Overview

overview

7

Static

static

3

2026-09-30...ee.exe

windows10-2004-x64

7

2026-09-30...ee.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    92s
  • max time network
    155s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    01/10/2026, 10:58

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-09-30_85e11fcfe6d3568b5bf4e5fa9f1d411a_darkgate_elex_gcleaner_mafia_stealc_tofsee.exe
  • Size 5.7MB
  • Sample261001-m2wc2sae94
  • SHA256 0115bc82d7ac551a6d7b7a4e60c32b1daf0c2ba24b08f862e9c15a41d4a83a73
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryinstallerpersistenceprivilege_escalation

Malware Config

Signatures

  • Creates a file in the Startup directory 1 TTPs 64 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Executes dropped EXE 64 IoCs
  • Loads dropped DLL 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Reads the TCP/IP host and domain name from the registry 1 TTPs 64 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Inno Setup is an open-source installation builder for Windows applications. 4 IoCs

    Inno Setup installer

    installer
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-09-30_85e11fcfe6d3568b5bf4e5fa9f1d411a_darkgate_elex_gcleaner_mafia_stealc_tofsee.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-09-30_85e11fcfe6d3568b5bf4e5fa9f1d411a_darkgate_elex_gcleaner_mafia_stealc_tofsee.exe"
    1⤵
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4276
    • C:\Users\Admin\AppData\Local\Temp\optprosetup.exe
      C:\Users\Admin\AppData\Local\Temp\\optprosetup.exe /MMJS
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4376
      • C:\Users\Admin\AppData\Local\Temp\is-30KPD.tmp\optprosetup.tmp
        "C:\Users\Admin\AppData\Local\Temp\is-30KPD.tmp\optprosetup.tmp" /SL5="$300AE,5165377,115200,C:\Users\Admin\AppData\Local\Temp\optprosetup.exe" /MMJS
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Reads the TCP/IP host and domain name from the registry
        • Checks processor information in registry
        PID:1044
  • C:\PROGRA~3\{8C927~1\2026-09-30_85e11fcfe6d3568b5bf4e5fa9f1d411a_darkgate_elex_gcleaner_mafia_stealc_tofsee.exe
    C:\PROGRA~3\{8C927~1\2026-0~1.EXE
    1⤵
    • Creates a file in the Startup directory
    • Executes dropped EXE
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    PID:4100
  • C:\PROGRA~3\{0A0D2~1\2026-09-30_85e11fcfe6d3568b5bf4e5fa9f1d411a_darkgate_elex_gcleaner_mafia_stealc_tofsee.exe
    C:\PROGRA~3\{0A0D2~1\2026-0~1.EXE
    1⤵
    • Creates a file in the Startup directory
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    PID:4356
  • C:\PROGRA~3\{15F17~1\2026-09-30_85e11fcfe6d3568b5bf4e5fa9f1d411a_darkgate_elex_gcleaner_mafia_stealc_tofsee.exe
    C:\PROGRA~3\{15F17~1\2026-0~1.EXE
    1⤵
    • Creates a file in the Startup directory
    • Executes dropped EXE
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    PID:1676
  • C:\PROGRA~3\{28E0E~1\2026-09-30_85e11fcfe6d3568b5bf4e5fa9f1d411a_darkgate_elex_gcleaner_mafia_stealc_tofsee.exe
    C:\PROGRA~3\{28E0E~1\2026-0~1.EXE
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    PID:5996
  • C:\PROGRA~3\{5F5F2~1\2026-09-30_85e11fcfe6d3568b5bf4e5fa9f1d411a_darkgate_elex_gcleaner_mafia_stealc_tofsee.exe
    C:\PROGRA~3\{5F5F2~1\2026-0~1.EXE
    1⤵
    • Creates a file in the Startup directory
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    PID:2208
  • C:\PROGRA~3\{57291~1\2026-09-30_85e11fcfe6d3568b5bf4e5fa9f1d411a_darkgate_elex_gcleaner_mafia_stealc_tofsee.exe
    C:\PROGRA~3\{57291~1\2026-0~1.EXE
    1⤵
    • Creates a file in the Startup directory
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    PID:2324
  • C:\PROGRA~3\{13C81~1\2026-09-30_85e11fcfe6d3568b5bf4e5fa9f1d411a_darkgate_elex_gcleaner_mafia_stealc_tofsee.exe
    C:\PROGRA~3\{13C81~1\2026-0~1.EXE
    1⤵
    • Creates a file in the Startup directory
    • Executes dropped EXE
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    PID:2700
  • C:\PROGRA~3\{FF6EF~1\2026-09-30_85e11fcfe6d3568b5bf4e5fa9f1d411a_darkgate_elex_gcleaner_mafia_stealc_tofsee.exe
    C:\PROGRA~3\{FF6EF~1\2026-0~1.EXE
    1⤵
    • Creates a file in the Startup directory
    • Executes dropped EXE
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    PID:4580
  • C:\PROGRA~3\{53BBB~1\2026-09-30_85e11fcfe6d3568b5bf4e5fa9f1d411a_darkgate_elex_gcleaner_mafia_stealc_tofsee.exe
    C:\PROGRA~3\{53BBB~1\2026-0~1.EXE
    1⤵
    • Creates a file in the Startup directory
    • Executes dropped EXE
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    PID:4520
  • C:\PROGRA~3\{664EC~1\2026-09-30_85e11fcfe6d3568b5bf4e5fa9f1d411a_darkgate_elex_gcleaner_mafia_stealc_tofsee.exe
    C:\PROGRA~3\{664EC~1\2026-0~1.EXE
    1⤵
    • Creates a file in the Startup directory
    • Executes dropped EXE
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    PID:3600
  • C:\PROGRA~3\{2F4EF~1\2026-09-30_85e11fcfe6d3568b5bf4e5fa9f1d411a_darkgate_elex_gcleaner_mafia_stealc_tofsee.exe
    C:\PROGRA~3\{2F4EF~1\2026-0~1.EXE
    1⤵
    • Creates a file in the Startup directory
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    PID:4084
  • C:\PROGRA~3\{843EB~1\2026-09-30_85e11fcfe6d3568b5bf4e5fa9f1d411a_darkgate_elex_gcleaner_mafia_stealc_tofsee.exe
    C:\PROGRA~3\{843EB~1\2026-0~1.EXE
    1⤵
    • Creates a file in the Startup directory
    • Executes dropped EXE
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    PID:2952
  • C:\PROGRA~3\{C5805~1\2026-09-30_85e11fcfe6d3568b5bf4e5fa9f1d411a_darkgate_elex_gcleaner_mafia_stealc_tofsee.exe
    C:\PROGRA~3\{C5805~1\2026-0~1.EXE
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    PID:4088
  • C:\PROGRA~3\{95838~1\2026-09-30_85e11fcfe6d3568b5bf4e5fa9f1d411a_darkgate_elex_gcleaner_mafia_stealc_tofsee.exe
    C:\PROGRA~3\{95838~1\2026-0~1.EXE
    1⤵
    • Creates a file in the Startup directory
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    PID:2192
  • C:\PROGRA~3\{3271B~1\2026-09-30_85e11fcfe6d3568b5bf4e5fa9f1d411a_darkgate_elex_gcleaner_mafia_stealc_tofsee.exe
    C:\PROGRA~3\{3271B~1\2026-0~1.EXE
    1⤵
    • Creates a file in the Startup directory
    • Executes dropped EXE
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    PID:4480
  • C:\PROGRA~3\{911F6~1\2026-09-30_85e11fcfe6d3568b5bf4e5fa9f1d411a_darkgate_elex_gcleaner_mafia_stealc_tofsee.exe
    C:\PROGRA~3\{911F6~1\2026-0~1.EXE
    1⤵
    • Creates a file in the Startup directory
    • Executes dropped EXE
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    PID:1936
  • C:\PROGRA~3\{B9D54~1\2026-09-30_85e11fcfe6d3568b5bf4e5fa9f1d411a_darkgate_elex_gcleaner_mafia_stealc_tofsee.exe
    C:\PROGRA~3\{B9D54~1\2026-0~1.EXE
    1⤵
    • Creates a file in the Startup directory
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    PID:1476
  • C:\PROGRA~3\{32BE1~1\2026-09-30_85e11fcfe6d3568b5bf4e5fa9f1d411a_darkgate_elex_gcleaner_mafia_stealc_tofsee.exe
    C:\PROGRA~3\{32BE1~1\2026-0~1.EXE
    1⤵
    • Creates a file in the Startup directory
    • Executes dropped EXE
    • Reads the TCP/IP host and domain name from the registry
    PID:796
  • C:\PROGRA~3\{E0A3E~1\2026-09-30_85e11fcfe6d3568b5bf4e5fa9f1d411a_darkgate_elex_gcleaner_mafia_stealc_tofsee.exe
    C:\PROGRA~3\{E0A3E~1\2026-0~1.EXE
    1⤵
    • Creates a file in the Startup directory
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    PID:2020
  • C:\PROGRA~3\{AE26E~1\2026-09-30_85e11fcfe6d3568b5bf4e5fa9f1d411a_darkgate_elex_gcleaner_mafia_stealc_tofsee.exe
    C:\PROGRA~3\{AE26E~1\2026-0~1.EXE
    1⤵
    • Creates a file in the Startup directory
    • Executes dropped EXE
