp
stealc
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 6 sections
MD5:

001E8AD1E0D0800E75B1FA32B07D2A46

SHA1:

4C4FD4ADFBCB8A2C3831F0F9605FCF65B44E9DB7

SHA256:

BE68F32481E1551531F9C2AE9322870AA30E48224FB0AD1F4468B04EC07374C0

SSDEEP:

98304:Mab2JFhkb/PcEdJuAGnbMj/Z85nQvA7twD4g+kWJOGmRkIXGYjfVuuSHeoIsJIl1:4yRsR7eEGrN

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • REDLINE has been found (auto)

      • random.exe (PID: 2144)
      • random.exe (PID: 2816)
      • random.exe (PID: 8540)

    • AMADEY mutex has been found

      • svchostam.exe (PID: 6416)
      • svchostam.exe (PID: 7876)
      • svchostam.exe (PID: 8808)
      • svchosthelper.exe (PID: 8864)
      • svchosthelper.exe (PID: 9020)
      • svchosthelper.exe (PID: 2360)
      • svchosthelper.exe (PID: 6988)
      • svchosthelper.exe (PID: 4076)
      • svchosthelper.exe (PID: 9120)
      • svchosthelper.exe (PID: 5592)
      • svchosthelper.exe (PID: 1908)
      • svchosthelper.exe (PID: 6292)
      • svchosthelper.exe (PID: 5836)
      • svchosthelper.exe (PID: 4316)
      • svchosthelper.exe (PID: 4176)
      • svchosthelper.exe (PID: 7096)
      • svchosthelper.exe (PID: 8456)
      • svchosthelper.exe (PID: 6544)
      • svchosthelper.exe (PID: 7912)

    • AMADEY has been detected (SURICATA)

      • svchostam.exe (PID: 6416)

    • Connects to the CnC server

      • svchostam.exe (PID: 6416)

    • VIDAR has been detected (YARA)

      • svchostmanager.exe (PID: 6364)
      • svchostmanager.exe (PID: 2312)

    • AMADEY has been detected (YARA)

      • svchostam.exe (PID: 6416)
      • random.exe (PID: 2816)

    • Uses Task Scheduler to run other applications

      • cmd.exe (PID: 8856)

    • Adds path to the Windows Defender exclusion list

      • cmd.exe (PID: 4744)
      • NSudoLG.exe (PID: 9052)

    • Changes Windows Defender settings

      • NSudoLG.exe (PID: 9052)

    • Changes the Windows auto-update feature

      • reg.exe (PID: 8320)

  • SUSPICIOUS

    • Reads the BIOS version

      • random.exe (PID: 2144)
      • svchostmanager.exe (PID: 6364)
      • random.exe (PID: 2816)
      • random.exe (PID: 8540)
      • svchostmanager.exe (PID: 8684)
      • svchostmanager.exe (PID: 2312)

    • Executable content was dropped or overwritten

      • random.exe (PID: 2144)
      • random.exe (PID: 2816)
      • random.exe (PID: 8540)
      • systemhelper.exe (PID: 8984)
      • game.exe (PID: 9152)
      • game.exe (PID: 2836)

    • Reads security settings of Internet Explorer

      • random.exe (PID: 2144)
      • svchostam.exe (PID: 6416)
      • random.exe (PID: 2816)
      • systemhelper.exe (PID: 8984)
      • game.exe (PID: 9128)
      • game.exe (PID: 9152)
      • game.exe (PID: 2836)
      • IObitUnlocker.exe (PID: 2364)
      • StartMenuExperienceHost.exe (PID: 2568)
      • svchostmanager.exe (PID: 6364)
      • StartMenuExperienceHost.exe (PID: 8532)
      • svchostmanager.exe (PID: 2312)
      • svchostmanager.exe (PID: 8684)

    • Application launched itself

      • random.exe (PID: 2144)
      • cmd.exe (PID: 4744)

    • Contacting a server suspected of hosting an CnC

      • svchostam.exe (PID: 6416)

    • Creates a new Windows service

      • sc.exe (PID: 8056)

