3596dec82eb91db8fb8b3bcdee51519a13cd462d25e0cd2e3db80a88edcde1e7

Analysis

max time kernel
150s
max time network
133s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
18/05/2026, 04:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-18_be33540038a92fbf632984d8c841a3bb_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_magniber_njrat.exe
Size 27.7MB
Sample260518-e5yzcabw6r
SHA256 3596dec82eb91db8fb8b3bcdee51519a13cd462d25e0cd2e3db80a88edcde1e7
MD5 be33540038a92fbf632984d8c841a3bb
SHA1 a6eeefb44c4b45c85fd4ce5836c8fb84de27e530
SHA512 251a4f84f6094a3a94a8a903a25f63f4398b9322ec143a77591404d710de453083132ac9cc1ff174595713797096ab5e21802ab0ebcf58388d0b986f4d04bc4e
SSDEEP 786432:5P+0shcYjvRwTYXLteHkSE3DILO2Q7wl2H:5W0s9jvWTYbtQBIeev
TLSH
T191573301B8D140B7C0710039043C6B6B553EAE684B284DE77BD56B7DAD378925EBBFA2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery persistence spyware trojan

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
896	CuEyes.exe
2132	CuEyes.exe
560	CuEyes.exe
4996	CuEyes.exe

Loads dropped DLL 11 IoCs

pid	Process
3212	2026-05-18_be33540038a92fbf632984d8c841a3bb_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_magniber_njrat.exe
3212	2026-05-18_be33540038a92fbf632984d8c841a3bb_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_magniber_njrat.exe
896	CuEyes.exe
896	CuEyes.exe
2132	CuEyes.exe
2132	CuEyes.exe
896	CuEyes.exe
560	CuEyes.exe
560	CuEyes.exe
4996	CuEyes.exe
4996	CuEyes.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Windows\CurrentVersion\Run\CuEyes = "\"C:\\Program Files (x86)\\CuEyes\\CuEyes.exe\" /auto"	2026-05-18_be33540038a92fbf632984d8c841a3bb_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_magniber_njrat.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\CuEyes\resources\inspector\toolbox.js	2026-05-18_be33540038a92fbf632984d8c841a3bb_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files (x86)\CuEyes\resources\inspector\Images\deleteIcon.png	2026-05-18_be33540038a92fbf632984d8c841a3bb_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_magniber_njrat.exe
File created	C:\Program Files (x86)\CuEyes\resources\inspector\Images\fileSystem.png	2026-05-18_be33540038a92fbf632984d8c841a3bb_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_magniber_njrat.exe
File created	C:\Program Files (x86)\CuEyes\resources\inspector\Images\navigationControls.png	2026-05-18_be33540038a92fbf632984d8c841a3bb_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_magniber_njrat.exe
File created	C:\Program Files (x86)\CuEyes\resources\inspector\Images\radioDot.png	2026-05-18_be33540038a92fbf632984d8c841a3bb_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files (x86)\CuEyes\resources\inspector\Images\settingsListRemove_2x.png	2026-05-18_be33540038a92fbf632984d8c841a3bb_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_magniber_njrat.exe
File created	C:\Program Files (x86)\CuEyes\resources\inspector\Images\securityStateNeutral.svg	2026-05-18_be33540038a92fbf632984d8c841a3bb_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_magniber_njrat.exe
File created	C:\Program Files (x86)\CuEyes\resources\inspector\devtools_extension_api.js	2026-05-18_be33540038a92fbf632984d8c841a3bb_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files (x86)\CuEyes\resources\inspector\inspector.js	2026-05-18_be33540038a92fbf632984d8c841a3bb_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files (x86)\CuEyes\resources\inspector\emulated_devices\google-nexus-5-horizontal-keyboard-1x.png	2026-05-18_be33540038a92fbf632984d8c841a3bb_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_magniber_njrat.exe
File created	C:\Program Files (x86)\CuEyes\resources\inspector\emulated_devices\google-nexus-5x-horizontal-keyboard-2x.png	2026-05-18_be33540038a92fbf632984d8c841a3bb_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_magniber_njrat.exe
File created	C:\Program Files (x86)\CuEyes\resources\inspector\Images\navigationControls_2x.png	2026-05-18_be33540038a92fbf632984d8c841a3bb_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files (x86)\CuEyes\resources\inspector\Images\paneFilterButtons.png	2026-05-18_be33540038a92fbf632984d8c841a3bb_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files (x86)\CuEyes\resources\inspector\Images\touchCursor.png	2026-05-18_be33540038a92fbf632984d8c841a3bb_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files (x86)\CuEyes\widevinecdmadapter.dll	2026-05-18_be33540038a92fbf632984d8c841a3bb_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_magniber_njrat.exe
File created	C:\Program Files (x86)\CuEyes\resources\inspector\Images\chromeDisabledSelect_2x.png	2026-05-18_be33540038a92fbf632984d8c841a3bb_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_magniber_njrat.exe
