shodi | 1c04f564ef75bb1cc8b2c3bd1bd9bc43e777de571ca5108f81575c56ec413fa9

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
24/04/2026, 14:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-24_c6b189b3e0461228b0d10c28a4251cac_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_hijack.exe
Size 3.8MB
Sample260424-rb2vcsc12m
SHA256 1c04f564ef75bb1cc8b2c3bd1bd9bc43e777de571ca5108f81575c56ec413fa9
MD5 c6b189b3e0461228b0d10c28a4251cac
SHA1 292f981ff4e5bf586ca200953b1cda40b3efc5db
SHA512 ed8cc90b890770f791c1a36abc00daad88fc1d34e6f70240a0944289895c6f54184ad4dcf21ea3490bf7a1e1e81d41b158c8c8b625b6fd98498d723411e84cc7
SSDEEP 49152:xxgGhqFTT2+Cq99LyHHI+t6O8N+ailEy6dmpzeioK2enVzRFx9+CVD2SouuFOnYZ:EP30oAaldmdTx9vuFOnYHEXO
TLSH
T116067C13B6E901A8F0BBD2349B795135DA777C511F30A6DF03805A5A2E36FD05B3AB22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery shodi spyware stealer trojan worm

Malware Config

Signatures

Family: Shodi
Shodi is a Windows worm written in C++.
worm shodi

Detects Shodi worm 1 IoCs

resource	yara_rule
behavioral2/files/0x000f0000000004aa-91.dat	family_shodi

Executes dropped EXE 2 IoCs

pid	Process
1368	2026-04-24_c6b189b3e0461228b0d10c28a4251cac_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_hijack.usa
2144	AdobeARMHelper.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\UsaShohdi.asu	2026-04-24_c6b189b3e0461228b0d10c28a4251cac_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_hijack.exe
File opened for modification	C:\Windows\SysWOW64\UsaShohdi.asu	2026-04-24_c6b189b3e0461228b0d10c28a4251cac_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_hijack.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	\??\c:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe	2026-04-24_c6b189b3e0461228b0d10c28a4251cac_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_hijack.exe
File created	\??\c:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateCore.exe	2026-04-24_c6b189b3e0461228b0d10c28a4251cac_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_hijack.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\identity_helper.usa	2026-04-24_c6b189b3e0461228b0d10c28a4251cac_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_hijack.exe
File created	\??\c:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\notification_helper.exe	2026-04-24_c6b189b3e0461228b0d10c28a4251cac_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_hijack.exe
File opened for modification	\??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.usa	2026-04-24_c6b189b3e0461228b0d10c28a4251cac_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_hijack.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Client\AppVLP.usa	2026-04-24_c6b189b3e0461228b0d10c28a4251cac_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_hijack.exe
File opened for modification	\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.usa	2026-04-24_c6b189b3e0461228b0d10c28a4251cac_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_hijack.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.usa	2026-04-24_c6b189b3e0461228b0d10c28a4251cac_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_hijack.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.usa	2026-04-24_c6b189b3e0461228b0d10c28a4251cac_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_hijack.exe
File created	\??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE	2026-04-24_c6b189b3e0461228b0d10c28a4251cac_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_hijack.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\cookie_exporter.usa	2026-04-24_c6b189b3e0461228b0d10c28a4251cac_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_hijack.exe
File opened for modification	\??\c:\Program Files\Google\Chrome\Application\chrome_proxy.usa	2026-04-24_c6b189b3e0461228b0d10c28a4251cac_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_hijack.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Office16\MSOHTMED.usa	2026-04-24_c6b189b3e0461228b0d10c28a4251cac_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_hijack.exe
File created	\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	2026-04-24_c6b189b3e0461228b0d10c28a4251cac_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_hijack.exe
File created	\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	2026-04-24_c6b189b3e0461228b0d10c28a4251cac_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_hijack.exe
File opened for modification	\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.usa	2026-04-24_c6b189b3e0461228b0d10c28a4251cac_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_hijack.exe
File opened for modification	\??\c:\Program Files\Java\jdk-1.8\jre\bin\javaws.usa	2026-04-24_c6b189b3e0461228b0d10c28a4251cac_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_hijack.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Office16\MSOUC.usa	2026-04-24_c6b189b3e0461228b0d10c28a4251cac_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_hijack.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.usa	2026-04-24_c6b189b3e0461228b0d10c28a4251cac_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_hijack.exe
File created	\??\c:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe	2026-04-24_c6b189b3e0461228b0d10c28a4251cac_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_hijack.exe
File opened for modification	\??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.usa	2026-04-24_c6b189b3e0461228b0d10c28a4251cac_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_hijack.exe
File opened for modification	\??\c:\Program Files\Java\jdk-1.8\bin\javaws.usa	2026-04-24_c6b189b3e0461228b0d10c28a4251cac_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_hijack.exe
File created	\??\c:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe	2026-04-24_c6b189b3e0461228b0d10c28a4251cac_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_hijack.exe
File created	\??\c:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe	2026-04-24_c6b189b3e0461228b0d10c28a4251cac_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_hijack.exe
File created	\??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE	2026-04-24_c6b189b3e0461228b0d10c28a4251cac_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_hijack.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.usa	2026-04-24_c6b189b3e0461228b0d10c28a4251cac_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_hijack.exe
File opened for modification	\??\c:\Program Files\VideoLAN\VLC\vlc.usa	2026-04-24_c6b189b3e0461228b0d10c28a4251cac_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_hijack.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\Backup	AdobeARM.exe
File opened for modification	\??\c:\Program Files\Java\jdk-1.8\jre\bin\javaw.usa	2026-04-24_c6b189b3e0461228b0d10c28a4251cac_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_hijack.exe
