5a16f3583c2c296b250b3e2cdcb5489d3798dd5d9970d53385954a84bd5f6832

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/08/2026, 14:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-09_09105ab1a2aeaaa76d7ddb706980f2ab_amadey_darkgate_elex_smoke-loader_stop.exe
Size 1.9MB
Sample260809-sb6c8atses
SHA256 5a16f3583c2c296b250b3e2cdcb5489d3798dd5d9970d53385954a84bd5f6832
MD5 09105ab1a2aeaaa76d7ddb706980f2ab
SHA1 eb3b04ca34d8aa0c35d73a00266c0e148d164afc
SHA512 3df0c5fae08b042eb744a597ea1695ba3557aaa142f5d7e37b28b9c872c8fbee503f2d3e38b42f765b439700c595dd3c8e8038730150d9f2b78274480422a7a3
SSDEEP 49152:lWBDTImP/1KISgouvAeFfenxyQZXS7uQ0NIq:lwZtKIS1uxaxdS7u9
TLSH
T15D954C0667F54129F9F3AB74DAB983A45A767C619D39C30F23C0125E0DB8AA09D32773
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery spyware stealer trojan

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation	2026-08-09_09105ab1a2aeaaa76d7ddb706980f2ab_amadey_darkgate_elex_smoke-loader_stop.exe.exe

Executes dropped EXE 3 IoCs

pid	Process
4260	2026-08-09_09105ab1a2aeaaa76d7ddb706980f2ab_amadey_darkgate_elex_smoke-loader_stop.exe.exe
2716	Reader_sl.exe
1528	Reader_sl.exe.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-08-09_09105ab1a2aeaaa76d7ddb706980f2ab_amadey_darkgate_elex_smoke-loader_stop.exe.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe.exe	2026-08-09_09105ab1a2aeaaa76d7ddb706980f2ab_amadey_darkgate_elex_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	2026-08-09_09105ab1a2aeaaa76d7ddb706980f2ab_amadey_darkgate_elex_smoke-loader_stop.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE.exe	2026-08-09_09105ab1a2aeaaa76d7ddb706980f2ab_amadey_darkgate_elex_smoke-loader_stop.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe.exe	2026-08-09_09105ab1a2aeaaa76d7ddb706980f2ab_amadey_darkgate_elex_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe	2026-08-09_09105ab1a2aeaaa76d7ddb706980f2ab_amadey_darkgate_elex_smoke-loader_stop.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe.exe	2026-08-09_09105ab1a2aeaaa76d7ddb706980f2ab_amadey_darkgate_elex_smoke-loader_stop.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe.ico	2026-08-09_09105ab1a2aeaaa76d7ddb706980f2ab_amadey_darkgate_elex_smoke-loader_stop.exe
File created	C:\Program Files\Mozilla Firefox\plugin-container.exe.exe	2026-08-09_09105ab1a2aeaaa76d7ddb706980f2ab_amadey_darkgate_elex_smoke-loader_stop.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe.ico	2026-08-09_09105ab1a2aeaaa76d7ddb706980f2ab_amadey_darkgate_elex_smoke-loader_stop.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jps.exe.ico	2026-08-09_09105ab1a2aeaaa76d7ddb706980f2ab_amadey_darkgate_elex_smoke-loader_stop.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe	2026-08-09_09105ab1a2aeaaa76d7ddb706980f2ab_amadey_darkgate_elex_smoke-loader_stop.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxCalendarAppImm.exe.ico	2026-08-09_09105ab1a2aeaaa76d7ddb706980f2ab_amadey_darkgate_elex_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\RCX96C8.tmp	2026-08-09_09105ab1a2aeaaa76d7ddb706980f2ab_amadey_darkgate_elex_smoke-loader_stop.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe.exe	2026-08-09_09105ab1a2aeaaa76d7ddb706980f2ab_amadey_darkgate_elex_smoke-loader_stop.exe
File created	C:\Program Files\Java\jre-1.8\bin\unpack200.exe.exe	2026-08-09_09105ab1a2aeaaa76d7ddb706980f2ab_amadey_darkgate_elex_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\RCX46A6.tmp	2026-08-09_09105ab1a2aeaaa76d7ddb706980f2ab_amadey_darkgate_elex_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\RCX4D4E.tmp	2026-08-09_09105ab1a2aeaaa76d7ddb706980f2ab_amadey_darkgate_elex_smoke-loader_stop.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_x64__8wekyb3d8bbwe\Microsoft.Notes.exe	2026-08-09_09105ab1a2aeaaa76d7ddb706980f2ab_amadey_darkgate_elex_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-08-09_09105ab1a2aeaaa76d7ddb706980f2ab_amadey_darkgate_elex_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\RCX2D3A.tmp	2026-08-09_09105ab1a2aeaaa76d7ddb706980f2ab_amadey_darkgate_elex_smoke-loader_stop.exe
File created	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe.exe	2026-08-09_09105ab1a2aeaaa76d7ddb706980f2ab_amadey_darkgate_elex_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\RCX5F00.tmp	2026-08-09_09105ab1a2aeaaa76d7ddb706980f2ab_amadey_darkgate_elex_smoke-loader_stop.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe.exe	2026-08-09_09105ab1a2aeaaa76d7ddb706980f2ab_amadey_darkgate_elex_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\RCX4186.tmp	2026-08-09_09105ab1a2aeaaa76d7ddb706980f2ab_amadey_darkgate_elex_smoke-loader_stop.exe
File created	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerElevatedAppServiceClient.exe.ico	2026-08-09_09105ab1a2aeaaa76d7ddb706980f2ab_amadey_darkgate_elex_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2026-08-09_09105ab1a2aeaaa76d7ddb706980f2ab_amadey_darkgate_elex_smoke-loader_stop.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateBroker.exe.ico	2026-08-09_09105ab1a2aeaaa76d7ddb706980f2ab_amadey_darkgate_elex_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\RCX9A37.tmp	2026-08-09_09105ab1a2aeaaa76d7ddb706980f2ab_amadey_darkgate_elex_smoke-loader_stop.exe
File created	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe.exe	2026-08-09_09105ab1a2aeaaa76d7ddb706980f2ab_amadey_darkgate_elex_smoke-loader_stop.exe
File created	C:\Program Files\Java\jre-1.8\bin\javaw.exe.exe	2026-08-09_09105ab1a2aeaaa76d7ddb706980f2ab_amadey_darkgate_elex_smoke-loader_stop.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\RCX65C8.tmp	2026-08-09_09105ab1a2aeaaa76d7ddb706980f2ab_amadey_darkgate_elex_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\RCX131F.tmp	2026-08-09_09105ab1a2aeaaa76d7ddb706980f2ab_amadey_darkgate_elex_smoke-loader_stop.exe
File created	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe.ico	2026-08-09_09105ab1a2aeaaa76d7ddb706980f2ab_amadey_darkgate_elex_smoke-loader_stop.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe.ico	2026-08-09_09105ab1a2aeaaa76d7ddb706980f2ab_amadey_darkgate_elex_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE	2026-08-09_09105ab1a2aeaaa76d7ddb706980f2ab_amadey_darkgate_elex_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\RCX4CFF.tmp	2026-08-09_09105ab1a2aeaaa76d7ddb706980f2ab_amadey_darkgate_elex_smoke-loader_stop.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe.exe	2026-08-09_09105ab1a2aeaaa76d7ddb706980f2ab_amadey_darkgate_elex_smoke-loader_stop.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe.ico	2026-08-09_09105ab1a2aeaaa76d7ddb706980f2ab_amadey_darkgate_elex_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-08-09_09105ab1a2aeaaa76d7ddb706980f2ab_amadey_darkgate_elex_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\RCX2B0F.tmp	2026-08-09_09105ab1a2aeaaa76d7ddb706980f2ab_amadey_darkgate_elex_smoke-loader_stop.exe
File created	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe.exe	2026-08-09_09105ab1a2aeaaa76d7ddb706980f2ab_amadey_darkgate_elex_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\RCX4A38.tmp	2026-08-09_09105ab1a2aeaaa76d7ddb706980f2ab_amadey_darkgate_elex_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe	2026-08-09_09105ab1a2aeaaa76d7ddb706980f2ab_amadey_darkgate_elex_smoke-loader_stop.exe
File created	C:\Program Files\Java\jdk-1.8\bin\pack200.exe.exe	2026-08-09_09105ab1a2aeaaa76d7ddb706980f2ab_amadey_darkgate_elex_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\RCX3BD1.tmp	2026-08-09_09105ab1a2aeaaa76d7ddb706980f2ab_amadey_darkgate_elex_smoke-loader_stop.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe.exe	2026-08-09_09105ab1a2aeaaa76d7ddb706980f2ab_amadey_darkgate_elex_smoke-loader_stop.exe
File created	C:\Program Files\Mozilla Firefox\crashreporter.exe.exe	2026-08-09_09105ab1a2aeaaa76d7ddb706980f2ab_amadey_darkgate_elex_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe	2026-08-09_09105ab1a2aeaaa76d7ddb706980f2ab_amadey_darkgate_elex_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\RCXA7A3.tmp	2026-08-09_09105ab1a2aeaaa76d7ddb706980f2ab_amadey_darkgate_elex_smoke-loader_stop.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeApp.exe	2026-08-09_09105ab1a2aeaaa76d7ddb706980f2ab_amadey_darkgate_elex_smoke-loader_stop.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.46.11001.0_x64__8wekyb3d8bbwe\GameBar.exe	2026-08-09_09105ab1a2aeaaa76d7ddb706980f2ab_amadey_darkgate_elex_smoke-loader_stop.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe.exe	2026-08-09_09105ab1a2aeaaa76d7ddb706980f2ab_amadey_darkgate_elex_smoke-loader_stop.exe
File created	C:\Program Files\Mozilla Firefox\plugin-container.exe.ico	2026-08-09_09105ab1a2aeaaa76d7ddb706980f2ab_amadey_darkgate_elex_smoke-loader_stop.exe
File created	C:\Program Files (x86)\Internet Explorer\ielowutil.exe.ico	2026-08-09_09105ab1a2aeaaa76d7ddb706980f2ab_amadey_darkgate_elex_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Installer\RCX962B.tmp	2026-08-09_09105ab1a2aeaaa76d7ddb706980f2ab_amadey_darkgate_elex_smoke-loader_stop.exe
File created	C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe.ico	2026-08-09_09105ab1a2aeaaa76d7ddb706980f2ab_amadey_darkgate_elex_smoke-loader_stop.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe.exe	2026-08-09_09105ab1a2aeaaa76d7ddb706980f2ab_amadey_darkgate_elex_smoke-loader_stop.exe
File created	C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe.exe	2026-08-09_09105ab1a2aeaaa76d7ddb706980f2ab_amadey_darkgate_elex_smoke-loader_stop.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe.exe	2026-08-09_09105ab1a2aeaaa76d7ddb706980f2ab_amadey_darkgate_elex_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe	2026-08-09_09105ab1a2aeaaa76d7ddb706980f2ab_amadey_darkgate_elex_smoke-loader_stop.exe
File created	C:\Program Files\Java\jdk-1.8\bin\rmid.exe.exe	2026-08-09_09105ab1a2aeaaa76d7ddb706980f2ab_amadey_darkgate_elex_smoke-loader_stop.exe
File created	C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE.ico	2026-08-09_09105ab1a2aeaaa76d7ddb706980f2ab_amadey_darkgate_elex_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\RCX3E36.tmp	2026-08-09_09105ab1a2aeaaa76d7ddb706980f2ab_amadey_darkgate_elex_smoke-loader_stop.exe
File created	C:\Program Files\Windows Media Player\wmlaunch.exe.exe	2026-08-09_09105ab1a2aeaaa76d7ddb706980f2ab_amadey_darkgate_elex_smoke-loader_stop.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Reader_sl.exe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-09_09105ab1a2aeaaa76d7ddb706980f2ab_amadey_darkgate_elex_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-09_09105ab1a2aeaaa76d7ddb706980f2ab_amadey_darkgate_elex_smoke-loader_stop.exe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Reader_sl.exe

