shodi | ac9865442ac80f229f0f410d4ba25a31df79868b8dd4daba640220f9227a9ed1

Analysis

max time kernel
150s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
06/05/2026, 11:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-06_6d2b3e42d6c11dd7100caf0d1655987b_amadey_cloudeye_darkgate_elex_hellokitty_hijackloader_ic.exe
Size 2.0MB
Sample260506-nltd7act9k
SHA256 ac9865442ac80f229f0f410d4ba25a31df79868b8dd4daba640220f9227a9ed1
MD5 6d2b3e42d6c11dd7100caf0d1655987b
SHA1 89fc332a68ec0d1e6b9e7d94809afcd2d31ef68a
SHA512 ed9af814a97a0086f675ef69efc6d615a6e7b7ac93340e01d761da722c24b4ad68131e8d7519e3785bf80026f4d098f4c204ae5b28da86231e465b50ee137e1a
SSDEEP 49152:xGT2KyFx9+CVD2SouuFOnYIsE5JIMzHRX4y:22KGx9vuFOnYHEXL
TLSH
T1D9A539117BE55A35F1BB2B31A97852645A7BBC615F31C7CF13802A5E2D30AC09936B33
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery shodi spyware stealer trojan worm

Malware Config

Signatures

Family: Shodi
Shodi is a Windows worm written in C++.
worm shodi

Detects Shodi worm 3 IoCs

resource	yara_rule
behavioral2/files/0x000f0000000004aa-91.dat	family_shodi
behavioral2/files/0x0005000000027b2b-1784.dat	family_shodi
behavioral2/files/0x004b000000028dc6-1987.dat	family_shodi

Executes dropped EXE 4 IoCs

pid	Process
4268	2026-05-06_6d2b3e42d6c11dd7100caf0d1655987b_amadey_cloudeye_darkgate_elex_hellokitty_hijackloader_ic.usa
3160	AdobeARMHelper.exe
1304	AdobeARM.exe
3816	AdobeARM.usa