File created	\??\c:\Program Files\Microsoft Office\root\Office16\msoasb.exe	2026-04-24_c6b189b3e0461228b0d10c28a4251cac_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_hijack.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Office16\protocolhandler.usa	2026-04-24_c6b189b3e0461228b0d10c28a4251cac_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_hijack.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Office16\WINWORD.usa	2026-04-24_c6b189b3e0461228b0d10c28a4251cac_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_hijack.exe
File created	\??\c:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe	2026-04-24_c6b189b3e0461228b0d10c28a4251cac_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_hijack.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.usa	2026-04-24_c6b189b3e0461228b0d10c28a4251cac_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_hijack.exe
File opened for modification	\??\c:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.usa	2026-04-24_c6b189b3e0461228b0d10c28a4251cac_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_hijack.exe
File created	\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	2026-04-24_c6b189b3e0461228b0d10c28a4251cac_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_hijack.exe
File created	\??\c:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE	2026-04-24_c6b189b3e0461228b0d10c28a4251cac_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_hijack.exe
File created	\??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE	2026-04-24_c6b189b3e0461228b0d10c28a4251cac_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_hijack.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\plugin-container.usa	2026-04-24_c6b189b3e0461228b0d10c28a4251cac_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_hijack.exe
File opened for modification	\??\c:\Program Files\VideoLAN\VLC\uninstall.usa	2026-04-24_c6b189b3e0461228b0d10c28a4251cac_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_hijack.exe
File created	\??\c:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2026-04-24_c6b189b3e0461228b0d10c28a4251cac_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_hijack.exe
File created	\??\c:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe	2026-04-24_c6b189b3e0461228b0d10c28a4251cac_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_hijack.exe
File created	\??\c:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe	2026-04-24_c6b189b3e0461228b0d10c28a4251cac_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_hijack.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.usa	2026-04-24_c6b189b3e0461228b0d10c28a4251cac_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_hijack.exe
File created	\??\c:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-04-24_c6b189b3e0461228b0d10c28a4251cac_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_hijack.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Office16\msoasb.usa	2026-04-24_c6b189b3e0461228b0d10c28a4251cac_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_hijack.exe
File created	\??\c:\Program Files\Microsoft Office\root\Office16\Wordconv.exe	2026-04-24_c6b189b3e0461228b0d10c28a4251cac_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_hijack.exe
File created	\??\c:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE	2026-04-24_c6b189b3e0461228b0d10c28a4251cac_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_hijack.exe
File created	\??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe	2026-04-24_c6b189b3e0461228b0d10c28a4251cac_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_hijack.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.usa	2026-04-24_c6b189b3e0461228b0d10c28a4251cac_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_hijack.exe
File created	\??\c:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\pwahelper.exe	2026-04-24_c6b189b3e0461228b0d10c28a4251cac_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_hijack.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.usa	2026-04-24_c6b189b3e0461228b0d10c28a4251cac_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_hijack.exe
File opened for modification	\??\c:\Program Files\Java\jre-1.8\bin\javaws.usa	2026-04-24_c6b189b3e0461228b0d10c28a4251cac_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_hijack.exe
File created	\??\c:\Program Files\Mozilla Firefox\maintenanceservice.exe	2026-04-24_c6b189b3e0461228b0d10c28a4251cac_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_hijack.exe
File opened for modification	\??\c:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.usa	2026-04-24_c6b189b3e0461228b0d10c28a4251cac_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_hijack.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.usa	2026-04-24_c6b189b3e0461228b0d10c28a4251cac_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_hijack.exe
File created	\??\c:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe	2026-04-24_c6b189b3e0461228b0d10c28a4251cac_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_hijack.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.usa	2026-04-24_c6b189b3e0461228b0d10c28a4251cac_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_hijack.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.usa	2026-04-24_c6b189b3e0461228b0d10c28a4251cac_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_hijack.exe
File created	\??\c:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe	2026-04-24_c6b189b3e0461228b0d10c28a4251cac_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_hijack.exe
File created	\??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE	2026-04-24_c6b189b3e0461228b0d10c28a4251cac_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_hijack.exe
File opened for modification	\??\c:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.usa	2026-04-24_c6b189b3e0461228b0d10c28a4251cac_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_hijack.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.usa	2026-04-24_c6b189b3e0461228b0d10c28a4251cac_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_hijack.exe
File created	\??\c:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe	2026-04-24_c6b189b3e0461228b0d10c28a4251cac_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_hijack.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-24_c6b189b3e0461228b0d10c28a4251cac_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_hijack.usa
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AdobeARMHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AdobeARM.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-24_c6b189b3e0461228b0d10c28a4251cac_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_hijack.exe

Modifies system certificate store 2 TTPs 3 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25	2026-04-24_c6b189b3e0461228b0d10c28a4251cac_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_hijack.usa
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 040000000100000010000000d474de575c39b2d39c8583c5c065498a0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000007431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25190000000100000010000000ba4f3972e7aed9dccdc210db59da13c92000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	2026-04-24_c6b189b3e0461228b0d10c28a4251cac_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_hijack.usa
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 5c000000010000000400000000080000190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc36200000001000000200000007431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8040000000100000010000000d474de575c39b2d39c8583c5c065498a2000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	2026-04-24_c6b189b3e0461228b0d10c28a4251cac_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_hijack.usa

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2144	AdobeARMHelper.exe
2144	AdobeARMHelper.exe
2144	AdobeARMHelper.exe
2144	AdobeARMHelper.exe
2144	AdobeARMHelper.exe
2144	AdobeARMHelper.exe
2144	AdobeARMHelper.exe
2144	AdobeARMHelper.exe
2144	AdobeARMHelper.exe
2144	AdobeARMHelper.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1368	2026-04-24_c6b189b3e0461228b0d10c28a4251cac_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_hijack.usa
1068	AdobeARM.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1916 wrote to memory of 1368	1916	2026-04-24_c6b189b3e0461228b0d10c28a4251cac_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_hijack.exe	79
PID 1368 wrote to memory of 3292	1368	2026-04-24_c6b189b3e0461228b0d10c28a4251cac_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_hijack.usa	82
PID 1368 wrote to memory of 2144	1368	2026-04-24_c6b189b3e0461228b0d10c28a4251cac_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_hijack.usa	83
PID 2144 wrote to memory of 1068	2144	AdobeARMHelper.exe	84

C:\Users\Admin\AppData\Local\Temp\2026-04-24_c6b189b3e0461228b0d10c28a4251cac_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_hijack.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-24_c6b189b3e0461228b0d10c28a4251cac_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_hijack.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1916
- C:\Users\Admin\AppData\Local\Temp\2026-04-24_c6b189b3e0461228b0d10c28a4251cac_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_hijack.usa
  C:\Users\Admin\AppData\Local\Temp\2026-04-24_c6b189b3e0461228b0d10c28a4251cac_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_hijack.usa
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies system certificate store
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1368
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe"
    3⤵
    PID:3292
- - C:\ProgramData\Adobe\ARM\S\22872\AdobeARMHelper.exe
    "C:\ProgramData\Adobe\ARM\S\22872\AdobeARMHelper.exe" /ArmUpdate /MSI FOLDER:"C:\ProgramData\Adobe\ARM\S\22872" /MODE:3 /UpdateSelection:1 /PRODUCT:{291AA914-A987-4CE9-BD63-AC0A92D435E5} /VERSION:19.0 /LANG:ENU
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2144
  - - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
      "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" /ArmUpdate /MSI FOLDER:"C:\ProgramData\Adobe\ARM\S\22872" /MODE:3 /UpdateSelection:1 /PRODUCT:{291AA914-A987-4CE9-BD63-AC0A92D435E5} /VERSION:19.0 /LANG:ENU
      4⤵
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1068

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ArmReport.ini

Path C:\ProgramData\Adobe\ARM\ArmReport.ini
Size 82B
SHA256 5a1e0a0216dd3893a738efdfc9c1bc5445e68d3939840578341f6cd08b14d815
MD5 9de1c12da78157648e8e5b25adab3467
SHA1 e9a8e45cbc66f9323f530a7bc88249e92e99fa52
SHA512 cbc027271d3977d2c248dbcd683da728880d5c26d2bae6df6299b4eeed551f34b2e687865b578a688f98a3865b63450ac0bf7cc07d031dad0f8dbe72e9e531b9
TLSH
T1FEA0222333C0803CB8203A02CCE088333322B0C8B00BC00CC002228E00F022002223BF
MD5 SHA1 SHA512 TLSH

Submit Download

AdobeARM.msi

Path C:\ProgramData\Adobe\ARM\S\22872\AdobeARM.msi
Size 1.0MB
SHA256 f3f339de3a391d7f8baf37009ec52a6948d769977e2f407faf46f7064a524638
MD5 9474db895113963c06cf1050a3d5c91d
SHA1 5c599ee58ffb1fac122823e30814702fa38eec2d
SHA512 cb4fc2145582e459af1d8eb0ef3f33a629929eb7e0730a7af15d98b4c5577a5a5b3853c5695bc9e356be96c35a91cec69f57a81322c839a2cd6d73b9958d35af
SSDEEP 24576:5tsYy4SyBEqipH6t3uhK76TwlO/TTj11:5tsYy/yUpaiqhETTz
TLSH
T12935F107B3804236C59A0235544F87724B79FC348B21426B37D9B75D3EB27E0AABB5E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AdobeARMHelper.exe

Path C:\ProgramData\Adobe\ARM\S\22872\AdobeARMHelper.exe
Size 413KB
SHA256 fd115ae8ebd2f37cf1ef72f75242206cf1331c7cb258305011302e981137ee5e
MD5 522026a14d6bc781d2a15c665e454310
SHA1 9451a39108326ba578793b1feb62f23a02bce916
SHA512 4e4eb2f582c8590899a0ada6133b705d13775f60818f1ff4f9bb35e40e09d6570af4f7ac4c80b525b445a03702ca0f3a9867a93080f90697d8be668e2abe2fe7
SSDEEP 6144:q/6JSQsSVWSLjX2PxPNMRyfn7LzPdKblt0K+HAfh0v8axsbQuXYvr6yIl2:u6dVWnxlMSn7nFKbltn+Ch/m6X2
TLSH
T1DE947C1037D0C036F1B329768ABFD728556DB9715F6881CFA3C8166E5EB06E0AA3171B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RdrManifest2.msi

Path C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-AC0A92D435E5}\RdrManifest2.msi
Size 18KB
SHA256 0abcb8b7c0bda3128316b3e4f4a5857e9c8194105043a0c0e9801a1a96105d01
MD5 f5d4c05bc8ea0d4fc4d277abda7369d9
SHA1 f67e793b159bd1e75ed4dec0de352ea1b6583708
SHA512 359a966c4dc8d62a570b428dfb3e666a63efd6bfff7c5b5ace3bc97ea09ba701d9fa524f439bf9902746c2ecac9c1f76c90868b0152eb825b2a09a9474fdbb34
SSDEEP 384:MrUq75oUFtb0F+o5nfy9jdIYigYws0i9Db9Ey8RbmL4A8UiINyGNB:MrUq75oUFtb0F+o5nfy9uYigY9K5ALdH
TLSH
T19D820BA2B4408C11CD868F3EA4C1D726D672BC813D8591C27565F219CFB23869A9F7EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
Size 471B
SHA256 76acd8c407c0e7d3d58c03fe924ce35f15fb57453c900fe0c1e54c4a87db640e
MD5 6690cdba01d380c7b858de7be5e95194
SHA1 6ec0f002dcf73bd75c35287038ac5cc3abc70ddd
SHA512 f3c9a2194f85dc58eb104f3e111cc5c44b8e33b394eb30364692ef41450c7ba027402bd5e9e07dd2448d3c63a59ae9c16680d18be64166decd0d55b392f52e82
TLSH
T10BF05C2F4AE335A234039CBC2BE08CBF3C581A8A882A2531863418A984CA290210B809
MD5 SHA1 SHA512 TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_54359052731E413C60F1C59EABAD4E05

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_54359052731E413C60F1C59EABAD4E05
Size 727B
SHA256 a70e374ca6c08454fc99aeb6529d7d60b41568655f4178681f2453063c207476
MD5 e9cf44ca6d9a06a59ef9c24c1c1eca5c
SHA1 8be8f9418066bdd5ead6be0ccf0236adcac6a50d
SHA512 1611ef52bf841a3c115294b971aed13af20c40c3fb4c74bb5c74cf4b7cc48020b6a1bc1922d9dcb3a797bef16476908de5919d3ece4a62b447c8848af4901043
TLSH
T12E01446223A43349953AC9CC6FED4AE6724F47910DE6585E092DD184F10C760B91DE56
MD5 SHA1 SHA512 TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_5809FDAACC125718B26BC11DC8E8116A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_5809FDAACC125718B26BC11DC8E8116A
Size 727B
SHA256 a47e58302ecce2411bcc08c595b15297a2b2cfd70e4dd077026ab0636901c4ac
MD5 b7a4f3ff9aba36fc167d65702c226f51
SHA1 20c8f7d3250a7ea38678a58cda2e1fddec71f490
SHA512 22a2ad60dbc6b3d821293779815893e829bd96cbcbea6275d6ca9fc11940093478c7897c94e3c0c94cf804a058df5be5ac147ad5dd5e994c756b2f0a4081006c
TLSH
T103014404316EA7506C129CD04BBFB79430BB41D1785F349BA37291A8A36CB16B9D71B5
MD5 SHA1 SHA512 TLSH

Submit Download

C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Size 727B
SHA256 ee09d28a61cf6899ae48a0d7d18c0bc476ad048deb6912ebeb17394488be1025
MD5 a7c4adf9c1253497d873b11fa681311b
SHA1 be4b62cedb3c04b66b8ad0e759fe1f7a61674753
SHA512 3781523f972dcdcb1141149da989f3c537f0d122c0b18a6d0847c1d79702c3943b81b0b02dafaf5b1ed9df5b9f0549e709ad5dcf41de77cf3d8562c0605a0310
TLSH
T111012C1B742AAA407801DE409BEC1B717A3A2AD509B6977410FC228F098DBB4E84A684
MD5 SHA1 SHA512 TLSH

Submit Download

698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
Size 400B
SHA256 9538c82ebeb90a0cb430a3c2edf9c2605f410bbfee5437a61179e1e7ed0e0334
MD5 44f10c5852c523eb31a0f69f6ebeae73
SHA1 f33e39ce79763d5fd2363aec57d7ed79bdf11ee5
SHA512 186447d003a041cad4f50a8012c0b6c9753baff3fad8498488ccec5072ef6c36d8cd29e66dc8bc3f36bbc0e4a05b31f925639c254ef7764eab9a904f07d2e650
TLSH
T1B0E0203017FA121EF1609B7403D6D1999F25F1126C6556BE5881541D6D06E105CA3C34
MD5 SHA1 SHA512 TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_54359052731E413C60F1C59EABAD4E05

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_54359052731E413C60F1C59EABAD4E05
Size 404B
SHA256 2912982b79e134e5ecd22a1f24f713498effd0cc5d4a7f7c75c09ddc0549d599
MD5 3deb97eb3dc66d70ef1b6a4f52ba0a97
SHA1 860d9d47b54a82c136a41e18365596e0bce48241
SHA512 727e8a3ec6368e00ad662eb41fcd732c207ce91beb18436ac425aab5e3625e63c52fa57835d166f35b843c6521db3d57fd77d69635048de511d38340937fd70b
TLSH
T1FCE0203435F5455FF5E5D53447E9AD2759D5F1530561D7A91040174DBA22F800C91A24
MD5 SHA1 SHA512 TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_5809FDAACC125718B26BC11DC8E8116A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_5809FDAACC125718B26BC11DC8E8116A
Size 404B
SHA256 95de711363ba34046d81b6472aa6bc2c39a93218e755f9a2ddc762837de726b7
MD5 641781bb53881a927d02490ccdef52c9
SHA1 3b0aa4821f0a4feae2c5f2a9f0f876e19eb1e85b
SHA512 f5e14454ba81e2fadb3d9a80d0cdf85deea9316b8ba304df94ebd9d12c7101d28b6cc549f9cf5a7c1a7da3295da4fc8828d77e0b4ef3a1eafe485585a4640ec1
TLSH
T103E0263432F9495EF0B0F83847F6AD16599AF2166D67D3BD0080676AAA12B004DDA524
MD5 SHA1 SHA512 TLSH

Submit Download

C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Size 412B
SHA256 bc73278ab7d1a06a1ac633bd24801d35543276f45feeb002a7cc3a1689612259
MD5 0df6d3f4b757679546b1185a88822527
SHA1 bcecbee62c37be2a5a700100dcf48da073ff95e8
SHA512 9fba55a727e895ab27a8f70d7e7874c80d18aa4abe4b9664f33f66822cb64f0a7591645f03e26897784f26e4f2966d58bb209a81b6287a1114ddcce32bc7f1f4
TLSH
T15EE06F2822ABA1AEF09089388AEAE07A1E48E311102483BA10C14718BB16F40AC10AB0
MD5 SHA1 SHA512 TLSH

Submit Download

2026-04-24_c6b189b3e0461228b0d10c28a4251cac_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_hijack.usa

Path C:\Users\Admin\AppData\Local\Temp\2026-04-24_c6b189b3e0461228b0d10c28a4251cac_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_hijack.usa
Size 1.5MB
SHA256 27c962221dbb07220215e3c65f0ce0e42430e456db84e99ecf0eee449c4167f7
MD5 bf606aedf0fce1aed6537542c62c9cbd
SHA1 7cf79e0468a679b90f3d9817028d5e1efc5e06aa
SHA512 aa978f28897452ce1ecc9c3ea1cdf30d42b054d8fa07098df6cfac56843309609ceb397e26224371e1b0e947c9802be5d8dc5f7afef169caab16fce6a6a2d132
SSDEEP 24576:uFxhhv9+avbHVD2SouDaFOnY548usEj1J4JMzHRX4q:uFx9+CVD2SouuFOnYIsE5JIMzHRX4q
TLSH
T1867519117BE95A29F1FB2B31AE7852644A7B7C615F31C7CF13801A5E2934AC09936B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AdobeARM.log

Path C:\Users\Admin\AppData\Local\Temp\AdobeARM.log
Size 334B
SHA256 b47c1a56d4e7509d165cc05e237995f5afec0404c50096e1f4856d91eed5138c
MD5 ca6ee56d423719778eaac2e315c5b784
SHA1 dfec3988e8c8166294e14c1c47e48b324971171e
SHA512 1a9ae3a99356780bc5c4f8cfc68c70136da96930036f9011db17497174cfb6fbf7dcc706061f72d22bc6930ba31000864a833c8439834abbbb0635b11d5fe040
TLSH
T145E02D88203BC0BC1B2B00CF478A3FD19802B047D3AF41E2A2183700F836C014E1F718
MD5 SHA1 SHA512 TLSH

Submit Download

ArmUI.ini

Path C:\Users\Admin\AppData\Local\Temp\ArmUI.ini
Size 251KB
SHA256 b4d4dcd9594d372d7c0c975d80ef5802c88502895ed4b8a26ca62e225f2f18b0
MD5 864c22fb9a1c0670edf01c6ed3e4fbe4
SHA1 bf636f8baed998a1eb4531af9e833e6d3d8df129
SHA512 ff23616ee67d51daa2640ae638f59a8d331930a29b98c2d1bd3b236d2f651f243f9bae38d58515714886cfbb13b9be721d490aad4f2d10cbba74d7701ab34e09
SSDEEP 3072:wT4DJAvCXkQqSmSgojgTaDuK1+4xKtaU/QX5Pm9vR549QHmYPCjTMNro0Jnxu4Fn:xvUzH5
TLSH
T1B144E44363FC1209F6F37B41EEB852A44B77BDA5AA3EC15D1184015E08F5A90DA72BB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Tmp91EA.tmp

Path C:\Users\Admin\AppData\Local\Temp\Tmp91EA.tmp
Size 5KB
SHA256 aaaced351a90b2029c44c6ebb68084a331f296a0ace8115d9889f549d596564b
MD5 42ff6aa7e64b25f09ffb2a89ce7f36ba
SHA1 0dbf44a94dbd6801b3afba7a6c602f39c7d44732
SHA512 47337d9919bc26dedfea1af060dd1fa2ef4a3dcf35c0a84ac7bfe0333b4885a368fc46fec5bc317fe257abdbcab9cdff67104382b60e9a1aa5f755aba604adde
SSDEEP 96:6jX74Lc8pJvjU8RunwXGkmIKBiHJdij9tAz4yT+QE4yKSeTEnXtGbE:0ULc8pq8RuwdmL4pUQrNyKQnCE
TLSH
T102C13CA388946C05AC27FC00B4C89933EDB676A61EC1D0D3625CC1A58B913873EDE5FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TmpAE2F.tmp

Path C:\Users\Admin\AppData\Local\Temp\TmpAE2F.tmp
Size 5KB
SHA256 27ead591d4c7f8fadd0d9e5d32eb6c9bf8830f83fddf83ddd47e6b3b413f5b75
MD5 5a68f4aec3689d0dc750adcae8e60520
SHA1 ebd8482e30140da9e44bebde6e4da997a7391e22
SHA512 311cfca7e98c8db69d2d599c5845d26a4686d03d1ab1d79237952c008269928ce8434a877e3fe411e967995536e2171844df0db14add053037de278571269a04
SSDEEP 96:zX74Lc8pJvjU8RunwXGkmIKBiHJdij9tAz4yT+QE4ycOr0BO:zULc8pq8RuwdmL4pUQrNycOrkO
TLSH
T127C12AA38DD06C05AC5BFD11B4D89A33ADB276952D81C1C3325CC2658F913973AEE2ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TmpAF0B.tmp

Path C:\Users\Admin\AppData\Local\Temp\TmpAF0B.tmp
Size 3KB
SHA256 dcc9d2695125406282ba990fec39403c44b12964acf51b5e0dc7f2080d714398
MD5 fc2430057cb1be74c788f10c2d4540c8
SHA1 cab67ee8d5191fbf9f25545825e06c1a822af2f2
SHA512 4e2b9709a9e3ca5173abb35816e5a0aebbf2a7aaf971d7f75f3ae66e4a812cbade103baa5016525f5ab83a60c18f8d3c278c90ff83e4afdae419f81673cb5aee
TLSH
T1FC71D8CE0D1A6813ABC7FE8AA1C5E3695C30A3E16AD154CB08BC95824FC6FC51A4901D
MD5 SHA1 SHA512 TLSH

Submit Download

TmpB5B3.tmp

Path C:\Users\Admin\AppData\Local\Temp\TmpB5B3.tmp
Size 5KB
SHA256 e6bcbcb70401d63ff0746fcbcc63230269058736f7644151393edfdcec8b8765
MD5 1b7ade3253fc67477dea69ef2147603d
SHA1 b71e8e749a3461c9b37ff2c3d099b1911d9cc6a0
SHA512 0edd5eb1635b1599e50b368cb254c94bf1588acf1d063e89f45fcfd6fa625e33d2c7764d9d00afd53dec2dfb342e9cfe199d256edcff8430ae183d357d4382da
SSDEEP 96:7NLX74Lc8pJvjU8RunwXGkmIKBiHJdij9tAz4yT+QE4yGtDwwBq:RULc8pq8RuwdmL4pUQrNyGewBq
TLSH
T16CC12AB388D06C41AD5BBD11B4C89933ADB272992DC1D0D33258C6A58B913873BDE2ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TmpE197.tmp

Path C:\Users\Admin\AppData\Local\Temp\TmpE197.tmp
Size 5KB
SHA256 a86ac1b119a6653e0c3fc24c2c40e44a7bfdc435fd81c4442af9d5526ef64e85
MD5 5bc2d1f7a5fd950dd51547ead6afdabd
SHA1 90f4e48ac87f4eb9dd10f1a80d46a7063f06a7d2
SHA512 45f18bf24c7f1102c17dd30aa205498f27336259ac3869c1d6129609a40385e68d9a2f353e3b13f18f40e7d1d32c4fb31d10f7b2fa204e24e4411183bb749f55
SSDEEP 96:7sX74Lc8pJvjU8RunwXGkmIKBiHJdij9tAz4yT+QE4yQRlOelNMQtU:gULc8pq8RuwdmL4pUQrNyYlOefM/
TLSH
T13DC12AA388D46C05AD17BC04B4C49A23FEB2B2855EC1D1D36258C1A58B913973ADE6ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UsaShohdi.asu

Path C:\Windows\SysWOW64\UsaShohdi.asu
Size 3.8MB
SHA256 1c04f564ef75bb1cc8b2c3bd1bd9bc43e777de571ca5108f81575c56ec413fa9
MD5 c6b189b3e0461228b0d10c28a4251cac
SHA1 292f981ff4e5bf586ca200953b1cda40b3efc5db
SHA512 ed8cc90b890770f791c1a36abc00daad88fc1d34e6f70240a0944289895c6f54184ad4dcf21ea3490bf7a1e1e81d41b158c8c8b625b6fd98498d723411e84cc7
SSDEEP 49152:xxgGhqFTT2+Cq99LyHHI+t6O8N+ailEy6dmpzeioK2enVzRFx9+CVD2SouuFOnYZ:EP30oAaldmdTx9vuFOnYHEXO
TLSH
T116067C13B6E901A8F0BBD2349B795135DA777C511F30A6DF03805A5A2E36FD05B3AB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ArmReport.ini

Path C:\Windows\Temp\ArmReport.ini
Size 916B
SHA256 3909779f313abf11024a66ff1867f2c07d980b11a33455467bbc728649ee9c56
MD5 3887846a79de09880cb1bd7680c46966
SHA1 4fface817b09f6c845399c5145b7508520c64a54
SHA512 423881aa178ff39b57473d3e17b0798d8049d87651d04d4eb77e42ebfc1dac065fa2d5f6b2d63ae3f84b6c020287198be8cca564ff1fe871f72bc66c858dbdc8
TLSH
T1C411A94B22E54204F0B31F62EBFD80B357333C919D1981BC80D8031A4AE1A46E8B3BB3
MD5 SHA1 SHA512 TLSH

Submit Download

ArmReport.ini

Path C:\Windows\Temp\ArmReport.ini
Size 1KB
SHA256 baae7afdb21454e82bc5944e46d61e5554982015b30752b63950c60bbded18c2
MD5 a29ecbb1d50558d64f5aa2ea9071e50d
SHA1 6059e491bbdf12e5ca7e13e17f9128fbff66de94
SHA512 05a4957b8524efb307a966d146bf7236ef3138d7e607bb05a38a4337b37873fa403ee61a6cca1c21d116212c2016b22c2e9db15d065b0694bde4c042cb3b5f22
TLSH
T10D216D832AE91520F4B35F95DBFD94B25B337CE21D2DC86D80E4120E4AE0A85E5727B7
MD5 SHA1 SHA512 TLSH

Submit Download

ArmReport.ini

Path C:\Windows\Temp\ArmReport.ini
Size 1KB
SHA256 10457b4818df001caa6d54d57c9daa823a88c52b8c15d76865eef88d4108fa29
MD5 c60b4846fe2385b7b993a1505feb36da
SHA1 430f59160e204829500ebb5e62e2191df601c1c9
SHA512 c4ca60ab56a5641f493388d898acf8325f4ecc71f88107ad9b787302bb534b9021612f2392305a1ae9652dfa22948aca465f744b1af51193f0c6a65b9cf14014
TLSH
T125219A872AE91120F4B35F95DBBD94B25B333CE21D19C46C80E4120E4EE1B95E5B27B7
MD5 SHA1 SHA512 TLSH

Submit Download

ArmReport.ini

Path C:\Windows\Temp\ArmReport.ini
Size 762B
SHA256 92940e784a2e02f123f28bb516f8652be7ebe89e7c2fe273cdcdcc8ece287862
MD5 813d89cdede4618214924dee603b0166
SHA1 d9ae3e2676cf3f80f676ea18682dec0b5dbf9a41
SHA512 c9cbb68073c792d3d67b4d1b503818d4893344c5f1332d6be5a94a3ec56bb2d1f033b996e36894edb6b2ab1942bce832a5ea46f7dcd67fb03f93abc75cd227fc
TLSH
T19901561B26E54204F0B31F22EBF980B353373C929D2991AC9088031E49E2A42D4A3BB3
MD5 SHA1 SHA512 TLSH

Submit Download

ArmUI.ini

Path C:\Windows\Temp\ArmUI.ini
Size 233KB
SHA256 76362509a8ca3e4a9fdc854c56674083ef77ca2c53628ce0acf4bb4c42d73894
MD5 b0df20baa9dee27bdbc3285c7d6d4c57
SHA1 443fe739e4c5a2ab4ece3eaff0179e7b1deba639
SHA512 0da5976d3096f598d0bec4a2c4e64f708d02a6376bd87e460744f5054d2b6e1b710e655831c287d7e672f73a3db846b19ff054270c3ce41fa02b61ecb5e31fab
SSDEEP 3072:03IJ8zcVOWmxltum8PMkufNWwhEIrKNCpNugYW+lCIr0YxbFKRWSp4Vf37FbAjG/:ByJvW
TLSH
T132342A5667FD1209F6F37F41EEB852944B7B7DA2BE3AC14D1680014E08B5A90DA72B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RdrServicesUpdater2_x86.exe

Path \??\c:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-AC0A92D435E5}\RdrServicesUpdater2_x86.exe
Size 846KB
SHA256 6a142c879a0676aef5c825d6fd6336800846167fab422d0f912096d286aa0070
MD5 a447c3cf3b7547e5a1e12dbb92d8c052
SHA1 d2b246eda6302534b21b2003719d9f911d0c77d3
SHA512 ce7446e337cc13a560a12b0b789813bfb5a96a6a9d25a8b3e2fc1ed884f0c4950f01937714614666befb9b92123d359b9597116e9ed9e8efd46b77a640d002ea
SSDEEP 24576:uSU4vrTQA/gK/c8DV5Wa1ZmPEKBLeiGA5nEJ:uP4j5gKU83W3FLeilVEJ
TLSH
T10C059E22EAD18073D563143102A66F368EBEB9310971D98FA3D41A4E5E705E1BB3F397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1068-1728-0x0000000000BC0000-0x0000000000BCB000-memory.dmp

Download

memory/1068-1729-0x0000000002610000-0x0000000002674000-memory.dmp

Download

memory/1368-1539-0x0000000003C20000-0x0000000003C49000-memory.dmp

Download

memory/1368-1300-0x0000000003C20000-0x0000000003C49000-memory.dmp

Download

memory/2144-1550-0x0000000000BB0000-0x0000000000BBB000-memory.dmp

Download

memory/2144-1551-0x00000000025C0000-0x0000000002624000-memory.dmp

Download