7e76dff92b9178a3f4087d4572a93183fdd22c61b6b6c26e8e40c1bb2f76ee8c

Analysis

max time kernel
150s
max time network
145s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
22/05/2026, 03:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-22_6fc5e9cbb3f6c41864f1542ea641faee_amadey_darkgate_elex_luca-stealer_njrat_redline-stealer_.exe
Size 24.9MB
Sample260522-d35tfadv5n
SHA256 7e76dff92b9178a3f4087d4572a93183fdd22c61b6b6c26e8e40c1bb2f76ee8c
MD5 6fc5e9cbb3f6c41864f1542ea641faee
SHA1 75314f40d8c17c8a2c50d12f5013314a6869047d
SHA512 b9673e6ef60f2d09137f6f833d0212f3b8fe406a46824233b1d9991be6c3b390d912652da05d909dd3856f8d29408dc20fc92b32fb5f985f8a528ab128e3c490
SSDEEP 786432:vF5mgISC+5qIhq6HJW1LwoblvW1Po5q3CdxwI5Gm:vF5mgISC+5qIhq6crvWlo5RP
TLSH
T1A3470131758EC52BE57A01B09E2DDA6A562CAD360F6100E7B3DC7E6E2A745C31732E13
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery persistence ransomware trojan

Malware Config

Signatures

Modifies visibility of hidden/system files in Explorer 2 TTPs 2 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Detects executables containing possible sandbox analysis VM usernames 1 IoCs

resource	yara_rule
behavioral2/files/0x001d00000002b4c3-203.dat	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
16	1500	rundll32.exe
17	1192	rundll32.exe

Executes dropped EXE 11 IoCs

pid	Process
3708	2026-05-22_6fc5e9cbb3f6c41864f1542ea641faee_amadey_darkgate_elex_luca-stealer_njrat_redline-stealer_.exe
4892	icsys.icn.exe
1004	explorer.exe
4072	spoolsv.exe
4720	svchost.exe
2852	spoolsv.exe
2200	Honeygain_install.exe
2816	Honeygain_install.exe
876	MSIBC2F.tmp
4992	Honeygain.exe
2636	Honeygain.exe

Loads dropped DLL 64 IoCs

pid	Process
2588	MsiExec.exe
2588	MsiExec.exe
2588	MsiExec.exe
2588	MsiExec.exe
2588	MsiExec.exe
2588	MsiExec.exe
2588	MsiExec.exe
2588	MsiExec.exe
2588	MsiExec.exe
2588	MsiExec.exe
2588	MsiExec.exe
2588	MsiExec.exe
2400	MsiExec.exe
2400	MsiExec.exe
2400	MsiExec.exe
2400	MsiExec.exe
2400	MsiExec.exe
2400	MsiExec.exe
2400	MsiExec.exe
2104	rundll32.exe
2104	rundll32.exe
2104	rundll32.exe
2104	rundll32.exe
2104	rundll32.exe
2400	MsiExec.exe
1500	rundll32.exe
1500	rundll32.exe
1500	rundll32.exe
1500	rundll32.exe
1500	rundll32.exe
1500	rundll32.exe
1500	rundll32.exe
1500	rundll32.exe
1500	rundll32.exe
2400	MsiExec.exe
1192	rundll32.exe
1192	rundll32.exe
1192	rundll32.exe
1192	rundll32.exe
1192	rundll32.exe
1192	rundll32.exe
1192	rundll32.exe
1192	rundll32.exe
1192	rundll32.exe
2588	MsiExec.exe
4992	Honeygain.exe
4992	Honeygain.exe
4992	Honeygain.exe
4992	Honeygain.exe
4992	Honeygain.exe
4992	Honeygain.exe
4992	Honeygain.exe
4992	Honeygain.exe
4992	Honeygain.exe
4992	Honeygain.exe
4992	Honeygain.exe
4992	Honeygain.exe
4992	Honeygain.exe
4992	Honeygain.exe
4992	Honeygain.exe
4992	Honeygain.exe
4992	Honeygain.exe
4992	Honeygain.exe
4992	Honeygain.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000\Software\Microsoft\Windows\CurrentVersion\Run\Honeygain = "\"C:\\Program Files (x86)\\Honeygain\\Honeygain.exe\" -silent"	reg.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Honeygain.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Z:	Honeygain_install.exe
File opened (read-only)	\??\P:	Honeygain_install.exe
File opened (read-only)	\??\A:	Honeygain_install.exe
File opened (read-only)	\??\S:	Honeygain_install.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\X:	Honeygain_install.exe
File opened (read-only)	\??\K:	Honeygain_install.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\B:	Honeygain_install.exe
File opened (read-only)	\??\E:	Honeygain_install.exe
File opened (read-only)	\??\T:	Honeygain_install.exe
File opened (read-only)	\??\U:	Honeygain_install.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\W:	Honeygain_install.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\H:	Honeygain_install.exe
File opened (read-only)	\??\J:	Honeygain_install.exe
File opened (read-only)	\??\X:	Honeygain_install.exe
File opened (read-only)	\??\Y:	Honeygain_install.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\I:	Honeygain_install.exe
File opened (read-only)	\??\O:	Honeygain_install.exe
File opened (read-only)	\??\P:	Honeygain_install.exe
File opened (read-only)	\??\O:	Honeygain_install.exe
File opened (read-only)	\??\Q:	Honeygain_install.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\J:	Honeygain_install.exe
File opened (read-only)	\??\M:	Honeygain_install.exe
File opened (read-only)	\??\T:	Honeygain_install.exe
File opened (read-only)	\??\N:	Honeygain_install.exe
File opened (read-only)	\??\A:	Honeygain_install.exe
File opened (read-only)	\??\N:	Honeygain_install.exe
File opened (read-only)	\??\M:	Honeygain_install.exe
File opened (read-only)	\??\V:	Honeygain_install.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\E:	Honeygain_install.exe
File opened (read-only)	\??\Q:	Honeygain_install.exe
File opened (read-only)	\??\L:	Honeygain_install.exe
File opened (read-only)	\??\W:	Honeygain_install.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\G:	Honeygain_install.exe
File opened (read-only)	\??\Y:	Honeygain_install.exe
File opened (read-only)	\??\R:	Honeygain_install.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	Honeygain_install.exe
File opened (read-only)	\??\S:	Honeygain_install.exe
File opened (read-only)	\??\Z:	Honeygain_install.exe
File opened (read-only)	\??\B:	Honeygain_install.exe
File opened (read-only)	\??\I:	Honeygain_install.exe
File opened (read-only)	\??\V:	Honeygain_install.exe
File opened (read-only)	\??\L:	Honeygain_install.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	Honeygain_install.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\explorer.exe	explorer.exe
File opened for modification	C:\Windows\SysWOW64\explorer.exe	svchost.exe

Drops file in Program Files directory 51 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Honeygain\Honeygain.Core.dll	msiexec.exe
File created	C:\Program Files (x86)\Honeygain\System.ValueTuple.dll	msiexec.exe
File created	C:\Program Files (x86)\Honeygain\WpfAnimatedGif.dll	msiexec.exe
File created	C:\Program Files (x86)\Honeygain\msquic.dll	msiexec.exe
File created	C:\Program Files (x86)\Honeygain\GrowthBook.dll	msiexec.exe
File created	C:\Program Files (x86)\Honeygain\Honeygain.exe.config	msiexec.exe
File created	C:\Program Files (x86)\Honeygain\Caliburn.Micro.Core.dll	msiexec.exe
File created	C:\Program Files (x86)\Honeygain\LiveCharts.Wpf.dll	msiexec.exe
File created	C:\Program Files (x86)\Honeygain\System.Collections.Immutable.dll	msiexec.exe
File created	C:\Program Files (x86)\Honeygain\Microsoft.Extensions.DependencyInjection.dll	msiexec.exe
File created	C:\Program Files (x86)\Honeygain\Microsoft.Extensions.Logging.Abstractions.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Honeygain\HoneygainUpdater.ini	msiexec.exe
File created	C:\Program Files (x86)\Honeygain\hgwin.dll	msiexec.exe
File created	C:\Program Files (x86)\Honeygain\Honeygain.Common.dll.config	msiexec.exe
File created	C:\Program Files (x86)\Honeygain\Microsoft.Xaml.Behaviors.dll	msiexec.exe
File created	C:\Program Files (x86)\Honeygain\Microsoft.Extensions.Primitives.dll	msiexec.exe
File created	C:\Program Files (x86)\Honeygain\Honeygain.exe	msiexec.exe
File created	C:\Program Files (x86)\Honeygain\Google.Apis.dll	msiexec.exe
File created	C:\Program Files (x86)\Honeygain\System.Memory.dll	msiexec.exe
File created	C:\Program Files (x86)\Honeygain\Caliburn.Micro.Platform.dll	msiexec.exe
File created	C:\Program Files (x86)\Honeygain\Microsoft.Extensions.DependencyInjection.Abstractions.dll	msiexec.exe
File created	C:\Program Files (x86)\Honeygain\Microsoft.Extensions.Http.dll	msiexec.exe
File created	C:\Program Files (x86)\Honeygain\Honeygain.Proxies.dll	msiexec.exe
File created	C:\Program Files (x86)\Honeygain\System.Numerics.Vectors.dll	msiexec.exe
File created	C:\Program Files (x86)\Honeygain\System.Threading.Tasks.Extensions.dll	msiexec.exe
File created	C:\Program Files (x86)\Honeygain\Microsoft.Web.WebView2.Wpf.dll	msiexec.exe
File created	C:\Program Files (x86)\Honeygain\Microsoft.Extensions.Logging.dll	msiexec.exe
File created	C:\Program Files (x86)\Honeygain\Countly.dll	msiexec.exe
File created	C:\Program Files (x86)\Honeygain\Newtonsoft.Json.dll	msiexec.exe
File created	C:\Program Files (x86)\Honeygain\LiveCharts.dll	msiexec.exe
File created	C:\Program Files (x86)\Honeygain\System.Text.Encodings.Web.dll	msiexec.exe
File created	C:\Program Files (x86)\Honeygain\Microsoft.Extensions.Configuration.Abstractions.dll	msiexec.exe
File created	C:\Program Files (x86)\Honeygain\Microsoft.Extensions.Options.dll	msiexec.exe
File created	C:\Program Files (x86)\Honeygain\Caliburn.Micro.Platform.Core.dll	msiexec.exe
File created	C:\Program Files (x86)\Honeygain\HoneygainUpdater.exe	msiexec.exe
File created	C:\Program Files (x86)\Honeygain\Microsoft.DotNet.PlatformAbstractions.dll	msiexec.exe
File created	C:\Program Files (x86)\Honeygain\Microsoft.Web.WebView2.Core.dll	msiexec.exe
File created	C:\Program Files (x86)\Honeygain\Autofac.dll	msiexec.exe
File created	C:\Program Files (x86)\Honeygain\Microsoft.Bcl.AsyncInterfaces.dll	msiexec.exe
File created	C:\Program Files (x86)\Honeygain\System.Diagnostics.DiagnosticSource.dll	msiexec.exe
File created	C:\Program Files (x86)\Honeygain\System.Runtime.CompilerServices.Unsafe.dll	msiexec.exe
File created	C:\Program Files (x86)\Honeygain\Facebook.dll	msiexec.exe
File created	C:\Program Files (x86)\Honeygain\Google.Apis.Auth.dll	msiexec.exe
File created	C:\Program Files (x86)\Honeygain\WebView2Loader.dll	msiexec.exe
File created	C:\Program Files (x86)\Honeygain\Honeygain.Common.dll	msiexec.exe
File created	C:\Program Files (x86)\Honeygain\Hardcodet.NotifyIcon.Wpf.dll	msiexec.exe
File created	C:\Program Files (x86)\Honeygain\System.Reflection.Metadata.dll	msiexec.exe
File created	C:\Program Files (x86)\Honeygain\System.Text.Json.dll	msiexec.exe
File created	C:\Program Files (x86)\Honeygain\Sentry.dll	msiexec.exe
File created	C:\Program Files (x86)\Honeygain\Google.Apis.Core.dll	msiexec.exe
File created	C:\Program Files (x86)\Honeygain\System.Buffers.dll	msiexec.exe

