79a28181ad4d9ba3614694edd3d5efc880d65b690de8ce8c453a0671176ad6a7

Analysis

max time kernel
149s
max time network
99s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
15/04/2026, 15:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-15_61940a91b55ef21c23ae0e5416519661_amadey_darkgate_elex_gcleaner_glassworm_hawkeye_smoke-loader.exe
Size 580KB
Sample260415-sns9esdx3s
SHA256 79a28181ad4d9ba3614694edd3d5efc880d65b690de8ce8c453a0671176ad6a7
MD5 61940a91b55ef21c23ae0e5416519661
SHA1 5a82f04e4627a5c899ab5e71b8596bd37a410035
SHA512 b92b17f101427a7771fe00ef48bdec45a93315836268a37aca09088bbf817804658d5c95d156c9d5d249d60effa42b22efa2fb5689c8560e6f62a06aa032b0aa
SSDEEP 12288:eW4m8nt8tLpm1dAwSfxL/2Dc3jDLLmt0LDQewsAjRR:54mW8tLpwOaewsAjD
TLSH
T184C48C31FAB4D032D2BB0DB11B79D726543DBA200B621AC7E3E85E9D59702D12736B1B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-04-15_61940a91b55ef21c23ae0e5416519661_amadey_darkgate_elex_gcleaner_glassworm_hawkeye_smoke-loader.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-04-15_61940a91b55ef21c23ae0e5416519661_amadey_darkgate_elex_gcleaner_glassworm_hawkeye_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-04-15_61940a91b55ef21c23ae0e5416519661_amadey_darkgate_elex_gcleaner_glassworm_hawkeye_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-04-15_61940a91b55ef21c23ae0e5416519661_amadey_darkgate_elex_gcleaner_glassworm_hawkeye_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-04-15_61940a91b55ef21c23ae0e5416519661_amadey_darkgate_elex_gcleaner_glassworm_hawkeye_smoke-loader.exe
File created	C:\Program Files\Internet Explorer\ExtExport.exe	2026-04-15_61940a91b55ef21c23ae0e5416519661_amadey_darkgate_elex_gcleaner_glassworm_hawkeye_smoke-loader.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-04-15_61940a91b55ef21c23ae0e5416519661_amadey_darkgate_elex_gcleaner_glassworm_hawkeye_smoke-loader.exe
File created	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-04-15_61940a91b55ef21c23ae0e5416519661_amadey_darkgate_elex_gcleaner_glassworm_hawkeye_smoke-loader.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-04-15_61940a91b55ef21c23ae0e5416519661_amadey_darkgate_elex_gcleaner_glassworm_hawkeye_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-04-15_61940a91b55ef21c23ae0e5416519661_amadey_darkgate_elex_gcleaner_glassworm_hawkeye_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	2026-04-15_61940a91b55ef21c23ae0e5416519661_amadey_darkgate_elex_gcleaner_glassworm_hawkeye_smoke-loader.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-04-15_61940a91b55ef21c23ae0e5416519661_amadey_darkgate_elex_gcleaner_glassworm_hawkeye_smoke-loader.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-04-15_61940a91b55ef21c23ae0e5416519661_amadey_darkgate_elex_gcleaner_glassworm_hawkeye_smoke-loader.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-04-15_61940a91b55ef21c23ae0e5416519661_amadey_darkgate_elex_gcleaner_glassworm_hawkeye_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-04-15_61940a91b55ef21c23ae0e5416519661_amadey_darkgate_elex_gcleaner_glassworm_hawkeye_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-04-15_61940a91b55ef21c23ae0e5416519661_amadey_darkgate_elex_gcleaner_glassworm_hawkeye_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	2026-04-15_61940a91b55ef21c23ae0e5416519661_amadey_darkgate_elex_gcleaner_glassworm_hawkeye_smoke-loader.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-04-15_61940a91b55ef21c23ae0e5416519661_amadey_darkgate_elex_gcleaner_glassworm_hawkeye_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-04-15_61940a91b55ef21c23ae0e5416519661_amadey_darkgate_elex_gcleaner_glassworm_hawkeye_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-04-15_61940a91b55ef21c23ae0e5416519661_amadey_darkgate_elex_gcleaner_glassworm_hawkeye_smoke-loader.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-04-15_61940a91b55ef21c23ae0e5416519661_amadey_darkgate_elex_gcleaner_glassworm_hawkeye_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-04-15_61940a91b55ef21c23ae0e5416519661_amadey_darkgate_elex_gcleaner_glassworm_hawkeye_smoke-loader.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-04-15_61940a91b55ef21c23ae0e5416519661_amadey_darkgate_elex_gcleaner_glassworm_hawkeye_smoke-loader.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-04-15_61940a91b55ef21c23ae0e5416519661_amadey_darkgate_elex_gcleaner_glassworm_hawkeye_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-04-15_61940a91b55ef21c23ae0e5416519661_amadey_darkgate_elex_gcleaner_glassworm_hawkeye_smoke-loader.exe
File created	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-04-15_61940a91b55ef21c23ae0e5416519661_amadey_darkgate_elex_gcleaner_glassworm_hawkeye_smoke-loader.exe
