File name:

2025-06-21_d2e3f0fec1a2b27806b413cbf3b1e8ea_amadey_elex_smoke-loader_stop

Full analysis: https://app.any.run/tasks/b528ed22-1840-4bda-8cc3-ef344b3eb02d
Verdict: Malicious activity
Threats:

BlackMoon also known as KrBanker is a trojan aimed at stealing payment credentials. It specializes in man-in-the-browser (MitB) attacks, web injection, and credential theft to compromise users' online banking accounts. It was first noticed in early 2014 attacking banks in South Korea and has impressively evolved since by adding a number of new infiltration techniques and information stealing methods.

Malware Trends Tracker     >>>
Analysis date: June 21, 2025, 06:04:58
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
blackmoon
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 6 sections
MD5:

D2E3F0FEC1A2B27806B413CBF3B1E8EA

SHA1:

08475F1DA2D43AEEA743A9BF28E018EB5062E6FC

SHA256:

8F4B016FE95AE9B087116A589447B1B4E719F20A3237710F0DBC05033E0D4866

SSDEEP:

98304:vKOlBcIt0ML1CXN0RqfaSfS25dBWO7thGjLK/cVYRrs47iZEcF2W7rxLyDzsRncD:koxjraH

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • BLACKMOON has been detected (YARA)

      • 2025-06-21_d2e3f0fec1a2b27806b413cbf3b1e8ea_amadey_elex_smoke-loader_stop.exe (PID: 1356)
      • ufxujmsyaz.exe (PID: 4372)

  • SUSPICIOUS

    • Application launched itself

      • 2025-06-21_d2e3f0fec1a2b27806b413cbf3b1e8ea_amadey_elex_smoke-loader_stop.exe (PID: 1356)
      • ryhqscxais.exe (PID: 4868)
      • rrqjuohiwd.exe (PID: 3752)
      • rccbismcdp.exe (PID: 4768)
      • rcdhuaruyn.exe (PID: 6540)
      • wpxoncwcsw.exe (PID: 2120)
      • hzmusayftu.exe (PID: 2976)
      • mfjcftxqou.exe (PID: 3740)
      • mjgszzjley.exe (PID: 5764)
      • juqcyakxpf.exe (PID: 504)
      • zhaynchxhs.exe (PID: 2620)
      • wthoczabzg.exe (PID: 7008)
      • gxgkvlprpj.exe (PID: 5612)
      • iluqqfrrmm.exe (PID: 6772)
      • ojcjuaddkd.exe (PID: 5240)
      • bmtcfhumbt.exe (PID: 1480)
      • odyctbhclp.exe (PID: 4984)
      • ttfimxowgi.exe (PID: 2368)
      • gvvidqvpje.exe (PID: 6016)
      • oowgpspksg.exe (PID: 4816)
      • ohfejtaojz.exe (PID: 4088)
      • vmzpgykmfg.exe (PID: 3704)
      • dfafbzwioa.exe (PID: 5124)
      • qofgxcrypw.exe (PID: 1100)
      • nxzlqmyqay.exe (PID: 6868)
      • vumonsqowf.exe (PID: 3196)
      • qamcnxaxty.exe (PID: 3640)
      • ateffhjivg.exe (PID: 3736)
      • cksadagqeo.exe (PID: 2716)
      • iukornhfih.exe (PID: 684)
      • amwekfdrxa.exe (PID: 5720)
      • foafjhbxdv.exe (PID: 2972)
      • fkeppapvnr.exe (PID: 2524)
      • snfjcegjph.exe (PID: 2120)
      • auttjmlfan.exe (PID: 2468)
      • snqmbgtrsp.exe (PID: 2160)
      • vmgvwkcwwu.exe (PID: 3740)
      • fxxqvjpugm.exe (PID: 2696)
      • sdympzdpvv.exe (PID: 2116)
      • vodcmkfwod.exe (PID: 1560)
      • hmucvyydlz.exe (PID: 4808)
      • hfidamsmxz.exe (PID: 1636)
      • clzlokfdst.exe (PID: 2780)
      • fgmghrpnjl.exe (PID: 1036)
      • cxepzhigqm.exe (PID: 3876)
      • xgyjrfyrmj.exe (PID: 5504)
      • mpdwoukock.exe (PID: 2368)
      • kqfnticczf.exe (PID: 4412)
      • zvxtcfisxf.exe (PID: 1816)
      • rzyvgqdzqo.exe (PID: 4036)
      • mxockrqlij.exe (PID: 6012)
      • xxfazestuh.exe (PID: 3864)
      • kotghgcbyb.exe (PID: 3948)
      • uggcmgveht.exe (PID: 4552)
      • toffrqobjk.exe (PID: 4760)
      • gfviefoqww.exe (PID: 2632)
      • mkgdzzqlad.exe (PID: 420)
      • twajshbgys.exe (PID: 5724)
      • llczudnhvx.exe (PID: 6292)
      • zdtitzkoci.exe (PID: 6128)
      • ruufiqwerq.exe (PID: 5744)
      • oozbqhcorn.exe (PID: 3624)
      • rcdppeqtih.exe (PID: 6164)
      • omyvqpfdsj.exe (PID: 1484)
      • qwziwfusia.exe (PID: 6368)
      • vqrbsxhgqy.exe (PID: 2040)
      • wqvmjzuguo.exe (PID: 1604)
      • gtvzwwoaki.exe (PID: 2188)
      • bpnvcooabp.exe (PID: 4120)
      • oskrqecuux.exe (PID: 2532)
      • bptynykkeq.exe (PID: 5240)
      • epukheoxkc.exe (PID: 5012)
      • lbpdntojly.exe (PID: 6420)
      • digftsdnbe.exe (PID: 6688)
      • ghirnygair.exe (PID: 1068)
      • npfhnixsql.exe (PID: 1560)
      • ilvfekuckl.exe (PID: 5528)
      • oefxjyeyhg.exe (PID: 1128)
      • xmsvlipqso.exe (PID: 2272)
      • iwseptwtxv.exe (PID: 1644)
      • abcqvrbreq.exe (PID: 3704)
      • ldjnkfmfaz.exe (PID: 5968)
      • ksqltkyzfy.exe (PID: 5564)
      • slzjgljdws.exe (PID: 1688)
      • qgwpbvsqzu.exe (PID: 6264)
      • fwfnioffbo.exe (PID: 5252)
      • dflwabhypy.exe (PID: 4528)
      • pvdvrpzfmu.exe (PID: 5708)
      • xsajfpwlls.exe (PID: 5264)
      • cvvfbixaxg.exe (PID: 6160)
      • ufxujmsyaz.exe (PID: 4372)
      • kctqsfjbcm.exe (PID: 5960)
      • kvegsmbaqq.exe (PID: 5724)
      • eggzjcwybg.exe (PID: 6292)
      • mdmbjjyoub.exe (PID: 4860)
      • fvoxyacwrb.exe (PID: 536)
      • ullwubngft.exe (PID: 1056)
      • sjuptpvwvb.exe (PID: 1132)
      • kbsvxjbapj.exe (PID: 5620)
      • epxvgstiyd.exe (PID: 1740)
      • exgbjdusmm.exe (PID: 6796)
      • efpkzotpjt.exe (PID: 6504)
      • jhzdvfgday.exe (PID: 2528)
      • zwdryuhxhf.exe (PID: 2188)
      • zpwotroswp.exe (PID: 4224)
      • rxqmduasqx.exe (PID: 2580)
      • mdjadykbfq.exe (PID: 7096)
      • btdbbusqsb.exe (PID: 3716)
      • wohdcqxzxi.exe (PID: 5220)
      • yvxhcehidv.exe (PID: 4088)
      • bbnpfqpvyz.exe (PID: 6004)
      • osbveticcu.exe (PID: 3908)
      • qvgmbdkjvc.exe (PID: 1180)
      • tfxovkpttz.exe (PID: 1028)
      • dbjxawgmtv.exe (PID: 5504)
      • wcflrkxmat.exe (PID: 1816)
      • tzsqrcocrk.exe (PID: 2864)
      • yikmseuncy.exe (PID: 1352)
      • yfkkouattb.exe (PID: 728)
      • qffipfllmb.exe (PID: 5248)
      • wsqvkrwgqi.exe (PID: 3388)
      • yvdzsbvmdg.exe (PID: 4544)
      • fvaphaqauk.exe (PID: 4832)

