b0c1c12ebd5db3bbbeec5e85bdbd2945713738da663adfe3f400a7f1789ea59e

Analysis

max time kernel
149s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
15/04/2026, 22:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-15_8dac5bbb5f790a5586b79c665fca1a6f_amadey_darkgate_elex_hellokitty_hijackloader_icedid_luca.exe
Size 4.8MB
Sample260415-2b1bmsa17n
SHA256 b0c1c12ebd5db3bbbeec5e85bdbd2945713738da663adfe3f400a7f1789ea59e
MD5 8dac5bbb5f790a5586b79c665fca1a6f
SHA1 77150dc1ecb2216e8a5d5e0ba6077fbc0fb970a4
SHA512 7a45beb01e55dd02391c3ff491a673479947f00e5b254622b77664a2168b997ec77d6c128efa9ae181803154da88084054ebc67b985d0ff382e2cae3c7df107c
SSDEEP 98304:uK5ZkB/qoHMdnJE7hAlKnsz2C2PYdhI8x9vuFOnYHEXv:PJEul4szE8jvUev
TLSH
T161367C2179C58A39F1B712B1997CAF75846EFD310F3044CB67C06D2A69B06C29A36F27
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery spyware stealer trojan

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
17	4828	Process not Found

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2023547815-1162023398-1465618254-1000\Control Panel\International\Geo\Nation	AdobeARMHelper.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2023547815-1162023398-1465618254-1000\Control Panel\International\Geo\Nation	2026-04-15_8dac5bbb5f790a5586b79c665fca1a6f_amadey_darkgate_elex_hellokitty_hijackloader_icedid_luca.sho

Executes dropped EXE 2 IoCs

pid	Process
2988	2026-04-15_8dac5bbb5f790a5586b79c665fca1a6f_amadey_darkgate_elex_hellokitty_hijackloader_icedid_luca.sho
2620	AdobeARMHelper.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Shohdi.hdi	2026-04-15_8dac5bbb5f790a5586b79c665fca1a6f_amadey_darkgate_elex_hellokitty_hijackloader_icedid_luca.exe
File opened for modification	C:\Windows\SysWOW64\Shohdi.hdi	2026-04-15_8dac5bbb5f790a5586b79c665fca1a6f_amadey_darkgate_elex_hellokitty_hijackloader_icedid_luca.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	\??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.sho	2026-04-15_8dac5bbb5f790a5586b79c665fca1a6f_amadey_darkgate_elex_hellokitty_hijackloader_icedid_luca.exe
File created	\??\c:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE	2026-04-15_8dac5bbb5f790a5586b79c665fca1a6f_amadey_darkgate_elex_hellokitty_hijackloader_icedid_luca.exe
File created	\??\c:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe	2026-04-15_8dac5bbb5f790a5586b79c665fca1a6f_amadey_darkgate_elex_hellokitty_hijackloader_icedid_luca.exe
File created	\??\c:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe	2026-04-15_8dac5bbb5f790a5586b79c665fca1a6f_amadey_darkgate_elex_hellokitty_hijackloader_icedid_luca.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.sho	2026-04-15_8dac5bbb5f790a5586b79c665fca1a6f_amadey_darkgate_elex_hellokitty_hijackloader_icedid_luca.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\pwahelper.sho	2026-04-15_8dac5bbb5f790a5586b79c665fca1a6f_amadey_darkgate_elex_hellokitty_hijackloader_icedid_luca.exe
File created	\??\c:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-04-15_8dac5bbb5f790a5586b79c665fca1a6f_amadey_darkgate_elex_hellokitty_hijackloader_icedid_luca.exe
File created	\??\c:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	2026-04-15_8dac5bbb5f790a5586b79c665fca1a6f_amadey_darkgate_elex_hellokitty_hijackloader_icedid_luca.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\uninstall\helper.sho	2026-04-15_8dac5bbb5f790a5586b79c665fca1a6f_amadey_darkgate_elex_hellokitty_hijackloader_icedid_luca.exe
File created	\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	2026-04-15_8dac5bbb5f790a5586b79c665fca1a6f_amadey_darkgate_elex_hellokitty_hijackloader_icedid_luca.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateOnDemand.sho	2026-04-15_8dac5bbb5f790a5586b79c665fca1a6f_amadey_darkgate_elex_hellokitty_hijackloader_icedid_luca.exe
File created	\??\c:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge_pwa_launcher.exe	2026-04-15_8dac5bbb5f790a5586b79c665fca1a6f_amadey_darkgate_elex_hellokitty_hijackloader_icedid_luca.exe
File created	\??\c:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-04-15_8dac5bbb5f790a5586b79c665fca1a6f_amadey_darkgate_elex_hellokitty_hijackloader_icedid_luca.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.sho	2026-04-15_8dac5bbb5f790a5586b79c665fca1a6f_amadey_darkgate_elex_hellokitty_hijackloader_icedid_luca.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\crashreporter.sho	2026-04-15_8dac5bbb5f790a5586b79c665fca1a6f_amadey_darkgate_elex_hellokitty_hijackloader_icedid_luca.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.sho	2026-04-15_8dac5bbb5f790a5586b79c665fca1a6f_amadey_darkgate_elex_hellokitty_hijackloader_icedid_luca.exe
File created	\??\c:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe	2026-04-15_8dac5bbb5f790a5586b79c665fca1a6f_amadey_darkgate_elex_hellokitty_hijackloader_icedid_luca.exe
File created	\??\c:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe	2026-04-15_8dac5bbb5f790a5586b79c665fca1a6f_amadey_darkgate_elex_hellokitty_hijackloader_icedid_luca.exe
File created	\??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE	2026-04-15_8dac5bbb5f790a5586b79c665fca1a6f_amadey_darkgate_elex_hellokitty_hijackloader_icedid_luca.exe
File created	\??\c:\Program Files\Mozilla Firefox\private_browsing.exe	2026-04-15_8dac5bbb5f790a5586b79c665fca1a6f_amadey_darkgate_elex_hellokitty_hijackloader_icedid_luca.exe
File created	\??\c:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe	2026-04-15_8dac5bbb5f790a5586b79c665fca1a6f_amadey_darkgate_elex_hellokitty_hijackloader_icedid_luca.exe
File opened for modification	\??\c:\Program Files\7-Zip\7zG.sho	2026-04-15_8dac5bbb5f790a5586b79c665fca1a6f_amadey_darkgate_elex_hellokitty_hijackloader_icedid_luca.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.sho	2026-04-15_8dac5bbb5f790a5586b79c665fca1a6f_amadey_darkgate_elex_hellokitty_hijackloader_icedid_luca.exe
File created	\??\c:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-04-15_8dac5bbb5f790a5586b79c665fca1a6f_amadey_darkgate_elex_hellokitty_hijackloader_icedid_luca.exe
File created	\??\c:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE	2026-04-15_8dac5bbb5f790a5586b79c665fca1a6f_amadey_darkgate_elex_hellokitty_hijackloader_icedid_luca.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Office16\ORGCHART.sho	2026-04-15_8dac5bbb5f790a5586b79c665fca1a6f_amadey_darkgate_elex_hellokitty_hijackloader_icedid_luca.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Office16\protocolhandler.sho	2026-04-15_8dac5bbb5f790a5586b79c665fca1a6f_amadey_darkgate_elex_hellokitty_hijackloader_icedid_luca.exe
File opened for modification	\??\c:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.sho	2026-04-15_8dac5bbb5f790a5586b79c665fca1a6f_amadey_darkgate_elex_hellokitty_hijackloader_icedid_luca.exe
File created	\??\c:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe	2026-04-15_8dac5bbb5f790a5586b79c665fca1a6f_amadey_darkgate_elex_hellokitty_hijackloader_icedid_luca.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Office16\SETLANG.sho	2026-04-15_8dac5bbb5f790a5586b79c665fca1a6f_amadey_darkgate_elex_hellokitty_hijackloader_icedid_luca.exe
File opened for modification	\??\c:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.sho	2026-04-15_8dac5bbb5f790a5586b79c665fca1a6f_amadey_darkgate_elex_hellokitty_hijackloader_icedid_luca.exe
File opened for modification	\??\c:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.sho	2026-04-15_8dac5bbb5f790a5586b79c665fca1a6f_amadey_darkgate_elex_hellokitty_hijackloader_icedid_luca.exe