Drops file in Windows directory 47 IoCs

description	ioc	Process
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\e5995ef.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9BA1.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9C4E.tmp-\Honeygain.Proxies.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI9C4E.tmp-\hgwin.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIA1BF.tmp-\Honeygain.CustomActions.dll	rundll32.exe
File created	C:\Windows\Installer\e5995ed.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9C4E.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI9C4E.tmp-\msquic.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIA1BF.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIA1BF.tmp-\msquic.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI9C4E.tmp	msiexec.exe
File opened for modification	\??\c:\windows\resources\svchost.exe	spoolsv.exe
File opened for modification	C:\Windows\Resources\tjud.exe	explorer.exe
File opened for modification	C:\Windows\Installer\e5995ed.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9784.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9C4E.tmp-\Honeygain.CustomActions.dll	rundll32.exe
File created	C:\Windows\Installer\{AF6B0CBA-FBE3-4FEC-9EAC-970F105289B4}\MainIcon.exe	msiexec.exe
File created	C:\Windows\SystemTemp\~DFBE4607A5118B8F95.TMP	msiexec.exe
File opened for modification	C:\Windows\Resources\Themes\icsys.icn.exe	2026-05-22_6fc5e9cbb3f6c41864f1542ea641faee_amadey_darkgate_elex_luca-stealer_njrat_redline-stealer_.exe
File opened for modification	C:\Windows\Installer\MSI99DB.tmp-\Honeygain.Proxies.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIA19E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA1BF.tmp	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI99DB.tmp-\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIA1BF.tmp-\Honeygain.Proxies.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIA1BF.tmp-\hgwin.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIA1BF.tmp-\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI98E0.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI99DB.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI99DB.tmp-\msquic.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI9C4E.tmp-\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\{AF6B0CBA-FBE3-4FEC-9EAC-970F105289B4}\MainIcon.exe	msiexec.exe
File created	C:\Windows\SystemTemp\~DF0BE2954F24ECE172.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFA43281DB629C48F9.TMP	msiexec.exe
File opened for modification	\??\c:\windows\resources\themes\explorer.exe	icsys.icn.exe
File opened for modification	\??\c:\windows\resources\spoolsv.exe	explorer.exe
File opened for modification	C:\Windows\Installer\MSI96F7.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI97A4.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DFCF9FFE54339DC0F5.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI99DB.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI99DB.tmp-\Honeygain.CustomActions.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI99DB.tmp-\hgwin.dll	rundll32.exe
File created	C:\Windows\Installer\SourceHash{AF6B0CBA-FBE3-4FEC-9EAC-970F105289B4}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI97B5.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9862.tmp	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 17 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-22_6fc5e9cbb3f6c41864f1542ea641faee_amadey_darkgate_elex_luca-stealer_njrat_redline-stealer_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icsys.icn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Honeygain_install.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSIBC2F.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Honeygain.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-22_6fc5e9cbb3f6c41864f1542ea641faee_amadey_darkgate_elex_luca-stealer_njrat_redline-stealer_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Honeygain.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Honeygain_install.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2816	Honeygain_install.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000512b028b2c2fe2ee0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000512b028b0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900512b028b000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1a512b028b000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d512b028b000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe

Modifies registry class 25 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ABC0B6FA3EBFCEF4E9CA79F00125984B\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ABC0B6FA3EBFCEF4E9CA79F00125984B\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ABC0B6FA3EBFCEF4E9CA79F00125984B\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\ABC0B6FA3EBFCEF4E9CA79F00125984B\Core	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ABC0B6FA3EBFCEF4E9CA79F00125984B	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ABC0B6FA3EBFCEF4E9CA79F00125984B\ProductIcon = "C:\\Windows\\Installer\\{AF6B0CBA-FBE3-4FEC-9EAC-970F105289B4}\\MainIcon.exe"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ABC0B6FA3EBFCEF4E9CA79F00125984B\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ABC0B6FA3EBFCEF4E9CA79F00125984B\SourceList\PackageName = "Honeygain_install.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ABC0B6FA3EBFCEF4E9CA79F00125984B\SourceList\Media\DiskPrompt = "[1]"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ABC0B6FA3EBFCEF4E9CA79F00125984B\SourceList\Media\1 = "Disk1;Disk1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\ABC0B6FA3EBFCEF4E9CA79F00125984B	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ABC0B6FA3EBFCEF4E9CA79F00125984B\PackageCode = "776E719A48AA9CE47B5595C4A4241096"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ABC0B6FA3EBFCEF4E9CA79F00125984B\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ABC0B6FA3EBFCEF4E9CA79F00125984B\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\87F45A54E3EC37E4A9C35636860D2B76	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ABC0B6FA3EBFCEF4E9CA79F00125984B\SourceList\Net	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ABC0B6FA3EBFCEF4E9CA79F00125984B\Clients = 3a0000000000	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ABC0B6FA3EBFCEF4E9CA79F00125984B\Version = "17235968"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ABC0B6FA3EBFCEF4E9CA79F00125984B\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\87F45A54E3EC37E4A9C35636860D2B76\ABC0B6FA3EBFCEF4E9CA79F00125984B	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ABC0B6FA3EBFCEF4E9CA79F00125984B\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Roaming\\Honeygain UAB\\Honeygain 1.7.0.0\\install\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ABC0B6FA3EBFCEF4E9CA79F00125984B\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Roaming\\Honeygain UAB\\Honeygain 1.7.0.0\\install\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\ABC0B6FA3EBFCEF4E9CA79F00125984B\Updater	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ABC0B6FA3EBFCEF4E9CA79F00125984B\ProductName = "Honeygain"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ABC0B6FA3EBFCEF4E9CA79F00125984B\InstanceType = "0"	msiexec.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
4636	reg.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1888	2026-05-22_6fc5e9cbb3f6c41864f1542ea641faee_amadey_darkgate_elex_luca-stealer_njrat_redline-stealer_.exe
1888	2026-05-22_6fc5e9cbb3f6c41864f1542ea641faee_amadey_darkgate_elex_luca-stealer_njrat_redline-stealer_.exe
1888	2026-05-22_6fc5e9cbb3f6c41864f1542ea641faee_amadey_darkgate_elex_luca-stealer_njrat_redline-stealer_.exe
1888	2026-05-22_6fc5e9cbb3f6c41864f1542ea641faee_amadey_darkgate_elex_luca-stealer_njrat_redline-stealer_.exe
1888	2026-05-22_6fc5e9cbb3f6c41864f1542ea641faee_amadey_darkgate_elex_luca-stealer_njrat_redline-stealer_.exe
1888	2026-05-22_6fc5e9cbb3f6c41864f1542ea641faee_amadey_darkgate_elex_luca-stealer_njrat_redline-stealer_.exe
1888	2026-05-22_6fc5e9cbb3f6c41864f1542ea641faee_amadey_darkgate_elex_luca-stealer_njrat_redline-stealer_.exe
1888	2026-05-22_6fc5e9cbb3f6c41864f1542ea641faee_amadey_darkgate_elex_luca-stealer_njrat_redline-stealer_.exe
1888	2026-05-22_6fc5e9cbb3f6c41864f1542ea641faee_amadey_darkgate_elex_luca-stealer_njrat_redline-stealer_.exe
1888	2026-05-22_6fc5e9cbb3f6c41864f1542ea641faee_amadey_darkgate_elex_luca-stealer_njrat_redline-stealer_.exe
1888	2026-05-22_6fc5e9cbb3f6c41864f1542ea641faee_amadey_darkgate_elex_luca-stealer_njrat_redline-stealer_.exe
1888	2026-05-22_6fc5e9cbb3f6c41864f1542ea641faee_amadey_darkgate_elex_luca-stealer_njrat_redline-stealer_.exe
1888	2026-05-22_6fc5e9cbb3f6c41864f1542ea641faee_amadey_darkgate_elex_luca-stealer_njrat_redline-stealer_.exe
1888	2026-05-22_6fc5e9cbb3f6c41864f1542ea641faee_amadey_darkgate_elex_luca-stealer_njrat_redline-stealer_.exe
1888	2026-05-22_6fc5e9cbb3f6c41864f1542ea641faee_amadey_darkgate_elex_luca-stealer_njrat_redline-stealer_.exe
1888	2026-05-22_6fc5e9cbb3f6c41864f1542ea641faee_amadey_darkgate_elex_luca-stealer_njrat_redline-stealer_.exe
1888	2026-05-22_6fc5e9cbb3f6c41864f1542ea641faee_amadey_darkgate_elex_luca-stealer_njrat_redline-stealer_.exe
1888	2026-05-22_6fc5e9cbb3f6c41864f1542ea641faee_amadey_darkgate_elex_luca-stealer_njrat_redline-stealer_.exe
1888	2026-05-22_6fc5e9cbb3f6c41864f1542ea641faee_amadey_darkgate_elex_luca-stealer_njrat_redline-stealer_.exe
1888	2026-05-22_6fc5e9cbb3f6c41864f1542ea641faee_amadey_darkgate_elex_luca-stealer_njrat_redline-stealer_.exe
1888	2026-05-22_6fc5e9cbb3f6c41864f1542ea641faee_amadey_darkgate_elex_luca-stealer_njrat_redline-stealer_.exe
1888	2026-05-22_6fc5e9cbb3f6c41864f1542ea641faee_amadey_darkgate_elex_luca-stealer_njrat_redline-stealer_.exe
1888	2026-05-22_6fc5e9cbb3f6c41864f1542ea641faee_amadey_darkgate_elex_luca-stealer_njrat_redline-stealer_.exe
1888	2026-05-22_6fc5e9cbb3f6c41864f1542ea641faee_amadey_darkgate_elex_luca-stealer_njrat_redline-stealer_.exe
1888	2026-05-22_6fc5e9cbb3f6c41864f1542ea641faee_amadey_darkgate_elex_luca-stealer_njrat_redline-stealer_.exe
1888	2026-05-22_6fc5e9cbb3f6c41864f1542ea641faee_amadey_darkgate_elex_luca-stealer_njrat_redline-stealer_.exe
1888	2026-05-22_6fc5e9cbb3f6c41864f1542ea641faee_amadey_darkgate_elex_luca-stealer_njrat_redline-stealer_.exe
1888	2026-05-22_6fc5e9cbb3f6c41864f1542ea641faee_amadey_darkgate_elex_luca-stealer_njrat_redline-stealer_.exe
1888	2026-05-22_6fc5e9cbb3f6c41864f1542ea641faee_amadey_darkgate_elex_luca-stealer_njrat_redline-stealer_.exe
1888	2026-05-22_6fc5e9cbb3f6c41864f1542ea641faee_amadey_darkgate_elex_luca-stealer_njrat_redline-stealer_.exe
1888	2026-05-22_6fc5e9cbb3f6c41864f1542ea641faee_amadey_darkgate_elex_luca-stealer_njrat_redline-stealer_.exe
1888	2026-05-22_6fc5e9cbb3f6c41864f1542ea641faee_amadey_darkgate_elex_luca-stealer_njrat_redline-stealer_.exe
4892	icsys.icn.exe
4892	icsys.icn.exe
4892	icsys.icn.exe
4892	icsys.icn.exe
4892	icsys.icn.exe
4892	icsys.icn.exe
4892	icsys.icn.exe
4892	icsys.icn.exe
4892	icsys.icn.exe
4892	icsys.icn.exe
4892	icsys.icn.exe
4892	icsys.icn.exe
4892	icsys.icn.exe
4892	icsys.icn.exe
4892	icsys.icn.exe
4892	icsys.icn.exe
4892	icsys.icn.exe
4892	icsys.icn.exe
4892	icsys.icn.exe
4892	icsys.icn.exe
4892	icsys.icn.exe
4892	icsys.icn.exe
4892	icsys.icn.exe
4892	icsys.icn.exe
4892	icsys.icn.exe
4892	icsys.icn.exe
4892	icsys.icn.exe
4892	icsys.icn.exe
4892	icsys.icn.exe
4892	icsys.icn.exe
4892	icsys.icn.exe
4892	icsys.icn.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
1004	explorer.exe
4720	svchost.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeSecurityPrivilege	5064	msiexec.exe
Token: SeCreateTokenPrivilege	2200	Honeygain_install.exe
Token: SeAssignPrimaryTokenPrivilege	2200	Honeygain_install.exe
Token: SeLockMemoryPrivilege	2200	Honeygain_install.exe
Token: SeIncreaseQuotaPrivilege	2200	Honeygain_install.exe
Token: SeMachineAccountPrivilege	2200	Honeygain_install.exe
Token: SeTcbPrivilege	2200	Honeygain_install.exe
Token: SeSecurityPrivilege	2200	Honeygain_install.exe
Token: SeTakeOwnershipPrivilege	2200	Honeygain_install.exe
Token: SeLoadDriverPrivilege	2200	Honeygain_install.exe
Token: SeSystemProfilePrivilege	2200	Honeygain_install.exe
Token: SeSystemtimePrivilege	2200	Honeygain_install.exe
Token: SeProfSingleProcessPrivilege	2200	Honeygain_install.exe
Token: SeIncBasePriorityPrivilege	2200	Honeygain_install.exe
Token: SeCreatePagefilePrivilege	2200	Honeygain_install.exe
Token: SeCreatePermanentPrivilege	2200	Honeygain_install.exe
Token: SeBackupPrivilege	2200	Honeygain_install.exe
Token: SeRestorePrivilege	2200	Honeygain_install.exe
Token: SeShutdownPrivilege	2200	Honeygain_install.exe
Token: SeDebugPrivilege	2200	Honeygain_install.exe
Token: SeAuditPrivilege	2200	Honeygain_install.exe
Token: SeSystemEnvironmentPrivilege	2200	Honeygain_install.exe
Token: SeChangeNotifyPrivilege	2200	Honeygain_install.exe
Token: SeRemoteShutdownPrivilege	2200	Honeygain_install.exe
Token: SeUndockPrivilege	2200	Honeygain_install.exe
Token: SeSyncAgentPrivilege	2200	Honeygain_install.exe
Token: SeEnableDelegationPrivilege	2200	Honeygain_install.exe
Token: SeManageVolumePrivilege	2200	Honeygain_install.exe
Token: SeImpersonatePrivilege	2200	Honeygain_install.exe
Token: SeCreateGlobalPrivilege	2200	Honeygain_install.exe
Token: SeCreateTokenPrivilege	2200	Honeygain_install.exe
Token: SeAssignPrimaryTokenPrivilege	2200	Honeygain_install.exe
Token: SeLockMemoryPrivilege	2200	Honeygain_install.exe
Token: SeIncreaseQuotaPrivilege	2200	Honeygain_install.exe
Token: SeMachineAccountPrivilege	2200	Honeygain_install.exe
Token: SeTcbPrivilege	2200	Honeygain_install.exe
Token: SeSecurityPrivilege	2200	Honeygain_install.exe
Token: SeTakeOwnershipPrivilege	2200	Honeygain_install.exe
Token: SeLoadDriverPrivilege	2200	Honeygain_install.exe
Token: SeSystemProfilePrivilege	2200	Honeygain_install.exe
Token: SeSystemtimePrivilege	2200	Honeygain_install.exe
Token: SeProfSingleProcessPrivilege	2200	Honeygain_install.exe
Token: SeIncBasePriorityPrivilege	2200	Honeygain_install.exe
Token: SeCreatePagefilePrivilege	2200	Honeygain_install.exe
Token: SeCreatePermanentPrivilege	2200	Honeygain_install.exe
Token: SeBackupPrivilege	2200	Honeygain_install.exe
Token: SeRestorePrivilege	2200	Honeygain_install.exe
Token: SeShutdownPrivilege	2200	Honeygain_install.exe
Token: SeDebugPrivilege	2200	Honeygain_install.exe
Token: SeAuditPrivilege	2200	Honeygain_install.exe
Token: SeSystemEnvironmentPrivilege	2200	Honeygain_install.exe
Token: SeChangeNotifyPrivilege	2200	Honeygain_install.exe
Token: SeRemoteShutdownPrivilege	2200	Honeygain_install.exe
Token: SeUndockPrivilege	2200	Honeygain_install.exe
Token: SeSyncAgentPrivilege	2200	Honeygain_install.exe
Token: SeEnableDelegationPrivilege	2200	Honeygain_install.exe
Token: SeManageVolumePrivilege	2200	Honeygain_install.exe
Token: SeImpersonatePrivilege	2200	Honeygain_install.exe
Token: SeCreateGlobalPrivilege	2200	Honeygain_install.exe
Token: SeCreateTokenPrivilege	2200	Honeygain_install.exe
Token: SeAssignPrimaryTokenPrivilege	2200	Honeygain_install.exe
Token: SeLockMemoryPrivilege	2200	Honeygain_install.exe
Token: SeIncreaseQuotaPrivilege	2200	Honeygain_install.exe
Token: SeMachineAccountPrivilege	2200	Honeygain_install.exe

Suspicious use of FindShellTrayWindow 8 IoCs

pid	Process
3708	2026-05-22_6fc5e9cbb3f6c41864f1542ea641faee_amadey_darkgate_elex_luca-stealer_njrat_redline-stealer_.exe
2200	Honeygain_install.exe
2200	Honeygain_install.exe
4992	Honeygain.exe
4992	Honeygain.exe
4992	Honeygain.exe
4992	Honeygain.exe
4992	Honeygain.exe

Suspicious use of SendNotifyMessage 5 IoCs

pid	Process
4992	Honeygain.exe
4992	Honeygain.exe
4992	Honeygain.exe
4992	Honeygain.exe
4992	Honeygain.exe

