File name:

_aa82b9c348f023063c6d83ca7f437f6374fc3d4ab039f253a0a56950a365446e.exe

Full analysis: https://app.any.run/tasks/4b92b98e-5d47-4f2f-ae8f-82337902acd2
Verdict: Malicious activity
Threats:

Amadey is a formidable Windows infostealer threat, characterized by its persistence mechanisms, modular design, and ability to execute various malicious tasks.

Malware Trends Tracker     >>>
Analysis date: July 24, 2025, 09:50:16
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
auto-reg
amadey
botnet
stealer
loader
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:

F7778FAB08EF250AE652AEF0F5333B6C

SHA1:

D9187036DDB060D7A300A44EF175E91026A796F7

SHA256:

AA82B9C348F023063C6D83CA7F437F6374FC3D4AB039F253A0A56950A365446E

SSDEEP:

6144:11PP7fgY4nalavzzPzg5xC/TkGVphuXjnlJA/9sfzzQuU9I+BuHiEsZ9znbJZ0Sh:DzfgYfKrg7eYGPhuXg+zu9IOZbZ2

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • fdx3r.exe (PID: 4476)

    • Uses Task Scheduler to run other applications

      • fdx3r.exe (PID: 4476)

    • AMADEY has been detected (YARA)

      • fdx3r.exe (PID: 4476)

    • AMADEY has been detected (SURICATA)

      • fdx3r.exe (PID: 4476)

    • Connects to the CnC server

      • fdx3r.exe (PID: 4476)

    • Actions looks like stealing of personal data

      • rundll32.exe (PID: 6664)

    • Steals credentials from Web Browsers

      • rundll32.exe (PID: 6664)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • _aa82b9c348f023063c6d83ca7f437f6374fc3d4ab039f253a0a56950a365446e.exe (PID: 3976)
      • fdx3r.exe (PID: 4476)

    • Executes application which crashes

      • _aa82b9c348f023063c6d83ca7f437f6374fc3d4ab039f253a0a56950a365446e.exe (PID: 3976)
      • fdx3r.exe (PID: 4476)
      • fdx3r.exe (PID: 3160)
      • fdx3r.exe (PID: 4168)

    • Starts itself from another location

      • _aa82b9c348f023063c6d83ca7f437f6374fc3d4ab039f253a0a56950a365446e.exe (PID: 3976)

    • Reads security settings of Internet Explorer

      • _aa82b9c348f023063c6d83ca7f437f6374fc3d4ab039f253a0a56950a365446e.exe (PID: 3976)
      • fdx3r.exe (PID: 4476)

    • Starts CMD.EXE for commands execution

      • fdx3r.exe (PID: 4476)
      • cmd.exe (PID: 888)

    • Application launched itself

      • cmd.exe (PID: 888)

    • Uses ICACLS.EXE to modify access control lists

      • cmd.exe (PID: 888)

    • Connects to the server without a host name

      • fdx3r.exe (PID: 4476)
      • rundll32.exe (PID: 6664)

    • There is functionality for taking screenshot (YARA)

      • fdx3r.exe (PID: 4476)

    • Contacting a server suspected of hosting an CnC

      • fdx3r.exe (PID: 4476)

    • The process executes via Task Scheduler

      • fdx3r.exe (PID: 3160)
      • fdx3r.exe (PID: 4168)

    • Process requests binary or script from the Internet

      • fdx3r.exe (PID: 4476)

    • Potential Corporate Privacy Violation

      • fdx3r.exe (PID: 4476)

    • Uses RUNDLL32.EXE to load library

      • rundll32.exe (PID: 4528)

    • Loads DLL from Mozilla Firefox

      • rundll32.exe (PID: 6664)

