0df8b0ec0b001689e02a97c1b1ebb89fd8bb189a423cabc28e56ec823cb80998

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/10/2026, 16:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-22_38ee80186f38eba6402e9f32ea241521_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
Size 10.3MB
Sample261024-tx1wasaz3s
SHA256 0df8b0ec0b001689e02a97c1b1ebb89fd8bb189a423cabc28e56ec823cb80998
MD5 38ee80186f38eba6402e9f32ea241521
SHA1 322053880baf419cf8e7575fa60d9f5469a06c26
SHA512 e1c1dcc6f6c4e29facfee88c32c47a459601005f44e27b4e1b2d80581060b5cb251627f20254f481e33842a9d7881bbf0e83b7060c9c5dc1bc8d0b9fc351a1f7
SSDEEP 196608:6gdzhjeEf6xi7teSDFNICjCAQXs5FguJSS7R:/NyEf6xi7ASDzICjCKLg0d7R
TLSH
T192B6AD22B345C036F5A011F1592EBB2A62687D39236084DBF6E19F6D12E56C34F36F1B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

adware defense_evasion discovery spyware trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-10-22_38ee80186f38eba6402e9f32ea241521_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 37 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5544_533444249\Mu\Advertising	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5544_533444249\Sigma\Other	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5544_586221744\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5544_533444249\Sigma\Fingerprinting	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5544_533444249\Mu\Analytics	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5544_533444249\Mu\Fingerprinting	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5544_533444249\Mu\TransparentAdvertisers	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3932_944218001\protocols.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5544_586221744\protocols.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5544_533444249\Mu\Cryptomining	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5544_533444249\Sigma\Staging	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3932_1415060507\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5544_533444249\Mu\Staging	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5544_533444249\Mu\CompatExceptions	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5544_533444249\Mu\LICENSE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5544_533444249\Mu\Other	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5544_533444249\Sigma\Social	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3932_455623748\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3932_455623748\Microsoft.CognitiveServices.Speech.core.dll	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5544_533444249\Mu\Social	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3932_455623748\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5544_533444249\Sigma\Entities	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5544_533444249\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5544_533444249\Mu\Content	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5544_533444249\Mu\Entities	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5544_533444249\Sigma\Advertising	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5544_533444249\Sigma\Content	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5544_533444249\Sigma\Cryptomining	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5544_1866557274\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5544_533444249\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5544_533444249\Sigma\Analytics	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5544_533444249\Sigma\LICENSE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3932_944218001\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3932_944218001\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5544_1866557274\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3932_1415060507\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5544_586221744\manifest.json	msedgewebview2.exe

Direct Volume Access: Opens a physical disk for reading 1 TTPs 1 IoCs

Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

defense_evasion

Direct Volume Access

T1006

description	ioc	Process
File opened (read-only)	\??\PhysicalDrive0	2026-10-22_38ee80186f38eba6402e9f32ea241521_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-22_38ee80186f38eba6402e9f32ea241521_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-22_38ee80186f38eba6402e9f32ea241521_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-22_38ee80186f38eba6402e9f32ea241521_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	2026-10-22_38ee80186f38eba6402e9f32ea241521_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	2026-10-22_38ee80186f38eba6402e9f32ea241521_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	2026-10-22_38ee80186f38eba6402e9f32ea241521_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe

Enumerates system info in registry 2 TTPs 10 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	2026-10-22_38ee80186f38eba6402e9f32ea241521_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	2026-10-22_38ee80186f38eba6402e9f32ea241521_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	2026-10-22_38ee80186f38eba6402e9f32ea241521_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	2026-10-22_38ee80186f38eba6402e9f32ea241521_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	2026-10-22_38ee80186f38eba6402e9f32ea241521_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\2026-10-22_38ee80186f38eba6402e9f32ea241521_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe = "11001"	2026-10-22_38ee80186f38eba6402e9f32ea241521_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe

Modifies data under HKEY_USERS 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe

Modifies system certificate store 2 TTPs 12 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000\Software\Microsoft\SystemCertificates\AdobeCertStore	2026-10-22_38ee80186f38eba6402e9f32ea241521_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
Key created	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000\Software\Microsoft\SystemCertificates\AdobeCertStore\CRLs	2026-10-22_38ee80186f38eba6402e9f32ea241521_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
Key created	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000\Software\Microsoft\SystemCertificates\AdobeCertStore\CTLs	2026-10-22_38ee80186f38eba6402e9f32ea241521_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000\Software\Microsoft\SystemCertificates\AdobeCertStore\Certificates\85E2C5B0D9CFF505363FA62A5E8B8C1D76A60B46\Blob = 03000000010000001400000085e2c5b0d9cff505363fa62a5e8b8c1d76a60b462000000001000000bc050000308205b8308203a0a003020102020426c66cd0300d06092a864886f70d01010d0500308185310b30090603550406130255533113301106035504080c0a43616c69666f726e69613111300f06035504070c0853616e204a6f736531163014060355040a0c0d41646f62652053797374656d7331193017060355040b0c10436c6f756420546563686e6f6c6f6779311b301906035504030c1241646f626520526f6f742043412031302d333020170d3138303831373137333831395a180f32303638303830343137333831395a30818e310b30090603550406130255533113301106035504080c0a43616c69666f726e69613111300f06035504070c0853616e204a6f736531163014060355040a0c0d41646f62652053797374656d7331193017060355040b0c10436c6f756420546563686e6f6c6f67793124302206035504030c1b41646f626520496e7465726d6564696174652043412031302d313930820222300d06092a864886f70d01010105000382020f003082020a0282020100b533b875034a0e7563110700e026d838b4ed1369ee54d6db09ebf764a4778ef8a7dc7dfba9386a78e61be8ff8722d2ca1535cc02c111f9fae54fdc09698d22d9d936b3133aab757b596a1c093cf3559f351d3f10dc44fb0f9787e1f685e83dc775c74d0e563f1509071a1d4bcd919d0b9ebaf925867a85e7e5b9b13040760dfbe2a9bd70e028963dd69631e9cf2f5ca3a6634ac8bfe2dae5cde9df35e935b4f88a17fc78786052badf6e5a378e34a16d16ec7eeb69bf0917fd7210ae129ae2b5f3473e28ea73e25e81176229f0ad99b74069cf6c30413ab85d86f7fec519e01806a928cf2e5ea9c9aae9f57a60401e76313fd017bbe23541b455da6c7d49e39f6b451a67ea2160056781067c489526d297410ac05e87fbeca66d75bda1eaeec9652891598957f4c19fb53ec491b1d600d1ad75d7c164d613ba6ce275682f44399515c247d11d72dc440fd800225a13ae8d16494eaa9f1f82120d2f51243683d2aa62cdcf5be075720b7d566eadb5e46ee3299b43296a49bf3fbe2e672e72e42e7918e608466028de4f215cd362cfd921200ff946168717d09af99095950812f5a4de4073e2c5697a318b9eb51a585a36e74dbd8fb7277c8aeb7ddd42ffbeb32c181f9edaddc1480b95f16e7ea37d0dab3f2f5009d570aa4624b66a7017c75f1caa7c544e15def0c6e6cf6a4f26312b68f633b7a5a4203c97e77a32141e7cf4970203010001a3233021300e0603551d0f0101ff040403020204300f0603551d130101ff040530030101ff300d06092a864886f70d01010d050003820201005bd66c82ca184490136b886ef3b5f5b6866768c8cfd13f701025aeb8dc8b7b4539c071032663327f1b55d773e062ea01551038bc12895b4a760a23ec0ef1e24c1d25649b12dad880b576a952ba1f9d1ed0c5bdf45e8a9f9465c091e22ff7165912fba642b3e2979897339ab2ae511615d3e20b27e3e60e13fe188c7c7119f14029ccfaf1e9fef5c7e53ce1c0d1cfcb8507131c446af5b7f67b701e1ee4151cadd14048737cf0ec86f8964d75b8509bf07a984441641622568d5ea1b9124101db76c578bee86acdb651a90b5c3abdab541f3a41e82cbfc0d30319e1975924540a71e8d1a3603caade3cefcf0b362b62fa09efe97827276b0b79f58553136c89aa72a9f3f7fdaa87e5789978abe6af28c04f7d673954594329ace012159c5ee6b2cb43b55f507e0e0f68233e8a3c6fe13a2cb23b4f38ddecaeae21e99bd6e152793ad59b8286256ede041654cb8a7c069d773868f8bddea44fccdcfc4c0cfec6f9357093024d88519a40bdb3b77b0988051418fcba0a67c5caabc66f21d094e5d612dd7f951291892a4f8ef35efdb2c9d940fcbddfdb75d19b1b215a36dec147c9d716bb4a06047e90d0d0fad64a56f24a6b650843d5cdd2aba7e8894b4693d775aebc8d65063d1813b0be5c9c6357c43be7aea9b3b6021935acc2b8f38746aeab5eaa06f447be0cfff20b38811e273023cd035f14ad3a7babee646909282cc3ef	2026-10-22_38ee80186f38eba6402e9f32ea241521_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000\Software\Microsoft\SystemCertificates\AdobeCertStore\Certificates\4C7C2E87F0BC79A039D39B05F899A1CC521FDE99\Blob = 