Modifies system certificate store 2 TTPs 3 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25	2026-08-09_09105ab1a2aeaaa76d7ddb706980f2ab_amadey_darkgate_elex_smoke-loader_stop.exe.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 040000000100000010000000d474de575c39b2d39c8583c5c065498a0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000007431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25190000000100000010000000ba4f3972e7aed9dccdc210db59da13c92000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	2026-08-09_09105ab1a2aeaaa76d7ddb706980f2ab_amadey_darkgate_elex_smoke-loader_stop.exe.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 5c000000010000000400000000080000190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc36200000001000000200000007431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8040000000100000010000000d474de575c39b2d39c8583c5c065498a2000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	2026-08-09_09105ab1a2aeaaa76d7ddb706980f2ab_amadey_darkgate_elex_smoke-loader_stop.exe.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
5060	2026-08-09_09105ab1a2aeaaa76d7ddb706980f2ab_amadey_darkgate_elex_smoke-loader_stop.exe
5060	2026-08-09_09105ab1a2aeaaa76d7ddb706980f2ab_amadey_darkgate_elex_smoke-loader_stop.exe
4260	2026-08-09_09105ab1a2aeaaa76d7ddb706980f2ab_amadey_darkgate_elex_smoke-loader_stop.exe.exe
2716	Reader_sl.exe
2716	Reader_sl.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5060 wrote to memory of 4260	5060	2026-08-09_09105ab1a2aeaaa76d7ddb706980f2ab_amadey_darkgate_elex_smoke-loader_stop.exe	85
PID 4260 wrote to memory of 2716	4260	2026-08-09_09105ab1a2aeaaa76d7ddb706980f2ab_amadey_darkgate_elex_smoke-loader_stop.exe.exe	97
PID 2716 wrote to memory of 1528	2716	Reader_sl.exe	98