File created	C:\Program Files (x86)\CuEyes\resources\inspector\Images\ic_warning_black_18dp.svg	2026-05-18_be33540038a92fbf632984d8c841a3bb_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files (x86)\CuEyes\resources\inspector\security_module.js	2026-05-18_be33540038a92fbf632984d8c841a3bb_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_magniber_njrat.exe
File created	C:\Program Files (x86)\CuEyes\locales\en-US.pak	2026-05-18_be33540038a92fbf632984d8c841a3bb_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_magniber_njrat.exe
File created	C:\Program Files (x86)\CuEyes\resources\inspector\Images\chromeRight.png	2026-05-18_be33540038a92fbf632984d8c841a3bb_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files (x86)\CuEyes\resources\inspector\Images\resizeDiagonal.png	2026-05-18_be33540038a92fbf632984d8c841a3bb_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_magniber_njrat.exe
File created	C:\Program Files (x86)\CuEyes\resources\inspector\Images\toolbarItemSelected.png	2026-05-18_be33540038a92fbf632984d8c841a3bb_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_magniber_njrat.exe
File created	C:\Program Files (x86)\CuEyes\libcurl.dll	2026-05-18_be33540038a92fbf632984d8c841a3bb_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_magniber_njrat.exe
File created	C:\Program Files (x86)\CuEyes\resources\inspector\Images\frame.png	2026-05-18_be33540038a92fbf632984d8c841a3bb_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files (x86)\CuEyes\resources\inspector\emulated_devices\google-nexus-5-vertical-keyboard-1x.png	2026-05-18_be33540038a92fbf632984d8c841a3bb_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_magniber_njrat.exe
File created	C:\Program Files (x86)\CuEyes\resources\inspector\emulated_devices\google-nexus-5x-horizontal-navigation-2x.png	2026-05-18_be33540038a92fbf632984d8c841a3bb_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_magniber_njrat.exe
File created	C:\Program Files (x86)\CuEyes\resources\inspector\emulated_devices\google-nexus-5x-vertical-keyboard-1x.png	2026-05-18_be33540038a92fbf632984d8c841a3bb_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_magniber_njrat.exe
File created	C:\Program Files (x86)\CuEyes\resources\inspector\Images\ic_info_black_18dp.svg	2026-05-18_be33540038a92fbf632984d8c841a3bb_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files (x86)\CuEyes\resources\inspector\emulated_devices\google-nexus-5-vertical-default-2x.png	2026-05-18_be33540038a92fbf632984d8c841a3bb_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_magniber_njrat.exe
File created	C:\Program Files (x86)\CuEyes\resources\inspector\Images\resizeHorizontal_2x.png	2026-05-18_be33540038a92fbf632984d8c841a3bb_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_magniber_njrat.exe
File created	C:\Program Files (x86)\CuEyes\resources\inspector\Images\resizeVertical_2x.png	2026-05-18_be33540038a92fbf632984d8c841a3bb_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files (x86)\CuEyes\libEGL.dll	2026-05-18_be33540038a92fbf632984d8c841a3bb_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_magniber_njrat.exe
File created	C:\Program Files (x86)\CuEyes\resources\inspector\components_lazy_module.js	2026-05-18_be33540038a92fbf632984d8c841a3bb_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_magniber_njrat.exe
File created	C:\Program Files (x86)\CuEyes\resources\inspector\timeline_module.js	2026-05-18_be33540038a92fbf632984d8c841a3bb_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_magniber_njrat.exe
File created	C:\Program Files (x86)\CuEyes\experience_optimizer_x86_mt.dll	2026-05-18_be33540038a92fbf632984d8c841a3bb_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_magniber_njrat.exe
File created	C:\Program Files (x86)\CuEyes\widevinecdmadapter.dll	2026-05-18_be33540038a92fbf632984d8c841a3bb_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files (x86)\CuEyes\resources\inspector\Images\applicationCache.png	2026-05-18_be33540038a92fbf632984d8c841a3bb_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_magniber_njrat.exe
File created	C:\Program Files (x86)\CuEyes\resources\inspector\Images\database.png	2026-05-18_be33540038a92fbf632984d8c841a3bb_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_magniber_njrat.exe
File created	C:\Program Files (x86)\CuEyes\resources\inspector\emulated_devices\google-nexus-5-horizontal-default-2x.png	2026-05-18_be33540038a92fbf632984d8c841a3bb_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_magniber_njrat.exe
File created	C:\Program Files (x86)\CuEyes\resources\inspector\emulated_devices\google-nexus-5-vertical-keyboard-1x.png	2026-05-18_be33540038a92fbf632984d8c841a3bb_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_magniber_njrat.exe
