aa7278d9909effa481d2afc73c6c57b9ffa5befac95e7d4c27569ea86abbbe8e

Analysis

max time kernel
148s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/04/2026, 03:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-20_15db559565fd2cb6664ca9247fd283f7_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
Size 623KB
Sample260420-egdnhact4x
SHA256 aa7278d9909effa481d2afc73c6c57b9ffa5befac95e7d4c27569ea86abbbe8e
MD5 15db559565fd2cb6664ca9247fd283f7
SHA1 9618da888d23029563377d75c034e9462c3fe98c
SHA512 52c45c315a5706db5822a6ff4d74e740745c29300a75aae814db5fe36359651f8d09a34814f27021fa9e1797c3e0baa9b2dcceb40ce5452121bc4064413f1da4
SSDEEP 12288:FW4m8ntq04D+k3HVJ5xDfp4D7/SAOZi+5v4+rcKftR:Y4mW7qJVJTt4D7/SAOZi+5v48cKfv
TLSH
T1A8D48E25B3F044F5E1B7A238CE664621E976BC155B30D24F23A86A5D1F33760ED3A722
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	2026-04-20_15db559565fd2cb6664ca9247fd283f7_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-04-20_15db559565fd2cb6664ca9247fd283f7_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	2026-04-20_15db559565fd2cb6664ca9247fd283f7_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-04-20_15db559565fd2cb6664ca9247fd283f7_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	2026-04-20_15db559565fd2cb6664ca9247fd283f7_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-04-20_15db559565fd2cb6664ca9247fd283f7_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	2026-04-20_15db559565fd2cb6664ca9247fd283f7_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	2026-04-20_15db559565fd2cb6664ca9247fd283f7_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-04-20_15db559565fd2cb6664ca9247fd283f7_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	2026-04-20_15db559565fd2cb6664ca9247fd283f7_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-04-20_15db559565fd2cb6664ca9247fd283f7_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-04-20_15db559565fd2cb6664ca9247fd283f7_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-04-20_15db559565fd2cb6664ca9247fd283f7_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	2026-04-20_15db559565fd2cb6664ca9247fd283f7_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-04-20_15db559565fd2cb6664ca9247fd283f7_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-04-20_15db559565fd2cb6664ca9247fd283f7_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	2026-04-20_15db559565fd2cb6664ca9247fd283f7_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File created	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-04-20_15db559565fd2cb6664ca9247fd283f7_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	2026-04-20_15db559565fd2cb6664ca9247fd283f7_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-04-20_15db559565fd2cb6664ca9247fd283f7_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-04-20_15db559565fd2cb6664ca9247fd283f7_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-04-20_15db559565fd2cb6664ca9247fd283f7_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-04-20_15db559565fd2cb6664ca9247fd283f7_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	2026-04-20_15db559565fd2cb6664ca9247fd283f7_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-04-20_15db559565fd2cb6664ca9247fd283f7_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-04-20_15db559565fd2cb6664ca9247fd283f7_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-04-20_15db559565fd2cb6664ca9247fd283f7_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	2026-04-20_15db559565fd2cb6664ca9247fd283f7_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-04-20_15db559565fd2cb6664ca9247fd283f7_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-04-20_15db559565fd2cb6664ca9247fd283f7_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-04-20_15db559565fd2cb6664ca9247fd283f7_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	2026-04-20_15db559565fd2cb6664ca9247fd283f7_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-04-20_15db559565fd2cb6664ca9247fd283f7_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-04-20_15db559565fd2cb6664ca9247fd283f7_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	2026-04-20_15db559565fd2cb6664ca9247fd283f7_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-04-20_15db559565fd2cb6664ca9247fd283f7_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	2026-04-20_15db559565fd2cb6664ca9247fd283f7_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	2026-04-20_15db559565fd2cb6664ca9247fd283f7_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-04-20_15db559565fd2cb6664ca9247fd283f7_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File created	C:\Program Files\Internet Explorer\ExtExport.exe	2026-04-20_15db559565fd2cb6664ca9247fd283f7_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-04-20_15db559565fd2cb6664ca9247fd283f7_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	2026-04-20_15db559565fd2cb6664ca9247fd283f7_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-04-20_15db559565fd2cb6664ca9247fd283f7_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-04-20_15db559565fd2cb6664ca9247fd283f7_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-04-20_15db559565fd2cb6664ca9247fd283f7_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-04-20_15db559565fd2cb6664ca9247fd283f7_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-04-20_15db559565fd2cb6664ca9247fd283f7_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-04-20_15db559565fd2cb6664ca9247fd283f7_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-04-20_15db559565fd2cb6664ca9247fd283f7_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	2026-04-20_15db559565fd2cb6664ca9247fd283f7_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	2026-04-20_15db559565fd2cb6664ca9247fd283f7_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-04-20_15db559565fd2cb6664ca9247fd283f7_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-04-20_15db559565fd2cb6664ca9247fd283f7_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	2026-04-20_15db559565fd2cb6664ca9247fd283f7_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-04-20_15db559565fd2cb6664ca9247fd283f7_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-04-20_15db559565fd2cb6664ca9247fd283f7_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	2026-04-20_15db559565fd2cb6664ca9247fd283f7_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	2026-04-20_15db559565fd2cb6664ca9247fd283f7_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-04-20_15db559565fd2cb6664ca9247fd283f7_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe	2026-04-20_15db559565fd2cb6664ca9247fd283f7_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-04-20_15db559565fd2cb6664ca9247fd283f7_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-04-20_15db559565fd2cb6664ca9247fd283f7_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	2026-04-20_15db559565fd2cb6664ca9247fd283f7_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe	2026-04-20_15db559565fd2cb6664ca9247fd283f7_darkgate_elex_gcleaner_icedid_njrat_vidar.exe

