File name:

intitle password site netflix filetype pdf.7z

Full analysis: https://app.any.run/tasks/df2bdf9a-3fb6-4b80-ae5f-2b976be31b86
Verdict: Malicious activity
Threats:

Amadey is a formidable Windows infostealer threat, characterized by its persistence mechanisms, modular design, and ability to execute various malicious tasks.

Analysis date: April 11, 2025, 21:03:49
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
autoit
lumma
stealer
loader
autoit-loader
amadey
botnet
Indicators:
MIME: application/x-7z-compressed
File info: 7-zip archive data, version 0.4
MD5:

3317340204A5527B3A94F4D8008C3CE3

SHA1:

133858758B775088CC44ED761BCD780348773D71

SHA256:

C1D3D9809E40C834D24AB7BDBF0B805ABD39DB59CFD494488CA479E4C16FDDBA

SSDEEP:

196608:jZW5VEYmksjjOGUDm40OTGUXobEmINHXP:j4EjjiDQOGUXobgP

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • AutoIt loader has been detected (YARA)

      • Council.com (PID: 7036)
    • LUMMA mutex has been found

      • Council.com (PID: 7036)
    • Steals credentials from Web Browsers

      • Council.com (PID: 7036)
    • Actions looks like stealing of personal data

      • Council.com (PID: 7036)
    • Run PowerShell with an invisible window

      • powershell.exe (PID: 7100)
    • AMADEY has been detected (SURICATA)

      • tgvazx.exe (PID: 680)
    • Connects to the CnC server

      • tgvazx.exe (PID: 680)
  • SUSPICIOUS

    • Using 'findstr.exe' to search for text patterns in files and output

      • cmd.exe (PID: 4268)
    • Reads security settings of Internet Explorer

      • intitle password site netflix filetype pdf.exe (PID: 6392)
      • 71YARTCUCXH40X7163Z9.exe (PID: 4560)
      • tgvazx.exe (PID: 680)
    • Get information on the list of running processes

      • cmd.exe (PID: 4268)
    • There is functionality for taking screenshot (YARA)

      • intitle password site netflix filetype pdf.exe (PID: 6392)
      • Council.com (PID: 7036)
    • Executing commands from a ".bat" file

      • intitle password site netflix filetype pdf.exe (PID: 6392)
    • Starts CMD.EXE for commands execution

      • intitle password site netflix filetype pdf.exe (PID: 6392)
      • cmd.exe (PID: 4268)
    • Application launched itself

      • cmd.exe (PID: 4268)
    • The executable file from the user directory is run by the CMD process

      • Council.com (PID: 7036)
    • Starts application with an unusual extension

      • cmd.exe (PID: 4268)
    • Starts the AutoIt3 executable file

      • cmd.exe (PID: 4268)
    • Connects to the server without a host name

      • Council.com (PID: 7036)
      • rundll32.exe (PID: 2772)
      • tgvazx.exe (PID: 680)
    • Potential Corporate Privacy Violation

      • Council.com (PID: 7036)
      • tgvazx.exe (PID: 680)
    • Process requests binary or script from the Internet

      • Council.com (PID: 7036)
      • tgvazx.exe (PID: 680)
    • Executable content was dropped or overwritten

      • Council.com (PID: 7036)
      • 71YARTCUCXH40X7163Z9.exe (PID: 4560)
      • tgvazx.exe (PID: 680)
    • Searches for installed software

      • Council.com (PID: 7036)
    • Starts itself from another location

      • 71YARTCUCXH40X7163Z9.exe (PID: 4560)
    • The process executes via Task Scheduler

      • tgvazx.exe (PID: 3020)
    • Starts POWERSHELL.EXE for commands execution

      • 22WQHXJG2QPB34PPI95MU.exe (PID: 896)
    • Connects to unusual port

      • 22WQHXJG2QPB34PPI95MU.exe (PID: 896)
    • Contacting a server suspected of hosting an CnC

