80a4afc208ab5c0fafeacc26383d49dc07d614363916505897c1c8ddc6bc641f

Analysis

max time kernel
149s
max time network
136s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/07/2026, 03:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-17_65eb181c128916045cabd5d3167be6ab_darkgate_elex_glassworm_hijackloader_mimic.exe
Size 5.0MB
Sample260718-d4mn9aat8s
SHA256 80a4afc208ab5c0fafeacc26383d49dc07d614363916505897c1c8ddc6bc641f
MD5 65eb181c128916045cabd5d3167be6ab
SHA1 16c21d8df29f6f99f64ed29013b4f72b5152cbdc
SHA512 d528d5ba6f11e5a0baa28c0e4cda7dc1a0fcdb32d0693342ae63c3e8fdf4e6499d458e1aaf07c820cde5b657e66dcb837be67c6c45c5d6261c77e7b222c1e3d3
SSDEEP 98304:exyNWcJpJzAWTIJFfpSZZ6/2/5X08FKTKK4KKDyK5FZ1EEEEmEEE1EEEEEEEEEE5:7NjiiGFfpgciXZF3
TLSH
T19F368D107E41C176FBC202F59ABD7BFA466D9E20472C94DBC2983D5E4E701C32B366A6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2944	svghost.exe

Executes dropped EXE 2 IoCs

pid	Process
2944	svghost.exe
5836	2026-07-17_65eb181c128916045cabd5d3167be6ab_darkgate_elex_glassworm_hijackloader_mimic.exe

Loads dropped DLL 34 IoCs

pid	Process
2944	svghost.exe
2944	svghost.exe
2944	svghost.exe
2944	svghost.exe
2944	svghost.exe
2944	svghost.exe
2944	svghost.exe
2944	svghost.exe
2944	svghost.exe
2944	svghost.exe
2944	svghost.exe
2944	svghost.exe
2944	svghost.exe
2944	svghost.exe
2944	svghost.exe
2944	svghost.exe
2944	svghost.exe
2944	svghost.exe
2944	svghost.exe
2944	svghost.exe
2944	svghost.exe
2944	svghost.exe
2944	svghost.exe
2944	svghost.exe
2944	svghost.exe
2944	svghost.exe
2944	svghost.exe
2944	svghost.exe
2944	svghost.exe
2944	svghost.exe
2944	svghost.exe
2944	svghost.exe
2944	svghost.exe
2944	svghost.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\H:	svghost.exe
File opened (read-only)	\??\L:	svghost.exe
File opened (read-only)	\??\M:	svghost.exe
File opened (read-only)	\??\N:	svghost.exe
File opened (read-only)	\??\T:	svghost.exe
File opened (read-only)	\??\I:	svghost.exe
File opened (read-only)	\??\K:	svghost.exe
File opened (read-only)	\??\O:	svghost.exe
File opened (read-only)	\??\V:	svghost.exe
File opened (read-only)	\??\W:	svghost.exe
File opened (read-only)	\??\X:	svghost.exe
File opened (read-only)	\??\A:	svghost.exe
File opened (read-only)	\??\B:	svghost.exe
File opened (read-only)	\??\P:	svghost.exe
File opened (read-only)	\??\S:	svghost.exe
File opened (read-only)	\??\Z:	svghost.exe
File opened (read-only)	\??\D:	svghost.exe
File opened (read-only)	\??\J:	svghost.exe
File opened (read-only)	\??\Q:	svghost.exe
File opened (read-only)	\??\R:	svghost.exe
File opened (read-only)	\??\U:	svghost.exe
File opened (read-only)	\??\Y:	svghost.exe
File opened (read-only)	\??\G:	svghost.exe