    • Executable content was dropped or overwritten

      • 2025-06-21_d2e3f0fec1a2b27806b413cbf3b1e8ea_amadey_elex_smoke-loader_stop.exe (PID: 4644)
      • ryhqscxais.exe (PID: 2280)
      • rrqjuohiwd.exe (PID: 2596)
      • rccbismcdp.exe (PID: 1180)
      • wpxoncwcsw.exe (PID: 3908)
      • rcdhuaruyn.exe (PID: 6220)
      • hzmusayftu.exe (PID: 5616)
      • mfjcftxqou.exe (PID: 6584)
      • juqcyakxpf.exe (PID: 1644)
      • mjgszzjley.exe (PID: 6980)
      • zhaynchxhs.exe (PID: 684)
      • 2025-06-21_d2e3f0fec1a2b27806b413cbf3b1e8ea_amadey_elex_smoke-loader_stop.exe (PID: 1356)
      • wthoczabzg.exe (PID: 4116)
      • gxgkvlprpj.exe (PID: 5708)
      • iluqqfrrmm.exe (PID: 5552)
      • ojcjuaddkd.exe (PID: 5348)
      • bmtcfhumbt.exe (PID: 3148)
      • odyctbhclp.exe (PID: 6380)
      • ttfimxowgi.exe (PID: 4708)
      • gvvidqvpje.exe (PID: 436)
      • oowgpspksg.exe (PID: 6672)
      • ohfejtaojz.exe (PID: 4196)
      • dfafbzwioa.exe (PID: 5564)
      • vmzpgykmfg.exe (PID: 5968)
      • qofgxcrypw.exe (PID: 5456)
      • nxzlqmyqay.exe (PID: 1816)
      • vumonsqowf.exe (PID: 5896)
      • ateffhjivg.exe (PID: 6148)
      • qamcnxaxty.exe (PID: 6656)
      • cksadagqeo.exe (PID: 6980)
      • amwekfdrxa.exe (PID: 6892)
      • iukornhfih.exe (PID: 6180)
      • foafjhbxdv.exe (PID: 728)
      • fkeppapvnr.exe (PID: 5060)
      • auttjmlfan.exe (PID: 5744)
      • snqmbgtrsp.exe (PID: 7056)
      • snfjcegjph.exe (PID: 2512)
      • vmgvwkcwwu.exe (PID: 2952)
      • sdympzdpvv.exe (PID: 1872)
      • fxxqvjpugm.exe (PID: 3540)
      • vodcmkfwod.exe (PID: 2280)
      • hmucvyydlz.exe (PID: 2680)
      • hfidamsmxz.exe (PID: 6304)
      • fgmghrpnjl.exe (PID: 4580)
      • clzlokfdst.exe (PID: 4172)
      • xgyjrfyrmj.exe (PID: 4836)
      • kqfnticczf.exe (PID: 1068)
      • cxepzhigqm.exe (PID: 1096)
      • zvxtcfisxf.exe (PID: 6016)
      • mpdwoukock.exe (PID: 1136)
      • rzyvgqdzqo.exe (PID: 3488)
      • mxockrqlij.exe (PID: 5896)
      • xxfazestuh.exe (PID: 1644)
      • uggcmgveht.exe (PID: 5124)
      • kotghgcbyb.exe (PID: 3704)
      • toffrqobjk.exe (PID: 2604)
      • mkgdzzqlad.exe (PID: 6360)
      • gfviefoqww.exe (PID: 1932)
      • twajshbgys.exe (PID: 1896)
      • llczudnhvx.exe (PID: 5552)
      • ruufiqwerq.exe (PID: 7072)
      • zdtitzkoci.exe (PID: 4832)
      • oozbqhcorn.exe (PID: 5692)
      • rcdppeqtih.exe (PID: 6836)
      • omyvqpfdsj.exe (PID: 7004)
      • qwziwfusia.exe (PID: 724)
      • vqrbsxhgqy.exe (PID: 2380)
      • gtvzwwoaki.exe (PID: 320)
      • wqvmjzuguo.exe (PID: 2120)
      • bpnvcooabp.exe (PID: 3740)
      • bptynykkeq.exe (PID: 6504)
      • epukheoxkc.exe (PID: 1096)
      • oskrqecuux.exe (PID: 5020)
      • digftsdnbe.exe (PID: 2792)
      • ghirnygair.exe (PID: 1136)
      • lbpdntojly.exe (PID: 2664)
      • npfhnixsql.exe (PID: 6620)
      • oefxjyeyhg.exe (PID: 2220)
      • xmsvlipqso.exe (PID: 4752)
      • ilvfekuckl.exe (PID: 1180)
      • iwseptwtxv.exe (PID: 2168)
      • abcqvrbreq.exe (PID: 5952)
      • ldjnkfmfaz.exe (PID: 3160)
      • ksqltkyzfy.exe (PID: 188)
      • qgwpbvsqzu.exe (PID: 2612)
      • slzjgljdws.exe (PID: 868)
      • fwfnioffbo.exe (PID: 3732)
      • pvdvrpzfmu.exe (PID: 3668)
      • xsajfpwlls.exe (PID: 2648)
      • dflwabhypy.exe (PID: 3388)
      • ufxujmsyaz.exe (PID: 3976)
      • cvvfbixaxg.exe (PID: 6748)
      • kvegsmbaqq.exe (PID: 2468)
      • kctqsfjbcm.exe (PID: 3752)
      • eggzjcwybg.exe (PID: 3112)
      • fvoxyacwrb.exe (PID: 4576)
      • mdmbjjyoub.exe (PID: 2296)
      • sjuptpvwvb.exe (PID: 620)
      • ullwubngft.exe (PID: 7140)
      • epxvgstiyd.exe (PID: 6260)
      • kbsvxjbapj.exe (PID: 3644)
      • exgbjdusmm.exe (PID: 6268)
      • efpkzotpjt.exe (PID: 2696)
      • zpwotroswp.exe (PID: 6876)
      • jhzdvfgday.exe (PID: 6124)
      • rxqmduasqx.exe (PID: 5480)
      • zwdryuhxhf.exe (PID: 3820)
      • mdjadykbfq.exe (PID: 6828)
      • wohdcqxzxi.exe (PID: 504)
      • btdbbusqsb.exe (PID: 4984)
      • yvxhcehidv.exe (PID: 6344)
      • bbnpfqpvyz.exe (PID: 5772)
      • osbveticcu.exe (PID: 1216)
      • tfxovkpttz.exe (PID: 1852)
      • dbjxawgmtv.exe (PID: 188)
      • qvgmbdkjvc.exe (PID: 3672)
      • tzsqrcocrk.exe (PID: 1036)
      • yikmseuncy.exe (PID: 1896)
      • wcflrkxmat.exe (PID: 1440)
      • yfkkouattb.exe (PID: 3864)
      • wsqvkrwgqi.exe (PID: 4684)
      • yvdzsbvmdg.exe (PID: 6232)
      • qffipfllmb.exe (PID: 3572)
      • fvaphaqauk.exe (PID: 4760)

    • Starts itself from another location

      • 2025-06-21_d2e3f0fec1a2b27806b413cbf3b1e8ea_amadey_elex_smoke-loader_stop.exe (PID: 1356)
      • ryhqscxais.exe (PID: 4868)
      • rrqjuohiwd.exe (PID: 3752)
      • rccbismcdp.exe (PID: 4768)
      • wpxoncwcsw.exe (PID: 2120)
      • rcdhuaruyn.exe (PID: 6540)
      • hzmusayftu.exe (PID: 2976)
      • mfjcftxqou.exe (PID: 3740)
      • juqcyakxpf.exe (PID: 504)
      • mjgszzjley.exe (PID: 5764)
      • zhaynchxhs.exe (PID: 2620)
      • wthoczabzg.exe (PID: 7008)
      • gxgkvlprpj.exe (PID: 5612)
      • ojcjuaddkd.exe (PID: 5240)
      • iluqqfrrmm.exe (PID: 6772)
      • bmtcfhumbt.exe (PID: 1480)
      • odyctbhclp.exe (PID: 4984)
      • ttfimxowgi.exe (PID: 2368)
      • gvvidqvpje.exe (PID: 6016)
      • oowgpspksg.exe (PID: 4816)
      • ohfejtaojz.exe (PID: 4088)
      • vmzpgykmfg.exe (PID: 3704)
      • dfafbzwioa.exe (PID: 5124)
      • qofgxcrypw.exe (PID: 1100)
      • nxzlqmyqay.exe (PID: 6868)
      • vumonsqowf.exe (PID: 3196)
      • ateffhjivg.exe (PID: 3736)
      • qamcnxaxty.exe (PID: 3640)
      • cksadagqeo.exe (PID: 2716)
      • amwekfdrxa.exe (PID: 5720)
      • iukornhfih.exe (PID: 684)
      • fkeppapvnr.exe (PID: 2524)
      • foafjhbxdv.exe (PID: 2972)
      • auttjmlfan.exe (PID: 2468)
      • snfjcegjph.exe (PID: 2120)
      • snqmbgtrsp.exe (PID: 2160)
      • vmgvwkcwwu.exe (PID: 3740)
      • sdympzdpvv.exe (PID: 2116)
      • fxxqvjpugm.exe (PID: 2696)
      • hmucvyydlz.exe (PID: 4808)
      • hfidamsmxz.exe (PID: 1636)
      • vodcmkfwod.exe (PID: 1560)
      • fgmghrpnjl.exe (PID: 1036)
      • clzlokfdst.exe (PID: 2780)
      • xgyjrfyrmj.exe (PID: 5504)
      • kqfnticczf.exe (PID: 4412)
      • cxepzhigqm.exe (PID: 3876)
      • mpdwoukock.exe (PID: 2368)
      • zvxtcfisxf.exe (PID: 1816)
      • mxockrqlij.exe (PID: 6012)
      • rzyvgqdzqo.exe (PID: 4036)
      • xxfazestuh.exe (PID: 3864)
      • kotghgcbyb.exe (PID: 3948)
      • toffrqobjk.exe (PID: 4760)
      • uggcmgveht.exe (PID: 4552)
      • mkgdzzqlad.exe (PID: 420)
      • gfviefoqww.exe (PID: 2632)
      • llczudnhvx.exe (PID: 6292)
      • twajshbgys.exe (PID: 5724)
      • ruufiqwerq.exe (PID: 5744)
      • zdtitzkoci.exe (PID: 6128)
      • rcdppeqtih.exe (PID: 6164)
      • oozbqhcorn.exe (PID: 3624)
      • omyvqpfdsj.exe (PID: 1484)
      • qwziwfusia.exe (PID: 6368)
      • vqrbsxhgqy.exe (PID: 2040)
      • wqvmjzuguo.exe (PID: 1604)
      • gtvzwwoaki.exe (PID: 2188)
      • bpnvcooabp.exe (PID: 4120)
      • bptynykkeq.exe (PID: 5240)
      • epukheoxkc.exe (PID: 5012)
      • oskrqecuux.exe (PID: 2532)
      • digftsdnbe.exe (PID: 6688)
      • lbpdntojly.exe (PID: 6420)
      • npfhnixsql.exe (PID: 1560)
      • ghirnygair.exe (PID: 1068)
      • oefxjyeyhg.exe (PID: 1128)
      • ilvfekuckl.exe (PID: 5528)
      • iwseptwtxv.exe (PID: 1644)
      • xmsvlipqso.exe (PID: 2272)
      • abcqvrbreq.exe (PID: 3704)
      • ldjnkfmfaz.exe (PID: 5968)
      • ksqltkyzfy.exe (PID: 5564)
      • slzjgljdws.exe (PID: 1688)
      • qgwpbvsqzu.exe (PID: 6264)
      • fwfnioffbo.exe (PID: 5252)
      • pvdvrpzfmu.exe (PID: 5708)
      • xsajfpwlls.exe (PID: 5264)
      • dflwabhypy.exe (PID: 4528)
      • ufxujmsyaz.exe (PID: 4372)
      • cvvfbixaxg.exe (PID: 6160)
      • kctqsfjbcm.exe (PID: 5960)
      • eggzjcwybg.exe (PID: 6292)
      • kvegsmbaqq.exe (PID: 5724)
      • fvoxyacwrb.exe (PID: 536)
      • mdmbjjyoub.exe (PID: 4860)
      • sjuptpvwvb.exe (PID: 1132)
      • ullwubngft.exe (PID: 1056)
      • epxvgstiyd.exe (PID: 1740)
      • kbsvxjbapj.exe (PID: 5620)
      • efpkzotpjt.exe (PID: 6504)
      • exgbjdusmm.exe (PID: 6796)
      • zpwotroswp.exe (PID: 4224)
      • jhzdvfgday.exe (PID: 2528)
      • zwdryuhxhf.exe (PID: 2188)
      • mdjadykbfq.exe (PID: 7096)
      • rxqmduasqx.exe (PID: 2580)
      • wohdcqxzxi.exe (PID: 5220)
      • btdbbusqsb.exe (PID: 3716)
      • yvxhcehidv.exe (PID: 4088)
      • osbveticcu.exe (PID: 3908)
      • bbnpfqpvyz.exe (PID: 6004)
      • tfxovkpttz.exe (PID: 1028)
      • qvgmbdkjvc.exe (PID: 1180)
      • dbjxawgmtv.exe (PID: 5504)
      • tzsqrcocrk.exe (PID: 2864)
      • wcflrkxmat.exe (PID: 1816)
      • yfkkouattb.exe (PID: 728)
      • yikmseuncy.exe (PID: 1352)
      • wsqvkrwgqi.exe (PID: 3388)
      • yvdzsbvmdg.exe (PID: 4544)
      • qffipfllmb.exe (PID: 5248)
      • fvaphaqauk.exe (PID: 4832)

    • There is functionality for taking screenshot (YARA)

      • 2025-06-21_d2e3f0fec1a2b27806b413cbf3b1e8ea_amadey_elex_smoke-loader_stop.exe (PID: 1356)
      • ufxujmsyaz.exe (PID: 4372)

  • INFO

    • Checks supported languages

      • 2025-06-21_d2e3f0fec1a2b27806b413cbf3b1e8ea_amadey_elex_smoke-loader_stop.exe (PID: 4644)
      • 2025-06-21_d2e3f0fec1a2b27806b413cbf3b1e8ea_amadey_elex_smoke-loader_stop.exe (PID: 1356)
      • ryhqscxais.exe (PID: 4868)
      • ryhqscxais.exe (PID: 2280)
      • rrqjuohiwd.exe (PID: 2596)
      • rrqjuohiwd.exe (PID: 3752)
      • rccbismcdp.exe (PID: 4768)
      • rccbismcdp.exe (PID: 1180)
      • rcdhuaruyn.exe (PID: 6540)
      • rcdhuaruyn.exe (PID: 6220)
      • wpxoncwcsw.exe (PID: 2120)
      • wpxoncwcsw.exe (PID: 3908)
      • hzmusayftu.exe (PID: 2976)
      • hzmusayftu.exe (PID: 5616)
      • mfjcftxqou.exe (PID: 3740)
      • mfjcftxqou.exe (PID: 6584)
      • juqcyakxpf.exe (PID: 504)
      • juqcyakxpf.exe (PID: 1644)
      • mjgszzjley.exe (PID: 6980)
      • zhaynchxhs.exe (PID: 2620)
      • zhaynchxhs.exe (PID: 684)
      • mjgszzjley.exe (PID: 5764)
      • wthoczabzg.exe (PID: 7008)
      • wthoczabzg.exe (PID: 4116)
      • gxgkvlprpj.exe (PID: 5708)
      • iluqqfrrmm.exe (PID: 6772)
      • iluqqfrrmm.exe (PID: 5552)
      • ojcjuaddkd.exe (PID: 5348)
      • bmtcfhumbt.exe (PID: 1480)
      • bmtcfhumbt.exe (PID: 3148)
      • ojcjuaddkd.exe (PID: 5240)
      • gxgkvlprpj.exe (PID: 5612)
      • odyctbhclp.exe (PID: 4984)
      • odyctbhclp.exe (PID: 6380)
      • ttfimxowgi.exe (PID: 2368)
      • ttfimxowgi.exe (PID: 4708)
      • gvvidqvpje.exe (PID: 6016)
      • gvvidqvpje.exe (PID: 436)
      • ohfejtaojz.exe (PID: 4196)
      • vmzpgykmfg.exe (PID: 3704)
      • oowgpspksg.exe (PID: 4816)
      • vmzpgykmfg.exe (PID: 5968)
      • oowgpspksg.exe (PID: 6672)
      • ohfejtaojz.exe (PID: 4088)
      • dfafbzwioa.exe (PID: 5124)
      • dfafbzwioa.exe (PID: 5564)
      • qofgxcrypw.exe (PID: 1100)
      • nxzlqmyqay.exe (PID: 6868)
      • nxzlqmyqay.exe (PID: 1816)
      • qofgxcrypw.exe (PID: 5456)
      • qamcnxaxty.exe (PID: 3640)
      • vumonsqowf.exe (PID: 3196)
      • vumonsqowf.exe (PID: 5896)
      • ateffhjivg.exe (PID: 3736)
      • ateffhjivg.exe (PID: 6148)
      • cksadagqeo.exe (PID: 2716)
      • qamcnxaxty.exe (PID: 6656)
      • iukornhfih.exe (PID: 684)
      • iukornhfih.exe (PID: 6180)
      • cksadagqeo.exe (PID: 6980)
      • amwekfdrxa.exe (PID: 6892)
      • fkeppapvnr.exe (PID: 2524)
      • amwekfdrxa.exe (PID: 5720)
      • foafjhbxdv.exe (PID: 728)
      • fkeppapvnr.exe (PID: 5060)
      • foafjhbxdv.exe (PID: 2972)
      • auttjmlfan.exe (PID: 5744)
      • snfjcegjph.exe (PID: 2120)
      • snfjcegjph.exe (PID: 2512)
      • auttjmlfan.exe (PID: 2468)
      • snqmbgtrsp.exe (PID: 2160)
      • snqmbgtrsp.exe (PID: 7056)
      • vmgvwkcwwu.exe (PID: 2952)
      • fxxqvjpugm.exe (PID: 2696)
      • vmgvwkcwwu.exe (PID: 3740)
      • sdympzdpvv.exe (PID: 2116)
      • sdympzdpvv.exe (PID: 1872)
      • hmucvyydlz.exe (PID: 4808)
      • fxxqvjpugm.exe (PID: 3540)
      • hmucvyydlz.exe (PID: 2680)
      • vodcmkfwod.exe (PID: 1560)
      • vodcmkfwod.exe (PID: 2280)
      • hfidamsmxz.exe (PID: 6304)
      • clzlokfdst.exe (PID: 4172)
      • clzlokfdst.exe (PID: 2780)
      • hfidamsmxz.exe (PID: 1636)
      • fgmghrpnjl.exe (PID: 1036)
      • fgmghrpnjl.exe (PID: 4580)
      • xgyjrfyrmj.exe (PID: 5504)
      • xgyjrfyrmj.exe (PID: 4836)
      • cxepzhigqm.exe (PID: 1096)
      • cxepzhigqm.exe (PID: 3876)
      • mpdwoukock.exe (PID: 2368)
      • mpdwoukock.exe (PID: 1136)
      • kqfnticczf.exe (PID: 4412)
      • kqfnticczf.exe (PID: 1068)
      • zvxtcfisxf.exe (PID: 1816)
      • zvxtcfisxf.exe (PID: 6016)
      • mxockrqlij.exe (PID: 6012)
      • rzyvgqdzqo.exe (PID: 4036)
      • rzyvgqdzqo.exe (PID: 3488)
      • mxockrqlij.exe (PID: 5896)
      • kotghgcbyb.exe (PID: 3948)
      • kotghgcbyb.exe (PID: 3704)
      • xxfazestuh.exe (PID: 3864)
      • uggcmgveht.exe (PID: 5124)
      • uggcmgveht.exe (PID: 4552)
      • toffrqobjk.exe (PID: 2604)
      • toffrqobjk.exe (PID: 4760)
      • mkgdzzqlad.exe (PID: 420)
      • gfviefoqww.exe (PID: 2632)
      • mkgdzzqlad.exe (PID: 6360)
      • twajshbgys.exe (PID: 1896)
      • gfviefoqww.exe (PID: 1932)
      • twajshbgys.exe (PID: 5724)
      • ruufiqwerq.exe (PID: 5744)
      • llczudnhvx.exe (PID: 5552)
      • zdtitzkoci.exe (PID: 6128)
      • llczudnhvx.exe (PID: 6292)
      • zdtitzkoci.exe (PID: 4832)
      • ruufiqwerq.exe (PID: 7072)
      • oozbqhcorn.exe (PID: 5692)
      • oozbqhcorn.exe (PID: 3624)
      • omyvqpfdsj.exe (PID: 1484)
      • rcdppeqtih.exe (PID: 6164)
      • rcdppeqtih.exe (PID: 6836)
      • qwziwfusia.exe (PID: 6368)
      • qwziwfusia.exe (PID: 724)
      • omyvqpfdsj.exe (PID: 7004)
      • vqrbsxhgqy.exe (PID: 2040)
      • vqrbsxhgqy.exe (PID: 2380)
      • wqvmjzuguo.exe (PID: 1604)
      • gtvzwwoaki.exe (PID: 320)
      • wqvmjzuguo.exe (PID: 2120)
      • gtvzwwoaki.exe (PID: 2188)
      • bpnvcooabp.exe (PID: 3740)
      • bpnvcooabp.exe (PID: 4120)
      • oskrqecuux.exe (PID: 5020)
      • bptynykkeq.exe (PID: 5240)
      • bptynykkeq.exe (PID: 6504)
      • oskrqecuux.exe (PID: 2532)
      • epukheoxkc.exe (PID: 5012)
      • epukheoxkc.exe (PID: 1096)
      • digftsdnbe.exe (PID: 2792)
      • lbpdntojly.exe (PID: 2664)
      • digftsdnbe.exe (PID: 6688)
      • ghirnygair.exe (PID: 1068)
      • ghirnygair.exe (PID: 1136)
      • npfhnixsql.exe (PID: 1560)
      • lbpdntojly.exe (PID: 6420)
      • npfhnixsql.exe (PID: 6620)
      • oefxjyeyhg.exe (PID: 1128)
      • ilvfekuckl.exe (PID: 5528)
      • ilvfekuckl.exe (PID: 1180)
      • oefxjyeyhg.exe (PID: 2220)
      • xmsvlipqso.exe (PID: 4752)
      • xmsvlipqso.exe (PID: 2272)
      • ldjnkfmfaz.exe (PID: 5968)
      • iwseptwtxv.exe (PID: 1644)
      • iwseptwtxv.exe (PID: 2168)
      • abcqvrbreq.exe (PID: 3704)
      • abcqvrbreq.exe (PID: 5952)
      • ksqltkyzfy.exe (PID: 5564)
      • ldjnkfmfaz.exe (PID: 3160)
      • ksqltkyzfy.exe (PID: 188)
      • slzjgljdws.exe (PID: 1688)
      • slzjgljdws.exe (PID: 868)
      • qgwpbvsqzu.exe (PID: 6264)
      • qgwpbvsqzu.exe (PID: 2612)
      • fwfnioffbo.exe (PID: 5252)
      • fwfnioffbo.exe (PID: 3732)
      • dflwabhypy.exe (PID: 4528)
      • dflwabhypy.exe (PID: 3388)
      • pvdvrpzfmu.exe (PID: 3668)
      • pvdvrpzfmu.exe (PID: 5708)
      • xsajfpwlls.exe (PID: 2648)
      • xsajfpwlls.exe (PID: 5264)
      • cvvfbixaxg.exe (PID: 6160)
      • ufxujmsyaz.exe (PID: 4372)
      • ufxujmsyaz.exe (PID: 3976)
      • kctqsfjbcm.exe (PID: 3752)
      • cvvfbixaxg.exe (PID: 6748)
      • kctqsfjbcm.exe (PID: 5960)
      • kvegsmbaqq.exe (PID: 2468)
      • kvegsmbaqq.exe (PID: 5724)
      • fvoxyacwrb.exe (PID: 536)
      • eggzjcwybg.exe (PID: 6292)
      • eggzjcwybg.exe (PID: 3112)
      • mdmbjjyoub.exe (PID: 4860)
      • mdmbjjyoub.exe (PID: 2296)
      • fvoxyacwrb.exe (PID: 4576)
      • ullwubngft.exe (PID: 7140)
      • ullwubngft.exe (PID: 1056)
      • sjuptpvwvb.exe (PID: 620)
      • epxvgstiyd.exe (PID: 1740)
      • sjuptpvwvb.exe (PID: 1132)
      • kbsvxjbapj.exe (PID: 3644)
      • kbsvxjbapj.exe (PID: 5620)
      • epxvgstiyd.exe (PID: 6260)
      • exgbjdusmm.exe (PID: 6796)
      • exgbjdusmm.exe (PID: 6268)
      • jhzdvfgday.exe (PID: 2528)
      • efpkzotpjt.exe (PID: 6504)
      • efpkzotpjt.exe (PID: 2696)
      • jhzdvfgday.exe (PID: 6124)
      • zwdryuhxhf.exe (PID: 2188)
      • zwdryuhxhf.exe (PID: 3820)
      • zpwotroswp.exe (PID: 6876)
      • rxqmduasqx.exe (PID: 2580)
      • zpwotroswp.exe (PID: 4224)
      • rxqmduasqx.exe (PID: 5480)
      • mdjadykbfq.exe (PID: 6828)
      • wohdcqxzxi.exe (PID: 5220)
      • mdjadykbfq.exe (PID: 7096)
      • btdbbusqsb.exe (PID: 3716)
      • btdbbusqsb.exe (PID: 4984)
      • wohdcqxzxi.exe (PID: 504)
      • yvxhcehidv.exe (PID: 4088)
      • yvxhcehidv.exe (PID: 6344)
      • bbnpfqpvyz.exe (PID: 6004)
      • bbnpfqpvyz.exe (PID: 5772)
      • osbveticcu.exe (PID: 3908)
      • osbveticcu.exe (PID: 1216)
      • tfxovkpttz.exe (PID: 1028)
      • qvgmbdkjvc.exe (PID: 3672)
      • qvgmbdkjvc.exe (PID: 1180)
      • tfxovkpttz.exe (PID: 1852)
      • dbjxawgmtv.exe (PID: 5504)
      • dbjxawgmtv.exe (PID: 188)
      • tzsqrcocrk.exe (PID: 2864)
      • tzsqrcocrk.exe (PID: 1036)
      • wcflrkxmat.exe (PID: 1816)
      • wcflrkxmat.exe (PID: 1440)
      • yikmseuncy.exe (PID: 1896)
      • yikmseuncy.exe (PID: 1352)
      • wsqvkrwgqi.exe (PID: 3388)
      • yfkkouattb.exe (PID: 728)
      • yfkkouattb.exe (PID: 3864)
      • qffipfllmb.exe (PID: 3572)
      • wsqvkrwgqi.exe (PID: 4684)
      • qffipfllmb.exe (PID: 5248)
      • yvdzsbvmdg.exe (PID: 6232)
      • fvaphaqauk.exe (PID: 4832)
      • yvdzsbvmdg.exe (PID: 4544)
      • fvaphaqauk.exe (PID: 4760)
      • xxfazestuh.exe (PID: 1644)

    • The sample compiled with chinese language support

      • 2025-06-21_d2e3f0fec1a2b27806b413cbf3b1e8ea_amadey_elex_smoke-loader_stop.exe (PID: 1356)
      • 2025-06-21_d2e3f0fec1a2b27806b413cbf3b1e8ea_amadey_elex_smoke-loader_stop.exe (PID: 4644)
      • ryhqscxais.exe (PID: 2280)
      • rrqjuohiwd.exe (PID: 2596)
      • rccbismcdp.exe (PID: 1180)
      • wpxoncwcsw.exe (PID: 3908)
      • rcdhuaruyn.exe (PID: 6220)
      • hzmusayftu.exe (PID: 5616)
      • mfjcftxqou.exe (PID: 6584)
      • juqcyakxpf.exe (PID: 1644)
      • mjgszzjley.exe (PID: 6980)
      • zhaynchxhs.exe (PID: 684)
      • wthoczabzg.exe (PID: 4116)
      • gxgkvlprpj.exe (PID: 5708)
      • ojcjuaddkd.exe (PID: 5348)
      • iluqqfrrmm.exe (PID: 5552)
      • odyctbhclp.exe (PID: 6380)
      • bmtcfhumbt.exe (PID: 3148)
      • ttfimxowgi.exe (PID: 4708)
      • gvvidqvpje.exe (PID: 436)
      • ohfejtaojz.exe (PID: 4196)
      • oowgpspksg.exe (PID: 6672)
      • vmzpgykmfg.exe (PID: 5968)
      • dfafbzwioa.exe (PID: 5564)
      • nxzlqmyqay.exe (PID: 1816)
      • qofgxcrypw.exe (PID: 5456)
      • vumonsqowf.exe (PID: 5896)
      • ateffhjivg.exe (PID: 6148)
      • qamcnxaxty.exe (PID: 6656)
      • cksadagqeo.exe (PID: 6980)
      • amwekfdrxa.exe (PID: 6892)
      • iukornhfih.exe (PID: 6180)
      • fkeppapvnr.exe (PID: 5060)
      • auttjmlfan.exe (PID: 5744)
      • foafjhbxdv.exe (PID: 728)
      • snqmbgtrsp.exe (PID: 7056)
      • snfjcegjph.exe (PID: 2512)
      • vmgvwkcwwu.exe (PID: 2952)
      • sdympzdpvv.exe (PID: 1872)
      • fxxqvjpugm.exe (PID: 3540)
      • hmucvyydlz.exe (PID: 2680)
      • vodcmkfwod.exe (PID: 2280)
      • hfidamsmxz.exe (PID: 6304)
      • fgmghrpnjl.exe (PID: 4580)
      • clzlokfdst.exe (PID: 4172)
      • xgyjrfyrmj.exe (PID: 4836)
      • kqfnticczf.exe (PID: 1068)
      • cxepzhigqm.exe (PID: 1096)
      • mpdwoukock.exe (PID: 1136)
      • zvxtcfisxf.exe (PID: 6016)
      • rzyvgqdzqo.exe (PID: 3488)
      • mxockrqlij.exe (PID: 5896)
      • xxfazestuh.exe (PID: 1644)
      • uggcmgveht.exe (PID: 5124)
      • kotghgcbyb.exe (PID: 3704)
      • toffrqobjk.exe (PID: 2604)
      • mkgdzzqlad.exe (PID: 6360)
      • twajshbgys.exe (PID: 1896)
      • gfviefoqww.exe (PID: 1932)
      • llczudnhvx.exe (PID: 5552)
      • ruufiqwerq.exe (PID: 7072)
      • zdtitzkoci.exe (PID: 4832)
      • rcdppeqtih.exe (PID: 6836)
      • oozbqhcorn.exe (PID: 5692)
      • omyvqpfdsj.exe (PID: 7004)
      • qwziwfusia.exe (PID: 724)
      • vqrbsxhgqy.exe (PID: 2380)
      • wqvmjzuguo.exe (PID: 2120)
      • bpnvcooabp.exe (PID: 3740)
      • gtvzwwoaki.exe (PID: 320)
      • bptynykkeq.exe (PID: 6504)
      • oskrqecuux.exe (PID: 5020)
      • epukheoxkc.exe (PID: 1096)
      • digftsdnbe.exe (PID: 2792)
      • ghirnygair.exe (PID: 1136)
      • lbpdntojly.exe (PID: 2664)
      • npfhnixsql.exe (PID: 6620)
      • oefxjyeyhg.exe (PID: 2220)
      • ilvfekuckl.exe (PID: 1180)
      • iwseptwtxv.exe (PID: 2168)
      • xmsvlipqso.exe (PID: 4752)
      • ldjnkfmfaz.exe (PID: 3160)
      • abcqvrbreq.exe (PID: 5952)
      • ksqltkyzfy.exe (PID: 188)
      • slzjgljdws.exe (PID: 868)
      • fwfnioffbo.exe (PID: 3732)
      • qgwpbvsqzu.exe (PID: 2612)
      • pvdvrpzfmu.exe (PID: 3668)
      • xsajfpwlls.exe (PID: 2648)
      • dflwabhypy.exe (PID: 3388)
      • ufxujmsyaz.exe (PID: 3976)
      • cvvfbixaxg.exe (PID: 6748)
      • kctqsfjbcm.exe (PID: 3752)
      • eggzjcwybg.exe (PID: 3112)
      • kvegsmbaqq.exe (PID: 2468)
      • fvoxyacwrb.exe (PID: 4576)
      • mdmbjjyoub.exe (PID: 2296)
      • sjuptpvwvb.exe (PID: 620)
      • ullwubngft.exe (PID: 7140)
      • epxvgstiyd.exe (PID: 6260)
      • exgbjdusmm.exe (PID: 6268)
      • kbsvxjbapj.exe (PID: 3644)
      • efpkzotpjt.exe (PID: 2696)
      • jhzdvfgday.exe (PID: 6124)
      • zpwotroswp.exe (PID: 6876)
      • zwdryuhxhf.exe (PID: 3820)
      • rxqmduasqx.exe (PID: 5480)
      • mdjadykbfq.exe (PID: 6828)
      • wohdcqxzxi.exe (PID: 504)
      • btdbbusqsb.exe (PID: 4984)
      • yvxhcehidv.exe (PID: 6344)
      • osbveticcu.exe (PID: 1216)
      • bbnpfqpvyz.exe (PID: 5772)
      • tfxovkpttz.exe (PID: 1852)
      • qvgmbdkjvc.exe (PID: 3672)
      • dbjxawgmtv.exe (PID: 188)
      • tzsqrcocrk.exe (PID: 1036)
      • wcflrkxmat.exe (PID: 1440)
      • yikmseuncy.exe (PID: 1896)
      • yfkkouattb.exe (PID: 3864)
      • wsqvkrwgqi.exe (PID: 4684)
      • yvdzsbvmdg.exe (PID: 6232)
      • qffipfllmb.exe (PID: 3572)
      • fvaphaqauk.exe (PID: 4760)

