a662943e7ecbaead33a8a9b1d6a7ac724ddefb6125c39429a679b43403b182eb

Analysis

max time kernel
148s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
14/10/2026, 20:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-14_642e4224f78f6f3be35cf500af87264e_amadey_avoslocker_darkgate_elex_glassworm_helldown_hijac.exe
Size 14.0MB
Sample261014-yz43ysht3l
SHA256 a662943e7ecbaead33a8a9b1d6a7ac724ddefb6125c39429a679b43403b182eb
MD5 642e4224f78f6f3be35cf500af87264e
SHA1 f3dc249ec82e761a87470a1694468f4e1e801801
SHA512 81fe04d714b02268871973e19641af7bb33f828a51f12554f834e2d9ec96743668587b678edd55c8fd0c1bbdbe082417f6b23eb7571f4bdfe85835e4c4f6f14e
SSDEEP 393216:mjhGtW9IBuiGTBXBsVnHZe3sjAVgdQrrqNZ/GXZf:mjYtW9IBuiGTBXB+nHZe3yV/GXN
TLSH
T157E69D31BA42C079D69101F0596CABBE917DAA390B7152CBB3EC2E2D5B305C26B35F17
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

defense_evasion discovery spyware trojan

Malware Config

Signatures

Executes dropped EXE 5 IoCs

pid	Process
1780	PDFSuite20.exe
704	PDFSuite20.exe
4140	PDFSuite20.exe
2384	PDFSuite20.exe
1880	PDFSuite20.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	PDFSuite20.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	PDFSuite20.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-14_642e4224f78f6f3be35cf500af87264e_amadey_avoslocker_darkgate_elex_glassworm_helldown_hijac.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-14_642e4224f78f6f3be35cf500af87264e_amadey_avoslocker_darkgate_elex_glassworm_helldown_hijac.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	PDFSuite20.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	PDFSuite20.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	PDFSuite20.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	PDFSuite20.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PDFSuite20.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PDFSuite20.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PDFSuite20.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PDFSuite20.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PDFSuite20.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-14_642e4224f78f6f3be35cf500af87264e_amadey_avoslocker_darkgate_elex_glassworm_helldown_hijac.exe