C:\Users\Admin\AppData\Local\Temp\2026-08-09_09105ab1a2aeaaa76d7ddb706980f2ab_amadey_darkgate_elex_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_09105ab1a2aeaaa76d7ddb706980f2ab_amadey_darkgate_elex_smoke-loader_stop.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5060
- C:\Users\Admin\AppData\Local\Temp\2026-08-09_09105ab1a2aeaaa76d7ddb706980f2ab_amadey_darkgate_elex_smoke-loader_stop.exe.exe
  C:\Users\Admin\AppData\Local\Temp/2026-08-09_09105ab1a2aeaaa76d7ddb706980f2ab_amadey_darkgate_elex_smoke-loader_stop.exe.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - System Location Discovery: System Language Discovery
  - Modifies system certificate store
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4260
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2716
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader/Reader_sl.exe.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1528

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RdrCEF.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
Size 10.1MB
SHA256 6b42339cd146d581499764929ed854b75dee4d4d87bee888b3fa29760c1c0224
MD5 de00f6458ec817446a7bc647c4a0a90a
SHA1 96352fe8ed0ff8a90d88cc30c7aae11fcba2c12f
SHA512 e68db70750acad0a04d2fe3cf78a0f1c4a548af30ff83510326c8cfcb7e4f98f95525a1b2fcdb9fce17cb61b3f3da5116c011552ba87d75ca58f8304025d736e
SSDEEP 98304:Yv7GxFUrbT5JhEP+SuC0qyLfPeLDo/uLGM7gbl91hxkPZTM:sQ0XnfW/JLGMcblLheTM
TLSH
T10DB6BE1D7FE21032C9736175AB4F9104EB39D007A215C69779DC83981FB1AA252BAFF8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AcroRd32.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
Size 3.2MB
SHA256 1ca9c8c7955300bffcaa2ced5d9586718f0d8e92826cceaffc4956b0aee3d1ad
MD5 fa6df332aa2d757eb381f4da56c2cddd
SHA1 85ac1ac8473ac37d034b5542980c5698a5506550
SHA512 25843336c6fa4ccf64e82025baf4287398dc3bf2096c4ad4cba5ecd0fff67010d2cf2820c748aa653107c5ed5ec805a2e91c71c3e497bd8f11e859ed2d1d512b
SSDEEP 49152:ivB7YJDRdTfiUEWo6zuEz439z99akTBc4O8b8ITDnlT4NvJS:iWhTfiG/nzU90m
TLSH
T157E5F51666C8C0EBD5682170CC5DBBF900186D78DB928DD7BE447E0AB9307D2A533A7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Reader_sl.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe
Size 816KB
SHA256 78b65d51872e96f4e788a70a3a0a23fc185f8d110dc2a3a2a2ecc0ac7d45782b
MD5 c8760ec752375880eda066a9219fa422
SHA1 d9615412683176d61e1f4068d8b51b5cc2b3d728
SHA512 7a46b4da97ebb703d4bf930f672e2bc6fc9c4e0db6ec230cd3310fbef60191e4caccc1ed95dba779cba43703b4b244a068ef0e4ac923cdb9081a103d468bf5b7
SSDEEP 12288:1SqcYWt/cH3ipidm0tLlT3UheLHT/vWqNuyCTQw5i/cBHvwFfj:1SrYG/cXPm0tlkMLHT3wXNqcBHGfj
TLSH
T1EA05AE75A6818517C22C59714CEF0DF513E3A8017D82161F289834AEEBBAFF755BA23C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Reader_sl.exe.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe.exe
Size 60KB
SHA256 0970b73d6f2bda342b5a178b58a6a64c6a7464aa33572ac605aae58ce30037b5
MD5 054d547455910217debfe6ba774421c0
SHA1 45e46890894b809c77c3083bc5517a0bfbc07ad0
SHA512 0e284067a8197fa7eab69e44eea9ad3e86f99ce3afad3d7a62d6961a195304631554de738752857f7a90642d16a242e8015ebc0a5ce952a97ad17521d09a8828
SSDEEP 768:NvA45im0N0I9U96lOQ7ABFPXdLtZqW/4nws6wqN3M3wh:u4wNlu9HQIXsW/4T6w8Mgh
TLSH
T1D0535B033F86CF63E851857114A99BBDE4BEE930AF5197E35714461B4DB83C2297222F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

arh.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe
Size 848KB
SHA256 134a83f606e3f44110b033d64b8a6f7c13681a10846573fb371c9fda93ba9b51
MD5 0724c5a639e006ad2a95a00b58608dfc
SHA1 a402baaca7c150713d7c8b2e64166af20763f445
SHA512 ae40f01799e8ae8671cbd26f5f10f68575f8bfb944eecbb2f2ad51b6e221adba901c3b9af2e5bcd336d370a1c56dcb86ddac7985c9deb652df96a3073f8a09a4
SSDEEP 12288:MYJqW43kGx1JIqkVYiQqu+6BC82xkmrP0eecw5irgJhcQrYmIjE72:HqkGbZkVHWxGhj0ewkCV72
TLSH
T143058C0EBC74C47EC8AB4830D499D3BCA5699CCFE929D5C37654B3096B3020FA9952BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

32BitMAPIBroker.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe
Size 866KB
SHA256 3cbc876676f694f14f256bb33b894009da22944e64af743291b2f00a28449131
MD5 f124c270d371f5b0e754ed0eb0e178d2
SHA1 7c9eb33fb08aa70f90f63f31ae51c7f8a0fda34a
SHA512 b7e271a1387e1a7ea433f031e114af697ef70424b98d37bdb620db6ea96b2059acdffa154489f457a762b91a61ea970331eb09271981adb8bc63d34dcab42cca
SSDEEP 12288:p/biZCQ14cz0w9qP8Y1VP2OHffimCxLXsAvFEZP6JHZvpXww5idljObnb5x2:YR9q1VP2OHfqTsAvFAG5VtQObbW
TLSH
T19515AE0CB142C8A3E92649360BCA9BAD6353AC331F55E1DB926B7F3F27356520D27271
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AdobeARMHelper.exe

Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe
Size 1.1MB
SHA256 32168e16b295c95e0ece6b6c7b3fc053ec87dfa6fe2095ab64b3f0fc73ce6e94
MD5 7fc21b66e16374bfe81146e5ddfc3850
SHA1 830c15800d9d0ac9c11f29e075cd924c7b91b365
SHA512 c6269931a9e77a62c410b650f179d60449792d3565b2200a87440e99f0509487a1d3d4a98e76b5853fd31efa8d96f68b726a680b23287714a6bf984c21d9580f
SSDEEP 24576:lRk40tzfXqweq9DWSIMEaljMwOTaiTAbD+Ome2:l1wX9DdIaljyT7TAGOme2
TLSH
T1AA45AE047FA1B13AE163D43145AF8BA2386D7C624F77468B5B58361E0FB96C89A31337
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DisabledGoogleUpdate.exe

Path C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe
Size 6.4MB
SHA256 178ba55b36e4a766619c4d3b17f26ce93a99ffb3b2e799c82dfce377dbc022c7
MD5 5b9baf6beba3ed1ac62ab4ba37cab3d6
SHA1 097008f58881a92780959eeb57cbef08ce349b24
SHA512 3857ce4f06002e4d73c1e3729a6a61ad6d3fa84d57a6e246a54378e381bc3a46c5002bc7dbc30d981ebe7eae296944fb776853d7dc4edcb01ee97fbd87812d05
SSDEEP 196608:IG7BHog1P9fIlOuz6IgF+I3m2MXP6HG8Qzb:IWFognqO86IgF+qbM/6HG8QH
TLSH
T11C668C23B4E08031E5F73235AD2C67395A327FA29F3145CB87946C946EB46E3253936B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ieinstal.exe.ico