File created	\??\c:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe	2026-04-15_8dac5bbb5f790a5586b79c665fca1a6f_amadey_darkgate_elex_hellokitty_hijackloader_icedid_luca.exe
File created	\??\c:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe	2026-04-15_8dac5bbb5f790a5586b79c665fca1a6f_amadey_darkgate_elex_hellokitty_hijackloader_icedid_luca.exe
File created	\??\c:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE	2026-04-15_8dac5bbb5f790a5586b79c665fca1a6f_amadey_darkgate_elex_hellokitty_hijackloader_icedid_luca.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Office16\WORDICON.sho	2026-04-15_8dac5bbb5f790a5586b79c665fca1a6f_amadey_darkgate_elex_hellokitty_hijackloader_icedid_luca.exe
File created	\??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe	2026-04-15_8dac5bbb5f790a5586b79c665fca1a6f_amadey_darkgate_elex_hellokitty_hijackloader_icedid_luca.exe
File created	\??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe	2026-04-15_8dac5bbb5f790a5586b79c665fca1a6f_amadey_darkgate_elex_hellokitty_hijackloader_icedid_luca.exe
File opened for modification	\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.sho	2026-04-15_8dac5bbb5f790a5586b79c665fca1a6f_amadey_darkgate_elex_hellokitty_hijackloader_icedid_luca.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge.sho	2026-04-15_8dac5bbb5f790a5586b79c665fca1a6f_amadey_darkgate_elex_hellokitty_hijackloader_icedid_luca.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.sho	2026-04-15_8dac5bbb5f790a5586b79c665fca1a6f_amadey_darkgate_elex_hellokitty_hijackloader_icedid_luca.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge_pwa_launcher.sho	2026-04-15_8dac5bbb5f790a5586b79c665fca1a6f_amadey_darkgate_elex_hellokitty_hijackloader_icedid_luca.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.sho	2026-04-15_8dac5bbb5f790a5586b79c665fca1a6f_amadey_darkgate_elex_hellokitty_hijackloader_icedid_luca.exe
File created	\??\c:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-04-15_8dac5bbb5f790a5586b79c665fca1a6f_amadey_darkgate_elex_hellokitty_hijackloader_icedid_luca.exe
File created	\??\c:\Program Files\Mozilla Firefox\firefox.exe	2026-04-15_8dac5bbb5f790a5586b79c665fca1a6f_amadey_darkgate_elex_hellokitty_hijackloader_icedid_luca.exe
File created	\??\c:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	2026-04-15_8dac5bbb5f790a5586b79c665fca1a6f_amadey_darkgate_elex_hellokitty_hijackloader_icedid_luca.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.sho	2026-04-15_8dac5bbb5f790a5586b79c665fca1a6f_amadey_darkgate_elex_hellokitty_hijackloader_icedid_luca.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.sho	2026-04-15_8dac5bbb5f790a5586b79c665fca1a6f_amadey_darkgate_elex_hellokitty_hijackloader_icedid_luca.exe
File created	\??\c:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe	2026-04-15_8dac5bbb5f790a5586b79c665fca1a6f_amadey_darkgate_elex_hellokitty_hijackloader_icedid_luca.exe
File created	\??\c:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-04-15_8dac5bbb5f790a5586b79c665fca1a6f_amadey_darkgate_elex_hellokitty_hijackloader_icedid_luca.exe
File created	\??\c:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE	2026-04-15_8dac5bbb5f790a5586b79c665fca1a6f_amadey_darkgate_elex_hellokitty_hijackloader_icedid_luca.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\firefox.sho	2026-04-15_8dac5bbb5f790a5586b79c665fca1a6f_amadey_darkgate_elex_hellokitty_hijackloader_icedid_luca.exe
File created	\??\c:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe	2026-04-15_8dac5bbb5f790a5586b79c665fca1a6f_amadey_darkgate_elex_hellokitty_hijackloader_icedid_luca.exe
File opened for modification	\??\c:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.sho	2026-04-15_8dac5bbb5f790a5586b79c665fca1a6f_amadey_darkgate_elex_hellokitty_hijackloader_icedid_luca.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.sho	2026-04-15_8dac5bbb5f790a5586b79c665fca1a6f_amadey_darkgate_elex_hellokitty_hijackloader_icedid_luca.exe
File created	\??\c:\Program Files\Mozilla Firefox\maintenanceservice.exe	2026-04-15_8dac5bbb5f790a5586b79c665fca1a6f_amadey_darkgate_elex_hellokitty_hijackloader_icedid_luca.exe
File created	\??\c:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe	2026-04-15_8dac5bbb5f790a5586b79c665fca1a6f_amadey_darkgate_elex_hellokitty_hijackloader_icedid_luca.exe
File created	\??\c:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\identity_helper.exe	2026-04-15_8dac5bbb5f790a5586b79c665fca1a6f_amadey_darkgate_elex_hellokitty_hijackloader_icedid_luca.exe
File created	\??\c:\Program Files\7-Zip\Uninstall.exe	2026-04-15_8dac5bbb5f790a5586b79c665fca1a6f_amadey_darkgate_elex_hellokitty_hijackloader_icedid_luca.exe
File created	\??\c:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-04-15_8dac5bbb5f790a5586b79c665fca1a6f_amadey_darkgate_elex_hellokitty_hijackloader_icedid_luca.exe
File created	\??\c:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE	2026-04-15_8dac5bbb5f790a5586b79c665fca1a6f_amadey_darkgate_elex_hellokitty_hijackloader_icedid_luca.exe
File created	\??\c:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe	2026-04-15_8dac5bbb5f790a5586b79c665fca1a6f_amadey_darkgate_elex_hellokitty_hijackloader_icedid_luca.exe
File opened for modification	\??\c:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.sho	2026-04-15_8dac5bbb5f790a5586b79c665fca1a6f_amadey_darkgate_elex_hellokitty_hijackloader_icedid_luca.exe
File opened for modification	\??\c:\Program Files\Java\jdk-1.8\jre\bin\javaw.sho	2026-04-15_8dac5bbb5f790a5586b79c665fca1a6f_amadey_darkgate_elex_hellokitty_hijackloader_icedid_luca.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AdobeARMHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AdobeARM.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-15_8dac5bbb5f790a5586b79c665fca1a6f_amadey_darkgate_elex_hellokitty_hijackloader_icedid_luca.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-15_8dac5bbb5f790a5586b79c665fca1a6f_amadey_darkgate_elex_hellokitty_hijackloader_icedid_luca.sho