Modifies registry class 46 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{FF8EFF09-2CE0-443F-B774-755550B4AFB5}\AccessPermission = 010014804c0000005c000000140000003000000002001c0001000000110014000400000001010000000000100010000002001c0001000000000014000b0000000101000000000001000000000102000000000005200000002002000001020000000000052000000020020000	PDFSuite20.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{FF8EFF09-2CE0-443F-B774-755550B4AFB5}\AccessPermission = 010014804c0000005c000000140000003000000002001c0001000000110014000400000001010000000000100010000002001c0001000000000014000b0000000101000000000001000000000102000000000005200000002002000001020000000000052000000020020000	PDFSuite20.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B625AD83-D3D2-424C-8CD7-E07020CC2565}\Programmable	PDFSuite20.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B625AD83-D3D2-424C-8CD7-E07020CC2565}\TypeLib	PDFSuite20.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9601EEF2-E240-49D2-B1E1-9CDC05FFE9FA}\ = "IInstaller"	PDFSuite20.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9601EEF2-E240-49D2-B1E1-9CDC05FFE9FA}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	PDFSuite20.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{FF8EFF09-2CE0-443F-B774-755550B4AFB5}\AccessPermission = 010014804c0000005c000000140000003000000002001c0001000000110014000400000001010000000000100010000002001c0001000000000014000b0000000101000000000001000000000102000000000005200000002002000001020000000000052000000020020000	PDFSuite20.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{FF8EFF09-2CE0-443F-B774-755550B4AFB5}	PDFSuite20.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{FF8EFF09-2CE0-443F-B774-755550B4AFB5}\LaunchPermission = 010014804c0000005c000000140000003000000002001c0001000000110014000400000001010000000000100010000002001c0001000000000014000b0000000101000000000001000000000102000000000005200000002002000001020000000000052000000020020000	PDFSuite20.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B625AD83-D3D2-424C-8CD7-E07020CC2565}\LocalServer32\ = "\"C:\\ProgramData\\PDF Suite 20\\Installation\\PDFSuite20.exe\""	PDFSuite20.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B625AD83-D3D2-424C-8CD7-E07020CC2565}\Version\ = "1.0"	PDFSuite20.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B625AD83-D3D2-424C-8CD7-E07020CC2565}\Elevation	PDFSuite20.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{7B0BE9B4-3498-4CEE-8E52-AFF35157D56B}\1.0\0	PDFSuite20.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9601EEF2-E240-49D2-B1E1-9CDC05FFE9FA}\TypeLib	PDFSuite20.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9601EEF2-E240-49D2-B1E1-9CDC05FFE9FA}\TypeLib\ = "{7B0BE9B4-3498-4CEE-8E52-AFF35157D56B}"	PDFSuite20.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{FF8EFF09-2CE0-443F-B774-755550B4AFB5}\LaunchPermission = 010014804c0000005c000000140000003000000002001c0001000000110014000400000001010000000000100010000002001c0001000000000014000b0000000101000000000001000000000102000000000005200000002002000001020000000000052000000020020000	PDFSuite20.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B625AD83-D3D2-424C-8CD7-E07020CC2565}\ = "Installer Class"	PDFSuite20.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B625AD83-D3D2-424C-8CD7-E07020CC2565}\Elevation\IconReference = "@C:\\ProgramData\\PDF Suite 20\\Installation\\PDFSuite20.exe,-501"	PDFSuite20.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{7B0BE9B4-3498-4CEE-8E52-AFF35157D56B}\1.0	PDFSuite20.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{7B0BE9B4-3498-4CEE-8E52-AFF35157D56B}\1.0\FLAGS	PDFSuite20.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9601EEF2-E240-49D2-B1E1-9CDC05FFE9FA}\ = "IInstaller"	PDFSuite20.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9601EEF2-E240-49D2-B1E1-9CDC05FFE9FA}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	PDFSuite20.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9601EEF2-E240-49D2-B1E1-9CDC05FFE9FA}	PDFSuite20.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B625AD83-D3D2-424C-8CD7-E07020CC2565}\Version	PDFSuite20.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{7B0BE9B4-3498-4CEE-8E52-AFF35157D56B}\1.0\0\win32	PDFSuite20.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9601EEF2-E240-49D2-B1E1-9CDC05FFE9FA}\TypeLib\ = "{7B0BE9B4-3498-4CEE-8E52-AFF35157D56B}"	PDFSuite20.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{FF8EFF09-2CE0-443F-B774-755550B4AFB5}\LaunchPermission = 010014804c0000005c000000140000003000000002001c0001000000110014000400000001010000000000100010000002001c0001000000000014000b0000000101000000000001000000000102000000000005200000002002000001020000000000052000000020020000	PDFSuite20.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B625AD83-D3D2-424C-8CD7-E07020CC2565}	PDFSuite20.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{7B0BE9B4-3498-4CEE-8E52-AFF35157D56B}\1.0\ = "GlamInstallerComLib"	PDFSuite20.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9601EEF2-E240-49D2-B1E1-9CDC05FFE9FA}\ProxyStubClsid32	PDFSuite20.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{FF8EFF09-2CE0-443F-B774-755550B4AFB5}	PDFSuite20.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9601EEF2-E240-49D2-B1E1-9CDC05FFE9FA}	PDFSuite20.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9601EEF2-E240-49D2-B1E1-9CDC05FFE9FA}\TypeLib	PDFSuite20.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B625AD83-D3D2-424C-8CD7-E07020CC2565}\LocalServer32\ServerExecutable = "C:\\ProgramData\\PDF Suite 20\\Installation\\PDFSuite20.exe"	PDFSuite20.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{7B0BE9B4-3498-4CEE-8E52-AFF35157D56B}\1.0\FLAGS\ = "0"	PDFSuite20.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{7B0BE9B4-3498-4CEE-8E52-AFF35157D56B}\1.0\HELPDIR	PDFSuite20.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9601EEF2-E240-49D2-B1E1-9CDC05FFE9FA}\ProxyStubClsid32	PDFSuite20.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9601EEF2-E240-49D2-B1E1-9CDC05FFE9FA}\TypeLib\Version = "1.0"	PDFSuite20.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B625AD83-D3D2-424C-8CD7-E07020CC2565}\LocalServer32	PDFSuite20.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B625AD83-D3D2-424C-8CD7-E07020CC2565}\TypeLib\ = "{7B0BE9B4-3498-4CEE-8E52-AFF35157D56B}"	PDFSuite20.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B625AD83-D3D2-424C-8CD7-E07020CC2565}\Elevation\Enabled = "1"	PDFSuite20.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{7B0BE9B4-3498-4CEE-8E52-AFF35157D56B}	PDFSuite20.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{7B0BE9B4-3498-4CEE-8E52-AFF35157D56B}\1.0\0\win32\ = "C:\\ProgramData\\PDF Suite 20\\Installation\\PDFSuite20.exe"	PDFSuite20.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{7B0BE9B4-3498-4CEE-8E52-AFF35157D56B}\1.0\HELPDIR\ = "C:\\ProgramData\\PDF Suite 20\\Installation"	PDFSuite20.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9601EEF2-E240-49D2-B1E1-9CDC05FFE9FA}\TypeLib\Version = "1.0"	PDFSuite20.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{FF8EFF09-2CE0-443F-B774-755550B4AFB5}	PDFSuite20.exe

