File name:

2025-08-03_6d53b017597ff64ba6d1db9394bb4cf1_amadey_darkgate_elex_hellokitty_mafia_smoke-loader_stop.exe

Full analysis: https://app.any.run/tasks/b7135485-619b-4246-ace8-51b057ffff43
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: August 03, 2025, 02:46:31
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
vmprotect
loader
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 7 sections
MD5:

6D53B017597FF64BA6D1DB9394BB4CF1

SHA1:

25FA0DEFEA1FA5C44DD814A67AACEFAA4F23F27D

SHA256:

62E9E6936ED01B74AD76AB02A073A87F4694D326ECBD2407043F55B8028330B8

SSDEEP:

98304:gwgpCpFMWlu8yqhnz0FTON83Ctfa5PXH0CQYEqZdOt+0zPDFfFYNKj5jYAwWHgp8:2x011j

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was injected by another process

      • explorer.exe (PID: 4772)

    • Runs injected code in another process

      • 2025-08-03_6d53b017597ff64ba6d1db9394bb4cf1_amadey_darkgate_elex_hellokitty_mafia_smoke-loader_stop.exe (PID: 6340)

    • Starts CMD.EXE for self-deleting

      • 2025-08-03_6d53b017597ff64ba6d1db9394bb4cf1_amadey_darkgate_elex_hellokitty_mafia_smoke-loader_stop.exe (PID: 6340)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • 2025-08-03_6d53b017597ff64ba6d1db9394bb4cf1_amadey_darkgate_elex_hellokitty_mafia_smoke-loader_stop.exe (PID: 2880)
      • 2025-08-03_6d53b017597ff64ba6d1db9394bb4cf1_amadey_darkgate_elex_hellokitty_mafia_smoke-loader_stop.exe (PID: 6340)
      • wiaacmgr.exe (PID: 1148)

    • Drops a system driver (possible attempt to evade defenses)

      • 2025-08-03_6d53b017597ff64ba6d1db9394bb4cf1_amadey_darkgate_elex_hellokitty_mafia_smoke-loader_stop.exe (PID: 2880)
      • 2025-08-03_6d53b017597ff64ba6d1db9394bb4cf1_amadey_darkgate_elex_hellokitty_mafia_smoke-loader_stop.exe (PID: 6340)
      • wiaacmgr.exe (PID: 1148)

    • Application launched itself

      • 2025-08-03_6d53b017597ff64ba6d1db9394bb4cf1_amadey_darkgate_elex_hellokitty_mafia_smoke-loader_stop.exe (PID: 2880)

    • Creates files in the driver directory

      • 2025-08-03_6d53b017597ff64ba6d1db9394bb4cf1_amadey_darkgate_elex_hellokitty_mafia_smoke-loader_stop.exe (PID: 6340)

    • Reads security settings of Internet Explorer

      • 2025-08-03_6d53b017597ff64ba6d1db9394bb4cf1_amadey_darkgate_elex_hellokitty_mafia_smoke-loader_stop.exe (PID: 2880)
      • 2025-08-03_6d53b017597ff64ba6d1db9394bb4cf1_amadey_darkgate_elex_hellokitty_mafia_smoke-loader_stop.exe (PID: 6340)
      • wiaacmgr.exe (PID: 1148)

    • Creates file in the systems drive root

      • wiaacmgr.exe (PID: 1148)

    • Process requests binary or script from the Internet

      • wiaacmgr.exe (PID: 1148)

    • Uses TIMEOUT.EXE to delay execution

      • cmd.exe (PID: 6840)

    • Starts CMD.EXE for commands execution

      • 2025-08-03_6d53b017597ff64ba6d1db9394bb4cf1_amadey_darkgate_elex_hellokitty_mafia_smoke-loader_stop.exe (PID: 6340)

    • The process checks if it is being run in the virtual environment

      • explorer.exe (PID: 4772)

  • INFO

    • Reads the computer name

      • 2025-08-03_6d53b017597ff64ba6d1db9394bb4cf1_amadey_darkgate_elex_hellokitty_mafia_smoke-loader_stop.exe (PID: 2880)
      • 2025-08-03_6d53b017597ff64ba6d1db9394bb4cf1_amadey_darkgate_elex_hellokitty_mafia_smoke-loader_stop.exe (PID: 6340)
      • wiaacmgr.exe (PID: 1148)