Modifies system certificate store 2 TTPs 3 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25	2026-04-15_8dac5bbb5f790a5586b79c665fca1a6f_amadey_darkgate_elex_hellokitty_hijackloader_icedid_luca.sho
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 040000000100000010000000d474de575c39b2d39c8583c5c065498a0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000007431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25190000000100000010000000ba4f3972e7aed9dccdc210db59da13c92000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	2026-04-15_8dac5bbb5f790a5586b79c665fca1a6f_amadey_darkgate_elex_hellokitty_hijackloader_icedid_luca.sho
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 5c000000010000000400000000080000190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc36200000001000000200000007431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8040000000100000010000000d474de575c39b2d39c8583c5c065498a2000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	2026-04-15_8dac5bbb5f790a5586b79c665fca1a6f_amadey_darkgate_elex_hellokitty_hijackloader_icedid_luca.sho

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2620	AdobeARMHelper.exe
2620	AdobeARMHelper.exe
2620	AdobeARMHelper.exe
2620	AdobeARMHelper.exe
2620	AdobeARMHelper.exe
2620	AdobeARMHelper.exe
2620	AdobeARMHelper.exe
2620	AdobeARMHelper.exe
2620	AdobeARMHelper.exe
2620	AdobeARMHelper.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2988	2026-04-15_8dac5bbb5f790a5586b79c665fca1a6f_amadey_darkgate_elex_hellokitty_hijackloader_icedid_luca.sho
4992	AdobeARM.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4228 wrote to memory of 2988	4228	2026-04-15_8dac5bbb5f790a5586b79c665fca1a6f_amadey_darkgate_elex_hellokitty_hijackloader_icedid_luca.exe	86
PID 2988 wrote to memory of 3148	2988	2026-04-15_8dac5bbb5f790a5586b79c665fca1a6f_amadey_darkgate_elex_hellokitty_hijackloader_icedid_luca.sho	93
PID 2988 wrote to memory of 2620	2988	2026-04-15_8dac5bbb5f790a5586b79c665fca1a6f_amadey_darkgate_elex_hellokitty_hijackloader_icedid_luca.sho	97
PID 2620 wrote to memory of 4992	2620	AdobeARMHelper.exe	98

C:\Users\Admin\AppData\Local\Temp\2026-04-15_8dac5bbb5f790a5586b79c665fca1a6f_amadey_darkgate_elex_hellokitty_hijackloader_icedid_luca.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-15_8dac5bbb5f790a5586b79c665fca1a6f_amadey_darkgate_elex_hellokitty_hijackloader_icedid_luca.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4228
- C:\Users\Admin\AppData\Local\Temp\2026-04-15_8dac5bbb5f790a5586b79c665fca1a6f_amadey_darkgate_elex_hellokitty_hijackloader_icedid_luca.sho
  C:\Users\Admin\AppData\Local\Temp\2026-04-15_8dac5bbb5f790a5586b79c665fca1a6f_amadey_darkgate_elex_hellokitty_hijackloader_icedid_luca.sho
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies system certificate store
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2988
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe"
    3⤵
    PID:3148
- - C:\ProgramData\Adobe\ARM\S\30723\AdobeARMHelper.exe
    "C:\ProgramData\Adobe\ARM\S\30723\AdobeARMHelper.exe" /ArmUpdate /MSI FOLDER:"C:\ProgramData\Adobe\ARM\S\30723" /MODE:3 /UpdateSelection:1 /PRODUCT:{291AA914-A987-4CE9-BD63-AC0A92D435E5} /VERSION:19.0 /LANG:ENU
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2620
  - - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
      "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" /ArmUpdate /MSI FOLDER:"C:\ProgramData\Adobe\ARM\S\30723" /MODE:3 /UpdateSelection:1 /PRODUCT:{291AA914-A987-4CE9-BD63-AC0A92D435E5} /VERSION:19.0 /LANG:ENU
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:4992

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ArmReport.ini

Path C:\ProgramData\Adobe\ARM\ArmReport.ini
Size 82B
SHA256 5a1e0a0216dd3893a738efdfc9c1bc5445e68d3939840578341f6cd08b14d815
MD5 9de1c12da78157648e8e5b25adab3467
SHA1 e9a8e45cbc66f9323f530a7bc88249e92e99fa52
SHA512 cbc027271d3977d2c248dbcd683da728880d5c26d2bae6df6299b4eeed551f34b2e687865b578a688f98a3865b63450ac0bf7cc07d031dad0f8dbe72e9e531b9
TLSH
T1FEA0222333C0803CB8203A02CCE088333322B0C8B00BC00CC002228E00F022002223BF
MD5 SHA1 SHA512 TLSH

Submit Download

AdobeARM.msi

Path C:\ProgramData\Adobe\ARM\S\30723\AdobeARM.msi
Size 1.0MB
SHA256 f3f339de3a391d7f8baf37009ec52a6948d769977e2f407faf46f7064a524638
MD5 9474db895113963c06cf1050a3d5c91d
SHA1 5c599ee58ffb1fac122823e30814702fa38eec2d
SHA512 cb4fc2145582e459af1d8eb0ef3f33a629929eb7e0730a7af15d98b4c5577a5a5b3853c5695bc9e356be96c35a91cec69f57a81322c839a2cd6d73b9958d35af
SSDEEP 24576:5tsYy4SyBEqipH6t3uhK76TwlO/TTj11:5tsYy/yUpaiqhETTz
TLSH
T12935F107B3804236C59A0235544F87724B79FC348B21426B37D9B75D3EB27E0AABB5E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AdobeARMHelper.exe

Path C:\ProgramData\Adobe\ARM\S\30723\AdobeARMHelper.exe
Size 413KB
SHA256 fd115ae8ebd2f37cf1ef72f75242206cf1331c7cb258305011302e981137ee5e
MD5 522026a14d6bc781d2a15c665e454310
SHA1 9451a39108326ba578793b1feb62f23a02bce916
SHA512 4e4eb2f582c8590899a0ada6133b705d13775f60818f1ff4f9bb35e40e09d6570af4f7ac4c80b525b445a03702ca0f3a9867a93080f90697d8be668e2abe2fe7
SSDEEP 6144:q/6JSQsSVWSLjX2PxPNMRyfn7LzPdKblt0K+HAfh0v8axsbQuXYvr6yIl2:u6dVWnxlMSn7nFKbltn+Ch/m6X2
TLSH
T1DE947C1037D0C036F1B329768ABFD728556DB9715F6881CFA3C8166E5EB06E0AA3171B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RdrManifest2.msi

