271e55aed807c5c2d1e7e70bd968c49d7eb3ad62bcbb015398627ed7b0489455

Analysis

max time kernel
165s
max time network
168s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 08:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-02_8a572bd774b0acd454628c0d9d167e99_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
Size 13.7MB
Sample260802-j9e49aycph
SHA256 271e55aed807c5c2d1e7e70bd968c49d7eb3ad62bcbb015398627ed7b0489455
MD5 8a572bd774b0acd454628c0d9d167e99
SHA1 9bd9c337ecd3a4a21d731e6f0112ce8c2eceb0f8
SHA512 ba617b49adfad3e3d627e1f83e50b93ce4fcfc8173459d4f44374c92ccc7f45e5ab4a20ce7b7aec1cc16a97a75691495da19b1f88e64a29115b9608230d60bea
SSDEEP 196608:+XjUf3o6qtedfp2sV5NaIOO8Y7wO+wNTx9Pe20/aVHXiu6E:+XIf3o6qqfLVSICY7S+dCahXie
TLSH
T155E6D042EB826125EE1A39305D3EBE764724BDC94FF006CBA6E53C545A702C33936B5E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery spyware stealer trojan

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
61	3252	2026-08-02_8a572bd774b0acd454628c0d9d167e99_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-08-02_8a572bd774b0acd454628c0d9d167e99_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp\scoped_dir3252_1798553446\EBWebView\Crashpad\settings.dat	msedgewebview2.exe
File opened for modification	C:\Windows\SystemTemp\scoped_dir3252_1798553446\EBWebView\Default\GPUCache\data_2	msedgewebview2.exe
File opened for modification	C:\Windows\SystemTemp\scoped_dir3252_1798553446\EBWebView\Default\shared_proto_db\metadata\LOCK	msedgewebview2.exe
File opened for modification	C:\Windows\SystemTemp\scoped_dir3252_1798553446\EBWebView\Default\Cache\Cache_Data\data_3	msedgewebview2.exe
File opened for modification	C:\Windows\SystemTemp\scoped_dir3252_1798553446\EBWebView\Default\optimization_guide_model_metadata_store\LOCK	msedgewebview2.exe
File created	C:\Windows\SystemTemp\scoped_dir3252_1798553446\EBWebView\hyphen-data\120.0.6050.0\hyph-as.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\scoped_dir3252_1798553446\EBWebView\Default\Site Characteristics Database\MANIFEST-000001	msedgewebview2.exe
File opened for modification	C:\Windows\SystemTemp\scoped_dir3252_1798553446\EBWebView\Default\commerce_subscription_db\LOCK	msedgewebview2.exe
File opened for modification	C:\Windows\SystemTemp\scoped_dir3252_1798553446\EBWebView\Default\File System\000\t\Paths\CURRENT	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5192_193916094\hyph-ru.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\scoped_dir3252_1798553446\EBWebView\hyphen-data\120.0.6050.0\hyph-es.hyb	msedgewebview2.exe
File opened for modification	C:\Windows\SystemTemp\scoped_dir3252_1798553446\EBWebView\Default\shared_proto_db\metadata\MANIFEST-000001	msedgewebview2.exe
File opened for modification	C:\Windows\SystemTemp\scoped_dir3252_1798553446\EBWebView\Default\shared_proto_db\CURRENT	msedgewebview2.exe
File opened for modification	C:\Windows\SystemTemp\scoped_dir3252_1798553446\EBWebView\GrShaderCache\data_2	msedgewebview2.exe
File created	C:\Windows\SystemTemp\scoped_dir3252_1798553446\EBWebView\Default\0103304d-76a2-4a3e-9482-a43a80a63c89.tmp	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5192_193916094\hyph-gu.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5192_193916094\hyph-or.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\scoped_dir3252_1798553446\EBWebView\hyphen-data\120.0.6050.0\hyph-mn-cyrl.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\scoped_dir3252_1798553446\EBWebView\Default\Safe Browsing Network\NetworkDataMigrated	msedgewebview2.exe
File created	C:\Windows\SystemTemp\scoped_dir3252_1798553446\EBWebView\GraphiteDawnCache\data_1	msedgewebview2.exe