    • Windows service management via SC.EXE

      • sc.exe (PID: 8476)
      • sc.exe (PID: 9196)
      • sc.exe (PID: 8072)
      • sc.exe (PID: 9072)
      • sc.exe (PID: 9180)
      • sc.exe (PID: 9136)
      • sc.exe (PID: 7072)
      • sc.exe (PID: 2036)
      • sc.exe (PID: 9008)
      • sc.exe (PID: 9024)

    • Executes as Windows Service

      • random.exe (PID: 8540)
      • VSSVC.exe (PID: 9108)

    • There is functionality for enable RDP (YARA)

      • svchostam.exe (PID: 6416)

    • There is functionality for taking screenshot (YARA)

      • svchostam.exe (PID: 6416)

    • Starts CMD.EXE for commands execution

      • random.exe (PID: 2816)
      • systemhelper.exe (PID: 8984)
      • NSudoLG.exe (PID: 8332)
      • game.exe (PID: 9128)
      • cmd.exe (PID: 4744)
      • game.exe (PID: 9152)
      • game.exe (PID: 2836)

    • Executes application which crashes

      • svchostam.exe (PID: 8808)
      • svchosthelper.exe (PID: 9020)
      • svchosthelper.exe (PID: 2360)
      • svchosthelper.exe (PID: 4076)
      • svchosthelper.exe (PID: 9120)
      • svchosthelper.exe (PID: 1908)
      • svchosthelper.exe (PID: 5592)
      • svchosthelper.exe (PID: 6292)
      • svchosthelper.exe (PID: 7912)
      • svchosthelper.exe (PID: 4316)
      • svchosthelper.exe (PID: 4176)
      • svchosthelper.exe (PID: 5836)
      • svchosthelper.exe (PID: 7096)
      • svchosthelper.exe (PID: 6544)
      • svchosthelper.exe (PID: 8456)

    • Drops 7-zip archiver for unpacking

      • systemhelper.exe (PID: 8984)

    • The process creates files with name similar to system file names

      • systemhelper.exe (PID: 8984)

    • The executable file from the user directory is run by the CMD process

      • nircmd.exe (PID: 9172)
      • NSudoLG.exe (PID: 8332)
      • nircmd.exe (PID: 8892)
      • game.exe (PID: 9128)
      • game.exe (PID: 9152)
      • NSudoLG.exe (PID: 9052)
      • 7z.exe (PID: 9076)
      • game.exe (PID: 2836)

    • Executing commands from a ".bat" file

      • systemhelper.exe (PID: 8984)
      • NSudoLG.exe (PID: 8332)

    • Starts application with an unusual extension

      • cmd.exe (PID: 9092)
      • cmd.exe (PID: 4744)

    • Uses REG/REGEDIT.EXE to modify registry

      • cmd.exe (PID: 9092)
      • cmd.exe (PID: 4744)

    • Get information on the list of running processes

      • cmd.exe (PID: 4744)
      • cmd.exe (PID: 9184)

    • Using 'findstr.exe' to search for text patterns in files and output

      • cmd.exe (PID: 4744)

    • Escape characters obfuscation (POWERSHELL)

      • NSudoLG.exe (PID: 9052)
      • powershell.exe (PID: 8996)

    • Starts POWERSHELL.EXE for commands execution

      • NSudoLG.exe (PID: 9052)

    • Reads the date of Windows installation

      • game.exe (PID: 9128)
      • game.exe (PID: 9152)
      • game.exe (PID: 2836)
      • StartMenuExperienceHost.exe (PID: 2568)
      • SearchApp.exe (PID: 2188)
      • StartMenuExperienceHost.exe (PID: 8532)
      • SearchApp.exe (PID: 7652)

    • PowerShell delay command usage (probably sleep evasion)

      • powershell.exe (PID: 8996)

    • Script adds exclusion path to Windows Defender

      • NSudoLG.exe (PID: 9052)

    • Uses TASKKILL.EXE to kill process

      • cmd.exe (PID: 9152)
      • cmd.exe (PID: 9132)

    • Stops a currently running service

      • sc.exe (PID: 9012)
      • sc.exe (PID: 8968)
      • sc.exe (PID: 2504)
      • sc.exe (PID: 9100)
      • sc.exe (PID: 9124)
      • sc.exe (PID: 2188)