File created	C:\Program Files\Internet Explorer\ExtExport.exe	2026-04-15_61940a91b55ef21c23ae0e5416519661_amadey_darkgate_elex_gcleaner_glassworm_hawkeye_smoke-loader.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	2026-04-15_61940a91b55ef21c23ae0e5416519661_amadey_darkgate_elex_gcleaner_glassworm_hawkeye_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	2026-04-15_61940a91b55ef21c23ae0e5416519661_amadey_darkgate_elex_gcleaner_glassworm_hawkeye_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-04-15_61940a91b55ef21c23ae0e5416519661_amadey_darkgate_elex_gcleaner_glassworm_hawkeye_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-04-15_61940a91b55ef21c23ae0e5416519661_amadey_darkgate_elex_gcleaner_glassworm_hawkeye_smoke-loader.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	2026-04-15_61940a91b55ef21c23ae0e5416519661_amadey_darkgate_elex_gcleaner_glassworm_hawkeye_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	2026-04-15_61940a91b55ef21c23ae0e5416519661_amadey_darkgate_elex_gcleaner_glassworm_hawkeye_smoke-loader.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	2026-04-15_61940a91b55ef21c23ae0e5416519661_amadey_darkgate_elex_gcleaner_glassworm_hawkeye_smoke-loader.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	2026-04-15_61940a91b55ef21c23ae0e5416519661_amadey_darkgate_elex_gcleaner_glassworm_hawkeye_smoke-loader.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	2026-04-15_61940a91b55ef21c23ae0e5416519661_amadey_darkgate_elex_gcleaner_glassworm_hawkeye_smoke-loader.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe	2026-04-15_61940a91b55ef21c23ae0e5416519661_amadey_darkgate_elex_gcleaner_glassworm_hawkeye_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-04-15_61940a91b55ef21c23ae0e5416519661_amadey_darkgate_elex_gcleaner_glassworm_hawkeye_smoke-loader.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	2026-04-15_61940a91b55ef21c23ae0e5416519661_amadey_darkgate_elex_gcleaner_glassworm_hawkeye_smoke-loader.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-04-15_61940a91b55ef21c23ae0e5416519661_amadey_darkgate_elex_gcleaner_glassworm_hawkeye_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	2026-04-15_61940a91b55ef21c23ae0e5416519661_amadey_darkgate_elex_gcleaner_glassworm_hawkeye_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-04-15_61940a91b55ef21c23ae0e5416519661_amadey_darkgate_elex_gcleaner_glassworm_hawkeye_smoke-loader.exe
File created	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-04-15_61940a91b55ef21c23ae0e5416519661_amadey_darkgate_elex_gcleaner_glassworm_hawkeye_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-04-15_61940a91b55ef21c23ae0e5416519661_amadey_darkgate_elex_gcleaner_glassworm_hawkeye_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-04-15_61940a91b55ef21c23ae0e5416519661_amadey_darkgate_elex_gcleaner_glassworm_hawkeye_smoke-loader.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-04-15_61940a91b55ef21c23ae0e5416519661_amadey_darkgate_elex_gcleaner_glassworm_hawkeye_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-04-15_61940a91b55ef21c23ae0e5416519661_amadey_darkgate_elex_gcleaner_glassworm_hawkeye_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-04-15_61940a91b55ef21c23ae0e5416519661_amadey_darkgate_elex_gcleaner_glassworm_hawkeye_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-04-15_61940a91b55ef21c23ae0e5416519661_amadey_darkgate_elex_gcleaner_glassworm_hawkeye_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-04-15_61940a91b55ef21c23ae0e5416519661_amadey_darkgate_elex_gcleaner_glassworm_hawkeye_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-04-15_61940a91b55ef21c23ae0e5416519661_amadey_darkgate_elex_gcleaner_glassworm_hawkeye_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-04-15_61940a91b55ef21c23ae0e5416519661_amadey_darkgate_elex_gcleaner_glassworm_hawkeye_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-04-15_61940a91b55ef21c23ae0e5416519661_amadey_darkgate_elex_gcleaner_glassworm_hawkeye_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-04-15_61940a91b55ef21c23ae0e5416519661_amadey_darkgate_elex_gcleaner_glassworm_hawkeye_smoke-loader.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-04-15_61940a91b55ef21c23ae0e5416519661_amadey_darkgate_elex_gcleaner_glassworm_hawkeye_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	2026-04-15_61940a91b55ef21c23ae0e5416519661_amadey_darkgate_elex_gcleaner_glassworm_hawkeye_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-04-15_61940a91b55ef21c23ae0e5416519661_amadey_darkgate_elex_gcleaner_glassworm_hawkeye_smoke-loader.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	2026-04-15_61940a91b55ef21c23ae0e5416519661_amadey_darkgate_elex_gcleaner_glassworm_hawkeye_smoke-loader.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	2026-04-15_61940a91b55ef21c23ae0e5416519661_amadey_darkgate_elex_gcleaner_glassworm_hawkeye_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-04-15_61940a91b55ef21c23ae0e5416519661_amadey_darkgate_elex_gcleaner_glassworm_hawkeye_smoke-loader.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	2026-04-15_61940a91b55ef21c23ae0e5416519661_amadey_darkgate_elex_gcleaner_glassworm_hawkeye_smoke-loader.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-04-15_61940a91b55ef21c23ae0e5416519661_amadey_darkgate_elex_gcleaner_glassworm_hawkeye_smoke-loader.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-04-15_61940a91b55ef21c23ae0e5416519661_amadey_darkgate_elex_gcleaner_glassworm_hawkeye_smoke-loader.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-04-15_61940a91b55ef21c23ae0e5416519661_amadey_darkgate_elex_gcleaner_glassworm_hawkeye_smoke-loader.exe