File created	C:\Windows\SystemTemp\scoped_dir3252_1798553446\EBWebView\Default\bd8b3cb0-e383-4f6d-8bec-3406fe7b55a5.tmp	msedgewebview2.exe
File created	C:\Windows\SystemTemp\scoped_dir3252_1798553446\EBWebView\Default\Network\07b83967-13a0-43b4-84c7-a81e65f1f15c.tmp	msedgewebview2.exe
File created	C:\Windows\SystemTemp\scoped_dir3252_1798553446\EBWebView\hyphen-data\120.0.6050.0\hyph-kn.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\scoped_dir3252_1798553446\EBWebView\TpcdMetadata\2025.2.12.1\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\scoped_dir3252_1798553446\EBWebView\Local State~RFe5bac88.TMP	msedgewebview2.exe
File created	C:\Windows\SystemTemp\scoped_dir3252_1798553446\EBWebView\ShaderCache\data_2	msedgewebview2.exe
File created	C:\Windows\SystemTemp\scoped_dir3252_1798553446\EBWebView\Default\Shared Dictionary\cache\index	msedgewebview2.exe
File created	C:\Windows\SystemTemp\scoped_dir3252_1798553446\EBWebView\Default\Code Cache\js\6bd082a0f51159d3_0	msedgewebview2.exe
File opened for modification	C:\Windows\SystemTemp\scoped_dir3252_1798553446\EBWebView\Default\ExtensionActivityEdge	msedgewebview2.exe
File opened for modification	C:\Windows\SystemTemp\scoped_dir3252_1798553446\EBWebView\Default\optimization_guide_hint_cache_store\LOCK	msedgewebview2.exe
File created	C:\Windows\SystemTemp\scoped_dir3252_1798553446\EBWebView\Default\Site Characteristics Database\000001.dbtmp	msedgewebview2.exe
File created	C:\Windows\SystemTemp\scoped_dir3252_1798553446\EBWebView\Default\Code Cache\wasm\index	msedgewebview2.exe
File created	C:\Windows\SystemTemp\scoped_dir3252_1798553446\EBWebView\Default\DawnCache\data_0	msedgewebview2.exe
File opened for modification	C:\Windows\SystemTemp\scoped_dir3252_1798553446\EBWebView\Default\Extension State\CURRENT	msedgewebview2.exe
File opened for modification	C:\Windows\SystemTemp\scoped_dir3252_1798553446\EBWebView\Default\0103304d-76a2-4a3e-9482-a43a80a63c89.tmp	msedgewebview2.exe
File created	C:\Windows\SystemTemp\scoped_dir3252_1798553446\EBWebView\Local State~RFe5af704.TMP	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5192_938714056\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\scoped_dir3252_1798553446\EBWebView\Default\Network\SCT Auditing Pending Reports~RFe5988ae.TMP	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5192_193916094\hyph-de-1996.hyb	msedgewebview2.exe
File opened for modification	C:\Windows\SystemTemp\scoped_dir3252_1798553446\EBWebView\Default\GPUCache\data_0	msedgewebview2.exe
File created	C:\Windows\SystemTemp\scoped_dir3252_1798553446\EBWebView\Default\Sync Data\LevelDB\000003.log	msedgewebview2.exe
File opened for modification	C:\Windows\SystemTemp\scoped_dir3252_1798553446\EBWebView\Default\Extension State\LOCK	msedgewebview2.exe
File created	C:\Windows\SystemTemp\scoped_dir3252_1798553446\EBWebView\GrShaderCache\data_1	msedgewebview2.exe
File opened for modification	C:\Windows\SystemTemp\scoped_dir3252_1798553446\EBWebView\GraphiteDawnCache	msedgewebview2.exe
File created	C:\Windows\SystemTemp\scoped_dir3252_1798553446\EBWebView\GraphiteDawnCache\data_3	msedgewebview2.exe
File opened for modification	C:\Windows\SystemTemp\scoped_dir3252_1798553446\EBWebView\Default\Network\Cookies-journal	msedgewebview2.exe
File opened for modification	C:\Windows\SystemTemp\scoped_dir3252_1798553446\EBWebView\Default\Session Storage\MANIFEST-000001	msedgewebview2.exe
File created	C:\Windows\SystemTemp\scoped_dir3252_1798553446\EBWebView\Default\Extension Rules\MANIFEST-000001	msedgewebview2.exe
File created	C:\Windows\SystemTemp\scoped_dir3252_1798553446\EBWebView\Default\DawnCache\data_1	msedgewebview2.exe