Suspicious use of SetWindowsHookEx 14 IoCs

pid	Process
1888	2026-05-22_6fc5e9cbb3f6c41864f1542ea641faee_amadey_darkgate_elex_luca-stealer_njrat_redline-stealer_.exe
1888	2026-05-22_6fc5e9cbb3f6c41864f1542ea641faee_amadey_darkgate_elex_luca-stealer_njrat_redline-stealer_.exe
4892	icsys.icn.exe
4892	icsys.icn.exe
1004	explorer.exe
1004	explorer.exe
4072	spoolsv.exe
4072	spoolsv.exe
4720	svchost.exe
4720	svchost.exe
2852	spoolsv.exe
2852	spoolsv.exe
4992	Honeygain.exe
4992	Honeygain.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 1888 wrote to memory of 3708	1888	2026-05-22_6fc5e9cbb3f6c41864f1542ea641faee_amadey_darkgate_elex_luca-stealer_njrat_redline-stealer_.exe	81
PID 1888 wrote to memory of 4892	1888	2026-05-22_6fc5e9cbb3f6c41864f1542ea641faee_amadey_darkgate_elex_luca-stealer_njrat_redline-stealer_.exe	82
PID 4892 wrote to memory of 1004	4892	icsys.icn.exe	83
PID 1004 wrote to memory of 4072	1004	explorer.exe	84
PID 4072 wrote to memory of 4720	4072	spoolsv.exe	85
PID 4720 wrote to memory of 2852	4720	svchost.exe	86
PID 3708 wrote to memory of 2200	3708	2026-05-22_6fc5e9cbb3f6c41864f1542ea641faee_amadey_darkgate_elex_luca-stealer_njrat_redline-stealer_.exe	89
PID 5064 wrote to memory of 2588	5064	msiexec.exe	91
PID 2200 wrote to memory of 2816	2200	Honeygain_install.exe	92
PID 5064 wrote to memory of 4328	5064	msiexec.exe	96
PID 5064 wrote to memory of 2400	5064	msiexec.exe	98
PID 2400 wrote to memory of 2104	2400	MsiExec.exe	99
PID 2400 wrote to memory of 1500	2400	MsiExec.exe	100
PID 2400 wrote to memory of 1192	2400	MsiExec.exe	101
PID 2200 wrote to memory of 876	2200	Honeygain_install.exe	103

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-05-22_6fc5e9cbb3f6c41864f1542ea641faee_amadey_darkgate_elex_luca-stealer_njrat_redline-stealer_.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-22_6fc5e9cbb3f6c41864f1542ea641faee_amadey_darkgate_elex_luca-stealer_njrat_redline-stealer_.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1888
- \??\c:\users\admin\appdata\local\temp\2026-05-22_6fc5e9cbb3f6c41864f1542ea641faee_amadey_darkgate_elex_luca-stealer_njrat_redline-stealer_.exe
  c:\users\admin\appdata\local\temp\2026-05-22_6fc5e9cbb3f6c41864f1542ea641faee_amadey_darkgate_elex_luca-stealer_njrat_redline-stealer_.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3708
- - C:\Users\Admin\Downloads\Honeygain_install.exe
    "C:\Users\Admin\Downloads\Honeygain_install.exe" /exenoupdates
    3⤵
    - Executes dropped EXE
    - Enumerates connected drives
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2200
  - - C:\Users\Admin\Downloads\Honeygain_install.exe
      "C:\Users\Admin\Downloads\Honeygain_install.exe" /i "C:\Users\Admin\AppData\Roaming\Honeygain UAB\Honeygain 1.7.0.0\install\Honeygain_install.msi" AI_EUIMSI=1 SHORTCUTDIR="C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Honeygain" APPDIR="C:\Program Files (x86)\Honeygain" SECONDSEQUENCE="1" CLIENTPROCESSID="2200" CHAINERUIPROCESSID="2200Chainer" ACTION="INSTALL" EXECUTEACTION="INSTALL" CLIENTUILEVEL="0" ADDLOCAL="Core,Updater" CHECKBOX_1_PROP="checked" PRIMARYFOLDER="APPDIR" ROOTDRIVE="C:\" AI_FOUND_PREREQS=".NET Framework 4.7.2 (web installer)" AI_SETUPEXEPATH="C:\Users\Admin\Downloads\Honeygain_install.exe" SETUPEXEDIR="C:\Users\Admin\Downloads\" EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1779180118 " AI_SETUPEXEPATH_ORIGINAL="C:\Users\Admin\Downloads\Honeygain_install.exe" HG_DETECTED_DOTNET_VERSION="#528449" TARGETDIR="C:\" AI_INSTALL="1"
      4⤵
      Executes dropped EXE
      Enumerates connected drives
      System Location Discovery: System Language Discovery
      System Time Discovery
      PID:2816
  - - C:\Users\Admin\AppData\Local\Temp\MSIBC2F.tmp
      "C:\Users\Admin\AppData\Local\Temp\MSIBC2F.tmp" /HideWindow REG ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "Honeygain" /d "\"C:\Program Files (x86)\Honeygain\Honeygain.exe\" -silent" /f
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:876
- C:\Windows\Resources\Themes\icsys.icn.exe
  C:\Windows\Resources\Themes\icsys.icn.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4892
- - \??\c:\windows\resources\themes\explorer.exe
    c:\windows\resources\themes\explorer.exe
    3⤵
    - Modifies visibility of hidden/system files in Explorer
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in System32 directory
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1004
  - - \??\c:\windows\resources\spoolsv.exe
      c:\windows\resources\spoolsv.exe SE
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4072
    - - \??\c:\windows\resources\svchost.exe
        
        c:\windows\resources\svchost.exe
        5⤵
        Modifies visibility of hidden/system files in Explorer
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4720
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe PR
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2852

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5064
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 04353A134775881D0003A1FECC76FB94 C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2588
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:4328
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 836640FAD57BC932E348CF096EB9E331
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2400
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI99DB.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240753125 271 Honeygain.CustomActions!Honeygain.CustomActions.CustomAction.InitEventParams
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:2104
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI9C4E.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240753750 275 Honeygain.CustomActions!Honeygain.CustomActions.CustomAction.SendStartEvent
    3⤵
    - Badlisted process makes network request
    - Loads dropped DLL
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:1500
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSIA1BF.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240755140 279 Honeygain.CustomActions!Honeygain.CustomActions.CustomAction.SendFinishEvent
    3⤵
    - Badlisted process makes network request
    - Loads dropped DLL
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:1192

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:4184

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "Honeygain" /d "\"C:\Program Files (x86)\Honeygain\Honeygain.exe\" -silent" /f
1⤵
- Adds Run key to start application
- Modifies registry key
PID:4636

C:\Program Files (x86)\Honeygain\Honeygain.exe
"C:\Program Files (x86)\Honeygain\Honeygain.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4992

C:\Program Files (x86)\Honeygain\Honeygain.exe
"C:\Program Files (x86)\Honeygain\Honeygain.exe" -silent
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2636

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e5995ee.rbs

Path C:\Config.Msi\e5995ee.rbs
Size 3.0MB
SHA256 f649ad6b692f90af555cdcf9a744adc4a8e189fd6bd878222ac55a93750047db
MD5 3813736f7f63990f5493237c9223b2bf
SHA1 f93b460254577a02ffaae959c7647a347318830b
SHA512 2d5a102ce5cfbd04e3cfec0f9e6018d871a641ca1b84db8935e6e91ae90bb6547b80d3a3dfb5add0715cb648d6c2b4864242c3125c6d49477fb94300d1fabca6
SSDEEP 49152:DpnKnbdscF13vOCrLPqKoF9dA1SuHbdlughXxolp//i4Ab1UXhK8TrD527aEcD4U:Dpo3vOCvPqKoFU1SuHB4ghhov/i4AbOf
TLSH
T1D6E533009225C2F1F1B73A3C2DA462A5573E7EB18F31F65A5B8CA5194FB4EC0DA941B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5995f0.rbs

Path C:\Config.Msi\e5995f0.rbs
Size 421B
SHA256 4a546125dc36c5e58fd598c7dab455926586823b83f294e6874e69bb98083ec3
MD5 5dfbb8fa13a6e4ecae1382d91c116ae6
SHA1 d465ce2c09f5e3866b09a814630119e197a47157
SHA512 e848b6529a4de96e2f489685c493352c915717b29b0fea0dcd5ededa4982801ec7d7e1bfdad6eb188d40e84e17973515584bfb780a62219faf68f72c1182d0ea
TLSH
T188E0685BD74213F8D8D1C1395B4753617437E272C6104B157F64063C7E632998EFA494
MD5 SHA1 SHA512 TLSH

Submit Download

Honeygain.Proxies.dll

Path C:\Program Files (x86)\Honeygain\Honeygain.Proxies.dll
Size 10KB
SHA256 e5604aac56014f51ffbe9ac03bc21b2237e9eba2979a205298a362173235d65d
MD5 15e52d2c20136dcb3bc27a0598e36799
SHA1 9722d2b7424bf0cd62271ccfdc95754389e223c7
SHA512 bb343200fae1f7abce0915d76bbb6dbfab9876b78dbe3f3abdc7337673a58cc06b8e3e09234d2f31ad8c0ad36cc7d41cfdd923756665a93bd435274e041469f6
SSDEEP 96:2GJIurUprKD9wHE7rb6KmRwEHlelel5OlpyWKNoCfL5L75Dz2ZlfJYP0lNVNsyV0:Lzw1H88/Kpyxx0ZWMrrGVz
TLSH
T19E227205BBF40E22FDBE47359D3B1B25027BB9858972DB2E089C128E1D3735049A5F53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

616AD1AB067CFD351D6C0EF6F3E12F40

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\616AD1AB067CFD351D6C0EF6F3E12F40
Size 1KB
SHA256 a44bf56bae1ab21f4d01d2788920b3084fd5a3d0536839e7a4728805ea79d749
MD5 4534629a86961e3757c63510f5dd8cbf
SHA1 0c61f34459008cb363a98994d2ee2b2df401058c
SHA512 b523cb84d489541c039b9846e0cd6ff6eb741f35c25a99fab8bb027fecab8a5ca677576416da888329235039ea22739f1c6f4f930782faef3033341d1e1214b6
TLSH
T13B11F04948442763A6092E31DD8EEDA79EF1A34A52C1880BE350C6C12A33BC81F894F9
MD5 SHA1 SHA512 TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_BDB5A8B5F8193C0E7588496C77F02BD2