    • Starts SC.EXE for service management

      • cmd.exe (PID: 2188)
      • cmd.exe (PID: 4744)
      • cmd.exe (PID: 9100)
      • cmd.exe (PID: 5756)
      • cmd.exe (PID: 9112)

    • Creates or modifies Windows services

      • reg.exe (PID: 5756)
      • game.exe (PID: 9152)

    • Drops a system driver (possible attempt to evade defenses)

      • game.exe (PID: 9152)
      • game.exe (PID: 2836)

    • The process verifies whether the antivirus software is installed

      • game.exe (PID: 2836)
      • IObitUnlocker.exe (PID: 2364)

    • Process communicates with Telegram (possibly using it as an attacker's C2 server)

      • svchostmanager.exe (PID: 6364)
      • svchostmanager.exe (PID: 2312)
      • svchostmanager.exe (PID: 8684)

  • INFO

    • Create files in a temporary directory

      • random.exe (PID: 2144)
      • random.exe (PID: 2816)
      • systemhelper.exe (PID: 8984)

    • Checks supported languages

      • random.exe (PID: 2144)
      • svchostam.exe (PID: 6416)
      • svchostmanager.exe (PID: 2312)
      • random.exe (PID: 2816)
      • svchostmanager.exe (PID: 6364)
      • svchostam.exe (PID: 7876)
      • random.exe (PID: 8540)
      • svchostmanager.exe (PID: 8684)
      • svchostam.exe (PID: 8808)
      • svchosthelper.exe (PID: 8864)
      • systemhelper.exe (PID: 8984)
      • nircmd.exe (PID: 9172)
      • chcp.com (PID: 9196)
      • NSudoLG.exe (PID: 8332)
      • nircmd.exe (PID: 8892)
      • chcp.com (PID: 8928)
      • mode.com (PID: 8888)
      • NSudoLG.exe (PID: 9052)
      • game.exe (PID: 9128)
      • 7z.exe (PID: 9076)
      • svchosthelper.exe (PID: 9020)
      • game.exe (PID: 9152)
      • game.exe (PID: 2836)
      • IObitUnlocker.exe (PID: 2364)
      • svchosthelper.exe (PID: 2360)
      • svchosthelper.exe (PID: 6988)
      • StartMenuExperienceHost.exe (PID: 2568)
      • SearchApp.exe (PID: 2188)
      • StartMenuExperienceHost.exe (PID: 8532)
      • SearchApp.exe (PID: 7652)
      • svchosthelper.exe (PID: 4076)
      • svchosthelper.exe (PID: 9120)
      • svchosthelper.exe (PID: 1908)
      • svchosthelper.exe (PID: 5592)
      • svchosthelper.exe (PID: 7912)
      • svchosthelper.exe (PID: 6292)
      • svchosthelper.exe (PID: 5836)
      • svchosthelper.exe (PID: 4316)
      • svchosthelper.exe (PID: 7096)
      • svchosthelper.exe (PID: 8456)
      • svchosthelper.exe (PID: 6544)
      • svchosthelper.exe (PID: 4176)

    • Reads the computer name

      • random.exe (PID: 2144)
      • random.exe (PID: 2816)
      • svchostam.exe (PID: 6416)
      • random.exe (PID: 8540)
      • svchostam.exe (PID: 8808)
      • systemhelper.exe (PID: 8984)
      • NSudoLG.exe (PID: 8332)
      • NSudoLG.exe (PID: 9052)
      • game.exe (PID: 9128)
      • svchosthelper.exe (PID: 9020)
      • game.exe (PID: 9152)
      • game.exe (PID: 2836)
      • IObitUnlocker.exe (PID: 2364)
      • svchosthelper.exe (PID: 2360)
      • svchostmanager.exe (PID: 6364)
      • 7z.exe (PID: 9076)
      • SearchApp.exe (PID: 2188)
      • svchostmanager.exe (PID: 2312)
      • svchosthelper.exe (PID: 4076)
      • StartMenuExperienceHost.exe (PID: 8532)
      • SearchApp.exe (PID: 7652)
      • svchosthelper.exe (PID: 9120)
      • svchosthelper.exe (PID: 7912)
      • svchosthelper.exe (PID: 5592)
      • svchosthelper.exe (PID: 1908)
      • svchosthelper.exe (PID: 6292)
      • svchostmanager.exe (PID: 8684)
      • svchosthelper.exe (PID: 5836)
      • svchosthelper.exe (PID: 4316)
      • svchosthelper.exe (PID: 4176)
      • svchosthelper.exe (PID: 8456)
      • svchosthelper.exe (PID: 6544)
      • StartMenuExperienceHost.exe (PID: 2568)
      • svchosthelper.exe (PID: 7096)