Path C:\Program Files (x86)\Internet Explorer\ieinstal.exe.ico
Size 3KB
SHA256 dd8074940b2a1e8d0ad513e7c6e2a0d0b11a857893f11dc77387800ca272e970
MD5 f48ab39db9ca4956776a50b86a8e8c81
SHA1 c8f6dc9e0c0ffaa61075e9d02ffe0a1a319dd842
SHA512 c122c826c7146e86238bb8098c91abfb8270f72e4cbb8af9d5664eb98a181376f8e5cbdfea31050c9df1d895225d6c70a06810c91d40f24b1798936682c7897c
TLSH
T1B2619526B216ABA5C11A41308C8F1A2E1632AE4184A6A0010B753983D27E63BE33687F
MD5 SHA1 SHA512 TLSH

Submit Download

msedge.exe.ico

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge.exe.ico
Size 3KB
SHA256 4785d266a2c476e0948100ea80f927d16389f7718b540daf0488457ba01958b0
MD5 cc055af6d5fab0514052a985d406293d
SHA1 6c856938f56c75841cd93bbe467d624e2bda6e07
SHA512 4f3387c19d12e5154841d97b552c8c47e107a4bc6ac376fe7a60493d4013572be61886d7ee8e40acc62653c97b3a761097f8dd3d97d72d361c38775ec512eb63
TLSH
T10F61C864933541DACB8DDAFF541843A1AE22C875D73FC4868271E9A33DA92FCA800C2D
MD5 SHA1 SHA512 TLSH

Submit Download

msedge_pwa_launcher.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_pwa_launcher.exe
Size 2.2MB
SHA256 49970473b6eaf5f69013406ba27a6f2cc6528bb65aba18adfe374d24ea4ab0ce
MD5 f3b8561ea5ae455ebaff3bf68d96b031
SHA1 9370c3110fe14c73222774d4c95ab61d1b247a9f
SHA512 7359492a1532bfa33e37f6ca5a153ecc63f489b6cd611bc4b19b88111124f3baa8bdc4f9b94922e57a88fb11317722edf4e69c5f9d392b2d387344f4eb4a9ab5
SSDEEP 24576:J9GtdwSEsOd44DDILxQOUJtUp90v1XFf3ng7d9+1UXJwhXCTi2Qlkkkkkkkl0T3f:0d/CTIQOitU/03nmdXa5o5QPQ+
TLSH
T127B5AD47F6D5C1A5E0A9C134CA778F2096B17C125F9051FF02A07B9A2EF6AC40F39BA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\notification_helper.exe
Size 2.0MB
SHA256 dd7c7645545010b6bd8bb865a2ab5b6b2787ea0dfb69baffe33fb2eaee49de3a
MD5 d6b20f5d8a45da229667a86261a0627a
SHA1 33c89ce878250a784e3b75ee50d0b74d1c62c392
SHA512 93eb61cbfc4fe39aaf4ba7ca918d142531040d5210b16e2666ced7ed13a662c6ff8cc4e6d03ce329c014411adb42df4aafc566796e6667b532df3b2c2d71fed4
SSDEEP 24576:fM0kCiO2+ug8yEdER6AVorgc3y0w9jfGX7yxgCJd1fbgqf1ChKRADe1qRAi:UjO2Z+D6ru0WjiMgCv1jn1ChuADSi
TLSH
T1E0A5AE07F69A51D8D03EC438CA1A8175FAA1BC470F2491EF06987A4A2E77BD85F7D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ie_to_edge_stub.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe
Size 1.3MB
SHA256 6affd3af49b7ac27cf10c683304b88f194a086aaa27391f403e7997ad2ffc2a0
MD5 6f76a5508ba6e8d147f3b8b0c2d3aed6
SHA1 67dcc99d1a0de52aa8299a9f2fb2adc437990cbf
SHA512 754eb35530ea850609f74a3f81f5c41b183c82b86bd6ac14f28d664b4707ec1df77e06aaeb1a61b20259b02bca2917fe8e6fbe7251b57a18579c597e6029788b
SSDEEP 24576:tdHdEsGQzhGo4PZmE8DahqKF0ad/kZACZ0g86n9kAJ9tA3L:td9rXzF4PZB8B+h6T9t2
TLSH
T13C55AE0476BC97D7D02985344D0382669C7B7DA50BD05BDBB3A275AE2F321E90EBA331
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge_proxy.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe
Size 2.2MB
SHA256 1a4741ea62eaef188d27f308757e6c3e82486a764de878af5b2d1be14c255eed
MD5 d446b93d1f6e5a7b225b526d4eea304d
SHA1 2b63721ce36c0bfaa9612ea63af9830b4193e00e
SHA512 d1298cfbc3bc997cba5341da7e5f7767b591dd53440cdd449fc67c9e4c76e817d447c03b33129a5e0a1de2cc53a542f87c3318354d7352ea3b73ebd058877c20
SSDEEP 49152:sO4BMQYokfehjvHHKTdfxINPEt99G2Bo7EukU1a:F4BpYoqyjvnORmE
TLSH
T1EAB59D0BB7D840E9D01DC0B4CA568631DDB27C424B296AFF0694B61D1E77BE85F3A722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge_pwa_launcher.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe
Size 2.6MB
SHA256 18dd6ee7e55ba1f3ea1ca7b8005705525b9a5c2d3fc3355017a6a533c15eb399
MD5 76ba1fb33af9f3f6b327af1b12674a7c
SHA1 cfc27a50d7b723cefad765ccfddbe6da5b714f68
SHA512 6ee7b03d13485044c7da679e8a2cb3e98dddafb62663080666e8114a8ed551cd768fa77cf6ba569892c6c1ce061d0dd10eccc8d5305236853dd7f455428f0b3b
SSDEEP 49152:URLyDr3zL+g9MZGu6qG13O7Q7gLYduZrSdHBAVfb:URHTR6YjwA1b
TLSH
T145C5BF03F6D681A5D019F578CA7687B4D6717C456F20A6FF06887A263E77AC04B383B8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pwahelper.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe
Size 2.1MB
SHA256 0ce47378cd7b6aadfbb47a49ccc4a32d9150a4edfa5c82b910bdc638f137643b
MD5 e0beea4673d3213bade773b843fffdba
SHA1 310d7e8a053ad99d8443a7d254cad7ce687a2fb9
SHA512 d3082d04d54f74448714a7973fee279d1cf93c0e983d430688f4eb01a32c070c892df855495303fc7c579a7ceab19388404c1ce553b13ad31030a64b89c3b0ed
SSDEEP 49152:R+9IKqq9JsY2fF8FhmS86IUJWQn+6h27d6:R+9IKqssbOjjsts
TLSH
T139A5ADC3B2A94294C09DC1B5CA068539DFB2BD61076662EF0790B64F9E37BD85B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MicrosoftEdgeUpdate.exe.ico

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe.ico
Size 3KB
SHA256 2e039a7ce5af3783a3d522d27112bfe7a1dac319ed5061de3bef89790d5ad63e
MD5 6dd3d92bc5e7a45a2001a77bcc1c1fc0
SHA1 e942bc4b46d6fc683babd5d21da30f195aecadbb
SHA512 c8d9b2166f432da32f91d8de3162c74590c5753757c6a00bf9835c7c096c29bbf9ece24eb8688e2b87f137129fdaa9be3770a4eee1b99258e39247a3de64f6c2
TLSH
T189616E7C0F7CDC6FEE9230B9624A0A4132B0CDE15670A6D756127806813DAE2D9F4F9E
MD5 SHA1 SHA512 TLSH

Submit Download

MicrosoftEdgeUpdateOnDemand.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe
Size 862KB
SHA256 06080d24e778bf9a8b19e4a77cc83ceeedb5d80d5316224fde75c081cf88de72
MD5 f6d74a7f0d25cacb2ac33bebdb024ce7
SHA1 b1e37ad9ab2d26bedb726f280eda32e323d47f4d
SHA512 02893dab2d3ea13a69fc9e45ba564347882e32ae157a21aa5bd919b10126b43cd5c5471a72404130c34c79a3426b73a7c403e6974d039a807dad1d665bbe275a
SSDEEP 12288:Pa6onyaS+b9vSVWpq9OsYiPP9tLlSq4uwK2SyX+w5imHUIybrNPzB+NU:Ptohb9vSVF9CXugf1UIybBPzBAU
TLSH
T1FE15BE3D39D8D1A9C6A10838C49D4E7C44B3EC955F17FABB1DB2265E3A3A1636D32630
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

identity_helper.exe

Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\identity_helper.exe
Size 1.8MB
SHA256 d35918f58d13c6d126005fc408069ef392f2e343ac13171e10cfff4c5d63e4d5
MD5 cc3e62213bc56913c880746587ac904e
SHA1 ff03dafff42a5c0c56f58f053ece14ca67bd2cee
SHA512 34c74894ee36d48d62917dc791e1feffc4c5a12f24dba1163d1deec8b7e276b7ef288c1c3ac0a132b4be1e1a21145a7ffc53064b14c513eeb393786931289fe5
SSDEEP 24576:5OTKhSX6PuWMZ/YCg5cD1xYmWHHo7fvqcXFudDJdWQCkvjZQqg+lIVprS7:ETcP1MZ/corYzno7fvTqJdbPrCx9pG7
TLSH
T14085AE0775F94299D079C430CAAD4225D7B1BC910BA052DF6A92B31D2E7BEE45F3A338
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe.ico

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe.ico
Size 3KB
SHA256 3d275500cf3ebda5e878d81dcbbaa53528397ccbe631aae8fae60de1ffefccf7
MD5 70f7eb6f0e42805134583ac203c2dfd9
SHA1 fc513300d133a9b8a45da81a72a10b937e909190
SHA512 bf3126bfc018c3890afc1a105db52b9b332ed24228cf1a8e1df715287ad51161ff3fa94c88ef2cbcdda9a10bdc992691b9171fa07cfb2e8b71c35d12605a1179
TLSH
T1A46144423D3ED9E5C80005348C5F0FB80A315F92B810A30287BBBD6ED9B8754E61E35E
MD5 SHA1 SHA512 TLSH

Submit Download

identity_helper.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
Size 2.1MB
SHA256 ff77f9081856245b515d8b28c05cdeab144e1dbf6488b35478399c814d9a15f0
MD5 aed761aeb30c7624b4eddd2b79cf4f2f
SHA1 2c33927e4802308a16958d4f626699f914ff50aa
SHA512 5bdcdd723b535862be718cae322b7c2a71a6590abd6561cd2e4afcb9ddc86230f65ebed465618afe985baf6c936d7038a4d5954fecbd9305a7df31a9d92d4032
SSDEEP 49152:Mb+qbLqGB2mDvwZ2XuTjPb33g9gZLfCdW9HTlXrk9dBB:MbrbLq02wI4Ds9Ol
TLSH
T172A5AD53B285C0E9C0BEC274DA8297B1F9B77C410B2466EF0754B71A1E3BAD45B7A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgewebview2.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe
Size 4.1MB
SHA256 3e43618d905bbfd55154dbfc4ee2f401e2cd3cdad27264f19eee9366f3da0bb9
MD5 6ccf39b06ae8150c52a6187fc73313d0
SHA1 270479e42c1b67eee98161b3220572e9715bfc45
SHA512 78459b3d8502b83ba042cec07430e6198d48f86d00cdb78e91923d394d911edc870c7058763b5b06c819c37e8d8e7d1c7d8428ac13fa532d2a49d960e94562f1
SSDEEP 49152:kGcZTbHawJ3G4uZgk07G0auOj85q7aGScYbb6YErz7z4AkOuaRoBISCaQZCLlrrZ:kJFbz3GIo/Yhy8OnZy
TLSH
T14D165903A2D910D5E059C078CF469222EBA27C9847F5B2EF3680B6D52E73ED47B79760
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pwahelper.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe
Size 2.1MB
SHA256 ecbdabf1415e10a77fc8c0ee722766e0c6492a86ce1c1ce6c1a0280c1b9c1b09
MD5 c34c9c0e682ac78c2ecc8dca1e00817a
SHA1 e877f2fa85b33042f7256c99af08299186cbaf1a
SHA512 008d5a16b36b0c3660c04e282e187378fda7e47b5fe0646e00638a2c70591ab3773047bf3f59e46057d718b582200359e9be71123619711b3b7d09abb540861e
SSDEEP 49152:Bcl5WjJKBuMY2fF8FhmS86IUJWQn+6h27d6:BcliK5bOjjsts
TLSH
T1E2A59E07F68840E9D02DD0F4C6966935E9B3FC820B25B7EF0654B6092F37AE45B79728
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe.ico

Path C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe.ico
Size 3KB
SHA256 44ae793c391e8578709e181e83cb820caaa10c08844440885d969a6c839b8a2b
MD5 0becb6bcbe9400e6d9441ceef104e743
SHA1 2f4e955a4c3c11236501b5c7ea36a392a0891ed8
SHA512 f7fcfe5f5274d2a27f233e5e67361988b8176497a9711767dac1bf0079a4b6cf5a1dd62750775b25c269169be6a1e3d1faa62207ddcc3d71dbd4e4c928b3017f
TLSH
T10461C6A9BF4080C1E21183F01C831B94A5052E6395EC9B3BB822BC878D7C8EA4038E3D
MD5 SHA1 SHA512 TLSH

Submit Download

RCXF0E.tmp

Path C:\Program Files\7-Zip\RCXF0E.tmp
Size 760KB
SHA256 b26a09f4f64a60bf2ac53dcfc9ee9c7a9c313bdbe46ea66669e0f106efdb9092
MD5 7bc590abe722113d32630e37ab7cda52
SHA1 1e979c401f52b237c711b6248614f594a7d87ed3
SHA512 70312cc70cd88cb4a63d8fa60da20828f8c5d564353fb72c531e6d3c97c5406d2cc10db94860176f8bc2d6b4a7f744115d8a3ebb9aa3b436434a871cc9c4d224
SSDEEP 12288:Axs5H2RoI1OxPDZo91vRT5c9mP4ZqXSWFKVp1i2gYZw5iG7c:AxsKoEB5RTi9mP4kLCyK6dc
TLSH
T1F4F4AE4C7931A426ED1CC338E57587E1AEB9A8636C79034F37D0772A299D0F5A8336B1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe.ico