      • tgvazx.exe (PID: 680)
  • INFO

    • Process checks computer location settings

      • intitle password site netflix filetype pdf.exe (PID: 6392)
      • 71YARTCUCXH40X7163Z9.exe (PID: 4560)
      • tgvazx.exe (PID: 680)
    • Manual execution by a user

      • intitle password site netflix filetype pdf.exe (PID: 6392)
      • WINWORD.EXE (PID: 6488)
    • Create files in a temporary directory

      • intitle password site netflix filetype pdf.exe (PID: 6392)
      • extrac32.exe (PID: 5228)
      • 71YARTCUCXH40X7163Z9.exe (PID: 4560)
      • Council.com (PID: 7036)
    • Reads the computer name

      • extrac32.exe (PID: 5228)
      • Council.com (PID: 7036)
      • intitle password site netflix filetype pdf.exe (PID: 6392)
      • 71YARTCUCXH40X7163Z9.exe (PID: 4560)
      • tgvazx.exe (PID: 680)
    • Checks supported languages

      • intitle password site netflix filetype pdf.exe (PID: 6392)
      • extrac32.exe (PID: 5228)
      • Council.com (PID: 7036)
      • 22WQHXJG2QPB34PPI95MU.exe (PID: 896)
      • 71YARTCUCXH40X7163Z9.exe (PID: 4560)
      • tgvazx.exe (PID: 680)
      • tgvazx.exe (PID: 3020)
    • Creates a new folder

      • cmd.exe (PID: 208)
    • Reads mouse settings

      • Council.com (PID: 7036)
    • Reads the software policy settings

      • slui.exe (PID: 1164)
      • slui.exe (PID: 5600)
      • Council.com (PID: 7036)
    • Checks proxy server information

      • slui.exe (PID: 5600)
      • tgvazx.exe (PID: 680)
      • rundll32.exe (PID: 2772)
    • Drops encrypted JS script (Microsoft Script Encoder)

      • 22WQHXJG2QPB34PPI95MU.exe (PID: 896)
    • Creates files or folders in the user directory

      • 22WQHXJG2QPB34PPI95MU.exe (PID: 896)
      • tgvazx.exe (PID: 680)
    • Changes the registry key values via Powershell

      • 22WQHXJG2QPB34PPI95MU.exe (PID: 896)
    • Reads security settings of Internet Explorer

      • rundll32.exe (PID: 2772)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.7z | 7-Zip compressed archive (v0.4) (57.1)
.7z | 7-Zip compressed archive (gen) (42.8)

EXIF

ZIP

FileVersion: 7z v0.04
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
163
Monitored processes
27
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe no specs sppextcomobj.exe no specs slui.exe intitle password site netflix filetype pdf.exe no specs cmd.exe no specs conhost.exe no specs tasklist.exe no specs findstr.exe no specs tasklist.exe no specs findstr.exe no specs cmd.exe no specs extrac32.exe no specs findstr.exe no specs cmd.exe no specs cmd.exe no specs #LUMMA council.com choice.exe no specs slui.exe 22wqhxjg2qpb34ppi95mu.exe 71yartcucxh40x7163z9.exe winword.exe ai.exe no specs #AMADEY tgvazx.exe powershell.exe no specs conhost.exe no specs tgvazx.exe no specs rundll32.exe