    • Process checks computer location settings

      • random.exe (PID: 2144)
      • systemhelper.exe (PID: 8984)
      • random.exe (PID: 2816)
      • StartMenuExperienceHost.exe (PID: 2568)
      • SearchApp.exe (PID: 2188)
      • StartMenuExperienceHost.exe (PID: 8532)
      • SearchApp.exe (PID: 7652)

    • Reads the machine GUID from the registry

      • random.exe (PID: 2816)
      • random.exe (PID: 2144)
      • random.exe (PID: 8540)
      • game.exe (PID: 9128)
      • game.exe (PID: 9152)
      • game.exe (PID: 2836)
      • svchostmanager.exe (PID: 6364)
      • SearchApp.exe (PID: 2188)
      • svchostmanager.exe (PID: 2312)
      • SearchApp.exe (PID: 7652)
      • svchostmanager.exe (PID: 8684)

    • Checks proxy server information

      • svchostam.exe (PID: 6416)
      • svchostmanager.exe (PID: 6364)
      • SearchApp.exe (PID: 2188)
      • SearchApp.exe (PID: 7652)
      • svchostmanager.exe (PID: 8684)
      • svchostmanager.exe (PID: 2312)

    • Themida protector has been detected

      • svchostmanager.exe (PID: 6364)
      • random.exe (PID: 2816)
      • svchostmanager.exe (PID: 2312)

    • The sample compiled with english language support

      • systemhelper.exe (PID: 8984)
      • game.exe (PID: 9152)
      • game.exe (PID: 2836)

    • NirSoft software is detected

      • nircmd.exe (PID: 9172)
      • nircmd.exe (PID: 8892)

    • Changes the display of characters in the console

      • cmd.exe (PID: 9092)
      • cmd.exe (PID: 4744)

    • Starts MODE.COM to configure console settings

      • mode.com (PID: 8888)

    • Checks operating system version

      • cmd.exe (PID: 4744)

    • Reads the software policy settings

      • WerFault.exe (PID: 9004)
      • WerFault.exe (PID: 9124)
      • WerFault.exe (PID: 4948)
      • svchostmanager.exe (PID: 6364)
      • SearchApp.exe (PID: 2188)
      • WerFault.exe (PID: 1952)
      • svchostmanager.exe (PID: 2312)
      • SearchApp.exe (PID: 7652)
      • WerFault.exe (PID: 6088)
      • WerFault.exe (PID: 8364)
      • WerFault.exe (PID: 596)
      • svchostmanager.exe (PID: 8684)
      • WerFault.exe (PID: 2284)
      • WerFault.exe (PID: 3088)
      • WerFault.exe (PID: 5012)
      • WerFault.exe (PID: 6380)
      • WerFault.exe (PID: 8384)
      • WerFault.exe (PID: 4140)
      • WerFault.exe (PID: 8944)

    • UNLOCKER BY EJECT mutex has been found

      • game.exe (PID: 9128)
      • game.exe (PID: 9152)
      • game.exe (PID: 2836)

    • Reads the time zone

      • explorer.exe (PID: 3848)

    • Changes appearance of the Explorer extensions

      • explorer.exe (PID: 3848)

    • Creates files in the program directory

      • svchostmanager.exe (PID: 6364)
      • svchostmanager.exe (PID: 2312)
      • svchostmanager.exe (PID: 8684)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 8996)

    • Reads Environment values

      • SearchApp.exe (PID: 2188)
      • SearchApp.exe (PID: 7652)

    • Creates files or folders in the user directory

      • svchostmanager.exe (PID: 6364)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Amadey