    • Reads the machine GUID from the registry

      • 2025-06-21_d2e3f0fec1a2b27806b413cbf3b1e8ea_amadey_elex_smoke-loader_stop.exe (PID: 4644)
      • ryhqscxais.exe (PID: 2280)
      • rccbismcdp.exe (PID: 1180)
      • rcdhuaruyn.exe (PID: 6220)
      • rrqjuohiwd.exe (PID: 2596)
      • wpxoncwcsw.exe (PID: 3908)
      • 2025-06-21_d2e3f0fec1a2b27806b413cbf3b1e8ea_amadey_elex_smoke-loader_stop.exe (PID: 1356)
      • ryhqscxais.exe (PID: 4868)
      • hzmusayftu.exe (PID: 5616)
      • mfjcftxqou.exe (PID: 6584)
      • rccbismcdp.exe (PID: 4768)
      • rrqjuohiwd.exe (PID: 3752)
      • wpxoncwcsw.exe (PID: 2120)
      • hzmusayftu.exe (PID: 2976)
      • juqcyakxpf.exe (PID: 1644)
      • mfjcftxqou.exe (PID: 3740)
      • mjgszzjley.exe (PID: 6980)
      • rcdhuaruyn.exe (PID: 6540)
      • juqcyakxpf.exe (PID: 504)
      • zhaynchxhs.exe (PID: 684)
      • mjgszzjley.exe (PID: 5764)
      • wthoczabzg.exe (PID: 4116)
      • gxgkvlprpj.exe (PID: 5708)
      • wthoczabzg.exe (PID: 7008)
      • iluqqfrrmm.exe (PID: 5552)
      • zhaynchxhs.exe (PID: 2620)
      • iluqqfrrmm.exe (PID: 6772)
      • gxgkvlprpj.exe (PID: 5612)
      • ojcjuaddkd.exe (PID: 5348)
      • bmtcfhumbt.exe (PID: 3148)
      • ttfimxowgi.exe (PID: 4708)
      • odyctbhclp.exe (PID: 6380)
      • bmtcfhumbt.exe (PID: 1480)
      • ojcjuaddkd.exe (PID: 5240)
      • odyctbhclp.exe (PID: 4984)
      • gvvidqvpje.exe (PID: 436)
      • oowgpspksg.exe (PID: 6672)
      • ttfimxowgi.exe (PID: 2368)
      • ohfejtaojz.exe (PID: 4196)
      • gvvidqvpje.exe (PID: 6016)
      • oowgpspksg.exe (PID: 4816)
      • vmzpgykmfg.exe (PID: 5968)
      • ohfejtaojz.exe (PID: 4088)
      • dfafbzwioa.exe (PID: 5564)
      • qofgxcrypw.exe (PID: 5456)
      • dfafbzwioa.exe (PID: 5124)
      • nxzlqmyqay.exe (PID: 1816)
      • vmzpgykmfg.exe (PID: 3704)
      • vumonsqowf.exe (PID: 5896)
      • nxzlqmyqay.exe (PID: 6868)
      • qamcnxaxty.exe (PID: 6656)
      • qofgxcrypw.exe (PID: 1100)
      • ateffhjivg.exe (PID: 6148)
      • qamcnxaxty.exe (PID: 3640)
      • vumonsqowf.exe (PID: 3196)
      • ateffhjivg.exe (PID: 3736)
      • cksadagqeo.exe (PID: 6980)
      • amwekfdrxa.exe (PID: 6892)
      • iukornhfih.exe (PID: 6180)
      • cksadagqeo.exe (PID: 2716)
      • foafjhbxdv.exe (PID: 728)
      • amwekfdrxa.exe (PID: 5720)
      • iukornhfih.exe (PID: 684)
      • fkeppapvnr.exe (PID: 5060)
      • auttjmlfan.exe (PID: 5744)
      • foafjhbxdv.exe (PID: 2972)
      • fkeppapvnr.exe (PID: 2524)
      • snqmbgtrsp.exe (PID: 7056)
      • snfjcegjph.exe (PID: 2512)
      • auttjmlfan.exe (PID: 2468)
      • vmgvwkcwwu.exe (PID: 2952)
      • snqmbgtrsp.exe (PID: 2160)
      • fxxqvjpugm.exe (PID: 3540)
      • snfjcegjph.exe (PID: 2120)
      • sdympzdpvv.exe (PID: 1872)
      • vmgvwkcwwu.exe (PID: 3740)
      • vodcmkfwod.exe (PID: 2280)
      • fxxqvjpugm.exe (PID: 2696)
      • hmucvyydlz.exe (PID: 2680)
      • sdympzdpvv.exe (PID: 2116)
      • hmucvyydlz.exe (PID: 4808)
      • hfidamsmxz.exe (PID: 6304)
      • vodcmkfwod.exe (PID: 1560)
      • clzlokfdst.exe (PID: 4172)
      • hfidamsmxz.exe (PID: 1636)
      • fgmghrpnjl.exe (PID: 4580)
      • xgyjrfyrmj.exe (PID: 4836)
      • fgmghrpnjl.exe (PID: 1036)
      • cxepzhigqm.exe (PID: 1096)
      • clzlokfdst.exe (PID: 2780)
      • kqfnticczf.exe (PID: 1068)
      • cxepzhigqm.exe (PID: 3876)
      • mpdwoukock.exe (PID: 1136)
      • xgyjrfyrmj.exe (PID: 5504)
      • zvxtcfisxf.exe (PID: 6016)
      • kqfnticczf.exe (PID: 4412)
      • mpdwoukock.exe (PID: 2368)
      • zvxtcfisxf.exe (PID: 1816)
      • mxockrqlij.exe (PID: 5896)
      • rzyvgqdzqo.exe (PID: 3488)
      • xxfazestuh.exe (PID: 1644)
      • mxockrqlij.exe (PID: 6012)
      • rzyvgqdzqo.exe (PID: 4036)
      • xxfazestuh.exe (PID: 3864)
      • uggcmgveht.exe (PID: 5124)
      • kotghgcbyb.exe (PID: 3704)
      • toffrqobjk.exe (PID: 2604)
      • uggcmgveht.exe (PID: 4552)
      • kotghgcbyb.exe (PID: 3948)
      • toffrqobjk.exe (PID: 4760)
      • gfviefoqww.exe (PID: 1932)
      • mkgdzzqlad.exe (PID: 6360)
      • twajshbgys.exe (PID: 1896)
      • mkgdzzqlad.exe (PID: 420)
      • llczudnhvx.exe (PID: 5552)
      • twajshbgys.exe (PID: 5724)
      • gfviefoqww.exe (PID: 2632)
      • llczudnhvx.exe (PID: 6292)
      • ruufiqwerq.exe (PID: 7072)
      • ruufiqwerq.exe (PID: 5744)
      • zdtitzkoci.exe (PID: 4832)
      • oozbqhcorn.exe (PID: 5692)
      • rcdppeqtih.exe (PID: 6836)
      • zdtitzkoci.exe (PID: 6128)
      • qwziwfusia.exe (PID: 724)
      • rcdppeqtih.exe (PID: 6164)
      • oozbqhcorn.exe (PID: 3624)
      • omyvqpfdsj.exe (PID: 7004)
      • vqrbsxhgqy.exe (PID: 2380)
      • qwziwfusia.exe (PID: 6368)
      • omyvqpfdsj.exe (PID: 1484)
      • vqrbsxhgqy.exe (PID: 2040)
      • gtvzwwoaki.exe (PID: 320)
      • wqvmjzuguo.exe (PID: 2120)
      • gtvzwwoaki.exe (PID: 2188)
      • wqvmjzuguo.exe (PID: 1604)
      • bpnvcooabp.exe (PID: 3740)
      • oskrqecuux.exe (PID: 5020)
      • bptynykkeq.exe (PID: 6504)
      • bpnvcooabp.exe (PID: 4120)
      • epukheoxkc.exe (PID: 1096)
      • bptynykkeq.exe (PID: 5240)
      • oskrqecuux.exe (PID: 2532)
      • digftsdnbe.exe (PID: 2792)
      • epukheoxkc.exe (PID: 5012)
      • ghirnygair.exe (PID: 1136)
      • lbpdntojly.exe (PID: 2664)
      • digftsdnbe.exe (PID: 6688)
      • npfhnixsql.exe (PID: 6620)
      • ghirnygair.exe (PID: 1068)
      • lbpdntojly.exe (PID: 6420)
      • npfhnixsql.exe (PID: 1560)
      • oefxjyeyhg.exe (PID: 2220)
      • ilvfekuckl.exe (PID: 1180)
      • oefxjyeyhg.exe (PID: 1128)
      • xmsvlipqso.exe (PID: 4752)
      • xmsvlipqso.exe (PID: 2272)
      • ilvfekuckl.exe (PID: 5528)
      • iwseptwtxv.exe (PID: 2168)
      • iwseptwtxv.exe (PID: 1644)
      • abcqvrbreq.exe (PID: 5952)
      • ldjnkfmfaz.exe (PID: 3160)
      • ldjnkfmfaz.exe (PID: 5968)
      • abcqvrbreq.exe (PID: 3704)
      • ksqltkyzfy.exe (PID: 188)
      • ksqltkyzfy.exe (PID: 5564)
      • qgwpbvsqzu.exe (PID: 2612)
      • slzjgljdws.exe (PID: 868)
      • fwfnioffbo.exe (PID: 3732)
      • slzjgljdws.exe (PID: 1688)
      • qgwpbvsqzu.exe (PID: 6264)
      • dflwabhypy.exe (PID: 3388)
      • pvdvrpzfmu.exe (PID: 3668)
      • fwfnioffbo.exe (PID: 5252)
      • xsajfpwlls.exe (PID: 2648)
      • pvdvrpzfmu.exe (PID: 5708)
      • xsajfpwlls.exe (PID: 5264)
      • dflwabhypy.exe (PID: 4528)
      • ufxujmsyaz.exe (PID: 3976)
      • ufxujmsyaz.exe (PID: 4372)
      • cvvfbixaxg.exe (PID: 6748)
      • cvvfbixaxg.exe (PID: 6160)
      • kvegsmbaqq.exe (PID: 2468)
      • kctqsfjbcm.exe (PID: 3752)
      • kctqsfjbcm.exe (PID: 5960)
      • eggzjcwybg.exe (PID: 3112)
      • eggzjcwybg.exe (PID: 6292)
      • kvegsmbaqq.exe (PID: 5724)
      • fvoxyacwrb.exe (PID: 4576)
      • fvoxyacwrb.exe (PID: 536)
      • ullwubngft.exe (PID: 7140)
      • mdmbjjyoub.exe (PID: 2296)
      • sjuptpvwvb.exe (PID: 620)
      • ullwubngft.exe (PID: 1056)
      • mdmbjjyoub.exe (PID: 4860)
      • epxvgstiyd.exe (PID: 6260)
      • sjuptpvwvb.exe (PID: 1132)
      • exgbjdusmm.exe (PID: 6268)
      • kbsvxjbapj.exe (PID: 3644)
      • epxvgstiyd.exe (PID: 1740)
      • efpkzotpjt.exe (PID: 2696)
      • exgbjdusmm.exe (PID: 6796)
      • kbsvxjbapj.exe (PID: 5620)
      • zpwotroswp.exe (PID: 6876)
      • jhzdvfgday.exe (PID: 2528)
      • zwdryuhxhf.exe (PID: 3820)
      • jhzdvfgday.exe (PID: 6124)
      • efpkzotpjt.exe (PID: 6504)
      • zpwotroswp.exe (PID: 4224)
      • rxqmduasqx.exe (PID: 5480)
      • mdjadykbfq.exe (PID: 6828)
      • rxqmduasqx.exe (PID: 2580)
      • zwdryuhxhf.exe (PID: 2188)
      • mdjadykbfq.exe (PID: 7096)
      • btdbbusqsb.exe (PID: 4984)
      • wohdcqxzxi.exe (PID: 504)
      • wohdcqxzxi.exe (PID: 5220)
      • yvxhcehidv.exe (PID: 6344)
      • btdbbusqsb.exe (PID: 3716)
      • bbnpfqpvyz.exe (PID: 5772)
      • bbnpfqpvyz.exe (PID: 6004)
      • yvxhcehidv.exe (PID: 4088)
      • osbveticcu.exe (PID: 1216)
      • tfxovkpttz.exe (PID: 1852)
      • osbveticcu.exe (PID: 3908)
      • qvgmbdkjvc.exe (PID: 3672)
      • dbjxawgmtv.exe (PID: 188)
      • tfxovkpttz.exe (PID: 1028)
      • dbjxawgmtv.exe (PID: 5504)
      • qvgmbdkjvc.exe (PID: 1180)
      • tzsqrcocrk.exe (PID: 1036)
      • yikmseuncy.exe (PID: 1896)
      • wcflrkxmat.exe (PID: 1440)
      • tzsqrcocrk.exe (PID: 2864)
      • yfkkouattb.exe (PID: 3864)
      • yikmseuncy.exe (PID: 1352)
      • wcflrkxmat.exe (PID: 1816)
      • yfkkouattb.exe (PID: 728)
      • qffipfllmb.exe (PID: 3572)
      • wsqvkrwgqi.exe (PID: 4684)
      • wsqvkrwgqi.exe (PID: 3388)
      • yvdzsbvmdg.exe (PID: 6232)
      • qffipfllmb.exe (PID: 5248)
      • fvaphaqauk.exe (PID: 4760)

