113360c4664349e2a996427aae9bf8b76514a36a4e048e9c40ac741ad51bec9e

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/07/2026, 02:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-06_7d58f9fbcf6e3e531acb29f6f87b70df_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
Size 10.3MB
Sample260707-c8ptqsdv4j
SHA256 113360c4664349e2a996427aae9bf8b76514a36a4e048e9c40ac741ad51bec9e
MD5 7d58f9fbcf6e3e531acb29f6f87b70df
SHA1 13206f33af82eb25b0247917737bf2413f12749d
SHA512 a122537653567e6f46a74b452e51e2062cec26667e8b113a42e0374dfa1d300ea101eddad2b0553ac2367ba6f67a59babd06d14252ea37714e21f7473e330260
SSDEEP 196608:gD8raFimwfAibMapSDyRqCbCgWo2jN+5D5iS7b:rqzwfAiQGS2RqCbCgW18D5iS7b
TLSH
T1E6B69D22B215C032F9A011F1692FBB6A62287D39637084DBF5E19F6D11E56C34B36F1B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

adware defense_evasion discovery spyware trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-07-06_7d58f9fbcf6e3e531acb29f6f87b70df_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3924_956133586\Microsoft.CognitiveServices.Speech.core.dll	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4244_277315873\Part-IT	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4244_277315873\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4244_1055626639\hyph-af.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4244_1055626639\hyph-cs.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4244_1055626639\hyph-ml.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4244_1055626639\hyph-sk.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3924_1557985728\Mu\Other	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4244_1055626639\hyph-bn.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4244_1055626639\hyph-kn.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3924_1557985728\Mu\TransparentAdvertisers	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3924_1557985728\Sigma\Fingerprinting	msedgewebview2.exe
File opened for modification	C:\Windows\SystemTemp	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3924_24063115\Part-ZH	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4244_1055626639\hyph-bg.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4244_1055626639\hyph-de-1996.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4244_1055626639\hyph-en-us.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4244_1055626639\hyph-la.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4244_1055626639\hyph-nb.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3924_1557985728\Mu\Advertising	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4244_277315873\adblock_snippet.js	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4244_277315873\Filtering Rules-AA	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4244_277315873\Part-DE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4244_1055626639\hyph-nl.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4244_1055626639\hyph-sq.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4244_1055626639\hyph-und-ethi.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3924_1557985728\Mu\Analytics	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3924_1557985728\Sigma\Advertising	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4244_1055626639\hyph-it.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4244_1055626639\hyph-te.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4244_1055626639\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3924_1557985728\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3924_1557985728\Sigma\Staging	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4244_277315873\Filtering Rules	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4244_277315873\Filtering Rules-CA	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4244_277315873\Part-ZH	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3924_24063115\Part-ES	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4244_1055626639\hyph-cu.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3924_1557985728\Mu\LICENSE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3924_1557985728\Sigma\Content	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3924_1557985728\Sigma\LICENSE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4244_277315873\Part-FR	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3924_24063115\Filtering Rules-AA	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4244_1055626639\hyph-cy.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4244_1055626639\hyph-gl.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4244_1055626639\hyph-hr.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4244_1055626639\hyph-pa.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3924_24063115\Filtering Rules	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4244_1055626639\hyph-ru.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4244_1055626639\hyph-ta.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4244_1055626639\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3924_1557985728\Mu\Social	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3924_1557985728\Sigma\Entities	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4244_277315873\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4244_277315873\Part-ES	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4244_1055626639\hyph-de-ch-1901.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4244_1055626639\hyph-en-gb.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4244_1055626639\hyph-hy.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4244_1055626639\hyph-lt.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4244_1055626639\hyph-or.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4244_1055626639\hyph-sv.hyb	msedgewebview2.exe
File opened for modification	C:\Windows\SystemTemp	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3924_24063115\LICENSE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3924_24063115\Part-RU	msedgewebview2.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-06_7d58f9fbcf6e3e531acb29f6f87b70df_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	2026-07-06_7d58f9fbcf6e3e531acb29f6f87b70df_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	2026-07-06_7d58f9fbcf6e3e531acb29f6f87b70df_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	2026-07-06_7d58f9fbcf6e3e531acb29f6f87b70df_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe

Enumerates system info in registry 2 TTPs 10 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	2026-07-06_7d58f9fbcf6e3e531acb29f6f87b70df_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	2026-07-06_7d58f9fbcf6e3e531acb29f6f87b70df_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	2026-07-06_7d58f9fbcf6e3e531acb29f6f87b70df_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	2026-07-06_7d58f9fbcf6e3e531acb29f6f87b70df_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	2026-07-06_7d58f9fbcf6e3e531acb29f6f87b70df_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\2026-07-06_7d58f9fbcf6e3e531acb29f6f87b70df_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe = "11001"	2026-07-06_7d58f9fbcf6e3e531acb29f6f87b70df_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe

Modifies data under HKEY_USERS 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe

Modifies system certificate store 2 TTPs 12 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000\Software\Microsoft\SystemCertificates\AdobeCertStore\Certificates\85E2C5B0D9CFF505363FA62A5E8B8C1D76A60B46\Blob = 03000000010000001400000085e2c5b0d9cff505363fa62a5e8b8c1d76a60b462000000001000000bc050000308205b8308203a0a003020102020426c66cd0300d06092a864886f70d01010d0500308185310b30090603550406130255533113301106035504080c0a43616c69666f726e69613111300f06035504070c0853616e204a6f736531163014060355040a0c0d41646f62652053797374656d7331193017060355040b0c10436c6f756420546563686e6f6c6f6779311b301906035504030c1241646f626520526f6f742043412031302d333020170d3138303831373137333831395a180f32303638303830343137333831395a30818e310b30090603550406130255533113301106035504080c0a43616c69666f726e69613111300f06035504070c0853616e204a6f736531163014060355040a0c0d41646f62652053797374656d7331193017060355040b0c10436c6f756420546563686e6f6c6f67793124302206035504030c1b41646f626520496e7465726d6564696174652043412031302d313930820222300d06092a864886f70d01010105000382020f003082020a0282020100b533b875034a0e7563110700e026d838b4ed1369ee54d6db09ebf764a4778ef8a7dc7dfba9386a78e61be8ff8722d2ca1535cc02c111f9fae54fdc09698d22d9d936b3133aab757b596a1c093cf3559f351d3f10dc44fb0f9787e1f685e83dc775c74d0e563f1509071a1d4bcd919d0b9ebaf925867a85e7e5b9b13040760dfbe2a9bd70e028963dd69631e9cf2f5ca3a6634ac8bfe2dae5cde9df35e935b4f88a17fc78786052badf6e5a378e34a16d16ec7eeb69bf0917fd7210ae129ae2b5f3473e28ea73e25e81176229f0ad99b74069cf6c30413ab85d86f7fec519e01806a928cf2e5ea9c9aae9f57a60401e76313fd017bbe23541b455da6c7d49e39f6b451a67ea2160056781067c489526d297410ac05e87fbeca66d75bda1eaeec9652891598957f4c19fb53ec491b1d600d1ad75d7c164d613ba6ce275682f44399515c247d11d72dc440fd800225a13ae8d16494eaa9f1f82120d2f51243683d2aa62cdcf5be075720b7d566eadb5e46ee3299b43296a49bf3fbe2e672e72e42e7918e608466028de4f215cd362cfd921200ff946168717d09af99095950812f5a4de4073e2c5697a318b9eb51a585a36e74dbd8fb7277c8aeb7ddd42ffbeb32c181f9edaddc1480b95f16e7ea37d0dab3f2f5009d570aa4624b66a7017c75f1caa7c544e15def0c6e6cf6a4f26312b68f633b7a5a4203c97e77a32141e7cf4970203010001a3233021300e0603551d0f0101ff040403020204300f0603551d130101ff040530030101ff300d06092a864886f70d01010d050003820201005bd66c82ca184490136b886ef3b5f5b6866768c8cfd13f701025aeb8dc8b7b4539c071032663327f1b55d773e062ea01551038bc12895b4a760a23ec0ef1e24c1d25649b12dad880b576a952ba1f9d1ed0c5bdf45e8a9f9465c091e22ff7165912fba642b3e2979897339ab2ae511615d3e20b27e3e60e13fe188c7c7119f14029ccfaf1e9fef5c7e53ce1c0d1cfcb8507131c446af5b7f67b701e1ee4151cadd14048737cf0ec86f8964d75b8509bf07a984441641622568d5ea1b9124101db76c578bee86acdb651a90b5c3abdab541f3a41e82cbfc0d30319e1975924540a71e8d1a3603caade3cefcf0b362b62fa09efe97827276b0b79f58553136c89aa72a9f3f7fdaa87e5789978abe6af28c04f7d673954594329ace012159c5ee6b2cb43b55f507e0e0f68233e8a3c6fe13a2cb23b4f38ddecaeae21e99bd6e152793ad59b8286256ede041654cb8a7c069d773868f8bddea44fccdcfc4c0cfec6f9357093024d88519a40bdb3b77b0988051418fcba0a67c5caabc66f21d094e5d612dd7f951291892a4f8ef35efdb2c9d940fcbddfdb75d19b1b215a36dec147c9d716bb4a06047e90d0d0fad64a56f24a6b650843d5cdd2aba7e8894b4693d775aebc8d65063d1813b0be5c9c6357c43be7aea9b3b6021935acc2b8f38746aeab5eaa06f447be0cfff20b38811e273023cd035f14ad3a7babee646909282cc3ef	2026-07-06_7d58f9fbcf6e3e531acb29f6f87b70df_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
Key created	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000\Software\Microsoft\SystemCertificates\AdobeCertStore\Certificates\4C7C2E87F0BC79A039D39B05F899A1CC521FDE99	2026-07-06_7d58f9fbcf6e3e531acb29f6f87b70df_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000\Software\Microsoft\SystemCertificates\AdobeCertStore\Certificates\4C7C2E87F0BC79A039D39B05F899A1CC521FDE99\Blob = 0300000001000000140000004c7c2e87f0bc79a039d39b05f899a1cc521fde992000000001000000c3050000308205bf308203a7a00302010202046e271780300d06092a864886f70d01010d050030818e310b30090603550406130255533113301106035504080c0a43616c69666f726e69613111300f06035504070c0853616e204a6f736531163014060355040a0c0d41646f62652053797374656d7331193017060355040b0c10436c6f756420546563686e6f6c6f67793124302206035504030c1b41646f626520496e7465726d6564696174652043412031302d3135301e170d3233303830373133343834335a170d3330303830353133343834315a308191310b30090603550406130255533113301106035504080c0a43616c69666f726e69613111300f06035504070c0853616e204a6f736531163014060355040a0c0d41646f62652053797374656d7331193017060355040b0c10436c6f756420546563686e6f6c6f67793127302506035504030c1e41646f626520436f6e74656e742043657274696669636174652031302d3730820222300d06092a864886f70d01010105000382020f003082020a0282020100ad280d5cfb35f4129a580996209e83cd117cab917f7f8b85e353c39899fa07bc7050077db622fe4b43c477c0abb8325a1ee90f76416e2af5cb76ed9ccec153694c6add14358e1c5c45d32db721654781ba134e981ae3b21d56fe739afd397db8101fa65554ad67d9b808d45487d9913bd7cf30e094a948546da75f51395ab7b0f122244976683d87ce6797aaea3d5ee468553fc658b2b9530e33e2aa418950458d4147270f8773e3d93da7df6a1e8f58e439218236d110a658bf5037260d3f596e1f06b9e963f758eca3f99faa454640628e3bc66c16e914aad9bea5a47f954ca0ff73cf4237e8545e5e82f66795493508a6852f4564ef44dbb31b23c27d6dcc54e749094bb404073ed05ab6bf54afadec8ea7b58ce2d935c4b0ec8a054bef86cebfd63faab8fae41104e8bdaf1f3f2474d78e050c8f33510c80abba83c0da198107e47b40cd119b71827a510ae65e9b97d5e617b397cf517cfecbc47a890bbc350c5b631a50f254151d4d84cd512e0f57241e10b1bd1569287a900d4bf4a23532556266bc1c8b1014972f126b20a2e2e7db73774eb822669fc2bcf56d817ee3f5d20f9b029ec62d377d5328000ce5d921c965337c500416a6c3e828ed27ad8ed370f8b9035c322ce75ed6de25002e363475f95e24ad6e30b9350eb2934a431bf09c8b4df073213fd6393192d796022b4275a73e5b4a2bf3b226d6a537e96c450203010001a320301e300e0603551d0f0101ff040403020780300c0603551d130101ff04023000300d06092a864886f70d01010d05000382020100315188a437cb6a526ab679d888ef1051ea301191b36ff818d3e7e1b8cbc8e1c078fc058e0d7bd61b11fd8efef27b411c3f494f6734c286008ffb39d2eecf012929913628c5b160f6ca24fab63068fc48cb91293fc302f3d16f5de8dbdfe3a57abca9a081c4cfa82fa3e06f36a318251a351c5e08fe4f4a286d1ebb4bf87278f7e54faf53e1b37148f19f210136c5f3b5981a89a3aaf8351490555d001aee6c9ab2bd27cc13d162ef6314c47fce2c668e16ed641d2b6871ef3b0afbc8e5e2b93d775049061496057a361c2cd1ed7cbdadd143a0f114e9d5066c6e2f2bfd771b44c8979cf0f094d2d89e104c935ef362eabcccda4559bb33e640b3c1920cf314688fdc639665e8e81f6b9312516d937a6db751fd39e044271432d0e83bfcb5e8df5cbe2a7c15e272e09aa96f939ac7b6655fcfe91e59474b3a4cecf12490cb1f3aa2a80ae53cbe867ccaeff9ca84d487bf438f4213b253148ff8be54caee1e4aa157353f707a966f946e89a8fc8964849eb948bd54b2b2e6d1dd85ba7df45208206472a5aa93860c5ee8f6460739ea3231ec590f09602ff29f09ecedbdbd635cb42670c8288b3f051dd6c393240d0a668b9a2c20bd70f182ce58d152089385ab717c7c624826ec39424050ad45048927d2e771be6f6693055589f3612df47c206d6ae8600f9d60f7aebc5567458d8a423b76d6082ab213fff88584909e76b458ab	2026-07-06_7d58f9fbcf6e3e531acb29f6f87b70df_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000\Software\Microsoft\SystemCertificates\AdobeCertStore\Certificates\A5C8D928986EC17FCC7D5F2353885D1709B73A29\Blob = 030000000100000014000000a5c8d928986ec17fcc7d5f2353885d1709b73a292000000001000000bc050000308205b8308203a0a00302010202047ce3bf47300d06092a864886f70d01010d0500308185310b30090603550406130255533113301106035504080c0a43616c69666f726e69613111300f06035504070c0853616e204a6f736531163014060355040a0c0d41646f62652053797374656d7331193017060355040b0c10436c6f756420546563686e6f6c6f6779311b301906035504030c1241646f626520526f6f742043412031302d333020170d3138303831373137333831355a180f32303638303830343137333831355a30818e310b30090603550406130255533113301106035504080c0a43616c69666f726e69613111300f06035504070c0853616e204a6f736531163014060355040a0c0d41646f62652053797374656d7331193017060355040b0c10436c6f756420546563686e6f6c6f67793124302206035504030c1b41646f626520496e7465726d6564696174652043412031302d313530820222300d06092a864886f70d01010105000382020f003082020a0282020100a0e7345276469020a420dfb0569684d7adf0f493a0a0a53742c25e1bf39a91a481ae07efcf40586a5b42a776dad12710078884bfcb2c3af2bdd70b4301490e58de99cb28b1dc5befd617dadfc34c653d9ef643ff6fd9069cb2ad740ebf1abc42c9fabb8a65cd0d76e9b0b64c77ec0e9350da1ba5f3aabbad9e076e2aebb3af34809dd50bb29cb26577536791a0c672c843fd11a60ce5aa99e0ac5ff81819ab8d4306e790040b6d9d4eb9e37b88d9bdfd8271ee8ba557aff9ec66da32c1f483cc84e0e9af352f5fd083e0933047a13529568e22491266b576b50af641676031593285135758d3f86467159b00ff3662b885dc7a331a1b658c42ae8e76101a67abf22002b4ccf330b966d05f63a91870ef56916ff131a0b8737e111413bc3620c593d5c1452012ec77d77b99240ab972c2fd0d20474bb9c63f1053cfded7de55d57e2d735ac280e1faa8f8af095fb29d5b03b7e45ff8c6d1a7c052e0854418d27c9adb3e40032000e988fd8f6f556bd956e85eed4e7c4d1916c4fc090c27e6b1a3bdaadf8eda48c81b212feee1f1b97ebe4b2ed98b49662c101efdb212720d73a7a432af6d816c7997a5485dae77209f060718e50c524d089750a51bfab47e04fccbf04017762c3597fa5b52b2394b7159053034065e17c184c25736ac793c6e2b25e04d59dc1fe74f9e338c719573d6d6b4b29ea7adbc259e5d4fb4d0fa89a92b0203010001a3233021300e0603551d0f0101ff040403020204300f0603551d130101ff040530030101ff300d06092a864886f70d01010d05000382020100501c3b74f2e4857d8171cffe355895c8241c0590b0f5a81321aad9b328916dc68479ed41c47396336cae923db8c14276504c81f99ee5d961fae32ea75fa707717fe6d3a0cdea05bd40c1d69f21a619b09209f09be929c02125020d7eb9e94670ef57bc02080be6718832fd9f5e7fbfd1bd75c278665582452f66a282d7bcb7936bc336ff64ab06a4a5f12f4a4592dd13ac944fc5a2dd8b084fa429d2eecc10fd7e9a5be17b8c235a12c3e48e0df101837bcd4563cac3e02d7b93e172847881db7ed7e3c01e5e426fe51ee67262154daba09ea358bd10e8d10a9028e6dded33fa8c0b5e5e88d751a73bc68cbd30ebed017024affcc1a3942010531a398ea8120158d78c214e813d6023ec021e80967de3131284f80d0650b1a068d7c5e2bf7f8e019c70db26ee5f0d1719240c7a06c66344d95749b73aff74d6471d97297a248370f30b76d15d576e24fc4f2ac5960eb03d44d9fd145415eb99960802ff81c17439d9594187ffeb98e6e6f1ec11b44fb24eaadfcc1e9107e03eafb42bc717d3a0db4a73c66f0a22c7924a400b02742ea8609051927fac69131dba15df08d152e226764f30438bdb422a895c7d0e60b1da26370806914e4cc1dac1777385d470c81292d597def9c7bbdbca6ed5d8a36cbd97c159590fd075b93c32a22e2405fad8c239b66cdc016e3ffe13c191065ecfefcabdaac7164846611cf24ac9506e7af7	2026-07-06_7d58f9fbcf6e3e531acb29f6f87b70df_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
Key created	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000\Software\Microsoft\SystemCertificates\AdobeCertStore	2026-07-06_7d58f9fbcf6e3e531acb29f6f87b70df_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
Key created	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000\Software\Microsoft\SystemCertificates\AdobeCertStore\Certificates	2026-07-06_7d58f9fbcf6e3e531acb29f6f87b70df_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
Key created	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000\Software\Microsoft\SystemCertificates\AdobeCertStore\CTLs	2026-07-06_7d58f9fbcf6e3e531acb29f6f87b70df_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
Key created	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000\Software\Microsoft\SystemCertificates\AdobeCertStore\Certificates\686DF0A4A89F7CB6BFB4D33C6A48E2EE5FB6C4FB	2026-07-06_7d58f9fbcf6e3e531acb29f6f87b70df_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
Key created	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000\Software\Microsoft\SystemCertificates\AdobeCertStore\Certificates\85E2C5B0D9CFF505363FA62A5E8B8C1D76A60B46	2026-07-06_7d58f9fbcf6e3e531acb29f6f87b70df_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
Key created	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000\Software\Microsoft\SystemCertificates\AdobeCertStore\Certificates\A5C8D928986EC17FCC7D5F2353885D1709B73A29	2026-07-06_7d58f9fbcf6e3e531acb29f6f87b70df_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
Key created	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000\Software\Microsoft\SystemCertificates\AdobeCertStore\CRLs	2026-07-06_7d58f9fbcf6e3e531acb29f6f87b70df_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000\Software\Microsoft\SystemCertificates\AdobeCertStore\Certificates\686DF0A4A89F7CB6BFB4D33C6A48E2EE5FB6C4FB\Blob = 030000000100000014000000686df0a4a89f7cb6bfb4d33c6a48e2ee5fb6c4fb2000000001000000c3050000308205bf308203a7a003020102020401cfbd1c300d06092a864886f70d01010d050030818e310b30090603550406130255533113301106035504080c0a43616c69666f726e69613111300f06035504070c0853616e204a6f736531163014060355040a0c0d41646f62652053797374656d7331193017060355040b0c10436c6f756420546563686e6f6c6f67793124302206035504030c1b41646f626520496e7465726d6564696174652043412031302d3139301e170d3233303830373135313132375a170d3330303830353135313132355a308191310b30090603550406130255533113301106035504080c0a43616c69666f726e69613111300f06035504070c0853616e204a6f736531163014060355040a0c0d41646f62652053797374656d7331193017060355040b0c10436c6f756420546563686e6f6c6f67793127302506035504030c1e41646f626520436f6e74656e742043657274696669636174652031302d3830820222300d06092a864886f70d01010105000382020f003082020a0282020100d119f9b8d2d41d892abf9f1f3cd1f947141b9867e9be6d96e479c74c87e42f61f5b927bccb7caebe27b26465b8e2f1118c2041980b88d7f559b8f9d041110e19f29ce5033fe9b8184d47982257e97d1b62744521bc329a7861a2376eeb8f3248eb031a7b43b1f22174fcc3c642033770137cad8329b240970127edd3030d9a69af242fc7405b5867d0f5950bb0b79f702e84180ee43ca21f46adce07ad014f5cfd7be25e735eb0431889bcce40a4e94791fca5a65da24838d189b85218c9961eb1bce8db4cb2ffc7a2c3419788e68098350cacc6aa61dfb3d8476454927f9ab767037a84ed4e39862b3f386a065b169403259617150679e34af188035d8bebd9f4f22544cbf81f0d0516799d39a17a56c12e5c151945d65084367647c6f6a78ade46f7bcc0b8aca7d8abfe3eb34ab2d1fb7800a98da86c8da956b267e309634d55ff7f6570f9b926bd602d4a94e77c662d1479c576b972d87bb35ea634b5f676774d40e04a0a908948c269c7dc71778ed5d15d9b8f4519ee858bc273a49afc7a206afd97286716b832e64154a074305d7bbcb7f2205017d1ed5ca6e42edc6d35fabc88dd188028b15e5aa5296e12c03486a80a6e3cb0c001e4742b1edf02fa70c2ebdcbec606480054fc467729e99d1eb80bee04b36fb17c722068079146fde54b06c3ec5c4bafaf113d2000ef36aebe8454560e81d0cf982a798bae3c39cd430203010001a320301e300e0603551d0f0101ff040403020780300c0603551d130101ff04023000300d06092a864886f70d01010d050003820201006bf0137ee63d74f0df4ee19376625ac33574898a025b764e9bd69f8c7d9fa1c7f9b58f0355f206cab84927d626275a8fd0d1c6a3b9a7811b361a68523ad86199ec1188922ce525246bfef1b4dd23eb5b8ee0894d4495ceb1c0f27bca3812c7c02432f9a693c7a331c53162a76c687c0ff60b31389a0e11f9da1fd8ceae91ff671222083643e0a7c0b97f170ab051856ab58c8b3278d16753cfaac05cec9a08c0fcc2e993aaea79225d70e9ec8bfb53c93be8915b2026a35bf05d3c9e5e417fabc5648d9fd8f153e8787f1e3cdd637fe2abd8c8a5d1c9171c342e588a77ff2739dc6b88c79dc933dedf535c496ba652a184b6b65b831aa7706251494108d58f8565624e37a343696f2e42c029333dab8b1a9e34bda64b58546906e9bd3f0d67f3cb830e8b6bf3b01f653c938da93b53a6878a14fe75550b546d580fa40f0e6e6fac25113513f48c9fc79b27689b906afd59d11abbdf4fde466d2a93431606db3938d9e9f7505d1a0cd91e4f116a2f3e1837ba0c1ab0cc74724916a65d9b2c09b00eef96bda7156f789449923371b5aac2a6728b0b3e71ac656ebc820bad65977cebaf56611c8d322c78af95c5dc1c2e56d95eca6efb5664010860dd6c82faf60a9cd493eecc6b013449633928d96bb0d38f28f838564db989958ecfd5325fa51f8ec4148545c5a94705beb7200b427f978959cc7a031fe58f7e2f42ad48e3bb82	2026-07-06_7d58f9fbcf6e3e531acb29f6f87b70df_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
5300	2026-07-06_7d58f9fbcf6e3e531acb29f6f87b70df_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
5300	2026-07-06_7d58f9fbcf6e3e531acb29f6f87b70df_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
5300	2026-07-06_7d58f9fbcf6e3e531acb29f6f87b70df_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
5300	2026-07-06_7d58f9fbcf6e3e531acb29f6f87b70df_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
5300	2026-07-06_7d58f9fbcf6e3e531acb29f6f87b70df_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
5300	2026-07-06_7d58f9fbcf6e3e531acb29f6f87b70df_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
5300	2026-07-06_7d58f9fbcf6e3e531acb29f6f87b70df_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
5300	2026-07-06_7d58f9fbcf6e3e531acb29f6f87b70df_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
5300	2026-07-06_7d58f9fbcf6e3e531acb29f6f87b70df_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
5300	2026-07-06_7d58f9fbcf6e3e531acb29f6f87b70df_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
5300	2026-07-06_7d58f9fbcf6e3e531acb29f6f87b70df_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
5300	2026-07-06_7d58f9fbcf6e3e531acb29f6f87b70df_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
5732	msedgewebview2.exe
5732	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
4244	msedgewebview2.exe
3924	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	5300	2026-07-06_7d58f9fbcf6e3e531acb29f6f87b70df_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
Token: SeIncreaseQuotaPrivilege	5300	2026-07-06_7d58f9fbcf6e3e531acb29f6f87b70df_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
Token: SeIncreaseQuotaPrivilege	5300	2026-07-06_7d58f9fbcf6e3e531acb29f6f87b70df_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
Token: SeIncreaseQuotaPrivilege	5300	2026-07-06_7d58f9fbcf6e3e531acb29f6f87b70df_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
Token: SeIncreaseQuotaPrivilege	5300	2026-07-06_7d58f9fbcf6e3e531acb29f6f87b70df_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
Token: SeIncreaseQuotaPrivilege	5300	2026-07-06_7d58f9fbcf6e3e531acb29f6f87b70df_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe

Suspicious use of WriteProcessMemory 47 IoCs

description	pid	Process	procid_target
PID 5300 wrote to memory of 3924	5300	2026-07-06_7d58f9fbcf6e3e531acb29f6f87b70df_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe	88
PID 5300 wrote to memory of 4244	5300	2026-07-06_7d58f9fbcf6e3e531acb29f6f87b70df_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe	89
PID 3924 wrote to memory of 4296	3924	msedgewebview2.exe	90
PID 4244 wrote to memory of 5388	4244	msedgewebview2.exe	91
PID 3924 wrote to memory of 3408	3924	msedgewebview2.exe	92
PID 3924 wrote to memory of 3408	3924	msedgewebview2.exe	92
PID 3924 wrote to memory of 3408	3924	msedgewebview2.exe	92
PID 3924 wrote to memory of 3408	3924	msedgewebview2.exe	92
PID 4244 wrote to memory of 3780	4244	msedgewebview2.exe	93
PID 4244 wrote to memory of 3780	4244	msedgewebview2.exe	93
PID 4244 wrote to memory of 3780	4244	msedgewebview2.exe	93
PID 4244 wrote to memory of 3780	4244	msedgewebview2.exe	93
PID 4244 wrote to memory of 1600	4244	msedgewebview2.exe	94
PID 4244 wrote to memory of 2748	4244	msedgewebview2.exe	95
PID 4244 wrote to memory of 2748	4244	msedgewebview2.exe	95
PID 4244 wrote to memory of 2748	4244	msedgewebview2.exe	95
PID 3924 wrote to memory of 1672	3924	msedgewebview2.exe	96
PID 3924 wrote to memory of 240	3924	msedgewebview2.exe	97
PID 3924 wrote to memory of 240	3924	msedgewebview2.exe	97
PID 3924 wrote to memory of 240	3924	msedgewebview2.exe	97
PID 4244 wrote to memory of 3836	4244	msedgewebview2.exe	98
PID 4244 wrote to memory of 3836	4244	msedgewebview2.exe	98
PID 4244 wrote to memory of 3836	4244	msedgewebview2.exe	98
PID 4244 wrote to memory of 3836	4244	msedgewebview2.exe	98
PID 4244 wrote to memory of 3836	4244	msedgewebview2.exe	98
PID 3924 wrote to memory of 2824	3924	msedgewebview2.exe	99
PID 3924 wrote to memory of 2824	3924	msedgewebview2.exe	99
PID 3924 wrote to memory of 2824	3924	msedgewebview2.exe	99
PID 3924 wrote to memory of 2824	3924	msedgewebview2.exe	99
PID 3924 wrote to memory of 2824	3924	msedgewebview2.exe	99
PID 3924 wrote to memory of 2888	3924	msedgewebview2.exe	104
PID 3924 wrote to memory of 2888	3924	msedgewebview2.exe	104
PID 3924 wrote to memory of 2888	3924	msedgewebview2.exe	104
PID 4244 wrote to memory of 4520	4244	msedgewebview2.exe	105
PID 4244 wrote to memory of 4520	4244	msedgewebview2.exe	105
PID 4244 wrote to memory of 4520	4244	msedgewebview2.exe	105
PID 3924 wrote to memory of 1380	3924	msedgewebview2.exe	106
PID 3924 wrote to memory of 1380	3924	msedgewebview2.exe	106
PID 3924 wrote to memory of 1380	3924	msedgewebview2.exe	106
PID 4244 wrote to memory of 3044	4244	msedgewebview2.exe	107
PID 4244 wrote to memory of 3044	4244	msedgewebview2.exe	107
PID 4244 wrote to memory of 3044	4244	msedgewebview2.exe	107
PID 3924 wrote to memory of 5732	3924	msedgewebview2.exe	108
PID 4244 wrote to memory of 6088	4244	msedgewebview2.exe	109
PID 3924 wrote to memory of 2124	3924	msedgewebview2.exe	110
PID 3924 wrote to memory of 2124	3924	msedgewebview2.exe	110
PID 3924 wrote to memory of 2124	3924	msedgewebview2.exe	110

