44e1425d6f32afed2d0096d787392aa26ecfac3c0ef6955d9ec30c754b17c566

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/07/2026, 22:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-08_c2004c7adf58ea97e66a9b252c30e294_amadey_darkgate_elex_smoke-loader_stop.exe
Size 562KB
Sample260708-12mmsshx7p
SHA256 44e1425d6f32afed2d0096d787392aa26ecfac3c0ef6955d9ec30c754b17c566
MD5 c2004c7adf58ea97e66a9b252c30e294
SHA1 9b36380fea4cde95e59aaba9aa5aedde5b5e0972
SHA512 00563ef040d1001e4cb9c0d7998a4b4cecc527eab7b1fd80e463e86b5f06060998a82fc1c93275717c64011f3e4fd386d18dfdef52114c7bfbd08870840ced69
SSDEEP 12288:OpnIlsAkjIf/WbGH/+8zoXEyO4pV1JTcgoLjAC5gS:OpnHAL7+8zuEgdIgoLjApS
TLSH
T131C4AFB2BA50C172C10255704D26EB6894B9DEF03F304AE7F7D83E6E6DB26D16C3650A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2760	Logo1_.exe
4896	2026-07-08_c2004c7adf58ea97e66a9b252c30e294_amadey_darkgate_elex_smoke-loader_stop.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmprph.exe	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Work\LTR\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\XboxApp.UI\Resources\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\css\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\EBWebView\x86\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\PdfPreview\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\VisualElements\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-white\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\zh-CN\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\cs-cz\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\en-gb\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\images\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ko-kr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\da-dk\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\pl-pl\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\eu-es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\Network Sharing\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\es_MX\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\fr-ma\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\he-il\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Place\RTL\contrast-black\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\en-US\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Google\Chrome\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\hrtfs\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\id\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.NET.Native.Framework.1.7_1.7.25531.0_x64__8wekyb3d8bbwe\AppxMetadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Work\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Configuration\Registration\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\zh-tw\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.XboxIdentityProvider_12.50.6001.0_x64__8wekyb3d8bbwe\Assets\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\nb-no\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\hr-hr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\sk-sk\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\de-DE\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\de-DE\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\en-gb\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\ro-ro\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\ar-ae\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\cs-cz\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\en-il\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\hr-hr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\fi-fi\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jre-1.8\lib\images\cursors\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.People_2019.305.632.0_neutral_~_8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Home\RTL\contrast-black\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\fr-ma\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\zh-tw\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\bn_IN\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\libs\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\ja-JP\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	2026-07-08_c2004c7adf58ea97e66a9b252c30e294_amadey_darkgate_elex_smoke-loader_stop.exe
File created	C:\Windows\Logo1_.exe	2026-07-08_c2004c7adf58ea97e66a9b252c30e294_amadey_darkgate_elex_smoke-loader_stop.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\vDll.dll	Logo1_.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-08_c2004c7adf58ea97e66a9b252c30e294_amadey_darkgate_elex_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-08_c2004c7adf58ea97e66a9b252c30e294_amadey_darkgate_elex_smoke-loader_stop.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
2760	Logo1_.exe
2760	Logo1_.exe
2760	Logo1_.exe
2760	Logo1_.exe
2760	Logo1_.exe
2760	Logo1_.exe
2760	Logo1_.exe
2760	Logo1_.exe
2760	Logo1_.exe
2760	Logo1_.exe
2760	Logo1_.exe
2760	Logo1_.exe
2760	Logo1_.exe
2760	Logo1_.exe
2760	Logo1_.exe
2760	Logo1_.exe
2760	Logo1_.exe
2760	Logo1_.exe
2760	Logo1_.exe
2760	Logo1_.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3140 wrote to memory of 5084	3140	2026-07-08_c2004c7adf58ea97e66a9b252c30e294_amadey_darkgate_elex_smoke-loader_stop.exe	86
PID 3140 wrote to memory of 2760	3140	2026-07-08_c2004c7adf58ea97e66a9b252c30e294_amadey_darkgate_elex_smoke-loader_stop.exe	87
PID 2760 wrote to memory of 724	2760	Logo1_.exe	89
PID 724 wrote to memory of 4048	724	net.exe	91
PID 5084 wrote to memory of 4896	5084	cmd.exe	92