File created	C:\Windows\SystemTemp\scoped_dir3252_1798553446\EBWebView\Default\Cache\Cache_Data\data_1	msedgewebview2.exe
File created	C:\Windows\SystemTemp\scoped_dir3252_1798553446\EBWebView\Default\Code Cache\js\b686577edaa46c86_0	msedgewebview2.exe
File created	C:\Windows\SystemTemp\scoped_dir3252_1798553446\EBWebView\Default\optimization_guide_hint_cache_store\LOG	msedgewebview2.exe
File created	C:\Windows\SystemTemp\scoped_dir3252_1798553446\EBWebView\Default\Network\Network Persistent State~RFe5aa01a.TMP	msedgewebview2.exe
File created	C:\Windows\SystemTemp\scoped_dir3252_1798553446\EBWebView\BrowserMetrics-spare.pma.tmp	msedgewebview2.exe
File created	C:\Windows\SystemTemp\scoped_dir3252_1798553446\EBWebView\hyphen-data\120.0.6050.0\hyph-sl.hyb	msedgewebview2.exe
File opened for modification	C:\Windows\SystemTemp\scoped_dir3252_1798553446\EBWebView\Default\DawnCache	msedgewebview2.exe
File created	C:\Windows\SystemTemp\scoped_dir3252_1798553446\EBWebView\GraphiteDawnCache\data_0	msedgewebview2.exe
File opened for modification	C:\Windows\SystemTemp\scoped_dir3252_1798553446\EBWebView\Default\Local Storage\leveldb\LOCK	msedgewebview2.exe
File created	C:\Windows\SystemTemp\scoped_dir3252_1798553446\EBWebView\Default\Code Cache\js\c7bdbefb7bedb4b9_0	msedgewebview2.exe
File opened for modification	C:\Windows\SystemTemp\scoped_dir3252_1798553446\EBWebView\Default\File System\Origins\MANIFEST-000001	msedgewebview2.exe
File opened for modification	C:\Windows\SystemTemp\scoped_dir3252_1798553446\EBWebView\Default\File System\000\t\Paths\MANIFEST-000001	msedgewebview2.exe
File created	C:\Windows\SystemTemp\scoped_dir3252_1798553446\EBWebView\Default\d5b5242c-5771-4b3f-b905-66b15edee932.tmp	msedgewebview2.exe
File opened for modification	C:\Windows\SystemTemp\scoped_dir3252_1798553446\EBWebView\BrowserMetrics-spare.pma	msedgewebview2.exe
File opened for modification	C:\Windows\SystemTemp\scoped_dir3252_1798553446\EBWebView\Crashpad\settings.dat	msedgewebview2.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-02_8a572bd774b0acd454628c0d9d167e99_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2892	msedgewebview2.exe
2892	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
5192	msedgewebview2.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 3252 wrote to memory of 5192	3252	2026-08-02_8a572bd774b0acd454628c0d9d167e99_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe	89
PID 5192 wrote to memory of 880	5192	msedgewebview2.exe	90
PID 5192 wrote to memory of 572	5192	msedgewebview2.exe	91
PID 5192 wrote to memory of 572	5192	msedgewebview2.exe	91
PID 5192 wrote to memory of 572	5192	msedgewebview2.exe	91
PID 5192 wrote to memory of 572	5192	msedgewebview2.exe	91
PID 5192 wrote to memory of 4688	5192	msedgewebview2.exe	92
PID 5192 wrote to memory of 2460	5192	msedgewebview2.exe	93
PID 5192 wrote to memory of 2460	5192	msedgewebview2.exe	93
PID 5192 wrote to memory of 2460	5192	msedgewebview2.exe	93
PID 5192 wrote to memory of 3144	5192	msedgewebview2.exe	94
PID 5192 wrote to memory of 3144	5192	msedgewebview2.exe	94
PID 5192 wrote to memory of 3144	5192	msedgewebview2.exe	94
PID 5192 wrote to memory of 3144	5192	msedgewebview2.exe	94
PID 5192 wrote to memory of 3144	5192	msedgewebview2.exe	94
PID 5192 wrote to memory of 4912	5192	msedgewebview2.exe	98
PID 5192 wrote to memory of 4912	5192	msedgewebview2.exe	98
PID 5192 wrote to memory of 4912	5192	msedgewebview2.exe	98
PID 5192 wrote to memory of 2892	5192	msedgewebview2.exe	99
PID 5192 wrote to memory of 5556	5192	msedgewebview2.exe	100
PID 5192 wrote to memory of 5556	5192	msedgewebview2.exe	100
PID 5192 wrote to memory of 5556	5192	msedgewebview2.exe	100