Drops file in Program Files directory 20 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	svghost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	svghost.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	svghost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	svghost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	svghost.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	svghost.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	svghost.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	svghost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	svghost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	svghost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	svghost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	svghost.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	svghost.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	svghost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	svghost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	svghost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	svghost.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe	svghost.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	svghost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	svghost.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\svghost.exe	2026-07-17_65eb181c128916045cabd5d3167be6ab_darkgate_elex_glassworm_hijackloader_mimic.exe
File created	C:\Windows\svghost.exe	2026-07-17_65eb181c128916045cabd5d3167be6ab_darkgate_elex_glassworm_hijackloader_mimic.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-17_65eb181c128916045cabd5d3167be6ab_darkgate_elex_glassworm_hijackloader_mimic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svghost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-17_65eb181c128916045cabd5d3167be6ab_darkgate_elex_glassworm_hijackloader_mimic.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	2026-07-17_65eb181c128916045cabd5d3167be6ab_darkgate_elex_glassworm_hijackloader_mimic.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	2026-07-17_65eb181c128916045cabd5d3167be6ab_darkgate_elex_glassworm_hijackloader_mimic.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5836	2026-07-17_65eb181c128916045cabd5d3167be6ab_darkgate_elex_glassworm_hijackloader_mimic.exe
5836	2026-07-17_65eb181c128916045cabd5d3167be6ab_darkgate_elex_glassworm_hijackloader_mimic.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5116 wrote to memory of 2944	5116	2026-07-17_65eb181c128916045cabd5d3167be6ab_darkgate_elex_glassworm_hijackloader_mimic.exe	88
PID 2944 wrote to memory of 5836	2944	svghost.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-17_65eb181c128916045cabd5d3167be6ab_darkgate_elex_glassworm_hijackloader_mimic.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-17_65eb181c128916045cabd5d3167be6ab_darkgate_elex_glassworm_hijackloader_mimic.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5116
- C:\Windows\svghost.exe
  "C:\Windows\svghost.exe" "C:\Users\Admin\AppData\Local\Temp\2026-07-17_65eb181c128916045cabd5d3167be6ab_darkgate_elex_glassworm_hijackloader_mimic.exe"
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Loads dropped DLL
  - Enumerates connected drives
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2944
- - C:\Users\Admin\AppData\Local\Temp\2026-07-17_65eb181c128916045cabd5d3167be6ab_darkgate_elex_glassworm_hijackloader_mimic.exe
    C:\Users\Admin\AppData\Local\Temp\2026-07-17_65eb181c128916045cabd5d3167be6ab_darkgate_elex_glassworm_hijackloader_mimic.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    PID:5836

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 630KB
SHA256 11e78d4e7da0463d29bb5dacfca82787d2386437b92de844307fe85fdedeb32b
MD5 da75e852286f8c1c7190ae8bc0b63663
SHA1 1423c7fca1236959a8785ddf965e2766df1a97df
SHA512 af58bd628538e4b191478ba18378c58304045313784a9f463ef3f91ad4c944bb4bae20529bb9c4450406bc14c98c56633445062918a71208556c952ff63aeeea
SSDEEP 12288:vXZNYVLeyUji0a0h90ZD0wxpGZIVuKrHs:h0Le5ji0a0hmxNrM
TLSH
T150D40916F6748335D073C0B9C5D2A69EE972308257308ACB4296C77C7F67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.0MB
SHA256 6cbc4a60814fd499a2827c9e65b341fb50c7160e0193bfbbce1144dbce4e77b4
MD5 87752d740652f03f7243e734f1175c77
SHA1 3bfedcde109f6597796357fc16e92a23e3c81118
SHA512 fbdea83c2c0fec75290248eb3b634861f8de93e738850b3c3c303b330f680542e42ea5ddbee20a03aa6e80d0046daf964e82de2cf84898552f59b0213f85f4a1
SSDEEP 12288:O8vaa8zYSZ8vaa81soeyezSC6v/ciLKK3kg5aqghpSy1TIPxTmqCLwKzu/:7aZPaa7/ezSC6vUyD/aqgrvWx6q8wyu
TLSH
T1AD35F825F5788333D0B2D0BAC5D6BA9AFE723046573089CB0246976C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.0MB
SHA256 93e8d2dca26b8b2aa195da53b80e0d9bbf1eb42ae462d8777a2d926208e22eba
MD5 83cae25c127c376c9cb0f01ab3202623
SHA1 6c0b7d67cc244c094a0837160c93953b454f27bb
SHA512 2e96bb020ada17567bc3f4c86998362debdc263cb5a6d6ca2db42f19f2cffa053a4ef6bb6cd94b66d44b952a5cc59035e0370c65848a77b93e59c909d4e928ae
SSDEEP 12288:MkVyYSZ8vaa81soeyezSC6v/ciLKK3kg5aqghpSy1TIPxTmqCLwKzu/:tkPaa7/ezSC6vUyD/aqgrvWx6q8wyu
TLSH
T16E35F915F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 773KB
SHA256 b6d64569b95479ecac7b8b2bdfbe9c27cc88e5da2b5d45467cb4781a2e5ebbe9
MD5 fb098955df41775691c6ef38d1e6be4a
SHA1 a61aee13094337ef1b80702f710cc98033ea7a6a
SHA512 638d7e9c6fbf35318040ea67dced1eb1705deb2df2453f328a876dea4dc9a7fc87203afca01b6818fae1ee731ac0e538ee5358ab1b770bcd5844b501353193a2
SSDEEP 12288:MkVyYSaVJjBq33vb5O8M+l1D0hwsEBoW/lx4Zf0Im98:tkPaVbqPb88hv/l+7
TLSH
T1BAF43B66F5748331D073C0BAC5D2AA9AEE3234425B318ACB0246D76C3E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 95KB
SHA256 39aaa86712b5ce2f0418d89579272d0535fa6b414a0f5fce979253001ff7a8e6
MD5 ec964ba678d5a80ed56dc5842afaffad
SHA1 c0ae53ebaa609b362f638b122fddbdc541a4b7ca
SHA512 cf2cadf1bfcfffb195e43133e32f374124a70a5e952cfad7a5e7042cd35c64250319b9952e59c8d99abeb915d2b18e014ea89e7e64b7de4df76c5524aebfca08
SSDEEP 1536:YA1V5CfA/L3WiukvSQc+HNAn6wPHX589HiF4V1dQh3geDmN6HSKm7Ct/EyYd9IAW:DCiyiukvvVHC6++uq3eqW14k/EyK9fSt
TLSH
T1BEA301178B516056F7F70130BABF2A96917E1D62DDA8DB0E4B907ACD0E78314E862733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InspectorOfficeGadget.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
Size 47KB
SHA256 6598ca3e59435f37ed0394e8bc1f2555b19acb60df87a3f7109a318186f0452d
MD5 7cd19ecb92ca273bfe0fbc6981f074b4
SHA1 1673458eeecdf3b4c69ba0f9b22050709d76b19f
SHA512 5eafa9a701f586822e4e0a572c67d328383547b58c0d51de2a1578660f557adfc485ffa0f02a07899be261b023a979bafe510f6d6d0615db311adfc12fe44d1f
SSDEEP 768:xrv0+Wh0VwUbH+48TLMM0l7h4TA5zt70oOLvEbFX2:xrecnr8fMMq2TozxOL8bg
TLSH
T14D233A41A7AC8217F9BB1F70B5F0C5121E7DEBC63C31C65E188AB49A2D637C08A1172B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InspectorOfficeGadget.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
Size 130KB
SHA256 86e5f3f3e3d35f220d71354e1bebbe7f73e29927871e8473dbbaf91eb4206569
MD5 ac350d6f41740ce78caa08f6a3b64a0f
SHA1 59174f6da0d205b0f80541236c33180f8e97e816
SHA512 411185fa5a4f08d7377ea435a5aa191abdcec5d4e2f24b7378845500826a2f402eb36a54d4e0cae0aa9547cd3c4749b6e00dccdf2efc05a4a55b6b6376b6d261
SSDEEP 3072:xrecrS2aozwLseqW14k/EyK9fq4nzrecrS2aozwL9:wcr0XdK9fqpcr0X9
TLSH
T1BBD37D41A7A88217F9FB1F34B5F485521E7DBBC63C31C61E1889B49A2D637C09A11B3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.2MB
SHA256 a8a2fe3b7cd21d591d680c9a0372dca3fa29f37cad3fdbf9056da7b5cc4a906e
MD5 f82231fc7dbdf0ed07a1777a307a761c
SHA1 453d49816662f6ec2c5823155ae7f7dfaf91261d
SHA512 e776e6036f0b020217e563c8d5aa6499952c3128dc9a2650f4aab57e11cf847896ce90cc97c97f4c94df4673872a6262c10cffc5d62e9ea5145201879dfeee94
SSDEEP 49152:Ze4QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJb9DN5J8NRV3j:Ze4QvGAdlCEL8c/bRNw5CO
TLSH
T1C1165B656BF880F5E0A7E178897AC672F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.2MB