Path C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-AC0A92D435E5}\RdrManifest2.msi
Size 18KB
SHA256 0abcb8b7c0bda3128316b3e4f4a5857e9c8194105043a0c0e9801a1a96105d01
MD5 f5d4c05bc8ea0d4fc4d277abda7369d9
SHA1 f67e793b159bd1e75ed4dec0de352ea1b6583708
SHA512 359a966c4dc8d62a570b428dfb3e666a63efd6bfff7c5b5ace3bc97ea09ba701d9fa524f439bf9902746c2ecac9c1f76c90868b0152eb825b2a09a9474fdbb34
SSDEEP 384:MrUq75oUFtb0F+o5nfy9jdIYigYws0i9Db9Ey8RbmL4A8UiINyGNB:MrUq75oUFtb0F+o5nfy9uYigY9K5ALdH
TLSH
T19D820BA2B4408C11CD868F3EA4C1D726D672BC813D8591C27565F219CFB23869A9F7EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
Size 471B
SHA256 4be903a0fb9c24009984c811d76ba25f34ba65dd6b3593ace2bfd30e2106ea91
MD5 c1122705975c1eccd5f910ed3cf91e2e
SHA1 aa1837721fc914eb3eb9a89ce500f4f887e3742f
SHA512 822e434416fd15201f909f8efd3ebd7d26e0a77beedf1b5ea4f664cf0936e231029b329b9e721da6c6a377120ffa883ff7e062065e923c0324dad8f447ab8c6a
TLSH
T135F0DCBB69796AB34C36841C2FF4DBB034B1974E1581052E2C3B05C54AEB383F07E429
MD5 SHA1 SHA512 TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_54359052731E413C60F1C59EABAD4E05

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_54359052731E413C60F1C59EABAD4E05
Size 727B
SHA256 e3b2a0e09c6812ce097b7eb356d6b7d205519ed6450e6882ea3d509aa20e44da
MD5 0360096585929282572e9c609b12fbde
SHA1 af206ca3a3f8644d724f0e120ebacffc194fb5f3
SHA512 245adfbbe546a30bbd6bfd40f854519360bd976ec55b6b8e8f5af37df8fdf300c153010793b2cfc8e632aba2a788e8539214c7b87025396e32aa647e088a3663
TLSH
T1B90160834AB900AAA1256D0C8DF86BB2365A1001303B998E63330681A848F109E1AB11
MD5 SHA1 SHA512 TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_5809FDAACC125718B26BC11DC8E8116A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_5809FDAACC125718B26BC11DC8E8116A
Size 727B
SHA256 41c5fa2f35d2cb5735b4ef52eb809906bcd8085ea0086f337f358cde993abf77
MD5 169ecc101072fa0ee0cebf1e0e1f0305
SHA1 65c33518be3a539d2f9875fd5b51cbdf9f9e3818
SHA512 d1ad9175181d8531b65ff92fd425f740b229a4804e8f48dfad6a8dcbe82969828801839ce4d0a67f0457d862d4e12c019d0eba6b909ea7b464a53b7794a13a17
TLSH
T16D01940F25A745E19A04FC08EFD8DAE976164630218C064F03B955158849F07562880E
MD5 SHA1 SHA512 TLSH

Submit Download

C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Size 727B
SHA256 050bfb4a0623d7970e76d7b2d7684f41a9d41b311232fafb16f1bdbbbea97695
MD5 3463f67b4afecf42eecc9bc8897d7fa1
SHA1 54561d595325e243b106bf2b71d3308eac49c1e8
SHA512 28a1979480b481b5b3dc15fbe14e4d6308b9bb6c4bc73029c73a0d33e33bebbbbedca0d49c4a944bc02cd90911a6c461a5f569b20792784b82a705a932fcbe19
TLSH
T1A401602F90983A3069168C84D2FCF2A02179D5F59DE8010F5A68838F54ECB206DE38B2
MD5 SHA1 SHA512 TLSH

Submit Download

698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
Size 400B
SHA256 585903559c2b1a6a7a45136727e33302ce02924519ece8b0baf5b437e05d522e
MD5 bbc463b03cc39387d948cb23260050d6
SHA1 a5c3211bc3c1dcd1f45ef062ce2ac41f4f69cda1
SHA512 822bc62b318a3921830f7bdd71d3026f53e44315b620caa59c69e14d77498520c9760f78c49b2293c392e5dc22db6fa880c6475984c1afcb5000940e083ed9cf
TLSH
T1B8E0C02017FA521EF1609B3406E5A1C99F26F0032C51A3BD0481046D7906A105C92C30
MD5 SHA1 SHA512 TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_54359052731E413C60F1C59EABAD4E05

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_54359052731E413C60F1C59EABAD4E05
Size 404B
SHA256 d72311b0ee4c8910a850f9676bc50b548d3a4659310e5dbeadd47001c0c31e76
MD5 beb45933c4dbd2a0d4afcec0885be23a
SHA1 97a10c6df21748627f7bb9107a1380e6d261f2dc
SHA512 96d99e32122cdeb3e0651be0ddfb0418500c55291df5c007bdeb4b9d6bf5ed73129e7542b4270ff61aea8b094b795783ebf959f40e842c043a8148c24f65aa2f
TLSH
T1D1E0263032F9456EF2E5993847EAAC1259D9F25305A6D76A1140278EBE12BC00DA37A5
MD5 SHA1 SHA512 TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_5809FDAACC125718B26BC11DC8E8116A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_5809FDAACC125718B26BC11DC8E8116A
Size 404B
SHA256 e01f3d1a8981555a698cd04d3bc32bddbc29f326777a8bb71333ed698d2fd3ce
MD5 64444de44802a16b1d651e39e6cd66f5
SHA1 cb5d2b4ef95c5b58bdbce7a2151c7711356acbb8
SHA512 b253caf0808a614d7dfdb9dff33314a48c839bd586f4fa62c04183e877ebbea01baa2555538a1535637bb05db0bd1d3622162f6902a0e647fd438e90eec555f3
TLSH
T15AE0263032F9459EF8F4F4384BFBA956598AF2161D66E279008066A6AA20B404DD7625
MD5 SHA1 SHA512 TLSH