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_BDB5A8B5F8193C0E7588496C77F02BD2
Size 727B
SHA256 4365288c2ba4dbc1bba957fe9ae361529c08aa7f6df8f19a8508b5ee4a0bf4cd
MD5 2239c93e9192384b35d21a1853129032
SHA1 c78c2e3ddc869b32311e3efa9fc03d72ec5fcfe9
SHA512 07a55847696c968d01b96322a0026c8d5f20141a2b05ab8576118b8f8fa387ed9514250d3efac93db29ce8e59ea4ca910be50da6b38537c9aa83847e0be10819
TLSH
T13801941F2F3DA817A51229981998EBF0F27B82B427CE2C3F22296103E480F754285449
MD5 SHA1 SHA512 TLSH

Submit Download

BA74182F76F15A9CF514DEF352303C95

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BA74182F76F15A9CF514DEF352303C95
Size 737B
SHA256 e5a156151da5783855e60d6c0689c5ec0b4d9ff00b0a796760ec7037ca016fea
MD5 3c9633dcae28312f9dd39b9cebdfbc5e
SHA1 c51575845cba2bdcd3d4969c507136ee47794286
SHA512 7634eb065f0478a21a5bd6f95ee42e32a781000e85afa14d5867de6e455364d126c5dfc2fa540ada6fa8464ee8b3068e29ee8091465b90f0c60da16c6fdaf4d5
TLSH
T1320165F58E104DD5EC258D6AB2F4CC2CB8FA4404501091AE5464C0C7969AB0A711788F
MD5 SHA1 SHA512 TLSH

Submit Download

616AD1AB067CFD351D6C0EF6F3E12F40

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\616AD1AB067CFD351D6C0EF6F3E12F40
Size 252B
SHA256 ad9e0421b7c89b2072f7167341ad17d32a373ffe356fd1c2ab4a9a4bbb3d5980
MD5 5872a0da1e960f26954b4d37e9a9c9f2
SHA1 5ce3af1bb51a3427df49ce1480513c012f127f82
SHA512 71a3f5e899b96fc79f18148fa2c00e3c383c00644ccfbb3164969c84ec8c4129da2e8f5af86769eca0bc4b4942697cee0dc0370a2cf653cc3ef1e86970a41b17
TLSH
T193D0122067F89326F155097ABEB166C3EB34B526A416CF2B05AA254F6421F44883091A
MD5 SHA1 SHA512 TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_BDB5A8B5F8193C0E7588496C77F02BD2

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_BDB5A8B5F8193C0E7588496C77F02BD2
Size 404B
SHA256 ce17681ea3dbbaddabfa47c0274a99f44514e995abfa916884ac8fd51e2a7f5f
MD5 ccf8467f0c3ed92ace520078c0e9b4ef
SHA1 4ec6a83c12fe259bebfda72b840c63023ecfb762
SHA512 70e45ba24c8e909b693da998adec4fa5517daad4543de288ce87f8a5ed411e1d7150a282e92f3cb40244fe4c5b2fba0f3d8774071e59c8639d9413beb5cb54a5
TLSH
T1A5E0263821FA464EF0F9E5759FFAA8225E9EF212185582A920502B19EB20F408CE2534
MD5 SHA1 SHA512 TLSH

Submit Download

BA74182F76F15A9CF514DEF352303C95

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BA74182F76F15A9CF514DEF352303C95
Size 248B
SHA256 a85ce467b1319bd9535a994cdc62a7d42087fb826096409e4ed41eb71aad64fb
MD5 1c0a22ff60bc4ac9d5c4cc7a8ab0d26b
SHA1 790cebf70603ec6a62b02125c8087d94badf6a50
SHA512 4205658bbc58521e3be70f6cc83360b865779d6936b74b07bc5f68d1c43a6b1536ed75867d1ee9c18bb19e405c57986c110365af5f3c58934a62945bec23b41c
TLSH
T17ED012B0A7F9135BF2A6523A6CB44A42AA60B95BB513CF1913B016DF9420F09083392B
MD5 SHA1 SHA512 TLSH

Submit Download

2rozphit.newcfg

Path C:\Users\Admin\AppData\Local\Honeygain_UAB\Honeygain.exe_Url_epbi3eytgcbwwd03t3prrswshfoqg0m1\1.7.0.0\2rozphit.newcfg
Size 1KB
SHA256 64d96f508d6ab94d85e167975be3a4e5e73286b543886855362fddba25e40762
MD5 ccb80e3697bc03a2a6d082e8227aec2d
SHA1 e116941aba1132d1465751f98cda06d37ccb81e5
SHA512 b31c142f1bf452211ff5727095de7f352c79b7997bb1d983fbc9a527beb51075db95cfcb309b519fe3637cd88352f219df8a5ef32a0f2263c514415a3d10e981
TLSH
T19F31F70C71C1EE9A85376A31D63252C0EDA05693517670B4B9AD32678F71CDA0BE33AA
MD5 SHA1 SHA512 TLSH

Submit Download

f4kk5mcx.newcfg

Path C:\Users\Admin\AppData\Local\Honeygain_UAB\Honeygain.exe_Url_epbi3eytgcbwwd03t3prrswshfoqg0m1\1.7.0.0\f4kk5mcx.newcfg
Size 2KB
SHA256 e5b96667667b7a012a10a5490541cac57b33fac8dd2750d5079d0631320424a3
MD5 ba388b82696c9af7533b03772203431d
SHA1 b599c221ae8392e86daf658af6e08aa462001e08
SHA512 65142d9bbaab921eb059291aeea6db847c992d499cf0d5cfaaad43a8549e2cacb7e1f47cbf8d911228629668080f42586bdf35a97cc30bc62022e7a424f85a66
TLSH
T18051E70CB2C1DE9A857B2B31D63142C1DDA016A3517670F076ED31638FB5CDA0AE3399
MD5 SHA1 SHA512 TLSH

Submit Download

hxm3drxa.newcfg

Path C:\Users\Admin\AppData\Local\Honeygain_UAB\Honeygain.exe_Url_epbi3eytgcbwwd03t3prrswshfoqg0m1\1.7.0.0\hxm3drxa.newcfg
Size 1KB
SHA256 0713291c8c0091d7532655ff367034b6c2aa12f276e31f2f963a1f241addef3d
MD5 e5c2e970891769b9f8046d5975d9e36d
SHA1 af94c759e936b61539c55dbd62dc9cf7688e7ce5
SHA512 8b34f6b9adae19fcd2939caf889163b30c1e5bf1a243d7e850c8932ded0f3e3187ebc018494f46759b02b4e03e4c2ad5a2eadd5248305759fe66ba4f119823b0
TLSH
T18641E70CB1C1EE9A85776A31D63142C0EDA01693517670F4B5ED31678F71CDA07E33AA
MD5 SHA1 SHA512 TLSH

Submit Download

lp3hskvm.newcfg

Path C:\Users\Admin\AppData\Local\Honeygain_UAB\Honeygain.exe_Url_epbi3eytgcbwwd03t3prrswshfoqg0m1\1.7.0.0\lp3hskvm.newcfg
Size 2KB
SHA256 aad4fadd076efc821867fd3d8c8e058eb558c95fc98ffa375dab6aebe0fb3898
MD5 12613eeddb3aaca26573b1bfcdb4c6d4
SHA1 0bf369ee2fbab6cfbfce7f366703f38f8c7b6bac
SHA512 8ee272682fcb46243777aa559721c7717051dc541b0b95c2b5414101d4c1f0130a9d816c2b970c0125e6aa34b0c6fa9a1afb8978448ab8993714f31d01c4178c
TLSH
T1F741F70CB2C1DE9A45772B31D63142C1DDA01693517670F476ED31678FB5CDA0AE3399
MD5 SHA1 SHA512 TLSH

Submit Download

user.config

Path C:\Users\Admin\AppData\Local\Honeygain_UAB\Honeygain.exe_Url_epbi3eytgcbwwd03t3prrswshfoqg0m1\1.7.0.0\user.config
Size 1KB
SHA256 cf8ff62a683425ad16f06f246c0e75a1ea3fcdc94a3d3b5c781330b588d272a1
MD5 353e855966db237926560242802fd685
SHA1 2601dfa42628d1b5c62e1f7f666ea7ce975ccb83
SHA512 2fb60376ad992cb6e4e02c30ec095c5633da941b89e645ac9b103359eca770df83dd0e038a458abf98898f39ae3c91f4614c3fad0e5c9e0d94e7829631573163
TLSH
T16B31370C71C1EE9A85376A31D6324280EDB05693517670B4B5AD32678F70CCA07E339A
MD5 SHA1 SHA512 TLSH

Submit Download

user.config

Path C:\Users\Admin\AppData\Local\Honeygain_UAB\Honeygain.exe_Url_epbi3eytgcbwwd03t3prrswshfoqg0m1\1.7.0.0\user.config
Size 1KB
SHA256 de2149289bd30afbad96003e7346810e3ea17990f8cdfd525e50391ab932161a
MD5 a78e435da9f8fd05185c5ef4dcb9a938
SHA1 04329cb7af926c3010e04af22366d69a961bfefb
SHA512 6f05a105d9ca9d9d8926181eb44bf7f96cdd1bbe7401c8880272e40358dfc938dd8eb1e341d9d7511fd8e81165e4d2ddc93cb2eb2d9041afb5eca9454043b489
TLSH
T14B31F50CB1C1EE9A85376A31D63142C0EDA05693517670B4B9ED32678F70CDA0BE33AA
MD5 SHA1 SHA512 TLSH

Submit Download

user.config

Path C:\Users\Admin\AppData\Local\Honeygain_UAB\Honeygain.exe_Url_epbi3eytgcbwwd03t3prrswshfoqg0m1\1.7.0.0\user.config
Size 2KB
SHA256 49ae74d01ba114dd15ae8b127aa727d4befbeab0b2fe9b86d865bd6f499e52c0
MD5 d9b2cc97d00ed919c11dea2dbba069e2
SHA1 331b4c162956472580559adc50d5e813b11702d3
SHA512 a6a72b9ff82fb932c017f988d717cf7192627e51486f011cceb6dcf981694992571db45e270bbf75415c9ecfc2255bae0791ea2a62614654fcd9f746349fe224
TLSH
T1E641090CB2C1DE9A45772A31D73142C1DDA01693517670F476ED31678F71CDA06E3399
MD5 SHA1 SHA512 TLSH