Modifies system certificate store 2 TTPs 8 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8CF427FD790C3AD166068DE81E57EFBB932272D4	PDFSuite20.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8CF427FD790C3AD166068DE81E57EFBB932272D4\Blob = 0f0000000100000020000000fde5f2d9ce2026e1e10064c0a468c9f355b90acf85baf5ce6f52d4016837fd94090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b06010505070308530000000100000041000000303f3020060a6086480186fa6c0a010230123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c07f00000001000000360000003034060a2b0601040182370a030406082b0601050507030506082b0601050507030606082b0601050507030706082b0601050507030162000000010000002000000043df5774b03e7fef5fe40d931a7bedf1bb2e6b42738c4e6d3841103d3aa7f3390b000000010000001800000045006e00740072007500730074002e006e006500740000001400000001000000140000006a72267ad01eef7de73b6951d46c8d9f901266ab1d0000000100000010000000521b5f4582c1dcaae381b05e37ca2d347e000000010000000800000000001a7f62aedb010300000001000000140000008cf427fd790c3ad166068de81e57efbb932272d42000000001000000420400003082043e30820326a00302010202044a538c28300d06092a864886f70d01010b05003081be310b300906035504061302555331163014060355040a130d456e74727573742c20496e632e31283026060355040b131f536565207777772e656e74727573742e6e65742f6c6567616c2d7465726d7331393037060355040b1330286329203230303920456e74727573742c20496e632e202d20666f7220617574686f72697a656420757365206f6e6c793132303006035504031329456e747275737420526f6f742043657274696669636174696f6e20417574686f72697479202d204732301e170d3039303730373137323535345a170d3330313230373137353535345a3081be310b300906035504061302555331163014060355040a130d456e74727573742c20496e632e31283026060355040b131f536565207777772e656e74727573742e6e65742f6c6567616c2d7465726d7331393037060355040b1330286329203230303920456e74727573742c20496e632e202d20666f7220617574686f72697a656420757365206f6e6c793132303006035504031329456e747275737420526f6f742043657274696669636174696f6e20417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100ba84b672db9e0c6be299e93001a776ea32b895411ac9da614e5872cffef68279bf7361060aa527d8b35fd3454e1c72d64e32f2728a0ff78319d06a808000451eb0c7e79abf1257271ca3682f0a87bd6a6b0e5e65f31c77d5d4858d7021b4b332e78ba2d5863902b1b8d247cee4c949c43ba7defb547d57bef0e86ec279b23a0b55e250981632135c2f7856c1c294b3f25ae4279a9f24d7c6ecd09b2582e3ccc2c445c58c977a066b2a119fa90a6e483b6fdbd4111942f78f07bff5535f9c3ef4172ce669ac4e324c6277eab7e8e5bb34bc198bae9c51e7b77eb553b13322e56dcf703c1afae29b67b683f48da5af624c4de058ac64341203f8b68d946324a4710203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604146a72267ad01eef7de73b6951d46c8d9f901266ab300d06092a864886f70d01010b05000382010100799f1d96c6b6793f228d87d3870304606a6b9a2e59897311ac43d1f513ff8d392bc0f2bd4f708ca92fea17c40b549ed41b9698333ca8ad62a20076ab59696e061d7ec4b9448d98af12d461db0a194647f3ebf763c1400540a5d2b7f4b59a36bfa98876880455042b9c877f1a373c7e2da51ad8d4895ecabdac3d6cd86dafd5f3760fcd3b8838229d6c939ac43dbf821b653fa60f5daafce5b215cab5adc6bc3dd084e8ea0672b04d393278bf3e119c0ba49d9a21f3f09b0b3078dbc1dc8743febc639acac5c21cc9c78dff3b125808e6b63dec7a2c4efb8396ce0c3c69875473a473c293ff5110ac155401d8fc05b189a17f74839a49d7dc4e7b8a486f8b45f6	PDFSuite20.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8CF427FD790C3AD166068DE81E57EFBB932272D4\Blob = 190000000100000010000000fa46ce7cbb85cfb4310075313a09ee050300000001000000140000008cf427fd790c3ad166068de81e57efbb932272d47e000000010000000800000000001a7f62aedb011d0000000100000010000000521b5f4582c1dcaae381b05e37ca2d341400000001000000140000006a72267ad01eef7de73b6951d46c8d9f901266ab0b000000010000001800000045006e00740072007500730074002e006e0065007400000062000000010000002000000043df5774b03e7fef5fe40d931a7bedf1bb2e6b42738c4e6d3841103d3aa7f3397f00000001000000360000003034060a2b0601040182370a030406082b0601050507030506082b0601050507030606082b0601050507030706082b06010505070301530000000100000041000000303f3020060a6086480186fa6c0a010230123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f0000000100000020000000fde5f2d9ce2026e1e10064c0a468c9f355b90acf85baf5ce6f52d4016837fd942000000001000000420400003082043e30820326a00302010202044a538c28300d06092a864886f70d01010b05003081be310b300906035504061302555331163014060355040a130d456e74727573742c20496e632e31283026060355040b131f536565207777772e656e74727573742e6e65742f6c6567616c2d7465726d7331393037060355040b1330286329203230303920456e74727573742c20496e632e202d20666f7220617574686f72697a656420757365206f6e6c793132303006035504031329456e747275737420526f6f742043657274696669636174696f6e20417574686f72697479202d204732301e170d3039303730