C:\Users\Admin\AppData\Local\Temp\2026-07-06_7d58f9fbcf6e3e531acb29f6f87b70df_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-06_7d58f9fbcf6e3e531acb29f6f87b70df_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe"
1⤵
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5300
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=2026-07-06_7d58f9fbcf6e3e531acb29f6f87b70df_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe --webview-exe-version=2.14.0.73 --user-data-dir="C:\Users\Admin\AppData\Local\Adobe\webview2\2026-07-06_7d58f9fbcf6e3e531acb29f6f87b70df_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=1 --allow-file-access-from-files --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=5300.1200.1305791483168442133 /pfhostedapp:a79450ca023f220997d45f9286c8bce070a3adba
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:3924
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Adobe\webview2\2026-07-06_7d58f9fbcf6e3e531acb29f6f87b70df_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe\EBWebView /prefetch:4 /pfhostedapp:a79450ca023f220997d45f9286c8bce070a3adba --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Adobe\webview2\2026-07-06_7d58f9fbcf6e3e531acb29f6f87b70df_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x188,0x18c,0x190,0x184,0xa4,0x7ffdaabb5fd8,0x7ffdaabb5fe4,0x7ffdaabb5ff0
    3⤵
    PID:4296
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Adobe\webview2\2026-07-06_7d58f9fbcf6e3e531acb29f6f87b70df_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe\EBWebView" --webview-exe-name=2026-07-06_7d58f9fbcf6e3e531acb29f6f87b70df_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe --webview-exe-version=2.14.0.73 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1552 --field-trial-handle=1364,i,10530438409357160366,11637377991611274476,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:2 /pfhostedapp:a79450ca023f220997d45f9286c8bce070a3adba
    3⤵
    PID:3408
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Adobe\webview2\2026-07-06_7d58f9fbcf6e3e531acb29f6f87b70df_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe\EBWebView" --webview-exe-name=2026-07-06_7d58f9fbcf6e3e531acb29f6f87b70df_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe --webview-exe-version=2.14.0.73 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --no-appcompat-clear --mojo-platform-channel-handle=2004 --field-trial-handle=1364,i,10530438409357160366,11637377991611274476,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:3 /pfhostedapp:a79450ca023f220997d45f9286c8bce070a3adba
    3⤵
    PID:1672
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Adobe\webview2\2026-07-06_7d58f9fbcf6e3e531acb29f6f87b70df_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe\EBWebView" --webview-exe-name=2026-07-06_7d58f9fbcf6e3e531acb29f6f87b70df_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe --webview-exe-version=2.14.0.73 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --no-appcompat-clear --mojo-platform-channel-handle=2216 --field-trial-handle=1364,i,10530438409357160366,11637377991611274476,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:a79450ca023f220997d45f9286c8bce070a3adba
    3⤵
    PID:240
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Adobe\webview2\2026-07-06_7d58f9fbcf6e3e531acb29f6f87b70df_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe\EBWebView" --webview-exe-name=2026-07-06_7d58f9fbcf6e3e531acb29f6f87b70df_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe --webview-exe-version=2.14.0.73 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3404 --field-trial-handle=1364,i,10530438409357160366,11637377991611274476,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:a79450ca023f220997d45f9286c8bce070a3adba /prefetch:1
    3⤵
    PID:2824
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Adobe\webview2\2026-07-06_7d58f9fbcf6e3e531acb29f6f87b70df_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe\EBWebView" --webview-exe-name=2026-07-06_7d58f9fbcf6e3e531acb29f6f87b70df_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe --webview-exe-version=2.14.0.73 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --no-appcompat-clear --mojo-platform-channel-handle=4564 --field-trial-handle=1364,i,10530438409357160366,11637377991611274476,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:a79450ca023f220997d45f9286c8bce070a3adba
    3⤵
    PID:2888
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Adobe\webview2\2026-07-06_7d58f9fbcf6e3e531acb29f6f87b70df_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe\EBWebView" --webview-exe-name=2026-07-06_7d58f9fbcf6e3e531acb29f6f87b70df_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe --webview-exe-version=2.14.0.73 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --no-appcompat-clear --mojo-platform-channel-handle=4568 --field-trial-handle=1364,i,10530438409357160366,11637377991611274476,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:a79450ca023f220997d45f9286c8bce070a3adba
    3⤵
    PID:1380
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Adobe\webview2\2026-07-06_7d58f9fbcf6e3e531acb29f6f87b70df_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe\EBWebView" --webview-exe-name=2026-07-06_7d58f9fbcf6e3e531acb29f6f87b70df_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe --webview-exe-version=2.14.0.73 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4836 --field-trial-handle=1364,i,10530438409357160366,11637377991611274476,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:a79450ca023f220997d45f9286c8bce070a3adba
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5732
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Adobe\webview2\2026-07-06_7d58f9fbcf6e3e531acb29f6f87b70df_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe\EBWebView" --webview-exe-name=2026-07-06_7d58f9fbcf6e3e531acb29f6f87b70df_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe --webview-exe-version=2.14.0.73 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --no-appcompat-clear --mojo-platform-channel-handle=4384 --field-trial-handle=1364,i,10530438409357160366,11637377991611274476,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:a79450ca023f220997d45f9286c8bce070a3adba
    3⤵
    PID:2124
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=2026-07-06_7d58f9fbcf6e3e531acb29f6f87b70df_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe --webview-exe-version=2.14.0.73 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\{2CE3B3D1-623A-4474-8B17-8C5489873854}\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=1 --allow-file-access-from-files --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=5300.1200.17385850186725467016 /pfhostedapp:b7cf8b9795ef6984634186d6c492a27a35720b16
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:4244
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\{2CE3B3D1-623A-4474-8B17-8C5489873854}\EBWebView /prefetch:4 /pfhostedapp:b7cf8b9795ef6984634186d6c492a27a35720b16 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\{2CE3B3D1-623A-4474-8B17-8C5489873854}\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ffdaabb5fd8,0x7ffdaabb5fe4,0x7ffdaabb5ff0
    3⤵
    PID:5388
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\{2CE3B3D1-623A-4474-8B17-8C5489873854}\EBWebView" --webview-exe-name=2026-07-06_7d58f9fbcf6e3e531acb29f6f87b70df_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe --webview-exe-version=2.14.0.73 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1748 --field-trial-handle=1764,i,10080719572436412319,15377128120981685945,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:2 /pfhostedapp:b7cf8b9795ef6984634186d6c492a27a35720b16
    3⤵
    PID:3780
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\{2CE3B3D1-623A-4474-8B17-8C5489873854}\EBWebView" --webview-exe-name=2026-07-06_7d58f9fbcf6e3e531acb29f6f87b70df_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe --webview-exe-version=2.14.0.73 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --no-appcompat-clear --mojo-platform-channel-handle=2484 --field-trial-handle=1764,i,10080719572436412319,15377128120981685945,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:3 /pfhostedapp:b7cf8b9795ef6984634186d6c492a27a35720b16
    3⤵
    PID:1600
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\{2CE3B3D1-623A-4474-8B17-8C5489873854}\EBWebView" --webview-exe-name=2026-07-06_7d58f9fbcf6e3e531acb29f6f87b70df_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe --webview-exe-version=2.14.0.73 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --no-appcompat-clear --mojo-platform-channel-handle=2544 --field-trial-handle=1764,i,10080719572436412319,15377128120981685945,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:b7cf8b9795ef6984634186d6c492a27a35720b16
    3⤵
    PID:2748
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\{2CE3B3D1-623A-4474-8B17-8C5489873854}\EBWebView" --webview-exe-name=2026-07-06_7d58f9fbcf6e3e531acb29f6f87b70df_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe --webview-exe-version=2.14.0.73 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3420 --field-trial-handle=1764,i,10080719572436412319,15377128120981685945,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:b7cf8b9795ef6984634186d6c492a27a35720b16 /prefetch:1
    3⤵
    PID:3836
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\{2CE3B3D1-623A-4474-8B17-8C5489873854}\EBWebView" --webview-exe-name=2026-07-06_7d58f9fbcf6e3e531acb29f6f87b70df_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe --webview-exe-version=2.14.0.73 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --no-appcompat-clear --mojo-platform-channel-handle=4688 --field-trial-handle=1764,i,10080719572436412319,15377128120981685945,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:b7cf8b9795ef6984634186d6c492a27a35720b16
    3⤵
    PID:4520
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\{2CE3B3D1-623A-4474-8B17-8C5489873854}\EBWebView" --webview-exe-name=2026-07-06_7d58f9fbcf6e3e531acb29f6f87b70df_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe --webview-exe-version=2.14.0.73 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --no-appcompat-clear --mojo-platform-channel-handle=4716 --field-trial-handle=1764,i,10080719572436412319,15377128120981685945,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:b7cf8b9795ef6984634186d6c492a27a35720b16
    3⤵
    PID:3044
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\{2CE3B3D1-623A-4474-8B17-8C5489873854}\EBWebView" --webview-exe-name=2026-07-06_7d58f9fbcf6e3e531acb29f6f87b70df_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe --webview-exe-version=2.14.0.73 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4792 --field-trial-handle=1764,i,10080719572436412319,15377128120981685945,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:b7cf8b9795ef6984634186d6c492a27a35720b16
    3⤵
    PID:6088

