7decd13fe2e957a64feb6f6fb64ff0a27b3e1e8ee59c992f96b00dd1f8ff48fd

Analysis

max time kernel
150s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
18/04/2026, 02:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-18_2e6f73e9f6dfbc8436de309295e4bf29_amadey_coinminer_darkgate_elex_hijackloader_icedid_luca-.exe
Size 6.0MB
Sample260418-c2sxtaas3m
SHA256 7decd13fe2e957a64feb6f6fb64ff0a27b3e1e8ee59c992f96b00dd1f8ff48fd
MD5 2e6f73e9f6dfbc8436de309295e4bf29
SHA1 5583078a7b4505a08995e67a50891a05dd3addc4
SHA512 71b3a56b4f23c6ee4b6719c12ce3e0b62777e20b8430cc4e6b7aa38f659277c7fb72ed7d5d05d50324dfd4c0ab0799e82be7d7542180897b46d15c0441fa9d56
SSDEEP 98304:jbXsPN5kiQaZ58kB/qoHMdnJEsKsW1+M5NC:I5VPgJEs1yC
TLSH
T15356D52076D5CFA5E06F1171DD69BAF5402BBD208F654FCB6A803E1A35706C2A931B2F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery spyware stealer trojan

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
24	3796	Process not Found

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\Control Panel\International\Geo\Nation	AdobeARMHelper.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\Control Panel\International\Geo\Nation	2026-04-18_2e6f73e9f6dfbc8436de309295e4bf29_amadey_coinminer_darkgate_elex_hijackloader_icedid_luca-.sho