(PID) Process(6416) svchostam.exe
C294.154.35.25
URLhttp://94.154.35.25/di9ku38f/index.php
Version5.55
Options
Drop directory96a319e745
Drop nameSrxelqcif.exe
Strings (125)------
2019
DefaultSettings.YResolution
/quiet
2025
&& Exit"
%-lu
shutdown -s -t 0
ar:
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
\
id:
Main
abcdefghijklmnopqrstuvwxyz0123456789-_
GetNativeSystemInfo
<d>
ps1
wb
dll
e2
cmd
dm:
"
Bitdefender
og:
SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName
https://
cmd /C RMDIR /s/q
"taskkill /f /im "
/di9ku38f/index.php
=
SYSTEM\CurrentControlSet\Control\UnitedVideo\CONTROL\VIDEO\
SOFTWARE\Microsoft\Windows NT\CurrentVersion
DefaultSettings.XResolution
&&
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
Content-Type: multipart/form-data; boundary=----
|
os:
2016
ESET
------
exe
Comodo
%USERPROFILE%
Sophos
SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
vs:
Powershell.exe
<c>
96a319e745
shell32.dll
-unicode-
\App
Avira
00000419
Norton
rundll32.exe
:::
Kaspersky Lab
94.154.35.25
/k
rundll32
AVAST Software
" && ren
Keyboard Layout\Preload
clip.dll
e1
-executionpolicy remotesigned -File "
" Content-Type: application/octet-stream
cred.dll|clip.dll|
5.55
AVG
/Plugins/
CurrentBuild
http://
Rem
&unit=
ProductName
msi
-%lu
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
VideoID
" && timeout 1 && del
0123456789
r=
\0000
Panda Security
bi:
WinDefender
sd:
Startup
Srxelqcif.exe
POST
d1
kernel32.dll
st=s
#
cred.dll
?scr=1
Programs
S-%lu-
GET
e3
un:
ComputerName
zip
ProgramData\
360TotalSecurity
Content-Type: application/x-www-form-urlencoded
pc:
Doctor Web
--
av:
+++
.jpg
rb
lv:
2022
SYSTEM\ControlSet001\Services\BasicDisplay\Video
random
Content-Disposition: form-data; name="data"; filename="
0000043f
00000423
00000422
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (52.9)
.exe | Generic Win/DOS Executable (23.5)
.exe | DOS Executable Generic (23.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2082:06:11 10:11:31+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32
LinkerVersion: 48
CodeSize: 5467136
InitializedDataSize: 2048
UninitializedDataSize: -
EntryPoint: 0x95a000
OSVersion: 4
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.0
ProductVersionNumber: 1.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: -
CompanyName: -
FileDescription: DownloaderApp
FileVersion: 1.0.0.0
InternalName: DownloaderApp.exe
LegalCopyright: Copyright © 2025
LegalTrademarks: -
OriginalFileName: DownloaderApp.exe
ProductName: DownloaderApp
ProductVersion: 1.0.0.0
AssemblyVersion: 1.0.0.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
346
Monitored processes
152
Malicious processes
31
Suspicious processes
2

Behavior graph

Click at the process to see the details
start #REDLINE random.exe #VIDAR svchostmanager.exe #AMADEY svchostam.exe #AMADEY random.exe #VIDAR svchostmanager.exe svchostam.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs #REDLINE random.exe svchostmanager.exe svchostam.exe cmd.exe no specs svchosthelper.exe no specs conhost.exe no specs schtasks.exe no specs systemhelper.exe werfault.exe cmd.exe no specs conhost.exe no specs nircmd.exe no specs chcp.com no specs reg.exe no specs reg.exe no specs nsudolg.exe no specs cmd.exe conhost.exe no specs nircmd.exe no specs chcp.com no specs reg.exe no specs reg.exe no specs mode.com no specs cmd.exe no specs reg.exe no specs find.exe no specs cmd.exe no specs tasklist.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs cmd.exe no specs findstr.exe no specs reg.exe no specs find.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs find.exe no specs nsudolg.exe no specs powershell.exe no specs conhost.exe no specs 7z.exe no specs game.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs svchosthelper.exe game.exe werfault.exe cmd.exe no specs conhost.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs game.exe cmd.exe no specs conhost.exe no specs sc.exe no specs iobitunlocker.exe reg.exe no specs reg.exe no specs reg.exe no specs svchosthelper.exe svchosthelper.exe no specs werfault.exe explorer.exe no specs rundll32.exe no specs vssvc.exe no specs startmenuexperiencehost.exe no specs tiworker.exe no specs searchapp.exe explorer.exe no specs rundll32.exe no specs svchosthelper.exe slui.exe no specs werfault.exe startmenuexperiencehost.exe no specs searchapp.exe mobsync.exe no specs svchosthelper.exe werfault.exe svchosthelper.exe werfault.exe svchosthelper.exe werfault.exe svchosthelper.exe werfault.exe svchosthelper.exe werfault.exe svchosthelper.exe werfault.exe svchosthelper.exe werfault.exe svchosthelper.exe werfault.exe svchosthelper.exe werfault.exe svchosthelper.exe werfault.exe svchosthelper.exe werfault.exe svchost.exe