    • The sample compiled with chinese language support

      • 2025-08-03_6d53b017597ff64ba6d1db9394bb4cf1_amadey_darkgate_elex_hellokitty_mafia_smoke-loader_stop.exe (PID: 2880)

    • Creates files in the program directory

      • 2025-08-03_6d53b017597ff64ba6d1db9394bb4cf1_amadey_darkgate_elex_hellokitty_mafia_smoke-loader_stop.exe (PID: 2880)
      • explorer.exe (PID: 4772)
      • wiaacmgr.exe (PID: 1148)

    • Checks supported languages

      • 2025-08-03_6d53b017597ff64ba6d1db9394bb4cf1_amadey_darkgate_elex_hellokitty_mafia_smoke-loader_stop.exe (PID: 2880)
      • 2025-08-03_6d53b017597ff64ba6d1db9394bb4cf1_amadey_darkgate_elex_hellokitty_mafia_smoke-loader_stop.exe (PID: 6340)
      • wiaacmgr.exe (PID: 1148)

    • Process checks computer location settings

      • 2025-08-03_6d53b017597ff64ba6d1db9394bb4cf1_amadey_darkgate_elex_hellokitty_mafia_smoke-loader_stop.exe (PID: 2880)
      • 2025-08-03_6d53b017597ff64ba6d1db9394bb4cf1_amadey_darkgate_elex_hellokitty_mafia_smoke-loader_stop.exe (PID: 6340)

    • Checks proxy server information

      • 2025-08-03_6d53b017597ff64ba6d1db9394bb4cf1_amadey_darkgate_elex_hellokitty_mafia_smoke-loader_stop.exe (PID: 6340)
      • wiaacmgr.exe (PID: 1148)
      • slui.exe (PID: 7084)

    • Reads the machine GUID from the registry

      • 2025-08-03_6d53b017597ff64ba6d1db9394bb4cf1_amadey_darkgate_elex_hellokitty_mafia_smoke-loader_stop.exe (PID: 6340)
      • wiaacmgr.exe (PID: 1148)

    • Reads the software policy settings

      • 2025-08-03_6d53b017597ff64ba6d1db9394bb4cf1_amadey_darkgate_elex_hellokitty_mafia_smoke-loader_stop.exe (PID: 6340)
      • slui.exe (PID: 7084)

    • VMProtect protector has been detected

      • 2025-08-03_6d53b017597ff64ba6d1db9394bb4cf1_amadey_darkgate_elex_hellokitty_mafia_smoke-loader_stop.exe (PID: 6340)
      • wiaacmgr.exe (PID: 1148)

    • Manual execution by a user

      • wiaacmgr.exe (PID: 1148)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (52.9)
.exe | Generic Win/DOS Executable (23.5)
.exe | DOS Executable Generic (23.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2025:04:09 02:41:14+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 9
CodeSize: 229376
InitializedDataSize: 358400
UninitializedDataSize: -
EntryPoint: 0xd5207
OSVersion: 5
ImageVersion: -
SubsystemVersion: 5
Subsystem: Windows GUI
FileVersionNumber: 24.1.12.946
ProductVersionNumber: 24.1.12.946
FileFlagsMask: 0x0017
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Chinese (Simplified)
CharacterSet: Unicode
FileVersion: 24, 1, 12, 946
ProductVersion: 24, 1, 12, 946
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
140
Monitored processes
8
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start 2025-08-03_6d53b017597ff64ba6d1db9394bb4cf1_amadey_darkgate_elex_hellokitty_mafia_smoke-loader_stop.exe 2025-08-03_6d53b017597ff64ba6d1db9394bb4cf1_amadey_darkgate_elex_hellokitty_mafia_smoke-loader_stop.exe wiaacmgr.exe slui.exe cmd.exe no specs conhost.exe no specs timeout.exe no specs explorer.exe

