3d50ab1e7dd2d34ed14fd70009c36c685f0e88bed2c79744a596b13267c83b15

Analysis

max time kernel
148s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 09:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_a77104d4e30380f63da1f1ddf8b90b04_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
Size 10.3MB
Sample260810-lttc2sfc79
SHA256 3d50ab1e7dd2d34ed14fd70009c36c685f0e88bed2c79744a596b13267c83b15
MD5 a77104d4e30380f63da1f1ddf8b90b04
SHA1 82473a374189aed1925e916b63ebe402d7fc1f31
SHA512 63b074b7d4e73308a71f4b8d9450046ce806da5c9207f3c532b2a7d54c1a0140aee18c10fd7f90c75196aceb25bdd1ecd8653c84f497af3bf628148c2fe45c61
SSDEEP 196608:SgUpHkwuqM9i6m6SSysDRmCbCHj0UED/3FDyVC:2KVqM9i6mtSysDRmCbC/8/pyVC
TLSH
T1A6B6AE22B315C032E96011F1596FBB6A62287D39236088DBF5E19F6D21F56C38B35F1B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

adware defense_evasion discovery spyware trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-08-10_a77104d4e30380f63da1f1ddf8b90b04_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3684_202966708\hyph-da.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3684_202966708\hyph-mn-cyrl.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4728_1888127979\model.markov	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3684_915093870\Filtering Rules	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4728_201564640\Mu\Content	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4728_201564640\Sigma\Entities	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4728_1533135726\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3684_202966708\hyph-de-1996.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3684_202966708\hyph-hr.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3684_202966708\hyph-pa.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3684_202966708\hyph-sv.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3684_915093870\Part-RU	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4728_201564640\Mu\Staging	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4728_201564640\Sigma\LICENSE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3684_1887169874\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3684_202966708\hyph-et.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3684_202966708\hyph-fr.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3684_202966708\hyph-mr.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3684_202966708\hyph-ru.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4728_1888127979\surnames.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3684_915093870\Part-DE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4728_201564640\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3684_202966708\hyph-as.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3684_202966708\hyph-bn.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3684_202966708\hyph-la.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3684_202966708\hyph-lt.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3684_202966708\hyph-lv.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3684_202966708\hyph-nn.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3684_202966708\hyph-te.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3684_202966708\hyph-uk.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3684_1887169874\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3684_202966708\hyph-ka.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3684_202966708\hyph-or.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4728_1888127979\english_wikipedia.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3684_915093870\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4728_201564640\Mu\CompatExceptions	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4728_201564640\Mu\Other	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4728_201564640\Sigma\Analytics	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3684_202966708\hyph-eu.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3684_202966708\hyph-hi.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3684_202966708\hyph-ta.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4728_201564640\Mu\Social	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4728_201564640\Sigma\Advertising	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4728_201564640\Sigma\Cryptomining	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4728_201564640\Sigma\Staging	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4728_201564640\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3684_202966708\hyph-gu.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3684_202966708\hyph-hy.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3684_202966708\hyph-it.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3684_202966708\hyph-kn.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3684_202966708\hyph-pt.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3684_202966708\hyph-sl.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4728_1888127979\passwords.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4728_201564640\Mu\TransparentAdvertisers	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3684_202966708\hyph-af.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3684_202966708\hyph-bg.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3684_202966708\hyph-el.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3684_202966708\hyph-es.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3684_202966708\hyph-nl.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3684_202966708\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4728_1888127979\test.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4728_201564640\Mu\Advertising	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3684_202966708\hyph-en-gb.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3684_202966708\hyph-ga.hyb	msedgewebview2.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_a77104d4e30380f63da1f1ddf8b90b04_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	2026-08-10_a77104d4e30380f63da1f1ddf8b90b04_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	2026-08-10_a77104d4e30380f63da1f1ddf8b90b04_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	2026-08-10_a77104d4e30380f63da1f1ddf8b90b04_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe

Enumerates system info in registry 2 TTPs 10 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	2026-08-10_a77104d4e30380f63da1f1ddf8b90b04_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	2026-08-10_a77104d4e30380f63da1f1ddf8b90b04_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	2026-08-10_a77104d4e30380f63da1f1ddf8b90b04_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	2026-08-10_a77104d4e30380f63da1f1ddf8b90b04_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	2026-08-10_a77104d4e30380f63da1f1ddf8b90b04_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\2026-08-10_a77104d4e30380f63da1f1ddf8b90b04_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe = "11001"	2026-08-10_a77104d4e30380f63da1f1ddf8b90b04_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe

Modifies data under HKEY_USERS 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe

Modifies system certificate store 2 TTPs 12 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\SystemCertificates\AdobeCertStore\Certificates\85E2C5B0D9CFF505363FA62A5E8B8C1D76A60B46	2026-08-10_a77104d4e30380f63da1f1ddf8b90b04_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\SystemCertificates\AdobeCertStore\Certificates\4C7C2E87F0BC79A039D39B05F899A1CC521FDE99	2026-08-10_a77104d4e30380f63da1f1ddf8b90b04_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\SystemCertificates\AdobeCertStore\Certificates\4C7C2E87F0BC79A039D39B05F899A1CC521FDE99\Blob = 0300000001000000140000004c7c2e87f0bc79a039d39b05f899a1cc521fde992000000001000000c3050000308205bf308203a7a00302010202046e271780300d06092a864886f70d01010d050030818e310b30090603550406130255533113301106035504080c0a43616c69666f726e69613111300f06035504070c0853616e204a6f736531163014060355040a0c0d41646f62652053797374656d7331193017060355040b0c10436c6f756420546563686e6f6c6f67793124302206035504030c1b41646f626520496e7465726d6564696174652043412031302d3135301e170d3233303830373133343834335a170d3330303830353133343834315a308191310b30090603550406130255533113301106035504080c0a43616c69666f726e69613111300f06035504070c0853616e204a6f736531163014060355040a0c0d41646f62652053797374656d7331193017060355040b0c10436c6f756420546563686e6f6c6f67793127302506035504030c1e41646f626520436f6e74656e742043657274696669636174652031302d3730820222300d06092a864886f70d01010105000382020f003082020a0282020100ad280d5cfb35f4129a580996209e83cd117cab917f7f8b85e353c39899fa07bc7050077db622fe4b43c477c0abb8325a1ee90f76416e2af5cb76ed9ccec153694c6add14358e1c5c45d32db721654781ba134e981ae3b21d56fe739afd397db8101fa65554ad67d9b808d45487d9913bd7cf30e094a948546da75f51395ab7b0f122244976683d87ce6797aaea3d5ee468553fc658b2b9530e33e2aa418950458d4147270f8773e3d93da7df6a1e8f58e439218236d110a658bf5037260d3f596e1f06b9e963f758eca3f99faa454640628e3bc66c16e914aad9bea5a47f954ca0ff73cf4237e8545e5e82f66795493508a6852f4564ef44dbb31b23c27d6dcc54e749094bb404073ed05ab6bf54afadec8ea7b58ce2d935c4b0ec8a054bef86cebfd63faab8fae41104e8bdaf1f3f2474d78e050c8f33510c80abba83c0da198107e47b40cd119b71827a510ae65e9b97d5e617b397cf517cfecbc47a890bbc350c5b631a50f254151d4d84cd512e0f57241e10b1bd1569287a900d4bf4a23532556266bc1c8b1014972f126b20a2e2e7db73774eb822669fc2bcf56d817ee3f5d20f9b029ec62d377d5328000ce5d921c965337c500416a6c3e828ed27ad8ed370f8b9035c322ce75ed6de25002e363475f95e24ad6e30b9350eb2934a431bf09c8b4df073213fd6393192d796022b4275a73e5b4a2bf3b226d6a537e96c450203010001a320301e300e0603551d0f0101ff040403020780300c0603551d130101ff04023000300d06092a864886f70d01010d05000382020100315188a437cb6a526ab679d888ef1051ea301191b36ff818d3e7e1b8cbc8e1c078fc058e0d7bd61b11fd8efef27b411c3f494f6734c286008ffb39d2eecf012929913628c5b160f6ca24fab63068fc48cb91293fc302f3d16f5de8dbdfe3a57abca9a081c4cfa82fa3e06f36a318251a351c5e08fe4f4a286d1ebb4bf87278f7e54faf53e1b37148f19f210136c5f3b5981a89a3aaf8351490555d001aee6c9ab2bd27cc13d162ef6314c47fce2c668e16ed641d2b6871ef3b0afbc8e5e2b93d775049061496057a361c2cd1ed7cbdadd143a0f114e9d5066c6e2f2bfd771b44c8979cf0f094d2d89e104c935ef362eabcccda4559bb33e640b3c1920cf314688fdc639665e8e81f6b9312516d937a6db751fd39e044271432d0e83bfcb5e8df5cbe2a7c15e272e09aa96f939ac7b6655fcfe91e59474b3a4cecf12490cb1f3aa2a80ae53cbe867ccaeff9ca84d487bf438f4213b253148ff8be54caee1e4aa157353f707a966f946e89a8fc8964849eb948bd54b2b2e6d1dd85ba7df45208206472a5aa93860c5ee8f6460739ea3231ec590f09602ff29f09ecedbdbd635cb42670c8288b3f051dd6c393240d0a668b9a2c20bd70f182ce58d152089385ab717c7c624826ec39424050ad45048927d2e771be6f6693055589f3612df47c206d6ae8600f9d60f7aebc5567458d8a423b76d6082ab213fff88584909e76b458ab	2026-08-10_a77104d4e30380f63da1f1ddf8b90b04_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\SystemCertificates\AdobeCertStore	2026-08-10_a77104d4e30380f63da1f1ddf8b90b04_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\SystemCertificates\AdobeCertStore\CRLs	2026-08-10_a77104d4e30380f63da1f1ddf8b90b04_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\SystemCertificates\AdobeCertStore\Certificates\85E2C5B0D9CFF505363FA62A5E8B8C1D76A60B46\Blob = 03000000010000001400000085e2c5b0d9cff505363fa62a5e8b8c1d76a60b462000000001000000bc050000308205b8308203a0a003020102020426c66cd0300d06092a864886f70d01010d0500308185310b30090603550406130255533113301106035504080c0a43616c69666f726e69613111300f06035504070c0853616e204a6f736531163014060355040a0c0d41646f62652053797374656d7331193017060355040b0c10436c6f756420546563686e6f6c6f6779311b301906035504030c1241646f626520526f6f742043412031302d333020170d3138303831373137333831395a180f32303638303830343137333831395a30818e310b30090603550406130255533113301106035504080c0a43616c69666f726e69613111300f06035504070c0853616e204a6f736531163014060355040a0c0d41646f62652053797374656d7331193017060355040b0c10436c6f756420546563686e6f6c6f67793124302206035504030c1b41646f626520496e7465726d6564696174652043412031302d313930820222300d06092a864886f70d01010105000382020f003082020a0282020100b533b875034a0e7563110700e026d838b4ed1369ee54d6db09ebf764a4778ef8a7dc7dfba9386a78e61be8ff8722d2ca1535cc02c111f9fae54fdc09698d22d9d936b3133aab757b596a1c093cf3559f351d3f10dc44fb0f9787e1f685e83dc775c74d0e563f1509071a1d4bcd919d0b9ebaf925867a85e7e5b9b13040760dfbe2a9bd70e028963dd69631e9cf2f5ca3a6634ac8bfe2dae5cde9df35e935b4f88a17fc78786052badf6e5a378e34a16d16ec7eeb69bf0917fd7210ae129ae2b5f3473e28ea73e25e81176229f0ad99b74069cf6c30413ab85d86f7fec519e01806a928cf2e5ea9c9aae9f57a60401e76313fd017bbe23541b455da6c7d49e39f6b451a67ea2160056781067c489526d297410ac05e87fbeca66d75bda1eaeec9652891598957f4c19fb53ec491b1d600d1ad75d7c164d613ba6ce275682f44399515c247d11d72dc440fd800225a13ae8d16494eaa9f1f82120d2f51243683d2aa62cdcf5be075720b7d566eadb5e46ee3299b43296a49bf3fbe2e672e72e42e7918e608466028de4f215cd362cfd921200ff946168717d09af99095950812f5a4de4073e2c5697a318b9eb51a585a36e74dbd8fb7277c8aeb7ddd42ffbeb32c181f9edaddc1480b95f16e7ea37d0dab3f2f5009d570aa4624b66a7017c75f1caa7c544e15def0c6e6cf6a4f26312b68f633b7a5a4203c97e77a32141e7cf4970203010001a3233021300e0603551d0f0101ff040403020204300f0603551d130101ff040530030101ff300d06092a864886f70d01010d050003820201005bd66c82ca184490136b886ef3b5f5b6866768c8cfd13f701025aeb8dc8b7b4539c071032663327f1b55d773e062ea01551038bc12895b4a760a23ec0ef1e24c1d25649b12dad880b576a952ba1f9d1ed0c5bdf45e8a9f9465c091e22ff7165912fba642b3e2979897339ab2ae511615d3e20b27e3e60e13fe188c7c7119f14029ccfaf1e9fef5c7e53ce1c0d1cfcb8507131c446af5b7f67b701e1ee4151cadd14048737cf0ec86f8964d75b8509bf07a984441641622568d5ea1b9124101db76c578bee86acdb651a90b5c3abdab541f3a41e82cbfc0d30319e1975924540a71e8d1a3603caade3cefcf0b362b62fa09efe97827276b0b79f58553136c89aa72a9f3f7fdaa87e5789978abe6af28c04f7d673954594329ace012159c5ee6b2cb43b55f507e0e0f68233e8a3c6fe13a2cb23b4f38ddecaeae21e99bd6e152793ad59b8286256ede041654cb8a7c069d773868f8bddea44fccdcfc4c0cfec6f9357093024d88519a40bdb3b77b0988051418fcba0a67c5caabc66f21d094e5d612dd7f951291892a4f8ef35efdb2c9d940fcbddfdb75d19b1b215a36dec147c9d716bb4a06047e90d0d0fad64a56f24a6b650843d5cdd2aba7e8894b4693d775aebc8d65063d1813b0be5c9c6357c43be7aea9b3b6021935acc2b8f38746aeab5eaa06f447be0cfff20b38811e273023cd035f14ad3a7babee646909282cc3ef	2026-08-10_a77104d4e30380f63da1f1ddf8b90b04_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\SystemCertificates\AdobeCertStore\Certificates\A5C8D928986EC17FCC7D5F2353885D1709B73A29	2026-08-10_a77104d4e30380f63da1f1ddf8b90b04_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\SystemCertificates\AdobeCertStore\Certificates\A5C8D928986EC17FCC7D5F2353885D1709B73A29\Blob = 030000000100000014000000a5c8d928986ec17fcc7d5f2353885d1709b73a292000000001000000bc050000308205b8308203a0a00302010202047ce3bf47300d06092a864886f70d01010d0500308185310b30090603550406130255533113301106035504080c0a43616c69666f726e69613111300f06035504070c0853616e204a6f736531163014060355040a0c0d41646f62652053797374656d7331193017060355040b0c10436c6f756420546563686e6f6c6f6779311b301906035504030c1241646f626520526f6f742043412031302d333020170d3138303831373137333831355a180f32303638303830343137333831355a30818e310b30090603550406130255533113301106035504080c0a43616c69666f726e69613111300f06035504070c0853616e204a6f736531163014060355040a0c0d41646f62652053797374656d7331193017060355040b0c10436c6f756420546563686e6f6c6f67793124302206035504030c1b41646f626520496e7465726d6564696174652043412031302d313530820222300d06092a864886f70d01010105000382020f003082020a0282020100a0e7345276469020a420dfb0569684d7adf0f493a0a0a53742c25e1bf39a91a481ae07efcf40586a5b42a776dad12710078884bfcb2c3af2bdd70b4301490e58de99cb28b1dc5befd617dadfc34c653d9ef643ff6fd9069cb2ad740ebf1abc42c9fabb8a65cd0d76e9b0b64c77ec0e9350da1ba5f3aabbad9e076e2aebb3af34809dd50bb29cb26577536791a0c672c843fd11a60ce5aa99e0ac5ff81819ab8d4306e790040b6d9d4eb9e37b88d9bdfd8271ee8ba557aff9ec66da32c1f483cc84e0e9af352f5fd083e0933047a13529568e22491266b576b50af641676031593285135758d3f86467159b00ff3662b885dc7a331a1b658c42ae8e76101a67abf22002b4ccf330b966d05f63a91870ef56916ff131a0b8737e111413bc3620c593d5c1452012ec77d77b99240ab972c2fd0d20474bb9c63f1053cfded7de55d57e2d735ac280e1faa8f8af095fb29d5b03b7e45ff8c6d1a7c052e0854418d27c9adb3e40032000e988fd8f6f556bd956e85eed4e7c4d1916c4fc090c27e6b1a3bdaadf8eda48c81b212feee1f1b97ebe4b2ed98b49662c101efdb212720d73a7a432af6d816c7997a5485dae77209f060718e50c524d089750a51bfab47e04fccbf04017762c3597fa5b52b2394b7159053034065e17c184c25736ac793c6e2b25e04d59dc1fe74f9e338c719573d6d6b4b29ea7adbc259e5d4fb4d0fa89a92b0203010001a3233021300e0603551d0f0101ff040403020204300f0603551d130101ff040530030101ff300d06092a864886f70d01010d05000382020100501c3b74f2e4857d8171cffe355895c8241c0590b0f5a81321aad9b328916dc68479ed41c47396336cae923db8c14276504c81f99ee5d961fae32ea75fa707717fe6d3a0cdea05bd40c1d69f21a619b09209f09be929c02125020d7eb9e94670ef57bc02080be6718832fd9f5e7fbfd1bd75c278665582452f66a282d7bcb7936bc336ff64ab06a4a5f12f4a4592dd13ac944fc5a2dd8b084fa429d2eecc10fd7e9a5be17b8c235a12c3e48e0df101837bcd4563cac3e02d7b93e172847881db7ed7e3c01e5e426fe51ee67262154daba09ea358bd10e8d10a9028e6dded33fa8c0b5e5e88d751a73bc68cbd30ebed017024affcc1a3942010531a398ea8120158d78c214e813d6023ec021e80967de3131284f80d0650b1a068d7c5e2bf7f8e019c70db26ee5f0d1719240c7a06c66344d95749b73aff74d6471d97297a248370f30b76d15d576e24fc4f2ac5960eb03d44d9fd145415eb99960802ff81c17439d9594187ffeb98e6e6f1ec11b44fb24eaadfcc1e9107e03eafb42bc717d3a0db4a73c66f0a22c7924a400b02742ea8609051927fac69131dba15df08d152e226764f30438bdb422a895c7d0e60b1da26370806914e4cc1dac1777385d470c81292d597def9c7bbdbca6ed5d8a36cbd97c159590fd075b93c32a22e2405fad8c239b66cdc016e3ffe13c191065ecfefcabdaac7164846611cf24ac9506e7af7	2026-08-10_a77104d4e30380f63da1f1ddf8b90b04_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\SystemCertificates\AdobeCertStore\Certificates	2026-08-10_a77104d4e30380f63da1f1ddf8b90b04_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\SystemCertificates\AdobeCertStore\CTLs	2026-08-10_a77104d4e30380f63da1f1ddf8b90b04_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\SystemCertificates\AdobeCertStore\Certificates\686DF0A4A89F7CB6BFB4D33C6A48E2EE5FB6C4FB	2026-08-10_a77104d4e30380f63da1f1ddf8b90b04_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\SystemCertificates\AdobeCertStore\Certificates\686DF0A4A89F7CB6BFB4D33C6A48E2EE5FB6C4FB\Blob = 030000000100000014000000686df0a4a89f7cb6bfb4d33c6a48e2ee5fb6c4fb2000000001000000c3050000308205bf308203a7a003020102020401cfbd1c300d06092a864886f70d01010d050030818e310b30090603550406130255533113301106035504080c0a43616c69666f726e69613111300f06035504070c0853616e204a6f736531163014060355040a0c0d41646f62652053797374656d7331193017060355040b0c10436c6f756420546563686e6f6c6f67793124302206035504030c1b41646f626520496e7465726d6564696174652043412031302d3139301e170d3233303830373135313132375a170d3330303830353135313132355a308191310b30090603550406130255533113301106035504080c0a43616c69666f726e69613111300f06035504070c0853616e204a6f736531163014060355040a0c0d41646f62652053797374656d7331193017060355040b0c10436c6f756420546563686e6f6c6f67793127302506035504030c1e41646f626520436f6e74656e742043657274696669636174652031302d3830820222300d06092a864886f70d01010105000382020f003082020a0282020100d119f9b8d2d41d892abf9f1f3cd1f947141b9867e9be6d96e479c74c87e42f61f5b927bccb7caebe27b26465b8e2f1118c2041980b88d7f559b8f9d041110e19f29ce5033fe9b8184d47982257e97d1b62744521bc329a7861a2376eeb8f3248eb031a7b43b1f22174fcc3c642033770137cad8329b240970127edd3030d9a69af242fc7405b5867d0f5950bb0b79f702e84180ee43ca21f46adce07ad014f5cfd7be25e735eb0431889bcce40a4e94791fca5a65da24838d189b85218c9961eb1bce8db4cb2ffc7a2c3419788e68098350cacc6aa61dfb3d8476454927f9ab767037a84ed4e39862b3f386a065b169403259617150679e34af188035d8bebd9f4f22544cbf81f0d0516799d39a17a56c12e5c151945d65084367647c6f6a78ade46f7bcc0b8aca7d8abfe3eb34ab2d1fb7800a98da86c8da956b267e309634d55ff7f6570f9b926bd602d4a94e77c662d1479c576b972d87bb35ea634b5f676774d40e04a0a908948c269c7dc71778ed5d15d9b8f4519ee858bc273a49afc7a206afd97286716b832e64154a074305d7bbcb7f2205017d1ed5ca6e42edc6d35fabc88dd188028b15e5aa5296e12c03486a80a6e3cb0c001e4742b1edf02fa70c2ebdcbec606480054fc467729e99d1eb80bee04b36fb17c722068079146fde54b06c3ec5c4bafaf113d2000ef36aebe8454560e81d0cf982a798bae3c39cd430203010001a320301e300e0603551d0f0101ff040403020780300c0603551d130101ff04023000300d06092a864886f70d01010d050003820201006bf0137ee63d74f0df4ee19376625ac33574898a025b764e9bd69f8c7d9fa1c7f9b58f0355f206cab84927d626275a8fd0d1c6a3b9a7811b361a68523ad86199ec1188922ce525246bfef1b4dd23eb5b8ee0894d4495ceb1c0f27bca3812c7c02432f9a693c7a331c53162a76c687c0ff60b31389a0e11f9da1fd8ceae91ff671222083643e0a7c0b97f170ab051856ab58c8b3278d16753cfaac05cec9a08c0fcc2e993aaea79225d70e9ec8bfb53c93be8915b2026a35bf05d3c9e5e417fabc5648d9fd8f153e8787f1e3cdd637fe2abd8c8a5d1c9171c342e588a77ff2739dc6b88c79dc933dedf535c496ba652a184b6b65b831aa7706251494108d58f8565624e37a343696f2e42c029333dab8b1a9e34bda64b58546906e9bd3f0d67f3cb830e8b6bf3b01f653c938da93b53a6878a14fe75550b546d580fa40f0e6e6fac25113513f48c9fc79b27689b906afd59d11abbdf4fde466d2a93431606db3938d9e9f7505d1a0cd91e4f116a2f3e1837ba0c1ab0cc74724916a65d9b2c09b00eef96bda7156f789449923371b5aac2a6728b0b3e71ac656ebc820bad65977cebaf56611c8d322c78af95c5dc1c2e56d95eca6efb5664010860dd6c82faf60a9cd493eecc6b013449633928d96bb0d38f28f838564db989958ecfd5325fa51f8ec4148545c5a94705beb7200b427f978959cc7a031fe58f7e2f42ad48e3bb82	2026-08-10_a77104d4e30380f63da1f1ddf8b90b04_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
4508	2026-08-10_a77104d4e30380f63da1f1ddf8b90b04_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
4508	2026-08-10_a77104d4e30380f63da1f1ddf8b90b04_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
4508	2026-08-10_a77104d4e30380f63da1f1ddf8b90b04_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
4508	2026-08-10_a77104d4e30380f63da1f1ddf8b90b04_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
4508	2026-08-10_a77104d4e30380f63da1f1ddf8b90b04_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
4508	2026-08-10_a77104d4e30380f63da1f1ddf8b90b04_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
4508	2026-08-10_a77104d4e30380f63da1f1ddf8b90b04_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
4508	2026-08-10_a77104d4e30380f63da1f1ddf8b90b04_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
4508	2026-08-10_a77104d4e30380f63da1f1ddf8b90b04_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
4508	2026-08-10_a77104d4e30380f63da1f1ddf8b90b04_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
4508	2026-08-10_a77104d4e30380f63da1f1ddf8b90b04_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
4508	2026-08-10_a77104d4e30380f63da1f1ddf8b90b04_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
4284	msedgewebview2.exe
4284	msedgewebview2.exe
2408	msedgewebview2.exe
2408	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
3684	msedgewebview2.exe
4728	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	4508	2026-08-10_a77104d4e30380f63da1f1ddf8b90b04_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
Token: SeIncreaseQuotaPrivilege	4508	2026-08-10_a77104d4e30380f63da1f1ddf8b90b04_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
Token: SeIncreaseQuotaPrivilege	4508	2026-08-10_a77104d4e30380f63da1f1ddf8b90b04_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
Token: SeIncreaseQuotaPrivilege	4508	2026-08-10_a77104d4e30380f63da1f1ddf8b90b04_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
Token: SeIncreaseQuotaPrivilege	4508	2026-08-10_a77104d4e30380f63da1f1ddf8b90b04_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
Token: SeIncreaseQuotaPrivilege	4508	2026-08-10_a77104d4e30380f63da1f1ddf8b90b04_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe

Suspicious use of WriteProcessMemory 50 IoCs

description	pid	Process	procid_target
PID 4508 wrote to memory of 3684	4508	2026-08-10_a77104d4e30380f63da1f1ddf8b90b04_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe	90
PID 4508 wrote to memory of 4728	4508	2026-08-10_a77104d4e30380f63da1f1ddf8b90b04_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe	91
PID 3684 wrote to memory of 800	3684	msedgewebview2.exe	93
PID 4728 wrote to memory of 1980	4728	msedgewebview2.exe	92
PID 3684 wrote to memory of 5824	3684	msedgewebview2.exe	94
PID 3684 wrote to memory of 5824	3684	msedgewebview2.exe	94
PID 3684 wrote to memory of 5824	3684	msedgewebview2.exe	94
PID 3684 wrote to memory of 5824	3684	msedgewebview2.exe	94
PID 4728 wrote to memory of 1428	4728	msedgewebview2.exe	95
PID 4728 wrote to memory of 1428	4728	msedgewebview2.exe	95
PID 4728 wrote to memory of 1428	4728	msedgewebview2.exe	95
PID 4728 wrote to memory of 1428	4728	msedgewebview2.exe	95
PID 3684 wrote to memory of 5484	3684	msedgewebview2.exe	96
PID 4728 wrote to memory of 3116	4728	msedgewebview2.exe	97
PID 3684 wrote to memory of 1852	3684	msedgewebview2.exe	98
PID 3684 wrote to memory of 1852	3684	msedgewebview2.exe	98
PID 3684 wrote to memory of 1852	3684	msedgewebview2.exe	98
PID 4728 wrote to memory of 4396	4728	msedgewebview2.exe	99
PID 4728 wrote to memory of 4396	4728	msedgewebview2.exe	99
PID 4728 wrote to memory of 4396	4728	msedgewebview2.exe	99
PID 3684 wrote to memory of 6020	3684	msedgewebview2.exe	100
PID 3684 wrote to memory of 6020	3684	msedgewebview2.exe	100
PID 3684 wrote to memory of 6020	3684	msedgewebview2.exe	100
PID 3684 wrote to memory of 6020	3684	msedgewebview2.exe	100
PID 3684 wrote to memory of 6020	3684	msedgewebview2.exe	100
PID 4728 wrote to memory of 1228	4728	msedgewebview2.exe	101
PID 4728 wrote to memory of 1228	4728	msedgewebview2.exe	101
PID 4728 wrote to memory of 1228	4728	msedgewebview2.exe	101
PID 4728 wrote to memory of 1228	4728	msedgewebview2.exe	101
PID 4728 wrote to memory of 1228	4728	msedgewebview2.exe	101
PID 3684 wrote to memory of 4988	3684	msedgewebview2.exe	107
PID 3684 wrote to memory of 4988	3684	msedgewebview2.exe	107
PID 3684 wrote to memory of 4988	3684	msedgewebview2.exe	107
PID 4728 wrote to memory of 2408	4728	msedgewebview2.exe	108
PID 4728 wrote to memory of 2408	4728	msedgewebview2.exe	108
PID 4728 wrote to memory of 2408	4728	msedgewebview2.exe	108
PID 3684 wrote to memory of 2824	3684	msedgewebview2.exe	109
PID 3684 wrote to memory of 2824	3684	msedgewebview2.exe	109
PID 3684 wrote to memory of 2824	3684	msedgewebview2.exe	109
PID 4728 wrote to memory of 1596	4728	msedgewebview2.exe	110
PID 4728 wrote to memory of 1596	4728	msedgewebview2.exe	110
PID 4728 wrote to memory of 1596	4728	msedgewebview2.exe	110
PID 4728 wrote to memory of 4284	4728	msedgewebview2.exe	111
PID 3684 wrote to memory of 2408	3684	msedgewebview2.exe	112
PID 3684 wrote to memory of 3344	3684	msedgewebview2.exe	113
PID 3684 wrote to memory of 3344	3684	msedgewebview2.exe	113
PID 3684 wrote to memory of 3344	3684	msedgewebview2.exe	113
PID 4728 wrote to memory of 1716	4728	msedgewebview2.exe	114
PID 4728 wrote to memory of 1716	4728	msedgewebview2.exe	114
PID 4728 wrote to memory of 1716	4728	msedgewebview2.exe	114

C:\Users\Admin\AppData\Local\Temp\2026-08-10_a77104d4e30380f63da1f1ddf8b90b04_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_a77104d4e30380f63da1f1ddf8b90b04_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe"
1⤵
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4508
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=2026-08-10_a77104d4e30380f63da1f1ddf8b90b04_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe --webview-exe-version=2.14.0.82 --user-data-dir="C:\Users\Admin\AppData\Local\Adobe\webview2\2026-08-10_a77104d4e30380f63da1f1ddf8b90b04_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=1 --allow-file-access-from-files --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=4508.2920.15438271726048232297 /pfhostedapp:27b5d0d04ebd00a3e20db0a94a078ca167b674f0
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:3684
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Adobe\webview2\2026-08-10_a77104d4e30380f63da1f1ddf8b90b04_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe\EBWebView /prefetch:4 /pfhostedapp:27b5d0d04ebd00a3e20db0a94a078ca167b674f0 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Adobe\webview2\2026-08-10_a77104d4e30380f63da1f1ddf8b90b04_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x188,0x18c,0x190,0x164,0x198,0x7ffc7f6c5fd8,0x7ffc7f6c5fe4,0x7ffc7f6c5ff0
    3⤵
    PID:800
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Adobe\webview2\2026-08-10_a77104d4e30380f63da1f1ddf8b90b04_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe\EBWebView" --webview-exe-name=2026-08-10_a77104d4e30380f63da1f1ddf8b90b04_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe --webview-exe-version=2.14.0.82 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1712 --field-trial-handle=1716,i,6797619302983336185,13671940806885202127,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:2 /pfhostedapp:27b5d0d04ebd00a3e20db0a94a078ca167b674f0
    3⤵
    PID:5824
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Adobe\webview2\2026-08-10_a77104d4e30380f63da1f1ddf8b90b04_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe\EBWebView" --webview-exe-name=2026-08-10_a77104d4e30380f63da1f1ddf8b90b04_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe --webview-exe-version=2.14.0.82 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --no-appcompat-clear --mojo-platform-channel-handle=2540 --field-trial-handle=1716,i,6797619302983336185,13671940806885202127,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:3 /pfhostedapp:27b5d0d04ebd00a3e20db0a94a078ca167b674f0
    3⤵
    PID:5484
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Adobe\webview2\2026-08-10_a77104d4e30380f63da1f1ddf8b90b04_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe\EBWebView" --webview-exe-name=2026-08-10_a77104d4e30380f63da1f1ddf8b90b04_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe --webview-exe-version=2.14.0.82 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --no-appcompat-clear --mojo-platform-channel-handle=2432 --field-trial-handle=1716,i,6797619302983336185,13671940806885202127,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:27b5d0d04ebd00a3e20db0a94a078ca167b674f0
    3⤵
    PID:1852
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Adobe\webview2\2026-08-10_a77104d4e30380f63da1f1ddf8b90b04_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe\EBWebView" --webview-exe-name=2026-08-10_a77104d4e30380f63da1f1ddf8b90b04_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe --webview-exe-version=2.14.0.82 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3392 --field-trial-handle=1716,i,6797619302983336185,13671940806885202127,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:27b5d0d04ebd00a3e20db0a94a078ca167b674f0 /prefetch:1
    3⤵
    PID:6020
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Adobe\webview2\2026-08-10_a77104d4e30380f63da1f1ddf8b90b04_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe\EBWebView" --webview-exe-name=2026-08-10_a77104d4e30380f63da1f1ddf8b90b04_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe --webview-exe-version=2.14.0.82 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --no-appcompat-clear --mojo-platform-channel-handle=4552 --field-trial-handle=1716,i,6797619302983336185,13671940806885202127,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:27b5d0d04ebd00a3e20db0a94a078ca167b674f0
    3⤵
    PID:4988
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Adobe\webview2\2026-08-10_a77104d4e30380f63da1f1ddf8b90b04_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe\EBWebView" --webview-exe-name=2026-08-10_a77104d4e30380f63da1f1ddf8b90b04_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe --webview-exe-version=2.14.0.82 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --no-appcompat-clear --mojo-platform-channel-handle=4660 --field-trial-handle=1716,i,6797619302983336185,13671940806885202127,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:27b5d0d04ebd00a3e20db0a94a078ca167b674f0
    3⤵
    PID:2824
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Adobe\webview2\2026-08-10_a77104d4e30380f63da1f1ddf8b90b04_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe\EBWebView" --webview-exe-name=2026-08-10_a77104d4e30380f63da1f1ddf8b90b04_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe --webview-exe-version=2.14.0.82 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4604 --field-trial-handle=1716,i,6797619302983336185,13671940806885202127,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:27b5d0d04ebd00a3e20db0a94a078ca167b674f0
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2408
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Adobe\webview2\2026-08-10_a77104d4e30380f63da1f1ddf8b90b04_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe\EBWebView" --webview-exe-name=2026-08-10_a77104d4e30380f63da1f1ddf8b90b04_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe --webview-exe-version=2.14.0.82 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --no-appcompat-clear --mojo-platform-channel-handle=4688 --field-trial-handle=1716,i,6797619302983336185,13671940806885202127,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:27b5d0d04ebd00a3e20db0a94a078ca167b674f0
    3⤵
    PID:3344
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=2026-08-10_a77104d4e30380f63da1f1ddf8b90b04_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe --webview-exe-version=2.14.0.82 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\{C8319F1C-76A7-4C44-8940-F8C5BE668232}\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=1 --allow-file-access-from-files --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=4508.2920.16570128193016568766 /pfhostedapp:adfc39500decdb1f149e7dd3b417a1b9a2691bf9
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:4728
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\{C8319F1C-76A7-4C44-8940-F8C5BE668232}\EBWebView /prefetch:4 /pfhostedapp:adfc39500decdb1f149e7dd3b417a1b9a2691bf9 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\{C8319F1C-76A7-4C44-8940-F8C5BE668232}\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ffc7f6c5fd8,0x7ffc7f6c5fe4,0x7ffc7f6c5ff0
    3⤵
    PID:1980
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\{C8319F1C-76A7-4C44-8940-F8C5BE668232}\EBWebView" --webview-exe-name=2026-08-10_a77104d4e30380f63da1f1ddf8b90b04_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe --webview-exe-version=2.14.0.82 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1760 --field-trial-handle=1768,i,4682601730804005551,3955059332010398987,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:2 /pfhostedapp:adfc39500decdb1f149e7dd3b417a1b9a2691bf9
    3⤵
    PID:1428
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\{C8319F1C-76A7-4C44-8940-F8C5BE668232}\EBWebView" --webview-exe-name=2026-08-10_a77104d4e30380f63da1f1ddf8b90b04_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe --webview-exe-version=2.14.0.82 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --no-appcompat-clear --mojo-platform-channel-handle=2556 --field-trial-handle=1768,i,4682601730804005551,3955059332010398987,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:3 /pfhostedapp:adfc39500decdb1f149e7dd3b417a1b9a2691bf9
    3⤵
    PID:3116
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\{C8319F1C-76A7-4C44-8940-F8C5BE668232}\EBWebView" --webview-exe-name=2026-08-10_a77104d4e30380f63da1f1ddf8b90b04_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe --webview-exe-version=2.14.0.82 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --no-appcompat-clear --mojo-platform-channel-handle=2572 --field-trial-handle=1768,i,4682601730804005551,3955059332010398987,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:adfc39500decdb1f149e7dd3b417a1b9a2691bf9
    3⤵
    PID:4396
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\{C8319F1C-76A7-4C44-8940-F8C5BE668232}\EBWebView" --webview-exe-name=2026-08-10_a77104d4e30380f63da1f1ddf8b90b04_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe --webview-exe-version=2.14.0.82 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3412 --field-trial-handle=1768,i,4682601730804005551,3955059332010398987,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:adfc39500decdb1f149e7dd3b417a1b9a2691bf9 /prefetch:1
    3⤵
    PID:1228
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\{C8319F1C-76A7-4C44-8940-F8C5BE668232}\EBWebView" --webview-exe-name=2026-08-10_a77104d4e30380f63da1f1ddf8b90b04_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe --webview-exe-version=2.14.0.82 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --no-appcompat-clear --mojo-platform-channel-handle=4684 --field-trial-handle=1768,i,4682601730804005551,3955059332010398987,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:adfc39500decdb1f149e7dd3b417a1b9a2691bf9
    3⤵
    PID:2408
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\{C8319F1C-76A7-4C44-8940-F8C5BE668232}\EBWebView" --webview-exe-name=2026-08-10_a77104d4e30380f63da1f1ddf8b90b04_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe --webview-exe-version=2.14.0.82 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --no-appcompat-clear --mojo-platform-channel-handle=4740 --field-trial-handle=1768,i,4682601730804005551,3955059332010398987,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:adfc39500decdb1f149e7dd3b417a1b9a2691bf9
    3⤵
    PID:1596
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\{C8319F1C-76A7-4C44-8940-F8C5BE668232}\EBWebView" --webview-exe-name=2026-08-10_a77104d4e30380f63da1f1ddf8b90b04_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe --webview-exe-version=2.14.0.82 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2024 --field-trial-handle=1768,i,4682601730804005551,3955059332010398987,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:adfc39500decdb1f149e7dd3b417a1b9a2691bf9
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4284
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\{C8319F1C-76A7-4C44-8940-F8C5BE668232}\EBWebView" --webview-exe-name=2026-08-10_a77104d4e30380f63da1f1ddf8b90b04_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe --webview-exe-version=2.14.0.82 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --no-appcompat-clear --mojo-platform-channel-handle=816 --field-trial-handle=1768,i,4682601730804005551,3955059332010398987,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:adfc39500decdb1f149e7dd3b417a1b9a2691bf9
    3⤵
    PID:1716

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3752

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:3284

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

.adobefeatureflagnotification

Path C:\Users\Admin\AppData\Local\Adobe\.adobefeatureflagnotification
Size 13B
SHA256 e846f39362168bce024ac0d6df571586cf0146d87daa4d558ca3db5f854137f7
MD5 422bdb7b1334bb4524561f872891b49f
SHA1 0116a25599eaf2a0b6b9c90a20be7872efb7b552
SHA512 47345124fc89c9ccbc8f6960bef6300268439e6deb3726185342727042df8f6cee67ab373d5b8668000d2a3a190085995ae59656b38ceacef4161e1af3fb9523
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Adobe\webview2\2026-08-10_a77104d4e30380f63da1f1ddf8b90b04_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 4fa446af98b54a8de0f62893cfea6db846fc54dabe20810bfd036e6242949a9e
MD5 382b96267077713df19de7923c9aaaec
SHA1 88447c7fccacee7646f5170ac67967228f0faf2b
SHA512 5b24c1f984336ecea2eb2bec997f28d159b6ab95730bb07fca48bfd59669b667f6fdcca547e71400cc6156204909fd20f732d02654085e797b877be90a49c637
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Adobe\webview2\2026-08-10_a77104d4e30380f63da1f1ddf8b90b04_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 b5c0ebbf1d0d3fa76e395742353659daffa21d527920a225515ea67fbc9dfd32
MD5 6c5913f1f44299048811770932c2f594
SHA1 a1ecb158dbb9f080424d4856b9fb86d3822672e2
SHA512 a3670cea5082d7b7f84e7fde7d92da19c3be477f740c4d0802cd254783fe6787e3e29ef19b61997cf8396ec6fcb68ad46b2eb277fb317ef9d9f8cc89fa04a204
TLSH
T1ADD0121676910634C4503133002275491D41C30B8105600458699A5D1E48050094AC81
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Adobe\webview2\2026-08-10_a77104d4e30380f63da1f1ddf8b90b04_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Adobe\webview2\2026-08-10_a77104d4e30380f63da1f1ddf8b90b04_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe\EBWebView\Default\Network\Network Persistent State
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Adobe\webview2\2026-08-10_a77104d4e30380f63da1f1ddf8b90b04_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe\EBWebView\Default\Network\Network Persistent State
Size 230B
SHA256 27c739561615160aaec0e7ed7f318ddb661114fd768ee1f72dcccbe4e82ea588
MD5 75ad241bc81224195f620e20abcad795
SHA1 ee4b68e146b88c8b3c128a837611f006e512bab3
SHA512 d47860e196e7b0a406bbda570f28058ad5c36d6991b3523074345e144e093a9e81416ca2f147ca3210932d591351ebd2f3fd5335b55087d091815b5476ebd1b5
TLSH
T1EFD0A77A466019FE075543A05928B81BCEBE5003021CFDBA95347B6A83761B8901458B
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Adobe\webview2\2026-08-10_a77104d4e30380f63da1f1ddf8b90b04_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe\EBWebView\Default\Preferences
Size 6KB
SHA256 58882990b4e06be5b3bb832bfc1ca358d3bfe74292c0107d601bc1ac61d6245d
MD5 83f987bbeae67c45935a31ab661df415
SHA1 74174e5001ceab9de62f462dfcfd52ce7a9b8c1f
SHA512 65919f98125c1badf1a3a9a566024860d788ad4645ee8627dea501817d8785b52ba97eeab2190cc0713f700e1ea9b32c1f70fa0e0ae009bdf792829ed2376155
SSDEEP 96:stt/dAFeGZTb9pkYo5h16Zdrs7/x+6MhmuecmxiecK+gwlm+28XM1C7K:stxSpposrsV+FixigIm+G6K
TLSH
T1B1D175025E28787B4CCBE519BA29BA53D2F9603265D51E58E7FC462C08EB5DC131790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Adobe\webview2\2026-08-10_a77104d4e30380f63da1f1ddf8b90b04_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe\EBWebView\Default\Shared Dictionary\cache\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Adobe\webview2\2026-08-10_a77104d4e30380f63da1f1ddf8b90b04_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Adobe\webview2\2026-08-10_a77104d4e30380f63da1f1ddf8b90b04_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe\EBWebView\Default\Sync Data\LevelDB\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

e6cd594e-b8bc-4cc6-8538-fc961b1030db.tmp

Path C:\Users\Admin\AppData\Local\Adobe\webview2\2026-08-10_a77104d4e30380f63da1f1ddf8b90b04_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe\EBWebView\Default\e6cd594e-b8bc-4cc6-8538-fc961b1030db.tmp
Size 6KB
SHA256 a5544cd1cd08bd070af4874dcbcf3e773554c1dec1ba3a3934a8e9a1c388807a
MD5 0786d70d879175809524bb34f968e336
SHA1 49a2632a49eba99b37b7795fc8f2b362fa1f80c0
SHA512 32ff009fd72a2856e7a9188c51f5326a580388d7f1972a0c216b7fef7b77dce16cdec6d8af0ab3b48beb34fedae977f6df9dd730d3a02a51509e3fdceb341e1a
SSDEEP 96:stt/dAFfZTb9pkYo5h16Zdrs7/x+6MhmuecmxiecK+gMm+28XM1C7K:stxSzposrsV+Fixigmm+G6K
TLSH
T136D175025E28797B4CCBE519BA39BA43D2F9603275D51E58E7FC862C08EB5DC231790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Adobe\webview2\2026-08-10_a77104d4e30380f63da1f1ddf8b90b04_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe\EBWebView\Local State
Size 15KB
SHA256 999fa886119be669fb3b5fe54a5f15e9246d0b54dcb3f77f6d2eb0931ce871d1
MD5 1a477b1b5067df6550f22dbc9f120579
SHA1 4ed50457db5d8ade4bda044ba6ec64199e5094a4
SHA512 4fc9225819bc1019861a724b9376e57a476de18db790e0d0b4347555dd621ec5cc10c7d8e4c5e80f4076430a62474cbce5817b544f962ffba340cfb039196a71
SSDEEP 384:Z+aQikB+z/xvxjg/qhEwNBSdgR4D+CSDRAVdpowdY9zU:E/UxvxjgC+VuarcRUcFU
TLSH
T138729E2B546D7E3395F7EA05795D578BCEFD84B290817EA84AFD6F0D06C72980302C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Adobe\webview2\2026-08-10_a77104d4e30380f63da1f1ddf8b90b04_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe\EBWebView\Local State
Size 3KB
SHA256 e29d807e66f218a26afdd7a1ff7391e24e0c67619256fd0acabb9da554a177a0
MD5 d2679e4512d04bbb8a29a1fe877e67ce
SHA1 f55df2009d4fe8f7466fbf550b0b1526b9b1a032
SHA512 f51786d10be7125565694f2605bd2be1adbaa29e11e34896a608bdef31fe1894dfb6a98fbc05252bebbd1f680dab2f3e0f2ca05be5395785173f4b810a09e8d9
TLSH
T1CF6185276974EA374EF3CA09B98A3B12EAAA4027E5953F95D6EC0F0C01D729C1341C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Adobe\webview2\2026-08-10_a77104d4e30380f63da1f1ddf8b90b04_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe\EBWebView\Local State
Size 2KB
SHA256 d2ee8f9f59564b8f5e8414104019778404ceb6262cc03a719e0cb9f759dfc196
MD5 38fd940a78b1249e85473abbcdfa08ba
SHA1 6a5bc39e8b706496c597dd808dd7b36ce5ace8c5
SHA512 a755d1e3ca88dcd9dce8ae2f452b88aedf771b60ef3b8995ef35b23f2bd98d75a683337917d022f9ab2c176111a15d565e069b5583844396a448d43785bc4c23
TLSH
T1D15197736918AF3789F38B08795F3B13CE7A90669A222F50D6ED1B0C01D656D1301C76
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe593128.TMP

Path C:\Users\Admin\AppData\Local\Adobe\webview2\2026-08-10_a77104d4e30380f63da1f1ddf8b90b04_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe\EBWebView\Local State~RFe593128.TMP
Size 1KB
SHA256 e3db868c79721a8eb32a3fb919fc39f8536e78de20ad21da295b221e886fcd24
MD5 a73766e8464658d15445375c54410080
SHA1 3ab6bdab108553b6ad9a8fd036d7f18897f8a3bf
SHA512 35be8a19627a412b348f71ac5d9a0d2e0f17c838aff523d2a48eba452ca7cb20dfe4eddecc8d42c934b608a610e4ce3edc380dea0ac867fada11af77101a684d
TLSH
T1602187B3D0649F32DDE25749625B7B539D76803741214F04F1EE4B1C01D555DD226936
MD5 SHA1 SHA512 TLSH

Submit Download

CCDInstaller.js

Path C:\Users\Admin\AppData\Local\Temp\{C8319F1C-76A7-4C44-8940-F8C5BE668232}\CCDInstaller.js
Size 1.8MB
SHA256 6fbc27170c290f8d52cab90c67a989fee43596ef66732769fa428d649968e524
MD5 aed5b29fc11bb303efb576761e8155ce
SHA1 e7ebd7384dedc2981c8203255d2728974d4053ea
SHA512 073e52ed2789814793137807528aec2382d0ad26a4609f4ee5bc03fbf0a70672c5190fa771109c1d8852361f628a39bde18309ba12f5bb1e10bcec5a127fc142
SSDEEP 12288:foG7938dDXSUinTsdhAaKZwH1CVeXFmkxtXsLqHL1qCUgFwigkiqloSb2eL2LI:xsrPdhAJwHsKFmkx+ZCUgFZlN2et
TLSH
T1C795F77F74E5A872AF803096009BB40FB7753539738084A89955CF9C92E6B8D4B0BE5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5d00d811-35aa-4022-b340-118b59c28276.tmp

Path C:\Users\Admin\AppData\Local\Temp\{C8319F1C-76A7-4C44-8940-F8C5BE668232}\EBWebView\5d00d811-35aa-4022-b340-118b59c28276.tmp
Size 15KB
SHA256 f12fe46473299e570079bffec190b39d628b43302b7939ff68431405c7975b21
MD5 600890fec5526d15a83e727e249a41f7
SHA1 9406f20287e840b78f5fd1a3b7d8e7d4b53682c7
SHA512 8de263cf9143e0b8ca4b3b7638ecf3ceb2abfcb660924ef9239a4a0bd7a2650cdd0cdfabd17aebe7aa6a19a5e6606316afe748d09f5f7428f30d1ddadc06f031
SSDEEP 384:h+aQikB+z/xvxjg/qhEwNBSn7u1d7AVdpowdt9zU:s/UxvxjgC+z27U5FU
TLSH
T1F272AE2B946D7E27A5F7EA05794D478BCFF884B290C16DB84AFC6F0D06C72981302C12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\{C8319F1C-76A7-4C44-8940-F8C5BE668232}\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 e6fcb9e8c20e8da4c90d812e9ed3a51141705c8219041aa34a795bcd161591bb
MD5 beee69d62ce615cebc862318714237de
SHA1 6b0b6d3c4cbff5d6546eeed2f97bc9c81acc7448
SHA512 ec330f4d26824a3834b2df4fa40ea2d92db4b812c754a5b17b41dfb94029f47685c5ad60c045f762d659963c8a9bbc2b8dba58cbf646561c1e51be748db1ca95
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\{C8319F1C-76A7-4C44-8940-F8C5BE668232}\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 9907df2666bb71e28da8dee3a5e8981a90d7f233ab740f7640631b8f242d1857
MD5 00bda16f8c96138f6038a45ab9386977
SHA1 36c14c3ea516d0499d71d968d305f64987f4bf75
SHA512 5ed96168793ad1efa1c1294a65e1d674390a40d45585ed0e2af7377d2071cee344dd47ef362210ce03ba318073f107a6059b10ca69a129bea6f0ae163695a7ad
TLSH
T141D0121237025134C86020731186714C0601D30B8009420054288E1D1E540E02907451
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\{C8319F1C-76A7-4C44-8940-F8C5BE668232}\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 264B
SHA256 a796167fd553c3648642db7cb3ca3f5522b11d043e65b4ceec518e3e0252b574
MD5 14bfbd3c7f226a8c37374f3716ba68ac
SHA1 0be43d93099a80f056e7d5d0673252774cec741c
SHA512 819484d13a89b4ab97cb6eaf0faa3c79e2a6a4f6c880d3e110857341c7d7b1e11b3c29e2066566674fe92a75a054efa34ed1093d41cd68dcedd9f1d718863463
TLSH
T1F4D012915497F157DB1126B12AC7CD77B7F59D1942630F017B782F384D3039DAE48642
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\{C8319F1C-76A7-4C44-8940-F8C5BE668232}\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 240B
SHA256 5183ad91c15f05cb498f113518b1d568933e4e82e7cf9cea857fcaee0d1232bb
MD5 1f02130ffe7b396740602edfc6439b81
SHA1 62f0c2910c89dea17829caf8051097e093ee0425
SHA512 5defedf39bcf26c5da0749e2981a3400410426470688d236bc6c591f4b0a81f2873e5878bb91af8af6870cee0d3ef406e4f2ce1586f6c5e20c70649d25d93847
TLSH
T1CFD012612087F162CB1126F127C38827B2B0CD1503530E02A7581E348C3139DAE85541
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59baea.TMP

Path C:\Users\Admin\AppData\Local\Temp\{C8319F1C-76A7-4C44-8940-F8C5BE668232}\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe59baea.TMP
Size 48B
SHA256 c8f18406bc0988559d5f2712662522e98e19b91210dba0308ef7fbd619d18448
MD5 4da3e3ca6adaa9356d91228862ac7807
SHA1 507b99c23afe09ff9ddf2381d541ebb00fe5fe72
SHA512 d71c1c427e21e127bdb4f3fec792947c1302345888769b616f5a3991e73bc1e80df8e33e688ab8c40f10deb3322f280440d7d3ffcf6c7226806ba9cd58eca333
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\{C8319F1C-76A7-4C44-8940-F8C5BE668232}\EBWebView\Default\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\{C8319F1C-76A7-4C44-8940-F8C5BE668232}\EBWebView\Default\GPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\{C8319F1C-76A7-4C44-8940-F8C5BE668232}\EBWebView\Default\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\{C8319F1C-76A7-4C44-8940-F8C5BE668232}\EBWebView\Default\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Action Predictor

Path C:\Users\Admin\AppData\Local\Temp\{C8319F1C-76A7-4C44-8940-F8C5BE668232}\EBWebView\Default\Network Action Predictor
Size 4KB
SHA256 9827429749037198cb3d19a851ccff2adafad344fbade7220aa022d3c9e2fa85
MD5 9088df5de5b8306c52e744141a100532
SHA1 0aea85a36ef3ddc53df198227fcaf212139ae1db
SHA512 96c0c8ee90bd8aec34ea905f48e76ed7dc370d24f64efaeadf36e9b59b9ff01856ed837b5169241ef2bd4a6b8fe2ee77de443b09b9ee604e39f9ba57929859e8
TLSH
T15C819285F7C02420DA346EF3A4824BBD5E72CA82A5124B93097002D0FCA74ECCC796AA
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Temp\{C8319F1C-76A7-4C44-8940-F8C5BE668232}\EBWebView\Default\Network\Network Persistent State
Size 1KB
SHA256 de10cc08d210390e19ef0db46107e9e9050e2cda54eddaf1e32f9d7f129da942
MD5 47bae95bc3982730df06220f98955aa0
SHA1 716f10e0b757ce4c7bae9011a1bfae9652a26d1f
SHA512 0e8eca2da432065b9618350882b766bab7e4a31b58d3a38d2cef6cbf685f7a06ff362e5ce7032d5b66f6b2b917af625c23c8d6f315545039661e62b300785259
TLSH
T1D83119B783B8152D8A1291F45B18DE1FCF5D1811836CF939C9D16EA7D3E14B1E210F4A
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\{C8319F1C-76A7-4C44-8940-F8C5BE668232}\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Temp\{C8319F1C-76A7-4C44-8940-F8C5BE668232}\EBWebView\Default\Network\TransportSecurity
Size 1KB
SHA256 27c2bb6976ece1a70f80c7a5c33a2aa3be5d2272f5ff9db1d848ad4b298920c4
MD5 9e727285a6ea637a15ff65c94684b712
SHA1 d9b60ac4bddcd4cd00a3794cafef0ecdca21b05e
SHA512 269d09f117658abf4bd7c0cbf83d87289ccf27f872d56b124fd0c54b6e1607c63b302350f675bdd35cd6a2beacd33cf2b29aa9e812bcb57a0aa7ae2edd21ec83
TLSH
T16A317AD3D1BEF46B206D09EB0E48B809597EB871159194F9CBA791BCF0C48B7270641B
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Temp\{C8319F1C-76A7-4C44-8940-F8C5BE668232}\EBWebView\Default\Network\TransportSecurity
Size 1KB
SHA256 6f4576ad19057597e2a7f7de5d6f65abeacab47ea8a0c6c5481c4f6f2d769948
MD5 24124b86c58d8f64a8bd201b58340e9b
SHA1 8d510d62098d8dfa44cbab74cd84b2a03d09595d
SHA512 9d4b8b9b478a725dd0408ee417ff3ebac57cf4b66fbb236d11679d0e67e664bcf28b35118cd102679a80d32e16ca9a3ad3764907873a58f9cc7c82a7e8adb4e1
TLSH
T14D2199E394BEF46B206E0AEB0E08BC09597EB835119190F9CB96927CF0C48B73742417
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Temp\{C8319F1C-76A7-4C44-8940-F8C5BE668232}\EBWebView\Default\Network\TransportSecurity
Size 1KB
SHA256 29f0acdc4e9869d8d52d22f8a4a82aa8861810bce77651d831ce2a271392fe22
MD5 703bfd88c8671541fc8f743b78063aaf
SHA1 931dafd62226fba98cacd31820fd6eb6dea58af3
SHA512 d5eb911a5a9bb096363a442747f304fdd1ff92aa73b2f1edc2dcbdfc44f2d813989007fcc047ed3992e01a90f58c2ee8002185a70ee54c8c0940cd89aa07c25c
TLSH
T1A2317AD395BEF46B246D09EB0E48BC095D7EB871119194F9CB9691BCF0C48B72706417
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity~RFe59913a.TMP

Path C:\Users\Admin\AppData\Local\Temp\{C8319F1C-76A7-4C44-8940-F8C5BE668232}\EBWebView\Default\Network\TransportSecurity~RFe59913a.TMP
Size 1KB
SHA256 87f285a007068b01ba0246d1f99f9105308b8cfd4419431334445fd2c2ab1172
MD5 a5e55cd4616043089429fb0d7f0688ad
SHA1 e2e529cc477fe3e90ba9292cf935bf55857afd46
SHA512 4cc45c80378dd85cd68e3987972c644f051edcfc8ad0f3edcd225e21fe2f7a78d6162b6c4a37d33f9e6d40ef42c0181377c410d0786276b9d87327ed53452d23
TLSH
T1FE2179D7A1FEF46B106D09EB0E08BC056A7ABC74119154F9C796816CF0C55F7274641B
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Temp\{C8319F1C-76A7-4C44-8940-F8C5BE668232}\EBWebView\Default\Preferences
Size 6KB
SHA256 aba8cbf07e6f2d916427b4a568b50d3deb5661170b69e463725d2449deada1c8
MD5 f09c1c07f6eb8dfcf4029e08e76c158c
SHA1 df5a33c10e74dcc050fcea807e4f09d2cd0d7f60
SHA512 91d5d96545651e24a398594736d168333173e62751cf1e4d6c2a4726f7bdd3538e76f8b7a02d1a820f08033ed1138cba5a7e569dd4cafb043e0b9d2aedd07f29
SSDEEP 96:stC/dAAUjTJb9Gkuo5h16Zvzs7/x+6MhmuecDEy1eje7K+gOIm28XM1C7K:staSNidoqzsV+FvEyQjVwImG6K
TLSH
T1A6D1A8025E28797B4CCBF109BA25BA13E2F9607265D51E58E7FC852C04D75DC631780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Temp\{C8319F1C-76A7-4C44-8940-F8C5BE668232}\EBWebView\Default\Preferences
Size 6KB
SHA256 9f4158a96866393e67930d36307537120c24b69166c6554a55a6f2e6af571493
MD5 c21e87734049149eee10be18b42db7ef
SHA1 72b0d0add97c008f2e9a2ca1c7196910fee83ca1
SHA512 93d7c3d7a053dc04a2a5272997da8f29f23e6e4f5e914102a3e35c7ef419f624c04f54f8e10af5dde62290797a4f9c9c9fc39618f00cb38bc5fae3a109cd754e
SSDEEP 96:stC/dAAbGjTJb9Gkuo5h16Zvzs7/x+6MhmuecDEy1eje7K+g/P28XM1C7K:staSridoqzsV+FvEyQjVFG6K
TLSH
T15BD1B8025E287C7B4CCBE109BA25BB13E2F9607265D51E58E7FC852C08EB6DC631780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe599409.TMP

Path C:\Users\Admin\AppData\Local\Temp\{C8319F1C-76A7-4C44-8940-F8C5BE668232}\EBWebView\Default\Preferences~RFe599409.TMP
Size 5KB
SHA256 38fc68dbe05237f9c1e72cc7d18c2aebd029336cfeb00fff89ee6b9f90bccd09
MD5 a47b7b2abfafaa2bf3997efe4c7b37b7
SHA1 b92cd354110794dd0d3474fe1ece6a751c860660
SHA512 bd408cda23080ed974d79e079c39c4cfd652709cdc3e9345206a77af78a576254bbe1159688bf0744a715c191d2b083facc56bc1792471627ea595a6238f98bb
SSDEEP 96:rC/dAAUjTJb9Gkodo616ZZs7/x+6Mhmuecmje7K+gBm28XM1C7K:raSNi1ojsV+FijVbmG6K
TLSH
T14CC185025E28797B4CCAF509FA29BA43D2F9643235D51E58E7F8862C08DB5DC631780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\{C8319F1C-76A7-4C44-8940-F8C5BE668232}\EBWebView\Local State
Size 3KB
SHA256 97559f492899ea6772fae9bacdb1f86876957498b944c6e6404e9842ed81449a
MD5 a57e1402c0a71ed8ade05dc90d4153bd
SHA1 c6e037a05262ef34efb118d3c1003ea5fdcebe59
SHA512 d08ffcca8d87cd00acf6e5c37399cd6e610dc8e2fb4fe99849f63230d678a3ddc97bf74dd04062856d4fe73b33e2de2acf59239d44c1318c086f9a6869d1bfde
TLSH
T1B871B866A578A93B4EF7DA04B9863B03EBA45023E5923FA9D6EC1F0D01D72DD1342C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\{C8319F1C-76A7-4C44-8940-F8C5BE668232}\EBWebView\Local State
Size 2KB
SHA256 87a2d267da6708e57fdf36c69c629d55ba841952ef68ebe5bf5533741abc396b
MD5 b3451a1b8b50b59f8d4999547a6d398a
SHA1 b87c2e74efd37203268ae1fa84fd9e5d2aa3dc58
SHA512 bfa4a63842ec7e63cc2315f5980c6cecd7c8ab6042513cf019305dd704b56fa875891b47b15a744e373a2ae74382bffb15c789c67458cbcc1cb80e946250f5ac
TLSH
T1E151D773B818AF3799E78A047A4B3B53CFB99052AA522F6096EC1B1C00D755D2702C37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\{C8319F1C-76A7-4C44-8940-F8C5BE668232}\EBWebView\Local State
Size 3KB
SHA256 7ab8825133b55e169445459d037e79a7f85e3442cf6f2d7597b76024ac959811
MD5 693bc546d10464ddb3de7063005425a6
SHA1 ada8b008ca456166a58de1215fe44a6c27c30385
SHA512 2a2e89b42256bd92d26e8e842e563813d3936e8995c49d79e94d6b2c30e5afaea0d7329c10a47630ec02a5f9c28838ed3558f7664ee898c3b370210d9d6b648b
TLSH
T10861B676A974A93B4EE7DA00B9863B02EBE95027E5913FA9D6EC1E0C00D729C1342C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe593147.TMP

Path C:\Users\Admin\AppData\Local\Temp\{C8319F1C-76A7-4C44-8940-F8C5BE668232}\EBWebView\Local State~RFe593147.TMP
Size 1KB
SHA256 581e20cbde7bc9d81b7a7234cb3cb3a889634de12b5970ffa2260c9f43f9354c
MD5 d8e2055b946291bcc1b5ca1150cc95f1
SHA1 c71ff2c3b1983f39f9fb66d3ac18bb4144b2d691
SHA512 b7bbdb88d33c2512e63ab0af7a6066d72dc4ea99cbe4895d4f615c5c9d76dcbfdf4d2a79fff338b033ba87a300d021e0450699b367744f3f989cf7d34fb08237
TLSH
T1B62195B1F1651F33ADD656422243BB839FB5502B92114F04A1DD5A2C01D218EAA2BC32
MD5 SHA1 SHA512 TLSH

Submit Download

index.css

Path C:\Users\Admin\AppData\Local\Temp\{C8319F1C-76A7-4C44-8940-F8C5BE668232}\index.css
Size 925KB
SHA256 12cbb7a4a55a446e3e3c6e1523d5a113394966709e696f53877c0a8b434d682a
MD5 09e950a1b2cc1e928fd2424ce5b3cc48
SHA1 4d754ee386bab301d98cc11dfcf31271f84046a3
SHA512 8a667f4c74cd610ed987e9adee9aa238798db3807ca7b969950e0d6c0d79fb7c3baa6dbbb78b486d32b609c03d5d85dd522e66d4407fcae39b65699811fd7f30
SSDEEP 12288:oUxDxiaHbr3Gq5XRi5i6jE/5acgsu0wxT63kaSROcdOLeK+CnjG1VWzWhHuajOG2:oEBP3/5XSo/5F5K65SROcwLeKVYgzWIJ
TLSH
T10515CEE0D6A04D1D74378C3AA1CEB75E5514C28E55889FDBAE83ACF540CA696CF2270F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.html

Path C:\Users\Admin\AppData\Local\Temp\{C8319F1C-76A7-4C44-8940-F8C5BE668232}\index.html
Size 426B
SHA256 886c0ab69e6e9d9d5b5909451640ea587accfcdf11b8369cad8542d1626ac375
MD5 a28ab17b18ff254173dfeef03245efd0
SHA1 c6ce20924565644601d4e0dd0fba9dde8dea5c77
SHA512 9371a699921b028bd93c35f9f2896d9997b906c8aba90dd4279abba0ae1909a8808a43bf829584e552ccfe534b2c991a5a7e3e3de7618343f50b1c47cff269d6
TLSH
T1A9E0225B1D924C1C62701BB4D9E2F82DCA45B64AA743AE2074C5256B6FB2B88CCCB64D
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-bn.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3684_202966708\hyph-bn.hyb
Size 703B
SHA256 c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe
MD5 8961fdd3db036dd43002659a4e4a7365
SHA1 7b2fa321d50d5417e6c8d48145e86d15b7ff8321
SHA512 531ecec11d296a1ab3faeb2c7ac619da9d80c1054a2ccee8a5a0cd996346fea2a2fee159ac5a8d79b46a764a2aa8e542d6a79d86b3d7dda461e41b19c9bebe92
TLSH
T13001E1B0B7014F4BC635EDB0117A4A6D9664C43553BE051D84B1F9634F19714E70A8A8
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-mr.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3684_202966708\hyph-mr.hyb
Size 687B
SHA256 f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42
MD5 0807cf29fc4c5d7d87c1689eb2e0baaa
SHA1 d0914fb069469d47a36d339ca70164253fccf022
SHA512 5324fd47c94f5804bfa1aa6df952949915896a3fc77dccaed0eeffeafe995ce087faef035aecea6b4c864a16ad32de00055f55260af974f2c41afff14dce00f3
TLSH
T14801E178BE13888BC6784DB1054115AA0320F90EF296021B4262B13ACB18FD61C95484
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-nn.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3684_202966708\hyph-nn.hyb
Size 141KB
SHA256 5bcbb58eaf65f13f6d039244d942f37c127344e3a0a2e6c32d08236945132809
MD5 f2d8fe158d5361fc1d4b794a7255835a
SHA1 6c8744fa70651f629ed887cb76b6bc1bed304af9
SHA512 946f4e41be624458b5e842a6241d43cd40369b2e0abc2cacf67d892b5f3d8a863a0e37e8120e11375b0bacb4651eedb8d324271d9a0c37527d4d54dd4905afab
SSDEEP 3072:pPTHXHEm69FrOP8d4hRLiinKL4Qshbv2fuOQXCxj+60EoM8WC5zgY:p73HEUP8dsiinTThjy90VKY
TLSH
T1C1E319F3A3394AC29420A8A4DF593B7E4044FA944D80E197B5EC2038E667CBC76D579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Staging

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4728_201564640\Mu\Staging
Size 36B
SHA256 411a706def2e70f96a507208bf80bceb93e950c4c2d671cd1ddb4134ce54b2a9
MD5 0163de1b14421d4eee3757ff76fd81e4
SHA1 96c75c4fe1e3f33a367f45293bd1bd8bff1c06f4
SHA512 80114d59db8f3654dd6821589e5ad03daa923a35610a372756a8865b3e769621e32ef2aed92c2494de2b9fc06d9796b12f1e3bb75873ed794e8c9ae8a0d5e965
MD5 SHA1 SHA512

Submit Download

memory/1228-506-0x0000017487BC0000-0x0000017487C69000-memory.dmp

Download

memory/1228-219-0x00007FFCA1A70000-0x00007FFCA1A71000-memory.dmp

Download

memory/1228-425-0x0000017487BC0000-0x0000017487C69000-memory.dmp

Download

memory/1228-362-0x0000017487BC0000-0x0000017487C69000-memory.dmp

Download

memory/1428-360-0x000001CEA4A30000-0x000001CEA4AD9000-memory.dmp

Download

memory/1428-1037-0x000001CEA4A30000-0x000001CEA4AD9000-memory.dmp

Download

memory/1428-484-0x000001CEA4A30000-0x000001CEA4AD9000-memory.dmp

Download

memory/1428-459-0x000001CEA4A30000-0x000001CEA4AD9000-memory.dmp

Download

memory/1428-178-0x00007FFCA1A70000-0x00007FFCA1A71000-memory.dmp

Download

memory/2408-874-0x000001F314FE0000-0x000001F314FE1000-memory.dmp

Download

memory/2408-877-0x000001F314FE0000-0x000001F314FE1000-memory.dmp

Download

memory/2408-875-0x000001F314FE0000-0x000001F314FE1000-memory.dmp

Download

memory/2408-872-0x000001F314FE0000-0x000001F314FE1000-memory.dmp

Download

memory/2408-876-0x000001F314FE0000-0x000001F314FE1000-memory.dmp

Download

memory/2408-873-0x000001F314FE0000-0x000001F314FE1000-memory.dmp

Download

memory/4284-868-0x0000028E67D30000-0x0000028E67D31000-memory.dmp

Download

memory/4284-866-0x0000028E67D30000-0x0000028E67D31000-memory.dmp

Download

memory/4508-0-0x0000000000F10000-0x0000000001987000-memory.dmp

Download

memory/4988-584-0x00007FFCA09B0000-0x00007FFCA09B1000-memory.dmp

Download

memory/4988-583-0x00007FFCA1DB0000-0x00007FFCA1DB1000-memory.dmp

Download

memory/5824-359-0x000002A938D20000-0x000002A938DC9000-memory.dmp

Download

memory/5824-458-0x000002A938D20000-0x000002A938DC9000-memory.dmp

Download

memory/5824-1036-0x000002A938D20000-0x000002A938DC9000-memory.dmp

Download

memory/5824-483-0x000002A938D20000-0x000002A938DC9000-memory.dmp

Download

memory/6020-563-0x0000015545A10000-0x0000015545AB9000-memory.dmp

Download

memory/6020-361-0x0000015545A10000-0x0000015545AB9000-memory.dmp

Download

memory/6020-493-0x0000015545A10000-0x0000015545AB9000-memory.dmp

Download