File name:

Reminder.exe

Full analysis: https://app.any.run/tasks/db335a2b-98c3-4a30-b963-ef78e0117844
Verdict: Malicious activity
Threats:

Amadey is a formidable Windows infostealer threat, characterized by its persistence mechanisms, modular design, and ability to execute various malicious tasks.

Malware Trends Tracker     >>>
Analysis date: October 22, 2024, 00:36:22
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
amadey
botnet
stealer
rdp
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

D743BB6502147D38ADDB430590BC7A98

SHA1:

16CD70DD31FC54C0E42695441DBF3EAB5DE2E2BD

SHA256:

EBE565A1A2B13E3CBCF7BCC58EA8BEE81BD1ED2FED0E5977DC9E108EE8CBAE95

SSDEEP:

98304:rrq3BdwBsUBDPtvYZ6/vJsjSCPPuqV8aY/nsZLcGAXdO008HY/5UroTzROoF4XLC:nq6f1vJhz17PPH/idQZS8t8rt

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Antivirus name has been found in the command line (generic signature)

      • cmd.exe (PID: 6952)
      • tasklist.exe (PID: 1700)
      • find.exe (PID: 6168)
      • cmd.exe (PID: 4508)
      • tasklist.exe (PID: 3964)
      • find.exe (PID: 5264)
      • find.exe (PID: 6216)
      • cmd.exe (PID: 4676)
      • tasklist.exe (PID: 7152)
      • cmd.exe (PID: 5332)
      • tasklist.exe (PID: 2928)
      • tasklist.exe (PID: 6320)
      • find.exe (PID: 6848)
      • find.exe (PID: 7144)
      • cmd.exe (PID: 5160)

    • Starts CMD.EXE for self-deleting

      • Updater.exe (PID: 6952)

    • AMADEY has been detected (SURICATA)

      • MSBuild.exe (PID: 6124)

    • AMADEY has been detected (YARA)

      • MSBuild.exe (PID: 6124)

    • Changes the autorun value in the registry

      • Updater.exe (PID: 2736)

    • Connects to the CnC server

      • MSBuild.exe (PID: 6124)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • Reminder.tmp (PID: 6640)
      • Reminder.exe (PID: 5328)
      • Reminder.exe (PID: 6676)
      • Reminder.tmp (PID: 6664)
      • Updater.exe (PID: 2736)

    • Reads security settings of Internet Explorer

      • Reminder.tmp (PID: 6640)
      • Updater.exe (PID: 6952)
      • MSBuild.exe (PID: 6124)

    • Get information on the list of running processes

      • Reminder.tmp (PID: 6664)
      • cmd.exe (PID: 6952)
      • cmd.exe (PID: 4128)
      • cmd.exe (PID: 5160)
      • cmd.exe (PID: 4676)
      • cmd.exe (PID: 4508)
      • cmd.exe (PID: 5332)

    • Reads the Windows owner or organization settings

      • Reminder.tmp (PID: 6664)
      • Reminder.tmp (PID: 6640)

    • Starts CMD.EXE for commands execution

      • Reminder.tmp (PID: 6664)
      • Updater.exe (PID: 6952)

    • The executable file from the user directory is run by the CMD process

      • Updater.exe (PID: 2736)

    • Hides command output

      • cmd.exe (PID: 6464)

    • Runs PING.EXE to delay simulation

      • cmd.exe (PID: 6464)

    • Contacting a server suspected of hosting an CnC

      • MSBuild.exe (PID: 6124)

    • There is functionality for enable RDP (YARA)

      • MSBuild.exe (PID: 6124)

    • Connects to the server without a host name

      • MSBuild.exe (PID: 6124)

  • INFO

    • Create files in a temporary directory

      • Reminder.exe (PID: 5328)
      • Reminder.tmp (PID: 6640)
      • Reminder.exe (PID: 6676)
      • Reminder.tmp (PID: 6664)

    • Checks supported languages

      • Reminder.exe (PID: 5328)
      • Reminder.exe (PID: 6676)
      • Updater.exe (PID: 2736)
      • Reminder.tmp (PID: 6640)
      • Updater.exe (PID: 6952)
      • Reminder.tmp (PID: 6664)
      • MSBuild.exe (PID: 6124)

    • Reads the computer name

      • Reminder.tmp (PID: 6640)
      • Updater.exe (PID: 6952)
      • MSBuild.exe (PID: 6124)
      • Reminder.tmp (PID: 6664)

    • The process uses the downloaded file

      • Reminder.tmp (PID: 6640)
      • Updater.exe (PID: 6952)

    • Reads mouse settings

      • Updater.exe (PID: 6952)
      • Updater.exe (PID: 2736)

    • Process checks computer location settings

      • Updater.exe (PID: 6952)
      • Reminder.tmp (PID: 6640)

    • Reads Windows Product ID

      • Updater.exe (PID: 2736)

    • Reads the machine GUID from the registry

      • Updater.exe (PID: 6952)

    • Creates files in the program directory

      • Updater.exe (PID: 6952)

