Malware Analysis Report

2025-08-10 20:05

Sample ID 250704-phpr9stjw6
Target 2025-07-04_9f53efdb1a9a2d227de8659286c187ad_amadey_black-basta_darkgate_elex_hawkeye_luca-stealer_rhadamanthys_smoke-loader
SHA256 accfbe97eeacd4492b319f3377fc40b7a58440e93bcdfcc195b9672e61175dc3
Tags
discovery persistence spyware stealer
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V16

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

accfbe97eeacd4492b319f3377fc40b7a58440e93bcdfcc195b9672e61175dc3

Threat Level: Shows suspicious behavior

The file 2025-07-04_9f53efdb1a9a2d227de8659286c187ad_amadey_black-basta_darkgate_elex_hawkeye_luca-stealer_rhadamanthys_smoke-loader was found to be: Shows suspicious behavior.

Malicious Activity Summary

discovery persistence spyware stealer

Reads user/profile data of web browsers

Executes dropped EXE

Adds Run key to start application

Drops autorun.inf file

Drops file in System32 directory

Drops file in Program Files directory

Unsigned PE

System Location Discovery: System Language Discovery

NTFS ADS

Suspicious use of WriteProcessMemory

Suspicious use of SetWindowsHookEx

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2025-07-04 12:20

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2025-07-04 12:19

Reported

2025-07-04 12:22

Platform

win10v2004-20250610-en

Max time kernel

116s

Max time network

136s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2025-07-04_9f53efdb1a9a2d227de8659286c187ad_amadey_black-basta_darkgate_elex_hawkeye_luca-stealer_rhadamanthys_smoke-loader.exe"

Signatures

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\905c0769f9a06c95a24ddf945\patcher.exe N/A

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" C:\Users\Admin\AppData\Local\Temp\2025-07-04_9f53efdb1a9a2d227de8659286c187ad_amadey_black-basta_darkgate_elex_hawkeye_luca-stealer_rhadamanthys_smoke-loader.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" C:\905c0769f9a06c95a24ddf945\patcher.exe N/A

