Malware Analysis Report

2025-08-05 14:40

Sample ID 250703-f5yh9ahq5w
Target 2025-07-03_07db9ac75e149b7f06fe2ecb428844bb_amadey_elex_smoke-loader_stop_swisyn
SHA256 1c646d1f4c5e5f034359ebeeb75bbc8b57a82f12c220f4b244e724649fb99b19
Tags
bootkit defense_evasion discovery persistence
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V16

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

1c646d1f4c5e5f034359ebeeb75bbc8b57a82f12c220f4b244e724649fb99b19

Threat Level: Known bad

The file 2025-07-03_07db9ac75e149b7f06fe2ecb428844bb_amadey_elex_smoke-loader_stop_swisyn was found to be: Known bad.

Malicious Activity Summary

bootkit defense_evasion discovery persistence

Modifies visiblity of hidden/system files in Explorer

Executes dropped EXE

Writes to the Master Boot Record (MBR)

Adds Run key to start application

Drops file in System32 directory

Drops file in Windows directory

Unsigned PE

System Location Discovery: System Language Discovery

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Suspicious use of SetWindowsHookEx

Suspicious behavior: GetForegroundWindowSpam

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2025-07-03 05:27

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2025-07-03 05:27

Reported

2025-07-03 05:30

Platform

win10v2004-20250619-en

Max time kernel

150s

Max time network

147s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2025-07-03_07db9ac75e149b7f06fe2ecb428844bb_amadey_elex_smoke-loader_stop_swisyn.exe"

Signatures

Modifies visiblity of hidden/system files in Explorer

defense_evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-4097847965-469305640-2969917343-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" \??\c:\windows\resources\themes\explorer.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4097847965-469305640-2969917343-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" \??\c:\windows\resources\svchost.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO" \??\c:\windows\resources\themes\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO" \??\c:\windows\resources\themes\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO" \??\c:\windows\resources\svchost.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO" \??\c:\windows\resources\svchost.exe N/A

Writes to the Master Boot Record (MBR)