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3500

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:2820

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

.adobefeatureflagnotification

Path C:\Users\Admin\AppData\Local\Adobe\.adobefeatureflagnotification
Size 13B
SHA256 e846f39362168bce024ac0d6df571586cf0146d87daa4d558ca3db5f854137f7
MD5 422bdb7b1334bb4524561f872891b49f
SHA1 0116a25599eaf2a0b6b9c90a20be7872efb7b552
SHA512 47345124fc89c9ccbc8f6960bef6300268439e6deb3726185342727042df8f6cee67ab373d5b8668000d2a3a190085995ae59656b38ceacef4161e1af3fb9523
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Adobe\webview2\2026-07-06_7d58f9fbcf6e3e531acb29f6f87b70df_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 0f515540f689bb3a1902cfe16fc4198a966bade3b237d14b946ab43dadc0d5e5
MD5 00ed34b368528cfbfa2e28583808d2cc
SHA1 fe8fcf4e1db3e9b7bb955a3454d4d64f47a91333
SHA512 c28d88f0b25a2db7f48df1cf578a87ff0cca5637ce4a393371680c36bf511fa4a60927035131c74f9cc03b1f7d277dabf4fe249782e2dcba8b935941b6b8bc36
TLSH
T129D0121232124238C4202633051261080801C14F800541005538992E2A444941A17445
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Adobe\webview2\2026-07-06_7d58f9fbcf6e3e531acb29f6f87b70df_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 6a57c360fb9191df1a1277553f72cf6db5656424a97b5e8c2d486bc10da102eb
MD5 1b09d5a5006c92ed0a097a1b4ab5fd23
SHA1 dc62c12995472e2fe54f5e746530031f8f8fd340
SHA512 ca62dc9cfcf772a1683017911647b44ab36fff63b74df8444099c4759ec94dca50a9e7a08f176587f2c8b3204362e8eda0001bdf80b6b78e9f08e96217767b1b
MD5 SHA1 SHA512

Submit Download

1bf54783-30c9-4bf7-935a-643904543c6f.tmp

Path C:\Users\Admin\AppData\Local\Adobe\webview2\2026-07-06_7d58f9fbcf6e3e531acb29f6f87b70df_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe\EBWebView\Default\1bf54783-30c9-4bf7-935a-643904543c6f.tmp
Size 6KB
SHA256 8e919648790c7eb97494c72cd3f13d49d64db42abe4485a25d32f6f40cb1c886
MD5 2fe21f20799ad1a60ad89f40280dda0d
SHA1 ed89bb3ac160fd347e9b523800b5e5fe575ce0b1
SHA512 866cc82c8e612dc5a57ad968c7ecc2440aab5cbab01caef339760a3c60bf6dde1b4e4693475b1a8a1c7eccffe2e117bf4a1fe7ccb0fbdc366bb197cf63628290
SSDEEP 96:stcq/dAxKZb9tk9o5h16ZdDs7/x+6MhmuecmxYe6K+g2d28XM1C7K:stbSigosDsV+FixYKgG6K
TLSH
T14ED185025E28787B4CC6F519FA69BB03E6F9603261D51E98E7F8461C09EB5DC630790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Adobe\webview2\2026-07-06_7d58f9fbcf6e3e531acb29f6f87b70df_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe\EBWebView\Default\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Adobe\webview2\2026-07-06_7d58f9fbcf6e3e531acb29f6f87b70df_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe\EBWebView\Default\GPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Adobe\webview2\2026-07-06_7d58f9fbcf6e3e531acb29f6f87b70df_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe\EBWebView\Default\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Adobe\webview2\2026-07-06_7d58f9fbcf6e3e531acb29f6f87b70df_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe\EBWebView\Default\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Adobe\webview2\2026-07-06_7d58f9fbcf6e3e531acb29f6f87b70df_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe\EBWebView\Default\Network\Network Persistent State
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Adobe\webview2\2026-07-06_7d58f9fbcf6e3e531acb29f6f87b70df_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe\EBWebView\Default\Network\Network Persistent State
Size 230B
SHA256 27c739561615160aaec0e7ed7f318ddb661114fd768ee1f72dcccbe4e82ea588
MD5 75ad241bc81224195f620e20abcad795
SHA1 ee4b68e146b88c8b3c128a837611f006e512bab3
SHA512 d47860e196e7b0a406bbda570f28058ad5c36d6991b3523074345e144e093a9e81416ca2f147ca3210932d591351ebd2f3fd5335b55087d091815b5476ebd1b5
TLSH
T1EFD0A77A466019FE075543A05928B81BCEBE5003021CFDBA95347B6A83761B8901458B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Adobe\webview2\2026-07-06_7d58f9fbcf6e3e531acb29f6f87b70df_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Adobe\webview2\2026-07-06_7d58f9fbcf6e3e531acb29f6f87b70df_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe\EBWebView\Default\Preferences
Size 6KB
SHA256 fa3c6e7986262d25c77af5663f091e7ebe97d5b3331dd44265ab50169f6ea1d1
MD5 39b7051438f7f4be90a491aa920b07b4
SHA1 0325c11861675f394ec39da7826322e74bc86185
SHA512 b8dee5424f09049f1eb09c143adfc29053908df6cd5c77faa1921d22550b740d94b044553201ee4bf2e3d267085af3bd0b12537bd5ccae746db7fe7c11c8a670
SSDEEP 96:stcq/dAxRGZb9tk9o5h16ZdDs7/x+6MhmuecmxYe6K+g2V28XM1C7K:stbS8gosDsV+FixYK4G6K
TLSH
T163D196025E28787B8CC7E519FA69BB13E6F5603261D11E98E7FC461C09EB5DC630790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Adobe\webview2\2026-07-06_7d58f9fbcf6e3e531acb29f6f87b70df_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe\EBWebView\Default\Shared Dictionary\cache\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Adobe\webview2\2026-07-06_7d58f9fbcf6e3e531acb29f6f87b70df_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe\EBWebView\Local State
Size 15KB
SHA256 59b56e1cb4b8a93af0e51b40d275ee1268adbe516e35d04a7a3d3e9a890dd17c
MD5 67b13fe4601e971e2c5e3e4bc6584b57
SHA1 d5dd2ced911d1a7932f5249a1cd96bfbbec099c5
SHA512 f46f586262f136d39d606b864d67d4d2c83da31d5e223a6b2ad9e8c022175dcf95bf048fed0df0767e413cb7861a7b5fbaacca9defd1657a9637e5daaa1ff1d1
SSDEEP 384:vsrv+89zHqlDNP9oid6NBS5+KbJisd6YlN4:0rv+4UNbdOAJisYKN4
TLSH
T13A72AF33A53CBB738DB2D909B4866B173F7C60A795834AE4D9E95B8C419B0DA2307D13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Adobe\webview2\2026-07-06_7d58f9fbcf6e3e531acb29f6f87b70df_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe\EBWebView\Local State
Size 2KB
SHA256 790657f21e4f5ee03057d741d301f98ff33b24175e485d64b14e549983e4647b
MD5 e8345728e16b2c0507f93ad0099809de
SHA1 f61118404276754b591ca6088682b851ce87931c
SHA512 4fc0c32accd2ca2500747173e7c09db87d3c9dfb4809c7313d939944e45ec9c38ca490d597f8f23da54b953e88ef39f103ea30af1803150a21e334ef2a088dc6
TLSH
T15C5183739910BE7685B2CA0879866F62DE755166AA532F90AADC0B0C01D745C230BC3B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Adobe\webview2\2026-07-06_7d58f9fbcf6e3e531acb29f6f87b70df_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe\EBWebView\Local State
Size 3KB
SHA256 7d1b917fca8d54669ab58e24e8587b07b8e4e18355cc03554cfbf20a0479d8e3
MD5 791188dff35b19c752d93876c7e9b7da
SHA1 151c684c1d85e4fcc7198fd30a19d9736909e669
SHA512 cb414a95a1e7f5e2b85808adadad663a612ebf2b5576ace3b78c96db502bd43f905617b51dddb3a9e9540915725b6d4a9cfce22fac85b6f1cadeff2999aba05b
TLSH
T1B371837B9960BD7749B2C908B8862B56ABA55037E9923FE5E9EC0F0C01D729C1347C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe58cfde.TMP

Path C:\Users\Admin\AppData\Local\Adobe\webview2\2026-07-06_7d58f9fbcf6e3e531acb29f6f87b70df_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe\EBWebView\Local State~RFe58cfde.TMP
Size 1KB
SHA256 1dc8d2e038d10308b665f43c6b3ec5ec76caebb2177e219f729eda0d9873069a
MD5 9c8d090cc2f3a2eaf4e4f16b06367022
SHA1 d5e6e02f780aee6d5449fde19ca2cfcbb9aeb3a7
SHA512 422cc74d6458bc2674e645e4c9828aaaea91c69663b23198a118e3ef171eaab609d6d6d5e74f51fe05f308365b73cda719e05bda2768b106eee058aa03f1e7c5
TLSH
T1853186B785A06F7298B2D50A3152AFEB9F30107BD2534EC4B9DD4B0812E704D912FC36
MD5 SHA1 SHA512 TLSH