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	AdobeARM.usa

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\UsaShohdi.asu	2026-05-06_6d2b3e42d6c11dd7100caf0d1655987b_amadey_cloudeye_darkgate_elex_hellokitty_hijackloader_ic.exe
File opened for modification	C:\Windows\SysWOW64\UsaShohdi.asu	2026-05-06_6d2b3e42d6c11dd7100caf0d1655987b_amadey_cloudeye_darkgate_elex_hellokitty_hijackloader_ic.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	\??\c:\Program Files\Java\jdk-1.8\jre\bin\javaws.usa	2026-05-06_6d2b3e42d6c11dd7100caf0d1655987b_amadey_cloudeye_darkgate_elex_hellokitty_hijackloader_ic.exe
File created	\??\c:\Program Files\Java\jre-1.8\bin\javacpl.exe	2026-05-06_6d2b3e42d6c11dd7100caf0d1655987b_amadey_cloudeye_darkgate_elex_hellokitty_hijackloader_ic.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Office16\SDXHelper.usa	2026-05-06_6d2b3e42d6c11dd7100caf0d1655987b_amadey_cloudeye_darkgate_elex_hellokitty_hijackloader_ic.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\private_browsing.usa	2026-05-06_6d2b3e42d6c11dd7100caf0d1655987b_amadey_cloudeye_darkgate_elex_hellokitty_hijackloader_ic.exe
File opened for modification	\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.usa	2026-05-06_6d2b3e42d6c11dd7100caf0d1655987b_amadey_cloudeye_darkgate_elex_hellokitty_hijackloader_ic.exe
File opened for modification	\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.usa	2026-05-06_6d2b3e42d6c11dd7100caf0d1655987b_amadey_cloudeye_darkgate_elex_hellokitty_hijackloader_ic.exe
File created	\??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-05-06_6d2b3e42d6c11dd7100caf0d1655987b_amadey_cloudeye_darkgate_elex_hellokitty_hijackloader_ic.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Office16\WORDICON.usa	2026-05-06_6d2b3e42d6c11dd7100caf0d1655987b_amadey_cloudeye_darkgate_elex_hellokitty_hijackloader_ic.exe
File created	\??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE	2026-05-06_6d2b3e42d6c11dd7100caf0d1655987b_amadey_cloudeye_darkgate_elex_hellokitty_hijackloader_ic.exe
File opened for modification	\??\c:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.usa	2026-05-06_6d2b3e42d6c11dd7100caf0d1655987b_amadey_cloudeye_darkgate_elex_hellokitty_hijackloader_ic.exe
File created	\??\c:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe	2026-05-06_6d2b3e42d6c11dd7100caf0d1655987b_amadey_cloudeye_darkgate_elex_hellokitty_hijackloader_ic.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.usa	2026-05-06_6d2b3e42d6c11dd7100caf0d1655987b_amadey_cloudeye_darkgate_elex_hellokitty_hijackloader_ic.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Office16\CLVIEW.usa	2026-05-06_6d2b3e42d6c11dd7100caf0d1655987b_amadey_cloudeye_darkgate_elex_hellokitty_hijackloader_ic.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Office16\PPTICO.usa	2026-05-06_6d2b3e42d6c11dd7100caf0d1655987b_amadey_cloudeye_darkgate_elex_hellokitty_hijackloader_ic.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.usa	2026-05-06_6d2b3e42d6c11dd7100caf0d1655987b_amadey_cloudeye_darkgate_elex_hellokitty_hijackloader_ic.exe
File created	\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	2026-05-06_6d2b3e42d6c11dd7100caf0d1655987b_amadey_cloudeye_darkgate_elex_hellokitty_hijackloader_ic.exe
File created	\??\c:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2026-05-06_6d2b3e42d6c11dd7100caf0d1655987b_amadey_cloudeye_darkgate_elex_hellokitty_hijackloader_ic.exe
File created	\??\c:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	2026-05-06_6d2b3e42d6c11dd7100caf0d1655987b_amadey_cloudeye_darkgate_elex_hellokitty_hijackloader_ic.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdate.usa	2026-05-06_6d2b3e42d6c11dd7100caf0d1655987b_amadey_cloudeye_darkgate_elex_hellokitty_hijackloader_ic.exe
File opened for modification	\??\c:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.usa	2026-05-06_6d2b3e42d6c11dd7100caf0d1655987b_amadey_cloudeye_darkgate_elex_hellokitty_hijackloader_ic.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Office16\IEContentService.usa	2026-05-06_6d2b3e42d6c11dd7100caf0d1655987b_amadey_cloudeye_darkgate_elex_hellokitty_hijackloader_ic.exe
File created	\??\c:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe	2026-05-06_6d2b3e42d6c11dd7100caf0d1655987b_amadey_cloudeye_darkgate_elex_hellokitty_hijackloader_ic.exe
File created	\??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE	2026-05-06_6d2b3e42d6c11dd7100caf0d1655987b_amadey_cloudeye_darkgate_elex_hellokitty_hijackloader_ic.exe
File created	\??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE	2026-05-06_6d2b3e42d6c11dd7100caf0d1655987b_amadey_cloudeye_darkgate_elex_hellokitty_hijackloader_ic.exe
File created	\??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe	2026-05-06_6d2b3e42d6c11dd7100caf0d1655987b_amadey_cloudeye_darkgate_elex_hellokitty_hijackloader_ic.exe
File created	\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	2026-05-06_6d2b3e42d6c11dd7100caf0d1655987b_amadey_cloudeye_darkgate_elex_hellokitty_hijackloader_ic.exe
File created	\??\c:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe	2026-05-06_6d2b3e42d6c11dd7100caf0d1655987b_amadey_cloudeye_darkgate_elex_hellokitty_hijackloader_ic.exe
File opened for modification	\??\c:\Program Files\7-Zip\Uninstall.usa	2026-05-06_6d2b3e42d6c11dd7100caf0d1655987b_amadey_cloudeye_darkgate_elex_hellokitty_hijackloader_ic.exe
File created	\??\c:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	2026-05-06_6d2b3e42d6c11dd7100caf0d1655987b_amadey_cloudeye_darkgate_elex_hellokitty_hijackloader_ic.exe
File created	\??\c:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE	2026-05-06_6d2b3e42d6c11dd7100caf0d1655987b_amadey_cloudeye_darkgate_elex_hellokitty_hijackloader_ic.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Office16\msoadfsb.usa	2026-05-06_6d2b3e42d6c11dd7100caf0d1655987b_amadey_cloudeye_darkgate_elex_hellokitty_hijackloader_ic.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\cookie_exporter.usa	2026-05-06_6d2b3e42d6c11dd7100caf0d1655987b_amadey_cloudeye_darkgate_elex_hellokitty_hijackloader_ic.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\BHO\ie_to_edge_stub.usa	2026-05-06_6d2b3e42d6c11dd7100caf0d1655987b_amadey_cloudeye_darkgate_elex_hellokitty_hijackloader_ic.exe
File opened for modification	\??\c:\Program Files\Java\jdk-1.8\bin\jconsole.usa	2026-05-06_6d2b3e42d6c11dd7100caf0d1655987b_amadey_cloudeye_darkgate_elex_hellokitty_hijackloader_ic.exe
File created	\??\c:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	2026-05-06_6d2b3e42d6c11dd7100caf0d1655987b_amadey_cloudeye_darkgate_elex_hellokitty_hijackloader_ic.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.usa	2026-05-06_6d2b3e42d6c11dd7100caf0d1655987b_amadey_cloudeye_darkgate_elex_hellokitty_hijackloader_ic.exe
File created	\??\c:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedgewebview2.exe	2026-05-06_6d2b3e42d6c11dd7100caf0d1655987b_amadey_cloudeye_darkgate_elex_hellokitty_hijackloader_ic.exe
File created	\??\c:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe	2026-05-06_6d2b3e42d6c11dd7100caf0d1655987b_amadey_cloudeye_darkgate_elex_hellokitty_hijackloader_ic.exe
File created	\??\c:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE	2026-05-06_6d2b3e42d6c11dd7100caf0d1655987b_amadey_cloudeye_darkgate_elex_hellokitty_hijackloader_ic.exe
File created	\??\c:\Program Files\Microsoft Office\root\Office16\msoasb.exe	2026-05-06_6d2b3e42d6c11dd7100caf0d1655987b_amadey_cloudeye_darkgate_elex_hellokitty_hijackloader_ic.exe
File opened for modification	\??\c:\Program Files\VideoLAN\VLC\vlc.usa	2026-05-06_6d2b3e42d6c11dd7100caf0d1655987b_amadey_cloudeye_darkgate_elex_hellokitty_hijackloader_ic.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.usa	2026-05-06_6d2b3e42d6c11dd7100caf0d1655987b_amadey_cloudeye_darkgate_elex_hellokitty_hijackloader_ic.exe
File created	\??\c:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe	2026-05-06_6d2b3e42d6c11dd7100caf0d1655987b_amadey_cloudeye_darkgate_elex_hellokitty_hijackloader_ic.exe
File created	\??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-05-06_6d2b3e42d6c11dd7100caf0d1655987b_amadey_cloudeye_darkgate_elex_hellokitty_hijackloader_ic.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Office16\POWERPNT.usa	2026-05-06_6d2b3e42d6c11dd7100caf0d1655987b_amadey_cloudeye_darkgate_elex_hellokitty_hijackloader_ic.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.usa	2026-05-06_6d2b3e42d6c11dd7100caf0d1655987b_amadey_cloudeye_darkgate_elex_hellokitty_hijackloader_ic.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\uninstall\helper.usa	2026-05-06_6d2b3e42d6c11dd7100caf0d1655987b_amadey_cloudeye_darkgate_elex_hellokitty_hijackloader_ic.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.usa	2026-05-06_6d2b3e42d6c11dd7100caf0d1655987b_amadey_cloudeye_darkgate_elex_hellokitty_hijackloader_ic.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\BHO\ie_to_edge_stub.usa	2026-05-06_6d2b3e42d6c11dd7100caf0d1655987b_amadey_cloudeye_darkgate_elex_hellokitty_hijackloader_ic.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Installer\setup.usa	2026-05-06_6d2b3e42d6c11dd7100caf0d1655987b_amadey_cloudeye_darkgate_elex_hellokitty_hijackloader_ic.exe
File created	\??\c:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\pwahelper.exe	2026-05-06_6d2b3e42d6c11dd7100caf0d1655987b_amadey_cloudeye_darkgate_elex_hellokitty_hijackloader_ic.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\plugin-container.usa	2026-05-06_6d2b3e42d6c11dd7100caf0d1655987b_amadey_cloudeye_darkgate_elex_hellokitty_hijackloader_ic.exe
File created	\??\c:\Program Files\VideoLAN\VLC\uninstall.exe	2026-05-06_6d2b3e42d6c11dd7100caf0d1655987b_amadey_cloudeye_darkgate_elex_hellokitty_hijackloader_ic.exe
File created	\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	2026-05-06_6d2b3e42d6c11dd7100caf0d1655987b_amadey_cloudeye_darkgate_elex_hellokitty_hijackloader_ic.exe
File created	\??\c:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateSetup.exe	2026-05-06_6d2b3e42d6c11dd7100caf0d1655987b_amadey_cloudeye_darkgate_elex_hellokitty_hijackloader_ic.exe
File created	\??\c:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE	2026-05-06_6d2b3e42d6c11dd7100caf0d1655987b_amadey_cloudeye_darkgate_elex_hellokitty_hijackloader_ic.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.usa	2026-05-06_6d2b3e42d6c11dd7100caf0d1655987b_amadey_cloudeye_darkgate_elex_hellokitty_hijackloader_ic.exe
File created	\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	2026-05-06_6d2b3e42d6c11dd7100caf0d1655987b_amadey_cloudeye_darkgate_elex_hellokitty_hijackloader_ic.exe
File created	\??\c:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Installer\setup.exe	2026-05-06_6d2b3e42d6c11dd7100caf0d1655987b_amadey_cloudeye_darkgate_elex_hellokitty_hijackloader_ic.exe
File opened for modification	\??\c:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.usa	2026-05-06_6d2b3e42d6c11dd7100caf0d1655987b_amadey_cloudeye_darkgate_elex_hellokitty_hijackloader_ic.exe
File created	\??\c:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\elevation_service.exe	2026-05-06_6d2b3e42d6c11dd7100caf0d1655987b_amadey_cloudeye_darkgate_elex_hellokitty_hijackloader_ic.exe
File opened for modification	\??\c:\Program Files\Java\jre-1.8\bin\ssvagent.usa	2026-05-06_6d2b3e42d6c11dd7100caf0d1655987b_amadey_cloudeye_darkgate_elex_hellokitty_hijackloader_ic.exe
File created	\??\c:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE	2026-05-06_6d2b3e42d6c11dd7100caf0d1655987b_amadey_cloudeye_darkgate_elex_hellokitty_hijackloader_ic.exe
File created	\??\c:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE	2026-05-06_6d2b3e42d6c11dd7100caf0d1655987b_amadey_cloudeye_darkgate_elex_hellokitty_hijackloader_ic.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AdobeARM.usa
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-06_6d2b3e42d6c11dd7100caf0d1655987b_amadey_cloudeye_darkgate_elex_hellokitty_hijackloader_ic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-06_6d2b3e42d6c11dd7100caf0d1655987b_amadey_cloudeye_darkgate_elex_hellokitty_hijackloader_ic.usa
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AdobeARMHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AdobeARM.exe