C:\Users\Admin\AppData\Local\Temp\2026-08-02_8a572bd774b0acd454628c0d9d167e99_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-02_8a572bd774b0acd454628c0d9d167e99_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe"
1⤵
- Downloads MZ/PE file
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3252
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=2026-08-02_8a572bd774b0acd454628c0d9d167e99_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe --webview-exe-version=25.12.5.693 --user-data-dir="C:\Windows\SystemTemp\scoped_dir3252_1798553446\EBWebView" --noerrdialogs --edge-webview-custom-scheme --enable-features=MojoIpcz --lang=ru --accept-lang=ru --mojo-named-platform-channel-pipe=3252.5268.15383847742952111941 /pfhostedapp:4a86c576ad4e368e7fbd64c7f1ca9bc71df234fc
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:5192
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Windows\SystemTemp\scoped_dir3252_1798553446\EBWebView /prefetch:4 /pfhostedapp:4a86c576ad4e368e7fbd64c7f1ca9bc71df234fc --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\scoped_dir3252_1798553446\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ffcd6065fd8,0x7ffcd6065fe4,0x7ffcd6065ff0
    3⤵
    - Drops file in Windows directory
    PID:880
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Windows\SystemTemp\scoped_dir3252_1798553446\EBWebView" --webview-exe-name=2026-08-02_8a572bd774b0acd454628c0d9d167e99_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe --webview-exe-version=25.12.5.693 --embedded-browser-webview=1 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1792 --field-trial-handle=1796,i,4768989147137284566,11279861102906500166,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:2 /pfhostedapp:4a86c576ad4e368e7fbd64c7f1ca9bc71df234fc
    3⤵
    PID:572
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=ru --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Windows\SystemTemp\scoped_dir3252_1798553446\EBWebView" --webview-exe-name=2026-08-02_8a572bd774b0acd454628c0d9d167e99_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe --webview-exe-version=25.12.5.693 --embedded-browser-webview=1 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2300 --field-trial-handle=1796,i,4768989147137284566,11279861102906500166,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:3 /pfhostedapp:4a86c576ad4e368e7fbd64c7f1ca9bc71df234fc
    3⤵
    - Drops file in Windows directory
    PID:4688
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=ru --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Windows\SystemTemp\scoped_dir3252_1798553446\EBWebView" --webview-exe-name=2026-08-02_8a572bd774b0acd454628c0d9d167e99_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe --webview-exe-version=25.12.5.693 --embedded-browser-webview=1 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2404 --field-trial-handle=1796,i,4768989147137284566,11279861102906500166,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:4a86c576ad4e368e7fbd64c7f1ca9bc71df234fc
    3⤵
    PID:2460
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Windows\SystemTemp\scoped_dir3252_1798553446\EBWebView" --webview-exe-name=2026-08-02_8a572bd774b0acd454628c0d9d167e99_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe --webview-exe-version=25.12.5.693 --embedded-browser-webview=1 --edge-webview-custom-scheme --no-appcompat-clear --lang=ru --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3336 --field-trial-handle=1796,i,4768989147137284566,11279861102906500166,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:4a86c576ad4e368e7fbd64c7f1ca9bc71df234fc /prefetch:1
    3⤵
    PID:3144
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=ru --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Windows\SystemTemp\scoped_dir3252_1798553446\EBWebView" --webview-exe-name=2026-08-02_8a572bd774b0acd454628c0d9d167e99_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe --webview-exe-version=25.12.5.693 --embedded-browser-webview=1 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4636 --field-trial-handle=1796,i,4768989147137284566,11279861102906500166,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:4a86c576ad4e368e7fbd64c7f1ca9bc71df234fc
    3⤵
    PID:4912
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Windows\SystemTemp\scoped_dir3252_1798553446\EBWebView" --webview-exe-name=2026-08-02_8a572bd774b0acd454628c0d9d167e99_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe --webview-exe-version=25.12.5.693 --embedded-browser-webview=1 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4788 --field-trial-handle=1796,i,4768989147137284566,11279861102906500166,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:4a86c576ad4e368e7fbd64c7f1ca9bc71df234fc
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2892
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=ru --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Windows\SystemTemp\scoped_dir3252_1798553446\EBWebView" --webview-exe-name=2026-08-02_8a572bd774b0acd454628c0d9d167e99_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe --webview-exe-version=25.12.5.693 --embedded-browser-webview=1 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4732 --field-trial-handle=1796,i,4768989147137284566,11279861102906500166,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:4a86c576ad4e368e7fbd64c7f1ca9bc71df234fc
    3⤵
    PID:5556