373137323535345a170d3330313230373137353535345a3081be310b300906035504061302555331163014060355040a130d456e74727573742c20496e632e31283026060355040b131f536565207777772e656e74727573742e6e65742f6c6567616c2d7465726d7331393037060355040b1330286329203230303920456e74727573742c20496e632e202d20666f7220617574686f72697a656420757365206f6e6c793132303006035504031329456e747275737420526f6f742043657274696669636174696f6e20417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100ba84b672db9e0c6be299e93001a776ea32b895411ac9da614e5872cffef68279bf7361060aa527d8b35fd3454e1c72d64e32f2728a0ff78319d06a808000451eb0c7e79abf1257271ca3682f0a87bd6a6b0e5e65f31c77d5d4858d7021b4b332e78ba2d5863902b1b8d247cee4c949c43ba7defb547d57bef0e86ec279b23a0b55e250981632135c2f7856c1c294b3f25ae4279a9f24d7c6ecd09b2582e3ccc2c445c58c977a066b2a119fa90a6e483b6fdbd4111942f78f07bff5535f9c3ef4172ce669ac4e324c6277eab7e8e5bb34bc198bae9c51e7b77eb553b13322e56dcf703c1afae29b67b683f48da5af624c4de058ac64341203f8b68d946324a4710203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604146a72267ad01eef7de73b6951d46c8d9f901266ab300d06092a864886f70d01010b05000382010100799f1d96c6b6793f228d87d3870304606a6b9a2e59897311ac43d1f513ff8d392bc0f2bd4f708ca92fea17c40b549ed41b9698333ca8ad62a20076ab59696e061d7ec4b9448d98af12d461db0a194647f3ebf763c1400540a5d2b7f4b59a36bfa98876880455042b9c877f1a373c7e2da51ad8d4895ecabdac3d6cd86dafd5f3760fcd3b8838229d6c939ac43dbf821b653fa60f5daafce5b215cab5adc6bc3dd084e8ea0672b04d393278bf3e119c0ba49d9a21f3f09b0b3078dbc1dc8743febc639acac5c21cc9c78dff3b125808e6b63dec7a2c4efb8396ce0c3c69875473a473c293ff5110ac155401d8fc05b189a17f74839a49d7dc4e7b8a486f8b45f6	PDFSuite20.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4	PDFSuite20.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 0f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e1996530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703080b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac89988140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f1d0000000100000010000000a86dc6a233eb339610f3ed414927c559030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e42000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e	PDFSuite20.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 04000000010000001000000078f2fcaa601f2fb4ebc937ba532e7549030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e41d0000000100000010000000a86dc6a233eb339610f3ed414927c559140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac899880b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e19962000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e	PDFSuite20.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 190000000100000010000000ffac207997bb2cfe865570179ee037b90f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e1996530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703080b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac89988140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f1d0000000100000010000000a86dc6a233eb339610f3ed414927c559030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e404000000010000001000000078f2fcaa601f2fb4ebc937ba532e75492000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e	PDFSuite20.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 5c00000001000000040000000010000004000000010000001000000078f2fcaa601f2fb4ebc937ba532e7549030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e41d0000000100000010000000a86dc6a233eb339610f3ed414927c559140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac899880b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e1996190000000100000010000000ffac207997bb2cfe865570179ee037b92000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e	PDFSuite20.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
1780	PDFSuite20.exe
1780	PDFSuite20.exe
1780	PDFSuite20.exe
1780	PDFSuite20.exe
1780	PDFSuite20.exe
1780	PDFSuite20.exe
704	PDFSuite20.exe
704	PDFSuite20.exe
704	PDFSuite20.exe
704	PDFSuite20.exe
2384	PDFSuite20.exe
2384	PDFSuite20.exe
2384	PDFSuite20.exe
2384	PDFSuite20.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1780	PDFSuite20.exe
1780	PDFSuite20.exe
2384	PDFSuite20.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1300 wrote to memory of 1780	1300	2026-10-14_642e4224f78f6f3be35cf500af87264e_amadey_avoslocker_darkgate_elex_glassworm_helldown_hijac.exe	90
PID 1780 wrote to memory of 704	1780	PDFSuite20.exe	95
PID 704 wrote to memory of 4140	704	PDFSuite20.exe	96
PID 704 wrote to memory of 2384	704	PDFSuite20.exe	97
PID 704 wrote to memory of 1880	704	PDFSuite20.exe	98