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    PID:1512
  • C:\PROGRA~3\{618A6~1\2026-09-30_85e11fcfe6d3568b5bf4e5fa9f1d411a_darkgate_elex_gcleaner_mafia_stealc_tofsee.exe
    C:\PROGRA~3\{618A6~1\2026-0~1.EXE
    1⤵
    • Creates a file in the Startup directory
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    PID:2908
  • C:\PROGRA~3\{48097~1\2026-09-30_85e11fcfe6d3568b5bf4e5fa9f1d411a_darkgate_elex_gcleaner_mafia_stealc_tofsee.exe
    C:\PROGRA~3\{48097~1\2026-0~1.EXE
    1⤵
    • Creates a file in the Startup directory
    • Executes dropped EXE
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    PID:2072
  • C:\PROGRA~3\{AF363~1\2026-09-30_85e11fcfe6d3568b5bf4e5fa9f1d411a_darkgate_elex_gcleaner_mafia_stealc_tofsee.exe
    C:\PROGRA~3\{AF363~1\2026-0~1.EXE
    1⤵
    • Creates a file in the Startup directory
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    PID:2320
  • C:\PROGRA~3\{871F6~1\2026-09-30_85e11fcfe6d3568b5bf4e5fa9f1d411a_darkgate_elex_gcleaner_mafia_stealc_tofsee.exe
    C:\PROGRA~3\{871F6~1\2026-0~1.EXE
    1⤵
    • Creates a file in the Startup directory
    • Executes dropped EXE
    • Reads the TCP/IP host and domain name from the registry
    PID:4976
  • C:\PROGRA~3\{3603B~1\2026-09-30_85e11fcfe6d3568b5bf4e5fa9f1d411a_darkgate_elex_gcleaner_mafia_stealc_tofsee.exe
    C:\PROGRA~3\{3603B~1\2026-0~1.EXE
    1⤵
    • Creates a file in the Startup directory
    • Executes dropped EXE
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    PID:5708
  • C:\PROGRA~3\{E68F4~1\2026-09-30_85e11fcfe6d3568b5bf4e5fa9f1d411a_darkgate_elex_gcleaner_mafia_stealc_tofsee.exe
    C:\PROGRA~3\{E68F4~1\2026-0~1.EXE
    1⤵
    • Executes dropped EXE
    PID:4472
  • C:\PROGRA~3\{9CC6E~1\2026-09-30_85e11fcfe6d3568b5bf4e5fa9f1d411a_darkgate_elex_gcleaner_mafia_stealc_tofsee.exe
    C:\PROGRA~3\{9CC6E~1\2026-0~1.EXE
    1⤵
    • Creates a file in the Startup directory
    • Executes dropped EXE
    PID:1980
  • C:\PROGRA~3\{DE612~1\2026-09-30_85e11fcfe6d3568b5bf4e5fa9f1d411a_darkgate_elex_gcleaner_mafia_stealc_tofsee.exe
    C:\PROGRA~3\{DE612~1\2026-0~1.EXE
    1⤵
    • Creates a file in the Startup directory
    • Executes dropped EXE
    PID:1840
  • C:\PROGRA~3\{2F75A~1\2026-09-30_85e11fcfe6d3568b5bf4e5fa9f1d411a_darkgate_elex_gcleaner_mafia_stealc_tofsee.exe
    C:\PROGRA~3\{2F75A~1\2026-0~1.EXE
    1⤵
    • Creates a file in the Startup directory
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    PID:4672
  • C:\PROGRA~3\{35327~1\2026-09-30_85e11fcfe6d3568b5bf4e5fa9f1d411a_darkgate_elex_gcleaner_mafia_stealc_tofsee.exe
    C:\PROGRA~3\{35327~1\2026-0~1.EXE
    1⤵
    • Creates a file in the Startup directory
    • Executes dropped EXE
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    PID:4444
  • C:\PROGRA~3\{8DB23~1\2026-09-30_85e11fcfe6d3568b5bf4e5fa9f1d411a_darkgate_elex_gcleaner_mafia_stealc_tofsee.exe
    C:\PROGRA~3\{8DB23~1\2026-0~1.EXE
    1⤵
    • Executes dropped EXE
    • Reads the TCP/IP host and domain name from the registry
    PID:4796
  • C:\PROGRA~3\{61065~1\2026-09-30_85e11fcfe6d3568b5bf4e5fa9f1d411a_darkgate_elex_gcleaner_mafia_stealc_tofsee.exe
    C:\PROGRA~3\{61065~1\2026-0~1.EXE
    1⤵
    • Executes dropped EXE
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    PID:2844
  • C:\PROGRA~3\{E99AB~1\2026-09-30_85e11fcfe6d3568b5bf4e5fa9f1d411a_darkgate_elex_gcleaner_mafia_stealc_tofsee.exe
    C:\PROGRA~3\{E99AB~1\2026-0~1.EXE
    1⤵
    • Creates a file in the Startup directory
    • Executes dropped EXE
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    PID:1772
  • C:\PROGRA~3\{5449C~1\2026-09-30_85e11fcfe6d3568b5bf4e5fa9f1d411a_darkgate_elex_gcleaner_mafia_stealc_tofsee.exe
    C:\PROGRA~3\{5449C~1\2026-0~1.EXE
    1⤵
    • Creates a file in the Startup directory
    • Executes dropped EXE
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    PID:2852
  • C:\PROGRA~3\{12304~1\2026-09-30_85e11fcfe6d3568b5bf4e5fa9f1d411a_darkgate_elex_gcleaner_mafia_stealc_tofsee.exe
    C:\PROGRA~3\{12304~1\2026-0~1.EXE
    1⤵
    • Creates a file in the Startup directory
    • Executes dropped EXE
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    PID:3704
  • C:\PROGRA~3\{6B171~1\2026-09-30_85e11fcfe6d3568b5bf4e5fa9f1d411a_darkgate_elex_gcleaner_mafia_stealc_tofsee.exe
    C:\PROGRA~3\{6B171~1\2026-0~1.EXE
    1⤵
    • Creates a file in the Startup directory
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    PID:1900
  • C:\PROGRA~3\{0C327~1\2026-09-30_85e11fcfe6d3568b5bf4e5fa9f1d411a_darkgate_elex_gcleaner_mafia_stealc_tofsee.exe
    C:\PROGRA~3\{0C327~1\2026-0~1.EXE
    1⤵
    • Creates a file in the Startup directory
    • Executes dropped EXE
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    PID:4248
  • C:\PROGRA~3\{D4EC3~1\2026-09-30_85e11fcfe6d3568b5bf4e5fa9f1d411a_darkgate_elex_gcleaner_mafia_stealc_tofsee.exe
    C:\PROGRA~3\{D4EC3~1\2026-0~1.EXE
    1⤵
    • Executes dropped EXE
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    PID:1084
  • C:\PROGRA~3\{FA16E~1\2026-09-30_85e11fcfe6d3568b5bf4e5fa9f1d411a_darkgate_elex_gcleaner_mafia_stealc_tofsee.exe
    C:\PROGRA~3\{FA16E~1\2026-0~1.EXE
    1⤵
    • Creates a file in the Startup directory
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    PID:3728
  • C:\PROGRA~3\{7B0B7~1\2026-09-30_85e11fcfe6d3568b5bf4e5fa9f1d411a_darkgate_elex_gcleaner_mafia_stealc_tofsee.exe
    C:\PROGRA~3\{7B0B7~1\2026-0~1.EXE
    1⤵
    • Executes dropped EXE
    PID:4748
  • C:\PROGRA~3\{FC090~1\2026-09-30_85e11fcfe6d3568b5bf4e5fa9f1d411a_darkgate_elex_gcleaner_mafia_stealc_tofsee.exe
    C:\PROGRA~3\{FC090~1\2026-0~1.EXE
    1⤵
    • Creates a file in the Startup directory
    • Executes dropped EXE
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    PID:3376
  • C:\PROGRA~3\{BA119~1\2026-09-30_85e11fcfe6d3568b5bf4e5fa9f1d411a_darkgate_elex_gcleaner_mafia_stealc_tofsee.exe
    C:\PROGRA~3\{BA119~1\2026-0~1.EXE
    1⤵
    • Executes dropped EXE
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    PID:256
  • C:\PROGRA~3\{F51EC~1\2026-09-30_85e11fcfe6d3568b5bf4e5fa9f1d411a_darkgate_elex_gcleaner_mafia_stealc_tofsee.exe
    C:\PROGRA~3\{F51EC~1\2026-0~1.EXE
    1⤵
    • Creates a file in the Startup directory
    • Executes dropped EXE
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    PID:5576
  • C:\PROGRA~3\{E6716~1\2026-09-30_85e11fcfe6d3568b5bf4e5fa9f1d411a_darkgate_elex_gcleaner_mafia_stealc_tofsee.exe
    C:\PROGRA~3\{E6716~1\2026-0~1.EXE
    1⤵
    • Creates a file in the Startup directory
    • Executes dropped EXE
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    PID:4816
  • C:\PROGRA~3\{5174C~1\2026-09-30_85e11fcfe6d3568b5bf4e5fa9f1d411a_darkgate_elex_gcleaner_mafia_stealc_tofsee.exe
    C:\PROGRA~3\{5174C~1\2026-0~1.EXE
    1⤵
    • Creates a file in the Startup directory
    • Executes dropped EXE
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    PID:1120
  • C:\PROGRA~3\{B70C9~1\2026-09-30_85e11fcfe6d3568b5bf4e5fa9f1d411a_darkgate_elex_gcleaner_mafia_stealc_tofsee.exe
    C:\PROGRA~3\{B70C9~1\2026-0~1.EXE
    1⤵
    • Creates a file in the Startup directory
    • Executes dropped EXE
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    PID:1556
  • C:\PROGRA~3\{0D63F~1\2026-09-30_85e11fcfe6d3568b5bf4e5fa9f1d411a_darkgate_elex_gcleaner_mafia_stealc_tofsee.exe
    C:\PROGRA~3\{0D63F~1\2026-0~1.EXE
    1⤵
    • Creates a file in the Startup directory
    • Executes dropped EXE
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    PID:4072
  • C:\PROGRA~3\{DBB34~1\2026-09-30_85e11fcfe6d3568b5bf4e5fa9f1d411a_darkgate_elex_gcleaner_mafia_stealc_tofsee.exe
    C:\PROGRA~3\{DBB34~1\2026-0~1.EXE
    1⤵
    • Creates a file in the Startup directory
    • Executes dropped EXE
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    PID:2960
  • C:\PROGRA~3\{2C6AF~1\2026-09-30_85e11fcfe6d3568b5bf4e5fa9f1d411a_darkgate_elex_gcleaner_mafia_stealc_tofsee.exe
    C:\PROGRA~3\{2C6AF~1\2026-0~1.EXE
    1⤵
    • Creates a file in the Startup directory
    • Executes dropped EXE
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    PID:4912
  • C:\PROGRA~3\{E76F7~1\2026-09-30_85e11fcfe6d3568b5bf4e5fa9f1d411a_darkgate_elex_gcleaner_mafia_stealc_tofsee.exe
    C:\PROGRA~3\{E76F7~1\2026-0~1.EXE
    1⤵
    • Creates a file in the Startup directory
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    PID:4500
  • C:\PROGRA~3\{39F5A~1\2026-09-30_85e11fcfe6d3568b5bf4e5fa9f1d411a_darkgate_elex_gcleaner_mafia_stealc_tofsee.exe
    C:\PROGRA~3\{39F5A~1\2026-0~1.EXE
    1⤵
    • Creates a file in the Startup directory
    • Executes dropped EXE
    • Reads the TCP/IP host and domain name from the registry
    PID:6032
  • C:\PROGRA~3\{870DD~1\2026-09-30_85e11fcfe6d3568b5bf4e5fa9f1d411a_darkgate_elex_gcleaner_mafia_stealc_tofsee.exe
    C:\PROGRA~3\{870DD~1\2026-0~1.EXE
    1⤵
    • Creates a file in the Startup directory
    • Executes dropped EXE
    PID:1912
  • C:\PROGRA~3\{7A7E9~1\2026-09-30_85e11fcfe6d3568b5bf4e5fa9f1d411a_darkgate_elex_gcleaner_mafia_stealc_tofsee.exe
    C:\PROGRA~3\{7A7E9~1\2026-0~1.EXE
    1⤵
    • Creates a file in the Startup directory
    • Executes dropped EXE
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    PID:3448
  • C:\PROGRA~3\{908CE~1\2026-09-30_85e11fcfe6d3568b5bf4e5fa9f1d411a_darkgate_elex_gcleaner_mafia_stealc_tofsee.exe
    C:\PROGRA~3\{908CE~1\2026-0~1.EXE
    1⤵
    • Creates a file in the Startup directory
    • Executes dropped EXE
    • Reads the TCP/IP host and domain name from the registry
    PID:1764
  • C:\PROGRA~3\{F3323~1\2026-09-30_85e11fcfe6d3568b5bf4e5fa9f1d411a_darkgate_elex_gcleaner_mafia_stealc_tofsee.exe
    C:\PROGRA~3\{F3323~1\2026-0~1.EXE
    1⤵
    • Creates a file in the Startup directory
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    PID:2936
  • C:\PROGRA~3\{F9241~1\2026-09-30_85e11fcfe6d3568b5bf4e5fa9f1d411a_darkgate_elex_gcleaner_mafia_stealc_tofsee.exe
    C:\PROGRA~3\{F9241~1\2026-0~1.EXE
    1⤵
    • Creates a file in the Startup directory
    • Executes dropped EXE
    PID:3228
  • C:\PROGRA~3\{D5238~1\2026-09-30_85e11fcfe6d3568b5bf4e5fa9f1d411a_darkgate_elex_gcleaner_mafia_stealc_tofsee.exe
    C:\PROGRA~3\{D5238~1\2026-0~1.EXE
    1⤵
    • Creates a file in the Startup directory
    • Executes dropped EXE
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    PID:2540
  • C:\PROGRA~3\{542FE~1\2026-09-30_85e11fcfe6d3568b5bf4e5fa9f1d411a_darkgate_elex_gcleaner_mafia_stealc_tofsee.exe
    C:\PROGRA~3\{542FE~1\2026-0~1.EXE
    1⤵
    • Executes dropped EXE
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    PID:5684
  • C:\PROGRA~3\{4B50F~1\2026-09-30_85e11fcfe6d3568b5bf4e5fa9f1d411a_darkgate_elex_gcleaner_mafia_stealc_tofsee.exe
    C:\PROGRA~3\{4B50F~1\2026-0~1.EXE
    1⤵
    • Creates a file in the Startup directory
    • Executes dropped EXE
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    PID:5996
  • C:\PROGRA~3\{5423E~1\2026-09-30_85e11fcfe6d3568b5bf4e5fa9f1d411a_darkgate_elex_gcleaner_mafia_stealc_tofsee.exe
    C:\PROGRA~3\{5423E~1\2026-0~1.EXE
    1⤵
    • Creates a file in the Startup directory
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    PID:1560
  • C:\PROGRA~3\{EEF6F~1\2026-09-30_85e11fcfe6d3568b5bf4e5fa9f1d411a_darkgate_elex_gcleaner_mafia_stealc_tofsee.exe
    C:\PROGRA~3\{EEF6F~1\2026-0~1.EXE
    1⤵
    • Creates a file in the Startup directory
    • Executes dropped EXE
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    PID:3916
  • C:\PROGRA~3\{80F33~1\2026-09-30_85e11fcfe6d3568b5bf4e5fa9f1d411a_darkgate_elex_gcleaner_mafia_stealc_tofsee.exe
    C:\PROGRA~3\{80F33~1\2026-0~1.EXE
    1⤵
    • Creates a file in the Startup directory
    • Executes dropped EXE
    PID:2940
  • C:\PROGRA~3\{D6B68~1\2026-09-30_85e11fcfe6d3568b5bf4e5fa9f1d411a_darkgate_elex_gcleaner_mafia_stealc_tofsee.exe
    C:\PROGRA~3\{D6B68~1\2026-0~1.EXE
    1⤵
    • Creates a file in the Startup directory
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    PID:3384
  • C:\PROGRA~3\{1CE32~1\2026-09-30_85e11fcfe6d3568b5bf4e5fa9f1d411a_darkgate_elex_gcleaner_mafia_stealc_tofsee.exe
    C:\PROGRA~3\{1CE32~1\2026-0~1.EXE
    1⤵
    • Creates a file in the Startup directory
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    PID:1848
  • C:\PROGRA~3\{77F3F~1\2026-09-30_85e11fcfe6d3568b5bf4e5fa9f1d411a_darkgate_elex_gcleaner_mafia_stealc_tofsee.exe
    C:\PROGRA~3\{77F3F~1\2026-0~1.EXE
    1⤵
    • Creates a file in the Startup directory
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    PID:2404
  • C:\PROGRA~3\{0791A~1\2026-09-30_85e11fcfe6d3568b5bf4e5fa9f1d411a_darkgate_elex_gcleaner_mafia_stealc_tofsee.exe
    C:\PROGRA~3\{0791A~1\2026-0~1.EXE
    1⤵
    • Creates a file in the Startup directory
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    PID:4128
  • C:\PROGRA~3\{42A52~1\2026-09-30_85e11fcfe6d3568b5bf4e5fa9f1d411a_darkgate_elex_gcleaner_mafia_stealc_tofsee.exe
    C:\PROGRA~3\{42A52~1\2026-0~1.EXE
    1⤵
    • Creates a file in the Startup directory
    • Reads the TCP/IP host and domain name from the registry
    PID:1340
  • C:\PROGRA~3\{E4E4B~1\2026-09-30_85e11fcfe6d3568b5bf4e5fa9f1d411a_darkgate_elex_gcleaner_mafia_stealc_tofsee.exe
    C:\PROGRA~3\{E4E4B~1\2026-0~1.EXE
    1⤵
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    PID:2028
  • C:\PROGRA~3\{CD1C0~1\2026-09-30_85e11fcfe6d3568b5bf4e5fa9f1d411a_darkgate_elex_gcleaner_mafia_stealc_tofsee.exe
    C:\PROGRA~3\{CD1C0~1\2026-0~1.EXE
    1⤵
    • Creates a file in the Startup directory
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    PID:5936
  • C:\PROGRA~3\{2DBD1~1\2026-09-30_85e11fcfe6d3568b5bf4e5fa9f1d411a_darkgate_elex_gcleaner_mafia_stealc_tofsee.exe
    C:\PROGRA~3\{2DBD1~1\2026-0~1.EXE
    1⤵
    • Creates a file in the Startup directory
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    PID:256
  • C:\PROGRA~3\{90621~1\2026-09-30_85e11fcfe6d3568b5bf4e5fa9f1d411a_darkgate_elex_gcleaner_mafia_stealc_tofsee.exe
    C:\PROGRA~3\{90621~1\2026-0~1.EXE
    1⤵
    • Creates a file in the Startup directory
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    PID:4468
  • C:\PROGRA~3\{AC4F8~1\2026-09-30_85e11fcfe6d3568b5bf4e5fa9f1d411a_darkgate_elex_gcleaner_mafia_stealc_tofsee.exe
    C:\PROGRA~3\{AC4F8~1\2026-0~1.EXE
    1⤵
    • Creates a file in the Startup directory
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    PID:2996
  • C:\PROGRA~3\{5D1B7~1\2026-09-30_85e11fcfe6d3568b5bf4e5fa9f1d411a_darkgate_elex_gcleaner_mafia_stealc_tofsee.exe
    C:\PROGRA~3\{5D1B7~1\2026-0~1.EXE
    1⤵
    • Creates a file in the Startup directory
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    PID:4544
  • C:\PROGRA~3\{8659A~1\2026-09-30_85e11fcfe6d3568b5bf4e5fa9f1d411a_darkgate_elex_gcleaner_mafia_stealc_tofsee.exe
    C:\PROGRA~3\{8659A~1\2026-0~1.EXE
    1⤵
    • Creates a file in the Startup directory
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    PID:1200
  • C:\PROGRA~3\{308BB~1\2026-09-30_85e11fcfe6d3568b5bf4e5fa9f1d411a_darkgate_elex_gcleaner_mafia_stealc_tofsee.exe
    C:\PROGRA~3\{308BB~1\2026-0~1.EXE
    1⤵
    • System Location Discovery: System Language Discovery
    PID:2012
  • C:\PROGRA~3\{DB5B2~1\2026-09-30_85e11fcfe6d3568b5bf4e5fa9f1d411a_darkgate_elex_gcleaner_mafia_stealc_tofsee.exe
    C:\PROGRA~3\{DB5B2~1\2026-0~1.EXE
    1⤵
      PID:4904
    • C:\PROGRA~3\{F2E67~1\2026-09-30_85e11fcfe6d3568b5bf4e5fa9f1d411a_darkgate_elex_gcleaner_mafia_stealc_tofsee.exe
      C:\PROGRA~3\{F2E67~1\2026-0~1.EXE
      1⤵
        PID:2420
      • C:\PROGRA~3\{C1F58~1\2026-09-30_85e11fcfe6d3568b5bf4e5fa9f1d411a_darkgate_elex_gcleaner_mafia_stealc_tofsee.exe
        C:\PROGRA~3\{C1F58~1\2026-0~1.EXE
        1⤵
          PID:5632
        • C:\PROGRA~3\{3014B~1\2026-09-30_85e11fcfe6d3568b5bf4e5fa9f1d411a_darkgate_elex_gcleaner_mafia_stealc_tofsee.exe
          C:\PROGRA~3\{3014B~1\2026-0~1.EXE
          1⤵
            PID:4844
          • C:\PROGRA~3\{3FB08~1\2026-09-30_85e11fcfe6d3568b5bf4e5fa9f1d411a_darkgate_elex_gcleaner_mafia_stealc_tofsee.exe
            C:\PROGRA~3\{3FB08~1\2026-0~1.EXE
            1⤵
              PID:3424
            • C:\PROGRA~3\{F8240~1\2026-09-30_85e11fcfe6d3568b5bf4e5fa9f1d411a_darkgate_elex_gcleaner_mafia_stealc_tofsee.exe
              C:\PROGRA~3\{F8240~1\2026-0~1.EXE
              1⤵
                PID:3212
              • C:\PROGRA~3\{A8530~1\2026-09-30_85e11fcfe6d3568b5bf4e5fa9f1d411a_darkgate_elex_gcleaner_mafia_stealc_tofsee.exe
                C:\PROGRA~3\{A8530~1\2026-0~1.EXE
                1⤵
                  PID:1812
                • C:\PROGRA~3\{0B76A~1\2026-09-30_85e11fcfe6d3568b5bf4e5fa9f1d411a_darkgate_elex_gcleaner_mafia_stealc_tofsee.exe
                  C:\PROGRA~3\{0B76A~1\2026-0~1.EXE
                  1⤵
                    PID:5452
                  • C:\PROGRA~3\{2FF53~1\2026-09-30_85e11fcfe6d3568b5bf4e5fa9f1d411a_darkgate_elex_gcleaner_mafia_stealc_tofsee.exe
                    C:\PROGRA~3\{2FF53~1\2026-0~1.EXE
                    1⤵
                      PID:3284
                    • C:\PROGRA~3\{3E2AF~1\2026-09-30_85e11fcfe6d3568b5bf4e5fa9f1d411a_darkgate_elex_gcleaner_mafia_stealc_tofsee.exe
                      C:\PROGRA~3\{3E2AF~1\2026-0~1.EXE
                      1⤵
                        PID:1964
                      • C:\PROGRA~3\{E4A10~1\2026-09-30_85e11fcfe6d3568b5bf4e5fa9f1d411a_darkgate_elex_gcleaner_mafia_stealc_tofsee.exe
                        C:\PROGRA~3\{E4A10~1\2026-0~1.EXE
                        1⤵
                          PID:3192
                        • C:\PROGRA~3\{BBCAC~1\2026-09-30_85e11fcfe6d3568b5bf4e5fa9f1d411a_darkgate_elex_gcleaner_mafia_stealc_tofsee.exe
                          C:\PROGRA~3\{BBCAC~1\2026-0~1.EXE
                          1⤵
                            PID:796
                          • C:\PROGRA~3\{BEADE~1\2026-09-30_85e11fcfe6d3568b5bf4e5fa9f1d411a_darkgate_elex_gcleaner_mafia_stealc_tofsee.exe
                            C:\PROGRA~3\{BEADE~1\2026-0~1.EXE
                            1⤵
                              PID:2020
                            • C:\PROGRA~3\{FF4B0~1\2026-09-30_85e11fcfe6d3568b5bf4e5fa9f1d411a_darkgate_elex_gcleaner_mafia_stealc_tofsee.exe
                              C:\PROGRA~3\{FF4B0~1\2026-0~1.EXE
                              1⤵
                                PID:1416
                              • C:\PROGRA~3\{7257C~1\2026-09-30_85e11fcfe6d3568b5bf4e5fa9f1d411a_darkgate_elex_gcleaner_mafia_stealc_tofsee.exe
                                C:\PROGRA~3\{7257C~1\2026-0~1.EXE
                                1⤵
                                  PID:1096
                                • C:\PROGRA~3\{18BE9~1\2026-09-30_85e11fcfe6d3568b5bf4e5fa9f1d411a_darkgate_elex_gcleaner_mafia_stealc_tofsee.exe
                                  C:\PROGRA~3\{18BE9~1\2026-0~1.EXE
                                  1⤵
                                    PID:4620
                                  • C:\PROGRA~3\{D7C93~1\2026-09-30_85e11fcfe6d3568b5bf4e5fa9f1d411a_darkgate_elex_gcleaner_mafia_stealc_tofsee.exe
                                    C:\PROGRA~3\{D7C93~1\2026-0~1.EXE
                                    1⤵
                                      PID:4500
                                    • C:\PROGRA~3\{A94FF~1\2026-09-30_85e11fcfe6d3568b5bf4e5fa9f1d411a_darkgate_elex_gcleaner_mafia_stealc_tofsee.exe
                                      C:\PROGRA~3\{A94FF~1\2026-0~1.EXE
                                      1⤵
                                        PID:3912
                                      • C:\PROGRA~3\{E3765~1\2026-09-30_85e11fcfe6d3568b5bf4e5fa9f1d411a_darkgate_elex_gcleaner_mafia_stealc_tofsee.exe
                                        C:\PROGRA~3\{E3765~1\2026-0~1.EXE
                                        1⤵
                                          PID:896
                                        • C:\PROGRA~3\{486A9~1\2026-09-30_85e11fcfe6d3568b5bf4e5fa9f1d411a_darkgate_elex_gcleaner_mafia_stealc_tofsee.exe
                                          C:\PROGRA~3\{486A9~1\2026-0~1.EXE
                                          1⤵
                                            PID:3812
                                          • C:\PROGRA~3\{D2C6D~1\2026-09-30_85e11fcfe6d3568b5bf4e5fa9f1d411a_darkgate_elex_gcleaner_mafia_stealc_tofsee.exe
                                            C:\PROGRA~3\{D2C6D~1\2026-0~1.EXE
                                            1⤵
                                              PID:1788
                                            • C:\PROGRA~3\{4422A~1\2026-09-30_85e11fcfe6d3568b5bf4e5fa9f1d411a_darkgate_elex_gcleaner_mafia_stealc_tofsee.exe
                                              C:\PROGRA~3\{4422A~1\2026-0~1.EXE
                                              1⤵
                                                PID:2660
                                              • C:\PROGRA~3\{D6FA9~1\2026-09-30_85e11fcfe6d3568b5bf4e5fa9f1d411a_darkgate_elex_gcleaner_mafia_stealc_tofsee.exe
                                                C:\PROGRA~3\{D6FA9~1\2026-0~1.EXE
                                                1⤵
                                                  PID:1840
                                                • C:\PROGRA~3\{EA533~1\2026-09-30_85e11fcfe6d3568b5bf4e5fa9f1d411a_darkgate_elex_gcleaner_mafia_stealc_tofsee.exe
                                                  C:\PROGRA~3\{EA533~1\2026-0~1.EXE
                                                  1⤵
                                                    PID:3080
                                                  • C:\PROGRA~3\{1C4E2~1\2026-09-30_85e11fcfe6d3568b5bf4e5fa9f1d411a_darkgate_elex_gcleaner_mafia_stealc_tofsee.exe
                                                    C:\PROGRA~3\{1C4E2~1\2026-0~1.EXE
                                                    1⤵
                                                      PID:4444
                                                    • C:\PROGRA~3\{A973A~1\2026-09-30_85e11fcfe6d3568b5bf4e5fa9f1d411a_darkgate_elex_gcleaner_mafia_stealc_tofsee.exe
                                                      C:\PROGRA~3\{A973A~1\2026-0~1.EXE
                                                      1⤵
                                                        PID:5384
                                                      • C:\PROGRA~3\{549E1~1\2026-09-30_85e11fcfe6d3568b5bf4e5fa9f1d411a_darkgate_elex_gcleaner_mafia_stealc_tofsee.exe
                                                        C:\PROGRA~3\{549E1~1\2026-0~1.EXE
                                                        1⤵
                                                          PID:2700