    • Checks proxy server information

      • MSBuild.exe (PID: 6124)

    • Creates files or folders in the user directory

      • Reminder.tmp (PID: 6664)

    • Reads CPU info

      • Updater.exe (PID: 2736)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Inno Setup installer (56.2)
.exe | Win32 EXE PECompact compressed (generic) (21.3)
.exe | Win32 EXE Yoda's Crypter (13.6)
.dll | Win32 Dynamic Link Library (generic) (3.3)
.exe | Win32 Executable (generic) (2.3)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:07:12 07:26:53+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 2.25
CodeSize: 685056
InitializedDataSize: 149504
UninitializedDataSize: -
EntryPoint: 0xa83bc
OSVersion: 6.1
ImageVersion: -
SubsystemVersion: 6.1
Subsystem: Windows GUI
FileVersionNumber: 3.2565.51.5
ProductVersionNumber: 3.2565.51.5
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: This installation was built with Inno Setup.
CompanyName: Acronis International GmbH
FileDescription: Acronis Media Builder
FileVersion: 29.1.1.41505
LegalCopyright: Acronis
OriginalFileName:
ProductName: Acronis True Image
ProductVersion: 29.1.1.41505
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
166
Monitored processes
34
Malicious processes
8
Suspicious processes
5

Behavior graph

Click at the process to see the details
start reminder.exe reminder.tmp reminder.exe reminder.tmp cmd.exe no specs conhost.exe no specs tasklist.exe no specs find.exe no specs cmd.exe no specs conhost.exe no specs tasklist.exe no specs find.exe no specs cmd.exe no specs conhost.exe no specs tasklist.exe no specs find.exe no specs cmd.exe no specs conhost.exe no specs tasklist.exe no specs find.exe no specs cmd.exe no specs conhost.exe no specs tasklist.exe no specs find.exe no specs cmd.exe no specs conhost.exe no specs tasklist.exe no specs find.exe no specs updater.exe no specs cmd.exe no specs conhost.exe no specs ping.exe no specs updater.exe #AMADEY msbuild.exe

Process information

PID
CMD
Path
Indicators
Parent process
1700tasklist /FI "IMAGENAME eq wrsa.exe" /FO CSV /NH C:\Windows\System32\tasklist.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Lists the current running tasks
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\tasklist.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
2736updater.exe C:\ProgramData\\Zq7Zebr.a3x C:\Users\admin\AppData\Local\coigned\Updater.exe
cmd.exe
User:
admin
Company:
AutoIt Team
Integrity Level:
MEDIUM
Description:
AutoIt v3 Script (Beta)
Exit code:
0
Version:
3, 3, 15, 1
Modules
Images
c:\users\admin\appdata\local\coigned\updater.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\psapi.dll
2928tasklist /FI "IMAGENAME eq sophoshealth.exe" /FO CSV /NH C:\Windows\System32\tasklist.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Lists the current running tasks
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\tasklist.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
3076\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
3128find /I "opssvc.exe"C:\Windows\System32\find.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Find String (grep) Utility
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\find.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ulib.dll
c:\windows\system32\fsutilext.dll
3648tasklist /FI "IMAGENAME eq opssvc.exe" /FO CSV /NH C:\Windows\System32\tasklist.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Lists the current running tasks
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\tasklist.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
3964tasklist /FI "IMAGENAME eq avgui.exe" /FO CSV /NH C:\Windows\System32\tasklist.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Lists the current running tasks
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\tasklist.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
4128"cmd.exe" /C tasklist /FI "IMAGENAME eq opssvc.exe" /FO CSV /NH | find /I "opssvc.exe"C:\Windows\System32\cmd.exe—Reminder.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
4508"cmd.exe" /C tasklist /FI "IMAGENAME eq avastui.exe" /FO CSV /NH | find /I "avastui.exe"C:\Windows\System32\cmd.exe—Reminder.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
4676"cmd.exe" /C tasklist /FI "IMAGENAME eq nswscsvc.exe" /FO CSV /NH | find /I "nswscsvc.exe"C:\Windows\System32\cmd.exe—Reminder.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
Total events
3 278
Read events
3 274
Write events
4
Delete events
0