Executes dropped EXE 2 IoCs

pid	Process
2304	2026-04-18_2e6f73e9f6dfbc8436de309295e4bf29_amadey_coinminer_darkgate_elex_hijackloader_icedid_luca-.sho
3836	AdobeARMHelper.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Shohdi.hdi	2026-04-18_2e6f73e9f6dfbc8436de309295e4bf29_amadey_coinminer_darkgate_elex_hijackloader_icedid_luca-.exe
File opened for modification	C:\Windows\SysWOW64\Shohdi.hdi	2026-04-18_2e6f73e9f6dfbc8436de309295e4bf29_amadey_coinminer_darkgate_elex_hijackloader_icedid_luca-.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	\??\c:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE	2026-04-18_2e6f73e9f6dfbc8436de309295e4bf29_amadey_coinminer_darkgate_elex_hijackloader_icedid_luca-.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Office16\msoasb.sho	2026-04-18_2e6f73e9f6dfbc8436de309295e4bf29_amadey_coinminer_darkgate_elex_hijackloader_icedid_luca-.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Office16\msotd.sho	2026-04-18_2e6f73e9f6dfbc8436de309295e4bf29_amadey_coinminer_darkgate_elex_hijackloader_icedid_luca-.exe
File created	\??\c:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE	2026-04-18_2e6f73e9f6dfbc8436de309295e4bf29_amadey_coinminer_darkgate_elex_hijackloader_icedid_luca-.exe
File opened for modification	\??\c:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.sho	2026-04-18_2e6f73e9f6dfbc8436de309295e4bf29_amadey_coinminer_darkgate_elex_hijackloader_icedid_luca-.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.sho	2026-04-18_2e6f73e9f6dfbc8436de309295e4bf29_amadey_coinminer_darkgate_elex_hijackloader_icedid_luca-.exe
File created	\??\c:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe	2026-04-18_2e6f73e9f6dfbc8436de309295e4bf29_amadey_coinminer_darkgate_elex_hijackloader_icedid_luca-.exe
File created	\??\c:\Program Files\Microsoft Office\root\Client\AppVLP.exe	2026-04-18_2e6f73e9f6dfbc8436de309295e4bf29_amadey_coinminer_darkgate_elex_hijackloader_icedid_luca-.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Office16\PPTICO.sho	2026-04-18_2e6f73e9f6dfbc8436de309295e4bf29_amadey_coinminer_darkgate_elex_hijackloader_icedid_luca-.exe
File created	\??\c:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE	2026-04-18_2e6f73e9f6dfbc8436de309295e4bf29_amadey_coinminer_darkgate_elex_hijackloader_icedid_luca-.exe
File opened for modification	\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.sho	2026-04-18_2e6f73e9f6dfbc8436de309295e4bf29_amadey_coinminer_darkgate_elex_hijackloader_icedid_luca-.exe
File created	\??\c:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	2026-04-18_2e6f73e9f6dfbc8436de309295e4bf29_amadey_coinminer_darkgate_elex_hijackloader_icedid_luca-.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.sho	2026-04-18_2e6f73e9f6dfbc8436de309295e4bf29_amadey_coinminer_darkgate_elex_hijackloader_icedid_luca-.exe
File created	\??\c:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe	2026-04-18_2e6f73e9f6dfbc8436de309295e4bf29_amadey_coinminer_darkgate_elex_hijackloader_icedid_luca-.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge.sho	2026-04-18_2e6f73e9f6dfbc8436de309295e4bf29_amadey_coinminer_darkgate_elex_hijackloader_icedid_luca-.exe
File created	\??\c:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-04-18_2e6f73e9f6dfbc8436de309295e4bf29_amadey_coinminer_darkgate_elex_hijackloader_icedid_luca-.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.sho	2026-04-18_2e6f73e9f6dfbc8436de309295e4bf29_amadey_coinminer_darkgate_elex_hijackloader_icedid_luca-.exe
File created	\??\c:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateComRegisterShell64.exe	2026-04-18_2e6f73e9f6dfbc8436de309295e4bf29_amadey_coinminer_darkgate_elex_hijackloader_icedid_luca-.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Office16\protocolhandler.sho	2026-04-18_2e6f73e9f6dfbc8436de309295e4bf29_amadey_coinminer_darkgate_elex_hijackloader_icedid_luca-.exe
File created	\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	2026-04-18_2e6f73e9f6dfbc8436de309295e4bf29_amadey_coinminer_darkgate_elex_hijackloader_icedid_luca-.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge_pwa_launcher.sho	2026-04-18_2e6f73e9f6dfbc8436de309295e4bf29_amadey_coinminer_darkgate_elex_hijackloader_icedid_luca-.exe
File opened for modification	\??\c:\Program Files\Java\jdk-1.8\jre\bin\javaw.sho	2026-04-18_2e6f73e9f6dfbc8436de309295e4bf29_amadey_coinminer_darkgate_elex_hijackloader_icedid_luca-.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Office16\ORGCHART.sho	2026-04-18_2e6f73e9f6dfbc8436de309295e4bf29_amadey_coinminer_darkgate_elex_hijackloader_icedid_luca-.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Office16\VPREVIEW.sho	2026-04-18_2e6f73e9f6dfbc8436de309295e4bf29_amadey_coinminer_darkgate_elex_hijackloader_icedid_luca-.exe
File created	\??\c:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	2026-04-18_2e6f73e9f6dfbc8436de309295e4bf29_amadey_coinminer_darkgate_elex_hijackloader_icedid_luca-.exe
File created	\??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe	2026-04-18_2e6f73e9f6dfbc8436de309295e4bf29_amadey_coinminer_darkgate_elex_hijackloader_icedid_luca-.exe
File created	\??\c:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe	2026-04-18_2e6f73e9f6dfbc8436de309295e4bf29_amadey_coinminer_darkgate_elex_hijackloader_icedid_luca-.exe
File created	\??\c:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateCore.exe	2026-04-18_2e6f73e9f6dfbc8436de309295e4bf29_amadey_coinminer_darkgate_elex_hijackloader_icedid_luca-.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\elevation_service.sho	2026-04-18_2e6f73e9f6dfbc8436de309295e4bf29_amadey_coinminer_darkgate_elex_hijackloader_icedid_luca-.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.sho	2026-04-18_2e6f73e9f6dfbc8436de309295e4bf29_amadey_coinminer_darkgate_elex_hijackloader_icedid_luca-.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\notification_helper.sho	2026-04-18_2e6f73e9f6dfbc8436de309295e4bf29_amadey_coinminer_darkgate_elex_hijackloader_icedid_luca-.exe
File created	\??\c:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\BHO\ie_to_edge_stub.exe	2026-04-18_2e6f73e9f6dfbc8436de309295e4bf29_amadey_coinminer_darkgate_elex_hijackloader_icedid_luca-.exe
File opened for modification	\??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.sho	2026-04-18_2e6f73e9f6dfbc8436de309295e4bf29_amadey_coinminer_darkgate_elex_hijackloader_icedid_luca-.exe
File created	\??\c:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe	2026-04-18_2e6f73e9f6dfbc8436de309295e4bf29_amadey_coinminer_darkgate_elex_hijackloader_icedid_luca-.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_pwa_launcher.sho	2026-04-18_2e6f73e9f6dfbc8436de309295e4bf29_amadey_coinminer_darkgate_elex_hijackloader_icedid_luca-.exe
File opened for modification	\??\c:\Program Files\Google\Chrome\Application\chrome_proxy.sho	2026-04-18_2e6f73e9f6dfbc8436de309295e4bf29_amadey_coinminer_darkgate_elex_hijackloader_icedid_luca-.exe
File opened for modification	\??\c:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.sho	2026-04-18_2e6f73e9f6dfbc8436de309295e4bf29_amadey_coinminer_darkgate_elex_hijackloader_icedid_luca-.exe
File created	\??\c:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE	2026-04-18_2e6f73e9f6dfbc8436de309295e4bf29_amadey_coinminer_darkgate_elex_hijackloader_icedid_luca-.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.sho	2026-04-18_2e6f73e9f6dfbc8436de309295e4bf29_amadey_coinminer_darkgate_elex_hijackloader_icedid_luca-.exe
File opened for modification	\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.sho	2026-04-18_2e6f73e9f6dfbc8436de309295e4bf29_amadey_coinminer_darkgate_elex_hijackloader_icedid_luca-.exe
File created	\??\c:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_pwa_launcher.exe	2026-04-18_2e6f73e9f6dfbc8436de309295e4bf29_amadey_coinminer_darkgate_elex_hijackloader_icedid_luca-.exe
File created	\??\c:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe	2026-04-18_2e6f73e9f6dfbc8436de309295e4bf29_amadey_coinminer_darkgate_elex_hijackloader_icedid_luca-.exe
File created	\??\c:\Program Files\Mozilla Firefox\firefox.exe	2026-04-18_2e6f73e9f6dfbc8436de309295e4bf29_amadey_coinminer_darkgate_elex_hijackloader_icedid_luca-.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\BHO\ie_to_edge_stub.sho	2026-04-18_2e6f73e9f6dfbc8436de309295e4bf29_amadey_coinminer_darkgate_elex_hijackloader_icedid_luca-.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Office16\IEContentService.sho	2026-04-18_2e6f73e9f6dfbc8436de309295e4bf29_amadey_coinminer_darkgate_elex_hijackloader_icedid_luca-.exe
File created	\??\c:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE	2026-04-18_2e6f73e9f6dfbc8436de309295e4bf29_amadey_coinminer_darkgate_elex_hijackloader_icedid_luca-.exe
File opened for modification	\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.sho	2026-04-18_2e6f73e9f6dfbc8436de309295e4bf29_amadey_coinminer_darkgate_elex_hijackloader_icedid_luca-.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\cookie_exporter.sho	2026-04-18_2e6f73e9f6dfbc8436de309295e4bf29_amadey_coinminer_darkgate_elex_hijackloader_icedid_luca-.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.sho	2026-04-18_2e6f73e9f6dfbc8436de309295e4bf29_amadey_coinminer_darkgate_elex_hijackloader_icedid_luca-.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.sho	2026-04-18_2e6f73e9f6dfbc8436de309295e4bf29_amadey_coinminer_darkgate_elex_hijackloader_icedid_luca-.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.sho	2026-04-18_2e6f73e9f6dfbc8436de309295e4bf29_amadey_coinminer_darkgate_elex_hijackloader_icedid_luca-.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\identity_helper.sho	2026-04-18_2e6f73e9f6dfbc8436de309295e4bf29_amadey_coinminer_darkgate_elex_hijackloader_icedid_luca-.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.sho	2026-04-18_2e6f73e9f6dfbc8436de309295e4bf29_amadey_coinminer_darkgate_elex_hijackloader_icedid_luca-.exe
File created	\??\c:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	2026-04-18_2e6f73e9f6dfbc8436de309295e4bf29_amadey_coinminer_darkgate_elex_hijackloader_icedid_luca-.exe
File opened for modification	\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.sho	2026-04-18_2e6f73e9f6dfbc8436de309295e4bf29_amadey_coinminer_darkgate_elex_hijackloader_icedid_luca-.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.sho	2026-04-18_2e6f73e9f6dfbc8436de309295e4bf29_amadey_coinminer_darkgate_elex_hijackloader_icedid_luca-.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedgewebview2.sho	2026-04-18_2e6f73e9f6dfbc8436de309295e4bf29_amadey_coinminer_darkgate_elex_hijackloader_icedid_luca-.exe
File created	\??\c:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\pwahelper.exe	2026-04-18_2e6f73e9f6dfbc8436de309295e4bf29_amadey_coinminer_darkgate_elex_hijackloader_icedid_luca-.exe
File created	\??\c:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-04-18_2e6f73e9f6dfbc8436de309295e4bf29_amadey_coinminer_darkgate_elex_hijackloader_icedid_luca-.exe
File created	\??\c:\Program Files\VideoLAN\VLC\vlc.exe	2026-04-18_2e6f73e9f6dfbc8436de309295e4bf29_amadey_coinminer_darkgate_elex_hijackloader_icedid_luca-.exe
File created	\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	2026-04-18_2e6f73e9f6dfbc8436de309295e4bf29_amadey_coinminer_darkgate_elex_hijackloader_icedid_luca-.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\elevation_service.sho	2026-04-18_2e6f73e9f6dfbc8436de309295e4bf29_amadey_coinminer_darkgate_elex_hijackloader_icedid_luca-.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.sho	2026-04-18_2e6f73e9f6dfbc8436de309295e4bf29_amadey_coinminer_darkgate_elex_hijackloader_icedid_luca-.exe
File opened for modification	\??\c:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.sho	2026-04-18_2e6f73e9f6dfbc8436de309295e4bf29_amadey_coinminer_darkgate_elex_hijackloader_icedid_luca-.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-18_2e6f73e9f6dfbc8436de309295e4bf29_amadey_coinminer_darkgate_elex_hijackloader_icedid_luca-.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-18_2e6f73e9f6dfbc8436de309295e4bf29_amadey_coinminer_darkgate_elex_hijackloader_icedid_luca-.sho
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AdobeARMHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AdobeARM.exe

Modifies system certificate store 2 TTPs 3 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 040000000100000010000000d474de575c39b2d39c8583c5c065498a0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000007431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25190000000100000010000000ba4f3972e7aed9dccdc210db59da13c92000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	2026-04-18_2e6f73e9f6dfbc8436de309295e4bf29_amadey_coinminer_darkgate_elex_hijackloader_icedid_luca-.sho
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 5c000000010000000400000000080000190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc36200000001000000200000007431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8040000000100000010000000d474de575c39b2d39c8583c5c065498a2000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	2026-04-18_2e6f73e9f6dfbc8436de309295e4bf29_amadey_coinminer_darkgate_elex_hijackloader_icedid_luca-.sho
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25	2026-04-18_2e6f73e9f6dfbc8436de309295e4bf29_amadey_coinminer_darkgate_elex_hijackloader_icedid_luca-.sho

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3836	AdobeARMHelper.exe
3836	AdobeARMHelper.exe
3836	AdobeARMHelper.exe
3836	AdobeARMHelper.exe
3836	AdobeARMHelper.exe
3836	AdobeARMHelper.exe
3836	AdobeARMHelper.exe
3836	AdobeARMHelper.exe
3836	AdobeARMHelper.exe
3836	AdobeARMHelper.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2304	2026-04-18_2e6f73e9f6dfbc8436de309295e4bf29_amadey_coinminer_darkgate_elex_hijackloader_icedid_luca-.sho
1432	AdobeARM.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 5116 wrote to memory of 2304	5116	2026-04-18_2e6f73e9f6dfbc8436de309295e4bf29_amadey_coinminer_darkgate_elex_hijackloader_icedid_luca-.exe	83
PID 2304 wrote to memory of 4488	2304	2026-04-18_2e6f73e9f6dfbc8436de309295e4bf29_amadey_coinminer_darkgate_elex_hijackloader_icedid_luca-.sho	93
PID 2304 wrote to memory of 3836	2304	2026-04-18_2e6f73e9f6dfbc8436de309295e4bf29_amadey_coinminer_darkgate_elex_hijackloader_icedid_luca-.sho	95
PID 3836 wrote to memory of 1432	3836	AdobeARMHelper.exe	96