bootkit persistence
Description Indicator Process Target
File opened for modification \??\PhysicalDrive0 \??\c:\users\admin\appdata\local\temp\2025-07-03_07db9ac75e149b7f06fe2ecb428844bb_amadey_elex_smoke-loader_stop_swisyn.exe  N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\explorer.exe \??\c:\windows\resources\themes\explorer.exe N/A
File opened for modification C:\Windows\SysWOW64\explorer.exe \??\c:\windows\resources\svchost.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Resources\Themes\icsys.icn.exe C:\Users\Admin\AppData\Local\Temp\2025-07-03_07db9ac75e149b7f06fe2ecb428844bb_amadey_elex_smoke-loader_stop_swisyn.exe N/A
File opened for modification \??\c:\windows\resources\themes\explorer.exe C:\Windows\Resources\Themes\icsys.icn.exe N/A
File opened for modification \??\c:\windows\resources\spoolsv.exe \??\c:\windows\resources\themes\explorer.exe N/A
File opened for modification \??\c:\windows\resources\svchost.exe \??\c:\windows\resources\spoolsv.exe N/A
File opened for modification C:\Windows\Resources\tjud.exe \??\c:\windows\resources\themes\explorer.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language \??\c:\users\admin\appdata\local\temp\2025-07-03_07db9ac75e149b7f06fe2ecb428844bb_amadey_elex_smoke-loader_stop_swisyn.exe  N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Resources\Themes\icsys.icn.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language \??\c:\windows\resources\spoolsv.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language \??\c:\windows\resources\spoolsv.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language \??\c:\windows\resources\themes\explorer.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language \??\c:\windows\resources\svchost.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language \??\c:\windows\resources\svchost.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language \??\c:\windows\resources\themes\explorer.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\2025-07-03_07db9ac75e149b7f06fe2ecb428844bb_amadey_elex_smoke-loader_stop_swisyn.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_07db9ac75e149b7f06fe2ecb428844bb_amadey_elex_smoke-loader_stop_swisyn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_07db9ac75e149b7f06fe2ecb428844bb_amadey_elex_smoke-loader_stop_swisyn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_07db9ac75e149b7f06fe2ecb428844bb_amadey_elex_smoke-loader_stop_swisyn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_07db9ac75e149b7f06fe2ecb428844bb_amadey_elex_smoke-loader_stop_swisyn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_07db9ac75e149b7f06fe2ecb428844bb_amadey_elex_smoke-loader_stop_swisyn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_07db9ac75e149b7f06fe2ecb428844bb_amadey_elex_smoke-loader_stop_swisyn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_07db9ac75e149b7f06fe2ecb428844bb_amadey_elex_smoke-loader_stop_swisyn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_07db9ac75e149b7f06fe2ecb428844bb_amadey_elex_smoke-loader_stop_swisyn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_07db9ac75e149b7f06fe2ecb428844bb_amadey_elex_smoke-loader_stop_swisyn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_07db9ac75e149b7f06fe2ecb428844bb_amadey_elex_smoke-loader_stop_swisyn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_07db9ac75e149b7f06fe2ecb428844bb_amadey_elex_smoke-loader_stop_swisyn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_07db9ac75e149b7f06fe2ecb428844bb_amadey_elex_smoke-loader_stop_swisyn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_07db9ac75e149b7f06fe2ecb428844bb_amadey_elex_smoke-loader_stop_swisyn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_07db9ac75e149b7f06fe2ecb428844bb_amadey_elex_smoke-loader_stop_swisyn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_07db9ac75e149b7f06fe2ecb428844bb_amadey_elex_smoke-loader_stop_swisyn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_07db9ac75e149b7f06fe2ecb428844bb_amadey_elex_smoke-loader_stop_swisyn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_07db9ac75e149b7f06fe2ecb428844bb_amadey_elex_smoke-loader_stop_swisyn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_07db9ac75e149b7f06fe2ecb428844bb_amadey_elex_smoke-loader_stop_swisyn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_07db9ac75e149b7f06fe2ecb428844bb_amadey_elex_smoke-loader_stop_swisyn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_07db9ac75e149b7f06fe2ecb428844bb_amadey_elex_smoke-loader_stop_swisyn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_07db9ac75e149b7f06fe2ecb428844bb_amadey_elex_smoke-loader_stop_swisyn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_07db9ac75e149b7f06fe2ecb428844bb_amadey_elex_smoke-loader_stop_swisyn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_07db9ac75e149b7f06fe2ecb428844bb_amadey_elex_smoke-loader_stop_swisyn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_07db9ac75e149b7f06fe2ecb428844bb_amadey_elex_smoke-loader_stop_swisyn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_07db9ac75e149b7f06fe2ecb428844bb_amadey_elex_smoke-loader_stop_swisyn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_07db9ac75e149b7f06fe2ecb428844bb_amadey_elex_smoke-loader_stop_swisyn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_07db9ac75e149b7f06fe2ecb428844bb_amadey_elex_smoke-loader_stop_swisyn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_07db9ac75e149b7f06fe2ecb428844bb_amadey_elex_smoke-loader_stop_swisyn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_07db9ac75e149b7f06fe2ecb428844bb_amadey_elex_smoke-loader_stop_swisyn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_07db9ac75e149b7f06fe2ecb428844bb_amadey_elex_smoke-loader_stop_swisyn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_07db9ac75e149b7f06fe2ecb428844bb_amadey_elex_smoke-loader_stop_swisyn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_07db9ac75e149b7f06fe2ecb428844bb_amadey_elex_smoke-loader_stop_swisyn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A \??\c:\windows\resources\themes\explorer.exe N/A
N/A N/A \??\c:\windows\resources\svchost.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4708 wrote to memory of 2416 N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_07db9ac75e149b7f06fe2ecb428844bb_amadey_elex_smoke-loader_stop_swisyn.exe \??\c:\users\admin\appdata\local\temp\2025-07-03_07db9ac75e149b7f06fe2ecb428844bb_amadey_elex_smoke-loader_stop_swisyn.exe 
PID 4708 wrote to memory of 2416 N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_07db9ac75e149b7f06fe2ecb428844bb_amadey_elex_smoke-loader_stop_swisyn.exe \??\c:\users\admin\appdata\local\temp\2025-07-03_07db9ac75e149b7f06fe2ecb428844bb_amadey_elex_smoke-loader_stop_swisyn.exe 
PID 4708 wrote to memory of 2416 N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_07db9ac75e149b7f06fe2ecb428844bb_amadey_elex_smoke-loader_stop_swisyn.exe \??\c:\users\admin\appdata\local\temp\2025-07-03_07db9ac75e149b7f06fe2ecb428844bb_amadey_elex_smoke-loader_stop_swisyn.exe 
PID 4708 wrote to memory of 3440 N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_07db9ac75e149b7f06fe2ecb428844bb_amadey_elex_smoke-loader_stop_swisyn.exe C:\Windows\Resources\Themes\icsys.icn.exe
PID 4708 wrote to memory of 3440 N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_07db9ac75e149b7f06fe2ecb428844bb_amadey_elex_smoke-loader_stop_swisyn.exe C:\Windows\Resources\Themes\icsys.icn.exe
PID 4708 wrote to memory of 3440 N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_07db9ac75e149b7f06fe2ecb428844bb_amadey_elex_smoke-loader_stop_swisyn.exe C:\Windows\Resources\Themes\icsys.icn.exe
PID 3440 wrote to memory of 2708 N/A C:\Windows\Resources\Themes\icsys.icn.exe \??\c:\windows\resources\themes\explorer.exe
PID 3440 wrote to memory of 2708 N/A C:\Windows\Resources\Themes\icsys.icn.exe \??\c:\windows\resources\themes\explorer.exe
PID 3440 wrote to memory of 2708 N/A C:\Windows\Resources\Themes\icsys.icn.exe \??\c:\windows\resources\themes\explorer.exe
PID 2708 wrote to memory of 4996 N/A \??\c:\windows\resources\themes\explorer.exe \??\c:\windows\resources\spoolsv.exe
PID 2708 wrote to memory of 4996 N/A \??\c:\windows\resources\themes\explorer.exe \??\c:\windows\resources\spoolsv.exe
PID 2708 wrote to memory of 4996 N/A \??\c:\windows\resources\themes\explorer.exe \??\c:\windows\resources\spoolsv.exe
PID 4996 wrote to memory of 4876 N/A \??\c:\windows\resources\spoolsv.exe \??\c:\windows\resources\svchost.exe
PID 4996 wrote to memory of 4876 N/A \??\c:\windows\resources\spoolsv.exe \??\c:\windows\resources\svchost.exe
PID 4996 wrote to memory of 4876 N/A \??\c:\windows\resources\spoolsv.exe \??\c:\windows\resources\svchost.exe
PID 4876 wrote to memory of 1376 N/A \??\c:\windows\resources\svchost.exe \??\c:\windows\resources\spoolsv.exe
PID 4876 wrote to memory of 1376 N/A \??\c:\windows\resources\svchost.exe \??\c:\windows\resources\spoolsv.exe
PID 4876 wrote to memory of 1376 N/A \??\c:\windows\resources\svchost.exe \??\c:\windows\resources\spoolsv.exe
PID 4132 wrote to memory of 3504 N/A C:\Windows\system32\cmd.exe \??\c:\windows\resources\svchost.exe
PID 4132 wrote to memory of 3504 N/A C:\Windows\system32\cmd.exe \??\c:\windows\resources\svchost.exe
PID 4132 wrote to memory of 3504 N/A C:\Windows\system32\cmd.exe \??\c:\windows\resources\svchost.exe
PID 3472 wrote to memory of 2196 N/A C:\Windows\system32\cmd.exe \??\c:\windows\resources\themes\explorer.exe
PID 3472 wrote to memory of 2196 N/A C:\Windows\system32\cmd.exe \??\c:\windows\resources\themes\explorer.exe
PID 3472 wrote to memory of 2196 N/A C:\Windows\system32\cmd.exe \??\c:\windows\resources\themes\explorer.exe