SHA256 0b568012c235053dde0abbeebbf2a7b930f147e43051da5d5aa9cc868b66a69e
MD5 8a2ad865f0bbe2463f5fb089fdf0c74d
SHA1 14e1aabdc932c83322243cf03068f8530490d56f
SHA512 25c02443f289af5d52731887a0dac62c94465243d1b49e9c4adb0917efd4f3884607ca262fc9c2c5969b4e3613eb2402d02de2549c6df382caf3a87a3b021514
SSDEEP 49152:e4QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJb9DN5J8NRV3Tf:e4QvGAdlCEL8c/bRNw5CO
TLSH
T1E2165C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 440KB
SHA256 76963b7bd4c28e3218bb472299157c77e5968e0e5f9e8e99eb92df967d6f8b8e
MD5 5c5dea08333fa84e4b1aecb0ffe620e9
SHA1 b03ed6250f04378d06271949a6c5b322270fb881
SHA512 9d0ef551b0b78b8b2491d5ecade71f40175be03e768fda2361d3d6bda4dc14a1d558b068f61c2afd23dc0d454037a6f8d5595b60b49a914cdd8daaaad7fb4a0c
SSDEEP 12288:EkVyYMhAwSfxL/2Dc3jDLLmt0LDQewsAjRE:1klCaewsAju
TLSH
T1B4A48D31FE74E036C7BB0DB21B35C716183D7A604F611AC3E3A88A9D59602D26776E27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 23.5MB
SHA256 8c116a26e771e94d8a307472c61f3b49ea2d09d578b3e883cdeda5707ab8f89d
MD5 4b962753c42f8be4ae7c770113670fe8
SHA1 863057cc4ed6119d5bc2da76202ffef6f7f0cfc2
SHA512 fb54428039f4f56d1b46e7c310980ab052cc754c2e8587b60d5ec0a2862aec8f97a7c23275c6dcbe34cf081dda2c9f4231ab43181e458644b56018eb5a6e5f8c
SSDEEP 49152:AYVCPaBGkaXESCMBB7bu+zQ6zFZtcDYObMOpTKd6z0EEQ86fHxq455QJ7:vVJ3MREJqyQd
TLSH
T1B6477C9657B801FAD57BE0B8C79A8537FBF0780505346B9B86B1CB572F3BA60592E300
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 23.5MB
SHA256 2d3d4d7c0b5aa1e42665ee03bd3161450948b361dba0ee94fc06a4639c1ed9b1
MD5 4b72a0d04e9954b11b7b3ebfa75f1224
SHA1 7568d6253c3bbeed3e0bc0fc7ae2d2c6f15c2f47
SHA512 fcea79a7bddd4acc33e33c0b941b22ed17bac8ec344989ad099a42d7ac7490588e6f31578b7502700e6fdedf23776ca22328b42306decccd7edc186ad9fd4c7c
SSDEEP 49152:AYVCPaBGkaXGXESCMBB7bu+zQ6zFZcDYObMOpTKd6z0EEQ86fHxq455QJ7HXU:vVJYMXEJqyQdk
TLSH
T177475A66D76403F5C26AE074C6BA8577F6F03C0902319BAB86BDFA5B2F37660192D314
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.1MB
SHA256 7e0976036431640ae1d9f1c0b52bcea5dd37ef86cd3f5304dc8a96459d9483cd
MD5 b8d69fa2755c3ab1f12f8866a8e2a4f7
SHA1 8e3cdfb20e158c2906323ba0094a18c7dd2aaf2d
SHA512 5acac46068b331216978500f67a7fa5257bc5b05133fab6d88280b670ae4885ef2d5d1f531169b66bf1952e082f56b1ad2bc3901479b740f96c53ea405adda18
SSDEEP 24576:GCbRquA/m2z+L5WqJdrHCYRFiV+XenmE3Pnzc344:GCbRquA/m2yL5zbfFiV+XenmE3/z
TLSH
T156A55B0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.2MB
SHA256 7c7439d6b28d3c3dd9721e623582c10b07c044e9e51b5c81d234a67bed031462
MD5 a4fe1d6e7dbaf959ca7e46dad2d6f7d5
SHA1 51dae47cdeafeb01dfc83b5ff5d6eabb2d070691
SHA512 24f7cc03dea72acf7f6be9524133d83b09d5bdb2207091df130a5ba0f9345234681a899972cfd553e29c67b55658089b1301dbadd700cf58fddbba16837fd660
SSDEEP 24576:GCbRquA/m2z+L5WqJdrHCYRFiV+XenmE3Pnzc3Rzc344:GCbRquA/m2yL5zbfFiV+XenmE3/zUz
TLSH
T14CB55C0976B882E4D1F6C37886A2CA47F37178158B3197FF5665460E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 660KB
SHA256 ae2f4ea05caa487db83200dd38933895b4e12e1ec429c6122c6094149ac52fc7
MD5 934fa5415009862a8b17793e5597f728
SHA1 1dfa12c06ecb5eddd51fa0355715a3c133d80f74
SHA512 e4bf1320b0d639add3eaa432cb293158d1dadd61e746a1658984729797c0dda0366b9cccc087257310841f06bd95f48e64188c9652fdef3df6935b23af359666
SSDEEP 12288:MkVyYSaAZ/GLAIFoiwtA5qy97S9uaYFLq3Oq:tkPaAhGLAIFoiwtA5l7S53f
TLSH
T14AE42881EBF955D4F5B3AA7899B69171EA76BCA65E30C20F2160D11F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 338KB
SHA256 ca58f6a7bcb733b1bb172346bd52236ea21afdc248fd6f8de0b8c83772ff1d2b
MD5 36c67628181f5c10a46bb5b0b01bdc68
SHA1 98a41d676c32d3cd838aed821996ca80a680af37
SHA512 2b062525aa6b51ef796d81a67b2dc2e66c3f6251ea5dee37c03d18a0469e0ec3e2aacb921ea4b1d8ecdbafcc8f8ce82004117a3ca1b6a033ea92631c13d00c09
SSDEEP 6144:MknVuOGK9faimw5HEiIsCCINUGBZjgXwYz4WDZSFxgHiGfE:MkVyYSimw5HEjsChNVBFgl0WDm+Cp
TLSH
T151749E4677A41CF9E9A791388697C536F7B2B8022A25D71F0760C65B1F33361BE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 96KB
SHA256 18b510c72c99f49d25aab59bfc99529b5c48d9f8c57c5119d187818f17ce8edf
MD5 f5aeb920f15f4a6f0df6a16aec1588fc
SHA1 0938bdf86b0071f7d691b2bee03b943fc09defef