Submit Download

CCDInstaller.js

Path C:\Users\Admin\AppData\Local\Temp\{2CE3B3D1-623A-4474-8B17-8C5489873854}\CCDInstaller.js
Size 1.8MB
SHA256 0ea193ba3ebe7ec3b9f1f6f1b99ba0b454e8508f8a8d564df2e0ba7222b619f9
MD5 86e7929225243fd20c0b4113202345ae
SHA1 61bd980481404ee51e25f00676ccb9875356585d
SHA512 6907ba4b69aadabe49b64d5b8eb2c3fe06c1afb4280c233e51e197c91eded20c8a7c180c9856b7435972dc502b92b8d6e2dcaa6b65e71911a49316709c93ecba
SSDEEP 12288:7FG7938dDXT5inNsdsw6zZwH1CVeXFmkxtXsLqHL1qCUgFwigkiqloSU2eDTLI:msrNdswYwHsKFmkx+ZCUgFZly2es
TLSH
T1A595F77F74E5A872AF803096009BB40FB7753539738084A89955CF9C92E6B8D4B0BE5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\{2CE3B3D1-623A-4474-8B17-8C5489873854}\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 2c1623420fb4043b681950ca39c446b43b8cce3f76031218718261fd10143f28
MD5 a277c28ccd0c06a34c7271a2e1d39eb5
SHA1 83c1dc20ca01eaf5a2b11c6fedb7291452a15cef
SHA512 59af811d70c8d9fceb5cb7968fb168d8f5d06c4429e4c3914ce09b3d23606b12044fa49cf47935aaede7f35395ecb9984607706033b25185aa88f605852f193f
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\{2CE3B3D1-623A-4474-8B17-8C5489873854}\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 5d8e9b4ed77186ecec0ee3d3472a8d8a6d98fabdcffb2df3947a3d1a28d30b51
MD5 32148ecf7dc2065e5c6c8250e83d92ad
SHA1 4e1ba99c1b4e0c1d1c7111952cf56577b06bb7b4
SHA512 d5587f650a2dc4c33b2d43ff12ed9b5770e7d5e785ee9c196dcafc15ee9ce5e24158d06c4e20410038452aeb77a09cb46a7eae21299708cca83e6bd550a8025a
TLSH
T1BBD0122732210234C02024331003714C0700D50F400941196928855D9E581641D12452
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Temp\{2CE3B3D1-623A-4474-8B17-8C5489873854}\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\{2CE3B3D1-623A-4474-8B17-8C5489873854}\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 168B
SHA256 b91a01675c593910525c11c8a24199bd4b8a034c005ac8f5ac36c473dc7f3b5c
MD5 ac7008a81e09ecc09b1880546996fd32
SHA1 43e98d1d7f1177c1ff2df0efcd30e7109049a9cd
SHA512 0ece5bc01009738e891e1760b71d065aa2e1b58a8b265bc04f10a16c2f607e6547ef44398eabcf312dafe0ab6415e9bf0e50aba59a761fbc73abc4f863db4ddc
TLSH
T1E5C092DA6F1AC8E2C3A02270BACB01843378DC2D43931C0178BFE631C5B9385E50B869
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\{2CE3B3D1-623A-4474-8B17-8C5489873854}\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 5f6448cbe01908598b1b7b088b56139a9b3d160aecebd2ff0d3e2a924fe60068
MD5 632a85917ce2a24332f918631ae737b4
SHA1 964b13cd178a3ed8e89d15d7d20437b695c1798b
SHA512 6dd636a2eeb7d5d4a814b066a29f6f73b5ac4a56053d87dde1b23772d99197f6e6865ce465a7a2c1b7da311dd467d1e420fec0537ce7358003fc780a7e5957c7
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\{2CE3B3D1-623A-4474-8B17-8C5489873854}\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Temp\{2CE3B3D1-623A-4474-8B17-8C5489873854}\EBWebView\Default\Network\Network Persistent State
Size 1KB
SHA256 2a135d740d37d0f7ac2a496419d0a83f7006dd56359748f673726de99571b086
MD5 fa7a1b6308a60deb61ce5fca73fc19bd
SHA1 dca7bd896779bf221a572da01a59d9770adf17a2
SHA512 deb7ad92a5d54acb188334e2df2eb64d29a4db2cb606bb52e628958a2a9a4b58922e6f7d9ab0b2a6e5f2f18eaa275912ad1d9fb0e398e2f40c569bafbe1b2d7e
TLSH
T1074109F783B8052D8A1291F45B18DE1FCF9E1821836CEA39C9D05E9793E24B1E210B4A
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Temp\{2CE3B3D1-623A-4474-8B17-8C5489873854}\EBWebView\Default\Preferences
Size 6KB
SHA256 a701d18235a8d2007abfdf88ed26fc4775a99158366598560eb3cf51105a81a4
MD5 e846b07b4b7fef3ece9c013092401309
SHA1 c83b7b9041f62478859e082d5bc502e0f2fa8827
SHA512 81fb7955b34110f8a6b7e7adcd3ae21e1e045f05c0f32f7cee6a2f572281ec93beb4222fab939f8696d266b37de300269404718a8a4aa381dffdc6c814ee8a6d
SSDEEP 96:sti/dA8SRb9wkjo5h16Zvms7/x+6MhmuecDtq1ejeGK+gt28XM1C7K:st6SYMoqmsV+FvtqQjWbG6K
TLSH
T146D1A7035E34797B4CC6E209FA65BA13E2F9603275D51E98EBF8461C08EB6DC630790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Temp\{2CE3B3D1-623A-4474-8B17-8C5489873854}\EBWebView\Default\Preferences
Size 6KB
SHA256 d57c9cc58d555752ebe58e9a38882ddc991697206f64b27aad687fb2f46a40e3
MD5 6494019db890719b12ef7da2674765ec
SHA1 6ee749685eadc132f3b0d30d352d18b157a88623
SHA512 879077b7455892305b2cf6badec7874413e165de82394f6f9e41e7002f9cf24f806a4b94597891bf39ee4e026d32978db3eb75b152b66b885d5ac24eca30e9a4
SSDEEP 96:sti/dA8pGRb9wkjo5h16Zvms7/x+6MhmuecDtq1ejeGK+gOc28XM1C7K:st6SGMoqmsV+FvtqQjWnG6K
TLSH
T16ED1A7035E24797B4CC6E109BA65BB13E2F9603265D51E88E7FC471C08EBADC6307907
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe591fb3.TMP

Path C:\Users\Admin\AppData\Local\Temp\{2CE3B3D1-623A-4474-8B17-8C5489873854}\EBWebView\Default\Preferences~RFe591fb3.TMP
Size 5KB
SHA256 3eafb321fc16816cbaa1e3b8294e0953bf5feb386a3d2ea1864a59ddfc22d69f
MD5 0ea5f9e63218efacd67751f2913fbf77
SHA1 a835678aeb3f6614476f0b3cd3afe7b66108e394
SHA512 98575940ea62a0942e08267d150a8e1b431369487af2860b4a039736a840910c56f092eee8be6c368ac7bf5036a1d4110ff9d691bebf2dc650ce4d8bc2e929ef
SSDEEP 96:ri/dA8SRb9wkXdo616Zvms7/x+6MhmuecDtq1ejeGK+gt28XM1C7K:r6SYgoZmsV+FvtqQjWbG6K
TLSH
T1B1C1A6035E24797F4CC6E108BA65BA13E2F9613275D52E98E7F8861C08EB6DC631790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\{2CE3B3D1-623A-4474-8B17-8C5489873854}\EBWebView\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\{2CE3B3D1-623A-4474-8B17-8C5489873854}\EBWebView\Local State
Size 3KB
SHA256 790de937816dcb05512c2beb1460cec26f107d884412edca596a8c02551b1af3
MD5 9812d85de067e84f88e72957833e4288
SHA1 4284521904bbeb0ee3e6523ea7b0cdf734d73703
SHA512 2b223d2fca00fb3e1787b2a198e4df5d277e274b796907449d08dc0e7bd26c4addacab625e25ea0ea8a3523b7b65a930ff8ecf36793af08c01529955ba3af43a
TLSH
T1C881A6369974B9374EB2D50879C63B16AB60A137A6963FD5E9EC0F0D02D728C1343813
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\{2CE3B3D1-623A-4474-8B17-8C5489873854}\EBWebView\Local State
Size 15KB
SHA256 8435ac32eabea09871c5b04d18d4903f35c784be1a94b6f755a62e95e02fc410
MD5 c97b0387adae2da59aca9633cbed716a
SHA1 f8d309356d806baa9ac6fb8fafb52b0c20701226
SHA512 781900c346e09cf581d0617c948645bb5a3e8dd2dbbeffe7ef0b111fc3eddccf2c155bc91dddcac18e83131c85fb51ed99b9241a9cbe76a50deefac9631c99fb
SSDEEP 384:psrv+89zHqlDNP9oid6NBS+ZDipJ0LFisd6YbNN:2rv+4UNbds8EFisYQNN
TLSH
T13772BF33993C76375EB2D908B4C67B1B3F7870A666C20AA0E9D91B4D41CB4DA2307D43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\{2CE3B3D1-623A-4474-8B17-8C5489873854}\EBWebView\Local State
Size 2KB
SHA256 493088a23f45c6c6ce6a4d6c5f722ab3f1c1294b628bdf0cbc176b922f12e343
MD5 18d5dc1a93a3eb4cf0ac39952ac4931c
SHA1 471432eaf9708930a6a4ab29ec7c3222cbd4f6ac
SHA512 e877253a6b54206b2f04a9d21a73d2a4fd4abf36b8b35fc03e1d95f9f2f7a966657e66c21058b02932ad1360aebf06ebaa69e7c550d99e2e4a0231c4ae6420e9
TLSH
T1FD519573AD147A3646B2D64879863F228E31A175A7522F90BDEC0B0C02D745C1307C36
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\{2CE3B3D1-623A-4474-8B17-8C5489873854}\EBWebView\Local State
Size 3KB
SHA256 e69a2832a3fd030f58aa25f88238576b33c5cb0d84292f05227c83fe0cdc4a79
MD5 20c45c64d4b6a639a3ef6b1a6218180e
SHA1 308d63b31f15d4533ae48f9dea9c86f6636b7138
SHA512 c414b53a0eb60bb9ba9d5bb830cfcd22b076fc9b258fb290ac12ab88da144795ffdc2e8b39462a20cfd8af20c776957c428954789b987baaee06a81545b9566d
TLSH
T1DD71B77BA964B9374EF2D5087CC13B16ABA06136E6923F95E9EC0F0C02D76881353C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe58cf42.TMP

