0052eb8bf0ee599a98eea42e3950c158d38da98df66d1881ee6c1f7d9757f4cb

Analysis

max time kernel
149s
max time network
154s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
11/05/2026, 10:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-11_77d0b51215739f48bcb227cf5e28f380_cobalt-strike_darkgate_elex_gcleaner_icedid_luca-stealer_njrat_vidar.exe
Size 416KB
Sample260511-mgdmhae191
SHA256 0052eb8bf0ee599a98eea42e3950c158d38da98df66d1881ee6c1f7d9757f4cb
MD5 77d0b51215739f48bcb227cf5e28f380
SHA1 ed4d49d0d504be8f71428d9a40e54f13d100ccc7
SHA512 a4e89c35ae511b6fc2daa6278d672a5d3ad5519d98c8908cb14bafda526d430fb6a6b1418171f8ea89ed241f8680cc598ab18053f7c744f8a261ed412f5d982d
SSDEEP 6144:tFQ4afbQz3TOe6my2PcOq6KpCHNNHwfQuP4GQOF1vf5pS8Vb6IJ6noeL3X8S:tW4m8ntmfQo4XO7vxpS8xPKX8S
TLSH
T188947C1172DC47B6E2F31A344D7CB625963A7D680B34C63F13E45A5EAE337909D2A322
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	2026-05-11_77d0b51215739f48bcb227cf5e28f380_cobalt-strike_darkgate_elex_gcleaner_icedid_luca-stealer_njrat_vidar.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	2026-05-11_77d0b51215739f48bcb227cf5e28f380_cobalt-strike_darkgate_elex_gcleaner_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	2026-05-11_77d0b51215739f48bcb227cf5e28f380_cobalt-strike_darkgate_elex_gcleaner_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-05-11_77d0b51215739f48bcb227cf5e28f380_cobalt-strike_darkgate_elex_gcleaner_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-05-11_77d0b51215739f48bcb227cf5e28f380_cobalt-strike_darkgate_elex_gcleaner_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	2026-05-11_77d0b51215739f48bcb227cf5e28f380_cobalt-strike_darkgate_elex_gcleaner_icedid_luca-stealer_njrat_vidar.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	2026-05-11_77d0b51215739f48bcb227cf5e28f380_cobalt-strike_darkgate_elex_gcleaner_icedid_luca-stealer_njrat_vidar.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-05-11_77d0b51215739f48bcb227cf5e28f380_cobalt-strike_darkgate_elex_gcleaner_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-05-11_77d0b51215739f48bcb227cf5e28f380_cobalt-strike_darkgate_elex_gcleaner_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-05-11_77d0b51215739f48bcb227cf5e28f380_cobalt-strike_darkgate_elex_gcleaner_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-05-11_77d0b51215739f48bcb227cf5e28f380_cobalt-strike_darkgate_elex_gcleaner_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	2026-05-11_77d0b51215739f48bcb227cf5e28f380_cobalt-strike_darkgate_elex_gcleaner_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-05-11_77d0b51215739f48bcb227cf5e28f380_cobalt-strike_darkgate_elex_gcleaner_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-05-11_77d0b51215739f48bcb227cf5e28f380_cobalt-strike_darkgate_elex_gcleaner_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-05-11_77d0b51215739f48bcb227cf5e28f380_cobalt-strike_darkgate_elex_gcleaner_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-05-11_77d0b51215739f48bcb227cf5e28f380_cobalt-strike_darkgate_elex_gcleaner_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-05-11_77d0b51215739f48bcb227cf5e28f380_cobalt-strike_darkgate_elex_gcleaner_icedid_luca-stealer_njrat_vidar.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-05-11_77d0b51215739f48bcb227cf5e28f380_cobalt-strike_darkgate_elex_gcleaner_icedid_luca-stealer_njrat_vidar.exe
File created	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-05-11_77d0b51215739f48bcb227cf5e28f380_cobalt-strike_darkgate_elex_gcleaner_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe	2026-05-11_77d0b51215739f48bcb227cf5e28f380_cobalt-strike_darkgate_elex_gcleaner_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	2026-05-11_77d0b51215739f48bcb227cf5e28f380_cobalt-strike_darkgate_elex_gcleaner_icedid_luca-stealer_njrat_vidar.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	2026-05-11_77d0b51215739f48bcb227cf5e28f380_cobalt-strike_darkgate_elex_gcleaner_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-05-11_77d0b51215739f48bcb227cf5e28f380_cobalt-strike_darkgate_elex_gcleaner_icedid_luca-stealer_njrat_vidar.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	2026-05-11_77d0b51215739f48bcb227cf5e28f380_cobalt-strike_darkgate_elex_gcleaner_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-05-11_77d0b51215739f48bcb227cf5e28f380_cobalt-strike_darkgate_elex_gcleaner_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	2026-05-11_77d0b51215739f48bcb227cf5e28f380_cobalt-strike_darkgate_elex_gcleaner_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-05-11_77d0b51215739f48bcb227cf5e28f380_cobalt-strike_darkgate_elex_gcleaner_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-05-11_77d0b51215739f48bcb227cf5e28f380_cobalt-strike_darkgate_elex_gcleaner_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-05-11_77d0b51215739f48bcb227cf5e28f380_cobalt-strike_darkgate_elex_gcleaner_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-05-11_77d0b51215739f48bcb227cf5e28f380_cobalt-strike_darkgate_elex_gcleaner_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-05-11_77d0b51215739f48bcb227cf5e28f380_cobalt-strike_darkgate_elex_gcleaner_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-05-11_77d0b51215739f48bcb227cf5e28f380_cobalt-strike_darkgate_elex_gcleaner_icedid_luca-stealer_njrat_vidar.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	2026-05-11_77d0b51215739f48bcb227cf5e28f380_cobalt-strike_darkgate_elex_gcleaner_icedid_luca-stealer_njrat_vidar.exe