Program crash 10 IoCs

pid	pid_target	Process	procid_target
4032	5004	WerFault.exe	78
1180	5004	WerFault.exe	78
6004	4304	WerFault.exe	79
5472	4304	WerFault.exe	79
3524	2880	WerFault.exe	83
3876	2880	WerFault.exe	83
6124	3768	WerFault.exe	90
1220	3768	WerFault.exe	90
1436	3360	WerFault.exe	95
3092	3360	WerFault.exe	95

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-15_61940a91b55ef21c23ae0e5416519661_amadey_darkgate_elex_gcleaner_glassworm_hawkeye_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-15_61940a91b55ef21c23ae0e5416519661_amadey_darkgate_elex_gcleaner_glassworm_hawkeye_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-15_61940a91b55ef21c23ae0e5416519661_amadey_darkgate_elex_gcleaner_glassworm_hawkeye_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-15_61940a91b55ef21c23ae0e5416519661_amadey_darkgate_elex_gcleaner_glassworm_hawkeye_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-15_61940a91b55ef21c23ae0e5416519661_amadey_darkgate_elex_gcleaner_glassworm_hawkeye_smoke-loader.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5004	2026-04-15_61940a91b55ef21c23ae0e5416519661_amadey_darkgate_elex_gcleaner_glassworm_hawkeye_smoke-loader.exe
5004	2026-04-15_61940a91b55ef21c23ae0e5416519661_amadey_darkgate_elex_gcleaner_glassworm_hawkeye_smoke-loader.exe
4304	2026-04-15_61940a91b55ef21c23ae0e5416519661_amadey_darkgate_elex_gcleaner_glassworm_hawkeye_smoke-loader.exe
4304	2026-04-15_61940a91b55ef21c23ae0e5416519661_amadey_darkgate_elex_gcleaner_glassworm_hawkeye_smoke-loader.exe
2880	2026-04-15_61940a91b55ef21c23ae0e5416519661_amadey_darkgate_elex_gcleaner_glassworm_hawkeye_smoke-loader.exe
2880	2026-04-15_61940a91b55ef21c23ae0e5416519661_amadey_darkgate_elex_gcleaner_glassworm_hawkeye_smoke-loader.exe
3768	2026-04-15_61940a91b55ef21c23ae0e5416519661_amadey_darkgate_elex_gcleaner_glassworm_hawkeye_smoke-loader.exe
3768	2026-04-15_61940a91b55ef21c23ae0e5416519661_amadey_darkgate_elex_gcleaner_glassworm_hawkeye_smoke-loader.exe
3360	2026-04-15_61940a91b55ef21c23ae0e5416519661_amadey_darkgate_elex_gcleaner_glassworm_hawkeye_smoke-loader.exe
3360	2026-04-15_61940a91b55ef21c23ae0e5416519661_amadey_darkgate_elex_gcleaner_glassworm_hawkeye_smoke-loader.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 5004 wrote to memory of 4304	5004	2026-04-15_61940a91b55ef21c23ae0e5416519661_amadey_darkgate_elex_gcleaner_glassworm_hawkeye_smoke-loader.exe	79
PID 4304 wrote to memory of 2880	4304	2026-04-15_61940a91b55ef21c23ae0e5416519661_amadey_darkgate_elex_gcleaner_glassworm_hawkeye_smoke-loader.exe	83
PID 2880 wrote to memory of 3768	2880	2026-04-15_61940a91b55ef21c23ae0e5416519661_amadey_darkgate_elex_gcleaner_glassworm_hawkeye_smoke-loader.exe	90
PID 3768 wrote to memory of 3360	3768	2026-04-15_61940a91b55ef21c23ae0e5416519661_amadey_darkgate_elex_gcleaner_glassworm_hawkeye_smoke-loader.exe	95

C:\Users\Admin\AppData\Local\Temp\2026-04-15_61940a91b55ef21c23ae0e5416519661_amadey_darkgate_elex_gcleaner_glassworm_hawkeye_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-15_61940a91b55ef21c23ae0e5416519661_amadey_darkgate_elex_gcleaner_glassworm_hawkeye_smoke-loader.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5004
- C:\Users\Admin\AppData\Local\Temp\2026-04-15_61940a91b55ef21c23ae0e5416519661_amadey_darkgate_elex_gcleaner_glassworm_hawkeye_smoke-loader.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-04-15_61940a91b55ef21c23ae0e5416519661_amadey_darkgate_elex_gcleaner_glassworm_hawkeye_smoke-loader.exe"
  2⤵
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4304
- - C:\Users\Admin\AppData\Local\Temp\2026-04-15_61940a91b55ef21c23ae0e5416519661_amadey_darkgate_elex_gcleaner_glassworm_hawkeye_smoke-loader.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-04-15_61940a91b55ef21c23ae0e5416519661_amadey_darkgate_elex_gcleaner_glassworm_hawkeye_smoke-loader.exe"
    3⤵
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2880
  - - C:\Users\Admin\AppData\Local\Temp\2026-04-15_61940a91b55ef21c23ae0e5416519661_amadey_darkgate_elex_gcleaner_glassworm_hawkeye_smoke-loader.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-04-15_61940a91b55ef21c23ae0e5416519661_amadey_darkgate_elex_gcleaner_glassworm_hawkeye_smoke-loader.exe"
      4⤵
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:3768
    - - C:\Users\Admin\AppData\Local\Temp\2026-04-15_61940a91b55ef21c23ae0e5416519661_amadey_darkgate_elex_gcleaner_glassworm_hawkeye_smoke-loader.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-04-15_61940a91b55ef21c23ae0e5416519661_amadey_darkgate_elex_gcleaner_glassworm_hawkeye_smoke-loader.exe"
        5⤵
        Drops file in Program Files directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:3360
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3360 -s 424
        6⤵
        Program crash
        
        PID:1436
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3360 -s 464
        6⤵
        Program crash
        
        PID:3092
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3768 -s 460
        5⤵
        Program crash
        
        PID:6124
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3768 -s 460
        5⤵
        Program crash
        
        PID:1220
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2880 -s 468
      4⤵
      Program crash
      PID:3524
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2880 -s 468
      4⤵
      Program crash
      PID:3876
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4304 -s 412
    3⤵
    - Program crash
    PID:6004
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4304 -s 412
    3⤵
    - Program crash
    PID:5472
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5004 -s 432
  2⤵
  - Program crash
  PID:4032
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5004 -s 432
  2⤵
  - Program crash
  PID:1180

