Overview

overview

10

Static

static

3

2026-09-29...ar.exe

windows10-2004-x64

10

2026-09-29...ar.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    138s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    30/09/2026, 22:35

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-09-29_2f756d70d50fce97acac2e81d2bc27a3_amadey_darkgate_datper_elex_gcleaner_icedid_luca-stealer_njrat_remcos_vidar.exe
  • Size 21.5MB
  • Sample260930-2hn7ystdma
  • SHA256 ee751ee890eb57fbdb9cd2079e9d27dfec97ac4576eaebc3e255e692a8756b06
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoveryinstallerpersistenceprivilege_escalation

Malware Config

Signatures

  • Modifies security service 2 TTPs 2 IoCs
    defense_evasion
  • Drops file in Drivers directory 3 IoCs
  • Modifies Windows Firewall 2 TTPs 2 IoCs
    defense_evasion
  • Executes dropped EXE 7 IoCs
  • Loads dropped DLL 37 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 24 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 18 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 21 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 27 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 18 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Inno Setup is an open-source installation builder for Windows applications. 6 IoCs

    Inno Setup installer

    installer
  • Checks SCSI registry key(s) 3 TTPs 52 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 25 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious behavior: LoadsDriver 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 12 IoCs
  • Suspicious use of SendNotifyMessage 11 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-09-29_2f756d70d50fce97acac2e81d2bc27a3_amadey_darkgate_datper_elex_gcleaner_icedid_luca-stealer_njrat_remcos_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-09-29_2f756d70d50fce97acac2e81d2bc27a3_amadey_darkgate_datper_elex_gcleaner_icedid_luca-stealer_njrat_remcos_vidar.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3428
    • C:\Users\Admin\AppData\Local\Temp\._cache_2026-09-29_2f756d70d50fce97acac2e81d2bc27a3_amadey_darkgate_datper_elex_gcleaner_icedid_luca-stealer_njrat_remcos_vidar.exe
      "C:\Users\Admin\AppData\Local\Temp\._cache_2026-09-29_2f756d70d50fce97acac2e81d2bc27a3_amadey_darkgate_datper_elex_gcleaner_icedid_luca-stealer_njrat_remcos_vidar.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1412
      • C:\Users\Admin\AppData\Local\Temp\is-7B91I.tmp\._cache_2026-09-29_2f756d70d50fce97acac2e81d2bc27a3_amadey_darkgate_datper_elex_gcleaner_icedid_luca-stealer_njrat_remcos_vidar.tmp
        "C:\Users\Admin\AppData\Local\Temp\is-7B91I.tmp\._cache_2026-09-29_2f756d70d50fce97acac2e81d2bc27a3_amadey_darkgate_datper_elex_gcleaner_icedid_luca-stealer_njrat_remcos_vidar.tmp" /SL5="$400AE,21124305,189952,C:\Users\Admin\AppData\Local\Temp\._cache_2026-09-29_2f756d70d50fce97acac2e81d2bc27a3_amadey_darkgate_datper_elex_gcleaner_icedid_luca-stealer_njrat_remcos_vidar.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        PID:1776
    • C:\Program Files (x86)\Google Chrome Helper\chromehelper.exe
      "C:\Program Files (x86)\Google Chrome Helper\chromehelper.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:3688
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Adds Run key to start application
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1096
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 7206D869F54CB3074B15BF1EC8E4F137
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:4816
    • C:\Windows\Installer\MSI8842.tmp
      "C:\Windows\Installer\MSI8842.tmp" install "C:\Program Files (x86)\Radmin VPN\Driver.1.1\NetMP60.inf" "C:\Program Files (x86)\Radmin VPN\Driver.1.0\NetMP60.inf" ad_InstallDriver_64 ""
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Checks SCSI registry key(s)
      • Modifies data under HKEY_USERS
      • Suspicious use of AdjustPrivilegeToken
      PID:2344
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding B5BDF6CF67CC02E6A8694CCBC5850F48 E Global\MSI0000
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4448
      • C:\Windows\SysWOW64\netsh.exe
        netsh advfirewall firewall add rule name="Radmin VPN Control Service" dir=in action=allow program="C:\Program Files (x86)\Radmin VPN\RvControlSvc.exe" enable=yes profile=any edge=yes
        3⤵
        • Modifies Windows Firewall
        • Event Triggered Execution: Netsh Helper DLL
        • System Location Discovery: System Language Discovery