Process information

PID
CMD
Path
Indicators
Parent process
1148"C:\ProgramData\wiaacmgr.exe"C:\ProgramData\wiaacmgr.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Picture Acquisition Wizard
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\programdata\wiaacmgr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\gdi32.dll
1632\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2880"C:\Users\admin\Desktop\2025-08-03_6d53b017597ff64ba6d1db9394bb4cf1_amadey_darkgate_elex_hellokitty_mafia_smoke-loader_stop.exe" C:\Users\admin\Desktop\2025-08-03_6d53b017597ff64ba6d1db9394bb4cf1_amadey_darkgate_elex_hellokitty_mafia_smoke-loader_stop.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Version:
24, 1, 12, 946
Modules
Images
c:\users\admin\desktop\2025-08-03_6d53b017597ff64ba6d1db9394bb4cf1_amadey_darkgate_elex_hellokitty_mafia_smoke-loader_stop.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
4772C:\WINDOWS\Explorer.EXEC:\Windows\explorer.exe
—
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Version:
10.0.19041.3758 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\smartscreenps.dll
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\oleaut32.dll
6292timeout /t 1 C:\Windows\SysWOW64\timeout.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
timeout - pauses command processing
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\timeout.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
6340"C:\Users\admin\Desktop\2025-08-03_6d53b017597ff64ba6d1db9394bb4cf1_amadey_darkgate_elex_hellokitty_mafia_smoke-loader_stop.exe" C:\Users\admin\Desktop\2025-08-03_6d53b017597ff64ba6d1db9394bb4cf1_amadey_darkgate_elex_hellokitty_mafia_smoke-loader_stop.exe
2025-08-03_6d53b017597ff64ba6d1db9394bb4cf1_amadey_darkgate_elex_hellokitty_mafia_smoke-loader_stop.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Version:
24, 1, 12, 946
Modules
Images
c:\users\admin\desktop\2025-08-03_6d53b017597ff64ba6d1db9394bb4cf1_amadey_darkgate_elex_hellokitty_mafia_smoke-loader_stop.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
6840"C:\Windows\System32\cmd.exe" /c timeout /t 1 & del /Q /F "C:\Users\admin\Desktop\2025-08-03_6d53b017597ff64ba6d1db9394bb4cf1_amadey_darkgate_elex_hellokitty_mafia_smoke-loader_stop.exe"C:\Windows\SysWOW64\cmd.exe—2025-08-03_6d53b017597ff64ba6d1db9394bb4cf1_amadey_darkgate_elex_hellokitty_mafia_smoke-loader_stop.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
7084C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
Total events
9 243
Read events
9 228
Write events
15
Delete events
0