SHA512 f1052a385be49825977f95c0dcc0d7335b25b5bfda8191d49acc73bce2dd1363200fa95c6119361d3f1d89e0594e31d20efb61a6e9d3e9776c70fa6a7f1b311f
SSDEEP 3072:qkv57OsX2T3TH0XzZP1Pwe8UXDCsCy17EM9laRYq:557L2DTH0Z1Ie8YDfvat
TLSH
T14DA35C9A33E430F9E2A3523CD9F55A46E7727452277283CF126446AA1F23BC15E39732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 177KB
SHA256 72011d12a6c2135e686be92c31ed9b1c7fe509ac9d92a8d91dfdc7de4d974e92
MD5 08a994996b67751690ad5030fd08aa5b
SHA1 35f2ea6e46f12b225664b4511efded6143f355a8
SHA512 6fd25dd6133b75caadbccd3e7011403cf1ca535e10bc74ca568c2a6dd8072bdfdca9fe7f1323895e95d1d962339b163e4e21e187bf005dca666eb3e2b69d6372
SSDEEP 3072:TCiyiukvvVHC6++uq3eqW14k/EyK9fa4UXkv57OsX2T3TH0XzZP1Pwe8UXDCsCys:MknVuOGK9fa857L2DTH0Z1Ie8YDfvat
TLSH
T1F204CF5A33E430FAE2A35238D9F55A46E7727463673583CF066042AA1F23BD15E39732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 224KB
SHA256 6b9d88cabf6e36b2c0197b35298068d46e16eb8b6af9efcd25b01862e937d4b4
MD5 b2ce2ee1e45b20b890c1465bd8de7df5
SHA1 e369fd405716d3e17df30ee950fda75fc6cd7a71
SHA512 c4be20f6d29223715e05985fd901b04e63f124cbfe21ae3b5ddda6432d8c7907a5384688b76c519f76ac0275126c18b6e75f9f3518e29ae3ec7c5b2cd6814823
SSDEEP 3072:TCiyiukvvVHC6++uq3eqW14k/EyK9fa4UdvJ9psmeIBcV8pQFq4XKF3QP6:MknVuOGK9faD3psmeI+sQFqT3Qi
TLSH
T1E624591AD29802E8C06E6175C7568A41B3373C6297E1D3CB53D0F53E1F76690AEEAB13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
Size 137KB
SHA256 e6367a6428bd0aa37df5c510d4af674f75927b28fa55dc338d2c0c71b34963f4
MD5 77881c7d70ad95e5839c0070812a8937
SHA1 6fbd90c9abec47da825aa44de2e9850b83b84e23
SHA512 023edb27d2bd5c5d29957cd46ffbaf42af7cc62f3763307263056714ac1bfba1ad14748157f1e9a1468b070dc4e7421dda6db3e3e4312c9a5c80bdadecee51f0
SSDEEP 3072:TCiyiukvvVHC6++uq3eqW14k/EyK9fa4UR4WJgkt:MknVuOGK9faXJJ
TLSH
T1DBD3E10A67B600DAD06781B0C6E25B56F97DF553A75092CF0FA9C21A1F633C49E3AB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
Size 145KB
SHA256 551c7f6f4825ebe2ad4bfa46c10e8a54ee8d138543a5756daa2ca70973a20291
MD5 2370b94362a6955041bca807c4566325
SHA1 60b1a19fd1afdce76f9e3a9056c9ff09bfe77883
SHA512 2c483e97e47a2b4819fb7562e6d0d00e017e0259cf880f42dd603a13e1986f5be28dad44cdb2d5c2590a03607843fad03d296ce5e75cfbbcf220cfd45f175e51
SSDEEP 1536:zt/EyYd9IAZ44RoNk4kIvrUnkrauV8TxouBzzhE:p/EyK9fa4UTkIvQnkraVTxoQG
TLSH
T1ACE3AF4553A900EDE25F42B8C1A35A41F979F8134790E6EF0BA8C61A1F53BC0DE3DB96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
Size 145KB
SHA256 d03d966fb37f8b371da927fd13e733736295a584804d270a172b5fb808435604
MD5 a6155167a4d4c52ffacf2fbc80387787
SHA1 c8e18fa3c55ad3c725d56cd791de025b0525a3ab
SHA512 fae292763eb1f176e678b6d208af6d2aa6d5e6158c3e1e30a873f9576ef82e894425ba0980ab347ac97382810c92cad4fa59f1683a39f34195749eca8f15d57a
SSDEEP 3072:TCiyiukvvVHC6++uq3eqW14k/EyK9fa4UTkIvQnkraVTxoQG:MknVuOGK9faJk3nkraVT8
TLSH
T129E3E04513E600EAD25B4278D2A35A45F57AF42387A0E6EF0FE5C21A1F53BC0DE3AB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
Size 141KB
SHA256 4771301fbb3df42e1ab6ca6aa8b500bc3ba53eb07c33b722ef7bd5cce4ce0bb3
MD5 9afd243055f494e334374075afefc3bc
SHA1 9fc32315fc41ac34b49d054a830e73f04c9ddbfd
SHA512 7ee639c9a0a0cf8f926873f5e5163cdaa78b47adad8b7a5b45d4413818af46ca0370c20debefa5b765c67032505c2cbc6929cac947d681dc39072036c9547409
SSDEEP 3072:TCiyiukvvVHC6++uq3eqW14k/EyK9fa4UZpw5Z/KtbmmD22RQXSfj:MknVuOGK9faTpw5ySuJQX0
TLSH
T1B3E3E18623E200DEE16701B4C2A71647F979F8539BA0D6DF0BA5820D1F637D59E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-07-17_65eb181c128916045cabd5d3167be6ab_darkgate_elex_glassworm_hijackloader_mimic.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-07-17_65eb181c128916045cabd5d3167be6ab_darkgate_elex_glassworm_hijackloader_mimic.exe
Size 5.0MB
SHA256 ba717872b3cc65436488c6c0f7182d146b28662b36f608b7742553fa55929dd2
MD5 d0066b489a1f3cc26560d068669147e0
SHA1 77069d320a07da6caeca35181de147713371b6a6
SHA512 3bf39ce4c514e07c0dcc56461bb9e91095554a99dd1c92fa823f407096530b0b65f1dea99c892d5acfe36492954b76dd303fd6ada7d7371453cf758a966ba62c
SSDEEP 98304:CyNWcJpJzAWTIJFfpSZZ6/2/5X08FKTKK4KKDyK5FZ1EEEEmEEE1EEEEEEEEEEE0:tNjiiGFfpgciXZF3
TLSH
T17D368D107E41C176FBC202F59AFD7BFA466D9E20472C94DBC2983D594E701C32B366AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ruuee

Path C:\Users\Admin\AppData\Local\Temp\ruuee
Size 4KB
SHA256 9246c24b939c3aff800b14303e845d3f5b4757b07894e3b039fb2d5b1021e3c7
MD5 4f8b0cc1b83412f2299292f56e32910d
SHA1 f1315c9b1e2bc609d2d5f8349c7f73b6946a444b
SHA512 9578a0d16ade65b4425af88bd552266101fc9ab0bbf75281de2d6678f8cbb731cb8cf692bacd6f52727a7b975d43bce7de06e5268fe2465946f0c4830b10d3db
SSDEEP 96:2nnQTcTvcxPIBfxSQcy3Nk+0cl9/l8KnM:m0eMd
TLSH
T16D918E63630C2D36FC28A8F5ACA26362415CBF5107E4AC429A3DF42CA43EEC259F4438
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tvvdw

Path C:\Users\Admin\AppData\Local\Temp\tvvdw
Size 130KB
SHA256 5d6b0fefd20999430da9409e99bfce3168aa3f78078ea2977f2573758f93d01d
MD5 d86d4d97300c56942ce07468a79b0599
SHA1 18a94032baf0031e40afad0dcfa60898b4da91ca
SHA512 33bc075e5f91df5e2e4cf36292bb8a7ee0b8a5beb180dd02d029cd33c83cfee3b15b66160db77eb11e0666e88fc98749918d2208857a72ec5a4edee20a41fcc0
SSDEEP 3072:zCiyiukvvVHC6++uq3eqW14k/EyK9fq4nzrecrS2aozwL9:sknVuOGK9fqpcr0X9
TLSH
T1D6D3E142A7E44207F9FB0F30B6F586521A7CABD37D30C61F1985B49A1D637808A21B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wtbxv

Path C:\Users\Admin\AppData\Local\Temp\wtbxv
Size 630KB
SHA256 dec99a6b5feb7bb8f6a908cc6683ff30bba4a0562b518c74acb13e8bae5bfde4
MD5 76a669146d2a71053a09b81dee598e8b
SHA1 9b556dfac8073eb07eaade5e4888919f4010d650
SHA512 0ae1da1c543d17de1a6ce565b238f09d9562104f9ec94a16ac25f6b501ef53b12df29d0f88f940d4ad5ef53ab09ce824d415992a2e7602f7d57694f970a7981b
SSDEEP 12288:MkVyYSWXZNYVLeyUji0h90ZD0wxpGZIVuKrHs:tkPa0Le5ji0hmxNrM
TLSH
T1A1D41A16F6748335D073C0B9C5D2A69AE97130825B308ACB4286D77C7F67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svghost.exe

Path C:\Windows\svghost.exe
Size 81KB
SHA256 21fad7bdcb08823c874a8a9cf796c91691ecdf505282cdce79d8638fdf4fd2d1
MD5 ef3ba6bce00de0d4a3f0080c5cd32f72
SHA1 f9e806ef7b37d93a216c4d6f54f4186753c6deaa
SHA512 35cc4cb940161afd55d08b07b7364ae3ebf3b34562921f8626ad7591f7a1e7f5488ec6e7686d91e5f11a5b0c8e87829251bf7b3d1961ea8f55fd8846a95a8e6f
SSDEEP 1536:oA1V5CfA/L3WiukvSQc+HNAn6wPHX589HiF4V1dQh3geDmN6HSKm7Ct/EyYd9IAx:TCiyiukvvVHC6++uq3eqW14k/EyK9faO
TLSH
T14E83026B2743700AD6A251347B5F27E5917D09B3EFBC934E4F82509D1B8A3296D22F31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2944-15-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/2944-48-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/2944-47-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/5116-1-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/5116-2-0x0000000000427000-0x000000000043A000-memory.dmp

Download

memory/5116-9-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/5116-0-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/5836-22-0x00000000012A0000-0x00000000012A1000-memory.dmp

Download

memory/5836-61-0x00000000012A0000-0x00000000012A1000-memory.dmp

Download