C:\Users\Admin\AppData\Local\Temp\2026-04-18_2e6f73e9f6dfbc8436de309295e4bf29_amadey_coinminer_darkgate_elex_hijackloader_icedid_luca-.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-18_2e6f73e9f6dfbc8436de309295e4bf29_amadey_coinminer_darkgate_elex_hijackloader_icedid_luca-.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5116
- C:\Users\Admin\AppData\Local\Temp\2026-04-18_2e6f73e9f6dfbc8436de309295e4bf29_amadey_coinminer_darkgate_elex_hijackloader_icedid_luca-.sho
  C:\Users\Admin\AppData\Local\Temp\2026-04-18_2e6f73e9f6dfbc8436de309295e4bf29_amadey_coinminer_darkgate_elex_hijackloader_icedid_luca-.sho
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies system certificate store
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2304
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe"
    3⤵
    PID:4488
- - C:\ProgramData\Adobe\ARM\S\21305\AdobeARMHelper.exe
    "C:\ProgramData\Adobe\ARM\S\21305\AdobeARMHelper.exe" /ArmUpdate /MSI FOLDER:"C:\ProgramData\Adobe\ARM\S\21305" /MODE:3 /UpdateSelection:1 /PRODUCT:{291AA914-A987-4CE9-BD63-AC0A92D435E5} /VERSION:19.0 /LANG:ENU
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:3836
  - - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
      "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" /ArmUpdate /MSI FOLDER:"C:\ProgramData\Adobe\ARM\S\21305" /MODE:3 /UpdateSelection:1 /PRODUCT:{291AA914-A987-4CE9-BD63-AC0A92D435E5} /VERSION:19.0 /LANG:ENU
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1432

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ArmReport.ini

Path C:\ProgramData\Adobe\ARM\ArmReport.ini
Size 82B
SHA256 5a1e0a0216dd3893a738efdfc9c1bc5445e68d3939840578341f6cd08b14d815
MD5 9de1c12da78157648e8e5b25adab3467
SHA1 e9a8e45cbc66f9323f530a7bc88249e92e99fa52
SHA512 cbc027271d3977d2c248dbcd683da728880d5c26d2bae6df6299b4eeed551f34b2e687865b578a688f98a3865b63450ac0bf7cc07d031dad0f8dbe72e9e531b9
TLSH
T1FEA0222333C0803CB8203A02CCE088333322B0C8B00BC00CC002228E00F022002223BF
MD5 SHA1 SHA512 TLSH

Submit Download

AdobeARM.msi

Path C:\ProgramData\Adobe\ARM\S\21305\AdobeARM.msi
Size 1.0MB
SHA256 f3f339de3a391d7f8baf37009ec52a6948d769977e2f407faf46f7064a524638
MD5 9474db895113963c06cf1050a3d5c91d
SHA1 5c599ee58ffb1fac122823e30814702fa38eec2d
SHA512 cb4fc2145582e459af1d8eb0ef3f33a629929eb7e0730a7af15d98b4c5577a5a5b3853c5695bc9e356be96c35a91cec69f57a81322c839a2cd6d73b9958d35af
SSDEEP 24576:5tsYy4SyBEqipH6t3uhK76TwlO/TTj11:5tsYy/yUpaiqhETTz
TLSH
T12935F107B3804236C59A0235544F87724B79FC348B21426B37D9B75D3EB27E0AABB5E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AdobeARMHelper.exe

Path C:\ProgramData\Adobe\ARM\S\21305\AdobeARMHelper.exe
Size 413KB
SHA256 fd115ae8ebd2f37cf1ef72f75242206cf1331c7cb258305011302e981137ee5e
MD5 522026a14d6bc781d2a15c665e454310
SHA1 9451a39108326ba578793b1feb62f23a02bce916
SHA512 4e4eb2f582c8590899a0ada6133b705d13775f60818f1ff4f9bb35e40e09d6570af4f7ac4c80b525b445a03702ca0f3a9867a93080f90697d8be668e2abe2fe7
SSDEEP 6144:q/6JSQsSVWSLjX2PxPNMRyfn7LzPdKblt0K+HAfh0v8axsbQuXYvr6yIl2:u6dVWnxlMSn7nFKbltn+Ch/m6X2
TLSH
T1DE947C1037D0C036F1B329768ABFD728556DB9715F6881CFA3C8166E5EB06E0AA3171B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RdrManifest2.msi

Path C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-AC0A92D435E5}\RdrManifest2.msi
Size 18KB
SHA256 0abcb8b7c0bda3128316b3e4f4a5857e9c8194105043a0c0e9801a1a96105d01
MD5 f5d4c05bc8ea0d4fc4d277abda7369d9
SHA1 f67e793b159bd1e75ed4dec0de352ea1b6583708
SHA512 359a966c4dc8d62a570b428dfb3e666a63efd6bfff7c5b5ace3bc97ea09ba701d9fa524f439bf9902746c2ecac9c1f76c90868b0152eb825b2a09a9474fdbb34
SSDEEP 384:MrUq75oUFtb0F+o5nfy9jdIYigYws0i9Db9Ey8RbmL4A8UiINyGNB:MrUq75oUFtb0F+o5nfy9uYigY9K5ALdH
TLSH
T19D820BA2B4408C11CD868F3EA4C1D726D672BC813D8591C27565F219CFB23869A9F7EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
Size 471B
SHA256 eba166c10696dcf0ba7dd1cf31c0bce51dce2ac568d9d25263eba2a0295b47e6
MD5 00c40d9b9fa9ba4e91a1567a4555189c
SHA1 7cb3b6ca50367b073459e3c3ef385a50c31ee8c5
SHA512 5399baef6fe1741f8fc38398a0b50d3dcea2688bc7c9dfd0288b10ef1bd6b96e41bcae3a835fc9546dd0fb2d7a14daeb2fa7318372cf6644802221b3d51899ca
TLSH
T10EF0DC37D4A714B2601A84DD1AF88AB225B5A54F12C9C1F960B427E1021B3D7610E436
MD5 SHA1 SHA512 TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_54359052731E413C60F1C59EABAD4E05

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_54359052731E413C60F1C59EABAD4E05
Size 727B
SHA256 41b287e7a40024c567ca285002055d78a669611da02f2788311694a5039391c2
MD5 6c3563b975c7d742755bed3199dac1e2
SHA1 d6af1086fe3e19476519cec252bcc90dde707e82
SHA512 065ec448b524a9af80c36bfdb18ec398076a53feffc015d79f1b042dd68abd78f816b630f23d421353fdd613d323ccb51fc98740341599072856f50e7dfa0a8f
TLSH
T1D8014406AA3D37609A424F54E7F93B20F7428BB6DC8C02AD5A3976CA97883620951659
MD5 SHA1 SHA512 TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_5809FDAACC125718B26BC11DC8E8116A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_5809FDAACC125718B26BC11DC8E8116A
Size 727B
SHA256 f509f6ca9690d341e398f1bc8c6643fc41cc2dcf0b104f362dc72c451d2c2a75
MD5 899c7c58653d6a22eb92e39e85558a15
SHA1 1a5a5ff815cb6287ba0a2beb41a019105b5d50dd
SHA512 a9ca9f14ec6a353292b54ec39b59b5b79cbf052266c51a87f96b2c54701a643653413fcc1a523f07843ff694676fa230bef91dc84a2f9720cbe5874f61b273e6
TLSH
T1A5019401375C16803E217E8A9D41ABA1B7BBA101B48C420F373A53BCF09EF66BC42238
MD5 SHA1 SHA512 TLSH

Submit Download

C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Size 727B
SHA256 1345d234af619f656cb2940ab028eae20ff4375eb8da1834a02599d3c10e02b6
MD5 ad5d0a6456c9affe2d0fcca59f5d0ebd
SHA1 ec4a611109a00ac3e1d5c33fea53ce7159bf102b
SHA512 ec7d9b830c060256d4e9c6a2266afdb95c134332e6fc6db2a98182f4d83e3054e586dbe6f2a7986dd3af15277434956ad3ee74510691cf454238194691ff6be1
TLSH
T1E601152364A6CD903620A901DBEC3A70777595F024BC476D63B9139A576D5509801515
MD5 SHA1 SHA512 TLSH

Submit Download

698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
Size 400B
SHA256 42ddd0f8678894767885b54d8f40465c87db4c389c7042f7680ef0ab329e5edb
MD5 c40eef3a6e13b4b78264fb5bbd0531e2
SHA1 8f5e6a2ffa25da70e3dbc5b89530e329750252ec
SHA512 3de9f07c917bf14a2eed67f887eb6c396ab56ec73c94f678d94fe0c710d52032565c6210e76636f772c894076805868094999568b19bb7735162726507db3ee2
TLSH
T1CEE0202017FF221EF5649B7407D5D09AAF25F1123C5557BE1583152D7905E005D77C31
MD5 SHA1 SHA512 TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_54359052731E413C60F1C59EABAD4E05

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_54359052731E413C60F1C59EABAD4E05
Size 404B
SHA256 ee4d6ec095f46a2245ed62f2c8410b7a0a57d11943c959e701576c650f76204d
MD5 ee77c429af2abae817b4a4788eaf4a37
SHA1 27b6d95bc6ebce315f560e0d83e2267792a8eb81
SHA512 be97dd5ab0027c4d6b115e0e9690956dc7d967cc67335496e2461fb8cdc74ad29cdacf9a35bd78500c77f39d5cc44cf65555aa9584b16edde7d20179f5b90b80
TLSH
T106E0267875F9466EF2E5D53587E69D2698E9F2420956C6A90040A74EBF12B800CB2638
MD5 SHA1 SHA512 TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_5809FDAACC125718B26BC11DC8E8116A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_5809FDAACC125718B26BC11DC8E8116A
Size 404B
SHA256 4ed70ab74e330ae5214c4253b720337c9803084d82e79c7928f42adf4fa9a475
MD5 5368addcc867f7c19df5dbb95c5905d3
SHA1 21924bce717bafd79d317c0e84d8f721fe4a5e8b
SHA512 cb3269f6ea1b3ab881a21433bb19e4bdd7357d0958832acacb2314315ab0bd133e7786bb97a580449cfd09992a5129831bd3f45e52a233e4db5ef201448fbb85
TLSH
T188E0C03071F4415DF1F0F8340BE6AC2684A9F303195AC278004026566A107005CE5530
MD5 SHA1 SHA512 TLSH

Submit Download

C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Size 412B
SHA256 446ee215a0774165547eac2b59e4bec6b0eb1d76d733252c3019f4883898c7ba
MD5 2331674394600865f52817a0c1aa7ccd
SHA1 94b310aaebd83626778eaf803a3eca02f52adcfb
SHA512 7aacd365e3e79498aa8b14205628a3d7d0c76b7290a75ca732d0f1f3bc72ac817537202185d612d2b252f74874e1642bc1f4d2de60b5fc4720ee1e41667bcb65
TLSH
T19DE0D82815EF655EF090D93545F9E1751D59E2011464977A15D1570DFB0AF409C14AB0
MD5 SHA1 SHA512 TLSH

Submit Download

2026-04-18_2e6f73e9f6dfbc8436de309295e4bf29_amadey_coinminer_darkgate_elex_hijackloader_icedid_luca-.sho

Path C:\Users\Admin\AppData\Local\Temp\2026-04-18_2e6f73e9f6dfbc8436de309295e4bf29_amadey_coinminer_darkgate_elex_hijackloader_icedid_luca-.sho
Size 1.5MB
SHA256 434538507c6299325a76974e90d6d876a913c39e27e815d9482bdd1e76e4679b
MD5 b9201a24e5f4dde7db468d3cb24a4a55
SHA1 96cfee656fba50791ce6f9f9f80bd4403241ecba
SHA512 ec24dd5352020eb3f5183d1d0f0d5894a7dcedace5779ea2179647fbd0ee5109c88a82b63cc28f197c3328491f407aa9dcbdc94d1f0c57d7a79c3d8a06e950ba
SSDEEP 24576:3KP2pH7efRtJ3YeEAYOnwj1+M57Ef85PNMLasvqia/:3KKe1YeEAYOW1+M5A83M+svqia/
TLSH
T1F475081177E95A29F1FB2B71AEB851604A7B7C615F31C7CF13802A5E2970AC09936B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AdobeARM.log

Path C:\Users\Admin\AppData\Local\Temp\AdobeARM.log
Size 334B
SHA256 a8963770e3bc034ccfed4d6bb66cc9aaa7e5608dced1d987a8e49c6efd2a183a
MD5 5e506d3e74bdc0d42526f80612173f12
SHA1 e5a669f3a8d11980ab9c46af99c353151b7f6a4b
SHA512 b39d85f31462ac7ad28a7baa5ad0def88db07227678fc4f71447d3694989ed1267dae3abb53c0c8ef38f2e93cdfb83198b154a6c0804a20e48cce12f9556140b
TLSH
T12DE07D45F03AD0AD4757E0CE530B2F61C5A03276D34785E2F1642301F929C15493FA18
MD5 SHA1 SHA512 TLSH

Submit Download

ArmUI.ini

Path C:\Users\Admin\AppData\Local\Temp\ArmUI.ini
Size 251KB
SHA256 b4d4dcd9594d372d7c0c975d80ef5802c88502895ed4b8a26ca62e225f2f18b0
MD5 864c22fb9a1c0670edf01c6ed3e4fbe4
SHA1 bf636f8baed998a1eb4531af9e833e6d3d8df129
SHA512 ff23616ee67d51daa2640ae638f59a8d331930a29b98c2d1bd3b236d2f651f243f9bae38d58515714886cfbb13b9be721d490aad4f2d10cbba74d7701ab34e09
SSDEEP 3072:wT4DJAvCXkQqSmSgojgTaDuK1+4xKtaU/QX5Pm9vR549QHmYPCjTMNro0Jnxu4Fn:xvUzH5
TLSH
T1B144E44363FC1209F6F37B41EEB852A44B77BDA5AA3EC15D1184015E08F5A90DA72BB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Rdr21309.txt

Path C:\Users\Admin\AppData\Local\Temp\Rdr21309.txt
Size 13B
SHA256 b633a587c652d02386c4f16f8c6f6aab7352d97f16367c3c40576214372dd628
MD5 c83301425b2ad1d496473a5ff3d9ecca
SHA1 941efb7368e46b27b937d34b07fc4d41da01b002
SHA512 83bafe4c888008afdd1b72c028c7f50dee651ca9e7d8e1b332e0bf3aa1315884155a1458a304f6e5c5627e714bf5a855a8b8d7db3f4eb2bb2789fe2f8f6a1d83
MD5 SHA1 SHA512

Submit Download

ReportUpdaterPolicy21309.txt

Path C:\Users\Admin\AppData\Local\Temp\ReportUpdaterPolicy21309.txt
Size 4B
SHA256 69bf0bc46f51b33377c4f3d92caf876714f6bbbe99e7544487327920873f9820
MD5 455831477b82574f6bf871193f2f761d
SHA1 f44217a81173869e08671753c52553646ff5d95b
SHA512 cbc0ee58e447428bdcf72fc8b03c8cfb086edbb14205b918e75ebeff1d85ff1dd254e9dcb387afbd3fa766c803937c306e0a2a79870c0d87abcb7ab93661cf85
MD5 SHA1 SHA512

Submit Download

Tmp8364.tmp

Path C:\Users\Admin\AppData\Local\Temp\Tmp8364.tmp
Size 5KB
SHA256 aaaced351a90b2029c44c6ebb68084a331f296a0ace8115d9889f549d596564b
MD5 42ff6aa7e64b25f09ffb2a89ce7f36ba
SHA1 0dbf44a94dbd6801b3afba7a6c602f39c7d44732
SHA512 47337d9919bc26dedfea1af060dd1fa2ef4a3dcf35c0a84ac7bfe0333b4885a368fc46fec5bc317fe257abdbcab9cdff67104382b60e9a1aa5f755aba604adde
SSDEEP 96:6jX74Lc8pJvjU8RunwXGkmIKBiHJdij9tAz4yT+QE4yKSeTEnXtGbE:0ULc8pq8RuwdmL4pUQrNyKQnCE
TLSH
T102C13CA388946C05AC27FC00B4C89933EDB676A61EC1D0D3625CC1A58B913873EDE5FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Tmp979A.tmp

Path C:\Users\Admin\AppData\Local\Temp\Tmp979A.tmp
Size 5KB
SHA256 27ead591d4c7f8fadd0d9e5d32eb6c9bf8830f83fddf83ddd47e6b3b413f5b75
MD5 5a68f4aec3689d0dc750adcae8e60520
SHA1 ebd8482e30140da9e44bebde6e4da997a7391e22
SHA512 311cfca7e98c8db69d2d599c5845d26a4686d03d1ab1d79237952c008269928ce8434a877e3fe411e967995536e2171844df0db14add053037de278571269a04
SSDEEP 96:zX74Lc8pJvjU8RunwXGkmIKBiHJdij9tAz4yT+QE4ycOr0BO:zULc8pq8RuwdmL4pUQrNycOrkO
TLSH
T127C12AA38DD06C05AC5BFD11B4D89A33ADB276952D81C1C3325CC2658F913973AEE2ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Tmp9875.tmp

Path C:\Users\Admin\AppData\Local\Temp\Tmp9875.tmp
Size 3KB
SHA256 dcc9d2695125406282ba990fec39403c44b12964acf51b5e0dc7f2080d714398
MD5 fc2430057cb1be74c788f10c2d4540c8
SHA1 cab67ee8d5191fbf9f25545825e06c1a822af2f2
SHA512 4e2b9709a9e3ca5173abb35816e5a0aebbf2a7aaf971d7f75f3ae66e4a812cbade103baa5016525f5ab83a60c18f8d3c278c90ff83e4afdae419f81673cb5aee
TLSH
T1FC71D8CE0D1A6813ABC7FE8AA1C5E3695C30A3E16AD154CB08BC95824FC6FC51A4901D
MD5 SHA1 SHA512 TLSH

Submit Download

TmpA2E6.tmp

Path C:\Users\Admin\AppData\Local\Temp\TmpA2E6.tmp
Size 5KB
SHA256 e6bcbcb70401d63ff0746fcbcc63230269058736f7644151393edfdcec8b8765
MD5 1b7ade3253fc67477dea69ef2147603d
SHA1 b71e8e749a3461c9b37ff2c3d099b1911d9cc6a0
SHA512 0edd5eb1635b1599e50b368cb254c94bf1588acf1d063e89f45fcfd6fa625e33d2c7764d9d00afd53dec2dfb342e9cfe199d256edcff8430ae183d357d4382da
SSDEEP 96:7NLX74Lc8pJvjU8RunwXGkmIKBiHJdij9tAz4yT+QE4yGtDwwBq:RULc8pq8RuwdmL4pUQrNyGewBq
TLSH
T16CC12AB388D06C41AD5BBD11B4C89933ADB272992DC1D0D33258C6A58B913873BDE2ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TmpCEAB.tmp

Path C:\Users\Admin\AppData\Local\Temp\TmpCEAB.tmp
Size 5KB
SHA256 a86ac1b119a6653e0c3fc24c2c40e44a7bfdc435fd81c4442af9d5526ef64e85
MD5 5bc2d1f7a5fd950dd51547ead6afdabd
SHA1 90f4e48ac87f4eb9dd10f1a80d46a7063f06a7d2
SHA512 45f18bf24c7f1102c17dd30aa205498f27336259ac3869c1d6129609a40385e68d9a2f353e3b13f18f40e7d1d32c4fb31d10f7b2fa204e24e4411183bb749f55
SSDEEP 96:7sX74Lc8pJvjU8RunwXGkmIKBiHJdij9tAz4yT+QE4yQRlOelNMQtU:gULc8pq8RuwdmL4pUQrNyYlOefM/
TLSH
T13DC12AA388D46C05AD17BC04B4C49A23FEB2B2855EC1D1D36258C1A58B913973ADE6ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Shohdi.hdi

Path C:\Windows\SysWOW64\Shohdi.hdi
Size 6.0MB
SHA256 33d1af63107324b8bba5891e1ff077933180aa78a8b16948388fb7d06812a016
MD5 96d03aa68ebad22d6873e37349476e8b
SHA1 a2ab936daa950c3bf9f0151c367f107fa538c047
SHA512 56146c999b15ac008b84f2f47554be132d17cdd13c4b4ad2aa8d1aa2d4f8743b42dfbc8cc9da1642fb2cca1d224f58519087cecb39779005ecd5b337d5cec66d
SSDEEP 98304:lbXsPN5kiQaZ58kB/qoHMdnJEsKsW1+M5NC:G5VPgJEs1yC
TLSH
T1D156D52076D5CFA5E06F1171DD69BAF5402BBD208F654FCB6A803E1A35706C2A931B2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ArmReport.ini

Path C:\Windows\Temp\ArmReport.ini
Size 472B
SHA256 9d7407b8bcd4af6820eae7da00db7598246d0f58dc502ef3c89aacbd9cc8a104
MD5 150650f8b4ce06bf6720a55c29275c38
SHA1 c69a908cd7138d119f38c8db07031364b1d21388
SHA512 fcfb7f30078c6e1c43cf272b96b5fbd599fb6ea694cbb79a7a3e40de0eea9e031a4b67d1c2f348d3ab19760b48b67758fd7b4ddd921aab9f3e8d3a064c662bd4
TLSH
T198F0651725F54655E0F75F11DBF990B35B367C456D18846CA0C8031F0CD1A51D872BB3
MD5 SHA1 SHA512 TLSH

Submit Download

ArmReport.ini

Path C:\Windows\Temp\ArmReport.ini
Size 594B
SHA256 6b1bed1fa21d7c0e263368370908c45833a12819d8133a2ad14c8b74972c675a
MD5 afdf801b64774edf0b99fa758ba72710
SHA1 9304d0500976f30d9ae79d12218d93a38649432c
SHA512 b21fd54ef4d93264adb31db0076d44bbcaa631f2f87f8494bc9c09ca3ff753a5b7e0a603227855af80be9b21ea6c4e548fcf05fe370f3fcee62f8256acfd0d34
TLSH
T141F0175626F54654E0F75F15EAF990B31B367C426E1994AC90C8031A08E1A61E972BB3
MD5 SHA1 SHA512 TLSH

Submit Download

ArmReport.ini

Path C:\Windows\Temp\ArmReport.ini
Size 724B
SHA256 75c515a974331642bba2005b0d0764cde29ffd6ac526a700e27b9de049c0c6bc
MD5 9d62d227564196c844e892bf220a1298
SHA1 444b2371426b3ef7bc372aa40cc96b2428f29e8d
SHA512 b421783afc5d58727b8949f3a8db3e361047d99e9248ebdecd13bf60e0e0606dba6d6f6e293d2cc165b2bf0e793ec1076fd204a0d6b73699fdcb0f2bbf9a3e1c
TLSH
T16A01AD961AE91631F0F34F45DFFA90721E327C131E18C9AC50C8820E49E1EA0E872B7B
MD5 SHA1 SHA512 TLSH

Submit Download

ArmUI.ini

Path C:\Windows\Temp\ArmUI.ini
Size 234KB
SHA256 790b06745f32e0f56a7af24c871ffce225ba05ebf0d8f8a71a00c727c97dcf09
MD5 cd12a965da4fb66e7f8a07e3f421196c
SHA1 f6377f231362acbd1063aff829ced283a2660b89
SHA512 3fa242c3f573c706e0f36b477ce03f47d9ba0712ef72b94eae4f426dfe21ebbaf1dbebb0981335970b5186d416b4d25e175773796486f39e17de1df0a68a9b0d
SSDEEP 3072:03IJ8zcVOWmxltum8PMkufNWwhEIrKNCpNugYWKOlCIr0YxbFKRWSp4Vf37FbAjO:BxJvW
TLSH
T124342A5667FD1209F6F37F41EEB852944B7B7DA2BE3AC14D1680014E08B5A90DA72B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RdrServicesUpdater2_x86.exe

Path \??\c:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-AC0A92D435E5}\RdrServicesUpdater2_x86.exe
Size 846KB
SHA256 6a142c879a0676aef5c825d6fd6336800846167fab422d0f912096d286aa0070
MD5 a447c3cf3b7547e5a1e12dbb92d8c052
SHA1 d2b246eda6302534b21b2003719d9f911d0c77d3
SHA512 ce7446e337cc13a560a12b0b789813bfb5a96a6a9d25a8b3e2fc1ed884f0c4950f01937714614666befb9b92123d359b9597116e9ed9e8efd46b77a640d002ea
SSDEEP 24576:uSU4vrTQA/gK/c8DV5Wa1ZmPEKBLeiGA5nEJ:uP4j5gKU83W3FLeilVEJ
TLSH
T10C059E22EAD18073D563143102A66F368EBEB9310971D98FA3D41A4E5E705E1BB3F397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1432-957-0x00000000017B0000-0x00000000017B7000-memory.dmp

Download

memory/1432-955-0x0000000001790000-0x000000000179A000-memory.dmp

Download

memory/1432-954-0x0000000001660000-0x000000000171F000-memory.dmp

Download

memory/1432-956-0x0000000003830000-0x000000000388E000-memory.dmp

Download

memory/2304-751-0x0000000003500000-0x000000000355E000-memory.dmp

Download

memory/2304-750-0x0000000000EF0000-0x0000000000FAF000-memory.dmp

Download

memory/2304-752-0x00000000036A0000-0x00000000036A7000-memory.dmp

Download

memory/2304-753-0x00000000037B0000-0x00000000037D9000-memory.dmp

Download

memory/2304-518-0x00000000036A0000-0x00000000036A7000-memory.dmp

Download

memory/2304-517-0x0000000003500000-0x000000000355E000-memory.dmp

Download

memory/2304-516-0x0000000000EF0000-0x0000000000FAF000-memory.dmp

Download

memory/2304-519-0x00000000037B0000-0x00000000037D9000-memory.dmp

Download

memory/2304-233-0x0000000000EF0000-0x0000000000FAF000-memory.dmp

Download

memory/3836-765-0x0000000003340000-0x000000000339E000-memory.dmp

Download

memory/3836-766-0x00000000014D0000-0x00000000014D7000-memory.dmp

Download

memory/3836-764-0x0000000001310000-0x00000000013CF000-memory.dmp

Download