Processes

C:\Users\Admin\AppData\Local\Temp\2025-07-03_07db9ac75e149b7f06fe2ecb428844bb_amadey_elex_smoke-loader_stop_swisyn.exe

"C:\Users\Admin\AppData\Local\Temp\2025-07-03_07db9ac75e149b7f06fe2ecb428844bb_amadey_elex_smoke-loader_stop_swisyn.exe"

\??\c:\users\admin\appdata\local\temp\2025-07-03_07db9ac75e149b7f06fe2ecb428844bb_amadey_elex_smoke-loader_stop_swisyn.exe 

c:\users\admin\appdata\local\temp\2025-07-03_07db9ac75e149b7f06fe2ecb428844bb_amadey_elex_smoke-loader_stop_swisyn.exe 

C:\Windows\Resources\Themes\icsys.icn.exe

C:\Windows\Resources\Themes\icsys.icn.exe

\??\c:\windows\resources\themes\explorer.exe

c:\windows\resources\themes\explorer.exe

\??\c:\windows\resources\spoolsv.exe

c:\windows\resources\spoolsv.exe SE

\??\c:\windows\resources\svchost.exe

c:\windows\resources\svchost.exe

\??\c:\windows\resources\spoolsv.exe

c:\windows\resources\spoolsv.exe PR

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c c:\windows\resources\themes\explorer.exe RO

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c c:\windows\resources\svchost.exe RO

\??\c:\windows\resources\svchost.exe

c:\windows\resources\svchost.exe RO

\??\c:\windows\resources\themes\explorer.exe

c:\windows\resources\themes\explorer.exe RO

Network

Country Destination Domain Proto
US 8.8.8.8:53 www.360tools.org udp
US 8.8.8.8:53 update.360tools.org udp
US 8.8.8.8:53 update.360tools.org udp
US 8.8.8.8:53 update.360tools.org udp
US 8.8.8.8:53 update.360tools.org udp
US 8.8.8.8:53 update.360tools.org udp
US 8.8.8.8:53 update.360tools.org udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 update.360tools.org udp
US 8.8.8.8:53 update.360tools.org udp
US 8.8.8.8:53 update.360tools.org udp
US 8.8.8.8:53 update.360tools.org udp
GB 142.250.179.227:80 c.pki.goog tcp
US 8.8.8.8:53 update.360tools.org udp
US 8.8.8.8:53 update.360tools.org udp
US 8.8.8.8:53 update.360tools.org udp
US 8.8.8.8:53 update.360tools.org udp
US 8.8.8.8:53 update.360tools.org udp
US 8.8.8.8:53 update.360tools.org udp
US 8.8.8.8:53 update.360tools.org udp
US 8.8.8.8:53 update.360tools.org udp
US 8.8.8.8:53 update.360tools.org udp
US 8.8.8.8:53 update.360tools.org udp
US 8.8.8.8:53 update.360tools.org udp
US 8.8.8.8:53 www.360tools.org udp

Files

memory/4708-0-0x0000000000400000-0x000000000041F000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\2025-07-03_07db9ac75e149b7f06fe2ecb428844bb_amadey_elex_smoke-loader_stop_swisyn.exe 

MD5 489c0f5b5966f14f43a52a5860489a14
SHA1 ccd2de35d4ddc416347b5ddce0f809b7cda1d165
SHA256 9d24373fac83e14571ef0f9f4f2083ca137f16039058b8dd80535b38e7db1974
SHA512 6a31c1c7a9232cf6fdfcbd777eb48b9a8d84eb9c69f39ef7c269dd8a8483756f4ddcae5c8478b100d165bfae9bf024396cd21aba77f996826cea4913f382f024