C:\Users\Admin\AppData\Local\Temp\2026-10-14_642e4224f78f6f3be35cf500af87264e_amadey_avoslocker_darkgate_elex_glassworm_helldown_hijac.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-14_642e4224f78f6f3be35cf500af87264e_amadey_avoslocker_darkgate_elex_glassworm_helldown_hijac.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1300
- C:\Users\Admin\AppData\Local\Temp\PDFSuite20\20.0.10.3169\EED023E4-70D0-4065-8CAD-1A9066F6E4F8\PDFSuite20.exe
  "C:\Users\Admin\AppData\Local\Temp\PDFSuite20\20.0.10.3169\EED023E4-70D0-4065-8CAD-1A9066F6E4F8\PDFSuite20.exe" /update=start /welcome
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Modifies system certificate store
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1780
- - C:\Users\Admin\AppData\Local\Temp\PDFSuite20\20.0.52.3306\BBBAFACC-6AED-4FE4-87DF-20F8970F3D87\PDFSuite20.exe
    "C:\Users\Admin\AppData\Local\Temp\PDFSuite20\20.0.52.3306\BBBAFACC-6AED-4FE4-87DF-20F8970F3D87\PDFSuite20.exe" /update=finish /welcome
    3⤵
    - Executes dropped EXE
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:704
  - - C:\ProgramData\PDF Suite 20\Installation\PDFSuite20.exe
      "C:\ProgramData\PDF Suite 20\Installation\PDFSuite20.exe" /RegServer
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Modifies registry class
      PID:4140
  - - C:\ProgramData\PDF Suite 20\Installation\PDFSuite20.exe
      "C:\ProgramData\PDF Suite 20\Installation\PDFSuite20.exe" /welcome /no-check-updates
      4⤵
      Executes dropped EXE
      Reads the TCP/IP host and domain name from the registry
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      PID:2384
  - - C:\ProgramData\PDF Suite 20\Installation\PDFSuite20.exe
      "C:\ProgramData\PDF Suite 20\Installation\PDFSuite20.exe" /CleanupTempFolder /ParentProcessId=704
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1880