File created	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-05-11_77d0b51215739f48bcb227cf5e28f380_cobalt-strike_darkgate_elex_gcleaner_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-05-11_77d0b51215739f48bcb227cf5e28f380_cobalt-strike_darkgate_elex_gcleaner_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	2026-05-11_77d0b51215739f48bcb227cf5e28f380_cobalt-strike_darkgate_elex_gcleaner_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-05-11_77d0b51215739f48bcb227cf5e28f380_cobalt-strike_darkgate_elex_gcleaner_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	2026-05-11_77d0b51215739f48bcb227cf5e28f380_cobalt-strike_darkgate_elex_gcleaner_icedid_luca-stealer_njrat_vidar.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	2026-05-11_77d0b51215739f48bcb227cf5e28f380_cobalt-strike_darkgate_elex_gcleaner_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	2026-05-11_77d0b51215739f48bcb227cf5e28f380_cobalt-strike_darkgate_elex_gcleaner_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	2026-05-11_77d0b51215739f48bcb227cf5e28f380_cobalt-strike_darkgate_elex_gcleaner_icedid_luca-stealer_njrat_vidar.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-05-11_77d0b51215739f48bcb227cf5e28f380_cobalt-strike_darkgate_elex_gcleaner_icedid_luca-stealer_njrat_vidar.exe
File created	C:\Program Files\Internet Explorer\ExtExport.exe	2026-05-11_77d0b51215739f48bcb227cf5e28f380_cobalt-strike_darkgate_elex_gcleaner_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-05-11_77d0b51215739f48bcb227cf5e28f380_cobalt-strike_darkgate_elex_gcleaner_icedid_luca-stealer_njrat_vidar.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-05-11_77d0b51215739f48bcb227cf5e28f380_cobalt-strike_darkgate_elex_gcleaner_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-05-11_77d0b51215739f48bcb227cf5e28f380_cobalt-strike_darkgate_elex_gcleaner_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-05-11_77d0b51215739f48bcb227cf5e28f380_cobalt-strike_darkgate_elex_gcleaner_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-05-11_77d0b51215739f48bcb227cf5e28f380_cobalt-strike_darkgate_elex_gcleaner_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-05-11_77d0b51215739f48bcb227cf5e28f380_cobalt-strike_darkgate_elex_gcleaner_icedid_luca-stealer_njrat_vidar.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	2026-05-11_77d0b51215739f48bcb227cf5e28f380_cobalt-strike_darkgate_elex_gcleaner_icedid_luca-stealer_njrat_vidar.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-05-11_77d0b51215739f48bcb227cf5e28f380_cobalt-strike_darkgate_elex_gcleaner_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-05-11_77d0b51215739f48bcb227cf5e28f380_cobalt-strike_darkgate_elex_gcleaner_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-05-11_77d0b51215739f48bcb227cf5e28f380_cobalt-strike_darkgate_elex_gcleaner_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	2026-05-11_77d0b51215739f48bcb227cf5e28f380_cobalt-strike_darkgate_elex_gcleaner_icedid_luca-stealer_njrat_vidar.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-05-11_77d0b51215739f48bcb227cf5e28f380_cobalt-strike_darkgate_elex_gcleaner_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-05-11_77d0b51215739f48bcb227cf5e28f380_cobalt-strike_darkgate_elex_gcleaner_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-05-11_77d0b51215739f48bcb227cf5e28f380_cobalt-strike_darkgate_elex_gcleaner_icedid_luca-stealer_njrat_vidar.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-05-11_77d0b51215739f48bcb227cf5e28f380_cobalt-strike_darkgate_elex_gcleaner_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-05-11_77d0b51215739f48bcb227cf5e28f380_cobalt-strike_darkgate_elex_gcleaner_icedid_luca-stealer_njrat_vidar.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-05-11_77d0b51215739f48bcb227cf5e28f380_cobalt-strike_darkgate_elex_gcleaner_icedid_luca-stealer_njrat_vidar.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	2026-05-11_77d0b51215739f48bcb227cf5e28f380_cobalt-strike_darkgate_elex_gcleaner_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-05-11_77d0b51215739f48bcb227cf5e28f380_cobalt-strike_darkgate_elex_gcleaner_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-05-11_77d0b51215739f48bcb227cf5e28f380_cobalt-strike_darkgate_elex_gcleaner_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-05-11_77d0b51215739f48bcb227cf5e28f380_cobalt-strike_darkgate_elex_gcleaner_icedid_luca-stealer_njrat_vidar.exe