Submit Download

user.config

Path C:\Users\Admin\AppData\Local\Honeygain_UAB\Honeygain.exe_Url_epbi3eytgcbwwd03t3prrswshfoqg0m1\1.7.0.0\user.config
Size 2KB
SHA256 ac9a0083662d8c17c5ebca8b474dcd125dc1af45544698184238954c581de27d
MD5 149588651e18dd81a3928f471c74ee40
SHA1 ef71b30040307fccf4ca382aff53daa48c436de5
SHA512 d90e8758c6c84006d47d98f138c0669a120757ce3ccc5ae573176c183d0815c9cd56fd7f2daae0b378766996b9dbca45a622f12723b89751c4366cbc5f002967
TLSH
T1B151040CA2C6DE9A857B2B31D63242C1DDA41693417670F079ED35638FB0CEA4AF3799
MD5 SHA1 SHA512 TLSH

Submit Download

user.config

Path C:\Users\Admin\AppData\Local\Honeygain_UAB\Honeygain.exe_Url_epbi3eytgcbwwd03t3prrswshfoqg0m1\1.7.0.0\user.config
Size 3KB
SHA256 b461eb52353634ab20e0adbd7ff6dd2e65020497b4e8a0caef07e8d450790027
MD5 25e475ba113d82524b12f06d7d6c9b9c
SHA1 d0d2662d6e09f0bd4abc541ac62ddf4998d4eb50
SHA512 3ee0f0c04e951eee5dbdfa8bb072476c1a1618c9126170c21a8d4371671dd17d88df163ac12e0a19e3cde3934baa5e39543431919fef03e4439dac7057a36860
TLSH
T1EB71AB0DA2C2DE5986662734E6361285DCE0175349B6B4F4B5EC36638FB0CE60AB3399
MD5 SHA1 SHA512 TLSH

Submit Download

user.config

Path C:\Users\Admin\AppData\Local\Honeygain_UAB\Honeygain.exe_Url_epbi3eytgcbwwd03t3prrswshfoqg0m1\1.7.0.0\user.config
Size 3KB
SHA256 b717192c144b9243c88f48f31a7eb661b8bc4bf506ce5b26c7ab37e625697ce9
MD5 d45cd274ea1cd93e1f0803d536225a7b
SHA1 2ba65811eea6c652ba00744847f3c32e3729d53f
SHA512 ebb002216b19e1dd3ddec0a2da4a7b0955c934751df852e4c8a33eb1680a6bfe71aa60b26b0ec24e11c88cd4b08809ff59a7c62346f7663697497c93bd5847ed
TLSH
T116819B0DA2C2DE5946662734E73612C5DCE0175349B6B0F4B9EC36678FB0CE60AB3399
MD5 SHA1 SHA512 TLSH

Submit Download

user.config

Path C:\Users\Admin\AppData\Local\Honeygain_UAB\Honeygain.exe_Url_epbi3eytgcbwwd03t3prrswshfoqg0m1\1.7.0.0\user.config
Size 3KB
SHA256 acf8e875a21f472c3b8fd844aadb576ff62857401c9c6e95297154dddc1614e0
MD5 51f59f27b0e45fbb775cd2e250e6cc3d
SHA1 de7bb885c330c8ec3c5700e087a77d5fc30e283f
SHA512 9d7c66b61f36769d86111d711d3d3e411d189649daa2b8b7422783d815a7abc42cf8b7171e65afda18e6ea0905b301bc4f8cb9ace28f306d885fc89c2bf30108
TLSH
T125819C0DA2C2DE5946762734E73612C5DCE0165349B6B0F4B9EC36678FB0CE60AB3399
MD5 SHA1 SHA512 TLSH

Submit Download

user.config

Path C:\Users\Admin\AppData\Local\Honeygain_UAB\Honeygain.exe_Url_epbi3eytgcbwwd03t3prrswshfoqg0m1\1.7.0.0\user.config
Size 4KB
SHA256 6c68a51f02330d37f728157b2284f5bfd16f6e0a082c91b7b47a90033b26be44
MD5 c128d1fbfcb4b67b5bdb353a810a0b6c
SHA1 be27dfe2ba96b0024e0bea062c969200ff009daa
SHA512 94b945f3bd461ad3b036295c45f48935f079e74415681c97cd604a2826522029712323b88d9127d09f74eaf27bf3590af435721073866fa4c844180d5714f69d
SSDEEP 96:ur7z7KnWHZRna5TLn+nCEx0gnpsttZBIXVvAn0lzk:ur7z78mEL+/Wtt/Mw
TLSH
T16C818B0DA2C2DE5946762734E73612C5DCA0165349B6B0F4B9EC36678FB0CE60AB3399
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

identity.dat

Path C:\Users\Admin\AppData\Local\IsolatedStorage\ypv4z10v.ust\u0hs5lzw.sfv\Url.drerdjicalwioz5gl5pdz4uyeiwfdopr\identity.dat
Size 1KB
SHA256 9b372e5dc571e311dbccf7d5812f6d23fc2953ae0decc048dd0243152b91815f
MD5 12c7a63156d54aae1c5fd07c62125a80
SHA1 880466804f547d51fd78445cb466338c0594f3e6
SHA512 a9e2ba4674fa1fbcc3ff5a46a7f288e403b81440acaf61bf8415beaa1c0b030057fcac508a72d6c22bd9946e87e79b0b752eabe75b971215801273fe238f98b7
TLSH
T11B21AD72B7C5CB60D54629B3A49755A00730D120D02ECF91F3C8DA20EE9525C62BA34E
MD5 SHA1 SHA512 TLSH

Submit Download

info.dat

Path C:\Users\Admin\AppData\Local\IsolatedStorage\ypv4z10v.ust\u0hs5lzw.sfv\Url.drerdjicalwioz5gl5pdz4uyeiwfdopr\info.dat
Size 64B
SHA256 caa8d9ccb57fbfdb0435cd6b01118c469cc9723a74d0530770f917db3b5a6f1f
MD5 79f297ecdff08bc6f5f328d518660a2f
SHA1 fb37facccd846f2a86a40d3f9e487bead526abeb
SHA512 ccf04a4b253fc59ffb25a165bbdc9f9c0c57da243cb6d4db0ff23aa9ec818c2def66124b124dc3267dc30e88dae983168aa31f68f7e6a88d79556b4b5142dc4a
MD5 SHA1 SHA512

Submit Download

2026-05-22_6fc5e9cbb3f6c41864f1542ea641faee_amadey_darkgate_elex_luca-stealer_njrat_redline-stealer_.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-05-22_6fc5e9cbb3f6c41864f1542ea641faee_amadey_darkgate_elex_luca-stealer_njrat_redline-stealer_.exe
Size 24.8MB
SHA256 3d57d4e3bd93c871596c96f35dc5b0355df7e243990abe67a16f584aa8c330d7
MD5 b3149499aea420dbd93da823a08879fd
SHA1 380ceafa63920a24283b816a971058b76cf7062e
SHA512 8b2cf6b8493cb174f6f6104d6d40563386f4b17f0f478d4ed5b64e8fbc1901d05a34614c624c495b3ee8032d0756819c58d68270815594b2a063968696004ee6
SSDEEP 786432:+F5mgISC+5qIhq6HJW1LwoblvW1Po5q3CdxwI5G:+F5mgISC+5qIhq6crvWlo5R
TLSH
T19C470131758EC52BE57A01B09E2DDA6A562CAD360F6100E7B3DC7EAE1A745C31732E13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

installer_logo_large.png

Path C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_2200\installer_logo_large.png
Size 15KB
SHA256 71a8107a9f5e4464519fb74b4e83b7f7af86812399210f55a2505870391aec66
MD5 92a8f755b579ffc8c3f86ec87076f45e
SHA1 cd5536b089a281807eabe2def1e6f4020e2b124b
SHA512 11857b0eefbacc7faf7e1056124319c3acfc82eef0c1769a3ad7945a1019b85757fbd8f620a5bd360652c7f877a8634df744a3cee0fb0f7a07689522024d06fb
SSDEEP 192:1SJYZZZZ95YEfKD2D/hWtFCdOwxSMYvsW8jG5e+DROp719twoWru2nPizoDP2y0e:UOUDe/Row4MZXG5e+lOzkntnXeVS
TLSH
T1C3625949CB234E706A2A4E9F102997B61D76DB4BEF15F55AAE1B5833070F10C3B3A21C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

installer_logo_small.png

Path C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_2200\installer_logo_small.png
Size 5KB
SHA256 54305db25aef864e71e02d5a1cdadf831387d7b850a80512e041d9fadc0c5438
MD5 743d8274c5efa5b66c12eff6d89f819e
SHA1 655ab5d69e17883d3651792d7c3ff7e133e9ab54
SHA512 9f261f384932990796143b95cef3540e962757c7ada9bb0485df084f3c8391f28d31ac1eb78478c67eda56ffb1cb238924b107c7ed8e1c72d37cdd6acccc75ae
SSDEEP 96:hSEazpx8Z6lZFWF9dalGIVdju4+xcML3154fwssdNeM/Dm9H3mI:hSEazEiREC6HlqyNeIDoH3f
TLSH
T120B18E8E6FAE88584A08902E8ACF58B536E72F1CE5BE062B74055C1E3E5621B4D523F5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI825.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI825.tmp
Size 1.1MB
SHA256 98911811a173883c729791a5d57e16533bfd8703d340f71da80c3e5996aecf17
MD5 5209ba1f48c19c8d255b91a13adbdd3d
SHA1 ba14f5ea3d5a9036e1cfde14d9b8adc4b2641138
SHA512 7daf32304c6a7eeec1425e490e0a3c6c71ebd97e9512291fc89f1e56f02595d5bb02cae2e24fafba21becb65041c7c16b3b9cde033d100f125311da840b72e70
SSDEEP 24576:3aJvuQpxX7UP76P2yzIAqynDzTSpiwkGh0lhSMXlpnt1GeWLhPdSs0V:KpuQpxrK7e2QnDzTSpwlt1GeWLhPdSsA
TLSH
T154456C313E8EC426D79E16B0693C8E9BA12DBE750B6144C7A3D8BDEB54709C22735E13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI941.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI941.tmp
Size 926KB
SHA256 09266865df24fcbd8ae16d895a25551422cd2659b1d889cc6b074aae716f12d4
MD5 c67ea5c101a5a2c952478ec906296049
SHA1 d7960e3b6fdd588dbc567c8aa723cc9e3d82489b
SHA512 3390152c5e498d2dc01dcd6608b08f8933d95a2d074fc0b3814e7d48f773cc94f87489eb7b734975e3cb43263155b4d608ae5a0b2b266e2537e09fb442f51685
SSDEEP 24576:HJyLzBbJdcdYXquxC2/ZhOVh0lhSMXl5oGU8DS15XgF:pygz2/ZhVJoGdDS15XgF
TLSH
T18A156C21259FC036F26E01B02E3DCFBAD11D6D760BB164DB63E46E6A59B44C2133AE17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

shi7006.tmp

Path C:\Users\Admin\AppData\Local\Temp\shi7006.tmp
Size 5.0MB
SHA256 06285446d57089fe85b3b6127bbc92508773af458ad5cf20abf4570d41c0fee7
MD5 b40e4304f279119d9345be970babce41
SHA1 f76f5b30e7c333efcba1d4e19215ef1fd21d6943
SHA512 ad7e6b30b3ba32d641737f499874f23ccda7c4539def0465d1723d579c79c5e3e981df8526d31f2eb79dc0fe572eb4b71a780eb63df11170d4b6a0786f588299
SSDEEP 49152:MYsVB8iClmCxs6eymR9t9MF4sUe4/xdlIG1+MhbuNKm7g+eTr0fEJJh+XLT8VAMV:id0m0JyR90FNUXVAEi9w
TLSH
T1F436AF5563FE1398F6F78A38A9BA55559C76BC22EB11CBCF011201190AB2EC19F74F23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

upd5445.tmp

Path C:\Users\Admin\AppData\Local\Temp\upd5445.tmp
Size 457B
SHA256 90f22a492b012ca85c935e1eafe6ed0b56d49680b2f19f69e249c0749b243714
MD5 a6eeb74cf6ddb588bbcc694d4d65cea8
SHA1 2476ac3b79085919f6694be85b2d905e4034798f
SHA512 8b6914ecd757e1feb1a32e9e869e3ad11ab239fa3d92e24ce21bbd0ea59a73313f69e2ab0fa45187d9512c636b49b24f3240cd75c1022486a919237df50bccc5
TLSH
T1AAF055A9C212A2F8C484260C505F301123A3BF47DE44A40882727812E362C6AE71B4EC
MD5 SHA1 SHA512 TLSH

Submit Download

Honeygain_install.msi

Path C:\Users\Admin\AppData\Roaming\Honeygain UAB\Honeygain 1.7.0.0\install\Honeygain_install.msi
Size 5.8MB
SHA256 e2c9d680c48c3fb356a3cb72e4a0f01fa7a2ecea7f09efe6ed22c57f9e4cd5f8
MD5 f6c9be2fa8c2fccd3ceef377cee8141f
SHA1 eaa4e472281d0435a98c4853faa7d5b117cef8f2
SHA512 c4a7c2370d00de1e2c9c73e29ee22bb6b8c98c9f939ceb5f64ce286275c2c70fbe9ca0b3ce6e3862187ba67aec8d53b477394d3f65ea0ebc2ce6217bb8ed735e
SSDEEP 98304:OpuQnrt2QnumfyRjbdpo3vOCvPqKoFU1SuHB4ghhov/i4AbOhKoF6ql:guQnJ2HFjbdy35nqdFUYuHSSJOhKBq
TLSH
T13A56E020799FC036E26E02B2AA2DDF6B913D7E720B6154D773E47D9A19708C16336E13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Honeygain_install.exe

Path C:\Users\Admin\Downloads\Honeygain_install.exe
Size 24.1MB
SHA256 eaf6cf8841c168fa3d3a2d2e2d0b9c06693998415d125969824b987247fdad7c
MD5 1072f0086c77782f7e06572da82a66f4
SHA1 e7b18f2d80e887154f3ce71858a1a42b5c526f1b
SHA512 97b0a6f9a92465ad8b6f2e54ad0a6fb50751aeea3305ed1617589a20fd722581b8dcd3ec87cd695df39fed36e40da18e1811efa6af8b791ca20fe99a18e305f9
SSDEEP 786432:zF5mgISC+5qIhq6HlSABrkkpTfc1W1eTwHiBlc3Dh89j:zF5mgISC+5qIhq614kliW8dlc3DhU
TLSH
T112470131758EC52BE57A05B09E2DDA6A562CAD320F6100E7B3DC7E6E1A745C31732E23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI99DB.tmp

Path C:\Windows\Installer\MSI99DB.tmp
Size 3.0MB
SHA256 4a8a91d56b9f1b2db47d397004ff88e8a8b29ea9d9fccc32ec38ba271952869d
MD5 b6dd1c64dd9f4ea00fd179969cc663e9
SHA1 0215f8dc02ea1aa3a5510c292be003236be101d9
SHA512 baec50ba0c5a0735af5091ce5605f64d3aa970ab9ad4868dc179ca3bcc4967132209c2006dde5a5317a2cd548a55f2fded8fdfadf3bd8909ed232411c42c2ee4
SSDEEP 49152:kpnKnbdscF13vOCrLPqKoF9dA1SuHbdlughXxolp//i4Ab1UXhK8TrD527aEcD4q:kpo3vOCvPqKoFU1SuHB4ghhov/i4AbOx
TLSH
T168E53310926591B1F1BB3A3C2D70A195473F3EB18F32F6995B98A5290FB4DD0DB902B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Deployment.WindowsInstaller.dll

Path C:\Windows\Installer\MSI99DB.tmp-\Microsoft.Deployment.WindowsInstaller.dll
Size 179KB
SHA256 cf06d4ed4a8baf88c82d6c9ae0efc81c469de6da8788ab35f373b350a4b4cdca
MD5 1a5caea6734fdd07caa514c3f3fb75da
SHA1 f070ac0d91bd337d7952abd1ddf19a737b94510c
SHA512 a22dd3b7cf1c2edcf5b540f3daa482268d8038d468b8f00ca623d1c254affbbc1446e5bd42adc3d8e274be3ba776b0034e179faccd9ac8612ccd75186d1e3bf1
SSDEEP 3072:BGfZS7hUuK3PcbFeRRLxyR69UgoCaf8+aCnfKlRUjW01KymkO:9zMRLkR6joxfRPW
TLSH
T159046B2953FC473ACAFF4778E261425197B1F2E67117DB0EEC8181AA2522780F792397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CustomAction.config

Path C:\Windows\Installer\MSI9C4E.tmp-\CustomAction.config
Size 1KB
SHA256 33d947c04a10e3aff3dca3b779393fa56ce5f02251c8cbae5076a125fdea081f
MD5 01c01d040563a55e0fd31cc8daa5f155
SHA1 3c1c229703198f9772d7721357f1b90281917842
SHA512 9c3f0cc17868479575090e1949e31a688b8c1cdfa56ac4a08cbe661466bb40ecfc94ea512dc4b64d5ff14a563f96f1e71c03b6eeacc42992455bd4f1c91f17d5
TLSH
T11031568E0B05B77711312753AEED90C5DB7561A73C95811834DE99293F36978137338E
MD5 SHA1 SHA512 TLSH

Submit Download

Honeygain.CustomActions.dll

Path C:\Windows\Installer\MSI9C4E.tmp-\Honeygain.CustomActions.dll
Size 10KB
SHA256 2072f10285ae4eda5d970b4ffb8734948f035d95c254eff7e27ec2f5659db4da
MD5 8db5beb5657e97670ee42bdac5d3f32b
SHA1 52dfe729b52cffb9f82cca280cb4ad0e4244b9f7
SHA512 80aa2b9fbbc58e2f7c6ba513445133e3be5adac659681f48068486c069a733025bab425ead74421d3a0e80cb088ecf32835367d8b04c0ef90ad64f36562b4702
SSDEEP 192:L7O8e6u5Mkivwt+GO0M+WDX6NaqiiGfqbNPxYcRwo0MKU7:M6u5liv13D6NaqiiDmcRxZ7
TLSH
T19322D808B7FC4336D9778734A967421013BAFA999A62C72F0D80545E5E217059AB3FB1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hgwin.dll

Path C:\Windows\Installer\MSI9C4E.tmp-\hgwin.dll
Size 6.8MB
SHA256 483e3d8960afaf174d570b3cf12a812437dc2cf426765a3bf71db68df12dca26
MD5 e511642fad4db696a684ae4c1ad95159
SHA1 5f67619a88ed22166f6df22aa64c0ae1a368ed77
SHA512 0d813d9b666d590c2568105016eade60b068fe96b0559c7389b105d94fd54fbd7eca5412756806acdc6b2dacacaede6f166f310dcd2b988e2649e41683b80eba
SSDEEP 98304:+QZPOXPI5y5o1Jh4+QuN6ImJ86AFXv+5:+3AO9xk4yv+
TLSH
T1CB766C03B741E0FAC44F52B0A51D637E92359B49CB1649E783A89FBC5EB07C11E36A78
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msquic.dll

Path C:\Windows\Installer\MSI9C4E.tmp-\msquic.dll
Size 1.9MB
SHA256 9353e700f5d9dbb03552d6b4d2bc52ae625ef508957e1a7234e09c4c377d40bc
MD5 3247e146ffb02fb3d542ea75e21bf46c
SHA1 7c96c2e5bd73d5a895e13afc3a8106251d3434fa
SHA512 f690db8b0709b593091aa523c6995af06b54fe010966907653baa83940ae499900f19899b76b00c2096373bb4c39f8c0f26b8b3a0547d4f255c796011c80d37c
SSDEEP 49152:Md7aYPcnDDvSMZnOsdrzP0yKVChZpvO2:Md7ak8vSpsdsyKVC
TLSH
T17195AE03FB8198B2E4DE027860BB577F5D3AAD184334C9D397D425B98D216D06A3B3AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icsys.icn.exe

Path C:\Windows\Resources\Themes\icsys.icn.exe
Size 135KB
SHA256 991a627dc7bfb73367ff0c16c0ea21c11bf556f239170db57d3856b9c8532695
MD5 0283c2df2971087aca1b9ac6f5e0a921
SHA1 9ec577f3ac9bd7baad8c62bd7f38f21c925a5cb1
SHA512 c7d0e74d9efb65300d372f13442baee832ce7beb12bba9a2356006b038deafb0d60800c777118db3b1c45279a79e117372e7b2909a777b2460bf7980b7a71b8a
SSDEEP 1536:4fsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVa9:4VqoCl/YgjxEufVU0TbTyDDalk9
TLSH
T142D318236E50542FD4928AF128AADB2F7A255E370BE57C132397BB0129791537AF031F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 24.6MB
SHA256 81a199ee9a6d794ebf1f928ee2a80f296f04eaf28b596ec573434ad120804a4b
MD5 b6f8c662b10f120df0cb90a6d2423d85
SHA1 04970f9cbaad622d3f5f14d6e9899c5a915ded18
SHA512 bd5201b2a4e62c76b119193bee2d0b1546255d012615dbd5984a5c6a1963859c913cdf6c91ad2f2d5fef50bbd302867a7235c950e5406556b67d9a2e3d5f0f4d
SSDEEP 24576:Y2gmSp1ddoO/vvTL5GyuxEHKv65pg4WoGWBdHJESL5KoEe2HoZTVrf4lx:o
TLSH
T13847F61832F92140E7F39E3DA8F06A67493A7D5B9C15DE8D05811B8D0921FB1E872F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{2f77005b-8310-413a-8611-bc19787e2bdc}_OnDiskSnapshotProp

Path \??\Volume{8b022b51-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{2f77005b-8310-413a-8611-bc19787e2bdc}_OnDiskSnapshotProp
Size 6KB
SHA256 c4864990aaafad6992675b2eb0f8ac7b90b164e1ceb83e5dbb30d4dfac71d9b3
MD5 ee52ff63980402e8c2b9f21889698bc2
SHA1 213ac872d14b7422c6701c12c7f58866e4722c4d
SHA512 1a50ef0e1edaf949a0eb32b413e8221994e995730708e3014bfecac1b84cd34f08b2212df28e83495816e7c018c602f1bffac8ccaa230ccebca6f577367ebb16
SSDEEP 96:FOyC4u9vc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpuN:Ubb++ZVmN
TLSH
T1C7D1890C5AE54711E2B3AB7229F58557A477B911EF33CB8E0198238E2670910F876F6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

spoolsv.exe

Path \??\c:\windows\resources\spoolsv.exe
Size 135KB
SHA256 7a59e5efd06a538626a20f92e6eb32999d2b1da670afd338e4a05774cbc8ffbb
MD5 55ccee7ddc5ea981d828fe0e7db38e5f
SHA1 7cb9281303ea6d901ead4f24360fe62767f8040e
SHA512 d8ce0a354623f3ca59e7774b79fbbf93f33df7874f6e2882a15885068f716fdba707a26593fbdc5ef2d0500d24a0291d5d2010a67e3b25fc59cc2ae4357d1296
SSDEEP 1536:4fsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVa2:4VqoCl/YgjxEufVU0TbTyDDalk2
TLSH
T1B7D3FA23BE60542FE4228AF12CA9D71EBE550E3A5B91AE073163FB043A3524775F524F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost.exe

Path \??\c:\windows\resources\svchost.exe
Size 135KB
SHA256 52536f491ed57ee78712dbb5ce1029b8eb044c025c57c4c31d477b469394060a
MD5 04cdb6915e6aab60fb1a442604c01c2a
SHA1 992756330d368daf755d8d22b5a177d677dcef7c
SHA512 049e38e04b318c4366592262f6931c571bd6a53576a0ba44005feac28199e92900c4c9bd3b2f98ce2c7af5df363ddac1e534149cef46d06729ed82481f4b463c
SSDEEP 1536:4fsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVa0SSSSSSSSSSSSH:4VqoCl/YgjxEufVU0TbTyDDalkW
TLSH
T16AD3E9237E14402FD8A68AF128A4D67FB5335E662BD4AC57B2977B0428B1113B6F131F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

explorer.exe

Path \??\c:\windows\resources\themes\explorer.exe
Size 135KB
SHA256 9bad5085997482ef8de106545f34f568e789be7888d927b802a1503023233116
MD5 1abb28543bb72fc119bf6caaed9cfe4f
SHA1 703168bac725e978e5f00a6d4bada8d567381b1d
SHA512 0cccf591a59af5bb526eda3c296fe365ea37ac98c4b2b5e0a947117c5a1b21020f4bd3dce436b3aee174dfc3193b028af0273b9e94c6641d1c6e1b4adfce4f16
SSDEEP 1536:4fsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVaP:4VqoCl/YgjxEufVU0TbTyDDalkP
TLSH
T12CD308237D54642ED823C8F128B9EB2AB9211E3A1FD0AE473556B754397620B73F160F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1004-205-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/1500-275-0x0000000002E30000-0x0000000002E38000-memory.dmp

Download

memory/1500-283-0x0000000005B80000-0x00000000060AC000-memory.dmp

Download

memory/1500-282-0x0000000005480000-0x0000000005642000-memory.dmp

Download

memory/1888-45-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/1888-0-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/2104-257-0x0000000004BE0000-0x0000000004BE8000-memory.dmp

Download

memory/2104-255-0x0000000004BA0000-0x0000000004BCE000-memory.dmp

Download

memory/2852-43-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/4072-44-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/4720-206-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/4892-46-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/4992-426-0x0000000006880000-0x00000000068E2000-memory.dmp

Download

memory/4992-432-0x0000000006C20000-0x0000000006CD8000-memory.dmp

Download

memory/4992-434-0x0000000006C00000-0x0000000006C08000-memory.dmp

Download

memory/4992-433-0x0000000006FC0000-0x0000000007042000-memory.dmp

Download

memory/4992-436-0x0000000007370000-0x0000000007396000-memory.dmp

Download

memory/4992-437-0x0000000007320000-0x0000000007328000-memory.dmp

Download

memory/4992-439-0x00000000073A0000-0x00000000073B6000-memory.dmp

Download

memory/4992-440-0x00000000073F0000-0x0000000007420000-memory.dmp

Download

memory/4992-444-0x00000000077C0000-0x00000000077D2000-memory.dmp

Download

memory/4992-445-0x0000000007820000-0x000000000785C000-memory.dmp

Download

memory/4992-431-0x0000000006A10000-0x0000000006A5A000-memory.dmp

Download

memory/4992-446-0x0000000007920000-0x00000000079D2000-memory.dmp

Download

memory/4992-452-0x00000000079E0000-0x0000000007A46000-memory.dmp

Download

memory/4992-453-0x0000000008220000-0x00000000082B2000-memory.dmp

Download

memory/4992-454-0x0000000008870000-0x0000000008E16000-memory.dmp

Download

memory/4992-455-0x00000000082F0000-0x0000000008312000-memory.dmp

Download

memory/4992-457-0x0000000008320000-0x0000000008677000-memory.dmp

Download

memory/4992-463-0x0000000008760000-0x0000000008800000-memory.dmp

Download

memory/4992-466-0x0000000008720000-0x0000000008742000-memory.dmp

Download

memory/4992-467-0x0000000009160000-0x000000000917A000-memory.dmp

Download

memory/4992-468-0x0000000009180000-0x0000000009194000-memory.dmp

Download

memory/4992-469-0x00000000091A0000-0x00000000091B8000-memory.dmp

Download

memory/4992-470-0x0000000008860000-0x0000000008870000-memory.dmp

Download

memory/4992-471-0x00000000091E0000-0x00000000091F4000-memory.dmp

Download

memory/4992-472-0x0000000009200000-0x000000000921C000-memory.dmp

Download

memory/4992-473-0x00000000091C0000-0x00000000091D4000-memory.dmp

Download

memory/4992-474-0x0000000009230000-0x000000000923A000-memory.dmp

Download

memory/4992-478-0x0000000009270000-0x0000000009278000-memory.dmp

Download

memory/4992-479-0x00000000092C0000-0x00000000092F8000-memory.dmp

Download

memory/4992-480-0x0000000009280000-0x000000000928E000-memory.dmp

Download

memory/4992-481-0x0000000009330000-0x0000000009358000-memory.dmp

Download

memory/4992-482-0x0000000009320000-0x0000000009330000-memory.dmp

Download

memory/4992-430-0x0000000006980000-0x00000000069B2000-memory.dmp

Download

memory/4992-429-0x0000000006850000-0x0000000006858000-memory.dmp

Download

memory/4992-428-0x0000000006820000-0x000000000682A000-memory.dmp

Download

memory/4992-427-0x0000000006810000-0x000000000681A000-memory.dmp

Download

memory/4992-424-0x00000000067A0000-0x00000000067DC000-memory.dmp

Download

memory/4992-425-0x00000000067E0000-0x000000000680C000-memory.dmp

Download

memory/4992-423-0x0000000006730000-0x000000000675A000-memory.dmp

Download

memory/4992-422-0x00000000066F0000-0x00000000066FE000-memory.dmp

Download

memory/4992-419-0x0000000006690000-0x00000000066AC000-memory.dmp

Download

memory/4992-420-0x00000000066B0000-0x00000000066CA000-memory.dmp

Download

memory/4992-421-0x00000000066D0000-0x00000000066DA000-memory.dmp

Download

memory/4992-418-0x00000000062B0000-0x00000000062CE000-memory.dmp

Download

memory/4992-753-0x0000000009630000-0x0000000009638000-memory.dmp

Download

memory/4992-754-0x00000000096B0000-0x00000000096C8000-memory.dmp

Download

memory/4992-757-0x0000000009B20000-0x0000000009B2A000-memory.dmp

Download

memory/4992-820-0x000000000E970000-0x000000000F116000-memory.dmp

Download

memory/4992-417-0x0000000000E80000-0x00000000016E0000-memory.dmp

Download

memory/4992-823-0x0000000011AB0000-0x0000000011B26000-memory.dmp

Download

memory/4992-824-0x000000000F560000-0x000000000F57E000-memory.dmp

Download