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lite_installer.log

Path C:\Users\Admin\AppData\Local\Temp\lite_installer.log
Size 5KB
SHA256 e1b8f2e0a45d038712733a0e23cf2bb6be3000f2c11a55f91993e6a67fc1970d
MD5 c21820a4664fc29e46a897c70b3477a9
SHA1 3192742e0cdf88ec891b28ebc47d063fc822802c
SHA512 4ab1ac6207ace6afadb7108ca2cb048eddf0b85f0878ffb6235f49bf02672ec8cd429a4b068fc012ed123ae49bae28d0ffb041d71f45045e35ac6f74e18fa102
SSDEEP 96:Ke0WSPy4xorGegHXhxh0hHIHovHKzzCH8sHZKnHHtVMDH6UHwtVHQlHxGHAnH7BF:0Eq36EzMxLO4012VMa
TLSH
T103B1C21078FA5D6D1E17C1EC99EA3C5A8CEE361C757888D1BAC92448C9C2D017D3F99D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lite_installer.log

Path C:\Users\Admin\AppData\Local\Temp\lite_installer.log
Size 10KB
SHA256 e1349c98befc882b75a2623c0f808711eaccc7911e73767758a103566eb82874
MD5 ef88496c76cd69013db7127dc0256234
SHA1 cc4be304b00f5ce2d415ad13916ab5dbe332eca2
SHA512 249c4ca7b52d17aa8b95216e22821affe94bc646a54f9c56de9b8b82d3e2353e57e5736296c13fa38927cbe25a7010f33d002db22e48045e02e261705a7cbea5
SSDEEP 192:0Eq36EzMxLO4012VM/O5Bd8CMYNhHPITmB2:m36dLO40dO5BdJNhHPITmB2
TLSH
T15B228D1078FAA93C1E17D1ECD9AA3C9A4CED760C357888D1A9DE2558C8C2D017D3F99E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Users\Admin\AppData\Roaming\Yandex\ui
Size 38B
SHA256 0bd5d6fa6e554072d8fd7c3ac7bb074eb85f13bd5d915ba67807623702bee3cb
MD5 0dc45c3072d6f3fd307722ce7ad754b7
SHA1 bb969956a1fcb16005e882040011ff0e4ef526e2
SHA512 306e7537eb4ab23ec9c0e41aa890bdd2c8b0e03206ad69b9372b08e1d8bb55131ea437e5fc0c66b7a0f6bf7a314880f7dd9f81f5b3331ff2a32331af364267ac
MD5 SHA1 SHA512