Drops autorun.inf file

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\:\autorun.inf C:\905c0769f9a06c95a24ddf945\patcher.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf C:\Users\Admin\AppData\Local\Temp\2025-07-04_9f53efdb1a9a2d227de8659286c187ad_amadey_black-basta_darkgate_elex_hawkeye_luca-stealer_rhadamanthys_smoke-loader.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\:\autorun.inf C:\905c0769f9a06c95a24ddf945\patcher.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe C:\905c0769f9a06c95a24ddf945\patcher.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe C:\905c0769f9a06c95a24ddf945\patcher.exe N/A
File created C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE C:\905c0769f9a06c95a24ddf945\patcher.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe C:\Users\Admin\AppData\Local\Temp\2025-07-04_9f53efdb1a9a2d227de8659286c187ad_amadey_black-basta_darkgate_elex_hawkeye_luca-stealer_rhadamanthys_smoke-loader.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe C:\Users\Admin\AppData\Local\Temp\2025-07-04_9f53efdb1a9a2d227de8659286c187ad_amadey_black-basta_darkgate_elex_hawkeye_luca-stealer_rhadamanthys_smoke-loader.exe N/A
File created C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevated_tracing_service.exe C:\905c0769f9a06c95a24ddf945\patcher.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.43\MicrosoftEdgeUpdateSetup.exe$ C:\Users\Admin\AppData\Local\Temp\2025-07-04_9f53efdb1a9a2d227de8659286c187ad_amadey_black-basta_darkgate_elex_hawkeye_luca-stealer_rhadamanthys_smoke-loader.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe C:\905c0769f9a06c95a24ddf945\patcher.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe C:\Users\Admin\AppData\Local\Temp\2025-07-04_9f53efdb1a9a2d227de8659286c187ad_amadey_black-basta_darkgate_elex_hawkeye_luca-stealer_rhadamanthys_smoke-loader.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE$ C:\Users\Admin\AppData\Local\Temp\2025-07-04_9f53efdb1a9a2d227de8659286c187ad_amadey_black-basta_darkgate_elex_hawkeye_luca-stealer_rhadamanthys_smoke-loader.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe C:\Users\Admin\AppData\Local\Temp\2025-07-04_9f53efdb1a9a2d227de8659286c187ad_amadey_black-basta_darkgate_elex_hawkeye_luca-stealer_rhadamanthys_smoke-loader.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE C:\905c0769f9a06c95a24ddf945\patcher.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe$ C:\905c0769f9a06c95a24ddf945\patcher.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe C:\905c0769f9a06c95a24ddf945\patcher.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\msedge_pwa_launcher.exe$ C:\905c0769f9a06c95a24ddf945\patcher.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.69\msedgewebview2.exe$ C:\Users\Admin\AppData\Local\Temp\2025-07-04_9f53efdb1a9a2d227de8659286c187ad_amadey_black-basta_darkgate_elex_hawkeye_luca-stealer_rhadamanthys_smoke-loader.exe N/A
File opened for modification C:\Program Files (x86)\Windows Media Player\wmpconfig.exe C:\Users\Admin\AppData\Local\Temp\2025-07-04_9f53efdb1a9a2d227de8659286c187ad_amadey_black-basta_darkgate_elex_hawkeye_luca-stealer_rhadamanthys_smoke-loader.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE C:\905c0769f9a06c95a24ddf945\patcher.exe N/A
File created C:\Program Files\Java\jdk-1.8\bin\klist.exe C:\905c0769f9a06c95a24ddf945\patcher.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe C:\905c0769f9a06c95a24ddf945\patcher.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe C:\905c0769f9a06c95a24ddf945\patcher.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe$ C:\905c0769f9a06c95a24ddf945\patcher.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe C:\905c0769f9a06c95a24ddf945\patcher.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE C:\905c0769f9a06c95a24ddf945\patcher.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\chrmstp.exe C:\Users\Admin\AppData\Local\Temp\2025-07-04_9f53efdb1a9a2d227de8659286c187ad_amadey_black-basta_darkgate_elex_hawkeye_luca-stealer_rhadamanthys_smoke-loader.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe C:\Users\Admin\AppData\Local\Temp\2025-07-04_9f53efdb1a9a2d227de8659286c187ad_amadey_black-basta_darkgate_elex_hawkeye_luca-stealer_rhadamanthys_smoke-loader.exe N/A
File created C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\Installer\setup.exe C:\Users\Admin\AppData\Local\Temp\2025-07-04_9f53efdb1a9a2d227de8659286c187ad_amadey_black-basta_darkgate_elex_hawkeye_luca-stealer_rhadamanthys_smoke-loader.exe N/A
File created C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\msedge_proxy.exe C:\905c0769f9a06c95a24ddf945\patcher.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.43\MicrosoftEdgeUpdateComRegisterShell64.exe$ C:\905c0769f9a06c95a24ddf945\patcher.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe C:\Users\Admin\AppData\Local\Temp\2025-07-04_9f53efdb1a9a2d227de8659286c187ad_amadey_black-basta_darkgate_elex_hawkeye_luca-stealer_rhadamanthys_smoke-loader.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe$ C:\905c0769f9a06c95a24ddf945\patcher.exe N/A