Path C:\Users\Admin\AppData\Local\Temp\{2CE3B3D1-623A-4474-8B17-8C5489873854}\EBWebView\Local State~RFe58cf42.TMP
Size 1KB
SHA256 19861c2b4e7d77c8960a6d50f3563549c77a7b1e438d2659ef311d5bee8453ed
MD5 2cf749e42eec1630491bcae4783c2c10
SHA1 4942ecf6fdb20c29dab9fbeeff38be4dba721143
SHA512 5fcc60d4707ecf02abdec54bba30c9081da72777f8a7f16d62e9cd16e4c2c7d033689e53fc1f06d80ef894ff73ced85f1c1e6affc118b623f02a8e71afac3c0f
TLSH
T1023196B2DAA03B325D92A18A35817B5B5E30617E93120E40B9DD4B0D03DB44C663F832
MD5 SHA1 SHA512 TLSH

Submit Download

index.css

Path C:\Users\Admin\AppData\Local\Temp\{2CE3B3D1-623A-4474-8B17-8C5489873854}\index.css
Size 923KB
SHA256 cdd337f639e76f36fa41002b26e9a4f8c819d196747983283e25e3049fe5028e
MD5 e09f799bb69cecaf3987bc12cf65dd24
SHA1 ea57b540f246e00bd1e4bb7df3824bd8fa129a6c
SHA512 90a877a6024d996646055f496907276e4746cecab334b701f0d44d11b1d636984a049c74310606b7f0487549eb4b454318ba3b2e02ebc1121ff57970d885e1a4
SSDEEP 12288:oUxDxiaHbr3Gq5XRi5i6jE/5acgsu0wxT63kaSROcdOLeK+CnjG1VWzWhHuajOGh:oEBP3/5XSo/5F5K65SROcwLeKVYgzWIK
TLSH
T14D15CEE0D6A04D1D74378C3AA1CEA75E5514C28E55889FDBAE83ECF540CA696CF2270F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.html

Path C:\Users\Admin\AppData\Local\Temp\{2CE3B3D1-623A-4474-8B17-8C5489873854}\index.html
Size 426B
SHA256 886c0ab69e6e9d9d5b5909451640ea587accfcdf11b8369cad8542d1626ac375
MD5 a28ab17b18ff254173dfeef03245efd0
SHA1 c6ce20924565644601d4e0dd0fba9dde8dea5c77
SHA512 9371a699921b028bd93c35f9f2896d9997b906c8aba90dd4279abba0ae1909a8808a43bf829584e552ccfe534b2c991a5a7e3e3de7618343f50b1c47cff269d6
TLSH
T1A9E0225B1D924C1C62701BB4D9E2F82DCA45B64AA743AE2074C5256B6FB2B88CCCB64D
MD5 SHA1 SHA512 TLSH

Submit Download

Staging

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3924_1557985728\Mu\Staging
Size 36B
SHA256 411a706def2e70f96a507208bf80bceb93e950c4c2d671cd1ddb4134ce54b2a9
MD5 0163de1b14421d4eee3757ff76fd81e4
SHA1 96c75c4fe1e3f33a367f45293bd1bd8bff1c06f4
SHA512 80114d59db8f3654dd6821589e5ad03daa923a35610a372756a8865b3e769621e32ef2aed92c2494de2b9fc06d9796b12f1e3bb75873ed794e8c9ae8a0d5e965
MD5 SHA1 SHA512

Submit Download

Filtering Rules

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3924_24063115\Filtering Rules
Size 2.1MB
SHA256 5e301c48e6d7290990971e9f0bcb2263c8adba06ed0a2c6db5086949825d999b
MD5 43f62d9f35fa6597cec4e2ad5643e282
SHA1 8dba6404724ffd6a2e89901e8dc6e5e55fed3374
SHA512 91891d23464f89e6769d9ec7a28867e28f77925e6e3b3b75fb628d8672157ba239676c07699c931ac307a21ccc4dae95dd707d410f988ff82be4015103d4d6a3
SSDEEP 49152:ua2qP9SKIrivd04TxN/7Uw+zJEhs6dl61n4Kmq9SL6bbBT0HjTsQc8cxjw:u8d
TLSH
T1BAA55D237518BDF45BB31F3EA44B6D48823962A483E3EDC5EA2BD10ED5E014F79601B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Filtering Rules-AA

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3924_24063115\Filtering Rules-AA
Size 2.3MB
SHA256 95beb1f39b4cd5b29f5ebaced4a33753fb0bb876f078ed3de041f12be16cec5c
MD5 b91a6cf79bedefedcb5603d3477cc3ed
SHA1 b3512a426a6a613f8cdf7f9ae3a0d02b700d1843
SHA512 9d85945f7f963fd9277adc20a0af459e8bb5904ef7038584e510ebd041b3029bf24ecae2047b24ecfa853154beef7e2bc5bd34ff8d90aeda000fbcdde741341d
SSDEEP 12288:DUoPNPlfiCBGkqNEWymqMD2N3FRgVfFRg3oFRgHsFRg/sFRg7dFRgImFRgJ1FRgs:JNhiSGkqdT5+9
TLSH
T189B51BF69947509145B9631938ADB2C82B14A28147ECCBF2EBB4C4AA2791DC737C05FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Filtering Rules-CA

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3924_24063115\Filtering Rules-CA
Size 11KB
SHA256 65aa171487dca70aad69973d0459c6a4b0882fcc6223bdfb53cd9ab711c5b125
MD5 40b3ba01a09be340fdf879f97b31c867
SHA1 b6ac58d1653c1b76e0e9898b17cfea3e6b56de94
SHA512 97f82f162588a761a13a2efd38d2c9518954400c7898cdd12923ce26e90818d94310b4a9f2a2cb2f55f5101c9a2e177dc1b14de8c9486eafc910271e2991dea9
SSDEEP 96:MKSlCviF3P2DoTc+cTKSlCviF3P2Do3lTKSlCviF3P2DoT:MaviVucryaviVualTaviVuC
TLSH
T17C3275333E488D6792A4C1A0DC92752C9E3087D98C9CBEC31235B9776BD1E6A508B5F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICENSE

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3924_24063115\LICENSE
Size 24KB
SHA256 ed0f972d56566a96fb2f128a7b58091dfbf32dc365b975bc9318c9701677f44d
MD5 aad9405766b20014ab3beb08b99536de
SHA1 486a379bdfeecdc99ed3f4617f35ae65babe9d47
SHA512 bd9bf257306fdaff3f1e3e1fccb1f0d6a3181d436035124bd4953679d1af2cd5b4cc053b0e2ef17745ae44ae919cd8fd9663fbc0cd9ed36607e9b2472c206852
SSDEEP 384:mva5sf5dXrCN7tnBxpxkepTqzazijFgZk231Py9zD6WApYbm9:mvagXreRnTqzazWgj0v6XqK
TLSH
T140B2526EB64903731AF30116AA4B64DBF31ED03F362A4564346CC1481FB6E7443FA6EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Part-DE

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3924_24063115\Part-DE
Size 305KB
SHA256 367ad4a5699a69499d13e8bf9ed5e8bab3573e3731ff8127178e539735ba46a8
MD5 fa08e85d713ad46803e924d443e4bf7e
SHA1 bbcce20f5ce73be4b34cf5c43d6f71bb4ae2c5ff
SHA512 884314e04cab57c9907f90525a4fea7710fdff5e47db4500c03d4dc6c5491a3f4df4868620a2a1817444ee75bfc913e79f9a414e3a68108deb7abab700ae9f85
SSDEEP 6144:7FjHKfRBie5M0SPtVRY7od0x6qNgKWIescUHVTl1dKcJEtmmt4l843NWKOb2P5+S:5T41N/IuscpL1Kxa
TLSH
T10264C693296AFAB12A320E7D600A1C4C5322F111C2C7DDD9F775C98DD1E468BBAC16F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Part-ES

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3924_24063115\Part-ES
Size 137KB
SHA256 55e005c8aea4180093fcb56f4ddeb9fc763892d8cf1fcc840f612a7531b7ed18
MD5 6e8f660d075254a08948dc3517304256
SHA1 bc8abaa82d6d555ee9482c568a1d661453fbc956
SHA512 cc3484fe628e4242eeec2ce969c51e817ec9ab3feecec8d8097f43a319c9dc226771eefe63316d8ec2ad895f23ed4603c4836faa49369db785580455ecf21f37
SSDEEP 3072:NiZ3EhHST197h/6Jl06bBeS1G56asSnGpFrUboki9a8jRU+Zw1:/RxbR1EnYpLv/Vy
TLSH
T166D30D55AADCA8B55A73102C64D9254C911772D082CECDE4FB6686CECAE05CF3BA03FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Part-FR

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3924_24063115\Part-FR
Size 528KB
SHA256 56e80041432156be4f08bac11e3494f2f06f65b61a60b7dcb61d15debb7b318c
MD5 6804859c589fa0ce46529c3a53b882d6
SHA1 70ffd62bb826e29500d36bbdd7c8d9c6895e2d1d
SHA512 3a659c284f55d203fded7f2754673e55a43d2c131b4790fcfe374af138158a690b5a330d4e720348c03aabb561b0aee7d818dcc111698c05ecd99c239d07735c
SSDEEP 6144:zfi0kH6u1I6c2Qiw934vv8gxK2SzX6rDVu9cBwZp0CiEksn7p0heBB6pHIgnb3hc:aT43+R5I7p0ABaIgne
TLSH
T114B45D136619F9F11FB31E3D640B5C088235B2A183E3EDD5EA67C14DD4E468FB9A02B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Part-IT

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3924_24063115\Part-IT
Size 216KB
SHA256 e1552312fc16e0f279e72f7eb4189a47e0beb36733220b0ef605f66defcc5fa7
MD5 268f6a3c0990d434175268cf09cfa6ad
SHA1 464e10c57c536e6bb55a326a48469246a9241505
SHA512 5154048a794227c45b950ec2d2ca378f9e7a9542b9fc79c1fef1f1615e97a263168927d883967b06f8b52227a47e3ac75ac7061b25400ebaa63e4536a368d50a
SSDEEP 6144:1quRAGty7QiWYIeezuu2CGiXTyRl+XPWRq14T/KfY:HRZtQl+XPWRS4T/5
TLSH
T16524E9176A54EDBE4E22156CA09F5E0C7225758182C7CED4F3D5C08DE5F827A2BA03EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Part-NL

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3924_24063115\Part-NL
Size 79KB
SHA256 935465fc40adbb4ae89ba37542ed37609014666c67fdf5115927809d69144b41
MD5 65126d1e76de4f0872e6cfa96609beba
SHA1 95268d3b2134894040afd0530d062a3b836f63c7
SHA512 0c6dd17cf622ad1a1a4ddc43fdc6f36567a98309e145e16d95edf38e9b21905867b28865bee591b52eecaa371138ac436eee6d18ff8d78f4c8f7031ba4e7ad84
SSDEEP 1536:x3ACbKFpRTfKGy7Dpj+u9huKCe/MELfmoRyQpnokj:x3ACbYpxfKGy7Dpj++hu8/L7moRyQpnv
TLSH
T14A83D70AAD68F8754A331D2FA4990D1C9625B600C7CAFDC4E725908EC9F52DF2AD07ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Part-RU

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3924_24063115\Part-RU
Size 1.2MB
SHA256 f8abf856660805e271d9d2033accf4f8cc43b19b7662fc2b96f56739229a90fe
MD5 e946014ae78f059f0698731a745a3f00
SHA1 afeb8dc2d86d2763b69f97717e454a7c6b8a267a
SHA512 3c699d3205c3a000c13d20411a0e958f2107f62d813591652cfc573f9a29647badfb1703e499a8896644f1485ecc19cdcaca0c6bd5ec1e5e328339c95784cfa3
SSDEEP 12288:4o9g8Q9u1Xku8Uc24wpDs2zGFtyKnVgLxB7rsvAyLuQCdj9/CwYJWj0Ek0ozM/vQ:4Oe9u1Xn1KFtyKnKq1CvH0Ra3Rnkd
TLSH
T1F44560137254F9F04F734E7E549A9C089275B1A083D7EDC5CA29C19C98F2A9FFA402B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Part-ZH

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3924_24063115\Part-ZH
Size 686KB
SHA256 9645edd48b978354345b657bacb3f30be1f450300856a82ba4d5dbf1236c7c9e
MD5 3e8cbee42dcb97db0df88cb96643e3fc
SHA1 94cd9e2bc876e04bfd2f311cdc160b6ae1d3c9f3
SHA512 319c69fcba623a0fea9ba4e1dcfabe3e9bd47f31dce7146e317835331217730fb61d0449abe7e66b1bc6f06a50c12269f7f09dbb633c85b4fd8dcc7b21c95304
SSDEEP 12288:g3gaBN1zyZzxT04duSeYXzhW+svzgAfk+XTAdXUd84nT4x09/xSE8Y:CgaBN1zyZzxT0N9YVW+sv8Afk+XTAdXy
TLSH
T114E491132168FCF51EB21E7D284B6D48813A76A047E3ECC6D62BD54ED6F025F39A01B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adblock_snippet.js

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3924_24063115\adblock_snippet.js
Size 2KB
SHA256 9aa899e0bf660ee8f894b97c28f05db06cc486915953b7f3b2ff9902fa8da690
MD5 f5c93c471485f4b9ab45260518c30267
SHA1 ee6e09fb23b6f3f402e409a2272521fdd7ad89ed
SHA512 e50a1baf20db9bc867e85ab72f9976430e87d8516ca552f9342a5c91822c9e1404e4f915042d48d841cca3fb16fd969bf0aa01195791ce29de63c45814fcdcda
TLSH
T1C541F146AB3477B703EC24D158271C03B3684494562CE519FB51EBAEAE1C46B4EEED23
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.fingerprint

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3924_24063115\manifest.fingerprint
Size 66B
SHA256 b1c8d3a1e8d3d85433eaa60a50001e5d1599809fb03a7b31bc19f963058a0d54
MD5 58d2918fbd8bfa6cecc58ecb48dd0723
SHA1 1c6f36fa1434000e97d6f32f32edf02772bb40ad
SHA512 31a3a6d71ec58392f3330df1cb23088c437d72c8709da71598fd626af76b45f26091daa1ae3d49ef15929b6b518a3fac0a911d09cf79ef67bc823d52db4580a5
TLSH
T18FA0220C20C82AA088BE0A0302082803832000A0AC383380A30CA3C8BC0C80820C00FA
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3924_24063115\manifest.json
Size 116B
SHA256 181a1631374b5ac1fff89559f7e23498ad9ee4796885d7b956d5e7d5f9c3f8c7
MD5 daf93729356a67ea1f849554827fdab1
SHA1 17dad0cbc82d5e04fb068896a5832f983e124c01
SHA512 473d9d608f2f3324d5db6eddeb4554a7271df4a6b62377820d935c001a8a2376479aa4d3e3b80ffbfdd3ba80f56fe72f1bc9dd020bcb396182b753353b883a30
TLSH
T1FBB09262A8084633249523F4A2639363CBA86D4A91346606091B9480659E73B22A5219
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-bn.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4244_1055626639\hyph-bn.hyb
Size 703B
SHA256 c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe
MD5 8961fdd3db036dd43002659a4e4a7365
SHA1 7b2fa321d50d5417e6c8d48145e86d15b7ff8321
SHA512 531ecec11d296a1ab3faeb2c7ac619da9d80c1054a2ccee8a5a0cd996346fea2a2fee159ac5a8d79b46a764a2aa8e542d6a79d86b3d7dda461e41b19c9bebe92
TLSH
T13001E1B0B7014F4BC635EDB0117A4A6D9664C43553BE051D84B1F9634F19714E70A8A8
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-mr.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4244_1055626639\hyph-mr.hyb
Size 687B
SHA256 f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42
MD5 0807cf29fc4c5d7d87c1689eb2e0baaa
SHA1 d0914fb069469d47a36d339ca70164253fccf022
SHA512 5324fd47c94f5804bfa1aa6df952949915896a3fc77dccaed0eeffeafe995ce087faef035aecea6b4c864a16ad32de00055f55260af974f2c41afff14dce00f3
TLSH
T14801E178BE13888BC6784DB1054115AA0320F90EF296021B4262B13ACB18FD61C95484
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-nn.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4244_1055626639\hyph-nn.hyb
Size 141KB
SHA256 5bcbb58eaf65f13f6d039244d942f37c127344e3a0a2e6c32d08236945132809
MD5 f2d8fe158d5361fc1d4b794a7255835a
SHA1 6c8744fa70651f629ed887cb76b6bc1bed304af9
SHA512 946f4e41be624458b5e842a6241d43cd40369b2e0abc2cacf67d892b5f3d8a863a0e37e8120e11375b0bacb4651eedb8d324271d9a0c37527d4d54dd4905afab
SSDEEP 3072:pPTHXHEm69FrOP8d4hRLiinKL4Qshbv2fuOQXCxj+60EoM8WC5zgY:p73HEUP8dsiinTThjy90VKY
TLSH
T1C1E319F3A3394AC29420A8A4DF593B7E4044FA944D80E197B5EC2038E667CBC76D579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2888-510-0x00007FFDCABD0000-0x00007FFDCABD1000-memory.dmp

Download

memory/2888-511-0x00007FFDCCB40000-0x00007FFDCCB41000-memory.dmp

Download

memory/3408-122-0x00007FFDCB4C0000-0x00007FFDCB4C1000-memory.dmp

Download

memory/3836-200-0x00007FFDCB4C0000-0x00007FFDCB4C1000-memory.dmp

Download

memory/5300-0-0x0000000000370000-0x0000000000DE2000-memory.dmp

Download

memory/5732-822-0x00000197903D0000-0x00000197903D1000-memory.dmp

Download

memory/5732-824-0x00000197903D0000-0x00000197903D1000-memory.dmp

Download

memory/5732-826-0x00000197903D0000-0x00000197903D1000-memory.dmp

Download

memory/5732-823-0x00000197903D0000-0x00000197903D1000-memory.dmp

Download

memory/5732-821-0x00000197903D0000-0x00000197903D1000-memory.dmp

Download

memory/5732-825-0x00000197903D0000-0x00000197903D1000-memory.dmp

Download

memory/5732-817-0x00000197903D0000-0x00000197903D1000-memory.dmp

Download

memory/5732-815-0x00000197903D0000-0x00000197903D1000-memory.dmp

Download