9a4fe664a32b07ab15d15524d45d70ef297d4d6d1676ccfad2274f64c426aaf7

Analysis

max time kernel
150s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/11/2026, 13:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-01_9e4053992f8c530863a67f1dc3d4598b_coinminer_darkgate_elex_stop.exe
Size 1.4MB
Sample261102-qrf26atxhv
SHA256 9a4fe664a32b07ab15d15524d45d70ef297d4d6d1676ccfad2274f64c426aaf7
MD5 9e4053992f8c530863a67f1dc3d4598b
SHA1 7c7fd757806cec4f30034faccc7bba47fb3c4527
SHA512 ecf6108332aa2d96beba549fa28c345de11d31f86ded9dc262ec69365ff6705a25dda9073e769089b538d48a5c8f42cd134213c99e9ba782e6e9760b0348f1c0
SSDEEP 24576:yzxmyOLcq+yH8YAI+XCz8Dq74wWCdgt0GT+otNZNwW:4xbCJACdAT3L/l
TLSH
T1F3657C13BFC190B2DA930E7405769366AB3EF5655B208BC793901E5ACEE13C1AE342D7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4220	Logo1_.exe
3800	2026-11-01_9e4053992f8c530863a67f1dc3d4598b_coinminer_darkgate_elex_stop.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\sl-sl\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\cgg\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Car\LTR\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.34.28001.0_neutral_split.scale-100_8wekyb3d8bbwe\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\pl-pl\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\en-il\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\pl-pl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\nls\fr-fr\_desktop.ini	Logo1_.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\css\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.18.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\contrast-black\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\plugins\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\zh-tw\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\it-it\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\zh-cn\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\plugin2\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\is\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\pl\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\AppxMetadata\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\ko-kr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\ja\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\stream_extractor\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\sk-sk\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\ru-ru\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\nls\en-gb\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\nls\ja-jp\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ast\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.BingWeather_4.25.20211.0_neutral_split.scale-150_8wekyb3d8bbwe\Assets\AppTiles\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\nls\de-de\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\pt-br\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\ca-es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\fr-fr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\fr-ma\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_neutral_~_8wekyb3d8bbwe\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\root\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\uk-ua\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\ja-jp\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\BHO\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_2019.716.2316.0_neutral_~_8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_neutral_~_8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\ko-kr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\fi-fi\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\pl-pl\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\CMap\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\7-Zip\Lang\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsStore_11910.1002.5.0_neutral_split.scale-125_8wekyb3d8bbwe\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Microsoft.MicrosoftSolitaireCollection.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\zh-cn\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\ResiliencyLinks\identity_proxy\win11\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge_proxy.exe	Logo1_.exe
File created	C:\Program Files\Java\jre-1.8\lib\images\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxIdentityProvider_12.50.6001.0_x64__8wekyb3d8bbwe\XboxIdp.exe	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files-select\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\ja-jp\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\uk-ua\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\tr-tr\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	2026-11-01_9e4053992f8c530863a67f1dc3d4598b_coinminer_darkgate_elex_stop.exe
File created	C:\Windows\Logo1_.exe	2026-11-01_9e4053992f8c530863a67f1dc3d4598b_coinminer_darkgate_elex_stop.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\vDll.dll	Logo1_.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4404	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Logo1_.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Logo1_.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-01_9e4053992f8c530863a67f1dc3d4598b_coinminer_darkgate_elex_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-01_9e4053992f8c530863a67f1dc3d4598b_coinminer_darkgate_elex_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
4220	Logo1_.exe
4220	Logo1_.exe
4220	Logo1_.exe
4220	Logo1_.exe
4220	Logo1_.exe
4220	Logo1_.exe
4220	Logo1_.exe
4220	Logo1_.exe
4220	Logo1_.exe
4220	Logo1_.exe
4220	Logo1_.exe
4220	Logo1_.exe
4220	Logo1_.exe
4220	Logo1_.exe
4220	Logo1_.exe
4220	Logo1_.exe
4220	Logo1_.exe
4220	Logo1_.exe
4220	Logo1_.exe
4220	Logo1_.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3800	2026-11-01_9e4053992f8c530863a67f1dc3d4598b_coinminer_darkgate_elex_stop.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
3800	2026-11-01_9e4053992f8c530863a67f1dc3d4598b_coinminer_darkgate_elex_stop.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1844 wrote to memory of 4404	1844	2026-11-01_9e4053992f8c530863a67f1dc3d4598b_coinminer_darkgate_elex_stop.exe	85
PID 1844 wrote to memory of 4220	1844	2026-11-01_9e4053992f8c530863a67f1dc3d4598b_coinminer_darkgate_elex_stop.exe	86
PID 4220 wrote to memory of 1716	4220	Logo1_.exe	89
PID 1716 wrote to memory of 2712	1716	net.exe	91
PID 4404 wrote to memory of 3800	4404	cmd.exe	92

C:\Users\Admin\AppData\Local\Temp\2026-11-01_9e4053992f8c530863a67f1dc3d4598b_coinminer_darkgate_elex_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-01_9e4053992f8c530863a67f1dc3d4598b_coinminer_darkgate_elex_stop.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1844
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a98EF.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4404
- - C:\Users\Admin\AppData\Local\Temp\2026-11-01_9e4053992f8c530863a67f1dc3d4598b_coinminer_darkgate_elex_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-11-01_9e4053992f8c530863a67f1dc3d4598b_coinminer_darkgate_elex_stop.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:3800
- C:\Windows\Logo1_.exe
  C:\Windows\Logo1_.exe
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4220
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1716
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2712

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MicrosoftEdgeUpdate.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdate.exe
Size 239KB
SHA256 ac641e3769573606c2aa4d47dde55d23c24f303c96da88edc086c15d3369b852
MD5 7cb69fd445ab6b28a68899d02177065c
SHA1 666f78c5d7d650e56ed391a8ea010e55ac8bf5b4
SHA512 2cb5bc10b5351722d95d91ac6f1904d1f1619126407dd5fa4f1d7b67834472cf8b50c6e0221d8dc6b0055e4cffac10f6690c49230d24142d9063a41a1ddff4dd
SSDEEP 3072:pjkuJVLGgNpVWYxi/7gKNkhSC+t+MMCTs0kH+Bkx6uyXnZeiB+N6LpCcu51lviIz:auJc7gKNkhSR/5kHouyXnZhB+h8WH3
TLSH
T1E934912233F84969F8F35E306C359F2A993EBC35AE35E72E1644219D2D35A41D921B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VC_redist.x64.exe

Path C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
Size 663KB
SHA256 0cbd29104e15741f840ad51d67488bc540434dc67ed1d37ef274a9d88fe6250d
MD5 06c03b88d1c0794c9235b2b2ddb13622
SHA1 ca9f5ad4e6799c94a3523935eb36a83ddbcf1bc5
SHA512 3e101f89e76fb5dd1da04f35b75e61040654ef9485a9ec7c6573c411d9e87ec839b6b80b5d041d00232c3157df16d16d5edb50decd6ab346c0d4eb18f8fd43a7
SSDEEP 12288:w/nMwHskY7gjcjhVIEhqgM7bWvcsi6aVtrIyzU40vy3W/ceKSHMsiFyY6XN9:gMysZgjS1hqgSC/izJfojymk4HM5yJ
TLSH
T173E49E32D5614032E6F106B3A928A2347D7CE21867148DAEE3E8ED5D3EA849177F7347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

$$a98EF.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a98EF.bat
Size 770B
SHA256 1fb32cbcf93954e29b81650fb70d98c44eaa26415a4c37fd8e7e1462f6663a5f
MD5 1bf8749177513989e78950be24d79730
SHA1 e476d67d4435a14b83a099adbaf16b34030d9990
SHA512 ec6faa7ff65e4eae758012cb1ea8c682044ded0d8b776a6b065bf45cb7b2ec3e6d30d5d44da51f78c5891aaaaa5664a0a90a3f44bf97173b025f8f30930c1d95
TLSH
T19F010082476BDF759E0562470FBAA8DDE06E15FA37323626B338D2DC90D0C9C7996141
MD5 SHA1 SHA512 TLSH

Submit Download

2026-11-01_9e4053992f8c530863a67f1dc3d4598b_coinminer_darkgate_elex_stop.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-11-01_9e4053992f8c530863a67f1dc3d4598b_coinminer_darkgate_elex_stop.exe.exe
Size 1.4MB
SHA256 31926b16861f9408811d6b3de30558b60ef58d5e71ee6eb9cb31222b7ced2053
MD5 61a15585164392a0f74a91f528f62f2d
SHA1 c00b3e555ecab1ebbea53d53a715f366110e065d
SHA512 c1ca6a7bdbe647883ce4aae11cb71115ff4bae4e225fc822c3d5a563644f678238ad842a087e27801a229a0ae73926f0fe9b73ed541fb4a53c100904d9872042
SSDEEP 24576:8zxmyOLcq+yH8YAI+XCz8Dq74wWCdgt0GT+otNZNwW:6xbCJACdAT3L/l
TLSH
T163657C13BFC190B2DA930E7405769366AB3EF5655B208BC793901E5ACEE13C1AE342D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rundl132.exe

Path C:\Windows\rundl132.exe
Size 29KB
SHA256 5c9a1e2526783e8a167c7bbcb2c57d459ca3640de6598dc7ad92934e1bfb1084
MD5 780759899c3b5324b5ee62b0d656f11a
SHA1 6e46823a92632b76dbe47f14553f631c391d00b9
SHA512 041828e5fa86c07058869726160e95f8c630599fd3ebb3754a02e423d225339e2b533c3c10e00e1382503190a53aa127168314c1a4fe50736e7071437e7cc636
SSDEEP 384:NbbdRw1Gt5M0zhIV/DZ3KZp7JcTO4yf9Knuf2MqlUV2V9wVfUnfRqOzGOnJh:pJq16GVRu1yK9fMnJG2V9dHS8
TLSH
T10CD2E168BBFD9573E6E11FF064B34FBB8966F204DD4AC61F5D14A7410C90E0099A1A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_desktop.ini

Path F:\$RECYCLE.BIN\_desktop.ini
Size 9B
SHA256 0af15a3ce4f4d2fbbfae5716a07dfabaa2abd7fa0ea35841b3beb25101cf56b2
MD5 734a66e0314ab7a3a5f6763010e61f5d
SHA1 bf2d445df4e8fb2ca5cffc5b8c9c9b9814964a9c
SHA512 a6e84feeeb0fe8b0675ac4701e16828d279a4a71aff23cb3d81c5efe99a28b074890f4288ef9bf567a04bf00cadc2e43498bc633954b67012f450527f8db3258
MD5 SHA1 SHA512

Submit Download

memory/1844-0-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/1844-10-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4220-27-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4220-33-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4220-37-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4220-509-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4220-1246-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4220-20-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4220-5035-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4220-9-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4220-5538-0x0000000000400000-0x0000000000436000-memory.dmp

Download