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2026.10.14_21.14.27_2026-10-14_642e4224f78f6f3be35cf500af87264e_amadey_avoslocker_darkgate_elex_glassworm_helldown_hijac_1300.txt

Path C:\ProgramData\PDF Suite 20\Installation\logs\2026.10.14_21.14.27_2026-10-14_642e4224f78f6f3be35cf500af87264e_amadey_avoslocker_darkgate_elex_glassworm_helldown_hijac_1300.txt
Size 1KB
SHA256 7b2d28b5ba405b62c3a4fb535d7d202882a39915166031f36282033d7c94153b
MD5 3b9482cd59071b3cb70eaa8e06056d86
SHA1 9d17ba6a456a6b3bc59d08d8a4c9ffa1395344bf
SHA512 599aee17b6674f70c024ab43f9421f7241334825e75a6794958b72c111a0573debb30422b7662a0ed99161a0277b93ce21974dadfff1ea4976a59babfa72372e
TLSH
T11211DA6834D2C191D1D8374E3A5AF9A08121766E41E1135973C857A57E0BD4E2FF40B4
MD5 SHA1 SHA512 TLSH

Submit Download

2026.10.14_21.14.30_PDFSuite20_1780.txt

Path C:\ProgramData\PDF Suite 20\Installation\logs\2026.10.14_21.14.30_PDFSuite20_1780.txt
Size 1KB
SHA256 a28a5b1c2087c3727c0cf3c62882a832f1804fbc528bf7053c52e4ae3549fa04
MD5 43db1015c1991f734d3b2cc8ad05eed7
SHA1 0b97c3ae0988f23a0ec6d03a7271bfc10cbb95c7
SHA512 71028d4350979171b375f2cba5f1ee1dc97f18022826e799b94f70fd0dcaf831b7f33c1678b60c4b5b4109e92b485369629d7f2a3cc7679b1843123f1ec799c8
TLSH
T15421AD9D30C1C1AAD6D4774D3E1EF9A08539743981E023992390EA60B90F8A96FF50B6
MD5 SHA1 SHA512 TLSH

Submit Download

2026.10.14_21.14.38_PDFSuite20_704.txt

Path C:\ProgramData\PDF Suite 20\Installation\logs\2026.10.14_21.14.38_PDFSuite20_704.txt
Size 1KB
SHA256 4b044bfac4364abaa8899c20eb7cab4711e90566bd41d29e8dcce34e8ef62b12
MD5 e2531b1ccbded90622328e8f85dea774
SHA1 ce464a9e918f520a65fb30daeeccc963d6916b36
SHA512 4616ac9f08ced7e91f455a0bf92befa956488fe300d761aa2bdec33d82a7666de3830e7bf0aacfeded798ecb8a47f48051eaae754c5982fc813bac02e3e685de
TLSH
T1EF41EC0835C3C019C6E476BC3A05F9A05769716A46E05B8EA3C0C764689FD45AFF92B6
MD5 SHA1 SHA512 TLSH

Submit Download

updates-info.json

Path C:\ProgramData\PDF Suite 20\Installation\updates-info.json
Size 2KB
SHA256 0f801fd56f57cc7418584c561322399a7e00bf41e9ba5488b8b7f9de35e6fb60
MD5 c7b4742c04bf2dbd1a44fca0a5489253
SHA1 16351729e236897372b68ee5e50b511c1b58067d
SHA512 634d2de325041f688f65eacbc2e154fc161ecb0411772a1b52a5ee2d51a7745b617c6b97c8e8b3f4f320916151e8179d6ac9700240c4fd4b2cd1ad6a4720857c
TLSH
T1E75119A7F670288F2E7681D94F4A232ADE55D31725A0CC0D30B2754E1B7397F25B290B
MD5 SHA1 SHA512 TLSH

Submit Download

698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
Size 471B
SHA256 b6ee29e2257f344fd859e326a17e80a16690fc13cbd2c9a1fd2f75a2257a2cca
MD5 80cdf8fcad886a7ed11661fe7efbb599
SHA1 f028e1d6235da4b2080de3fef59141052bf9bcb9
SHA512 8949955cbdff8301f46fc36b1dfdecb7751ad99ccc3b26c68208e7e4231d74ec2cf705a813f2315517be2e42330d9e0a332df7f0fd0aceae9d3975b7eeb110ec
TLSH
T1ACF0D42355FF70B51B0BD49C1EE55F7012B61A5C10D7856F383509D4598F9D5F50F029
MD5 SHA1 SHA512 TLSH

Submit Download

8B2B9A00839EED1DFDCCC3BFC2F5DF12

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12
Size 1KB
SHA256 791735e52af30a1c6a750df3837784a34cfe763332e5b45acfd731ddaa159b83
MD5 937eade2963d309f04ad7c807ba17156
SHA1 b183c87c76481b1e153a6bdfdc71945a59542a84
SHA512 5760b7dcfdcb1f5cd481e3d3c183b9c21996542896c602a0bdb665420693d3c67d3cacf98a2e18e437e6f7abf9263e0a18501930e02dabf2d748f749351820c8
TLSH
T1FB31C14EA2103067D946BF72D9CF7E83CDB1324AB7CAC46B18445E4229AAFC25F840C5
MD5 SHA1 SHA512 TLSH

Submit Download

8C7F1D8619347684DFBCB844964213E1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8C7F1D8619347684DFBCB844964213E1
Size 310B
SHA256 8bac41c9ce88ea0d2cc60d94ec6be0239a84b809df5aab4d517b400e6bfe833e
MD5 4240fd6687db95031291f2a343ce7d91
SHA1 397e3f1c605ebf582276685db325071e73892139
SHA512 a1008be88055c5f2262dfb2608b35c9c8d33fe7875a85b3a6a2fbeb36d0e5cb9a043c0eb9a444052106cf193cdfd968583a4539c87fd0b9a7d492732475541ab
TLSH
T1B4E07DD0517D26D54660E4008CD0C8975CB894426A8FF0121DC0CB7237D7F8AD58418D
MD5 SHA1 SHA512 TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_627195D761F7715D3B72D0DCB397B7C9