Process information

PID
CMD
Path
Indicators
Parent process
208cmd /c md 646867C:\Windows\SysWOW64\cmd.execmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
680"C:\Users\admin\AppData\Local\Temp\90876749ec\tgvazx.exe" C:\Users\admin\AppData\Local\Temp\90876749ec\tgvazx.exe
71YARTCUCXH40X7163Z9.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\appdata\local\temp\90876749ec\tgvazx.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
896"C:\Users\admin\AppData\Local\Temp\22WQHXJG2QPB34PPI95MU.exe"C:\Users\admin\AppData\Local\Temp\22WQHXJG2QPB34PPI95MU.exe
Council.com
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\appdata\local\temp\22wqhxjg2qpb34ppi95mu.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
1164"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
1328tasklist C:\Windows\SysWOW64\tasklist.execmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Lists the current running tasks
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\tasklist.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
2772"C:\Windows\System32\rundll32.exe" C:\Users\admin\AppData\Roaming\8de4e43376be4f\clip64.dll, MainC:\Windows\SysWOW64\rundll32.exe
tgvazx.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
3020"C:\Users\admin\AppData\Local\Temp\90876749ec\tgvazx.exe"C:\Users\admin\AppData\Local\Temp\90876749ec\tgvazx.exesvchost.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\90876749ec\tgvazx.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\user32.dll
c:\windows\syswow64\win32u.dll
3896findstr /V "STEEL" Softball C:\Windows\SysWOW64\findstr.execmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Find String (QGREP) Utility
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\findstr.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
3976\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exepowershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4268"C:\WINDOWS\System32\cmd.exe" /c copy Circles.wbk Circles.wbk.bat & Circles.wbk.batC:\Windows\SysWOW64\cmd.exeintitle password site netflix filetype pdf.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
Total events
18 253
Read events
17 954
Write events
275
Delete events
24

Modification events

(PID) Process:(5364) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface
Operation:writeName:ShowPassword
Value:
0
(PID) Process:(5364) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(5364) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(5364) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(5364) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\intitle password site netflix filetype pdf.7z
(PID) Process:(5364) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(5364) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(5364) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(5364) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(5364) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\MainWin
Operation:writeName:Placement
Value:
2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF3D0000002D000000FD03000016020000
Executable files
6
Suspicious files
51
Text files
9
Unknown types
0

Dropped files

PID
Process
Filename
Type
5364WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb5364.26942\intitle password site netflix filetype pdf.exe
MD5:
SHA256:
6392intitle password site netflix filetype pdf.exeC:\Users\admin\AppData\Local\Temp\Circles.wbktext
MD5:8287AA6E639598557F27C0A107EE922A
SHA256:B93F322980DDCC9F695C92EF8C863E5DC3E88238D5E2DF98231D003047458517
6392intitle password site netflix filetype pdf.exeC:\Users\admin\AppData\Local\Temp\Parties.wbkbinary
MD5:B31E00C275AEDFFCFC96B48C8490F7CB
SHA256:09161E2FB583EDAD6D2DE161BA8BAC084BE231EB95769D11794CBB50C711C794
6392intitle password site netflix filetype pdf.exeC:\Users\admin\AppData\Local\Temp\Cement.wbkbinary
MD5:7182AB6671881C7D9EB7F2F0B9621032
SHA256:1B10D7FD9492336DC12EF56CF60C6049090B707014B8A6C44AA3DFCF97A6FDF9
6392intitle password site netflix filetype pdf.exeC:\Users\admin\AppData\Local\Temp\Worse.wbkbinary
MD5:8C195D44EAC52809510F288FA45C2A4E
SHA256:3B0F43F6B89B273DBBCC16704BE19C0C9F8C0BFFCB009A67B168CA524B862C44
6392intitle password site netflix filetype pdf.exeC:\Users\admin\AppData\Local\Temp\Millions.wbkbinary
MD5:D6F3F678E1A2AA6B6FD199111F7B35F8
SHA256:894527BF3E0AC9B464118DA4F9E0216FE117EC4A267CA8D4187E7BA0F2D8FD3F
6392intitle password site netflix filetype pdf.exeC:\Users\admin\AppData\Local\Temp\Reduced.wbkbinary
MD5:11B393B636678F8C824F4E656EB6C20F
SHA256:508BA6AD8F976B504E1A63F07703FC7C87D189A333DC1D4903A1CABB8BCA2577
6392intitle password site netflix filetype pdf.exeC:\Users\admin\AppData\Local\Temp\Digital.wbkbinary
MD5:D324AD203EBC06EB5C12D5091ED39F04
SHA256:C561AAE89D6B53BE242317151A140AD06B27BD409598A99EBEE7FF440EE23372
6392intitle password site netflix filetype pdf.exeC:\Users\admin\AppData\Local\Temp\Disclaimer.wbkbinary
MD5:E319E68DA0C1655CD5817B075B369399
SHA256:583D5B6DAB929B1B79556CB655E0BCF5555D9EE6D3ABE204B4B2807B46107377
6392intitle password site netflix filetype pdf.exeC:\Users\admin\AppData\Local\Temp\Repeat.wbkbinary
MD5:3597CB5A9FF49EAD43749EA6B3BB9DA2
SHA256:981AA130B1FEC736354E08C9DD27BC86D7A26BE12F032448196C503D7EB2993F
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
14
TCP/UDP connections
49
DNS requests
29
Threats
12