Process information

PID
CMD
Path
Indicators
Parent process
596C:\WINDOWS\SysWOW64\WerFault.exe -u -p 7912 -s 540C:\Windows\SysWOW64\WerFault.exe
svchosthelper.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
1908"C:\WINDOWS\svchosthelper.exe"C:\Windows\svchosthelper.exe
random.exe
User:
SYSTEM
Integrity Level:
SYSTEM
Exit code:
3221226505
Modules
Images
c:\windows\svchosthelper.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\user32.dll
c:\windows\syswow64\win32u.dll
1952C:\WINDOWS\SysWOW64\WerFault.exe -u -p 9120 -s 540C:\Windows\SysWOW64\WerFault.exe
svchosthelper.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
2036sc query IObitUnlockerC:\Windows\System32\sc.exe—cmd.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Service Control Manager Configuration Tool
Exit code:
1060
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
2144"C:\Users\admin\Desktop\random.exe" C:\Users\admin\Desktop\random.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
DownloaderApp
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\random.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
2188"C:\Windows\System32\cmd.exe" /c sc query IObitUnlockerC:\Windows\System32\cmd.exe—game.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Command Processor
Exit code:
1060
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
2188sc stop IObitUnlocker C:\Windows\System32\sc.exe—cmd.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Service Control Manager Configuration Tool
Exit code:
1060
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
2188"C:\WINDOWS\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mcaC:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Search application
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\systemapps\microsoft.windows.search_cw5n1h2txyewy\searchapp.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2284C:\WINDOWS\SysWOW64\WerFault.exe -u -p 5836 -s 540C:\Windows\SysWOW64\WerFault.exe
svchosthelper.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
2312"C:\Users\admin\AppData\Local\Temp\svchostmanager.exe"C:\Users\admin\AppData\Local\Temp\svchostmanager.exe
random.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\svchostmanager.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
Total events
73 752
Read events
73 428
Write events
273
Delete events
51

Modification events

(PID) Process:(6416) svchostam.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(6416) svchostam.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(6416) svchostam.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(9004) WerFault.exeKey:\REGISTRY\A\{a0d2271c-ed4a-b5b0-27a9-f45a967c6f86}\Root\InventoryApplicationFile
Operation:writeName:WritePermissionsCheck
Value:
1
(PID) Process:(9004) WerFault.exeKey:\REGISTRY\A\{a0d2271c-ed4a-b5b0-27a9-f45a967c6f86}\Root\InventoryApplicationFile\PermissionsCheckTestKey
Operation:delete keyName:(default)
Value:
(PID) Process:(9004) WerFault.exeKey:\REGISTRY\A\{a0d2271c-ed4a-b5b0-27a9-f45a967c6f86}\Root\InventoryApplicationFile\svchostam.exe|1caa8885a4a95e0f
Operation:writeName:ProgramId
Value:
000615939ed0ac2ba175cc44be91a649a1c20000ffff
(PID) Process:(9004) WerFault.exeKey:\REGISTRY\A\{a0d2271c-ed4a-b5b0-27a9-f45a967c6f86}\Root\InventoryApplicationFile\svchostam.exe|1caa8885a4a95e0f
Operation:writeName:FileId
Value:
0000c1b667b0ff98bbb1d2495b4fd5dda1eeca494799
(PID) Process:(9004) WerFault.exeKey:\REGISTRY\A\{a0d2271c-ed4a-b5b0-27a9-f45a967c6f86}\Root\InventoryApplicationFile\svchostam.exe|1caa8885a4a95e0f
Operation:writeName:LowerCaseLongPath
Value:
c:\windows\temp\svchostam.exe
(PID) Process:(9004) WerFault.exeKey:\REGISTRY\A\{a0d2271c-ed4a-b5b0-27a9-f45a967c6f86}\Root\InventoryApplicationFile\svchostam.exe|1caa8885a4a95e0f
Operation:writeName:LongPathHash
Value:
svchostam.exe|1caa8885a4a95e0f
(PID) Process:(9004) WerFault.exeKey:\REGISTRY\A\{a0d2271c-ed4a-b5b0-27a9-f45a967c6f86}\Root\InventoryApplicationFile\svchostam.exe|1caa8885a4a95e0f
Operation:writeName:Name
Value:
svchostam.exe
Executable files
21
Suspicious files
95
Text files
48
Unknown types
0