        PID:5460
      • C:\Windows\SysWOW64\netsh.exe
        netsh advfirewall firewall add rule name="Radmin VPN icmpv4" action=allow enable=yes dir=in profile=any remoteip=26.0.0.0/8 protocol=icmpv4
        3⤵
        • Modifies Windows Firewall
        • Event Triggered Execution: Netsh Helper DLL
        • System Location Discovery: System Language Discovery
        PID:3712
  • C:\Windows\system32\DrvInst.exe
    DrvInst.exe "4" "1" "c:\program files (x86)\radmin vpn\driver.1.1\netmp60.inf" "9" "42f731a47" "0000000000000164" "WinSta0\Default" "0000000000000174" "208" "c:\program files (x86)\radmin vpn\driver.1.1"
    1⤵
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Checks SCSI registry key(s)
    • Modifies data under HKEY_USERS
    PID:996
  • C:\Program Files (x86)\Radmin VPN\RvRvpnGui.exe
    "C:\Program Files (x86)\Radmin VPN\RvRvpnGui.exe" /minimized
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    PID:3784
  • C:\Windows\system32\DrvInst.exe
    DrvInst.exe "2" "211" "ROOT\NET\0000" "C:\Windows\System32\DriverStore\FileRepository\netmp60.inf_amd64_f32b93923791d26a\netmp60.inf" "oem1.inf:c36c271bc64eefc9:RVpnNetMP.ndi:15.39.54.8:{b06d84d1-af78-41ec-a5b9-3cce676528b2}\rvnetmp60," "42f731a47" "00000000000000E0" "e4e3"
    1⤵
    • Drops file in Drivers directory
    • Drops file in Windows directory
    • Checks SCSI registry key(s)
    • Suspicious use of AdjustPrivilegeToken
    PID:4956
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k GPSvcGroup
    1⤵
      PID:2384
    • C:\Program Files (x86)\Radmin VPN\RvControlSvc.exe
      "C:\Program Files (x86)\Radmin VPN\RvControlSvc.exe" /service
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in System32 directory
      • Reads the TCP/IP host and domain name from the registry
      • System Location Discovery: System Language Discovery
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2180
      • C:\Windows\SysWOW64\netsh.exe
        C:\Windows\system32\netsh.exe interface set interface name="Ethernet 2" newname="Radmin VPN"
        2⤵
        • Event Triggered Execution: Netsh Helper DLL
        • System Location Discovery: System Language Discovery
        PID:2540
      • C:\Windows\SysWOW64\netsh.exe
        C:\Windows\system32\netsh.exe interface set interface "Radmin VPN" ENABLE
        2⤵
        • Event Triggered Execution: Netsh Helper DLL
        • System Location Discovery: System Language Discovery
        PID:728
      • C:\Windows\SysWOW64\netsh.exe
        C:\Windows\system32\netsh.exe interface ipv4 set interface interface="Radmin VPN" metric=1
        2⤵
        • Event Triggered Execution: Netsh Helper DLL
        • System Location Discovery: System Language Discovery
        PID:996
      • C:\Windows\SysWOW64\netsh.exe
        C:\Windows\system32\netsh.exe interface ip delete route prefix=0.0.0.0/0 interface="Radmin VPN" nexthop=26.0.0.1
        2⤵
        • Event Triggered Execution: Netsh Helper DLL
        • System Location Discovery: System Language Discovery
        PID:4308
      • C:\Windows\SysWOW64\netsh.exe
        C:\Windows\system32\netsh.exe interface ip add route prefix=0.0.0.0/0 interface="Radmin VPN" nexthop=26.0.0.1 publish=Yes metric=9256
        2⤵
        • Event Triggered Execution: Netsh Helper DLL
        • System Location Discovery: System Language Discovery
        PID:4964
      • C:\Windows\SysWOW64\netsh.exe
        C:\Windows\system32\netsh.exe interface ip add address name="Radmin VPN" addr=26.84.52.87 mask=255.0.0.0 gateway=26.0.0.1 gwmetric=9256
        2⤵
        • Event Triggered Execution: Netsh Helper DLL
        • System Location Discovery: System Language Discovery
        PID:4736
      • C:\Windows\SysWOW64\netsh.exe
        C:\Windows\system32\netsh.exe interface ipv6 add address interface="Radmin VPN" address=fdfd::1a54:3457
        2⤵
        • Event Triggered Execution: Netsh Helper DLL
        • System Location Discovery: System Language Discovery
        PID:1152
    • C:\Program Files (x86)\Radmin VPN\RvRvpnGui.exe
      "C:\Program Files (x86)\Radmin VPN\RvRvpnGui.exe" /show
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      PID:2308
    • C:\Windows\System32\svchost.exe
      C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s Netman
      1⤵
      • Modifies data under HKEY_USERS
      PID:3532
    • C:\Windows\System32\svchost.exe
      C:\Windows\System32\svchost.exe -k NetSvcs -p -s iphlpsvc
      1⤵
      • Modifies security service
      PID:2276

    Network

          MITRE ATT&CK Enterprise v16

          Reconnaissance

          Resource Development

          Initial Access

          Execution

          Persistence

          Boot or Logon Autostart Execution

          1
          T1547

          Registry Run Keys / Startup Folder

          1
          T1547.001

          Create or Modify System Process

          2
          T1543

          Windows Service

          2
          T1543.003

          Event Triggered Execution

          1
          T1546

          Netsh Helper DLL

          1
          T1546.007

          Privilege Escalation

          Boot or Logon Autostart Execution

          1
          T1547

          Registry Run Keys / Startup Folder

          1
          T1547.001

          Create or Modify System Process

          2
          T1543

          Windows Service

          2
          T1543.003

          Event Triggered Execution

          1
          T1546

          Netsh Helper DLL

          1
          T1546.007

          Defense Evasion

          Impair Defenses

          1
          T1562

          Disable or Modify System Firewall

          1
          T1562.004

          Modify Registry

          2
          T1112

          Credential Access

          Discovery

          Peripheral Device Discovery

          2
          T1120

          Query Registry

          2
          T1012

          System Information Discovery

          3
          T1082

          System Location Discovery

          1
          T1614

          System Language Discovery

          1
          T1614.001

          System Network Configuration Discovery

          1
          T1016

          Lateral Movement

          Collection

          Command and Control

          Exfiltration

          Impact

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          e597170.rbs
          • Path C:\Config.Msi\e597170.rbs
          • Size 882KB
          • SHA256 875428a69acda34c404935f2739373cd7d1c22b80d8b3dff239d5dfcfb6a444b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          chromehelper.exe
          • Path C:\Program Files (x86)\Google Chrome Helper\chromehelper.exe
          • Size 726KB
          • SHA256 baddfb48e8d43de4912f1029461cff405715d944f4d37c34cad3e11e60c6b3e9
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          NetMP60.inf
          • Path C:\Program Files (x86)\Radmin VPN\Driver.1.1\NetMP60.inf
          • Size 5KB
          • SHA256 ef6769520c94a3b5885458cd19696b45cf79010e9757729b2049ba6782fecfd7
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Qt5Core.dll
          • Path C:\Program Files (x86)\Radmin VPN\Qt5Core.dll
          • Size 5.7MB
          • SHA256 c59a08385bbcb2a365eaef65e0fcd0e7c348be033871472a79ea0ffaf953035f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Qt5Gui.dll
          • Path C:\Program Files (x86)\Radmin VPN\Qt5Gui.dll
          • Size 6.4MB
          • SHA256 d2bfd11de25ff2dfbb25fc36b3b719ba0a265d692fb8cde36232bac15e1dbe1c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Qt5Network.dll
          • Path C:\Program Files (x86)\Radmin VPN\Qt5Network.dll
          • Size 1.1MB
          • SHA256 56a9f187e5c5b34db814a3c6d361b2135a1034582cdfc5166aba18519d44e986
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Qt5Svg.dll
          • Path C:\Program Files (x86)\Radmin VPN\Qt5Svg.dll
          • Size 371KB
          • SHA256 e4265fde83177c7e43674a057b219eea7ec95a2e42a82a7a77f4b901481223e1
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Qt5Widgets.dll
          • Path C:\Program Files (x86)\Radmin VPN\Qt5Widgets.dll
          • Size 5.5MB
          • SHA256 14733381ecdeaf6370eea31f5df655d2354dcc67ad1866c9170a5884efe84909
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Qt5WinExtras.dll
          • Path C:\Program Files (x86)\Radmin VPN\Qt5WinExtras.dll
          • Size 486KB
          • SHA256 b9d95d74851b475f63852883ce31855f0b214302eaa3b49cb69ef347db2f5646
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          RvControlSvc.exe
          • Path C:\Program Files (x86)\Radmin VPN\RvControlSvc.exe
          • Size 1.0MB
          • SHA256 36baea67e6c627f24ba02976a0236ded5224681ff7dab6f3a1eede73bd61ced6
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          RvDownloader.dll
          • Path C:\Program Files (x86)\Radmin VPN\RvDownloader.dll
          • Size 357KB
          • SHA256 98123fc5750c7c1d50578e7236bd7065d465927a427985df0f735303c97cd4a3
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          RvEnetConnect.dll
          • Path C:\Program Files (x86)\Radmin VPN\RvEnetConnect.dll
          • Size 413KB
          • SHA256 62d6737b22163a65c0ec1ad1acbe3d5501865aac15a9a7a872ddfb2b612e29e7
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          RvROLClient.dll
          • Path C:\Program Files (x86)\Radmin VPN\RvROLClient.dll
          • Size 1.3MB
          • SHA256 e5c5c7774f9769d920a3ae78787c64d95ded6bfd39c452f718e291106bf48276
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          RvRolUpdater.dll
          • Path C:\Program Files (x86)\Radmin VPN\RvRolUpdater.dll
          • Size 478KB
          • SHA256 8ef017cc7eeba8cf34c33bd59ea696196ac0f23ac903ccfe5d1a5061dd7e711a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          RvRvpnGui.exe
          • Path C:\Program Files (x86)\Radmin VPN\RvRvpnGui.exe
          • Size 2.0MB
          • SHA256 4cfb334d8196cd378069b8fe069cd3be36bd3f6e0195192abe0dec6135fa77ff
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          RvRvpnGui_en_us.qm
          • Path C:\Program Files (x86)\Radmin VPN\RvRvpnGui_en_us.qm
          • Size 21KB
          • SHA256 48b939cc90beec0478c7856f699f707017d0a00a00ca62042b26e7f57331373c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          RvTCPConnect.dll
          • Path C:\Program Files (x86)\Radmin VPN\RvTCPConnect.dll
          • Size 413KB
          • SHA256 64ffa460c99e554547b12e1488e76b899513467ef3051391bae4da93c2b18de6
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          RvTRSConnect.dll
          • Path C:\Program Files (x86)\Radmin VPN\RvTRSConnect.dll
          • Size 695KB
          • SHA256 a6ea92721282365ab6c31347732a0efe864ddd94e743e9b4f2a6cf11000892a1
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          RvUESClient.dll
          • Path C:\Program Files (x86)\Radmin VPN\RvUESClient.dll
          • Size 356KB
          • SHA256 d39aed90973525c09f707f6b12eb699aef25cc6f63c3374f6bc7e75411f49f29
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          qgif.dll
          • Path C:\Program Files (x86)\Radmin VPN\imageformats\qgif.dll
          • Size 40KB
          • SHA256 b49c00a14a146d53c912f3a52024241079202e8ac54fbbc6684a2fa8e5bd3157
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          qico.dll
          • Path C:\Program Files (x86)\Radmin VPN\imageformats\qico.dll
          • Size 39KB
          • SHA256 796d9587583a430e98212597cc16fd831abaad52f899e515a77b4e629acc1fb5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          qsvg.dll
          • Path C:\Program Files (x86)\Radmin VPN\imageformats\qsvg.dll
          • Size 30KB
          • SHA256 e4767f946eb6d0fe76bcecdd56df5f215fdca17ef35ec1e5dab00c09b14b407f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          msvcp140.dll
          • Path C:\Program Files (x86)\Radmin VPN\msvcp140.dll
          • Size 438KB
          • SHA256 2db7fd3c9c3c4b67f2d50a5a50e8c69154dc859780dd487c28a4e6ed1af90d01
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          qwindows.dll
          • Path C:\Program Files (x86)\Radmin VPN\platforms\qwindows.dll
          • Size 1.3MB
          • SHA256 85f6b7d3dba47289f6109169db3212abec22ee842b9bd78d70798e97db4aecf2
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          shelper.dll
          • Path C:\Program Files (x86)\Radmin VPN\shelper.dll
          • Size 726KB
          • SHA256 d89daf6bcd5cafa3c7f6173f835ccf045baf8e7134f868819db6fd7615959ac4
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          vcruntime140.dll
          • Path C:\Program Files (x86)\Radmin VPN\vcruntime140.dll
          • Size 78KB
          • SHA256 9d02e952396bdff3abfe5654e07b7a713c84268a225e11ed9a3bf338ed1e424c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ._cache_2026-09-29_2f756d70d50fce97acac2e81d2bc27a3_amadey_darkgate_datper_elex_gcleaner_icedid_luca-stealer_njrat_remcos_vidar.exe
          • Path C:\Users\Admin\AppData\Local\Temp\._cache_2026-09-29_2f756d70d50fce97acac2e81d2bc27a3_amadey_darkgate_datper_elex_gcleaner_icedid_luca-stealer_njrat_remcos_vidar.exe
          • Size 20.7MB
          • SHA256 1f4d6ca8cc9230c4b3c87ec4babbdc3749c471b3065d850058abb2258cd8c79f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          RadminVPN_1.3.4568.3.msi
          • Path C:\Users\Admin\AppData\Local\Temp\is-3VM41.tmp\RadminVPN_1.3.4568.3.msi
          • Size 19.8MB
          • SHA256 a846e0eca7af1e257735daa568046235c88632c7b40f25594f2d8b455dfdd1ae
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Rvis_install_dll.dll
          • Path C:\Users\Admin\AppData\Local\Temp\is-3VM41.tmp\Rvis_install_dll.dll
          • Size 361KB
          • SHA256 ec8d9949fe10f84f7950b498ddca87e6c07189158cd89bddca0c7e2d69289893
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ._cache_2026-09-29_2f756d70d50fce97acac2e81d2bc27a3_amadey_darkgate_datper_elex_gcleaner_icedid_luca-stealer_njrat_remcos_vidar.tmp
          • Path C:\Users\Admin\AppData\Local\Temp\is-7B91I.tmp\._cache_2026-09-29_2f756d70d50fce97acac2e81d2bc27a3_amadey_darkgate_datper_elex_gcleaner_icedid_luca-stealer_njrat_remcos_vidar.tmp
          • Size 1.2MB
          • SHA256 421cb7e48e3063d927eefe28940e119fb1309a3990bc7325c7f7052a2b286a09
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          MSI8842.tmp
          • Path C:\Windows\Installer\MSI8842.tmp
          • Size 495KB
          • SHA256 a098115e03a542a19459f252ddc7dabf733e9dd612585c71db978d9b0f8cf984
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          MSI99F6.tmp
          • Path C:\Windows\Installer\MSI99F6.tmp
          • Size 366KB
          • SHA256 8a96198043910d6673de6626b814b932f424f954f3d8b4e9e1b5c5f08549096c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          netmp60.inf_amd64_f32b93923791d26a.ini
          • Path C:\Windows\System32\DriverStore\FileRepository\netmp60.inf_amd64_f32b93923791d26a.ini
          • Size 418B
          • SHA256 03d2281f07e9842fc94593a7b690de4540c95143c879f0bc73cdf2c91bdcc740
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          RvNetMP60.sys
          • Path \??\c:\PROGRA~2\RADMIN~1\DRIVER~1.1\RvNetMP60.sys
          • Size 56KB
          • SHA256 88765957ac41e3f00f1fd98393342ea40ddcc05952aba418e099d866296c1bf2
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          NetMP60.cat
          • Path \??\c:\program files (x86)\radmin vpn\driver.1.1\NetMP60.cat
          • Size 10KB
          • SHA256 6ba444527b66803b9fa43b80509788c761fa18b52360e27b74cc2e8a1c115b3a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          memory/1412-334-0x0000000000400000-0x0000000000439000-memory.dmp
          Download

          memory/1412-85-0x0000000000400000-0x0000000000439000-memory.dmp
          Download

          memory/1412-60-0x0000000000400000-0x0000000000439000-memory.dmp
          Download

          memory/1776-332-0x0000000000400000-0x000000000053C000-memory.dmp
          Download

          memory/1776-86-0x0000000000400000-0x000000000053C000-memory.dmp
          Download

          memory/1776-333-0x0000000000400000-0x000000000053C000-memory.dmp
          Download

          memory/3428-82-0x0000000003740000-0x0000000003741000-memory.dmp
          Download

          memory/3428-83-0x0000000000400000-0x0000000001984000-memory.dmp
          Download

          memory/3428-0-0x0000000003740000-0x0000000003741000-memory.dmp
          Download

          memory/3428-1-0x000000000048E000-0x000000000048F000-memory.dmp
          Download

          memory/3428-351-0x0000000000400000-0x0000000001984000-memory.dmp
          Download

          memory/3688-352-0x0000000000400000-0x00000000004C5000-memory.dmp
          Download