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe.ico
Size 3KB
SHA256 2a5c5c2bc95c18eded222f0a38752717c1a6ad20e31bcda6472bbba77ed22fe4
MD5 de1dbafd46ca8d953c93a1c89766a8c2
SHA1 41ec8c2a24317bba7a64f4b60341307033edcda0
SHA512 06a89f154036252f396a9f2ac515c5e03e8dd54eb7ba6c3bd0159f693d85846c4ba1b29c0fdc83f14d8c9128f18db3ee27c73111891dc66f81d4fd14361e6ce2
TLSH
T1D861565C04E3ACB1D6E548B83235B2C460D88A364424C867A89D7AD7CE7D8D473DEB0D
MD5 SHA1 SHA512 TLSH

Submit Download

OfficeClickToRun.exe.ico

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe.ico
Size 3KB
SHA256 19306f3f899e8bae15a744924f1ebf2ce88624f5dd297e3993645fe8453adaa9
MD5 eeb23b93433af30f3061c261b8368401
SHA1 87e274077a0eff8831e33ed45b2f740b2d8545ea
SHA512 108348395c1833031a0abbcd7ea57194733e606fc79cfb6181d821e2e750b53c636977d802c0fce70d64157767d61b7df0cd30fa80535f0586417250eccc9e3c
TLSH
T15961C9FFE23099C8C1467E30408F06C03EBE0E4EBCD01E330A9030A82A39252B83EE01
MD5 SHA1 SHA512 TLSH

Submit Download

javaws.exe.ico

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe.ico
Size 3KB
SHA256 6c3d33a5119708abbf19b802f0908183037cd57a6394e45b7b234a76ef4b46c5
MD5 13fb0b721f1a5288bba88efe12d3c4c2
SHA1 08899424be48b76e1189abac3b067cd19398282d
SHA512 0fac8e02873e36841d4a6aaea8d4e7d2c034fad2a0fd18d9a0c8973126dd0d969bd108eaae19fae2f5bb3988bc77fd70405b80a76b68e398a880dbb496b9b3a3
TLSH
T17D61B974F1C12D6ADA1A1EB662BE3412E1B27F8207015A1C091FBB5C17FB32034D9EB9
MD5 SHA1 SHA512 TLSH

Submit Download

XLICONS.EXE.ico

Path C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE.ico
Size 3KB
SHA256 6454633b8c6a69aad48c3fc556c5e81cb5362db0c449b3f543bddfa41eba8d6b
MD5 fdb893a42e2519f60a9a943e687de76a
SHA1 9540510a3415d3bd50ec0416ec72af6809e8711e
SHA512 6c783bf16856305121dccb03fc749c66edaa063f730f274312bf29531b3abfd43c860196442f2e566800a383237c84a04a1bfea6fbb2be94004ada693b733c7c
TLSH
T1F861F7C443D872C3C8ECF234352AA51B5F95BA211410BE1D0EAC67C8BAA9E33FD5401B
MD5 SHA1 SHA512 TLSH

Submit Download

dbcicons.exe

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe
Size 843KB
SHA256 a01aa9b7ad51dc5c323cce142715c8e1dd6508520489522f878baa81b43fa806
MD5 daf6267d643f32965bc658ea9eaa4f29
SHA1 d9e4557c0a5565681341a32304fde4be16f2bbe9
SHA512 b6e4bd569fd9bd56545b3e9810f68fbd0277d459d3373e6703117bf21b343a62a6f991f177b8bbceb4071410c6ca961a0ecdecb314be4459e44976e85bd2aa61
SSDEEP 12288:8K6QXFZ3kk26z+eYja6u+d+viSRbFGw5i2M1cuF:8K6QXFxgoxYmL+4bFTQ1cuF
TLSH
T1DA058C6AF7816B03CBF8583CCDAB46E4BD29ADC749145C7F046C3B3E9F746502652AA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

misc.exe.ico

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe.ico
Size 3KB
SHA256 df2cca9b322f9432b3f3aa7b91a12dd5f22fd50e589e3107e066d99bdb071176
MD5 1e135e5bf5dbc0a82efa354c532e9c26
SHA1 b49dc6821a4e21d4c9f4385fb7658035a867dc82
SHA512 5e62520decd7db2d44477ee6e11da45bbb356138bf9482ba873b2cbaa69a44249b0515ee61a3438d835a18bb9fb2e229eca6d5a5da262938ac62245f539d8700
TLSH
T170618442693E89F8C5550530C9AF8FB00F341C17801095428733BEEFAEF5B60F62B668
MD5 SHA1 SHA512 TLSH

Submit Download

ohub32.exe.ico

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe.ico
Size 3KB
SHA256 063c8f44d23e1ebbe390ea320eee672c449f47333120b7abbd4a78094c613113
MD5 c8d18488a47a8054af9be67ebb94b6a2
SHA1 d231e824dd885833a1d6875741745994fc08ffa5
SHA512 1942ffe7db988342597c781a820b65b74dbf89862ea505285a1a96bafcfa48ac8f5b8f583aae0ccc0fe00bb3b80b897c61a87142f3b5f4274740fdf34256bf3e
TLSH
T127617E03F704D1A8C9883FF0F193022F32710D3614602F030B2DB888A9B10E8C426DBE
MD5 SHA1 SHA512 TLSH

Submit Download

pptico.exe.ico

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe.ico
Size 3KB
SHA256 3b07d1aaa1c9c27082d7811d694aae3d422d5d965a91b2d4b8ecda3a79f760a2
MD5 cdcde2807eee3a72d0b027bb11969739
SHA1 9b5bf494d53c68d3959d44c8e8cba399c55f2745
SHA512 aa91c211ec2ae00bc635958145b12ab7ae002e52f5ce7753e0790e96d9c61947a88b34b79e580772b53cc2492d5eb8bb69596d4de2106c1400ad64b4cceec645
TLSH
T1FA61AC5B72564B78C803D7719B228B5CF4AD7AE8E5324200C970F4762F24DB53B496BC
MD5 SHA1 SHA512 TLSH

Submit Download

sscicons.exe.ico

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe.ico
Size 3KB
SHA256 b2a350ffac5074add67fe974467351777915de5a319be7879ba15d1f6915a092
MD5 f142fd1b4cf10595f4565171b56388cb
SHA1 d8cff8a45fb7b27e34c9fc21eb672ff0a1d4076c
SHA512 3d045c3ceef64b1402605c9a0eb19d65c67f79553de4e21cdf935a0054475699102c25dab9cf3c36c9f9da0b81f350c81dc148726d0fd2e0717f961593dcd3d9
TLSH
T1F861C671A4323D58E54D573C8349B7D0E6064D852DF122AF312379BE0A741ABAAFF1D2
MD5 SHA1 SHA512 TLSH