C:\Users\Public\Documents\Baidu\Common\I18N\conf.db

MD5 33039bae56792bcc6c5bfefaab4002ee
SHA1 428af59f494f19f23b19388fcb8fefd9491e301f
SHA256 b84a26fc26b1803f4a1b52f606c7a2fa4e15172c02a0e6333694b1377a56caf0
SHA512 4e7beb9794c164474caad667819cf8be7247e512be51449f419da7561a908caef21edecb16683f629f5a50c2cd6fcddf996a48ab46470da65ace98a2a193f8f0

memory/2416-18-0x00000000013A0000-0x00000000013A1000-memory.dmp

C:\Windows\Resources\Themes\icsys.icn.exe

MD5 e53e7c00ebc9c91f8e438d3e5f972405
SHA1 89f45635f5369adcb0fac8dcdfecc08f496bbf04
SHA256 3bce5366a0b06f4078417ae88f9efe71293ac18623749387058776dc3944cc78
SHA512 f5c47d3057c313bf2ce72de3cb252bce04b5b46bdce92b9c35245605fe677ca89dad2cb6d2f47017d80e597f760cd6f2c308a0ee276e076c0f1dd6cc6d930e41

memory/3440-28-0x0000000000400000-0x000000000041F000-memory.dmp

C:\Windows\Resources\Themes\explorer.exe

MD5 e7ece1f9d048decafe4d33509e23d1da
SHA1 2eac31d35eda722f281757405b26bf09da09f70d
SHA256 b30b634376d91174dc5a97d49a6d3e94994b85f4a24b8c9d8b960c9fb66a5b0c
SHA512 efc9ba2cdfe6facb9499514cb64422c5fe436f16cec70fc8aea7503428668f7f383f2d75d5f87c2b1425056b61df6151f237406d32543b742933a8966cb85635

\??\c:\windows\resources\spoolsv.exe

MD5 a4ddb5cafab9c3681d9f7db9e55749a2
SHA1 4ce490c50ac18290ea1a9700964905ee3d780efe
SHA256 4cc2a79704cb68f55272995bab8b35546caf41ec9b4461aa2c575ebe8b4014d5
SHA512 7caf04d807b47fe2770f4740613bca46ddba181b37c93100d52a535f6d3399e2d1cb301c8b9a38aff80ca4025b6e42e399382d047033c5b145aca2cd09582277

memory/4996-47-0x0000000000400000-0x000000000041F000-memory.dmp

C:\Windows\Resources\svchost.exe

MD5 f643f9525d3babeb5cbbc05ccafdc7f9
SHA1 8e88b63d9557a40ccb40ce338d78c0c6f0033bb6
SHA256 17b49f0672ed8490dc38c26fddfddd2355bdc6ae29974a08d3b4c295ab35815d
SHA512 5c43bb57d267279276cca9abcf8b0d6534d89b5d12416f2d09f0f63e5681f247e4a0f94fb27c33daaf76c61e1ccb24e8f963d67f7ab273bf46a0d26e09d9e975

memory/1376-61-0x0000000000400000-0x000000000041F000-memory.dmp

memory/4996-62-0x0000000000400000-0x000000000041F000-memory.dmp

memory/3440-63-0x0000000000400000-0x000000000041F000-memory.dmp

memory/4708-64-0x0000000000400000-0x000000000041F000-memory.dmp

memory/3504-70-0x0000000000400000-0x000000000041F000-memory.dmp

memory/2196-74-0x0000000000400000-0x000000000041F000-memory.dmp

memory/2708-76-0x0000000000400000-0x000000000041F000-memory.dmp

memory/4876-77-0x0000000000400000-0x000000000041F000-memory.dmp