Program crash 12 IoCs

pid	pid_target	Process	procid_target
2412	4640	WerFault.exe	78
700	4640	WerFault.exe	78
3832	3116	WerFault.exe	79
2240	3116	WerFault.exe	79
3304	2152	WerFault.exe	85
4140	2152	WerFault.exe	85
2532	4152	WerFault.exe	90
1744	4152	WerFault.exe	90
1068	3180	WerFault.exe	95
4884	3180	WerFault.exe	95
3600	2728	WerFault.exe	100
5852	2728	WerFault.exe	100

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-11_77d0b51215739f48bcb227cf5e28f380_cobalt-strike_darkgate_elex_gcleaner_icedid_luca-stealer_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-11_77d0b51215739f48bcb227cf5e28f380_cobalt-strike_darkgate_elex_gcleaner_icedid_luca-stealer_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-11_77d0b51215739f48bcb227cf5e28f380_cobalt-strike_darkgate_elex_gcleaner_icedid_luca-stealer_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-11_77d0b51215739f48bcb227cf5e28f380_cobalt-strike_darkgate_elex_gcleaner_icedid_luca-stealer_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-11_77d0b51215739f48bcb227cf5e28f380_cobalt-strike_darkgate_elex_gcleaner_icedid_luca-stealer_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-11_77d0b51215739f48bcb227cf5e28f380_cobalt-strike_darkgate_elex_gcleaner_icedid_luca-stealer_njrat_vidar.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4640	2026-05-11_77d0b51215739f48bcb227cf5e28f380_cobalt-strike_darkgate_elex_gcleaner_icedid_luca-stealer_njrat_vidar.exe
4640	2026-05-11_77d0b51215739f48bcb227cf5e28f380_cobalt-strike_darkgate_elex_gcleaner_icedid_luca-stealer_njrat_vidar.exe
3116	2026-05-11_77d0b51215739f48bcb227cf5e28f380_cobalt-strike_darkgate_elex_gcleaner_icedid_luca-stealer_njrat_vidar.exe
3116	2026-05-11_77d0b51215739f48bcb227cf5e28f380_cobalt-strike_darkgate_elex_gcleaner_icedid_luca-stealer_njrat_vidar.exe
2152	2026-05-11_77d0b51215739f48bcb227cf5e28f380_cobalt-strike_darkgate_elex_gcleaner_icedid_luca-stealer_njrat_vidar.exe
2152	2026-05-11_77d0b51215739f48bcb227cf5e28f380_cobalt-strike_darkgate_elex_gcleaner_icedid_luca-stealer_njrat_vidar.exe
4152	2026-05-11_77d0b51215739f48bcb227cf5e28f380_cobalt-strike_darkgate_elex_gcleaner_icedid_luca-stealer_njrat_vidar.exe
4152	2026-05-11_77d0b51215739f48bcb227cf5e28f380_cobalt-strike_darkgate_elex_gcleaner_icedid_luca-stealer_njrat_vidar.exe
3180	2026-05-11_77d0b51215739f48bcb227cf5e28f380_cobalt-strike_darkgate_elex_gcleaner_icedid_luca-stealer_njrat_vidar.exe
3180	2026-05-11_77d0b51215739f48bcb227cf5e28f380_cobalt-strike_darkgate_elex_gcleaner_icedid_luca-stealer_njrat_vidar.exe
2728	2026-05-11_77d0b51215739f48bcb227cf5e28f380_cobalt-strike_darkgate_elex_gcleaner_icedid_luca-stealer_njrat_vidar.exe
2728	2026-05-11_77d0b51215739f48bcb227cf5e28f380_cobalt-strike_darkgate_elex_gcleaner_icedid_luca-stealer_njrat_vidar.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4640 wrote to memory of 3116	4640	2026-05-11_77d0b51215739f48bcb227cf5e28f380_cobalt-strike_darkgate_elex_gcleaner_icedid_luca-stealer_njrat_vidar.exe	79
PID 3116 wrote to memory of 2152	3116	2026-05-11_77d0b51215739f48bcb227cf5e28f380_cobalt-strike_darkgate_elex_gcleaner_icedid_luca-stealer_njrat_vidar.exe	85
PID 2152 wrote to memory of 4152	2152	2026-05-11_77d0b51215739f48bcb227cf5e28f380_cobalt-strike_darkgate_elex_gcleaner_icedid_luca-stealer_njrat_vidar.exe	90
PID 4152 wrote to memory of 3180	4152	2026-05-11_77d0b51215739f48bcb227cf5e28f380_cobalt-strike_darkgate_elex_gcleaner_icedid_luca-stealer_njrat_vidar.exe	95
PID 3180 wrote to memory of 2728	3180	2026-05-11_77d0b51215739f48bcb227cf5e28f380_cobalt-strike_darkgate_elex_gcleaner_icedid_luca-stealer_njrat_vidar.exe	100

C:\Users\Admin\AppData\Local\Temp\2026-05-11_77d0b51215739f48bcb227cf5e28f380_cobalt-strike_darkgate_elex_gcleaner_icedid_luca-stealer_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-11_77d0b51215739f48bcb227cf5e28f380_cobalt-strike_darkgate_elex_gcleaner_icedid_luca-stealer_njrat_vidar.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4640
- C:\Users\Admin\AppData\Local\Temp\2026-05-11_77d0b51215739f48bcb227cf5e28f380_cobalt-strike_darkgate_elex_gcleaner_icedid_luca-stealer_njrat_vidar.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-05-11_77d0b51215739f48bcb227cf5e28f380_cobalt-strike_darkgate_elex_gcleaner_icedid_luca-stealer_njrat_vidar.exe"
  2⤵
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3116
- - C:\Users\Admin\AppData\Local\Temp\2026-05-11_77d0b51215739f48bcb227cf5e28f380_cobalt-strike_darkgate_elex_gcleaner_icedid_luca-stealer_njrat_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-05-11_77d0b51215739f48bcb227cf5e28f380_cobalt-strike_darkgate_elex_gcleaner_icedid_luca-stealer_njrat_vidar.exe"
    3⤵
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2152
  - - C:\Users\Admin\AppData\Local\Temp\2026-05-11_77d0b51215739f48bcb227cf5e28f380_cobalt-strike_darkgate_elex_gcleaner_icedid_luca-stealer_njrat_vidar.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-05-11_77d0b51215739f48bcb227cf5e28f380_cobalt-strike_darkgate_elex_gcleaner_icedid_luca-stealer_njrat_vidar.exe"
      4⤵
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:4152
    - - C:\Users\Admin\AppData\Local\Temp\2026-05-11_77d0b51215739f48bcb227cf5e28f380_cobalt-strike_darkgate_elex_gcleaner_icedid_luca-stealer_njrat_vidar.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-05-11_77d0b51215739f48bcb227cf5e28f380_cobalt-strike_darkgate_elex_gcleaner_icedid_luca-stealer_njrat_vidar.exe"
        5⤵
        Drops file in Program Files directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:3180
      - C:\Users\Admin\AppData\Local\Temp\2026-05-11_77d0b51215739f48bcb227cf5e28f380_cobalt-strike_darkgate_elex_gcleaner_icedid_luca-stealer_njrat_vidar.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-05-11_77d0b51215739f48bcb227cf5e28f380_cobalt-strike_darkgate_elex_gcleaner_icedid_luca-stealer_njrat_vidar.exe"
        6⤵
        Drops file in Program Files directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:2728
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2728 -s 432
        7⤵
        Program crash
        
        PID:3600
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2728 -s 452
        7⤵
        Program crash
        
        PID:5852
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3180 -s 460
        6⤵
        Program crash
        
        PID:1068
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3180 -s 460
        6⤵
        Program crash
        
        PID:4884
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4152 -s 408
        5⤵
        Program crash
        