Submit Download

wordicon.exe.ico

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe.ico
Size 3KB
SHA256 5bd706a18e0cf54197df7f1d5239f3e058652bfde372afcab230ee9b95ba14a5
MD5 bc5b17be640393be725d1c6bf384febb
SHA1 7acc0bcd224dce982aa2c109bd091b85179dcaa1
SHA512 ac17cf409d1652db87b91818d2a0f9a88136fef55389c2e7e3d2ec61b5d5012413ebf9dead6686fb0a16d5197a6af2c1fb6250a1dc46685c8350897ab6655eb4
TLSH
T18061E401D9E71E91FC23E2F6E60252F8327018780AD3112D79EC2ABAE5A4F0B30073C0
MD5 SHA1 SHA512 TLSH

Submit Download

vlc.exe.ico

Path C:\Program Files\VideoLAN\VLC\vlc.exe.ico
Size 3KB
SHA256 3b17b29b6c4e39fc36571f8e0795eae6559637529602ae7a37d5f8f6254d0500
MD5 0c328d41f4955cb0f6d408c63512c280
SHA1 3bf6219e411e79db50b8fb24557c692c5b82fcd0
SHA512 0185abba75dc735bdcc24a2d4003943c2a6a88e63eb806a058dbdc4ec4691ed03b7233e60d38e251ab6297f6eed1f446a9644b851d02fc14723551168436e762
TLSH
T18E6163703D321388C04B66BA86133A335E2A2FF61D43C6109B25728A2650FE1CA2D5B2
MD5 SHA1 SHA512 TLSH

Submit Download

wmplayer.exe.ico

Path C:\Program Files\Windows Media Player\wmplayer.exe.ico
Size 3KB
SHA256 a32208cf5c16d7223999e6ecf1c185bc88d519483ff56ad5ca5f2cc00e677307
MD5 44102aaaf107a6544eef73219f2c5f06
SHA1 c260d347155704cb817de08b8e72468897c446b6
SHA512 f575a3f5b83ccf08331c23419606414f487ad46c753ddd1b52cd15b89991e61f452f75b8162f88c29e0382c221ae4b9649560eda5138f82cc9a81b031f95ff3e
TLSH
T10A6167FD198B18C7E0054BF6C122AB421FC56CA15F071962EA80B54D3B316DF94D022D
MD5 SHA1 SHA512 TLSH

Submit Download

ArmReport.ini

Path C:\ProgramData\Adobe\ARM\ArmReport.ini
Size 782B
SHA256 8395f93b0e0240f5c79ce70bc2257f9cb0d92227b15f7724ba65b1c5c0b19625
MD5 29f1b2d1b6f9290138596cf180847e53
SHA1 ab496ce19c74cb15fe0b38807cf29db776336461
SHA512 bdadd50c6371d05f5d43fe7f95e8c02bd74842b0a7b982f571e80520d8748d67fc6f3912f9eb797edc476387168d597747b9a8705ded1ea473e5ee160c627227
TLSH
T1E0014C531AE81125F1B35A44DFF9947357327C975C2DC8AC90D8520E49E1940D5B27BB
MD5 SHA1 SHA512 TLSH

Submit Download

RdrManifest2.msi

Path C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-AC0A92D435E5}\RdrManifest2.msi
Size 18KB
SHA256 0abcb8b7c0bda3128316b3e4f4a5857e9c8194105043a0c0e9801a1a96105d01
MD5 f5d4c05bc8ea0d4fc4d277abda7369d9
SHA1 f67e793b159bd1e75ed4dec0de352ea1b6583708
SHA512 359a966c4dc8d62a570b428dfb3e666a63efd6bfff7c5b5ace3bc97ea09ba701d9fa524f439bf9902746c2ecac9c1f76c90868b0152eb825b2a09a9474fdbb34
SSDEEP 384:MrUq75oUFtb0F+o5nfy9jdIYigYws0i9Db9Ey8RbmL4A8UiINyGNB:MrUq75oUFtb0F+o5nfy9uYigY9K5ALdH
TLSH
T19D820BA2B4408C11CD868F3EA4C1D726D672BC813D8591C27565F219CFB23869A9F7EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VC_redist.x86.exe.ico

Path C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe.ico
Size 3KB
SHA256 6ed1664d7718a68084ea1a4abb1d9621a6ae8da8e19db35cfca13aaa4c05eb33
MD5 5cc1166b9cd6f8310369f631daf2f737
SHA1 8d2e3162e9b8ca7d196be95fc3b6e5b09e41ff61
SHA512 647617515c2750dfd460994a818bb759b40f867990102efbf592eccee7ed5460e7b731c87ae79af42cd18ccc16d8061102123747aa87a50e059b1490ae6e5411
TLSH
T10761E3576E5C8048DF843D31F4B6EB3003A3ACC13D916676A211B725EEBA3D399187AC
MD5 SHA1 SHA512 TLSH

Submit Download

windowsdesktop-runtime-8.0.15-win-x64.exe

Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
Size 1.3MB
SHA256 d2775eccfccec07977074df8730dd8417bd8566873f7fb2c26d5d7251900dd40
MD5 ce0fefbd3fd19dd6bda23fd6800abdf6
SHA1 31db81dbfdd295264ecccd6821616b9f4d981a55
SHA512 e1168fc251c6b46a2c77dea4a9f5075ae13699109a5a1b920b2f413beb1f97a534c5bf33ea670431d7413a8fb6538bcad090ec5f1770bb847c8461d7460cc184
SSDEEP 24576:x7keIf2q5rQG0+/lricSpioNNN2H1MvK/m39PZfePv3r7fm6t+jqp+3l+zCM0D:OeI+q5rx0Qp1M2gZ2HbbZt+jqpQ0CMO
TLSH
T1F255AE72F0948021E6FA1572EC3492F869289D21DBB58857D3C4FB1C7FF8585BAB7122
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VC_redist.x64.exe

Path C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
Size 1.4MB
SHA256 59823a52b0c067a5ca4025e38706a206d0bd78e8bbe8ed41fa3c5651cbdb675c
MD5 aebf4feb99a8f0944128367503f98d1c
SHA1 cb77141d24f5046542f963705fa05878e55d66f2
SHA512 e6b1e4be2d530c7841caa3434ef13a34ad9b5175559ff82f35ea1166b325382356aa02a257b5d14697d2c47a474cbf198c0b47dfbde6541c916b817765bf7c13
SSDEEP 24576:D751T0s+T7Nb2bGuVNWQYS5/DXTGpMysZgjS1hqgSC/izJfojymk4HM5yJ:T0v7hmiQxFKRjvQotoy4F
TLSH
T1E165BE71BD549C32D5F582325414C9702E7EAD802B05C67BF6D8B81EFAB414F3ABE2A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcredist_x64.exe

Path C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
Size 1.2MB
SHA256 155c1452e4d2a1724e61f14c94c2af7a8d15b740e24da63cc54d35d7c54efa63
MD5 6a9538adf41b8c748a4f15b9cd58332a
SHA1 901adb955d9a43fd77d6fd5e8d29d18859129eb3
SHA512 ecc7c4586f54b60dce63e58ff7f2f7dd5e9ca218fd481c0b45bf2944aa9cd46e3b1d4ce9d2ac6b3486ea3b7194fae4f98d555e6657cddad67cdbc151596be042
SSDEEP 24576:yxLF9CVdlBGisAwMYenGJiKEbXWtfOkUy:ypF9CNBeAnPnRWtGkf
TLSH
T1D645BF25FC64C625EC7D3CB25CA882B01FF9A8046F65046B02EDA92FE97B0456D7F325
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OneDriveSetup.exe.ico

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\OneDriveSetup.exe.ico
Size 3KB
SHA256 3a2d7fd9799178af58fbd08a2fffc56398cbf289c7ddd5c5f0fb2e241395261e
MD5 ea27d80794552048d73d1fdadac459d3
SHA1 f976de7f799d750ea73fdebefbe57ce9d81844d9
SHA512 f526d0d089d25625f6c24232334f0b1a18ec7682769d7c2ad6ffeef6a45231c8ce807e8276874e190ac7c9a9876432cc900c567042f6c046015f22aafd121753
TLSH
T15C614C71E91C517CF2D452334146120C440E4D1A19F51F401D333B18FD3D6A5552CEA3
MD5 SHA1 SHA512 TLSH

Submit Download

OneDriveStandaloneUpdater.exe

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe
Size 3.1MB
SHA256 1c9cb15627d129b432fb55c194057968bdb47a205d7474c87d4818b1c96d89fe
MD5 45351a87cce70d16a7f3b08b5c2149a7
SHA1 62cdb3dfff8a3ff0a2d539c6ede143a24ba8bfbc
SHA512 943e5c6fde6a756a6b9ed706c482147cf56d3183158edf89fd6d94a02fcbe731a364b87f0e4fea84c44c50adb22032fe261f97518b9ec91ca2b38526f5f025d1
SSDEEP 49152:l1wX9DdIaljyT0t8NVAjXR6t2jgZ8tzPFASjYhMleFLyJwXP9L8vzbtu14BCNbTg:cIoqnAjUt2jc8tzhYhMMFW8LMprG2
TLSH
T1FFE5CE21BFD5C032D1A351318AADABB9257CBD321B3385CB67C4274D1B745C2AA3A763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-08-09_09105ab1a2aeaaa76d7ddb706980f2ab_amadey_darkgate_elex_smoke-loader_stop.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-08-09_09105ab1a2aeaaa76d7ddb706980f2ab_amadey_darkgate_elex_smoke-loader_stop.exe.exe
Size 1.1MB
SHA256 97f405dead5a9463f7b223d72947311d4f94807dc24709f0ad5b7e91085ad848
MD5 076718063fac77083bd3d1e9d18b8d82
SHA1 8d3910896e37678e735e71739f125b5f702ce940
SHA512 01b57357b48a6d71a9f07f59e36454217bf946e440c575d43f3a6b5a4da268eb6e67c98e2c968b3b7ffa4cd3b2fcececf74e1da93e76c15fa600a2cbdd8f6159
SSDEEP 12288:k3Sgouvz0ZRHkXVfeeO4LMneqyQsWSjGQCfLBlS7guN1AnQ6i12NI+:+Sgouvz0ZRHkFfenxyQZXS7gZnQh2NI
TLSH
T15745E50267F94129F1F37B71EEB993645A77BCA1AE39C50E5280025E0DB4A90DE71B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-08-09_09105ab1a2aeaaa76d7ddb706980f2ab_amadey_darkgate_elex_smoke-loader_stop.exe.exe.ico

Path C:\Users\Admin\AppData\Local\Temp\2026-08-09_09105ab1a2aeaaa76d7ddb706980f2ab_amadey_darkgate_elex_smoke-loader_stop.exe.exe.ico
Size 3KB
SHA256 2f33dacaebb8bdf6d2d88550cce349c09b51dfeb4f499796f32bd30e14aab86c
MD5 36bffd836d98a23f463bce74cb62315a
SHA1 a47b9829a0b83f42abad3e224f0fb8a6e5a5dea9
SHA512 159b17807ac5c4162630d780cf46fccc7bd0b985c7023155c5459469774d44739123b965ff4d47174678a1e5959ff1936c97be1532ee41ca1dd25a011f8a0e15
TLSH
T1206128BDF108B47ED44B5B31C016923723924CD2BD1E600A76193B39A6796657E29163
MD5 SHA1 SHA512 TLSH

Submit Download

ArmUI.ini

Path C:\Users\Admin\AppData\Local\Temp\ArmUI.ini
Size 251KB
SHA256 b4d4dcd9594d372d7c0c975d80ef5802c88502895ed4b8a26ca62e225f2f18b0
MD5 864c22fb9a1c0670edf01c6ed3e4fbe4
SHA1 bf636f8baed998a1eb4531af9e833e6d3d8df129
SHA512 ff23616ee67d51daa2640ae638f59a8d331930a29b98c2d1bd3b236d2f651f243f9bae38d58515714886cfbb13b9be721d490aad4f2d10cbba74d7701ab34e09
SSDEEP 3072:wT4DJAvCXkQqSmSgojgTaDuK1+4xKtaU/QX5Pm9vR549QHmYPCjTMNro0Jnxu4Fn:xvUzH5
TLSH
T1B144E44363FC1209F6F37B41EEB852A44B77BDA5AA3EC15D1184015E08F5A90DA72BB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Tmp4E1B.tmp

Path C:\Users\Admin\AppData\Local\Temp\Tmp4E1B.tmp
Size 3KB
SHA256 ff9b4cf04e3202f150f19c1711767361343935da7841c98b876c42fd2cabce9b
MD5 bbb796dd2b53f7fb7ce855bb39535e2f
SHA1 dfb022a179775c82893fe8c4f59df8f6d19bd2fd
SHA512 0d122f454fcbf4524c2756692f0f33dc98f5bd2426839c6f03cd5c5f4fd507a8a15cf489d7a7ceadd1b95cf31b506c04bf03d613a9ba7d76add92766b1dc5c2b
TLSH
T10D71D9CF0D1A6413ABC7ED8EB1C5F3AB4C34A7E06AD1588B05B895C24FC3B862A5905D
MD5 SHA1 SHA512 TLSH

Submit Download

TmpA3CF.tmp

Path C:\Users\Admin\AppData\Local\Temp\TmpA3CF.tmp
Size 3KB
SHA256 19fe53c801ad7edc635f61e9e28d07da31780c2480e6f37ecfc63fffe1b250fe
MD5 ec946860cff4f4a6d325a8de7d6254d2
SHA1 7c909f646d9b2d23c58f73ec2bb603cd59dc11fd
SHA512 38a98b18dbae063bc533a1ff25a3467a7de197651e07e77a1b22cf8ce251282ab31f61dcff5c51ef186cfd115dc506181d480eabffbe92af01dee6282cbee13e
TLSH
T10971B9DB092A5413ABC7DE8AA2C5F3774C34A7E45B96548B087C95C34FCBB971B4401D
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2716-3333-0x0000000000400000-0x00000000004E1000-memory.dmp

Download

memory/2716-3363-0x0000000000400000-0x00000000004E1000-memory.dmp

Download

memory/5060-963-0x0000000000400000-0x00000000004E0000-memory.dmp

Download

memory/5060-0-0x0000000000400000-0x00000000004E0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads