a3b47a5c1549d6139f4899e00b5f0ed4a2a09443bed7ee9a784794f607283a28

Analysis

max time kernel
148s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 22:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_a3ea697a011319b486ab00de274845ba_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
Size 10.3MB
Sample260804-2fnhmssang
SHA256 a3b47a5c1549d6139f4899e00b5f0ed4a2a09443bed7ee9a784794f607283a28
MD5 a3ea697a011319b486ab00de274845ba
SHA1 585850024e7f341024d2c5958238813ae3941cd2
SHA512 32858bb4f487bf09b150a91a1ba8e7c650f6ece5722227e0fea234a83537b6281bb8b5ce47a69714e1d618b81e453e8f16dedf5483cbf95e509aed5c913a88e0
SSDEEP 196608:7QdzhjzEf6xi7teSDFNICjC0AXs5FXunSKIG:0NHEf6xi7ASDzICjCmLXmNIG
TLSH
T1A2B6AE22B345C036E9A011F1592FBB1A62687D39236084DBF6E19F6D21E56C38F35F1B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

adware defense_evasion discovery spyware trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-08-04_a3ea697a011319b486ab00de274845ba_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2056_1657669923\Sigma\Advertising	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2056_1657669923\Sigma\Fingerprinting	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2056_1657669923\Sigma\Social	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping844_1911179709\manifest.fingerprint	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2056_1695303208\manifest.fingerprint	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping844_348611496\hyph-hu.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping844_348611496\hyph-ka.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping844_348611496\hyph-mul-ethi.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping844_1911179709\crl-set	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping844_348611496\hyph-hy.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping844_348611496\hyph-la.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping844_348611496\hyph-or.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping844_348611496\hyph-sl.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping844_348611496\manifest.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping844_1820441686\manifest.fingerprint	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2056_1695303208\manifest.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping844_348611496\hyph-be.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping844_348611496\hyph-cs.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping844_348611496\hyph-el.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping844_348611496\hyph-gl.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping844_348611496\hyph-nb.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping844_348611496\hyph-ru.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2056_1657669923\Mu\Fingerprinting	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping844_1911179709\manifest.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2056_1695303208\crl-set	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping844_348611496\hyph-lv.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping844_348611496\hyph-mr.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping844_348611496\hyph-sk.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping844_348611496\hyph-ta.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping844_348611496\hyph-te.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2056_1657669923\Sigma\LICENSE	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping844_348611496\hyph-en-gb.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping844_348611496\hyph-tk.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2056_1657669923\Mu\Content	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2056_1657669923\Mu\Cryptomining	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping844_1820441686\manifest.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2056_1657669923\manifest.fingerprint	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping844_348611496\hyph-et.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping844_348611496\hyph-ml.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping844_348611496\hyph-uk.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2056_1657669923\Mu\Analytics	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2056_1657669923\Mu\CompatExceptions	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping844_348611496\hyph-es.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping844_348611496\hyph-hi.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping844_348611496\hyph-it.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2056_1657669923\Sigma\Analytics	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2056_1657669923\Sigma\Content	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping844_1820441686\protocols.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping844_348611496\hyph-as.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping844_348611496\hyph-pa.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2056_2081744493\manifest.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2056_2081744493\manifest.fingerprint	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping844_348611496\hyph-de-1901.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping844_348611496\hyph-eu.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping844_348611496\hyph-hr.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping844_348611496\hyph-sq.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping844_348611496\hyph-und-ethi.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2056_1657669923\Mu\TransparentAdvertisers	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2056_1657669923\manifest.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping844_348611496\hyph-cu.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping844_348611496\hyph-de-ch-1901.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping844_348611496\hyph-sv.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2056_2081744493\protocols.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping844_348611496\hyph-bg.hyb	msedgewebview2.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-04_a3ea697a011319b486ab00de274845ba_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	2026-08-04_a3ea697a011319b486ab00de274845ba_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	2026-08-04_a3ea697a011319b486ab00de274845ba_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	2026-08-04_a3ea697a011319b486ab00de274845ba_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe

Enumerates system info in registry 2 TTPs 10 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	2026-08-04_a3ea697a011319b486ab00de274845ba_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	2026-08-04_a3ea697a011319b486ab00de274845ba_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	2026-08-04_a3ea697a011319b486ab00de274845ba_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	2026-08-04_a3ea697a011319b486ab00de274845ba_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\2026-08-04_a3ea697a011319b486ab00de274845ba_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe = "11001"	2026-08-04_a3ea697a011319b486ab00de274845ba_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	2026-08-04_a3ea697a011319b486ab00de274845ba_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134303563095381085"	msedgewebview2.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe

Modifies system certificate store 2 TTPs 12 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Software\Microsoft\SystemCertificates\AdobeCertStore	2026-08-04_a3ea697a011319b486ab00de274845ba_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\SystemCertificates\AdobeCertStore\Certificates	2026-08-04_a3ea697a011319b486ab00de274845ba_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\SystemCertificates\AdobeCertStore\Certificates\BDBC98D38EBED76E25B49D0BF03063E0D58E3A50\Blob = 030000000100000014000000bdbc98d38ebed76e25b49d0bf03063e0d58e3a502000000001000000c2050000308205be308203a6a0030201020204093387c7300d06092a864886f70d01010d050030818d310b30090603550406130255533113301106035504080c0a43616c69666f726e69613111300f06035504070c0853616e204a6f736531163014060355040a0c0d41646f62652053797374656d7331193017060355040b0c10436c6f756420546563686e6f6c6f67793123302106035504030c1a41646f626520496e7465726d6564696174652043412031302d35301e170d3233303632383132333134325a170d3330303632373132333133395a308191310b30090603550406130255533113301106035504080c0a43616c69666f726e69613111300f06035504070c0853616e204a6f736531163014060355040a0c0d41646f62652053797374656d7331193017060355040b0c10436c6f756420546563686e6f6c6f67793127302506035504030c1e41646f626520436f6e74656e742043657274696669636174652031302d3830820222300d06092a864886f70d01010105000382020f003082020a0282020100dac5c201114e19865d7268347772d263b217cdaa505999820cf226e68a574c74f90b7a55b73c51ba202526755dbf226377dac31d37eaa54452b606c2af62d59ff6d8808d8c1b75f0b687ecc81df096de44b7480031804be412eb117e2d8354837c8da3cb36cc1c2c2058b4f5c613cb324055ba7d012037827095b1f4546d86216fc9e27a2907422b88d54127c44f86a0bc490cd4cd2a55429657523b876529c28a356c3755203c24ee6129ff9fcb29596c1220c286ada94009203c13716d961fd86a097de3a2d0049c4246160b6bbf78866bbe0efe8f59749af149d28260eefdbd8ab7016c4e0853e3958fc200c92180fec8da3aab1cf9c3105bdc5f01c82048c5f6885168391a2e8dc9658f4766b539bc6a05543149b95ed4e5bf5fb197cd555d164ee7dba0c1c7da663df1aa56f631566f9e1989a69b687a02618d245804c4d2b0c3234de64cf288d53e123d65c116c01477102f3db3b7ae9a051ff3c8d997984fdb9340aec4f3ff95cc748814d46bbdec35ae7368dbacc9d52505bbea2c2dbf0b8fc7a0cd5803276a1424f8597efd2b9d8aea589fb64563d8a3fc719b6c10e8b956e1f6738247c8c3727c7179536a591dce79c6c8e34a4ef57d881f24133616dd8142714c678afa34dbf197c5e4d784793c4dfe995f1f7c6f19527d095e820c499ae18fbf467b9f84bde0c9a2ead072b333b31b6039ca9d0262a340e03d990203010001a320301e300e0603551d0f0101ff040403020780300c0603551d130101ff04023000300d06092a864886f70d01010d05000382020100167ecb3641e5ed96dec91ad7d2864feb64e7a2dcea6a35fa2c2c2b2206c1ceeef3e40291f0ed7e40771d5fc7008a8309d8a5e0f14b5e6ddbc323c8b691778b6d4517d5677ea753a96609142673c1325c47832d1877a11f75c6a0ecca0a624dc6b0d86dfad77e08fda9f84e20af0e770bc10ec6bfde40ebe17d292e6f77b9a9a96857b71db1971c3da95ef0d6b41951469303bab3a8b49d7865371db1bcf6ddf1b5ae1723a084739c7498c5dd7866af590993a3af0ea8b7edd711059b21bbcea7f6c34146aad531cee7f2446b724f3408f9ba316cd9d98dcfb52d86a5d6c52e33929a38c92f88868538bd31bbb43a2552bc0b30ca957128fd245f080ae11cb36fb42282b07493b0ae9d164481f907fa8faf6b93ba171424ab0dde1641f366590ad59fe64c65b85f6840ee3a0a907aa692bd9999e2c4b472be51c60f3540ebab56a5d7d4a53f7f1ad993478ccd05e677c89fee25c4c98c7af469af976ce6e5acd92eef71676ccf87ab1663ebaf776842091df9ebceea1a5cffae61ad220fe64a7fd5901812f2e8a3442b5f1c25ab3777b895ead6d9c966a0174ce336977f13dd10469614338917a1b2e79a7eec1a0b9e570f2105359bd2ef8a6895a4e35667f4906eea6ac66968027d1b0a957a5feab2e72c7fb87a47931d2c90dece69639eff6d6ee789146beee1284e129a86df090fa1a6c298f6e3d1c102c858c87ce66d8799	2026-08-04_a3ea697a011319b486ab00de274845ba_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\SystemCertificates\AdobeCertStore\Certificates\E93BE4F41096282FBCB5F067829258F0ADF0E739	2026-08-04_a3ea697a011319b486ab00de274845ba_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\SystemCertificates\AdobeCertStore\Certificates\E93BE4F41096282FBCB5F067829258F0ADF0E739\Blob = 030000000100000014000000e93be4f41096282fbcb5f067829258f0adf0e7392000000001000000bb050000308205b73082039fa003020102020409536662300d06092a864886f70d01010d0500308185310b30090603550406130255533113301106035504080c0a43616c69666f726e69613111300f06035504070c0853616e204a6f736531163014060355040a0c0d41646f62652053797374656d7331193017060355040b0c10436c6f756420546563686e6f6c6f6779311b301906035504030c1241646f626520526f6f742043412031302d333020170d3138303831373139353131375a180f32303638303830343139353131375a30818d310b30090603550406130255533113301106035504080c0a43616c69666f726e69613111300f06035504070c0853616e204a6f736531163014060355040a0c0d41646f62652053797374656d7331193017060355040b0c10436c6f756420546563686e6f6c6f67793123302106035504030c1a41646f626520496e7465726d6564696174652043412031302d3530820222300d06092a864886f70d01010105000382020f003082020a0282020100b32e2f364ca82c0e31bbc1cf6cb8ae362626570fafbbb36fef8ac437a3d110f232509f462f27b7037c1b2937496f34cc789a3eac3382efae2914eb2bc268a52fee22f902ec680a59f128a98ee8c04a9f7ce21e480d8a25f9b05b6438eeb4f7197e5f9ced82a830f1ef004bdd2885c0afe7b2013491554270334670fd892ec987663d4c29f5738e9cbf056f4b98e7cdf73865c632ebbbab47df4115dc15d372dfe730aed7263479471ccf8f6de0080c215fc12018123ce7921d0fef44d822577a2ac2b5c3bc201a92ae354e717147977a35772da016d39bd2d291603768faa80963cd1c3f5b408d6c6fd9416c3b45e3ffbecbdf0ab27f97742cfd921e5f2209a569d6625e34c692e37e481c839011361d7a2ea0ba57e357d1a9bd867d31e041451592475e85d4ca6b927118e7a71f48a14eb81c3b09236375dd94c72e35d5bb4e1ea8707ce8c7518e5fa75b728e59dd11963aa4ac0fed595223df651c99cf9ba4e9840c440544c7264b1d305bd65068665a4d8806beef73694b57d3d5dc87e96768b49d0dc072618db0064f681a3cdd26f1b1b3abd782e8c9eaea26f95cc4fbf8dd329fa8b8e1bff3b2ba5ab77f2613b51a8a8556d056f7db0491d0d9a5d1b1a9876b47600b0e584d7498579fe2b4bd03044871bd255832f08a712b57e28887ff50a70e5f580d9c58012fc7471ecc373cbe3c7ed7be1f2e1bf7d340335cf132ad0203010001a3233021300e0603551d0f0101ff040403020204300f0603551d130101ff040530030101ff300d06092a864886f70d01010d05000382020100afe65b1ad925e025b642e557a890efc55a5e553fe1aaac2777dfa27089793ecf3e07b23ad8ebd05dc5c87e8eb5b16fa1b78fb5258aaffd401e3ffde6cb98dcf01dddb693f4af7db174770f0be7d6babb4fb5699e706b3b4f9210f33e4f1dca952de9e319d9305c9a4204d8997176e5139fcd0aec733ca43e84a9820b1457367c0fbe56cd946ba8fbe71317f7e375b12fb81c2fdb22a4854572ca12f0d5d50da544d66d70dd4d8d2742f0e35ce9553efda5d0f173a4004978887f3ccfdc1f17e7a4f6a4a6ae7b1fd8120d079705b0f1e5a398e9575bb70539cd8f84a23125539d1e975845c4482c7a6b9414733646ffc774a44558d8eadd6ab59fe1f39d938858596027c4e21380321ccd21905867bb6cf5dde01e41cb23b07f86338fb7acf1a979c5addf76b3c5fd0021a364b7be9d427c01ecf3aff73a070c76b338c12b850454b5278ca8d828b0a9879b5e465b7796b5ec5c63f18e601e487a45bbaf60d01fdf3fb4c9fe4430c23a29b5987990aafdf5491c33c51a20326c0e0eaff1b3368ba10f7ca62882518987ff3b028961204a76c1ff0e62357c44a76fc21d8b99cc35bf6bdfff3e09f87d8de0fe47db642218af6749de8d671c616fca8813b8fb18a5114768d37f9f2a8c7684b0efa6b737ab72e7ce920800c10f306483bb7914b6f21d866b7d777047bba9cfe542c9be80b33bddbe7581829753386ae75ea2eba2d4	2026-08-04_a3ea697a011319b486ab00de274845ba_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\SystemCertificates\AdobeCertStore\Certificates\94988E3B7A85FF611B05FADFA35F89E5F38D9F4C	2026-08-04_a3ea697a011319b486ab00de274845ba_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\SystemCertificates\AdobeCertStore\Certificates\0F7ABEE9D4141504024CA67E8358446E00F483E0	2026-08-04_a3ea697a011319b486ab00de274845ba_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\SystemCertificates\AdobeCertStore\Certificates\0F7ABEE9D4141504024CA67E8358446E00F483E0\Blob = 0300000001000000140000000f7abee9d4141504024ca67e8358446e00f483e02000000001000000bb050000308205b73082039fa003020102020462e4860a300d06092a864886f70d01010d0500308185310b30090603550406130255533113301106035504080c0a43616c69666f726e69613111300f06035504070c0853616e204a6f736531163014060355040a0c0d41646f62652053797374656d7331193017060355040b0c10436c6f756420546563686e6f6c6f6779311b301906035504030c1241646f626520526f6f742043412031302d333020170d3138303831373139353132325a180f32303638303830343139353132325a30818d310b30090603550406130255533113301106035504080c0a43616c69666f726e69613111300f06035504070c0853616e204a6f736531163014060355040a0c0d41646f62652053797374656d7331193017060355040b0c10436c6f756420546563686e6f6c6f67793123302106035504030c1a41646f626520496e7465726d6564696174652043412031302d3730820222300d06092a864886f70d01010105000382020f003082020a02820201008320f9e1c1272a6dd544f533e081bf622f7f2a5880e882a5aa429dfc95d50dd4f2d28382b1fdb439c725e54e16d7cac18093a329d3bb4627d6685303d9813acd3a7f843dfc68411b72c3aa949ff5d30859447919a4e7668bfba87f7e9386524b1509f7ae415b0ba6998bee4c9669162761a12fdb2636c84c3a82f809ce3c8841a96157d9f9177f9075155842eee6b6c255cc3b74f005b82687af3e8514a78ff884223a090c78ab1112253e4699d4241b22c091cab81ca389043d1deb8585b9613971012502af89f1894cec83795f45b8d3e8563eafbd310ed885fb2eda014b135466d393e261dee2e57374517449b260d86ebb476c6d5df5ead894e9805769c182dc874024df053d7f99705fa283b2ffad0e40640727beccea1d8bd560b734870bdb6dffc8df3781167c059f2da21b162b8fadd56cae4b763d827a1b268d2ba32664c137aa424ef8574572306140e4524e757e2f21b1acd3be1313a999933ffd2d1f29217ed3f14055c04258657bf5829abb09e205f5d9750a32586ae233e01a1279a25030397c1620437bd5c86a5c8185cb5ccdb1141783b7324b6e3e5a4ed440352a9c95df70c8dee7cc0612d64d3bc8a99a885e8728316b18087073e881d8dc28c4b7e2ec2400593ea9bd43e776da0025edb3874559acfa064e5aaf2e1c8b74a194f92c6176469b25e2ffed7798041844b045df4f27cda3d3dd4d4d9a6d290203010001a3233021300e0603551d0f0101ff040403020204300f0603551d130101ff040530030101ff300d06092a864886f70d01010d0500038202010015c9c0128693855a317c2dcbb83b34275efbc8023ef4bedd928bcf295f7264f2d4264187b50b3fd774ee05fe78b43a7363b2249b12fe89402218188ad876e3965aa1634f24165a7d9fc8431811f5b8a41e032f0e0f246246c899a21db24eaff958d33b6ab18d9e82250f1b5715b66ecfcf8144dd336316786ab4e21f07b5a4f1b455a7cf5d9f4b5084448a72290467066f4ac61c7b967bc78cd92a4f29772fb5ad7d3876f80b1bb55c392244787cca4fc5ab5bd095aaa3b6fe34fc35f0856c73e8db1e1e7de5f98ab6a6c404eeb8829cd2dd262a06b4031ab14fe4678c29949a778f8a8cab4235e4147beda43c9d7761408e5fad63cf21e4e15cd7e10f7470047a3ce41ca9ac74a17ede8289bce6c61821a8b7f171e09da0386db993db4ee52991e0899636242547863650f10a42d0738a130dd15559fa691f71f26e05eb42267f3c7054a94210c74c7700e953afe6598e181c8804aa324358dfc2f3adc4a3e08faa682379e2caff035a7eb5dd07e093febc0894fc5f82981e7ee1295a5b23b5e6ca4481c8f06bcf6398c1bc908186e88bb7f06739590c1500e162194b7a19a67517bb43d824b1f705f07b7b7897b565316e37bb8aa91a18a5bdebed799b8fe345c761c733283fe8fa44a0362bbb67889ebb35cee2802e78af891484cb6d98657320733c4ae1dcde1fdbaec2552efdb4946f3020abc4779efd88741f186f828d	2026-08-04_a3ea697a011319b486ab00de274845ba_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\SystemCertificates\AdobeCertStore\CRLs	2026-08-04_a3ea697a011319b486ab00de274845ba_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\SystemCertificates\AdobeCertStore\CTLs	2026-08-04_a3ea697a011319b486ab00de274845ba_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\SystemCertificates\AdobeCertStore\Certificates\BDBC98D38EBED76E25B49D0BF03063E0D58E3A50	2026-08-04_a3ea697a011319b486ab00de274845ba_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\SystemCertificates\AdobeCertStore\Certificates\94988E3B7A85FF611B05FADFA35F89E5F38D9F4C\Blob = 03000000010000001400000094988e3b7a85ff611b05fadfa35f89e5f38d9f4c2000000001000000c2050000308205be308203a6a00302010202047221c9ae300d06092a864886f70d01010d050030818d310b30090603550406130255533113301106035504080c0a43616c69666f726e69613111300f06035504070c0853616e204a6f736531163014060355040a0c0d41646f62652053797374656d7331193017060355040b0c10436c6f756420546563686e6f6c6f67793123302106035504030c1a41646f626520496e7465726d6564696174652043412031302d37301e170d3233303632323039313030375a170d3330303632313039313030355a308191310b30090603550406130255533113301106035504080c0a43616c69666f726e69613111300f06035504070c0853616e204a6f736531163014060355040a0c0d41646f62652053797374656d7331193017060355040b0c10436c6f756420546563686e6f6c6f67793127302506035504030c1e41646f626520436f6e74656e742043657274696669636174652031302d3730820222300d06092a864886f70d01010105000382020f003082020a0282020100c83400ca50e5549e336a85a98b03899e0e3a52a646f0e39e75e9f4904244cf50bd68066dc5273dc88419276de3afa530df669180387d695b03a92d1d8f163b595ef747376ded6b9005acfeaa9d15616e7b5ad7c878d6560f0b7fe731946f903cd5fc013bb69c4676cf6d0fc2688c2ebde34796a284b5693a6efb135b03b49853ddb718ec6f85a905c4994dd53555c0ae99a41c8e7ac582d2882ac5535fd0e20418e0c5e8e5e99550998663c4517cf1a04fbcecd75eb09aeef3d742020a230700defb5498e119edc0f0d838bb056feeee4a3bb26f57517bd8cfed047d4fe3a42ac48d6209afb3efb324f60601e85d1354a86e4f89508c0a585c1edc49a012097ef1e83cf7d434b0828f6544c6bfe0fc045f7d93e7896ff168de7b16a7c2ef5b6a5b4af94f9eb47d7cc6c00b729c3af911f204b841eec6b697bbb6b5015cb02eab81a191943c2a91f840db1f7c3cb52eaf12c731ad61552b451cb00305c0b70c12c644c52b4ff872636493421bc74a54150aa5f5439936a8fe5e8c70629b1d45bff99ae311d3ae6c585280d279de2b97fffc894df2e2dc41412b8e25a24207dcc6d7a951b53e945d00f39a544ef06af89d0cdcdf5bf658ab440cd9755c02b7a7ea54bc5ef5d0521af23f0f60c3a5385a5911575fa1b800f4ca75162f504f2141ddad1c1b993a5d6de964e8b03b3517ac9b712df9836c993bb6a961b225166989350203010001a320301e300e0603551d0f0101ff040403020780300c0603551d130101ff04023000300d06092a864886f70d01010d050003820201001875e36cd93bec2cb7780cfb5af7001447dbcacbdbb6ba0eb178cf51fbed3f813c9bca588b060747e29a00913b5bc4812f0fcb5975a0a9c808ce977ba90a0bab1de84f347235df40d1415d48ac7d6d84cf3b649e589e4b3baa069e32f4b1ac117031a0184f573419c6bc3aaa0f406fc19b8debd27b9e3a933c963ba641ecfc778049f57775fa306359f8baf4bee9f38af7b7e0081eab6452cc344a51ed86b2bcdd32f46316753ffcd7cd25ef81f0a5fb5df247ff07e23ea4e939d3deeba1f2bae6f51c44fb09e2b4a93e87f8f38f6197245eff98dccb59921f9dd25eddd1d21a9ba2da7ff9a2e52ec2fd273dc5f203c15d1dedc166835fb0685dcd31a338ccce6cb701ac45d499afe17e6ece9ab48427a971b3c079c71e69a5795dcfb9521f04eb352a95329d13f9f4a61cb656a18476e3ff98c90531f163b01e91cd0cabcebfbe814fb36010883dc6d4ad38c568834b8088cd7a480a4d7a5a25b2a4e11cd5228f379fba53bca5bef0193e6a4bd4aa60dc5834eee7c0a7ad261bda5e9e4944100a72df1a3cbffd09852f24c23fd70395e1f998785699639ba2a59a3a7c232bb7679b29f039463a08db8bea6d7572b047e3e71bd2a179526ad54e39c9b3ac37e87f745b36a8a5e6c93955aeb4409ff3f8feeb3b318e8751b19781c603c9a6cda8aa99a008983c6f2566056ab3fbaf733a26ef9ddf530d00937d9fe2bbdd0b5830	2026-08-04_a3ea697a011319b486ab00de274845ba_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
4800	2026-08-04_a3ea697a011319b486ab00de274845ba_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
4800	2026-08-04_a3ea697a011319b486ab00de274845ba_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
4800	2026-08-04_a3ea697a011319b486ab00de274845ba_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
4800	2026-08-04_a3ea697a011319b486ab00de274845ba_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
4800	2026-08-04_a3ea697a011319b486ab00de274845ba_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
4800	2026-08-04_a3ea697a011319b486ab00de274845ba_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
4800	2026-08-04_a3ea697a011319b486ab00de274845ba_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
4800	2026-08-04_a3ea697a011319b486ab00de274845ba_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
4800	2026-08-04_a3ea697a011319b486ab00de274845ba_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
4800	2026-08-04_a3ea697a011319b486ab00de274845ba_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
4800	2026-08-04_a3ea697a011319b486ab00de274845ba_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
4800	2026-08-04_a3ea697a011319b486ab00de274845ba_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
6064	msedgewebview2.exe
6064	msedgewebview2.exe
6056	msedgewebview2.exe
6056	msedgewebview2.exe
6056	msedgewebview2.exe
6056	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
844	msedgewebview2.exe
2056	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	4800	2026-08-04_a3ea697a011319b486ab00de274845ba_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
Token: SeIncreaseQuotaPrivilege	4800	2026-08-04_a3ea697a011319b486ab00de274845ba_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
Token: SeIncreaseQuotaPrivilege	4800	2026-08-04_a3ea697a011319b486ab00de274845ba_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
Token: SeIncreaseQuotaPrivilege	4800	2026-08-04_a3ea697a011319b486ab00de274845ba_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
Token: SeIncreaseQuotaPrivilege	4800	2026-08-04_a3ea697a011319b486ab00de274845ba_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
Token: SeIncreaseQuotaPrivilege	4800	2026-08-04_a3ea697a011319b486ab00de274845ba_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 4800 wrote to memory of 844	4800	2026-08-04_a3ea697a011319b486ab00de274845ba_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe	88
PID 4800 wrote to memory of 2056	4800	2026-08-04_a3ea697a011319b486ab00de274845ba_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe	89
PID 844 wrote to memory of 1044	844	msedgewebview2.exe	90
PID 2056 wrote to memory of 4484	2056	msedgewebview2.exe	91
PID 2056 wrote to memory of 4164	2056	msedgewebview2.exe	92
PID 2056 wrote to memory of 4164	2056	msedgewebview2.exe	92
PID 2056 wrote to memory of 4164	2056	msedgewebview2.exe	92
PID 844 wrote to memory of 4772	844	msedgewebview2.exe	93
PID 844 wrote to memory of 4772	844	msedgewebview2.exe	93
PID 844 wrote to memory of 4772	844	msedgewebview2.exe	93
PID 2056 wrote to memory of 1404	2056	msedgewebview2.exe	94
PID 844 wrote to memory of 1392	844	msedgewebview2.exe	95
PID 844 wrote to memory of 4048	844	msedgewebview2.exe	96
PID 844 wrote to memory of 4048	844	msedgewebview2.exe	96
PID 2056 wrote to memory of 3408	2056	msedgewebview2.exe	97
PID 2056 wrote to memory of 3408	2056	msedgewebview2.exe	97
PID 844 wrote to memory of 2212	844	msedgewebview2.exe	98
PID 844 wrote to memory of 2212	844	msedgewebview2.exe	98
PID 844 wrote to memory of 2212	844	msedgewebview2.exe	98
PID 2056 wrote to memory of 3324	2056	msedgewebview2.exe	99
PID 2056 wrote to memory of 3324	2056	msedgewebview2.exe	99
PID 2056 wrote to memory of 3324	2056	msedgewebview2.exe	99
PID 2056 wrote to memory of 1640	2056	msedgewebview2.exe	112
PID 2056 wrote to memory of 1640	2056	msedgewebview2.exe	112
PID 844 wrote to memory of 2320	844	msedgewebview2.exe	113
PID 844 wrote to memory of 2320	844	msedgewebview2.exe	113
PID 2056 wrote to memory of 5764	2056	msedgewebview2.exe	114
PID 2056 wrote to memory of 5764	2056	msedgewebview2.exe	114
PID 844 wrote to memory of 5848	844	msedgewebview2.exe	115
PID 844 wrote to memory of 5848	844	msedgewebview2.exe	115
PID 844 wrote to memory of 6056	844	msedgewebview2.exe	116
PID 2056 wrote to memory of 6064	2056	msedgewebview2.exe	117
PID 2056 wrote to memory of 2892	2056	msedgewebview2.exe	118
PID 2056 wrote to memory of 2892	2056	msedgewebview2.exe	118
PID 844 wrote to memory of 5244	844	msedgewebview2.exe	119
PID 844 wrote to memory of 5244	844	msedgewebview2.exe	119

C:\Users\Admin\AppData\Local\Temp\2026-08-04_a3ea697a011319b486ab00de274845ba_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_a3ea697a011319b486ab00de274845ba_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe"
1⤵
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4800
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=2026-08-04_a3ea697a011319b486ab00de274845ba_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe --webview-exe-version=2.14.0.66 --user-data-dir="C:\Users\Admin\AppData\Local\Adobe\webview2\2026-08-04_a3ea697a011319b486ab00de274845ba_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=1 --allow-file-access-from-files --mojo-named-platform-channel-pipe=4800.1656.9236435637309803511
  2⤵
  - Drops file in Program Files directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:844
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Adobe\webview2\2026-08-04_a3ea697a011319b486ab00de274845ba_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Adobe\webview2\2026-08-04_a3ea697a011319b486ab00de274845ba_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x15c,0x160,0x164,0x138,0x16c,0x7ffaeaeeb078,0x7ffaeaeeb084,0x7ffaeaeeb090
    3⤵
    PID:1044
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Adobe\webview2\2026-08-04_a3ea697a011319b486ab00de274845ba_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe\EBWebView" --webview-exe-name=2026-08-04_a3ea697a011319b486ab00de274845ba_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe --webview-exe-version=2.14.0.66 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1696,i,14967885698295065934,2530193838834957043,262144 --variations-seed-version --mojo-platform-channel-handle=1720 /prefetch:2
    3⤵
    PID:4772
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Adobe\webview2\2026-08-04_a3ea697a011319b486ab00de274845ba_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe\EBWebView" --webview-exe-name=2026-08-04_a3ea697a011319b486ab00de274845ba_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe --webview-exe-version=2.14.0.66 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=2032,i,14967885698295065934,2530193838834957043,262144 --variations-seed-version --mojo-platform-channel-handle=2040 /prefetch:3
    3⤵
    PID:1392
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Adobe\webview2\2026-08-04_a3ea697a011319b486ab00de274845ba_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe\EBWebView" --webview-exe-name=2026-08-04_a3ea697a011319b486ab00de274845ba_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe --webview-exe-version=2.14.0.66 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=2328,i,14967885698295065934,2530193838834957043,262144 --variations-seed-version --mojo-platform-channel-handle=2336 /prefetch:8
    3⤵
    PID:4048
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Adobe\webview2\2026-08-04_a3ea697a011319b486ab00de274845ba_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe\EBWebView" --webview-exe-name=2026-08-04_a3ea697a011319b486ab00de274845ba_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe --webview-exe-version=2.14.0.66 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3480,i,14967885698295065934,2530193838834957043,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
    3⤵
    PID:2212
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Adobe\webview2\2026-08-04_a3ea697a011319b486ab00de274845ba_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe\EBWebView" --webview-exe-name=2026-08-04_a3ea697a011319b486ab00de274845ba_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe --webview-exe-version=2.14.0.66 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=2180,i,14967885698295065934,2530193838834957043,262144 --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:8
    3⤵
    PID:2320
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Adobe\webview2\2026-08-04_a3ea697a011319b486ab00de274845ba_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe\EBWebView" --webview-exe-name=2026-08-04_a3ea697a011319b486ab00de274845ba_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe --webview-exe-version=2.14.0.66 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=756,i,14967885698295065934,2530193838834957043,262144 --variations-seed-version --mojo-platform-channel-handle=4604 /prefetch:8
    3⤵
    PID:5848
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Adobe\webview2\2026-08-04_a3ea697a011319b486ab00de274845ba_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe\EBWebView" --webview-exe-name=2026-08-04_a3ea697a011319b486ab00de274845ba_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe --webview-exe-version=2.14.0.66 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=4432,i,14967885698295065934,2530193838834957043,262144 --variations-seed-version --mojo-platform-channel-handle=4520 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:6056
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Adobe\webview2\2026-08-04_a3ea697a011319b486ab00de274845ba_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe\EBWebView" --webview-exe-name=2026-08-04_a3ea697a011319b486ab00de274845ba_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe --webview-exe-version=2.14.0.66 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=3808,i,14967885698295065934,2530193838834957043,262144 --variations-seed-version --mojo-platform-channel-handle=4464 /prefetch:8
    3⤵
    PID:5244
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=2026-08-04_a3ea697a011319b486ab00de274845ba_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe --webview-exe-version=2.14.0.66 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\{C71B0E76-CA28-4EEC-B91F-764EC5F53A78}\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=1 --allow-file-access-from-files --mojo-named-platform-channel-pipe=4800.1656.515176988672071994
  2⤵
  - Drops file in Program Files directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:2056
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\{C71B0E76-CA28-4EEC-B91F-764EC5F53A78}\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\{C71B0E76-CA28-4EEC-B91F-764EC5F53A78}\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x15c,0x160,0x164,0x138,0x174,0x7ffaeaeeb078,0x7ffaeaeeb084,0x7ffaeaeeb090
    3⤵
    PID:4484
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\{C71B0E76-CA28-4EEC-B91F-764EC5F53A78}\EBWebView" --webview-exe-name=2026-08-04_a3ea697a011319b486ab00de274845ba_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe --webview-exe-version=2.14.0.66 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1736,i,6028110028098031346,5018794983201021060,262144 --variations-seed-version --mojo-platform-channel-handle=1732 /prefetch:2
    3⤵
    PID:4164
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\{C71B0E76-CA28-4EEC-B91F-764EC5F53A78}\EBWebView" --webview-exe-name=2026-08-04_a3ea697a011319b486ab00de274845ba_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe --webview-exe-version=2.14.0.66 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=2032,i,6028110028098031346,5018794983201021060,262144 --variations-seed-version --mojo-platform-channel-handle=2044 /prefetch:3
    3⤵
    PID:1404
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\{C71B0E76-CA28-4EEC-B91F-764EC5F53A78}\EBWebView" --webview-exe-name=2026-08-04_a3ea697a011319b486ab00de274845ba_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe --webview-exe-version=2.14.0.66 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=2328,i,6028110028098031346,5018794983201021060,262144 --variations-seed-version --mojo-platform-channel-handle=2340 /prefetch:8
    3⤵
    PID:3408
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\{C71B0E76-CA28-4EEC-B91F-764EC5F53A78}\EBWebView" --webview-exe-name=2026-08-04_a3ea697a011319b486ab00de274845ba_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe --webview-exe-version=2.14.0.66 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3628,i,6028110028098031346,5018794983201021060,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:1
    3⤵
    PID:3324
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\{C71B0E76-CA28-4EEC-B91F-764EC5F53A78}\EBWebView" --webview-exe-name=2026-08-04_a3ea697a011319b486ab00de274845ba_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe --webview-exe-version=2.14.0.66 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=2176,i,6028110028098031346,5018794983201021060,262144 --variations-seed-version --mojo-platform-channel-handle=4596 /prefetch:8
    3⤵
    PID:1640
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\{C71B0E76-CA28-4EEC-B91F-764EC5F53A78}\EBWebView" --webview-exe-name=2026-08-04_a3ea697a011319b486ab00de274845ba_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe --webview-exe-version=2.14.0.66 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=4744,i,6028110028098031346,5018794983201021060,262144 --variations-seed-version --mojo-platform-channel-handle=4728 /prefetch:8
    3⤵
    PID:5764
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\{C71B0E76-CA28-4EEC-B91F-764EC5F53A78}\EBWebView" --webview-exe-name=2026-08-04_a3ea697a011319b486ab00de274845ba_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe --webview-exe-version=2.14.0.66 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=4608,i,6028110028098031346,5018794983201021060,262144 --variations-seed-version --mojo-platform-channel-handle=4164 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:6064
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\{C71B0E76-CA28-4EEC-B91F-764EC5F53A78}\EBWebView" --webview-exe-name=2026-08-04_a3ea697a011319b486ab00de274845ba_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe --webview-exe-version=2.14.0.66 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=4380,i,6028110028098031346,5018794983201021060,262144 --variations-seed-version --mojo-platform-channel-handle=924 /prefetch:8
    3⤵
    PID:2892

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Staging

Path C:\Program Files\chrome_Unpacker_BeginUnzipping2056_1657669923\Sigma\Staging
Size 36B
SHA256 411a706def2e70f96a507208bf80bceb93e950c4c2d671cd1ddb4134ce54b2a9
MD5 0163de1b14421d4eee3757ff76fd81e4
SHA1 96c75c4fe1e3f33a367f45293bd1bd8bff1c06f4
SHA512 80114d59db8f3654dd6821589e5ad03daa923a35610a372756a8865b3e769621e32ef2aed92c2494de2b9fc06d9796b12f1e3bb75873ed794e8c9ae8a0d5e965
MD5 SHA1 SHA512

Submit Download

manifest.fingerprint

Path C:\Program Files\chrome_Unpacker_BeginUnzipping2056_1657669923\manifest.fingerprint
Size 66B
SHA256 f96cf59ef5cdf10cdebb367e16c6736d188af934062a8721eb9d60539556a2a9
MD5 0f487a41f1bb9a49dfc5814815dc8b1e
SHA1 39e5af8034fab47bdfbaa2a66455c74185756f0a
SHA512 bbbd1619eead82c70cdc0f72867db2ffdd4a45cb908c81e852eec8c1293bcafb90c554bc3d51afab7fd7e478efc15aa9ad90fe1b56a01d0012ecee493184d36a
TLSH
T1B0A0024A47C1F51A80D137495D771D41C91755E1BEDF91481A929F2266379C0586C454
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping2056_1657669923\manifest.json
Size 132B
SHA256 68683970ce6d7de9a2043c34129106ae68af21a3b0a3c53cb59695640a7c1cbc
MD5 a4d9ab812da8b2906ff9d46f9ffc07c3
SHA1 48b428dc760bc008058e6df47a9f05f2f86b4abb
SHA512 5a2ba950ed85ee55bc1402d57d09ca8d54c0c2df5b43a402bb8bf3668920a40d584fa18d270376b046e23be00698bd1399ef6a0b695ee6c0b99fb454616b1cb6
TLSH
T1E8C09B115801797654DD77F00D29D7526672CB1D1494250546F5C218EC2DCDFB5B330B
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.fingerprint

Path C:\Program Files\chrome_Unpacker_BeginUnzipping2056_1695303208\manifest.fingerprint
Size 66B
SHA256 bc8d4367c67f869cbf134ee18cc34007003022251fd5d54980fae22d990f1563
MD5 c3d8ccd4813a33b2ad5ece6575c67046
SHA1 0630d245e905f65fbb619c087fa117559ca170b0
SHA512 4691eb27a8f859aae2a4bbe5727a927674cfda0f9970d7384f01761705097bd8629562d0cef462551b9ae5699074e0d5cdb68a3e82150b21f3063012c1eb4ea5
TLSH
T1CEA022C2F2A20022C8030382A38A00008008882CCEC32030002E0E3BC02F0020022A00
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.fingerprint

Path C:\Program Files\chrome_Unpacker_BeginUnzipping844_1820441686\manifest.fingerprint
Size 66B
SHA256 e84df839eb3dee2a10ba66de65c372c6e2bba0cbab46a39af041f4eeaab1ffe8
MD5 06d2b48de0edcb3e022ed639f0fb0085
SHA1 32f93d5a76998c407087269794026d1ea028828f
SHA512 3c883d4c342f95f28e4a76c73ce7151e8a76d6f5b2c86f90a9ee7f9976ae7e1be94c963489b326d2ff5f7c6423b29552d9aa09b65c17396c2f66ce271fe19506
TLSH
T1F3A022E32CE8880EACEC0AAB020A0AFA0ECC8000020280C80008080220028F0008CA8C
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping844_1820441686\manifest.json
Size 135B
SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
MD5 616eb6b585f16811dc5db5063e088cd7
SHA1 fc50aa7b747f9367d2b177eab7ab12cdafdeea85
SHA512 cdaf55640f0279c1cee06338912a07bc8bc8cb3780f70202363e25b327eb94a524c0acdd25cc2b22fbb1895d32af888857b17b3f0d7a2064f51ccdf1bab57f79
TLSH
T1BFC04C668D41DEAB00A647A56B295315E23B4B4B5044400A7AB5429C1A285964271844
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping844_1911179709\manifest.json
Size 113B
SHA256 98821f71a1973ac61b45967ce0c121eb598ac6e95abaa23c912d2f33e4237d8c
MD5 7ef3c71464d0fef472bc1d81fd363c62
SHA1 230e8ec0f849bf34d444c55ef548ba0c9c94d39b
SHA512 f74b96ec3b9569e360a02bfdd4fe237efad8ee2a5deaf46db891bcadd39dba22fd6d59a4e9aafe5511152625ce9f468519dadd53fc0c9b6c8826dc58cbe6cd7c
TLSH
T1C8B09262DC80D872693A93AC0E2246C4F228234B2558AA493630048C0A3A3F082A2321
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-as.hyb

Path C:\Program Files\chrome_Unpacker_BeginUnzipping844_348611496\hyph-as.hyb
Size 703B
SHA256 c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe
MD5 8961fdd3db036dd43002659a4e4a7365
SHA1 7b2fa321d50d5417e6c8d48145e86d15b7ff8321
SHA512 531ecec11d296a1ab3faeb2c7ac619da9d80c1054a2ccee8a5a0cd996346fea2a2fee159ac5a8d79b46a764a2aa8e542d6a79d86b3d7dda461e41b19c9bebe92
TLSH
T13001E1B0B7014F4BC635EDB0117A4A6D9664C43553BE051D84B1F9634F19714E70A8A8
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-hi.hyb

Path C:\Program Files\chrome_Unpacker_BeginUnzipping844_348611496\hyph-hi.hyb
Size 687B
SHA256 f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42
MD5 0807cf29fc4c5d7d87c1689eb2e0baaa
SHA1 d0914fb069469d47a36d339ca70164253fccf022
SHA512 5324fd47c94f5804bfa1aa6df952949915896a3fc77dccaed0eeffeafe995ce087faef035aecea6b4c864a16ad32de00055f55260af974f2c41afff14dce00f3
TLSH
T14801E178BE13888BC6784DB1054115AA0320F90EF296021B4262B13ACB18FD61C95484
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-nb.hyb

Path C:\Program Files\chrome_Unpacker_BeginUnzipping844_348611496\hyph-nb.hyb
Size 141KB
SHA256 c2771fbb1bfff7db5e267dc7a4505a9675c6b98cfe7a8f7ae5686d7a5a2b3dd0
MD5 677edd1a17d50f0bd11783f58725d0e7
SHA1 98fedc5862c78f3b03daed1ff9efbe5e31c205ee
SHA512 c368f6687fa8a2ef110fcb2b65df13f6a67feac7106014bd9ea9315f16e4d7f5cbc8b4a67ba2169c6909d49642d88ae2a0a9cd3f1eb889af326f29b379cfd3ff
SSDEEP 3072:pPTHXHEm69FrOP8d4hRLiinKL4Qshbv2fuOQXCxj+60EoM8WC5zgk:p73HEUP8dsiinTThjy90VKk
TLSH
T1CCE319F3A3394AC29420A8A4DF593B7E4044FA944D80E197B5EC2038E667CBC76D579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping844_348611496\manifest.json
Size 82B
SHA256 d571ef33b0e707571f10bb37b99a607d6f43afe33f53d15b4395b16ef3fda665
MD5 2617c38bed67a4190fc499142b6f2867
SHA1 a37f0251cd6be0a6983d9a04193b773f86d31da1
SHA512 b08053050692765f172142bad7afbcd038235275c923f3cd089d556251482b1081e53c4ad7367a1fb11ca927f2ad183dc63d31ccfbf85b0160cf76a31343a6d0
TLSH
T137A022A0BC0880333E8803A8023E83E3C3BE3E0A20003C0002A33C8022EC33B3038E2C
MD5 SHA1 SHA512 TLSH

Submit Download

protocols.json

Path C:\Users\Admin\AppData\Local\Adobe\webview2\2026-08-04_a3ea697a011319b486ab00de274845ba_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe\EBWebView\AutoLaunchProtocolsComponent\1.0.0.12\protocols.json
Size 3KB
SHA256 2edf732da5fd827859e7a1a5b69a4a622cfc416f60a6ae04154d5aad3a1bccec
MD5 5e2067a92dcfcb05537479c384a89725
SHA1 eeed29b07d865ac4d46629fddadad629d0ad4e2b
SHA512 c96c5f9cb7a169ad91b070b567cf9fa8f35951ccc5aa930e97dbeccbeac27f7e9dde1379138c9ba6b0d10339f9cb053ef21f19f06d7560f97d5d23a27c8ed4f6
TLSH
T17D7184B7862088194E360AB4AA0DF10DF93702DF2AF598D3B27D455F1F712BB3946249
MD5 SHA1 SHA512 TLSH

Submit Download

crl-set

Path C:\Users\Admin\AppData\Local\Adobe\webview2\2026-08-04_a3ea697a011319b486ab00de274845ba_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe\EBWebView\CertificateRevocation\6498.2025.9.4\crl-set
Size 22KB
SHA256 6ddcaf50aaff98b960d067054ce2ce17872ac0719d02abbb7fe56b9eabc818f2
MD5 d01869348d5a783f61f90cbb27b82a78
SHA1 d4eccc91435adaf01f8589cf7f3589cf65425de2
SHA512 7ad7f27d1f559d1f50f1f009518ccca5d6d01696cd70657ad94c9fe37db7bbe06e4afc13170bc5c065cf72d69a92c3df78f637b7faa2f968bb89aa154fe371da
SSDEEP 384:2t71+UygzeWhU6yVS2Ddc0fp/9yYoIJgWUeJuDzeG0LOsr2h9ltQYX9hVPz/HG1y:m4OBwVPDdFhVyYoPWUiuXeG0K5dQYXFr
TLSH
T1B8A2BE9FAF48F112E211523D94245F40DD24D54A23996AB74F943F30ADAE42AAF3CC7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Adobe\webview2\2026-08-04_a3ea697a011319b486ab00de274845ba_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 b01a6aad999a75d8d528f16a003ee52656177511e03e0eeffe4aefd528a45a5a
MD5 4d2fbffa34b6f246b8d6e68e81d8a671
SHA1 a6dfa9d2c9c3734928d3c5a9e3701db7535d721b
SHA512 d0c32eec0b2d345b6a07dc0082eacfdc99f3fc939823ead2def28dd4f08913c2f9defda29366b5643ee626e27a8629ded039abd6b4f1d20fc79ad6bc575b0427
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Adobe\webview2\2026-08-04_a3ea697a011319b486ab00de274845ba_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 4f7ac0358d85a78a802207b74329aa35c63cff0c6523f257565e1b7e894dd2a4
MD5 3c5f45f1c884c532e917f78647703663
SHA1 92503f37b32223e277959b62de70ecb7db7ae429
SHA512 8257505ddd40d7185e5b7355ef446021d9ef2fcf7905eca2092d975bbca5344c3cc2be7826008cef772f8e192f004457b27c677e1185d2fe7a331cb112572016
TLSH
T160D012273622413CC02025330843A2091500CD1F410641085428851D3E584900D06442
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Adobe\webview2\2026-08-04_a3ea697a011319b486ab00de274845ba_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe\EBWebView\Default\Extension Rules\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Adobe\webview2\2026-08-04_a3ea697a011319b486ab00de274845ba_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Adobe\webview2\2026-08-04_a3ea697a011319b486ab00de274845ba_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe\EBWebView\Default\Network\Network Persistent State
Size 236B
SHA256 478d0704de9dd4d0db7a5c5d8980665e0499690c8ac5a45a36cddd0cac04f385
MD5 3bdec28d1dcb4ed2e9d94407711cb950
SHA1 77345a20852258dd99a4c3ca9664dd5d2b872b4f
SHA512 09d9243eaf68c94bf3793ef9687dfc6aeeef40e3b0307d2874920e4fa00455729bf76b968f63e377c1f07a054430ccf3d536c8f95e215d3998398af4e41df66c
TLSH
T19CD0A77A46601DFE079583A05A2CA817CE7E9007021CFDBA85347B2A83761B8901458B
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Adobe\webview2\2026-08-04_a3ea697a011319b486ab00de274845ba_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe\EBWebView\Default\Preferences
Size 6KB
SHA256 711556fbbc76f95175ec591ea9ad96aa713d02667dda93bac99afc74f0bcd539
MD5 b0a37831292af5580e29d40a872672cf
SHA1 3e5316a4f320adcf2922e730179d529020fec5fd
SHA512 01337594f482a0a0c88e8d05392e7eb1f1cbdb18dc752f9a67e9f879022799c81c9c66285d3db93bd48731fb956e26a4e0a70a2871200321e04374dfea0f0694
SSDEEP 96:stEW05GBUMjb9wgl9Iff+Z8i0vhExkmDm/7qx+WVHMSm+uecaRQwbQjP+g4v1MOB:str0YF8fmZ8papy/S+Wi8RQwb241MC
TLSH
T1B9D1A9065F686DB78CC7F619BA35BB12E2FA202271D50E98ABFC861C05E65DC1307D0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe591db0.TMP

Path C:\Users\Admin\AppData\Local\Adobe\webview2\2026-08-04_a3ea697a011319b486ab00de274845ba_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe\EBWebView\Default\Preferences~RFe591db0.TMP
Size 6KB
SHA256 aabec4c600750a0ecb936b12212dc16a36bd31af75b73b9c4f5805b94efb03f0
MD5 e1ea5ad810239b052e196fbc2d30b813
SHA1 5a0a76eca8b5497e25b040b4e810a99469632dca
SHA512 1b059555c4f72e5bb0c804ecbdcd28db38db4031d671ec9bf344d84869648ece418af419f3ec02165ab777d371472ccf0549f5f8e2f5abbe8cdfef96d0240a26
SSDEEP 96:stEW05GBUMjb969Iff+Z8i0vhExkmDm/7qx+WVHMSm+uecaRQwbQjP+gS1MEB:str0YdfmZ8papy/S+Wi8RQwb2I1M8
TLSH
T18ED1A9065F6869778CC7E219BB35BB12D1FA206171D41E98EBFC851C09D65DC1307D0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Adobe\webview2\2026-08-04_a3ea697a011319b486ab00de274845ba_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe\EBWebView\Local State
Size 1KB
SHA256 cef7f809ecf31187553d90dbc6758491f1df676280cd09ac090e443636ea1096
MD5 ca88e533dce412a02c48b2ba5bf501f6
SHA1 4b254101a3e7ff01ed46f496b3f68ab0e91f877d
SHA512 128fa79153bd35da3c8292613e88b5335c64d29c2dee407f724c04f76fd62ab7b168823a17c33253357e3d849f572f0be64d5bb6aa40fb03cbf05c0f746b7174
TLSH
T17631A9B2ECA43FB6E9817246B1517F472E36302791104E58A6EF572C21F31CC862AC33
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Adobe\webview2\2026-08-04_a3ea697a011319b486ab00de274845ba_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe\EBWebView\Local State
Size 2KB
SHA256 5d6d0b283edc4698164dfa82d4d3cc9f495b0cd4949093acf6b8f20bf712f4e7
MD5 214e1e23a5cf3f30a0119638c8e6bdec
SHA1 af5488039a3277c1220f97455cfaf1fb84b0c1e2
SHA512 8a63cc9d840e5c17179e342a0e955619a626b670a5da805da6dd43d93fd3c1fb0d444e6ad46fb90931dbe41cff6094af615544d995c6a7f3a5e39dad6658ff27
TLSH
T12F51EB73BC187A77C9D36644F9453F13AD3A7052A6612F649AEE171C11E718C2346C37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Adobe\webview2\2026-08-04_a3ea697a011319b486ab00de274845ba_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe\EBWebView\Local State
Size 3KB
SHA256 412056fb31a37e731753740f784f26573a5af4b3e1f5dacbb9ba42ffefc959fd
MD5 3d6d14386b8fe6ca18ed74c3c9c617ec
SHA1 52cf6f2681dec473845ed3bb5973f4dc7153d736
SHA512 ac41df5ce2b57086356a0d804220e32e34d37b084d0a2fbc8b18ee14a1a9b3acb61d3d8c2176b1e1fdbaa637d94bee1dbba25452db1a5e82bd5625bd34620328
TLSH
T15D71B776AC68B9778DE2AA05F9853B02B6666123E5903FA8DAED1F1C01D73CC1342C13
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Adobe\webview2\2026-08-04_a3ea697a011319b486ab00de274845ba_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe\EBWebView\Local State
Size 16KB
SHA256 fb20ff23b26f33ea2a8fd3d608ad9c106166fb96fcee9c1e3cbcef1b1d773e73
MD5 15fc5bedb30c742ac25e7b53c27f7e8c
SHA1 659fc390c475f3e4fb806ebfd3164a0c955e415f
SHA512 6783fde3f1d9ef090a2c3993b44cc768624b927eaff995f2f40f0f9cb3a2a83e84303cc77789b23f641950e0da2845c265bb6d39e6e3f1a9d4fb76af3d9515bd
SSDEEP 384:z9+aQikB+z/xvxjg/qhEwNbgRGPEqAtk2U59zC:c/UxvxjgC+CYk2U5FC
TLSH
T1D0728E3B996C3E23A8F3F9057A5D1B4BDA79946251C12EB84EFE2F0916D73D80342C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe587ea1.TMP

Path C:\Users\Admin\AppData\Local\Adobe\webview2\2026-08-04_a3ea697a011319b486ab00de274845ba_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe\EBWebView\Local State~RFe587ea1.TMP
Size 1KB
SHA256 89394e6adf94ece4d41e9a053a9bc979144b318c8b2182c18d2421f0b0257369
MD5 095ab25e690a44fa71e38eeb3978d235
SHA1 7f13dbc4735fc64b1cb2d1d60a9b6bf6e418e2b5
SHA512 9888361e4fa21b44f68f96f22325a1c203d756e5e3ea44ab1de1f621d3324577d1a1e9ee8b4d74b369175370e88c549902cdf6a397a1fbc46ca3c7d357d50cbe
TLSH
T1AB216872DCA83EB5E5816545F1617B472D25606691104E1CD5DF132821F71CD877BC33
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 4766d6dad5612c615a784ec77560d1fc96adf1258bb7263101ba243052678109
MD5 571a7d8013a003c54a22116c85da9331
SHA1 7c282f31138700bdb36466fa5681784225067db0
SHA512 2528a422e22d95a757cb85ee7116764eb7c372894abc79dec29e9e3b5f129416de7b3834fcdfafa75bc69a7559f90519dd4179c48686027d09dbd2ec4ae0c2a4
TLSH
T13A410948B6E91148B3B77F4A9BF7946D587EB8772F46945D00110E4E0A27B45CCB2733
MD5 SHA1 SHA512 TLSH

Submit Download

CCDInstaller.js

Path C:\Users\Admin\AppData\Local\Temp\{C71B0E76-CA28-4EEC-B91F-764EC5F53A78}\CCDInstaller.js
Size 1.8MB
SHA256 b3cd90e4b56fa44d062d9b061f48f88cfb4372f64ed2f71da40e04aeb004bfda
MD5 02fd165c6436aa8bd7c66b6cdfaf0538
SHA1 f76364bc78aaa44ed404edabc3ec52d8357ad213
SHA512 972d85183ed0cc36904636a74c4351ff170f6346f80f2d8724d8141d285104ee5946e81c0fb9d855f399ff3d865f19c9494d72a27d481240106e9e966cbdcae0
SSDEEP 12288:ZiG9838Pp42Tino9x9LYzKzX58x5MX8kkWd634OpHdVFbDgxMNEk+DRUbA24hQLT:7TC6x9L5zX5wU8kkWA/bDgxDRV24y
TLSH
T1DB95F77F74A5A872AF8030D6009BB40FB7753539738084A89955CF9C92E6B8D4B0BE5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6c33d0fd-d439-4474-acad-fc4de2bf09d5.tmp

Path C:\Users\Admin\AppData\Local\Temp\{C71B0E76-CA28-4EEC-B91F-764EC5F53A78}\EBWebView\6c33d0fd-d439-4474-acad-fc4de2bf09d5.tmp
Size 16KB
SHA256 d33c7b744b79c35c4f3bbb69b28d4be13de12735cd4e1be7637e1b5f9102597f
MD5 bad08b645fa12cfc86976a63025955cf
SHA1 ed88eef1118c3b6304cc22da4f594a09e589d6be
SHA512 8dfe71e771c62035ac295e9e40e93ee8181ef1d0aef87da20e8df98959568e61896635e875b1f9b0acbefe50931651922d98bcf25ffb0bef57ed71b4af6597b4
SSDEEP 384:z0+aQikB+z/xvxjg/qhEwNblRKDsoqSs2Us9z9:f/UxvxjgC+Hfs2UsF9
TLSH
T1DA729E3B557D3E2398F3F9057A5D1B4BDAB9946250C16BB88EEE2F0916DB3D80342C12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\{C71B0E76-CA28-4EEC-B91F-764EC5F53A78}\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 3c0996a337af10c3eacdcbd59701f9d97c31ad798805f892681b80147f03e201
MD5 71bb9c59383ba7630f92cb10016d5e70
SHA1 2d203b3e8f5b96af8e8cffc812f2441c13ee8a09
SHA512 a2008e47d28259d87f5961506d0f341d851137d4dada5660c6cf371b0c5a019ffd0d4a7d0aaa5cf3327b7aa66ba882f86c50245a4142b8174968917622ead7ca
TLSH
T186D004757504C050F0445071453047070104444C114155004110144434C34453031D54
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\{C71B0E76-CA28-4EEC-B91F-764EC5F53A78}\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 7a0c244d2f485fae40897a0f71bd3ef6f826b4b42fdcdf3a54f2edf9abe7aa6a
MD5 bd19e32bef5bbd07633b159797e85ddd
SHA1 a4229d7f6e1f44c1cfe6116bb006ba448a1f569f
SHA512 141aeca080d5badaf37428e12e2b6ca9706247ccf42be1dd7065ab6e8a24feaf0229375d2f58c36b160639463915262d88a2d152ad7ff7c63a52dfac762f8db8
TLSH
T14FD0122736018174D01020730522660E0400C10F414580009428995D3A454942922C91
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Temp\{C71B0E76-CA28-4EEC-B91F-764EC5F53A78}\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\{C71B0E76-CA28-4EEC-B91F-764EC5F53A78}\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 720B
SHA256 7df5f7bacabeb82af02cab0acf49c04bf8c7538e5cba5b9c5b38933ae8b2ef0a
MD5 8c3ade31ee6a62d9fe4976d8ea753f65
SHA1 bcfa3831175617b9042bda439f52617840cdc3ac
SHA512 ea19c08aea744b4d044e53de2b4fe52d5722e285bb2b5309d02478d264c6e6963abec445e0c707757619d0663ade4bc6bce694423565932d6ac75d861e9db612
TLSH
T1F501E2920764F16BDB61E3719AC8D3713E715B3B0B833DD81B602978CA8738D0686A48
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58f613.TMP

Path C:\Users\Admin\AppData\Local\Temp\{C71B0E76-CA28-4EEC-B91F-764EC5F53A78}\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe58f613.TMP
Size 48B
SHA256 cdd0e7f6eeb70a0aeb433b56c94f88c72c8e888d57c82c686870824594d636a2
MD5 535ad9ec6c2f3deba83169ffcf7e5b7e
SHA1 575370bd597d1530f07916e43145bdc16da88956
SHA512 c08f5465363e67ec7408bf784123501b7ebbecff52137e102b0410201487c8e58111242284aeb5eb55797b557990cd026c86dcc6334b6bbc197f64819c8d8c59
MD5 SHA1 SHA512

Submit Download

ExtensionActivityComp

Path C:\Users\Admin\AppData\Local\Temp\{C71B0E76-CA28-4EEC-B91F-764EC5F53A78}\EBWebView\Default\ExtensionActivityComp
Size 4KB
SHA256 8c471cab38a1696289186d01b06ff6af2a888852dc18d6fb8d2a0e54898104ed
MD5 d25d5e1dc1d93430e64ee17e48ce442e
SHA1 d5c7ca9a57e6cc68927a249fe8e601d52680ac7a
SHA512 f4cff7510b4ad81090e0b1842652f8eb7995f7aefd0ce651151bc24ca3a4305d34ecae41cf193d9b846e8f6359ccf545e5d05e63e6e766fa9761ccebce620f6c
TLSH
T154819284F7C02420DA306EF7A5024BB85E62CA82A5124F93487002D0FCA78ECDC75AAA
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\{C71B0E76-CA28-4EEC-B91F-764EC5F53A78}\EBWebView\Default\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\{C71B0E76-CA28-4EEC-B91F-764EC5F53A78}\EBWebView\Default\GPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\{C71B0E76-CA28-4EEC-B91F-764EC5F53A78}\EBWebView\Default\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\{C71B0E76-CA28-4EEC-B91F-764EC5F53A78}\EBWebView\Default\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

7e299306-604c-478d-8c7c-4acdcd015ad9.tmp

Path C:\Users\Admin\AppData\Local\Temp\{C71B0E76-CA28-4EEC-B91F-764EC5F53A78}\EBWebView\Default\Network\7e299306-604c-478d-8c7c-4acdcd015ad9.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Temp\{C71B0E76-CA28-4EEC-B91F-764EC5F53A78}\EBWebView\Default\Network\Network Persistent State
Size 1KB
SHA256 b6dd330e84d923b241b04e1940b1f2690a959c9b77459a5c313580b28cc930a0
MD5 ce9e487ffdbd5944126ac63c486398bb
SHA1 632121c35919a9e21da6dc50eb28a4d7e0910405
SHA512 24609829ff6bea17696ba321cf92c1a37c605f9103a0e68c5b2512723ce1a05e12591af3d579c2d93a0e92beea80600d74def1ce51198e58b4eef608fb9fdaad
TLSH
T184316AF783F8052D8A5341F41B18ED1FCE5E0811832CF939C9D0AF9793E14B1E210A4A
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Temp\{C71B0E76-CA28-4EEC-B91F-764EC5F53A78}\EBWebView\Default\Network\Network Persistent State
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Temp\{C71B0E76-CA28-4EEC-B91F-764EC5F53A78}\EBWebView\Default\Network\TransportSecurity
Size 1KB
SHA256 402d6476ef30414d736c4611810ce920bb820c13ab2e0742c67e70c8728b3062
MD5 2854bcbdda050e1965f478a836fbc238
SHA1 493cfaa7373600bc410d824846f713cef97d7358
SHA512 489c21909fda664a9369aea56192e3f4a37857f67b2b315bb99df9943329b747831e46f4896c5fe733a8f596bc4532da48c503095835b0d799f39220f09b1327
TLSH
T12A319EA3DD7EB497702C686F0D84BC0A99BFF8395352A4F9EB67503CA0865B30B47016
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Temp\{C71B0E76-CA28-4EEC-B91F-764EC5F53A78}\EBWebView\Default\Network\TransportSecurity
Size 1KB
SHA256 6253ebba4043570673906deeb577dace176e82193d4e2e3d4799c1e72b1c5eff
MD5 cfd6f71241f9c3b8f9862aa0c989180a
SHA1 3550dd535f822ba13febb5829d205bb4a5891f24
SHA512 3716536c31c2bd8d6db4b172ec4d156e57afe137435c8f219e10082623586e3999b7e5bb28caa4dea13196214880e61e769ff007eae29adf6dabfbfa2755e9ff
TLSH
T114319EA3DD7EB497202CA86F0D84FC0599BBF835435294F9EB57613CB0875B30A87416
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity~RFe594358.TMP

Path C:\Users\Admin\AppData\Local\Temp\{C71B0E76-CA28-4EEC-B91F-764EC5F53A78}\EBWebView\Default\Network\TransportSecurity~RFe594358.TMP
Size 1KB
SHA256 5c6ad1a06ef26d8ca7040bfaa889d2b9fbe1ff09888c65bc92f7fdc0d268a61e
MD5 e49fdeb2603439799cff2a78512006e8
SHA1 66a7af5d840c998ce3469e8be0d7bf8bbbcf8f00
SHA512 5e0ceb29a92686e96ddc6f4d3cc229d3dcec551fba9dd57f4848e7b713d32c45c088ef6d4f4e93c794dc8f533d8a766de9f3c3f16842ef11029d8eb0fae3eff9
TLSH
T18B317FA3DD7EB497203CA86B0D84FC0699BBF835435294F9DB57917C704B5B30A47416
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Temp\{C71B0E76-CA28-4EEC-B91F-764EC5F53A78}\EBWebView\Default\Preferences
Size 6KB
SHA256 79c1b2c64172b85d5968c0eaa861a147da937b5ef42e0b03a44bd0e930da3c0e
MD5 eb8c94fc634a4d2b60363d0583530b09
SHA1 40454da138e952aab49ea200b58a4042bbb77337
SHA512 d8ca05a5c2ef1692ce1037c2fc8be4a4687cadeb22e17a8a0209e823e2d9be966a3123aad5d0271f7de96de4d1a8199bb740161a0deff68525a6956f57789387
SSDEEP 192:stx0YuJQf2Z8pabm/S+Wi/aOw8e7IFoRM8:styYYQ5X/VDw28
TLSH
T1E6E1B7479E6869774CC7E219BA35BB16D2FA302175D00E98EBFC852C18EB6DC5207C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Temp\{C71B0E76-CA28-4EEC-B91F-764EC5F53A78}\EBWebView\Default\Preferences
Size 6KB
SHA256 eef8df024f89d35f51f66c5aca78714508d22a292a8995e7fabf03fa8a682155
MD5 9d5a88ff30eae93eb637585f69beb580
SHA1 e13ce4dcb8112005ed1f10b289d7537529d1d61b
SHA512 6bdfd2829efb94db244e206296bae307f26fc36b67ac991b5204a1313f413810c54de41de7dd79f2989bb2f06a93f215a219c4fbfcca3e876eb1fa6a12a90709
SSDEEP 192:stx0YuNQf2Z8pabm/S+Wi/aOw8e7IFxRMC:styYYQ5X/VDwxC
TLSH
T130E1B9479E686DB74CC7E219BA25BB16E2FA302265D00E98EBFCC52C14E76CC5207C07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe58d2eb.TMP

Path C:\Users\Admin\AppData\Local\Temp\{C71B0E76-CA28-4EEC-B91F-764EC5F53A78}\EBWebView\Default\Preferences~RFe58d2eb.TMP
Size 6KB
SHA256 71d9451982505f6151872e6b641609d615bad1feab4934cf9ff280880abe7b54
MD5 62c3cf141eacf0c41c6c1330e286d171
SHA1 b48ad96e1b8a80103cafd8306d641dc3c0867d62
SHA512 5d8744f2e69d983ffa7255c26ee12bfa377b96f040a3c1859ab9257f5179a97eb6422a42f37196ac6b89a2f67286e767f16cb528123d3aefdc3280c4763399f0
SSDEEP 192:stx0YuJQf+Z8pFbm/S+Wi/aOw8e7IFoRM8:styYYQRY/VDw28
TLSH
T14CD1B7479E68697B4CC7E219BA25BB16D2FA202175D00E98EBFC852C08DB6CC5207C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\{C71B0E76-CA28-4EEC-B91F-764EC5F53A78}\EBWebView\Default\Shared Dictionary\cache\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\{C71B0E76-CA28-4EEC-B91F-764EC5F53A78}\EBWebView\Local State
Size 1KB
SHA256 3b1e8f2ebd8faa0f51aab3967e35b7d3fb10e48bb564af23a1fb9df6e9175f45
MD5 7cb06502a59d0376524941382c916a09
SHA1 b8882bde079dbf40b53dfbdd984c5c0c893b371d
SHA512 6dd5006558dfe7405fb4ce24259d884d9eb394ee02f691d061a88cf7221422c64c90cf4c201a8ba69557131e528f54a9de4011dee8093d2461ed193dc0a82eee
TLSH
T1F83195F7D4A82BB39C926546B2026B431D61202591508F54F1EF1A2C12E72DCC669C33
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\{C71B0E76-CA28-4EEC-B91F-764EC5F53A78}\EBWebView\Local State
Size 2KB
SHA256 e3345b3f61e14d1872861069bdd62c39d097a973770f8c64da247107dc1aa115
MD5 d101bf70c032842e23a7867c54f8a0b0
SHA1 b5a12be1b9f53b48a20b9422095078f49c5f94c9
SHA512 4c29c795a6580359d8f07e32b0ecec198f1f7b612a6045c2d6140079ac4621e2ce6e02bf777ae77f8108c56cf6dff17bd8fccad3c40976211a358d8cacf8142b
TLSH
T16251EBB3AC5C67B7CDE35944BE4A3F129976601166511F60E5DE1B1C01DB29C1345C37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\{C71B0E76-CA28-4EEC-B91F-764EC5F53A78}\EBWebView\Local State
Size 3KB
SHA256 bd3fc1b9da5075ade7ea368673b253ca8fdcbf9d9a4470d71b1a50127d7e9844
MD5 d0f08f9d9bea2a6bbece1df8bf6d3571
SHA1 a2a8a4379372df5a6e2d791d46aa332a4fd4f93d
SHA512 00331fab57b58c3bfd685330e0c18ac231936a156baa3aa9ba922eca3f7e06759e178e33a1a05e4f0c457fad74ffb4778a6ca9e1a06964c3445ac4c4869b39d0
TLSH
T18B71D876A968A5778DE3A901F9863F02B6A22123E5D03FA4D9ED1F1C01D73DC1341C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\{C71B0E76-CA28-4EEC-B91F-764EC5F53A78}\EBWebView\Local State
Size 4KB
SHA256 00cf8e41a4f9f6374f24ac6147c603f990cb0665c73656eab753558b832c02b0
MD5 2e36f4a7542daee9c964a88936453885
SHA1 03b4fba60a41cf4d916e37705af2a65e9ecc9e59
SHA512 f86c1b7dbd16771634ae9f925f47b23331d4b85f5d00b44c3d4922648f19f9ca27211fff39a06672618492750a7fabc4c71f60158cd8bf6a93507fdd4d359d0b
SSDEEP 96:zu4ebNkCEBfr/+C58Frh/cInURoDotoiihA0DidBsBZqU61GZJWtTBlFa:zlebNbK/+ZooDUDi/iDsBZqA40
TLSH
T18081D736A978AA678CF3E905B9463F0266A56023E5D07FA8D9ED1F1C01DB3CD1381C17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe587eb1.TMP

Path C:\Users\Admin\AppData\Local\Temp\{C71B0E76-CA28-4EEC-B91F-764EC5F53A78}\EBWebView\Local State~RFe587eb1.TMP
Size 1KB
SHA256 d63c24ca03640e1098d9572d2935f5ae1089d94ea7e85c4138c851d489a16a9b
MD5 0fa8dc69be124ca7baacb987d8a8c3db
SHA1 8db1828b571dcb775949fe94ebe0adf2b20d45bc
SHA512 9a450e7d677df7b43b4f9dbffad8760de28ff6e79816f26cfd28c941310663ddc59739d4cf070f592faf26cd604e2e0899cb506b1146d1b16ce59332e1f9fc27
TLSH
T1C32195F7C4D83AB3DC922856B2127B462DA1602551508B18F1EF262C22E75EDC66AC33
MD5 SHA1 SHA512 TLSH

Submit Download

Advertising

Path C:\Users\Admin\AppData\Local\Temp\{C71B0E76-CA28-4EEC-B91F-764EC5F53A78}\EBWebView\Trust Protection Lists\1.0.0.34\Mu\Advertising
Size 19KB
SHA256 5989ccf9a58e4ffd47c2422bd8dfcb3ea4e1d412fbdec2291385a9955af9eace
MD5 3495430eefd1e96e8bd95b67ccab0f91
SHA1 54129d2d72e062ad36a66922331818e81bd34df3
SHA512 9197537719b70837ce997cd2b168c6bf6fe877811f81459a0c0f1363b7179960594761df147c85034c628b8e9a3463084ac26fb8bcc3fbc765089adfeea56f6b
SSDEEP 384:/jA5024xyUE2oAklQth8rYWepdFhgX/0lRwjTV2qh8NmrbijF4E5C65aNbC:q0WCoAklQcrJepdFeP0lmjTV2qSV9C6P
TLSH
T162925151887035622F2F50CEE0583F8E1199767540AEE6DE9FE48666F28C0F37494EFA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analytics

Path C:\Users\Admin\AppData\Local\Temp\{C71B0E76-CA28-4EEC-B91F-764EC5F53A78}\EBWebView\Trust Protection Lists\1.0.0.34\Mu\Analytics
Size 4KB
SHA256 163a5318312b814104d244a4b37b676a02f827068820aa60fc069e6346cb2b75
MD5 db9a3dbc4820c8d84a0a569be1234dc0
SHA1 78fe9b49b800627cd2eb458cbe0251591a2a693a
SHA512 a6735713a801d28e644b31f34335e29d55a46d4b263e923cbec9b57fd18f8b0cecf9b78fab578065207080faa5e81156d04c8fbedb436b718893b6d17123742c
SSDEEP 96:2eHeEcb6eD0Hl1LJEmjwsi4RjBzGPeKkF7y5W4jNU/oyw:2/EcWeQ0d4OZkVkW4jNoo1
TLSH
T105817615A4A024423F2E5668E03C76F911E8253880F6F7D5EFB19975B30C0D778E497E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CompatExceptions

Path C:\Users\Admin\AppData\Local\Temp\{C71B0E76-CA28-4EEC-B91F-764EC5F53A78}\EBWebView\Trust Protection Lists\1.0.0.34\Mu\CompatExceptions
Size 689B
SHA256 5b462316a51c918d0bae95959bf827cb9c72bbd84ffb0e43b750aa91fbf3ba53
MD5 108de320dc5348d3b6af1f06a4374407
SHA1 90aa226d3c9d50cf4435ecdd2b8b0086d8edeb8b
SHA512 70f30c45e20b7cddd0cba6476af9338975cec8e40b8b19603af5fa859a34c6eb2138957daaa263633fe65213e2186402d05d9d29ad53e8f311335555116314c2
TLSH
T1E101E6F18EBD58313C74967C876C0E8FB9A5636F2898F2E96502CC87E3C054761A6C78
MD5 SHA1 SHA512 TLSH

Submit Download

Content

Path C:\Users\Admin\AppData\Local\Temp\{C71B0E76-CA28-4EEC-B91F-764EC5F53A78}\EBWebView\Trust Protection Lists\1.0.0.34\Mu\Content
Size 4KB
SHA256 7869993fcb93b302598643be96c6ab94c4f3be47c9fc344959773c754291376e
MD5 26c006f350f70dbc8c18098b773c3d4c
SHA1 eb015f7010dd74c874675d0599e634027363b7b4
SHA512 0f56d119a5f89689d0e45a6163133048aa95255447c4156d4fb2565f45c32dbb95adc39666a833d2127ce57f3f4198ce45d2a174955ec088bcdd2f74f59b3f6b
SSDEEP 96:lApOOxO7bthcySBm1yJJzyEsQBCETe+yH:+xqT6mcJJz4QBXTeBH
TLSH
T13F91B8037E4409276E95D005C0ED209E2DB5ABB0C85DDDC99B964B7FBBC8C8BA4961FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Cryptomining

Path C:\Users\Admin\AppData\Local\Temp\{C71B0E76-CA28-4EEC-B91F-764EC5F53A78}\EBWebView\Trust Protection Lists\1.0.0.34\Mu\Cryptomining
Size 668B
SHA256 1e92781e88ee786bf6d1d5cb71d467a92fe7f281f2d1e548524bf119d7ddc700
MD5 95aa820d67ec466eb3444a9458eb7e56
SHA1 f93e178ff40310e071e4d596f0aff0514666f787
SHA512 15281c334f013f0200ca2d6faaaec81dc5602058cf3522b805e21ca5f031cb4ca68606d353e6745bfb86f07fdd6ccc892942aee5ad7cf0f9f0798a4d7f497a47
TLSH
T1FE01D3D7D86197676FE25AD1D02E73C9F04456F26050F7C10F55315857A8A432794CE8
MD5 SHA1 SHA512 TLSH

Submit Download

Entities

Path C:\Users\Admin\AppData\Local\Temp\{C71B0E76-CA28-4EEC-B91F-764EC5F53A78}\EBWebView\Trust Protection Lists\1.0.0.34\Mu\Entities
Size 68KB
SHA256 f6e93c83d9e3cfdff064535647cee76fc85aa1c86fd22a93dcf3d2c377346d94
MD5 478a605d5578236f2d1ddc93c2f22456
SHA1 917f05453d497b3e3de684a905e141972c34a267
SHA512 26d75309976fac0bd03ffe7596209c50ead7518584dd9f27d12a86d80ecec0889bb58da1b8dc8cdb38fc6bfdca7928a54c5a15903c4b8d293633d4d58ec147b5
SSDEEP 1536:Wz20p1W8VMVLwecMFUh+oP9jt1PNEOjy+in:W2W1WUMzUT1jpw
TLSH
T152630877BC500D3384FB804BB09D2D6C21249FE5D8ABFED89BB1516612839C4B5D86FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Fingerprinting

Path C:\Users\Admin\AppData\Local\Temp\{C71B0E76-CA28-4EEC-B91F-764EC5F53A78}\EBWebView\Trust Protection Lists\1.0.0.34\Mu\Fingerprinting
Size 1KB
SHA256 c7d2b05ff6e790af78b0f1f341219fdb554dc5e14fbf3e3981819fccdd1ddfed
MD5 3d90e5235a4bee8f1dccfc2aecf7c585
SHA1 5beb333084b3af33e7fbd8c83326e18650a87f85
SHA512 c81af723cadaa57f638b9dbc60aca5d2600cebb8282d78a7b86edc6b473bd3a1768c8fde1b11d50b6b967b2866495655de09577973778038434bf4b513ba74a7
TLSH
T180214F8685D038316E6E148CD55C3B9C12EA3A7040E6F6DCCEF486A0B50489F7280CA7
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Local\Temp\{C71B0E76-CA28-4EEC-B91F-764EC5F53A78}\EBWebView\Trust Protection Lists\1.0.0.34\Mu\LICENSE
Size 34KB
SHA256 8ceb4b9ee5adedde47b31e975c1d90c73ad27b6b165a1dcd80c7c545eb65b903
MD5 d32239bcb673463ab874e80d47fae504
SHA1 8624bcdae55baeef00cd11d5dfcfa60f68710a02
SHA512 7633623b66b5e686bb94dd96a7cdb5a7e5ee00e87004fab416a5610d59c62badaf512a2e26e34e2455b7ed6b76690d2cd47464836d7d85d78b51d50f7e933d5c
SSDEEP 768:Mo1acy3LTB2VsrHG/OfvMmnBCtLmJ9A7D:Mhcycsrfrnoue
TLSH
T1B6F2735FB74413B2018206A26A9F68DEE319D07A73664095785DC15C27B3E3483BFBED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Other

Path C:\Users\Admin\AppData\Local\Temp\{C71B0E76-CA28-4EEC-B91F-764EC5F53A78}\EBWebView\Trust Protection Lists\1.0.0.34\Mu\Other
Size 34B
SHA256 2b4a47b82cbe70e34407c7df126a24007aff8b45d5716db384d27cc1f3b30707
MD5 cd0395742b85e2b669eaec1d5f15b65b
SHA1 43c81d1c62fc7ff94f9364639c9a46a0747d122e
SHA512 4df2ce734e2f7bc5f02bb7845ea801b57dcf649565dd94b1b71f578b453ba0a17c61ccee73e7cff8f23cdd6aa37e55be5cb15f4767ff88a9a06de3623604fbf0
MD5 SHA1 SHA512

Submit Download

Social

Path C:\Users\Admin\AppData\Local\Temp\{C71B0E76-CA28-4EEC-B91F-764EC5F53A78}\EBWebView\Trust Protection Lists\1.0.0.34\Mu\Social
Size 754B
SHA256 4955c3e7f56641a4ae0ce9c79b4ceee4b21733b0f6dedc980bf8d822a792eba2
MD5 1d06d58fe9131c14ba5ba5ff740b020f
SHA1 e6ed812e23e201b20170e928686a5d612165df85
SHA512 2854c73c6ef4d271d0e992113732ad65e406d6310711551952b4d451e2c577a2c3dcb06052e3ab30003b01619a39e87e5dd28d54f459f94efe879d1a79039b8f
TLSH
T14E0126DB1A1450027FAAC495E4458B6948B00630445DFDE582B8D27BA08EC97F39F7B9
MD5 SHA1 SHA512 TLSH

Submit Download

TransparentAdvertisers

Path C:\Users\Admin\AppData\Local\Temp\{C71B0E76-CA28-4EEC-B91F-764EC5F53A78}\EBWebView\Trust Protection Lists\1.0.0.34\Mu\TransparentAdvertisers
Size 105B
SHA256 d2cd0bef5f45daf490c53e705d6f67dfe12390c72a00efa6f5117432bd8edb8c
MD5 57d5a3548911886de2f3bd3172e808ed
SHA1 ca932af3b25f245ce931fbc6cf10299e5fbe35a7
SHA512 933194509d305b2a60b38c149ba1d74e142ef15647242b287844d263006d33ffa38b6ea263c89cb821a9277d41f0cfda95a0eda830f3a5ef8df5ba80d3bbc818
TLSH
T1FEB00170D480008ADF4062C1D032DD98E08D5377A138C4CAAAF80C66F2433CAD1A38F9
MD5 SHA1 SHA512 TLSH

Submit Download

Advertising

Path C:\Users\Admin\AppData\Local\Temp\{C71B0E76-CA28-4EEC-B91F-764EC5F53A78}\EBWebView\Trust Protection Lists\1.0.0.34\Sigma\Advertising
Size 20KB
SHA256 868f3ed3f86f1e82a5041f0a7b382bdd720e411531df2dc680da34eb60580b75
MD5 6959a6835772c67f4e72105e4be259a2
SHA1 72d1fe9070a5c0eed55d989cbd961dbc5442796c
SHA512 98085236a15e810642602e5dd475aa5a9532bb38917aef784e977bb398b3f9e39f7966370d39c1b554cf3e39858713e8b45bc27fbdb8a701b2a903e453a67591
SSDEEP 384:5z8Qpkm9jXUmEtMANAgFYNX8htrCoEeZCNyn9CbRqKi8iyZd0KE:1lb9TU/t9NAgFYNMhte1eZ0yn9is38iT
TLSH
T10292C261986035523EAF019DF1993FCD69A4633080E9FAE9CFA0C636B35D4D335948FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analytics

Path C:\Users\Admin\AppData\Local\Temp\{C71B0E76-CA28-4EEC-B91F-764EC5F53A78}\EBWebView\Trust Protection Lists\1.0.0.34\Sigma\Analytics
Size 3KB
SHA256 33d2b069ea874c12ec96242ca7eb539c1086d38ac6c2e4858c0efcd74fc632e5
MD5 e018dfa2df54c80ffbfd02c6d2ff5430
SHA1 de3f876b05355c6024d76f1bc24a552e532e2a2a
SHA512 b6d7886b4094837b271d1aa1f72b8c521970527552186604bcb83e17f85fa4a22e658628f79eca7d164ace781555abaa07c423a380fe87006aaed77f53e37838
TLSH
T16C61D918252024211F1B526AE55D3E8E69F4233904F8F7E08FF04EB5B10A4E738E5B77
MD5 SHA1 SHA512 TLSH

Submit Download

Content

Path C:\Users\Admin\AppData\Local\Temp\{C71B0E76-CA28-4EEC-B91F-764EC5F53A78}\EBWebView\Trust Protection Lists\1.0.0.34\Sigma\Content
Size 5KB
SHA256 d99df5936c57a50aebb7f0a3ca65fcc682f523ace93641fbcfb9b09cfb71c739
MD5 dee2a727844dd3cea088941e82722406
SHA1 24ebec9b92eeb6af83841ab02e858f415580f719
SHA512 e48edf5f6dcbbd615f42f1b3181b2998bd700508094466009a6a48193a48c3e30e6c4d71cc43aae81d18a88ad9fd7e28eb50a0a52ca6889a270001fecdb64dfb
SSDEEP 96:PwYuGYJywH2R7pBBYy+wf0yhZ7RBJ1ja8nBwGhQmxpFD1Lcg:Pnf03H2/KwfNL7vNTBR
TLSH
T152B154B2855079922F7D01D2F9D6225088E482715CBEEBC747A1C61CCD1EDE735A835B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Cryptomining

Path C:\Users\Admin\AppData\Local\Temp\{C71B0E76-CA28-4EEC-B91F-764EC5F53A78}\EBWebView\Trust Protection Lists\1.0.0.34\Sigma\Cryptomining
Size 32B
SHA256 696e930706b5d391eb8778f73b0627ffc2be7f6c9a3e7659170d9d37fc4a97b5
MD5 4ec1eda0e8a06238ff5bf88569964d59
SHA1 a2e78944fcac34d89385487ccbbfa4d8f078d612
SHA512 c9b1ed7b61f26d94d7f5eded2d42d40f3e4300eee2319fe28e04b25cdb6dd92daf67828bff453bf5fc8d7b6ceb58cab319fc0daac9b0050e27a89efe74d2734e
MD5 SHA1 SHA512

Submit Download

Entities

Path C:\Users\Admin\AppData\Local\Temp\{C71B0E76-CA28-4EEC-B91F-764EC5F53A78}\EBWebView\Trust Protection Lists\1.0.0.34\Sigma\Entities
Size 106KB
SHA256 0f305323c627cf0c790831c7e0bc38455b7a99983c4ab5bd9d2d9567766c3499
MD5 751e7cc660220e7464935a9b90643274
SHA1 05a725af45c74a9e129839b2fa7acca5d83066d8
SHA512 bc879a9bed224b6abdaed2581f948fcad53361b17dc76d5b5df10607ac893db2f39bc5ce5fbbe86e6392ae66f29fc93ac1079fd2d029b9338697b004325c4b36
SSDEEP 1536:PYNbfqJF3b6wgb6hh2Dgf+x8GC2kMYdSKySPxVMRjAxUR9Wv:Gbi3M6hjf+W2kMk26VMRjaUX4
TLSH
T131B3E73C9F70C4295EE7000B6C28B95846142BD59E87DDC4EEBF7A090272AF536A85F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Fingerprinting

Path C:\Users\Admin\AppData\Local\Temp\{C71B0E76-CA28-4EEC-B91F-764EC5F53A78}\EBWebView\Trust Protection Lists\1.0.0.34\Sigma\Fingerprinting
Size 2KB
SHA256 ec0fcbf71d58e707aaf6ba8d3c0719972f26727febe03f8efbf570b9635faddf
MD5 5330ccc991b45c6f2777d23c7d8afe8d
SHA1 d11187c035458fe1201608a91062962903de2e53
SHA512 2db42b7a6b7f2170f6cad2a26a606ff6357cb8c707ba9947baab14dd7f566df04a274e46e36cee72c43ee87ebf4d455b4af3f6da973f29bdbefeb0304f1d6f93
TLSH
T1A3414422581030617E7D49DCF59A3F0D29D9613A84C9F6D6DFE08936722E8E734A4896
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Local\Temp\{C71B0E76-CA28-4EEC-B91F-764EC5F53A78}\EBWebView\Trust Protection Lists\1.0.0.34\Sigma\LICENSE
Size 66B
SHA256 44071e0fcffb9a9a32e8fa7010bb18dbc41afd0b176f81bf700b15b638a88a51
MD5 5b7baf861a48c045d997992424b5877b
SHA1 2b2bd9a13afe49748abf39faf9eb29ed658f066e
SHA512 4820b41aa5ff4d934a583e1f0b93b1512631102bb2dfdb74792a2f0dcf9907da7680c02a5ddd2492a1e6d58cdada3453d9e38bb8deab6ce831ff36a7f8de016c
TLSH
T1A8A0025216021A6312E295EA5E589B4FA50A1AD5255C0341164904D898B01D995E87AE
MD5 SHA1 SHA512 TLSH

Submit Download

Other

Path C:\Users\Admin\AppData\Local\Temp\{C71B0E76-CA28-4EEC-B91F-764EC5F53A78}\EBWebView\Trust Protection Lists\1.0.0.34\Sigma\Other
Size 198B
SHA256 c9ab8dbc87043c71dd649fc06bb006e7f62e81c973c37b125afb88e654e436f8
MD5 7bb2f4076e4f47781b77d811b21ef1ff
SHA1 fc0feddf6f52841bbd780d21b8e0ddff74fd70ac
SHA512 28356614bc38576ecb37218f9f6f631bd9e55573206c3aa854b91956a33fc828c71f42c7dc7dc6aa86540dab8e345b8f88bf9c6eb56e49824f492854c193b27b
TLSH
T1B4D01250151A5B0D6FEA41D1DA8055241DA19DF474CFF8CC5555B032E68895729C0DD3
MD5 SHA1 SHA512 TLSH

Submit Download

Social

Path C:\Users\Admin\AppData\Local\Temp\{C71B0E76-CA28-4EEC-B91F-764EC5F53A78}\EBWebView\Trust Protection Lists\1.0.0.34\Sigma\Social
Size 3KB
SHA256 e520603e6fb543cd078b2a7dbd8ccfc175e9aecf71654fc19785927a014d3435
MD5 fbfc314bba2160b09a3376521c762772
SHA1 3566357486c5d466958334e813c90c0a97bfc985
SHA512 e4383491ce5170d0daf4abee61484c62611dfc604549b537d0080f24bfb8cf379ec3efbfb6caf10e7c066ec06457fb077832d5f780d226f0a957f624e0ba9383
TLSH
T17161DD36C590A9932E5D0C41EEC55E700DD8157ECCA6F4D287B082F8F0AD8977D94BAB
MD5 SHA1 SHA512 TLSH

Submit Download

index.css

Path C:\Users\Admin\AppData\Local\Temp\{C71B0E76-CA28-4EEC-B91F-764EC5F53A78}\index.css
Size 923KB
SHA256 cdd337f639e76f36fa41002b26e9a4f8c819d196747983283e25e3049fe5028e
MD5 e09f799bb69cecaf3987bc12cf65dd24
SHA1 ea57b540f246e00bd1e4bb7df3824bd8fa129a6c
SHA512 90a877a6024d996646055f496907276e4746cecab334b701f0d44d11b1d636984a049c74310606b7f0487549eb4b454318ba3b2e02ebc1121ff57970d885e1a4
SSDEEP 12288:oUxDxiaHbr3Gq5XRi5i6jE/5acgsu0wxT63kaSROcdOLeK+CnjG1VWzWhHuajOGh:oEBP3/5XSo/5F5K65SROcwLeKVYgzWIK
TLSH
T14D15CEE0D6A04D1D74378C3AA1CEA75E5514C28E55889FDBAE83ECF540CA696CF2270F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.html

Path C:\Users\Admin\AppData\Local\Temp\{C71B0E76-CA28-4EEC-B91F-764EC5F53A78}\index.html
Size 426B
SHA256 886c0ab69e6e9d9d5b5909451640ea587accfcdf11b8369cad8542d1626ac375
MD5 a28ab17b18ff254173dfeef03245efd0
SHA1 c6ce20924565644601d4e0dd0fba9dde8dea5c77
SHA512 9371a699921b028bd93c35f9f2896d9997b906c8aba90dd4279abba0ae1909a8808a43bf829584e552ccfe534b2c991a5a7e3e3de7618343f50b1c47cff269d6
TLSH
T1A9E0225B1D924C1C62701BB4D9E2F82DCA45B64AA743AE2074C5256B6FB2B88CCCB64D
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2212-246-0x00007FFB065C0000-0x00007FFB065C1000-memory.dmp

Download

memory/3408-198-0x00007FFB06820000-0x00007FFB06821000-memory.dmp

Download

memory/3408-199-0x00007FFB06C20000-0x00007FFB06C21000-memory.dmp

Download

memory/4164-64-0x00007FFB065C0000-0x00007FFB065C1000-memory.dmp

Download

memory/4164-480-0x000002245B1A0000-0x000002245B24D000-memory.dmp

Download

memory/4772-481-0x0000015A24A60000-0x0000015A24B0D000-memory.dmp

Download

memory/4800-0-0x0000000000210000-0x0000000000C7E000-memory.dmp

Download

memory/6056-931-0x000002D2C6DC0000-0x000002D2C6DC1000-memory.dmp

Download

memory/6056-932-0x000002D2C6DC0000-0x000002D2C6DC1000-memory.dmp

Download

memory/6056-930-0x000002D2C6DC0000-0x000002D2C6DC1000-memory.dmp

Download

memory/6056-928-0x000002D2C6DC0000-0x000002D2C6DC1000-memory.dmp

Download

memory/6056-929-0x000002D2C6DC0000-0x000002D2C6DC1000-memory.dmp

Download

memory/6056-933-0x000002D2C6DC0000-0x000002D2C6DC1000-memory.dmp

Download

memory/6056-934-0x000002D2C6DC0000-0x000002D2C6DC1000-memory.dmp

Download

memory/6064-922-0x0000018DC4F70000-0x0000018DC4F71000-memory.dmp

Download

memory/6064-923-0x0000018DC4F70000-0x0000018DC4F71000-memory.dmp

Download

memory/6064-924-0x0000018DC4F70000-0x0000018DC4F71000-memory.dmp

Download