Modification events

(PID) Process:(4772) explorer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Shell\Bags\1\Desktop
Operation:writeName:IconLayouts
Value:
00000000000000000000000000000000030001000100010012000000000000002C000000000000003A003A007B00360034003500460046003000340030002D0035003000380031002D0031003000310042002D0039004600300038002D003000300041004100300030003200460039003500340045007D003E002000200000001000000000000000430043006C00650061006E00650072002E006C006E006B003E0020007C0000001500000000000000410064006F006200650020004100630072006F006200610074002E006C006E006B003E0020007C000000160000000000000061007300700072006F00660065007300730069006F006E0061006C002E0070006E0067003E002000200000000F00000000000000460069007200650066006F0078002E006C006E006B003E0020007C000000150000000000000047006F006F0067006C00650020004300680072006F006D0065002E006C006E006B003E0020007C000000180000000000000056004C00430020006D006500640069006100200070006C0061007900650072002E006C006E006B003E0020007C00000016000000000000004D006900630072006F0073006F0066007400200045006400670065002E006C006E006B003E0020007C0000001000000000000000610062006C006500620061006E0064002E0070006E0067003E00200020000000140000000000000061006D0070006F00700075006C006100740069006F006E002E007200740066003E0020002000000017000000000000006100730073006F00630069006100740065007300740068006F00730065002E006A00700067003E002000200000001500000000000000630075007200720065006E006300790070006C006100630065002E007200740066003E002000200000000F000000000000006400610079006A0075006E0065002E007200740066003E0020002000000018000000000000006C006F0063006100740069006F006E007300760065007200730069006F006E002E007200740066003E00200020000000100000000000000070006C006100790065007200730061002E007200740066003E002000200000001B000000000000007000750062006C00690063006100740069006F006E00730068006F007500730069006E0067002E0070006E0067003E002000200000000C00000000000000780076006F006C002E0070006E0067003E002000200000006B0000000000000032003000320035002D00300038002D00300033005F00360064003500330062003000310037003500390037006600660036003400620061003600640031006400620039003300390034006200620034006300660031005F0061006D0061006400650079005F006400610072006B0067006100740065005F0065006C00650078005F00680065006C006C006F006B0069007400740079005F006D0061006600690061005F0073006D006F006B0065002D006C006F0061006400650072005F00730074006F0070002E006500780065003E00200020000000010000000000000002000100000000000000000001000000000000000200010000000000000000001100000006000000010000001200000000000000000000000000000000000000803F0000004008000000803F000040400900000000000000404003000000803F000080400A000000803F0000A0400B0000000040000000000C00000000400000803F0D0000000040000000400E0000000040000040400F0000000040000080401000000000000000803F01000000000000000040020000000000000080400400000000000000A04005000000803F0000000006000000803F0000803F0700000000400000A0401100
(PID) Process:(4772) explorer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Shell\Bags\1\Desktop
Operation:writeName:IconNameVersion
Value:
1
(PID) Process:(4772) explorer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\OneDrive\Accounts
Operation:writeName:LastUpdate
Value:
91CD8E6800000000
(PID) Process:(6340) 2025-08-03_6d53b017597ff64ba6d1db9394bb4cf1_amadey_darkgate_elex_hellokitty_mafia_smoke-loader_stop.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(6340) 2025-08-03_6d53b017597ff64ba6d1db9394bb4cf1_amadey_darkgate_elex_hellokitty_mafia_smoke-loader_stop.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(6340) 2025-08-03_6d53b017597ff64ba6d1db9394bb4cf1_amadey_darkgate_elex_hellokitty_mafia_smoke-loader_stop.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(1148) wiaacmgr.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(1148) wiaacmgr.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(1148) wiaacmgr.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(4772) explorer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Shell\Bags\1\Desktop
Operation:writeName:IconLayouts
Value:
00000000000000000000000000000000030001000100010011000000000000002C000000000000003A003A007B00360034003500460046003000340030002D0035003000380031002D0031003000310042002D0039004600300038002D003000300041004100300030003200460039003500340045007D003E002000200000001000000000000000430043006C00650061006E00650072002E006C006E006B003E0020007C0000001500000000000000410064006F006200650020004100630072006F006200610074002E006C006E006B003E0020007C000000160000000000000061007300700072006F00660065007300730069006F006E0061006C002E0070006E0067003E002000200000000F00000000000000460069007200650066006F0078002E006C006E006B003E0020007C000000150000000000000047006F006F0067006C00650020004300680072006F006D0065002E006C006E006B003E0020007C000000180000000000000056004C00430020006D006500640069006100200070006C0061007900650072002E006C006E006B003E0020007C00000016000000000000004D006900630072006F0073006F0066007400200045006400670065002E006C006E006B003E0020007C0000001000000000000000610062006C006500620061006E0064002E0070006E0067003E00200020000000140000000000000061006D0070006F00700075006C006100740069006F006E002E007200740066003E0020002000000017000000000000006100730073006F00630069006100740065007300740068006F00730065002E006A00700067003E002000200000001500000000000000630075007200720065006E006300790070006C006100630065002E007200740066003E002000200000000F000000000000006400610079006A0075006E0065002E007200740066003E0020002000000018000000000000006C006F0063006100740069006F006E007300760065007200730069006F006E002E007200740066003E00200020000000100000000000000070006C006100790065007200730061002E007200740066003E002000200000001B000000000000007000750062006C00690063006100740069006F006E00730068006F007500730069006E0067002E0070006E0067003E002000200000000C00000000000000780076006F006C002E0070006E0067003E00200020000000010000000000000002000100000000000000000001000000000000000200010000000000000000001100000006000000010000001100000000000000000000000000000000000000803F0000004008000000803F000040400900000000000000404003000000803F000080400A000000803F0000A0400B0000000040000000000C00000000400000803F0D0000000040000000400E0000000040000040400F0000000040000080401000000000000000803F01000000000000000040020000000000000080400400000000000000A04005000000803F0000000006000000803F0000803F0700
Executable files
10
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
63402025-08-03_6d53b017597ff64ba6d1db9394bb4cf1_amadey_darkgate_elex_hellokitty_mafia_smoke-loader_stop.exeC:\Windows\SysWOW64\X3RjtWJrRU.sysexecutable
MD5:B78512A09B506B7AF9EA08D64FF16E08
SHA256:91BD0ECB80D5CE3FAFDA7BDA4A092F7BEEFFF012F07C458A0056CA6363E7E3B1
28802025-08-03_6d53b017597ff64ba6d1db9394bb4cf1_amadey_darkgate_elex_hellokitty_mafia_smoke-loader_stop.exeC:\ProgramData\nBDdAE0wNYH9O.mgqexecutable
MD5:B78512A09B506B7AF9EA08D64FF16E08
SHA256:91BD0ECB80D5CE3FAFDA7BDA4A092F7BEEFFF012F07C458A0056CA6363E7E3B1
63402025-08-03_6d53b017597ff64ba6d1db9394bb4cf1_amadey_darkgate_elex_hellokitty_mafia_smoke-loader_stop.exeC:\Windows\SysWOW64\drivers\DFcs16k3klik.sysexecutable
MD5:B78512A09B506B7AF9EA08D64FF16E08
SHA256:91BD0ECB80D5CE3FAFDA7BDA4A092F7BEEFFF012F07C458A0056CA6363E7E3B1
63402025-08-03_6d53b017597ff64ba6d1db9394bb4cf1_amadey_darkgate_elex_hellokitty_mafia_smoke-loader_stop.exeC:\Windows\iC1T4UBaOZTy.sysexecutable
MD5:B78512A09B506B7AF9EA08D64FF16E08
SHA256:91BD0ECB80D5CE3FAFDA7BDA4A092F7BEEFFF012F07C458A0056CA6363E7E3B1
4772explorer.exeC:\ProgramData\wiaacmgr.exeexecutable
MD5:51A33B2190190BDBD1B084A8A2951C89
SHA256:7EF633EBC3B457FC0D02BE0F2194015E02DA40554EED7CAD203E26DB766ECEBC
1148wiaacmgr.exeC:\ProgramData\xWXu5woHCG.iyhexecutable
MD5:DF15188E8972240D7741928D63FE5481
SHA256:2797933BEA1BD39FC108ED4023B5CD0C3C46F2F7E13F0704D4A830511132A046
1148wiaacmgr.exeC:\ProgramData\nGpq2ZrDQigFv.sysexecutable
MD5:DF15188E8972240D7741928D63FE5481
SHA256:2797933BEA1BD39FC108ED4023B5CD0C3C46F2F7E13F0704D4A830511132A046
63402025-08-03_6d53b017597ff64ba6d1db9394bb4cf1_amadey_darkgate_elex_hellokitty_mafia_smoke-loader_stop.exeC:\Windows\SysWOW64\drivers\aEvMYEVW1WIS2.zndexecutable
MD5:B78512A09B506B7AF9EA08D64FF16E08
SHA256:91BD0ECB80D5CE3FAFDA7BDA4A092F7BEEFFF012F07C458A0056CA6363E7E3B1
28802025-08-03_6d53b017597ff64ba6d1db9394bb4cf1_amadey_darkgate_elex_hellokitty_mafia_smoke-loader_stop.exeC:\ProgramData\1JNFXjzUfNLoM.sysexecutable
MD5:B78512A09B506B7AF9EA08D64FF16E08
SHA256:91BD0ECB80D5CE3FAFDA7BDA4A092F7BEEFFF012F07C458A0056CA6363E7E3B1
63402025-08-03_6d53b017597ff64ba6d1db9394bb4cf1_amadey_darkgate_elex_hellokitty_mafia_smoke-loader_stop.exeC:\Windows\SysWOW64\rcxAR8WAvFM.twmexecutable
MD5:B78512A09B506B7AF9EA08D64FF16E08
SHA256:91BD0ECB80D5CE3FAFDA7BDA4A092F7BEEFFF012F07C458A0056CA6363E7E3B1
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
29
TCP/UDP connections
32
DNS requests
15
Threats
14

