a3b47a5c1549d6139f4899e00b5f0ed4a2a09443bed7ee9a784794f607283a28

Analysis

max time kernel
150s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 22:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_a3ea697a011319b486ab00de274845ba_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
Size 10.3MB
Sample260804-2fnhmssang
SHA256 a3b47a5c1549d6139f4899e00b5f0ed4a2a09443bed7ee9a784794f607283a28
MD5 a3ea697a011319b486ab00de274845ba
SHA1 585850024e7f341024d2c5958238813ae3941cd2
SHA512 32858bb4f487bf09b150a91a1ba8e7c650f6ece5722227e0fea234a83537b6281bb8b5ce47a69714e1d618b81e453e8f16dedf5483cbf95e509aed5c913a88e0
SSDEEP 196608:7QdzhjzEf6xi7teSDFNICjC0AXs5FXunSKIG:0NHEf6xi7ASDzICjCmLXmNIG
TLSH
T1A2B6AE22B345C036E9A011F1592FBB1A62687D39236084DBF6E19F6D21E56C38F35F1B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

adware defense_evasion discovery spyware trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-08-04_a3ea697a011319b486ab00de274845ba_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 14 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping916_1358622959\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping916_1358622959\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping916_622535501\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping916_622535501\protocols.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping916_622535501\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping916_1621855106\LICENSE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping916_1621855106\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping916_1621855106\_platform_specific\win_x64\widevinecdm.dll	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping916_1621855106\_platform_specific\win_x64\widevinecdm.dll.sig	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping916_1621855106\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping916_1621855106\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping916_1358622959\crs.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping916_1358622959\ct_config.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping916_1358622959\kp_pinslist.pb	msedgewebview2.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-04_a3ea697a011319b486ab00de274845ba_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	2026-08-04_a3ea697a011319b486ab00de274845ba_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	2026-08-04_a3ea697a011319b486ab00de274845ba_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	2026-08-04_a3ea697a011319b486ab00de274845ba_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe

Enumerates system info in registry 2 TTPs 10 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	2026-08-04_a3ea697a011319b486ab00de274845ba_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	2026-08-04_a3ea697a011319b486ab00de274845ba_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	2026-08-04_a3ea697a011319b486ab00de274845ba_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	2026-08-04_a3ea697a011319b486ab00de274845ba_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	2026-08-04_a3ea697a011319b486ab00de274845ba_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\2026-08-04_a3ea697a011319b486ab00de274845ba_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe = "11001"	2026-08-04_a3ea697a011319b486ab00de274845ba_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe

Modifies data under HKEY_USERS 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe

Modifies system certificate store 2 TTPs 12 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\SystemCertificates\AdobeCertStore\Certificates\94988E3B7A85FF611B05FADFA35F89E5F38D9F4C\Blob = 03000000010000001400000094988e3b7a85ff611b05fadfa35f89e5f38d9f4c2000000001000000c2050000308205be308203a6a00302010202047221c9ae300d06092a864886f70d01010d050030818d310b30090603550406130255533113301106035504080c0a43616c69666f726e69613111300f06035504070c0853616e204a6f736531163014060355040a0c0d41646f62652053797374656d7331193017060355040b0c10436c6f756420546563686e6f6c6f67793123302106035504030c1a41646f626520496e7465726d6564696174652043412031302d37301e170d3233303632323039313030375a170d3330303632313039313030355a308191310b30090603550406130255533113301106035504080c0a43616c69666f726e69613111300f06035504070c0853616e204a6f736531163014060355040a0c0d41646f62652053797374656d7331193017060355040b0c10436c6f756420546563686e6f6c6f67793127302506035504030c1e41646f626520436f6e74656e742043657274696669636174652031302d3730820222300d06092a864886f70d01010105000382020f003082020a0282020100c83400ca50e5549e336a85a98b03899e0e3a52a646f0e39e75e9f4904244cf50bd68066dc5273dc88419276de3afa530df669180387d695b03a92d1d8f163b595ef747376ded6b9005acfeaa9d15616e7b5ad7c878d6560f0b7fe731946f903cd5fc013bb69c4676cf6d0fc2688c2ebde34796a284b5693a6efb135b03b49853ddb718ec6f85a905c4994dd53555c0ae99a41c8e7ac582d2882ac5535fd0e20418e0c5e8e5e99550998663c4517cf1a04fbcecd75eb09aeef3d742020a230700defb5498e119edc0f0d838bb056feeee4a3bb26f57517bd8cfed047d4fe3a42ac48d6209afb3efb324f60601e85d1354a86e4f89508c0a585c1edc49a012097ef1e83cf7d434b0828f6544c6bfe0fc045f7d93e7896ff168de7b16a7c2ef5b6a5b4af94f9eb47d7cc6c00b729c3af911f204b841eec6b697bbb6b5015cb02eab81a191943c2a91f840db1f7c3cb52eaf12c731ad61552b451cb00305c0b70c12c644c52b4ff872636493421bc74a54150aa5f5439936a8fe5e8c70629b1d45bff99ae311d3ae6c585280d279de2b97fffc894df2e2dc41412b8e25a24207dcc6d7a951b53e945d00f39a544ef06af89d0cdcdf5bf658ab440cd9755c02b7a7ea54bc5ef5d0521af23f0f60c3a5385a5911575fa1b800f4ca75162f504f2141ddad1c1b993a5d6de964e8b03b3517ac9b712df9836c993bb6a961b225166989350203010001a320301e300e0603551d0f0101ff040403020780300c0603551d130101ff04023000300d06092a864886f70d01010d050003820201001875e36cd93bec2cb7780cfb5af7001447dbcacbdbb6ba0eb178cf51fbed3f813c9bca588b060747e29a00913b5bc4812f0fcb5975a0a9c808ce977ba90a0bab1de84f347235df40d1415d48ac7d6d84cf3b649e589e4b3baa069e32f4b1ac117031a0184f573419c6bc3aaa0f406fc19b8debd27b9e3a933c963ba641ecfc778049f57775fa306359f8baf4bee9f38af7b7e0081eab6452cc344a51ed86b2bcdd32f46316753ffcd7cd25ef81f0a5fb5df247ff07e23ea4e939d3deeba1f2bae6f51c44fb09e2b4a93e87f8f38f6197245eff98dccb59921f9dd25eddd1d21a9ba2da7ff9a2e52ec2fd273dc5f203c15d1dedc166835fb0685dcd31a338ccce6cb701ac45d499afe17e6ece9ab48427a971b3c079c71e69a5795dcfb9521f04eb352a95329d13f9f4a61cb656a18476e3ff98c90531f163b01e91cd0cabcebfbe814fb36010883dc6d4ad38c568834b8088cd7a480a4d7a5a25b2a4e11cd5228f379fba53bca5bef0193e6a4bd4aa60dc5834eee7c0a7ad261bda5e9e4944100a72df1a3cbffd09852f24c23fd70395e1f998785699639ba2a59a3a7c232bb7679b29f039463a08db8bea6d7572b047e3e71bd2a179526ad54e39c9b3ac37e87f745b36a8a5e6c93955aeb4409ff3f8feeb3b318e8751b19781c603c9a6cda8aa99a008983c6f2566056ab3fbaf733a26ef9ddf530d00937d9fe2bbdd0b5830	2026-08-04_a3ea697a011319b486ab00de274845ba_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\SystemCertificates\AdobeCertStore\Certificates\0F7ABEE9D4141504024CA67E8358446E00F483E0	2026-08-04_a3ea697a011319b486ab00de274845ba_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\SystemCertificates\AdobeCertStore\Certificates	2026-08-04_a3ea697a011319b486ab00de274845ba_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\SystemCertificates\AdobeCertStore\CTLs	2026-08-04_a3ea697a011319b486ab00de274845ba_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\SystemCertificates\AdobeCertStore\Certificates\E93BE4F41096282FBCB5F067829258F0ADF0E739	2026-08-04_a3ea697a011319b486ab00de274845ba_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\SystemCertificates\AdobeCertStore\Certificates\0F7ABEE9D4141504024CA67E8358446E00F483E0\Blob = 0300000001000000140000000f7abee9d4141504024ca67e8358446e00f483e02000000001000000bb050000308205b73082039fa003020102020462e4860a300d06092a864886f70d01010d0500308185310b30090603550406130255533113301106035504080c0a43616c69666f726e69613111300f06035504070c0853616e204a6f736531163014060355040a0c0d41646f62652053797374656d7331193017060355040b0c10436c6f756420546563686e6f6c6f6779311b301906035504030c1241646f626520526f6f742043412031302d333020170d3138303831373139353132325a180f32303638303830343139353132325a30818d310b30090603550406130255533113301106035504080c0a43616c69666f726e69613111300f06035504070c0853616e204a6f736531163014060355040a0c0d41646f62652053797374656d7331193017060355040b0c10436c6f756420546563686e6f6c6f67793123302106035504030c1a41646f626520496e7465726d6564696174652043412031302d3730820222300d06092a864886f70d01010105000382020f003082020a02820201008320f9e1c1272a6dd544f533e081bf622f7f2a5880e882a5aa429dfc95d50dd4f2d28382b1fdb439c725e54e16d7cac18093a329d3bb4627d6685303d9813acd3a7f843dfc68411b72c3aa949ff5d30859447919a4e7668bfba87f7e9386524b1509f7ae415b0ba6998bee4c9669162761a12fdb2636c84c3a82f809ce3c8841a96157d9f9177f9075155842eee6b6c255cc3b74f005b82687af3e8514a78ff884223a090c78ab1112253e4699d4241b22c091cab81ca389043d1deb8585b9613971012502af89f1894cec83795f45b8d3e8563eafbd310ed885fb2eda014b135466d393e261dee2e57374517449b260d86ebb476c6d5df5ead894e9805769c182dc874024df053d7f99705fa283b2ffad0e40640727beccea1d8bd560b734870bdb6dffc8df3781167c059f2da21b162b8fadd56cae4b763d827a1b268d2ba32664c137aa424ef8574572306140e4524e757e2f21b1acd3be1313a999933ffd2d1f29217ed3f14055c04258657bf5829abb09e205f5d9750a32586ae233e01a1279a25030397c1620437bd5c86a5c8185cb5ccdb1141783b7324b6e3e5a4ed440352a9c95df70c8dee7cc0612d64d3bc8a99a885e8728316b18087073e881d8dc28c4b7e2ec2400593ea9bd43e776da0025edb3874559acfa064e5aaf2e1c8b74a194f92c6176469b25e2ffed7798041844b045df4f27cda3d3dd4d4d9a6d290203010001a3233021300e0603551d0f0101ff040403020204300f0603551d130101ff040530030101ff300d06092a864886f70d01010d0500038202010015c9c0128693855a317c2dcbb83b34275efbc8023ef4bedd928bcf295f7264f2d4264187b50b3fd774ee05fe78b43a7363b2249b12fe89402218188ad876e3965aa1634f24165a7d9fc8431811f5b8a41e032f0e0f246246c899a21db24eaff958d33b6ab18d9e82250f1b5715b66ecfcf8144dd336316786ab4e21f07b5a4f1b455a7cf5d9f4b5084448a72290467066f4ac61c7b967bc78cd92a4f29772fb5ad7d3876f80b1bb55c392244787cca4fc5ab5bd095aaa3b6fe34fc35f0856c73e8db1e1e7de5f98ab6a6c404eeb8829cd2dd262a06b4031ab14fe4678c29949a778f8a8cab4235e4147beda43c9d7761408e5fad63cf21e4e15cd7e10f7470047a3ce41ca9ac74a17ede8289bce6c61821a8b7f171e09da0386db993db4ee52991e0899636242547863650f10a42d0738a130dd15559fa691f71f26e05eb42267f3c7054a94210c74c7700e953afe6598e181c8804aa324358dfc2f3adc4a3e08faa682379e2caff035a7eb5dd07e093febc0894fc5f82981e7ee1295a5b23b5e6ca4481c8f06bcf6398c1bc908186e88bb7f06739590c1500e162194b7a19a67517bb43d824b1f705f07b7b7897b565316e37bb8aa91a18a5bdebed799b8fe345c761c733283fe8fa44a0362bbb67889ebb35cee2802e78af891484cb6d98657320733c4ae1dcde1fdbaec2552efdb4946f3020abc4779efd88741f186f828d	2026-08-04_a3ea697a011319b486ab00de274845ba_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\SystemCertificates\AdobeCertStore	2026-08-04_a3ea697a011319b486ab00de274845ba_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\SystemCertificates\AdobeCertStore\CRLs	2026-08-04_a3ea697a011319b486ab00de274845ba_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\SystemCertificates\AdobeCertStore\Certificates\BDBC98D38EBED76E25B49D0BF03063E0D58E3A50	2026-08-04_a3ea697a011319b486ab00de274845ba_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\SystemCertificates\AdobeCertStore\Certificates\BDBC98D38EBED76E25B49D0BF03063E0D58E3A50\Blob = 