  • INFO

    • Creates files or folders in the user directory

      • WerFault.exe (PID: 2148)
      • WerFault.exe (PID: 5744)
      • WerFault.exe (PID: 5348)
      • WerFault.exe (PID: 6664)
      • WerFault.exe (PID: 1588)
      • WerFault.exe (PID: 3720)
      • WerFault.exe (PID: 1944)
      • WerFault.exe (PID: 3620)
      • WerFault.exe (PID: 1204)
      • WerFault.exe (PID: 4688)
      • WerFault.exe (PID: 7032)
      • WerFault.exe (PID: 2464)
      • WerFault.exe (PID: 2692)
      • WerFault.exe (PID: 6412)
      • WerFault.exe (PID: 6780)
      • WerFault.exe (PID: 4084)
      • WerFault.exe (PID: 4912)
      • WerFault.exe (PID: 4820)
      • WerFault.exe (PID: 2980)
      • WerFault.exe (PID: 4544)
      • WerFault.exe (PID: 6656)
      • WerFault.exe (PID: 1380)
      • WerFault.exe (PID: 1872)
      • WerFault.exe (PID: 5528)
      • fdx3r.exe (PID: 4476)
      • WerFault.exe (PID: 2348)
      • WerFault.exe (PID: 5848)
      • WerFault.exe (PID: 5528)
      • WerFault.exe (PID: 6180)
      • WerFault.exe (PID: 3100)
      • WerFault.exe (PID: 504)

    • Checks supported languages

      • _aa82b9c348f023063c6d83ca7f437f6374fc3d4ab039f253a0a56950a365446e.exe (PID: 3976)
      • fdx3r.exe (PID: 4476)
      • fdx3r.exe (PID: 3160)
      • fdx3r.exe (PID: 4168)
      • tar.exe (PID: 2120)

    • Create files in a temporary directory

      • _aa82b9c348f023063c6d83ca7f437f6374fc3d4ab039f253a0a56950a365446e.exe (PID: 3976)
      • fdx3r.exe (PID: 4476)
      • tar.exe (PID: 2120)

    • Reads the computer name

      • _aa82b9c348f023063c6d83ca7f437f6374fc3d4ab039f253a0a56950a365446e.exe (PID: 3976)
      • fdx3r.exe (PID: 4476)

    • Launching a file from a Registry key

      • fdx3r.exe (PID: 4476)

    • Process checks computer location settings

      • _aa82b9c348f023063c6d83ca7f437f6374fc3d4ab039f253a0a56950a365446e.exe (PID: 3976)
      • fdx3r.exe (PID: 4476)

    • Checks proxy server information

      • WerFault.exe (PID: 3620)
      • fdx3r.exe (PID: 4476)
      • WerFault.exe (PID: 2348)
      • rundll32.exe (PID: 6664)
      • WerFault.exe (PID: 3100)
      • slui.exe (PID: 5824)

    • Reads the software policy settings

      • WerFault.exe (PID: 3620)
      • WerFault.exe (PID: 2348)
      • WerFault.exe (PID: 3100)
      • slui.exe (PID: 5824)

    • Reads security settings of Internet Explorer

      • rundll32.exe (PID: 6664)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Amadey

(PID) Process(4476) fdx3r.exe
C2 (1)http://212.118.43.106
Version3.67
Options
Drop directory416acdeed8
Drop nameknuus.exe
Strings (116)SCHTASKS
/Create /SC MINUTE /MO 1 /TN
/TR "
" /F
SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
Startup
Rem
cmd /C RMDIR /s/q
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
rundll32
/Delete /TN "
Programs
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
%USERPROFILE%
\App
POST
GET
id=
&vs=
&sd=
&os=
&bi=
&ar=
&pc=
&un=
&dm=
&av=
&lv=
&og=
cred.dll|clip.dll|
d1
e1
e0
Main
http://
https://
exe
dll
cmd
ps1
<c>
<d>
Plugins/
+++
#
|
&unit=
=
shell32.dll
kernel32.dll
GetNativeSystemInfo
ProgramData\
AVAST Software
Avira
Kaspersky Lab
ESET
Panda Security
Doctor Web
AVG
360TotalSecurity
Bitdefender
Norton
Sophos
Comodo
WinDefender
0123456789
rb
wb
Content-Type: multipart/form-data; boundary=----
------
Content-Disposition: form-data; name="data"; filename="
" Content-Type: application/octet-stream
------
--
?scr=1
.jpg
Content-Type: application/x-www-form-urlencoded
SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName
ComputerName
abcdefghijklmnopqrstuvwxyz0123456789-_
-unicode-
SYSTEM\CurrentControlSet\Control\UnitedVideo\CONTROL\VIDEO\
SYSTEM\ControlSet001\Services\BasicDisplay\Video
VideoID
\0000
DefaultSettings.XResolution
DefaultSettings.YResolution
SOFTWARE\Microsoft\Windows NT\CurrentVersion
ProductName
2019
2022
2016
CurrentBuild
&&
echo Y|CACLS "
" /P "
:N"
CACLS "
" /P "
:R" /E
:F" /E
&&Exit
..\
\
:::
rundll32.exe
/k
"taskkill /f /im "
" && timeout 1 && del
&& Exit"
" && ren
&&
Powershell.exe
-executionpolicy remotesigned -File "
"
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (76.4)
.exe | Win32 Executable (generic) (12.4)
.exe | Generic Win/DOS Executable (5.5)
.exe | DOS Executable Generic (5.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2022:05:06 19:26:14+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 9
CodeSize: 97792
InitializedDataSize: 41594880
UninitializedDataSize: -
EntryPoint: 0x27c5000
OSVersion: 5
ImageVersion: -
SubsystemVersion: 5
Subsystem: Windows GUI
FileVersionNumber: 10.0.0.0
ProductVersionNumber: 84.0.0.0
FileFlagsMask: 0x192a
FileFlags: (none)
FileOS: Unknown (0x20461)
ObjectFileType: Unknown
FileSubtype: -
LanguageCode: Dutch
CharacterSet: Unknown (01F4)
FilesVersion: 93.84.7.37
InternalNames: HlameProduction
ProductName: HyperV
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
210
Monitored processes
49
Malicious processes
4
Suspicious processes
1

Behavior graph

Click at the process to see the details
start _aa82b9c348f023063c6d83ca7f437f6374fc3d4ab039f253a0a56950a365446e.exe werfault.exe no specs werfault.exe no specs werfault.exe no specs werfault.exe no specs werfault.exe no specs werfault.exe no specs #AMADEY fdx3r.exe werfault.exe werfault.exe no specs werfault.exe no specs werfault.exe no specs werfault.exe no specs werfault.exe no specs werfault.exe no specs werfault.exe no specs schtasks.exe no specs conhost.exe no specs werfault.exe no specs werfault.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs werfault.exe no specs cacls.exe no specs cacls.exe no specs cmd.exe no specs cacls.exe no specs cacls.exe no specs werfault.exe no specs werfault.exe no specs werfault.exe no specs werfault.exe no specs werfault.exe no specs werfault.exe no specs werfault.exe no specs fdx3r.exe werfault.exe werfault.exe no specs slui.exe werfault.exe no specs rundll32.exe no specs rundll32.exe werfault.exe no specs tar.exe no specs conhost.exe no specs fdx3r.exe werfault.exe werfault.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
504C:\WINDOWS\SysWOW64\WerFault.exe -u -p 4476 -s 1456C:\Windows\SysWOW64\WerFault.exe—fdx3r.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
888"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "fdx3r.exe" /P "admin:N"&&CACLS "fdx3r.exe" /P "admin:R" /E&&echo Y|CACLS "..\iqsyocyocw" /P "admin:N"&&CACLS "..\iqsyocyocw" /P "admin:R" /E&&ExitC:\Windows\SysWOW64\cmd.exe—fdx3r.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
1148CACLS "fdx3r.exe" /P "admin:N"C:\Windows\SysWOW64\cacls.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Control ACLs Program
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cacls.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
1204C:\WINDOWS\SysWOW64\WerFault.exe -u -p 4476 -s 944C:\Windows\SysWOW64\WerFault.exe—fdx3r.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
1380C:\WINDOWS\SysWOW64\WerFault.exe -u -p 4476 -s 600C:\Windows\SysWOW64\WerFault.exe—fdx3r.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
1588C:\WINDOWS\SysWOW64\WerFault.exe -u -p 3976 -s 904C:\Windows\SysWOW64\WerFault.exe—_aa82b9c348f023063c6d83ca7f437f6374fc3d4ab039f253a0a56950a365446e.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
1636CACLS "..\iqsyocyocw" /P "admin:N"C:\Windows\SysWOW64\cacls.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Control ACLs Program
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cacls.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
1872C:\WINDOWS\SysWOW64\WerFault.exe -u -p 4476 -s 616C:\Windows\SysWOW64\WerFault.exe—fdx3r.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
1944C:\WINDOWS\SysWOW64\WerFault.exe -u -p 4476 -s 760C:\Windows\SysWOW64\WerFault.exe—fdx3r.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
2120tar.exe -cf "C:\Users\admin\AppData\Local\Temp\693682860607_Desktop.tar" "C:\Users\admin\AppData\Local\Temp\_Files_\*.*"C:\Windows\System32\tar.exe—rundll32.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
bsdtar archive tool
Exit code:
0
Version:
3.5.2 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\tar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\archiveint.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\cryptsp.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\msvcrt.dll
Total events
67 544
Read events
67 537
Write events
7
Delete events
0