Submit Download

hyph-bn.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5192_193916094\hyph-bn.hyb
Size 703B
SHA256 c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe
MD5 8961fdd3db036dd43002659a4e4a7365
SHA1 7b2fa321d50d5417e6c8d48145e86d15b7ff8321
SHA512 531ecec11d296a1ab3faeb2c7ac619da9d80c1054a2ccee8a5a0cd996346fea2a2fee159ac5a8d79b46a764a2aa8e542d6a79d86b3d7dda461e41b19c9bebe92
TLSH
T13001E1B0B7014F4BC635EDB0117A4A6D9664C43553BE051D84B1F9634F19714E70A8A8
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-mr.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5192_193916094\hyph-mr.hyb
Size 687B
SHA256 f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42
MD5 0807cf29fc4c5d7d87c1689eb2e0baaa
SHA1 d0914fb069469d47a36d339ca70164253fccf022
SHA512 5324fd47c94f5804bfa1aa6df952949915896a3fc77dccaed0eeffeafe995ce087faef035aecea6b4c864a16ad32de00055f55260af974f2c41afff14dce00f3
TLSH
T14801E178BE13888BC6784DB1054115AA0320F90EF296021B4262B13ACB18FD61C95484
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-nn.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5192_193916094\hyph-nn.hyb
Size 141KB
SHA256 5bcbb58eaf65f13f6d039244d942f37c127344e3a0a2e6c32d08236945132809
MD5 f2d8fe158d5361fc1d4b794a7255835a
SHA1 6c8744fa70651f629ed887cb76b6bc1bed304af9
SHA512 946f4e41be624458b5e842a6241d43cd40369b2e0abc2cacf67d892b5f3d8a863a0e37e8120e11375b0bacb4651eedb8d324271d9a0c37527d4d54dd4905afab
SSDEEP 3072:pPTHXHEm69FrOP8d4hRLiinKL4Qshbv2fuOQXCxj+60EoM8WC5zgY:p73HEUP8dsiinTThjy90VKY
TLSH
T1C1E319F3A3394AC29420A8A4DF593B7E4044FA944D80E197B5EC2038E667CBC76D579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Windows\SystemTemp\scoped_dir3252_1798553446\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 330e3dfbb8c025af420b8ec1be3b6bd64b4274d774ad38a76d5e778cb1994381
MD5 1ad8675078557c1d954c19f792cf560d
SHA1 05510e37c0bcf5b6bc0a50891ca0e6a85f5a631a
SHA512 9891ba4fa14877bbf9b9978d76a02db5c5c94a013060d462c0932da82b3ee9ba2e6aa6a0e323e7cbb062f23fa21df6d69bb1fb23a415ae8b2325fd52884c713f
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Windows\SystemTemp\scoped_dir3252_1798553446\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 541858b4cc781e6fca269761494280ea6f69f102a574cc5dde598040f7ec2d83
MD5 0a21a1f55777e080df0437399e07a92e
SHA1 70370a6c4b249c7c766f7bdf798c87859f8e024f
SHA512 b49f1d27ef6b44ac3a41da10527a246c94bf03f1a94e26426ff30758f186192ce79816ceebf31d9abe1586f1ab35e4ea81dda94fafd69df7052c55ef3e395752
TLSH
T16AD0121232510534C42020F30412660C1601C24FC00940427C38D55E1E440A80902481
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Windows\SystemTemp\scoped_dir3252_1798553446\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

2ef4ed5c-ec4f-4cd0-8fee-f49dc2ea44c1.tmp

Path C:\Windows\SystemTemp\scoped_dir3252_1798553446\EBWebView\Default\2ef4ed5c-ec4f-4cd0-8fee-f49dc2ea44c1.tmp
Size 6KB
SHA256 602ff01ee32221676cebe32b1d2abd112e710a8d3cc8a1646175f06fabb30620
MD5 8c1330d81d2f86b00e11c78fa97ed16d
SHA1 5a11da7760f600cb85bb0c3ccb953ccdfa3a8eb3
SHA512 3372471631f034f574b88a8f031515533c7f12f1d02c76bb72c377e74c905e888579d06ed274e2c36d85a18598179c66ef9f4b82dd51b3f9a0e44d0efdc41972
SSDEEP 96:stgXdxjPrb9kkoDxx5h16Z/DVs7/x+6Mhmuecv6f1ejeZK+gK28XMQFC7K:stcHyvDxx0DVsV+F76fQjnwGRK
TLSH
T114D1B4125E2869BB4CC7F159FA25BA0BE2F9607260D11E5CEBF8851C08DA6DC7317C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Windows\SystemTemp\scoped_dir3252_1798553446\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 456B
SHA256 2d711f4d7f19571bb4a03c16a98cfeab3ed939a81acbed13b54edf228064ec77
MD5 f7cf4276040b4a9d231260aa331fb6be
SHA1 2c4545c585812b868fe085bd01b6f690b735c3d3
SHA512 306493aa800a6ee735ec56bc2ce98a0e31a1ac7c934bcd1abf27f3be6531929079eaafa8bd32e095f1076ce62e2793553c86f526fcdf2bf20374979e9d05a77d
TLSH
T1D8F0C2841CDB8200FF448731B0C6EFA5AF621E8409B15B93C14B0421E4AF3C0E12C32C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59df98.TMP