030000000100000014000000bdbc98d38ebed76e25b49d0bf03063e0d58e3a502000000001000000c2050000308205be308203a6a0030201020204093387c7300d06092a864886f70d01010d050030818d310b30090603550406130255533113301106035504080c0a43616c69666f726e69613111300f06035504070c0853616e204a6f736531163014060355040a0c0d41646f62652053797374656d7331193017060355040b0c10436c6f756420546563686e6f6c6f67793123302106035504030c1a41646f626520496e7465726d6564696174652043412031302d35301e170d3233303632383132333134325a170d3330303632373132333133395a308191310b30090603550406130255533113301106035504080c0a43616c69666f726e69613111300f06035504070c0853616e204a6f736531163014060355040a0c0d41646f62652053797374656d7331193017060355040b0c10436c6f756420546563686e6f6c6f67793127302506035504030c1e41646f626520436f6e74656e742043657274696669636174652031302d3830820222300d06092a864886f70d01010105000382020f003082020a0282020100dac5c201114e19865d7268347772d263b217cdaa505999820cf226e68a574c74f90b7a55b73c51ba202526755dbf226377dac31d37eaa54452b606c2af62d59ff6d8808d8c1b75f0b687ecc81df096de44b7480031804be412eb117e2d8354837c8da3cb36cc1c2c2058b4f5c613cb324055ba7d012037827095b1f4546d86216fc9e27a2907422b88d54127c44f86a0bc490cd4cd2a55429657523b876529c28a356c3755203c24ee6129ff9fcb29596c1220c286ada94009203c13716d961fd86a097de3a2d0049c4246160b6bbf78866bbe0efe8f59749af149d28260eefdbd8ab7016c4e0853e3958fc200c92180fec8da3aab1cf9c3105bdc5f01c82048c5f6885168391a2e8dc9658f4766b539bc6a05543149b95ed4e5bf5fb197cd555d164ee7dba0c1c7da663df1aa56f631566f9e1989a69b687a02618d245804c4d2b0c3234de64cf288d53e123d65c116c01477102f3db3b7ae9a051ff3c8d997984fdb9340aec4f3ff95cc748814d46bbdec35ae7368dbacc9d52505bbea2c2dbf0b8fc7a0cd5803276a1424f8597efd2b9d8aea589fb64563d8a3fc719b6c10e8b956e1f6738247c8c3727c7179536a591dce79c6c8e34a4ef57d881f24133616dd8142714c678afa34dbf197c5e4d784793c4dfe995f1f7c6f19527d095e820c499ae18fbf467b9f84bde0c9a2ead072b333b31b6039ca9d0262a340e03d990203010001a320301e300e0603551d0f0101ff040403020780300c0603551d130101ff04023000300d06092a864886f70d01010d05000382020100167ecb3641e5ed96dec91ad7d2864feb64e7a2dcea6a35fa2c2c2b2206c1ceeef3e40291f0ed7e40771d5fc7008a8309d8a5e0f14b5e6ddbc323c8b691778b6d4517d5677ea753a96609142673c1325c47832d1877a11f75c6a0ecca0a624dc6b0d86dfad77e08fda9f84e20af0e770bc10ec6bfde40ebe17d292e6f77b9a9a96857b71db1971c3da95ef0d6b41951469303bab3a8b49d7865371db1bcf6ddf1b5ae1723a084739c7498c5dd7866af590993a3af0ea8b7edd711059b21bbcea7f6c34146aad531cee7f2446b724f3408f9ba316cd9d98dcfb52d86a5d6c52e33929a38c92f88868538bd31bbb43a2552bc0b30ca957128fd245f080ae11cb36fb42282b07493b0ae9d164481f907fa8faf6b93ba171424ab0dde1641f366590ad59fe64c65b85f6840ee3a0a907aa692bd9999e2c4b472be51c60f3540ebab56a5d7d4a53f7f1ad993478ccd05e677c89fee25c4c98c7af469af976ce6e5acd92eef71676ccf87ab1663ebaf776842091df9ebceea1a5cffae61ad220fe64a7fd5901812f2e8a3442b5f1c25ab3777b895ead6d9c966a0174ce336977f13dd10469614338917a1b2e79a7eec1a0b9e570f2105359bd2ef8a6895a4e35667f4906eea6ac66968027d1b0a957a5feab2e72c7fb87a47931d2c90dece69639eff6d6ee789146beee1284e129a86df090fa1a6c298f6e3d1c102c858c87ce66d8799	2026-08-04_a3ea697a011319b486ab00de274845ba_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\SystemCertificates\AdobeCertStore\Certificates\E93BE4F41096282FBCB5F067829258F0ADF0E739\Blob = 030000000100000014000000e93be4f41096282fbcb5f067829258f0adf0e7392000000001000000bb050000308205b73082039fa003020102020409536662300d06092a864886f70d01010d0500308185310b30090603550406130255533113301106035504080c0a43616c69666f726e69613111300f06035504070c0853616e204a6f736531163014060355040a0c0d41646f62652053797374656d7331193017060355040b0c10436c6f756420546563686e6f6c6f6779311b301906035504030c1241646f626520526f6f742043412031302d333020170d3138303831373139353131375a180f32303638303830343139353131375a30818d310b30090603550406130255533113301106035504080c0a43616c69666f726e69613111300f06035504070c0853616e204a6f736531163014060355040a0c0d41646f62652053797374656d7331193017060355040b0c10436c6f756420546563686e6f6c6f67793123302106035504030c1a41646f626520496e7465726d6564696174652043412031302d3530820222300d06092a864886f70d01010105000382020f003082020a0282020100b32e2f364ca82c0e31bbc1cf6cb8ae362626570fafbbb36fef8ac437a3d110f232509f462f27b7037c1b2937496f34cc789a3eac3382efae2914eb2bc268a52fee22f902ec680a59f128a98ee8c04a9f7ce21e480d8a25f9b05b6438eeb4f7197e5f9ced82a830f1ef004bdd2885c0afe7b2013491554270334670fd892ec987663d4c29f5738e9cbf056f4b98e7cdf73865c632ebbbab47df4115dc15d372dfe730aed7263479471ccf8f6de0080c215fc12018123ce7921d0fef44d822577a2ac2b5c3bc201a92ae354e717147977a35772da016d39bd2d291603768faa80963cd1c3f5b408d6c6fd9416c3b45e3ffbecbdf0ab27f97742cfd921e5f2209a569d6625e34c692e37e481c839011361d7a2ea0ba57e357d1a9bd867d31e041451592475e85d4ca6b927118e7a71f48a14eb81c3b09236375dd94c72e35d5bb4e1ea8707ce8c7518e5fa75b728e59dd11963aa4ac0fed595223df651c99cf9ba4e9840c440544c7264b1d305bd65068665a4d8806beef73694b57d3d5dc87e96768b49d0dc072618db0064f681a3cdd26f1b1b3abd782e8c9eaea26f95cc4fbf8dd329fa8b8e1bff3b2ba5ab77f2613b51a8a8556d056f7db0491d0d9a5d1b1a9876b47600b0e584d7498579fe2b4bd03044871bd255832f08a712b57e28887ff50a70e5f580d9c58012fc7471ecc373cbe3c7ed7be1f2e1bf7d340335cf132ad0203010001a3233021300e0603551d0f0101ff040403020204300f0603551d130101ff040530030101ff300d06092a864886f70d01010d05000382020100afe65b1ad925e025b642e557a890efc55a5e553fe1aaac2777dfa27089793ecf3e07b23ad8ebd05dc5c87e8eb5b16fa1b78fb5258aaffd401e3ffde6cb98dcf01dddb693f4af7db174770f0be7d6babb4fb5699e706b3b4f9210f33e4f1dca952de9e319d9305c9a4204d8997176e5139fcd0aec733ca43e84a9820b1457367c0fbe56cd946ba8fbe71317f7e375b12fb81c2fdb22a4854572ca12f0d5d50da544d66d70dd4d8d2742f0e35ce9553efda5d0f173a4004978887f3ccfdc1f17e7a4f6a4a6ae7b1fd8120d079705b0f1e5a398e9575bb70539cd8f84a23125539d1e975845c4482c7a6b9414733646ffc774a44558d8eadd6ab59fe1f39d938858596027c4e21380321ccd21905867bb6cf5dde01e41cb23b07f86338fb7acf1a979c5addf76b3c5fd0021a364b7be9d427c01ecf3aff73a070c76b338c12b850454b5278ca8d828b0a9879b5e465b7796b5ec5c63f18e601e487a45bbaf60d01fdf3fb4c9fe4430c23a29b5987990aafdf5491c33c51a20326c0e0eaff1b3368ba10f7ca62882518987ff3b028961204a76c1ff0e62357c44a76fc21d8b99cc35bf6bdfff3e09f87d8de0fe47db642218af6749de8d671c616fca8813b8fb18a5114768d37f9f2a8c7684b0efa6b737ab72e7ce920800c10f306483bb7914b6f21d866b7d777047bba9cfe542c9be80b33bddbe7581829753386ae75ea2eba2d4	2026-08-04_a3ea697a011319b486ab00de274845ba_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\SystemCertificates\AdobeCertStore\Certificates\94988E3B7A85FF611B05FADFA35F89E5F38D9F4C	2026-08-04_a3ea697a011319b486ab00de274845ba_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
5932	2026-08-04_a3ea697a011319b486ab00de274845ba_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
5932	2026-08-04_a3ea697a011319b486ab00de274845ba_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
5932	2026-08-04_a3ea697a011319b486ab00de274845ba_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
5932	2026-08-04_a3ea697a011319b486ab00de274845ba_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
5932	2026-08-04_a3ea697a011319b486ab00de274845ba_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
5932	2026-08-04_a3ea697a011319b486ab00de274845ba_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
5932	2026-08-04_a3ea697a011319b486ab00de274845ba_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
5932	2026-08-04_a3ea697a011319b486ab00de274845ba_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
5932	2026-08-04_a3ea697a011319b486ab00de274845ba_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
5932	2026-08-04_a3ea697a011319b486ab00de274845ba_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
5932	2026-08-04_a3ea697a011319b486ab00de274845ba_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
5932	2026-08-04_a3ea697a011319b486ab00de274845ba_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
4364	msedgewebview2.exe
4364	msedgewebview2.exe
252	msedgewebview2.exe
252	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
5828	msedgewebview2.exe
916	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	5932	2026-08-04_a3ea697a011319b486ab00de274845ba_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
Token: SeIncreaseQuotaPrivilege	5932	2026-08-04_a3ea697a011319b486ab00de274845ba_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
Token: SeIncreaseQuotaPrivilege	5932	2026-08-04_a3ea697a011319b486ab00de274845ba_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
Token: SeIncreaseQuotaPrivilege	5932	2026-08-04_a3ea697a011319b486ab00de274845ba_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
Token: SeIncreaseQuotaPrivilege	5932	2026-08-04_a3ea697a011319b486ab00de274845ba_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
Token: SeIncreaseQuotaPrivilege	5932	2026-08-04_a3ea697a011319b486ab00de274845ba_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe

Suspicious use of WriteProcessMemory 41 IoCs

description	pid	Process	procid_target
PID 5932 wrote to memory of 5828	5932	2026-08-04_a3ea697a011319b486ab00de274845ba_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe	90
PID 5932 wrote to memory of 916	5932	2026-08-04_a3ea697a011319b486ab00de274845ba_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe	91
PID 5828 wrote to memory of 352	5828	msedgewebview2.exe	93
PID 916 wrote to memory of 396	916	msedgewebview2.exe	92
PID 916 wrote to memory of 5220	916	msedgewebview2.exe	94
PID 916 wrote to memory of 5220	916	msedgewebview2.exe	94
PID 916 wrote to memory of 5220	916	msedgewebview2.exe	94
PID 916 wrote to memory of 5220	916	msedgewebview2.exe	94
PID 916 wrote to memory of 5072	916	msedgewebview2.exe	96
PID 5828 wrote to memory of 3388	5828	msedgewebview2.exe	95
PID 5828 wrote to memory of 3388	5828	msedgewebview2.exe	95
PID 5828 wrote to memory of 3388	5828	msedgewebview2.exe	95
PID 5828 wrote to memory of 3388	5828	msedgewebview2.exe	95
PID 916 wrote to memory of 1752	916	msedgewebview2.exe	97
PID 916 wrote to memory of 1752	916	msedgewebview2.exe	97
PID 916 wrote to memory of 1752	916	msedgewebview2.exe	97
PID 5828 wrote to memory of 5604	5828	msedgewebview2.exe	98
PID 5828 wrote to memory of 4500	5828	msedgewebview2.exe	99
PID 5828 wrote to memory of 4500	5828	msedgewebview2.exe	99
PID 5828 wrote to memory of 4500	5828	msedgewebview2.exe	99
PID 5828 wrote to memory of 5260	5828	msedgewebview2.exe	100
PID 5828 wrote to memory of 5260	5828	msedgewebview2.exe	100
PID 5828 wrote to memory of 5260	5828	msedgewebview2.exe	100
PID 5828 wrote to memory of 5260	5828	msedgewebview2.exe	100
PID 5828 wrote to memory of 5260	5828	msedgewebview2.exe	100
PID 916 wrote to memory of 4256	916	msedgewebview2.exe	101
PID 916 wrote to memory of 4256	916	msedgewebview2.exe	101
PID 916 wrote to memory of 4256	916	msedgewebview2.exe	101
PID 916 wrote to memory of 4256	916	msedgewebview2.exe	101
PID 916 wrote to memory of 4256	916	msedgewebview2.exe	101
PID 916 wrote to memory of 1628	916	msedgewebview2.exe	107
PID 916 wrote to memory of 1628	916	msedgewebview2.exe	107
PID 916 wrote to memory of 1628	916	msedgewebview2.exe	107
PID 916 wrote to memory of 4632	916	msedgewebview2.exe	108
PID 916 wrote to memory of 4632	916	msedgewebview2.exe	108
PID 916 wrote to memory of 4632	916	msedgewebview2.exe	108
PID 5828 wrote to memory of 4364	5828	msedgewebview2.exe	109
PID 916 wrote to memory of 252	916	msedgewebview2.exe	110
PID 916 wrote to memory of 3324	916	msedgewebview2.exe	111
PID 916 wrote to memory of 3324	916	msedgewebview2.exe	111
PID 916 wrote to memory of 3324	916	msedgewebview2.exe	111

C:\Users\Admin\AppData\Local\Temp\2026-08-04_a3ea697a011319b486ab00de274845ba_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_a3ea697a011319b486ab00de274845ba_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe"
1⤵
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5932
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=2026-08-04_a3ea697a011319b486ab00de274845ba_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe --webview-exe-version=2.14.0.66 --user-data-dir="C:\Users\Admin\AppData\Local\Adobe\webview2\2026-08-04_a3ea697a011319b486ab00de274845ba_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=1 --allow-file-access-from-files --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=5932.3040.8643782483374875149 /pfhostedapp:d40e362d2e9b89484e3fd93bab8299ebba853429
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:5828
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Adobe\webview2\2026-08-04_a3ea697a011319b486ab00de274845ba_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe\EBWebView /prefetch:4 /pfhostedapp:d40e362d2e9b89484e3fd93bab8299ebba853429 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Adobe\webview2\2026-08-04_a3ea697a011319b486ab00de274845ba_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ffe2b0d5fd8,0x7ffe2b0d5fe4,0x7ffe2b0d5ff0
    3⤵
    PID:352
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Adobe\webview2\2026-08-04_a3ea697a011319b486ab00de274845ba_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe\EBWebView" --webview-exe-name=2026-08-04_a3ea697a011319b486ab00de274845ba_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe --webview-exe-version=2.14.0.66 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1740 --field-trial-handle=1744,i,11797302512958310304,13889595285696714394,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:2 /pfhostedapp:d40e362d2e9b89484e3fd93bab8299ebba853429
    3⤵
    PID:3388
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Adobe\webview2\2026-08-04_a3ea697a011319b486ab00de274845ba_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe\EBWebView" --webview-exe-name=2026-08-04_a3ea697a011319b486ab00de274845ba_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe --webview-exe-version=2.14.0.66 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --no-appcompat-clear --mojo-platform-channel-handle=2316 --field-trial-handle=1744,i,11797302512958310304,13889595285696714394,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:3 /pfhostedapp:d40e362d2e9b89484e3fd93bab8299ebba853429
    3⤵
    PID:5604
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Adobe\webview2\2026-08-04_a3ea697a011319b486ab00de274845ba_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe\EBWebView" --webview-exe-name=2026-08-04_a3ea697a011319b486ab00de274845ba_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe --webview-exe-version=2.14.0.66 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --no-appcompat-clear --mojo-platform-channel-handle=2364 --field-trial-handle=1744,i,11797302512958310304,13889595285696714394,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:d40e362d2e9b89484e3fd93bab8299ebba853429
    3⤵
    PID:4500
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Adobe\webview2\2026-08-04_a3ea697a011319b486ab00de274845ba_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe\EBWebView" --webview-exe-name=2026-08-04_a3ea697a011319b486ab00de274845ba_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe --webview-exe-version=2.14.0.66 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=2760 --field-trial-handle=1744,i,11797302512958310304,13889595285696714394,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:d40e362d2e9b89484e3fd93bab8299ebba853429 /prefetch:1
    3⤵
    PID:5260
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Adobe\webview2\2026-08-04_a3ea697a011319b486ab00de274845ba_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe\EBWebView" --webview-exe-name=2026-08-04_a3ea697a011319b486ab00de274845ba_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe --webview-exe-version=2.14.0.66 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4408 --field-trial-handle=1744,i,11797302512958310304,13889595285696714394,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:d40e362d2e9b89484e3fd93bab8299ebba853429
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4364
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=2026-08-04_a3ea697a011319b486ab00de274845ba_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe --webview-exe-version=2.14.0.66 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\{A9E8A9B0-D804-43E7-8939-B00F0E557606}\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=1 --allow-file-access-from-files --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=5932.3040.5523476525195981010 /pfhostedapp:94641b6191efd9a665d69ac082ef5fbee8fa1fc4
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:916
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\{A9E8A9B0-D804-43E7-8939-B00F0E557606}\EBWebView /prefetch:4 /pfhostedapp:94641b6191efd9a665d69ac082ef5fbee8fa1fc4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\{A9E8A9B0-D804-43E7-8939-B00F0E557606}\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x198,0x19c,0x1a0,0x174,0x1a8,0x7ffe2b0d5fd8,0x7ffe2b0d5fe4,0x7ffe2b0d5ff0
    3⤵
    PID:396
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\{A9E8A9B0-D804-43E7-8939-B00F0E557606}\EBWebView" --webview-exe-name=2026-08-04_a3ea697a011319b486ab00de274845ba_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe --webview-exe-version=2.14.0.66 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1892 --field-trial-handle=1896,i,2634850217494543213,15869946000980561999,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:2 /pfhostedapp:94641b6191efd9a665d69ac082ef5fbee8fa1fc4
    3⤵
    PID:5220
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\{A9E8A9B0-D804-43E7-8939-B00F0E557606}\EBWebView" --webview-exe-name=2026-08-04_a3ea697a011319b486ab00de274845ba_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe --webview-exe-version=2.14.0.66 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --no-appcompat-clear --mojo-platform-channel-handle=2208 --field-trial-handle=1896,i,2634850217494543213,15869946000980561999,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:3 /pfhostedapp:94641b6191efd9a665d69ac082ef5fbee8fa1fc4
    3⤵
    PID:5072
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\{A9E8A9B0-D804-43E7-8939-B00F0E557606}\EBWebView" --webview-exe-name=2026-08-04_a3ea697a011319b486ab00de274845ba_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe --webview-exe-version=2.14.0.66 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --no-appcompat-clear --mojo-platform-channel-handle=2368 --field-trial-handle=1896,i,2634850217494543213,15869946000980561999,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:94641b6191efd9a665d69ac082ef5fbee8fa1fc4
    3⤵
    PID:1752
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\{A9E8A9B0-D804-43E7-8939-B00F0E557606}\EBWebView" --webview-exe-name=2026-08-04_a3ea697a011319b486ab00de274845ba_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe --webview-exe-version=2.14.0.66 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3368 --field-trial-handle=1896,i,2634850217494543213,15869946000980561999,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:94641b6191efd9a665d69ac082ef5fbee8fa1fc4 /prefetch:1
    3⤵
    PID:4256
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\{A9E8A9B0-D804-43E7-8939-B00F0E557606}\EBWebView" --webview-exe-name=2026-08-04_a3ea697a011319b486ab00de274845ba_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe --webview-exe-version=2.14.0.66 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --no-appcompat-clear --mojo-platform-channel-handle=4600 --field-trial-handle=1896,i,2634850217494543213,15869946000980561999,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:94641b6191efd9a665d69ac082ef5fbee8fa1fc4
    3⤵
    PID:1628
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\{A9E8A9B0-D804-43E7-8939-B00F0E557606}\EBWebView" --webview-exe-name=2026-08-04_a3ea697a011319b486ab00de274845ba_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe --webview-exe-version=2.14.0.66 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --no-appcompat-clear --mojo-platform-channel-handle=4712 --field-trial-handle=1896,i,2634850217494543213,15869946000980561999,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:94641b6191efd9a665d69ac082ef5fbee8fa1fc4
    3⤵
    PID:4632
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\{A9E8A9B0-D804-43E7-8939-B00F0E557606}\EBWebView" --webview-exe-name=2026-08-04_a3ea697a011319b486ab00de274845ba_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe --webview-exe-version=2.14.0.66 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4708 --field-trial-handle=1896,i,2634850217494543213,15869946000980561999,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:94641b6191efd9a665d69ac082ef5fbee8fa1fc4
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:252
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\{A9E8A9B0-D804-43E7-8939-B00F0E557606}\EBWebView" --webview-exe-name=2026-08-04_a3ea697a011319b486ab00de274845ba_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe --webview-exe-version=2.14.0.66 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --no-appcompat-clear --mojo-platform-channel-handle=4316 --field-trial-handle=1896,i,2634850217494543213,15869946000980561999,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:94641b6191efd9a665d69ac082ef5fbee8fa1fc4
    3⤵
    PID:3324

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5016

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:5720

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Adobe\webview2\2026-08-04_a3ea697a011319b486ab00de274845ba_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 833b5eaf0bc29f72b94740670faa665891cabfd0dd75a5b93d4f56b6f4782ffb
MD5 d263780280668330d37a688fdef63efc
SHA1 51772e84ee8230e5597c00365a1687dce3096881
SHA512 ad86b4b51bb50d5c3770d7a25ced843f3bcc313ceb707e079b8a026c2fae717139659be02c886d1dd663085b2ecf66401d77bcc891abff840729d1bcbb792eff
TLSH
T1B6D0045055407411C00113FD1550450F05505451011355C30C5044044440411050170C
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Adobe\webview2\2026-08-04_a3ea697a011319b486ab00de274845ba_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 d3a65099f20a708d9671dfd7b2ee6300164d686bbdd29ef3d7fc5297616c0f37
MD5 4dd15197614744bc72160b56c924a18c
SHA1 7d3e2e4ca2825ba257b12d51c6efb68259538a42
SHA512 d4640147ada4ce10a5498cd90725b082d179ec63c971afb6c1246e28b61ce2540448240c50c187cd3bdf26d9a10147811303297db4cbe7ecbc1cacd9eed0067b
TLSH
T1B3D0121236415534C01022B71542650E0840D11B410680825C28C91D5A044600E02949
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Adobe\webview2\2026-08-04_a3ea697a011319b486ab00de274845ba_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Adobe\webview2\2026-08-04_a3ea697a011319b486ab00de274845ba_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe\EBWebView\Default\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Adobe\webview2\2026-08-04_a3ea697a011319b486ab00de274845ba_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe\EBWebView\Default\GPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Adobe\webview2\2026-08-04_a3ea697a011319b486ab00de274845ba_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe\EBWebView\Default\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Adobe\webview2\2026-08-04_a3ea697a011319b486ab00de274845ba_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe\EBWebView\Default\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Adobe\webview2\2026-08-04_a3ea697a011319b486ab00de274845ba_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe\EBWebView\Default\Network\Network Persistent State
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Adobe\webview2\2026-08-04_a3ea697a011319b486ab00de274845ba_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe\EBWebView\Default\Network\Network Persistent State
Size 236B
SHA256 478d0704de9dd4d0db7a5c5d8980665e0499690c8ac5a45a36cddd0cac04f385
MD5 3bdec28d1dcb4ed2e9d94407711cb950
SHA1 77345a20852258dd99a4c3ca9664dd5d2b872b4f
SHA512 09d9243eaf68c94bf3793ef9687dfc6aeeef40e3b0307d2874920e4fa00455729bf76b968f63e377c1f07a054430ccf3d536c8f95e215d3998398af4e41df66c
TLSH
T19CD0A77A46601DFE079583A05A2CA817CE7E9007021CFDBA85347B2A83761B8901458B
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Adobe\webview2\2026-08-04_a3ea697a011319b486ab00de274845ba_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe\EBWebView\Default\Preferences
Size 6KB
SHA256 53d587708c8a26919619b86b7ad948ddcf891a761dc2758e99c6c8f7520cb062
MD5 73e3186b60af2c8e7d0895c123a68d2a
SHA1 93de5779ee86d4e2ad022cb7e425de51c614df6e
SHA512 a2b1accbb44d66ead06bafc5b293fba2339b390a1a500f18c1b9f3a958dbf90faf7b6601e8a137ad073e87553b05e78c6ce338c11a1c31621460a148cbd368d8
SSDEEP 96:steN/dARuzGWb95kao5h16ZdlAs7/x+6MhmuecmfQIevK+gm0C28XM1C7K:stcSsHosCsV+FifQIVk3G6K
TLSH
T17FD1A6025E28787B8CC6E519BA29BB03D2FAA03271D51E58E7FC852C18DB5DC2347D0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Adobe\webview2\2026-08-04_a3ea697a011319b486ab00de274845ba_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe\EBWebView\Default\Shared Dictionary\cache\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

c16acb02-b472-485a-b2f0-ada29adda9a5.tmp

Path C:\Users\Admin\AppData\Local\Adobe\webview2\2026-08-04_a3ea697a011319b486ab00de274845ba_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe\EBWebView\Default\c16acb02-b472-485a-b2f0-ada29adda9a5.tmp
Size 6KB
SHA256 9da19c458682c8b0cbedc71dd620a87f1d9710a5748cfe44f64fe1a22252a80e
MD5 f157f3fb2e122b5063e6532fe48ee8bf
SHA1 742705acd78bfb62e12c37caa906298eff0e3026
SHA512 3d7c812e4f3b018209e9b7af5e90b21f996c5fd0063daf8a6022b8a2a316fad3592895452987aca1c16189dd967ad496d756bb5956e0a63b622a0ebc07bb985c
SSDEEP 96:steN/dARucWb95kao5h16ZdlAs7/x+6MhmuecmfQIevK+gmCH28XM1C7K:stcSuHosCsV+FifQIVk8G6K
TLSH
T188D1B7025E28797B8CC6E519BA39BA03D2FAA03231D51D58E7FC852C18DB5DC2347D0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Adobe\webview2\2026-08-04_a3ea697a011319b486ab00de274845ba_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe\EBWebView\Local State
Size 3KB
SHA256 e066f6132ad23c83bbb46260d9aa06ad587831dd6d234492d9b391c95db8919b
MD5 03c3f5390abbc236327e816a4c98f6e2
SHA1 15964e5a7af46497dd73d2750a6711fe06f814a8
SHA512 67c2c836091b89ba8a2bad1d24f29c7db5dfa026138b7365a4c92c395d6c9f8f0e3031982c30c81efabc68f9395bd1c8af8c9bf4d22107b89660a6222e2354a4
TLSH
T18B7176666C78A6378DF2D505B9863B07ABA55073E9D03FA5D6EC0F1C12DB28C1382C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Adobe\webview2\2026-08-04_a3ea697a011319b486ab00de274845ba_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe\EBWebView\Local State
Size 3KB
SHA256 e5441d45c373450e582b2c53b49bc5c138aaff0cf3a004d330a42a107b25343e
MD5 ad1d4b1b350c1d5b0e4f592155e9a91f
SHA1 347cfb2a7c62f5feb29d76cc185e344491cb4933
SHA512 677bb61dd9c06788c191141ced5753295f1df3ae10c06ad4ca9743b839da9e4da8bcdc1e62ac98ec74d94ec79b3ff581df0c15fb3b97a4010227f5c32aaad042
TLSH
T1A67155666878A5378DE2D505B9863B07A6A5A067E5D03FA5D6EC0F1C11DB38C1382C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Adobe\webview2\2026-08-04_a3ea697a011319b486ab00de274845ba_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe\EBWebView\Local State
Size 2KB
SHA256 d87fa82006439ed2486329f3366cfd05c320a9d94ef81c5fe561a26c2ec5408e
MD5 a55fd63bfa4bee709210b3226c10be9a
SHA1 c78bf485d99f879492f6ead9af3a2839c3b527d3
SHA512 d9044f5cf60d8b397772d6172aed24affb914c80ed39c0494e9dc337a6370159dbbaf12efd0d9a59989015a433be9dc4c8bbfb5dc1150b1cccc77e76ad89bcfe
TLSH
T10551B4726C18A737C9E24605B94A3B178E3AA072BA912F6096DD0B2C01DA25C2746C3B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Adobe\webview2\2026-08-04_a3ea697a011319b486ab00de274845ba_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe\EBWebView\Local State
Size 3KB
SHA256 c45c470cafb1bf18b3d6dda545cf73c4c9613dc55f3784ddd009a633f954912c
MD5 955d09e65b57156e1ff23a5c59671744
SHA1 7d1ccc2b85dcbf7dd39aaa20753c3acfe9bef49b
SHA512 193b7703c71ce87ea6f7ec5212948811d6a0c764f5c3d05427f859569d60a3ca6fb9e5f323dd6a4423dbe2e77c4e1b58da4757b7f01daf8739ef1764caee3552
TLSH
T1FF61866A6D78A6278DE29A05B8863B16A7A56033F5C13FA5D6EC0F1C11D728C1342C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Adobe\webview2\2026-08-04_a3ea697a011319b486ab00de274845ba_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe\EBWebView\Local State
Size 14KB
SHA256 200882e5742208babf89c7a75e2ef655fe72d573e95b93c4264e75e66183264a
MD5 1ad930044b7bbbe1d8eaceff1e63c696
SHA1 929ee6372979796db635cdcf7ec2d8fe24fe961e
SHA512 b53f4ac8b31fd0f8abed9023b3e4825831c7cabc071fa148a4918caf9846bce425f70c10644b81b3090e78e7b32dcfe7209a73298cd5ba143f98f4158b59603e
SSDEEP 384:A+aQikB+z/xvxjg/qhEgNBSBwLr8Zg9z/:f/UxvxjgC+5y+gF/
TLSH
T1AB629E2A697C7E2795F2F6057949178BDBB9A872A0C17AB84AFD1F0C17C73980342C17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe59407a.TMP

Path C:\Users\Admin\AppData\Local\Adobe\webview2\2026-08-04_a3ea697a011319b486ab00de274845ba_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe\EBWebView\Local State~RFe59407a.TMP
Size 1KB
SHA256 5b3273b008d31df57162106bb1415b3d2583dc0f54dcff038e14f8d5df279a55
MD5 45dba390254cddb63e0e41c5a94ee4aa
SHA1 f421ddf3ef0977504130e6abddd81fa4abfb589e
SHA512 4b187f1db89d8c0092f12e838da6803d67a1c617d20f909c88ef680f7bc549a7a3821705f50a77c0ecbaa8bbe8aa6721a4c8725309b7462c368b770f4b6bcfe0
TLSH
T1862192F2AC6C5B33E890224231477A4B5E212077A2805E5092CE4B3C23DA24CA97FD37
MD5 SHA1 SHA512 TLSH

Submit Download

F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx

Path C:\Users\Admin\AppData\Local\D3DSCache\bcc2ef54ddd674d5\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx
Size 64KB
SHA256 45d326d51fc12b43cc21567b210d4d2cf9d286757e2ee80cb2540c4af9756000
MD5 473fcda1a7f0c2fd53d38be647c94dc4
SHA1 0fe533538da7525a8699e4a438471d0d8b7da21b
SHA512 21bfb59d04f11985288e899d65e8e67d3a8d3d107a90e2e31ff4343cc44df1eb83b913e8bd651cc3f6f968db57df866ee0ab9f42ba6c8a7b0cab7236c4bf54c2
SSDEEP 3:T41HlGlll/l/lXp9ZjrPBY0LlWlxemQlll/ZP:CH0dPBY0cQD
TLSH
T11953124112820517C442037006CA4A943AB46204038304118260D130D459B042571180
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock

Path C:\Users\Admin\AppData\Local\D3DSCache\bcc2ef54ddd674d5\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock
Size 4B
SHA256 7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba
MD5 f49655f856acb8884cc0ace29216f511
SHA1 cb0f1f87ec0455ec349aaa950c600475ac7b7b6b
SHA512 599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8
MD5 SHA1 SHA512

Submit Download

F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val

Path C:\Users\Admin\AppData\Local\D3DSCache\bcc2ef54ddd674d5\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val
Size 1KB
SHA256 40928da695b4c88e4f1487f64b20258fe457319908f7b1534ee8874e03fb895b
MD5 febfbea66e6cc686e0709f8a483cfd4e
SHA1 683597e562895538eae3005eb3335b560fccaff9
SHA512 2ae97de729e626afe740417c3b280c6b90e754077b0fe6c23a30b2c12a150dab7f016c299c2c58a892762253102159ad38de05325feac31e3b7a53c5a777b521
TLSH
T1ED112E2C37D60E30F396AA3080766A682077B1055490938D80C043260922808E4B4FA6
MD5 SHA1 SHA512 TLSH

Submit Download

CCDInstaller.js

Path C:\Users\Admin\AppData\Local\Temp\{A9E8A9B0-D804-43E7-8939-B00F0E557606}\CCDInstaller.js
Size 1.8MB
SHA256 b3cd90e4b56fa44d062d9b061f48f88cfb4372f64ed2f71da40e04aeb004bfda
MD5 02fd165c6436aa8bd7c66b6cdfaf0538
SHA1 f76364bc78aaa44ed404edabc3ec52d8357ad213
SHA512 972d85183ed0cc36904636a74c4351ff170f6346f80f2d8724d8141d285104ee5946e81c0fb9d855f399ff3d865f19c9494d72a27d481240106e9e966cbdcae0
SSDEEP 12288:ZiG9838Pp42Tino9x9LYzKzX58x5MX8kkWd634OpHdVFbDgxMNEk+DRUbA24hQLT:7TC6x9L5zX5wU8kkWA/bDgxDRV24y
TLSH
T1DB95F77F74A5A872AF8030D6009BB40FB7753539738084A89955CF9C92E6B8D4B0BE5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\{A9E8A9B0-D804-43E7-8939-B00F0E557606}\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 46dd1184d9fd59d65412217c9439eeddaed8de8e30d6f4d220551f33c2160e8c
MD5 fbdd51b2408f37925d9c193cb3a0386a
SHA1 68126a5adfad73131cc26b01cd84889ef9c3f8b8
SHA512 cbc804c50950bf6903c98a9fc2cb5c3c191e55a530ecd799fa722eb2f1e01b06ccabacc27ef44ed3cfdd476c128d0980928ff1b8505875cbf524da5e5e8121b2
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\{A9E8A9B0-D804-43E7-8939-B00F0E557606}\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 123d3c9fe18019d4cc8fffdd9b01c2191860f061b8d097f3f19b09210260a018
MD5 dfef63f4f3e0c7adc2ad8d9b44f47806
SHA1 f534cc94d29f51d4e31cb0793ac72a83d7be6895
SHA512 c6d4b03b89081fe22c632b2277a24f4051fd6388a550b11aa67fc0292cf574b8c96b0c029d0b766bd287eda756e8f6291c46d5bd0164ed9a2ab81e5ab0f382e9
TLSH
T19ED012123A1142B5C0202033101272185800D50B81458001543D859F1A440741907443
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\{A9E8A9B0-D804-43E7-8939-B00F0E557606}\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 720B
SHA256 d5d33efa7c9e31210a5b240433ef6f6d6ab8681d9f143cd2e3338c6916bbf419
MD5 a93ca542a865e25e1845d34efffa5de4
SHA1 8ad6e33752f81c09633e30be26ab1567a3062b30
SHA512 1a56658ec3bd562c57f3137438b550c5d5e2907a35217bce8325ceac7368fb79d6cf0a35ec15f57f983326a1ce17718125db0a68ec52abe929b2de9de8bdc6f1
TLSH
T1BA019A313728D1DBCBB0F37169DA073479713A36060F3DE019243871043E3490205A5D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59b5e8.TMP

Path C:\Users\Admin\AppData\Local\Temp\{A9E8A9B0-D804-43E7-8939-B00F0E557606}\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe59b5e8.TMP
Size 48B
SHA256 fbccf37369624d5450d27051db70cc615a0f57f7ac0e02d23d2cff73f599bbc7
MD5 cda0a7c1135f54e32c8d15bfcbe14c3c
SHA1 f9dfecfececdad526ed68e12a38da83f23c7f250
SHA512 b3b2b0053bbc26ff595818fdda6efdc43b8fddcd0af9bf92abcbbe5330e9c5992e06d07fec5c969ec84e5799303f6cf09f929eb6d03a0b59bd51fac564cf9468
MD5 SHA1 SHA512

Submit Download

Network Action Predictor

Path C:\Users\Admin\AppData\Local\Temp\{A9E8A9B0-D804-43E7-8939-B00F0E557606}\EBWebView\Default\Network Action Predictor
Size 4KB
SHA256 9827429749037198cb3d19a851ccff2adafad344fbade7220aa022d3c9e2fa85
MD5 9088df5de5b8306c52e744141a100532
SHA1 0aea85a36ef3ddc53df198227fcaf212139ae1db
SHA512 96c0c8ee90bd8aec34ea905f48e76ed7dc370d24f64efaeadf36e9b59b9ff01856ed837b5169241ef2bd4a6b8fe2ee77de443b09b9ee604e39f9ba57929859e8
TLSH
T15C819285F7C02420DA346EF3A4824BBD5E72CA82A5124B93097002D0FCA74ECCC796AA
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Temp\{A9E8A9B0-D804-43E7-8939-B00F0E557606}\EBWebView\Default\Network\Network Persistent State
Size 1KB
SHA256 cfc51eaaa0cb5f7ffc4fb8f9117217dab7e6025ff9b7fb011e0478a8bf26f357
MD5 a8dde22b7e08bfd947fabde087ca4212
SHA1 cc1c019c94fc7e4e3e51c9d66a0914532a1fc429
SHA512 11f9e45100a63f3bf55e7166ebd007d2c902387f32f469628732bfbfe24bd92d5d6ea3e5cb9bd5688cafc4771a7810f47c0521549682cdece5cfbe75eaede56b
TLSH
T146313BB783B8162D8A5351F41B18DE1FCE5E1911936CF939C9D09F9793E18B1E210A4B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\{A9E8A9B0-D804-43E7-8939-B00F0E557606}\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Temp\{A9E8A9B0-D804-43E7-8939-B00F0E557606}\EBWebView\Default\Network\TransportSecurity
Size 1KB
SHA256 2c8f2d26c65188bd9cc3ecbb8e4076e4cea52542bd7e9260435999321030b86b
MD5 429cb15ed437a08aa68eaabd94fbfb27
SHA1 af30f7a483f59a401d1cbf69fcd245bd7de84234
SHA512 2e02378acdab1a06e07eadfe28f79ab8c6716342035c6ad5adb51d50676a207e0c19fa8143e1691d2dc4c5b9657f28c4d0ec4c795a651778b2518a5674f32e11
TLSH
T19F317F6389BEB453602CA49F0D847C4968BFF831575194F5EB6791ACA0538B31A05427
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity~RFe59af51.TMP

Path C:\Users\Admin\AppData\Local\Temp\{A9E8A9B0-D804-43E7-8939-B00F0E557606}\EBWebView\Default\Network\TransportSecurity~RFe59af51.TMP
Size 1KB
SHA256 6d108b0742607bb59ea108f9fbfbd701672926db2db0181fb31e9cf4db0cd523
MD5 928fce6982a83924421fb92cde4aafb7
SHA1 3e6d5ae928bb7f3042f29dea7b9d44ba3b09bab2
SHA512 49e75e5a20098df0fb57855c11da175b792fe7b38990f73ebec8bd3d7769ac76d83fc4283b58db8a9365f232f9b0c555b3f8f8652426211cfebd4de275987cfc
TLSH
T189319E6389BEB493602CA8DF0D447C4DA8BFF830675194F9EB6790ACA0538F31B06427
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Temp\{A9E8A9B0-D804-43E7-8939-B00F0E557606}\EBWebView\Default\Preferences
Size 6KB
SHA256 768c89ceed225890a531b019295f7c588be3c4711d4b7bd8d6893e41317a80d1
MD5 0c3a6f2b64a2fbf4de94265a72c66dd7
SHA1 c5f8408f8cdc61e98ac1687e30bc68f7d4fdd8dd
SHA512 095f3fe86a8d5ab94f86c0c3f97fde784c88836a76c6f50e81ad2f376cea14f02dd3fb5f85889bb8964203fe03a751f7fda00ec39c63f255856c9a729c53e735
SSDEEP 96:stD/dAEeFjZb94kOo5h16Zv7s7/x+6Mhmuec5LH1eje+K+gG28XM1C7K:st7SNjkRoq7sV+FFLHQjGMG6K
TLSH
T168D1A7065E28797F4CC6E109BA25BA13E2F6603275D12D58E7FC852C18DB6DC6317D0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Temp\{A9E8A9B0-D804-43E7-8939-B00F0E557606}\EBWebView\Default\Preferences
Size 6KB
SHA256 985fdb89fa4b784ad29a6968d8b2852f19fca6df25f73677e42604c068510c41
MD5 74398da19804d4b3f6524015a0d894e5
SHA1 efaee6babe6341335cb8ff3dc5fbd2c5fe0d7649
SHA512 c42c4b083f45929f55440f7c4beaddf96505241438da9a087f743d1276ae66481750864dc85a451c2af377100c16f398916d6100e16b8a7477cca7c507db51c7
SSDEEP 96:stD/dAEFGFjZb94kOo5h16Zv7s7/x+6Mhmuec5LH1eje+K+gix28XM1C7K:st7SbjkRoq7sV+FFLHQjGgG6K
TLSH
T151D1A7065E28797B8CC7E109BA297A13E2F6603275D12E58E7FC552C18EB6DC2313D0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe5998db.TMP

