6c17eedb3ff42a1ab0d7ab2f78486c4cfa39386d06afafff1a4f12e35b95a335

Analysis

max time kernel
149s
max time network
108s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/10/2026, 03:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-13_e0f78089dff62e2348fe201cd674aeaf_darkgate_elex_mafia_smoke-loader.exe
Size 2.3MB
Sample261014-d7zg8ae16w
SHA256 6c17eedb3ff42a1ab0d7ab2f78486c4cfa39386d06afafff1a4f12e35b95a335
MD5 e0f78089dff62e2348fe201cd674aeaf
SHA1 f59ffd6f9136f65899378bf7fee9eeca9e732e17
SHA512 24a0f5cf9677be22ede01336982d87d0936326b03b2931108331fced3fbfa5723d75de4e48510721829dd6b1c0265135b12f9b982777a30943a14831b6d0598f
SSDEEP 49152:cyNLrjjSTtQwZwOIyR7fJATyIeOgWfPfyDLmd/DIuJxThJqEB6ZmKYGCsWH/mxEh:bSTtQARtATyIe+fPf6Lmd/DI0xT56sKe
TLSH
T176B56C2A76A18036D3B232705A695379DEFAB9E04B35F68792D04D3C2E305D1BD3472B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery persistence

Malware Config

Signatures

UPX dump on OEP (original entry point) 1 IoCs

resource	yara_rule
behavioral2/files/0x000c00000001c5b9-100.dat	UPX

Executes dropped EXE 1 IoCs

pid	Process
4476	FWAInstallMonitor.exe

Loads dropped DLL 11 IoCs

pid	Process
2836	MsiExec.exe
2836	MsiExec.exe
2836	MsiExec.exe
2836	MsiExec.exe
2836	MsiExec.exe
2836	MsiExec.exe
2836	MsiExec.exe
2836	MsiExec.exe
2836	MsiExec.exe
2836	MsiExec.exe
2836	MsiExec.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\FWAInstaller = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-10-13_e0f78089dff62e2348fe201cd674aeaf_darkgate_elex_mafia_smoke-loader.exe\" -r"	2026-10-13_e0f78089dff62e2348fe201cd674aeaf_darkgate_elex_mafia_smoke-loader.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\FWAInstaller = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-10-13_e0f78089dff62e2348fe201cd674aeaf_darkgate_elex_mafia_smoke-loader.exe\" -r"	2026-10-13_e0f78089dff62e2348fe201cd674aeaf_darkgate_elex_mafia_smoke-loader.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\D:	Msiexec.exe
File opened (read-only)	\??\T:	Msiexec.exe
File opened (read-only)	\??\V:	Msiexec.exe
File opened (read-only)	\??\J:	Msiexec.exe
File opened (read-only)	\??\T:	Msiexec.exe
File opened (read-only)	\??\X:	Msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\P:	Msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\M:	Msiexec.exe
File opened (read-only)	\??\W:	Msiexec.exe
File opened (read-only)	\??\Y:	Msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\O:	Msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\H:	Msiexec.exe
File opened (read-only)	\??\G:	Msiexec.exe
File opened (read-only)	\??\Z:	Msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Q:	Msiexec.exe
File opened (read-only)	\??\R:	Msiexec.exe
File opened (read-only)	\??\X:	Msiexec.exe
File opened (read-only)	\??\J:	Msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\K:	Msiexec.exe
File opened (read-only)	\??\N:	Msiexec.exe
File opened (read-only)	\??\U:	Msiexec.exe
File opened (read-only)	\??\N:	Msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\P:	Msiexec.exe
File opened (read-only)	\??\S:	Msiexec.exe
File opened (read-only)	\??\L:	Msiexec.exe
File opened (read-only)	\??\U:	Msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\A:	Msiexec.exe
File opened (read-only)	\??\G:	Msiexec.exe
File opened (read-only)	\??\Z:	Msiexec.exe
File opened (read-only)	\??\H:	Msiexec.exe
File opened (read-only)	\??\R:	Msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	Msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\B:	Msiexec.exe
File opened (read-only)	\??\D:	Msiexec.exe
File opened (read-only)	\??\Y:	Msiexec.exe
File opened (read-only)	\??\A:	Msiexec.exe
File opened (read-only)	\??\I:	Msiexec.exe
File opened (read-only)	\??\K:	Msiexec.exe
File opened (read-only)	\??\Q:	Msiexec.exe
File opened (read-only)	\??\I:	Msiexec.exe
File opened (read-only)	\??\L:	Msiexec.exe
File opened (read-only)	\??\M:	Msiexec.exe

