a72a260288bf662f334bd514f33f8a0aebd789cccfee765eb876f5b207a97ba2

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/08/2026, 11:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-09_a769feffb88e52523eff2d255368e434_amadey_darkgate_elex_smoke-loader_stop.exe
Size 1.9MB
Sample260809-m6ek4aab63
SHA256 a72a260288bf662f334bd514f33f8a0aebd789cccfee765eb876f5b207a97ba2
MD5 a769feffb88e52523eff2d255368e434
SHA1 5b1aa80c0ecbb8eb31b1a8a9a1f3b6ff71bc7807
SHA512 95caca1c30821684a53a833e7d5806f9294989cb86d9b22690abbdc00f131fff33e3492076ca60a0f2f23f1411346884bf8d639f611783f35ad5a1e2a7972a50
SSDEEP 24576:LTmj83fXBVE1bSgouvz0ZRHkFfenxyQZXS7gZnQh2NIq:LHfBOSgouvAeFfenxyQZXS7uQ0NIq
TLSH
T1FC954B1227F9412AF0FB2B78DAF943646A727C659D39C40F1286157E2DF4A50AB32733
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery spyware stealer trojan

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	2026-08-09_a769feffb88e52523eff2d255368e434_amadey_darkgate_elex_smoke-loader_stop.exe.exe

Executes dropped EXE 1 IoCs

pid	Process
2756	2026-08-09_a769feffb88e52523eff2d255368e434_amadey_darkgate_elex_smoke-loader_stop.exe.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-08-09_a769feffb88e52523eff2d255368e434_amadey_darkgate_elex_smoke-loader_stop.exe.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\elevation_service.exe	2026-08-09_a769feffb88e52523eff2d255368e434_amadey_darkgate_elex_smoke-loader_stop.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\RCX3A5B.tmp	2026-08-09_a769feffb88e52523eff2d255368e434_amadey_darkgate_elex_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\RCX45AB.tmp	2026-08-09_a769feffb88e52523eff2d255368e434_amadey_darkgate_elex_smoke-loader_stop.exe
File created	C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE.ico	2026-08-09_a769feffb88e52523eff2d255368e434_amadey_darkgate_elex_smoke-loader_stop.exe
File created	C:\Program Files\Mozilla Firefox\default-browser-agent.exe.exe	2026-08-09_a769feffb88e52523eff2d255368e434_amadey_darkgate_elex_smoke-loader_stop.exe
File created	C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\PeopleApp.exe.ico	2026-08-09_a769feffb88e52523eff2d255368e434_amadey_darkgate_elex_smoke-loader_stop.exe
File created	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe.ico	2026-08-09_a769feffb88e52523eff2d255368e434_amadey_darkgate_elex_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe	2026-08-09_a769feffb88e52523eff2d255368e434_amadey_darkgate_elex_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe	2026-08-09_a769feffb88e52523eff2d255368e434_amadey_darkgate_elex_smoke-loader_stop.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javaws.exe.ico	2026-08-09_a769feffb88e52523eff2d255368e434_amadey_darkgate_elex_smoke-loader_stop.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe.exe	2026-08-09_a769feffb88e52523eff2d255368e434_amadey_darkgate_elex_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\RCX530C.tmp	2026-08-09_a769feffb88e52523eff2d255368e434_amadey_darkgate_elex_smoke-loader_stop.exe
File created	C:\Program Files\Java\jre-1.8\bin\kinit.exe.exe	2026-08-09_a769feffb88e52523eff2d255368e434_amadey_darkgate_elex_smoke-loader_stop.exe
File created	C:\Program Files\Java\jre-1.8\bin\unpack200.exe.exe	2026-08-09_a769feffb88e52523eff2d255368e434_amadey_darkgate_elex_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\RCX615B.tmp	2026-08-09_a769feffb88e52523eff2d255368e434_amadey_darkgate_elex_smoke-loader_stop.exe
File created	C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE.ico	2026-08-09_a769feffb88e52523eff2d255368e434_amadey_darkgate_elex_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe	2026-08-09_a769feffb88e52523eff2d255368e434_amadey_darkgate_elex_smoke-loader_stop.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe.exe	2026-08-09_a769feffb88e52523eff2d255368e434_amadey_darkgate_elex_smoke-loader_stop.exe
File created	C:\Program Files\Java\jdk-1.8\bin\idlj.exe.ico	2026-08-09_a769feffb88e52523eff2d255368e434_amadey_darkgate_elex_smoke-loader_stop.exe
File created	C:\Program Files\Java\jre-1.8\bin\javaw.exe.exe	2026-08-09_a769feffb88e52523eff2d255368e434_amadey_darkgate_elex_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\RCX6D70.tmp	2026-08-09_a769feffb88e52523eff2d255368e434_amadey_darkgate_elex_smoke-loader_stop.exe
File created	C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\fmui\fmui.exe.exe	2026-08-09_a769feffb88e52523eff2d255368e434_amadey_darkgate_elex_smoke-loader_stop.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe.ico	2026-08-09_a769feffb88e52523eff2d255368e434_amadey_darkgate_elex_smoke-loader_stop.exe
File created	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe.ico	2026-08-09_a769feffb88e52523eff2d255368e434_amadey_darkgate_elex_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe	2026-08-09_a769feffb88e52523eff2d255368e434_amadey_darkgate_elex_smoke-loader_stop.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe.ico	2026-08-09_a769feffb88e52523eff2d255368e434_amadey_darkgate_elex_smoke-loader_stop.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE.ico	2026-08-09_a769feffb88e52523eff2d255368e434_amadey_darkgate_elex_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\notification_helper.exe	2026-08-09_a769feffb88e52523eff2d255368e434_amadey_darkgate_elex_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe	2026-08-09_a769feffb88e52523eff2d255368e434_amadey_darkgate_elex_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-08-09_a769feffb88e52523eff2d255368e434_amadey_darkgate_elex_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe	2026-08-09_a769feffb88e52523eff2d255368e434_amadey_darkgate_elex_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE	2026-08-09_a769feffb88e52523eff2d255368e434_amadey_darkgate_elex_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe	2026-08-09_a769feffb88e52523eff2d255368e434_amadey_darkgate_elex_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\148.0.3967.54\BHO\RCXB6D7.tmp	2026-08-09_a769feffb88e52523eff2d255368e434_amadey_darkgate_elex_smoke-loader_stop.exe
File created	C:\Program Files (x86)\Windows Mail\wab.exe.exe	2026-08-09_a769feffb88e52523eff2d255368e434_amadey_darkgate_elex_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-08-09_a769feffb88e52523eff2d255368e434_amadey_darkgate_elex_smoke-loader_stop.exe
File created	C:\Program Files\Java\jdk-1.8\bin\serialver.exe.ico	2026-08-09_a769feffb88e52523eff2d255368e434_amadey_darkgate_elex_smoke-loader_stop.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE.exe	2026-08-09_a769feffb88e52523eff2d255368e434_amadey_darkgate_elex_smoke-loader_stop.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe.exe	2026-08-09_a769feffb88e52523eff2d255368e434_amadey_darkgate_elex_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\RCX7D0B.tmp	2026-08-09_a769feffb88e52523eff2d255368e434_amadey_darkgate_elex_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Windows Mail\RCX82E8.tmp	2026-08-09_a769feffb88e52523eff2d255368e434_amadey_darkgate_elex_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-08-09_a769feffb88e52523eff2d255368e434_amadey_darkgate_elex_smoke-loader_stop.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE.exe	2026-08-09_a769feffb88e52523eff2d255368e434_amadey_darkgate_elex_smoke-loader_stop.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe.ico	2026-08-09_a769feffb88e52523eff2d255368e434_amadey_darkgate_elex_smoke-loader_stop.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\View3D.ResourceResolver.exe.ico	2026-08-09_a769feffb88e52523eff2d255368e434_amadey_darkgate_elex_smoke-loader_stop.exe
File created	C:\Program Files\Java\jdk-1.8\bin\servertool.exe.ico	2026-08-09_a769feffb88e52523eff2d255368e434_amadey_darkgate_elex_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	2026-08-09_a769feffb88e52523eff2d255368e434_amadey_darkgate_elex_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	2026-08-09_a769feffb88e52523eff2d255368e434_amadey_darkgate_elex_smoke-loader_stop.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe.ico	2026-08-09_a769feffb88e52523eff2d255368e434_amadey_darkgate_elex_smoke-loader_stop.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	2026-08-09_a769feffb88e52523eff2d255368e434_amadey_darkgate_elex_smoke-loader_stop.exe
File created	C:\Program Files\Java\jdk-1.8\bin\idlj.exe.exe	2026-08-09_a769feffb88e52523eff2d255368e434_amadey_darkgate_elex_smoke-loader_stop.exe
File created	C:\Program Files\Java\jdk-1.8\bin\kinit.exe.ico	2026-08-09_a769feffb88e52523eff2d255368e434_amadey_darkgate_elex_smoke-loader_stop.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe.ico	2026-08-09_a769feffb88e52523eff2d255368e434_amadey_darkgate_elex_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\RCXC4A8.tmp	2026-08-09_a769feffb88e52523eff2d255368e434_amadey_darkgate_elex_smoke-loader_stop.exe
File created	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe.exe	2026-08-09_a769feffb88e52523eff2d255368e434_amadey_darkgate_elex_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\RCX519F.tmp	2026-08-09_a769feffb88e52523eff2d255368e434_amadey_darkgate_elex_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\RCX7939.tmp	2026-08-09_a769feffb88e52523eff2d255368e434_amadey_darkgate_elex_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\RCX43A1.tmp	2026-08-09_a769feffb88e52523eff2d255368e434_amadey_darkgate_elex_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-08-09_a769feffb88e52523eff2d255368e434_amadey_darkgate_elex_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\RCX3B77.tmp	2026-08-09_a769feffb88e52523eff2d255368e434_amadey_darkgate_elex_smoke-loader_stop.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe.exe	2026-08-09_a769feffb88e52523eff2d255368e434_amadey_darkgate_elex_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	2026-08-09_a769feffb88e52523eff2d255368e434_amadey_darkgate_elex_smoke-loader_stop.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\onenoteim.exe	2026-08-09_a769feffb88e52523eff2d255368e434_amadey_darkgate_elex_smoke-loader_stop.exe
File created	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\codecpacks.webp.exe.exe	2026-08-09_a769feffb88e52523eff2d255368e434_amadey_darkgate_elex_smoke-loader_stop.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-09_a769feffb88e52523eff2d255368e434_amadey_darkgate_elex_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-09_a769feffb88e52523eff2d255368e434_amadey_darkgate_elex_smoke-loader_stop.exe.exe

Modifies system certificate store 2 TTPs 3 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25	2026-08-09_a769feffb88e52523eff2d255368e434_amadey_darkgate_elex_smoke-loader_stop.exe.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 040000000100000010000000d474de575c39b2d39c8583c5c065498a0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000007431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25190000000100000010000000ba4f3972e7aed9dccdc210db59da13c92000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	2026-08-09_a769feffb88e52523eff2d255368e434_amadey_darkgate_elex_smoke-loader_stop.exe.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 5c000000010000000400000000080000190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc36200000001000000200000007431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8040000000100000010000000d474de575c39b2d39c8583c5c065498a2000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	2026-08-09_a769feffb88e52523eff2d255368e434_amadey_darkgate_elex_smoke-loader_stop.exe.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1804	2026-08-09_a769feffb88e52523eff2d255368e434_amadey_darkgate_elex_smoke-loader_stop.exe
1804	2026-08-09_a769feffb88e52523eff2d255368e434_amadey_darkgate_elex_smoke-loader_stop.exe
2756	2026-08-09_a769feffb88e52523eff2d255368e434_amadey_darkgate_elex_smoke-loader_stop.exe.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1804 wrote to memory of 2756	1804	2026-08-09_a769feffb88e52523eff2d255368e434_amadey_darkgate_elex_smoke-loader_stop.exe	85
PID 2756 wrote to memory of 1780	2756	2026-08-09_a769feffb88e52523eff2d255368e434_amadey_darkgate_elex_smoke-loader_stop.exe.exe	95

C:\Users\Admin\AppData\Local\Temp\2026-08-09_a769feffb88e52523eff2d255368e434_amadey_darkgate_elex_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_a769feffb88e52523eff2d255368e434_amadey_darkgate_elex_smoke-loader_stop.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1804
- C:\Users\Admin\AppData\Local\Temp\2026-08-09_a769feffb88e52523eff2d255368e434_amadey_darkgate_elex_smoke-loader_stop.exe.exe
  C:\Users\Admin\AppData\Local\Temp/2026-08-09_a769feffb88e52523eff2d255368e434_amadey_darkgate_elex_smoke-loader_stop.exe.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - System Location Discovery: System Language Discovery
  - Modifies system certificate store
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2756
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe"
    3⤵
    PID:1780

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

AcroRd32.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
Size 3.1MB
SHA256 2804d86fa13d07d8cf1f593a4c90336be09141d69710e9c7ffdb486bc0f5e871
MD5 633b33e14c8c1ff81e5248c08a8411fb
SHA1 2cc967d7e284336b78841b49bb9dbcd15b5a1c2a
SHA512 9d08396f43413f2fbe0d25b56d65958e7ab1a2ca1a4a67e87ed35b6ab3296cdb1a712efb2f23a2b1808edb1972d85f3ee5c52fc8f76afdf95d5960e1c597844a
SSDEEP 49152:45kPneu2zHI2DDTfiUEWo6zuEz439z99akTBc4O8b8ITDnlT4NvJS:45kPDKDTfiG/nzU90m
TLSH
T162E5075662C8C1EBE1642070CC69BBF910146DB8DBA28DD7BD407F46B9307D29933A7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

arh.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe
Size 836KB
SHA256 366fdccb7e337e51a33eff7f2e0b6ef79bdccd8582e34f18d21371163facec48
MD5 9cd5e1f00fd9e503430c2dfd41871803
SHA1 55c93dd69c4ef30ee5277502c73f6f4aabed01e2
SHA512 b45cb28692538618a0ae73dcdbd2140e7a3a4d8b15d011efd0e3c6af3ac100f1f3f21f6f708f44d61319a7237a9bee668d50e1d0fddd704c8db36fcd0babe2ff
SSDEEP 12288:P/7mqlEolRY2lpEAPZc7kU1M901IxQELcv2M6w5ibar/bYmIjE72:P/7pzbPZc7kUnaNcvNnesB72
TLSH
T10805AEC87ACDD751C0ACDA3500DA5EBB727B89351943050BB25CB36A1C396C4AD6BB3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DisabledGoogleUpdate.exe

Path C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe
Size 6.4MB
SHA256 5593cc0789f6789b5c3a4a78026a9ae5cb6ecc3a410c3a16047b119ea1e386e1
MD5 925cc4907cf0af0289249618268fcea4
SHA1 6fb31780f362157ad5b6ca9c174fc6b7d786f0b2
SHA512 acd280060dc7d1824bb2ae4b92944330b24ec692d2078987c98c1bd898803613121655c85f45f0a49e1d637999fdd8f1d0529aa74229e492fe4090d7c5cfab34
SSDEEP 196608:XlTmul+Gog1P9fIlOuz6IgF+I3m2MXP6HG8Qzb:XUu7ognqO86IgF+qbM/6HG8QH
TLSH
T1D3668D23E5E08035F5F732766C2C6B3959327BA29F3146CB86946C946FB42D3243936B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ieinstal.exe.ico

Path C:\Program Files (x86)\Internet Explorer\ieinstal.exe.ico
Size 3KB
SHA256 dd8074940b2a1e8d0ad513e7c6e2a0d0b11a857893f11dc77387800ca272e970
MD5 f48ab39db9ca4956776a50b86a8e8c81
SHA1 c8f6dc9e0c0ffaa61075e9d02ffe0a1a319dd842
SHA512 c122c826c7146e86238bb8098c91abfb8270f72e4cbb8af9d5664eb98a181376f8e5cbdfea31050c9df1d895225d6c70a06810c91d40f24b1798936682c7897c
TLSH
T1B2619526B216ABA5C11A41308C8F1A2E1632AE4184A6A0010B753983D27E63BE33687F
MD5 SHA1 SHA512 TLSH

Submit Download

msedge.exe.ico

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge.exe.ico
Size 3KB
SHA256 4785d266a2c476e0948100ea80f927d16389f7718b540daf0488457ba01958b0
MD5 cc055af6d5fab0514052a985d406293d
SHA1 6c856938f56c75841cd93bbe467d624e2bda6e07
SHA512 4f3387c19d12e5154841d97b552c8c47e107a4bc6ac376fe7a60493d4013572be61886d7ee8e40acc62653c97b3a761097f8dd3d97d72d361c38775ec512eb63
TLSH
T10F61C864933541DACB8DDAFF541843A1AE22C875D73FC4868271E9A33DA92FCA800C2D
MD5 SHA1 SHA512 TLSH

Submit Download

msedge_pwa_launcher.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_pwa_launcher.exe
Size 2.2MB
SHA256 58369914ab17610c67db44e0c7c361543e6381b73d7d017f4870ce04701f9684
MD5 c707dae218a0b75b578208b4a28b6ac6
SHA1 a4aad9ff7784109a19b71aed5d4a9885af4a5182
SHA512 5fbc47be01e776d1cb0790da98932b2881578cf22260abb025f5864f7a741c49baca7bf2dd7f97f63ea8dc33e380906f622247ec7c90cb6d96ee78c7467fb93a
SSDEEP 49152:fBqsXwcvTiDKZYKQOitU/03nmdXa5o5QPQ+:jJ/03mdX+PQ+
TLSH
T1A7B59D07F696C0A5D05DC27ACF768731E661BC614F5199DF0284BB292EB6AC40F393E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\notification_helper.exe
Size 2.0MB
SHA256 bd1b6e443dbace856b94bd270b0e73169750c43ffd25bdc8e3a1067994c54dfe
MD5 3f5db6ea53e92b5c77a637a5ce8b852f
SHA1 eaf9cedef246fefbd15e22686c754566a53eae26
SHA512 5e7002dcb034e66cbec9a977f762b9d90010fd3df1f2b6f4dc01b261b6365f9c9e5ca4fe086a55211f281e5b99521727e8b16635c00b6074454a371525425b0c
SSDEEP 49152:8ARgJFOIUlZXSru0WjiMgCv1jn1ChuADSi:gFOIUlmWjN1jo
TLSH
T11DA59E87BE9A81D5C029D074CADA4625EE727C510B2066DF0AF8721B1EB7ED45F39F20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ie_to_edge_stub.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe
Size 1.2MB
SHA256 09a9be9caed49872dbdc7447ec59302f038c73a551f417a16bb27d5af380f8bb
MD5 6abf946ea0cbaf8f13fe9955ab8d8495
SHA1 618c1ecb6ca57f3563dbd7c7f8ed6853cdb844ef
SHA512 84e1f95202247a13a0e1b92e93a2034ab2c427381749a148c542ced1a2a61924b17cc671544dd36c8f8649c386cbb91bd9c56dba8f5aea2280633c0af3c08ae1
SSDEEP 24576:4ji/Y/2/+FPoDj6nYcioc+KVnx86n9kAJ9tA3L:sO7/+FI6nYNV+OT9t2
TLSH
T10F55AD8972A8C6B5C03A84319A4142E5EAED78534B3A95AF8370177D2FF69DD0F39730
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge_proxy.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe
Size 2.2MB
SHA256 ec31dd0cffdbadb9b618dee816811949d8bb0db462d154a2f1582639044ec398
MD5 595736f6171d48cc51f96d217a461125
SHA1 7ccb3281a306e84897791b37bcc754cc8734c227
SHA512 0351a956ced0dbd7ec0c5ebd80f5796125a6a95c86a2d4a8cce532f90d2508a18ac70054c3a8436ed61830e36909620d11da79ab8932898361c3f8bf88b48273
SSDEEP 49152:khX39cdkH4fehjvHHKTdfxINPEt99G2Bo7EukU1a:VkeyjvnORmE
TLSH
T122A59E43B6C800D9F06AC174C6578525EAA3BC450B29B6DF06407A5B2EBFED45F3E722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge_pwa_launcher.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe
Size 2.5MB
SHA256 6b33582d127307667da19741b218729efe6599f0afbbc6420bcb5498c8aa54f8
MD5 b70ad55ded149b1ea89ac014ab292ed8
SHA1 d9ab376d53ddcac139edf1bf3d88fbbac20f7a34
SHA512 465c4af1a5dd88fe2ae10ca84309a61f13d15f95a808c6d4159bab78fde95708ff19f723613a7cd4dfa5bbe70ef52038bcf509b93c64c4c70bf60c59b14e2794
SSDEEP 49152:A/GKI0QM8koCnTb3wmJRZGu6qG13O7Q7gLYduZrSdHBAVfb:A3QFkoCn3LR6YjwA1b
TLSH
T12EC59D03F68540E5F05DC278EB678B3DAA617C955F24A6DF02947E253EB2AD04B3D3A0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pwahelper.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe
Size 2.1MB
SHA256 f83a3eee382ee0076a3cf7b03a784c957c191de59ee3ce2da6084c36912c6640
MD5 0e59fafbe33ab9c1e538253104f29ee8
SHA1 307224a4f15b976cef1a4a26220e41a571c7fe8d
SHA512 34cbf71907ccebf67805e01053821499e9004d16ebcab68a89de5a8df203173068d4802c13eb454dc72190ca9c367ccc5da62285201ee70d390edce9bf323bac
SSDEEP 49152:vkjxP941B9MY2fF8FhmS86IUJWQn+6h27d6:vkjxP9u9MbOjjsts
TLSH
T106A5AE07B2CD80D4D068D1B9C6568676DA72BC424B3566CF0B60BA992F37BF41B3D3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MicrosoftEdgeUpdate.exe.ico

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe.ico
Size 3KB
SHA256 2e039a7ce5af3783a3d522d27112bfe7a1dac319ed5061de3bef89790d5ad63e
MD5 6dd3d92bc5e7a45a2001a77bcc1c1fc0
SHA1 e942bc4b46d6fc683babd5d21da30f195aecadbb
SHA512 c8d9b2166f432da32f91d8de3162c74590c5753757c6a00bf9835c7c096c29bbf9ece24eb8688e2b87f137129fdaa9be3770a4eee1b99258e39247a3de64f6c2
TLSH
T189616E7C0F7CDC6FEE9230B9624A0A4132B0CDE15670A6D756127806813DAE2D9F4F9E
MD5 SHA1 SHA512 TLSH

Submit Download

MicrosoftEdgeComRegisterShellARM64.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe
Size 934KB
SHA256 474d57b46b67ae4bedd11bbde23cb8787ed25664a81d233668fc7ad771177712
MD5 6d23316824f2dc583b615af26d52a9ba
SHA1 200a518f2a580b8524d15a15cb4624c7f7c5348e
SHA512 c9b8d0c940968a9ae6e0bd3bf51f4425bae1436f52d2db4f3d93f062ff021a6ff901fc9540c5e657c18c0ef659ba4de251349c0b3c1730aca4eb7667248c6f91
SSDEEP 12288:cqRLDpJwV01ONZDN5orrLCF9MJnPSSl3Uf93h646HHyw5iKXXHg:cqtXAKONP5orr09MJPSSl3Ulh64QVXXg
TLSH
T1EA15AF1C78D7609BCCEA8E799B925FE0A33AAC3187325C1B7E53534C5C257804DE16BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

identity_helper.exe

Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\identity_helper.exe
Size 1.8MB
SHA256 e8d1822eeee75f9bbeb89c572b11cad21a4509925db4eefbb0e634d5750f1010
MD5 e5c6fdb6e458b776624257ce552cb87d
SHA1 dabf25e001cc462879cd1033eab28f8081a60ad2
SHA512 041042257b33c543437617c0fdd61d9c5c11c3110791a5ce8a6486b446134c54cec3b8e9a292824ed7ef6785bbaaec6c9c59d87ee212d7ca33f160c03809c476
SSDEEP 49152:E0atAIHhp32BTYzno7fvTqJdbPrCx9pG7:3N7fv0dbWG
TLSH
T11B859D0BF68440E8F06DD438CBAA4125E9627C474F60EADF0690F69D1F769D86B3B760
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe.ico

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe.ico
Size 3KB
SHA256 3d275500cf3ebda5e878d81dcbbaa53528397ccbe631aae8fae60de1ffefccf7
MD5 70f7eb6f0e42805134583ac203c2dfd9
SHA1 fc513300d133a9b8a45da81a72a10b937e909190
SHA512 bf3126bfc018c3890afc1a105db52b9b332ed24228cf1a8e1df715287ad51161ff3fa94c88ef2cbcdda9a10bdc992691b9171fa07cfb2e8b71c35d12605a1179
TLSH
T1A46144423D3ED9E5C80005348C5F0FB80A315F92B810A30287BBBD6ED9B8754E61E35E
MD5 SHA1 SHA512 TLSH

Submit Download

identity_helper.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
Size 2.1MB
SHA256 ffeab7f5518ff8cc941d6ff66194b957d8fe6384df6f9c76321f40d33786cfe7
MD5 de13a15894c048844088ba2917dc16bf
SHA1 98bb34f6542a29c408535a615d113b4acd52f8ef
SHA512 47974e4c6d7ca3467a9c9becfd5e0b17edf9d73f12d0c9766e3fe798ef2ab644d7d6ee9d789fbbb44fb62d134bca8b4ce3b53545052adf25ee353c4285c9834a
SSDEEP 49152:bvN3SWclwTjODvwZ2XuTjPb33g9gZLfCdW9HTlXrk9dBB:p3SWfII4Ds9Ol
TLSH
T1CDA5AE17B7AA40E9E019C0B4C652463AD9B27C494B20A6FF0657BB1A3E77BD05F7D320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgewebview2.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe
Size 4.1MB
SHA256 6427fb28978e366233d897b3c2474eb91f982962cdead1f45add104620bc84d3
MD5 06e61e9cdafc4d56ee6ae5e77c331cd1
SHA1 14d6bd33ab29e312b80d3c4cc9fe4bfdd895b0eb
SHA512 480ebd7b3a542b1aec36492f0d5d0a3531e207d2a105119f501b2c36bffc8a2811b886ae571d19e2d9b5d8342f6be76622ec0e2a8dc0103d9649da1e106d2fde
SSDEEP 49152:wu2BI0miUgMCVy2Q3BuZgk07G0auOj85q7aGScYbb6YErz7z4AkOuaRoBISCaQZy:w/BI0miUgMCVyV37o/Yhy8OnZy
TLSH
T103166A03F29980D4D059C474DF4A8232EBA27C8987F562EF3680B6D52A77ED47B39724
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pwahelper.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe
Size 2.1MB
SHA256 bc44a19da1fc8d54f94330afda0b26e9841ce8a3adcf960a61e6381f80cb5325
MD5 3a9739058e08c656569573538044af80
SHA1 04d7697a625602aae0b868e5220d7f3fc60e3cc4
SHA512 2015eff6238dfcaa2c129152cf66a64c9349a380ac5287df7011533b8945e7e3bb2f669e660d56f93ee08426fe04cf5f36309f9e75edab6140f607c75205db92
SSDEEP 49152:hR1PwcDLIUDldNY2fF8FhmS86IUJWQn+6h27d6:hzPDldNbOjjsts
TLSH
T116A5AE0BF6F948D5D06CC0B5CA42853BD9B27C120B21A6EF1645B7391EB7AD49F3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe.ico

Path C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe.ico
Size 3KB
SHA256 44ae793c391e8578709e181e83cb820caaa10c08844440885d969a6c839b8a2b
MD5 0becb6bcbe9400e6d9441ceef104e743
SHA1 2f4e955a4c3c11236501b5c7ea36a392a0891ed8
SHA512 f7fcfe5f5274d2a27f233e5e67361988b8176497a9711767dac1bf0079a4b6cf5a1dd62750775b25c269169be6a1e3d1faa62207ddcc3d71dbd4e4c928b3017f
TLSH
T10461C6A9BF4080C1E21183F01C831B94A5052E6395EC9B3BB822BC878D7C8EA4038E3D
MD5 SHA1 SHA512 TLSH

Submit Download

7z.exe.exe

Path C:\Program Files\7-Zip\7z.exe.exe
Size 748KB
SHA256 616aa784fab20c50f21e661de1da8e7d559eb6bbab78e3fc67e33c2cabc6bf1c
MD5 1383829ef1a4846b60c2e6dd3371996b
SHA1 d3488c593772a288ce41bb0f85ac74262f83c55d
SHA512 1dbc7c98134a3002427c639d0349428b42b46306898a3a80efe66051ddfa0f04c1d93d80cd6eba01369bed30671fd96b90082ab489070aa440dd09ef792324a9
SSDEEP 12288:nLTbpPAfXr2hLFxECxphs2UmptXWjaVTw5iRoX:LTmj83fXBVER
TLSH
T1E1F47BBA2B998427C0ED0F3C40E40698B5A0485B8CC604177A5FADBDBDF861AB773775
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe.ico

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe.ico
Size 3KB
SHA256 2a5c5c2bc95c18eded222f0a38752717c1a6ad20e31bcda6472bbba77ed22fe4
MD5 de1dbafd46ca8d953c93a1c89766a8c2
SHA1 41ec8c2a24317bba7a64f4b60341307033edcda0
SHA512 06a89f154036252f396a9f2ac515c5e03e8dd54eb7ba6c3bd0159f693d85846c4ba1b29c0fdc83f14d8c9128f18db3ee27c73111891dc66f81d4fd14361e6ce2
TLSH
T1D861565C04E3ACB1D6E548B83235B2C460D88A364424C867A89D7AD7CE7D8D473DEB0D
MD5 SHA1 SHA512 TLSH

Submit Download

OfficeClickToRun.exe.ico

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe.ico
Size 3KB
SHA256 19306f3f899e8bae15a744924f1ebf2ce88624f5dd297e3993645fe8453adaa9
MD5 eeb23b93433af30f3061c261b8368401
SHA1 87e274077a0eff8831e33ed45b2f740b2d8545ea
SHA512 108348395c1833031a0abbcd7ea57194733e606fc79cfb6181d821e2e750b53c636977d802c0fce70d64157767d61b7df0cd30fa80535f0586417250eccc9e3c
TLSH
T15961C9FFE23099C8C1467E30408F06C03EBE0E4EBCD01E330A9030A82A39252B83EE01
MD5 SHA1 SHA512 TLSH

Submit Download

javaws.exe.ico

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe.ico
Size 3KB
SHA256 6c3d33a5119708abbf19b802f0908183037cd57a6394e45b7b234a76ef4b46c5
MD5 13fb0b721f1a5288bba88efe12d3c4c2
SHA1 08899424be48b76e1189abac3b067cd19398282d
SHA512 0fac8e02873e36841d4a6aaea8d4e7d2c034fad2a0fd18d9a0c8973126dd0d969bd108eaae19fae2f5bb3988bc77fd70405b80a76b68e398a880dbb496b9b3a3
TLSH
T17D61B974F1C12D6ADA1A1EB662BE3412E1B27F8207015A1C091FBB5C17FB32034D9EB9
MD5 SHA1 SHA512 TLSH

Submit Download

XLICONS.EXE.ico

Path C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE.ico
Size 3KB
SHA256 6454633b8c6a69aad48c3fc556c5e81cb5362db0c449b3f543bddfa41eba8d6b
MD5 fdb893a42e2519f60a9a943e687de76a
SHA1 9540510a3415d3bd50ec0416ec72af6809e8711e
SHA512 6c783bf16856305121dccb03fc749c66edaa063f730f274312bf29531b3abfd43c860196442f2e566800a383237c84a04a1bfea6fbb2be94004ada693b733c7c
TLSH
T1F861F7C443D872C3C8ECF234352AA51B5F95BA211410BE1D0EAC67C8BAA9E33FD5401B
MD5 SHA1 SHA512 TLSH

Submit Download

dbcicons.exe

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe
Size 831KB
SHA256 e81233ade698a169bd9d45156ff5d1285c6461ad8e3dc9639964b023d0fc88df
MD5 c3c410a5df7b9c2a136517aeb8ffd638
SHA1 330dcbf6f8c9ecb685a2a4211550b2d57455676b
SHA512 9d05d1107d9120f72965ddc210b8d1be96cfaa5ab547233a6ebcd3c2d576acc0abb0f57382569fc20cd41406414bb55087be5d9ef5a3718da77587b572537f9e
SSDEEP 12288:FvqupBCKbJlKo+jbG+vfyVlKy52IGw5ibStCyF:EWCLPG+3VeTayF
TLSH
T14F058E9DE0C6716FD59F08708C9702BDA4676E628D160B6A25BBF7CEAC7D0386E13134
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

misc.exe.ico

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe.ico
Size 3KB
SHA256 df2cca9b322f9432b3f3aa7b91a12dd5f22fd50e589e3107e066d99bdb071176
MD5 1e135e5bf5dbc0a82efa354c532e9c26
SHA1 b49dc6821a4e21d4c9f4385fb7658035a867dc82
SHA512 5e62520decd7db2d44477ee6e11da45bbb356138bf9482ba873b2cbaa69a44249b0515ee61a3438d835a18bb9fb2e229eca6d5a5da262938ac62245f539d8700
TLSH
T170618442693E89F8C5550530C9AF8FB00F341C17801095428733BEEFAEF5B60F62B668
MD5 SHA1 SHA512 TLSH