0300000001000000140000004c7c2e87f0bc79a039d39b05f899a1cc521fde992000000001000000c3050000308205bf308203a7a00302010202046e271780300d06092a864886f70d01010d050030818e310b30090603550406130255533113301106035504080c0a43616c69666f726e69613111300f06035504070c0853616e204a6f736531163014060355040a0c0d41646f62652053797374656d7331193017060355040b0c10436c6f756420546563686e6f6c6f67793124302206035504030c1b41646f626520496e7465726d6564696174652043412031302d3135301e170d3233303830373133343834335a170d3330303830353133343834315a308191310b30090603550406130255533113301106035504080c0a43616c69666f726e69613111300f06035504070c0853616e204a6f736531163014060355040a0c0d41646f62652053797374656d7331193017060355040b0c10436c6f756420546563686e6f6c6f67793127302506035504030c1e41646f626520436f6e74656e742043657274696669636174652031302d3730820222300d06092a864886f70d01010105000382020f003082020a0282020100ad280d5cfb35f4129a580996209e83cd117cab917f7f8b85e353c39899fa07bc7050077db622fe4b43c477c0abb8325a1ee90f76416e2af5cb76ed9ccec153694c6add14358e1c5c45d32db721654781ba134e981ae3b21d56fe739afd397db8101fa65554ad67d9b808d45487d9913bd7cf30e094a948546da75f51395ab7b0f122244976683d87ce6797aaea3d5ee468553fc658b2b9530e33e2aa418950458d4147270f8773e3d93da7df6a1e8f58e439218236d110a658bf5037260d3f596e1f06b9e963f758eca3f99faa454640628e3bc66c16e914aad9bea5a47f954ca0ff73cf4237e8545e5e82f66795493508a6852f4564ef44dbb31b23c27d6dcc54e749094bb404073ed05ab6bf54afadec8ea7b58ce2d935c4b0ec8a054bef86cebfd63faab8fae41104e8bdaf1f3f2474d78e050c8f33510c80abba83c0da198107e47b40cd119b71827a510ae65e9b97d5e617b397cf517cfecbc47a890bbc350c5b631a50f254151d4d84cd512e0f57241e10b1bd1569287a900d4bf4a23532556266bc1c8b1014972f126b20a2e2e7db73774eb822669fc2bcf56d817ee3f5d20f9b029ec62d377d5328000ce5d921c965337c500416a6c3e828ed27ad8ed370f8b9035c322ce75ed6de25002e363475f95e24ad6e30b9350eb2934a431bf09c8b4df073213fd6393192d796022b4275a73e5b4a2bf3b226d6a537e96c450203010001a320301e300e0603551d0f0101ff040403020780300c0603551d130101ff04023000300d06092a864886f70d01010d05000382020100315188a437cb6a526ab679d888ef1051ea301191b36ff818d3e7e1b8cbc8e1c078fc058e0d7bd61b11fd8efef27b411c3f494f6734c286008ffb39d2eecf012929913628c5b160f6ca24fab63068fc48cb91293fc302f3d16f5de8dbdfe3a57abca9a081c4cfa82fa3e06f36a318251a351c5e08fe4f4a286d1ebb4bf87278f7e54faf53e1b37148f19f210136c5f3b5981a89a3aaf8351490555d001aee6c9ab2bd27cc13d162ef6314c47fce2c668e16ed641d2b6871ef3b0afbc8e5e2b93d775049061496057a361c2cd1ed7cbdadd143a0f114e9d5066c6e2f2bfd771b44c8979cf0f094d2d89e104c935ef362eabcccda4559bb33e640b3c1920cf314688fdc639665e8e81f6b9312516d937a6db751fd39e044271432d0e83bfcb5e8df5cbe2a7c15e272e09aa96f939ac7b6655fcfe91e59474b3a4cecf12490cb1f3aa2a80ae53cbe867ccaeff9ca84d487bf438f4213b253148ff8be54caee1e4aa157353f707a966f946e89a8fc8964849eb948bd54b2b2e6d1dd85ba7df45208206472a5aa93860c5ee8f6460739ea3231ec590f09602ff29f09ecedbdbd635cb42670c8288b3f051dd6c393240d0a668b9a2c20bd70f182ce58d152089385ab717c7c624826ec39424050ad45048927d2e771be6f6693055589f3612df47c206d6ae8600f9d60f7aebc5567458d8a423b76d6082ab213fff88584909e76b458ab	2026-10-22_38ee80186f38eba6402e9f32ea241521_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
Key created	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000\Software\Microsoft\SystemCertificates\AdobeCertStore\Certificates\A5C8D928986EC17FCC7D5F2353885D1709B73A29	2026-10-22_38ee80186f38eba6402e9f32ea241521_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
Key created	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000\Software\Microsoft\SystemCertificates\AdobeCertStore\Certificates	2026-10-22_38ee80186f38eba6402e9f32ea241521_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
Key created	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000\Software\Microsoft\SystemCertificates\AdobeCertStore\Certificates\686DF0A4A89F7CB6BFB4D33C6A48E2EE5FB6C4FB	2026-10-22_38ee80186f38eba6402e9f32ea241521_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000\Software\Microsoft\SystemCertificates\AdobeCertStore\Certificates\686DF0A4A89F7CB6BFB4D33C6A48E2EE5FB6C4FB\Blob = 