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5004 -ip 5004
1⤵
PID:3824

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 5004 -ip 5004
1⤵
PID:3552

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4304 -ip 4304
1⤵
PID:1288

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4304 -ip 4304
1⤵
PID:4080

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 2880 -ip 2880
1⤵
PID:4092

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 2880 -ip 2880
1⤵
PID:3932

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 3768 -ip 3768
1⤵
PID:2496

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 3768 -ip 3768
1⤵
PID:3952

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 3360 -ip 3360
1⤵
PID:596

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 3360 -ip 3360
1⤵
PID:1840

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.3MB
SHA256 48770abe319d42cbd22be265478d328263684396f8694237d4db8a3017d799b6
MD5 fb437a582345432640665e7b5c272d8e
SHA1 a6cef152060d106ebeea5dc54fa64d29cb494374
SHA512 fe3da177302780ecb64b84e32a3616a69d2a2e0187799a51b91b1da12ce5abc1d900ded2171672be35b0e2a8d4a794b82a8623d05e518a03b38ce3cea8df6aed
SSDEEP 49152:cm5tLbj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeKAaLSF259ruMHwpXMi4FqJ5:VVKQRQyi36YOcP+Lvw2gAf+PN39
TLSH
T1D6666B13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pUc11DD.tmp

Path C:\Users\Admin\AppData\Local\Temp\pUc11DD.tmp
Size 770KB
SHA256 4c13626a8a3ea552edfde825193bde5504fedf2b76948f4360248b44d11722eb
MD5 05772d399bc71d93af17da20a8d12aa2
SHA1 e91f497155d92e3c1ab971a192d4403140932925
SHA512 c4cccb98c1d7240278d08f3ed663b337a7e7fd2e5cd2399e658e4c8a4fdfd0853f60b7972e40f3c679738c1dcebde9441c3a596b43187e6f9f3c4e5d70fbad3f
SSDEEP 12288:eW4m8ntetLpm1/XZNYVLeyUji0h90ZD0wxpGZIVuKrHsF:54mWetLpwx0Le5ji0hmxNrMF
TLSH
T1C5F45C26F6B48331D073C0B9C5D2A69AE97234411B318ACB4395D76C7F677E68A36332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pUc11FF.tmp

Path C:\Users\Admin\AppData\Local\Temp\pUc11FF.tmp
Size 587KB
SHA256 cf45bae47f37723cfea1e1607619623ba8c3dfaa07b4fe8891aeb3182528c1f9
MD5 d1aabe241bc91039c828de4a4863a594
SHA1 c5af3a8e08ff99bc3b52bc90225858d4628edc54
SHA512 c490781fee31ee233fea73cb72ef26b9c96d473ae98d633f5d0384b5fa2a4e15ad91b9527a98322372fb3bce8229ea8dc01540bc0237881fcca338f80ab0b6bf
SSDEEP 12288:jW4m8ntZytLpm1dAwSfxL/2Dc3jDLLmt0LDQewsAjRp:C4mWctLpwOaewsAj7
TLSH
T18ED46A31FABCD232D3FB0DB01A6DF726143DBE240B6119E7E3A89A4D59702D12636617
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pUc11FF.tmp

Path C:\Users\Admin\AppData\Local\Temp\pUc11FF.tmp
Size 580KB
SHA256 79a28181ad4d9ba3614694edd3d5efc880d65b690de8ce8c453a0671176ad6a7
MD5 61940a91b55ef21c23ae0e5416519661
SHA1 5a82f04e4627a5c899ab5e71b8596bd37a410035
SHA512 b92b17f101427a7771fe00ef48bdec45a93315836268a37aca09088bbf817804658d5c95d156c9d5d249d60effa42b22efa2fb5689c8560e6f62a06aa032b0aa
SSDEEP 12288:eW4m8nt8tLpm1dAwSfxL/2Dc3jDLLmt0LDQewsAjRR:54mW8tLpwOaewsAjD
TLSH
T184C48C31FAB4D032D2BB0DB11B79D726543DBA200B621AC7E3E85E9D59702D12736B1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pUc1231.tmp

Path C:\Users\Admin\AppData\Local\Temp\pUc1231.tmp
Size 912KB
SHA256 a72e45a82bfa1e98f941314595afc7defdcc8557bff02583a0cabb2c882880f6
MD5 5d7aa292b4963a7e4838f687fa2162d5
SHA1 0c4db54b717c2188e47abdcb924bf7f6ed938b75
SHA512 20b4c1b66553cb596a6f395f64e832b6778a2ecd5ac972f10b84ec51e5553b2a8f287f3caaab116d84a2f1e81df0ce52cbdfa331919d3aeeb041c7c31b032979
SSDEEP 12288:pW4m8ntCtLpm1tVJjBq33vb5O8M+l1D0hwsEBoW/lx4Zf0Im98w:c4mWCtLpwtVbqPb88hv/l+7w
TLSH
T164153B66F5B4C331D073C0B9C5D2AA9AEA3234425B318ACB1385976C2E777E5D636332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pUc1244.tmp

Path C:\Users\Admin\AppData\Local\Temp\pUc1244.tmp
Size 235KB
SHA256 6e2e8b9b7dd75623b93ad55d8e35d38edcaa038de17096670369c1b405b99bfd
MD5 acba05375ba235d822258ca4ab755974
SHA1 a73e9f87a3758920dc70003c5f9f16d664923781
SHA512 a2bc664be2a9db7e00795e65e10abd04d6497d5a99e4d2fcbf339e0607cbfd48b091d1ce8224a5dc26c87be057764ccd58c4116129a960c68fffc9fcff66bee5
SSDEEP 6144:VFQ4afbQz3TOe6my2PcOq6KpCHNNIZEOHHrpm1Ta7Rp:VW4m8ntutLpm1TaL
TLSH
T12934AF36B2D4C073F2E20AB05EBDA575543EBF112B268D2B63E41E0D9E743E0591639B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pUc1257.tmp