Path C:\Windows\SystemTemp\scoped_dir3252_1798553446\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe59df98.TMP
Size 48B
SHA256 1ff74dd3b32aff73a84ecc74bb47dfaeb548231063bfaa9370764bc1e13de7a0
MD5 8666cff2c61f7f545f29613349d87740
SHA1 97c8f3a797a8cfa1577ba2578bab6fd5c0afc3b9
SHA512 3eb1922d09221bf34341f932dfa4bee4a556ebd0bf5e1802f01d6060364220345af6d48b9517b031678c371fb0dec9682d83818466bfb47eadd6af459a40e261
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Windows\SystemTemp\scoped_dir3252_1798553446\EBWebView\Default\Network\Network Persistent State
Size 600B
SHA256 45fa96e3fca1d0a91067468b031c8b5ecb143948f26deb19903f744a2d59f0e0
MD5 a3d0aaffa1524d06d0f35750a4f472c8
SHA1 6ecc9a2f565920a41a8caf5976406f09f193d4ac
SHA512 7c2a4e238c83fc25b61b01ea68b9fde1f45e73bd124f877f0213f028093d6c9740279f3d65200b72963cf8723d675fb9cf6d365ce3e720676bd1c96aefb6e410
TLSH
T1D2F0ACF343B07ABD4B6A92F85B14AC2B8FD80031D32C5675C9853F1253E2166E614B1B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5aa01a.TMP

Path C:\Windows\SystemTemp\scoped_dir3252_1798553446\EBWebView\Default\Network\Network Persistent State~RFe5aa01a.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Windows\SystemTemp\scoped_dir3252_1798553446\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Windows\SystemTemp\scoped_dir3252_1798553446\EBWebView\Default\Network\TransportSecurity
Size 859B
SHA256 aa262a3bffe5e4a0b3044b2788fb4ceb617b96172cffbb167017c7740757df38
MD5 e4ab3d60737f0be5ca181c83bed08f6b
SHA1 c6b9a959b2dbea8e2bd15677bfbe63a6f5d32807
SHA512 5e435814ecd63f1462d4a932d862aabb27140455456f6c7c6760822bb9f051ae6514743f47650c22dc6139406cad446ab59fd837b982a83e9e3670532a1a5a57
TLSH
T107116FA3D9BFB0375028596F2945F9066E75B83A4202A4F8DBE6853CA1880E79673411
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity~RFe59eecb.TMP

Path C:\Windows\SystemTemp\scoped_dir3252_1798553446\EBWebView\Default\Network\TransportSecurity~RFe59eecb.TMP
Size 859B
SHA256 458d32803fc96e7fbcfa2e59f966fd511d4bb61d7caf402bc5499d16fa4b5af4
MD5 2a4b48dc73c7a8818093224a2be145ea
SHA1 1918fef8aaeff220deecc017008391196bebc8ad
SHA512 44520e178c5ce5659ecde3fba5272767054eebd9936846397d1b74db627ffb290d18539b38803c57b895cb99b3d5aa8d4463a7b9dc44a9bd3a4049706b5075b7
TLSH
T102116FA3D8AFB0376028496F1945F9066E75B83E4102A4F8DBD7853CB1880E79673411
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Windows\SystemTemp\scoped_dir3252_1798553446\EBWebView\Default\Preferences
Size 6KB
SHA256 0d501e6e62d53c04d3c3f10961ef6dad5123bdacfe653ff552ff9fe72b7cc404
MD5 be6eb6bb494b698ca7d72cf76fc0741f
SHA1 2cc906e48d69e71a88a0ddd366f582a56a2f4a00
SHA512 64fabffa1a47d6acfb99fa6dbed158ac04fa38443f32bd29f46fd919d51677ca9ee1e5c7358cf553c7e14782221f880a3148300a6d468dfdc3d6a9ce0985aa6b
SSDEEP 96:stgXdxCGPrb9kkoDxx5h16Z/DVs7/x+6Mhmuecv6f1ejeZK+gR28XMQFC7K:stcpyvDxx0DVsV+F76fQjnLGRK
TLSH
T155D1B5025A2869BB4CC7F119FA25BA1BE2F9607260D01E5CEBF8451C08DAADC631780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Windows\SystemTemp\scoped_dir3252_1798553446\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Windows\SystemTemp\scoped_dir3252_1798553446\EBWebView\Default\Sync Data\LevelDB\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Windows\SystemTemp\scoped_dir3252_1798553446\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Windows\SystemTemp\scoped_dir3252_1798553446\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Windows\SystemTemp\scoped_dir3252_1798553446\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Windows\SystemTemp\scoped_dir3252_1798553446\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Windows\SystemTemp\scoped_dir3252_1798553446\EBWebView\Local State
Size 15KB
SHA256 652897b5c164a6c187fb48d2b41de163e50e304da71c76a90d694e0cd93a25fb
MD5 9a8e821ab98f4511878a6d065c293dfd
SHA1 71683e8fb6cc2c1c58d8d9bfecb0edb8e4fb5906
SHA512 30957de4a1a23449f008fd2dba2cef8dee8b9721b1440e47c0468662320961e37619ee28e2257b7dc2d94f222530b9d283907ba7242f1a1fc95b0f319f20dee1
SSDEEP 384:m+aQikB+z/xvxjg/qhEwNBS91r5x54AVdpzL9zo:x/UxvxjgC+jl/4U3Fo
TLSH
T1B772AF2B58397E23A9F3FA05794D1B8FDBB894B254C16EB84EBD5F0906C72D41342C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Windows\SystemTemp\scoped_dir3252_1798553446\EBWebView\Local State
Size 2KB
SHA256 783455c3dcba60d82f98aa9cf4571d322973292051e174dc7820050f1c9dc333
MD5 f4fc5e58fb65e8940410a425506ad52b
SHA1 99a712e1906a2165dcc31b1ee9f2e54aab9fb4b4
SHA512 ea4fffce04d6c469eb4fef14b0b716f90816b7a21ba9b6e7bd640bd987d3d880d401b6994619364415624d33b70fc34a60a525b01171b8e172d043c4e64d0c53
TLSH
T1545175337814AB37CEA35A08790A3F67DE365096AA921F649AED0B1C00D619C3341C37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Windows\SystemTemp\scoped_dir3252_1798553446\EBWebView\Local State
Size 3KB
SHA256 e2336261463e2cc81ac37bcea9e33bbdd5ae70e71f27470ea80435664fd27abb
MD5 cb267d211cf6e1b587bf5482580d7c42
SHA1 b9a82a7fcef7d427c825d15c5cbcc7364bff7f8d
SHA512 5768406aa80fa5fc08658eb86df3626e74fa7fd1c08c7a3caff7fd3406a8db6db1d8a4109ad3ce2a64d37a5945650fb380741beed62672f0a87052d908e5f098
TLSH
T1876177376874AA378EE39A04B8463F16AB655067E9D13FA8DAFC0F1C01D72982341C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe598330.TMP