File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe C:\Users\Admin\AppData\Local\Temp\2025-07-04_9f53efdb1a9a2d227de8659286c187ad_amadey_black-basta_darkgate_elex_hawkeye_luca-stealer_rhadamanthys_smoke-loader.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe C:\905c0769f9a06c95a24ddf945\patcher.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe C:\905c0769f9a06c95a24ddf945\patcher.exe N/A
File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\BHO\ie_to_edge_stub.exe C:\905c0769f9a06c95a24ddf945\patcher.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\pwahelper.exe C:\905c0769f9a06c95a24ddf945\patcher.exe N/A
File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\cookie_exporter.exe C:\905c0769f9a06c95a24ddf945\patcher.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe C:\905c0769f9a06c95a24ddf945\patcher.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\msotd.exe C:\Users\Admin\AppData\Local\Temp\2025-07-04_9f53efdb1a9a2d227de8659286c187ad_amadey_black-basta_darkgate_elex_hawkeye_luca-stealer_rhadamanthys_smoke-loader.exe N/A
File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe C:\Users\Admin\AppData\Local\Temp\2025-07-04_9f53efdb1a9a2d227de8659286c187ad_amadey_black-basta_darkgate_elex_hawkeye_luca-stealer_rhadamanthys_smoke-loader.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\YourPhone.exe C:\905c0769f9a06c95a24ddf945\patcher.exe N/A
File opened for modification C:\Program Files\7-Zip\7z.exe$ C:\Users\Admin\AppData\Local\Temp\2025-07-04_9f53efdb1a9a2d227de8659286c187ad_amadey_black-basta_darkgate_elex_hawkeye_luca-stealer_rhadamanthys_smoke-loader.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe$ C:\905c0769f9a06c95a24ddf945\patcher.exe N/A
File created C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe C:\905c0769f9a06c95a24ddf945\patcher.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe C:\905c0769f9a06c95a24ddf945\patcher.exe N/A
File created C:\Program Files\Java\jdk-1.8\bin\schemagen.exe C:\905c0769f9a06c95a24ddf945\patcher.exe N/A
File opened for modification C:\Program Files\Windows Photo Viewer\ImagingDevices.exe C:\905c0769f9a06c95a24ddf945\patcher.exe N/A
File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateCore.exe C:\905c0769f9a06c95a24ddf945\patcher.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge.exe C:\Users\Admin\AppData\Local\Temp\2025-07-04_9f53efdb1a9a2d227de8659286c187ad_amadey_black-basta_darkgate_elex_hawkeye_luca-stealer_rhadamanthys_smoke-loader.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe C:\Users\Admin\AppData\Local\Temp\2025-07-04_9f53efdb1a9a2d227de8659286c187ad_amadey_black-basta_darkgate_elex_hawkeye_luca-stealer_rhadamanthys_smoke-loader.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE C:\Users\Admin\AppData\Local\Temp\2025-07-04_9f53efdb1a9a2d227de8659286c187ad_amadey_black-basta_darkgate_elex_hawkeye_luca-stealer_rhadamanthys_smoke-loader.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe$ C:\Users\Admin\AppData\Local\Temp\2025-07-04_9f53efdb1a9a2d227de8659286c187ad_amadey_black-basta_darkgate_elex_hawkeye_luca-stealer_rhadamanthys_smoke-loader.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE C:\Users\Admin\AppData\Local\Temp\2025-07-04_9f53efdb1a9a2d227de8659286c187ad_amadey_black-basta_darkgate_elex_hawkeye_luca-stealer_rhadamanthys_smoke-loader.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe$ C:\905c0769f9a06c95a24ddf945\patcher.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.69\msedge.exe C:\Users\Admin\AppData\Local\Temp\2025-07-04_9f53efdb1a9a2d227de8659286c187ad_amadey_black-basta_darkgate_elex_hawkeye_luca-stealer_rhadamanthys_smoke-loader.exe N/A
File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe C:\Users\Admin\AppData\Local\Temp\2025-07-04_9f53efdb1a9a2d227de8659286c187ad_amadey_black-basta_darkgate_elex_hawkeye_luca-stealer_rhadamanthys_smoke-loader.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe C:\905c0769f9a06c95a24ddf945\patcher.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe C:\905c0769f9a06c95a24ddf945\patcher.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\cookie_exporter.exe C:\Users\Admin\AppData\Local\Temp\2025-07-04_9f53efdb1a9a2d227de8659286c187ad_amadey_black-basta_darkgate_elex_hawkeye_luca-stealer_rhadamanthys_smoke-loader.exe N/A
File created C:\Program Files\Java\jdk-1.8\bin\javac.exe C:\905c0769f9a06c95a24ddf945\patcher.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe$ C:\905c0769f9a06c95a24ddf945\patcher.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe C:\905c0769f9a06c95a24ddf945\patcher.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVLP.exe C:\Users\Admin\AppData\Local\Temp\2025-07-04_9f53efdb1a9a2d227de8659286c187ad_amadey_black-basta_darkgate_elex_hawkeye_luca-stealer_rhadamanthys_smoke-loader.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE C:\Users\Admin\AppData\Local\Temp\2025-07-04_9f53efdb1a9a2d227de8659286c187ad_amadey_black-basta_darkgate_elex_hawkeye_luca-stealer_rhadamanthys_smoke-loader.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\2025-07-04_9f53efdb1a9a2d227de8659286c187ad_amadey_black-basta_darkgate_elex_hawkeye_luca-stealer_rhadamanthys_smoke-loader.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\905c0769f9a06c95a24ddf945\patcher.exe N/A