Submit Download

C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Size 412B
SHA256 be21e717523a7185b1449015ece7dee73e5f9f90b1c0405b0f68c35a2e74f32a
MD5 29545f52538ad5f85fa1955c9da28992
SHA1 0c4ccc38de80adb6d210afcefc54654c03c4a60b
SHA512 f56b3f11b45fbc1bf801778f08806af79b1b57c188d8eb5890d1b2dfc556f6168586f9d09a4cc6f2667715d0e3cc125dfd0b2961e0b2712b64fc5419cb43e224
TLSH
T1EBE0682815AB750EF050BD3142FEA0B10E99E302104487791490431CBB52F005D10AF0
MD5 SHA1 SHA512 TLSH

Submit Download

2026-04-15_8dac5bbb5f790a5586b79c665fca1a6f_amadey_darkgate_elex_hellokitty_hijackloader_icedid_luca.sho

Path C:\Users\Admin\AppData\Local\Temp\2026-04-15_8dac5bbb5f790a5586b79c665fca1a6f_amadey_darkgate_elex_hellokitty_hijackloader_icedid_luca.sho
Size 1.5MB
SHA256 27c962221dbb07220215e3c65f0ce0e42430e456db84e99ecf0eee449c4167f7
MD5 bf606aedf0fce1aed6537542c62c9cbd
SHA1 7cf79e0468a679b90f3d9817028d5e1efc5e06aa
SHA512 aa978f28897452ce1ecc9c3ea1cdf30d42b054d8fa07098df6cfac56843309609ceb397e26224371e1b0e947c9802be5d8dc5f7afef169caab16fce6a6a2d132
SSDEEP 24576:uFxhhv9+avbHVD2SouDaFOnY548usEj1J4JMzHRX4q:uFx9+CVD2SouuFOnYIsE5JIMzHRX4q
TLSH
T1867519117BE95A29F1FB2B31AE7852644A7B7C615F31C7CF13801A5E2934AC09936B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AdobeARM.log

Path C:\Users\Admin\AppData\Local\Temp\AdobeARM.log
Size 334B
SHA256 fe96fc05b9847725801fab596493d26ea6374d52ce2956e79354c0ccfa23eb78
MD5 be2fb195beedac8ebecdc735762859b5
SHA1 9765b22ec4a880db9264490c79ffb078ec398fb6
SHA512 b9b167b6532c2a2165e4920cf75cfbf5a30b0c03885b34a614c70efd362811c2d65c2adc1c13d81e833020782b22c3addbf42c9c18cd2fb743a3b8614fb2106e
TLSH
T173E07D4A603EC0BD1B5790CEA1976F19CA603A57E3874DE5B14C6712F628801591FE0C
MD5 SHA1 SHA512 TLSH

Submit Download

ArmUI.ini

Path C:\Users\Admin\AppData\Local\Temp\ArmUI.ini
Size 251KB
SHA256 b4d4dcd9594d372d7c0c975d80ef5802c88502895ed4b8a26ca62e225f2f18b0
MD5 864c22fb9a1c0670edf01c6ed3e4fbe4
SHA1 bf636f8baed998a1eb4531af9e833e6d3d8df129
SHA512 ff23616ee67d51daa2640ae638f59a8d331930a29b98c2d1bd3b236d2f651f243f9bae38d58515714886cfbb13b9be721d490aad4f2d10cbba74d7701ab34e09
SSDEEP 3072:wT4DJAvCXkQqSmSgojgTaDuK1+4xKtaU/QX5Pm9vR549QHmYPCjTMNro0Jnxu4Fn:xvUzH5
TLSH
T1B144E44363FC1209F6F37B41EEB852A44B77BDA5AA3EC15D1184015E08F5A90DA72BB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Other30726.txt

Path C:\Users\Admin\AppData\Local\Temp\Other30726.txt
Size 13B
SHA256 b633a587c652d02386c4f16f8c6f6aab7352d97f16367c3c40576214372dd628
MD5 c83301425b2ad1d496473a5ff3d9ecca
SHA1 941efb7368e46b27b937d34b07fc4d41da01b002
SHA512 83bafe4c888008afdd1b72c028c7f50dee651ca9e7d8e1b332e0bf3aa1315884155a1458a304f6e5c5627e714bf5a855a8b8d7db3f4eb2bb2789fe2f8f6a1d83
MD5 SHA1 SHA512

Submit Download

ReportOwner30726.txt

Path C:\Users\Admin\AppData\Local\Temp\ReportOwner30726.txt
Size 4B
SHA256 69bf0bc46f51b33377c4f3d92caf876714f6bbbe99e7544487327920873f9820
MD5 455831477b82574f6bf871193f2f761d
SHA1 f44217a81173869e08671753c52553646ff5d95b
SHA512 cbc0ee58e447428bdcf72fc8b03c8cfb086edbb14205b918e75ebeff1d85ff1dd254e9dcb387afbd3fa766c803937c306e0a2a79870c0d87abcb7ab93661cf85
MD5 SHA1 SHA512

