2026-04-15_05c72bc846f84a3708abe4db8513c3a7_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader_stop

General

Target
2026-04-15_05c72bc846f84a3708abe4db8513c3a7_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader_stop
Size 3.7MB
Sample260415-q7tm7aax71
SHA256 0f700b480764287d750674b5cfdab80f270548431665c724e3dea6a00f17b25b
MD5 05c72bc846f84a3708abe4db8513c3a7
SHA1 3a58765c70bd12f7b342adff61f6cb3b63e92537
SHA512 949322ba21f5d60dafe216abf69748fad6303ae850c11b8cbec1e1b3e8d977a2c17e3c682bea4f4ced8cabefc0adae09b7ce845b7fb26f18d21d1b9469312e09
SSDEEP 49152:/9VfWTydB3IVLfU2mUi6AjW/MUSdGRf3/QhKPgssSt2gd:/9FqWCgjxAZQhv7St/
TLSH
T1A306291BAE9C8835D16F3D304E64D39D52257C608A236D4A6ED43E8DEBF0ED0792D632
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-04-15_05c72bc846f84a3708abe4db8513c3a7_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader_stop

File Explorer

2026-04-15_05c72bc846f84a3708abe4db8513c3a7_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader_stop

.exe 3.7MB

2026-04-15_05c72bc846f84a3708abe4db8513c3a7_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader_stop

SHA256 0f700b480764287d750674b5cfdab80f270548431665c724e3dea6a00f17b25b
MD5 05c72bc846f84a3708abe4db8513c3a7
SHA1 3a58765c70bd12f7b342adff61f6cb3b63e92537
SHA512 949322ba21f5d60dafe216abf69748fad6303ae850c11b8cbec1e1b3e8d977a2c17e3c682bea4f4ced8cabefc0adae09b7ce845b7fb26f18d21d1b9469312e09
SSDEEP 49152:/9VfWTydB3IVLfU2mUi6AjW/MUSdGRf3/QhKPgssSt2gd:/9FqWCgjxAZQhv7St/
TLSH
T1A306291BAE9C8835D16F3D304E64D39D52257C608A236D4A6ED43E8DEBF0ED0792D632
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

6

Entry point

195822

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

d:\dbs\el\oc\target\x86\ship\postc2r\x-none\msouc.pdb

??0CCritSec@@QAE@XZ ??0CDoubleList@@QAE@XZ ??0CFakeLock@@QAE@XZ ??0CLKRHashTableStats@LKRhash@@QAE@XZ ??0CLKRHashTable_Iterator@LKRhash@@IAE@PAVCLKRHashTable@1@F@Z ??0CLKRHashTable_Iterator@LKRhash@@QAE@$$QAV01@@Z ??0CLKRHashTable_Iterator@LKRhash@@QAE@ABV01@@Z ??0CLKRHashTable_Iterator@LKRhash@@QAE@XZ ??0CLKRLinearHashTable_Iterator@LKRhash@@IAE@PAVCLKRLinearHashTable@1@PAVCNodeClump@1@KF@Z ??0CLKRLinearHashTable_Iterator@LKRhash@@QAE@ABV01@@Z ??0CLKRLinearHashTable_Iterator@LKRhash@@QAE@XZ ??0CLKRhashDefaultAllocator@@QAE@XZ ??0CLockedDoubleList@@QAE@$$QAV0@@Z ??0CLockedDoubleList@@QAE@ABV0@@Z ??0CLockedDoubleList@@QAE@XZ ??0CLockedSingleList@@QAE@$$QAV0@@Z ??0CLockedSingleList@@QAE@ABV0@@Z ??0CLockedSingleList@@QAE@XZ ??0CReaderWriterLock2@@QAE@$$QAV0@@Z ??0CReaderWriterLock2@@QAE@ABV0@@Z ??0CReaderWriterLock2@@QAE@XZ ??0CReaderWriterLock3@@QAE@$$QAV0@@Z ??0CReaderWriterLock3@@QAE@ABV0@@Z ??0CReaderWriterLock3@@QAE@XZ ??0CReaderWriterLock@@QAE@$$QAV0@@Z ??0CReaderWriterLock@@QAE@ABV0@@Z ??0CReaderWriterLock@@QAE@XZ ??0CSingleList@@QAE@XZ ??0CSmallSpinLock@@QAE@$$QAV0@@Z ??0CSmallSpinLock@@QAE@ABV0@@Z ??0CSmallSpinLock@@QAE@XZ ??0CSpinLock@@QAE@$$QAV0@@Z ??0CSpinLock@@QAE@ABV0@@Z ??0CSpinLock@@QAE@XZ ??1CCritSec@@QAE@XZ ??1CDoubleList@@QAE@XZ ??1CFakeLock@@QAE@XZ ??1CLKRHashTable_Iterator@LKRhash@@QAE@XZ ??1CLKRLinearHashTable_Iterator@LKRhash@@QAE@XZ ??1CLockedDoubleList@@QAE@XZ ??1CLockedSingleList@@QAE@XZ ??1CSingleList@@QAE@XZ ??4?$CLockBase@$00$00$02$00$02$01@@QAEAAV0@$$QAV0@@Z ??4?$CLockBase@$00$00$02$00$02$01@@QAEAAV0@ABV0@@Z ??4?$CLockBase@$01$00$00$00$02$01@@QAEAAV0@$$QAV0@@Z ??4?$CLockBase@$01$00$00$00$02$01@@QAEAAV0@ABV0@@Z ??4?$CLockBase@$02$00$00$00$00$00@@QAEAAV0@$$QAV0@@Z ??4?$CLockBase@$02$00$00$00$00$00@@QAEAAV0@ABV0@@Z ??4?$CLockBase@$03$00$00$01$02$02@@QAEAAV0@$$QAV0@@Z ??4?$CLockBase@$03$00$00$01$02$02@@QAEAAV0@ABV0@@Z ??4?$CLockBase@$04$01$01$00$02$01@@QAEAAV0@$$QAV0@@Z ??4?$CLockBase@$04$01$01$00$02$01@@QAEAAV0@ABV0@@Z ??4?$CLockBase@$05$01$01$00$02$01@@QAEAAV0@$$QAV0@@Z ??4?$CLockBase@$05$01$01$00$02$01@@QAEAAV0@ABV0@@Z ??4?$CLockBase@$06$01$00$00$02$01@@QAEAAV0@$$QAV0@@Z ??4?$CLockBase@$06$01$00$00$02$01@@QAEAAV0@ABV0@@Z ??4CCritSec@@QAEAAV0@ABV0@@Z ??4CDoubleList@@QAEAAV0@ABV0@@Z ??4CFakeLock@@QAEAAV0@ABV0@@Z ??4CLKRHashTableStats@LKRhash@@QAEAAV01@$$QAV01@@Z ??4CLKRHashTableStats@LKRhash@@QAEAAV01@ABV01@@Z ??4CLKRHashTable_Iterator@LKRhash@@QAEAAV01@$$QAV01@@Z ??4CLKRHashTable_Iterator@LKRhash@@QAEAAV01@ABV01@@Z ??4CLKRLinearHashTable_Iterator@LKRhash@@QAEAAV01@ABV01@@Z ??4CLockedDoubleList@@QAEAAV0@$$QAV0@@Z ??4CLockedDoubleList@@QAEAAV0@ABV0@@Z ??4CLockedSingleList@@QAEAAV0@$$QAV0@@Z ??4CLockedSingleList@@QAEAAV0@ABV0@@Z ??4CReaderWriterLock2@@QAEAAV0@$$QAV0@@Z ??4CReaderWriterLock2@@QAEAAV0@ABV0@@Z ??4CReaderWriterLock3@@QAEAAV0@$$QAV0@@Z ??4CReaderWriterLock3@@QAEAAV0@ABV0@@Z ??4CReaderWriterLock@@QAEAAV0@$$QAV0@@Z ??4CReaderWriterLock@@QAEAAV0@ABV0@@Z ??4CSingleList@@QAEAAV0@ABV0@@Z ??4CSmallSpinLock@@QAEAAV0@$$QAV0@@Z ??4CSmallSpinLock@@QAEAAV0@ABV0@@Z ??4CSpinLock@@QAEAAV0@$$QAV0@@Z ??4CSpinLock@@QAEAAV0@ABV0@@Z ??8CLKRHashTable_Iterator@LKRhash@@QBE_NABV01@@Z ??8CLKRLinearHashTable_Iterator@LKRhash@@QBE_NABV01@@Z ??9CLKRHashTable_Iterator@LKRhash@@QBE_NABV01@@Z ??9CLKRLinearHashTable_Iterator@LKRhash@@QBE_NABV01@@Z ??_7CLKRhashDefaultAllocator@@6B@ ?Alloc@CLKRhashDefaultAllocator@@UAEPAXIW4Type@CLKRhashAllocator@@@Z ?BucketIndex@CLKRHashTableStats@LKRhash@@SGJJ@Z ?BucketSize@CLKRHashTableStats@LKRhash@@SGJJ@Z ?BucketSizes@CLKRHashTableStats@LKRhash@@SGPBJXZ ?ClassName@CCritSec@@SGPB_WXZ ?ClassName@CFakeLock@@SGPB_WXZ ?ClassName@CLKRHashTable@LKRhash@@SGPB_WXZ ?ClassName@CLKRLinearHashTable@LKRhash@@SGPB_WXZ ?ClassName@CLKRhashDefaultAllocator@@UAEPB_WXZ ?ClassName@CReaderWriterLock2@@SGPB_WXZ ?ClassName@CReaderWriterLock3@@SGPB_WXZ ?ClassName@CReaderWriterLock@@SGPB_WXZ ?ClassName@CSmallSpinLock@@SGPB_WXZ ?ClassName@CSpinLock@@SGPB_WXZ ?Clear@CLKRLinearHashTable@LKRhash@@QAEXXZ ?ConvertExclusiveToShared@CCritSec@@QAEXXZ ?ConvertExclusiveToShared@CFakeLock@@QAEXXZ ?ConvertExclusiveToShared@CLKRLinearHashTable@LKRhash@@QBEXXZ ?ConvertExclusiveToShared@CReaderWriterLock2@@QAEXXZ ?ConvertExclusiveToShared@CReaderWriterLock3@@QAEXXZ ?ConvertExclusiveToShared@CReaderWriterLock@@QAEXXZ ?ConvertExclusiveToShared@CSmallSpinLock@@QAEXXZ ?ConvertExclusiveToShared@CSpinLock@@QAEXXZ ?ConvertSharedToExclusive@CCritSec@@QAEXXZ ?ConvertSharedToExclusive@CFakeLock@@QAEXXZ ?ConvertSharedToExclusive@CLKRLinearHashTable@LKRhash@@QBEXXZ ?ConvertSharedToExclusive@CReaderWriterLock2@@QAEXXZ ?ConvertSharedToExclusive@CReaderWriterLock3@@QAEXXZ ?ConvertSharedToExclusive@CReaderWriterLock@@QAEXXZ ?ConvertSharedToExclusive@CSmallSpinLock@@QAEXXZ ?ConvertSharedToExclusive@CSpinLock@@QAEXXZ ?DeleteKey@CLKRLinearHashTable@LKRhash@@QAE?AW4LK_RETCODE@2@K@Z ?DeleteRecord@CLKRLinearHashTable@LKRhash@@QAE?AW4LK_RETCODE@2@PBX@Z ?End@CLKRHashTable@LKRhash@@QAE?AVCLKRHashTable_Iterator@2@XZ ?End@CLKRLinearHashTable@LKRhash@@QAE?AVCLKRLinearHashTable_Iterator@2@XZ ?FindKey@CLKRLinearHashTable@LKRhash@@QBE?AW4LK_RETCODE@2@KPAPBX@Z ?FindRecord@CLKRLinearHashTable@LKRhash@@QBE?AW4LK_RETCODE@2@PBX@Z ?First@CDoubleList@@QBEQAVCListEntry@@XZ ?First@CLockedDoubleList@@QAEQAVCListEntry@@XZ ?Free@CLKRhashDefaultAllocator@@UAE_NPAXW4Type@CLKRhashAllocator@@@Z ?GetDefaultSpinAdjustmentFactor@CCritSec@@SGNXZ ?GetDefaultSpinAdjustmentFactor@CFakeLock@@SGNXZ ?GetDefaultSpinAdjustmentFactor@CReaderWriterLock2@@SGNXZ ?GetDefaultSpinAdjustmentFactor@CReaderWriterLock3@@SGNXZ ?GetDefaultSpinAdjustmentFactor@CReaderWriterLock@@SGNXZ ?GetDefaultSpinAdjustmentFactor@CSmallSpinLock@@SGNXZ ?GetDefaultSpinAdjustmentFactor@CSpinLock@@SGNXZ ?GetDefaultSpinCount@CCritSec@@SGGXZ ?GetDefaultSpinCount@CFakeLock@@SGGXZ ?GetDefaultSpinCount@CReaderWriterLock2@@SGGXZ ?GetDefaultSpinCount@CReaderWriterLock3@@SGGXZ ?GetDefaultSpinCount@CReaderWriterLock@@SGGXZ ?GetDefaultSpinCount@CSmallSpinLock@@SGGXZ ?GetDefaultSpinCount@CSpinLock@@SGGXZ ?GetSpinCount@CCritSec@@QBEGXZ ?GetSpinCount@CFakeLock@@QBEGXZ ?GetSpinCount@CReaderWriterLock2@@QBEGXZ ?GetSpinCount@CReaderWriterLock3@@QBEGXZ ?GetSpinCount@CReaderWriterLock@@QBEGXZ ?GetSpinCount@CSmallSpinLock@@QBEGXZ ?GetSpinCount@CSpinLock@@QBEGXZ ?GetTableLockSpinCount@CLKRLinearHashTable@LKRhash@@QBEGXZ ?HeadNode@CDoubleList@@QBEQBVCListEntry@@XZ ?HeadNode@CLockedDoubleList@@QBEQBVCListEntry@@XZ ?Increment@CLKRHashTable_Iterator@LKRhash@@QAE_NXZ ?Increment@CLKRLinearHashTable_Iterator@LKRhash@@QAE_NXZ ?InsertHead@CDoubleList@@QAEXQAVCListEntry@@@Z ?InsertHead@CLockedDoubleList@@QAEXQAVCListEntry@@@Z ?InsertRecord@CLKRLinearHashTable@LKRhash@@QAE?AW4LK_RETCODE@2@PBX_NPAPBX@Z ?InsertTail@CDoubleList@@QAEXQAVCListEntry@@@Z ?InsertTail@CLockedDoubleList@@QAEXQAVCListEntry@@@Z ?IsEmpty@CDoubleList@@QBE_NXZ ?IsEmpty@CLockedDoubleList@@QBE_NXZ ?IsEmpty@CLockedSingleList@@QBE_NXZ ?IsEmpty@CSingleList@@QBE_NXZ ?IsLocked@CLockedDoubleList@@QBE_NXZ ?IsLocked@CLockedSingleList@@QBE_NXZ ?IsReadLocked@CCritSec@@QBE_NXZ ?IsReadLocked@CFakeLock@@QBE_NXZ ?IsReadLocked@CLKRLinearHashTable@LKRhash@@QBE_NXZ ?IsReadLocked@CReaderWriterLock2@@QBE_NXZ ?IsReadLocked@CReaderWriterLock3@@QBE_NXZ ?IsReadLocked@CReaderWriterLock@@QBE_NXZ ?IsReadLocked@CSmallSpinLock@@QBE_NXZ ?IsReadLocked@CSpinLock@@QBE_NXZ ?IsReadUnlocked@CCritSec@@QBE_NXZ ?IsReadUnlocked@CFakeLock@@QBE_NXZ ?IsReadUnlocked@CLKRLinearHashTable@LKRhash@@QBE_NXZ ?IsReadUnlocked@CReaderWriterLock2@@QBE_NXZ ?IsReadUnlocked@CReaderWriterLock3@@QBE_NXZ ?IsReadUnlocked@CReaderWriterLock@@QBE_NXZ ?IsReadUnlocked@CSmallSpinLock@@QBE_NXZ ?IsReadUnlocked@CSpinLock@@QBE_NXZ ?IsUnlocked@CLockedDoubleList@@QBE_NXZ ?IsUnlocked@CLockedSingleList@@QBE_NXZ ?IsUsable@CLKRHashTable@LKRhash@@QBE_NXZ ?IsUsable@CLKRLinearHashTable@LKRhash@@QBE_NXZ ?IsValid@CLKRHashTable_Iterator@LKRhash@@QBE_NXZ ?IsValid@CLKRLinearHashTable_Iterator@LKRhash@@QBE_NXZ ?IsWriteLocked@CCritSec@@QBE_NXZ ?IsWriteLocked@CFakeLock@@QBE_NXZ ?IsWriteLocked@CLKRLinearHashTable@LKRhash@@QBE_NXZ ?IsWriteLocked@CReaderWriterLock2@@QBE_NXZ ?IsWriteLocked@CReaderWriterLock3@@QBE_NXZ ?IsWriteLocked@CReaderWriterLock@@QBE_NXZ ?IsWriteLocked@CSmallSpinLock@@QBE_NXZ ?IsWriteLocked@CSpinLock@@QBE_NXZ ?IsWriteUnlocked@CCritSec@@QBE_NXZ ?IsWriteUnlocked@CFakeLock@@QBE_NXZ ?IsWriteUnlocked@CLKRLinearHashTable@LKRhash@@QBE_NXZ ?IsWriteUnlocked@CReaderWriterLock2@@QBE_NXZ ?IsWriteUnlocked@CReaderWriterLock3@@QBE_NXZ ?IsWriteUnlocked@CReaderWriterLock@@QBE_NXZ ?IsWriteUnlocked@CSmallSpinLock@@QBE_NXZ ?IsWriteUnlocked@CSpinLock@@QBE_NXZ ?Key@CLKRHashTable_Iterator@LKRhash@@QBE?BKXZ ?Key@CLKRLinearHashTable_Iterator@LKRhash@@QBE?BKXZ ?Last@CDoubleList@@QBEQAVCListEntry@@XZ ?Last@CLockedDoubleList@@QAEQAVCListEntry@@XZ ?Lock@CLockedDoubleList@@QAEXXZ ?Lock@CLockedSingleList@@QAEXXZ ?LockType@?$CLockBase@$00$00$02$00$02$01@@SG?AW4LOCK_LOCKTYPE@@XZ ?LockType@?$CLockBase@$01$00$00$00$02$01@@SG?AW4LOCK_LOCKTYPE@@XZ ?LockType@?$CLockBase@$02$00$00$00$00$00@@SG?AW4LOCK_LOCKTYPE@@XZ ?LockType@?$CLockBase@$03$00$00$01$02$02@@SG?AW4LOCK_LOCKTYPE@@XZ ?LockType@?$CLockBase@$04$01$01$00$02$01@@SG?AW4LOCK_LOCKTYPE@@XZ ?LockType@?$CLockBase@$05$01$01$00$02$01@@SG?AW4LOCK_LOCKTYPE@@XZ ?LockType@?$CLockBase@$06$01$00$00$02$01@@SG?AW4LOCK_LOCKTYPE@@XZ ?MaxSize@CLKRLinearHashTable@LKRhash@@QBEKXZ ?MultiKeys@CLKRLinearHashTable@LKRhash@@QBE_NXZ ?MutexType@?$CLockBase@$00$00$02$00$02$01@@SG?AW4LOCK_RW_MUTEX@@XZ ?MutexType@?$CLockBase@$01$00$00$00$02$01@@SG?AW4LOCK_RW_MUTEX@@XZ ?MutexType@?$CLockBase@$02$00$00$00$00$00@@SG?AW4LOCK_RW_MUTEX@@XZ ?MutexType@?$CLockBase@$03$00$00$01$02$02@@SG?AW4LOCK_RW_MUTEX@@XZ ?MutexType@?$CLockBase@$04$01$01$00$02$01@@SG?AW4LOCK_RW_MUTEX@@XZ ?MutexType@?$CLockBase@$05$01$01$00$02$01@@SG?AW4LOCK_RW_MUTEX@@XZ ?MutexType@?$CLockBase@$06$01$00$00$02$01@@SG?AW4LOCK_RW_MUTEX@@XZ ?NumSubTables@CLKRHashTable@LKRhash@@QBEHXZ ?NumSubTables@CLKRLinearHashTable@LKRhash@@QBEHXZ ?PerLockSpin@?$CLockBase@$00$00$02$00$02$01@@SG?AW4LOCK_PERLOCK_SPIN@@XZ ?PerLockSpin@?$CLockBase@$01$00$00$00$02$01@@SG?AW4LOCK_PERLOCK_SPIN@@XZ ?PerLockSpin@?$CLockBase@$02$00$00$00$00$00@@SG?AW4LOCK_PERLOCK_SPIN@@XZ ?PerLockSpin@?$CLockBase@$03$00$00$01$02$02@@SG?AW4LOCK_PERLOCK_SPIN@@XZ ?PerLockSpin@?$CLockBase@$04$01$01$00$02$01@@SG?AW4LOCK_PERLOCK_SPIN@@XZ ?PerLockSpin@?$CLockBase@$05$01$01$00$02$01@@SG?AW4LOCK_PERLOCK_SPIN@@XZ ?PerLockSpin@?$CLockBase@$06$01$00$00$02$01@@SG?AW4LOCK_PERLOCK_SPIN@@XZ ?Pop@CLockedSingleList@@QAEQAVCSingleListEntry@@XZ ?Pop@CSingleList@@QAEQAVCSingleListEntry@@XZ ?Push@CLockedSingleList@@QAEXQAVCSingleListEntry@@@Z ?Push@CSingleList@@QAEXQAVCSingleListEntry@@@Z ?QueueType@?$CLockBase@$00$00$02$00$02$01@@SG?AW4LOCK_QUEUE_TYPE@@XZ ?QueueType@?$CLockBase@$01$00$00$00$02$01@@SG?AW4LOCK_QUEUE_TYPE@@XZ ?QueueType@?$CLockBase@$02$00$00$00$00$00@@SG?AW4LOCK_QUEUE_TYPE@@XZ ?QueueType@?$CLockBase@$03$00$00$01$02$02@@SG?AW4LOCK_QUEUE_TYPE@@XZ ?QueueType@?$CLockBase@$04$01$01$00$02$01@@SG?AW4LOCK_QUEUE_TYPE@@XZ ?QueueType@?$CLockBase@$05$01$01$00$02$01@@SG?AW4LOCK_QUEUE_TYPE@@XZ ?QueueType@?$CLockBase@$06$01$00$00$02$01@@SG?AW4LOCK_QUEUE_TYPE@@XZ ?ReadLock@CCritSec@@QAEXXZ ?ReadLock@CFakeLock@@QAEXXZ ?ReadLock@CLKRLinearHashTable@LKRhash@@QBEXXZ ?ReadLock@CReaderWriterLock2@@QAEXXZ ?ReadLock@CReaderWriterLock3@@QAEXXZ ?ReadLock@CReaderWriterLock@@QAEXXZ ?ReadLock@CSmallSpinLock@@QAEXXZ ?ReadLock@CSpinLock@@QAEXXZ ?ReadOrWriteLock@CCritSec@@QAE_NXZ ?ReadOrWriteLock@CFakeLock@@QAE_NXZ ?ReadOrWriteLock@CReaderWriterLock3@@QAE_NXZ ?ReadOrWriteLock@CSpinLock@@QAE_NXZ ?ReadOrWriteUnlock@CCritSec@@QAEX_N@Z ?ReadOrWriteUnlock@CFakeLock@@QAEX_N@Z ?ReadOrWriteUnlock@CReaderWriterLock3@@QAEX_N@Z ?ReadOrWriteUnlock@CSpinLock@@QAEX_N@Z ?ReadUnlock@CCritSec@@QAEXXZ ?ReadUnlock@CFakeLock@@QAEXXZ ?ReadUnlock@CLKRLinearHashTable@LKRhash@@QBEXXZ ?ReadUnlock@CReaderWriterLock2@@QAEXXZ ?ReadUnlock@CReaderWriterLock3@@QAEXXZ ?ReadUnlock@CReaderWriterLock@@QAEXXZ ?ReadUnlock@CSmallSpinLock@@QAEXXZ ?ReadUnlock@CSpinLock@@QAEXXZ ?Record@CLKRHashTable_Iterator@LKRhash@@QBEPBXXZ ?Record@CLKRLinearHashTable_Iterator@LKRhash@@QBEPBXXZ ?Recursion@?$CLockBase@$00$00$02$00$02$01@@SG?AW4LOCK_RECURSION@@XZ ?Recursion@?$CLockBase@$01$00$00$00$02$01@@SG?AW4LOCK_RECURSION@@XZ ?Recursion@?$CLockBase@$02$00$00$00$00$00@@SG?AW4LOCK_RECURSION@@XZ ?Recursion@?$CLockBase@$03$00$00$01$02$02@@SG?AW4LOCK_RECURSION@@XZ ?Recursion@?$CLockBase@$04$01$01$00$02$01@@SG?AW4LOCK_RECURSION@@XZ ?Recursion@?$CLockBase@$05$01$01$00$02$01@@SG?AW4LOCK_RECURSION@@XZ ?Recursion@?$CLockBase@$06$01$00$00$02$01@@SG?AW4LOCK_RECURSION@@XZ ?RemoveEntry@CDoubleList@@SGXQAVCListEntry@@@Z ?RemoveEntry@CLockedDoubleList@@QAEXQAVCListEntry@@@Z ?RemoveHead@CDoubleList@@QAEQAVCListEntry@@XZ ?RemoveHead@CLockedDoubleList@@QAEQAVCListEntry@@XZ ?RemoveTail@CDoubleList@@QAEQAVCListEntry@@XZ ?RemoveTail@CLockedDoubleList@@QAEQAVCListEntry@@XZ ?SetDefaultSpinAdjustmentFactor@CCritSec@@SGXN@Z ?SetDefaultSpinAdjustmentFactor@CFakeLock@@SGXN@Z ?SetDefaultSpinAdjustmentFactor@CReaderWriterLock2@@SGXN@Z ?SetDefaultSpinAdjustmentFactor@CReaderWriterLock3@@SGXN@Z ?SetDefaultSpinAdjustmentFactor@CReaderWriterLock@@SGXN@Z ?SetDefaultSpinAdjustmentFactor@CSmallSpinLock@@SGXN@Z ?SetDefaultSpinAdjustmentFactor@CSpinLock@@SGXN@Z ?SetDefaultSpinCount@CCritSec@@SGXG@Z ?SetDefaultSpinCount@CFakeLock@@SGXG@Z ?SetDefaultSpinCount@CReaderWriterLock2@@SGXG@Z ?SetDefaultSpinCount@CReaderWriterLock3@@SGXG@Z ?SetDefaultSpinCount@CReaderWriterLock@@SGXG@Z ?SetDefaultSpinCount@CSmallSpinLock@@SGXG@Z ?SetDefaultSpinCount@CSpinLock@@SGXG@Z ?SetSpinCount@CFakeLock@@QAE_NG@Z ?SetSpinCount@CReaderWriterLock2@@QAE_NG@Z ?SetSpinCount@CReaderWriterLock3@@QAE_NG@Z ?SetSpinCount@CReaderWriterLock@@QAE_NG@Z ?SetSpinCount@CSmallSpinLock@@QAE_NG@Z ?SetSpinCount@CSpinLock@@QAE_NG@Z ?SetTableLockSpinCount@CLKRLinearHashTable@LKRhash@@QAEXG@Z ?Size@CLKRLinearHashTable@LKRhash@@QBEKXZ ?Swap@CSingleList@@QAEXAAV1@@Z ?TryConvertSharedToExclusive@CReaderWriterLock3@@QAE_NXZ ?TryReadLock@CCritSec@@QAE_NXZ ?TryReadLock@CFakeLock@@QAE_NXZ ?TryReadLock@CReaderWriterLock2@@QAE_NXZ ?TryReadLock@CReaderWriterLock3@@QAE_NXZ ?TryReadLock@CReaderWriterLock@@QAE_NXZ ?TryReadLock@CSmallSpinLock@@QAE_NXZ ?TryReadLock@CSpinLock@@QAE_NXZ ?TryReadOrWriteLock@CReaderWriterLock3@@QAE_NAA_N@Z ?TryWriteLock@CFakeLock@@QAE_NXZ ?TryWriteLock@CReaderWriterLock2@@QAE_NXZ ?TryWriteLock@CReaderWriterLock3@@QAE_NXZ ?TryWriteLock@CReaderWriterLock@@QAE_NXZ ?TryWriteLock@CSmallSpinLock@@QAE_NXZ ?TryWriteLock@CSpinLock@@QAE_NXZ ?Unlock@CLockedDoubleList@@QAEXXZ ?Unlock@CLockedSingleList@@QAEXXZ ?ValidSignature@CLKRHashTable@LKRhash@@QBE_NXZ ?ValidSignature@CLKRLinearHashTable@LKRhash@@QBE_NXZ ?WaitType@?$CLockBase@$00$00$02$00$02$01@@SG?AW4LOCK_WAIT_TYPE@@XZ ?WaitType@?$CLockBase@$01$00$00$00$02$01@@SG?AW4LOCK_WAIT_TYPE@@XZ ?WaitType@?$CLockBase@$02$00$00$00$00$00@@SG?AW4LOCK_WAIT_TYPE@@XZ ?WaitType@?$CLockBase@$03$00$00$01$02$02@@SG?AW4LOCK_WAIT_TYPE@@XZ ?WaitType@?$CLockBase@$04$01$01$00$02$01@@SG?AW4LOCK_WAIT_TYPE@@XZ ?WaitType@?$CLockBase@$05$01$01$00$02$01@@SG?AW4LOCK_WAIT_TYPE@@XZ ?WaitType@?$CLockBase@$06$01$00$00$02$01@@SG?AW4LOCK_WAIT_TYPE@@XZ ?WriteLock@CCritSec@@QAEXXZ ?WriteLock@CFakeLock@@QAEXXZ ?WriteLock@CLKRLinearHashTable@LKRhash@@QAEXXZ ?WriteLock@CReaderWriterLock2@@QAEXXZ ?WriteLock@CReaderWriterLock3@@QAEXXZ ?WriteLock@CReaderWriterLock@@QAEXXZ ?WriteLock@CSmallSpinLock@@QAEXXZ ?WriteLock@CSpinLock@@QAEXXZ ?WriteUnlock@CCritSec@@QAEXXZ ?WriteUnlock@CFakeLock@@QAEXXZ ?WriteUnlock@CLKRLinearHashTable@LKRhash@@QBEXXZ ?WriteUnlock@CReaderWriterLock2@@QAEXXZ ?WriteUnlock@CReaderWriterLock3@@QAEXXZ ?WriteUnlock@CReaderWriterLock@@QAEXXZ ?WriteUnlock@CSmallSpinLock@@QAEXXZ ?WriteUnlock@CSpinLock@@QAEXXZ ?_AddRef@CLKRLinearHashTable_Iterator@LKRhash@@IBEXH@Z ?_AddRefRecord@CLKRLinearHashTable@LKRhash@@ABEXPBXH@Z ?_Bucket@CLKRLinearHashTable@LKRhash@@ABEQAVCBucket@2@K@Z ?_BucketAddress@CLKRLinearHashTable@LKRhash@@ABEKK@Z ?_BucketLock@CLKRLinearHashTable@LKRhash@@ABEXQAVCBucket@2@W4LK_LOCKTYPE@2@@Z ?_BucketReadLock@CLKRLinearHashTable@LKRhash@@ABEXQAVCBucket@2@@Z ?_BucketReadUnlock@CLKRLinearHashTable@LKRhash@@ABEXQAVCBucket@2@@Z ?_BucketUnlock@CLKRLinearHashTable@LKRhash@@ABEXQAVCBucket@2@W4LK_LOCKTYPE@2@@Z ?_BucketWriteLock@CLKRLinearHashTable@LKRhash@@ABEXQAVCBucket@2@@Z ?_BucketWriteUnlock@CLKRLinearHashTable@LKRhash@@ABEXQAVCBucket@2@@Z ?_CalcKeyHash@CLKRHashTable@LKRhash@@ABEKK@Z ?_CalcKeyHash@CLKRLinearHashTable@LKRhash@@ABEKK@Z ?_CmpExch@CReaderWriterLock2@@AAE_NJJ@Z ?_CmpExch@CReaderWriterLock3@@AAE_NJJ@Z ?_CmpExch@CReaderWriterLock@@AAE_NJJ@Z ?_CurrentThreadId@CReaderWriterLock3@@CGJXZ ?_CurrentThreadId@CSmallSpinLock@@CGJXZ ?_CurrentThreadId@CSpinLock@@CGJXZ ?_EqualKeys@CLKRLinearHashTable@LKRhash@@ABE_NKK@Z ?_ExtractKey@CLKRHashTable@LKRhash@@ABE?BKPBX@Z ?_ExtractKey@CLKRLinearHashTable@LKRhash@@ABE?BKPBX@Z ?_H0@CLKRLinearHashTable@LKRhash@@ABEKK@Z ?_H0@CLKRLinearHashTable@LKRhash@@CGKKK@Z ?_H1@CLKRLinearHashTable@LKRhash@@ABEKK@Z ?_H1@CLKRLinearHashTable@LKRhash@@CGKKK@Z ?_InsertThisIntoGlobalList@CLKRHashTable@LKRhash@@AAEXXZ ?_InsertThisIntoGlobalList@CLKRLinearHashTable@LKRhash@@AAEXXZ ?_IsLocked@CSpinLock@@ABE_NXZ ?_IsValidIterator@CLKRHashTable@LKRhash@@ABE_NABVCLKRHashTable_Iterator@2@@Z ?_IsValidIterator@CLKRLinearHashTable@LKRhash@@ABE_NABVCLKRLinearHashTable_Iterator@2@@Z ?_Lock@CSpinLock@@AAEXXZ ?_PredTrue@CLKRLinearHashTable@LKRhash@@CG?AW4LK_PREDICATE@2@PBXPAX@Z ?_ReadLockSpin@CReaderWriterLock2@@AAEXXZ ?_ReadLockSpin@CReaderWriterLock3@@AAEXW4SPIN_TYPE@1@@Z ?_ReadLockSpin@CReaderWriterLock@@AAEXXZ ?_ReadOrWriteLock@CLKRLinearHashTable@LKRhash@@ABE_NXZ ?_ReadOrWriteUnlock@CLKRLinearHashTable@LKRhash@@ABEX_N@Z ?_RemoveThisFromGlobalList@CLKRHashTable@LKRhash@@AAEXXZ ?_RemoveThisFromGlobalList@CLKRLinearHashTable@LKRhash@@AAEXXZ ?_SegIndex@CLKRLinearHashTable@LKRhash@@ABEKK@Z ?_Segment@CLKRLinearHashTable@LKRhash@@ABEAAPAVCSegment@2@K@Z ?_TableLock@CLKRLinearHashTable@LKRhash@@AAEXW4LK_LOCKTYPE@2@@Z ?_TableUnlock@CLKRLinearHashTable@LKRhash@@AAEXW4LK_LOCKTYPE@2@@Z ?_TryLock@CSmallSpinLock@@AAE_NXZ ?_TryLock@CSpinLock@@AAE_NXZ ?_TryReadLock@CReaderWriterLock2@@AAE_NXZ ?_TryReadLock@CReaderWriterLock3@@AAE_NXZ ?_TryReadLock@CReaderWriterLock@@AAE_NXZ ?_TryReadLockRecursive@CReaderWriterLock3@@AAE_NXZ ?_TryWriteLock2@CReaderWriterLock3@@AAE_NXZ ?_TryWriteLock@CReaderWriterLock2@@AAE_NJ@Z ?_TryWriteLock@CReaderWriterLock3@@AAE_NJ@Z ?_TryWriteLock@CReaderWriterLock@@AAE_NXZ ?_Unlock@CSpinLock@@AAEXXZ ?_WriteLockSpin@CReaderWriterLock@@AAEXXZ ?s_aBucketSizes@?1??BucketSizes@CLKRHashTableStats@LKRhash@@SGPBJXZ@4QBJB

Sharing

General

Malware Config

Signatures

File Explorer

2026-04-15_05c72bc846f84a3708abe4db8513c3a7_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader_stop

generic