Submit Download

ohub32.exe.ico

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe.ico
Size 3KB
SHA256 063c8f44d23e1ebbe390ea320eee672c449f47333120b7abbd4a78094c613113
MD5 c8d18488a47a8054af9be67ebb94b6a2
SHA1 d231e824dd885833a1d6875741745994fc08ffa5
SHA512 1942ffe7db988342597c781a820b65b74dbf89862ea505285a1a96bafcfa48ac8f5b8f583aae0ccc0fe00bb3b80b897c61a87142f3b5f4274740fdf34256bf3e
TLSH
T127617E03F704D1A8C9883FF0F193022F32710D3614602F030B2DB888A9B10E8C426DBE
MD5 SHA1 SHA512 TLSH

Submit Download

pptico.exe.ico

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe.ico
Size 3KB
SHA256 3b07d1aaa1c9c27082d7811d694aae3d422d5d965a91b2d4b8ecda3a79f760a2
MD5 cdcde2807eee3a72d0b027bb11969739
SHA1 9b5bf494d53c68d3959d44c8e8cba399c55f2745
SHA512 aa91c211ec2ae00bc635958145b12ab7ae002e52f5ce7753e0790e96d9c61947a88b34b79e580772b53cc2492d5eb8bb69596d4de2106c1400ad64b4cceec645
TLSH
T1FA61AC5B72564B78C803D7719B228B5CF4AD7AE8E5324200C970F4762F24DB53B496BC
MD5 SHA1 SHA512 TLSH

Submit Download

sscicons.exe.ico

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe.ico
Size 3KB
SHA256 b2a350ffac5074add67fe974467351777915de5a319be7879ba15d1f6915a092
MD5 f142fd1b4cf10595f4565171b56388cb
SHA1 d8cff8a45fb7b27e34c9fc21eb672ff0a1d4076c
SHA512 3d045c3ceef64b1402605c9a0eb19d65c67f79553de4e21cdf935a0054475699102c25dab9cf3c36c9f9da0b81f350c81dc148726d0fd2e0717f961593dcd3d9
TLSH
T1F861C671A4323D58E54D573C8349B7D0E6064D852DF122AF312379BE0A741ABAAFF1D2
MD5 SHA1 SHA512 TLSH

Submit Download

wordicon.exe.ico

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe.ico
Size 3KB
SHA256 5bd706a18e0cf54197df7f1d5239f3e058652bfde372afcab230ee9b95ba14a5
MD5 bc5b17be640393be725d1c6bf384febb
SHA1 7acc0bcd224dce982aa2c109bd091b85179dcaa1
SHA512 ac17cf409d1652db87b91818d2a0f9a88136fef55389c2e7e3d2ec61b5d5012413ebf9dead6686fb0a16d5197a6af2c1fb6250a1dc46685c8350897ab6655eb4
TLSH
T18061E401D9E71E91FC23E2F6E60252F8327018780AD3112D79EC2ABAE5A4F0B30073C0
MD5 SHA1 SHA512 TLSH

Submit Download

vlc.exe.ico

Path C:\Program Files\VideoLAN\VLC\vlc.exe.ico
Size 3KB
SHA256 3b17b29b6c4e39fc36571f8e0795eae6559637529602ae7a37d5f8f6254d0500
MD5 0c328d41f4955cb0f6d408c63512c280
SHA1 3bf6219e411e79db50b8fb24557c692c5b82fcd0
SHA512 0185abba75dc735bdcc24a2d4003943c2a6a88e63eb806a058dbdc4ec4691ed03b7233e60d38e251ab6297f6eed1f446a9644b851d02fc14723551168436e762
TLSH
T18E6163703D321388C04B66BA86133A335E2A2FF61D43C6109B25728A2650FE1CA2D5B2
MD5 SHA1 SHA512 TLSH

Submit Download

wmplayer.exe.ico

Path C:\Program Files\Windows Media Player\wmplayer.exe.ico
Size 3KB
SHA256 a32208cf5c16d7223999e6ecf1c185bc88d519483ff56ad5ca5f2cc00e677307
MD5 44102aaaf107a6544eef73219f2c5f06
SHA1 c260d347155704cb817de08b8e72468897c446b6
SHA512 f575a3f5b83ccf08331c23419606414f487ad46c753ddd1b52cd15b89991e61f452f75b8162f88c29e0382c221ae4b9649560eda5138f82cc9a81b031f95ff3e
TLSH
T10A6167FD198B18C7E0054BF6C122AB421FC56CA15F071962EA80B54D3B316DF94D022D
MD5 SHA1 SHA512 TLSH

Submit Download

ArmReport.ini

Path C:\ProgramData\Adobe\ARM\ArmReport.ini
Size 782B
SHA256 8395f93b0e0240f5c79ce70bc2257f9cb0d92227b15f7724ba65b1c5c0b19625
MD5 29f1b2d1b6f9290138596cf180847e53
SHA1 ab496ce19c74cb15fe0b38807cf29db776336461
SHA512 bdadd50c6371d05f5d43fe7f95e8c02bd74842b0a7b982f571e80520d8748d67fc6f3912f9eb797edc476387168d597747b9a8705ded1ea473e5ee160c627227
TLSH
T1E0014C531AE81125F1B35A44DFF9947357327C975C2DC8AC90D8520E49E1940D5B27BB
MD5 SHA1 SHA512 TLSH

Submit Download

ArmReport.ini

Path C:\ProgramData\Adobe\ARM\ArmReport.ini
Size 634B
SHA256 4f9b2f699943dc7a42321fde879d884202e9b3bd8391519cc69bd83d8d485aae
MD5 4600ea83e72c40d5b6d25248895c4d66
SHA1 666d119fa0398adce7093f434fc15437ca6913c5
SHA512 08c1e1315bd3be50f47cce09a7b9c36aa38572495cdcbaa1053f6cc14af921437f3972c25d2d5c8df70a5b2e239a62d4cec6b3039de5b99e43b173eab4cb0bc9
TLSH
T108F0F41726E40254F1B72F22EBF990B357377C96AD2994BCA0D8031E48E1A45D5B27B3
MD5 SHA1 SHA512 TLSH

Submit Download

AdobeARMHelper.exe

Path C:\ProgramData\Adobe\ARM\S\22118\AdobeARMHelper.exe
Size 413KB
SHA256 fd115ae8ebd2f37cf1ef72f75242206cf1331c7cb258305011302e981137ee5e
MD5 522026a14d6bc781d2a15c665e454310
SHA1 9451a39108326ba578793b1feb62f23a02bce916
SHA512 4e4eb2f582c8590899a0ada6133b705d13775f60818f1ff4f9bb35e40e09d6570af4f7ac4c80b525b445a03702ca0f3a9867a93080f90697d8be668e2abe2fe7
SSDEEP 6144:q/6JSQsSVWSLjX2PxPNMRyfn7LzPdKblt0K+HAfh0v8axsbQuXYvr6yIl2:u6dVWnxlMSn7nFKbltn+Ch/m6X2
TLSH
T1DE947C1037D0C036F1B329768ABFD728556DB9715F6881CFA3C8166E5EB06E0AA3171B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AdobeARMHelper.exe

Path C:\ProgramData\Adobe\ARM\S\22118\AdobeARMHelper.exe
Size 1.1MB
SHA256 1994b304ab95ff9750d59c1ece7a83a30efebc88bcd45df581c17bdfc495357c
MD5 6b31caaeaa0c3fe3897f36fe0d5cc2ca
SHA1 4cea9e4d11c7495baf81dde8708a86addc22d74c
SHA512 ce4dd6ba4ccb7f9682aa2af0322da6c359b170b10fb0feb637661217cd0b89798ae8a10a09c418edb318b8e12ddd6d8ae7aa6d9e6e71be221e5820a1791f07a0
SSDEEP 12288:tY1V2dROcjF23im/fx06OEOp2hw5i/+EtV6dVWnxlMSn7nFKbltn+Ch/m6X2:tIwnJjFMvxMEOp2i8+EtkiTAbD+Ome2
TLSH
T19645AE157783CC31D4632B72877F83A94669BC625EA542AF72D05A2F1C700B66A3B33D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AdobeARMHelper.exe.ico

Path C:\ProgramData\Adobe\ARM\S\22118\AdobeARMHelper.exe.ico
Size 3KB
SHA256 2f33dacaebb8bdf6d2d88550cce349c09b51dfeb4f499796f32bd30e14aab86c
MD5 36bffd836d98a23f463bce74cb62315a
SHA1 a47b9829a0b83f42abad3e224f0fb8a6e5a5dea9
SHA512 159b17807ac5c4162630d780cf46fccc7bd0b985c7023155c5459469774d44739123b965ff4d47174678a1e5959ff1936c97be1532ee41ca1dd25a011f8a0e15
TLSH
T1206128BDF108B47ED44B5B31C016923723924CD2BD1E600A76193B39A6796657E29163
MD5 SHA1 SHA512 TLSH

Submit Download

RdrManifest2.msi

Path C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-AC0A92D435E5}\RdrManifest2.msi
Size 18KB
SHA256 0abcb8b7c0bda3128316b3e4f4a5857e9c8194105043a0c0e9801a1a96105d01
MD5 f5d4c05bc8ea0d4fc4d277abda7369d9
SHA1 f67e793b159bd1e75ed4dec0de352ea1b6583708
SHA512 359a966c4dc8d62a570b428dfb3e666a63efd6bfff7c5b5ace3bc97ea09ba701d9fa524f439bf9902746c2ecac9c1f76c90868b0152eb825b2a09a9474fdbb34
SSDEEP 384:MrUq75oUFtb0F+o5nfy9jdIYigYws0i9Db9Ey8RbmL4A8UiINyGNB:MrUq75oUFtb0F+o5nfy9uYigY9K5ALdH
TLSH
T19D820BA2B4408C11CD868F3EA4C1D726D672BC813D8591C27565F219CFB23869A9F7EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

integrator.exe

Path C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe
Size 7.4MB
SHA256 46aba5a69773ccbc6d35f20bc2a20fe35cc0ced86338db0cded8e2f5b65a0a9a
MD5 78dbec9b5d1e4fc04e590dd7dfaf9321
SHA1 d8a847702a6b8ae4228d7f9da0f58fc772dcdf3e
SHA512 b1c55952bed6b2b3d071d6844e8c51f7ad6ffe90e585e43fb4b618d9bec0f2680664022715b59e3bd7ebdbccfba4f204a0c299015cb40a21d514054c51c07419
SSDEEP 98304:lNMoePzbnbTWpz1T5mFB1GWdhrrmqJjeb2:lNePzzbqvT5wUWd5Sz
TLSH
T12576395D6AB481ECE0AAD1788D778772F67278418E33665B0361CA1F2F33D588D29732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VC_redist.x86.exe.ico

Path C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe.ico
Size 3KB
SHA256 6ed1664d7718a68084ea1a4abb1d9621a6ae8da8e19db35cfca13aaa4c05eb33
MD5 5cc1166b9cd6f8310369f631daf2f737
SHA1 8d2e3162e9b8ca7d196be95fc3b6e5b09e41ff61
SHA512 647617515c2750dfd460994a818bb759b40f867990102efbf592eccee7ed5460e7b731c87ae79af42cd18ccc16d8061102123747aa87a50e059b1490ae6e5411
TLSH
T10761E3576E5C8048DF843D31F4B6EB3003A3ACC13D916676A211B725EEBA3D399187AC
MD5 SHA1 SHA512 TLSH

Submit Download

vcredist_x86.exe

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
Size 1.2MB
SHA256 47a7c55976bfb0dfb0b611d2dc13c7edfb76c4d969ae69869f87679af28db8e9
MD5 18269f99859e6faba44ac56a20e426e0
SHA1 6d5b9b4108edc702d8e843076a525426186ec561
SHA512 b3a9700d14ce5fdc15df6739cb008bc86152dee7803b686e214497728003fc8a2d954ba4e54a6c93cac419e87c702bd49936ac974de369a0310156e47fd867ff
SSDEEP 24576:t/Q0vU7Fiv6Xbzs2J1BOkUhMXcBwc04nA:to0c7Fu6X/s4Uasqc
TLSH
T15345AE35F3916335C4B60A729E17C2702E7770452A11F96B8648ADEE38B83753A737A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcredist_x64.exe