File created	C:\Program Files (x86)\CuEyes\resources\inspector\Images\searchNext.png	2026-05-18_be33540038a92fbf632984d8c841a3bb_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_magniber_njrat.exe
File created	C:\Program Files (x86)\CuEyes\resources\inspector\Images\securityStateSecure.svg	2026-05-18_be33540038a92fbf632984d8c841a3bb_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_magniber_njrat.exe
File created	C:\Program Files (x86)\CuEyes\resources\inspector\devices_module.js	2026-05-18_be33540038a92fbf632984d8c841a3bb_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files (x86)\CuEyes\resources\inspector\devtools.js	2026-05-18_be33540038a92fbf632984d8c841a3bb_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_magniber_njrat.exe
File created	C:\Program Files (x86)\CuEyes\resources\inspector\Images\errorWave_2x.png	2026-05-18_be33540038a92fbf632984d8c841a3bb_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_magniber_njrat.exe
File created	C:\Program Files (x86)\CuEyes\resources\inspector\emulated_devices\google-nexus-5-vertical-default-1x.png	2026-05-18_be33540038a92fbf632984d8c841a3bb_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_magniber_njrat.exe
File created	C:\Program Files (x86)\CuEyes\resources\inspector\Images\resizeHorizontal.png	2026-05-18_be33540038a92fbf632984d8c841a3bb_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_magniber_njrat.exe
File created	C:\Program Files (x86)\CuEyes\resources\inspector\Images\toolbarResizerHorizontal.png	2026-05-18_be33540038a92fbf632984d8c841a3bb_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files (x86)\CuEyes\resources\inspector\inspector.css	2026-05-18_be33540038a92fbf632984d8c841a3bb_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_magniber_njrat.exe
File created	C:\Program Files (x86)\CuEyes\resources\inspector\elements_module.js	2026-05-18_be33540038a92fbf632984d8c841a3bb_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_magniber_njrat.exe
File created	C:\Program Files (x86)\CuEyes\resources\inspector\heap_snapshot_worker_module.js	2026-05-18_be33540038a92fbf632984d8c841a3bb_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_magniber_njrat.exe
File created	C:\Program Files (x86)\CuEyes\resources\inspector\network_module.js	2026-05-18_be33540038a92fbf632984d8c841a3bb_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files (x86)\CuEyes\cef_100_percent.pak	2026-05-18_be33540038a92fbf632984d8c841a3bb_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_magniber_njrat.exe
File created	C:\Program Files (x86)\CuEyes\resources\inspector\Images\applicationCache.png	2026-05-18_be33540038a92fbf632984d8c841a3bb_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files (x86)\CuEyes\resources\inspector\Images\chromeDisabledSelect_2x.png	2026-05-18_be33540038a92fbf632984d8c841a3bb_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_magniber_njrat.exe
File created	C:\Program Files (x86)\CuEyes\resources\inspector\Images\deleteIcon.png	2026-05-18_be33540038a92fbf632984d8c841a3bb_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_magniber_njrat.exe
File created	C:\Program Files (x86)\CuEyes\resources\inspector\Images\toolbarButtonGlyphs.png	2026-05-18_be33540038a92fbf632984d8c841a3bb_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_magniber_njrat.exe
File created	C:\Program Files (x86)\CuEyes\resources\inspector\Images\securityPropertyUnknown.svg	2026-05-18_be33540038a92fbf632984d8c841a3bb_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files (x86)\CuEyes\resources\inspector\Images\securityPropertyUnknown.svg	2026-05-18_be33540038a92fbf632984d8c841a3bb_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_magniber_njrat.exe
File created	C:\Program Files (x86)\CuEyes\resources\inspector\temp_storage_shared_worker_module.js	2026-05-18_be33540038a92fbf632984d8c841a3bb_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_magniber_njrat.exe
File created	C:\Program Files (x86)\CuEyes\cef_extensions.pak	2026-05-18_be33540038a92fbf632984d8c841a3bb_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files (x86)\CuEyes\resources\inspector\emulated_devices\google-nexus-5-horizontal-navigation-2x.png	2026-05-18_be33540038a92fbf632984d8c841a3bb_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_magniber_njrat.exe
File created	C:\Program Files (x86)\CuEyes\resources\inspector\Images\graphLabelCalloutRight.png	2026-05-18_be33540038a92fbf632984d8c841a3bb_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_magniber_njrat.exe
File created	C:\Program Files (x86)\CuEyes\resources\inspector\Images\responsiveDesign_2x.png	2026-05-18_be33540038a92fbf632984d8c841a3bb_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_magniber_njrat.exe