Modification events

(PID) Process:(2736) Updater.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
Operation:writeName:fdeahdg
Value:
"C:\begcffd\AutoIt3.exe" C:\begcffd\fdeahdg.a3x
(PID) Process:(6124) MSBuild.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(6124) MSBuild.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(6124) MSBuild.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
Executable files
9
Suspicious files
6
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
6640Reminder.tmpC:\Users\admin\AppData\Local\Temp\is-HPB9T.tmp\_isetup\_isdecmp.dllexecutable
MD5:077CB4461A2767383B317EB0C50F5F13
SHA256:8287D0E287A66EE78537C8D1D98E426562B95C50F569B92CEA9CE36A9FA57E64
5328Reminder.exeC:\Users\admin\AppData\Local\Temp\is-3VJ84.tmp\Reminder.tmpexecutable
MD5:4BFB5A37DC6ACBC273CEB792408BFEC9
SHA256:E35B01344C6ABD6463439DC23A450C3ED5FA656778647CBEA070E1F6A4A9C906
6676Reminder.exeC:\Users\admin\AppData\Local\Temp\is-JI1I6.tmp\Reminder.tmpexecutable
MD5:4BFB5A37DC6ACBC273CEB792408BFEC9
SHA256:E35B01344C6ABD6463439DC23A450C3ED5FA656778647CBEA070E1F6A4A9C906
2736Updater.exeC:\begcffd\fdeahdg.a3xbinary
MD5:356418D32F4117C84B577BE53DC1BBF2
SHA256:0D8586DA0418EAD69F96ECC3A19BF61AF9A6F8BCC42602E0D6F00F80C5E6CAA1
6664Reminder.tmpC:\Users\admin\AppData\Local\Temp\is-V6VC8.tmp\_isetup\_isdecmp.dllexecutable
MD5:077CB4461A2767383B317EB0C50F5F13
SHA256:8287D0E287A66EE78537C8D1D98E426562B95C50F569B92CEA9CE36A9FA57E64
6664Reminder.tmpC:\Users\admin\AppData\Local\coigned\friendliwise.csvbinary
MD5:70AE9B8A733EAA5A6AC51F701F86F73D
SHA256:151EC6640A046099F9FF5CC3A19001ACBC2D1C4CC8BD8C8BB43BA598CCAC6681
6664Reminder.tmpC:\Users\admin\AppData\Local\coigned\is-IB9UT.tmpexecutable
MD5:3F58A517F1F4796225137E7659AD2ADB
SHA256:1DA298CAB4D537B0B7B5DABF09BFF6A212B9E45731E0CC772F99026005FB9E48
6664Reminder.tmpC:\Users\admin\AppData\Local\coigned\Updater.exeexecutable
MD5:3F58A517F1F4796225137E7659AD2ADB
SHA256:1DA298CAB4D537B0B7B5DABF09BFF6A212B9E45731E0CC772F99026005FB9E48
2736Updater.exeC:\begcffd\AutoIt3.exeexecutable
MD5:3F58A517F1F4796225137E7659AD2ADB
SHA256:1DA298CAB4D537B0B7B5DABF09BFF6A212B9E45731E0CC772F99026005FB9E48
6664Reminder.tmpC:\Users\admin\AppData\Local\coigned\is-MSFBF.tmpa3x
MD5:70AE9B8A733EAA5A6AC51F701F86F73D
SHA256:151EC6640A046099F9FF5CC3A19001ACBC2D1C4CC8BD8C8BB43BA598CCAC6681
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
11
TCP/UDP connections
65
DNS requests
20
Threats
6

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4360
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
5488
MoUsoCoreWorker.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5512
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
6124
MSBuild.exe
POST
200
152.89.198.124:80
http://152.89.198.124/8bdDsv3dk2FF/index.php
unknown
—
—
malicious
2776
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5488
MoUsoCoreWorker.exe
GET
200
23.48.23.156:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
7160
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
7160
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
6124
MSBuild.exe
POST
200
152.89.198.124:80
http://152.89.198.124/8bdDsv3dk2FF/index.php
unknown
—
—
malicious
6124
MSBuild.exe
POST
200
152.89.198.124:80
http://152.89.198.124/8bdDsv3dk2FF/index.php
unknown
—
—
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
6944
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1752
RUXIMICS.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5488
MoUsoCoreWorker.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4360
SearchApp.exe
104.126.37.145:443
www.bing.com
Akamai International B.V.
DE
whitelisted
4360
SearchApp.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2776
svchost.exe
20.190.159.71:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2776
svchost.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
4360
SearchApp.exe
104.126.37.131:443
www.bing.com
Akamai International B.V.
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 52.191.219.104
whitelisted
www.bing.com
  • 104.126.37.145
  • 104.126.37.131
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
google.com
  • 216.58.212.142
whitelisted
login.live.com
  • 20.190.159.71
  • 20.190.159.75
  • 20.190.159.64
  • 20.190.159.2
  • 40.126.31.67
  • 20.190.159.68
  • 20.190.159.23
  • 20.190.159.4
whitelisted
th.bing.com
  • 104.126.37.131
  • 104.126.37.145
whitelisted
go.microsoft.com
  • 184.30.17.189
whitelisted
crl.microsoft.com
  • 23.48.23.156
  • 23.48.23.143
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
arc.msn.com
  • 20.103.156.88
whitelisted

Threats

PID
Process
Class
Message
6124
MSBuild.exe
Misc Attack
ET DROP Spamhaus DROP Listed Traffic Inbound group 24
6124
MSBuild.exe
Malware Command and Control Activity Detected
BOTNET [ANY.RUN] Amadey HTTP POST Request (st=s)
6124
MSBuild.exe
Malware Command and Control Activity Detected
BOTNET [ANY.RUN] Amadey HTTP POST Request (st=s)
3 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Reminder.exe