    • Reads the computer name

      • 2025-06-21_d2e3f0fec1a2b27806b413cbf3b1e8ea_amadey_elex_smoke-loader_stop.exe (PID: 4644)
      • ryhqscxais.exe (PID: 2280)
      • rrqjuohiwd.exe (PID: 2596)
      • rccbismcdp.exe (PID: 1180)
      • 2025-06-21_d2e3f0fec1a2b27806b413cbf3b1e8ea_amadey_elex_smoke-loader_stop.exe (PID: 1356)
      • wpxoncwcsw.exe (PID: 3908)
      • ryhqscxais.exe (PID: 4868)
      • hzmusayftu.exe (PID: 5616)
      • rcdhuaruyn.exe (PID: 6220)
      • mfjcftxqou.exe (PID: 6584)
      • rccbismcdp.exe (PID: 4768)
      • rrqjuohiwd.exe (PID: 3752)
      • wpxoncwcsw.exe (PID: 2120)
      • hzmusayftu.exe (PID: 2976)
      • juqcyakxpf.exe (PID: 1644)
      • mfjcftxqou.exe (PID: 3740)
      • rcdhuaruyn.exe (PID: 6540)
      • juqcyakxpf.exe (PID: 504)
      • zhaynchxhs.exe (PID: 684)
      • mjgszzjley.exe (PID: 6980)
      • mjgszzjley.exe (PID: 5764)
      • wthoczabzg.exe (PID: 4116)
      • zhaynchxhs.exe (PID: 2620)
      • wthoczabzg.exe (PID: 7008)
      • gxgkvlprpj.exe (PID: 5708)
      • iluqqfrrmm.exe (PID: 5552)
      • gxgkvlprpj.exe (PID: 5612)
      • ojcjuaddkd.exe (PID: 5348)
      • iluqqfrrmm.exe (PID: 6772)
      • bmtcfhumbt.exe (PID: 3148)
      • odyctbhclp.exe (PID: 6380)
      • ojcjuaddkd.exe (PID: 5240)
      • bmtcfhumbt.exe (PID: 1480)
      • gvvidqvpje.exe (PID: 436)
      • odyctbhclp.exe (PID: 4984)
      • ttfimxowgi.exe (PID: 2368)
      • ttfimxowgi.exe (PID: 4708)
      • ohfejtaojz.exe (PID: 4196)
      • gvvidqvpje.exe (PID: 6016)
      • oowgpspksg.exe (PID: 4816)
      • oowgpspksg.exe (PID: 6672)
      • ohfejtaojz.exe (PID: 4088)
      • dfafbzwioa.exe (PID: 5564)
      • vmzpgykmfg.exe (PID: 3704)
      • vmzpgykmfg.exe (PID: 5968)
      • dfafbzwioa.exe (PID: 5124)
      • nxzlqmyqay.exe (PID: 1816)
      • qofgxcrypw.exe (PID: 5456)
      • vumonsqowf.exe (PID: 5896)
      • nxzlqmyqay.exe (PID: 6868)
      • qamcnxaxty.exe (PID: 6656)
      • qofgxcrypw.exe (PID: 1100)
      • vumonsqowf.exe (PID: 3196)
      • ateffhjivg.exe (PID: 6148)
      • ateffhjivg.exe (PID: 3736)
      • iukornhfih.exe (PID: 6180)
      • qamcnxaxty.exe (PID: 3640)
      • cksadagqeo.exe (PID: 6980)
      • amwekfdrxa.exe (PID: 6892)
      • iukornhfih.exe (PID: 684)
      • cksadagqeo.exe (PID: 2716)
      • fkeppapvnr.exe (PID: 5060)
      • amwekfdrxa.exe (PID: 5720)
      • foafjhbxdv.exe (PID: 728)
      • fkeppapvnr.exe (PID: 2524)
      • auttjmlfan.exe (PID: 5744)
      • auttjmlfan.exe (PID: 2468)
      • foafjhbxdv.exe (PID: 2972)
      • snfjcegjph.exe (PID: 2512)
      • snqmbgtrsp.exe (PID: 7056)
      • fxxqvjpugm.exe (PID: 3540)
      • snfjcegjph.exe (PID: 2120)
      • vmgvwkcwwu.exe (PID: 2952)
      • snqmbgtrsp.exe (PID: 2160)
      • vmgvwkcwwu.exe (PID: 3740)
      • sdympzdpvv.exe (PID: 1872)
      • sdympzdpvv.exe (PID: 2116)
      • vodcmkfwod.exe (PID: 2280)
      • fxxqvjpugm.exe (PID: 2696)
      • hmucvyydlz.exe (PID: 2680)
      • hfidamsmxz.exe (PID: 6304)
      • hmucvyydlz.exe (PID: 4808)
      • hfidamsmxz.exe (PID: 1636)
      • fgmghrpnjl.exe (PID: 4580)
      • clzlokfdst.exe (PID: 2780)
      • vodcmkfwod.exe (PID: 1560)
      • clzlokfdst.exe (PID: 4172)
      • fgmghrpnjl.exe (PID: 1036)
      • cxepzhigqm.exe (PID: 1096)
      • xgyjrfyrmj.exe (PID: 4836)
      • xgyjrfyrmj.exe (PID: 5504)
      • kqfnticczf.exe (PID: 1068)
      • cxepzhigqm.exe (PID: 3876)
      • mpdwoukock.exe (PID: 1136)
      • zvxtcfisxf.exe (PID: 6016)
      • kqfnticczf.exe (PID: 4412)
      • zvxtcfisxf.exe (PID: 1816)
      • rzyvgqdzqo.exe (PID: 3488)
      • mpdwoukock.exe (PID: 2368)
      • mxockrqlij.exe (PID: 5896)
      • xxfazestuh.exe (PID: 1644)
      • rzyvgqdzqo.exe (PID: 4036)
      • mxockrqlij.exe (PID: 6012)
      • uggcmgveht.exe (PID: 5124)
      • xxfazestuh.exe (PID: 3864)
      • kotghgcbyb.exe (PID: 3704)
      • uggcmgveht.exe (PID: 4552)
      • kotghgcbyb.exe (PID: 3948)
      • toffrqobjk.exe (PID: 2604)
      • mkgdzzqlad.exe (PID: 6360)
      • toffrqobjk.exe (PID: 4760)
      • mkgdzzqlad.exe (PID: 420)
      • gfviefoqww.exe (PID: 1932)
      • twajshbgys.exe (PID: 1896)
      • twajshbgys.exe (PID: 5724)
      • gfviefoqww.exe (PID: 2632)
      • llczudnhvx.exe (PID: 5552)
      • ruufiqwerq.exe (PID: 7072)
      • llczudnhvx.exe (PID: 6292)
      • oozbqhcorn.exe (PID: 5692)
      • zdtitzkoci.exe (PID: 4832)
      • ruufiqwerq.exe (PID: 5744)
      • rcdppeqtih.exe (PID: 6836)
      • zdtitzkoci.exe (PID: 6128)
      • rcdppeqtih.exe (PID: 6164)
      • qwziwfusia.exe (PID: 724)
      • oozbqhcorn.exe (PID: 3624)
      • omyvqpfdsj.exe (PID: 7004)
      • omyvqpfdsj.exe (PID: 1484)
      • vqrbsxhgqy.exe (PID: 2380)
      • qwziwfusia.exe (PID: 6368)
      • vqrbsxhgqy.exe (PID: 2040)
      • gtvzwwoaki.exe (PID: 320)
      • wqvmjzuguo.exe (PID: 2120)
      • bpnvcooabp.exe (PID: 3740)
      • gtvzwwoaki.exe (PID: 2188)
      • wqvmjzuguo.exe (PID: 1604)
      • bpnvcooabp.exe (PID: 4120)
      • bptynykkeq.exe (PID: 6504)
      • epukheoxkc.exe (PID: 1096)
      • oskrqecuux.exe (PID: 5020)
      • bptynykkeq.exe (PID: 5240)
      • epukheoxkc.exe (PID: 5012)
      • oskrqecuux.exe (PID: 2532)
      • digftsdnbe.exe (PID: 2792)
      • digftsdnbe.exe (PID: 6688)
      • ghirnygair.exe (PID: 1136)
      • lbpdntojly.exe (PID: 2664)
      • npfhnixsql.exe (PID: 6620)
      • lbpdntojly.exe (PID: 6420)
      • npfhnixsql.exe (PID: 1560)
      • ghirnygair.exe (PID: 1068)
      • oefxjyeyhg.exe (PID: 2220)
      • xmsvlipqso.exe (PID: 4752)
      • ilvfekuckl.exe (PID: 1180)
      • oefxjyeyhg.exe (PID: 1128)
      • iwseptwtxv.exe (PID: 2168)
      • ilvfekuckl.exe (PID: 5528)
      • abcqvrbreq.exe (PID: 5952)
      • xmsvlipqso.exe (PID: 2272)
      • ldjnkfmfaz.exe (PID: 3160)
      • iwseptwtxv.exe (PID: 1644)
      • abcqvrbreq.exe (PID: 3704)
      • ksqltkyzfy.exe (PID: 188)
      • ldjnkfmfaz.exe (PID: 5968)
      • ksqltkyzfy.exe (PID: 5564)
      • slzjgljdws.exe (PID: 868)
      • qgwpbvsqzu.exe (PID: 2612)
      • fwfnioffbo.exe (PID: 3732)
      • qgwpbvsqzu.exe (PID: 6264)
      • slzjgljdws.exe (PID: 1688)
      • fwfnioffbo.exe (PID: 5252)
      • dflwabhypy.exe (PID: 3388)
      • pvdvrpzfmu.exe (PID: 3668)
      • xsajfpwlls.exe (PID: 2648)
      • pvdvrpzfmu.exe (PID: 5708)
      • ufxujmsyaz.exe (PID: 3976)
      • dflwabhypy.exe (PID: 4528)
      • xsajfpwlls.exe (PID: 5264)
      • ufxujmsyaz.exe (PID: 4372)
      • cvvfbixaxg.exe (PID: 6748)
      • kvegsmbaqq.exe (PID: 2468)
      • kctqsfjbcm.exe (PID: 3752)
      • cvvfbixaxg.exe (PID: 6160)
      • eggzjcwybg.exe (PID: 3112)
      • kvegsmbaqq.exe (PID: 5724)
      • kctqsfjbcm.exe (PID: 5960)
      • eggzjcwybg.exe (PID: 6292)
      • fvoxyacwrb.exe (PID: 4576)
      • mdmbjjyoub.exe (PID: 2296)
      • fvoxyacwrb.exe (PID: 536)
      • sjuptpvwvb.exe (PID: 620)
      • ullwubngft.exe (PID: 7140)
      • mdmbjjyoub.exe (PID: 4860)
      • sjuptpvwvb.exe (PID: 1132)
      • ullwubngft.exe (PID: 1056)
      • epxvgstiyd.exe (PID: 6260)
      • exgbjdusmm.exe (PID: 6268)
      • kbsvxjbapj.exe (PID: 3644)
      • epxvgstiyd.exe (PID: 1740)
      • efpkzotpjt.exe (PID: 2696)
      • kbsvxjbapj.exe (PID: 5620)
      • exgbjdusmm.exe (PID: 6796)
      • jhzdvfgday.exe (PID: 6124)
      • efpkzotpjt.exe (PID: 6504)
      • jhzdvfgday.exe (PID: 2528)
      • zpwotroswp.exe (PID: 6876)
      • zpwotroswp.exe (PID: 4224)
      • rxqmduasqx.exe (PID: 5480)
      • zwdryuhxhf.exe (PID: 3820)
      • rxqmduasqx.exe (PID: 2580)
      • zwdryuhxhf.exe (PID: 2188)
      • mdjadykbfq.exe (PID: 6828)
      • mdjadykbfq.exe (PID: 7096)
      • btdbbusqsb.exe (PID: 4984)
      • wohdcqxzxi.exe (PID: 504)
      • yvxhcehidv.exe (PID: 6344)
      • wohdcqxzxi.exe (PID: 5220)
      • btdbbusqsb.exe (PID: 3716)
      • bbnpfqpvyz.exe (PID: 5772)
      • yvxhcehidv.exe (PID: 4088)
      • osbveticcu.exe (PID: 1216)
      • osbveticcu.exe (PID: 3908)
      • bbnpfqpvyz.exe (PID: 6004)
      • tfxovkpttz.exe (PID: 1852)
      • dbjxawgmtv.exe (PID: 188)
      • qvgmbdkjvc.exe (PID: 1180)
      • qvgmbdkjvc.exe (PID: 3672)
      • tfxovkpttz.exe (PID: 1028)
      • dbjxawgmtv.exe (PID: 5504)
      • tzsqrcocrk.exe (PID: 1036)
      • yikmseuncy.exe (PID: 1896)
      • tzsqrcocrk.exe (PID: 2864)
      • wcflrkxmat.exe (PID: 1440)
      • yfkkouattb.exe (PID: 3864)
      • yikmseuncy.exe (PID: 1352)
      • wcflrkxmat.exe (PID: 1816)
      • yfkkouattb.exe (PID: 728)
      • qffipfllmb.exe (PID: 3572)
      • wsqvkrwgqi.exe (PID: 4684)
      • yvdzsbvmdg.exe (PID: 6232)
      • wsqvkrwgqi.exe (PID: 3388)
      • qffipfllmb.exe (PID: 5248)
      • fvaphaqauk.exe (PID: 4760)