C:\Users\Admin\AppData\Local\Temp\2026-07-08_c2004c7adf58ea97e66a9b252c30e294_amadey_darkgate_elex_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-08_c2004c7adf58ea97e66a9b252c30e294_amadey_darkgate_elex_smoke-loader_stop.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3140
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD513.bat
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5084
- - C:\Users\Admin\AppData\Local\Temp\2026-07-08_c2004c7adf58ea97e66a9b252c30e294_amadey_darkgate_elex_smoke-loader_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-08_c2004c7adf58ea97e66a9b252c30e294_amadey_darkgate_elex_smoke-loader_stop.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4896
- C:\Windows\Logo1_.exe
  C:\Windows\Logo1_.exe
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2760
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:724
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4048

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MicrosoftEdgeUpdateBroker.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateBroker.exe
Size 126KB
SHA256 37ef32f9e429f14a21ed058855bfffb0f673d1d35a531c13b71c380b21e4b987
MD5 d66d09cb884803bd29b4d01a209097d8
SHA1 3ff49c31cf9875bad072f311bbfc89c60f1c52a2
SHA512 4a22f45c1b9a13202ccc80be85e08fc69e2750e1ddb9f54f21b6ea270df2f126c4d5b541083b426e658aa0fede965feb48a50bfecb282090cf719ab2ead171d0
SSDEEP 3072:SgkF3pzYCkuRieOVETT+jYPnau3fVGAhoRqzB+NkGHS2:StFpzYCk3ET+Tu3fC0zB+JHv
TLSH
T1F9C39D1376D184B2E4B1593108A5DDB1493FFD621E50DE6B33D82A3E0F316C1DE2AA6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SyncConfirm.exe

Path C:\Program Files\SyncConfirm.exe
Size 536KB
SHA256 f6190dc014ce7fd7c434e0aa4da668aac43b50f526a282ad6e8bb1defb2bdf94
MD5 1fbaf1da45f07e5ca37e71f3ae1b606d
SHA1 94d08b965ce0a6a9fed1507926bb80bcc21c1756
SHA512 acdf09d3956ad9badaafe08feb26c858d5eb1dd53ec6dc897bdb4a184c9cfb563f4dec1dab3306f11e8787eeea189cca5677c9c9d34218182feead987aaafe87
SSDEEP 12288:Op/qIu3OnY9yTj5CJ32DJsIa+STTsqdBFOLVvaOMTrJxqx9He6pkyu6pMf60ur:OpkOYETj4J32DJszRTTXdBFOLVFS0Heu
TLSH
T179C4234C139E274FD29E10B06DAB4AD550F7FC27F7A3655AA87C3C0DAA9C78A431C950
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcredist_x86.exe

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
Size 482KB
SHA256 2c7657fe57ec426599ef848815689264720ffed5a0f9a5d33d07cafabeb43bf3
MD5 ef2faa6fbcf12b63da1cf3e9283ad1cf
SHA1 2032ddc0f6ed9560583f70a279ca858b1e746409
SHA512 46b169f4142d45197207d0015119145c12eb01150c6b742c5f3792b01d2e23bda9e25e181144f4b9963eefcff7ccb9d37fad4d27b044753325ceeaea330fa00b
SSDEEP 12288:LxpKqIOkU8AMXE9B7PElZlP41N+4PUWfo:FpKBOkUhMXcBwc04nA
TLSH
T10EB47D31A6A04037D6F106B3F915D2307E7DA2187B1194AB9394AE2D3EB8597A7F7303
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