030000000100000014000000686df0a4a89f7cb6bfb4d33c6a48e2ee5fb6c4fb2000000001000000c3050000308205bf308203a7a003020102020401cfbd1c300d06092a864886f70d01010d050030818e310b30090603550406130255533113301106035504080c0a43616c69666f726e69613111300f06035504070c0853616e204a6f736531163014060355040a0c0d41646f62652053797374656d7331193017060355040b0c10436c6f756420546563686e6f6c6f67793124302206035504030c1b41646f626520496e7465726d6564696174652043412031302d3139301e170d3233303830373135313132375a170d3330303830353135313132355a308191310b30090603550406130255533113301106035504080c0a43616c69666f726e69613111300f06035504070c0853616e204a6f736531163014060355040a0c0d41646f62652053797374656d7331193017060355040b0c10436c6f756420546563686e6f6c6f67793127302506035504030c1e41646f626520436f6e74656e742043657274696669636174652031302d3830820222300d06092a864886f70d01010105000382020f003082020a0282020100d119f9b8d2d41d892abf9f1f3cd1f947141b9867e9be6d96e479c74c87e42f61f5b927bccb7caebe27b26465b8e2f1118c2041980b88d7f559b8f9d041110e19f29ce5033fe9b8184d47982257e97d1b62744521bc329a7861a2376eeb8f3248eb031a7b43b1f22174fcc3c642033770137cad8329b240970127edd3030d9a69af242fc7405b5867d0f5950bb0b79f702e84180ee43ca21f46adce07ad014f5cfd7be25e735eb0431889bcce40a4e94791fca5a65da24838d189b85218c9961eb1bce8db4cb2ffc7a2c3419788e68098350cacc6aa61dfb3d8476454927f9ab767037a84ed4e39862b3f386a065b169403259617150679e34af188035d8bebd9f4f22544cbf81f0d0516799d39a17a56c12e5c151945d65084367647c6f6a78ade46f7bcc0b8aca7d8abfe3eb34ab2d1fb7800a98da86c8da956b267e309634d55ff7f6570f9b926bd602d4a94e77c662d1479c576b972d87bb35ea634b5f676774d40e04a0a908948c269c7dc71778ed5d15d9b8f4519ee858bc273a49afc7a206afd97286716b832e64154a074305d7bbcb7f2205017d1ed5ca6e42edc6d35fabc88dd188028b15e5aa5296e12c03486a80a6e3cb0c001e4742b1edf02fa70c2ebdcbec606480054fc467729e99d1eb80bee04b36fb17c722068079146fde54b06c3ec5c4bafaf113d2000ef36aebe8454560e81d0cf982a798bae3c39cd430203010001a320301e300e0603551d0f0101ff040403020780300c0603551d130101ff04023000300d06092a864886f70d01010d050003820201006bf0137ee63d74f0df4ee19376625ac33574898a025b764e9bd69f8c7d9fa1c7f9b58f0355f206cab84927d626275a8fd0d1c6a3b9a7811b361a68523ad86199ec1188922ce525246bfef1b4dd23eb5b8ee0894d4495ceb1c0f27bca3812c7c02432f9a693c7a331c53162a76c687c0ff60b31389a0e11f9da1fd8ceae91ff671222083643e0a7c0b97f170ab051856ab58c8b3278d16753cfaac05cec9a08c0fcc2e993aaea79225d70e9ec8bfb53c93be8915b2026a35bf05d3c9e5e417fabc5648d9fd8f153e8787f1e3cdd637fe2abd8c8a5d1c9171c342e588a77ff2739dc6b88c79dc933dedf535c496ba652a184b6b65b831aa7706251494108d58f8565624e37a343696f2e42c029333dab8b1a9e34bda64b58546906e9bd3f0d67f3cb830e8b6bf3b01f653c938da93b53a6878a14fe75550b546d580fa40f0e6e6fac25113513f48c9fc79b27689b906afd59d11abbdf4fde466d2a93431606db3938d9e9f7505d1a0cd91e4f116a2f3e1837ba0c1ab0cc74724916a65d9b2c09b00eef96bda7156f789449923371b5aac2a6728b0b3e71ac656ebc820bad65977cebaf56611c8d322c78af95c5dc1c2e56d95eca6efb5664010860dd6c82faf60a9cd493eecc6b013449633928d96bb0d38f28f838564db989958ecfd5325fa51f8ec4148545c5a94705beb7200b427f978959cc7a031fe58f7e2f42ad48e3bb82	2026-10-22_38ee80186f38eba6402e9f32ea241521_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
Key created	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000\Software\Microsoft\SystemCertificates\AdobeCertStore\Certificates\85E2C5B0D9CFF505363FA62A5E8B8C1D76A60B46	2026-10-22_38ee80186f38eba6402e9f32ea241521_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
Key created	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000\Software\Microsoft\SystemCertificates\AdobeCertStore\Certificates\4C7C2E87F0BC79A039D39B05F899A1CC521FDE99	2026-10-22_38ee80186f38eba6402e9f32ea241521_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000\Software\Microsoft\SystemCertificates\AdobeCertStore\Certificates\A5C8D928986EC17FCC7D5F2353885D1709B73A29\Blob = 030000000100000014000000a5c8d928986ec17fcc7d5f2353885d1709b73a292000000001000000bc050000308205b8308203a0a00302010202047ce3bf47300d06092a864886f70d01010d0500308185310b30090603550406130255533113301106035504080c0a43616c69666f726e69613111300f06035504070c0853616e204a6f736531163014060355040a0c0d41646f62652053797374656d7331193017060355040b0c10436c6f756420546563686e6f6c6f6779311b301906035504030c1241646f626520526f6f742043412031302d333020170d3138303831373137333831355a180f32303638303830343137333831355a30818e310b30090603550406130255533113301106035504080c0a43616c69666f726e69613111300f06035504070c0853616e204a6f736531163014060355040a0c0d41646f62652053797374656d7331193017060355040b0c10436c6f756420546563686e6f6c6f67793124302206035504030c1b41646f626520496e7465726d6564696174652043412031302d313530820222300d06092a864886f70d01010105000382020f003082020a0282020100a0e7345276469020a420dfb0569684d7adf0f493a0a0a53742c25e1bf39a91a481ae07efcf40586a5b42a776dad12710078884bfcb2c3af2bdd70b4301490e58de99cb28b1dc5befd617dadfc34c653d9ef643ff6fd9069cb2ad740ebf1abc42c9fabb8a65cd0d76e9b0b64c77ec0e9350da1ba5f3aabbad9e076e2aebb3af34809dd50bb29cb26577536791a0c672c843fd11a60ce5aa99e0ac5ff81819ab8d4306e790040b6d9d4eb9e37b88d9bdfd8271ee8ba557aff9ec66da32c1f483cc84e0e9af352f5fd083e0933047a13529568e22491266b576b50af641676031593285135758d3f86467159b00ff3662b885dc7a331a1b658c42ae8e76101a67abf22002b4ccf330b966d05f63a91870ef56916ff131a0b8737e111413bc3620c593d5c1452012ec77d77b99240ab972c2fd0d20474bb9c63f1053cfded7de55d57e2d735ac280e1faa8f8af095fb29d5b03b7e45ff8c6d1a7c052e0854418d27c9adb3e40032000e988fd8f6f556bd956e85eed4e7c4d1916c4fc090c27e6b1a3bdaadf8eda48c81b212feee1f1b97ebe4b2ed98b49662c101efdb212720d73a7a432af6d816c7997a5485dae77209f060718e50c524d089750a51bfab47e04fccbf04017762c3597fa5b52b2394b7159053034065e17c184c25736ac793c6e2b25e04d59dc1fe74f9e338c719573d6d6b4b29ea7adbc259e5d4fb4d0fa89a92b0203010001a3233021300e0603551d0f0101ff040403020204300f0603551d130101ff040530030101ff300d06092a864886f70d01010d05000382020100501c3b74f2e4857d8171cffe355895c8241c0590b0f5a81321aad9b328916dc68479ed41c47396336cae923db8c14276504c81f99ee5d961fae32ea75fa707717fe6d3a0cdea05bd40c1d69f21a619b09209f09be929c02125020d7eb9e94670ef57bc02080be6718832fd9f5e7fbfd1bd75c278665582452f66a282d7bcb7936bc336ff64ab06a4a5f12f4a4592dd13ac944fc5a2dd8b084fa429d2eecc10fd7e9a5be17b8c235a12c3e48e0df101837bcd4563cac3e02d7b93e172847881db7ed7e3c01e5e426fe51ee67262154daba09ea358bd10e8d10a9028e6dded33fa8c0b5e5e88d751a73bc68cbd30ebed017024affcc1a3942010531a398ea8120158d78c214e813d6023ec021e80967de3131284f80d0650b1a068d7c5e2bf7f8e019c70db26ee5f0d1719240c7a06c66344d95749b73aff74d6471d97297a248370f30b76d15d576e24fc4f2ac5960eb03d44d9fd145415eb99960802ff81c17439d9594187ffeb98e6e6f1ec11b44fb24eaadfcc1e9107e03eafb42bc717d3a0db4a73c66f0a22c7924a400b02742ea8609051927fac69131dba15df08d152e226764f30438bdb422a895c7d0e60b1da26370806914e4cc1dac1777385d470c81292d597def9c7bbdbca6ed5d8a36cbd97c159590fd075b93c32a22e2405fad8c239b66cdc016e3ffe13c191065ecfefcabdaac7164846611cf24ac9506e7af7	2026-10-22_38ee80186f38eba6402e9f32ea241521_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
1460	2026-10-22_38ee80186f38eba6402e9f32ea241521_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
1460	2026-10-22_38ee80186f38eba6402e9f32ea241521_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
1460	2026-10-22_38ee80186f38eba6402e9f32ea241521_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
1460	2026-10-22_38ee80186f38eba6402e9f32ea241521_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
1460	2026-10-22_38ee80186f38eba6402e9f32ea241521_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
1460	2026-10-22_38ee80186f38eba6402e9f32ea241521_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
1460	2026-10-22_38ee80186f38eba6402e9f32ea241521_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
1460	2026-10-22_38ee80186f38eba6402e9f32ea241521_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
1460	2026-10-22_38ee80186f38eba6402e9f32ea241521_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
1460	2026-10-22_38ee80186f38eba6402e9f32ea241521_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
1460	2026-10-22_38ee80186f38eba6402e9f32ea241521_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
1460	2026-10-22_38ee80186f38eba6402e9f32ea241521_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
1324	msedgewebview2.exe
4364	msedgewebview2.exe
4364	msedgewebview2.exe
1324	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
5544	msedgewebview2.exe
3932	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	1460	2026-10-22_38ee80186f38eba6402e9f32ea241521_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
Token: SeIncreaseQuotaPrivilege	1460	2026-10-22_38ee80186f38eba6402e9f32ea241521_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
Token: SeIncreaseQuotaPrivilege	1460	2026-10-22_38ee80186f38eba6402e9f32ea241521_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
Token: SeIncreaseQuotaPrivilege	1460	2026-10-22_38ee80186f38eba6402e9f32ea241521_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
Token: SeIncreaseQuotaPrivilege	1460	2026-10-22_38ee80186f38eba6402e9f32ea241521_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
Token: SeIncreaseQuotaPrivilege	1460	2026-10-22_38ee80186f38eba6402e9f32ea241521_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe

Suspicious use of WriteProcessMemory 50 IoCs

description	pid	Process	procid_target
PID 1460 wrote to memory of 3932	1460	2026-10-22_38ee80186f38eba6402e9f32ea241521_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe	90
PID 1460 wrote to memory of 5544	1460	2026-10-22_38ee80186f38eba6402e9f32ea241521_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe	91
PID 3932 wrote to memory of 4656	3932	msedgewebview2.exe	93
PID 5544 wrote to memory of 5592	5544	msedgewebview2.exe	92
PID 3932 wrote to memory of 2884	3932	msedgewebview2.exe	94
PID 3932 wrote to memory of 2884	3932	msedgewebview2.exe	94
PID 3932 wrote to memory of 2884	3932	msedgewebview2.exe	94
PID 3932 wrote to memory of 2884	3932	msedgewebview2.exe	94
PID 5544 wrote to memory of 1256	5544	msedgewebview2.exe	95
PID 5544 wrote to memory of 1256	5544	msedgewebview2.exe	95
PID 5544 wrote to memory of 1256	5544	msedgewebview2.exe	95
PID 5544 wrote to memory of 1256	5544	msedgewebview2.exe	95
PID 5544 wrote to memory of 4704	5544	msedgewebview2.exe	96
PID 5544 wrote to memory of 1572	5544	msedgewebview2.exe	97
PID 5544 wrote to memory of 1572	5544	msedgewebview2.exe	97
PID 5544 wrote to memory of 1572	5544	msedgewebview2.exe	97
PID 5544 wrote to memory of 5040	5544	msedgewebview2.exe	98
PID 5544 wrote to memory of 5040	5544	msedgewebview2.exe	98
PID 5544 wrote to memory of 5040	5544	msedgewebview2.exe	98
PID 5544 wrote to memory of 5040	5544	msedgewebview2.exe	98
PID 5544 wrote to memory of 5040	5544	msedgewebview2.exe	98
PID 3932 wrote to memory of 2488	3932	msedgewebview2.exe	99
PID 3932 wrote to memory of 4892	3932	msedgewebview2.exe	100
PID 3932 wrote to memory of 4892	3932	msedgewebview2.exe	100
PID 3932 wrote to memory of 4892	3932	msedgewebview2.exe	100
PID 3932 wrote to memory of 1688	3932	msedgewebview2.exe	101
PID 3932 wrote to memory of 1688	3932	msedgewebview2.exe	101
PID 3932 wrote to memory of 1688	3932	msedgewebview2.exe	101
PID 3932 wrote to memory of 1688	3932	msedgewebview2.exe	101
PID 3932 wrote to memory of 1688	3932	msedgewebview2.exe	101
PID 5544 wrote to memory of 1076	5544	msedgewebview2.exe	107
PID 5544 wrote to memory of 1076	5544	msedgewebview2.exe	107
PID 5544 wrote to memory of 1076	5544	msedgewebview2.exe	107
PID 3932 wrote to memory of 1464	3932	msedgewebview2.exe	108
PID 3932 wrote to memory of 1464	3932	msedgewebview2.exe	108
PID 3932 wrote to memory of 1464	3932	msedgewebview2.exe	108
PID 3932 wrote to memory of 4092	3932	msedgewebview2.exe	109
PID 3932 wrote to memory of 4092	3932	msedgewebview2.exe	109
PID 3932 wrote to memory of 4092	3932	msedgewebview2.exe	109
PID 5544 wrote to memory of 3512	5544	msedgewebview2.exe	110
PID 5544 wrote to memory of 3512	5544	msedgewebview2.exe	110
PID 5544 wrote to memory of 3512	5544	msedgewebview2.exe	110
PID 5544 wrote to memory of 1324	5544	msedgewebview2.exe	111
PID 3932 wrote to memory of 4364	3932	msedgewebview2.exe	112
PID 3932 wrote to memory of 4672	3932	msedgewebview2.exe	113
PID 3932 wrote to memory of 4672	3932	msedgewebview2.exe	113
PID 3932 wrote to memory of 4672	3932	msedgewebview2.exe	113
PID 5544 wrote to memory of 3828	5544	msedgewebview2.exe	114
PID 5544 wrote to memory of 3828	5544	msedgewebview2.exe	114
PID 5544 wrote to memory of 3828	5544	msedgewebview2.exe	114