        PID:2532
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4152 -s 408
        5⤵
        Program crash
        
        PID:1744
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2152 -s 500
      4⤵
      Program crash
      PID:3304
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2152 -s 500
      4⤵
      Program crash
      PID:4140
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3116 -s 452
    3⤵
    - Program crash
    PID:3832
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3116 -s 452
    3⤵
    - Program crash
    PID:2240
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4640 -s 480
  2⤵
  - Program crash
  PID:2412
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4640 -s 480
  2⤵
  - Program crash
  PID:700

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4640 -ip 4640
1⤵
PID:4796

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4640 -ip 4640
1⤵
PID:2128

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 3116 -ip 3116
1⤵
PID:5184

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 3116 -ip 3116
1⤵
PID:5580

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 2152 -ip 2152
1⤵
PID:1832

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 2152 -ip 2152
1⤵
PID:5940

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4152 -ip 4152
1⤵
PID:3908

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 400 -p 4152 -ip 4152
1⤵
PID:5864

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 400 -p 3180 -ip 3180
1⤵
PID:4948

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 3180 -ip 3180
1⤵
PID:412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 2728 -ip 2728
1⤵
PID:1368

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 2728 -ip 2728
1⤵
PID:1532

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.2MB
SHA256 dec4c939534f04dbb13fe920e7f3aa568a723ba5094f012e7524796fddcd2b91
MD5 424835150a10ed4fc6f3cd0e1d0a76f3
SHA1 24be83280160a5a4a0a989e69ec0044395c28fb6
SHA512 f8ded980ac9faa96b30f948d437c7e183116b46ecd295992187da63bf481c475ab1ca0b6944ac62bdce6d4807fb016c5d89535ce98c77b8afb80bd4c84aed2de
SSDEEP 49152:ZmLbj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeKAaLSF259ruMHwpXMi4FqJLdh:KKQRQyi36YOcP+Lvw2gAf+PN3
TLSH
T16D666C13F3A501E8E05ED974CF3D56229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pUc1400.tmp

Path C:\Users\Admin\AppData\Local\Temp\pUc1400.tmp
Size 483KB
SHA256 72af80a5e4478b315e9add65835536298a9623b69e7a1b8b15d4ab20951344aa
MD5 3683788b299e13577c854263002082ab
SHA1 40d9b49ae07d3c35e3104bde2538c96553a4a4da
SHA512 e42ebde5de9f7fbdad131483ea5fdc810deb9316eba7ea200f4ca2e325da023979752bddaaa8a404e9743ceae76fe32464f94613b1634daa01d0440c82611d17
SSDEEP 6144:DFQ4afbQz3TOe6my2PcOq6KpCHNNwQuP4GQOF1vf5pS8Vb6IJ6noeL3X8I:DW4m8ntSQo4XO7vxpS8xPKX8I
TLSH
T1A1B4593173E044B6E0B21A7449B89221963E7D101A37CE1F23E45E5EBF736D09D2A76E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pUc147C.tmp

Path C:\Users\Admin\AppData\Local\Temp\pUc147C.tmp
Size 805KB
SHA256 342917177a9fcfddefbab977bb862ac681374907b4862df5336578b7468291f1
MD5 24ec03c285d4940dfbc94b8ffdca98ae
SHA1 2fd719b61a7f3a622bcf42dafe149fb3c453d08d
SHA512 eb6853c5a44c4753711c20cf253a34592d1fb65eb413931144401bdb9a9151ef06157c63fa0334ebf97224c4ef15053d3c1e0fc497705f00150b02396ce3d735
SSDEEP 12288:fW4m8ntJ9YaYFzAZ/GLAIFoiwtA5qy97S9uaYFLq3OE:+4mWJsAhGLAIFoiwtA5l7S53r
TLSH
T122054A91E7F544E4F5B39AB89DBA9171E976BCA51E30C20F2260D60F0E33A909D25733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pUc149F.tmp

Path C:\Users\Admin\AppData\Local\Temp\pUc149F.tmp
Size 454KB
SHA256 1b3c6c4d1080a55d151cc37a63d05392de25a8845c234ce116ddb12798d5d349
MD5 5773d36d56bebd8379ac257761f08640
SHA1 cccecb9bb351dabda445b7e8d7f289b610bbb934
SHA512 59e3e825bfc12a3c5e600427fb3010591b34029bb2d21dc6e7721feb18d45b04d5b8050d7677da907ab97dbb4b9d31507470e5f1f16e8955b6a6b5c81df696f8
SSDEEP 12288:AW4m8ntpfQoqmw5HEjsChNVBFgl0WDm+C1:H4mW51wukOWA
TLSH
T145A47D5176DC4BF6E6E2453489AEF132E6B6BD192B20863F13E0DA1BAF333506D19311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pUc14B1.tmp

Path C:\Users\Admin\AppData\Local\Temp\pUc14B1.tmp
Size 293KB
SHA256 dbfbae4c222b8b4f0a5e8370696aa5e562833a5a15efc9f0dadecab2670456a8
MD5 14ae33734a4e3c2c43bbc893eece933e
SHA1 2bca936b67bc9128d6230003fd7f483d3fc1c1d8
SHA512 0456acddb6d324859b9b1a060355a3813ea00f067718a63edb85303f68594c98282aee7bb01762470985b82de5d76030ed4a272941ea03dcac56b3d849c84124
SSDEEP 6144:/FQ4afbQz3TOe6my2PcOq6KpCHNNJwfQuPU57L2DTH0Z1Ie8YDfva8:/W4m8ntgfQoUrZ1Iy1
TLSH
T189545A2172CC93B6D3D209788DADF6359235BD2D1B2143FF63E06A5EAE316D06D26312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pUc14C4.tmp