$$aD513.bat

Path C:\Users\Admin\AppData\Local\Temp\$$aD513.bat
Size 830B
SHA256 0bad40334f34139bed3f03c81a6ac67e9c0406ac08fa52acee4c4bca9cde4129
MD5 16d661b1b6a0cc26f5c79ebb247731a6
SHA1 a5364bb558838d86b0343fd56ad2cc1cfcd8c723
SHA512 d1ead430737eb83da8b083ef801e2ca8db7181648cc244980b67c26cbdf94c164de83403b3c0accece4943cd48965e775b44060aa72a5b343eebb2a7750d0b9e
TLSH
T17D01C80242FBED750516B0064BF51C8EE5DA769A3B9A33337B12D71C51E2289E4F7207
MD5 SHA1 SHA512 TLSH

Submit Download

2026-07-08_c2004c7adf58ea97e66a9b252c30e294_amadey_darkgate_elex_smoke-loader_stop.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-07-08_c2004c7adf58ea97e66a9b252c30e294_amadey_darkgate_elex_smoke-loader_stop.exe.exe
Size 534KB
SHA256 adb2322034128b81c03aa31614ed0fe2015c1c9be0fdc6e9a642daef5d64557b
MD5 a918acc1fb8688fdb0c4b8038f8688ec
SHA1 685d9db1fe41f4545a13e3de3749ee7cbd1122b7
SHA512 bec685b32d89c7e671e1fc33f914bd90a8179e31d70fadc891abbc63255442c85448253d9adfdbaa2e27d2f511155fd540aee51f764a4e573a04b49c44db30b0
SSDEEP 12288:AIlsAkjIf/WbGH/+8zoXEyO4pV1JTcgoLjAC5gS:AHAL7+8zuEgdIgoLjApS
TLSH
T1CFC49EB6BA50C172C10255704D26EB6894B9DEF03F304AE3F7D83E6D6EB26D16C3650A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rundl132.exe

Path C:\Windows\rundl132.exe
Size 27KB
SHA256 a09188048ad8de6fb0757cad9717dc5946cef743fb2022dd8fe4fb21d1f0f165
MD5 fa0667a010fcdbfd8d05a6e484156d50
SHA1 5958b3cd0ea140e984f2e132acaac98d218600da
SHA512 cfe6b35901c8751eaf586a54b2e2cea3dda8c19f6d57d8d5eff83d85a552ea8a2f98bd03255929184e78bb8e326e6805b439d93ca6887d0e6605b31f66c8ef53
SSDEEP 384:MJbwP1Gt5M0zhIV/DZ3KZp7JcTO4yf9KFL/KaUUqd3qR+FlYTj9QTN0wpD9p5Cs:gG16GVRu1yK9fMFLKaTxsujCT7pZpY
TLSH
T188C2D1F027DA7695C04012F20CDB4BA688F27D61DEC93A9B7B787D4B0CB0A04856760B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_desktop.ini

Path F:\$RECYCLE.BIN\S-1-5-21-668679576-120646659-2289335452-1000\_desktop.ini
Size 8B
SHA256 f2d2cf0c992b9fe521af1cba2f911d62494882e796a4cda4da2dba61b4d669d5
MD5 7ab5029d7f5c322ad04162b760b22eb3
SHA1 d98fd41f697f31766fe7bb680b6626b274b5622e
SHA512 af61fa934dfc9442ccf4e9560e13597e7d9ac056c0d9cff10df8a5d769eab97e87c659c434616b4afdd2e059a4042c65fbf8dde35ab5e4cfa6fd0a9ed27d52cf
MD5 SHA1 SHA512

Submit Download

memory/2760-27-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/2760-33-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/2760-37-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/2760-20-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/2760-358-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/2760-1247-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/2760-5036-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/2760-9-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/2760-5551-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/3140-0-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/3140-13-0x0000000000400000-0x0000000000435000-memory.dmp

Download