NTFS ADS

Description Indicator Process Target
File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf C:\Users\Admin\AppData\Local\Temp\2025-07-04_9f53efdb1a9a2d227de8659286c187ad_amadey_black-basta_darkgate_elex_hawkeye_luca-stealer_rhadamanthys_smoke-loader.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2604 wrote to memory of 1612 N/A C:\Windows\system32\cmd.exe C:\905c0769f9a06c95a24ddf945\patcher.exe
PID 2604 wrote to memory of 1612 N/A C:\Windows\system32\cmd.exe C:\905c0769f9a06c95a24ddf945\patcher.exe
PID 2604 wrote to memory of 1612 N/A C:\Windows\system32\cmd.exe C:\905c0769f9a06c95a24ddf945\patcher.exe

Processes

C:\Users\Admin\AppData\Local\Temp\2025-07-04_9f53efdb1a9a2d227de8659286c187ad_amadey_black-basta_darkgate_elex_hawkeye_luca-stealer_rhadamanthys_smoke-loader.exe

"C:\Users\Admin\AppData\Local\Temp\2025-07-04_9f53efdb1a9a2d227de8659286c187ad_amadey_black-basta_darkgate_elex_hawkeye_luca-stealer_rhadamanthys_smoke-loader.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\905c0769f9a06c95a24ddf945\patcher.exe

C:\905c0769f9a06c95a24ddf945\patcher.exe

C:\905c0769f9a06c95a24ddf945\patcher.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 c.pki.goog udp
GB 142.250.180.3:80 c.pki.goog tcp

Files

memory/6044-0-0x0000000000400000-0x000000000040D000-memory.dmp

C:\905c0769f9a06c95a24ddf945\patcher.exe

MD5 9f53efdb1a9a2d227de8659286c187ad
SHA1 9765f22507889a4733ef1ddc2c6cb9e9d688325e
SHA256 accfbe97eeacd4492b319f3377fc40b7a58440e93bcdfcc195b9672e61175dc3
SHA512 06b2d78c87ec9ad59c5ef9d9922894370a45861c102fc81b90d7966da42c6a8ad4af83ad4b32b594dbfc41b86e5fdb7a280cbc9b8392a253068a50e2a02fb506

memory/1612-8-0x0000000000400000-0x000000000040D000-memory.dmp

C:\Program Files\7-Zip\7z.exe

MD5 e617e077ec2c7a161aecf763ea02c89d
SHA1 f0e16be82eb1c93a7b8419e4d423f26398806a57
SHA256 2357787075a2f52bc534b5ea2a0bd430b66ad4ac5c4f425cbbf03f936cf321c0
SHA512 b56c607249073651c5711a8b133851bbc9dce4f9795486f0ef404663720a8feabbca41873acb849e4a12ad1b3a5ff9e5ea95c32cec6825c0fde840daaaeb7499

C:\Program Files\Mozilla Firefox\uninstall\helper.exe$

MD5 73c100fb51488621e9c344d456cb3097
SHA1 052789feeb9a4ed3ddd25cc2c61b9dae9bb2feb9
SHA256 c0579d6bac064b667649f678c62443a148bcf294db4af162a1754496b0ef82eb
SHA512 5290d0cf8da924b4fb012d6090a378699e7d56d7f88b344894a71317836758d067ad5edc897ba0224c6a91d87a08308c27df66a485ab343c2e482984206d0f6c

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe$

MD5 af5d6127b34128049d486443bb55ca0a
SHA1 54c8d77692ca1d408d76132522d44ef2ef3e57ae
SHA256 89d7126cfb64cc3e09ef1bf1b3f7013b175c66bfb39b47271f2af18c0f8a1438
SHA512 e89bf1e9b7bf6decd503251721e102ba985321ebd66288ad8f1c9b4b1e5f3aa2abe24aca521ade771a78b874beec77bdd6c30c7b4faaf047fd6d0388d58acc17

memory/6044-1602-0x0000000000400000-0x000000000040D000-memory.dmp

memory/1612-1658-0x0000000000400000-0x000000000040D000-memory.dmp

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe

MD5 75a0e2423c2badf3b6148046fb841ed6
SHA1 b93f73eecf742bbbcad604a99ef0ffcd2fb9a84b
SHA256 cd8528521f3a60bc36f271e1fc5f40bcd893c8a6af3f582ee1546e8fd141b050
SHA512 1b88827fd91f7173504f4605a4e6995aa8605e5b87037b9a10ba9f2678e3ca5105f9187a742d7a09bdb84f70272f403d955318cd6907006abcbace40704c5f14