Path C:\Users\Admin\AppData\Local\Temp\pUc1257.tmp
Size 2.3MB
SHA256 0410dae32e8c62531e4bbc837d22b37d46d97e7be9d4c1e2a3e0ec6930fda2ad
MD5 04edc49fdab65a146699afc6d1caf730
SHA1 4261c197d2fb99122bf1876c036ebe1b4c4e9325
SHA512 b70b4675efc44d7a2060ca42d8f85b18986af15b18979012c1d7f969f2eefb26d7fe3a43c6837b1a71d5b1f836f61e033e55e1ab03d07a05cb3fa7985a6ea4cc
SSDEEP 49152:QmrtL/CbRquA/m2yL5zbfFiV+XenmE3/zA:DVYoq2Vjnmf
TLSH
T15AB55B1A76A8C1B4D1F6C77886A6C647F37178154B319BEF4265460E2E33BE48E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pUc1279.tmp

Path C:\Users\Admin\AppData\Local\Temp\pUc1279.tmp
Size 502KB
SHA256 fbe300f4e7be768a24fe1a8072d1fd0f1915c95687f7d8c9c95042da7f41bbe2
MD5 d1bae8b75fb0b85da9e0efd64b7e3412
SHA1 c45e55edaeb6b93c3116bd1887c6f4e35f09513f
SHA512 209fdd57ce4f3bc1702a10c291da79cdd57cb0ae93b66fd75c428f2c960cee4d2dfe8aae362f048a9455b9d5ad95c7e2a975c16bc4a2e97a2c55905063d3d9c5
SSDEEP 6144:BFQ4afbQz3TOe6my2PcOq6KpCHNNnZEOHHrpm1DOOr/BJ/GKWWBNU6ITLBi0qttW:BW4m8nt7tLpm1WeBNUbTVO86Ub
TLSH
T173B46C3BFE68ECF2D27A4DB45AA1C600977679304F2297CBD264830DDE236E05D36916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pUc128B.tmp

Path C:\Users\Admin\AppData\Local\Temp\pUc128B.tmp
Size 268KB
SHA256 ea53a77b91f37287f0a4005cdaa410baf50f7c13e70c2e3e88c8d6fc14bf2517
MD5 83caec26c25a370e3a375c52bb96596b
SHA1 69336542fe21d2abf8e8373cba21df21eb65c9d3
SHA512 d624980d8057ee0605988a71311434824703b4a02bb5ed509d3263cfa8f4f8e1e1839f32cbbd7e2732f9fddec1eedccff328acca8993cb01b54965c893578ec7
SSDEEP 6144:BFQ4afbQz3TOe6my2PcOq6KpCHNNaZEOHHrpm1Acr0Xcp:BW4m8ntwtLpm1A0
TLSH
T19B44AD22B2D4C037E1E30BB06EB99571543EBF512E36CA2B67D46E0DAE713D05A1235B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pUc12DD.tmp

Path C:\Users\Admin\AppData\Local\Temp\pUc12DD.tmp
Size 4.4MB
SHA256 96e3597625140d4bdabd3d0aecf2307f6a75b6ed0db5a1cc081a67e696349e32
MD5 839986cbbab805ee9ca3284a628dcc30
SHA1 766d9f982a4898f39c0b1a8de68aee7d8e679052
SHA512 c72a4a2e63e5443109653fc108a347053a09c09f8a03eca677ee684aa252db8d19bd07368d380e78df89ea55d48e0c3040a8ab4374061ffa5f098c2da7cfafc6
SSDEEP 49152:9mwtL+QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJb9DN5J8Nc:lV+QvGAdlCEL8c/bRNw5C5
TLSH
T1B1264A656BE880F5E0A7D174897A8572F77A78421D32EF4F0291CA2F3F336904D29729
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pUc1350.tmp

Path C:\Users\Admin\AppData\Local\Temp\pUc1350.tmp
Size 23.8MB
SHA256 b4f22179515eae476b0782aae9c4414f0006922bf01fa5ad5579e7af47f7574b
MD5 0c2f29811a7ff86ec73f2e742d8c1e87
SHA1 941e25c35ca5b18940f9025df1152f38ba9fa942
SHA512 a6c672c484f289e8d060ad4c63408d8fac117ec90f9efd1d7fae54f313e695e3b502625d4eeceadb21bfac83b34b4acf339a553b04b9b65b2adec83afc7413d3
SSDEEP 196608:5VSUEtQeTbvf2zlO12sJTv6Ja1cpVLyXIldPlbuJH3:vSUEtQevvqc2W1cpV2XI323
TLSH
T1D9474A91BBE843E2E3A6953484B182B6FBB17C0E1F36A73B1179F21E1F376905D15221
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pUc144C.tmp

Path C:\Users\Admin\AppData\Local\Temp\pUc144C.tmp
Size 805KB
SHA256 101f439e0a60169c374f79c5844bd3b6595c404f35c3de9f34e82c27e8700a1d
MD5 d792bcc57bd2329326d38123a5f9c5c2
SHA1 0a3cc00a909bee551417375ea1de4a9dacff4b57
SHA512 5375029c7168330f75a8845df31db795d8b49e4569606f41dc85d131d6df48138fb4499d24cb898ff43ee536f2d155a92edd8e0378e86f2529aae5a1d82ee8ed
SSDEEP 12288:fW4m8ntJ9YaYFzAZ/GLAIFoiwtA5qy97S9uaYFLq3Oj:+4mWJsAhGLAIFoiwtA5l7S53e
TLSH
T135053A91E7F545E4F5F39AB89DBA9171A976BCA51E30C20F2260960F0E33A909D24733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pUc145F.tmp