Modifies system certificate store 2 TTPs 3 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25	2026-05-06_6d2b3e42d6c11dd7100caf0d1655987b_amadey_cloudeye_darkgate_elex_hellokitty_hijackloader_ic.usa
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 040000000100000010000000d474de575c39b2d39c8583c5c065498a0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000007431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25190000000100000010000000ba4f3972e7aed9dccdc210db59da13c92000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	2026-05-06_6d2b3e42d6c11dd7100caf0d1655987b_amadey_cloudeye_darkgate_elex_hellokitty_hijackloader_ic.usa
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 5c000000010000000400000000080000190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc36200000001000000200000007431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8040000000100000010000000d474de575c39b2d39c8583c5c065498a2000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	2026-05-06_6d2b3e42d6c11dd7100caf0d1655987b_amadey_cloudeye_darkgate_elex_hellokitty_hijackloader_ic.usa

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3160	AdobeARMHelper.exe
3160	AdobeARMHelper.exe
3160	AdobeARMHelper.exe
3160	AdobeARMHelper.exe
3160	AdobeARMHelper.exe
3160	AdobeARMHelper.exe
3160	AdobeARMHelper.exe
3160	AdobeARMHelper.exe
3160	AdobeARMHelper.exe
3160	AdobeARMHelper.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4268	2026-05-06_6d2b3e42d6c11dd7100caf0d1655987b_amadey_cloudeye_darkgate_elex_hellokitty_hijackloader_ic.usa
3816	AdobeARM.usa

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3300 wrote to memory of 4268	3300	2026-05-06_6d2b3e42d6c11dd7100caf0d1655987b_amadey_cloudeye_darkgate_elex_hellokitty_hijackloader_ic.exe	79
PID 4268 wrote to memory of 4928	4268	2026-05-06_6d2b3e42d6c11dd7100caf0d1655987b_amadey_cloudeye_darkgate_elex_hellokitty_hijackloader_ic.usa	82
PID 4268 wrote to memory of 3160	4268	2026-05-06_6d2b3e42d6c11dd7100caf0d1655987b_amadey_cloudeye_darkgate_elex_hellokitty_hijackloader_ic.usa	83
PID 3160 wrote to memory of 1304	3160	AdobeARMHelper.exe	84
PID 1304 wrote to memory of 3816	1304	AdobeARM.exe	85

C:\Users\Admin\AppData\Local\Temp\2026-05-06_6d2b3e42d6c11dd7100caf0d1655987b_amadey_cloudeye_darkgate_elex_hellokitty_hijackloader_ic.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-06_6d2b3e42d6c11dd7100caf0d1655987b_amadey_cloudeye_darkgate_elex_hellokitty_hijackloader_ic.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3300
- C:\Users\Admin\AppData\Local\Temp\2026-05-06_6d2b3e42d6c11dd7100caf0d1655987b_amadey_cloudeye_darkgate_elex_hellokitty_hijackloader_ic.usa
  C:\Users\Admin\AppData\Local\Temp\2026-05-06_6d2b3e42d6c11dd7100caf0d1655987b_amadey_cloudeye_darkgate_elex_hellokitty_hijackloader_ic.usa
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies system certificate store
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4268
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe"
    3⤵
    PID:4928
- - C:\ProgramData\Adobe\ARM\S\27379\AdobeARMHelper.exe
    "C:\ProgramData\Adobe\ARM\S\27379\AdobeARMHelper.exe" /ArmUpdate /MSI FOLDER:"C:\ProgramData\Adobe\ARM\S\27379" /MODE:3 /UpdateSelection:1 /PRODUCT:{291AA914-A987-4CE9-BD63-AC0A92D435E5} /VERSION:19.0 /LANG:ENU
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:3160
  - - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
      "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" /ArmUpdate /MSI FOLDER:"C:\ProgramData\Adobe\ARM\S\27379" /MODE:3 /UpdateSelection:1 /PRODUCT:{291AA914-A987-4CE9-BD63-AC0A92D435E5} /VERSION:19.0 /LANG:ENU
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1304
    - - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.usa
        
