86910232c49929fcfc966d4be05074f7f12ec4d33f4a0f1d5264b4176a9aab49

Analysis

max time kernel
148s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/10/2026, 04:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-10_b821cd6dca45a8c86edb6de13bfe4428_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
Size 9.7MB
Sample261011-e1xkqaez7x
SHA256 86910232c49929fcfc966d4be05074f7f12ec4d33f4a0f1d5264b4176a9aab49
MD5 b821cd6dca45a8c86edb6de13bfe4428
SHA1 ab3d895a684c6d824830823679a23a2f75a7f91a
SHA512 4ca4c1c0da6f285ff53d7cf0af778369d6bd394ae536cccafd94775825b310efa625dde7efb57a271df83f8ea17e2c00ed3bffad2df46479feb3bdc3d54095f0
SSDEEP 196608:t295Xg+ybzDNvexK9STaZirZnveGUdGPGIAPd1Gi0w6c2lN9YyCHjEk:t295Xg+ybz9exK9STasadSGI6dNB6cLT
TLSH
T107A6E032329AC52BD56505B01E2C9AAE933CAD350F6148D7B2CC7E5F177A6C35236E23
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery persistence privilege_escalation ransomware spyware trojan

Malware Config

Signatures

Detects executables packed with Babel 2 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c540-201.dat	INDICATOR_EXE_Packed_Babel
behavioral2/memory/3448-333-0x00000000062B0000-0x0000000006544000-memory.dmp	INDICATOR_EXE_Packed_Babel

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OICLauncher = "C:\\Program Files (x86)\\Origin Instruments, Corp\\Launcher\\OICLauncher.exe"	msiexec.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\I:	2026-10-10_b821cd6dca45a8c86edb6de13bfe4428_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\G:	2026-10-10_b821cd6dca45a8c86edb6de13bfe4428_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened (read-only)	\??\K:	2026-10-10_b821cd6dca45a8c86edb6de13bfe4428_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened (read-only)	\??\Z:	2026-10-10_b821cd6dca45a8c86edb6de13bfe4428_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\G:	2026-10-10_b821cd6dca45a8c86edb6de13bfe4428_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened (read-only)	\??\K:	2026-10-10_b821cd6dca45a8c86edb6de13bfe4428_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\M:	2026-10-10_b821cd6dca45a8c86edb6de13bfe4428_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened (read-only)	\??\R:	2026-10-10_b821cd6dca45a8c86edb6de13bfe4428_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened (read-only)	\??\U:	2026-10-10_b821cd6dca45a8c86edb6de13bfe4428_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened (read-only)	\??\A:	2026-10-10_b821cd6dca45a8c86edb6de13bfe4428_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	2026-10-10_b821cd6dca45a8c86edb6de13bfe4428_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Q:	2026-10-10_b821cd6dca45a8c86edb6de13bfe4428_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened (read-only)	\??\T:	2026-10-10_b821cd6dca45a8c86edb6de13bfe4428_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened (read-only)	\??\W:	2026-10-10_b821cd6dca45a8c86edb6de13bfe4428_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\H:	2026-10-10_b821cd6dca45a8c86edb6de13bfe4428_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	2026-10-10_b821cd6dca45a8c86edb6de13bfe4428_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	2026-10-10_b821cd6dca45a8c86edb6de13bfe4428_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened (read-only)	\??\N:	2026-10-10_b821cd6dca45a8c86edb6de13bfe4428_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\X:	2026-10-10_b821cd6dca45a8c86edb6de13bfe4428_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened (read-only)	\??\B:	2026-10-10_b821cd6dca45a8c86edb6de13bfe4428_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened (read-only)	\??\D:	2026-10-10_b821cd6dca45a8c86edb6de13bfe4428_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened (read-only)	\??\M:	2026-10-10_b821cd6dca45a8c86edb6de13bfe4428_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened (read-only)	\??\V:	2026-10-10_b821cd6dca45a8c86edb6de13bfe4428_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened (read-only)	\??\L:	2026-10-10_b821cd6dca45a8c86edb6de13bfe4428_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened (read-only)	\??\T:	2026-10-10_b821cd6dca45a8c86edb6de13bfe4428_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\J:	2026-10-10_b821cd6dca45a8c86edb6de13bfe4428_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened (read-only)	\??\O:	2026-10-10_b821cd6dca45a8c86edb6de13bfe4428_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened (read-only)	\??\X:	2026-10-10_b821cd6dca45a8c86edb6de13bfe4428_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\O:	2026-10-10_b821cd6dca45a8c86edb6de13bfe4428_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened (read-only)	\??\P:	2026-10-10_b821cd6dca45a8c86edb6de13bfe4428_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened (read-only)	\??\U:	2026-10-10_b821cd6dca45a8c86edb6de13bfe4428_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened (read-only)	\??\W:	2026-10-10_b821cd6dca45a8c86edb6de13bfe4428_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened (read-only)	\??\H:	2026-10-10_b821cd6dca45a8c86edb6de13bfe4428_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\I:	2026-10-10_b821cd6dca45a8c86edb6de13bfe4428_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened (read-only)	\??\N:	2026-10-10_b821cd6dca45a8c86edb6de13bfe4428_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened (read-only)	\??\Z:	2026-10-10_b821cd6dca45a8c86edb6de13bfe4428_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened (read-only)	\??\D:	2026-10-10_b821cd6dca45a8c86edb6de13bfe4428_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened (read-only)	\??\Q:	2026-10-10_b821cd6dca45a8c86edb6de13bfe4428_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened (read-only)	\??\S:	2026-10-10_b821cd6dca45a8c86edb6de13bfe4428_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\L:	2026-10-10_b821cd6dca45a8c86edb6de13bfe4428_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened (read-only)	\??\S:	2026-10-10_b821cd6dca45a8c86edb6de13bfe4428_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened (read-only)	\??\B:	2026-10-10_b821cd6dca45a8c86edb6de13bfe4428_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\V:	2026-10-10_b821cd6dca45a8c86edb6de13bfe4428_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Drops file in Program Files directory 25 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Origin Instruments, Corp\SofType\SofType.exe	msiexec.exe
File created	C:\Program Files (x86)\Origin Instruments, Corp\SofType\STdata\AlphaKey2.kys	msiexec.exe
File created	C:\Program Files (x86)\Origin Instruments, Corp\SofType\STdata\Alternate One.kys	msiexec.exe
File created	C:\Program Files (x86)\Origin Instruments, Corp\SofType\STdata\KidKeys.kys	msiexec.exe
File created	C:\Program Files (x86)\Origin Instruments, Corp\SofType\STdata\Minimal4.kys	msiexec.exe
File created	C:\Program Files (x86)\Origin Instruments, Corp\SofType\STdata\NumPad.kys	msiexec.exe
File created	C:\Program Files (x86)\Origin Instruments, Corp\SofType\STdata\SofType.st1	msiexec.exe
File created	C:\Program Files (x86)\Origin Instruments, Corp\SofType\SofType.chm	msiexec.exe
File created	C:\Program Files (x86)\Origin Instruments, Corp\SofType\STdata\AlphaKey.kys	msiexec.exe
File created	C:\Program Files (x86)\Origin Instruments, Corp\SofType\STdata\Minimal3.kys	msiexec.exe
File created	C:\Program Files (x86)\Origin Instruments, Corp\Launcher\OICLauncher.exe	msiexec.exe
File created	C:\Program Files (x86)\Origin Instruments, Corp\SofType\QlmLicenseLib.dll	msiexec.exe
File created	C:\Program Files (x86)\Origin Instruments, Corp\SofType\QlmLicenseLib.dll.manifest	msiexec.exe
File created	C:\Program Files (x86)\Origin Instruments, Corp\SofType\regid.1996-02.com.orin,access_SofType.swidtag	MsiExec.exe
File created	C:\Program Files (x86)\Origin Instruments, Corp\SofType\STdata\KidKeys2.kys	msiexec.exe
File created	C:\Program Files (x86)\Origin Instruments, Corp\SofType\OICHlpr.exe	msiexec.exe
File created	C:\Program Files (x86)\Origin Instruments, Corp\SofType\Default.kys	msiexec.exe
File created	C:\Program Files (x86)\Origin Instruments, Corp\SofType\STdata\Alternate Two.kys	msiexec.exe
File created	C:\Program Files (x86)\Origin Instruments, Corp\SofType\STdata\Default.kys	msiexec.exe
File created	C:\Program Files (x86)\Origin Instruments, Corp\SofType\STdata\Qwerty.kys	msiexec.exe
File created	C:\Program Files (x86)\Origin Instruments, Corp\SofType\Dood32.dll	msiexec.exe
File created	C:\Program Files (x86)\Origin Instruments, Corp\SofType\License.exe	msiexec.exe
File created	C:\Program Files (x86)\Origin Instruments, Corp\SofType\STdata\Minimal.kys	msiexec.exe
File created	C:\Program Files (x86)\Origin Instruments, Corp\SofType\STdata\Minimal2.kys	msiexec.exe
File created	C:\Program Files (x86)\Origin Instruments, Corp\SofType\STdata\Vertical.kys	msiexec.exe

Drops file in Windows directory 39 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e5a5b41.msi	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7727.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7872.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7A0C.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI62E4.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI63FE.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6C51.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF6B488D2C6E14DEEF.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF70D86D27D3681543.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7511.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI78C2.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF25F4487C776A9E48.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6295.tmp	msiexec.exe
File created	C:\Windows\Installer\{24B92538-FF27-4FB0-97F0-96325A454EB3}\STLauncher.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5EDA.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7184.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7570.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7785.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI678C.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6FBD.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI70F6.tmp	msiexec.exe
File created	C:\Windows\Installer\e5a5b43.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI78A2.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF51BE786F6BF0724B.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\e5a5b41.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI643D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6632.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6849.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI734B.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\AiFilesRemoveNoImpers_24B92538_FF27_4FB0_97F0_96325A454EB3.bak	MsiExec.exe
File opened for modification	C:\Windows\Installer\MSI77B5.tmp	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI66FF.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\SourceHash{24B92538-FF27-4FB0-97F0-96325A454EB3}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI71C4.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{24B92538-FF27-4FB0-97F0-96325A454EB3}\STLauncher.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7921.tmp	msiexec.exe

Executes dropped EXE 6 IoCs

pid	Process
3228	MSI66FF.tmp
5556	MSI678C.tmp
5508	OICLauncher.exe
1524	OICLauncher.exe
3620	SofType.exe
3448	License.exe