Path C:\Users\Admin\AppData\Local\Temp\{A9E8A9B0-D804-43E7-8939-B00F0E557606}\EBWebView\Default\Preferences~RFe5998db.TMP
Size 5KB
SHA256 1c15dbb2079dc004c668ea8d9b96275fbae2ff39bfdc5a336575af921c5f1237
MD5 bafa66abdf6e209d3e10a95bae552a3d
SHA1 9feef69168ed0cb539d8ff828a6da436364dd38d
SHA512 e3c892a2367ca4859be990acc99c9b0c9717bb611d52a0414410ef72df6d179df9b51c6a9d2f27fa15d7bdee78a6ea4f04a57cdc2d3a0739cc1dac6cada60a7d
SSDEEP 96:rD/dAEeFjZb94kQdo616Zv7s7/x+6Mhmuec5LH1eje+K+gG28XM1C7K:r7SNjkXoZ7sV+FFLHQjGMG6K
TLSH
T137C1B6065E28797F4CC6E109BA297A13D2F6603275D52D68E7FC852C18DB6DC6317C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\{A9E8A9B0-D804-43E7-8939-B00F0E557606}\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\{A9E8A9B0-D804-43E7-8939-B00F0E557606}\EBWebView\Default\Site Characteristics Database\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\{A9E8A9B0-D804-43E7-8939-B00F0E557606}\EBWebView\Local State
Size 3KB
SHA256 32a26db16e9c8b1ff8a0335c0e7b1b520d89f060fee1b2d8276d979233a054f9
MD5 45b595e307d657da2318c542bfc1e7ac
SHA1 b417c92f8a417a15cfc88917a920cbecc93aa059
SHA512 002e29d06c3a25d5320d3afcd31247c7869f9d5dca6d28cc6f8e80be4870783e4b51047d20b0f6c20bfda67a2fced123a1b657bb4929790b2973c31ff8a896fa
TLSH
T13771B53A6D3CA52B8DE29A05B88A3B17A7A56073E5903FA5D6EC0F1C11D72CC1382C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\{A9E8A9B0-D804-43E7-8939-B00F0E557606}\EBWebView\Local State
Size 2KB
SHA256 2bee6d4a38d0a655824145ef368d0a1cd18a41604f33e35df3dbe717cd42e4bd
MD5 eba13a785f2beee30acc6e71c961668a
SHA1 09fee5e644201ccb22622f0d7db78c9426496751
SHA512 05c32162f9dfc6035a79688aeacd08e121b77ba7432c4e80183eb6185119b0b5b98af18cf18da0bd6423e9dc714da9190f458578ec4a4e24c202dc3866f04df7
TLSH
T1E551A7336D2CA737D9E24609794A3F239A7570B2EA612F2196EC1B1C11D758C1782C3B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\{A9E8A9B0-D804-43E7-8939-B00F0E557606}\EBWebView\Local State
Size 3KB
SHA256 918fd0927f16bc46481125501f42f680613a458ba5bd5b6e8f7853b847efdb28
MD5 9b0c0ab7498892c975d9595f4c0989da
SHA1 3779d69c6d87432a4c3540be606149c285078c01
SHA512 1579253c5cfff88b57a48785733e83f094f30a9f620cda71902232baa35f8d8d8a92a5caa5fc1e30fa6da6c768aa1d5f2242467b080d287fb1de36ade4ee8a89
TLSH
T1E661B83B6D38E5378DE29A05B8863B16A7A16073E5903F65D6EC1F1C11D72CC1382C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\{A9E8A9B0-D804-43E7-8939-B00F0E557606}\EBWebView\Local State
Size 3KB
SHA256 476e43b8cd68f8cc74089c08ee0c4d9c88237d37ee4942351e65838c8d8b9e04
MD5 942676351daea3e9311192cec7060363
SHA1 3b2de90869085cb7d201aa55820cb0b366583d7f
SHA512 c128c0180a0967527403079aa27bbde5e6454b584a55fc1797778566a6dd09d00b6b33001ce2152066d6e2a38de6974db122d6bf8878c853dfca17688488726f
TLSH
T1F271B63A5D78E5278DE29A05B88A3B17A7A56077E5903FA5D6EC0F1C11D72CC1382C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\{A9E8A9B0-D804-43E7-8939-B00F0E557606}\EBWebView\Local State
Size 14KB
SHA256 4ffc52b0090bf000275141cfce010707b1dd1df459626adbb42cab59da294ec1
MD5 06460dc55313ed3e30d22aca870d463d
SHA1 01e839346f36033bfe43fd7b824a1675d9f7b1d6
SHA512 067e4aa5c47f60b63f1165905e0d4962b2570a17c2be82aa3c197dad201e7cca61fbc59a17e2ca3fa341c5c8ba74808e57ea179352db2a2066e18d232f1bd393
SSDEEP 192:gDFOKH/2/aQWjYhwZ00i+z/kNWIU6ZwNj1Jfo/iVQ45hgj4k0NBSUweoDUDQjMZV:i+aQikB+z/xvxjg/qhEwNBS5rg0g9z/
TLSH
T16C629E2B597C7A239AF3EA04394D175BDBB8687290C16AB84AFD1F0916C72980342C17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe593f70.TMP

Path C:\Users\Admin\AppData\Local\Temp\{A9E8A9B0-D804-43E7-8939-B00F0E557606}\EBWebView\Local State~RFe593f70.TMP
Size 1KB
SHA256 d49dacb8c5765bf24fd2826a6930a624352fb0c35c2ade48a5a22f029e77d457
MD5 b8e83d175cfd84a3a86841be16dae05a
SHA1 2f6e4852aa225fecb1fc7bc42cbcb9e07eb93ae5
SHA512 aad5eeaa8d6dba231297b15063c3b49eec8efed0f40db27974e5dd5b65bf578aad11d0964bc162e42c72ac3d028b44e055fe2bbd525d05b98ecce34be075c52f
TLSH
T197214276AD3CA733BCC51646224A2A2B1E6130B7D2204E1152ED4A2D22E248C5A9BC3B
MD5 SHA1 SHA512 TLSH

Submit Download

index.css

Path C:\Users\Admin\AppData\Local\Temp\{A9E8A9B0-D804-43E7-8939-B00F0E557606}\index.css
Size 923KB
SHA256 cdd337f639e76f36fa41002b26e9a4f8c819d196747983283e25e3049fe5028e
MD5 e09f799bb69cecaf3987bc12cf65dd24
SHA1 ea57b540f246e00bd1e4bb7df3824bd8fa129a6c
SHA512 90a877a6024d996646055f496907276e4746cecab334b701f0d44d11b1d636984a049c74310606b7f0487549eb4b454318ba3b2e02ebc1121ff57970d885e1a4
SSDEEP 12288:oUxDxiaHbr3Gq5XRi5i6jE/5acgsu0wxT63kaSROcdOLeK+CnjG1VWzWhHuajOGh:oEBP3/5XSo/5F5K65SROcwLeKVYgzWIK
TLSH
T14D15CEE0D6A04D1D74378C3AA1CEA75E5514C28E55889FDBAE83ECF540CA696CF2270F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.html

Path C:\Users\Admin\AppData\Local\Temp\{A9E8A9B0-D804-43E7-8939-B00F0E557606}\index.html
Size 426B
SHA256 886c0ab69e6e9d9d5b5909451640ea587accfcdf11b8369cad8542d1626ac375
MD5 a28ab17b18ff254173dfeef03245efd0
SHA1 c6ce20924565644601d4e0dd0fba9dde8dea5c77
SHA512 9371a699921b028bd93c35f9f2896d9997b906c8aba90dd4279abba0ae1909a8808a43bf829584e552ccfe534b2c991a5a7e3e3de7618343f50b1c47cff269d6
TLSH
T1A9E0225B1D924C1C62701BB4D9E2F82DCA45B64AA743AE2074C5256B6FB2B88CCCB64D
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1628-556-0x00007FFE4CA70000-0x00007FFE4CA71000-memory.dmp

Download

memory/1628-555-0x00007FFE4D3E0000-0x00007FFE4D3E1000-memory.dmp

Download

memory/3388-97-0x00007FFE4CA40000-0x00007FFE4CA41000-memory.dmp

Download

memory/3388-413-0x0000018B3B9E0000-0x0000018B3BA0A000-memory.dmp

Download

memory/4364-648-0x000001E704600000-0x000001E704601000-memory.dmp

Download

memory/4364-656-0x000001E704600000-0x000001E704601000-memory.dmp

Download

memory/4364-655-0x000001E704600000-0x000001E704601000-memory.dmp

Download

memory/4364-654-0x000001E704600000-0x000001E704601000-memory.dmp

Download

memory/4364-652-0x000001E704600000-0x000001E704601000-memory.dmp

Download

memory/4364-653-0x000001E704600000-0x000001E704601000-memory.dmp

Download

memory/4364-657-0x000001E704600000-0x000001E704601000-memory.dmp

Download

memory/4364-646-0x000001E704600000-0x000001E704601000-memory.dmp

Download

memory/5220-412-0x000001FE9DF90000-0x000001FE9DFBA000-memory.dmp

Download

memory/5260-219-0x00007FFE4CA40000-0x00007FFE4CA41000-memory.dmp

Download

memory/5932-0-0x0000000000C40000-0x00000000016AE000-memory.dmp

Download