Path C:\Users\Admin\AppData\Local\Temp\pUc145F.tmp
Size 478KB
SHA256 527ed5223d375c26f0c6bd2cf9409a7856af33bf23a159b48b6316937c058c93
MD5 3432de200d267fc3c20fd5dc9a0b57e6
SHA1 646cdfc309e7e3656e40023bb29cd15b4790aa97
SHA512 60d2b94defb41c9c5c3b9e695599c2d5c8e30c2f06515c01fb914e27699d5ad331862bc864e819abd8169e5a107fbe2ab42f708d85d332ddd2aa97ef42366be9
SSDEEP 12288:dW4m8ntZtLpm1Lmw5HEjsChNVBFgl0WDm+Ch:g4mWZtLpwKwukOWG
TLSH
T13FA4AF5673E448F6E5A3467489ABD132F6BBBD112B21CB1F13A0CA1E5F333A06D1A351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pUc1472.tmp

Path C:\Users\Admin\AppData\Local\Temp\pUc1472.tmp
Size 317KB
SHA256 ff0f17c74aa45cffc612bc41a826ba3993b6b3e488c370d241efbae1fd4a4403
MD5 9e3fddc2371436142b43cf659333eea7
SHA1 e0c84c0fb725717dc72dec60ac59a27b87b15cf3
SHA512 78bb0856cf09c245acd6a9ac08af49302d532b73cae23def91ec8a8ac52f0a5e2136eaa184149f8432b5a8fa8871ca9b9aa1ea680d0d53b262882ead1b5b65c2
SSDEEP 6144:jFQ4afbQz3TOe6my2PcOq6KpCHNN3ZEOHHrpm1J57L2DTH0Z1Ie8YDfva8p:jW4m8ntrtLpm1JrZ1IyB
TLSH
T18364BE2673E490B6E1E306B48DF99661963ABD112B328BDF23A00E1D5F717D01D3636B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pUc1484.tmp

Path C:\Users\Admin\AppData\Local\Temp\pUc1484.tmp
Size 393KB
SHA256 b00feae32f80eedc73ed7ce720bc146a9e9a86f568813769ac70cd5f1a417eb2
MD5 8a82797814cfbb3498658320396808bb
SHA1 2977495c322183521467eb108998104e12d0a9ca
SHA512 161d56ac7e738bca0587f73f70ed969aa0fd2e72e0ecde6e2b56543d12dfa8c93953703e49054ffb7d419ef8b476fddd85303022e6d86a5e34da2fb756c40025
SSDEEP 6144:lFQ4afbQz3TOe6my2PcOq6KpCHNNxHHrpm1s3psmeI+sQFqT3QLp:lW4m8nt3Lpm17Xsf34
TLSH
T14E848D2AE2D441F6D0AE1270CBA99661B2377D2157E1C2CB63D0FA3D0F752906DEA353
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pUc1497.tmp

Path C:\Users\Admin\AppData\Local\Temp\pUc1497.tmp
Size 277KB
SHA256 6f16fdf76fd00d8d5fb31e9327fd28bd71ab3d434a7e45e5ecfed7073e413714
MD5 6b0797590a1b79475b7869c3881e05ec
SHA1 e56b933fdd26f9b3dc5d754217de5cbfe48076cc
SHA512 ca71d85b233bb7f49632a50ba9f9a497af82f786a98d5312685d276633665d5a3c4077316d4c8f01a6369d6fe8838be954c28fa2b320e382c4bb94e143cced40
SSDEEP 6144:TFQ4afbQz3TOe6my2PcOq6KpCHNNOZEOHHrpm1AJmp:TW4m8ntEtLpm1Ae
TLSH
T17754CF36B2E4C0B3E1A306B04DB99672A43EFF112B22899F57E45E0D5E713D05E2635B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pUc14B9.tmp

Path C:\Users\Admin\AppData\Local\Temp\pUc14B9.tmp
Size 285KB
SHA256 d7e4ed174f5d877394b50294dbc453b90b7d606c6712e83badd07d93291b6c8b
MD5 8592076bb7328f2e64eba28267f9a47d
SHA1 ce5cd0e9331f53501d4e639726d6d7a6372f252b
SHA512 a26d8d4a07a05adf4eabedce7699f36a507b7e634d0e54c268f1211d299befaa0c8dba9dfe9a48de75593e449a504a3f6a69d5ddbab0f39d23482a8bd12164bd
SSDEEP 6144:kFQ4afbQz3TOe6my2PcOq6KpCHNNdZEOHHrpm1Sk3nkraVT6p:kW4m8nt9tLpm1Sqnkrai
TLSH
T19154C03272D4C0B7E1A306B04DBAA671A43EFE111B228DAF57E45E0D5E717E05D2638B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pUc14CC.tmp

Path C:\Users\Admin\AppData\Local\Temp\pUc14CC.tmp
Size 281KB
SHA256 9bcf1733971d2c7ce933779b7f4fa5ca5d4842d27f3bf9907e5b8b333f35f513
MD5 fd56434e26c083c5c0b3c9c1a87ec863
SHA1 ec88944154a0bf825544b4dde86e29030db1f028
SHA512 d4a06af4ff803f861f462623785131929f8580f39f0a215b7212662ba6d904126d4798e3c649ac5cbaeadb67bc799d59e1a41fcb75bbfb03e4a1c547356f5439
SSDEEP 6144:kFQ4afbQz3TOe6my2PcOq6KpCHNN+ZEOHHrpm1Qpw5ySuJQXSp:kW4m8nt0tLpm1QpIyvJR
TLSH
T16854BF7672D4C0B7E1A306F04EBAA576943EFE111B2289AF53E40E0D5E713E05D2639B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pUc151D.tmp