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_627195D761F7715D3B72D0DCB397B7C9
Size 727B
SHA256 1e65d4f35fc657278c12f62b559c3f866753d748ad3489773d0b52e4858ddc0c
MD5 ccb4cfe832e7f396ab1187574e630010
SHA1 8183585869befed9e203b2e31e499516b4769beb
SHA512 9f8bd8381b7a3c98cebeb718c14dd439f7b11576c1591f052947b962825713448d1671c930f0f797957c382d8cb09d4c7125f2f69e700e63a0f22322499604de
TLSH
T180016511D10E7A016D0059929B13CA903F3130362DBCC88F929511D4EE1E7BB3F40D50
MD5 SHA1 SHA512 TLSH

Submit Download

B46811C17859FFB409CF0E904A4AA8F8

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8
Size 529B
SHA256 39c727d70b8bdf5fc324233d0823555eb66ce846119609a22d1cebedbc3cf80c
MD5 f0102d5ebee72932834506783a39ffbf
SHA1 d6bf07be7cc02a713e0f8f94c124da8a15a016db
SHA512 621caa36ba48c567a850166b85b65474e96f860eca78fd1d3967e017f89a2c7919c6e6a21fef38136a5ae5ecfaade5b686be7476ba95253bfd023f71c0ce78a5
TLSH
T138F0C90C80182262CC04FF91CFD6AC93EC3A33427AD492031B444A420882F855FC16E9
MD5 SHA1 SHA512 TLSH

Submit Download

C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Size 727B
SHA256 6cffa6aafff2185baf6aaafe651f52e8718763f51e76217fa3242a4ea5a47c7e
MD5 5b4810c73dcd78c75fb4122961698650
SHA1 a629c3ba0a9df1f31a0a24feadc59ba0dd508109
SHA512 e9ebf82fd09d13c8ecab2172962bc872b17d20a2328fd2daa90eda5c41c36d75ab49ea8c195d989ac0e9e2dd702c5dad2c63d56b16b1e21621f96b6f3fafd0f0
TLSH
T18D01651B48FA3B807C02E5E2762C46D072BAC2552A8991471CCE004F8428B9B1EC5D15
MD5 SHA1 SHA512 TLSH

Submit Download

698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
Size 400B
SHA256 d6802fdbb372d4af08a9e85432258d5f3aa03b91e3cea44f42a6606f5398e8ff
MD5 9d47d5849320a9d17bfa1723a2129ac6
SHA1 213f4bdae63355919eb75404d393d5a54322ff25
SHA512 932428035f2ba63f1296adfa2cfda9a774355b5a20fd32869bb0fe7291c0282c4be0426715d88b817cf4e489f39e6d5e3118b2bcc5d3af6f3bbd096e2fa2a110
TLSH
T1F0E0203427FB115EF2A0677403D591D66F36F1166C45577E0DC1241D6A0DE044D52D31
MD5 SHA1 SHA512 TLSH

Submit Download

8B2B9A00839EED1DFDCCC3BFC2F5DF12

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12
Size 174B
SHA256 dfb5840f67e9a20bad6c55e491ab1a9c77788d51cbbe3c167237d6a9f9a615ae
MD5 212d98c7e9468d413717e944734c285b
SHA1 fc7100cbacb818839a090e8e367f01d4eeffe95b
SHA512 14453c4208caaf113d9b057b908f387f7dd1c51162373d3311107f17dca36c8931fc2d6c46f024b3b8bd44756aaf89dba902d5fe370af5838b7cecfa8765980f
TLSH
T13FC02B003730030DF470013F144102105BF7D100CED643008F701016541CD0198B3E05
MD5 SHA1 SHA512 TLSH

Submit Download

8C7F1D8619347684DFBCB844964213E1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8C7F1D8619347684DFBCB844964213E1
Size 192B
SHA256 e83ec0b792e56f270ee861d2e3560274694068c1332548440d909cbf8f949bcd
MD5 852a477b4f2ac9338bcbcba124ebe2ba
SHA1 e7c89823348a8d4925fe5044eb6c0e983628beef
SHA512 8b622fbbfe34253065a13dc79fab83997f03cd22d42f3d12a6498393011fe2267184004ce9ebec1143329c9ac225c8b3d3af83ff65744af288028ea7c9466b5f
TLSH
T11CC08C106AF80214F0010A3F88B1720363F4EE06C301C3048FF00298142C9860C30E12
MD5 SHA1 SHA512 TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_627195D761F7715D3B72D0DCB397B7C9