Program crash 16 IoCs

pid	pid_target	Process	procid_target
5888	4324	WerFault.exe	83
5904	4324	WerFault.exe	83
5868	3488	WerFault.exe	84
5920	3488	WerFault.exe	84
1112	3412	WerFault.exe	90
2348	3412	WerFault.exe	90
2012	4900	WerFault.exe	95
968	4900	WerFault.exe	95
5496	4400	WerFault.exe	115
5476	4400	WerFault.exe	115
2700	2404	WerFault.exe	106
3896	2404	WerFault.exe	106
4116	4580	WerFault.exe	111
3512	4580	WerFault.exe	111
5732	5060	WerFault.exe	114
2160	5060	WerFault.exe	114

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-20_15db559565fd2cb6664ca9247fd283f7_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-20_15db559565fd2cb6664ca9247fd283f7_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-20_15db559565fd2cb6664ca9247fd283f7_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-20_15db559565fd2cb6664ca9247fd283f7_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-20_15db559565fd2cb6664ca9247fd283f7_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-20_15db559565fd2cb6664ca9247fd283f7_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-20_15db559565fd2cb6664ca9247fd283f7_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-20_15db559565fd2cb6664ca9247fd283f7_darkgate_elex_gcleaner_icedid_njrat_vidar.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
4324	2026-04-20_15db559565fd2cb6664ca9247fd283f7_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
4324	2026-04-20_15db559565fd2cb6664ca9247fd283f7_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
3488	2026-04-20_15db559565fd2cb6664ca9247fd283f7_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
3488	2026-04-20_15db559565fd2cb6664ca9247fd283f7_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
3412	2026-04-20_15db559565fd2cb6664ca9247fd283f7_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
3412	2026-04-20_15db559565fd2cb6664ca9247fd283f7_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
4900	2026-04-20_15db559565fd2cb6664ca9247fd283f7_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
4900	2026-04-20_15db559565fd2cb6664ca9247fd283f7_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
2404	2026-04-20_15db559565fd2cb6664ca9247fd283f7_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
2404	2026-04-20_15db559565fd2cb6664ca9247fd283f7_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
4580	2026-04-20_15db559565fd2cb6664ca9247fd283f7_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
4580	2026-04-20_15db559565fd2cb6664ca9247fd283f7_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
5060	2026-04-20_15db559565fd2cb6664ca9247fd283f7_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
5060	2026-04-20_15db559565fd2cb6664ca9247fd283f7_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
4400	2026-04-20_15db559565fd2cb6664ca9247fd283f7_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
4400	2026-04-20_15db559565fd2cb6664ca9247fd283f7_darkgate_elex_gcleaner_icedid_njrat_vidar.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4324 wrote to memory of 3488	4324	2026-04-20_15db559565fd2cb6664ca9247fd283f7_darkgate_elex_gcleaner_icedid_njrat_vidar.exe	84
PID 3488 wrote to memory of 3412	3488	2026-04-20_15db559565fd2cb6664ca9247fd283f7_darkgate_elex_gcleaner_icedid_njrat_vidar.exe	90
PID 3412 wrote to memory of 4900	3412	2026-04-20_15db559565fd2cb6664ca9247fd283f7_darkgate_elex_gcleaner_icedid_njrat_vidar.exe	95
PID 4900 wrote to memory of 2404	4900	2026-04-20_15db559565fd2cb6664ca9247fd283f7_darkgate_elex_gcleaner_icedid_njrat_vidar.exe	106
PID 2404 wrote to memory of 4580	2404	2026-04-20_15db559565fd2cb6664ca9247fd283f7_darkgate_elex_gcleaner_icedid_njrat_vidar.exe	111
PID 4580 wrote to memory of 5060	4580	2026-04-20_15db559565fd2cb6664ca9247fd283f7_darkgate_elex_gcleaner_icedid_njrat_vidar.exe	114
PID 5060 wrote to memory of 4400	5060	2026-04-20_15db559565fd2cb6664ca9247fd283f7_darkgate_elex_gcleaner_icedid_njrat_vidar.exe	115