        "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.usa"
        5⤵
        Executes dropped EXE
        Checks whether UAC is enabled
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3816

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

AcroRd32.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
Size 2.9MB
SHA256 abcd47b9c88ad30d7af4efe9a01645fa4a532f88e9cf829d3cfe44145d9b7945
MD5 af5575224f95584166d2110c0f644563
SHA1 352a787f9cf33294f8c75e1b4203e0023ad35b66
SHA512 1e4896e8839c1a3c8855193c41a4302f13703a71cb625263b224131496b4f7f42fa3206381d588450a109805bfbab7c5013f5aeb9bb880ccfb58d641281c5ae8
SSDEEP 49152:8GT2KGTfiUEWo6zuEz439z99akTBc4O8b8ITDnlT4NvJF:d2KGTfiG/nzU90p
TLSH
T1BBE5D416A2C8C0EBE5652070CC59BBF910546D78DBA28DD7BE40BF16B9307D29533A3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AdobeARM.exe

Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
Size 1.7MB
SHA256 dcee62be7fe12679426be80452847a7ef17bf2aa6263d0491e99045609e02bd4
MD5 6d23ea324be773e82fd18bd2ad2f2e57
SHA1 0180bd874056b4e5d9a59e38f5e13cf48772b15a
SHA512 0209edceece41895aa3d2b80169cc6631d03190c5f92388a2e1bd90a6eb2da98d4aae11c6a1b3a42a8ba5ae8bcdb45a71a528888ec5780654456302a80c412d7
SSDEEP 24576:FGTjSw8K6Sgouvz0ZRHkFfenxyQZXS7gZnQh2NIQ:FGT2K6SgouvAeFfenxyQZXS7uQ0NIQ
TLSH
T17D85170277F94129F1F36B71EAB993745A77BC75AE39C50E1380125E0DB0A90AA35B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AdobeARM.usa

Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.usa
Size 1.1MB
SHA256 03b39c1e40731161ff527db03926e07485c051bb4c0694ab4bf16fcc212cc124
MD5 bd7ae0affbb3a6fd52d956a5694c8073
SHA1 4abb30acd9c8fc94f72b280856e868612fd476e0
SHA512 6f9e387a6d29729d2836f23e8eaf331945c7472a957cb7b98611a94f0bb31890c9b0c4da46956c1140f7ae411f0ee445008825c666a55617ff77aa43166386cb
SSDEEP 12288:k3Sgouvz0ZRHkXVfeeO4LMneqyQsWSjGQCfLBlS7guN1AnQ6i12NI+f:+Sgouvz0ZRHkFfenxyQZXS7gZnQh2NIq
TLSH
T11145E50267F94129F1F37B71EEB993645A77BCA1AE39C50E5280025E0DB4A90DE71B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ArmReport.ini

Path C:\ProgramData\Adobe\ARM\ArmReport.ini
Size 82B
SHA256 5a1e0a0216dd3893a738efdfc9c1bc5445e68d3939840578341f6cd08b14d815
MD5 9de1c12da78157648e8e5b25adab3467
SHA1 e9a8e45cbc66f9323f530a7bc88249e92e99fa52
SHA512 cbc027271d3977d2c248dbcd683da728880d5c26d2bae6df6299b4eeed551f34b2e687865b578a688f98a3865b63450ac0bf7cc07d031dad0f8dbe72e9e531b9
TLSH
T1FEA0222333C0803CB8203A02CCE088333322B0C8B00BC00CC002228E00F022002223BF
MD5 SHA1 SHA512 TLSH

Submit Download

ArmReport.ini

Path C:\ProgramData\Adobe\ARM\ArmReport.ini
Size 782B
SHA256 8395f93b0e0240f5c79ce70bc2257f9cb0d92227b15f7724ba65b1c5c0b19625
MD5 29f1b2d1b6f9290138596cf180847e53
SHA1 ab496ce19c74cb15fe0b38807cf29db776336461
SHA512 bdadd50c6371d05f5d43fe7f95e8c02bd74842b0a7b982f571e80520d8748d67fc6f3912f9eb797edc476387168d597747b9a8705ded1ea473e5ee160c627227
TLSH
T1E0014C531AE81125F1B35A44DFF9947357327C975C2DC8AC90D8520E49E1940D5B27BB
MD5 SHA1 SHA512 TLSH

Submit Download

AdobeARM.msi

Path C:\ProgramData\Adobe\ARM\S\27379\AdobeARM.msi
Size 1.0MB
SHA256 f3f339de3a391d7f8baf37009ec52a6948d769977e2f407faf46f7064a524638
MD5 9474db895113963c06cf1050a3d5c91d
SHA1 5c599ee58ffb1fac122823e30814702fa38eec2d
SHA512 cb4fc2145582e459af1d8eb0ef3f33a629929eb7e0730a7af15d98b4c5577a5a5b3853c5695bc9e356be96c35a91cec69f57a81322c839a2cd6d73b9958d35af
SSDEEP 24576:5tsYy4SyBEqipH6t3uhK76TwlO/TTj11:5tsYy/yUpaiqhETTz
TLSH
T12935F107B3804236C59A0235544F87724B79FC348B21426B37D9B75D3EB27E0AABB5E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AdobeARMHelper.exe

Path C:\ProgramData\Adobe\ARM\S\27379\AdobeARMHelper.exe
Size 413KB
SHA256 fd115ae8ebd2f37cf1ef72f75242206cf1331c7cb258305011302e981137ee5e
MD5 522026a14d6bc781d2a15c665e454310
SHA1 9451a39108326ba578793b1feb62f23a02bce916
SHA512 4e4eb2f582c8590899a0ada6133b705d13775f60818f1ff4f9bb35e40e09d6570af4f7ac4c80b525b445a03702ca0f3a9867a93080f90697d8be668e2abe2fe7
SSDEEP 6144:q/6JSQsSVWSLjX2PxPNMRyfn7LzPdKblt0K+HAfh0v8axsbQuXYvr6yIl2:u6dVWnxlMSn7nFKbltn+Ch/m6X2
TLSH
T1DE947C1037D0C036F1B329768ABFD728556DB9715F6881CFA3C8166E5EB06E0AA3171B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RdrManifest2.msi

Path C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-AC0A92D435E5}\RdrManifest2.msi
Size 18KB
SHA256 0abcb8b7c0bda3128316b3e4f4a5857e9c8194105043a0c0e9801a1a96105d01
MD5 f5d4c05bc8ea0d4fc4d277abda7369d9
SHA1 f67e793b159bd1e75ed4dec0de352ea1b6583708
SHA512 359a966c4dc8d62a570b428dfb3e666a63efd6bfff7c5b5ace3bc97ea09ba701d9fa524f439bf9902746c2ecac9c1f76c90868b0152eb825b2a09a9474fdbb34
SSDEEP 384:MrUq75oUFtb0F+o5nfy9jdIYigYws0i9Db9Ey8RbmL4A8UiINyGNB:MrUq75oUFtb0F+o5nfy9uYigY9K5ALdH
TLSH
T19D820BA2B4408C11CD868F3EA4C1D726D672BC813D8591C27565F219CFB23869A9F7EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
Size 471B
SHA256 94c65f9b8f0e88599ea536a72ff3315bef01077bb1eb79e1ca413b7e1cfeb13f
MD5 8e6ecdc0219fffa5445dc06f774b5428
SHA1 a18eaf757c6e15a7c6ded4173d0260e34846d314
SHA512 1b4c1ea4b9268b907385c0656ad335deabb5468f3d55c7ffab645adf651dd4dccb7ace1e0e7877d47a3de8de6c9d145dcb98679e16a55457b55f317ba3d4e2b9
TLSH
T1ABF0DC67D6BBFCA12102DCAC35F058F431E9A4CB40CA9562603837D143179F1628F806
MD5 SHA1 SHA512 TLSH

Submit Download

8890A77645B73478F5B1DED18ACBF795_C090A8C88B266C6FF99A97210E92B44D

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8890A77645B73478F5B1DED18ACBF795_C090A8C88B266C6FF99A97210E92B44D
Size 471B
SHA256 2203d5ef705b4fd8e612f2f4f01a01edf0454e746c33e189c241a6ec49b90c5e
MD5 e81160f81365fa17652bebbbd49bef3e
SHA1 556a961247a7b8e5c897cc7c463bad8454004b65
SHA512 9713289c75d6ce8f51e4f0931aabadd324bccabf0481ff25f10a72f13b1e6166f898ad1405eaf4575337a86c491c7bbc1732d9c610094a209bceba30e4b5bf89
TLSH
T1CFF0DC230EED28C2AC11BC4CAD9AB2BD2457785A488A1CCB34E9F741016D7B0D0AC023
MD5 SHA1 SHA512 TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_54359052731E413C60F1C59EABAD4E05

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_54359052731E413C60F1C59EABAD4E05
Size 727B
SHA256 100e2860fa24e8205e75532071f4677753d9ed3eea61e5b199e9c7d6aaa92968
MD5 553dc2881de3f7398dd514dfb58d5da8
SHA1 5a3ecd476913201280e3839f32ee09336d762515
SHA512 83e88f3707be095da5adabe7882e903f3293f306ba9d11b4864dda65472e9525782d4740d4957dbc8c9f87c060588bb2f0268598d9aae6d7d287e712d0d42002
TLSH
T1F30165660F6F6D0996C78F5DC5A86461720313237FDF446E3B256244C688770FD179D0
MD5 SHA1 SHA512 TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_5809FDAACC125718B26BC11DC8E8116A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_5809FDAACC125718B26BC11DC8E8116A
Size 727B
SHA256 391f900229ee782fd0c3ff89e96a3d6aaa7c9f306dcbdd15df6b083340296de3
MD5 e163d607e3fee10f01aabe48d985dbfc
SHA1 97010a10af94e5e9d3fa261f478513dc079ebc3f
SHA512 b9a09a832015d1f46769c64c12964c7f77ae2085956efe6bf3dab06887ae254740b492bea6ac49b436c0e5634d89e09e96bfe5cbe12c3be08a5ea43124e3978b
TLSH
T19D011508197C06C144026E655E9C61F67365831C2EDD604EF119659EF694FD1291269E
MD5 SHA1 SHA512 TLSH

Submit Download

C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Size 727B
SHA256 d1ab61d90abc7e7295c2ff0571b046f5b2fb3414203890690b5b59ff84a08833
MD5 d678666b89fb25d1fb55132cac2c3afd
SHA1 aef2bc504c71e8c70ec4030fb1766cd6a73840b0
SHA512 fa6d18b0c4ebb8b848792a5a8851c1f05ec8644dab1b0da4af7617f9ebeea86aa1ddc5c01099dadeb828cd5ce2831d7a06ada0195cfbe2f663e2766dc922951c
TLSH
T11F0110832D58DF913C608D439EDCC65C3C6BF2C824CD6176322732DB508AE92FA86C48
MD5 SHA1 SHA512 TLSH

Submit Download

DA3B6E45325D5FFF28CF6BAD6065C907_FBEAFB4EE7383EC8E0A3A2C1EC7FCEAC

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DA3B6E45325D5FFF28CF6BAD6065C907_FBEAFB4EE7383EC8E0A3A2C1EC7FCEAC
Size 471B
SHA256 107cae3b5a6ea35191c6f9f8b82e1002dacd3bc34a5837fe8528cb5b5b5e93da
MD5 f4ee17ebfaae6488beeffc56a34c170a
SHA1 05c6f31b4ac309f0beff49a7287b809d783435cd
SHA512 e7bf5e515b4c5ec3f71e71bf05e80d368dbca709ec7bebf3a8f6053f4534452df490d1041e2b8ad4f477a055875e1677fb2a49974b9da7c3a24b9dacc7c45312
TLSH
T102F0540D7B740205B0789C890CFCC4117D53C65C29D24EDE2C2C303130986BCD218890
MD5 SHA1 SHA512 TLSH

Submit Download

698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
Size 400B
SHA256 1511ea2f579c8e706996b8a887f0c513ab94cd890ad52dd8ce2ebe0142b613f1
MD5 82199be26647e4966009ff341eddd5f4
SHA1 ccfe8c9c83498563267bacbc610b78205c4895e0
SHA512 0c07f5491f1ed35dacac5120e9aa8232fd46f3ba518012dd4ca22d0cce71fb6e0cabed14bfb6b27c08066d4ea58211264caf3e08f052d8a8493b83089dae2210
TLSH
T14BE0203427FB507EF170977942D591E59F39F1037C5553BE08A2182D6D07E404C62C31
MD5 SHA1 SHA512 TLSH

Submit Download

8890A77645B73478F5B1DED18ACBF795_C090A8C88B266C6FF99A97210E92B44D

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8890A77645B73478F5B1DED18ACBF795_C090A8C88B266C6FF99A97210E92B44D
Size 396B
SHA256 2852057416fbc7fc5e7dc86136e2065fc77f53c96c04bbc20cf6476366f1de84
MD5 a49db60caa680fc8cc0dfe1527c9dfe5
SHA1 cab4c083b4244075f1893cc49c7833287f83e36f
SHA512 b623cbaa8bf57ff45a38e253eeb6151bee07959e6da31e134b47bc5042e3fcfe2031d1ac89e117574c70fd9c0c7b0ea5bdcddfa373ec3ab97e390d88b4287411
TLSH
T1EFE0203416FA113CF574AC7985C569394DB8E1140D49577514645609EF427C0CC61935
MD5 SHA1 SHA512 TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_54359052731E413C60F1C59EABAD4E05

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_54359052731E413C60F1C59EABAD4E05
Size 404B
SHA256 410b670616f573de9e2dd0a08b8f0a5de92a7fbc50063b9b7a0934949cdef5e2
MD5 c2c712b1d9cc80dd43a1da5622623e49
SHA1 4f4799c0f0e5e2ab27701e9292a8980a3eb7e67e
SHA512 f754e07e07467751e54dfb0415dfb90bb6af4f4966eb67a9b46e8d43b952297a3a9f8a13eed06057515a63ab6f0884b99a7b5193799901bce07d35fcd8ba3245
TLSH
T1FAE0C03031F60A3EF1E1D53447E59D1365F5F1070A81D76A10101B0E6F127800CA1734
MD5 SHA1 SHA512 TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_5809FDAACC125718B26BC11DC8E8116A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_5809FDAACC125718B26BC11DC8E8116A
Size 404B
SHA256 a8e3f8b398ad52411745c9dc781eac434ddc3739d9d79aeefb640a1249119a92
MD5 20cf908e6a8f563a4bce2e04fd68c809
SHA1 1fc5ea2d15042efcef6f3b1e6e3b7417b99b0b81
SHA512 cdc34f75704dd469b28631f0d4d9aed4b41bc7b5c9a3d17a0d4fa67437d477d6c78415bee36f37918948b63a853a2b4bf702bb44bda731cbf1f0eb3e1ef778e8
TLSH
T168E0C03032F5405EF1F0E4384AF5AF269889F2061D36D37801501315AB107008DD1530
MD5 SHA1 SHA512 TLSH

Submit Download

C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Size 412B
SHA256 233a57ce55944439e313a54f99a891af32a248c988f25461b8d0764efca21c5e
MD5 299090eb94d772010f2feeb907d1abaa
SHA1 b3d8ee1df9e96591a3131dfd1e91c0a67b23e038
SHA512 98959d52e3367ce4a588f5ecfa4c671166e19637cd3dcae45f21e48ad21460bca13872ebd2d6d15543d43bd0dc3ee8ab5114da1b6363f3dd08bd68b08e3dd570
TLSH
T137E0DF2C26EFA91EF090D93586FAA1B62E49F201145496B912944319BB07E009D60AF4
MD5 SHA1 SHA512 TLSH

Submit Download

DA3B6E45325D5FFF28CF6BAD6065C907_FBEAFB4EE7383EC8E0A3A2C1EC7FCEAC

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DA3B6E45325D5FFF28CF6BAD6065C907_FBEAFB4EE7383EC8E0A3A2C1EC7FCEAC
Size 408B
SHA256 ad453c3ca88514e8b14056a684c6e288e991a7a85ff40fca3820150dc8425f58
MD5 6d0514e8a87f278f9a06c87c6948e4aa
SHA1 981a1410f030a4debf6c538ad2d0d319bd089bc6
SHA512 cd37f1e026bb1695cb7492af9f5ec1eb13d512c56565caed77f3e946a8eb947471883dfc104f9fe257f52882cb60549f0f1c2cc9b1f740c5d8bf49b92e436021
TLSH
T102E0263812F71138F562E4788DD873F99C69E5111D24ABB609F51328BBA3B006C22D35
MD5 SHA1 SHA512 TLSH

Submit Download

2026-05-06_6d2b3e42d6c11dd7100caf0d1655987b_amadey_cloudeye_darkgate_elex_hellokitty_hijackloader_ic.usa

Path C:\Users\Admin\AppData\Local\Temp\2026-05-06_6d2b3e42d6c11dd7100caf0d1655987b_amadey_cloudeye_darkgate_elex_hellokitty_hijackloader_ic.usa
Size 1.5MB
SHA256 27c962221dbb07220215e3c65f0ce0e42430e456db84e99ecf0eee449c4167f7
MD5 bf606aedf0fce1aed6537542c62c9cbd
SHA1 7cf79e0468a679b90f3d9817028d5e1efc5e06aa
SHA512 aa978f28897452ce1ecc9c3ea1cdf30d42b054d8fa07098df6cfac56843309609ceb397e26224371e1b0e947c9802be5d8dc5f7afef169caab16fce6a6a2d132
SSDEEP 24576:uFxhhv9+avbHVD2SouDaFOnY548usEj1J4JMzHRX4q:uFx9+CVD2SouuFOnYIsE5JIMzHRX4q
TLSH
T1867519117BE95A29F1FB2B31AE7852644A7B7C615F31C7CF13801A5E2934AC09936B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AdobeARM.log

Path C:\Users\Admin\AppData\Local\Temp\AdobeARM.log
Size 328B
SHA256 76e831ed81b55f4b424e41f6a83fe33e4799117dd38e62c30a96552b6473fbcf
MD5 4d6e399ec00488c2a7304e426bd3c65e
SHA1 0bf8b187ef66f1737d7c0f954f394be6cff31b83
SHA512 05fd450ff68d308f1210f7770c723e116373bd3c597b44d01188c9b461ccda682e771d1c152f0c29df84e6f5116d299d2e557e0e51483ecae2ebc2f7b9104688
TLSH
T1D6E07D7F803B51FE076750CB821A3D02CC107352B353C76871102E91A42A812AE3F504
MD5 SHA1 SHA512 TLSH

Submit Download

ArmUI.ini

Path C:\Users\Admin\AppData\Local\Temp\ArmUI.ini
Size 251KB
SHA256 b4d4dcd9594d372d7c0c975d80ef5802c88502895ed4b8a26ca62e225f2f18b0
MD5 864c22fb9a1c0670edf01c6ed3e4fbe4
SHA1 bf636f8baed998a1eb4531af9e833e6d3d8df129
SHA512 ff23616ee67d51daa2640ae638f59a8d331930a29b98c2d1bd3b236d2f651f243f9bae38d58515714886cfbb13b9be721d490aad4f2d10cbba74d7701ab34e09
SSDEEP 3072:wT4DJAvCXkQqSmSgojgTaDuK1+4xKtaU/QX5Pm9vR549QHmYPCjTMNro0Jnxu4Fn:xvUzH5
TLSH
T1B144E44363FC1209F6F37B41EEB852A44B77BDA5AA3EC15D1184015E08F5A90DA72BB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Tmp4820.tmp

Path C:\Users\Admin\AppData\Local\Temp\Tmp4820.tmp
Size 5KB
SHA256 aaaced351a90b2029c44c6ebb68084a331f296a0ace8115d9889f549d596564b
MD5 42ff6aa7e64b25f09ffb2a89ce7f36ba
SHA1 0dbf44a94dbd6801b3afba7a6c602f39c7d44732
SHA512 47337d9919bc26dedfea1af060dd1fa2ef4a3dcf35c0a84ac7bfe0333b4885a368fc46fec5bc317fe257abdbcab9cdff67104382b60e9a1aa5f755aba604adde
SSDEEP 96:6jX74Lc8pJvjU8RunwXGkmIKBiHJdij9tAz4yT+QE4yKSeTEnXtGbE:0ULc8pq8RuwdmL4pUQrNyKQnCE
TLSH
T102C13CA388946C05AC27FC00B4C89933EDB676A61EC1D0D3625CC1A58B913873EDE5FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Tmp605D.tmp

Path C:\Users\Admin\AppData\Local\Temp\Tmp605D.tmp
Size 5KB
SHA256 27ead591d4c7f8fadd0d9e5d32eb6c9bf8830f83fddf83ddd47e6b3b413f5b75
MD5 5a68f4aec3689d0dc750adcae8e60520
SHA1 ebd8482e30140da9e44bebde6e4da997a7391e22
SHA512 311cfca7e98c8db69d2d599c5845d26a4686d03d1ab1d79237952c008269928ce8434a877e3fe411e967995536e2171844df0db14add053037de278571269a04
SSDEEP 96:zX74Lc8pJvjU8RunwXGkmIKBiHJdij9tAz4yT+QE4ycOr0BO:zULc8pq8RuwdmL4pUQrNycOrkO
TLSH
T127C12AA38DD06C05AC5BFD11B4D89A33ADB276952D81C1C3325CC2658F913973AEE2ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Tmp610A.tmp

Path C:\Users\Admin\AppData\Local\Temp\Tmp610A.tmp
Size 3KB
SHA256 dcc9d2695125406282ba990fec39403c44b12964acf51b5e0dc7f2080d714398
MD5 fc2430057cb1be74c788f10c2d4540c8
SHA1 cab67ee8d5191fbf9f25545825e06c1a822af2f2
SHA512 4e2b9709a9e3ca5173abb35816e5a0aebbf2a7aaf971d7f75f3ae66e4a812cbade103baa5016525f5ab83a60c18f8d3c278c90ff83e4afdae419f81673cb5aee
TLSH
T1FC71D8CE0D1A6813ABC7FE8AA1C5E3695C30A3E16AD154CB08BC95824FC6FC51A4901D
MD5 SHA1 SHA512 TLSH

Submit Download

Tmp7946.tmp

Path C:\Users\Admin\AppData\Local\Temp\Tmp7946.tmp
Size 5KB
SHA256 e6bcbcb70401d63ff0746fcbcc63230269058736f7644151393edfdcec8b8765
MD5 1b7ade3253fc67477dea69ef2147603d
SHA1 b71e8e749a3461c9b37ff2c3d099b1911d9cc6a0
SHA512 0edd5eb1635b1599e50b368cb254c94bf1588acf1d063e89f45fcfd6fa625e33d2c7764d9d00afd53dec2dfb342e9cfe199d256edcff8430ae183d357d4382da
SSDEEP 96:7NLX74Lc8pJvjU8RunwXGkmIKBiHJdij9tAz4yT+QE4yGtDwwBq:RULc8pq8RuwdmL4pUQrNyGewBq
TLSH
T16CC12AB388D06C41AD5BBD11B4C89933ADB272992DC1D0D33258C6A58B913873BDE2ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TmpE1F.tmp

Path C:\Users\Admin\AppData\Local\Temp\TmpE1F.tmp
Size 3KB
SHA256 ff9b4cf04e3202f150f19c1711767361343935da7841c98b876c42fd2cabce9b
MD5 bbb796dd2b53f7fb7ce855bb39535e2f
SHA1 dfb022a179775c82893fe8c4f59df8f6d19bd2fd
SHA512 0d122f454fcbf4524c2756692f0f33dc98f5bd2426839c6f03cd5c5f4fd507a8a15cf489d7a7ceadd1b95cf31b506c04bf03d613a9ba7d76add92766b1dc5c2b
TLSH
T10D71D9CF0D1A6413ABC7ED8EB1C5F3AB4C34A7E06AD1588B05B895C24FC3B862A5905D
MD5 SHA1 SHA512 TLSH

Submit Download

TmpF87A.tmp

Path C:\Users\Admin\AppData\Local\Temp\TmpF87A.tmp
Size 5KB
SHA256 a86ac1b119a6653e0c3fc24c2c40e44a7bfdc435fd81c4442af9d5526ef64e85
MD5 5bc2d1f7a5fd950dd51547ead6afdabd
SHA1 90f4e48ac87f4eb9dd10f1a80d46a7063f06a7d2
SHA512 45f18bf24c7f1102c17dd30aa205498f27336259ac3869c1d6129609a40385e68d9a2f353e3b13f18f40e7d1d32c4fb31d10f7b2fa204e24e4411183bb749f55
SSDEEP 96:7sX74Lc8pJvjU8RunwXGkmIKBiHJdij9tAz4yT+QE4yQRlOelNMQtU:gULc8pq8RuwdmL4pUQrNyYlOefM/
TLSH
T13DC12AA388D46C05AD17BC04B4C49A23FEB2B2855EC1D1D36258C1A58B913973ADE6ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UsaShohdi.asu

Path C:\Windows\SysWOW64\UsaShohdi.asu
Size 2.0MB
SHA256 ac9865442ac80f229f0f410d4ba25a31df79868b8dd4daba640220f9227a9ed1
MD5 6d2b3e42d6c11dd7100caf0d1655987b
SHA1 89fc332a68ec0d1e6b9e7d94809afcd2d31ef68a
SHA512 ed9af814a97a0086f675ef69efc6d615a6e7b7ac93340e01d761da722c24b4ad68131e8d7519e3785bf80026f4d098f4c204ae5b28da86231e465b50ee137e1a
SSDEEP 49152:xGT2KyFx9+CVD2SouuFOnYIsE5JIMzHRX4y:22KGx9vuFOnYHEXL
TLSH
T1D9A539117BE55A35F1BB2B31A97852645A7BBC615F31C7CF13802A5E2D30AC09936B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ArmReport.ini

Path C:\Windows\Temp\ArmReport.ini
Size 1KB
SHA256 c53c048db876ebe22bad12002304f302595c37ba530c66bccb04a236e630eadd
MD5 66e20076c8ee52198b10ee5a30b578a2
SHA1 e61b0848d4a3ea6bb75d2877351e298b610ff70e
SHA512 e29f933dec133fdbff18b3ee775562a0cfcfcc963de91557b141aa659e6da927d286996a8815ac3c885627967f4e5a96c7520118ecc02bbe0c0b955d4cca15a1
TLSH
T16A219A872AE91124F4B35F95DBF984B25B333CE21D19C46C80E4120E4EE0B95E5B27B7
MD5 SHA1 SHA512 TLSH

Submit Download

ArmReport.ini

Path C:\Windows\Temp\ArmReport.ini
Size 916B
SHA256 3909779f313abf11024a66ff1867f2c07d980b11a33455467bbc728649ee9c56
MD5 3887846a79de09880cb1bd7680c46966
SHA1 4fface817b09f6c845399c5145b7508520c64a54
SHA512 423881aa178ff39b57473d3e17b0798d8049d87651d04d4eb77e42ebfc1dac065fa2d5f6b2d63ae3f84b6c020287198be8cca564ff1fe871f72bc66c858dbdc8
TLSH
T1C411A94B22E54204F0B31F62EBFD80B357333C919D1981BC80D8031A4AE1A46E8B3BB3
MD5 SHA1 SHA512 TLSH

Submit Download

ArmUI.ini

Path C:\Windows\Temp\ArmUI.ini
Size 233KB
SHA256 76362509a8ca3e4a9fdc854c56674083ef77ca2c53628ce0acf4bb4c42d73894
MD5 b0df20baa9dee27bdbc3285c7d6d4c57
SHA1 443fe739e4c5a2ab4ece3eaff0179e7b1deba639
SHA512 0da5976d3096f598d0bec4a2c4e64f708d02a6376bd87e460744f5054d2b6e1b710e655831c287d7e672f73a3db846b19ff054270c3ce41fa02b61ecb5e31fab
SSDEEP 3072:03IJ8zcVOWmxltum8PMkufNWwhEIrKNCpNugYW+lCIr0YxbFKRWSp4Vf37FbAjG/:ByJvW
TLSH
T132342A5667FD1209F6F37F41EEB852944B7B7DA2BE3AC14D1680014E08B5A90DA72B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RdrServicesUpdater2_x86.exe

Path \??\c:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-AC0A92D435E5}\RdrServicesUpdater2_x86.exe
Size 846KB
SHA256 6a142c879a0676aef5c825d6fd6336800846167fab422d0f912096d286aa0070
MD5 a447c3cf3b7547e5a1e12dbb92d8c052
SHA1 d2b246eda6302534b21b2003719d9f911d0c77d3
SHA512 ce7446e337cc13a560a12b0b789813bfb5a96a6a9d25a8b3e2fc1ed884f0c4950f01937714614666befb9b92123d359b9597116e9ed9e8efd46b77a640d002ea
SSDEEP 24576:uSU4vrTQA/gK/c8DV5Wa1ZmPEKBLeiGA5nEJ:uP4j5gKU83W3FLeilVEJ
TLSH
T10C059E22EAD18073D563143102A66F368EBEB9310971D98FA3D41A4E5E705E1BB3F397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3160-1788-0x0000000000AC0000-0x0000000000ACB000-memory.dmp

Download

memory/3160-1787-0x0000000000D10000-0x0000000000DD2000-memory.dmp

Download

memory/3160-1789-0x0000000000AF0000-0x0000000000AF7000-memory.dmp

Download

memory/3300-300-0x0000000002500000-0x00000000025C2000-memory.dmp

Download

memory/3300-8136-0x0000000002500000-0x00000000025C2000-memory.dmp

Download

memory/3300-3306-0x0000000002500000-0x00000000025C2000-memory.dmp

Download

memory/3816-2160-0x0000000003280000-0x0000000003287000-memory.dmp

Download

memory/3816-2159-0x0000000000BB0000-0x0000000000C72000-memory.dmp

Download

memory/4268-1003-0x0000000003D80000-0x0000000003DA9000-memory.dmp

Download

memory/4268-1773-0x0000000003D40000-0x0000000003D47000-memory.dmp

Download

memory/4268-1736-0x00000000017E0000-0x00000000018A2000-memory.dmp

Download

memory/4268-1772-0x00000000017E0000-0x00000000018A2000-memory.dmp

Download

memory/4268-301-0x00000000017E0000-0x00000000018A2000-memory.dmp

Download

memory/4268-620-0x00000000017E0000-0x00000000018A2000-memory.dmp

Download

memory/4268-1774-0x0000000003D80000-0x0000000003DA9000-memory.dmp

Download

memory/4268-1001-0x00000000017E0000-0x00000000018A2000-memory.dmp

Download

memory/4268-621-0x0000000003D40000-0x0000000003D47000-memory.dmp

Download