Path C:\Users\Admin\AppData\Local\Temp\pUc151D.tmp
Size 3.3MB
SHA256 55275a97feaeed4f35e001f02ccd85215c6e72a05e409502c7a96cdd706b7407
MD5 50be41d513b6473d66e3c8d83c8e3415
SHA1 36a0c619ae5f87ed4878e16f7a78ebd1c2f44823
SHA512 225b55099d9d5badc5bf30b656eda9ca556303ccb21b5b364308933547905c3f0f2db405a6eafeeb074a92769a9839dc5b84f9bdcc805add6d6aeee16773747f
SSDEEP 49152:Rm0GyLSrJhMeJNvjLAE3dGGj8b2EGcjesaNkYQd0XNJKcvaAcPTY6Y5AT:9m7vj1BDlZm
TLSH
T15DF59D13F2D940E9D059C078875A9232EA72BC494B3166DF0790BB562F77BE06B3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pUc152F.tmp

Path C:\Users\Admin\AppData\Local\Temp\pUc152F.tmp
Size 1.6MB
SHA256 e044eb6610a8d7f3fbea93d70f33a32dcbfa6eeee2fd77343465e46a96506ab7
MD5 4970756d59d793401e5d1edd03e08459
SHA1 a1c13539ad4c187692dafa848d8ee58d66ce62f8
SHA512 9fb417bbcd7a0963ba936e2183f40f13be5707e65c7896090e30834f255db1dadb6b30cba4413b0863802e9d573a0f0e79f6936b3f1c252e138fa1e4ebb974b0
SSDEEP 24576:u4mWPtLpwGhiavrPSLT8EARn+FgyUgd0fJY6B1i3iy9CTn0AP5+2QLJ:9mgtLhhtSn8EApI0fig1giDn0AP5w1
TLSH
T1F4858C13F2D940E8D06AC1B4C7568632E972BC150B35AAEF0B90B7561E7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pUc1542.tmp

Path C:\Users\Admin\AppData\Local\Temp\pUc1542.tmp
Size 2.2MB
SHA256 769544dd24f15897d64fe79df9e85296359413a60ebfa5aadeb0d2b81cd9babc
MD5 923dc90a86512b0dfcf009254df49fd3
SHA1 385f80637bf4e73ceee25afd0a80bbf18a8faaa1
SHA512 9de2bb150d50813124ee05a0d56fc77c68537684e9ae408eba555a6164eb277e1d93fc4b4abff0789fdae45396f63217172a326a9d9ad1af55f25467183deb0d
SSDEEP 24576:l4mWwtLpwewvLof6SRQ+rn/fDboqxN1nnh6z7DaHGTNHu7PNU3/5W/ohL0z:imvtLz68Qg55nhoeWu7PNU3/2
TLSH
T1CEB5913772F300A9C48DA576AF5A972192D17CB1CFE1D3DB8115320A1BB29D07A3A61F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pUc1564.tmp

Path C:\Users\Admin\AppData\Local\Temp\pUc1564.tmp
Size 3.7MB
SHA256 9d3c8164d84e203cce04a539ac62cc61bf71c1f28fbd713c2792ba3e42de3253
MD5 b154962bd9aaf92bc42d833e1a4b7333
SHA1 d88782dfdfff008eaefb24ea87fdb2bef1a4464e
SHA512 5ef00c83fbe7f0a3656e88ce969da682f84fe5e2d4c1286b3ce339b32a10caf8100a8265a73777783c3095f58d807f76f33f5826a1e12a01e834c6391bde8a39
SSDEEP 49152:5mEtLN3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbgN3Oh6tznm2FQ/nho2qJ:JVcy5112gYy5azzVvf69nLKnhZg
TLSH
T1EB067B13F29900E8D05DD1B8878A9232E972BC474B35A6DF0A5077562F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pUc1577.tmp

Path C:\Users\Admin\AppData\Local\Temp\pUc1577.tmp
Size 2.5MB
SHA256 97d88dfdfe3e719504789141d3f3011ff12aef53da73ba76c8e92380ed41e1c8
MD5 c121583719cb69098f91b7c5e9986f9e
SHA1 ebb709a89d38e46380324087dcc00412ec8a7148
SHA512 28412bda3512181131702b49a8255b9245e3d7032e99ed3afb6cd1c83ed0b4e9d55ca2b1a0811f5cbbe3357d12d05623160a4bfd969d7e3686b3dc0674a132cf
SSDEEP 49152:dmgtLsB+taZ3usBWOBr4tEGW0bqx0z+n217aau1glC:ZVmu6Jm0xd2dC
TLSH
T134C58C13F2D901E8D06AD478974A9232E972BC090B35B6EF0B9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pUc158A.tmp

Path C:\Users\Admin\AppData\Local\Temp\pUc158A.tmp
Size 1.8MB
SHA256 3d183b509607c58b248e39794afdb3eb4cb6a457c221b7b9222dcc19dfc83306
MD5 4cc8af025c22c77b13d747f52748c5e3
SHA1 2362fa074e1a8c8ff90dbf0656cd8e92106485df
SHA512 c24a0c0e83fe1aa65029dc9180008829ce6385d5e7d7ba70f7aa1404ff3cac3d97a7c8c57c62ef4b0e215fc43d1d74fb80ea791c0ebc00029cf3754a3545b635
SSDEEP 24576:o4mWktLpwHhv8E1hps0+ogd2z615uCMVF1Agz6hUQ1zNOgLLwH7ReaQXx33:Lm7tLm1hpsNoJpF1A6GU44CwH7R4xn
TLSH
T185958C13F2D840F8D06AC1788B5A9232EA76BC450B35A6DF069077961F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pUc159C.tmp

Path C:\Users\Admin\AppData\Local\Temp\pUc159C.tmp
Size 2.1MB
SHA256 761bd83416fb0137007ebdfc339f1195b7b857820df4dc14cfe8c08795fbf0ec
MD5 2dbaa612c49d635011ccd3f02c587e38
SHA1 c1f2ea83f1d8b5448177e5e7285ef64b41c10601
SHA512 321a063de2ea05c8c009e90b421e0ea042f2be087b13932fe0280a9368e15adffa7a6fd1a611655b6bd35f741d25540aa59d45e3ae92f55e35ec960782b22b9d
SSDEEP 24576:n4mWbtLpwc4BvWw7fuwWQsBZFAfPSPa/0BeHWxE6bR04FxGgVG2Onks6xt4bSMHV:4mktLfSuZQIY0Be2K8RVtOnks6NMHqm
TLSH
T170A58D13F2E940E8E0BED6748B659236EA72BC454B34A6DF064072591E77FE05B3D322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pUc15BE.tmp

Path C:\Users\Admin\AppData\Local\Temp\pUc15BE.tmp
Size 6.3MB
SHA256 3ca6d1318490da5f0901dd4af51634d7cd5627a8256a38ab5d9a993b9e86fef6
MD5 97688c1680e023403d80b378c814e6fa
SHA1 505472e03fb952e3e683f2abf3c6528a61d6aafd
SHA512 c22904ef8688f01046ce8724265f7db1d84adaf2a147f6609ebafb79f3d0bd8ad41c701f02397d6484158f3d070d39e69ed0f8fc8a6214ec01546afe07e772ef
SSDEEP 49152:cmItLbj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeKAaLSF259ruMHwpXMi4FqJ5:sVKQRQyi36YOcP+Lvw2gAf+PN39
TLSH
T114666B13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pUc1E80.tmp

Path C:\Users\Admin\AppData\Local\Temp\pUc1E80.tmp
Size 654KB
SHA256 5e3647c1a2416bb9146dd65597001db44a2c593db60787ad277fe7a8324498a9
MD5 ee177b231baef75a1eb0012bbe158a05
SHA1 444cf32576e77f74993d43ffdba692e5e179b7bc
SHA512 0eaeb163da3e4f9fb370df80dfa87fa2bf50fc20eb4e520deea6adc8dcc065a713f25975e3b532e27e231f98d5181d032f0885b6f4ae7cc8259283d33fc9134c
SSDEEP 12288:xW4m8ntBtLpm1dAwSfxL/2Dc3jDLLmt0LDQewsAjRP:04mWBtLpwOaewsAjJ
TLSH
T1B5E45A31BAB4D432D2BB0DB01A69D726543DBA200B63CDC7E3A85E4D7B702D1273665E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pUc1E95.tmp

Path C:\Users\Admin\AppData\Local\Temp\pUc1E95.tmp
Size 600KB
SHA256 ec0557534e5e58ef10e16d7a7c70fe26be14269239863167ec98dad5a5361599
MD5 ddfe788af5b053ed53cf451de0cc0c8c
SHA1 740ad92d644076c049eab0ae66b00c040ba2013b
SHA512 66b9f71347e8dc06b787929ff868e6f24712e11d7ebc1f52228c655d0386056c8751c4f3dbd24efb71d69fc216165d846ee84f5190a9deb9c821861fb59fa741
SSDEEP 12288:YW4m8ntUo5XzAwSfxL/2Dc3jDLLmt0LDQewsAjR6:v4mWUo58aewsAjc
TLSH
T174D47B31FAB4D036D2BB0DB01B7AD726583DBE200B6119C7E3E85A9D99702D12736B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pUc1E98.tmp

Path C:\Users\Admin\AppData\Local\Temp\pUc1E98.tmp
Size 608KB
SHA256 7dbb3a884f6a3377abfe570724afe29b830c7786deb7a1c667f67f77e0c97f8f
MD5 5a5da54144d8bc7c3b3052878be095b6
SHA1 57e6df7a6e1a235afe6b02f1c4f0155c9daf5785
SHA512 8681092c5f640c3a1309f44a0f8b19c0fb85a06827d8ea4c8440e57ddd4c4ee7b2a54c50a770254cc01a787d6dac8bc2f1e647783f49090712b82e6ca87fdb1e
SSDEEP 12288:jW4m8ntfLpm1dAwSfxL/2Dc3jDLLmt0LDQewsAjRx:C4mWfLpwOaewsAjT
TLSH
T18CD45A21BAB4D032D2BB09B11E6BD7261C39BE604F6119C7F3F87B8E5D702D12636616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pUc1EAB.tmp

Path C:\Users\Admin\AppData\Local\Temp\pUc1EAB.tmp
Size 577KB
SHA256 26bf0f2cd9d355b8fc754318c339c2fbec0dd5d8adc435a47b846bcf0b8775db
MD5 0bf3ca4ba4e345719b3d33cf17d12321
SHA1 8dbacad111020e1555d447cb5b620fd142b63bc8
SHA512 052ef21c5841430fe2efe5a379e79d915b63314a8ae3cfc165c60ec3b2138aea8238ac7ce7c6732e2634d8642fcda65bca8956c312000e6f28a443ea156aca2a
SSDEEP 12288:+W4m8ntYtLpm1dAwSfxL/2Dc3jDLLmt0LDQewsAjR/:Z4mWYtLpwOaewsAj5
TLSH
T14AC48C31FAB4D036D2BB0DB11B7AD726583DBA200B611AC7E3E85E8D59702D12736B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2880-691-0x0000000000400000-0x000000000049B000-memory.dmp

Download

memory/2880-692-0x00000000008E0000-0x00000000009F2000-memory.dmp

Download

memory/3360-752-0x0000000000A80000-0x0000000000B92000-memory.dmp

Download

memory/3360-751-0x0000000000400000-0x000000000049B000-memory.dmp

Download

memory/3768-744-0x0000000000A80000-0x0000000000B92000-memory.dmp

Download

memory/3768-743-0x0000000000400000-0x000000000049B000-memory.dmp

Download

memory/4304-573-0x0000000000A00000-0x0000000000B12000-memory.dmp

Download

memory/4304-572-0x0000000000400000-0x000000000049B000-memory.dmp

Download

memory/5004-574-0x00000000008B0000-0x00000000009C2000-memory.dmp

Download

memory/5004-462-0x0000000000400000-0x000000000049B000-memory.dmp

Download