C:\Users\Admin\AppData\Local\Temp\2026-04-20_15db559565fd2cb6664ca9247fd283f7_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-20_15db559565fd2cb6664ca9247fd283f7_darkgate_elex_gcleaner_icedid_njrat_vidar.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4324
- C:\Users\Admin\AppData\Local\Temp\2026-04-20_15db559565fd2cb6664ca9247fd283f7_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-04-20_15db559565fd2cb6664ca9247fd283f7_darkgate_elex_gcleaner_icedid_njrat_vidar.exe"
  2⤵
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3488
- - C:\Users\Admin\AppData\Local\Temp\2026-04-20_15db559565fd2cb6664ca9247fd283f7_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-04-20_15db559565fd2cb6664ca9247fd283f7_darkgate_elex_gcleaner_icedid_njrat_vidar.exe"
    3⤵
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:3412
  - - C:\Users\Admin\AppData\Local\Temp\2026-04-20_15db559565fd2cb6664ca9247fd283f7_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-04-20_15db559565fd2cb6664ca9247fd283f7_darkgate_elex_gcleaner_icedid_njrat_vidar.exe"
      4⤵
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:4900
    - - C:\Users\Admin\AppData\Local\Temp\2026-04-20_15db559565fd2cb6664ca9247fd283f7_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-04-20_15db559565fd2cb6664ca9247fd283f7_darkgate_elex_gcleaner_icedid_njrat_vidar.exe"
        5⤵
        Drops file in Program Files directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:2404
      - C:\Users\Admin\AppData\Local\Temp\2026-04-20_15db559565fd2cb6664ca9247fd283f7_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-04-20_15db559565fd2cb6664ca9247fd283f7_darkgate_elex_gcleaner_icedid_njrat_vidar.exe"
        6⤵
        Drops file in Program Files directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:4580
        
        C:\Users\Admin\AppData\Local\Temp\2026-04-20_15db559565fd2cb6664ca9247fd283f7_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-04-20_15db559565fd2cb6664ca9247fd283f7_darkgate_elex_gcleaner_icedid_njrat_vidar.exe"
        7⤵
        Drops file in Program Files directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:5060
        
        C:\Users\Admin\AppData\Local\Temp\2026-04-20_15db559565fd2cb6664ca9247fd283f7_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-04-20_15db559565fd2cb6664ca9247fd283f7_darkgate_elex_gcleaner_icedid_njrat_vidar.exe"
        8⤵
        Drops file in Program Files directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:4400
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4400 -s 360
        9⤵
        Program crash
        
        PID:5496
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4400 -s 360
        9⤵
        Program crash
        
        PID:5476
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5060 -s 440
        8⤵
        Program crash
        
        PID:5732
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5060 -s 440
        8⤵
        Program crash
        
        PID:2160
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4580 -s 440
        7⤵
        Program crash
        
        PID:4116
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4580 -s 440
        7⤵
        Program crash
        
        PID:3512
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2404 -s 392
        6⤵
        Program crash
        
        PID:2700
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2404 -s 392
        6⤵
        Program crash
        
        PID:3896
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4900 -s 384
        5⤵
        Program crash
        
        PID:2012
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4900 -s 384
        5⤵
        Program crash
        
        PID:968
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3412 -s 440
      4⤵
      Program crash
      PID:1112
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3412 -s 440
      4⤵
      Program crash
      PID:2348
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3488 -s 440
    3⤵
    - Program crash
    PID:5868
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3488 -s 440
    3⤵
    - Program crash
    PID:5920
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4324 -s 468
  2⤵
  - Program crash
  PID:5888
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4324 -s 468
  2⤵
  - Program crash
  PID:5904

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4324 -ip 4324
1⤵
PID:3180

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 4324 -ip 4324
1⤵
PID:2520

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 3488 -ip 3488
1⤵
PID:4352

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 3488 -ip 3488
1⤵
PID:3336

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 3412 -ip 3412
1⤵
PID:2392

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 3412 -ip 3412
1⤵
PID:4116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 4900 -ip 4900
1⤵
PID:6036

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 4900 -ip 4900
1⤵
PID:1996

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 4400 -ip 4400
1⤵
PID:4784

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 4400 -ip 4400
1⤵
PID:1520

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 2404 -ip 2404
1⤵
PID:1736

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 2404 -ip 2404
1⤵
PID:3928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 4580 -ip 4580
1⤵
PID:2184

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4580 -ip 4580
1⤵
PID:3316

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 5060 -ip 5060
1⤵
PID:640

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 5060 -ip 5060
1⤵
PID:376

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

chrome.exe

Path C:\Program Files\Google\Chrome\Application\chrome.exe
Size 3.3MB
SHA256 55275a97feaeed4f35e001f02ccd85215c6e72a05e409502c7a96cdd706b7407
MD5 50be41d513b6473d66e3c8d83c8e3415
SHA1 36a0c619ae5f87ed4878e16f7a78ebd1c2f44823
SHA512 225b55099d9d5badc5bf30b656eda9ca556303ccb21b5b364308933547905c3f0f2db405a6eafeeb074a92769a9839dc5b84f9bdcc805add6d6aeee16773747f
SSDEEP 49152:Rm0GyLSrJhMeJNvjLAE3dGGj8b2EGcjesaNkYQd0XNJKcvaAcPTY6Y5AT:9m7vj1BDlZm
TLSH
T15DF59D13F2D940E9D059C078875A9232EA72BC494B3166DF0790BB562F77BE06B3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX7926.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCX7926.tmp
Size 1.8MB
SHA256 ccc398aa7a9bac95dd1d046ab13c0c52d0a965821b128f01debd11fced7dc281
MD5 ea7cc05fb04082adaf498d5143509819
SHA1 89c606e50ec6a1592409feb0e377ce1c97b7e97d
SHA512 49dc48283776dc90e6d0f5fa8f6c5392264cbfc33e48b39359e67c9bd1893098a91d11b9fdc9cad06462bdcf6601323d8f07e301f51ec30e7e3e2f3e4671578c
SSDEEP 24576:F4mWQJhv8E1hps0+ogd2z615uCMVF1Agz6hUQ1zNOgLLwH7ReaQXx3d:CmJL1hpsNoJpF1A6GU44CwH7R4xN
TLSH
T133958D13F2D840E8D05AD1788B569232EA72BC450B34A6DF06907B9A2F77BE46F3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pUc105.tmp

Path C:\Users\Admin\AppData\Local\Temp\pUc105.tmp
Size 741KB
SHA256 afa0071cb4821b3f3c077adb75253f80c62d5bb9d6bbb5efeed786b310c96e45
MD5 90a4517cb4024b6f2082537cb5567866
SHA1 b047e397c1282bf56b1f65efa860973d86b66e47
SHA512 2f783d4aa91f706b47ed1bed6235817682fef5551740e09a47f357038be0c283857520273999b6ca0d46139ca8723e50be0a8bd996b48745322e6e55de5d91fe
SSDEEP 12288:FW4m8ntw0ZXZNYVLeyUji0h90ZD0wxpGZIVuKrHsf:Y4mWtv0Le5ji0hmxNrMf
TLSH
T144F42926F6B48331D073C0B9C9D2A69AE93278411B3089CB5385DB6C7E776E6D536332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pUc127.tmp

Path C:\Users\Admin\AppData\Local\Temp\pUc127.tmp
Size 623KB
SHA256 aa7278d9909effa481d2afc73c6c57b9ffa5befac95e7d4c27569ea86abbbe8e
MD5 15db559565fd2cb6664ca9247fd283f7
SHA1 9618da888d23029563377d75c034e9462c3fe98c
SHA512 52c45c315a5706db5822a6ff4d74e740745c29300a75aae814db5fe36359651f8d09a34814f27021fa9e1797c3e0baa9b2dcceb40ce5452121bc4064413f1da4
SSDEEP 12288:FW4m8ntq04D+k3HVJ5xDfp4D7/SAOZi+5v4+rcKftR:Y4mW7qJVJTt4D7/SAOZi+5v48cKfv
TLSH
T1A8D48E25B3F044F5E1B7A238CE664621E976BC155B30D24F23A86A5D1F33760ED3A722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pUc13A.tmp

Path C:\Users\Admin\AppData\Local\Temp\pUc13A.tmp
Size 884KB
SHA256 6b4025c8a43b223918359208d37be3d3f87f763542e97f8d7b44ce35c3c0df71
MD5 e67a5e7ffaef0cab523ff2f676b671c2
SHA1 091e0404b31c5fdc80cb1c50445be8e4f9ed2d69
SHA512 b8c4847cbcaef287031669ac606f19994e4b666297965aa4432ba96c8bb3dd131219f84aa4eecc9f626bb6da805e33c4e62913db9f396465974c12f98a267a7d
SSDEEP 12288:hW4m8ntz0/VJjBq33vb5O8M+l1D0hwsEBoW/lx4Zf0Im98m:E4mWw/VbqPb88hv/l+7m
TLSH
T165152A66F5B4C231D073D0B9C5D3A69AEA3238415B318ACB12859B2C3E777E5D636332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pUc14C.tmp

Path C:\Users\Admin\AppData\Local\Temp\pUc14C.tmp
Size 207KB
SHA256 885f8fc49193fa3a8cd1fd92ded37be419314a54fc1962bea922ea9eb389b5e8
MD5 daaf533af2c3a9010101d1a6defa776f
SHA1 8ed5dc2bd5f66cbda5b5f9aa37fc3b6719d8e7b2
SHA512 3122e87369277af73a5aba48c7211cb0a160143706e89bdbd1160fbd0a745413908c60acccd755f6fd6b3d8637b379c200f0358ac282191bc0d7c2be84d3e237
SSDEEP 6144:1FQ4afbQz3TOe6my2PcOq6KpCHNNO0xa7jp:1W4m8nts0xat
TLSH
T13B246B32B2F0C436E1A226B09EAB96B5643AFE115A24451F73D07F1DB9743A0F936353
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pUc15F.tmp