Loads dropped DLL 39 IoCs

pid	Process
1752	MsiExec.exe
1752	MsiExec.exe
1752	MsiExec.exe
1752	MsiExec.exe
1752	MsiExec.exe
1752	MsiExec.exe
1752	MsiExec.exe
1752	MsiExec.exe
1752	MsiExec.exe
1752	MsiExec.exe
1752	MsiExec.exe
1752	MsiExec.exe
1752	MsiExec.exe
5536	MsiExec.exe
5536	MsiExec.exe
5536	MsiExec.exe
5536	MsiExec.exe
5536	MsiExec.exe
5536	MsiExec.exe
5536	MsiExec.exe
5536	MsiExec.exe
5536	MsiExec.exe
5536	MsiExec.exe
5536	MsiExec.exe
5536	MsiExec.exe
236	MsiExec.exe
5536	MsiExec.exe
236	MsiExec.exe
236	MsiExec.exe
5536	MsiExec.exe
236	MsiExec.exe
5536	MsiExec.exe
236	MsiExec.exe
5536	MsiExec.exe
1752	MsiExec.exe
1752	MsiExec.exe
3620	SofType.exe
3448	License.exe
3448	License.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
persistence privilege_escalation

Accessibility Features
T1546.008

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3196	5508	WerFault.exe	104

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	License.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	License.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-10_b821cd6dca45a8c86edb6de13bfe4428_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-10_b821cd6dca45a8c86edb6de13bfe4428_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-10_b821cd6dca45a8c86edb6de13bfe4428_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-10_b821cd6dca45a8c86edb6de13bfe4428_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OICLauncher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SofType.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-10_b821cd6dca45a8c86edb6de13bfe4428_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSI66FF.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSI678C.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OICLauncher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	License.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-10_b821cd6dca45a8c86edb6de13bfe4428_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000000463f4e358e8ea170000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c01200000000000000000000000027010100008838010463f4e30000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e841010463f4e3000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e30463f4e300000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e60463f4e300000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Modifies data under HKEY_USERS 26 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	MsiExec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{e3f46304-0000-0000-0000-d08302000000}\NukeOnDelete = "0"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Caphyon	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Caphyon\Advanced Installer\XML Config\{24B92538-FF27-4FB0-97F0-96325A454EB3}\C:\Program Files (x86)\Origin Instruments, Corp\SofType\regid.1996-02.com.orin,access_SofType.swidtag = "*"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	MsiExec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\TelemetrySalt = "7"	MsiExec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{e3f46304-0000-0000-0000-d08302000000}\MaxCapacity = "94852"	MsiExec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Caphyon\Advanced Installer\XML Config\{24B92538-FF27-4FB0-97F0-96325A454EB3}	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Caphyon\Advanced Installer	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Caphyon\Advanced Installer\XML Config\{24B92538-FF27-4FB0-97F0-96325A454EB3}\C:\ProgramData\regid.1996-02.com.orin,access\regid.1996-02.com.orin,access_SofType.swidtag = "*"	MsiExec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	MsiExec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\System32\urlmon.dll,-4200 = "Open File - Security Warning"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Caphyon\Advanced Installer\XML Config	MsiExec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{e3f46304-0000-0000-0000-d08302000000}	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume	MsiExec.exe

Modifies registry class 39 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\83529B4272FF0BF4790F6923A554E43B\PackageCode = "0F27876899AEDB34C899C8298B5188B0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\83529B4272FF0BF4790F6923A554E43B\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\702436AAA28E41440B36AA0751A4F14C\83529B4272FF0BF4790F6923A554E43B	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\83529B4272FF0BF4790F6923A554E43B\SourceList\Net	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\83529B4272FF0BF4790F6923A554E43B\Clients = 3a0000000000	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\83529B4272FF0BF4790F6923A554E43B\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\83529B4272FF0BF4790F6923A554E43B\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\83529B4272FF0BF4790F6923A554E43B\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Roaming\\Origin Instruments, Corp\\SofType 5.0.1105.0\\install\\A454EB3\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\83529B4272FF0BF4790F6923A554E43B\SourceList\Media\DiskPrompt = "[1]"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\83529B4272FF0BF4790F6923A554E43B	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\702436AAA28E41440B36AA0751A4F14C	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\83529B4272FF0BF4790F6923A554E43B\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\83529B4272FF0BF4790F6923A554E43B\MainFeature	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\83529B4272FF0BF4790F6923A554E43B\ProductName = "SofType"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\83529B4272FF0BF4790F6923A554E43B\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\83529B4272FF0BF4790F6923A554E43B\SourceList\PackageName = "SofTypeSetup.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\83529B4272FF0BF4790F6923A554E43B\SourceList\Media	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	MsiExec.exe
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\WOW6432Node	License.exe
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\WOW6432Node\CLSID	License.exe
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\WOW6432Node\CLSID\{DD61EFE8-DBC5-43FD-B2DE-364CBE8E6F14}	License.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\WOW6432Node\CLSID\{DD61EFE8-DBC5-43FD-B2DE-364CBE8E6F14}\Insertable\ = "12/32/4248/27/47/79"	License.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\83529B4272FF0BF4790F6923A554E43B	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\83529B4272FF0BF4790F6923A554E43B\Language = "1033"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	MsiExec.exe
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\WOW6432Node\CLSID\{DD61EFE8-DBC5-43FD-B2DE-364CBE8E6F14}\InProcServer32	License.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\WOW6432Node\CLSID\{DD61EFE8-DBC5-43FD-B2DE-364CBE8E6F14}\Control\Control1 = "E\u009eæèÎËßÎáÎÎËåÏãëåËõÖëÒàËÓñÓéäëõÖáÊÏÏËÏÎËÐÎÐÔËÎÓËÐÓËÓÕÙ"	License.exe
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\WOW6432Node\CLSID\{DD61EFE8-DBC5-43FD-B2DE-364CBE8E6F14}\Insertable	License.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\83529B4272FF0BF4790F6923A554E43B\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Roaming\\Origin Instruments, Corp\\SofType 5.0.1105.0\\install\\A454EB3\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	MsiExec.exe
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\WOW6432Node\CLSID\{DD61EFE8-DBC5-43FD-B2DE-364CBE8E6F14}\Control	License.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\83529B4272FF0BF4790F6923A554E43B\Version = "83887185"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\83529B4272FF0BF4790F6923A554E43B\ProductIcon = "C:\\Windows\\Installer\\{24B92538-FF27-4FB0-97F0-96325A454EB3}\\STLauncher.exe"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\83529B4272FF0BF4790F6923A554E43B\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\83529B4272FF0BF4790F6923A554E43B\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	MsiExec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\WOW6432Node\CLSID\{DD61EFE8-DBC5-43FD-B2DE-364CBE8E6F14}\InProcServer32\ = "C:\\Windows\\SysWow64\\kernel32.dll"	License.exe

Modifies system certificate store 2 TTPs 9 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2\Blob = 0f000000010000003000000041ce925678dfe0ccaa8089263c242b897ca582089d14e5eb685fca967f36dbd334e97e81fd0e64815f851f914ade1a1e0b00000001000000800000004d006900630072006f0073006f006600740020004900640065006e007400690074007900200056006500720069006600690063006100740069006f006e00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f0072006900740079002000320030003200300000006200000001000000200000005367f20c7ade0e2bca790915056d086b720c33c1fa2a2661acf787e3292e1270090000000100000016000000301406082b0601050507030306082b06010505070308140000000100000014000000c87ed26a852a1bca1998040727cf50104f68a8a21d0000000100000010000000e78921f81cea4d4105d2b5f4afae0c78030000000100000014000000f40042e2e5f7e8ef8189fed15519aece42c3bfa22000000001000000d0050000308205cc308203b4a00302010202105498d2d1d45b1995481379c811c08799300d06092a864886f70d01010c05003077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f726974792032303230301e170d3230303431363138333631365a170d3435303431363138343434305a3077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f72697479203230323030820222300d06092a864886f70d01010105000382020f003082020a0282020100b3912a07830667fd9e9de0c7c0b7a4e642047f0fa6db5ffbd55ad745a0fb770bf080f3a66d5a4d7953d8a08684574520c7a254fbc7a2bf8ac76e35f3a215c42f4ee34a8596490dffbe99d814f6bc2707ee429b2bf50b9206e4fd691365a89172f29884eb833d0ee4d771124821cb0dedf64749b79bf9c9c717b6844fffb8ac9ad773674985e386bd3740d02586d4deb5c26d626ad5a978bc2d6f49f9e56c1414fd14c7d3651637decb6ebc5e298dfd629b152cd605e6b9893233a362c7d7d6526708c42ef4562b9e0b87cceca7b4a6aaeb05cd1957a53a0b04271c91679e2d622d2f1ebedac020cb0419ca33fb89be98e272a07235be79e19c836fe46d176f90f33d008675388ed0e0499abbdbd3f830cad55788684d72d3bf6d7f71d8fdbd0dae926448b75b6f7926b5cd9b952184d1ef0f323d7b578cf345074c7ce05e180e35768b6d9ecb3674ab05f8e0735d3256946797250ac6353d9497e7c1448b80fdc1f8f47419e530f606fb21573e061c8b6b158627497b8293ca59e87547e83f38f4c75379a0b6b4e25c51efbd5f38c113e6780c955a2ec5405928cc0f24c0ecba0977239938a6b61cdac7ba20b6d737d87f37af08e33b71db6e731b7d9972b0e486335974b516007b506dc68613dafdc439823d24009a60daba94c005512c34ac50991387bbb30580b24d30025cb826835db46373efae23954f6028be37d55ba50203010001a3543052300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414c87ed26a852a1bca1998040727cf50104f68a8a2301006092b06010401823715010403020100300d06092a864886f70d01010c05000382020100af6adde619e72d9443194ecbe9509564a50391028be236803b15a252c21619b66a5a5d744330f49bff607409b1211e90166dc5248f5c668863f44fcc7df2124c40108b019fdaa9c8aef2951bcf9d05eb493e74a0685be5562c651c827e53da56d94617799245c4103608522917cb2fa6f27ed469248a1e8fb0730dcc1c4aabb2aaeda79163016422a832b87e3228b367732d91b4dc31010bf7470aa6f1d74aed5660c42c08a37b40b0bc74275287d6be88dd378a896e67881df5c95da0feb6ab3a80d71a973c173622411eac4dd583e63c38bd4f30e954a9d3b604c3327661bbb018c52b18b3c080d5b795b05e514d22fcec58aae8d894b4a52eed92dee7187c2157dd5563f7bf6dcd1fd2a6772870c7e25b3a5b08d25b4ec80096b3e18336af860a655c74f6eaec7a6a74a0f04beeef94a3ac50f287edd73a3083c9fb7d57bee5e3f841cae564aeb3a3ec58ec859accefb9eaf35618b95c739aafc577178359db371a187254a541d2b62375a3439ae5777c9679b7418dbfecdc80a09fd17775585f3513e0251a670b7dce25fa070ae46121d8d41ce507c63699f496d0c615fe4ecdd7ae8b9ddb16fd04c692bdd488e6a9a3aabbf764383b5fcc0cd035be741903a6c5aa4ca26136823e1df32bbc975ddb4b783b2df53bef6023e8f5ec0b233695af9866bf53d37bb8694a2a966669c494c6f45f6eac98788880065ca2b2eda2	2026-10-10_b821cd6dca45a8c86edb6de13bfe4428_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2\Blob = 6b00000001000000200000005367f20c7ade0e2bca790915056d086b720c33c1fa2a2661acf787e3292e12700f000000010000003000000041ce925678dfe0ccaa8089263c242b897ca582089d14e5eb685fca967f36dbd334e97e81fd0e64815f851f914ade1a1e0b00000001000000800000004d006900630072006f0073006f006600740020004900640065006e007400690074007900200056006500720069006600690063006100740069006f006e00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f0072006900740079002000320030003200300000006200000001000000200000005367f20c7ade0e2bca790915056d086b720c33c1fa2a2661acf787e3292e1270090000000100000016000000301406082b0601050507030306082b06010505070308140000000100000014000000c87ed26a852a1bca1998040727cf50104f68a8a21d0000000100000010000000e78921f81cea4d4105d2b5f4afae0c78030000000100000014000000f40042e2e5f7e8ef8189fed15519aece42c3bfa21900000001000000100000009f687581f7ef744ecfc12b9cee6238f12000000001000000d0050000308205cc308203b4a00302010202105498d2d1d45b1995481379c811c08799300d06092a864886f70d01010c05003077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f726974792032303230301e170d3230303431363138333631365a170d3435303431363138343434305a3077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f72697479203230323030820222300d06092a864886f70d01010105000382020f003082020a0282020100b3912a07830667fd9e9de0c7c0b7a4e642047f0fa6db5ffbd55ad745a0fb770bf080f3a66d5a4d7953d8a08684574520c7a254fbc7a2bf8ac76e35f3a215c42f4ee34a8596490dffbe99d814f6bc2707ee429b2bf50b9206e4fd691365a89172f29884eb833d0ee4d771124821cb0dedf64749b79bf9c9c717b6844fffb8ac9ad773674985e386bd3740d02586d4deb5c26d626ad5a978bc2d6f49f9e56c1414fd14c7d3651637decb6ebc5e298dfd629b152cd605e6b9893233a362c7d7d6526708c42ef4562b9e0b87cceca7b4a6aaeb05cd1957a53a0b04271c91679e2d622d2f1ebedac020cb0419ca33fb89be98e272a07235be79e19c836fe46d176f90f33d008675388ed0e0499abbdbd3f830cad55788684d72d3bf6d7f71d8fdbd0dae926448b75b6f7926b5cd9b952184d1ef0f323d7b578cf345074c7ce05e180e35768b6d9ecb3674ab05f8e0735d3256946797250ac6353d9497e7c1448b80fdc1f8f47419e530f606fb21573e061c8b6b158627497b8293ca59e87547e83f38f4c75379a0b6b4e25c51efbd5f38c113e6780c955a2ec5405928cc0f24c0ecba0977239938a6b61cdac7ba20b6d737d87f37af08e33b71db6e731b7d9972b0e486335974b516007b506dc68613dafdc439823d24009a60daba94c005512c34ac50991387bbb30580b24d30025cb826835db46373efae23954f6028be37d55ba50203010001a3543052300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414c87ed26a852a1bca1998040727cf50104f68a8a2301006092b06010401823715010403020100300d06092a864886f70d01010c05000382020100af6adde619e72d9443194ecbe9509564a50391028be236803b15a252c21619b66a5a5d744330f49bff607409b1211e90166dc5248f5c668863f44fcc7df2124c40108b019fdaa9c8aef2951bcf9d05eb493e74a0685be5562c651c827e53da56d94617799245c4103608522917cb2fa6f27ed469248a1e8fb0730dcc1c4aabb2aaeda79163016422a832b87e3228b367732d91b4dc31010bf7470aa6f1d74aed5660c42c08a37b40b0bc74275287d6be88dd378a896e67881df5c95da0feb6ab3a80d71a973c173622411eac4dd583e63c38bd4f30e954a9d3b604c3327661bbb018c52b18b3c080d5b795b05e514d22fcec58aae8d894b4a52eed92dee7187c2157dd5563f7bf6dcd1fd2a6772870c7e25b3a5b08d25b4ec80096b3e18336af860a655c74f6eaec7a6a74a0f04beeef94a3ac50f287edd73a3083c9fb7d57bee5e3f841cae564aeb3a3ec58ec859accefb9eaf35618b95c739aafc577178359db371a187254a541d2b62375a3439ae5777c9679b7418dbfecdc80a09fd17775585f3513e0251a670b7dce25fa070ae46121d8d41ce507c63699f496d0c615fe4ecdd7ae8b9ddb16fd04c692bdd488e6a9a3aabbf764383b5fcc0cd035be741903a6c5aa4ca26136823e1df32bbc975ddb4b783b2df53bef6023e8f5ec0b233695af9866bf53d37bb8694a2a966669c494c6f45f6eac98788880065ca2b2eda2	2026-10-10_b821cd6dca45a8c86edb6de13bfe4428_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2\Blob = 5c0000000100000004000000001000001900000001000000100000009f687581f7ef744ecfc12b9cee6238f1030000000100000014000000f40042e2e5f7e8ef8189fed15519aece42c3bfa21d0000000100000010000000e78921f81cea4d4105d2b5f4afae0c78140000000100000014000000c87ed26a852a1bca1998040727cf50104f68a8a2090000000100000016000000301406082b0601050507030306082b060105050703086200000001000000200000005367f20c7ade0e2bca790915056d086b720c33c1fa2a2661acf787e3292e12700b00000001000000800000004d006900630072006f0073006f006600740020004900640065006e007400690074007900200056006500720069006600690063006100740069006f006e00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f0072006900740079002000320030003200300000000f000000010000003000000041ce925678dfe0ccaa8089263c242b897ca582089d14e5eb685fca967f36dbd334e97e81fd0e64815f851f914ade1a1e6b00000001000000200000005367f20c7ade0e2bca790915056d086b720c33c1fa2a2661acf787e3292e12702000000001000000d0050000308205cc308203b4a00302010202105498d2d1d45b1995481379c811c08799300d06092a864886f70d01010c05003077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f726974792032303230301e170d3230303431363138333631365a170d3435303431363138343434305a3077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f72697479203230323030820222300d06092a864886f70d01010105000382020f003082020a0282020100b3912a07830667fd9e9de0c7c0b7a4e642047f0fa6db5ffbd55ad745a0fb770bf080f3a66d5a4d7953d8a08684574520c7a254fbc7a2bf8ac76e35f3a215c42f4ee34a8596490dffbe99d814f6bc2707ee429b2bf50b9206e4fd691365a89172f29884eb833d0ee4d771124821cb0dedf64749b79bf9c9c717b6844fffb8ac9ad773674985e386bd3740d02586d4deb5c26d626ad5a978bc2d6f49f9e56c1414fd14c7d3651637decb6ebc5e298dfd629b152cd605e6b9893233a362c7d7d6526708c42ef4562b9e0b87cceca7b4a6aaeb05cd1957a53a0b04271c91679e2d622d2f1ebedac020cb0419ca33fb89be98e272a07235be79e19c836fe46d176f90f33d008675388ed0e0499abbdbd3f830cad55788684d72d3bf6d7f71d8fdbd0dae926448b75b6f7926b5cd9b952184d1ef0f323d7b578cf345074c7ce05e180e35768b6d9ecb3674ab05f8e0735d3256946797250ac6353d9497e7c1448b80fdc1f8f47419e530f606fb21573e061c8b6b158627497b8293ca59e87547e83f38f4c75379a0b6b4e25c51efbd5f38c113e6780c955a2ec5405928cc0f24c0ecba0977239938a6b61cdac7ba20b6d737d87f37af08e33b71db6e731b7d9972b0e486335974b516007b506dc68613dafdc439823d24009a60daba94c005512c34ac50991387bbb30580b24d30025cb826835db46373efae23954f6028be37d55ba50203010001a3543052300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414c87ed26a852a1bca1998040727cf50104f68a8a2301006092b06010401823715010403020100300d06092a864886f70d01010c05000382020100af6adde619e72d9443194ecbe9509564a50391028be236803b15a252c21619b66a5a5d744330f49bff607409b1211e90166dc5248f5c668863f44fcc7df2124c40108b019fdaa9c8aef2951bcf9d05eb493e74a0685be5562c651c827e53da56d94617799245c4103608522917cb2fa6f27ed469248a1e8fb0730dcc1c4aabb2aaeda79163016422a832b87e3228b367732d91b4dc31010bf7470aa6f1d74aed5660c42c08a37b40b0bc74275287d6be88dd378a896e67881df5c95da0feb6ab3a80d71a973c173622411eac4dd583e63c38bd4f30e954a9d3b604c3327661bbb018c52b18b3c080d5b795b05e514d22fcec58aae8d894b4a52eed92dee7187c2157dd5563f7bf6dcd1fd2a6772870c7e25b3a5b08d25b4ec80096b3e18336af860a655c74f6eaec7a6a74a0f04beeef94a3ac50f287edd73a3083c9fb7d57bee5e3f841cae564aeb3a3ec58ec859accefb9eaf35618b95c739aafc577178359db371a187254a541d2b62375a3439ae5777c9679b7418dbfecdc80a09fd17775585f3513e0251a670b7dce25fa070ae46121d8d41ce507c63699f496d0c615fe4ecdd7ae8b9ddb16fd04c692bdd488e6a9a3aabbf764383b5fcc0cd035be741903a6c5aa4ca26136823e1df32bbc975ddb4b783b2df53bef6023e8f5ec0b233695af9866bf53d37bb8694a2a966669c494c6f45f6eac98788880065ca2b2eda2	2026-10-10_b821cd6dca45a8c86edb6de13bfe4428_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2\Blob = 5900000001000000160000005200530041002f0053004800410033003800340000006b00000001000000200000005367f20c7ade0e2bca790915056d086b720c33c1fa2a2661acf787e3292e12700f000000010000003000000041ce925678dfe0ccaa8089263c242b897ca582089d14e5eb685fca967f36dbd334e97e81fd0e64815f851f914ade1a1e0b00000001000000800000004d006900630072006f0073006f006600740020004900640065006e007400690074007900200056006500720069006600690063006100740069006f006e00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f0072006900740079002000320030003200300000006200000001000000200000005367f20c7ade0e2bca790915056d086b720c33c1fa2a2661acf787e3292e1270090000000100000016000000301406082b0601050507030306082b06010505070308140000000100000014000000c87ed26a852a1bca1998040727cf50104f68a8a21d0000000100000010000000e78921f81cea4d4105d2b5f4afae0c78030000000100000014000000f40042e2e5f7e8ef8189fed15519aece42c3bfa21900000001000000100000009f687581f7ef744ecfc12b9cee6238f15c0000000100000004000000001000002000000001000000d0050000308205cc308203b4a00302010202105498d2d1d45b1995481379c811c08799300d06092a864886f70d01010c05003077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f726974792032303230301e170d3230303431363138333631365a170d3435303431363138343434305a3077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f72697479203230323030820222300d06092a864886f70d01010105000382020f003082020a0282020100b3912a07830667fd9e9de0c7c0b7a4e642047f0fa6db5ffbd55ad745a0fb770bf080f3a66d5a4d7953d8a08684574520c7a254fbc7a2bf8ac76e35f3a215c42f4ee34a8596490dffbe99d814f6bc2707ee429b2bf50b9206e4fd691365a89172f29884eb833d0ee4d771124821cb0dedf64749b79bf9c9c717b6844fffb8ac9ad773674985e386bd3740d02586d4deb5c26d626ad5a978bc2d6f49f9e56c1414fd14c7d3651637decb6ebc5e298dfd629b152cd605e6b9893233a362c7d7d6526708c42ef4562b9e0b87cceca7b4a6aaeb05cd1957a53a0b04271c91679e2d622d2f1ebedac020cb0419ca33fb89be98e272a07235be79e19c836fe46d176f90f33d008675388ed0e0499abbdbd3f830cad55788684d72d3bf6d7f71d8fdbd0dae926448b75b6f7926b5cd9b952184d1ef0f323d7b578cf345074c7ce05e180e35768b6d9ecb3674ab05f8e0735d3256946797250ac6353d9497e7c1448b80fdc1f8f47419e530f606fb21573e061c8b6b158627497b8293ca59e87547e83f38f4c75379a0b6b4e25c51efbd5f38c113e6780c955a2ec5405928cc0f24c0ecba0977239938a6b61cdac7ba20b6d737d87f37af08e33b71db6e731b7d9972b0e486335974b516007b506dc68613dafdc439823d24009a60daba94c005512c34ac50991387bbb30580b24d30025cb826835db46373efae23954f6028be37d55ba50203010001a3543052300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414c87ed26a852a1bca1998040727cf50104f68a8a2301006092b06010401823715010403020100300d06092a864886f70d01010c05000382020100af6adde619e72d9443194ecbe9509564a50391028be236803b15a252c21619b66a5a5d744330f49bff607409b1211e90166dc5248f5c668863f44fcc7df2124c40108b019fdaa9c8aef2951bcf9d05eb493e74a0685be5562c651c827e53da56d94617799245c4103608522917cb2fa6f27ed469248a1e8fb0730dcc1c4aabb2aaeda79163016422a832b87e3228b367732d91b4dc31010bf7470aa6f1d74aed5660c42c08a37b40b0bc74275287d6be88dd378a896e67881df5c95da0feb6ab3a80d71a973c173622411eac4dd583e63c38bd4f30e954a9d3b604c3327661bbb018c52b18b3c080d5b795b05e514d22fcec58aae8d894b4a52eed92dee7187c2157dd5563f7bf6dcd1fd2a6772870c7e25b3a5b08d25b4ec80096b3e18336af860a655c74f6eaec7a6a74a0f04beeef94a3ac50f287edd73a3083c9fb7d57bee5e3f841cae564aeb3a3ec58ec859accefb9eaf35618b95c739aafc577178359db371a187254a541d2b62375a3439ae5777c9679b7418dbfecdc80a09fd17775585f3513e0251a670b7dce25fa070ae46121d8d41ce507c63699f496d0c615fe4ecdd7ae8b9ddb16fd04c692bdd488e6a9a3aabbf764383b5fcc0cd035be741903a6c5aa4ca26136823e1df32bbc975ddb4b783b2df53bef6023e8f5ec0b233695af9866bf53d37bb8694a2a966669c494c6f45f6eac98788880065ca2b2eda2	2026-10-10_b821cd6dca45a8c86edb6de13bfe4428_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2	2026-10-10_b821cd6dca45a8c86edb6de13bfe4428_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\C3197C3924E654AF1BC4AB20957AE2C30E13026A	License.