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_627195D761F7715D3B72D0DCB397B7C9
Size 404B
SHA256 e4f9a478eb5d87a38661c912272814731351a2baf15f12343ffc9d61cc508754
MD5 6dfc91f5165bde28be0d55867a487cca
SHA1 9efc0624850013bfa6e2f55d75ffeda272f5d2a1
SHA512 ed6f6145a44c280b59ef34aa7f4d3c710518da46a4a878929130c802cfbccc99d288f0ac9867498c09f542c47013b27ae0195f093a70da6c43c8d7b1eb9f30e3
TLSH
T10AE0263032F9459EF0F4E83843F69D515DADF246090197FA1D806396EE19B404EE3538
MD5 SHA1 SHA512 TLSH

Submit Download

B46811C17859FFB409CF0E904A4AA8F8

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8
Size 170B
SHA256 c85edfa728fdc0c5c866ad89e7eac566e04e717f91d5c7c3cf5bf9c0712960e9
MD5 86d4f7b09ae94b8793760ae968d77f64
SHA1 ea89c6932286ea74c9592030514e1d19ed709ce5
SHA512 3b9239395478ea2080751673a0c15b509bd8167006d7777abb2a7e46d54441981a38c81456397f8478c66d25b7aed8867ce6366fccb3246394bad2942461a391
TLSH
T111C09266B362C6ABF1E6013F09E557159BF68690F643831046B842AA872CF9208B6E42
MD5 SHA1 SHA512 TLSH

Submit Download

C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Size 412B
SHA256 8ddeabf0992c4d3e8794dc1058445ff66c747e4dc33955857dc742be92ea1702
MD5 47dec1c419b4d2437cff5d6c44449639
SHA1 010bff07300aac8dfa50eedf780eea850a416fef
SHA512 7f2565e777a2db9b61de7dd067a17830ff9c1bbe66bb2d822ac2c8eec4134e7d0eee7d61dd4b8e5d158a3715575a4efe29a64803088deba76f8ee41e410a4a29
TLSH
T111E0C03C92EF710FF0909D3546F6A1711E58F311140497790AD1430EBB1BF005C109F0
MD5 SHA1 SHA512 TLSH

Submit Download

PDFSuite20.exe

Path C:\Users\Admin\AppData\Local\Temp\PDFSuite20\20.0.10.3169\EED023E4-70D0-4065-8CAD-1A9066F6E4F8\PDFSuite20.exe
Size 14.0MB
SHA256 a662943e7ecbaead33a8a9b1d6a7ac724ddefb6125c39429a679b43403b182eb
MD5 642e4224f78f6f3be35cf500af87264e
SHA1 f3dc249ec82e761a87470a1694468f4e1e801801
SHA512 81fe04d714b02268871973e19641af7bb33f828a51f12554f834e2d9ec96743668587b678edd55c8fd0c1bbdbe082417f6b23eb7571f4bdfe85835e4c4f6f14e
SSDEEP 393216:mjhGtW9IBuiGTBXBsVnHZe3sjAVgdQrrqNZ/GXZf:mjYtW9IBuiGTBXB+nHZe3yV/GXN
TLSH
T157E69D31BA42C079D69101F0596CABBE917DAA390B7152CBB3EC2E2D5B305C26B35F17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PDFSuite20.exe

Path C:\Users\Admin\AppData\Local\Temp\PDFSuite20\20.0.52.3306\BBBAFACC-6AED-4FE4-87DF-20F8970F3D87\PDFSuite20.exe
Size 12.4MB
SHA256 17e3552e611d1d8f6c9121ec74c26a8ffc67ec3ac8f5ca83088624fb76cd0af6
MD5 bc1c439f08450d14be43d801e6262862
SHA1 cdbe6c8a29a298a72988307492a8e3878454cfc5
SHA512 78d64d2aebf05268874b272fa445ecb368e7fd1ea171e1342aadfe2302bf79d5339a4b84325bdf2c45d5bafba0d74e67173b6067eda1130246db71a66fa954f1
SSDEEP 393216:m0ezm5mNkDSRAVnDblrerqPItH8rqNBHF1:mIEk9Au6pF1
TLSH
T1FBD6BF12BB41C079C16102B0696CF7B996BDE9301BB581D7B3CC2B2D5F705C2AA26F5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download