C:\Users\Admin\AppData\Local\Temp\2026-10-22_38ee80186f38eba6402e9f32ea241521_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-22_38ee80186f38eba6402e9f32ea241521_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe"
1⤵
- Checks whether UAC is enabled
- Direct Volume Access: Opens a physical disk for reading
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1460
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=2026-10-22_38ee80186f38eba6402e9f32ea241521_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe --webview-exe-version=2.14.0.57 --user-data-dir="C:\Users\Admin\AppData\Local\Adobe\webview2\2026-10-22_38ee80186f38eba6402e9f32ea241521_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=1 --allow-file-access-from-files --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=1460.4140.16663565455955607215 /pfhostedapp:3ddf90a5d7e75896721ce079b941e544ff4fdf14
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:3932
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Adobe\webview2\2026-10-22_38ee80186f38eba6402e9f32ea241521_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe\EBWebView /prefetch:4 /pfhostedapp:3ddf90a5d7e75896721ce079b941e544ff4fdf14 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Adobe\webview2\2026-10-22_38ee80186f38eba6402e9f32ea241521_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ffa31fe5fd8,0x7ffa31fe5fe4,0x7ffa31fe5ff0
    3⤵
    PID:4656
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Adobe\webview2\2026-10-22_38ee80186f38eba6402e9f32ea241521_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe\EBWebView" --webview-exe-name=2026-10-22_38ee80186f38eba6402e9f32ea241521_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe --webview-exe-version=2.14.0.57 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1764 --field-trial-handle=1768,i,10485368775973108502,5374980861087308656,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:2 /pfhostedapp:3ddf90a5d7e75896721ce079b941e544ff4fdf14
    3⤵
    PID:2884
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Adobe\webview2\2026-10-22_38ee80186f38eba6402e9f32ea241521_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe\EBWebView" --webview-exe-name=2026-10-22_38ee80186f38eba6402e9f32ea241521_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe --webview-exe-version=2.14.0.57 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --no-appcompat-clear --mojo-platform-channel-handle=2640 --field-trial-handle=1768,i,10485368775973108502,5374980861087308656,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:3 /pfhostedapp:3ddf90a5d7e75896721ce079b941e544ff4fdf14
    3⤵
    PID:2488
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Adobe\webview2\2026-10-22_38ee80186f38eba6402e9f32ea241521_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe\EBWebView" --webview-exe-name=2026-10-22_38ee80186f38eba6402e9f32ea241521_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe --webview-exe-version=2.14.0.57 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --no-appcompat-clear --mojo-platform-channel-handle=2652 --field-trial-handle=1768,i,10485368775973108502,5374980861087308656,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:3ddf90a5d7e75896721ce079b941e544ff4fdf14
    3⤵
    PID:4892
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Adobe\webview2\2026-10-22_38ee80186f38eba6402e9f32ea241521_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe\EBWebView" --webview-exe-name=2026-10-22_38ee80186f38eba6402e9f32ea241521_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe --webview-exe-version=2.14.0.57 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3428 --field-trial-handle=1768,i,10485368775973108502,5374980861087308656,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:3ddf90a5d7e75896721ce079b941e544ff4fdf14 /prefetch:1
    3⤵
    PID:1688
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Adobe\webview2\2026-10-22_38ee80186f38eba6402e9f32ea241521_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe\EBWebView" --webview-exe-name=2026-10-22_38ee80186f38eba6402e9f32ea241521_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe --webview-exe-version=2.14.0.57 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --no-appcompat-clear --mojo-platform-channel-handle=4564 --field-trial-handle=1768,i,10485368775973108502,5374980861087308656,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:3ddf90a5d7e75896721ce079b941e544ff4fdf14
    3⤵
    PID:1464
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Adobe\webview2\2026-10-22_38ee80186f38eba6402e9f32ea241521_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe\EBWebView" --webview-exe-name=2026-10-22_38ee80186f38eba6402e9f32ea241521_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe --webview-exe-version=2.14.0.57 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --no-appcompat-clear --mojo-platform-channel-handle=4572 --field-trial-handle=1768,i,10485368775973108502,5374980861087308656,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:3ddf90a5d7e75896721ce079b941e544ff4fdf14
    3⤵
    PID:4092
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Adobe\webview2\2026-10-22_38ee80186f38eba6402e9f32ea241521_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe\EBWebView" --webview-exe-name=2026-10-22_38ee80186f38eba6402e9f32ea241521_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe --webview-exe-version=2.14.0.57 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4648 --field-trial-handle=1768,i,10485368775973108502,5374980861087308656,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:3ddf90a5d7e75896721ce079b941e544ff4fdf14
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4364
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Adobe\webview2\2026-10-22_38ee80186f38eba6402e9f32ea241521_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe\EBWebView" --webview-exe-name=2026-10-22_38ee80186f38eba6402e9f32ea241521_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe --webview-exe-version=2.14.0.57 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --no-appcompat-clear --mojo-platform-channel-handle=4112 --field-trial-handle=1768,i,10485368775973108502,5374980861087308656,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:3ddf90a5d7e75896721ce079b941e544ff4fdf14
    3⤵
    PID:4672
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=2026-10-22_38ee80186f38eba6402e9f32ea241521_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe --webview-exe-version=2.14.0.57 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\{56F19309-2B46-4801-912E-CC5C916CDE2C}\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=1 --allow-file-access-from-files --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=1460.4140.15009048683761864207 /pfhostedapp:a4b637af27219bc875a13f9076bac42c444ce932
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:5544
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\{56F19309-2B46-4801-912E-CC5C916CDE2C}\EBWebView /prefetch:4 /pfhostedapp:a4b637af27219bc875a13f9076bac42c444ce932 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\{56F19309-2B46-4801-912E-CC5C916CDE2C}\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x188,0x18c,0x190,0x184,0x160,0x7ffa31fe5fd8,0x7ffa31fe5fe4,0x7ffa31fe5ff0
    3⤵
    PID:5592
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\{56F19309-2B46-4801-912E-CC5C916CDE2C}\EBWebView" --webview-exe-name=2026-10-22_38ee80186f38eba6402e9f32ea241521_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe --webview-exe-version=2.14.0.57 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1724 --field-trial-handle=1728,i,1603673747976393018,10078940716951400426,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:2 /pfhostedapp:a4b637af27219bc875a13f9076bac42c444ce932
    3⤵
    PID:1256
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\{56F19309-2B46-4801-912E-CC5C916CDE2C}\EBWebView" --webview-exe-name=2026-10-22_38ee80186f38eba6402e9f32ea241521_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe --webview-exe-version=2.14.0.57 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --no-appcompat-clear --mojo-platform-channel-handle=3108 --field-trial-handle=1728,i,1603673747976393018,10078940716951400426,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:3 /pfhostedapp:a4b637af27219bc875a13f9076bac42c444ce932
    3⤵
    PID:4704
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\{56F19309-2B46-4801-912E-CC5C916CDE2C}\EBWebView" --webview-exe-name=2026-10-22_38ee80186f38eba6402e9f32ea241521_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe --webview-exe-version=2.14.0.57 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --no-appcompat-clear --mojo-platform-channel-handle=3128 --field-trial-handle=1728,i,1603673747976393018,10078940716951400426,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:a4b637af27219bc875a13f9076bac42c444ce932
    3⤵
    PID:1572
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\{56F19309-2B46-4801-912E-CC5C916CDE2C}\EBWebView" --webview-exe-name=2026-10-22_38ee80186f38eba6402e9f32ea241521_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe --webview-exe-version=2.14.0.57 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3164 --field-trial-handle=1728,i,1603673747976393018,10078940716951400426,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:a4b637af27219bc875a13f9076bac42c444ce932 /prefetch:1
    3⤵
    PID:5040
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\{56F19309-2B46-4801-912E-CC5C916CDE2C}\EBWebView" --webview-exe-name=2026-10-22_38ee80186f38eba6402e9f32ea241521_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe --webview-exe-version=2.14.0.57 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --no-appcompat-clear --mojo-platform-channel-handle=4752 --field-trial-handle=1728,i,1603673747976393018,10078940716951400426,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:a4b637af27219bc875a13f9076bac42c444ce932
    3⤵
    PID:1076
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\{56F19309-2B46-4801-912E-CC5C916CDE2C}\EBWebView" --webview-exe-name=2026-10-22_38ee80186f38eba6402e9f32ea241521_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe --webview-exe-version=2.14.0.57 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --no-appcompat-clear --mojo-platform-channel-handle=2588 --field-trial-handle=1728,i,1603673747976393018,10078940716951400426,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:a4b637af27219bc875a13f9076bac42c444ce932
    3⤵
    PID:3512
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\{56F19309-2B46-4801-912E-CC5C916CDE2C}\EBWebView" --webview-exe-name=2026-10-22_38ee80186f38eba6402e9f32ea241521_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe --webview-exe-version=2.14.0.57 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4384 --field-trial-handle=1728,i,1603673747976393018,10078940716951400426,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:a4b637af27219bc875a13f9076bac42c444ce932
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1324
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\{56F19309-2B46-4801-912E-CC5C916CDE2C}\EBWebView" --webview-exe-name=2026-10-22_38ee80186f38eba6402e9f32ea241521_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe --webview-exe-version=2.14.0.57 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --no-appcompat-clear --mojo-platform-channel-handle=4636 --field-trial-handle=1728,i,1603673747976393018,10078940716951400426,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:a4b637af27219bc875a13f9076bac42c444ce932
    3⤵
    PID:3828