    • Reads the software policy settings

      • slui.exe (PID: 1232)

    • Checks proxy server information

      • slui.exe (PID: 1232)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (64.4)
.dll | Win32 Dynamic Link Library (generic) (13.5)
.exe | Win32 Executable (generic) (9.3)
.exe | Win16/32 Executable Delphi generic (4.2)
.exe | Generic Win/DOS Executable (4.1)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2022:07:15 17:54:42+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 1421312
InitializedDataSize: 536576
UninitializedDataSize: -
EntryPoint: 0x87f838
OSVersion: 5
ImageVersion: -
SubsystemVersion: 5
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.0
ProductVersionNumber: 1.0.0.0
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Chinese (Simplified)
CharacterSet: Unicode
FileVersion: 1.0.0.0
FileDescription: 固定打怪,新手村任务,门派任务
ProductName: 千年3_新手任务
ProductVersion: 1.0.0.0
CompanyName: QQ:6365272
LegalCopyright: QQ:6365272
Comments: 本程序使用易语言编写(http://www.eyuyan.com)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
381
Monitored processes
249
Malicious processes
41
Suspicious processes
60

Behavior graph

Click at the process to see the details
start #BLACKMOON 2025-06-21_d2e3f0fec1a2b27806b413cbf3b1e8ea_amadey_elex_smoke-loader_stop.exe 2025-06-21_d2e3f0fec1a2b27806b413cbf3b1e8ea_amadey_elex_smoke-loader_stop.exe ryhqscxais.exe no specs ryhqscxais.exe rrqjuohiwd.exe no specs rrqjuohiwd.exe rccbismcdp.exe no specs rccbismcdp.exe rcdhuaruyn.exe no specs rcdhuaruyn.exe wpxoncwcsw.exe no specs wpxoncwcsw.exe hzmusayftu.exe no specs hzmusayftu.exe mfjcftxqou.exe no specs mfjcftxqou.exe juqcyakxpf.exe no specs juqcyakxpf.exe mjgszzjley.exe no specs mjgszzjley.exe zhaynchxhs.exe no specs zhaynchxhs.exe wthoczabzg.exe no specs wthoczabzg.exe gxgkvlprpj.exe no specs gxgkvlprpj.exe iluqqfrrmm.exe no specs iluqqfrrmm.exe ojcjuaddkd.exe no specs ojcjuaddkd.exe bmtcfhumbt.exe no specs bmtcfhumbt.exe odyctbhclp.exe no specs odyctbhclp.exe ttfimxowgi.exe no specs ttfimxowgi.exe gvvidqvpje.exe no specs gvvidqvpje.exe oowgpspksg.exe no specs oowgpspksg.exe ohfejtaojz.exe no specs ohfejtaojz.exe vmzpgykmfg.exe no specs vmzpgykmfg.exe dfafbzwioa.exe no specs dfafbzwioa.exe qofgxcrypw.exe no specs qofgxcrypw.exe nxzlqmyqay.exe no specs nxzlqmyqay.exe vumonsqowf.exe no specs vumonsqowf.exe qamcnxaxty.exe no specs qamcnxaxty.exe ateffhjivg.exe no specs ateffhjivg.exe cksadagqeo.exe no specs cksadagqeo.exe iukornhfih.exe no specs iukornhfih.exe amwekfdrxa.exe no specs amwekfdrxa.exe fkeppapvnr.exe no specs fkeppapvnr.exe foafjhbxdv.exe no specs foafjhbxdv.exe auttjmlfan.exe no specs auttjmlfan.exe snfjcegjph.exe no specs snfjcegjph.exe snqmbgtrsp.exe no specs snqmbgtrsp.exe vmgvwkcwwu.exe no specs vmgvwkcwwu.exe fxxqvjpugm.exe no specs fxxqvjpugm.exe sdympzdpvv.exe no specs sdympzdpvv.exe hmucvyydlz.exe no specs hmucvyydlz.exe vodcmkfwod.exe no specs vodcmkfwod.exe hfidamsmxz.exe no specs hfidamsmxz.exe clzlokfdst.exe no specs clzlokfdst.exe slui.exe fgmghrpnjl.exe no specs fgmghrpnjl.exe xgyjrfyrmj.exe no specs xgyjrfyrmj.exe cxepzhigqm.exe no specs cxepzhigqm.exe kqfnticczf.exe no specs kqfnticczf.exe mpdwoukock.exe no specs mpdwoukock.exe zvxtcfisxf.exe no specs zvxtcfisxf.exe mxockrqlij.exe no specs mxockrqlij.exe rzyvgqdzqo.exe no specs rzyvgqdzqo.exe xxfazestuh.exe no specs xxfazestuh.exe kotghgcbyb.exe no specs kotghgcbyb.exe uggcmgveht.exe no specs uggcmgveht.exe toffrqobjk.exe no specs toffrqobjk.exe mkgdzzqlad.exe no specs mkgdzzqlad.exe gfviefoqww.exe no specs gfviefoqww.exe twajshbgys.exe no specs twajshbgys.exe llczudnhvx.exe no specs llczudnhvx.exe ruufiqwerq.exe no specs ruufiqwerq.exe zdtitzkoci.exe no specs zdtitzkoci.exe oozbqhcorn.exe no specs oozbqhcorn.exe rcdppeqtih.exe no specs rcdppeqtih.exe omyvqpfdsj.exe no specs omyvqpfdsj.exe qwziwfusia.exe no specs qwziwfusia.exe vqrbsxhgqy.exe no specs vqrbsxhgqy.exe wqvmjzuguo.exe no specs wqvmjzuguo.exe gtvzwwoaki.exe no specs gtvzwwoaki.exe bpnvcooabp.exe no specs bpnvcooabp.exe bptynykkeq.exe no specs bptynykkeq.exe oskrqecuux.exe no specs oskrqecuux.exe epukheoxkc.exe no specs epukheoxkc.exe digftsdnbe.exe no specs digftsdnbe.exe lbpdntojly.exe no specs lbpdntojly.exe ghirnygair.exe no specs ghirnygair.exe npfhnixsql.exe no specs npfhnixsql.exe oefxjyeyhg.exe no specs oefxjyeyhg.exe ilvfekuckl.exe no specs ilvfekuckl.exe xmsvlipqso.exe no specs xmsvlipqso.exe iwseptwtxv.exe no specs iwseptwtxv.exe ldjnkfmfaz.exe no specs ldjnkfmfaz.exe abcqvrbreq.exe no specs abcqvrbreq.exe ksqltkyzfy.exe no specs ksqltkyzfy.exe slzjgljdws.exe no specs slzjgljdws.exe qgwpbvsqzu.exe no specs qgwpbvsqzu.exe fwfnioffbo.exe no specs fwfnioffbo.exe pvdvrpzfmu.exe no specs pvdvrpzfmu.exe dflwabhypy.exe no specs dflwabhypy.exe xsajfpwlls.exe no specs xsajfpwlls.exe #BLACKMOON ufxujmsyaz.exe no specs ufxujmsyaz.exe cvvfbixaxg.exe no specs cvvfbixaxg.exe kctqsfjbcm.exe no specs kctqsfjbcm.exe kvegsmbaqq.exe no specs kvegsmbaqq.exe eggzjcwybg.exe no specs eggzjcwybg.exe fvoxyacwrb.exe no specs fvoxyacwrb.exe mdmbjjyoub.exe no specs mdmbjjyoub.exe ullwubngft.exe no specs ullwubngft.exe sjuptpvwvb.exe no specs sjuptpvwvb.exe epxvgstiyd.exe no specs epxvgstiyd.exe kbsvxjbapj.exe no specs kbsvxjbapj.exe exgbjdusmm.exe no specs exgbjdusmm.exe efpkzotpjt.exe no specs efpkzotpjt.exe jhzdvfgday.exe no specs jhzdvfgday.exe zpwotroswp.exe no specs zpwotroswp.exe zwdryuhxhf.exe no specs zwdryuhxhf.exe rxqmduasqx.exe no specs rxqmduasqx.exe mdjadykbfq.exe no specs mdjadykbfq.exe wohdcqxzxi.exe no specs wohdcqxzxi.exe btdbbusqsb.exe no specs btdbbusqsb.exe yvxhcehidv.exe no specs yvxhcehidv.exe bbnpfqpvyz.exe no specs bbnpfqpvyz.exe osbveticcu.exe no specs osbveticcu.exe tfxovkpttz.exe no specs tfxovkpttz.exe qvgmbdkjvc.exe no specs qvgmbdkjvc.exe dbjxawgmtv.exe no specs dbjxawgmtv.exe tzsqrcocrk.exe no specs tzsqrcocrk.exe wcflrkxmat.exe no specs wcflrkxmat.exe yikmseuncy.exe no specs yikmseuncy.exe yfkkouattb.exe no specs yfkkouattb.exe wsqvkrwgqi.exe no specs wsqvkrwgqi.exe qffipfllmb.exe no specs qffipfllmb.exe yvdzsbvmdg.exe no specs yvdzsbvmdg.exe fvaphaqauk.exe no specs fvaphaqauk.exe ykbfjvcbqp.exe no specs 2025-06-21_d2e3f0fec1a2b27806b413cbf3b1e8ea_amadey_elex_smoke-loader_stop.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
188C:\Users\admin\Desktop\ksqltkyzfy.exe update slzjgljdws.exeC:\Users\admin\Desktop\ksqltkyzfy.exe
ksqltkyzfy.exe
User:
admin
Company:
QQ:6365272
Integrity Level:
HIGH
Description:
固定打怪,新手村任务,门派任务
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\ksqltkyzfy.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