Analysis: behavioral2

Detonation Overview

Submitted

2025-07-04 12:19

Reported

2025-07-04 12:22

Platform

win11-20250619-en

Max time kernel

119s

Max time network

105s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2025-07-04_9f53efdb1a9a2d227de8659286c187ad_amadey_black-basta_darkgate_elex_hawkeye_luca-stealer_rhadamanthys_smoke-loader.exe"

Signatures

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\905c0769f9a06c95a24ddf945\patcher.exe N/A

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" C:\Users\Admin\AppData\Local\Temp\2025-07-04_9f53efdb1a9a2d227de8659286c187ad_amadey_black-basta_darkgate_elex_hawkeye_luca-stealer_rhadamanthys_smoke-loader.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" C:\905c0769f9a06c95a24ddf945\patcher.exe N/A

Drops autorun.inf file

Description Indicator Process Target
File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf C:\Users\Admin\AppData\Local\Temp\2025-07-04_9f53efdb1a9a2d227de8659286c187ad_amadey_black-basta_darkgate_elex_hawkeye_luca-stealer_rhadamanthys_smoke-loader.exe N/A
File opened for modification C:\Windows\SysWOW64\:\autorun.inf C:\905c0769f9a06c95a24ddf945\patcher.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\:\autorun.inf C:\905c0769f9a06c95a24ddf945\patcher.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Java\jdk-1.8\bin\xjc.exe C:\905c0769f9a06c95a24ddf945\patcher.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE C:\905c0769f9a06c95a24ddf945\patcher.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe$ C:\905c0769f9a06c95a24ddf945\patcher.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_1.0.36.0_x64__8wekyb3d8bbwe\Time.exe C:\Users\Admin\AppData\Local\Temp\2025-07-04_9f53efdb1a9a2d227de8659286c187ad_amadey_black-basta_darkgate_elex_hawkeye_luca-stealer_rhadamanthys_smoke-loader.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe$ C:\905c0769f9a06c95a24ddf945\patcher.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.43\MicrosoftEdgeUpdateBroker.exe C:\Users\Admin\AppData\Local\Temp\2025-07-04_9f53efdb1a9a2d227de8659286c187ad_amadey_black-basta_darkgate_elex_hawkeye_luca-stealer_rhadamanthys_smoke-loader.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE C:\Users\Admin\AppData\Local\Temp\2025-07-04_9f53efdb1a9a2d227de8659286c187ad_amadey_black-basta_darkgate_elex_hawkeye_luca-stealer_rhadamanthys_smoke-loader.exe N/A
File created C:\Program Files\Java\jdk-1.8\bin\javaw.exe C:\905c0769f9a06c95a24ddf945\patcher.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe C:\905c0769f9a06c95a24ddf945\patcher.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe$ C:\Users\Admin\AppData\Local\Temp\2025-07-04_9f53efdb1a9a2d227de8659286c187ad_amadey_black-basta_darkgate_elex_hawkeye_luca-stealer_rhadamanthys_smoke-loader.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe$ C:\905c0769f9a06c95a24ddf945\patcher.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2020.503.58.0_x64__8wekyb3d8bbwe\WindowsCamera.exe C:\905c0769f9a06c95a24ddf945\patcher.exe N/A
File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\BHO\ie_to_edge_stub.exe C:\Users\Admin\AppData\Local\Temp\2025-07-04_9f53efdb1a9a2d227de8659286c187ad_amadey_black-basta_darkgate_elex_hawkeye_luca-stealer_rhadamanthys_smoke-loader.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe C:\Users\Admin\AppData\Local\Temp\2025-07-04_9f53efdb1a9a2d227de8659286c187ad_amadey_black-basta_darkgate_elex_hawkeye_luca-stealer_rhadamanthys_smoke-loader.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe C:\905c0769f9a06c95a24ddf945\patcher.exe N/A
File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe C:\Users\Admin\AppData\Local\Temp\2025-07-04_9f53efdb1a9a2d227de8659286c187ad_amadey_black-basta_darkgate_elex_hawkeye_luca-stealer_rhadamanthys_smoke-loader.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe C:\905c0769f9a06c95a24ddf945\patcher.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\notification_helper.exe$ C:\905c0769f9a06c95a24ddf945\patcher.exe N/A
File opened for modification C:\Program Files (x86)\Windows Mail\wabmig.exe C:\Users\Admin\AppData\Local\Temp\2025-07-04_9f53efdb1a9a2d227de8659286c187ad_amadey_black-basta_darkgate_elex_hawkeye_luca-stealer_rhadamanthys_smoke-loader.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe C:\905c0769f9a06c95a24ddf945\patcher.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe$ C:\Users\Admin\AppData\Local\Temp\2025-07-04_9f53efdb1a9a2d227de8659286c187ad_amadey_black-basta_darkgate_elex_hawkeye_luca-stealer_rhadamanthys_smoke-loader.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe$ C:\905c0769f9a06c95a24ddf945\patcher.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_proxy.exe$ C:\Users\Admin\AppData\Local\Temp\2025-07-04_9f53efdb1a9a2d227de8659286c187ad_amadey_black-basta_darkgate_elex_hawkeye_luca-stealer_rhadamanthys_smoke-loader.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe$ C:\Users\Admin\AppData\Local\Temp\2025-07-04_9f53efdb1a9a2d227de8659286c187ad_amadey_black-basta_darkgate_elex_hawkeye_luca-stealer_rhadamanthys_smoke-loader.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE C:\Users\Admin\AppData\Local\Temp\2025-07-04_9f53efdb1a9a2d227de8659286c187ad_amadey_black-basta_darkgate_elex_hawkeye_luca-stealer_rhadamanthys_smoke-loader.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\cookie_exporter.exe$ C:\Users\Admin\AppData\Local\Temp\2025-07-04_9f53efdb1a9a2d227de8659286c187ad_amadey_black-basta_darkgate_elex_hawkeye_luca-stealer_rhadamanthys_smoke-loader.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe C:\905c0769f9a06c95a24ddf945\patcher.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe$ C:\905c0769f9a06c95a24ddf945\patcher.exe N/A
File created C:\Program Files\Mozilla Firefox\plugin-container.exe C:\Users\Admin\AppData\Local\Temp\2025-07-04_9f53efdb1a9a2d227de8659286c187ad_amadey_black-basta_darkgate_elex_hawkeye_luca-stealer_rhadamanthys_smoke-loader.exe N/A
File opened for modification C:\Program Files\Windows Mail\wabmig.exe C:\Users\Admin\AppData\Local\Temp\2025-07-04_9f53efdb1a9a2d227de8659286c187ad_amadey_black-basta_darkgate_elex_hawkeye_luca-stealer_rhadamanthys_smoke-loader.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\pwahelper.exe C:\Users\Admin\AppData\Local\Temp\2025-07-04_9f53efdb1a9a2d227de8659286c187ad_amadey_black-basta_darkgate_elex_hawkeye_luca-stealer_rhadamanthys_smoke-loader.exe N/A
File created C:\Program Files\7-Zip\Uninstall.exe C:\905c0769f9a06c95a24ddf945\patcher.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe$ C:\905c0769f9a06c95a24ddf945\patcher.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE$ C:\Users\Admin\AppData\Local\Temp\2025-07-04_9f53efdb1a9a2d227de8659286c187ad_amadey_black-basta_darkgate_elex_hawkeye_luca-stealer_rhadamanthys_smoke-loader.exe N/A
File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe C:\905c0769f9a06c95a24ddf945\patcher.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVLP.exe C:\Users\Admin\AppData\Local\Temp\2025-07-04_9f53efdb1a9a2d227de8659286c187ad_amadey_black-basta_darkgate_elex_hawkeye_luca-stealer_rhadamanthys_smoke-loader.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe C:\905c0769f9a06c95a24ddf945\patcher.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe$ C:\905c0769f9a06c95a24ddf945\patcher.exe N/A
File created C:\Program Files\Mozilla Firefox\updater.exe C:\905c0769f9a06c95a24ddf945\patcher.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\notification_click_helper.exe C:\Users\Admin\AppData\Local\Temp\2025-07-04_9f53efdb1a9a2d227de8659286c187ad_amadey_black-basta_darkgate_elex_hawkeye_luca-stealer_rhadamanthys_smoke-loader.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe$ C:\Users\Admin\AppData\Local\Temp\2025-07-04_9f53efdb1a9a2d227de8659286c187ad_amadey_black-basta_darkgate_elex_hawkeye_luca-stealer_rhadamanthys_smoke-loader.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVLP.exe C:\905c0769f9a06c95a24ddf945\patcher.exe N/A
