Overview

overview

6

Static

static

3

2026-08-17...at.exe

windows10-2004-x64

6

2026-08-17...at.exe

windows11-ltsc_2024-x64

6

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    17/08/2026, 01:54

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-17_b9d260d366779d6c9e4cf23a0a7dec25_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
  • Size 10.5MB
  • Sample260817-cbk5aa1elf
  • SHA256 b60fb4c61c74ae5e988b23a4891f6278dd03a005c035d5ffd325ea85f35f75dd
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
adwaredefense_evasiondiscoveryspywaretrojan

Malware Config

Signatures

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    defense_evasiontrojan
  • Network Share Discovery 1 TTPs

    Attempt to gather information on host network.

    discovery
  • Drops file in Windows directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 10 IoCs
  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 7 IoCs
  • Modifies system certificate store 2 TTPs 12 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 20 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • Suspicious use of WriteProcessMemory 50 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-17_b9d260d366779d6c9e4cf23a0a7dec25_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-17_b9d260d366779d6c9e4cf23a0a7dec25_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe"
    1⤵
    • Checks whether UAC is enabled
    • System Location Discovery: System Language Discovery
    • Checks processor information in registry
    • Enumerates system info in registry
    • Modifies Internet Explorer settings
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1852
    • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=2026-08-17_b9d260d366779d6c9e4cf23a0a7dec25_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe --webview-exe-version=2.14.0.66 --user-data-dir="C:\Users\Admin\AppData\Local\Adobe\webview2\2026-08-17_b9d260d366779d6c9e4cf23a0a7dec25_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=1 --allow-file-access-from-files --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=1852.3664.3368031605045694821 /pfhostedapp:25299ffff35d6a68ddd3bf11b737369fb9197a67
      2⤵
      • Drops file in Windows directory
      • Enumerates system info in registry
      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      • Suspicious use of WriteProcessMemory
      PID:2748
      • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Adobe\webview2\2026-08-17_b9d260d366779d6c9e4cf23a0a7dec25_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe\EBWebView /prefetch:4 /pfhostedapp:25299ffff35d6a68ddd3bf11b737369fb9197a67 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Adobe\webview2\2026-08-17_b9d260d366779d6c9e4cf23a0a7dec25_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x188,0x18c,0x190,0x184,0x198,0x7ffb48bb5fd8,0x7ffb48bb5fe4,0x7ffb48bb5ff0
        3⤵
          PID:2540
        • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
          "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Adobe\webview2\2026-08-17_b9d260d366779d6c9e4cf23a0a7dec25_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe\EBWebView" --webview-exe-name=2026-08-17_b9d260d366779d6c9e4cf23a0a7dec25_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe --webview-exe-version=2.14.0.66 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1736 --field-trial-handle=1740,i,4448111803539465514,7053140788534392869,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:2 /pfhostedapp:25299ffff35d6a68ddd3bf11b737369fb9197a67
          3⤵
            PID:5016
          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Adobe\webview2\2026-08-17_b9d260d366779d6c9e4cf23a0a7dec25_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe\EBWebView" --webview-exe-name=2026-08-17_b9d260d366779d6c9e4cf23a0a7dec25_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe --webview-exe-version=2.14.0.66 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --no-appcompat-clear --mojo-platform-channel-handle=2868 --field-trial-handle=1740,i,4448111803539465514,7053140788534392869,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:3 /pfhostedapp:25299ffff35d6a68ddd3bf11b737369fb9197a67
            3⤵
              PID:4460
            • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
              "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Adobe\webview2\2026-08-17_b9d260d366779d6c9e4cf23a0a7dec25_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe\EBWebView" --webview-exe-name=2026-08-17_b9d260d366779d6c9e4cf23a0a7dec25_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe --webview-exe-version=2.14.0.66 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --no-appcompat-clear --mojo-platform-channel-handle=2992 --field-trial-handle=1740,i,4448111803539465514,7053140788534392869,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:25299ffff35d6a68ddd3bf11b737369fb9197a67
              3⤵
                PID:5784
              • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Adobe\webview2\2026-08-17_b9d260d366779d6c9e4cf23a0a7dec25_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe\EBWebView" --webview-exe-name=2026-08-17_b9d260d366779d6c9e4cf23a0a7dec25_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe --webview-exe-version=2.14.0.66 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3292 --field-trial-handle=1740,i,4448111803539465514,7053140788534392869,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:25299ffff35d6a68ddd3bf11b737369fb9197a67 /prefetch:1
                3⤵
                  PID:4184
                • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Adobe\webview2\2026-08-17_b9d260d366779d6c9e4cf23a0a7dec25_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe\EBWebView" --webview-exe-name=2026-08-17_b9d260d366779d6c9e4cf23a0a7dec25_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe --webview-exe-version=2.14.0.66 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --no-appcompat-clear --mojo-platform-channel-handle=1892 --field-trial-handle=1740,i,4448111803539465514,7053140788534392869,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:25299ffff35d6a68ddd3bf11b737369fb9197a67
                  3⤵
                    PID:2716
                  • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Adobe\webview2\2026-08-17_b9d260d366779d6c9e4cf23a0a7dec25_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe\EBWebView" --webview-exe-name=2026-08-17_b9d260d366779d6c9e4cf23a0a7dec25_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe --webview-exe-version=2.14.0.66 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --no-appcompat-clear --mojo-platform-channel-handle=4720 --field-trial-handle=1740,i,4448111803539465514,7053140788534392869,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:25299ffff35d6a68ddd3bf11b737369fb9197a67
                    3⤵
                      PID:3700
                    • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Adobe\webview2\2026-08-17_b9d260d366779d6c9e4cf23a0a7dec25_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe\EBWebView" --webview-exe-name=2026-08-17_b9d260d366779d6c9e4cf23a0a7dec25_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe --webview-exe-version=2.14.0.66 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4740 --field-trial-handle=1740,i,4448111803539465514,7053140788534392869,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:25299ffff35d6a68ddd3bf11b737369fb9197a67
                      3⤵
                      • Suspicious behavior: EnumeratesProcesses
                      PID:2652
                    • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Adobe\webview2\2026-08-17_b9d260d366779d6c9e4cf23a0a7dec25_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe\EBWebView" --webview-exe-name=2026-08-17_b9d260d366779d6c9e4cf23a0a7dec25_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe --webview-exe-version=2.14.0.66 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --no-appcompat-clear --mojo-platform-channel-handle=1036 --field-trial-handle=1740,i,4448111803539465514,7053140788534392869,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:25299ffff35d6a68ddd3bf11b737369fb9197a67
                      3⤵
                        PID:6124
                    • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=2026-08-17_b9d260d366779d6c9e4cf23a0a7dec25_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe --webview-exe-version=2.14.0.66 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\{836CF6DB-1AF5-41DA-B840-43B9F1773FAA}\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=1 --allow-file-access-from-files --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=1852.3664.9648591077620292273 /pfhostedapp:582495f866d8ca0cfe3a3dc8cd8b4127ba2b73f8
                      2⤵
                      • Drops file in Windows directory
                      • Enumerates system info in registry
                      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                      • Suspicious use of WriteProcessMemory
                      PID:2216
                      • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\{836CF6DB-1AF5-41DA-B840-43B9F1773FAA}\EBWebView /prefetch:4 /pfhostedapp:582495f866d8ca0cfe3a3dc8cd8b4127ba2b73f8 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\{836CF6DB-1AF5-41DA-B840-43B9F1773FAA}\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ffb48bb5fd8,0x7ffb48bb5fe4,0x7ffb48bb5ff0
                        3⤵
                          PID:5664
                        • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                          "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\{836CF6DB-1AF5-41DA-B840-43B9F1773FAA}\EBWebView" --webview-exe-name=2026-08-17_b9d260d366779d6c9e4cf23a0a7dec25_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe --webview-exe-version=2.14.0.66 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1704 --field-trial-handle=1708,i,11637329970077196564,5755075160863829526,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:2 /pfhostedapp:582495f866d8ca0cfe3a3dc8cd8b4127ba2b73f8
                          3⤵
                            PID:924
                          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\{836CF6DB-1AF5-41DA-B840-43B9F1773FAA}\EBWebView" --webview-exe-name=2026-08-17_b9d260d366779d6c9e4cf23a0a7dec25_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe --webview-exe-version=2.14.0.66 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --no-appcompat-clear --mojo-platform-channel-handle=2900 --field-trial-handle=1708,i,11637329970077196564,5755075160863829526,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:3 /pfhostedapp:582495f866d8ca0cfe3a3dc8cd8b4127ba2b73f8
                            3⤵
                              PID:1448
                            • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                              "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\{836CF6DB-1AF5-41DA-B840-43B9F1773FAA}\EBWebView" --webview-exe-name=2026-08-17_b9d260d366779d6c9e4cf23a0a7dec25_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe --webview-exe-version=2.14.0.66 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --no-appcompat-clear --mojo-platform-channel-handle=3100 --field-trial-handle=1708,i,11637329970077196564,5755075160863829526,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:582495f866d8ca0cfe3a3dc8cd8b4127ba2b73f8
                              3⤵
                                PID:4668
                              • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                                "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\{836CF6DB-1AF5-41DA-B840-43B9F1773FAA}\EBWebView" --webview-exe-name=2026-08-17_b9d260d366779d6c9e4cf23a0a7dec25_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe --webview-exe-version=2.14.0.66 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3360 --field-trial-handle=1708,i,11637329970077196564,5755075160863829526,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:582495f866d8ca0cfe3a3dc8cd8b4127ba2b73f8 /prefetch:1
                                3⤵
                                  PID:2536
                                • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                                  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\{836CF6DB-1AF5-41DA-B840-43B9F1773FAA}\EBWebView" --webview-exe-name=2026-08-17_b9d260d366779d6c9e4cf23a0a7dec25_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe --webview-exe-version=2.14.0.66 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --no-appcompat-clear --mojo-platform-channel-handle=4340 --field-trial-handle=1708,i,11637329970077196564,5755075160863829526,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:582495f866d8ca0cfe3a3dc8cd8b4127ba2b73f8
                                  3⤵
                                    PID:3712
                                  • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                                    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\{836CF6DB-1AF5-41DA-B840-43B9F1773FAA}\EBWebView" --webview-exe-name=2026-08-17_b9d260d366779d6c9e4cf23a0a7dec25_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe --webview-exe-version=2.14.0.66 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --no-appcompat-clear --mojo-platform-channel-handle=4340 --field-trial-handle=1708,i,11637329970077196564,5755075160863829526,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:582495f866d8ca0cfe3a3dc8cd8b4127ba2b73f8
                                    3⤵
                                      PID:4808
                                    • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                                      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\{836CF6DB-1AF5-41DA-B840-43B9F1773FAA}\EBWebView" --webview-exe-name=2026-08-17_b9d260d366779d6c9e4cf23a0a7dec25_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe --webview-exe-version=2.14.0.66 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4740 --field-trial-handle=1708,i,11637329970077196564,5755075160863829526,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:582495f866d8ca0cfe3a3dc8cd8b4127ba2b73f8
                                      3⤵
                                      • Suspicious behavior: EnumeratesProcesses
                                      PID:5560
                                    • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                                      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\{836CF6DB-1AF5-41DA-B840-43B9F1773FAA}\EBWebView" --webview-exe-name=2026-08-17_b9d260d366779d6c9e4cf23a0a7dec25_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe --webview-exe-version=2.14.0.66 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --no-appcompat-clear --mojo-platform-channel-handle=4588 --field-trial-handle=1708,i,11637329970077196564,5755075160863829526,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:582495f866d8ca0cfe3a3dc8cd8b4127ba2b73f8
                                      3⤵
                                        PID:3076
                                  • C:\Windows\system32\svchost.exe
                                    C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                                    1⤵
                                      PID:4760
                                    • C:\Windows\system32\svchost.exe
                                      C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
                                      1⤵
                                      • Modifies data under HKEY_USERS
                                      PID:1980

                                    Network

                                          MITRE ATT&CK Enterprise v16

                                          Replay Monitor

                                          Loading Replay Monitor...

                                          Downloads

                                          settings.dat
                                          • Path C:\Users\Admin\AppData\Local\Adobe\webview2\2026-08-17_b9d260d366779d6c9e4cf23a0a7dec25_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe\EBWebView\Crashpad\settings.dat
                                          • Size 280B
                                          • SHA256 b76cf7b897c8ed372aa33ab4b9cd2b995d7a71ae0b6e924d1fde956969566764
                                          • MD5 SHA1 SHA512
                                          Submit Download

                                          settings.dat
                                          • Path C:\Users\Admin\AppData\Local\Adobe\webview2\2026-08-17_b9d260d366779d6c9e4cf23a0a7dec25_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe\EBWebView\Crashpad\settings.dat
                                          • Size 280B
                                          • SHA256 4bc22cb771eba14b896c207fdde67754f9ece30c9753d32f56fa564ba4722e19
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          data_3
                                          • Path C:\Users\Admin\AppData\Local\Adobe\webview2\2026-08-17_b9d260d366779d6c9e4cf23a0a7dec25_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe\EBWebView\Default\GPUCache\data_3
                                          • Size 8KB
                                          • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
                                          • MD5 SHA1 SHA512 SSDEEP
                                          Submit Download

                                          Network Persistent State
                                          • Path C:\Users\Admin\AppData\Local\Adobe\webview2\2026-08-17_b9d260d366779d6c9e4cf23a0a7dec25_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe\EBWebView\Default\Network\Network Persistent State
                                          • Size 59B
                                          • SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          Network Persistent State
                                          • Path C:\Users\Admin\AppData\Local\Adobe\webview2\2026-08-17_b9d260d366779d6c9e4cf23a0a7dec25_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe\EBWebView\Default\Network\Network Persistent State
                                          • Size 230B
                                          • SHA256 27c739561615160aaec0e7ed7f318ddb661114fd768ee1f72dcccbe4e82ea588
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          Preferences
                                          • Path C:\Users\Admin\AppData\Local\Adobe\webview2\2026-08-17_b9d260d366779d6c9e4cf23a0a7dec25_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe\EBWebView\Default\Preferences
                                          • Size 6KB
                                          • SHA256 b7ab24515883a58eb89cf7d11777b1e7ceea396cb2a4fb74e7f766d655b8bf91
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          b7d3a092-1c24-469c-ad05-321ae3d50a32.tmp
                                          • Path C:\Users\Admin\AppData\Local\Adobe\webview2\2026-08-17_b9d260d366779d6c9e4cf23a0a7dec25_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe\EBWebView\Default\b7d3a092-1c24-469c-ad05-321ae3d50a32.tmp
                                          • Size 6KB
                                          • SHA256 84ea38bcd9489cb74c2a92fd8177fd991bf6a39d22fc23f9ce08e3aced23b44a
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          Local State
                                          • Path C:\Users\Admin\AppData\Local\Adobe\webview2\2026-08-17_b9d260d366779d6c9e4cf23a0a7dec25_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe\EBWebView\Local State
                                          • Size 2KB
                                          • SHA256 29790c3de8f6a91d0e4812cd28fab7798e848727056c1c193949408b59607ec3
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          Local State
                                          • Path C:\Users\Admin\AppData\Local\Adobe\webview2\2026-08-17_b9d260d366779d6c9e4cf23a0a7dec25_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe\EBWebView\Local State
                                          • Size 3KB
                                          • SHA256 d1c5a9c64a84ecc32220a021b5f213dcacb179d1997a677c926bad9a7ed88b70
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          Local State
                                          • Path C:\Users\Admin\AppData\Local\Adobe\webview2\2026-08-17_b9d260d366779d6c9e4cf23a0a7dec25_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe\EBWebView\Local State
                                          • Size 15KB
                                          • SHA256 c573b67c74abefb82c93667a07d32ced712a51c5a31966dbf60929f2d168121b
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          Local State~RFe5924e3.TMP
                                          • Path C:\Users\Admin\AppData\Local\Adobe\webview2\2026-08-17_b9d260d366779d6c9e4cf23a0a7dec25_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe\EBWebView\Local State~RFe5924e3.TMP
                                          • Size 1KB
                                          • SHA256 2f6d14a8277d25d2f7a75829f38785b85747f11b4a2a8eea4ffa22bc8f2394f4
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          CCDInstaller.js
                                          • Path C:\Users\Admin\AppData\Local\Temp\{836CF6DB-1AF5-41DA-B840-43B9F1773FAA}\CCDInstaller.js
                                          • Size 1.8MB
                                          • SHA256 b3cd90e4b56fa44d062d9b061f48f88cfb4372f64ed2f71da40e04aeb004bfda
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          settings.dat
                                          • Path C:\Users\Admin\AppData\Local\Temp\{836CF6DB-1AF5-41DA-B840-43B9F1773FAA}\EBWebView\Crashpad\settings.dat
                                          • Size 280B
                                          • SHA256 f62aaefdd748271f85d95feca232451aee654d2a5808925331684517154a8a2b
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          settings.dat
                                          • Path C:\Users\Admin\AppData\Local\Temp\{836CF6DB-1AF5-41DA-B840-43B9F1773FAA}\EBWebView\Crashpad\settings.dat
                                          • Size 280B
                                          • SHA256 a276c9189ecb474926bd30e61ae74904db2a242250af485c6f3597fc0a6d81d2
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          throttle_store.dat
                                          • Path C:\Users\Admin\AppData\Local\Temp\{836CF6DB-1AF5-41DA-B840-43B9F1773FAA}\EBWebView\Crashpad\throttle_store.dat
                                          • Size 20B
                                          • SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
                                          • MD5 SHA1 SHA512
                                          Submit Download

                                          the-real-index
                                          • Path C:\Users\Admin\AppData\Local\Temp\{836CF6DB-1AF5-41DA-B840-43B9F1773FAA}\EBWebView\Default\Code Cache\js\index-dir\the-real-index
                                          • Size 240B
                                          • SHA256 fee1110f1e26d6eb7cf0dba121574a9f2428181e1a9546d7db4fb44ccc7b61bd
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          the-real-index
                                          • Path C:\Users\Admin\AppData\Local\Temp\{836CF6DB-1AF5-41DA-B840-43B9F1773FAA}\EBWebView\Default\Code Cache\js\index-dir\the-real-index
                                          • Size 264B
                                          • SHA256 3dd0c03d35cc39914bdf5fe5effd09a0073009a627f2547c7022450ab66e85b3
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          the-real-index~RFe59e843.TMP
                                          • Path C:\Users\Admin\AppData\Local\Temp\{836CF6DB-1AF5-41DA-B840-43B9F1773FAA}\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe59e843.TMP
                                          • Size 48B
                                          • SHA256 2f11d93b72117644909d00faa9f2cbc8c1a74f4bb2f8f1c7451758be02d1fd99
                                          • MD5 SHA1 SHA512
                                          Submit Download

                                          data_0
                                          • Path C:\Users\Admin\AppData\Local\Temp\{836CF6DB-1AF5-41DA-B840-43B9F1773FAA}\EBWebView\Default\DawnCache\data_0
                                          • Size 8KB
                                          • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
                                          • MD5 SHA1 SHA512 SSDEEP
                                          Submit Download

                                          data_1
                                          • Path C:\Users\Admin\AppData\Local\Temp\{836CF6DB-1AF5-41DA-B840-43B9F1773FAA}\EBWebView\Default\DawnCache\data_1
                                          • Size 264KB
                                          • SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
                                          • MD5 SHA1 SHA512 SSDEEP
                                          Submit Download

                                          data_2
                                          • Path C:\Users\Admin\AppData\Local\Temp\{836CF6DB-1AF5-41DA-B840-43B9F1773FAA}\EBWebView\Default\DawnCache\data_2
                                          • Size 8KB
                                          • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
                                          • MD5 SHA1 SHA512 SSDEEP
                                          Submit Download

                                          CURRENT
                                          • Path C:\Users\Admin\AppData\Local\Temp\{836CF6DB-1AF5-41DA-B840-43B9F1773FAA}\EBWebView\Default\Extension Rules\CURRENT
                                          • Size 16B
                                          • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                                          • MD5 SHA1 SHA512
                                          Submit Download

                                          Network Persistent State
                                          • Path C:\Users\Admin\AppData\Local\Temp\{836CF6DB-1AF5-41DA-B840-43B9F1773FAA}\EBWebView\Default\Network\Network Persistent State
                                          • Size 1KB
                                          • SHA256 481a82133535730787344623040452796585fc3f151dcca437d88f2ecfd0e8df
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          SCT Auditing Pending Reports
                                          • Path C:\Users\Admin\AppData\Local\Temp\{836CF6DB-1AF5-41DA-B840-43B9F1773FAA}\EBWebView\Default\Network\SCT Auditing Pending Reports
                                          • Size 2B
                                          • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                          • MD5 SHA1 SHA512
                                          Submit Download

                                          TransportSecurity
                                          • Path C:\Users\Admin\AppData\Local\Temp\{836CF6DB-1AF5-41DA-B840-43B9F1773FAA}\EBWebView\Default\Network\TransportSecurity
                                          • Size 1KB
                                          • SHA256 87cb7dbe53550905d8a6cd2585313838e48392cd9d4e197775fe0bc3bf4ff256
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          TransportSecurity
                                          • Path C:\Users\Admin\AppData\Local\Temp\{836CF6DB-1AF5-41DA-B840-43B9F1773FAA}\EBWebView\Default\Network\TransportSecurity
                                          • Size 1KB
                                          • SHA256 11adcc199403de939f30e20cb384ce824e24dd7219c2edbf24ac1efe31b73b43
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          TransportSecurity~RFe59b491.TMP
                                          • Path C:\Users\Admin\AppData\Local\Temp\{836CF6DB-1AF5-41DA-B840-43B9F1773FAA}\EBWebView\Default\Network\TransportSecurity~RFe59b491.TMP
                                          • Size 188B
                                          • SHA256 05b882dc2f4cc3abfb40830af37dcbc772055dbc26a4e98401e1285555ccab60
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          Preferences
                                          • Path C:\Users\Admin\AppData\Local\Temp\{836CF6DB-1AF5-41DA-B840-43B9F1773FAA}\EBWebView\Default\Preferences
                                          • Size 6KB
                                          • SHA256 867940b4d86eeddca17f22e9ff229382d325bcc1dc3f63a27a4fb36415ddb92e
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          Preferences
                                          • Path C:\Users\Admin\AppData\Local\Temp\{836CF6DB-1AF5-41DA-B840-43B9F1773FAA}\EBWebView\Default\Preferences
                                          • Size 6KB
                                          • SHA256 7c940b43072d92348af7322579d196ae035e7c4b8e9da7180aff63dcd26aa5b3
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          Preferences~RFe59c172.TMP
                                          • Path C:\Users\Admin\AppData\Local\Temp\{836CF6DB-1AF5-41DA-B840-43B9F1773FAA}\EBWebView\Default\Preferences~RFe59c172.TMP
                                          • Size 5KB
                                          • SHA256 850957ddf6fb32b8a192af56b36b8bcaed56ac2d54af5c5cf616a283e1fa30fb
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          index
                                          • Path C:\Users\Admin\AppData\Local\Temp\{836CF6DB-1AF5-41DA-B840-43B9F1773FAA}\EBWebView\Default\Shared Dictionary\cache\index
                                          • Size 24B
                                          • SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
                                          • MD5 SHA1 SHA512
                                          Submit Download

                                          MANIFEST-000001
                                          • Path C:\Users\Admin\AppData\Local\Temp\{836CF6DB-1AF5-41DA-B840-43B9F1773FAA}\EBWebView\Default\shared_proto_db\metadata\MANIFEST-000001
                                          • Size 41B
                                          • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                                          • MD5 SHA1 SHA512
                                          Submit Download

                                          Local State
                                          • Path C:\Users\Admin\AppData\Local\Temp\{836CF6DB-1AF5-41DA-B840-43B9F1773FAA}\EBWebView\Local State
                                          • Size 3KB
                                          • SHA256 564a5d1f4f5f240757401e640c5cf23d42ce24e527873fce14c6213d1117480a
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          Local State
                                          • Path C:\Users\Admin\AppData\Local\Temp\{836CF6DB-1AF5-41DA-B840-43B9F1773FAA}\EBWebView\Local State
                                          • Size 3KB
                                          • SHA256 2b2d290501862b025bbb3ef0b4118b7c9280b5227fe9fb516303b530acbd0e30
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          Local State
                                          • Path C:\Users\Admin\AppData\Local\Temp\{836CF6DB-1AF5-41DA-B840-43B9F1773FAA}\EBWebView\Local State
                                          • Size 2KB
                                          • SHA256 7bf02a90e4a9b2fb7f206c0db6a0062c61e1f5499120391e21f95377904a7ed0
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          Local State~RFe592457.TMP
                                          • Path C:\Users\Admin\AppData\Local\Temp\{836CF6DB-1AF5-41DA-B840-43B9F1773FAA}\EBWebView\Local State~RFe592457.TMP
                                          • Size 1KB
                                          • SHA256 6eba5976c512d1fd03ae1411830d6e85008358bbc82732e4c733ae0b7e015c1a
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          index.css
                                          • Path C:\Users\Admin\AppData\Local\Temp\{836CF6DB-1AF5-41DA-B840-43B9F1773FAA}\index.css
                                          • Size 923KB
                                          • SHA256 cdd337f639e76f36fa41002b26e9a4f8c819d196747983283e25e3049fe5028e
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          index.html
                                          • Path C:\Users\Admin\AppData\Local\Temp\{836CF6DB-1AF5-41DA-B840-43B9F1773FAA}\index.html
                                          • Size 426B
                                          • SHA256 886c0ab69e6e9d9d5b5909451640ea587accfcdf11b8369cad8542d1626ac375
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          hyph-bn.hyb
                                          • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2216_1577633388\hyph-bn.hyb
                                          • Size 703B
                                          • SHA256 c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          hyph-mr.hyb
                                          • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2216_1577633388\hyph-mr.hyb
                                          • Size 687B
                                          • SHA256 f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          hyph-nn.hyb
                                          • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2216_1577633388\hyph-nn.hyb
                                          • Size 141KB
                                          • SHA256 5bcbb58eaf65f13f6d039244d942f37c127344e3a0a2e6c32d08236945132809
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          memory/924-215-0x00007FFB6A680000-0x00007FFB6A681000-memory.dmp
                                          Download

                                          memory/1852-0-0x0000000000470000-0x0000000000F20000-memory.dmp
                                          Download

                                          memory/2536-217-0x00007FFB6A680000-0x00007FFB6A681000-memory.dmp
                                          Download

                                          memory/2652-651-0x000002534DA70000-0x000002534DA71000-memory.dmp
                                          Download

                                          memory/2652-649-0x000002534DA70000-0x000002534DA71000-memory.dmp
                                          Download

                                          memory/2716-538-0x00007FFB69210000-0x00007FFB69211000-memory.dmp
                                          Download

                                          memory/2716-539-0x00007FFB6B090000-0x00007FFB6B091000-memory.dmp
                                          Download

                                          memory/5560-660-0x000001F4DCFF0000-0x000001F4DCFF1000-memory.dmp
                                          Download

                                          memory/5560-659-0x000001F4DCFF0000-0x000001F4DCFF1000-memory.dmp
                                          Download

                                          memory/5560-658-0x000001F4DCFF0000-0x000001F4DCFF1000-memory.dmp
                                          Download

                                          memory/5560-657-0x000001F4DCFF0000-0x000001F4DCFF1000-memory.dmp
                                          Download

                                          memory/5560-656-0x000001F4DCFF0000-0x000001F4DCFF1000-memory.dmp
                                          Download

                                          memory/5560-655-0x000001F4DCFF0000-0x000001F4DCFF1000-memory.dmp
                                          Download