Path C:\Users\Admin\AppData\Local\Temp\pUc15F.tmp
Size 2.3MB
SHA256 10924cd60351d42f020714f062b14622cd33b1302d72357867e4b5aa2255a81e
MD5 fbc6c3cb6c3587e3ed496de1f7347c03
SHA1 ac0c1d9878380e1c307a73ede7b23102bc0f9bc8
SHA512 60169cb3cd4af9e622a9dfdab2c4c32d38400739d0556807f5d697e4cf5b0487cd1fa1e89c5478ba65e13803673d9c386ab0fad0311f7534506dc5aa10a38e64
SSDEEP 24576:x4mWKoCbRquA/m2z+L5WqJdrHCYRFiV+XenmE3Pnzc344F:OmToCbRquA/m2yL5zbfFiV+XenmE3/zq
TLSH
T141B55B1A76B8C1B4D1F6C77886A2C647F37278154B3097EF5265460E2E33BE49A3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pUc181.tmp

Path C:\Users\Admin\AppData\Local\Temp\pUc181.tmp
Size 474KB
SHA256 33d3f413ce27b738236b45031c75552075e7d11587b12179c7d6b8d1b45436d5
MD5 b8f3d7dfd53ce295b41cbc262c746b15
SHA1 99f071ac7e27bcb7cb143a2c20e893a4736f15c2
SHA512 a5594bda04a715721c2771492913395caf121b421dab720fc795e87e655d70fa64bd986f19da5d23bf412a3d0151bfd7ee43eb6bf91cfba8140931c6c151eedd
SSDEEP 6144:iFQ4afbQz3TOe6my2PcOq6KpCHNNf09OOr/BJ/GKWWBNU6ITLBi0qttclOKgU91l:iW4m8ntR08eBNUbTVO86U9
TLSH
T1C1A43A37FE74ECF2C17A59B45A9282409776BC204F2193CFE2A4970DAE336D0AD35916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pUc184.tmp

Path C:\Users\Admin\AppData\Local\Temp\pUc184.tmp
Size 240KB
SHA256 385ae78b38ed907b7bfe959c47d48fb5ece0bc005ba8cc66bcf15eb39c4fa40f
MD5 6cf762a58122dc18fb17896f31700956
SHA1 a55a187d86a2e49c62d4b2a30ae3e5093177d725
SHA512 0c1a9362bfc8ce96643a28db3a04af717cb9b6d3b11a48c7d8b9ef88ef9e982adf7ac95b311cfcae0ff1403d071e2ff66eea6b7e6352edfe3b41498a2f487771
SSDEEP 6144:xFQ4afbQz3TOe6my2PcOq6KpCHNNB0Scr0Xap:xW4m8ntj0S6
TLSH
T17E345A31B2F4C036E0A62AB09EBB9272643AFE516920851F73D47E1D7971390F932357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pUc1A6.tmp

Path C:\Users\Admin\AppData\Local\Temp\pUc1A6.tmp
Size 4.4MB
SHA256 6e4a36fa63deea7ddf2fe84398bc740918f5d146dd91ed1f348886fa8ca99196
MD5 dac46afabe544084ecdb85774c82cec4
SHA1 ddf841a9ec6d5c0fa2038df145e703095e07b45c
SHA512 c065aa24a100b8e6919c6c0897a31332968a48830f4aeb5025f72966a968201a0632a94ec5e23e6876c95a1bd495c4257e5e8fc322f1d3558c5a1e2a23ce9133
SSDEEP 49152:JmprQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJb9DN5J8NRV+:GQvGAdlCEL8c/bRNw5Cb
TLSH
T11A264A656BE880F5E0A7D174897A8572F77A78420D32EF4F0291CA6F3F336904D29729
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pUc1C9.tmp

Path C:\Users\Admin\AppData\Local\Temp\pUc1C9.tmp
Size 552KB
SHA256 6e52650779291f9ef8c33fccb946cc6a022e07036a3366a9f3383075f5c7a6f2
MD5 43269f1f968db57f57c066032473f883
SHA1 e18e961a0ad1c7b5822aefcdffa7fd0f257fb656
SHA512 d7e0663160974176a7921d0af04e2d87aa0fe97ca3f1a130324239a7721ff5365e5bf809464164d9fa2400d869bb7b4f4de5d13df116ec91388e356abb6ceb79
SSDEEP 12288:JW4m8nt70PAwSfxL/2Dc3jDLLmt0LDQewsAjRf:84mWIYaewsAjp
TLSH
T1CCC46A31FAB4D032D2BB1DB01B6AD726143DBE204B6109CBF3E86E5D69702D1A636717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pUc229.tmp

Path C:\Users\Admin\AppData\Local\Temp\pUc229.tmp
Size 23.7MB
SHA256 3bc85a41e68066eeeb5c81fbc34d1bded761524e9978dce1b5295bd747856eaf
MD5 06ba3ba77c80fbcb09556b627b95e25f
SHA1 77e5fdc0858500502abb195e9d45d5879a0163a2
SHA512 34263c458b2eebb6aa85205b907ec0897167654b6fea3157c6aaa2c9befc4dec9f5f608e5ff91e8b8e4919dc13c249d192b1b4082086ae43244a1014e72e3199
SSDEEP 196608:uUEtQeTbvf2zlO12sJTv6Ja1cpVLyXIldPlbuJHl:uUEtQevvqc2W1cpV2XI32l
TLSH
T1EE474A91BBE843E2E3A6953484B182B6FBB17C0E1F36A73B1179F21E1F376905D15221
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pUc2E2B.tmp

Path C:\Users\Admin\AppData\Local\Temp\pUc2E2B.tmp
Size 336KB
SHA256 f487a67931b3c3122236806d8784690f1170b75d55e24c8a7b6a0ac12d63d127
MD5 45f28b71fe2581eee4624084135b80f5
SHA1 23f66195a6ebb45c409ae988938cd31376693535
SHA512 9d378b7379a99eb177f795c433443002df258701e35922f72ae0a811237b8d4ed4100673531fca34023c76528b75e5c494e8f6f26268115a43c74032115d7a5c
SSDEEP 6144:nFQ4afbQz3TOe6my2PcOq6KpCHNN60W3psmeI+sQFqT3Q8p:nW4m8ntQ0BXsf3f
TLSH
T1BB743925E2A480B5D0AE2574CB6A9661B637FD1156E0828F73D0FE3D2F71290EDE6343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pUc3DD1.tmp

Path C:\Users\Admin\AppData\Local\Temp\pUc3DD1.tmp
Size 257KB
SHA256 8bef09fafc1868a03af8ce1a7b9e277105b6dba4df45ff7b8a566d07d11b6415
MD5 6bd032b1b8aaa9a9921d656759f00332
SHA1 f20a2ca75747203ba33071311b2a0e339a655076
SHA512 26f0457ccafde1898bce8583c6cf51f3cd7b595e8de30597dc3ae52243afcca4ff02ca76a9717175baa420e97cfd3e081c18ebfb0e155c6516f0171a4ccac0bc
SSDEEP 6144:iFQ4afbQz3TOe6my2PcOq6KpCHNNs00k3nkraVTYp:iW4m8ntW00qnkraw
TLSH
T166446A31B2F0C0B6E09626B48EAB9665A43AFE115B20819F73D47E1D7E71790F936343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pUc4D46.tmp

Path C:\Users\Admin\AppData\Local\Temp\pUc4D46.tmp
Size 635KB
SHA256 e324cc15ead0d28e9166f4549fdcc277779f76e715196c43771e70d2f38382b9
MD5 520dd8ee23cd86037b23369df7f25836
SHA1 a4a2c3831d63c9e15c0ee8dac902d5a587cbd289
SHA512 084db5490c62cf35c2a39da82dbdb71d43c18ed074610ecc8233390b484bb6cc3ca0eff1406d690136ae1cf4f15209113d7abf1c18261af625264dbbfa870ece
SSDEEP 12288:NW4m8ntoJD+k3HVJ5xDfp4D7/SAOZi+5v4+rcKft1:w4mWoJJVJTt4D7/SAOZi+5v48cKfj
TLSH
T17ED48D16B3E444F5E1BBA238CDA65A21E9767C155B30D20F13ACB65D0F333606D3AB26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pUc4D59.tmp

Path C:\Users\Admin\AppData\Local\Temp\pUc4D59.tmp
Size 671KB
SHA256 4c2d91d59b79caf87134a8286167d389008a9712cb286693dd0bdc48853d4a0a
MD5 083ef1a06b53cc8572611c355c73769b
SHA1 d6ae8d62a0aadd6a9e1342b6bc53769db171f5ac
SHA512 e92354cf13d9392e1a84ff27d4ad7d45bcd1a50b3d6ec04e7c9e6654be6b3a17c900f6ce519bb57ab948df4aaa1cc6aeabb351d1500688ab2bc01bd4840ffb17
SSDEEP 12288:nW4m8ntRo5XED+k3HVJ5xDfp4D7/SAOZi+5v4+rcKftn:W4mWRo5WJVJTt4D7/SAOZi+5v48cKfd
TLSH
T184E4AE16B3E444F6E1B7D238CEA64621E9767C155B30D24F13A8966E0F337605E3BB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pUc4D6C.tmp

Path C:\Users\Admin\AppData\Local\Temp\pUc4D6C.tmp
Size 637KB
SHA256 6fa6fd8d5499940fff07142440672c8b1afa381e02a42a0bf5af541a58e5ef7e
MD5 77d478ea8c658400e8d033ad94fb1783
SHA1 5fad6861cb78a439e870eae3a5ad7c82cd1f66f8
SHA512 5da5de94e1fe84ec3aee4d4eb28ed8ddf9bf408d5c7c9bf143a5dda1a461dd1f774c5eb6b4c0d451eadac48181a5dfcd0c2212512c35de5c3989ee32259e6696
SSDEEP 12288:VW4m8nt9D+k3HVJ5xDfp4D7/SAOZi+5v4+rcKft9:I4mWNJVJTt4D7/SAOZi+5v48cKfr
TLSH
T150D46C15B3A084B5E0B79238CEA78615ED76BC555B30D20F23B8B76E0E337615D3A722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pUc5AEC.tmp

Path C:\Users\Admin\AppData\Local\Temp\pUc5AEC.tmp
Size 648KB
SHA256 4eac80373be68b0e8ab05e8d2b0335a4368db32cf19ffb11d9dc802ea3789140
MD5 8aaaefc282a6ae9cff8472b9863f1325
SHA1 f717a4e85df50f6226e0e439c0a4996f1d88f40f
SHA512 1884a64d8a1beac77a75e7c686a32e5b832b5b2cf96fdf30f7e7a7e97347f18b6cd1434d854b06dfdeee975fba88abaf5263da12e3807917caf5da8ad877184b
SSDEEP 12288:IW4m8nt8tLpm1mD+k3HVJ5xDfp4D7/SAOZi+5v4+rcKfta:/4mW8tLpwkJVJTt4D7/SAOZi+5v48cKI
TLSH
T14AE49E16B3E444F6E1B7D238CEA65A21E9777C155B30D24F13A8865E0F237605E3BB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pUc661D.tmp

Path C:\Users\Admin\AppData\Local\Temp\pUc661D.tmp
Size 1.6MB
SHA256 3a673b595f02748dd9b65d9210f29d05777d034451397dcc9b35270ee69c43d0
MD5 7710f34c0b5bbad5aff37ff1749a7e68
SHA1 a1ec2790f7b582e55815f6f2818528d742d3a487
SHA512 e95ebf72430e291504ffe4378e2e7bfb5596686fcc624d0ff57abac14576c5a028883fed72aca2773a38e0e06a5fda53d52126912b8a0aec6b7cb457b807a67f
SSDEEP 24576:g4mW1shiavrPSLT8EARn+FgyUgd0fJY6B1i3iy9CTn0AP5+2QL3:TmEshtSn8EApI0fig1giDn0AP5wj
TLSH
T175758D13F2D940E8D05AD174CB568632E972BC150B34A6DF0790BB5A2E7BBE46B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pUc6F86.tmp

Path C:\Users\Admin\AppData\Local\Temp\pUc6F86.tmp
Size 2.2MB
SHA256 5f05659cb2646bdd256ebb5f71658a9bc2913135d8ace4ac0942df587703247c
MD5 47ef00949ef0ff8e1f52e1493d562198
SHA1 be900f31124bda7c7417674eefd035094c9dcdce
SHA512 50b7276e65dda5f4074dce1a42d1c962768ccd025990f3faf4d865f36c782a730bbb8429523f11264b30c9f3b02c87ef722bfd26cbe35fc0133592a3731559e0
SSDEEP 24576:G4mWrowvLof6SRQ+rn/fDboqxN1nnh6z7DaHGTNHu7PNU3/5W/ohL0Z:lmmu68Qg55nhoeWu7PNU3/I
TLSH
T1D9A5913772F300A9C48DA576AF5A972192D17CB1CFE1D3DB8105720A1BB29D07A3A61F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pUc6F99.tmp

Path C:\Users\Admin\AppData\Local\Temp\pUc6F99.tmp
Size 3.6MB
SHA256 902a00b9bdb911f800752545b156174de533232aa9866b8fe9004038d1dfadaa
MD5 4bf97ecfb23ece14adf72af05bb63efe
SHA1 f717ddcda846edfbfe48ccfe077e121290a2048e
SHA512 1ce91c4fa99013751350caacd4d13ca1c2173390178a3f58cca80e7824eb0def1f38d446b5e252f5d8a0f871adb4ff2c995f75030ac4b29e7d9d2be1cb033127
SSDEEP 49152:4mnS3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbgN3Oh6tznm2FQ/nho2qkrC:zy5112gYy5azzVvf69nLKnhZK
TLSH
T1B2066B13F29900E8D05DD1B8874A9232E972BC474B35A6DF0A5077562F7BEE4AB3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pUc6FBB.tmp

Path C:\Users\Admin\AppData\Local\Temp\pUc6FBB.tmp
Size 2.5MB
SHA256 aeb385c50cdab50124e439eabfe2654765b2842fc17869ea6a3935e98f1f3a12
MD5 4eef3be49e99b81443796e9094da6abc
SHA1 b45a682b028b7e33ddbf1d955547f4103bc160cb
SHA512 b90242f365aa68ca35a30f39687b3f7b1bc285d20cdf38a5017a51accb3aa9b522aa8a1f144c04bef78b3b0722a61527d1a021cc6c3be11dd69783806aef2758
SSDEEP 49152:BmxTB+taZ3usBWOBr4tEGW0bqx0z+n217aau1glk:Su6Jm0xd2dk
TLSH
T1EAC58C13F1D901E8D06AD478874A9233E962BC490B34B6EF0B9077562E77EE4AB3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pUc7937.tmp

Path C:\Users\Admin\AppData\Local\Temp\pUc7937.tmp
Size 2.0MB
SHA256 20a9685a2cbf885c17b69e07f1508f4a42a0fcbfed41d8325c087ee13bd019c7
MD5 2f716c399578d470dace2ae68b7d9cae
SHA1 4bf1f5a08813d4684058fe425dc44dee204054b7
SHA512 95e0c3f51241b5beade12d7b4c6d9840579ed8129c96251ddcdb2a84a141edd6236e7d5687819d15c4a7eedcddd8f0446fe5566357903fed0631646ffa30e531
SSDEEP 24576:A4mW1a4BvWw7fuwWQsBZFAfPSPa/0BeHWxE6bR04FxGgVG2Onks6xt4bSMHnq4:zmUuSuZQIY0Be2K8RVtOnks6NMHq4
TLSH
T107A58D13F2E940E8E0BED5748B669232E972BC454B34A6DF064076591E77FE09B3D322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pUc7959.tmp

Path C:\Users\Admin\AppData\Local\Temp\pUc7959.tmp
Size 6.2MB
SHA256 c9152ca1a01ee2bff8e36deb9a8e58f2dfa03e283df2d8fd5c7e274cf5753342
MD5 8c1098493879bd0ff868d1985308aa7b
SHA1 63b155efcfad950d6acb0f9f17b893413fee0982
SHA512 6561c18b4932f3b21d027164a714e5aacbfdc646c8319fa69ff232e9a1f237093c731f3918592cad701e90c9b0abcfc36902beaa6ce3c56dffde1bd7e49bb210
SSDEEP 49152:HmMWj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeKAaLSF259ruMHwpXMi4FqJLd5:/QRQyi36YOcP+Lvw2gAf+PN3L
TLSH
T1FA666B13F3B501E8E05ED974CF3952229B357C4A8BB092EF259436E51A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pUcBC3.tmp

Path C:\Users\Admin\AppData\Local\Temp\pUcBC3.tmp
Size 695KB
SHA256 b9ef041184c1cea16085a353d0caa2cdc4dfbdfeecf132b9e332dfc1cd9a8f12
MD5 af9d7b58cba2034dd8ff14e2af1c3ea4
SHA1 680aabf7feb5d78d1827854d0230f5db386b0448
SHA512 0e122e60b62fa87dab857dfb49beea421a13bb9b9aaab20e7c27ae898f9768f236a32e2b4357c41dbb4c65c302e523bc6fe1a706628a48c82ba48065da0aae63
SSDEEP 12288:vW4m8ntd04D+k3HVJ5xDfp4D7/SAOZi+5v4+rcKftU:u4mW+qJVJTt4D7/SAOZi+5v48cKfi
TLSH
T1C4E46B35B3A044B5E077A638CA664611E97E7C115B33DE0E13985E593F333D0A93AB2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2404-565-0x0000000000540000-0x00000000005D6000-memory.dmp

Download

memory/2404-564-0x0000000000400000-0x00000000004A6000-memory.dmp

Download

memory/2404-692-0x0000000000400000-0x00000000004A6000-memory.dmp

Download

memory/3412-249-0x00000000004B0000-0x0000000000546000-memory.dmp

Download

memory/3412-248-0x0000000000400000-0x00000000004A6000-memory.dmp

Download

memory/3488-219-0x0000000000610000-0x00000000006A6000-memory.dmp

Download

memory/3488-218-0x0000000000400000-0x00000000004A6000-memory.dmp

Download

memory/4324-178-0x0000000000400000-0x00000000004A6000-memory.dmp

Download

memory/4324-179-0x00000000007E0000-0x0000000000876000-memory.dmp

Download

memory/4400-533-0x00000000005E0000-0x0000000000676000-memory.dmp

Download

memory/4400-532-0x0000000000400000-0x00000000004A6000-memory.dmp

Download

memory/4580-711-0x0000000000400000-0x00000000004A6000-memory.dmp

Download

memory/4580-567-0x0000000000580000-0x0000000000616000-memory.dmp

Download

memory/4580-566-0x0000000000400000-0x00000000004A6000-memory.dmp

Download

memory/4900-406-0x0000000000400000-0x00000000004A6000-memory.dmp

Download

memory/4900-407-0x00000000005C0000-0x0000000000656000-memory.dmp

Download

memory/4900-429-0x0000000000400000-0x00000000004A6000-memory.dmp

Download

memory/5060-614-0x0000000000860000-0x00000000008F6000-memory.dmp

Download

memory/5060-613-0x0000000000400000-0x00000000004A6000-memory.dmp

Download

memory/5060-719-0x0000000000400000-0x00000000004A6000-memory.dmp

Download