File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE C:\Users\Admin\AppData\Local\Temp\2025-07-04_9f53efdb1a9a2d227de8659286c187ad_amadey_black-basta_darkgate_elex_hawkeye_luca-stealer_rhadamanthys_smoke-loader.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe$ C:\905c0769f9a06c95a24ddf945\patcher.exe N/A
File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Users\Admin\AppData\Local\Temp\2025-07-04_9f53efdb1a9a2d227de8659286c187ad_amadey_black-basta_darkgate_elex_hawkeye_luca-stealer_rhadamanthys_smoke-loader.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\identity_helper.exe$ C:\Users\Admin\AppData\Local\Temp\2025-07-04_9f53efdb1a9a2d227de8659286c187ad_amadey_black-basta_darkgate_elex_hawkeye_luca-stealer_rhadamanthys_smoke-loader.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\identity_helper.exe C:\Users\Admin\AppData\Local\Temp\2025-07-04_9f53efdb1a9a2d227de8659286c187ad_amadey_black-basta_darkgate_elex_hawkeye_luca-stealer_rhadamanthys_smoke-loader.exe N/A
File created C:\Program Files\Java\jdk-1.8\bin\jstack.exe C:\905c0769f9a06c95a24ddf945\patcher.exe N/A
File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe C:\905c0769f9a06c95a24ddf945\patcher.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe$ C:\905c0769f9a06c95a24ddf945\patcher.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe C:\905c0769f9a06c95a24ddf945\patcher.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_4.0.2.0_x64__8wekyb3d8bbwe\StickyNotesStub.exe C:\Users\Admin\AppData\Local\Temp\2025-07-04_9f53efdb1a9a2d227de8659286c187ad_amadey_black-basta_darkgate_elex_hawkeye_luca-stealer_rhadamanthys_smoke-loader.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.46.11001.0_x64__8wekyb3d8bbwe\GameBar.exe C:\905c0769f9a06c95a24ddf945\patcher.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe C:\905c0769f9a06c95a24ddf945\patcher.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Installer\setup.exe$ C:\905c0769f9a06c95a24ddf945\patcher.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.69\msedge_proxy.exe C:\Users\Admin\AppData\Local\Temp\2025-07-04_9f53efdb1a9a2d227de8659286c187ad_amadey_black-basta_darkgate_elex_hawkeye_luca-stealer_rhadamanthys_smoke-loader.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateBroker.exe C:\Users\Admin\AppData\Local\Temp\2025-07-04_9f53efdb1a9a2d227de8659286c187ad_amadey_black-basta_darkgate_elex_hawkeye_luca-stealer_rhadamanthys_smoke-loader.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe C:\905c0769f9a06c95a24ddf945\patcher.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE$ C:\Users\Admin\AppData\Local\Temp\2025-07-04_9f53efdb1a9a2d227de8659286c187ad_amadey_black-basta_darkgate_elex_hawkeye_luca-stealer_rhadamanthys_smoke-loader.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\msedge.exe C:\Users\Admin\AppData\Local\Temp\2025-07-04_9f53efdb1a9a2d227de8659286c187ad_amadey_black-basta_darkgate_elex_hawkeye_luca-stealer_rhadamanthys_smoke-loader.exe N/A
File opened for modification C:\Program Files (x86)\Windows Media Player\wmpconfig.exe C:\905c0769f9a06c95a24ddf945\patcher.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\chrmstp.exe C:\905c0769f9a06c95a24ddf945\patcher.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe$ C:\905c0769f9a06c95a24ddf945\patcher.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe C:\Users\Admin\AppData\Local\Temp\2025-07-04_9f53efdb1a9a2d227de8659286c187ad_amadey_black-basta_darkgate_elex_hawkeye_luca-stealer_rhadamanthys_smoke-loader.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\2025-07-04_9f53efdb1a9a2d227de8659286c187ad_amadey_black-basta_darkgate_elex_hawkeye_luca-stealer_rhadamanthys_smoke-loader.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\905c0769f9a06c95a24ddf945\patcher.exe N/A

NTFS ADS

Description Indicator Process Target
File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf C:\Users\Admin\AppData\Local\Temp\2025-07-04_9f53efdb1a9a2d227de8659286c187ad_amadey_black-basta_darkgate_elex_hawkeye_luca-stealer_rhadamanthys_smoke-loader.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 736 wrote to memory of 2964 N/A C:\Windows\system32\cmd.exe C:\905c0769f9a06c95a24ddf945\patcher.exe
PID 736 wrote to memory of 2964 N/A C:\Windows\system32\cmd.exe C:\905c0769f9a06c95a24ddf945\patcher.exe
PID 736 wrote to memory of 2964 N/A C:\Windows\system32\cmd.exe C:\905c0769f9a06c95a24ddf945\patcher.exe

Processes

C:\Users\Admin\AppData\Local\Temp\2025-07-04_9f53efdb1a9a2d227de8659286c187ad_amadey_black-basta_darkgate_elex_hawkeye_luca-stealer_rhadamanthys_smoke-loader.exe

"C:\Users\Admin\AppData\Local\Temp\2025-07-04_9f53efdb1a9a2d227de8659286c187ad_amadey_black-basta_darkgate_elex_hawkeye_luca-stealer_rhadamanthys_smoke-loader.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\905c0769f9a06c95a24ddf945\patcher.exe

C:\905c0769f9a06c95a24ddf945\patcher.exe

C:\905c0769f9a06c95a24ddf945\patcher.exe

Network

Files

memory/5640-0-0x0000000000400000-0x000000000040D000-memory.dmp

C:\905c0769f9a06c95a24ddf945\patcher.exe

MD5 9f53efdb1a9a2d227de8659286c187ad
SHA1 9765f22507889a4733ef1ddc2c6cb9e9d688325e
SHA256 accfbe97eeacd4492b319f3377fc40b7a58440e93bcdfcc195b9672e61175dc3
SHA512 06b2d78c87ec9ad59c5ef9d9922894370a45861c102fc81b90d7966da42c6a8ad4af83ad4b32b594dbfc41b86e5fdb7a280cbc9b8392a253068a50e2a02fb506

C:\Program Files\7-Zip\7z.exe

MD5 e617e077ec2c7a161aecf763ea02c89d
SHA1 f0e16be82eb1c93a7b8419e4d423f26398806a57
SHA256 2357787075a2f52bc534b5ea2a0bd430b66ad4ac5c4f425cbbf03f936cf321c0
SHA512 b56c607249073651c5711a8b133851bbc9dce4f9795486f0ef404663720a8feabbca41873acb849e4a12ad1b3a5ff9e5ea95c32cec6825c0fde840daaaeb7499

C:\Program Files\Mozilla Firefox\uninstall\helper.exe$

MD5 73c100fb51488621e9c344d456cb3097
SHA1 052789feeb9a4ed3ddd25cc2c61b9dae9bb2feb9
SHA256 c0579d6bac064b667649f678c62443a148bcf294db4af162a1754496b0ef82eb
SHA512 5290d0cf8da924b4fb012d6090a378699e7d56d7f88b344894a71317836758d067ad5edc897ba0224c6a91d87a08308c27df66a485ab343c2e482984206d0f6c

memory/5640-1554-0x0000000000400000-0x000000000040D000-memory.dmp

memory/2964-1555-0x0000000000400000-0x000000000040D000-memory.dmp

C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe$

MD5 e4bf6dbaaed6cce69c1bfcf4704cc2fa
SHA1 76c006c02c91eac2c4c039ca97ea530390fc8037
SHA256 0cccca1bb72ce14724268da8faa5959544ea43f3e6794df4c1fc7aba41a577ed
SHA512 4dc7e2b8b66bbb850bdabfced80eab80b81eb1a512c25591b9678a602a277c9ecfdc31592098044f47e9acd3c33c5becab8a3b45dc2fd69b471a5915462862af

C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Installer\setup.exe$

MD5 659c3e64a939f223632adbb16addd84f
SHA1 242531d0b98ed71a9eb5b61890d905582dfec017
SHA256 54ac69d8465f7aa7cf4bc1bbcde721f528aaf5cd31d5c3afd5a6b6bcd1c3d0f5
SHA512 ee04dd1ee89b51ba6812c66511b15c1396f97ebbde6217cbdc1573dd868e5d011aa5f4f5bcc93225bf366976ec69a9dda27fde4055eba242daaf4ed47642f001