                                                        • C:\PROGRA~3\{8B20A~1\2026-09-30_85e11fcfe6d3568b5bf4e5fa9f1d411a_darkgate_elex_gcleaner_mafia_stealc_tofsee.exe
                                                          C:\PROGRA~3\{8B20A~1\2026-0~1.EXE
                                                          1⤵
                                                            PID:3408
                                                          • C:\PROGRA~3\{B5C59~1\2026-09-30_85e11fcfe6d3568b5bf4e5fa9f1d411a_darkgate_elex_gcleaner_mafia_stealc_tofsee.exe
                                                            C:\PROGRA~3\{B5C59~1\2026-0~1.EXE
                                                            1⤵
                                                              PID:980
                                                            • C:\PROGRA~3\{F7B04~1\2026-09-30_85e11fcfe6d3568b5bf4e5fa9f1d411a_darkgate_elex_gcleaner_mafia_stealc_tofsee.exe
                                                              C:\PROGRA~3\{F7B04~1\2026-0~1.EXE
                                                              1⤵
                                                                PID:4912
                                                              • C:\PROGRA~3\{E7D0B~1\2026-09-30_85e11fcfe6d3568b5bf4e5fa9f1d411a_darkgate_elex_gcleaner_mafia_stealc_tofsee.exe
                                                                C:\PROGRA~3\{E7D0B~1\2026-0~1.EXE
                                                                1⤵
                                                                  PID:5704
                                                                • C:\PROGRA~3\{09117~1\2026-09-30_85e11fcfe6d3568b5bf4e5fa9f1d411a_darkgate_elex_gcleaner_mafia_stealc_tofsee.exe
                                                                  C:\PROGRA~3\{09117~1\2026-0~1.EXE
                                                                  1⤵
                                                                    PID:4520
                                                                  • C:\PROGRA~3\{E3E92~1\2026-09-30_85e11fcfe6d3568b5bf4e5fa9f1d411a_darkgate_elex_gcleaner_mafia_stealc_tofsee.exe
                                                                    C:\PROGRA~3\{E3E92~1\2026-0~1.EXE
                                                                    1⤵
                                                                      PID:4456
                                                                    • C:\PROGRA~3\{A63B1~1\2026-09-30_85e11fcfe6d3568b5bf4e5fa9f1d411a_darkgate_elex_gcleaner_mafia_stealc_tofsee.exe
                                                                      C:\PROGRA~3\{A63B1~1\2026-0~1.EXE
                                                                      1⤵
                                                                        PID:6084
                                                                      • C:\PROGRA~3\{8C7C8~1\2026-09-30_85e11fcfe6d3568b5bf4e5fa9f1d411a_darkgate_elex_gcleaner_mafia_stealc_tofsee.exe
                                                                        C:\PROGRA~3\{8C7C8~1\2026-0~1.EXE
                                                                        1⤵
                                                                          PID:1340
                                                                        • C:\PROGRA~3\{54201~1\2026-09-30_85e11fcfe6d3568b5bf4e5fa9f1d411a_darkgate_elex_gcleaner_mafia_stealc_tofsee.exe
                                                                          C:\PROGRA~3\{54201~1\2026-0~1.EXE
                                                                          1⤵
                                                                            PID:5328
                                                                          • C:\PROGRA~3\{6CBF0~1\2026-09-30_85e11fcfe6d3568b5bf4e5fa9f1d411a_darkgate_elex_gcleaner_mafia_stealc_tofsee.exe
                                                                            C:\PROGRA~3\{6CBF0~1\2026-0~1.EXE
                                                                            1⤵
                                                                              PID:3948
                                                                            • C:\PROGRA~3\{D1A1D~1\2026-09-30_85e11fcfe6d3568b5bf4e5fa9f1d411a_darkgate_elex_gcleaner_mafia_stealc_tofsee.exe
                                                                              C:\PROGRA~3\{D1A1D~1\2026-0~1.EXE
                                                                              1⤵
                                                                                PID:236
                                                                              • C:\PROGRA~3\{C4EBD~1\2026-09-30_85e11fcfe6d3568b5bf4e5fa9f1d411a_darkgate_elex_gcleaner_mafia_stealc_tofsee.exe
                                                                                C:\PROGRA~3\{C4EBD~1\2026-0~1.EXE
                                                                                1⤵
                                                                                  PID:1804
                                                                                • C:\PROGRA~3\{E06D3~1\2026-09-30_85e11fcfe6d3568b5bf4e5fa9f1d411a_darkgate_elex_gcleaner_mafia_stealc_tofsee.exe
                                                                                  C:\PROGRA~3\{E06D3~1\2026-0~1.EXE
                                                                                  1⤵
                                                                                    PID:472
                                                                                  • C:\PROGRA~3\{57A2D~1\2026-09-30_85e11fcfe6d3568b5bf4e5fa9f1d411a_darkgate_elex_gcleaner_mafia_stealc_tofsee.exe
                                                                                    C:\PROGRA~3\{57A2D~1\2026-0~1.EXE
                                                                                    1⤵
                                                                                      PID:2120
                                                                                    • C:\PROGRA~3\{3B142~1\2026-09-30_85e11fcfe6d3568b5bf4e5fa9f1d411a_darkgate_elex_gcleaner_mafia_stealc_tofsee.exe
                                                                                      C:\PROGRA~3\{3B142~1\2026-0~1.EXE
                                                                                      1⤵
                                                                                        PID:692
                                                                                      • C:\PROGRA~3\{BD9FA~1\2026-09-30_85e11fcfe6d3568b5bf4e5fa9f1d411a_darkgate_elex_gcleaner_mafia_stealc_tofsee.exe
                                                                                        C:\PROGRA~3\{BD9FA~1\2026-0~1.EXE
                                                                                        1⤵
                                                                                          PID:1184
                                                                                        • C:\PROGRA~3\{C4FB2~1\2026-09-30_85e11fcfe6d3568b5bf4e5fa9f1d411a_darkgate_elex_gcleaner_mafia_stealc_tofsee.exe
                                                                                          C:\PROGRA~3\{C4FB2~1\2026-0~1.EXE
                                                                                          1⤵
                                                                                            PID:2552
                                                                                          • C:\PROGRA~3\{77322~1\2026-09-30_85e11fcfe6d3568b5bf4e5fa9f1d411a_darkgate_elex_gcleaner_mafia_stealc_tofsee.exe
                                                                                            C:\PROGRA~3\{77322~1\2026-0~1.EXE
                                                                                            1⤵
                                                                                              PID:1432
                                                                                            • C:\PROGRA~3\{09157~1\2026-09-30_85e11fcfe6d3568b5bf4e5fa9f1d411a_darkgate_elex_gcleaner_mafia_stealc_tofsee.exe
                                                                                              C:\PROGRA~3\{09157~1\2026-0~1.EXE
                                                                                              1⤵
                                                                                                PID:3616
                                                                                              • C:\PROGRA~3\{9EFE5~1\2026-09-30_85e11fcfe6d3568b5bf4e5fa9f1d411a_darkgate_elex_gcleaner_mafia_stealc_tofsee.exe
                                                                                                C:\PROGRA~3\{9EFE5~1\2026-0~1.EXE
                                                                                                1⤵
                                                                                                  PID:2420
                                                                                                • C:\PROGRA~3\{F8EBB~1\2026-09-30_85e11fcfe6d3568b5bf4e5fa9f1d411a_darkgate_elex_gcleaner_mafia_stealc_tofsee.exe
                                                                                                  C:\PROGRA~3\{F8EBB~1\2026-0~1.EXE
                                                                                                  1⤵
                                                                                                    PID:5860
                                                                                                  • C:\PROGRA~3\{89810~1\2026-09-30_85e11fcfe6d3568b5bf4e5fa9f1d411a_darkgate_elex_gcleaner_mafia_stealc_tofsee.exe
                                                                                                    C:\PROGRA~3\{89810~1\2026-0~1.EXE
                                                                                                    1⤵
                                                                                                      PID:2620
                                                                                                    • C:\PROGRA~3\{2F467~1\2026-09-30_85e11fcfe6d3568b5bf4e5fa9f1d411a_darkgate_elex_gcleaner_mafia_stealc_tofsee.exe
                                                                                                      C:\PROGRA~3\{2F467~1\2026-0~1.EXE
                                                                                                      1⤵
                                                                                                        PID:2904
                                                                                                      • C:\PROGRA~3\{2E797~1\2026-09-30_85e11fcfe6d3568b5bf4e5fa9f1d411a_darkgate_elex_gcleaner_mafia_stealc_tofsee.exe
                                                                                                        C:\PROGRA~3\{2E797~1\2026-0~1.EXE
                                                                                                        1⤵
                                                                                                          PID:2864
                                                                                                        • C:\PROGRA~3\{132EE~1\2026-09-30_85e11fcfe6d3568b5bf4e5fa9f1d411a_darkgate_elex_gcleaner_mafia_stealc_tofsee.exe
                                                                                                          C:\PROGRA~3\{132EE~1\2026-0~1.EXE
                                                                                                          1⤵
                                                                                                            PID:2676
                                                                                                          • C:\PROGRA~3\{5989B~1\2026-09-30_85e11fcfe6d3568b5bf4e5fa9f1d411a_darkgate_elex_gcleaner_mafia_stealc_tofsee.exe
                                                                                                            C:\PROGRA~3\{5989B~1\2026-0~1.EXE
                                                                                                            1⤵
                                                                                                              PID:1940
                                                                                                            • C:\PROGRA~3\{B6A8B~1\2026-09-30_85e11fcfe6d3568b5bf4e5fa9f1d411a_darkgate_elex_gcleaner_mafia_stealc_tofsee.exe
                                                                                                              C:\PROGRA~3\{B6A8B~1\2026-0~1.EXE
                                                                                                              1⤵
                                                                                                                PID:2208
                                                                                                              • C:\PROGRA~3\{7BE0B~1\2026-09-30_85e11fcfe6d3568b5bf4e5fa9f1d411a_darkgate_elex_gcleaner_mafia_stealc_tofsee.exe
                                                                                                                C:\PROGRA~3\{7BE0B~1\2026-0~1.EXE
                                                                                                                1⤵
                                                                                                                  PID:4796
                                                                                                                • C:\PROGRA~3\{F5323~1\2026-09-30_85e11fcfe6d3568b5bf4e5fa9f1d411a_darkgate_elex_gcleaner_mafia_stealc_tofsee.exe
                                                                                                                  C:\PROGRA~3\{F5323~1\2026-0~1.EXE
                                                                                                                  1⤵
                                                                                                                    PID:4768
                                                                                                                  • C:\PROGRA~3\{96A8B~1\2026-09-30_85e11fcfe6d3568b5bf4e5fa9f1d411a_darkgate_elex_gcleaner_mafia_stealc_tofsee.exe
                                                                                                                    C:\PROGRA~3\{96A8B~1\2026-0~1.EXE
                                                                                                                    1⤵
                                                                                                                      PID:3524

                                                                                                                    Network

                                                                                                                          MITRE ATT&CK Enterprise v16

                                                                                                                          Replay Monitor

                                                                                                                          Loading Replay Monitor...

                                                                                                                          Downloads

                                                                                                                          2026-09-30_85e11fcfe6d3568b5bf4e5fa9f1d411a_darkgate_elex_gcleaner_mafia_stealc_tofsee.exe
                                                                                                                          • Path C:\ProgramData\{8c927f95-1f08-ed8c-8c92-27f951f0fe54}\2026-09-30_85e11fcfe6d3568b5bf4e5fa9f1d411a_darkgate_elex_gcleaner_mafia_stealc_tofsee.exe
                                                                                                                          • Size 5.7MB
                                                                                                                          • SHA256 0115bc82d7ac551a6d7b7a4e60c32b1daf0c2ba24b08f862e9c15a41d4a83a73
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          optprosetup.tmp
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\is-30KPD.tmp\optprosetup.tmp
                                                                                                                          • Size 1.1MB
                                                                                                                          • SHA256 af7c2a6381358fc6d8861343185cec89ddd2738264d5dc02fc734d58fc382c00
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          OptProHelper.dll
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\is-7ISOK.tmp\OptProHelper.dll
                                                                                                                          • Size 1.2MB
                                                                                                                          • SHA256 cf76cd04b60c3e9392b3fa91650162dfee7a2da166216d53f0662a303150b600
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          itdownload.dll
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\is-7ISOK.tmp\itdownload.dll
                                                                                                                          • Size 200KB
                                                                                                                          • SHA256 b258c4d7d2113dee2168ed7e35568c8e03341e24e3eafc7a22a0d62e32122ef3
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          optprosetup.exe
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\optprosetup.exe
                                                                                                                          • Size 5.4MB
                                                                                                                          • SHA256 a358e4ee49a15dca1d4d45d6fbee1ab50ac3cbae8572bd6354984bf5e4f869fe
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          2026-09-30_85e11fcfe6d3568b5bf4e5fa9f1d411a_darkgate_elex_gcleaner_mafia_stealc_tofsee.lnk
                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2026-09-30_85e11fcfe6d3568b5bf4e5fa9f1d411a_darkgate_elex_gcleaner_mafia_stealc_tofsee.lnk
                                                                                                                          • Size 2KB
                                                                                                                          • SHA256 4dd957512279ea689c37b7bf3bf1dece6f2f443519e17eb0a7da41b5e5e62d42
                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                          Submit Download

                                                                                                                          2026-09-30_85e11fcfe6d3568b5bf4e5fa9f1d411a_darkgate_elex_gcleaner_mafia_stealc_tofsee.lnk
                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2026-09-30_85e11fcfe6d3568b5bf4e5fa9f1d411a_darkgate_elex_gcleaner_mafia_stealc_tofsee.lnk
                                                                                                                          • Size 2KB
                                                                                                                          • SHA256 adf58c52b864037f23da7da18ffed58478d08ace06fd176e209396ef3a682d04
                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                          Submit Download

                                                                                                                          2026-09-30_85e11fcfe6d3568b5bf4e5fa9f1d411a_darkgate_elex_gcleaner_mafia_stealc_tofsee.lnk
                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2026-09-30_85e11fcfe6d3568b5bf4e5fa9f1d411a_darkgate_elex_gcleaner_mafia_stealc_tofsee.lnk
                                                                                                                          • Size 2KB
                                                                                                                          • SHA256 ea57d8f250610289be44d4887461c9ffd8132ae8c315c7649f54834e327a9f05
                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                          Submit Download

                                                                                                                          2026-09-30_85e11fcfe6d3568b5bf4e5fa9f1d411a_darkgate_elex_gcleaner_mafia_stealc_tofsee.lnk
                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2026-09-30_85e11fcfe6d3568b5bf4e5fa9f1d411a_darkgate_elex_gcleaner_mafia_stealc_tofsee.lnk
                                                                                                                          • Size 2KB
                                                                                                                          • SHA256 55a43f1b8d4b33306066fc6ec713f76ecf269a06ab84bde10d66017d86b19f0c
                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                          Submit Download

                                                                                                                          2026-09-30_85e11fcfe6d3568b5bf4e5fa9f1d411a_darkgate_elex_gcleaner_mafia_stealc_tofsee.lnk
                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2026-09-30_85e11fcfe6d3568b5bf4e5fa9f1d411a_darkgate_elex_gcleaner_mafia_stealc_tofsee.lnk
                                                                                                                          • Size 2KB
                                                                                                                          • SHA256 cf061cb07593cff0203fa059afbc4639e7b20df452cf772f02ea6ea5d7d64c36
                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                          Submit Download

                                                                                                                          2026-09-30_85e11fcfe6d3568b5bf4e5fa9f1d411a_darkgate_elex_gcleaner_mafia_stealc_tofsee.lnk
                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2026-09-30_85e11fcfe6d3568b5bf4e5fa9f1d411a_darkgate_elex_gcleaner_mafia_stealc_tofsee.lnk
                                                                                                                          • Size 2KB
                                                                                                                          • SHA256 66e3de73f5489dd4a85a066a33ae07973e387d0ba6b2d59d12c1b8f3e5d0b33a
                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                          Submit Download

                                                                                                                          2026-09-30_85e11fcfe6d3568b5bf4e5fa9f1d411a_darkgate_elex_gcleaner_mafia_stealc_tofsee.lnk
                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2026-09-30_85e11fcfe6d3568b5bf4e5fa9f1d411a_darkgate_elex_gcleaner_mafia_stealc_tofsee.lnk
                                                                                                                          • Size 2KB
                                                                                                                          • SHA256 e795fc99b7e4e2fbf1952d742647342d642f4cb53d6afd71c58f5c2dc8c8c5eb
                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                          Submit Download

                                                                                                                          2026-09-30_85e11fcfe6d3568b5bf4e5fa9f1d411a_darkgate_elex_gcleaner_mafia_stealc_tofsee.lnk
                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2026-09-30_85e11fcfe6d3568b5bf4e5fa9f1d411a_darkgate_elex_gcleaner_mafia_stealc_tofsee.lnk
                                                                                                                          • Size 2KB
                                                                                                                          • SHA256 a09aa666b14ad92f7c754fb4a66fbe4b7f109d3c1f5409cdddbdaea88cf9a71d
                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                          Submit Download

                                                                                                                          2026-09-30_85e11fcfe6d3568b5bf4e5fa9f1d411a_darkgate_elex_gcleaner_mafia_stealc_tofsee.lnk
                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2026-09-30_85e11fcfe6d3568b5bf4e5fa9f1d411a_darkgate_elex_gcleaner_mafia_stealc_tofsee.lnk
                                                                                                                          • Size 2KB
                                                                                                                          • SHA256 7d9fedab4a139b4cb90bdf3bc0ccd1be69214425c127b9d40fef5cb37b18bf06
                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                          Submit Download

                                                                                                                          2026-09-30_85e11fcfe6d3568b5bf4e5fa9f1d411a_darkgate_elex_gcleaner_mafia_stealc_tofsee.lnk
                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2026-09-30_85e11fcfe6d3568b5bf4e5fa9f1d411a_darkgate_elex_gcleaner_mafia_stealc_tofsee.lnk
                                                                                                                          • Size 2KB
                                                                                                                          • SHA256 0c03153b3f442aed547dce92f2826557560dce954c99428e1f07443a912a7fa5
                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                          Submit Download

                                                                                                                          2026-09-30_85e11fcfe6d3568b5bf4e5fa9f1d411a_darkgate_elex_gcleaner_mafia_stealc_tofsee.lnk
                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2026-09-30_85e11fcfe6d3568b5bf4e5fa9f1d411a_darkgate_elex_gcleaner_mafia_stealc_tofsee.lnk
                                                                                                                          • Size 2KB
                                                                                                                          • SHA256 f410fe38c0d112974cacb60e8cfab171dea3b18a256544c3c31e0589937535e1
                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                          Submit Download

                                                                                                                          2026-09-30_85e11fcfe6d3568b5bf4e5fa9f1d411a_darkgate_elex_gcleaner_mafia_stealc_tofsee.lnk
                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2026-09-30_85e11fcfe6d3568b5bf4e5fa9f1d411a_darkgate_elex_gcleaner_mafia_stealc_tofsee.lnk
                                                                                                                          • Size 2KB
                                                                                                                          • SHA256 6e678fbdb4129a5ae948e0e8ed25f9333ca3661601a32bc61c6ffa82cc1e3e8d
                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                          Submit Download

                                                                                                                          2026-09-30_85e11fcfe6d3568b5bf4e5fa9f1d411a_darkgate_elex_gcleaner_mafia_stealc_tofsee.lnk
                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2026-09-30_85e11fcfe6d3568b5bf4e5fa9f1d411a_darkgate_elex_gcleaner_mafia_stealc_tofsee.lnk
                                                                                                                          • Size 2KB
                                                                                                                          • SHA256 9bb28de0379cd0cb0a45347fdb23783a0c11bdb3ef23dc0e3851d65d81aa0298
                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                          Submit Download

                                                                                                                          2026-09-30_85e11fcfe6d3568b5bf4e5fa9f1d411a_darkgate_elex_gcleaner_mafia_stealc_tofsee.lnk
                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2026-09-30_85e11fcfe6d3568b5bf4e5fa9f1d411a_darkgate_elex_gcleaner_mafia_stealc_tofsee.lnk
                                                                                                                          • Size 2KB
                                                                                                                          • SHA256 eca6d17538abc74becd02f48e371a33f5445170489974354ba96f16f0202d2c5
                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                          Submit Download

                                                                                                                          memory/1044-149-0x0000000000400000-0x000000000052A000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/1044-264-0x0000000000400000-0x000000000052A000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/1044-98-0x0000000002300000-0x0000000002301000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/1044-18-0x0000000002300000-0x0000000002301000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/1044-84-0x0000000000400000-0x000000000052A000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/1044-86-0x0000000004A20000-0x0000000004B66000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/1044-85-0x00000000025F0000-0x000000000262C000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/1044-45-0x0000000004A20000-0x0000000004B66000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/1044-881-0x0000000000400000-0x000000000052A000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/1044-37-0x00000000025F0000-0x000000000262C000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/1044-200-0x0000000000400000-0x000000000052A000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/1044-817-0x0000000000400000-0x000000000052A000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/1044-328-0x0000000000400000-0x000000000052A000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/1044-381-0x0000000000400000-0x000000000052A000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/1044-445-0x0000000000400000-0x000000000052A000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/1044-503-0x0000000000400000-0x000000000052A000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/1044-567-0x0000000000400000-0x000000000052A000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/1044-631-0x0000000000400000-0x000000000052A000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/1044-695-0x0000000000400000-0x000000000052A000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/1044-753-0x0000000000400000-0x000000000052A000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/4376-11-0x0000000000400000-0x0000000000427000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/4376-83-0x0000000000400000-0x0000000000427000-memory.dmp
                                                                                                                          Download