Modification events

(PID) Process:(4476) fdx3r.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
Operation:writeName:Startup
Value:
C:\Users\admin\AppData\Local\Temp\iqsyocyocw\
(PID) Process:(4476) fdx3r.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(4476) fdx3r.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(4476) fdx3r.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(6664) rundll32.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(6664) rundll32.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(6664) rundll32.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
Executable files
3
Suspicious files
0
Text files
62
Unknown types
59

Dropped files

PID
Process
Filename
Type
2148WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash__aa82b9c348f0230_29935e437b7cdcb28ff4546e4449446a7f93e76_21053545_b2d58fc3-e3a6-4b34-a541-fd41936b4559\Report.wer —
MD5:—
SHA256:—
5744WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash__aa82b9c348f0230_29935e437b7cdcb28ff4546e4449446a7f93e76_21053545_e4522a71-373e-4d2f-9f8b-3f6456c2df8b\Report.wer —
MD5:—
SHA256:—
5348WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash__aa82b9c348f0230_29935e437b7cdcb28ff4546e4449446a7f93e76_21053545_d9adeea4-240c-4892-8009-63968dfc40a5\Report.wer —
MD5:—
SHA256:—
6664WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash__aa82b9c348f0230_29935e437b7cdcb28ff4546e4449446a7f93e76_21053545_89830bf1-2fd9-49c7-a899-30d8dd991616\Report.wer —
MD5:—
SHA256:—
6664WerFault.exeC:\Users\admin\AppData\Local\CrashDumps\_aa82b9c348f023063c6d83ca7f437f6374fc3d4ab039f253a0a56950a365446e.exe(3).3976.dmpdmp
MD5:CE79F24821ADDDC221FFA9CEF8863758
SHA256:539B5C112D343825EBC2425B582C8FF8004E71D78CF8420C826B0B026E6E7784
1588WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash__aa82b9c348f0230_29935e437b7cdcb28ff4546e4449446a7f93e76_21053545_75f276a2-7dd7-40d0-a959-39f8d7c1bec1\Report.wer —
MD5:—
SHA256:—
2148WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WERE27C.tmp.WERInternalMetadata.xmlxml
MD5:2B3A102A86B4DC735D2A70FE8BDDAA8C
SHA256:0F44A1CE806BD9F5751508FB3BA947D4D15913F84873520991AF5FB561F16BC0
5744WerFault.exeC:\Users\admin\AppData\Local\CrashDumps\_aa82b9c348f023063c6d83ca7f437f6374fc3d4ab039f253a0a56950a365446e.exe(1).3976.dmpdmp
MD5:44785591868F9BDC9415CD1A234CF80F
SHA256:9F8B15C4A3B47248E370C1B4E979CF0180065D0B88C600A6BC30FC6DE1BC02FB
2148WerFault.exeC:\Users\admin\AppData\Local\CrashDumps\_aa82b9c348f023063c6d83ca7f437f6374fc3d4ab039f253a0a56950a365446e.exe.3976.dmpdmp
MD5:89FB714D7C1AA0C67ED410A6A7EEB997
SHA256:BCDA56B5C04B369F96E980D33D6C839837D80797A3BC2FB0B7230CB38EF2458F
6664WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WERE9B1.tmp.xmlxml
MD5:B1DE1FEAB2315E31006C31DE2B63A300
SHA256:631C5231239FA0C5D39826815E0A0850686147C5715508A6415D1F5717156873
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
12
TCP/UDP connections
28
DNS requests
11
Threats
11

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5944
MoUsoCoreWorker.exe
GET
200
23.216.77.39:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5944
MoUsoCoreWorker.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6584
RUXIMICS.exe
GET
200
23.216.77.39:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6584
RUXIMICS.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
4476
fdx3r.exe
POST
200
196.251.81.176:80
http://196.251.81.176/dF30Hn4m/index.php
unknown
—
—
malicious
4476
fdx3r.exe
POST
200
196.251.81.176:80
http://196.251.81.176/dF30Hn4m/index.php?scr=1
unknown
—
—
malicious
—
—
POST
500
20.83.72.98:443
https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail
unknown
xml
512 b
whitelisted
4476
fdx3r.exe
GET
404
196.251.81.176:80
http://196.251.81.176/dF30Hn4m/Plugins/clip64.dll
unknown
—
—
malicious
4476
fdx3r.exe
GET
200
196.251.81.176:80
http://196.251.81.176/dF30Hn4m/Plugins/cred64.dll
unknown
—
—
malicious
2940
svchost.exe
GET
200
72.246.169.163:80
http://x1.c.lencr.org/
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
5944
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6584
RUXIMICS.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1268
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
3620
WerFault.exe
135.233.45.223:443
watson.events.data.microsoft.com
LUCENT-CIO
US
whitelisted
5944
MoUsoCoreWorker.exe
23.216.77.39:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
6584
RUXIMICS.exe
23.216.77.39:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5944
MoUsoCoreWorker.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
  • 51.124.78.146
whitelisted
google.com
  • 142.250.185.110
whitelisted
watson.events.data.microsoft.com
  • 135.233.45.223
  • 13.89.179.12
whitelisted
crl.microsoft.com
  • 23.216.77.39
  • 23.216.77.7
  • 23.216.77.43
  • 23.216.77.27
  • 23.216.77.25
  • 23.216.77.11
  • 23.216.77.8
  • 23.216.77.41
  • 23.216.77.13
whitelisted
www.microsoft.com
  • 95.101.149.131
whitelisted
self.events.data.microsoft.com
  • 20.189.173.9
whitelisted
activation-v2.sls.microsoft.com
  • 40.91.76.224
whitelisted
x1.c.lencr.org
  • 72.246.169.163
whitelisted

Threats

PID
Process
Class
Message
4476
fdx3r.exe
Misc Attack
ET DROP Spamhaus DROP Listed Traffic Inbound group 44
4476
fdx3r.exe
A Network Trojan was detected
ET MALWARE Amadey Bot Activity (POST) M1
4476
fdx3r.exe
Misc activity
SUSPICIOUS [ANY.RUN] Sent Host Name in HTTP POST Body
4476
fdx3r.exe
Malware Command and Control Activity Detected
ET MALWARE Amadey CnC Check-In
4476
fdx3r.exe
A Network Trojan was detected
ET MALWARE Win32/Amadey Bot Activity (POST) M2
4476
fdx3r.exe
Potentially Bad Traffic
ET INFO Dotted Quad Host DLL Request
4476
fdx3r.exe
Potential Corporate Privacy Violation
ET INFO PE EXE or DLL Windows file download HTTP
4476
fdx3r.exe
A Network Trojan was detected
BOTNET [ANY.RUN] Amadey Stealer plugin download request
4476
fdx3r.exe
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
4476
fdx3r.exe
Potentially Bad Traffic
ET INFO Dotted Quad Host DLL Request
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
_aa82b9c348f023063c6d83ca7f437f6374fc3d4ab039f253a0a56950a365446e.exe