Path C:\Users\Admin\AppData\Local\Temp\pUc14C4.tmp
Size 353KB
SHA256 af9662c485bf1e8bbdac0737933cc1ddb083a8c4bf4bf678b941e27298e60941
MD5 744c163a24efeae0b44d11580d506d82
SHA1 1552739249ea41e68f7dfc649b7c3b1527188b15
SHA512 cdcc327ae1cd64cad8c1611903960e0d7787bd693e71052d8d427f93d5608f20e43216531457e56398a6778456159e0203839470e81b6e98c7f2174e07c0ad69
SSDEEP 6144:pFQ4afbQz3TOe6my2PcOq6KpCHNNu3psmeI+sQFqT3QV:pW4m8ntjXsf3O
TLSH
T18D746B2AE28041F6D05E1674CBAA9661B63B7D2157E1C2CBA3D0FA3D0F752D06DDA343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pUc14D7.tmp

Path C:\Users\Admin\AppData\Local\Temp\pUc14D7.tmp
Size 253KB
SHA256 919b5038475f4878ced522092db77a7ea7412b746140256ece76cd3df7d73bcf
MD5 8e5beba8ce9b8bdf82f1a1bf90da265d
SHA1 e673d6664e41ae2ec256fc740f54864a9fe82cb7
SHA512 fb2365581c2b832ce6115e045954f194e799afd7313224cbc457999420ba1c4401ab5f65726684a20f8b51bd84aa66d480741346741db416afd1a0d21a6b577e
SSDEEP 6144:9FQ4afbQz3TOe6my2PcOq6KpCHNNjwfQuPfJ6:9W4m8nt2fQofc
TLSH
T159447C2276DC83B6D3D209B48DADF635A539BE2C1B11417B63E4AF0EAE713D06D16243
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pUc14F9.tmp

Path C:\Users\Admin\AppData\Local\Temp\pUc14F9.tmp
Size 261KB
SHA256 15ac521d28378b59e9f8f8648270f634ab790130c9f4f1fdfc44db747965eb5f
MD5 6f733fb19ce52c64c5da189b0d89367f
SHA1 5c9b2ea1e510a401d6246a2d2f617d26a85608e0
SHA512 e7c568b66e80bfda010914236bafbbfafed437266a4f34b6fca00fe70e07b52fe17b538cba912d373e777aec5cfc23361e2a86c5bc409eacb47f28173efaabef
SSDEEP 6144:YFQ4afbQz3TOe6my2PcOq6KpCHNN6wfQuPBk3nkraVTC:YW4m8ntnfQoBqnkra0
TLSH
T1BD447D2176CC83B6D3D206B44DAEF635A579BE2C1B1041BB63E46F0EAE717D06D1A243
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pUc150B.tmp

Path C:\Users\Admin\AppData\Local\Temp\pUc150B.tmp
Size 257KB
SHA256 e2524bdd65d353c77ac2091e2fbb6cea504d7240a0d5acffd681d64467c6a239
MD5 f7ca8c33bab06186e0a84b4312380853
SHA1 e2fd1e394b13d005204f20cfc866bbe45705fe11
SHA512 5606bc8f211a25b68e4312ceab32f2a4c86107a878ff4bc0ef8d2bfdc300fdbfbb77fb270d1f6a7cd072036755ea84ed22fb4eb1c3d51123e394c289a106ccde
SSDEEP 6144:IFQ4afbQz3TOe6my2PcOq6KpCHNNjwfQuPbpw5ySuJQX4:IW4m8ntGfQobpIyvJX
TLSH
T18F447B2176CC87B6E3D209B44DAEF6359579BE2C1B1041BB63E46F0EAE713D06D1A243
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pUc155D.tmp

Path C:\Users\Admin\AppData\Local\Temp\pUc155D.tmp
Size 3.3MB
SHA256 f64370120ccf7c6e369ad1a5b3707d7badea79b56174f05ac3cb79bac208eb2f
MD5 e81bbbda7f988eccd0d7bb6924c56aec
SHA1 b1aaa554b6e1cdb89cacf1f5415ad0563a342cea
SHA512 21879f46e6abae5d8b34445370f17ba66c7ce82e0b366757c12ec986bf0c2ca2279386a3218a266143f0b92e44f64ffd8a07a9ab5b3d00a938cfc17d5b326d20
SSDEEP 49152:Rm0GyLSrJhMeJNvjLAE3dGGj8b2EGcjesaNkYQd0XNJKcvaAcPTY6Y5Ak:9m7vj1BDlZ
TLSH
T1B4F59D13F2D940E9D059C078875A9232EA72BC494B3166DF0790BB562F7BBE06B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pUc15FC.tmp

Path C:\Users\Admin\AppData\Local\Temp\pUc15FC.tmp
Size 1.6MB
SHA256 d8b9bfe39543aa49e0715e0272c06d266ebb6ffb97c20b4d40f4b8b22507e6d6
MD5 a5e39e2f276abe5034b6bde401cfdb0d
SHA1 8ecfe6fe30a17ff492d571b829116ea7ba833358
SHA512 7907a75db5596e30d78aae2f1cb80b21a48eb4bc79268aa5bfc792fb59df72860f6b7499bc72f38d7d4a46fd63604c98e265b789b693f771fb2c09b906306101
SSDEEP 24576:G4mWBhhiavrPSLT8EARn+FgyUgd0fJY6B1i3iy9CTn0AP5+2QL/:lm+hhtSn8EApI0fig1giDn0AP5wb
TLSH
T17A758D13F2D842E8D09AC174C75AA632E972BC150B34A6EF0790B7561E7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pUc160E.tmp

Path C:\Users\Admin\AppData\Local\Temp\pUc160E.tmp
Size 2.2MB
SHA256 433af00776a2be0128c4b88e877fe4e0e7d14f1c326a3d5cb1944679169e1d40
MD5 604fa52640d9703d3b8c70fdc44235fd
SHA1 8826f178b0922542483248b05e7948c2e4cd0959
SHA512 661c860dfba1fe2a6982747d623a0415fc9af3367af2f3546d2dd22d31b2ee85f27f368e20aec43972696d1093b2d25eb5ca4647077f1e159384d8cd2d54188f
SSDEEP 24576:Y4mWa7wvLof6SRQ+rn/fDboqxN1nnh6z7DaHGTNHu7PNU3/5W/ohL0x:bmlz68Qg55nhoeWu7PNU3/G
TLSH
T134B5903372F701A9C48DA576AF5A972192D17CB5CFE0D3DB8105720A1BB29D07A3A60F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pUc1621.tmp

Path C:\Users\Admin\AppData\Local\Temp\pUc1621.tmp
Size 3.7MB
SHA256 6f91dc6c5d53f441152ada4a80e0dcc013ea929e3710de2fc6bd365eeadbcdc2
MD5 4b4300c771bc07c4a8983b3cbb0e4113
SHA1 d8781f72c2a74af6f56218b9f30757d0cba36013
SHA512 133b72071effbf2a3ab15e2545e34097167233adf8b366b4d0cb55be523593085d3840bd9e90f2e670eecb310b0c058e0b7b8fbd6bde72ad98652a1d67dc50d1
SSDEEP 49152:imvN3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbgN3Oh6tznm2FQ/nho2qkr:Jcy5112gYy5azzVvf69nLKnhZ
TLSH
T107067B13F29901E8D05DD178874A9232EA72BC474B35A6DF0A9077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pUc1643.tmp

Path C:\Users\Admin\AppData\Local\Temp\pUc1643.tmp
Size 2.5MB
SHA256 108fca9b51668cbac9fcf62fed8b361c7e20cdf73f7a7cb631435bb71e1cb29a
MD5 1ce1237980ad3b1dc0744b725a06440e
SHA1 e90bee4ea7a4f4d44dfe085459be4f045f7cd217
SHA512 51296cbbaa7479ee438576e91b55ec01a849bb5b0d596afc1921570e58635c4ad4ddd2029a33c592c24fc391c2b232ec506503b2fc65c7eda9edb78e91479c2a
SSDEEP 49152:nmpsB+taZ3usBWOBr4tEGW0bqx0z+n217aau1glC:Kmu6Jm0xd2d
TLSH
T140C58C13F1D902E8D09AD478874AA232E972BC490B34B6EF079077562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pUc1656.tmp

Path C:\Users\Admin\AppData\Local\Temp\pUc1656.tmp
Size 1.8MB
SHA256 0b144a183ae68066af966874525bd3e63593bced03a838be01c5124767da4945
MD5 e57cd12cddd652c37c759771e3f65843
SHA1 cd7a7b81a7bbe86203bbe2e1ee01233986af4c04
SHA512 0614eac9becf723381d492cf85cdaefcefd9b248ceb26d3b3f9ecea052b2e430666a0a3df09dd309d044681d7a169a4065458fb9502787a3fff5af56a12a4dad
SSDEEP 24576:m4mWKGhv8E1hps0+ogd2z615uCMVF1Agz6hUQ1zNOgLLwH7ReaQXx3l:Fmdm1hpsNoJpF1A6GU44CwH7R4x1
TLSH
T1E3958D13F2D842E8D099C578875AA232EA71BC490B34A6EF069077961F77BE46F3D311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pUc1669.tmp

Path C:\Users\Admin\AppData\Local\Temp\pUc1669.tmp
Size 2.0MB
SHA256 914b6b457e33720bf4adfbe30d3cb5b2215d5cf4aa8583ea547ec29d5476439f
MD5 9c010a19488854cf35490ab35ac2df7b
SHA1 95e286ffe2c3a149b12f29256296d0acc8f6322d
SHA512 77ab61ca5fb2baa3d82f1798f858f0616b0a3b8f1a777082534f23b425ab8dbae596a9537ec5b9c0513febcda924b14f67383d2749d4f9335d75e8c1a5b91511
SSDEEP 24576:C4mWt54BvWw7fuwWQsBZFAfPSPa/0BeHWxE6bR04FxGgVG2Onks6xt4bSMHnqG:xmqfSuZQIY0Be2K8RVtOnks6NMHqG
TLSH
T1B3A58D13B2ED41E8E0FED5748769A232EA72BC454B34A6DF068072591E77EE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pUc168B.tmp

Path C:\Users\Admin\AppData\Local\Temp\pUc168B.tmp
Size 6.2MB
SHA256 0c50d141b010432a7229196ab2696e85a5404776b3b3c57a8bf5cfe349aad4a3
MD5 686f7a725f24f7121985d3fa2e0052e5
SHA1 dd5613f617757c37fca6d4e29f9d44fb58e47b4d
SHA512 e90a34dab98adc60f402c2795fcf9b00e2065a6cccaafddb4c1dbb9a127710dbf5fcfa4711cdf6fc11f165f5f944eee9777d52784d3407a346b96642907acd12
SSDEEP 49152:Zmmbj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeKAaLSF259ruMHwpXMi4FqJLdh:nKQRQyi36YOcP+Lvw2gAf+PN3
TLSH
T176666C13F3A501E8E05ED974CF3D56229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pUc1BD6.tmp

Path C:\Users\Admin\AppData\Local\Temp\pUc1BD6.tmp
Size 459KB
SHA256 25d58dff6e2919aef72ce8a6475cd0b4629f1b05b5b61364b53a38bf76d23860
MD5 f97bf45abd8b66c601e43e46f42f1983
SHA1 161f7801efec894f1aec0eade89c0777e63baac6
SHA512 2cf6af27027157f3bf875558fd01c47ada6e8ae0b6a41ef6d039c6377ce6ba083bbc3aca2f658a502fda7cf3ff97131c38caa22b34283b60c892480aa011a7b2
SSDEEP 6144:XFQ4afbQz3TOe6my2PcOq6KpCHNNHpq5Xgci38GQOF1vf5pS8Vb6IJ6noeL3X8e:XW4m8nt5o5XzXO7vxpS8xPKX8e
TLSH
T145A4AD21B2E044F6E0B31B344DB99225AA7BBD611B34C75F13A4465E9F73B909D3A323
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pUc1BF8.tmp

Path C:\Users\Admin\AppData\Local\Temp\pUc1BF8.tmp
Size 429KB
SHA256 c3d65f27348f315f90965a6ba56b156db7bf95f76744cb0127ca0649dacf7e5f
MD5 82db702f6f30abd69aded58e964c78d5
SHA1 e8eb6ae67128fe2eec4cc0332e0a3bfa522a4b5a
SHA512 901a425f4d089c896508361b37164f919c2db05a039e6302e7730e3e0029625207a638354c260c53f7fd2b1af828f1b446b30655db83b804e9fd08668be77a76
SSDEEP 6144:DFQ4afbQz3TOe6my2PcOq6KpCHNNgGQOF1vf5pS8Vb6IJ6noeL3X8G:DW4m8ntGXO7vxpS8xPKX8G
TLSH
T195945A1172D084B5E0B31A344DB7D6299E3ABD914E34C64F23F4779E9E337909D2A362
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pUc2801.tmp

Path C:\Users\Admin\AppData\Local\Temp\pUc2801.tmp
Size 436KB
SHA256 29490e1ad77b3bb58eca445d4284d5710c896662d92c87f2d9d4be404ecd884d
MD5 b09fc77371c9285b7afc7631d86aa73d
SHA1 e2ea0b59eef6a5accf9a9728fa3346099d644f9e
SHA512 0677ac1cece8619ffebf89b40f9ade150ac05d548ef95b12800d70739095859b2f5ba57da8a77765482715d1f345a05f318d1a2ece033fe992176a5f7ff568de
SSDEEP 6144:nFQ4afbQz3TOe6my2PcOq6KpCHNNmZEOHHrpm1ZGQOF1vf5pS8Vb6IJ6noeL3X8t:nW4m8ntktLpm1ZXO7vxpS8xPKX8t
TLSH
T1A594AD21B3E044F6E1B31A344DB9A625AA3BBD211F34C75F13A4465D9E33B909D3A363
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pUcF9F0.tmp

Path C:\Users\Admin\AppData\Local\Temp\pUcF9F0.tmp
Size 746KB
SHA256 9df42bd8a5a9ec13281d960baa844509fbf02a603d74e5d46ae3b704a3f16188
MD5 ced984da4ec3db1f2b10270035a910b7
SHA1 053d3d69ec90ced13f27049975064bf337fb7fba
SHA512 f738a1a55f436b57095e88ac98bdcba71d9af0aa6e5558ec0f981b5c238eca48287e185fa1702a7c2b5f66009b961ea67edf9d80f68a01ae98d6ab06a66072c1
SSDEEP 12288:/W4m8ntGfQo+XZNYVLeyUji0h90ZD0wxpGZIVuKrHsB:e4mWmk0Le5ji0hmxNrMB
TLSH
T1A9F43A25F6A88331D0F3C0B9C9DAB69AE93134451B3085DB5385DB6C7E277E68936332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pUcFA03.tmp

Path C:\Users\Admin\AppData\Local\Temp\pUcFA03.tmp
Size 416KB
SHA256 0052eb8bf0ee599a98eea42e3950c158d38da98df66d1881ee6c1f7d9757f4cb
MD5 77d0b51215739f48bcb227cf5e28f380
SHA1 ed4d49d0d504be8f71428d9a40e54f13d100ccc7
SHA512 a4e89c35ae511b6fc2daa6278d672a5d3ad5519d98c8908cb14bafda526d430fb6a6b1418171f8ea89ed241f8680cc598ab18053f7c744f8a261ed412f5d982d
SSDEEP 6144:tFQ4afbQz3TOe6my2PcOq6KpCHNNHwfQuP4GQOF1vf5pS8Vb6IJ6noeL3X8S:tW4m8ntmfQo4XO7vxpS8xPKX8S
TLSH
T188947C1172DC47B6E2F31A344D7CB625963A7D680B34C63F13E45A5EAE337909D2A322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pUcFA15.tmp

Path C:\Users\Admin\AppData\Local\Temp\pUcFA15.tmp
Size 889KB
SHA256 2288987eaf302f6aa7ffb6e153ade1b9b9c029741b6c70987b24bfe1f5bbb848
MD5 dfea4936ece73ded6e4f6439759cdd4f
SHA1 be6423d187eaec24f6c000f1a945b5958c06dab5
SHA512 0076e20e50491960c41386e10caf69ab7fcd656466cbd6f289ca9a635e85bade613c6c369f736da532040dd8b9ae674f7296c18f9cd1af47bf86725ca17b1248
SSDEEP 12288:jW4m8nt2fQoyVJjBq33vb5O8M+l1D0hwsEBoW/lx4Zf0Im98K:C4mW2wVbqPb88hv/l+7K
TLSH
T195153B65F5B88331D0B3C0B9C4DAB69AEA3238454B318ACB1385976C3E677D5D636332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pUcFA28.tmp

Path C:\Users\Admin\AppData\Local\Temp\pUcFA28.tmp
Size 211KB
SHA256 732f9d0aa11546c72320a79264feaffd227862672bbf4010e0542056d9edd9b4
MD5 da44938fdcd709756046e4ffe7b39bf4
SHA1 c76ef7993d78bc79ef805aa51b21166a5d175963
SHA512 2652922adbb97b5334a1bb934fff9d43376144089af6452fe07dd3bcd4730a5e7e5843b506387e6f0b5d1db951ae8853cb5157624ea2fe4649c453394bf48492
SSDEEP 6144:bFQ4afbQz3TOe6my2PcOq6KpCHNNkwfQuP8a7f:bW4m8ntBfQo8af
TLSH
T182245922B6CCC776E3D20AB44DBEF6755579BE2C1B14423BA3E47F4EAD702906906243
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pUcFA4A.tmp

Path C:\Users\Admin\AppData\Local\Temp\pUcFA4A.tmp
Size 2.3MB
SHA256 0f3674cc15998de98bca239e220c87cb4e21f0abe5ff82b411d32e1ffc24641d
MD5 73a3d1d84a889799c961d3d72793fc02
SHA1 f251f0c8c8eb889a767d4f823df23d5d16fa39c2
SHA512 ac22f387fb781894b8df781396a649b1ac427c75d25604127662476bfa73e575bebe27878c92049346ed16735e4c81755de157f6e8fcef358674a1dec3aa1d54
SSDEEP 49152:MmX/CbRquA/m2yL5zbfFiV+XenmE3/z8:DYoq2Vjnm
TLSH
T1CEB55B1976ACC2B4D1E6C77886A6C647F37178194B3097FF5265460E2E33AE48E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pUcFA5D.tmp

Path C:\Users\Admin\AppData\Local\Temp\pUcFA5D.tmp
Size 479KB
SHA256 56aab14779b6f53bcc8d50ee109f7cc1059ebb871bd6efec0c99a5f1e6e57f8b
MD5 0522914f9b1d997ae51cd3f17c569a58
SHA1 276e5e27a79a187fda4331eecd776294be06c6a8
SHA512 299aeef97fe54e13e3cc2e830956ec0e9b8f12dc6d4f4ff1f91841de47602aac6b6943b79a12163a4edcd44e99863fa14ea015d3717129e40aad5726c5d1c776
SSDEEP 6144:PFQ4afbQz3TOe6my2PcOq6KpCHNNpwfQuPyOOr/BJ/GKWWBNU6ITLBi0qttclOKH:PW4m8nt4fQodeBNUbTVO86UP
TLSH
T1B1A43A27AE6CEEF2C2FA4D745A9DF21097757C340B1193EBE2A4930EDE232D01D25916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pUcFA70.tmp

Path C:\Users\Admin\AppData\Local\Temp\pUcFA70.tmp
Size 245KB
SHA256 8ff6bea97cbd7780b0b9fcdbc827236f0698a3544b4deacaeea4d6b0524b697d
MD5 bcfaf56b29b6922be213aa5598421512
SHA1 849a54e1d06200b6e4eae45a3412501a98018cbc
SHA512 8aab44f13c93f505e5068875cae688355f0231157fc383803de8018237461d9bc6d3a166032f47c59e2b590241dea4412e4685183e38205293a1b9fed3be7476
SSDEEP 6144:LFQ4afbQz3TOe6my2PcOq6KpCHNNXwfQuP3cr0XA:LW4m8ntqfQo3C
TLSH
T1E3346A21B6CCC336E3E20A745DBDF6315578BE6C2B21823B63D4BE4EAD713906906257
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pUcFA82.tmp

Path C:\Users\Admin\AppData\Local\Temp\pUcFA82.tmp
Size 4.4MB
SHA256 2f295996645d8f512b0a216f670a4ba19356f71b3f67abbb449d2ffb0007f4ba
MD5 e0ae90c8846cb9f90fec4a75fce5c68c
SHA1 1d5d961ef929496609f03dd6abdb2299bda5387e
SHA512 238042b596d6c1cd735874e36c777f8c318e25eb535c996cb3259a1bcf001a26b37b30932ee437d672c0dfbd5c7a4170c77d82a0ebfbc7e8124a7d1bfbaee870
SSDEEP 49152:Jmc+QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJb9DN5J8NRVy:B+QvGAdlCEL8c/bRNw5C
TLSH
T1E4264A656BE880F5E0A7D174897A8572F77A78420D32EF4F0291CA6F3F336904D29729
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pUcFAA4.tmp

Path C:\Users\Admin\AppData\Local\Temp\pUcFAA4.tmp
Size 556KB
SHA256 03982321e0bbc22bd5dcabad416120234f010defc65576c0e09b50a523c32cb2
MD5 707a1be0bb3902f3623464bcece8e4b2
SHA1 13926d3e29be5fbfaf9cc97716af56863c86f7b5
SHA512 fa5bf92914882255490c5e01c78d294248bfed74f6ce7473ce6cdd804ce0663cb00b90b55a6c89875a39054d4b13667bb4d6a3da7bb1261c7ff76cd64ef7a209
SSDEEP 12288:PW4m8ntefQo6AwSfxL/2Dc3jDLLmt0LDQewsAjRz:O4mWeVaewsAjF
TLSH
T141C45A21FAACD636C3FB0DB11A6DF726543CBE240B5105E7E3E85E8E99302D12636617
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pUcFB05.tmp

Path C:\Users\Admin\AppData\Local\Temp\pUcFB05.tmp
Size 23.7MB
SHA256 cc892805ebb402378ef38c219855703ca488976d19a02704d3527dfe8b9f0a42
MD5 5e0c8eeaa309c75922ac0abcabe89b31
SHA1 e731d547b561abc158652e51ebfaf2c86bf3f2cd
SHA512 30f09fe1b0f9a57b8fc66f09ff5b1df88a8beacb6615d4d5db6c999820de2ba2d6416f3534b88f8081464d3c3a79524c5217b747988b7789436f62ab8e56fedf
SSDEEP 196608:UUEtQeTbvf2zlO12sJTv6Ja1cpVLyXIldPlbuJH:UUEtQevvqc2W1cpV2XI32
TLSH
T128474A91BBE843E2E3A6953484B182B6FBB17C0E1F36A73B1179F21E1F376905D15221
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2152-488-0x0000000000400000-0x0000000000472000-memory.dmp

Download

memory/2152-489-0x00000000008C0000-0x000000000093B000-memory.dmp

Download

memory/2728-682-0x0000000000400000-0x0000000000472000-memory.dmp

Download

memory/2728-683-0x00000000008E0000-0x000000000095B000-memory.dmp

Download

memory/3116-186-0x0000000000700000-0x000000000077B000-memory.dmp

Download

memory/3116-185-0x0000000000400000-0x0000000000472000-memory.dmp

Download

memory/3180-630-0x0000000000400000-0x0000000000472000-memory.dmp

Download

memory/3180-631-0x0000000000A40000-0x0000000000ABB000-memory.dmp

Download

memory/4152-540-0x0000000000400000-0x0000000000472000-memory.dmp

Download

memory/4152-541-0x0000000000A00000-0x0000000000A7B000-memory.dmp

Download

memory/4640-167-0x0000000000400000-0x0000000000472000-memory.dmp

Download

memory/4640-168-0x00000000006A0000-0x000000000071B000-memory.dmp

Download