Path C:\Windows\SystemTemp\scoped_dir3252_1798553446\EBWebView\Local State~RFe598330.TMP
Size 1KB
SHA256 8e6910acfeaac8a7296970ea1f4c5f28e35d3f3b5511c78bd65caf1cadcc75e9
MD5 7889a18eb388eee7c009b9de3053ae54
SHA1 f43f058340106f1bf0dcb299acbf94d3c17e2127
SHA512 f6e6cb8d0c29081dc8c2ae07d86b3c88829b7819f7f0f457cf10f8678db8ae581fd0dc275c55629dd30de9367e113f37943ce04ccf1d02a03df619d959ab7c41
TLSH
T1E7218773E4245B32FE93324A31177EAB9E3110AB96D14F1465ED4B1C01E60DDB656837
MD5 SHA1 SHA512 TLSH

Submit Download

memory/572-206-0x00007FFCF69A0000-0x00007FFCF69A1000-memory.dmp

Download

memory/2892-769-0x000001C7044B0000-0x000001C7044B1000-memory.dmp

Download

memory/2892-767-0x000001C7044B0000-0x000001C7044B1000-memory.dmp

Download

memory/2892-773-0x000001C7044B0000-0x000001C7044B1000-memory.dmp

Download

memory/2892-778-0x000001C7044B0000-0x000001C7044B1000-memory.dmp

Download

memory/2892-777-0x000001C7044B0000-0x000001C7044B1000-memory.dmp

Download

memory/2892-776-0x000001C7044B0000-0x000001C7044B1000-memory.dmp

Download

memory/2892-775-0x000001C7044B0000-0x000001C7044B1000-memory.dmp

Download

memory/2892-774-0x000001C7044B0000-0x000001C7044B1000-memory.dmp

Download

memory/3144-205-0x00007FFCF69A0000-0x00007FFCF69A1000-memory.dmp

Download

memory/4912-591-0x00007FFCF5FA0000-0x00007FFCF5FA1000-memory.dmp

Download

memory/4912-592-0x00007FFCF6C70000-0x00007FFCF6C71000-memory.dmp

Download