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\C3197C3924E654AF1BC4AB20957AE2C30E13026A\Blob = 0f00000001000000200000000cf408e20830ac839f2a12143ce4b3e53ac6a27b2338a504f200fa3a154c4fd80b0000000100000052000000530053004c002e0063006f006d00200052006f006f0074002000430065007200740069006600690063006100740069006f006e00200041007500740068006f0072006900740079002000450043004300000009000000010000004c000000304a06082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003417bb06cc6007da1b961c920b8ab4ce3fad820e4aa30b9acbc4a74ebdcebc6514000000010000001400000082d1857330e73504d38e0292fbe5a4d1c421e8cd1d0000000100000010000000aa0f958845d6cf47c0442d3960f923a4030000000100000014000000c3197c3924e654af1bc4ab20957ae2c30e13026a2000000001000000910200003082028d30820214a003020102020875e6dfcbc1685ba8300a06082a8648ce3d040302307c310b3009060355040613025553310e300c06035504080c0554657861733110300e06035504070c07486f7573746f6e31183016060355040a0c0f53534c20436f72706f726174696f6e3131302f06035504030c2853534c2e636f6d20526f6f742043657274696669636174696f6e20417574686f7269747920454343301e170d3136303231323138313430335a170d3431303231323138313430335a307c310b3009060355040613025553310e300c06035504080c0554657861733110300e06035504070c07486f7573746f6e31183016060355040a0c0f53534c20436f72706f726174696f6e3131302f06035504030c2853534c2e636f6d20526f6f742043657274696669636174696f6e20417574686f72697479204543433076301006072a8648ce3d020106052b8104002203620004456ea950c4a623369e5f288d17cb9622643fdc7a8e1dcc08b3a27124ba8e49b9041b479658ab2d95c8ed9e0835c827eb898c5358eb628afef05b0f6b315263413b89cdececb68d19d33407dcbbc6067fc24595eccb7fa823e009e981faf347d3a3633061301d0603551d0e0416041482d1857330e73504d38e0292fbe5a4d1c421e8cd300f0603551d130101ff040530030101ff301f0603551d2304183016801482d1857330e73504d38e0292fbe5a4d1c421e8cd300e0603551d0f0101ff040403020186300a06082a8648ce3d040302036700306402306fe7eb5911a460cf61b0967bed05f92f1391dcede5fc506b114646b31c210062bbbec3e7e8cd0799f90d0b5d723ec4aa02301fbcba0be23024fb7c6d80550a993e800d33e566a3b3a3bba5d58b8f092ca65d7ee2f00708686dd27c696e5fdfe56a65	License.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\C3197C3924E654AF1BC4AB20957AE2C30E13026A\Blob = 19000000010000001000000011a2b3490cb6c379a89e76c3569452d7030000000100000014000000c3197c3924e654af1bc4ab20957ae2c30e13026a1d0000000100000010000000aa0f958845d6cf47c0442d3960f923a414000000010000001400000082d1857330e73504d38e0292fbe5a4d1c421e8cd6200000001000000200000003417bb06cc6007da1b961c920b8ab4ce3fad820e4aa30b9acbc4a74ebdcebc6509000000010000004c000000304a06082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030106082b060105050703080b0000000100000052000000530053004c002e0063006f006d00200052006f006f0074002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900200045004300430000000f00000001000000200000000cf408e20830ac839f2a12143ce4b3e53ac6a27b2338a504f200fa3a154c4fd82000000001000000910200003082028d30820214a003020102020875e6dfcbc1685ba8300a06082a8648ce3d040302307c310b3009060355040613025553310e300c06035504080c0554657861733110300e06035504070c07486f7573746f6e31183016060355040a0c0f53534c20436f72706f726174696f6e3131302f06035504030c2853534c2e636f6d20526f6f742043657274696669636174696f6e20417574686f7269747920454343301e170d3136303231323138313430335a170d3431303231323138313430335a307c310b3009060355040613025553310e300c06035504080c0554657861733110300e06035504070c07486f7573746f6e31183016060355040a0c0f53534c20436f72706f726174696f6e3131302f06035504030c2853534c2e636f6d20526f6f742043657274696669636174696f6e20417574686f72697479204543433076301006072a8648ce3d020106052b8104002203620004456ea950c4a623369e5f288d17cb9622643fdc7a8e1dcc08b3a27124ba8e49b9041b479658ab2d95c8ed9e0835c827eb898c5358eb628afef05b0f6b315263413b89cdececb68d19d33407dcbbc6067fc24595eccb7fa823e009e981faf347d3a3633061301d0603551d0e0416041482d1857330e73504d38e0292fbe5a4d1c421e8cd300f0603551d130101ff040530030101ff301f0603551d2304183016801482d1857330e73504d38e0292fbe5a4d1c421e8cd300e0603551d0f0101ff040403020186300a06082a8648ce3d040302036700306402306fe7eb5911a460cf61b0967bed05f92f1391dcede5fc506b114646b31c210062bbbec3e7e8cd0799f90d0b5d723ec4aa02301fbcba0be23024fb7c6d80550a993e800d33e566a3b3a3bba5d58b8f092ca65d7ee2f00708686dd27c696e5fdfe56a65	License.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2	2026-10-10_b821cd6dca45a8c86edb6de13bfe4428_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2920	msiexec.exe
2920	msiexec.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3620	SofType.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeSecurityPrivilege	2920	msiexec.exe
Token: SeCreateTokenPrivilege	4228	2026-10-10_b821cd6dca45a8c86edb6de13bfe4428_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
Token: SeAssignPrimaryTokenPrivilege	4228	2026-10-10_b821cd6dca45a8c86edb6de13bfe4428_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
Token: SeLockMemoryPrivilege	4228	2026-10-10_b821cd6dca45a8c86edb6de13bfe4428_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
Token: SeIncreaseQuotaPrivilege	4228	2026-10-10_b821cd6dca45a8c86edb6de13bfe4428_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
Token: SeMachineAccountPrivilege	4228	2026-10-10_b821cd6dca45a8c86edb6de13bfe4428_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
Token: SeTcbPrivilege	4228	2026-10-10_b821cd6dca45a8c86edb6de13bfe4428_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
Token: SeSecurityPrivilege	4228	2026-10-10_b821cd6dca45a8c86edb6de13bfe4428_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
Token: SeTakeOwnershipPrivilege	4228	2026-10-10_b821cd6dca45a8c86edb6de13bfe4428_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
Token: SeLoadDriverPrivilege	4228	2026-10-10_b821cd6dca45a8c86edb6de13bfe4428_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
Token: SeSystemProfilePrivilege	4228	2026-10-10_b821cd6dca45a8c86edb6de13bfe4428_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
Token: SeSystemtimePrivilege	4228	2026-10-10_b821cd6dca45a8c86edb6de13bfe4428_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
Token: SeProfSingleProcessPrivilege	4228	2026-10-10_b821cd6dca45a8c86edb6de13bfe4428_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
Token: SeIncBasePriorityPrivilege	4228	2026-10-10_b821cd6dca45a8c86edb6de13bfe4428_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
Token: SeCreatePagefilePrivilege	4228	2026-10-10_b821cd6dca45a8c86edb6de13bfe4428_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
Token: SeCreatePermanentPrivilege	4228	2026-10-10_b821cd6dca45a8c86edb6de13bfe4428_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
Token: SeBackupPrivilege	4228	2026-10-10_b821cd6dca45a8c86edb6de13bfe4428_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
Token: SeRestorePrivilege	4228	2026-10-10_b821cd6dca45a8c86edb6de13bfe4428_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
Token: SeShutdownPrivilege	4228	2026-10-10_b821cd6dca45a8c86edb6de13bfe4428_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
Token: SeDebugPrivilege	4228	2026-10-10_b821cd6dca45a8c86edb6de13bfe4428_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
Token: SeAuditPrivilege	4228	2026-10-10_b821cd6dca45a8c86edb6de13bfe4428_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
Token: SeSystemEnvironmentPrivilege	4228	2026-10-10_b821cd6dca45a8c86edb6de13bfe4428_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
Token: SeChangeNotifyPrivilege	4228	2026-10-10_b821cd6dca45a8c86edb6de13bfe4428_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
Token: SeRemoteShutdownPrivilege	4228	2026-10-10_b821cd6dca45a8c86edb6de13bfe4428_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
Token: SeUndockPrivilege	4228	2026-10-10_b821cd6dca45a8c86edb6de13bfe4428_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
Token: SeSyncAgentPrivilege	4228	2026-10-10_b821cd6dca45a8c86edb6de13bfe4428_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
Token: SeEnableDelegationPrivilege	4228	2026-10-10_b821cd6dca45a8c86edb6de13bfe4428_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
Token: SeManageVolumePrivilege	4228	2026-10-10_b821cd6dca45a8c86edb6de13bfe4428_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
Token: SeImpersonatePrivilege	4228	2026-10-10_b821cd6dca45a8c86edb6de13bfe4428_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
Token: SeCreateGlobalPrivilege	4228	2026-10-10_b821cd6dca45a8c86edb6de13bfe4428_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
Token: SeCreateTokenPrivilege	4228	2026-10-10_b821cd6dca45a8c86edb6de13bfe4428_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
Token: SeAssignPrimaryTokenPrivilege	4228	2026-10-10_b821cd6dca45a8c86edb6de13bfe4428_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
Token: SeLockMemoryPrivilege	4228	2026-10-10_b821cd6dca45a8c86edb6de13bfe4428_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
Token: SeIncreaseQuotaPrivilege	4228	2026-10-10_b821cd6dca45a8c86edb6de13bfe4428_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
Token: SeMachineAccountPrivilege	4228	2026-10-10_b821cd6dca45a8c86edb6de13bfe4428_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
Token: SeTcbPrivilege	4228	2026-10-10_b821cd6dca45a8c86edb6de13bfe4428_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
Token: SeSecurityPrivilege	4228	2026-10-10_b821cd6dca45a8c86edb6de13bfe4428_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
Token: SeTakeOwnershipPrivilege	4228	2026-10-10_b821cd6dca45a8c86edb6de13bfe4428_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
Token: SeLoadDriverPrivilege	4228	2026-10-10_b821cd6dca45a8c86edb6de13bfe4428_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
Token: SeSystemProfilePrivilege	4228	2026-10-10_b821cd6dca45a8c86edb6de13bfe4428_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
Token: SeSystemtimePrivilege	4228	2026-10-10_b821cd6dca45a8c86edb6de13bfe4428_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
Token: SeProfSingleProcessPrivilege	4228	2026-10-10_b821cd6dca45a8c86edb6de13bfe4428_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
Token: SeIncBasePriorityPrivilege	4228	2026-10-10_b821cd6dca45a8c86edb6de13bfe4428_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
Token: SeCreatePagefilePrivilege	4228	2026-10-10_b821cd6dca45a8c86edb6de13bfe4428_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
Token: SeCreatePermanentPrivilege	4228	2026-10-10_b821cd6dca45a8c86edb6de13bfe4428_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
Token: SeBackupPrivilege	4228	2026-10-10_b821cd6dca45a8c86edb6de13bfe4428_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
Token: SeRestorePrivilege	4228	2026-10-10_b821cd6dca45a8c86edb6de13bfe4428_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
Token: SeShutdownPrivilege	4228	2026-10-10_b821cd6dca45a8c86edb6de13bfe4428_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
Token: SeDebugPrivilege	4228	2026-10-10_b821cd6dca45a8c86edb6de13bfe4428_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
Token: SeAuditPrivilege	4228	2026-10-10_b821cd6dca45a8c86edb6de13bfe4428_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
Token: SeSystemEnvironmentPrivilege	4228	2026-10-10_b821cd6dca45a8c86edb6de13bfe4428_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
Token: SeChangeNotifyPrivilege	4228	2026-10-10_b821cd6dca45a8c86edb6de13bfe4428_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
Token: SeRemoteShutdownPrivilege	4228	2026-10-10_b821cd6dca45a8c86edb6de13bfe4428_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
Token: SeUndockPrivilege	4228	2026-10-10_b821cd6dca45a8c86edb6de13bfe4428_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
Token: SeSyncAgentPrivilege	4228	2026-10-10_b821cd6dca45a8c86edb6de13bfe4428_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
Token: SeEnableDelegationPrivilege	4228	2026-10-10_b821cd6dca45a8c86edb6de13bfe4428_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
Token: SeManageVolumePrivilege	4228	2026-10-10_b821cd6dca45a8c86edb6de13bfe4428_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
Token: SeImpersonatePrivilege	4228	2026-10-10_b821cd6dca45a8c86edb6de13bfe4428_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
Token: SeCreateGlobalPrivilege	4228	2026-10-10_b821cd6dca45a8c86edb6de13bfe4428_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
Token: SeCreateTokenPrivilege	4228	2026-10-10_b821cd6dca45a8c86edb6de13bfe4428_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
Token: SeAssignPrimaryTokenPrivilege	4228	2026-10-10_b821cd6dca45a8c86edb6de13bfe4428_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
Token: SeLockMemoryPrivilege	4228	2026-10-10_b821cd6dca45a8c86edb6de13bfe4428_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
Token: SeIncreaseQuotaPrivilege	4228	2026-10-10_b821cd6dca45a8c86edb6de13bfe4428_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
Token: SeMachineAccountPrivilege	4228	2026-10-10_b821cd6dca45a8c86edb6de13bfe4428_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
4228	2026-10-10_b821cd6dca45a8c86edb6de13bfe4428_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
4228	2026-10-10_b821cd6dca45a8c86edb6de13bfe4428_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
5508	OICLauncher.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
5508	OICLauncher.exe

Suspicious use of SetWindowsHookEx 13 IoCs

pid	Process
2920	msiexec.exe
1752	MsiExec.exe
5536	MsiExec.exe
236	MsiExec.exe
5508	OICLauncher.exe
3620	SofType.exe
3620	SofType.exe
3620	SofType.exe
3448	License.exe
3620	SofType.exe
3620	SofType.exe
3620	SofType.exe
3620	SofType.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2920 wrote to memory of 1752	2920	msiexec.exe	89
PID 4228 wrote to memory of 1724	4228	2026-10-10_b821cd6dca45a8c86edb6de13bfe4428_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe	90
PID 2920 wrote to memory of 1748	2920	msiexec.exe	96
PID 2920 wrote to memory of 5536	2920	msiexec.exe	98
PID 2920 wrote to memory of 3228	2920	msiexec.exe	99
PID 2920 wrote to memory of 5556	2920	msiexec.exe	100
PID 2920 wrote to memory of 236	2920	msiexec.exe	101
PID 3496 wrote to memory of 3620	3496	utilman.exe	107
PID 3620 wrote to memory of 3448	3620	SofType.exe	108

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-10-10_b821cd6dca45a8c86edb6de13bfe4428_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-10_b821cd6dca45a8c86edb6de13bfe4428_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe"
1⤵
- Enumerates connected drives
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4228
- C:\Users\Admin\AppData\Local\Temp\2026-10-10_b821cd6dca45a8c86edb6de13bfe4428_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-10_b821cd6dca45a8c86edb6de13bfe4428_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe" /i "C:\Users\Admin\AppData\Roaming\Origin Instruments, Corp\SofType 5.0.1105.0\install\A454EB3\SofTypeSetup.msi" /L*V "C:\Users\Admin\AppData\Roaming\Origin Instruments, Corp\SofType 5.0.1105.0\install\st.log" AI_EUIMSI=1 SHORTCUTDIR="C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SofType" APPDIR="C:\Program Files (x86)\Origin Instruments, Corp\SofType" SECONDSEQUENCE="1" CLIENTPROCESSID="4228" AI_MORE_CMD_LINE=1
  2⤵
  - Enumerates connected drives
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Modifies system certificate store
  PID:1724

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2920
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 62F49CDAC0E8B97EF582D33EB01D5DAF C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1752
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:1748
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 9BA09D4C622057B64F23522B7242904E
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:5536
- C:\Windows\Installer\MSI66FF.tmp
  "C:\Windows\Installer\MSI66FF.tmp" SofTyperClass
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3228
- C:\Windows\Installer\MSI678C.tmp
  "C:\Windows\Installer\MSI678C.tmp" OICLauncherClass
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5556
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 7FC11E50BB4729FB8503653D2CCCB9A9 E Global\MSI0000
  2⤵
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:236

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:5224

C:\Program Files (x86)\Origin Instruments, Corp\Launcher\OICLauncher.exe
"C:\Program Files (x86)\Origin Instruments, Corp\Launcher\OICLauncher.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:5508
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5508 -s 764
  2⤵
  - Program crash
  PID:3196

C:\Program Files (x86)\Origin Instruments, Corp\Launcher\OICLauncher.exe
"C:\Program Files (x86)\Origin Instruments, Corp\Launcher\OICLauncher.exe" stlaunch
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1524

C:\Windows\system32\utilman.exe
utilman.exe /debug
1⤵
- Suspicious use of WriteProcessMemory
PID:3496
- C:\Program Files (x86)\Origin Instruments, Corp\SofType\SofType.exe
  "C:\Program Files (x86)\Origin Instruments, Corp\SofType\SofType.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3620
- - C:\Program Files (x86)\Origin Instruments, Corp\SofType\License.exe
    "C:\Program Files (x86)\Origin Instruments, Corp\SofType\License.exe" softype isactive
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Modifies system certificate store
    - Suspicious use of SetWindowsHookEx
    PID:3448

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004E8 0x00000000000004EC
1⤵
PID:2456

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 5508 -ip 5508
1⤵
PID:2572

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Component Object Model Hijacking

T1546.015

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e5a5b42.rbs

Path C:\Config.Msi\e5a5b42.rbs
Size 8.3MB
SHA256 6377709892e363e8ee2c657c8f0bf59b1ace552d519cb5001dc0df7034356297
MD5 e1e27d5a53fe8542231354a907553756
SHA1 c2c2953399bfc4cb5df39a595722d4f3a7474055
SHA512 f74562871b8a698f8566e5f4a2a95dbd6a84e043a1b5916c9112c4d4ea620b09cb43e21bfadf2f6343f454912fd8466527711b40eca95c245d2a546d4d3e9aa8
SSDEEP 98304:I+ZY+P+C+S+u+2+hHX3izTD5AHX3izTD5I:IiYa5xXNoHXSvtAHXSvtI
TLSH
T16B968D60358BC036F76E01B02A7ECFFA912D6E710B7058EBA3D46D6A6A344C15735B1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5a5b44.rbs

Path C:\Config.Msi\e5a5b44.rbs
Size 520B
SHA256 35a5151a1df0042e0a02173e71cc8451635639ad037c547f32b848c4fd1972d2
MD5 e969367f03e984ef724309ec2f4fa92a
SHA1 f9ac5a6f799fcb4a1122576ae05e60b6a5f51e2c
SHA512 a8676e090f41e94b679bb82e3e4a336af9fa52d4703963611d34806e3dad74f49ba2f11c0032c3a176c828d7245b1bee8deabb8e249a32f81f9c557ded0336dc
TLSH
T194F0DC87E7024FE4E34F8337765242801A3B0030831096D5EC0D11687D99158DFBE2E4
MD5 SHA1 SHA512 TLSH

Submit Download

Default.kys

Path C:\Program Files (x86)\Origin Instruments, Corp\SofType\STdata\Default.kys
Size 2KB
SHA256 d04b454bd18722dcf670d112d4f3cbead994db870e48bddfe58bc177507e63e0
MD5 2210f2ac60e815710d0890b359c08ee3
SHA1 dd153aa30253e4eea4a8a69f899387542b8a255b
SHA512 16d6cf144a6d8914602c467a0af1da50cb6d0f3abbd007314ea8f0d32a57d34e9d8189c462bdbc636596591d9cf00df9c75ad37659471bde674afc1d1d5e995e
TLSH
T18241F0774F9402A794B497D3E12EE61662FAC3063A168280B7664C06FC3C1E3A137160
MD5 SHA1 SHA512 TLSH

Submit Download

SofType.ini

Path C:\ProgramData\OIC\SofType.ini
Size 186B
SHA256 9b84db475227585d4a81eff16ddc6dedad2c97657baf4b2308a493e4a0c0f38a
MD5 585309e805d26d8c40c9248ae6276fd2
SHA1 e49c141224d8f5ebd75d6fe815a49ccfa9b02dbc
SHA512 45cdc28c5eee16767f518035622f3cffe910065498f8a26964c6cb91c9e3994403c4cebf95a0decd5f28ae91483219fd4dc70a862e3845fc1d7349c17895a437
TLSH
T1F7C0C0B317BCC38FC9391840786803913AC0CD4484031100315E2620FE8C0B3F31C2A3
MD5 SHA1 SHA512 TLSH

Submit Download

SofType.ini

Path C:\ProgramData\OIC\SofType.ini
Size 220B
SHA256 6154614efc29aac525041bb63382ea1f3c4b42a7323089305910c9b17b38750d
MD5 502e6165929ab7b795393284c1ef3148
SHA1 5e08e5b134c8cc66b3ea41e50208fefb1536ac8a
SHA512 c8ce100fd6d81c73d549531c2a3e019a0aecb1eca0309454e8672884d51e789dbf1eff817a24834c9f7d4ac4240bb0bddcf4f549c21c5a265277107def5980fb
TLSH
T144D02373A7BCC34F8D280440285C035136C08C0048431901315E1521FECC473F318393
MD5 SHA1 SHA512 TLSH

Submit Download

SofType.ini

Path C:\ProgramData\OIC\SofType.ini
Size 327B
SHA256 1a576cd4738cb376c8bb8934cd1d63b126bbac6ec767ab8047233dc2ad633b89
MD5 6782a84930d3c3add53b30d360fd25e5
SHA1 9dc2e73469e86c674e515918dbe5798f6d9d726b
SHA512 130210a4b89bdd9b3064db9d4238d6d832e28e2831b0513222b13cd9dbea25abb8561b8895a402d8193d74faf25bbbc13a09fd60bb1bf2b5f9a250c8ef41635f
TLSH
T1F3E07D73F269821F54940490185C02152EC04544484335D4155F9D61FDCC871A67B75A
MD5 SHA1 SHA512 TLSH

Submit Download

SofType.ini

Path C:\ProgramData\OIC\SofType.ini
Size 843B
SHA256 17d7cf5fda4aa5901cad6281c337be6f79933b8ea5586545cf10c4bb6a99e814
MD5 a3eb4783688ae5cddbdd195e0c391b60
SHA1 9ffac2662b457d2a8a8c5ffa1ea8398fa2d1a969
SHA512 18ca6c7c77ec837b7055ca8f82261dd80551d083f5c03242762b56b2d0f26f9a9442f05a7bfcb707fbc5003def6d0a43202f9e12c0551a5aca9bf1a2dc2bd077
TLSH
T1B201FDA773AA621F0CAE21F8143A360A1BC249C020715EE462CB4C51FECCD6573772A3
MD5 SHA1 SHA512 TLSH

Submit Download

SofType.ini

Path C:\ProgramData\OIC\SofType.ini
Size 892B
SHA256 4d94496b0be369d3b1cf74e932f187c728a2f29b191b8c22f21037f711a8baab
MD5 369b62aaecd5dc2b03212fd66cdfda1d
SHA1 4e4e12b82545424997ce7b6daa5cfeb31ad943c3
SHA512 5b8775b50d25da687637df4bde22b447ac939c3222a60d8b888d2c5d5a1565051b0cb26df986e260dcd83d464fc8d2d5105df5f27742625e77651b17e8268a11
TLSH
T19F11C2A77369621F0CAE21B91439360A1BC245C024716AD461DB4C55FDCCD6673772A3
MD5 SHA1 SHA512 TLSH

Submit Download

515195B826B230146D00BC66A056A7F8

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\515195B826B230146D00BC66A056A7F8
Size 20KB
SHA256 b7b6ae54511d0195e5da37158686ec9bfe9c28dd985e51c1a637a40ec9e22dad
MD5 df77560d8ba05e1f20c6ad605e170023
SHA1 05f511d89640a89a26fefe2731be94d84a648434
SHA512 fddc96f7ebede15474210520b36befdf73fefe81905d53c030107c80b1597b7fb586e4b50c4c52870b03ce596f20371f1348579d4167f1374dd2b4d0059a461b
SSDEEP 384:IqdD5rtYHH8vZprwyVR5hLiS3QCwX0WJwd1vQ:vdTFBp/VtiS3QrX0Wid14
TLSH
T19392E8FC6A1CA69750C5AA31CACB9FD3D8F651A53BD2E11F05B55E880424EC3CE97382
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

77003E887FC21E505B9E28CBA30E18ED_8ACE642DC0A43382FABA7AE806561A50

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77003E887FC21E505B9E28CBA30E18ED_8ACE642DC0A43382FABA7AE806561A50
Size 2KB
SHA256 5732ffd807c4df869fabd7fdc37b72b447643ae6aa394a2e15e0d7b433ac5fff
MD5 6ef3d970d7314a014af7c32b1fa1fc5d
SHA1 c72295f9e0de82be9f9c7be342f06cc71d5821fd
SHA512 c6fd319dacfba3a73a3ad9f3731d411a8e9a5030d32a1abee714f0262128cd842e0df66efd5ec24f6c79a2f2e1641bb9324821c8b11808ed51b1b5afeeb544d1
TLSH
T1B0411A47882D6043EF9ABAE1EBD9D87838F4CF631D162566366693404C2F3A1F74C14C
MD5 SHA1 SHA512 TLSH

Submit Download

EF7234CDBB1649702229F955C785C39F

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EF7234CDBB1649702229F955C785C39F
Size 785B
SHA256 9e153cc9331fb887cacd6f08cfa3dc5aac7b9b26b4b9cfa75d2ac57288e9142a
MD5 13c624bbd9ad9ff627a68b5ced19b228
SHA1 ff158247f5c6bf41d5fed9f3d756b82f735a24f6
SHA512 62251f6fd12706cc3b90b738523a3a32c34b104ed967b0f42da80596fe0a3b03a27dbbbab144afff619c4a910558b2f8f6f6f223f4cc65bb288f7516bfdb7068
TLSH
T14A017561A8BCF3844DA11BD603F4ADA559B407F6294CB2672437A1560562B53EF28129
MD5 SHA1 SHA512 TLSH

Submit Download

515195B826B230146D00BC66A056A7F8

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\515195B826B230146D00BC66A056A7F8
Size 290B
SHA256 4801597a486c3e11c5115484ae70271bfa0ce4d87c3501a0fb6313f4a472e345
MD5 5853da6729db8f174e34c8e1089c1df6
SHA1 1472c12b0e8074035696be797075e969720c6d5a
SHA512 8a5434204b3258b28bd1e204b831ff91391d35d8ea1e7da650281a479c48c036960a632a0a959c8cae8b6af68fd83da865ff02165cf07baceffd9db7d92ffddb
TLSH
T1C7D05E2CA3F50611E080853FA9D429A7F9767C2A8501C3541BF083087468E05ADB1B13
MD5 SHA1 SHA512 TLSH

Submit Download

77003E887FC21E505B9E28CBA30E18ED_8ACE642DC0A43382FABA7AE806561A50

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77003E887FC21E505B9E28CBA30E18ED_8ACE642DC0A43382FABA7AE806561A50
Size 422B
SHA256 540a3e3b2a3947850ae6467b3313654b2b5830752f1be8362f8e4237255ef2d3
MD5 f79705bca024d955a20c1ef2b9286405
SHA1 1c959f03ce08196d9394a20d385fbc43181eca39
SHA512 b54f046d0a28d25fcdff4de07c463346e4a9b148d607b766e7fba524b78ddf9671db8a9c1a66ccfbe1a9296b74c84453faaaa0f52f3e2176b52759b26f0089a6
TLSH
T1A9E0611024FFC51AD7727C3A4BC5B53F493FF713080C5665B2540065941FD018E31722
MD5 SHA1 SHA512 TLSH

Submit Download

EF7234CDBB1649702229F955C785C39F

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EF7234CDBB1649702229F955C785C39F
Size 308B
SHA256 70a483d7b0e613dd294a9d889f87950f404082dfdb37efc7d7d84aab43943b68
MD5 ed95b2f8b2a777705db5804f72574b7f
SHA1 c8dcf809d164edd74de73d46ae4afd6a7cdabca7
SHA512 f3ce9dfa8fb66fe3e63f741448a93c38f26a4c6be93380bd1882b92bb9398fa332ef19dd274bf7521b4058ac1f46ec97f3d377fc01436defc634aaa117b7b8c2
TLSH
T122E0174CA3F90A26F4E0C93E25E42413BA35AE548A0483490FF08719787C981B920713
MD5 SHA1 SHA512 TLSH

Submit Download

oic_banner.png

Path C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_4228\oic_banner.png
Size 2KB
SHA256 b23dd8ac44e0fdc428a6bfbfb96f6fec82b1b4ceafc22d70198bc86fed16c917
MD5 d713ecf017da9cf88a3e868c9988e48a
SHA1 192198348ffcda24fb9006c43ef322f19222fd43
SHA512 6da5081c015494260db7b0c35600f38e9ab133f7fb068f3b8a8fe4bac1a805ae343d38c55254445a71d9c33f8932c38e375f49ab6aa988907d4b643790b50586
TLSH
T1A2512B17D4DBF426247AFCE4316DB971543B616DC4D0B1C50027AAEAEC1468BCAD0B60
MD5 SHA1 SHA512 TLSH

Submit Download

oic_dialog.png

Path C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_4228\oic_dialog.png
Size 7KB
SHA256 6158334daa5ad10a416209deaee0cebb42ba8e0aa114c82a2cade9945a43d2cc
MD5 16b8c0ad7921802c697d41e4a7ebc988
SHA1 71aa5e4defbfd3ea03212dd9be9b0189e0bf5f08
SHA512 3447ec68ce9fc8b70835640694e0f0d025410207a010346eac370915b31d1ab617533a624dc1d6b92b121dc258e92ad3bf46393177f8049213bcf4ed7e6f4630
SSDEEP 96:fl4qZ1stl/GcC0sN0xEdwOyx0d8/H5TeQYyLJZwsN3Z7/z1mX437NY/3pppppppT:94U1stl/Gj0sN0xabyx0CJ9HwSzpXe9
TLSH
T158E1B39F62967FDC530D3E0BAAB3D913A35234C3097B8C488827F64D0519D6BC850C55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AiFilesRemoveImpers_24B92538_FF27_4FB0_97F0_96325A454EB3.bak

Path C:\Users\Admin\AppData\Local\Temp\AiFilesRemoveImpers_24B92538_FF27_4FB0_97F0_96325A454EB3.bak
Size 131B
SHA256 2021cf5d6f16ac1a8653f07b1c95f4db4a6123c33d7e99f6155f6936d9cacfbd
MD5 cf79acf33434eaed59bc84db1a298d09
SHA1 9a63513084ede3ac8e330ddb6a10b61fa0f452df
SHA512 37687041bc7f5f2cf601656969aac43174c0ecb454d8da0d67b00c2bbf35e46ab737edcf122f49dcceb3a07b1d2bc40b9207181f84abb53159fb00b5bfc3d7e2
MD5 SHA1 SHA512

Submit Download

MSIC877.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSIC877.tmp
Size 1.2MB
SHA256 1a2aea05933297955968db3f9d2cf4f6400cbc5129d8e1de40a02c4925bff931
MD5 8c1f15cbc9747626a9715861b52a986c
SHA1 c1af1bd268e493a36b549728af0aea23ce2c2827
SHA512 9121056cd373b756c285597a6a6d2fd6be886ded4e639686c8b7313fde270de8c9e13a96917c6a22137a0ff1f84805b3b2a5651e24ab41e8273bb8a2de8f2df2
SSDEEP 24576:bCtnkxCgnoz0yv6vRhW0/HZB/QVFxh0lhSMXlFvdS2Lug4h1GQu1:bSnkxFozxoX/HZB/uFYBdSwug4h1GQu1
TLSH
T153457C303A9FC037EB6E16B06A3DC65AD12EBA750BB144C763D46E9A65304C25736F23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSICBE5.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSICBE5.tmp
Size 1.0MB
SHA256 54a340f49f84fef69fccaf3edee266ba524fefd21e1963e69643cd662691176a
MD5 52d22224b09742fa17828a3a56d5b5fc
SHA1 ad0e3c33daaca21cb354156fa7a2348f64aa1c37
SHA512 808cbade6260a0adc3d1f6713c513f38bf6d4eb49d61bd02ceb5fc03a90a14d050d6d1b578d22478753b02d23c4fef3f7c21ad4c2d568f80761f5468172392d7
SSDEEP 24576:pvMLQO9kvJm/R06nxxzuOELncN2x2Qh0lhSMXlAhSVXPYAIoERY4Lq:tMo6nxRbEbcN2YloSVXPYAIo8Y4Lq
TLSH
T116357D20798AC035E52E01F12A7DDBABD57DBDB10BB294D763D0BD6A18704C2523AF27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSID3DE.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSID3DE.tmp
Size 334KB
SHA256 92aec5c747cc07b22c501e1f9c7bf8a9feb2e4a19715b8db76a2540ea4c001ed
MD5 dd07821ffb2a9cd37f36607048ce864d
SHA1 383ad9a87ed1ce09955cc7c11c35c8751563d1e8
SHA512 7da09119cdf0ad26243e06357e8082462cfb95dba34e3d921809537202f5a59b291e73496de21e34db52092282079deb6f7c9350df88804675b8335e55b3721c
SSDEEP 6144:ZcKc3ieced7Fklz96lOVVph0lhSMXlBXBW/jGF:yKStTMl/Vph0lhSMXle8
TLSH
T11374B020A946C033D65E09707D7DCFEB9A3D6EB14BA164CB73DC1DA95D702C1A738A0A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OICres.dll

Path C:\Users\Admin\AppData\Roaming\Origin Instruments, Corp\SofType 5.0.1105.0\install\A454EB3\CommonAppDataFolder\OIC\OICres.dll
Size 5KB
SHA256 2d29bb16935ab2cac44bc27fa198bc8a1edcc5517c07fa2ced39f631d915f2b6
MD5 dd91deddc185906f5d534348e631c613
SHA1 5ffe511375192f309a629095d878dcfaabdbb77a
SHA512 cddfefc59f6f9da966a9e1bd0d0ef44bff9efd105e8331f78c130c24f49922612bb4926bd18b2db3c86ae1bcdd2bcb59559951350a4a32861258bbd8f6fd5f32
SSDEEP 48:CsJVMlSblVlylv6Vkx9lg5lXNvlikhhR3Yu6RuqS:1ulSblVlylyOgho+XYBx
TLSH
T1FFC10B82A3FC052AF2BB2B7494F742166435BE75AE76C31D2B44112E2E30601D923BB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Dood32.dll

Path C:\Users\Admin\AppData\Roaming\Origin Instruments, Corp\SofType 5.0.1105.0\install\A454EB3\Dood32.dll
Size 372KB
SHA256 5d952e15b9e21ef50b9686d50d0ea33a966ab75cc46fef879e7b58f0620acbb5
MD5 5d088732d984567b50f051d5da61c77d
SHA1 f51a4cd9d6e97095e2628b0e2f7f5185632afc8b
SHA512 849ed90bfe13de024a7069bd23abdfc30d96d0ff1b32c3f8670c31dbb86ac75b3a5b881ce027bf863dbf6b8b11ec35bb75ad6cda1a48d2c79aeb6b858136e695
SSDEEP 6144:PMDNzWQhmoIiLRyTbba53o3kUpr2NfZS66Kukd+UMQZpHio:PMdWFTbeZckFNE/UDio
TLSH
T1ED847C01F4D18432D97A34314939EB7E4AADA4601F2866CF57DC59FBAF20AC09B3562F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

License.exe

Path C:\Users\Admin\AppData\Roaming\Origin Instruments, Corp\SofType 5.0.1105.0\install\A454EB3\License.exe
Size 3.4MB
SHA256 d0b4184d8f1d91bb0728f2f4dd763544ca1de49b41699ee245b3b72a4427d8fe
MD5 2d4b116d64f4e4b04bce21ad4fe23877
SHA1 c9ff6d0e3eab28ba0c79049a7516f929505fdb3e
SHA512 baf4f3f91fdd053320e0d47788a875d9ce506a3c7649a8356488170be316cef548189c82eff1e907fc137a01546bc0d8a18e323b8e6c8ae805ee4cf793f7925e
SSDEEP 98304:NBo9lU04MArB0Jdh1aEyNYvVFLOAkGkzdnEVomFHKnPH7Yw:NCi5YgEyNYvVFLOyomFHKnP0
TLSH
T13AF5AE513D8D007AD47202318EEAFE3DF16EBDB82B3505C727D0BA2DB9716824B26567
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OICHlpr.exe

Path C:\Users\Admin\AppData\Roaming\Origin Instruments, Corp\SofType 5.0.1105.0\install\A454EB3\OICHlpr.exe
Size 3.3MB
SHA256 f6b712591bb71fb6161d10e8df269b3c46b6d72835f6e59089854a1126cde377
MD5 f64eeeacd66a2112481ae23f9b981aab
SHA1 2981658e61642650b372b7b435d5fbfa2b4e8688
SHA512 a0c7a67e2bec6cd5c911241eb58ddc4d1352905b101437e3ac29c078946ad381db9f381f201afe7f3b89b63ac22a23f8e799fd6066e9c8125b3eb844e4a4bb8d
SSDEEP 98304:NKmLQg69toMJFrSEZB8dh0QKLFLOAkGkzdnEVomFHKnP:N1kRDrtB8dh0QWFLOyomFHKnP
TLSH
T1F0F5BF513F4944AEC2221FB2AEDCF23DF16EBE705B3501D71381B71A6B32A425A15D2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OICLauncher.exe

Path C:\Users\Admin\AppData\Roaming\Origin Instruments, Corp\SofType 5.0.1105.0\install\A454EB3\ProgramFilesFolder\Origin Instruments, Corp\Launcher\OICLauncher.exe
Size 266KB
SHA256 0059f8beaeffa81a589f19e51ba87db36aee8857d20a371e71e01249a22cb722
MD5 fcc51e691319ce7ba9ab4aa532c27cd3
SHA1 39f0f9fd6de0f1a802dcc4dbaae23f13245f2974
SHA512 7c6e3135b3067bcf2bebbc069f0dd8f7d2fbeaba52c166e259f93fa0089aff105cb84924a8822d198a0813d427608e6ac7bba202f39af35f0de265507c2724f6
SSDEEP 3072:qvcD3P9NymIfOn5e7gZ5EpPNy/ZwVUfv6z8i0gJ7U4re9LqgNJYae/Ph8CswKKNf:qYVsmIlgLE9Ny//X4cl9eLPh8Cs+G5Zg
TLSH
T11144395076C0C4A5F6B21A30C870DAF69A79BC79CB2199EB23C07D6FF9306C18935766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QlmLicenseLib.dll

Path C:\Users\Admin\AppData\Roaming\Origin Instruments, Corp\SofType 5.0.1105.0\install\A454EB3\QlmLicenseLib.dll
Size 2.6MB
SHA256 196775c83e3c721c11651db239a9a6af9609582ab779dd8f9824907a7a274497
MD5 6effd0739f588cc8352c384d41ec98f8
SHA1 ffba12930b4facb3e5d229809d0607bb5530eba0
SHA512 ebaf88421d50376f026cb001844a1dfa9a5b961024d328a0c88b6dffdc36a4514f1d312ead7235500e8067b02db5825ba3f6289ff23f24609e0c0c457df9af5f
SSDEEP 24576:+J5auMNL3IgUHIDEZc25TIsobMDPgPqGtoUtR/SW31FQpZEywTp8MuiqWW:+J5aNR3IgUrtZSyPgJPbjQpZEyw9U
TLSH
T105C54A0D33A5BEF2F81E03BADE261070677494494B51E3DF2AC89E3DAF413498A91F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlphaKey.kys

Path C:\Users\Admin\AppData\Roaming\Origin Instruments, Corp\SofType 5.0.1105.0\install\A454EB3\STdata\AlphaKey.kys
Size 2KB
SHA256 38076d805c05f5118db87a314bd5b4c8e3b47841f98c99e852c039b13bde4f1e
MD5 de347cd9bb406a880d1190c8f898ecb9
SHA1 b9eeb3e15ed719b21b97502cf0cba90e4db86a3e
SHA512 99347e5c858e3becc59d844c3563be767839889dbf437c5b90413eaf1d62aeca5ff3c5eed4999b2a835fde7a5c3951154e14d7547d3f55fba7d41ac8826b7023
TLSH
T17A419C734F8442A790B49BA3E23EA61776FAC34A37564281976A190AFD3D0E36137271
MD5 SHA1 SHA512 TLSH

Submit Download

SofType.chm

Path C:\Users\Admin\AppData\Roaming\Origin Instruments, Corp\SofType 5.0.1105.0\install\A454EB3\SofType.chm
Size 846KB
SHA256 0a1bfbf057cd1227607bf1f0f084024bf6643e9c22a137b895dedb0379783c1b
MD5 48d56877eb949800b92e6df9aacb5a86
SHA1 2c8ca6bdb65790210ad2f721550a559b055b64f3
SHA512 8f3e5f4b1cc3bcb7956480a040952ec8dc1d239df1f00dafe7d1bf9e41ac874dbe7c45c7040ae4067d2857ea057b3a5740f0d7730b34477e3cc5fa9511a0898c
SSDEEP 24576:9Wx1nqvI4ZyWVfg8PW3AwT81uGlrIAuijmuG3TIQ:YxYI4ZdPu3AwA8GxuMJG3TR
TLSH
T1D705338020B51DC8E1E2C2F93CDD456D45A93C00FBFDA255F6C29AE9ECA661D16338F5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SofType.exe

Path C:\Users\Admin\AppData\Roaming\Origin Instruments, Corp\SofType 5.0.1105.0\install\A454EB3\SofType.exe
Size 4.0MB
SHA256 d1bd2cde33400f54930b6491bb39325ca3143d58c884737df72bc0b3755932b2
MD5 53970bf4dc1f8b833c77b46cf7b645c5
SHA1 02b1f05020bb9d499191789a1093ef2d67c9e853
SHA512 0b31cdda18190f28baebfeb394133ac74c5c6e0cf07e75dbb45d682a0491b4344d1e9cd1c49d579cb119ccb643ae5bdbb68fd1ce3b077a00eb379dec6d7ad678
SSDEEP 98304:DnMAIB1ScfY1YlT3d8/ZxZv5VOKNHYnTjk5A5C:DnMAvIqhv7NHYnTj
TLSH
T1CF1628113541806ACDAE02315A18E279F3AFFDE02B257DF74298BB1919364C15EFE62F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SofTypeSetup.msi

Path C:\Users\Admin\AppData\Roaming\Origin Instruments, Corp\SofType 5.0.1105.0\install\A454EB3\SofTypeSetup.msi
Size 4.9MB
SHA256 fcd927f076797a442139bebe4be0fdeef0fe9f271a8517e46e29924b5168309e
MD5 884f9fb3d45090297a8212e4b79358c7
SHA1 e7cf0e33309387af76a47c81db18fc1411e6ef34
SHA512 2856f4bbe56da8d28b37ba85cfeb95bf343971b64dcf5c566c1e5714fee2884dfb6b16bbb7295916b03b02adabe7414a1707f3b6ba57bbcbc47c4e354adda676
SSDEEP 98304:DHX3izTD5c+n6xRwAMVeZSnqFozxY/XuFV:DHXSvtcq6xeBVeMnqiMuH
TLSH
T1E8369D20758BC036E26E01B16A3DEFAA953DBE720BB144D763D47DAA19304C2573AF17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

st.log

Path C:\Users\Admin\AppData\Roaming\Origin Instruments, Corp\SofType 5.0.1105.0\install\st.log
Size 94KB
SHA256 f931c1389428262a058c4576d203621d183c9aecaf33b073116a0617812251e4
MD5 aebe507240d74df1dbc09a7d252d1b27
SHA1 9f4f0f24e68926e24bd091f0dd944b8f27c87fdb
SHA512 38e5fbc03845e79afbd3e23fe15ef25d2fe078e133de34dd93ae8b1342ac08fb0264dced553219de8e8e3f03f67cf44efa3b190919a6523960363c24f1df2637
SSDEEP 1536:XHMHVfCPwrupMgkR5SKamXMRe9saojZJhCZHBTGy7NLEAS7j93MsEWn8jUmFMkXH:w
TLSH
T1449306197FF40105B2B7DB47AEF744628AB7FD665939C80C2082921D04B2E05AD69BFF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

st.log

Path C:\Users\Admin\AppData\Roaming\Origin Instruments, Corp\SofType 5.0.1105.0\install\st.log
Size 125KB
SHA256 581db72ddf13204bd01fed220267734c4f1ba47166de531a02f0c16710f86d84
MD5 3fa981ba1286aaee794d074d78def19b
SHA1 1075fb1ab257045eb40919835422a93e1a7804b1
SHA512 310061281cb6422bd270382804bdb87651056c6fc01acbc30c2e8f176fd5c7196bbc64c55e6ee40b05cdf7439a67550ad1f8d3820fdbe43f3d4231f5539e35b2
SSDEEP 1536:XHMHVfCPwrupMgkR5SKamXMRe9saojZJhCZHBTGy7NLEAS7j93MsEWn8jUmFMkXg:/
TLSH
T1B2C305197FF40105B3B7EB479EF744628AB7F9665939C90D2082821D04B2E04AD69BFF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

st.log

Path C:\Users\Admin\AppData\Roaming\Origin Instruments, Corp\SofType 5.0.1105.0\install\st.log
Size 433KB
SHA256 9e0383191118e51636cf16c24f0deddcbb746ce2cf48bdbfd6b44a99cf1d7a90
MD5 8aabfab291f126283ecd93e564258dd3
SHA1 e27d82d5796c824569df21269e7304ea3ed4cde5
SHA512 dd59f005f31725edc26884ad5db58f2317fd6e5d68c222613d84541d4f46170b90fc8f0f7efd05fbdce9d0db53a74e56c0d3fc985513b1d06e1699ca74d768c2
SSDEEP 3072:2vjeqbE8S3adXmDNqG5A4oWYjWPNKV/NuHXqdYjqnT:ejdbOj6T
TLSH
T1D59425157BF84105B3F7EB479EF34422CA77BD666D39C90D2182820E04B1E05A969BBF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI66FF.tmp

Path C:\Windows\Installer\MSI66FF.tmp
Size 135KB
SHA256 981c3861319c5da587d729c24cbdc72505ce4cbda12f43adaccf5dff1dd58b8b
MD5 819bc3abb8a1b0600b9f7f88879e01c3
SHA1 b331783dafbd8a33c42482e5d204abf21199a79e
SHA512 c0d49853fb1436473cd97870208adf9515a7c45a5c4a1e6571d881785ec6fe75473b2abceb6bfd708ff5dbeee96ac132a95c38910fe03ea3a524d62ca107344f
SSDEEP 3072:DQG8rgJFA6B55fUFpIweVIhcJNBUB/RZaeE1FK0KHApEQq71xU:H8rKB55fTwOIhcGtbQUMq1K
TLSH
T1E5D38D40B5C5C072D57A5E3404A4DAA1963DF9B00F909EEB67C855F9CE343C0AA39BBB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI6C51.tmp

Path C:\Windows\Installer\MSI6C51.tmp
Size 895KB
SHA256 44cb926c0944e4828470a4028ad2aa7ff34b382c00fdb8129a27a2fc63831533
MD5 108f9d91113e4b842b0fc84c689a3e5c
SHA1 127dddf686d757afe127e79559cada8e56ece8f0
SHA512 7d04b48cd2cf071e347906846f53ee3b6c52a8376f917170227f1747d360c35634c756c58fa180c83852f21d21fa5178c56bf9f692cfdc56ca7c9d1a49a3c5db
SSDEEP 24576:Mdp9ULhpUMJyBx5h0lhSMXlrSzR4OyMonef:apMpDJ0xgbSV4OyMonef
TLSH
T124157DB0258FC03AF76E01B02B7EDFFA911D2E710BA058EB93D46D6A65384C15735A1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI7727.tmp

Path C:\Windows\Installer\MSI7727.tmp
Size 915KB
SHA256 c1982c9da0c0750259ca4fa8fce0a5718450e5a71b43032b33328bc07732518b
MD5 6c337654c6c5968715412e2fb799ee87
SHA1 7e5bb715b2ce6ba812ef7e34ffe75cb8de88e28e
SHA512 603ec4476245c3618d677b2214db1422bc3a1cbd1a19cd9e7c5b821d6d8941f15de9ef40d89eb03479be0aa90952ec215d9894f502ee64b820a25eff94406a5f
SSDEEP 24576:vzbOKH5xOijGlrpc15wTUSDZzeIh0lhSMXlyGSNy8zdE7d:OKH5x3yrpOSTUSD5sBSNy8zdE7d
TLSH
T13D159D21369AC036F29E41B0293C8BB6913D7E754B7144DB73C8AEAE5A355C1173AF0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2920-146-0x000001F366550000-0x000001F366EF4000-memory.dmp

Download

memory/3448-333-0x00000000062B0000-0x0000000006544000-memory.dmp

Download

memory/3448-334-0x0000000006680000-0x00000000066E4000-memory.dmp

Download

memory/3448-335-0x00000000066E0000-0x0000000006A3B000-memory.dmp

Download