Path C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
Size 1.2MB
SHA256 b72e0aab7ec168a592f79da69cb8636b06970acb59ab7c2cc9e6fb99e3bce5fc
MD5 18b02bad6d1a8871bdce496a9262a9a8
SHA1 2ad37205ee143cac0e5e48cbac90b0cf474c9685
SHA512 6eccfa8b488c474e0d604f7a5d354c3daefdb1689384cafa97552afbd32e839e6fe68cd03c52cda53ca0441eb0eee5f128b9dd50e76d57c8bd2463b8c96564bf
SSDEEP 24576:WrU6CIUwlsMLdFzSH8VNMYenGJiKEbXWtfOkUy:WrUTdrML0ZPnRWtGkf
TLSH
T14F45AE3FB780D81BD4B83336D02D86F42E39A9046F1A44674758673C3DF4A596ABE362
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

windowsdesktop-runtime-7.0.16-win-x64.exe

Path C:\ProgramData\Package Cache\{ef5af41f-d68c-48f7-bfb0-5055718601fc}\windowsdesktop-runtime-7.0.16-win-x64.exe
Size 1.3MB
SHA256 975c747a4ed45783a238927ae5c9bcac1d2871d6e30bf92674ce4a4d9f919b39
MD5 41abf96d7e51d390945ab9117c8c32de
SHA1 17afa83ea858614e1dd74db76070fcb809256237
SHA512 74ce89ac5f5b7ef433a4b1c38b60ce81d394d86086db2d0266a594fc9691809aceb574aa8d9467896baf9475feca0de8d5f7ffaa558c11a529211cc1175dc7ba
SSDEEP 24576:FQZDQDWJec/ukD6oS92f8FBI5mWpI2jFM5sFzfTpi71R8dZd:PDo/p892z5BjBbTpi5R8d7
TLSH
T10F55AF3574D04533E6A00633EB78B270293DB6152FD05C67D6F4AA09AA7407E2FBF266
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OneDriveSetup.exe.ico

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\OneDriveSetup.exe.ico
Size 3KB
SHA256 3a2d7fd9799178af58fbd08a2fffc56398cbf289c7ddd5c5f0fb2e241395261e
MD5 ea27d80794552048d73d1fdadac459d3
SHA1 f976de7f799d750ea73fdebefbe57ce9d81844d9
SHA512 f526d0d089d25625f6c24232334f0b1a18ec7682769d7c2ad6ffeef6a45231c8ce807e8276874e190ac7c9a9876432cc900c567042f6c046015f22aafd121753
TLSH
T15C614C71E91C517CF2D452334146120C440E4D1A19F51F401D333B18FD3D6A5552CEA3
MD5 SHA1 SHA512 TLSH

Submit Download

2026-08-09_a769feffb88e52523eff2d255368e434_amadey_darkgate_elex_smoke-loader_stop.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-08-09_a769feffb88e52523eff2d255368e434_amadey_darkgate_elex_smoke-loader_stop.exe.exe
Size 1.1MB
SHA256 b99c2e9ce4d44a57e3829c780619ec117292f8ae988be72f48c6408075121256
MD5 aa51c457c7c8eba179f482e5b82753a5
SHA1 daaab5a98c0574c8c0a5ac844486968aa36b14bc
SHA512 7e18d5e3b7c36e5feabedfe5df464399840dd7806f735404c79a3177428a0b9d3bb50347f0712c84a16b2b4dea9432ddc4d2b84f17356418b9323ccc59c6cdac
SSDEEP 12288:k3Sgouvz0ZRHkXVfeeO4LMneqyQsWSjGQCfLBlS7guN1AnQ6i12NI+:+Sgouvz0ZRHkFfenxyQZXS7gZnQh2NI
TLSH
T19045E50267F94129F1F37B71EEB993645A77BCA1AE39C50E5280025E0DB4A90DE71B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ArmUI.ini

Path C:\Users\Admin\AppData\Local\Temp\ArmUI.ini
Size 251KB
SHA256 b4d4dcd9594d372d7c0c975d80ef5802c88502895ed4b8a26ca62e225f2f18b0
MD5 864c22fb9a1c0670edf01c6ed3e4fbe4
SHA1 bf636f8baed998a1eb4531af9e833e6d3d8df129
SHA512 ff23616ee67d51daa2640ae638f59a8d331930a29b98c2d1bd3b236d2f651f243f9bae38d58515714886cfbb13b9be721d490aad4f2d10cbba74d7701ab34e09
SSDEEP 3072:wT4DJAvCXkQqSmSgojgTaDuK1+4xKtaU/QX5Pm9vR549QHmYPCjTMNro0Jnxu4Fn:xvUzH5
TLSH
T1B144E44363FC1209F6F37B41EEB852A44B77BDA5AA3EC15D1184015E08F5A90DA72BB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Tmp6C90.tmp

Path C:\Users\Admin\AppData\Local\Temp\Tmp6C90.tmp
Size 3KB
SHA256 ff9b4cf04e3202f150f19c1711767361343935da7841c98b876c42fd2cabce9b
MD5 bbb796dd2b53f7fb7ce855bb39535e2f
SHA1 dfb022a179775c82893fe8c4f59df8f6d19bd2fd
SHA512 0d122f454fcbf4524c2756692f0f33dc98f5bd2426839c6f03cd5c5f4fd507a8a15cf489d7a7ceadd1b95cf31b506c04bf03d613a9ba7d76add92766b1dc5c2b
TLSH
T10D71D9CF0D1A6413ABC7ED8EB1C5F3AB4C34A7E06AD1588B05B895C24FC3B862A5905D
MD5 SHA1 SHA512 TLSH

Submit Download

Tmp96BF.tmp

Path C:\Users\Admin\AppData\Local\Temp\Tmp96BF.tmp
Size 3KB
SHA256 19fe53c801ad7edc635f61e9e28d07da31780c2480e6f37ecfc63fffe1b250fe
MD5 ec946860cff4f4a6d325a8de7d6254d2
SHA1 7c909f646d9b2d23c58f73ec2bb603cd59dc11fd
SHA512 38a98b18dbae063bc533a1ff25a3467a7de197651e07e77a1b22cf8ce251282ab31f61dcff5c51ef186cfd115dc506181d480eabffbe92af01dee6282cbee13e
TLSH
T10971B9DB092A5413ABC7DE8AA2C5F3774C34A7E45B96548B087C95C34FCBB971B4401D
MD5 SHA1 SHA512 TLSH

Submit Download

Tmp96CF.tmp

Path C:\Users\Admin\AppData\Local\Temp\Tmp96CF.tmp
Size 3KB
SHA256 dcc9d2695125406282ba990fec39403c44b12964acf51b5e0dc7f2080d714398
MD5 fc2430057cb1be74c788f10c2d4540c8
SHA1 cab67ee8d5191fbf9f25545825e06c1a822af2f2
SHA512 4e2b9709a9e3ca5173abb35816e5a0aebbf2a7aaf971d7f75f3ae66e4a812cbade103baa5016525f5ab83a60c18f8d3c278c90ff83e4afdae419f81673cb5aee
TLSH
T1FC71D8CE0D1A6813ABC7FE8AA1C5E3695C30A3E16AD154CB08BC95824FC6FC51A4901D
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1804-1125-0x0000000000400000-0x00000000004DD000-memory.dmp

Download

memory/1804-0-0x0000000000400000-0x00000000004DD000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads