b60fb4c61c74ae5e988b23a4891f6278dd03a005c035d5ffd325ea85f35f75dd

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
17/08/2026, 01:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-17_b9d260d366779d6c9e4cf23a0a7dec25_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
Size 10.5MB
Sample260817-cbk5aa1elf
SHA256 b60fb4c61c74ae5e988b23a4891f6278dd03a005c035d5ffd325ea85f35f75dd
MD5 b9d260d366779d6c9e4cf23a0a7dec25
SHA1 92010d188e1b7d32041abc44ff4d3e7b01b9f429
SHA512 07487e6864864ed9f6f0f6b1baffea9e47c7784caf79020cffd6fb5ff4709565a9c0d52e6579e545ab6e72a69703213fa40c68e8d5e5aeef1101241a1d81b7a2
SSDEEP 196608:BQdzhjzEf6xi7teSDFNICjC0AXs5FXunSKBm:mNHEf6xi7ASDzICjCmLXmNBm
TLSH
T17EB67C22A205C036E56035B1B91F77BA22A47D37636084DFB5E1BEA921F42C34B75F1B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

adware defense_evasion discovery spyware trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-08-17_b9d260d366779d6c9e4cf23a0a7dec25_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2160_185248527\hyph-uk.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2160_185248527\manifest.fingerprint	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1964_2113400741\_platform_specific\win_x64\widevinecdm.dll	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2160_185248527\hyph-en-us.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2160_185248527\hyph-ka.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2160_185248527\hyph-cs.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2160_185248527\hyph-ga.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2160_185248527\hyph-nn.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1964_83454346\manifest.fingerprint	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2160_185248527\hyph-fr.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2160_185248527\hyph-or.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2160_185248527\hyph-sk.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2160_185248527\hyph-und-ethi.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2160_185248527\hyph-as.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2160_185248527\hyph-cy.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2160_185248527\hyph-hr.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1964_1464973151\manifest.fingerprint	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2160_185248527\hyph-de-ch-1901.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2160_185248527\hyph-mul-ethi.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2160_185248527\hyph-pa.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2160_185248527\hyph-bn.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2160_185248527\hyph-da.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2160_185248527\hyph-eu.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2160_185248527\hyph-te.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1964_2113400741\manifest.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1964_83454346\manifest.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2160_185248527\hyph-bg.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2160_185248527\hyph-gu.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2160_185248527\hyph-hi.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2160_185248527\hyph-hy.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1964_1464973151\manifest.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2160_185248527\hyph-hu.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2160_185248527\hyph-lv.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2160_185248527\hyph-nl.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2160_185248527\hyph-pt.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2160_185248527\hyph-sq.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2160_1347455467\manifest.fingerprint	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2160_185248527\hyph-it.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2160_185248527\hyph-mn-cyrl.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2160_185248527\hyph-mr.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2160_185248527\hyph-ta.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2160_185248527\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2160_185248527\hyph-gl.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2160_185248527\hyph-be.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2160_185248527\hyph-la.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2160_185248527\manifest.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2160_185248527\hyph-de-1996.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2160_185248527\hyph-tk.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1964_2113400741\manifest.fingerprint	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2160_185248527\hyph-es.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2160_185248527\hyph-sv.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1964_2113400741\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2160_185248527\hyph-cu.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2160_185248527\hyph-et.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2160_185248527\hyph-nb.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1964_83454346\crl-set	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2160_185248527\hyph-el.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2160_1347455467\manifest.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2160_1347455467\Microsoft.CognitiveServices.Speech.core.dll	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1964_2113400741\LICENSE	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2160_185248527\hyph-de-1901.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2160_185248527\hyph-en-gb.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2160_185248527\hyph-kn.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2160_185248527\hyph-lt.hyb	msedgewebview2.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-17_b9d260d366779d6c9e4cf23a0a7dec25_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	2026-08-17_b9d260d366779d6c9e4cf23a0a7dec25_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	2026-08-17_b9d260d366779d6c9e4cf23a0a7dec25_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	2026-08-17_b9d260d366779d6c9e4cf23a0a7dec25_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe

Enumerates system info in registry 2 TTPs 10 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	2026-08-17_b9d260d366779d6c9e4cf23a0a7dec25_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	2026-08-17_b9d260d366779d6c9e4cf23a0a7dec25_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	2026-08-17_b9d260d366779d6c9e4cf23a0a7dec25_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	2026-08-17_b9d260d366779d6c9e4cf23a0a7dec25_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	2026-08-17_b9d260d366779d6c9e4cf23a0a7dec25_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\2026-08-17_b9d260d366779d6c9e4cf23a0a7dec25_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe = "11001"	2026-08-17_b9d260d366779d6c9e4cf23a0a7dec25_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134314052644623850"	msedgewebview2.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe

Modifies system certificate store 2 TTPs 12 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\SystemCertificates\AdobeCertStore\Certificates	2026-08-17_b9d260d366779d6c9e4cf23a0a7dec25_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\SystemCertificates\AdobeCertStore\Certificates\686DF0A4A89F7CB6BFB4D33C6A48E2EE5FB6C4FB	2026-08-17_b9d260d366779d6c9e4cf23a0a7dec25_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\SystemCertificates\AdobeCertStore\Certificates\686DF0A4A89F7CB6BFB4D33C6A48E2EE5FB6C4FB\Blob = 030000000100000014000000686df0a4a89f7cb6bfb4d33c6a48e2ee5fb6c4fb2000000001000000c3050000308205bf308203a7a003020102020401cfbd1c300d06092a864886f70d01010d050030818e310b30090603550406130255533113301106035504080c0a43616c69666f726e69613111300f06035504070c0853616e204a6f736531163014060355040a0c0d41646f62652053797374656d7331193017060355040b0c10436c6f756420546563686e6f6c6f67793124302206035504030c1b41646f626520496e7465726d6564696174652043412031302d3139301e170d3233303830373135313132375a170d3330303830353135313132355a308191310b30090603550406130255533113301106035504080c0a43616c69666f726e69613111300f06035504070c0853616e204a6f736531163014060355040a0c0d41646f62652053797374656d7331193017060355040b0c10436c6f756420546563686e6f6c6f67793127302506035504030c1e41646f626520436f6e74656e742043657274696669636174652031302d3830820222300d06092a864886f70d01010105000382020f003082020a0282020100d119f9b8d2d41d892abf9f1f3cd1f947141b9867e9be6d96e479c74c87e42f61f5b927bccb7caebe27b26465b8e2f1118c2041980b88d7f559b8f9d041110e19f29ce5033fe9b8184d47982257e97d1b62744521bc329a7861a2376eeb8f3248eb031a7b43b1f22174fcc3c642033770137cad8329b240970127edd3030d9a69af242fc7405b5867d0f5950bb0b79f702e84180ee43ca21f46adce07ad014f5cfd7be25e735eb0431889bcce40a4e94791fca5a65da24838d189b85218c9961eb1bce8db4cb2ffc7a2c3419788e68098350cacc6aa61dfb3d8476454927f9ab767037a84ed4e39862b3f386a065b169403259617150679e34af188035d8bebd9f4f22544cbf81f0d0516799d39a17a56c12e5c151945d65084367647c6f6a78ade46f7bcc0b8aca7d8abfe3eb34ab2d1fb7800a98da86c8da956b267e309634d55ff7f6570f9b926bd602d4a94e77c662d1479c576b972d87bb35ea634b5f676774d40e04a0a908948c269c7dc71778ed5d15d9b8f4519ee858bc273a49afc7a206afd97286716b832e64154a074305d7bbcb7f2205017d1ed5ca6e42edc6d35fabc88dd188028b15e5aa5296e12c03486a80a6e3cb0c001e4742b1edf02fa70c2ebdcbec606480054fc467729e99d1eb80bee04b36fb17c722068079146fde54b06c3ec5c4bafaf113d2000ef36aebe8454560e81d0cf982a798bae3c39cd430203010001a320301e300e0603551d0f0101ff040403020780300c0603551d130101ff04023000300d06092a864886f70d01010d050003820201006bf0137ee63d74f0df4ee19376625ac33574898a025b764e9bd69f8c7d9fa1c7f9b58f0355f206cab84927d626275a8fd0d1c6a3b9a7811b361a68523ad86199ec1188922ce525246bfef1b4dd23eb5b8ee0894d4495ceb1c0f27bca3812c7c02432f9a693c7a331c53162a76c687c0ff60b31389a0e11f9da1fd8ceae91ff671222083643e0a7c0b97f170ab051856ab58c8b3278d16753cfaac05cec9a08c0fcc2e993aaea79225d70e9ec8bfb53c93be8915b2026a35bf05d3c9e5e417fabc5648d9fd8f153e8787f1e3cdd637fe2abd8c8a5d1c9171c342e588a77ff2739dc6b88c79dc933dedf535c496ba652a184b6b65b831aa7706251494108d58f8565624e37a343696f2e42c029333dab8b1a9e34bda64b58546906e9bd3f0d67f3cb830e8b6bf3b01f653c938da93b53a6878a14fe75550b546d580fa40f0e6e6fac25113513f48c9fc79b27689b906afd59d11abbdf4fde466d2a93431606db3938d9e9f7505d1a0cd91e4f116a2f3e1837ba0c1ab0cc74724916a65d9b2c09b00eef96bda7156f789449923371b5aac2a6728b0b3e71ac656ebc820bad65977cebaf56611c8d322c78af95c5dc1c2e56d95eca6efb5664010860dd6c82faf60a9cd493eecc6b013449633928d96bb0d38f28f838564db989958ecfd5325fa51f8ec4148545c5a94705beb7200b427f978959cc7a031fe58f7e2f42ad48e3bb82	2026-08-17_b9d260d366779d6c9e4cf23a0a7dec25_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\SystemCertificates\AdobeCertStore\Certificates\85E2C5B0D9CFF505363FA62A5E8B8C1D76A60B46\Blob = 03000000010000001400000085e2c5b0d9cff505363fa62a5e8b8c1d76a60b462000000001000000bc050000308205b8308203a0a003020102020426c66cd0300d06092a864886f70d01010d0500308185310b30090603550406130255533113301106035504080c0a43616c69666f726e69613111300f06035504070c0853616e204a6f736531163014060355040a0c0d41646f62652053797374656d7331193017060355040b0c10436c6f756420546563686e6f6c6f6779311b301906035504030c1241646f626520526f6f742043412031302d333020170d3138303831373137333831395a180f32303638303830343137333831395a30818e310b30090603550406130255533113301106035504080c0a43616c69666f726e69613111300f06035504070c0853616e204a6f736531163014060355040a0c0d41646f62652053797374656d7331193017060355040b0c10436c6f756420546563686e6f6c6f67793124302206035504030c1b41646f626520496e7465726d6564696174652043412031302d313930820222300d06092a864886f70d01010105000382020f003082020a0282020100b533b875034a0e7563110700e026d838b4ed1369ee54d6db09ebf764a4778ef8a7dc7dfba9386a78e61be8ff8722d2ca1535cc02c111f9fae54fdc09698d22d9d936b3133aab757b596a1c093cf3559f351d3f10dc44fb0f9787e1f685e83dc775c74d0e563f1509071a1d4bcd919d0b9ebaf925867a85e7e5b9b13040760dfbe2a9bd70e028963dd69631e9cf2f5ca3a6634ac8bfe2dae5cde9df35e935b4f88a17fc78786052badf6e5a378e34a16d16ec7eeb69bf0917fd7210ae129ae2b5f3473e28ea73e25e81176229f0ad99b74069cf6c30413ab85d86f7fec519e01806a928cf2e5ea9c9aae9f57a60401e76313fd017bbe23541b455da6c7d49e39f6b451a67ea2160056781067c489526d297410ac05e87fbeca66d75bda1eaeec9652891598957f4c19fb53ec491b1d600d1ad75d7c164d613ba6ce275682f44399515c247d11d72dc440fd800225a13ae8d16494eaa9f1f82120d2f51243683d2aa62cdcf5be075720b7d566eadb5e46ee3299b43296a49bf3fbe2e672e72e42e7918e608466028de4f215cd362cfd921200ff946168717d09af99095950812f5a4de4073e2c5697a318b9eb51a585a36e74dbd8fb7277c8aeb7ddd42ffbeb32c181f9edaddc1480b95f16e7ea37d0dab3f2f5009d570aa4624b66a7017c75f1caa7c544e15def0c6e6cf6a4f26312b68f633b7a5a4203c97e77a32141e7cf4970203010001a3233021300e0603551d0f0101ff040403020204300f0603551d130101ff040530030101ff300d06092a864886f70d01010d050003820201005bd66c82ca184490136b886ef3b5f5b6866768c8cfd13f701025aeb8dc8b7b4539c071032663327f1b55d773e062ea01551038bc12895b4a760a23ec0ef1e24c1d25649b12dad880b576a952ba1f9d1ed0c5bdf45e8a9f9465c091e22ff7165912fba642b3e2979897339ab2ae511615d3e20b27e3e60e13fe188c7c7119f14029ccfaf1e9fef5c7e53ce1c0d1cfcb8507131c446af5b7f67b701e1ee4151cadd14048737cf0ec86f8964d75b8509bf07a984441641622568d5ea1b9124101db76c578bee86acdb651a90b5c3abdab541f3a41e82cbfc0d30319e1975924540a71e8d1a3603caade3cefcf0b362b62fa09efe97827276b0b79f58553136c89aa72a9f3f7fdaa87e5789978abe6af28c04f7d673954594329ace012159c5ee6b2cb43b55f507e0e0f68233e8a3c6fe13a2cb23b4f38ddecaeae21e99bd6e152793ad59b8286256ede041654cb8a7c069d773868f8bddea44fccdcfc4c0cfec6f9357093024d88519a40bdb3b77b0988051418fcba0a67c5caabc66f21d094e5d612dd7f951291892a4f8ef35efdb2c9d940fcbddfdb75d19b1b215a36dec147c9d716bb4a06047e90d0d0fad64a56f24a6b650843d5cdd2aba7e8894b4693d775aebc8d65063d1813b0be5c9c6357c43be7aea9b3b6021935acc2b8f38746aeab5eaa06f447be0cfff20b38811e273023cd035f14ad3a7babee646909282cc3ef	2026-08-17_b9d260d366779d6c9e4cf23a0a7dec25_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\SystemCertificates\AdobeCertStore\Certificates\4C7C2E87F0BC79A039D39B05F899A1CC521FDE99\Blob = 0300000001000000140000004c7c2e87f0bc79a039d39b05f899a1cc521fde992000000001000000c3050000308205bf308203a7a00302010202046e271780300d06092a864886f70d01010d050030818e310b30090603550406130255533113301106035504080c0a43616c69666f726e69613111300f06035504070c0853616e204a6f736531163014060355040a0c0d41646f62652053797374656d7331193017060355040b0c10436c6f756420546563686e6f6c6f67793124302206035504030c1b41646f626520496e7465726d6564696174652043412031302d3135301e170d3233303830373133343834335a170d3330303830353133343834315a308191310b30090603550406130255533113301106035504080c0a43616c69666f726e69613111300f06035504070c0853616e204a6f736531163014060355040a0c0d41646f62652053797374656d7331193017060355040b0c10436c6f756420546563686e6f6c6f67793127302506035504030c1e41646f626520436f6e74656e742043657274696669636174652031302d3730820222300d06092a864886f70d01010105000382020f003082020a0282020100ad280d5cfb35f4129a580996209e83cd117cab917f7f8b85e353c39899fa07bc7050077db622fe4b43c477c0abb8325a1ee90f76416e2af5cb76ed9ccec153694c6add14358e1c5c45d32db721654781ba134e981ae3b21d56fe739afd397db8101fa65554ad67d9b808d45487d9913bd7cf30e094a948546da75f51395ab7b0f122244976683d87ce6797aaea3d5ee468553fc658b2b9530e33e2aa418950458d4147270f8773e3d93da7df6a1e8f58e439218236d110a658bf5037260d3f596e1f06b9e963f758eca3f99faa454640628e3bc66c16e914aad9bea5a47f954ca0ff73cf4237e8545e5e82f66795493508a6852f4564ef44dbb31b23c27d6dcc54e749094bb404073ed05ab6bf54afadec8ea7b58ce2d935c4b0ec8a054bef86cebfd63faab8fae41104e8bdaf1f3f2474d78e050c8f33510c80abba83c0da198107e47b40cd119b71827a510ae65e9b97d5e617b397cf517cfecbc47a890bbc350c5b631a50f254151d4d84cd512e0f57241e10b1bd1569287a900d4bf4a23532556266bc1c8b1014972f126b20a2e2e7db73774eb822669fc2bcf56d817ee3f5d20f9b029ec62d377d5328000ce5d921c965337c500416a6c3e828ed27ad8ed370f8b9035c322ce75ed6de25002e363475f95e24ad6e30b9350eb2934a431bf09c8b4df073213fd6393192d796022b4275a73e5b4a2bf3b226d6a537e96c450203010001a320301e300e0603551d0f0101ff040403020780300c0603551d130101ff04023000300d06092a864886f70d01010d05000382020100315188a437cb6a526ab679d888ef1051ea301191b36ff818d3e7e1b8cbc8e1c078fc058e0d7bd61b11fd8efef27b411c3f494f6734c286008ffb39d2eecf012929913628c5b160f6ca24fab63068fc48cb91293fc302f3d16f5de8dbdfe3a57abca9a081c4cfa82fa3e06f36a318251a351c5e08fe4f4a286d1ebb4bf87278f7e54faf53e1b37148f19f210136c5f3b5981a89a3aaf8351490555d001aee6c9ab2bd27cc13d162ef6314c47fce2c668e16ed641d2b6871ef3b0afbc8e5e2b93d775049061496057a361c2cd1ed7cbdadd143a0f114e9d5066c6e2f2bfd771b44c8979cf0f094d2d89e104c935ef362eabcccda4559bb33e640b3c1920cf314688fdc639665e8e81f6b9312516d937a6db751fd39e044271432d0e83bfcb5e8df5cbe2a7c15e272e09aa96f939ac7b6655fcfe91e59474b3a4cecf12490cb1f3aa2a80ae53cbe867ccaeff9ca84d487bf438f4213b253148ff8be54caee1e4aa157353f707a966f946e89a8fc8964849eb948bd54b2b2e6d1dd85ba7df45208206472a5aa93860c5ee8f6460739ea3231ec590f09602ff29f09ecedbdbd635cb42670c8288b3f051dd6c393240d0a668b9a2c20bd70f182ce58d152089385ab717c7c624826ec39424050ad45048927d2e771be6f6693055589f3612df47c206d6ae8600f9d60f7aebc5567458d8a423b76d6082ab213fff88584909e76b458ab	2026-08-17_b9d260d366779d6c9e4cf23a0a7dec25_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\SystemCertificates\AdobeCertStore\Certificates\A5C8D928986EC17FCC7D5F2353885D1709B73A29	2026-08-17_b9d260d366779d6c9e4cf23a0a7dec25_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\SystemCertificates\AdobeCertStore\Certificates\A5C8D928986EC17FCC7D5F2353885D1709B73A29\Blob = 030000000100000014000000a5c8d928986ec17fcc7d5f2353885d1709b73a292000000001000000bc050000308205b8308203a0a00302010202047ce3bf47300d06092a864886f70d01010d0500308185310b30090603550406130255533113301106035504080c0a43616c69666f726e69613111300f06035504070c0853616e204a6f736531163014060355040a0c0d41646f62652053797374656d7331193017060355040b0c10436c6f756420546563686e6f6c6f6779311b301906035504030c1241646f626520526f6f742043412031302d333020170d3138303831373137333831355a180f32303638303830343137333831355a30818e310b30090603550406130255533113301106035504080c0a43616c69666f726e69613111300f06035504070c0853616e204a6f736531163014060355040a0c0d41646f62652053797374656d7331193017060355040b0c10436c6f756420546563686e6f6c6f67793124302206035504030c1b41646f626520496e7465726d6564696174652043412031302d313530820222300d06092a864886f70d01010105000382020f003082020a0282020100a0e7345276469020a420dfb0569684d7adf0f493a0a0a53742c25e1bf39a91a481ae07efcf40586a5b42a776dad12710078884bfcb2c3af2bdd70b4301490e58de99cb28b1dc5befd617dadfc34c653d9ef643ff6fd9069cb2ad740ebf1abc42c9fabb8a65cd0d76e9b0b64c77ec0e9350da1ba5f3aabbad9e076e2aebb3af34809dd50bb29cb26577536791a0c672c843fd11a60ce5aa99e0ac5ff81819ab8d4306e790040b6d9d4eb9e37b88d9bdfd8271ee8ba557aff9ec66da32c1f483cc84e0e9af352f5fd083e0933047a13529568e22491266b576b50af641676031593285135758d3f86467159b00ff3662b885dc7a331a1b658c42ae8e76101a67abf22002b4ccf330b966d05f63a91870ef56916ff131a0b8737e111413bc3620c593d5c1452012ec77d77b99240ab972c2fd0d20474bb9c63f1053cfded7de55d57e2d735ac280e1faa8f8af095fb29d5b03b7e45ff8c6d1a7c052e0854418d27c9adb3e40032000e988fd8f6f556bd956e85eed4e7c4d1916c4fc090c27e6b1a3bdaadf8eda48c81b212feee1f1b97ebe4b2ed98b49662c101efdb212720d73a7a432af6d816c7997a5485dae77209f060718e50c524d089750a51bfab47e04fccbf04017762c3597fa5b52b2394b7159053034065e17c184c25736ac793c6e2b25e04d59dc1fe74f9e338c719573d6d6b4b29ea7adbc259e5d4fb4d0fa89a92b0203010001a3233021300e0603551d0f0101ff040403020204300f0603551d130101ff040530030101ff300d06092a864886f70d01010d05000382020100501c3b74f2e4857d8171cffe355895c8241c0590b0f5a81321aad9b328916dc68479ed41c47396336cae923db8c14276504c81f99ee5d961fae32ea75fa707717fe6d3a0cdea05bd40c1d69f21a619b09209f09be929c02125020d7eb9e94670ef57bc02080be6718832fd9f5e7fbfd1bd75c278665582452f66a282d7bcb7936bc336ff64ab06a4a5f12f4a4592dd13ac944fc5a2dd8b084fa429d2eecc10fd7e9a5be17b8c235a12c3e48e0df101837bcd4563cac3e02d7b93e172847881db7ed7e3c01e5e426fe51ee67262154daba09ea358bd10e8d10a9028e6dded33fa8c0b5e5e88d751a73bc68cbd30ebed017024affcc1a3942010531a398ea8120158d78c214e813d6023ec021e80967de3131284f80d0650b1a068d7c5e2bf7f8e019c70db26ee5f0d1719240c7a06c66344d95749b73aff74d6471d97297a248370f30b76d15d576e24fc4f2ac5960eb03d44d9fd145415eb99960802ff81c17439d9594187ffeb98e6e6f1ec11b44fb24eaadfcc1e9107e03eafb42bc717d3a0db4a73c66f0a22c7924a400b02742ea8609051927fac69131dba15df08d152e226764f30438bdb422a895c7d0e60b1da26370806914e4cc1dac1777385d470c81292d597def9c7bbdbca6ed5d8a36cbd97c159590fd075b93c32a22e2405fad8c239b66cdc016e3ffe13c191065ecfefcabdaac7164846611cf24ac9506e7af7	2026-08-17_b9d260d366779d6c9e4cf23a0a7dec25_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Software\Microsoft\SystemCertificates\AdobeCertStore	2026-08-17_b9d260d366779d6c9e4cf23a0a7dec25_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\SystemCertificates\AdobeCertStore\CRLs	2026-08-17_b9d260d366779d6c9e4cf23a0a7dec25_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\SystemCertificates\AdobeCertStore\CTLs	2026-08-17_b9d260d366779d6c9e4cf23a0a7dec25_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\SystemCertificates\AdobeCertStore\Certificates\85E2C5B0D9CFF505363FA62A5E8B8C1D76A60B46	2026-08-17_b9d260d366779d6c9e4cf23a0a7dec25_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\SystemCertificates\AdobeCertStore\Certificates\4C7C2E87F0BC79A039D39B05F899A1CC521FDE99	2026-08-17_b9d260d366779d6c9e4cf23a0a7dec25_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
2284	2026-08-17_b9d260d366779d6c9e4cf23a0a7dec25_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
2284	2026-08-17_b9d260d366779d6c9e4cf23a0a7dec25_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
2284	2026-08-17_b9d260d366779d6c9e4cf23a0a7dec25_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
2284	2026-08-17_b9d260d366779d6c9e4cf23a0a7dec25_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
2284	2026-08-17_b9d260d366779d6c9e4cf23a0a7dec25_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
2284	2026-08-17_b9d260d366779d6c9e4cf23a0a7dec25_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
2284	2026-08-17_b9d260d366779d6c9e4cf23a0a7dec25_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
2284	2026-08-17_b9d260d366779d6c9e4cf23a0a7dec25_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
2284	2026-08-17_b9d260d366779d6c9e4cf23a0a7dec25_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
2284	2026-08-17_b9d260d366779d6c9e4cf23a0a7dec25_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
2284	2026-08-17_b9d260d366779d6c9e4cf23a0a7dec25_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
2284	2026-08-17_b9d260d366779d6c9e4cf23a0a7dec25_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
5372	msedgewebview2.exe
5348	msedgewebview2.exe
5372	msedgewebview2.exe
5348	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
2160	msedgewebview2.exe
1964	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	2284	2026-08-17_b9d260d366779d6c9e4cf23a0a7dec25_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
Token: SeIncreaseQuotaPrivilege	2284	2026-08-17_b9d260d366779d6c9e4cf23a0a7dec25_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
Token: SeIncreaseQuotaPrivilege	2284	2026-08-17_b9d260d366779d6c9e4cf23a0a7dec25_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
Token: SeIncreaseQuotaPrivilege	2284	2026-08-17_b9d260d366779d6c9e4cf23a0a7dec25_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
Token: SeIncreaseQuotaPrivilege	2284	2026-08-17_b9d260d366779d6c9e4cf23a0a7dec25_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
Token: SeIncreaseQuotaPrivilege	2284	2026-08-17_b9d260d366779d6c9e4cf23a0a7dec25_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe

Suspicious use of WriteProcessMemory 34 IoCs

description	pid	Process	procid_target
PID 2284 wrote to memory of 2160	2284	2026-08-17_b9d260d366779d6c9e4cf23a0a7dec25_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe	87
PID 2284 wrote to memory of 1964	2284	2026-08-17_b9d260d366779d6c9e4cf23a0a7dec25_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe	88
PID 1964 wrote to memory of 4384	1964	msedgewebview2.exe	89
PID 2160 wrote to memory of 1512	2160	msedgewebview2.exe	90
PID 2160 wrote to memory of 4928	2160	msedgewebview2.exe	91
PID 2160 wrote to memory of 4928	2160	msedgewebview2.exe	91
PID 2160 wrote to memory of 4928	2160	msedgewebview2.exe	91
PID 1964 wrote to memory of 2340	1964	msedgewebview2.exe	92
PID 1964 wrote to memory of 2340	1964	msedgewebview2.exe	92
PID 1964 wrote to memory of 2340	1964	msedgewebview2.exe	92
PID 2160 wrote to memory of 2148	2160	msedgewebview2.exe	93
PID 1964 wrote to memory of 1864	1964	msedgewebview2.exe	94
PID 1964 wrote to memory of 2224	1964	msedgewebview2.exe	95
PID 2160 wrote to memory of 3828	2160	msedgewebview2.exe	96
PID 2160 wrote to memory of 3828	2160	msedgewebview2.exe	96
PID 1964 wrote to memory of 2224	1964	msedgewebview2.exe	95
PID 2160 wrote to memory of 3520	2160	msedgewebview2.exe	97
PID 2160 wrote to memory of 3520	2160	msedgewebview2.exe	97
PID 2160 wrote to memory of 3520	2160	msedgewebview2.exe	97
PID 1964 wrote to memory of 4148	1964	msedgewebview2.exe	98
PID 1964 wrote to memory of 4148	1964	msedgewebview2.exe	98
PID 1964 wrote to memory of 4148	1964	msedgewebview2.exe	98
PID 1964 wrote to memory of 4668	1964	msedgewebview2.exe	119
PID 1964 wrote to memory of 4668	1964	msedgewebview2.exe	119
PID 2160 wrote to memory of 2416	2160	msedgewebview2.exe	120
PID 2160 wrote to memory of 2416	2160	msedgewebview2.exe	120
PID 1964 wrote to memory of 6104	1964	msedgewebview2.exe	122
PID 1964 wrote to memory of 6104	1964	msedgewebview2.exe	122
PID 2160 wrote to memory of 5168	2160	msedgewebview2.exe	123
PID 2160 wrote to memory of 5168	2160	msedgewebview2.exe	123
PID 2160 wrote to memory of 5372	2160	msedgewebview2.exe	124
PID 1964 wrote to memory of 5348	1964	msedgewebview2.exe	125
PID 1964 wrote to memory of 4636	1964	msedgewebview2.exe	126
PID 1964 wrote to memory of 4636	1964	msedgewebview2.exe	126

C:\Users\Admin\AppData\Local\Temp\2026-08-17_b9d260d366779d6c9e4cf23a0a7dec25_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_b9d260d366779d6c9e4cf23a0a7dec25_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe"
1⤵
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2284
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=2026-08-17_b9d260d366779d6c9e4cf23a0a7dec25_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe --webview-exe-version=2.14.0.66 --user-data-dir="C:\Users\Admin\AppData\Local\Adobe\webview2\2026-08-17_b9d260d366779d6c9e4cf23a0a7dec25_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=1 --allow-file-access-from-files --mojo-named-platform-channel-pipe=2284.1812.7349302074828217082
  2⤵
  - Drops file in Program Files directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:2160
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Adobe\webview2\2026-08-17_b9d260d366779d6c9e4cf23a0a7dec25_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Adobe\webview2\2026-08-17_b9d260d366779d6c9e4cf23a0a7dec25_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x15c,0x160,0x164,0x138,0x16c,0x7ffb75ccb078,0x7ffb75ccb084,0x7ffb75ccb090
    3⤵
    PID:1512
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Adobe\webview2\2026-08-17_b9d260d366779d6c9e4cf23a0a7dec25_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe\EBWebView" --webview-exe-name=2026-08-17_b9d260d366779d6c9e4cf23a0a7dec25_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe --webview-exe-version=2.14.0.66 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1772,i,5833462063062444457,2195476718687661769,262144 --variations-seed-version --mojo-platform-channel-handle=1736 /prefetch:2
    3⤵
    PID:4928
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Adobe\webview2\2026-08-17_b9d260d366779d6c9e4cf23a0a7dec25_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe\EBWebView" --webview-exe-name=2026-08-17_b9d260d366779d6c9e4cf23a0a7dec25_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe --webview-exe-version=2.14.0.66 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=1372,i,5833462063062444457,2195476718687661769,262144 --variations-seed-version --mojo-platform-channel-handle=1888 /prefetch:3
    3⤵
    PID:2148
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Adobe\webview2\2026-08-17_b9d260d366779d6c9e4cf23a0a7dec25_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe\EBWebView" --webview-exe-name=2026-08-17_b9d260d366779d6c9e4cf23a0a7dec25_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe --webview-exe-version=2.14.0.66 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=2356,i,5833462063062444457,2195476718687661769,262144 --variations-seed-version --mojo-platform-channel-handle=2348 /prefetch:8
    3⤵
    PID:3828
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Adobe\webview2\2026-08-17_b9d260d366779d6c9e4cf23a0a7dec25_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe\EBWebView" --webview-exe-name=2026-08-17_b9d260d366779d6c9e4cf23a0a7dec25_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe --webview-exe-version=2.14.0.66 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3548,i,5833462063062444457,2195476718687661769,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:1
    3⤵
    PID:3520
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Adobe\webview2\2026-08-17_b9d260d366779d6c9e4cf23a0a7dec25_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe\EBWebView" --webview-exe-name=2026-08-17_b9d260d366779d6c9e4cf23a0a7dec25_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe --webview-exe-version=2.14.0.66 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=4496,i,5833462063062444457,2195476718687661769,262144 --variations-seed-version --mojo-platform-channel-handle=4508 /prefetch:8
    3⤵
    PID:2416
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Adobe\webview2\2026-08-17_b9d260d366779d6c9e4cf23a0a7dec25_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe\EBWebView" --webview-exe-name=2026-08-17_b9d260d366779d6c9e4cf23a0a7dec25_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe --webview-exe-version=2.14.0.66 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=4624,i,5833462063062444457,2195476718687661769,262144 --variations-seed-version --mojo-platform-channel-handle=4632 /prefetch:8
    3⤵
    PID:5168
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Adobe\webview2\2026-08-17_b9d260d366779d6c9e4cf23a0a7dec25_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe\EBWebView" --webview-exe-name=2026-08-17_b9d260d366779d6c9e4cf23a0a7dec25_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe --webview-exe-version=2.14.0.66 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=4628,i,5833462063062444457,2195476718687661769,262144 --variations-seed-version --mojo-platform-channel-handle=4424 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5372
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=2026-08-17_b9d260d366779d6c9e4cf23a0a7dec25_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe --webview-exe-version=2.14.0.66 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\{6044A603-4DEE-4791-9A88-991787493727}\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=1 --allow-file-access-from-files --mojo-named-platform-channel-pipe=2284.1812.5092177339290466657
  2⤵
  - Drops file in Program Files directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:1964
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\{6044A603-4DEE-4791-9A88-991787493727}\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\{6044A603-4DEE-4791-9A88-991787493727}\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x160,0x164,0x168,0x13c,0x118,0x7ffb75ccb078,0x7ffb75ccb084,0x7ffb75ccb090
    3⤵
    PID:4384
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\{6044A603-4DEE-4791-9A88-991787493727}\EBWebView" --webview-exe-name=2026-08-17_b9d260d366779d6c9e4cf23a0a7dec25_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe --webview-exe-version=2.14.0.66 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1776,i,11161014063710231393,16759651052816695831,262144 --variations-seed-version --mojo-platform-channel-handle=1768 /prefetch:2
    3⤵
    PID:2340
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\{6044A603-4DEE-4791-9A88-991787493727}\EBWebView" --webview-exe-name=2026-08-17_b9d260d366779d6c9e4cf23a0a7dec25_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe --webview-exe-version=2.14.0.66 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=2056,i,11161014063710231393,16759651052816695831,262144 --variations-seed-version --mojo-platform-channel-handle=2060 /prefetch:3
    3⤵
    PID:1864
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\{6044A603-4DEE-4791-9A88-991787493727}\EBWebView" --webview-exe-name=2026-08-17_b9d260d366779d6c9e4cf23a0a7dec25_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe --webview-exe-version=2.14.0.66 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=2348,i,11161014063710231393,16759651052816695831,262144 --variations-seed-version --mojo-platform-channel-handle=2352 /prefetch:8
    3⤵
    PID:2224
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\{6044A603-4DEE-4791-9A88-991787493727}\EBWebView" --webview-exe-name=2026-08-17_b9d260d366779d6c9e4cf23a0a7dec25_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe --webview-exe-version=2.14.0.66 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3540,i,11161014063710231393,16759651052816695831,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:1
    3⤵
    PID:4148
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\{6044A603-4DEE-4791-9A88-991787493727}\EBWebView" --webview-exe-name=2026-08-17_b9d260d366779d6c9e4cf23a0a7dec25_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe --webview-exe-version=2.14.0.66 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=4620,i,11161014063710231393,16759651052816695831,262144 --variations-seed-version --mojo-platform-channel-handle=4424 /prefetch:8
    3⤵
    PID:4668
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\{6044A603-4DEE-4791-9A88-991787493727}\EBWebView" --webview-exe-name=2026-08-17_b9d260d366779d6c9e4cf23a0a7dec25_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe --webview-exe-version=2.14.0.66 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=756,i,11161014063710231393,16759651052816695831,262144 --variations-seed-version --mojo-platform-channel-handle=2336 /prefetch:8
    3⤵
    PID:6104
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\{6044A603-4DEE-4791-9A88-991787493727}\EBWebView" --webview-exe-name=2026-08-17_b9d260d366779d6c9e4cf23a0a7dec25_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe --webview-exe-version=2.14.0.66 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=4820,i,11161014063710231393,16759651052816695831,262144 --variations-seed-version --mojo-platform-channel-handle=3316 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5348
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\{6044A603-4DEE-4791-9A88-991787493727}\EBWebView" --webview-exe-name=2026-08-17_b9d260d366779d6c9e4cf23a0a7dec25_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe --webview-exe-version=2.14.0.66 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=4464,i,11161014063710231393,16759651052816695831,262144 --variations-seed-version --mojo-platform-channel-handle=4468 /prefetch:8
    3⤵
    PID:4636

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1964_1464973151\manifest.json
Size 76B
SHA256 0d664bc422a696452111b9a48e7da9043c03786c8d5401282cff9d77bcc34b11
MD5 ba25fcf816a017558d3434583e9746b8
SHA1 be05c87f7adf6b21273a4e94b3592618b6a4a624
SHA512 3763bd77675221e323faa5502023dc677c08911a673db038e4108a2d4d71b1a6c0727a65128898bb5dfab275e399f4b7ed19ca2194a8a286e8f9171b3536546f
TLSH
T170A022833A0EC03B008283B0202383C08BBCAA28380E080E082338C0CAC2BB80000B28
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1964_2113400741\manifest.json
Size 1002B
SHA256 dca3cd7a673d0776a085c0b8958a85bdd8392923db21a0b55f4d37210f752322
MD5 9be87722ce3608a2d38a79079feaa394
SHA1 34ed541044567272d5402b30fa99eff29d70e9b9
SHA512 d4d22a3c277a9cc3325f4f6f15f18c56efc6945ce8abccae32d66158b9f35039b347e93d0f1002b66336fbef2d750f78184e6a4b72644cb71a2ef944af52388d
TLSH
T10B119B00CC388DD322D4BAA21CC6580A93621DAF4CC23E84339E161D8F1C8AB927366C
MD5 SHA1 SHA512 TLSH

Submit Download

crl-set

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1964_83454346\crl-set
Size 22KB
SHA256 6ddcaf50aaff98b960d067054ce2ce17872ac0719d02abbb7fe56b9eabc818f2
MD5 d01869348d5a783f61f90cbb27b82a78
SHA1 d4eccc91435adaf01f8589cf7f3589cf65425de2
SHA512 7ad7f27d1f559d1f50f1f009518ccca5d6d01696cd70657ad94c9fe37db7bbe06e4afc13170bc5c065cf72d69a92c3df78f637b7faa2f968bb89aa154fe371da
SSDEEP 384:2t71+UygzeWhU6yVS2Ddc0fp/9yYoIJgWUeJuDzeG0LOsr2h9ltQYX9hVPz/HG1y:m4OBwVPDdFhVyYoPWUiuXeG0K5dQYXFr
TLSH
T1B8A2BE9FAF48F112E211523D94245F40DD24D54A23996AB74F943F30ADAE42AAF3CC7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1964_83454346\manifest.json
Size 113B
SHA256 98821f71a1973ac61b45967ce0c121eb598ac6e95abaa23c912d2f33e4237d8c
MD5 7ef3c71464d0fef472bc1d81fd363c62
SHA1 230e8ec0f849bf34d444c55ef548ba0c9c94d39b
SHA512 f74b96ec3b9569e360a02bfdd4fe237efad8ee2a5deaf46db891bcadd39dba22fd6d59a4e9aafe5511152625ce9f468519dadd53fc0c9b6c8826dc58cbe6cd7c
TLSH
T1C8B09262DC80D872693A93AC0E2246C4F228234B2558AA493630048C0A3A3F082A2321
MD5 SHA1 SHA512 TLSH

Submit Download

Microsoft.CognitiveServices.Speech.core.dll

Path C:\Program Files\chrome_Unpacker_BeginUnzipping2160_1347455467\Microsoft.CognitiveServices.Speech.core.dll
Size 2.6MB
SHA256 62a13d8459e0992c311dc3551bf3c2d1ce167ea7fa40f0ec62193f3bd760b36e
MD5 0ee2b50c85a110689352fccfa77b5b18
SHA1 d9ecc4b12d2d50e3cbce40e75edad804c9988b25
SHA512 a4f94a05a69b5ae3a0ecf8bdb7592f698d0df81e2f1fae679f38890ad04a2384883837bc792c73848955ff4af7afed49d38839f7ab174454e61919ed78655bff
SSDEEP 49152:NodIJ85qaIU7ui8DDR5s8L0Oty8CvFqwsNcrCY2/YUZzQ7L9qhV6O8mOn0k10:gEDRwrcAwDl
TLSH
T188C54C1FA64951E6C07AD138C543550BE2B27C60CB7263CB1BA7038A1FA37E2557FB92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.fingerprint

Path C:\Program Files\chrome_Unpacker_BeginUnzipping2160_1347455467\manifest.fingerprint
Size 66B
SHA256 22b55f5d9b1bafb80e00c1304cf5e0d6057a304a2e8757b4f021b416f4397297
MD5 5bbd09242392aacbb5fac763f9e3bd4e
SHA1 14bb7b23b459ce30193742ed1901a17b4dcf9645
SHA512 541e4c7998e91a5113f627c2c44e32b54878fe225b3b9476572f025f51f2b4ec4a44b102498adcc22b8fe388970645bacfafb6e7fc8a216df4d7bbfc8b0ff670
TLSH
T1CEA0026342648D9FBC1C042BD478A69DCD9115B088492445A925C75BB14203389F49A1
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-af.hyb

Path C:\Program Files\chrome_Unpacker_BeginUnzipping2160_185248527\hyph-af.hyb
Size 70KB
SHA256 5487ee44a4cd706d0086522e90c59c76cdf2ac68ce506fd3eae6054b9220c0cf
MD5 ffa9db945f0f0c15b8bba75a6e064880
SHA1 49217a9d5bb7a868464403b4e3c82e80df53456c
SHA512 cc67b2dfbbb009dd3fdb999fe86410425455613c12dac755a3cded435cd25ca4363782d70f3b7bb7c0fdd63e2eb649ae6a4053d929f463b646b43d7dbfda79c0
SSDEEP 1536:dH4Yzf/r1T2bhKC+wQ/MJ4tpBMfWDMxFaye3yrGZ3vGV9YODhX3yKfhGt:dxLr1qFKpNpufWIqye3KgGVnDxe
TLSH
T1D56329C3C62BDF90CC6419F4594D0AA811D816C6E7C039BE9B6C54797A27CB82BC13EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hyph-as.hyb

Path C:\Program Files\chrome_Unpacker_BeginUnzipping2160_185248527\hyph-as.hyb
Size 703B
SHA256 c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe
MD5 8961fdd3db036dd43002659a4e4a7365
SHA1 7b2fa321d50d5417e6c8d48145e86d15b7ff8321
SHA512 531ecec11d296a1ab3faeb2c7ac619da9d80c1054a2ccee8a5a0cd996346fea2a2fee159ac5a8d79b46a764a2aa8e542d6a79d86b3d7dda461e41b19c9bebe92
TLSH
T13001E1B0B7014F4BC635EDB0117A4A6D9664C43553BE051D84B1F9634F19714E70A8A8
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-hi.hyb

Path C:\Program Files\chrome_Unpacker_BeginUnzipping2160_185248527\hyph-hi.hyb
Size 687B
SHA256 f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42
MD5 0807cf29fc4c5d7d87c1689eb2e0baaa
SHA1 d0914fb069469d47a36d339ca70164253fccf022
SHA512 5324fd47c94f5804bfa1aa6df952949915896a3fc77dccaed0eeffeafe995ce087faef035aecea6b4c864a16ad32de00055f55260af974f2c41afff14dce00f3
TLSH
T14801E178BE13888BC6784DB1054115AA0320F90EF296021B4262B13ACB18FD61C95484
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-nb.hyb

Path C:\Program Files\chrome_Unpacker_BeginUnzipping2160_185248527\hyph-nb.hyb
Size 141KB
SHA256 c2771fbb1bfff7db5e267dc7a4505a9675c6b98cfe7a8f7ae5686d7a5a2b3dd0
MD5 677edd1a17d50f0bd11783f58725d0e7
SHA1 98fedc5862c78f3b03daed1ff9efbe5e31c205ee
SHA512 c368f6687fa8a2ef110fcb2b65df13f6a67feac7106014bd9ea9315f16e4d7f5cbc8b4a67ba2169c6909d49642d88ae2a0a9cd3f1eb889af326f29b379cfd3ff
SSDEEP 3072:pPTHXHEm69FrOP8d4hRLiinKL4Qshbv2fuOQXCxj+60EoM8WC5zgk:p73HEUP8dsiinTThjy90VKk
TLSH
T1CCE319F3A3394AC29420A8A4DF593B7E4044FA944D80E197B5EC2038E667CBC76D579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping2160_185248527\manifest.json
Size 82B
SHA256 d571ef33b0e707571f10bb37b99a607d6f43afe33f53d15b4395b16ef3fda665
MD5 2617c38bed67a4190fc499142b6f2867
SHA1 a37f0251cd6be0a6983d9a04193b773f86d31da1
SHA512 b08053050692765f172142bad7afbcd038235275c923f3cd089d556251482b1081e53c4ad7367a1fb11ca927f2ad183dc63d31ccfbf85b0160cf76a31343a6d0
TLSH
T137A022A0BC0880333E8803A8023E83E3C3BE3E0A20003C0002A33C8022EC33B3038E2C
MD5 SHA1 SHA512 TLSH

Submit Download

.adobefeatureflagnotification

Path C:\Users\Admin\AppData\Local\Adobe\.adobefeatureflagnotification
Size 13B
SHA256 e846f39362168bce024ac0d6df571586cf0146d87daa4d558ca3db5f854137f7
MD5 422bdb7b1334bb4524561f872891b49f
SHA1 0116a25599eaf2a0b6b9c90a20be7872efb7b552
SHA512 47345124fc89c9ccbc8f6960bef6300268439e6deb3726185342727042df8f6cee67ab373d5b8668000d2a3a190085995ae59656b38ceacef4161e1af3fb9523
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Adobe\webview2\2026-08-17_b9d260d366779d6c9e4cf23a0a7dec25_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 6717d0a8083245bc94530f55d9316ff04007b44dd7fee3f92b0f6c9d0bb837c6
MD5 a048d0d32d314f26287b6b771bc0f01f
SHA1 84231f0f5af08ba9d95387841185c036fd91a70c
SHA512 22de08adafda3882040ddde344e59208b9acf7218e61167aa22114e165e0f4caf7237aee5341128cc035d7e69b2a28ecebf420b6963724f72d211d9cc057584c
TLSH
T168D004135501C454C1DC10351D30715055145431504111113130154C04C51400001331
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Adobe\webview2\2026-08-17_b9d260d366779d6c9e4cf23a0a7dec25_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 60003dfa81d2d8599adab0160da749d171515e8d1634eee602755f12bac7c263
MD5 1c477e1905446eeeb8b7008d93437f28
SHA1 4a67bc03a17bc8c1ece8a46be6a9d69849f3dd4b
SHA512 4bb1c3a58d568bab276ef390530ae1459bd7171b1a666c483cce1b64473c923274d7d07a97fda5baa209e2d7e06d4e9cdab14bf16b479b674053d2189d605175
TLSH
T156D0121336028578C0642033191271481800D12B8045400174389A5D1A480900902762
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Adobe\webview2\2026-08-17_b9d260d366779d6c9e4cf23a0a7dec25_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe\EBWebView\Default\Network\Network Persistent State
Size 230B
SHA256 27c739561615160aaec0e7ed7f318ddb661114fd768ee1f72dcccbe4e82ea588
MD5 75ad241bc81224195f620e20abcad795
SHA1 ee4b68e146b88c8b3c128a837611f006e512bab3
SHA512 d47860e196e7b0a406bbda570f28058ad5c36d6991b3523074345e144e093a9e81416ca2f147ca3210932d591351ebd2f3fd5335b55087d091815b5476ebd1b5
TLSH
T1EFD0A77A466019FE075543A05928B81BCEBE5003021CFDBA95347B6A83761B8901458B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Adobe\webview2\2026-08-17_b9d260d366779d6c9e4cf23a0a7dec25_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe\EBWebView\Default\Network\Network Persistent State
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Adobe\webview2\2026-08-17_b9d260d366779d6c9e4cf23a0a7dec25_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe\EBWebView\Default\Preferences
Size 6KB
SHA256 aec9320503f8e67e3fdc352c9ec6f79622f537d79aee465b41f82d937c7a37f5
MD5 8878275878edd735ca240aa08e4c9785
SHA1 9ffb55d7c78b6edebf2b4dc370e4ab12a48c390f
SHA512 33c86297a8b1f76f64b733380a20aaff63e4339daa72f17254eacf3bb60a49870444c80db34df5db1ba196fdf835b15a72d99aa75f377caf96beb0031a5a0e22
SSDEEP 96:stu05GxX40b9KBffAZ8i0vhEdkmtm/7qx+WVHMSm+uecav5Qjk+gY3F+MOB:stu0Y+tBfIZ8pa1Q/S+Wi8v51IF+MC
TLSH
T164D197429F6869778CC7F7197A35BB02E2FA502221D50E98EBFC861C05E66CD530B90B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe59137e.TMP

Path C:\Users\Admin\AppData\Local\Adobe\webview2\2026-08-17_b9d260d366779d6c9e4cf23a0a7dec25_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe\EBWebView\Default\Preferences~RFe59137e.TMP
Size 6KB
SHA256 3a299cd4d4c489697da0d393795d20e51a1ade43b565b91426b12e4b4fc6bd96
MD5 ca56a8de5fa1dd35fb2004bdea4cad96
SHA1 6b95bcaa23cd0cb11cfae840c9643bee7021d367
SHA512 6ccd2bf93c664c9ebd033aee8e3db632d183592d20c27aa24bbedf40b9715eda4a4a62d3db283e8fcf732ba5843524c2c39cb7ee69014ec80c64e35346e4f1b9
SSDEEP 96:stu05GxX40b9jffAZ8i0vhEdkmtm/7qx+WVHMSm+uecav5Qjk+gYFF+MEB:stu0Y+YfIZ8pa1Q/S+Wi8v51gF+M8
TLSH
T128D1A7429F6869774CC7F719BA35BB02D2FA602261D40E98EFFC851C09E66CD530B90B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Adobe\webview2\2026-08-17_b9d260d366779d6c9e4cf23a0a7dec25_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe\EBWebView\Default\Shared Dictionary\cache\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Adobe\webview2\2026-08-17_b9d260d366779d6c9e4cf23a0a7dec25_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe\EBWebView\Default\shared_proto_db\metadata\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Adobe\webview2\2026-08-17_b9d260d366779d6c9e4cf23a0a7dec25_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe\EBWebView\Local State
Size 2KB
SHA256 efcffc60f9d42f4104e82f98bdc00c9d65c63bc1de5bbec7941bc63653c1c6f8
MD5 0cfd0fa876ebeff28311d92261053aa7
SHA1 96d5ab80fd3278e72a0dd45eede8808424c9868b
SHA512 4290737e9dd080c9d66d982757168ee0f89a6187dd17a517785e5761c4cadc453a9feaa62e4f6e867a60e108ee97588ab24a4be2bf303d07994a51dff731f61c
TLSH
T1F051C673EC446A7689D3B74579493F13AA3A91A59AA11F90CFDD0B0C02E734C2301C2B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Adobe\webview2\2026-08-17_b9d260d366779d6c9e4cf23a0a7dec25_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe\EBWebView\Local State
Size 16KB
SHA256 bc0e68286253e75cb1077b34b60239ac73c7c22e747364a671322d6769e9efa8
MD5 984b3d737a70b47aac3119c7b61b8619
SHA1 3911e5a05032e9f925be3dfccb874adbe076ca28
SHA512 5507ec8b0ac40a743ca979faa05e9d52fba1b36dd2eaeb345cb2ce43ff6217f907f59afd4c94b6d1ac635f6278e1993aa61b8f8414af43a5aac7e78261bf1960
SSDEEP 384:zX+aQikB+z/xvxjg/qhEwNbZKKuhc/R9zp:y/UxvxjgC+MCc/RFp
TLSH
T144728D3795686E2395F6FA45794D0B4BDBB984B280C12EF88EED5F0D079B3A40302D16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Adobe\webview2\2026-08-17_b9d260d366779d6c9e4cf23a0a7dec25_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe\EBWebView\Local State
Size 1KB
SHA256 f9b55973b935b34b6b6ee6b0ae5d135bc32c3a4d66ee768843a672d4497cf07f
MD5 d44908b0a53e7f4919462589288526a1
SHA1 41511d5508356b560de98014d333d0c2f9f6c31d
SHA512 47174d88c7b7986195f2bdf7023ab9f798c5a7cc016c9a506ca9cd55700acf2118ef807c091babdb0d62cadeb93073c0531a8474646fb6f72ccdd33e08096849
TLSH
T1D33187B3D5D42B319CC5B78772456A9B2F11506A81914EC4D7DE4B0C13E778C9529C37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Adobe\webview2\2026-08-17_b9d260d366779d6c9e4cf23a0a7dec25_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe\EBWebView\Local State
Size 3KB
SHA256 c64e765d5fa475e3708624e88bdb34f2039f268aaa21bae4d18aa1ca2d715c56
MD5 1d5d71326b3171c4b4bae3b7c508d426
SHA1 83df48bfcc02080154b409e328023f83af41ad2d
SHA512 2c91ebaeedc9c96c90a0ba4ecddcc7f8593a5a96ef729cdc9e5231fd9fea3356949fed72a7d73f12a30e647423901ead0774d33ec80269066271069cdc29a388
TLSH
T18071A673A9A4A9378DE3BA46B9852B16B7669127D5D13FD4CAED0F0C02D73881341C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe587412.TMP

Path C:\Users\Admin\AppData\Local\Adobe\webview2\2026-08-17_b9d260d366779d6c9e4cf23a0a7dec25_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe\EBWebView\Local State~RFe587412.TMP
Size 1KB
SHA256 12a36d265d1e95326b6420226a9e80d4de5e55702f4e23605234b7d274ce6918
MD5 3fac342524023673683951946436c7d8
SHA1 ebad264565fb4eebc0456505429cb05c64b6590b
SHA512 c232d83653096d9abd644d24a72afcd6de761bb9455a4fe3b1e7020479f3adfcaaeaed5b05963e23473bc48c9e9fe0d16ec057de358d7ccadebb3ebb640b5f8b
TLSH
T10C2187B3C8C82A35DCC576977202BA8B2E51906A92904F88D6CE470C13E778C9636C37
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 ccc3aaa795dff5ad12fafd0e2f0abbc8117ad946bfeaa2427aa2ffa4f64a39ea
MD5 76e2abfc61679ce8e2480451d89d0e42
SHA1 3c624571fd8e9c17fdb79180c4b9737a1993d688
SHA512 beaacc664955f72767605895352e4bea28368c3d68879be7625c9fdea663cadf1018c414c8c1a575adc15782d9148477dc8d438d490870b6eb1a4bc4dfd8e935
TLSH
T10F414D58AAE91118B3B77E5AABF7A96D487F78772F06C09E00110D4F0667B45C8B1733
MD5 SHA1 SHA512 TLSH

Submit Download

CCDInstaller.js

Path C:\Users\Admin\AppData\Local\Temp\{6044A603-4DEE-4791-9A88-991787493727}\CCDInstaller.js
Size 1.8MB
SHA256 b3cd90e4b56fa44d062d9b061f48f88cfb4372f64ed2f71da40e04aeb004bfda
MD5 02fd165c6436aa8bd7c66b6cdfaf0538
SHA1 f76364bc78aaa44ed404edabc3ec52d8357ad213
SHA512 972d85183ed0cc36904636a74c4351ff170f6346f80f2d8724d8141d285104ee5946e81c0fb9d855f399ff3d865f19c9494d72a27d481240106e9e966cbdcae0
SSDEEP 12288:ZiG9838Pp42Tino9x9LYzKzX58x5MX8kkWd634OpHdVFbDgxMNEk+DRUbA24hQLT:7TC6x9L5zX5wU8kkWA/bDgxDRV24y
TLSH
T1DB95F77F74A5A872AF8030D6009BB40FB7753539738084A89955CF9C92E6B8D4B0BE5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\{6044A603-4DEE-4791-9A88-991787493727}\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 e6931a30f9e2f42c0b3cc6fd267b455eb044c711decb30d0e382976af799802b
MD5 25388de17abb966cda40a1df562b9d7d
SHA1 b1f38add5cd2c4b69d602074d59e6ce36ee24b45
SHA512 59bddb89a71fc34ce64f805f7090d4ef8782a4279773f4802a414342a8ea548f652d0f1cc3e3775467fb0937075ce4b7b460525437008f4c3e8194f65d5c6ad9
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\{6044A603-4DEE-4791-9A88-991787493727}\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 fbf9bbd5d44e569f3b89397a08f5092c6db7e06d0a468d32720d0e563a7f9b21
MD5 c20becb142d9dfabfa021c0e4a27a1fc
SHA1 6aed816be2a6264205ee42d4725995f4ae96b92b
SHA512 523e252be1eb22f0f2435659acc297f050a8cb98fd3b6a4e8fa596ca8f2a0055daed016ca9c9da0bb9ac02c382ceb7dc98526ca10107c3bfd649b678913c0392
TLSH
T102D0121332215236C4102533104365081500C10B818A81005429859E6E580900D0B451
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Temp\{6044A603-4DEE-4791-9A88-991787493727}\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\{6044A603-4DEE-4791-9A88-991787493727}\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 10cf3eb7a406376e79f53d8d1b03fccae38485b1632d9543a3f912459a6fadd9
MD5 9082c71bce306e38103fdf73abd3b886
SHA1 0305de31bcfdc2aea571baab3c99d60aa6d70740
SHA512 9a1fa20652cdd09414aa0e6b1649e64658d7570bd303e9f1cbecf7e7666abdcd25dc79c6a3201e6c72f28a18682f50419bcc144e4d1f6c64662f48d711b42da9
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\{6044A603-4DEE-4791-9A88-991787493727}\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 264B
SHA256 defaddb6afc862ebe9f1e1cb87051830e56555a05ea2b920d84c7038a2444e02
MD5 e60d6d400fb62740e2d74a5f605f7b5b
SHA1 5dba67d96b8440a21e60ec87634b9e1538468fc9
SHA512 26444ddf5cf7d8477a054a42a46479bcf12dd75a1f5f65c6f4ae234f5880a99ad4c15b142ad2c905f8141c0e34e2886294f4e1a99dc5ac21795f19e52c0cc014
TLSH
T175D022B224C080B6CB3C53B0CDC60884B27CCDBA27D30E01B7A80DB439393D8B2A4241
MD5 SHA1 SHA512 TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\{6044A603-4DEE-4791-9A88-991787493727}\EBWebView\Default\DawnGraphiteCache\index
Size 256KB
SHA256 b000fe4f71258146baa314456152ea99d46630a57c9367ff46b3f46f4d94dba5
MD5 141b4fac3f3ca3c54561826bf8109d31
SHA1 a22027add3fd4af424f847d0a70a42dcc21bbf98
SHA512 4e494f6190c59168f858a2f25e96889c52e5876497eddf71e90aead16891675502acd08bf55f2480adf64840145ab88c3e199797963b544090cd4586460e972e
SSDEEP 3:LstlNllkll/lS/:LsX3lEtS/
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\{6044A603-4DEE-4791-9A88-991787493727}\EBWebView\Default\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\{6044A603-4DEE-4791-9A88-991787493727}\EBWebView\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\{6044A603-4DEE-4791-9A88-991787493727}\EBWebView\Default\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\{6044A603-4DEE-4791-9A88-991787493727}\EBWebView\Default\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Temp\{6044A603-4DEE-4791-9A88-991787493727}\EBWebView\Default\Network\Network Persistent State
Size 1KB
SHA256 c79b104a86b088a249b46b8e4d49b8f60b0eb6f8dbd124086bb3302ee930e653
MD5 14725c24327cbd69420105204310b151
SHA1 f853745edb85d1643cb4132f810f96faa1ac2995
SHA512 1ae6726e0d98d06796748103bda07d6c02355f4132c2a1c7359e9a7dcb444ff49f96906062041ea4dc392f88aceb4936134957eb02c82695d22b93c3fb10ebf8
TLSH
T18D3129B783B8052D8A1291F45B18DE1FCF5E1821836CFA79C9D55E9393A14B1E210B4B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\{6044A603-4DEE-4791-9A88-991787493727}\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Temp\{6044A603-4DEE-4791-9A88-991787493727}\EBWebView\Default\Preferences
Size 6KB
SHA256 c10c8e92c82739209ed0d933a3c4ef67df772f8532aaba051540c032026767d1
MD5 c6653a0058027dfc7aa79cb749bc2d12
SHA1 3283d2a002d8fff555c98328b4461ab49d5ad170
SHA512 98a15dd83020364b01d07fb71af997baf0dc880bd92c01fda3153d02753429b6d9cc30be9ab0a7bea1e2a486b0b56c668c678a8ffcb62981dea6a3b779989a0e
SSDEEP 96:stg05GXS1Wb9BffKZ8i0vhExkE1m/7qx+WVHMSm+uecDVC1ibksfQj9+gChMEB:stg0YVfyZ8pa74/S+Wi1VCwbZfg4hM8
TLSH
T113D1B6425E3869774CC7F31A7A35BB16D3FA502265C04E88EFFC851C08E66DC620784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Temp\{6044A603-4DEE-4791-9A88-991787493727}\EBWebView\Default\Preferences
Size 6KB
SHA256 82bbe7fc6966acf45b086b3afd6ea14f624d45edb78c9d1a6315794d62a7c645
MD5 0361a1d528387a9ad0373d7d4ad83f4f
SHA1 0c77c7f273c633027ac134d703be720615a193c2
SHA512 204168dd4074fb90817c788d7eb18fede64f4faccca1b63196ea04296982ba16ca597f33f0439bcb30c4276b65629e4eefc5bea928de1bb6c067ca38e2667b60
SSDEEP 96:stg05GXS1Wb9sffKZ8i0vhExkE1m/7qx+WVHMSm+uecDVC1ibksfQj9+g4hMOB:stg0YIfyZ8pa74/S+Wi1VCwbZfg6hMC
TLSH
T122E1A6425E2869774CC7F31A7A35BB16E3FA502265C04E98EFFC8A1C05E66DC620780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe58d04b.TMP

Path C:\Users\Admin\AppData\Local\Temp\{6044A603-4DEE-4791-9A88-991787493727}\EBWebView\Default\Preferences~RFe58d04b.TMP
Size 6KB
SHA256 fb92aa90c489cf86750efe723dcddd5b249b11ce848faa5dea3c96c225b9d009
MD5 5992a30de2cde6fbafd3a112085e8928
SHA1 30077f1d84dc20d6cf23b79ac3943f2d15e820f1
SHA512 a246ea82ab185ad67ef85e3272f63e11205ca5442bb62f7708daf1a19c62729d70c6686e2774857a051266737e4dabb9dacfcfe09d0bdbab3072e0140d2c8fbe
SSDEEP 96:stg05GXS1Wb9BffkdZ8i0oExkE1m/7qx+WVHMSm+uecDVC1ibksfQj9+gChMEB:stg0YVfSZ8pF74/S+Wi1VCwbZfg4hM8
TLSH
T181D1A6425E38697B4CC7F2197A35BB16D3FA502265C44E98EBFC892C08E66DC620784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000001.dbtmp

Path C:\Users\Admin\AppData\Local\Temp\{6044A603-4DEE-4791-9A88-991787493727}\EBWebView\Default\Site Characteristics Database\000001.dbtmp
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\{6044A603-4DEE-4791-9A88-991787493727}\EBWebView\Local State
Size 1KB
SHA256 00c32639c1dfb58a0f6c31935c5e424df6e78e1b128a2d44859d3f392fe55147
MD5 a4bcf0ddcadf8c202dec22ceb3168241
SHA1 650ff5eba0a779a6d6ec420044f3aba8815b162c
SHA512 60c58a681134f850e8f8ae5885674b9e977e43d74f071ba3ff56c64f82554d1750e4f8537e409905eeeb26a3a6cae147d591e11dd3a66d150f2da66d47755720
TLSH
T1E7214277D4843D3129467E95B502764B2F51902A46610E18E6DF871C12F7A9C873AC33
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\{6044A603-4DEE-4791-9A88-991787493727}\EBWebView\Local State
Size 1KB
SHA256 4ebfbb6208cbba58fe05b8e62165d85ebb755119f688ade9ddbccfb66b847a85
MD5 aad0318ebd7859f614ef87b8cc6737e5
SHA1 43beecc696b8c582aba0dd599e3b92806cb204e1
SHA512 c7e88813435991d06bb87456476d79ecd723085be103899a290db6874096e33a5026e9ba86fd87ae4cc37f482fccc5eaa6ecacbc2ca998ab20b7402ac5b68bc1
TLSH
T1DD316773A4903E311D42BAC6B5467A472F11502A86610E44F6DF8B1C12F7B9C973AC33
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\{6044A603-4DEE-4791-9A88-991787493727}\EBWebView\Local State
Size 2KB
SHA256 1fd0b6b348c8df51c1d48799f5cdc91565be6329514123e23aa185802896e21a
MD5 467a11454cd35999506279c257a5e331
SHA1 3cb9985618e53ceac0a8cd03771309e0450e4afb
SHA512 4874fb5653d23a6a9ff43e78ee3cf98bdf53f94b79763a7a2af4637ec858456a21c40ff222f14c2cf1f2de6b74c630e8acaddafadc99f989efb6ef0ae2da7078
TLSH
T15D51DA7378447A7749D3BB85B94A3F039B3591155A611F90EADE4B0C01EB75C1316C37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\{6044A603-4DEE-4791-9A88-991787493727}\EBWebView\Local State
Size 3KB
SHA256 0654d8a12846a80f429fc9be158237057ab6cf7725bb9fb1bc54dd9df775e43b
MD5 a8c38539e8d6941762f7bdfd00824f67
SHA1 4ad5362136a4d8185ebd9257730a5522a3f2a743
SHA512 a2d0319de47a7aedc32af71403010745a0cef913196d62c55d2e908238d41f4eabadbc8bef1e00b14ca71f4892e38bb41538dc82340aceb938acb6330c56f2f7
TLSH
T1FF7184776564B9370DA3EE41B8863B06B7A59127D9912FA8DAED0F0C01EB79C1312C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\{6044A603-4DEE-4791-9A88-991787493727}\EBWebView\Local State
Size 16KB
SHA256 1e9697f7e9fd806838bb484e36c473ce5157b3ec9b92b580e0da33f183ce0ac0
MD5 68d166a0977a7e9437b77b1fb51c5b7b
SHA1 4f6e7d252785ee769bf3e91085de251148015680
SHA512 d7478d32dd80b9323b586bf7a030563013233a603263fcc9efc18e45d185b9b78338e17c080f3235143d5f7aa7f7bcec3d5756a5e8c36a2b879b09b09a3b4240
SSDEEP 192:z/7DFOKH/2/aQWjYhwZ00i+z/kNWIU6ZwNj1Jfo/iVQ45hgj4k0NbZGHyooDUD4n:z7+aQikB+z/xvxjg/qhEwNbrhniGc9zc
TLSH
T1D6729D3B55687E2759F2FA45B94D0B4BDBB9D47240C12AF88EEE5F0907DB3A80302D16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\{6044A603-4DEE-4791-9A88-991787493727}\EBWebView\Local State
Size 4KB
SHA256 6978d49520348e51a08a8000e84e062750ea01d98181e229563e2f04ce71e2e9
MD5 306cefa175e3ecd1373834c7900be54f
SHA1 baf37168baa0879f3fb7d043734575fffd8e79a4
SHA512 b1136788c24ad7d7c1ce2d297d97c2f50c37093b3c308b8624753da0cf805219c6aac2579d18dafcb4a38b41d6a7f0f2d0909a6952f94a3c8f201eda6e62d46a
SSDEEP 96:zuMbNkCE+fLGarWUS58Frh/cInURoDotoi5MD1NB8ZP6TaZh5T1lfa:z/bNbZGHyooDUD41T8ZxF+
TLSH
T1BA8195326574A9374DE3EA45B94A3B077765902799912FD8DAED0F0C02EB39C1352C17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.css

Path C:\Users\Admin\AppData\Local\Temp\{6044A603-4DEE-4791-9A88-991787493727}\index.css
Size 923KB
SHA256 cdd337f639e76f36fa41002b26e9a4f8c819d196747983283e25e3049fe5028e
MD5 e09f799bb69cecaf3987bc12cf65dd24
SHA1 ea57b540f246e00bd1e4bb7df3824bd8fa129a6c
SHA512 90a877a6024d996646055f496907276e4746cecab334b701f0d44d11b1d636984a049c74310606b7f0487549eb4b454318ba3b2e02ebc1121ff57970d885e1a4
SSDEEP 12288:oUxDxiaHbr3Gq5XRi5i6jE/5acgsu0wxT63kaSROcdOLeK+CnjG1VWzWhHuajOGh:oEBP3/5XSo/5F5K65SROcwLeKVYgzWIK
TLSH
T14D15CEE0D6A04D1D74378C3AA1CEA75E5514C28E55889FDBAE83ECF540CA696CF2270F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.html

Path C:\Users\Admin\AppData\Local\Temp\{6044A603-4DEE-4791-9A88-991787493727}\index.html
Size 426B
SHA256 886c0ab69e6e9d9d5b5909451640ea587accfcdf11b8369cad8542d1626ac375
MD5 a28ab17b18ff254173dfeef03245efd0
SHA1 c6ce20924565644601d4e0dd0fba9dde8dea5c77
SHA512 9371a699921b028bd93c35f9f2896d9997b906c8aba90dd4279abba0ae1909a8808a43bf829584e552ccfe534b2c991a5a7e3e3de7618343f50b1c47cff269d6
TLSH
T1A9E0225B1D924C1C62701BB4D9E2F82DCA45B64AA743AE2074C5256B6FB2B88CCCB64D
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2284-0-0x0000000000CB0000-0x0000000001760000-memory.dmp

Download

memory/3520-237-0x00007FFB91760000-0x00007FFB91761000-memory.dmp

Download

memory/3828-231-0x00007FFB91DA0000-0x00007FFB91DA1000-memory.dmp

Download

memory/3828-230-0x00007FFB91630000-0x00007FFB91631000-memory.dmp

Download

memory/4928-54-0x00007FFB91760000-0x00007FFB91761000-memory.dmp

Download

memory/5348-917-0x000001BB025D0000-0x000001BB025D1000-memory.dmp

Download

memory/5348-919-0x000001BB025D0000-0x000001BB025D1000-memory.dmp

Download

memory/5348-929-0x000001BB025D0000-0x000001BB025D1000-memory.dmp

Download

memory/5348-928-0x000001BB025D0000-0x000001BB025D1000-memory.dmp

Download

memory/5348-927-0x000001BB025D0000-0x000001BB025D1000-memory.dmp

Download

memory/5348-926-0x000001BB025D0000-0x000001BB025D1000-memory.dmp

Download

memory/5348-925-0x000001BB025D0000-0x000001BB025D1000-memory.dmp

Download

memory/5348-924-0x000001BB025D0000-0x000001BB025D1000-memory.dmp

Download

memory/5348-923-0x000001BB025D0000-0x000001BB025D1000-memory.dmp

Download

memory/5348-920-0x000001BB025D0000-0x000001BB025D1000-memory.dmp

Download