Submit Download

Tmp23FE.tmp

Path C:\Users\Admin\AppData\Local\Temp\Tmp23FE.tmp
Size 5KB
SHA256 aaaced351a90b2029c44c6ebb68084a331f296a0ace8115d9889f549d596564b
MD5 42ff6aa7e64b25f09ffb2a89ce7f36ba
SHA1 0dbf44a94dbd6801b3afba7a6c602f39c7d44732
SHA512 47337d9919bc26dedfea1af060dd1fa2ef4a3dcf35c0a84ac7bfe0333b4885a368fc46fec5bc317fe257abdbcab9cdff67104382b60e9a1aa5f755aba604adde
SSDEEP 96:6jX74Lc8pJvjU8RunwXGkmIKBiHJdij9tAz4yT+QE4yKSeTEnXtGbE:0ULc8pq8RuwdmL4pUQrNyKQnCE
TLSH
T102C13CA388946C05AC27FC00B4C89933EDB676A61EC1D0D3625CC1A58B913873EDE5FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Tmp39BA.tmp

Path C:\Users\Admin\AppData\Local\Temp\Tmp39BA.tmp
Size 5KB
SHA256 27ead591d4c7f8fadd0d9e5d32eb6c9bf8830f83fddf83ddd47e6b3b413f5b75
MD5 5a68f4aec3689d0dc750adcae8e60520
SHA1 ebd8482e30140da9e44bebde6e4da997a7391e22
SHA512 311cfca7e98c8db69d2d599c5845d26a4686d03d1ab1d79237952c008269928ce8434a877e3fe411e967995536e2171844df0db14add053037de278571269a04
SSDEEP 96:zX74Lc8pJvjU8RunwXGkmIKBiHJdij9tAz4yT+QE4ycOr0BO:zULc8pq8RuwdmL4pUQrNycOrkO
TLSH
T127C12AA38DD06C05AC5BFD11B4D89A33ADB276952D81C1C3325CC2658F913973AEE2ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Tmp3A96.tmp

Path C:\Users\Admin\AppData\Local\Temp\Tmp3A96.tmp
Size 3KB
SHA256 dcc9d2695125406282ba990fec39403c44b12964acf51b5e0dc7f2080d714398
MD5 fc2430057cb1be74c788f10c2d4540c8
SHA1 cab67ee8d5191fbf9f25545825e06c1a822af2f2
SHA512 4e2b9709a9e3ca5173abb35816e5a0aebbf2a7aaf971d7f75f3ae66e4a812cbade103baa5016525f5ab83a60c18f8d3c278c90ff83e4afdae419f81673cb5aee
TLSH
T1FC71D8CE0D1A6813ABC7FE8AA1C5E3695C30A3E16AD154CB08BC95824FC6FC51A4901D
MD5 SHA1 SHA512 TLSH

Submit Download

Tmp4303.tmp

Path C:\Users\Admin\AppData\Local\Temp\Tmp4303.tmp
Size 5KB
SHA256 e6bcbcb70401d63ff0746fcbcc63230269058736f7644151393edfdcec8b8765
MD5 1b7ade3253fc67477dea69ef2147603d
SHA1 b71e8e749a3461c9b37ff2c3d099b1911d9cc6a0
SHA512 0edd5eb1635b1599e50b368cb254c94bf1588acf1d063e89f45fcfd6fa625e33d2c7764d9d00afd53dec2dfb342e9cfe199d256edcff8430ae183d357d4382da
SSDEEP 96:7NLX74Lc8pJvjU8RunwXGkmIKBiHJdij9tAz4yT+QE4yGtDwwBq:RULc8pq8RuwdmL4pUQrNyGewBq
TLSH
T16CC12AB388D06C41AD5BBD11B4C89933ADB272992DC1D0D33258C6A58B913873BDE2ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Tmp6F07.tmp

Path C:\Users\Admin\AppData\Local\Temp\Tmp6F07.tmp
Size 5KB
SHA256 a86ac1b119a6653e0c3fc24c2c40e44a7bfdc435fd81c4442af9d5526ef64e85
MD5 5bc2d1f7a5fd950dd51547ead6afdabd
SHA1 90f4e48ac87f4eb9dd10f1a80d46a7063f06a7d2
SHA512 45f18bf24c7f1102c17dd30aa205498f27336259ac3869c1d6129609a40385e68d9a2f353e3b13f18f40e7d1d32c4fb31d10f7b2fa204e24e4411183bb749f55
SSDEEP 96:7sX74Lc8pJvjU8RunwXGkmIKBiHJdij9tAz4yT+QE4yQRlOelNMQtU:gULc8pq8RuwdmL4pUQrNyYlOefM/
TLSH
T13DC12AA388D46C05AD17BC04B4C49A23FEB2B2855EC1D1D36258C1A58B913973ADE6ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Shohdi.hdi

Path C:\Windows\SysWOW64\Shohdi.hdi
Size 4.8MB
SHA256 d50b39c09e364b98c815d51d5c5ca9909f15c8a8ef817306394bd22a977a2f13
MD5 5108720096f673df3cd4a07faca026b5
SHA1 339f3a0e5ab49895e189581039c87def5979dbe1
SHA512 501c6b6119288436cd9e7f46722d2eca38de1c57d91256c40606c29d418358e777f2cccfa2c4feaefecee10d118ef13ec8cff44b268c9ede1b808d028e1413da
SSDEEP 98304:gK5ZkB/qoHMdnJE7hAlKnsz2C2PYdhI8x9vuFOnYHEXv:1JEul4szE8jvUev
TLSH
T1EB367D2179C58A39F1B712B1997C6F75846EFD310B3044CB67C06D2A69B06C39A36F2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ArmReport.ini

Path C:\Windows\Temp\ArmReport.ini
Size 916B
SHA256 3909779f313abf11024a66ff1867f2c07d980b11a33455467bbc728649ee9c56
MD5 3887846a79de09880cb1bd7680c46966
SHA1 4fface817b09f6c845399c5145b7508520c64a54
SHA512 423881aa178ff39b57473d3e17b0798d8049d87651d04d4eb77e42ebfc1dac065fa2d5f6b2d63ae3f84b6c020287198be8cca564ff1fe871f72bc66c858dbdc8
TLSH
T1C411A94B22E54204F0B31F62EBFD80B357333C919D1981BC80D8031A4AE1A46E8B3BB3
MD5 SHA1 SHA512 TLSH

Submit Download

ArmReport.ini

Path C:\Windows\Temp\ArmReport.ini
Size 1KB
SHA256 9ffedf1ebb526e46a0e3752c9a911f6e8332d66d1ff83a01ffebdf5326bd2387
MD5 e637c7104206262bdb8a94f30ccc301f
SHA1 7f3aad14c09da2339ba6c214fc7ccdf0c92237a5
SHA512 d2365120d2c94636f9046b464c5fdeaa2e3b4e1b57bc83178248b063d3e11ed7622d1c6f8c8e332f86ebb904968cdb5bf7ba1c4a19df8d42b4d8e96cc360027b
TLSH
T123118E832AE91110F4B35F95DBFD84725B337CE20D1DC46C80E4020E4AE0A85E5727B7
MD5 SHA1 SHA512 TLSH

Submit Download

ArmReport.ini

Path C:\Windows\Temp\ArmReport.ini
Size 1KB
SHA256 142a5a1f678e126eb627cec77c5a16bc7a3dabc727edd19bcd573abdea08e136
MD5 39f120a5bc55f66112848f6080b2d32e
SHA1 9dcae322f962e59660a6e47f85931d2ad1d6b91a
SHA512 44b705832621a5d2ca1a2dd9e4976cfec71f8b2d64109674d2f5a1cccaf5a71c965a3f10c9d0b1bc7467c525513ca19df05d134d7965f6605e6c113f7ee9b66f
TLSH
T101219A872AE91120F4B35F95DBB994B25B333CE21D19C46C80E4120E4EE0B95E5B27B7
MD5 SHA1 SHA512 TLSH

Submit Download

ArmUI.ini

Path C:\Windows\Temp\ArmUI.ini
Size 233KB
SHA256 76362509a8ca3e4a9fdc854c56674083ef77ca2c53628ce0acf4bb4c42d73894
MD5 b0df20baa9dee27bdbc3285c7d6d4c57
SHA1 443fe739e4c5a2ab4ece3eaff0179e7b1deba639
SHA512 0da5976d3096f598d0bec4a2c4e64f708d02a6376bd87e460744f5054d2b6e1b710e655831c287d7e672f73a3db846b19ff054270c3ce41fa02b61ecb5e31fab
SSDEEP 3072:03IJ8zcVOWmxltum8PMkufNWwhEIrKNCpNugYW+lCIr0YxbFKRWSp4Vf37FbAjG/:ByJvW
TLSH
T132342A5667FD1209F6F37F41EEB852944B7B7DA2BE3AC14D1680014E08B5A90DA72B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RdrServicesUpdater2_x86.exe

Path \??\c:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-AC0A92D435E5}\RdrServicesUpdater2_x86.exe
Size 846KB
SHA256 6a142c879a0676aef5c825d6fd6336800846167fab422d0f912096d286aa0070
MD5 a447c3cf3b7547e5a1e12dbb92d8c052
SHA1 d2b246eda6302534b21b2003719d9f911d0c77d3
SHA512 ce7446e337cc13a560a12b0b789813bfb5a96a6a9d25a8b3e2fc1ed884f0c4950f01937714614666befb9b92123d359b9597116e9ed9e8efd46b77a640d002ea
SSDEEP 24576:uSU4vrTQA/gK/c8DV5Wa1ZmPEKBLeiGA5nEJ:uP4j5gKU83W3FLeilVEJ
TLSH
T10C059E22EAD18073D563143102A66F368EBEB9310971D98FA3D41A4E5E705E1BB3F397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2620-895-0x0000000002F20000-0x0000000002F27000-memory.dmp

Download

memory/2620-894-0x0000000002E80000-0x0000000002EDF000-memory.dmp

Download

memory/2620-893-0x0000000001520000-0x000000000152A000-memory.dmp

Download

memory/2988-879-0x00000000032E0000-0x000000000333F000-memory.dmp

Download

memory/2988-880-0x0000000003B00000-0x0000000003B07000-memory.dmp

Download

memory/2988-881-0x0000000003C10000-0x0000000003C39000-memory.dmp

Download

memory/2988-882-0x00000000042B0000-0x00000000042C9000-memory.dmp

Download

memory/2988-779-0x00000000042B0000-0x00000000042C9000-memory.dmp

Download

memory/2988-778-0x0000000003C10000-0x0000000003C39000-memory.dmp

Download

memory/2988-461-0x0000000003B00000-0x0000000003B07000-memory.dmp

Download

memory/2988-256-0x00000000032E0000-0x000000000333F000-memory.dmp

Download

memory/4992-1072-0x0000000002DC0000-0x0000000002E1F000-memory.dmp

Download

memory/4992-1073-0x0000000001080000-0x0000000001087000-memory.dmp

Download