188C:\Users\admin\Desktop\dbjxawgmtv.exe update tzsqrcocrk.exeC:\Users\admin\Desktop\dbjxawgmtv.exe
dbjxawgmtv.exe
User:
admin
Company:
QQ:6365272
Integrity Level:
HIGH
Description:
固定打怪,新手村任务,门派任务
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\dbjxawgmtv.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
320C:\Users\admin\Desktop\gtvzwwoaki.exe update bpnvcooabp.exeC:\Users\admin\Desktop\gtvzwwoaki.exe
gtvzwwoaki.exe
User:
admin
Company:
QQ:6365272
Integrity Level:
HIGH
Description:
固定打怪,新手村任务,门派任务
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\gtvzwwoaki.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
420C:\Users\admin\Desktop\mkgdzzqlad.exeC:\Users\admin\Desktop\mkgdzzqlad.exe—toffrqobjk.exe
User:
admin
Company:
QQ:6365272
Integrity Level:
HIGH
Description:
固定打怪,新手村任务,门派任务
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\mkgdzzqlad.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
436C:\Users\admin\Desktop\gvvidqvpje.exe update oowgpspksg.exeC:\Users\admin\Desktop\gvvidqvpje.exe
gvvidqvpje.exe
User:
admin
Company:
QQ:6365272
Integrity Level:
HIGH
Description:
固定打怪,新手村任务,门派任务
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\gvvidqvpje.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
504C:\Users\admin\Desktop\juqcyakxpf.exeC:\Users\admin\Desktop\juqcyakxpf.exe—mfjcftxqou.exe
User:
admin
Company:
QQ:6365272
Integrity Level:
HIGH
Description:
固定打怪,新手村任务,门派任务
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\juqcyakxpf.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
504C:\Users\admin\Desktop\wohdcqxzxi.exe update btdbbusqsb.exeC:\Users\admin\Desktop\wohdcqxzxi.exe
wohdcqxzxi.exe
User:
admin
Company:
QQ:6365272
Integrity Level:
HIGH
Description:
固定打怪,新手村任务,门派任务
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\wohdcqxzxi.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
536C:\Users\admin\Desktop\fvoxyacwrb.exeC:\Users\admin\Desktop\fvoxyacwrb.exe—eggzjcwybg.exe
User:
admin
Company:
QQ:6365272
Integrity Level:
HIGH
Description:
固定打怪,新手村任务,门派任务
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\fvoxyacwrb.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
620C:\Users\admin\Desktop\sjuptpvwvb.exe update epxvgstiyd.exeC:\Users\admin\Desktop\sjuptpvwvb.exe
sjuptpvwvb.exe
User:
admin
Company:
QQ:6365272
Integrity Level:
HIGH
Description:
固定打怪,新手村任务,门派任务
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\sjuptpvwvb.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
684C:\Users\admin\Desktop\zhaynchxhs.exe update wthoczabzg.exeC:\Users\admin\Desktop\zhaynchxhs.exe
zhaynchxhs.exe
User:
admin
Company:
QQ:6365272
Integrity Level:
HIGH
Description:
固定打怪,新手村任务,门派任务
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\zhaynchxhs.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
Total events
46 442
Read events
46 442
Write events
0
Delete events
0

Modification events

No data
Executable files
124
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
2280ryhqscxais.exeC:\Users\admin\Desktop\rrqjuohiwd.exeexecutable
MD5:CA7F9A57FA48552BC8D8FB94C3AF778C
SHA256:3783A867F29581D17DBA47AB5F5CE7248B476FA45C2F949D6760886DAEF10DC0
3908wpxoncwcsw.exeC:\Users\admin\Desktop\hzmusayftu.exeexecutable
MD5:69E9AF8507F9F906EE02FAF2E2AC58BB
SHA256:420F4B4FC7C2D3887DA67F9BC813A6841326C873102932804C138A651D45BBE0
13562025-06-21_d2e3f0fec1a2b27806b413cbf3b1e8ea_amadey_elex_smoke-loader_stop.exeC:\Users\admin\Desktop\update.exeexecutable
MD5:22C473A29E1684BBD8D8B7BC68A3D7E1
SHA256:CB0E404A5D41AA05A78B63B208E55E5EDAC6FA146B1C1F3AC7165FC42D8059B5
5616hzmusayftu.exeC:\Users\admin\Desktop\mfjcftxqou.exeexecutable
MD5:7AD05308463F128BB664B9CA117CC9DC
SHA256:A50A785D8222B92D27F2F902A8E1931565494F344C2C2F7BF7174DADF26931D3
1180rccbismcdp.exeC:\Users\admin\Desktop\rcdhuaruyn.exeexecutable
MD5:AE363DBED45784D8D3763BF69BDA09C0
SHA256:5E69045133F5289E4C293FF220C7485B7AF7074E65F85592C1638BB56326BB7D
6980mjgszzjley.exeC:\Users\admin\Desktop\zhaynchxhs.exeexecutable
MD5:74F1289D87A51105EFDEACF34E4CB796
SHA256:7408C48E7652F3A436DCA9DE052002D2AE731A03A5EAB7A203D56457FFCABE62
5708gxgkvlprpj.exeC:\Users\admin\Desktop\iluqqfrrmm.exeexecutable
MD5:4B20F0E5D800D40687A803E0525CDBCA
SHA256:02EFC1EB829AAA12D5CE7D6091E304C625531A94D741E3EA9487AAF85B800CB8
5552iluqqfrrmm.exeC:\Users\admin\Desktop\ojcjuaddkd.exeexecutable
MD5:2D07F630B4164202407341FCC4B4A35F
SHA256:ECE0FFEBAE585F3B5ECB2EA7546D7F982C1914C71C79120FD55F3FF88741A66D
684zhaynchxhs.exeC:\Users\admin\Desktop\wthoczabzg.exeexecutable
MD5:BC5791D4C7B95D3F9A9C81D6DAB23C53
SHA256:57BB4A38F677FC9FD42AAE48D96B38708F9E8FCFC1D2348168D23773AD65D35D
5348ojcjuaddkd.exeC:\Users\admin\Desktop\bmtcfhumbt.exeexecutable
MD5:EDB5993D363703EAAB676AF7C51CA1EB
SHA256:C98B45608357BD561273990D97E9FF0CDBD7ACE3A4E2E84FFF947D410A683DD8
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
8
TCP/UDP connections
22
DNS requests
8
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5944
MoUsoCoreWorker.exe
GET
200
23.53.40.176:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5904
RUXIMICS.exe
GET
200
23.53.40.176:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
23.53.40.176:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5944
MoUsoCoreWorker.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5904
RUXIMICS.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
POST
500
20.83.72.98:443
https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail
unknown
xml
512 b
whitelisted
—
—
POST
500
20.83.72.98:443
https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail
unknown
xml
512 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1268
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
5944
MoUsoCoreWorker.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5904
RUXIMICS.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1268
svchost.exe
23.53.40.176:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5944
MoUsoCoreWorker.exe
23.53.40.176:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5904
RUXIMICS.exe
23.53.40.176:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
1268
svchost.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
5944
MoUsoCoreWorker.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.185.110
whitelisted
crl.microsoft.com
  • 23.53.40.176
  • 23.53.40.178
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
settings-win.data.microsoft.com
  • 4.231.128.59
whitelisted
activation-v2.sls.microsoft.com
  • 20.83.72.98
  • 40.91.76.224
whitelisted
self.events.data.microsoft.com
  • 52.168.117.171
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
2025-06-21_d2e3f0fec1a2b27806b413cbf3b1e8ea_amadey_elex_smoke-loader_stop