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
GET
200
23.48.23.164:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
whitelisted
5428
SIHClient.exe
GET
200
23.52.120.96:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
whitelisted
5428
SIHClient.exe
GET
200
23.52.120.96:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
whitelisted
7036
Council.com
GET
200
195.82.146.34:80
http://195.82.146.34/888.exe
unknown
unknown
7036
Council.com
GET
200
195.82.146.34:80
http://195.82.146.34/AMA.exe
unknown
unknown
6544
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
whitelisted
6488
WINWORD.EXE
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA77flR%2B3w%2FxBpruV2lte6A%3D
unknown
whitelisted
6488
WINWORD.EXE
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEApDqVCbATUviZV57HIIulA%3D
unknown
whitelisted
5352
backgroundTaskHost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
whitelisted
680
tgvazx.exe
POST
200
195.82.147.98:80
http://195.82.147.98/0Bdh3sQpbD/index.php
unknown
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
whitelisted
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
23.48.23.164:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4
System
192.168.100.255:138
whitelisted
2104
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
3216
svchost.exe
172.211.123.248:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
5428
SIHClient.exe
52.149.20.212:443
slscr.update.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
5428
SIHClient.exe
23.52.120.96:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
5428
SIHClient.exe
52.165.164.15:443
fe3cr.delivery.mp.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
7036
Council.com
104.21.48.1:443
brightplf.digital
CLOUDFLARENET
unknown

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
whitelisted
crl.microsoft.com
  • 23.48.23.164
  • 23.48.23.177
  • 23.48.23.147
  • 23.48.23.173
  • 23.48.23.176
  • 23.48.23.194
  • 23.48.23.166
whitelisted
google.com
  • 172.217.16.206
whitelisted
client.wns.windows.com
  • 172.211.123.248
whitelisted
slscr.update.microsoft.com
  • 52.149.20.212
whitelisted
www.microsoft.com
  • 23.52.120.96
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 52.165.164.15
whitelisted
FRwWOmoAYaanjLlyvULB.FRwWOmoAYaanjLlyvULB
unknown
brightplf.digital
  • 104.21.48.1
  • 104.21.112.1
  • 104.21.32.1
  • 104.21.64.1
  • 104.21.16.1
  • 104.21.96.1
  • 104.21.80.1
unknown
activation-v2.sls.microsoft.com
  • 40.91.76.224
whitelisted

Threats

PID
Process
Class
Message
7036
Council.com
Potentially Bad Traffic
ET INFO Executable Download from dotted-quad Host
7036
Council.com
Potential Corporate Privacy Violation
ET INFO PE EXE or DLL Windows file download HTTP
7036
Council.com
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
7036
Council.com
Potentially Bad Traffic
ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response
7036
Council.com
Potentially Bad Traffic
ET INFO Executable Download from dotted-quad Host
680
tgvazx.exe
Malware Command and Control Activity Detected
BOTNET [ANY.RUN] Amadey HTTP POST Request (st=s)
680
tgvazx.exe
Malware Command and Control Activity Detected
ET MALWARE Amadey CnC Response
680
tgvazx.exe
Potentially Bad Traffic
ET INFO Dotted Quad Host DLL Request
680
tgvazx.exe
Potential Corporate Privacy Violation
ET INFO PE EXE or DLL Windows file download HTTP
680
tgvazx.exe
Misc activity
ET INFO Packed Executable Download
No debug info