File name:

a3e22c15b300c6a2902800a127e2a364f0c5707041acdf9851e8c77407e963a3

Full analysis: https://app.any.run/tasks/b0a2c11a-206f-4164-ab16-79c297d37d03
Verdict: Malicious activity
Threats:

Amadey is a formidable Windows infostealer threat, characterized by its persistence mechanisms, modular design, and ability to execute various malicious tasks.

Malware Trends Tracker     >>>
Analysis date: August 21, 2025, 00:28:44
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
amadey
themida
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 7 sections
MD5:

2D0066CC4ED344E8330D9DCB9F8CA385

SHA1:

78BD228D8DBE0B7DB0D74F2630ADFC051740743F

SHA256:

A3E22C15B300C6A2902800A127E2A364F0C5707041ACDF9851E8C77407E963A3

SSDEEP:

98304:IF5rGsFTdJMa66AtN/HwTSk3XJ6jwVzOuLQ2xQEo7aS1YyWfakdZmj4eD2agpOkY:aC

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • AMADEY mutex has been found

      • a3e22c15b300c6a2902800a127e2a364f0c5707041acdf9851e8c77407e963a3.exe (PID: 5552)
      • explorgu.exe (PID: 3160)

    • AMADEY has been detected (YARA)

      • explorgu.exe (PID: 3160)

  • SUSPICIOUS

    • Reads the BIOS version

      • a3e22c15b300c6a2902800a127e2a364f0c5707041acdf9851e8c77407e963a3.exe (PID: 5552)
      • explorgu.exe (PID: 3160)

    • Reads security settings of Internet Explorer

      • a3e22c15b300c6a2902800a127e2a364f0c5707041acdf9851e8c77407e963a3.exe (PID: 5552)
      • explorgu.exe (PID: 3160)

    • The process executes via Task Scheduler

      • explorgu.exe (PID: 3160)

  • INFO

    • Checks supported languages

      • a3e22c15b300c6a2902800a127e2a364f0c5707041acdf9851e8c77407e963a3.exe (PID: 5552)
      • explorgu.exe (PID: 3160)

    • Create files in a temporary directory

      • a3e22c15b300c6a2902800a127e2a364f0c5707041acdf9851e8c77407e963a3.exe (PID: 5552)

    • Reads the computer name

      • a3e22c15b300c6a2902800a127e2a364f0c5707041acdf9851e8c77407e963a3.exe (PID: 5552)
      • explorgu.exe (PID: 3160)

    • Checks proxy server information

      • explorgu.exe (PID: 3160)

    • Creates files or folders in the user directory

      • explorgu.exe (PID: 3160)

    • Themida protector has been detected

      • explorgu.exe (PID: 3160)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Amadey

(PID) Process(3160) explorgu.exe
C2185.215.113.32
URLhttp://185.215.113.32/yandex/index.php
Version4.17
Options
Drop directory00c07260dc
Drop nameexplorgu.exe
Strings (112)AVG
SOFTWARE\Microsoft\Windows NT\CurrentVersion
%-lu
kernel32.dll
e1
dll
pc:
explorgu.exe
ProductName
:::
st=s
id:
Powershell.exe
e0
0123456789
"
DefaultSettings.YResolution
https://
av:
&&
WinDefender
Content-Type: multipart/form-data; boundary=----
og:
ComputerName
d1
?scr=1
/Plugins/
/yandex/index.php
DefaultSettings.XResolution
Comodo
" && ren
<d>
" Content-Type: application/octet-stream
|
2019
Panda Security
360TotalSecurity
Content-Disposition: form-data; name="data"; filename="
\
-%lu
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
shell32.dll
CurrentBuild
AVAST Software
GET
Avira
Norton
00c07260dc
Rem
rb
exe
Kaspersky Lab
ar:
S-%lu-
dm:
------
http://
wb
rundll32.exe
&unit=
<c>
cmd
185.215.113.32
2016
bi:
rundll32
Bitdefender
+++
r=
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
" && timeout 1 && del
2022
.jpg
SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName
GetNativeSystemInfo
abcdefghijklmnopqrstuvwxyz0123456789-_
------
=
SYSTEM\CurrentControlSet\Control\UnitedVideo\CONTROL\VIDEO\
ProgramData\
4.17
Content-Type: application/x-www-form-urlencoded
cred.dll|clip.dll|
un:
ps1
SYSTEM\ControlSet001\Services\BasicDisplay\Video
-unicode-
lv:
os:
-executionpolicy remotesigned -File "
shutdown -s -t 0
#
Main
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
VideoID
POST
&& Exit"
Doctor Web
\0000
\App
/k
%USERPROFILE%
ESET
cmd /C RMDIR /s/q
SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
--
sd:
vs:
"taskkill /f /im "
Startup
Sophos
Programs
No Malware configuration.

TRiD

.dll | Win32 Dynamic Link Library (generic) (43.5)
.exe | Win32 Executable (generic) (29.8)
.exe | Generic Win/DOS Executable (13.2)
.exe | DOS Executable Generic (13.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:02:04 15:51:37+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14.24
CodeSize: 318464
InitializedDataSize: 104960
UninitializedDataSize: -
EntryPoint: 0x4cf000
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
138
Monitored processes
3
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start a3e22c15b300c6a2902800a127e2a364f0c5707041acdf9851e8c77407e963a3.exe #AMADEY explorgu.exe slui.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3160"C:\Users\admin\AppData\Local\Temp\00c07260dc\explorgu.exe"C:\Users\admin\AppData\Local\Temp\00c07260dc\explorgu.exe
svchost.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\appdata\local\temp\00c07260dc\explorgu.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
Amadey
(PID) Process(3160) explorgu.exe
C2185.215.113.32
URLhttp://185.215.113.32/yandex/index.php
Version4.17
Options
Drop directory00c07260dc
Drop nameexplorgu.exe
Strings (112)AVG
SOFTWARE\Microsoft\Windows NT\CurrentVersion
%-lu
kernel32.dll
e1
dll
pc:
explorgu.exe
ProductName
:::
st=s
id:
Powershell.exe
e0
0123456789
"
DefaultSettings.YResolution
https://
av:
&&
WinDefender
Content-Type: multipart/form-data; boundary=----
og:
ComputerName
d1
?scr=1
/Plugins/
/yandex/index.php
DefaultSettings.XResolution
Comodo
" && ren
<d>
" Content-Type: application/octet-stream
|
2019
Panda Security
360TotalSecurity
Content-Disposition: form-data; name="data"; filename="
\
-%lu
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
shell32.dll
CurrentBuild
AVAST Software
GET
Avira
Norton
00c07260dc
Rem
rb
exe
Kaspersky Lab
ar:
S-%lu-
dm:
------
http://
wb
rundll32.exe
&unit=
<c>
cmd
185.215.113.32
2016
bi:
rundll32
Bitdefender
+++
r=
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
" && timeout 1 && del
2022
.jpg
SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName
GetNativeSystemInfo
abcdefghijklmnopqrstuvwxyz0123456789-_
------
=
SYSTEM\CurrentControlSet\Control\UnitedVideo\CONTROL\VIDEO\
ProgramData\
4.17
Content-Type: application/x-www-form-urlencoded
cred.dll|clip.dll|
un:
ps1
SYSTEM\ControlSet001\Services\BasicDisplay\Video
-unicode-
lv:
os:
-executionpolicy remotesigned -File "
shutdown -s -t 0
#
Main
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
VideoID
POST
&& Exit"
Doctor Web
\0000
\App
/k
%USERPROFILE%
ESET
cmd /C RMDIR /s/q
SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
--
sd:
vs:
"taskkill /f /im "
Startup
Sophos
Programs
5552"C:\Users\admin\AppData\Local\Temp\a3e22c15b300c6a2902800a127e2a364f0c5707041acdf9851e8c77407e963a3.exe" C:\Users\admin\AppData\Local\Temp\a3e22c15b300c6a2902800a127e2a364f0c5707041acdf9851e8c77407e963a3.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\a3e22c15b300c6a2902800a127e2a364f0c5707041acdf9851e8c77407e963a3.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
6160C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
Total events
851
Read events
848
Write events
3
Delete events
0

Modification events

(PID) Process:(3160) explorgu.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(3160) explorgu.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(3160) explorgu.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
Executable files
1
Suspicious files
1
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
5552a3e22c15b300c6a2902800a127e2a364f0c5707041acdf9851e8c77407e963a3.exeC:\Windows\Tasks\explorgu.jobbinary
MD5:C72CC1C9D8C125A5CEDFD69E08D5E1E1
SHA256:81DBD91BC1E837D07F9830F1ECF491B1D9BBA85230213802BC73E3F248E8C0C1
5552a3e22c15b300c6a2902800a127e2a364f0c5707041acdf9851e8c77407e963a3.exeC:\Users\admin\AppData\Local\Temp\00c07260dc\explorgu.exeexecutable
MD5:2D0066CC4ED344E8330D9DCB9F8CA385
SHA256:A3E22C15B300C6A2902800A127E2A364F0C5707041ACDF9851E8C77407E963A3
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
24
DNS requests
14
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6356
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
23.216.77.6:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6508
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
6508
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1268
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
4844
RUXIMICS.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5944
MoUsoCoreWorker.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
6356
svchost.exe
20.190.159.75:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6356
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
1268
svchost.exe
23.216.77.6:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
1268
svchost.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
3160
explorgu.exe
185.215.113.32:80
—
1337team Limited
SC
malicious

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
whitelisted
google.com
  • 216.58.212.142
whitelisted
login.live.com
  • 20.190.159.75
  • 40.126.31.71
  • 20.190.159.131
  • 40.126.31.3
  • 20.190.159.64
  • 40.126.31.2
  • 20.190.159.4
  • 20.190.159.130
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
crl.microsoft.com
  • 23.216.77.6
  • 23.216.77.28
whitelisted
www.microsoft.com
  • 23.35.229.160
whitelisted
slscr.update.microsoft.com
  • 74.178.76.128
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 40.69.42.241
whitelisted
self.events.data.microsoft.com
  • 13.69.239.78
whitelisted
activation-v2.sls.microsoft.com
  • 20.83.72.98
whitelisted

Threats

No threats detected
Process
Message
a3e22c15b300c6a2902800a127e2a364f0c5707041acdf9851e8c77407e963a3.exe
%s------------------------------------------------ --- Themida Professional --- --- (c)2012 Oreans Technologies --- ------------------------------------------------
explorgu.exe
%s------------------------------------------------ --- Themida Professional --- --- (c)2012 Oreans Technologies --- ------------------------------------------------
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
a3e22c15b300c6a2902800a127e2a364f0c5707041acdf9851e8c77407e963a3