Embeds OpenSSL 1 IoCs

Embeds OpenSSL, may be used to circumvent TLS interception.

resource	yara_rule
behavioral2/files/0x001900000002b58f-370.dat	embeds_openssl

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

defense_evasion

Install Root Certificate

T1553.004

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e20000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	CuEyes.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	CuEyes.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CuEyes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CuEyes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CuEyes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CuEyes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-18_be33540038a92fbf632984d8c841a3bb_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_magniber_njrat.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Software	CuEyes.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Software\CsE	CuEyes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Software\CsE\kv\v = "3TIfNu+uuDY=Ԁ"	CuEyes.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Software\CsE\kv	CuEyes.exe

Modifies system certificate store 2 TTPs 1 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	CuEyes.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3212	2026-05-18_be33540038a92fbf632984d8c841a3bb_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_magniber_njrat.exe
3212	2026-05-18_be33540038a92fbf632984d8c841a3bb_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_magniber_njrat.exe
3212	2026-05-18_be33540038a92fbf632984d8c841a3bb_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_magniber_njrat.exe
3212	2026-05-18_be33540038a92fbf632984d8c841a3bb_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_magniber_njrat.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
896	CuEyes.exe
896	CuEyes.exe
896	CuEyes.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
896	CuEyes.exe
896	CuEyes.exe
896	CuEyes.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3212 wrote to memory of 896	3212	2026-05-18_be33540038a92fbf632984d8c841a3bb_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_magniber_njrat.exe	80
PID 896 wrote to memory of 560	896	CuEyes.exe	84
PID 896 wrote to memory of 4996	896	CuEyes.exe	85

C:\Users\Admin\AppData\Local\Temp\2026-05-18_be33540038a92fbf632984d8c841a3bb_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_magniber_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-18_be33540038a92fbf632984d8c841a3bb_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_magniber_njrat.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3212
- C:\Program Files (x86)\CuEyes\CuEyes.exe
  "C:\Program Files (x86)\CuEyes\CuEyes.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Modifies trusted root certificate store through registry
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Modifies system certificate store
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:896
- - C:\Program Files (x86)\CuEyes\CuEyes.exe
    "C:\Program Files (x86)\CuEyes\CuEyes.exe" --type=renderer --disable-gpu-compositing --no-sandbox --lang=en-US --lang=en-US --log-file="C:\Users\Admin\AppData\Local\CuEyes\Cef.log" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --content-image-texture-target=3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553 --video-image-texture-target=3553 --disable-accelerated-video-decode --disable-webrtc-hw-encoding --disable-gpu-compositing --channel="896.0.752528407\362958453" /prefetch:1
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:560
- - C:\Program Files (x86)\CuEyes\CuEyes.exe
    "C:\Program Files (x86)\CuEyes\CuEyes.exe" --type=utility --channel="896.1.930385690\2015166522" --lang=en-US --no-sandbox --no-sandbox --lang=en-US --log-file="C:\Users\Admin\AppData\Local\CuEyes\Cef.log" /prefetch:8
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:4996

C:\Program Files (x86)\CuEyes\CuEyes.exe
"C:\Program Files (x86)\CuEyes\CuEyes.exe" /auto
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2132

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CuEyes.exe

Path C:\Program Files (x86)\CuEyes\CuEyes.exe
Size 2.2MB
SHA256 c94a9f22f0ab01822b5f2ecc95aa1f291d51dac35853411cde7f3fd478601068
MD5 93688c89440a31383fa9fca10ad17dc3
SHA1 cd3ccd6ec411ab330078a1e93804afec3c363aed
SHA512 0723aecdee1d90d13c721e3daca24d02ac8d70ba6da2122744b3f1c0918dd16d130785ac2f72e3bfdc152e7d0b6b539e8710b86b02464feed50f15912dae3abc
SSDEEP 49152:AgEYTOKczqJa3ZJZYZ/oFZIJeZq+07K/4d:AMTtczqyZJZYZyIJeZq+Mj
TLSH
T140A5AE227942C432D56011B169BDFBAE416ABE701B2144CBB7C52F1F8D306E29E3AF57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cef.pak

Path C:\Program Files (x86)\CuEyes\cef.pak
Size 2.2MB
SHA256 2b630beda09733863ee28d74a15da7644ce303120e1ac91a500077f00564ddd5
MD5 9d09aeaa99cb02639d68598611b2c556
SHA1 42ec412f3c3a984a531ea2495702a93e7fb64f09
SHA512 0ecd8995ae2e6c5696722d6deba61e53ad37059ea61c0b1cdf0d9c32f983a82d84f0eea9d81a1f79f18ba6fbf090a10bbd97ee075aa1c9798d9d7b7df646b88f
SSDEEP 49152:k+QA6bQaVNVtw5uwB2UKO0GGxsbMFsEMtggb7xqk2UQfVGGG2pLTux:4fGGG2pLTux
TLSH
T1CEB54B1A7B92033206E341656F5F51C9F329902B6A1AD914349CD29C1FBAE3443FFBE9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cef_100_percent.pak

Path C:\Program Files (x86)\CuEyes\cef_100_percent.pak
Size 141KB
SHA256 58f7ce00d589aaaebfaf3d0badac45924545e49f2d1531156f282eac7abb11b5
MD5 ad2ddfc39c78eedc734af6506a579a8c
SHA1 64e66d48ab3a98503948202dec3ff2f35470cd5b
SHA512 7482b0c4c51bf4d3c3389a6ccf9c59307911ba793116bac04077594d9b3d6f54a07e6187764201fba8bb31ede88b9ff65ab6867a2526e0f8e7b16136f7978367
SSDEEP 3072:Z7qrTpJroFYgI1epIMIZOgl95h4vjWX6pCa8+1pq0YAhstEtTUuS/po:Z74JrEXjIZJlHavSqT1YZYstATJ1
TLSH
T130E36EE7A3B0AC7DDB5A0773855A04B0ED724E791AA2014E4386F83A3D7670C98D87D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cef_extensions.pak

Path C:\Program Files (x86)\CuEyes\cef_extensions.pak
Size 4.1MB
SHA256 221a97daf8263321ceb9ce244452fc97b865b561e399b23d42682fef4785ea7f
MD5 6e727928ebeeeb5847c65c15c41802ed
SHA1 d22ba6f8e3160484dd40fd5f4eb685182f404d88
SHA512 d39e98d8d2e9afc84f8188e27e412079667df2174da14f93f451396ea1a27fd5abf9fb8218ff02c94b56c60e7e5e59a5819d50d2463ef6f6ad71d29cf1f155a8
SSDEEP 49152:a297+EfG5u8mWexScqKTtUtxT6z/t/G1hoLwpbeuR2oSKolWZHqYNYzv2v3zjKNL:keuKZULT6k1hq
TLSH
T1D7165B1D6EE6213285637179AFDF6144F339401B5216CAA47D9CC3E81FA4A3442BAFF8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

func_helper.dll

Path C:\Program Files (x86)\CuEyes\func_helper.dll
Size 128KB
SHA256 4df2a156c8d1ff0b729be8eb692e549342fe5a611a32e6cab8159c692ab0f415
MD5 df3af3a350cc822f2cf8410034240418
SHA1 e9444db42df7ced58935b71e546429ad27a26547
SHA512 f96a3a1b1d87cdf6a58d7701bef7362c50c021e64dee4e205a36483deb35b10cf1259b4dd0c0ff2aa4c519551d6cc3f89d28b0c302ff4ba1c13aac279f359251
SSDEEP 3072:AEbdtPJMAx8ZqN1lNWIXtSiC9iBf8JlIW+01:DbDJZLlIYylIW91
TLSH
T155D38D11B981C431D1BF1D381974CB725B7E7A30DFA19EEBA394126A4F701C0AE38E66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icudtl.dat

Path C:\Program Files (x86)\CuEyes\icudtl.dat
Size 9.7MB
SHA256 2857fbe46d007307b1e204c6eb1b7e4988973b958ec8edb07445988f332c1ab5
MD5 d03ad9a1189d190119209072d048e428
SHA1 aa954098e3ae4c00f67bace45b39a7b4a8242c6a
SHA512 4f73a2c0ceef525e5947dc6eeb7608db40e535eeadb37d83842bdd638eb4d9114f3654d8094c0b72c66ae4bb0214b0947cd4fe2b56426f778c07f3cac5faea21
SSDEEP 196608:L+7mOUgAjk3MVMP7mxl2b+2WYZjU15obkTQ89kxgc3bbHo4QY7iUT0ep:evWjk3mMP7mxl2b+2WYZjU15obkTQ89a
TLSH
T1F6A65B46A6FB4EC1FAF75F709AF852679963BD01AE31815D11042F3B0D733A48B64B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcef.dll

Path C:\Program Files (x86)\CuEyes\libcef.dll
Size 47.4MB
SHA256 bd8ce1462637fbd7fcfaa4969231d01ea917a59fe493f4a9c641e7c7e2c1d34c
MD5 5407554a485ec01c0305fde6d42616b4
SHA1 25492da77f53c6a83aedd6080bb1bae7cc5da424
SHA512 b8c19bde08ae1d1be4980b54f26f40ae5c9bbc55231dd889d0615419a6682faec64f08654c84c8866ff596c208c78a049bfab2d3fe6943fa7e494535602ce561
SSDEEP 786432:J1uZrmEVnYUZphXxUjdTMWh+5Qj03FBezJdQE6yH+itrN9qdADitZUwKaugPn405:JiBYeujdTMWh+5QjyTezIQH+i1N9qdA+
TLSH
T1CCB7BE23F4424039D6D342F19ABEBA2A96FC9A25033959E757CC5C489BB05E3733A353
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcurl.dll

Path C:\Program Files (x86)\CuEyes\libcurl.dll
Size 3.0MB
SHA256 0156ae258929ab47d94f8e4a7632f72aafd63944529475cab064abe7fc4f4f1c
MD5 192765c0e5285959d53a353c6f16b32c
SHA1 c4444e14110ccc96dfb7735155aa243ce948f0c2
SHA512 53a332a7c095289e78c650229a7005a66553d3b30de12272d105e5a6a1e53ae628a18e6ba6ddc4d709c531e90673b52bf5271d411313920ce265d8a60eba153e
SSDEEP 49152:fimvJbWauMhqZGGRcjfHU9PXqLT2Snn3WOlzFcPLd6XLjH:pJbWas4e/qLhn3zHidM
TLSH
T190E59E06FFC285A1E8CE017861B7577F0E3A4A189724D9D39BA128BADC315D1663F38D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en-US.pak

Path C:\Program Files (x86)\CuEyes\locales\en-US.pak
Size 39KB
SHA256 a76263a6b5c969a0b0a2cc90bdb86d35f3adaddef41884fa84832c24b0940192
MD5 ea20f7ef299ca680a72e9163c8ed0093
SHA1 f9ef3b9cc76f34f83142e1fcb67bf5c3f9031953
SHA512 c0d217475e81a629abce4cc3557f1ae3422eefcb27c71a36cdba607036977492eb5c28f31f3b9e9724fbda78661d29f27db816d18b86efc845b015298a6fe53d
SSDEEP 768:obq1iD/eqv9gNfDggl+dON+VcCwEpgmA1EmW+BlnkVSI/SBURkSNl:obq1iIfDggl+dO/EpVAppBAS2MURkSD
TLSH
T174032B9B53C5223E0AA20352A54757769718A0BD635241E5788CD1AC33BEB68C37BFE3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

natives_blob.bin

Path C:\Program Files (x86)\CuEyes\natives_blob.bin
Size 402KB
SHA256 7d9c0c4d88618bdd16bb0681fdec1dd736e2ed1141ae527a27b22fb93f27848f
MD5 8f4d6515f4d321313a39a659c3c5ff01
SHA1 f4c95f1abd24c715a3dd4b3e4c9cff5decda7250
SHA512 3c00eb9a8ca8d076140df0071cfa702e1c032edbc20481bb7f7b7a88c1a82c959b8ac901182c2f9d235f55b4528c8e12b1e765119f1e784645c61f66c1c2b007
SSDEEP 12288:ln3Cj7CQaMiyMzQ77Ua7Zm6ap4avfyM3G:lnk7CQWfy9
TLSH
T168940999BD95AC9342F344F8441F150DBDBC89689468D098F2CDC8E11BBA226573BF3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snapshot_blob.bin

Path C:\Program Files (x86)\CuEyes\snapshot_blob.bin
Size 474KB
SHA256 2073cac4abbb76eaf0693b8c15cd117638b8b046f4bad2938e7226084048ded4
MD5 a8176add4ce82b27c685dfa68f768ad4
SHA1 b3b9a33d1486eba6defa6aa410567e30e05c40f0
SHA512 530db28dd140628baf681508bfe4d0a9f77342b36808cd3433b43e349374e68d23e0534eb94ceda096be5d0f08943b9841e9722c6eba56ad5229e8dcb4f35fa3
SSDEEP 6144:h5a9x1hJCulzMq2+ok7G6RzkkR1Kjg2zE7TGrG2:/a9XfMq2+93zk41Cg2zE7R2
TLSH
T19FA41A8171D85DA6C0860A3160CE8355EE303C589EF42547FA8667ED3CFA7A2BF47B25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wzstat.dll

Path C:\Program Files (x86)\CuEyes\wzstat.dll
Size 407KB
SHA256 ee049ad61b8251a00e678a15c110192f77c667d74c74c4b6603d851700ac58be
MD5 dc5ea217d2947e163359d9cbb4029a80
SHA1 81215a5937a2f77bf0f6f4a7fb95974969239926
SHA512 2e30a645eb04f0a1ced4c79c20b644510b577698de98f4db9e59137d8df4911d73d12b0919d5d279c38b194aa0309cc5f8c2bac269fa0bf99497d4fc8b2d2aff
SSDEEP 12288:2WSpBhhbZl7LT7iPTLsUgp3sn5FjIVvtEG2om:2phf7i3sUgOjUviG2om
TLSH
T18F947C10B542C03AE5BF01349EBDAA5F56AC7A90073C98EBE3DC456F1FB45C16A319A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cfg.ini

Path C:\Users\Admin\AppData\Local\CuEyes\cfg.ini
Size 329B
SHA256 f3526e7567b01777aa51621baaf7e98ab6251ce967cb301a41acd8eb1561d5f3
MD5 cfacf1e2ace49da7d15d3bb7363369ec
SHA1 688ef7ba1bfc68f59e9e362d1a2c4b4dc4674056
SHA512 4e468da775cac2c4bfd4539fca5ade300e6775d7896f069871ec6b447be8448c9975b87365b3b4260d408f8427fafdf8ff4068ce74bba81f548df6a65c0147e1
TLSH
T1BEE02DA8798610185CF271CD2DF7A7608FC19E619A4E5F113E783638AA40BA1821E7A6
MD5 SHA1 SHA512 TLSH

Submit Download

cfg.ini

Path C:\Users\Admin\AppData\Local\CuEyes\cfg.ini
Size 376B
SHA256 9753dc3d8ed8cd22befa932598eeee76d6ac07f4765b8a2dff803abc20ab5107
MD5 adbc981c7f3ba871c04c189cd55ea468
SHA1 7a50319e2b126c01cdec945e6d9e9b662d2beb0c
SHA512 ee08f7c302dc19dd0c66044f4a5e0c6994bdef3d64afc966e2c5021486903d93571bab5895c22f5a2714d9ddd1776e1256101ea62d4ec99dda09007c20f3687a
TLSH
T1D4E092AC798600185CE274CE59FBA3A08FC58E65964E5F213E783634EE00BA14A0E7A5
MD5 SHA1 SHA512 TLSH

Submit Download

CuEyes.lnk

Path C:\Users\Admin\Desktop\CuEyes.lnk
Size 1KB
SHA256 9e7258875662fb0457c0b4d77e5864e0a71dfc2081d42d5f0298ab72bc184c4c
MD5 0e50fc1072f67b60d2ade7ee035a37c3
SHA1 7c066c7f58baeea6ebbecead722c93bc634c1d9d
SHA512 8a88eff50f4f4f5ecf1f9d206f7dfefff0fb96a58cf6a7359dba0abaefaef8979e16e80d4f9e71df7136f4962a570096c6bbf66c2f173dfebf9243dbe4c389b7
TLSH
T11A21B109C6C706B6D3A5DC715B7656231763FD42F9104F7E504442451CD560268ACF7F
MD5 SHA1 SHA512 TLSH

Submit Download

CuEyes.lnk~RFe584e69.TMP

Path C:\Users\Admin\Desktop\CuEyes.lnk~RFe584e69.TMP
Size 1KB
SHA256 60b5b612b20ee61b79dbc90c72d0b399af4a972b28e25c5c637c0065073b1a1a
MD5 3f50efa7754deaf7ea711978a3b5bdc4
SHA1 db016d7c90406a43c6832c5370ad7a1a1ad21058
SHA512 b4f9e12d61bc366ef9a53725ed3eeacfde1c370500c9d3da82a3466c7c9df87d8c053c758d3d71005446f473ae9e6f7d79c83ddf7f8d04569f789153529e1ee8
TLSH
T1D311C00ACAC7067AD3E5DCB25BB746232B63FD02FA114F6F5084424518E5602A4ACF7F
MD5 SHA1 SHA512 TLSH

Submit Download

memory/560-439-0x000000001BE00000-0x000000001BE01000-memory.dmp

Download

memory/560-471-0x0000000004A90000-0x0000000004A91000-memory.dmp

Download

memory/3212-0-0x0000000000A20000-0x00000000025D7000-memory.dmp

Download