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5944
MoUsoCoreWorker.exe
GET
200
23.216.77.28:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
23.216.77.28:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5944
MoUsoCoreWorker.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
7008
RUXIMICS.exe
GET
200
23.216.77.28:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
7008
RUXIMICS.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
223.6.6.6:443
https://dns.alidns.com/resolve?name=xcd.yycsl.top&type=1
unknown
binary
1.03 Kb
whitelisted
—
—
GET
200
223.6.6.6:443
https://dns.alidns.com/resolve?name=xcd.seaya.site&type=1
unknown
binary
381 b
whitelisted
6340
2025-08-03_6d53b017597ff64ba6d1db9394bb4cf1_amadey_darkgate_elex_hellokitty_mafia_smoke-loader_stop.exe
GET
418
1.56.98.184:80
http://xcd.seaya.site/pgm/mpr/c995ec7fd4f57c0d/31bd9b27a24e0be9.zip.md5.txt
unknown
—
—
unknown
6340
2025-08-03_6d53b017597ff64ba6d1db9394bb4cf1_amadey_darkgate_elex_hellokitty_mafia_smoke-loader_stop.exe
GET
418
1.56.98.184:80
http://xcd.seaya.site/pgm/mpr/c995ec7fd4f57c0d/31bd9b27a24e0be9.zip
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
5944
MoUsoCoreWorker.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1268
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
7008
RUXIMICS.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5944
MoUsoCoreWorker.exe
23.216.77.28:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
1268
svchost.exe
23.216.77.28:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
7008
RUXIMICS.exe
23.216.77.28:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5944
MoUsoCoreWorker.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
1268
svchost.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 40.119.249.228
whitelisted
google.com
  • 142.250.184.206
whitelisted
crl.microsoft.com
  • 23.216.77.28
  • 23.216.77.6
whitelisted
www.microsoft.com
  • 95.101.149.131
whitelisted
xcd.yycsl.top
  • —
unknown
dns.alidns.com
  • 223.5.5.5
  • 223.6.6.6
whitelisted
xcd.seaya.site
  • —
unknown
apps.game.qq.com
  • 43.129.139.164
  • 43.129.138.220
whitelisted
sp1.baidu.com
  • 103.235.46.102
  • 103.235.46.115
whitelisted
self.events.data.microsoft.com
  • 52.168.117.168
whitelisted

Threats

PID
Process
Class
Message
6340
2025-08-03_6d53b017597ff64ba6d1db9394bb4cf1_amadey_darkgate_elex_hellokitty_mafia_smoke-loader_stop.exe
Potentially Bad Traffic
ET DNS Query to a *.top domain - Likely Hostile
6340
2025-08-03_6d53b017597ff64ba6d1db9394bb4cf1_amadey_darkgate_elex_hellokitty_mafia_smoke-loader_stop.exe
Misc activity
ET INFO Observed DNS Over HTTPS Domain (dns .alidns .com in TLS SNI)
6340
2025-08-03_6d53b017597ff64ba6d1db9394bb4cf1_amadey_darkgate_elex_hellokitty_mafia_smoke-loader_stop.exe
Misc activity
ET INFO Observed DNS Over HTTPS Domain (dns .alidns .com in TLS SNI)
6340
2025-08-03_6d53b017597ff64ba6d1db9394bb4cf1_amadey_darkgate_elex_hellokitty_mafia_smoke-loader_stop.exe
Potentially Bad Traffic
ET INFO HTTP Request to a *.top domain
1148
wiaacmgr.exe
Potentially Bad Traffic
ET HUNTING Request to .TOP Domain with Minimal Headers
1148
wiaacmgr.exe
Potentially Bad Traffic
ET HUNTING Request to .TOP Domain with Minimal Headers
1148
wiaacmgr.exe
Potentially Bad Traffic
ET HUNTING Request to .TOP Domain with Minimal Headers
1148
wiaacmgr.exe
Potentially Bad Traffic
ET HUNTING Request to .TOP Domain with Minimal Headers
1148
wiaacmgr.exe
Potentially Bad Traffic
ET HUNTING Request to .TOP Domain with Minimal Headers
1148
wiaacmgr.exe
Potentially Bad Traffic
ET HUNTING Request to .TOP Domain with Minimal Headers
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
2025-08-03_6d53b017597ff64ba6d1db9394bb4cf1_amadey_darkgate_elex_hellokitty_mafia_smoke-loader_stop.exe