Dropped files

PID
Process
Filename
Type
2144random.exeC:\Users\admin\AppData\Local\Temp\svchostmanager.exeexecutable
MD5:E2CB0F1A7E9E0D011A881DC4AE6AD0EA
SHA256:23A45E87EE980EB30F5A4F65E269631BAA867010364FFBA4585785FE6E6EF6CD
9004WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_svchostam.exe_460c115342eaebf4e874c1245ef65dba855d3_0099dbc6_91fde0b2-1dc7-4fbe-b949-e9ff0855fee7\Report.wer —
MD5:—
SHA256:—
8540random.exeC:\Windows\Temp\svchostam.exeexecutable
MD5:156F4A8F006779A3493D9D476F1E8DDA
SHA256:C36ED034D523DA1F54D43176334D4BDA9F9ADCB940948646B43902A620EBDA45
2144random.exeC:\Users\admin\AppData\Local\Temp\svchostam.exeexecutable
MD5:156F4A8F006779A3493D9D476F1E8DDA
SHA256:C36ED034D523DA1F54D43176334D4BDA9F9ADCB940948646B43902A620EBDA45
8984systemhelper.exeC:\Users\admin\AppData\Local\Temp\barer\game.exeexecutable
MD5:B459B46970FB95CA0F68E9FD735254F2
SHA256:1A5A87227F98631CC3A039C856CDFE0566DDDD11F921C5F97944439AA734E17F
8984systemhelper.exeC:\Users\admin\AppData\Local\Temp\barer\NSudoLG.exeexecutable
MD5:423129DDB24FB923F35B2DD5787B13DD
SHA256:5094AD359D8CF6DC5324598605C35F68519CC5AF9C7ED5427E02A6B28121E4C7
2816random.exeC:\Windows\systemhelper.exeexecutable
MD5:6849203B20D6CEBB2D362C35B9244708
SHA256:7E5C5FA00578896197AB71274BE4D2039E032AFBA5B477002020BE49702E0E35
8984systemhelper.exeC:\Users\admin\AppData\Local\Temp\barer\7z.exeexecutable
MD5:426CCB645E50A3143811CFA0E42E2BA6
SHA256:CF878BFBD9ED93DC551AC038AFF8A8BBA4C935DDF8D48E62122BDDFDB3E08567
2816random.exeC:\Users\admin\AppData\Local\Temp\WindowsLogsHelper.xmlxml
MD5:2333DB7C7D2C4C5DBD95A8D0F370695E
SHA256:B7A133E0C20D2D572B52B7043DAF55E3DA1C1EC6E34A5AF8078DBF5726D5080C
9004WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WER4C4C.tmp.WERInternalMetadata.xmlxml
MD5:951F1E136B282F660C597E2D6ECE5D69
SHA256:AB690751DED56F519061D9F72393B1367AAC338ACA9FCF7BF424B18FF1A2A697
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
20
TCP/UDP connections
76
DNS requests
35
Threats
5