Drops file in Windows directory 16 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Products.ini	2026-10-13_e0f78089dff62e2348fe201cd674aeaf_darkgate_elex_mafia_smoke-loader.exe
File opened for modification	C:\Windows\Installer\MSIB200.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB995.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBA26.tmp	msiexec.exe
File opened for modification	C:\Windows\Products.ini	2026-10-13_e0f78089dff62e2348fe201cd674aeaf_darkgate_elex_mafia_smoke-loader.exe
File opened for modification	C:\Windows\Installer\MSIB7DD.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB9D5.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBA05.tmp	msiexec.exe
File created	C:\Windows\Installer\e59af80.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB9B5.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBA55.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e59af80.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB89A.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBA95.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBAB5.tmp	msiexec.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-13_e0f78089dff62e2348fe201cd674aeaf_darkgate_elex_mafia_smoke-loader.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-13_e0f78089dff62e2348fe201cd674aeaf_darkgate_elex_mafia_smoke-loader.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-13_e0f78089dff62e2348fe201cd674aeaf_darkgate_elex_mafia_smoke-loader.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-13_e0f78089dff62e2348fe201cd674aeaf_darkgate_elex_mafia_smoke-loader.exe

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-13_e0f78089dff62e2348fe201cd674aeaf_darkgate_elex_mafia_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FWAInstallMonitor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-13_e0f78089dff62e2348fe201cd674aeaf_darkgate_elex_mafia_smoke-loader.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
2308	taskkill.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5196	Msiexec.exe
Token: SeIncreaseQuotaPrivilege	5196	Msiexec.exe
Token: SeSecurityPrivilege	3340	msiexec.exe
Token: SeCreateTokenPrivilege	5196	Msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	5196	Msiexec.exe
Token: SeLockMemoryPrivilege	5196	Msiexec.exe
Token: SeIncreaseQuotaPrivilege	5196	Msiexec.exe
Token: SeMachineAccountPrivilege	5196	Msiexec.exe
Token: SeTcbPrivilege	5196	Msiexec.exe
Token: SeSecurityPrivilege	5196	Msiexec.exe
Token: SeTakeOwnershipPrivilege	5196	Msiexec.exe
Token: SeLoadDriverPrivilege	5196	Msiexec.exe
Token: SeSystemProfilePrivilege	5196	Msiexec.exe
Token: SeSystemtimePrivilege	5196	Msiexec.exe
Token: SeProfSingleProcessPrivilege	5196	Msiexec.exe
Token: SeIncBasePriorityPrivilege	5196	Msiexec.exe
Token: SeCreatePagefilePrivilege	5196	Msiexec.exe
Token: SeCreatePermanentPrivilege	5196	Msiexec.exe
Token: SeBackupPrivilege	5196	Msiexec.exe
Token: SeRestorePrivilege	5196	Msiexec.exe
Token: SeShutdownPrivilege	5196	Msiexec.exe
Token: SeDebugPrivilege	5196	Msiexec.exe
Token: SeAuditPrivilege	5196	Msiexec.exe
Token: SeSystemEnvironmentPrivilege	5196	Msiexec.exe
Token: SeChangeNotifyPrivilege	5196	Msiexec.exe
Token: SeRemoteShutdownPrivilege	5196	Msiexec.exe
Token: SeUndockPrivilege	5196	Msiexec.exe
Token: SeSyncAgentPrivilege	5196	Msiexec.exe
Token: SeEnableDelegationPrivilege	5196	Msiexec.exe
Token: SeManageVolumePrivilege	5196	Msiexec.exe
Token: SeImpersonatePrivilege	5196	Msiexec.exe
Token: SeCreateGlobalPrivilege	5196	Msiexec.exe
Token: SeRestorePrivilege	3340	msiexec.exe
Token: SeTakeOwnershipPrivilege	3340	msiexec.exe
Token: SeRestorePrivilege	3340	msiexec.exe
Token: SeTakeOwnershipPrivilege	3340	msiexec.exe
Token: SeShutdownPrivilege	2880	Msiexec.exe
Token: SeIncreaseQuotaPrivilege	2880	Msiexec.exe
Token: SeRestorePrivilege	3340	msiexec.exe
Token: SeTakeOwnershipPrivilege	3340	msiexec.exe
Token: SeRestorePrivilege	3340	msiexec.exe
Token: SeTakeOwnershipPrivilege	3340	msiexec.exe
Token: SeRestorePrivilege	3340	msiexec.exe
Token: SeTakeOwnershipPrivilege	3340	msiexec.exe
Token: SeRestorePrivilege	3340	msiexec.exe
Token: SeTakeOwnershipPrivilege	3340	msiexec.exe
Token: SeRestorePrivilege	3340	msiexec.exe
Token: SeTakeOwnershipPrivilege	3340	msiexec.exe
Token: SeRestorePrivilege	3340	msiexec.exe
Token: SeTakeOwnershipPrivilege	3340	msiexec.exe
Token: SeRestorePrivilege	3340	msiexec.exe
Token: SeTakeOwnershipPrivilege	3340	msiexec.exe
Token: SeRestorePrivilege	3340	msiexec.exe
Token: SeTakeOwnershipPrivilege	3340	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2836	MsiExec.exe
Token: SeSecurityPrivilege	2836	MsiExec.exe
Token: SeTakeOwnershipPrivilege	2836	MsiExec.exe
Token: SeLoadDriverPrivilege	2836	MsiExec.exe
Token: SeSystemProfilePrivilege	2836	MsiExec.exe
Token: SeSystemtimePrivilege	2836	MsiExec.exe
Token: SeProfSingleProcessPrivilege	2836	MsiExec.exe
Token: SeIncBasePriorityPrivilege	2836	MsiExec.exe
Token: SeCreatePagefilePrivilege	2836	MsiExec.exe
Token: SeBackupPrivilege	2836	MsiExec.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
5196	Msiexec.exe
3340	msiexec.exe
2836	MsiExec.exe
2880	Msiexec.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4820 wrote to memory of 5196	4820	2026-10-13_e0f78089dff62e2348fe201cd674aeaf_darkgate_elex_mafia_smoke-loader.exe	89
PID 3340 wrote to memory of 2836	3340	msiexec.exe	93
PID 5804 wrote to memory of 2880	5804	2026-10-13_e0f78089dff62e2348fe201cd674aeaf_darkgate_elex_mafia_smoke-loader.exe	94
PID 2836 wrote to memory of 2308	2836	MsiExec.exe	95
PID 2836 wrote to memory of 4476	2836	MsiExec.exe	99

C:\Users\Admin\AppData\Local\Temp\2026-10-13_e0f78089dff62e2348fe201cd674aeaf_darkgate_elex_mafia_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-13_e0f78089dff62e2348fe201cd674aeaf_darkgate_elex_mafia_smoke-loader.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4820
- C:\Windows\SysWOW64\Msiexec.exe
  Msiexec /i "C:\Users\Admin\AppData\Local\Temp\ProductInstaller\Web Agent_C64.msi" /q REBOOT="ReallySuppress" PAYLOADINFO="https://www8.deepfreeze.com/|83cb4b5b-830a-457f-981c-fc5bf4859ddb|0|2|FWAWSEDFEFRC||1791826420|0|||"
  2⤵
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:5196

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3340
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 6AEAA4F13C7ABF658DFDB651395C4521
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2836
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /IM FWAInstallMonitor.exe /F
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:2308
- - C:\ProgramData\FWAInstallMonitor.exe
    "C:\ProgramData\FWAInstallMonitor.exe" /StartMonitor /CreateStartUpMonitorTask /MsiPath "C:\Users\Admin\AppData\Local\Temp\ProductInstaller\Web Agent_C64.msi" /Pid 2836
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4476

C:\Users\Admin\AppData\Local\Temp\2026-10-13_e0f78089dff62e2348fe201cd674aeaf_darkgate_elex_mafia_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-13_e0f78089dff62e2348fe201cd674aeaf_darkgate_elex_mafia_smoke-loader.exe" -r
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5804
- C:\Windows\SysWOW64\Msiexec.exe
  Msiexec /i "C:\Users\Admin\AppData\Local\Temp\ProductInstaller\Web Agent_C64.msi" /q REBOOT="ReallySuppress" PAYLOADINFO="https://www8.deepfreeze.com/|83cb4b5b-830a-457f-981c-fc5bf4859ddb|0|2|FWAWSEDFEFRC||1791826420|0|||"
  2⤵
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2880

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CloudAgentCleanupHelper.LOG

Path C:\ProgramData\CloudAgentCleanupHelper.LOG
Size 1KB
SHA256 c478e9a2d499c65316a580adc28f3b9d8e3ae65eee1a1ab2cef23b7ccd437493
MD5 e1f2c8b3dfb7caf7df92a6b91a71f1d5
SHA1 316da3977edfb87b3569f604ac058145796e8454
SHA512 4fc73a01a76fcc9b0236d37a1aa950db38daeddd4e3b242ca92da26921df71c1bafec401b56c2ce9bde578abff4c9a052fb22068d50c65e7c113e7517ee1e1f7
TLSH
T18421292135C4500788B437F032BA9DEF93E3F9F93685A27D7621A78358CC11EDB18641
MD5 SHA1 SHA512 TLSH

Submit Download

CloudAgentCleanupHelper.LOG

Path C:\ProgramData\CloudAgentCleanupHelper.LOG
Size 26KB
SHA256 b78013949e72109d6e20ed52cfcedbb53dcc7d48d21fa27e1c096cfd83a42fcf
MD5 35300a1babee8c9c24d1a230b3ff79cc
SHA1 6e5f060e9babdebfa9f59a5433f78ba1bae8a1eb
SHA512 f0e2e80a5657bb0c2d723a0bb29438dc99dbb7e21ba32db9f174f2536ae96a294569915ff2105a0b54a8c6c4223d46b00bd47e411bb8fb24e84a3677c8f36dff
SSDEEP 768:6gXS7x4TS48kSnyoSJyISV+lSwo8Sry6SbySSN0mSlGUSVGeS/A/0Sq0OxSUC2Sn:6ySN4TS48kSnyoSJyISV+lSwo8Sry6SK
TLSH
T107C2AD1034C460294D7C67E168FB89DFBBABE6F9335453B875A6A343508F90EC178B86
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FWAInstallMonitor.exe

Path C:\ProgramData\FWAInstallMonitor.exe
Size 612KB
SHA256 fecded4fe7f8b94c4e459a10077aae82022321abbc0a6f0eea0de5ec973d2e27
MD5 e0ef150667f67024f5fe25083464ed65
SHA1 fafa0268373449dab71414ad1ae44d3484d12838
SHA512 a7d5968b0f590eb945583e4e5b4d7396dae3f26875211c28b33a5197242c69b35f75caf89634ab9f27e38365fd92a320f45e4c42b74f2771731a914e0d698697
SSDEEP 12288:sim3OqoxBxwT9O5Y/oPOjGS9LIoyeKtfQWGlm48FKiv44PwU3:sYfKs5YpjGS7yeKtIJlm48FKivDPwU
TLSH
T150D47E2177F5C136E4A611B19E3E8769443AF8605F3242CBA3C84A6D5F706C2EB36376
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI9ad6d.LOG

Path C:\Users\Admin\AppData\Local\Temp\MSI9ad6d.LOG
Size 1KB
SHA256 9ca34ce4ef404a93fab8437bf6257d8098cf6702ae38c7a8e32540bb1102c1af
MD5 371b94332ccc3b3aa438d7003c2d5684
SHA1 4dfa0010b40110f2c7a9407cf534b00b81801f89
SHA512 dbf042836fa8990012651175458fe3d8a8e1bf2e8238c2bdb9d83376e34daa664b6c3dd48b1ce059aa5c8346e0158f98274ee0384357552dc8657dbd4a3b39e6
TLSH
T13A31F4452BF4080FF5B26747AEF3C4531A73FDE56974870C6289831906AAD04EC68376
MD5 SHA1 SHA512 TLSH

Submit Download

MSI9b5c9.LOG

Path C:\Users\Admin\AppData\Local\Temp\MSI9b5c9.LOG
Size 2KB
SHA256 e3c65125146f392523ab58f063032c42bd962cbba2d21e3a7561701c39cd4f37
MD5 bdb9fa8a09534c68f34a007b23fe5eee
SHA1 14f8b1089cdc4ad7a22210a81d2778c6cdf41ec9
SHA512 5e8528ce9f408248d6b74ae46b7b401fe33c35f2561a39d69745951b488863245721cb28e183b58549c71475f75e20be575f29ad7e8319c4b780f14ca4224b18
TLSH
T19F51F3151BF5084AF5B25B079EF385535B73FE91A834CB0C6348831D05ABD09D9693A7
MD5 SHA1 SHA512 TLSH

Submit Download

Deep Freeze_C64.exe

Path C:\Users\Admin\AppData\Local\Temp\ProductInstaller\Deep Freeze_C64.exe
Size 11.6MB
SHA256 0cd1e17641fa09ee04945ead0a789e7094406211b0d22bbf0d21ba4d8bfcba81
MD5 955457522daa1990bd8b605e76aff3fa
SHA1 ea706a5e6751e1f901426040f758d53c235aa771
SHA512 87628b247ed61738611a03ff1a6592ab1a07019f6f20abe566d6fe553aa651dffc30205ba96564a511c7383848a86b3386b965b3ecfd4bddc7ed08cb3f545bbb
SSDEEP 196608:8mKLgnYdp47X8Qrz0xtIKZH64m59KbaLD7sPGYkJo7jJrwKJ:8/VX4sQHKZH64m5saL8jkJAjJRJ
TLSH
T108C62336B265E13ED09A067605B6B574843E7F60BA17CC2B93F08A4CDF71542AA3931F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WIN-Select_C64.msi

Path C:\Users\Admin\AppData\Local\Temp\ProductInstaller\WIN-Select_C64.msi
Size 12.3MB
SHA256 c7e6bebe457dd9b867408294d7a5265072fbe133173f7e645873a27bb694db3d
MD5 97e0e4a108e103edbcdee3bb82477c5c
SHA1 5d7c411e3fe2ea8817927a137fb0a7dc0a466f29
SHA512 12959620e97b55bfc4cba050b97c4bf047efd8a7eb5c865b7544e980b1b26e29a253805cc6497d0a4c383665156cca14aba4c2893a716189d771efad6e358ada
SSDEEP 196608:fE/ZonZb9yx4urrrGBDL8bPvSoVDUy8445HBr51cNdBu6xsnngw5tmgb4xXh:sqi4qkL8zvSodUy84Khr5KNdBjxK5qR
TLSH
T1A8D6234AF59D8935C091013055D952B7B6B0FC403BE9C95B3A8870891E7FEE42CA7AEF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Agent_C64.msi

Path C:\Users\Admin\AppData\Local\Temp\ProductInstaller\Web Agent_C64.msi
Size 8.4MB
SHA256 8fd2fa8b53230b568c2f866f2b29149e4f10ffdc0323bb00842e0ca0a54badb2
MD5 6fc8aa85e39e14d8a259215c6c9c7980
SHA1 0e7b957781ebd0d62422b9291bdb39ed0bb3a8e5
SHA512 636c515ad5927f97a17078d22285945dd07c9bcbef9b7a6716b257b20c2afaf588941c3b53703c55ca2de97f952ad96a79cc74148a6027650354b4460702b821
SSDEEP 196608:y/Z2hrvrrSVegpqDlnSfSEpn1HnKy+MdKToYJiDLX46GQ5Ft3J:g2hrv/SV35l5ndKTUHJtZ
TLSH
T16C96021577E5C136E6AF17B19E3A476D053AB8714F3081CBA3C48A2D5E70AD2DA32327
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIB200.tmp

Path C:\Windows\Installer\MSIB200.tmp
Size 57KB
SHA256 e1076225eafe4cca82c39a4a7db820e0fd44dd293c9847564346e4bb047214b3
MD5 d480853146cffda8e468cc4d2751b405
SHA1 e0b9de6eb4e0f5a92411dfe12a2e498a39eb102b
SHA512 c22fe3996ea0eeaed9dc4f90e107a5e4b9c5e56fe1bf33b09db2bdc6ae52fc57fee70ca7d4b02d8f446257b2c46c5927a1961146588b7dbc0af4e6104a481f2f
SSDEEP 768:i0J8+QCTqaHxKkUmrVSarTJym3OZESrcvFKuSL5bCC1q:ACTq2ttpDJT+lc9SVCUq
TLSH
T16A436C127AD200B7D78A4B3165E79F279E3F7A441FE114839FB1499A2D367E0533A20B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIB7DD.tmp

Path C:\Windows\Installer\MSIB7DD.tmp
Size 138KB
SHA256 69bdcb8dbad5145459bc64ee749e84d9e92171aeff5eea37f2145319c99bdf3e
MD5 b96cc173298220d17aa0932bf3047727
SHA1 38b81f2f69916d52d5d8c95185150c20586fe0ea
SHA512 7357ea0a95b77c2bb51283e7859b2ac000804bed4aeedeea22b7e6b261a7fece110c13f244bc3458ddaaa6d9f94ebb0098ffb37c7b5d733db49aea17e04040ca
SSDEEP 3072:rqNFBYkgRKygZ8P/5TZ5mMMRkNBorzgSLgG5y25Jj+d:ySkgUy+IdZ5MCIrziI0d
TLSH
T198D34A11B7E0C032E0AA2A35593AD7616A3BB8709F74C9CB77744A6E4E707D0AE35347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIB89A.tmp

Path C:\Windows\Installer\MSIB89A.tmp
Size 1.1MB
SHA256 db907ab7cd5e98c1d7b9cd78773b26e986cce70078d376de0b08ceb5e24e769d
MD5 7c34d73bbd0980a2fa00808e403ef070
SHA1 d3b486a5a065ee3b1df9fd3b8c3c61dc22a9bb08
SHA512 277c9dfa9158a7208f87a2319d00282d97a1cf66827ca4bbce51c003b14bf22ea6cc2e038677d769ea6cf252ae28865e73d55f54257864ac8af24806d2f908f8
SSDEEP 24576:2G5Fq72onE/F3n5QnRushmlKGG284flDBidWON6Y8pBQ6NtlCKn:2GU2Kcl5QnEsIhG284flDQdWON69pBQ2
TLSH
T17E355B2177EDC135F6AF17B0AE395A5A043AB9B20B3081CFA3844D5D6D706D29A3172B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Products.ini

Path C:\Windows\Products.ini
Size 40B
SHA256 78fb5c1929c1077fe9fe7f56ddfa6cdcd652d0952ad2fbf5cb028be1e3409997
MD5 9ace2879c3e29d8d5879919482cb97b3
SHA1 f6ab39ff1ac629157cffe99d9d9b7671de45ab77
SHA512 1a4c5036a79bd6b8d8074976f6bbb0c38ca1a48f49f75cbd77893c7b043310fe1c7daf8645304840599af68d8fe7a45f29ed9671d49ff54057e0b37fba9594a8
MD5 SHA1 SHA512

Submit Download

Products.ini

Path C:\Windows\Products.ini
Size 381B
SHA256 814753dd308f1d0134508032fd4108abd02802f0228c8114827d76f0ca9d31b2
MD5 3b21eb6720f31a6f1283cfb792e2e041
SHA1 257efdd4df21f0cecd750320991a0eadc4c84d13
SHA512 7f48bb36dd1837277ca933038bd13ec78cb91652c87db643148b069166e2b720c25ce74ed145d10d2bd7270fd435e1fcefdfe427e21536604457a0e5b7888ec7
TLSH
T10FE0D895C287C37E3108626707736AFE85E1080C3E6DF7312B2DA9190681205F7BB21B
MD5 SHA1 SHA512 TLSH

Submit Download

Products.ini

Path C:\Windows\Products.ini
Size 391B
SHA256 86676d324456f0906b30b5e51899f1a0014cca05b3741d117f6e29c0556cdca9
MD5 16752832b4fa31cd8322cf7aa2d09e28
SHA1 d3512c7d5e20b673f88d7634fdc62796e1be6121
SHA512 e17df81801c5d2050de85d560d0e432609b90e157fbfecf1c47d099936749556c51aecf54494a12ec01e00bc261998d71b76bd2a8c9034f6573e844fcb12b885
TLSH
T10FE09B958286C37E3108626707736AFE85E1484C3E6DF731675DA5190641105F7BB117
MD5 SHA1 SHA512 TLSH

Submit Download

FWAInstaller_2026-10-14-04-39-45.LOG

Path C:\Windows\Temp\FWAInstaller_2026-10-14-04-39-45.LOG
Size 2KB
SHA256 303b248e5b85032ff8d118a2a4669e1d182f197c00c5d85942ca42f13b70d46d
MD5 088509de838bb559631de7721fafe6a0
SHA1 873807b928c6d90b1d20a50fad0faea2bea54607
SHA512 dcce34014df89667484c7a29a305ab706ec6dc86fb9307b2c1a3e28943ae7e6ee0bdd6d4f25ad81161bd6c22734490029786d4c12b00cf347698767d0a4b6f3f
TLSH
T1C8418BC044C4D503A9786760A82A6FE77FEBF4BB624AE2FC3553D650505C7C78B6818E
MD5 SHA1 SHA512 TLSH

Submit Download

FWAInstaller_2026-10-14-04-39-45.LOG

Path C:\Windows\Temp\FWAInstaller_2026-10-14-04-39-45.LOG
Size 265B
SHA256 bf943f85a24ed27bc97efb6a0341e9757a2513713459532333c5e81af46cf096
MD5 8c417e347dc86bab9f99f7a2d9d707a5
SHA1 3478e8768e768d49239931f2094aacd12323d66c
SHA512 a4a5df6db87befaf41740220498ccfa68da5727efc2f8b359e2fcf2f94e980264a459f3a51ef23b2ec33eae82b2598b98985b1fcf0f7f4897af26fe0717a9d93
TLSH
T14DD05BD24ED6A153A1F483015C374EF80852F37B5286D2687227A538410EFD75DD9442
MD5 SHA1 SHA512 TLSH

Submit Download

FWAInstaller_2026-10-14-04-39-45.LOG

Path C:\Windows\Temp\FWAInstaller_2026-10-14-04-39-45.LOG
Size 2KB
SHA256 2dab75f21afde7c907e16705fad5882f8d3cde021449055adb0f8b1625ad3b9f
MD5 187a0d7a48312c3a51fe58336a9c597d
SHA1 576529628e8cc6d507077048cd4519181fd3f9be
SHA512 4b610b22de1ad2d2e401d25b1cf561640ffc371468bdfa9a8dc47ccf4e72df30ca2e660a5ee6055914fb1d2f5776205f781f70146895389226a15de1366535c7
TLSH
T11C517BC445D0D103A9B86360A42A6FE77BEFF4BB7385E2FC36228650505C6C68B691CA
MD5 SHA1 SHA512 TLSH

Submit Download

FWAInstaller_2026-10-14-04-39-45.LOG

Path C:\Windows\Temp\FWAInstaller_2026-10-14-04-39-45.LOG
Size 3KB
SHA256 efe4541a24570ebb6ccf4d7a22149da40428cc4e5d06054746c8a247676de3f7
MD5 cf198261af7ab4a424c8b960061b85d4
SHA1 d34861fa27c2182f60047b2a0dc97f658ef131d5
SHA512 f66a6d961c573eae4524f3ad452eebeed46bdec03475c6ddf49ebbc9bb5372e8f2ecdc1f728c66d19771411143fbb59a0acedff59cb5cb1da7bebbb3a0f567f2
TLSH
T15F71AFC045C0D1139DB86370542B5EEBBBEBF4B77349E2FD36628750904D68ACB651CA
MD5 SHA1 SHA512 TLSH

Submit Download

FWAInstaller_2026-10-14-04-40-02.LOG

Path C:\Windows\Temp\FWAInstaller_2026-10-14-04-40-02.LOG
Size 2KB
SHA256 e6b7af4de42e3c41ae48884b2af11930d7c76520d145eb55e18abefdf17ba351
MD5 02ca4a763fb7c694311d051709c20044
SHA1 871f4aa4c93b06bd29954c0865ec4d4683b8b81d
SHA512 6c61a87f653864a49bbbcb97c4010efa78865fbdc423cc397f6fb9103320a8f7e132bcdd18ec1283bf21f246806b39584743c502d313628a5d425f8cd4987fad
TLSH
T1DD51D28440E0C30399B9A36094165FEAAFEFF87FB7C992BE3652D254405D746CB351CA
MD5 SHA1 SHA512 TLSH

Submit Download

FWAInstaller_2026-10-14-04-40-02.LOG

Path C:\Windows\Temp\FWAInstaller_2026-10-14-04-40-02.LOG
Size 3KB
SHA256 453a552ffadf292ef8383f1ac8e337022c9d6d2cf17162aed0c55700e5956666
MD5 7a0a8f1b11fa92a319b62b8b4298cecc
SHA1 79f4cf98e586aeb41ed564f0a14a903b340aa1b0
SHA512 a56c1f433681267e21571b6488d5f8ae44e53ebd0108368dc8fc21cc24187795acd9125a27249cf975bd994a7dc2e8975dadcbcad6296f875f89b5d4c2c504e1
TLSH
T1BC61C28441E0D31399B5536094175EEA7FEFF87FB38992BE3652D210814D74ACB341CA
MD5 SHA1 SHA512 TLSH

Submit Download

FWAInstaller_2026-10-14-04-40-02.LOG

Path C:\Windows\Temp\FWAInstaller_2026-10-14-04-40-02.LOG
Size 907B
SHA256 a092b414a6a3302a16a389aeb5a79167a9e0370a2fb58db683d4945bf5940116
MD5 086b32ff44389a117b0633848250d72a
SHA1 f3e953137755e492f9cf125a949fc299dfe3a30b
SHA512 1e46b60f4364cd1c0ae24f586bd6f271c55ef385f308e92224f41250521495f10733e6c96329cb979c22964bdb78bc651997f95949bff378dda239a4f99c71d3
TLSH
T14911D48511E0D757857CE310E0166BE66A93787BF5CDD3FE73569128804F755471408B
MD5 SHA1 SHA512 TLSH

Submit Download

FWAInstaller_2026-10-14-04-40-02.LOG

Path C:\Windows\Temp\FWAInstaller_2026-10-14-04-40-02.LOG
Size 2KB
SHA256 3a50a19547ee4c8ba55032f48295e6f9a3d41e27b5bd575c6b4626b43e6c626f
MD5 becce89d86ff45da51577faface7a313
SHA1 05800813d3b8b124e7896d4b5e169a719956f9f9
SHA512 2e614f707780ddfd4cc24f98ceea8baf42eefe75604387441b3b6676e02ae0fb02ed8e2597d022d3847abd09dde38cfa6505a8917adf6e06c36edecffcf86e21
TLSH
T118418E8441E0C30399B9A360941A6FE67FEFF47FB7C992FE3612D254409D746873818A
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads