Overview

overview

7

Static

static

3

2026-07-15...ca.exe

windows10-2004-x64

7

2026-07-15...ca.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    112s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    15/07/2026, 15:45

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-15_2b7c60ce867bde768d3804933393f7ad_amadey_coinminer_darkgate_elex_glassworm_hellokitty_luca.exe
  • Size 36.9MB
  • Sample260715-s66bpsfy2r
  • SHA256 42035a0baed6dbc4b11c01f37f9ca00356eebbc2f34df1314ea0f0b6edbe93c4
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecutionpersistence

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 64 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Program crash 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 34 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 9 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 31 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-15_2b7c60ce867bde768d3804933393f7ad_amadey_coinminer_darkgate_elex_glassworm_hellokitty_luca.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-15_2b7c60ce867bde768d3804933393f7ad_amadey_coinminer_darkgate_elex_glassworm_hellokitty_luca.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4556
    • C:\Windows\SysWOW64\schtasks.exe
      "schtasks.exe" /Query /TN "RunstimeHost" /FO LIST /V
      2⤵
      • System Location Discovery: System Language Discovery
      PID:3028
    • C:\Windows\SysWOW64\schtasks.exe
      "schtasks.exe" /Query /TN "RuntimeHost" /FO LIST /V
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2744
    • C:\Windows\SysWOW64\schtasks.exe
      "schtasks.exe" /Query /TN "RunstimeHost_Admin" /FO LIST /V
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2028
    • C:\Windows\SysWOW64\schtasks.exe
      "schtasks.exe" /Query /TN "RunstimeHost_Admin" /FO LIST /V
      2⤵
      • System Location Discovery: System Language Discovery
      PID:5572
    • C:\Windows\SysWOW64\schtasks.exe
      "schtasks.exe" /Query /TN "RunstimeHost_Admin" /FO LIST /V
      2⤵
      • System Location Discovery: System Language Discovery
      PID:4300
    • C:\Windows\SysWOW64\schtasks.exe
      "schtasks.exe" /Create /TN "RunstimeHost_Admin" /TR "C:\ProgramData\RunstimeHost\RunstimeHost.exe" /SC ONLOGON /RL LIMITED /F
      2⤵
      • System Location Discovery: System Language Discovery
      • Scheduled Task/Job: Scheduled Task
      PID:860
    • C:\Windows\SysWOW64\schtasks.exe
      "schtasks.exe" /Query /TN "RunstimeHost" /FO LIST /V
      2⤵
      • System Location Discovery: System Language Discovery
      PID:3684
    • C:\Windows\SysWOW64\schtasks.exe
      "schtasks.exe" /Query /TN "RuntimeHost" /FO LIST /V
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2864
    • C:\Windows\SysWOW64\schtasks.exe
      "schtasks.exe" /Query /TN "RunstimeHost_Admin" /FO LIST /V
      2⤵
      • System Location Discovery: System Language Discovery
      PID:4520
    • C:\Windows\SysWOW64\schtasks.exe
      "schtasks.exe" /Query /TN "RunstimeHost_Admin" /FO LIST /V
      2⤵
      • System Location Discovery: System Language Discovery
      PID:5652
    • C:\Windows\SysWOW64\schtasks.exe
      "schtasks.exe" /Query /TN "RunstimeHost_Admin" /FO LIST /V
      2⤵
      • System Location Discovery: System Language Discovery
      PID:5372
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4556 -s 1936
      2⤵
      • Program crash
      PID:2740
  • C:\ProgramData\RunstimeHost\RunstimeHost.exe
    "C:\ProgramData\RunstimeHost\RunstimeHost.exe"
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:5248
    • C:\Windows\SysWOW64\schtasks.exe
      "schtasks.exe" /Query /TN "RunstimeHost" /FO LIST /V
      2⤵
      • System Location Discovery: System Language Discovery
      PID:4164
    • C:\Windows\SysWOW64\schtasks.exe
      "schtasks.exe" /Query /TN "RuntimeHost" /FO LIST /V
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2412
    • C:\Windows\SysWOW64\schtasks.exe
      "schtasks.exe" /Query /TN "RunstimeHost_Admin" /FO LIST /V
      2⤵
      • System Location Discovery: System Language Discovery
      PID:4112
    • C:\Windows\SysWOW64\schtasks.exe
      "schtasks.exe" /Query /TN "RunstimeHost_Admin" /FO LIST /V
      2⤵
      • System Location Discovery: System Language Discovery
      PID:4744
    • C:\Windows\SysWOW64\schtasks.exe
      "schtasks.exe" /Query /TN "RunstimeHost_Admin" /FO LIST /V
      2⤵
      • System Location Discovery: System Language Discovery
      PID:672
    • C:\Windows\SysWOW64\schtasks.exe
      "schtasks.exe" /Query /TN "RunstimeHost" /FO LIST /V
      2⤵
      • System Location Discovery: System Language Discovery
      PID:5656
    • C:\Windows\SysWOW64\schtasks.exe
      "schtasks.exe" /Query /TN "RuntimeHost" /FO LIST /V
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1548
    • C:\Windows\SysWOW64\schtasks.exe
      "schtasks.exe" /Query /TN "RunstimeHost_Admin" /FO LIST /V
      2⤵
      • System Location Discovery: System Language Discovery
      PID:5952
    • C:\Windows\SysWOW64\schtasks.exe
      "schtasks.exe" /Query /TN "RunstimeHost_Admin" /FO LIST /V
      2⤵
      • System Location Discovery: System Language Discovery
      PID:3004
    • C:\Windows\SysWOW64\schtasks.exe
      "schtasks.exe" /Query /TN "RunstimeHost_Admin" /FO LIST /V
      2⤵
      • System Location Discovery: System Language Discovery
      PID:4624
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5248 -s 1904
      2⤵
      • Program crash
      PID:5968
  • C:\ProgramData\RunstimeHost\RunstimeHost.exe
    C:\ProgramData\RunstimeHost\RunstimeHost.exe
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3412
    • C:\Windows\SysWOW64\schtasks.exe
      "schtasks.exe" /Query /TN "RunstimeHost" /FO LIST /V
      2⤵
      • System Location Discovery: System Language Discovery
      PID:3736
    • C:\Windows\SysWOW64\schtasks.exe
      "schtasks.exe" /Query /TN "RuntimeHost" /FO LIST /V
      2⤵
      • System Location Discovery: System Language Discovery
      PID:5608
    • C:\Windows\SysWOW64\schtasks.exe
      "schtasks.exe" /Query /TN "RunstimeHost_Admin" /FO LIST /V
      2⤵
      • System Location Discovery: System Language Discovery
      PID:4144
    • C:\Windows\SysWOW64\schtasks.exe
      "schtasks.exe" /Query /TN "RunstimeHost_Admin" /FO LIST /V
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1240
    • C:\Windows\SysWOW64\schtasks.exe
      "schtasks.exe" /Query /TN "RunstimeHost_Admin" /FO LIST /V
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1768
    • C:\Windows\SysWOW64\schtasks.exe
      "schtasks.exe" /Query /TN "RunstimeHost" /FO LIST /V
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1064
    • C:\Windows\SysWOW64\schtasks.exe
      "schtasks.exe" /Query /TN "RuntimeHost" /FO LIST /V
      2⤵
      • System Location Discovery: System Language Discovery
      PID:5324
    • C:\Windows\SysWOW64\schtasks.exe
      "schtasks.exe" /Query /TN "RunstimeHost_Admin" /FO LIST /V
      2⤵
      • System Location Discovery: System Language Discovery
      PID:888
    • C:\Windows\SysWOW64\schtasks.exe
      "schtasks.exe" /Query /TN "RunstimeHost_Admin" /FO LIST /V
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2360
    • C:\Windows\SysWOW64\schtasks.exe
      "schtasks.exe" /Query /TN "RunstimeHost_Admin" /FO LIST /V
      2⤵
      • System Location Discovery: System Language Discovery
      PID:4732
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3412 -s 1856
      2⤵
      • Program crash
      PID:4616
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 4556 -ip 4556
    1⤵
      PID:5732
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 3412 -ip 3412
      1⤵
        PID:2316
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 5248 -ip 5248
        1⤵
          PID:6088

        Network

              MITRE ATT&CK Enterprise v16

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              worker.log
              • Path C:\ProgramData\RunstimeHost\worker.log
              • Size 4KB
              • SHA256 4812e1c3ff3397b2cb006577226286bc6f805fbb7d454d3e81e4788c36c7195f
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Microsoft.Extensions.Configuration.Abstractions.dll
              • Path C:\Users\Admin\AppData\Local\Temp\.net\2026-07-15_2b7c60ce867bde768d3804933393f7ad_amadey_coinminer_darkgate_elex_glassworm_hellokitty_luca\zUbiemIvbH8H\Microsoft.Extensions.Configuration.Abstractions.dll
              • Size 20KB
              • SHA256 d7c93ca03223621c8a5a637c493963a54a7f3b998c843f8492eaaa56aa8282c0
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Microsoft.Extensions.Configuration.Binder.dll
              • Path C:\Users\Admin\AppData\Local\Temp\.net\2026-07-15_2b7c60ce867bde768d3804933393f7ad_amadey_coinminer_darkgate_elex_glassworm_hellokitty_luca\zUbiemIvbH8H\Microsoft.Extensions.Configuration.Binder.dll
              • Size 24KB
              • SHA256 e45c25ed278caf03269a8019c2fcc239cca54f2b8ef35f46552471945259da00
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Microsoft.Extensions.Configuration.FileExtensions.dll
              • Path C:\Users\Admin\AppData\Local\Temp\.net\2026-07-15_2b7c60ce867bde768d3804933393f7ad_amadey_coinminer_darkgate_elex_glassworm_hellokitty_luca\zUbiemIvbH8H\Microsoft.Extensions.Configuration.FileExtensions.dll
              • Size 22KB
              • SHA256 8303e61bd9b65ea69cb5fe82af99a91c4d297c33ec3a85fda53a9390d4ef5986
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Microsoft.Extensions.Configuration.Json.dll
              • Path C:\Users\Admin\AppData\Local\Temp\.net\2026-07-15_2b7c60ce867bde768d3804933393f7ad_amadey_coinminer_darkgate_elex_glassworm_hellokitty_luca\zUbiemIvbH8H\Microsoft.Extensions.Configuration.Json.dll
              • Size 21KB
              • SHA256 753bab17735f95718714bd70a44635491798b4ac933306733e080c2e6c8660b0
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Microsoft.Extensions.Configuration.UserSecrets.dll
              • Path C:\Users\Admin\AppData\Local\Temp\.net\2026-07-15_2b7c60ce867bde768d3804933393f7ad_amadey_coinminer_darkgate_elex_glassworm_hellokitty_luca\zUbiemIvbH8H\Microsoft.Extensions.Configuration.UserSecrets.dll
              • Size 20KB
              • SHA256 d78e760bd48321e8df0eeb7de6583ccc2313898d3022c88dd32435f80b0120e4
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Microsoft.Extensions.DependencyInjection.Abstractions.dll
              • Path C:\Users\Admin\AppData\Local\Temp\.net\2026-07-15_2b7c60ce867bde768d3804933393f7ad_amadey_coinminer_darkgate_elex_glassworm_hellokitty_luca\zUbiemIvbH8H\Microsoft.Extensions.DependencyInjection.Abstractions.dll
              • Size 36KB
              • SHA256 46a7958b78e832aa9ecd3eac71d5486ac2ab961386594ae968f071981a8a0edb
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Microsoft.Extensions.DependencyInjection.dll
              • Path C:\Users\Admin\AppData\Local\Temp\.net\2026-07-15_2b7c60ce867bde768d3804933393f7ad_amadey_coinminer_darkgate_elex_glassworm_hellokitty_luca\zUbiemIvbH8H\Microsoft.Extensions.DependencyInjection.dll
              • Size 70KB
              • SHA256 753058a319c0b68ad864cf5ce6ff7dd874cfb6e30073a4018621c783de062cff
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Microsoft.Extensions.FileProviders.Abstractions.dll
              • Path C:\Users\Admin\AppData\Local\Temp\.net\2026-07-15_2b7c60ce867bde768d3804933393f7ad_amadey_coinminer_darkgate_elex_glassworm_hellokitty_luca\zUbiemIvbH8H\Microsoft.Extensions.FileProviders.Abstractions.dll
              • Size 17KB
              • SHA256 a2971d22994e42b4882d7dee860778f172b05f62b2e17b53ad2efddea38d28b3
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Microsoft.Extensions.FileProviders.Physical.dll
              • Path C:\Users\Admin\AppData\Local\Temp\.net\2026-07-15_2b7c60ce867bde768d3804933393f7ad_amadey_coinminer_darkgate_elex_glassworm_hellokitty_luca\zUbiemIvbH8H\Microsoft.Extensions.FileProviders.Physical.dll
              • Size 34KB
              • SHA256 432594ede81978982e632386b647909f27e2633e59f23d3c9afba1ec8fcaefb5
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Microsoft.Extensions.FileSystemGlobbing.dll
              • Path C:\Users\Admin\AppData\Local\Temp\.net\2026-07-15_2b7c60ce867bde768d3804933393f7ad_amadey_coinminer_darkgate_elex_glassworm_hellokitty_luca\zUbiemIvbH8H\Microsoft.Extensions.FileSystemGlobbing.dll
              • Size 38KB
              • SHA256 25dd3e3f151d67c445e7602ffbc4d1c43ffaf6cae42a524f5926554e37ad1bf0
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Microsoft.Extensions.Hosting.Abstractions.dll
              • Path C:\Users\Admin\AppData\Local\Temp\.net\2026-07-15_2b7c60ce867bde768d3804933393f7ad_amadey_coinminer_darkgate_elex_glassworm_hellokitty_luca\zUbiemIvbH8H\Microsoft.Extensions.Hosting.Abstractions.dll
              • Size 24KB
              • SHA256 7bde991674c36db141ae9f681f5bb6da9d6b722b6d9beae1ba55065df9212e27
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Microsoft.Extensions.Hosting.WindowsServices.dll
              • Path C:\Users\Admin\AppData\Local\Temp\.net\2026-07-15_2b7c60ce867bde768d3804933393f7ad_amadey_coinminer_darkgate_elex_glassworm_hellokitty_luca\zUbiemIvbH8H\Microsoft.Extensions.Hosting.WindowsServices.dll
              • Size 20KB
              • SHA256 ca5cb3cff0f2ebe532b8c59bf1f9f0b7b5511b73f4357eafa1d76b9da88119dd
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Microsoft.Extensions.Hosting.dll
              • Path C:\Users\Admin\AppData\Local\Temp\.net\2026-07-15_2b7c60ce867bde768d3804933393f7ad_amadey_coinminer_darkgate_elex_glassworm_hellokitty_luca\zUbiemIvbH8H\Microsoft.Extensions.Hosting.dll
              • Size 40KB
              • SHA256 a02f578e95ef277222bf507e921492383854c05f96fb68b58e67588415dee427
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Microsoft.Extensions.Logging.Abstractions.dll
              • Path C:\Users\Admin\AppData\Local\Temp\.net\2026-07-15_2b7c60ce867bde768d3804933393f7ad_amadey_coinminer_darkgate_elex_glassworm_hellokitty_luca\zUbiemIvbH8H\Microsoft.Extensions.Logging.Abstractions.dll
              • Size 47KB
              • SHA256 75fc013d751f4dd09683ac5fa82761e43fc6d81e6c006ef8759c8a17c647f931
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Microsoft.Extensions.Logging.Configuration.dll
              • Path C:\Users\Admin\AppData\Local\Temp\.net\2026-07-15_2b7c60ce867bde768d3804933393f7ad_amadey_coinminer_darkgate_elex_glassworm_hellokitty_luca\zUbiemIvbH8H\Microsoft.Extensions.Logging.Configuration.dll
              • Size 19KB
              • SHA256 5f4274d17e79211adf365844f91532ac4f8c5022b36c1376f0d965c2fb51ca06
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Microsoft.Extensions.Logging.Console.dll
              • Path C:\Users\Admin\AppData\Local\Temp\.net\2026-07-15_2b7c60ce867bde768d3804933393f7ad_amadey_coinminer_darkgate_elex_glassworm_hellokitty_luca\zUbiemIvbH8H\Microsoft.Extensions.Logging.Console.dll
              • Size 27KB
              • SHA256 b2ee713a3faac33a2272af5c6b01ea7f880c88bb0f08a20ec96d5388b5faebc6
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Microsoft.Extensions.Logging.Debug.dll
              • Path C:\Users\Admin\AppData\Local\Temp\.net\2026-07-15_2b7c60ce867bde768d3804933393f7ad_amadey_coinminer_darkgate_elex_glassworm_hellokitty_luca\zUbiemIvbH8H\Microsoft.Extensions.Logging.Debug.dll
              • Size 17KB
              • SHA256 b24e88d1d7041c0ea69cef98de24ea82877f3b849e5fc28268c5e6eb63d4fb65
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Microsoft.Extensions.Logging.EventLog.dll
              • Path C:\Users\Admin\AppData\Local\Temp\.net\2026-07-15_2b7c60ce867bde768d3804933393f7ad_amadey_coinminer_darkgate_elex_glassworm_hellokitty_luca\zUbiemIvbH8H\Microsoft.Extensions.Logging.EventLog.dll
              • Size 21KB
              • SHA256 7c7c5370749e389a44801ea904979d7b4433adb8f55e1273fb9d5b35df1d292a
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Microsoft.Extensions.Logging.EventSource.dll
              • Path C:\Users\Admin\AppData\Local\Temp\.net\2026-07-15_2b7c60ce867bde768d3804933393f7ad_amadey_coinminer_darkgate_elex_glassworm_hellokitty_luca\zUbiemIvbH8H\Microsoft.Extensions.Logging.EventSource.dll
              • Size 28KB
              • SHA256 813e8012ddad6fd70c2ff1705d23f8a6605d8e5c033c8ca4d6de94ba06d54f68
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Microsoft.Extensions.Logging.dll
              • Path C:\Users\Admin\AppData\Local\Temp\.net\2026-07-15_2b7c60ce867bde768d3804933393f7ad_amadey_coinminer_darkgate_elex_glassworm_hellokitty_luca\zUbiemIvbH8H\Microsoft.Extensions.Logging.dll
              • Size 33KB
              • SHA256 6245bad54aac16035056d0e61a06a0d334816b95dda6ddee1d131de393f40aea
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Microsoft.Extensions.Options.ConfigurationExtensions.dll
              • Path C:\Users\Admin\AppData\Local\Temp\.net\2026-07-15_2b7c60ce867bde768d3804933393f7ad_amadey_coinminer_darkgate_elex_glassworm_hellokitty_luca\zUbiemIvbH8H\Microsoft.Extensions.Options.ConfigurationExtensions.dll
              • Size 17KB
              • SHA256 8f20aa833354038492c3c0e06dd3b26c23e5fccdefabdccfe7ae258172ddef12
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Microsoft.Extensions.Options.dll
              • Path C:\Users\Admin\AppData\Local\Temp\.net\2026-07-15_2b7c60ce867bde768d3804933393f7ad_amadey_coinminer_darkgate_elex_glassworm_hellokitty_luca\zUbiemIvbH8H\Microsoft.Extensions.Options.dll
              • Size 49KB
              • SHA256 5c6b0ce8c1d71c31cab555fa20e3affd9040b2fbef505f36b7150a0eb2de66b6
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Microsoft.Win32.Primitives.dll
              • Path C:\Users\Admin\AppData\Local\Temp\.net\2026-07-15_2b7c60ce867bde768d3804933393f7ad_amadey_coinminer_darkgate_elex_glassworm_hellokitty_luca\zUbiemIvbH8H\Microsoft.Win32.Primitives.dll
              • Size 7KB
              • SHA256 15e9ee01ebb14c15c298e5d0b88ba37114c8c9306fb0a2911daa483b9b77d789
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Microsoft.Win32.Registry.dll
              • Path C:\Users\Admin\AppData\Local\Temp\.net\2026-07-15_2b7c60ce867bde768d3804933393f7ad_amadey_coinminer_darkgate_elex_glassworm_hellokitty_luca\zUbiemIvbH8H\Microsoft.Win32.Registry.dll
              • Size 52KB
              • SHA256 5738f1e014d65979898848781075db25eede1f14d7e38d68cea6a4c49bc2b2c4
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              RunstimeHost.dll
              • Path C:\Users\Admin\AppData\Local\Temp\.net\2026-07-15_2b7c60ce867bde768d3804933393f7ad_amadey_coinminer_darkgate_elex_glassworm_hellokitty_luca\zUbiemIvbH8H\RunstimeHost.dll
              • Size 15.9MB
              • SHA256 392ee20a70a1911e8f4703db1eed5676a93fdf44fb322b53be51fd3791b1b3cd
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              System.Buffers.dll
              • Path C:\Users\Admin\AppData\Local\Temp\.net\2026-07-15_2b7c60ce867bde768d3804933393f7ad_amadey_coinminer_darkgate_elex_glassworm_hellokitty_luca\zUbiemIvbH8H\System.Buffers.dll
              • Size 5KB
              • SHA256 4602a079d819cf629cffd4f6d8469cf6509e2eb2cce55b1e458a9bf0f7dd9ded
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              System.Collections.NonGeneric.dll
              • Path C:\Users\Admin\AppData\Local\Temp\.net\2026-07-15_2b7c60ce867bde768d3804933393f7ad_amadey_coinminer_darkgate_elex_glassworm_hellokitty_luca\zUbiemIvbH8H\System.Collections.NonGeneric.dll
              • Size 25KB
              • SHA256 2968db75e97645107521faf506f1a618af214ca33043ca8faddd6f3e99d013f7
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              System.Collections.Specialized.dll
              • Path C:\Users\Admin\AppData\Local\Temp\.net\2026-07-15_2b7c60ce867bde768d3804933393f7ad_amadey_coinminer_darkgate_elex_glassworm_hellokitty_luca\zUbiemIvbH8H\System.Collections.Specialized.dll
              • Size 21KB
              • SHA256 f1ae4cc213dcb9a27c241471d0f32a6cb16671ca6e3c457cb6f638a60f49e2d7
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              System.Collections.dll
              • Path C:\Users\Admin\AppData\Local\Temp\.net\2026-07-15_2b7c60ce867bde768d3804933393f7ad_amadey_coinminer_darkgate_elex_glassworm_hellokitty_luca\zUbiemIvbH8H\System.Collections.dll
              • Size 54KB
              • SHA256 e44cf44cc04c3f7b3fc8b2cf153936bf3974a89bdaa6150cf00daee3d960174d
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              System.ComponentModel.Primitives.dll
              • Path C:\Users\Admin\AppData\Local\Temp\.net\2026-07-15_2b7c60ce867bde768d3804933393f7ad_amadey_coinminer_darkgate_elex_glassworm_hellokitty_luca\zUbiemIvbH8H\System.ComponentModel.Primitives.dll
              • Size 13KB
              • SHA256 128e808f970c49058a6a641e06a28ec424f412027d2aab6fe27821bcd2d1945f
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              System.ComponentModel.dll
              • Path C:\Users\Admin\AppData\Local\Temp\.net\2026-07-15_2b7c60ce867bde768d3804933393f7ad_amadey_coinminer_darkgate_elex_glassworm_hellokitty_luca\zUbiemIvbH8H\System.ComponentModel.dll
              • Size 4KB
              • SHA256 38d00e7a302ee4eee5abba3b11fc666d49682cb2b52401ddf56c2e6922d21137
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              System.Console.dll
              • Path C:\Users\Admin\AppData\Local\Temp\.net\2026-07-15_2b7c60ce867bde768d3804933393f7ad_amadey_coinminer_darkgate_elex_glassworm_hellokitty_luca\zUbiemIvbH8H\System.Console.dll
              • Size 35KB
              • SHA256 ad73c05d5b4f0c607564dbf4013512eb22ca24f46d850b124e65d300f9ceaf04
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              System.Diagnostics.Process.dll
              • Path C:\Users\Admin\AppData\Local\Temp\.net\2026-07-15_2b7c60ce867bde768d3804933393f7ad_amadey_coinminer_darkgate_elex_glassworm_hellokitty_luca\zUbiemIvbH8H\System.Diagnostics.Process.dll
              • Size 72KB
              • SHA256 687d2dd781dd0ec636c338ca496519a97d9f123662b94fbc0f2fc74d4ac4fe2e
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              System.Diagnostics.Tracing.dll
              • Path C:\Users\Admin\AppData\Local\Temp\.net\2026-07-15_2b7c60ce867bde768d3804933393f7ad_amadey_coinminer_darkgate_elex_glassworm_hellokitty_luca\zUbiemIvbH8H\System.Diagnostics.Tracing.dll
              • Size 5KB
              • SHA256 f71f6cf933d4975d495592ac38f733862bdc8a41243a2fdaa6820a850b1e3742
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              System.IO.FileSystem.dll
              • Path C:\Users\Admin\AppData\Local\Temp\.net\2026-07-15_2b7c60ce867bde768d3804933393f7ad_amadey_coinminer_darkgate_elex_glassworm_hellokitty_luca\zUbiemIvbH8H\System.IO.FileSystem.dll
              • Size 49KB
              • SHA256 230250285baaa9aa5384403186bc324bbf39a9e8140b7924841990e3654150a1
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              System.Linq.dll
              • Path C:\Users\Admin\AppData\Local\Temp\.net\2026-07-15_2b7c60ce867bde768d3804933393f7ad_amadey_coinminer_darkgate_elex_glassworm_hellokitty_luca\zUbiemIvbH8H\System.Linq.dll
              • Size 44KB
              • SHA256 5f974ee55a94c713feed701abf659675d1f6d8ba52b9cc5108ec7d0bca4b5570
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              System.Management.dll
              • Path C:\Users\Admin\AppData\Local\Temp\.net\2026-07-15_2b7c60ce867bde768d3804933393f7ad_amadey_coinminer_darkgate_elex_glassworm_hellokitty_luca\zUbiemIvbH8H\System.Management.dll
              • Size 287KB
              • SHA256 6995bc11aa735e6772222e782eea80238663d11fbe577435310735ce0a197335
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              System.Net.NameResolution.dll
              • Path C:\Users\Admin\AppData\Local\Temp\.net\2026-07-15_2b7c60ce867bde768d3804933393f7ad_amadey_coinminer_darkgate_elex_glassworm_hellokitty_luca\zUbiemIvbH8H\System.Net.NameResolution.dll
              • Size 29KB
              • SHA256 4fcaaec8ed4e32a540f043d9813cf308dda5f36e7875ce8107e721282858dbfb
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              System.Net.NetworkInformation.dll
              • Path C:\Users\Admin\AppData\Local\Temp\.net\2026-07-15_2b7c60ce867bde768d3804933393f7ad_amadey_coinminer_darkgate_elex_glassworm_hellokitty_luca\zUbiemIvbH8H\System.Net.NetworkInformation.dll
              • Size 37KB
              • SHA256 5e6a2a036605483660e861e0dfc446ba563a2d16f2d05faf5b5472ae07edd389
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              System.Net.Primitives.dll
              • Path C:\Users\Admin\AppData\Local\Temp\.net\2026-07-15_2b7c60ce867bde768d3804933393f7ad_amadey_coinminer_darkgate_elex_glassworm_hellokitty_luca\zUbiemIvbH8H\System.Net.Primitives.dll
              • Size 66KB
              • SHA256 382abbcdf3e85bea04ad1b062acf61e9f0b0f5f287b527df4613806d8dc33b96
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              System.Net.Sockets.dll
              • Path C:\Users\Admin\AppData\Local\Temp\.net\2026-07-15_2b7c60ce867bde768d3804933393f7ad_amadey_coinminer_darkgate_elex_glassworm_hellokitty_luca\zUbiemIvbH8H\System.Net.Sockets.dll
              • Size 114KB
              • SHA256 4edec066591ba65622422f1ab98426f271cd007ab0f6ff3e1a3a1709bc13bc14
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              System.Private.CoreLib.dll
              • Path C:\Users\Admin\AppData\Local\Temp\.net\2026-07-15_2b7c60ce867bde768d3804933393f7ad_amadey_coinminer_darkgate_elex_glassworm_hellokitty_luca\zUbiemIvbH8H\System.Private.CoreLib.dll
              • Size 1.9MB
              • SHA256 971f4520038e4eb1b9a3859e7b318008930347259b145b622e2e932cefc83504
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              System.Reflection.Emit.Lightweight.dll
              • Path C:\Users\Admin\AppData\Local\Temp\.net\2026-07-15_2b7c60ce867bde768d3804933393f7ad_amadey_coinminer_darkgate_elex_glassworm_hellokitty_luca\zUbiemIvbH8H\System.Reflection.Emit.Lightweight.dll
              • Size 4KB
              • SHA256 0653c210b5308732853e4185a900d1cf781bd8cffb9747e58b386c2c3989aab3
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              System.Runtime.Extensions.dll
              • Path C:\Users\Admin\AppData\Local\Temp\.net\2026-07-15_2b7c60ce867bde768d3804933393f7ad_amadey_coinminer_darkgate_elex_glassworm_hellokitty_luca\zUbiemIvbH8H\System.Runtime.Extensions.dll
              • Size 17KB
              • SHA256 9db285d5487aa38b11e92874c982bdba821116c81865dd09bac0c62ad09fd312
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              System.Runtime.InteropServices.RuntimeInformation.dll
              • Path C:\Users\Admin\AppData\Local\Temp\.net\2026-07-15_2b7c60ce867bde768d3804933393f7ad_amadey_coinminer_darkgate_elex_glassworm_hellokitty_luca\zUbiemIvbH8H\System.Runtime.InteropServices.RuntimeInformation.dll
              • Size 7KB
              • SHA256 e5b8bb7454acd11cc65391b548967734af7f3c9f75fdd517ea3641681c6e5ef5
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              System.Runtime.InteropServices.dll
              • Path C:\Users\Admin\AppData\Local\Temp\.net\2026-07-15_2b7c60ce867bde768d3804933393f7ad_amadey_coinminer_darkgate_elex_glassworm_hellokitty_luca\zUbiemIvbH8H\System.Runtime.InteropServices.dll
              • Size 8KB
              • SHA256 5234d112ad94d0bdd5692897e868a11624eba21dcb5199d0f012b9b53ce7ebcb
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              System.Runtime.dll
              • Path C:\Users\Admin\AppData\Local\Temp\.net\2026-07-15_2b7c60ce867bde768d3804933393f7ad_amadey_coinminer_darkgate_elex_glassworm_hellokitty_luca\zUbiemIvbH8H\System.Runtime.dll
              • Size 16KB
              • SHA256 9888f6c97cb2ebc4f0b9b316697f8f59569f2ec6cc68aeb4bfbd3d1d514d9c67
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              System.Security.Cryptography.Algorithms.dll
              • Path C:\Users\Admin\AppData\Local\Temp\.net\2026-07-15_2b7c60ce867bde768d3804933393f7ad_amadey_coinminer_darkgate_elex_glassworm_hellokitty_luca\zUbiemIvbH8H\System.Security.Cryptography.Algorithms.dll
              • Size 32KB
              • SHA256 666d6f84eaace63e8112b1480d9f2f0a875f0c5242a543d73190c50cb83e84ae
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              System.Security.Cryptography.Primitives.dll
              • Path C:\Users\Admin\AppData\Local\Temp\.net\2026-07-15_2b7c60ce867bde768d3804933393f7ad_amadey_coinminer_darkgate_elex_glassworm_hellokitty_luca\zUbiemIvbH8H\System.Security.Cryptography.Primitives.dll
              • Size 12KB
              • SHA256 138ab947e18e10e29600af33fa802733661519891871a790e2bdad33ab020cbb
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              System.Text.RegularExpressions.dll
              • Path C:\Users\Admin\AppData\Local\Temp\.net\2026-07-15_2b7c60ce867bde768d3804933393f7ad_amadey_coinminer_darkgate_elex_glassworm_hellokitty_luca\zUbiemIvbH8H\System.Text.RegularExpressions.dll
              • Size 128KB
              • SHA256 4b803e428684ccb32b2ce43f61bab9832bf6b052f29fafef215a809f27109ae6
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              System.Threading.Tasks.dll
              • Path C:\Users\Admin\AppData\Local\Temp\.net\2026-07-15_2b7c60ce867bde768d3804933393f7ad_amadey_coinminer_darkgate_elex_glassworm_hellokitty_luca\zUbiemIvbH8H\System.Threading.Tasks.dll
              • Size 5KB
              • SHA256 134fa427c89dc044839653f11c4bd18d06f2e6befa27daa0459f093c833a7b28
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              System.Threading.Thread.dll
              • Path C:\Users\Admin\AppData\Local\Temp\.net\2026-07-15_2b7c60ce867bde768d3804933393f7ad_amadey_coinminer_darkgate_elex_glassworm_hellokitty_luca\zUbiemIvbH8H\System.Threading.Thread.dll
              • Size 5KB
              • SHA256 08e2ee924a434140f2aed2b098a0ea82c0912df1de79af6e1c87f58e49634c8a
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              System.Threading.dll
              • Path C:\Users\Admin\AppData\Local\Temp\.net\2026-07-15_2b7c60ce867bde768d3804933393f7ad_amadey_coinminer_darkgate_elex_glassworm_hellokitty_luca\zUbiemIvbH8H\System.Threading.dll
              • Size 12KB
              • SHA256 90ba945186e909a6f80ca8bbaa4593d9513152fc1dcddb2eaf379facd2cc662e
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              clrjit.dll
              • Path C:\Users\Admin\AppData\Local\Temp\.net\2026-07-15_2b7c60ce867bde768d3804933393f7ad_amadey_coinminer_darkgate_elex_glassworm_hellokitty_luca\zUbiemIvbH8H\clrjit.dll
              • Size 1.1MB
              • SHA256 520ef22ad5cdc40025f8964d0cefb39b0c88cec4e0f7d49863f004887adecc95
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              coreclr.dll
              • Path C:\Users\Admin\AppData\Local\Temp\.net\2026-07-15_2b7c60ce867bde768d3804933393f7ad_amadey_coinminer_darkgate_elex_glassworm_hellokitty_luca\zUbiemIvbH8H\coreclr.dll
              • Size 4.1MB
              • SHA256 d8877ba978e5ffb733026d15fc6e7b60862c8c43ad04ca3e5b663b6dcc7dd6bc
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              hostfxr.dll
              • Path C:\Users\Admin\AppData\Local\Temp\.net\2026-07-15_2b7c60ce867bde768d3804933393f7ad_amadey_coinminer_darkgate_elex_glassworm_hellokitty_luca\zUbiemIvbH8H\hostfxr.dll
              • Size 335KB
              • SHA256 26ed6778f4d368df211d035b548fa9b3d22976def5055d33c0f2a2d7086ed54a
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              hostpolicy.dll
              • Path C:\Users\Admin\AppData\Local\Temp\.net\2026-07-15_2b7c60ce867bde768d3804933393f7ad_amadey_coinminer_darkgate_elex_glassworm_hellokitty_luca\zUbiemIvbH8H\hostpolicy.dll
              • Size 328KB
              • SHA256 1f81009336fed33b50bf187d70a16929f4d1b4f78b4d1e16bbbf7f6a87ec5bb1
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              netstandard.dll
              • Path C:\Users\Admin\AppData\Local\Temp\.net\2026-07-15_2b7c60ce867bde768d3804933393f7ad_amadey_coinminer_darkgate_elex_glassworm_hellokitty_luca\zUbiemIvbH8H\netstandard.dll
              • Size 12KB
              • SHA256 6d0e6e4ebc970683fc1a999b6e4fa871a9d6f9ac749969367ef8978d9c4da943
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Microsoft.Extensions.Configuration.CommandLine.dll
              • Path C:\Users\Admin\AppData\Local\Temp\.net\RunstimeHost\1480\Microsoft.Extensions.Configuration.CommandLine.dll
              • Size 19KB
              • SHA256 06067f1fe21bd9b2cb5099927503307e0149eee7410f2f9c7c28b557d1369659
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Microsoft.Extensions.Configuration.EnvironmentVariables.dll
              • Path C:\Users\Admin\AppData\Local\Temp\.net\RunstimeHost\1480\Microsoft.Extensions.Configuration.EnvironmentVariables.dll
              • Size 20KB
              • SHA256 f9ca107253d5953f81f9ab1f59230332c6874420a03aa6c5d4888855b67eacbb
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Microsoft.Extensions.Configuration.dll
              • Path C:\Users\Admin\AppData\Local\Temp\.net\RunstimeHost\1480\Microsoft.Extensions.Configuration.dll
              • Size 26KB
              • SHA256 9c9d2e1f1ba018dbeb926288d60e0617676733d4e3b2e5f8801730f2b2f74bfe
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Microsoft.Extensions.Primitives.dll
              • Path C:\Users\Admin\AppData\Local\Temp\.net\RunstimeHost\1480\Microsoft.Extensions.Primitives.dll
              • Size 37KB
              • SHA256 32096607d1684aa05305a2261e896e15ef73859544c61c2f21c744fb7d627a06
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              RunstimeHost.deps.json
              • Path C:\Users\Admin\AppData\Local\Temp\.net\RunstimeHost\1480\RunstimeHost.deps.json
              • Size 44KB
              • SHA256 4186cb208eab71a0091f2acb6afb975ce38a937c60bbdc1896b2bb8bbd23d1f4
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              System.Collections.Concurrent.dll
              • Path C:\Users\Admin\AppData\Local\Temp\.net\RunstimeHost\1480\System.Collections.Concurrent.dll
              • Size 37KB
              • SHA256 1a2b5225260813f6ed854c6083ee152354ee2554469f2e9619a7f77667cd10d8
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              System.IO.FileSystem.Watcher.dll
              • Path C:\Users\Admin\AppData\Local\Temp\.net\RunstimeHost\1480\System.IO.FileSystem.Watcher.dll
              • Size 22KB
              • SHA256 bc2fec61f51547ba9d7ea1f92cfbf63c0b05dee39aacef24eba2333fc74df838
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              System.Resources.ResourceManager.dll
              • Path C:\Users\Admin\AppData\Local\Temp\.net\RunstimeHost\1480\System.Resources.ResourceManager.dll
              • Size 4KB
              • SHA256 e898e4d19fbfd77857d15bec377003223a795d13ec86fea0f7d8550ad0c04452
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              System.Threading.Timer.dll
              • Path C:\Users\Admin\AppData\Local\Temp\.net\RunstimeHost\1480\System.Threading.Timer.dll
              • Size 4KB
              • SHA256 869ec4302b0050f00ec976150ae0bddc2e5d63a8cf7beec1d8707fd91d6df497
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              mscordaccore.dll
              • Path C:\Users\Admin\AppData\Local\Temp\.net\RunstimeHost\1480\mscordaccore.dll
              • Size 959KB
              • SHA256 5e63a9d0e5a7d10a738a7ce4633bff84e223183ef2155b7adf80c211a2b80a77
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              RunstimeHost.runtimeconfig.json
              • Path C:\Users\Admin\AppData\Local\Temp\.net\RunstimeHost\zUbiemIvbH8H\RunstimeHost.runtimeconfig.json
              • Size 292B
              • SHA256 467007dd25582358e994e0e524ec7387beca946650fac80fcff8fdd5fadeaae6
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              mscorrc.debug.dll
              • Path C:\Users\Admin\AppData\Local\Temp\.net\RunstimeHost\zUbiemIvbH8H\mscorrc.debug.dll
              • Size 175KB
              • SHA256 4681c02858164bb8cb210238fde27c7099dfd34d6150e9706da8845a3706b8e6
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              memory/3412-854-0x0000000072BB0000-0x0000000073AEA000-memory.dmp
              Download

              memory/4556-733-0x0000000072970000-0x00000000738AA000-memory.dmp
              Download

              memory/5248-880-0x0000000072BB0000-0x0000000073AEA000-memory.dmp
              Download