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6416
svchostam.exe
POST
200
94.154.35.25:80
http://94.154.35.25/di9ku38f/index.php
unknown
—
—
unknown
7784
backgroundTaskHost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
9004
WerFault.exe
GET
200
23.216.77.6:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6364
svchostmanager.exe
GET
200
104.18.21.213:80
http://e8.c.lencr.org/61.crl
unknown
—
—
whitelisted
5696
backgroundTaskHost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
9004
WerFault.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
4392
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
4392
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6364
svchostmanager.exe
GET
200
92.204.85.1:80
http://ocsp.godaddy.com//MEowSDBGMEQwQjAJBgUrDgMCGgUABBS2CA1fbGt26xPkOKX4ZguoUjM0TgQUQMK9J47MNIMwojPX%2B2yz8LQsgM4CCQCml4zJJc8tSg%3D%3D
unknown
—
—
whitelisted
8684
svchostmanager.exe
GET
200
192.124.249.22:80
http://ocsp.godaddy.com//MEIwQDA%2BMDwwOjAJBgUrDgMCGgUABBQdI2%2BOBkuXH93foRUj4a7lAr4rGwQUOpqFBxBnKLbv9r0FQW4gwZTaD94CAQc%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2128
RUXIMICS.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
6016
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5224
SearchApp.exe
92.123.104.38:443
www.bing.com
Akamai International B.V.
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
6416
svchostam.exe
94.154.35.25:80
—
WINDSTREAM
US
unknown
5224
SearchApp.exe
92.123.104.34:443
www.bing.com
Akamai International B.V.
DE
whitelisted
4392
svchost.exe
20.190.159.2:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4392
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
7784
backgroundTaskHost.exe
92.123.104.38:443
www.bing.com
Akamai International B.V.
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 20.73.194.208
whitelisted
www.bing.com
  • 92.123.104.38
  • 92.123.104.34
  • 92.123.104.32
  • 23.11.206.96
  • 23.3.89.120
  • 23.3.89.98
  • 95.100.158.107
  • 23.3.89.112
  • 23.11.206.107
  • 23.3.89.113
  • 23.3.89.107
  • 23.3.89.122
whitelisted
google.com
  • 142.250.185.174
whitelisted
login.live.com
  • 20.190.159.2
  • 20.190.159.75
  • 40.126.31.130
  • 20.190.159.0
  • 20.190.159.4
  • 20.190.159.23
  • 20.190.159.131
  • 40.126.31.2
whitelisted
ocsp.digicert.com
  • 2.17.190.73
  • 172.66.2.5
  • 162.159.142.9
  • 184.30.131.245
whitelisted
client.wns.windows.com
  • 172.211.123.248
whitelisted
arc.msn.com
  • 20.223.35.26
whitelisted
fd.api.iris.microsoft.com
  • 20.223.35.26
whitelisted
watson.events.data.microsoft.com
  • 172.178.240.163
  • 135.233.45.222
  • 135.234.160.244
  • 135.234.160.245
  • 172.178.240.161
whitelisted
crl.microsoft.com
  • 23.216.77.6
  • 23.216.77.28
whitelisted

Threats

PID
Process
Class
Message
6416
svchostam.exe
Malware Command and Control Activity Detected
BOTNET [ANY.RUN] Amadey HTTP POST Request (st=s)
6416
svchostam.exe
Malware Command and Control Activity Detected
ET MALWARE Amadey CnC Response
—
—
Unknown Traffic
ET USER_AGENTS Microsoft Dr Watson User-Agent (MSDW)
—
—
A Network Trojan was detected
ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M1
6416
svchostam.exe
Malware Command and Control Activity Detected
ET MALWARE Amadey CnC Response
Process
Message
random.exe
%s------------------------------------------------ --- Themida Professional --- --- (c)2012 Oreans Technologies --- ------------------------------------------------
random.exe
%s------------------------------------------------ --- Themida Professional --- --- (c)2012 Oreans Technologies --- ------------------------------------------------
random.exe
%s------------------------------------------------ --- Themida Professional --- --- (c)2012 Oreans Technologies --- ------------------------------------------------
IObitUnlocker.exe
C:\ProgramData\Microsoft\Windows Defender--------
IObitUnlocker.exe
FileCount:289
IObitUnlocker.exe
PostAction_Delete
IObitUnlocker.exe
C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection--------
IObitUnlocker.exe
C:\ProgramData\Microsoft\Windows Security Health--------
IObitUnlocker.exe
C:\ProgramData\Microsoft\Storage Health--------
IObitUnlocker.exe
C:\Program Files\Windows Defender--------
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
random.exe