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1504

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:4676

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Direct Volume Access

T1006

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

.adobefeatureflagnotification

Path C:\Users\Admin\AppData\Local\Adobe\.adobefeatureflagnotification
Size 13B
SHA256 e846f39362168bce024ac0d6df571586cf0146d87daa4d558ca3db5f854137f7
MD5 422bdb7b1334bb4524561f872891b49f
SHA1 0116a25599eaf2a0b6b9c90a20be7872efb7b552
SHA512 47345124fc89c9ccbc8f6960bef6300268439e6deb3726185342727042df8f6cee67ab373d5b8668000d2a3a190085995ae59656b38ceacef4161e1af3fb9523
MD5 SHA1 SHA512

Submit Download

3687291f-d858-4d3d-be7e-47f20178059f.tmp

Path C:\Users\Admin\AppData\Local\Adobe\webview2\2026-10-22_38ee80186f38eba6402e9f32ea241521_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe\EBWebView\3687291f-d858-4d3d-be7e-47f20178059f.tmp
Size 3KB
SHA256 542a87ac0105a7e7359b91eff3a7e1c0c3acd57225379aed79ff640d3747856f
MD5 fab9293a3d6518504188f3f51693208e
SHA1 ceff8665eb2eee191c6bededa5157ee5c20081cd
SHA512 5d1aada40f8a91b621fd0f894c6919772ec6ec5d0af52290316716a4eb51ebd28cc290ac9bfb208cf3607537d8ffc6c18d477ab32aaa118b8e2169fdf0ca3a3c
TLSH
T1BC6142266DB5AA374EF6DB05B8866B06EAA56027E5D13FA4D6EC0F0C01D72DC2342C17
MD5 SHA1 SHA512 TLSH

Submit Download

37ea3dee-be31-4384-9fd7-7083a2fe5131.tmp

Path C:\Users\Admin\AppData\Local\Adobe\webview2\2026-10-22_38ee80186f38eba6402e9f32ea241521_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe\EBWebView\37ea3dee-be31-4384-9fd7-7083a2fe5131.tmp
Size 2KB
SHA256 d92f8f62b716272021013d807a78134a8b5506f9aa9bc2f143df41a3e7a8b371
MD5 4eb4d5afdf3405d71faf0c814c5c4814
SHA1 4c47b67516d17db6ff14e8c1a07f312c943a562e
SHA512 fbd96ae9e44e1a83edcc86294ad83a7b0180166005f75b37e8a744097d0c1b1e05da9fcc9468d6f7948086ed077e9eaa81cdaa7069ec5439f6e65fe4c6f0733b
TLSH
T1A45172322C61AB378AF68748B94BBF13DE756066AA912F50D6DD0F1C00DA29C2346C37
MD5 SHA1 SHA512 TLSH

Submit Download

53794d3e-9ee1-4dea-bfec-f34662004a3f.tmp

Path C:\Users\Admin\AppData\Local\Adobe\webview2\2026-10-22_38ee80186f38eba6402e9f32ea241521_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe\EBWebView\53794d3e-9ee1-4dea-bfec-f34662004a3f.tmp
Size 15KB
SHA256 8a898a2a39997ed69b4a5f94c2e497f441b3f55ca2f241b95ee2377765bbb5f5
MD5 56fcb4c6847748e5c70aa8ad731d91fc
SHA1 d92e9affdc01bde5464ff81385e27df1a521fb4d
SHA512 19f78990505f8b53d74c2e408adf44838c9bf89550d78d1575c6d24f2304e89971cc3d2a10cb68ac82d57504e9bce5879466621ec08111aad237ee8a13103234
SSDEEP 384:f+OBqImmJvGBLx3NaFMJFNNBSx47jqOg6rB:ecvGtlN5Xq41
TLSH
T1FC729E2A2CB26A232CF7C60DFA8A6787CB656153C0D17BE9DDEC8F0F516B1841392D45
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Adobe\webview2\2026-10-22_38ee80186f38eba6402e9f32ea241521_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 4cfe41c962a80d61ff263cd93df6d7150de80c558898cd8d104cde4f1cabef3f
MD5 4b7e945d5046a8387e93013419c83193
SHA1 22665ba02a5dd1afeefec688ca42ca354dc47f44
SHA512 98551d1b2119319bd3cbbd8a4c1ae8638049fabc4e604e376652e42c1ce531b464d6a84a92948004cebd630d99a49df7ec3edbfa6dd6470d7893c4b3c9fbf17a
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Adobe\webview2\2026-10-22_38ee80186f38eba6402e9f32ea241521_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 2d203eb4be410e93fc45cd35f9f0367f5f1c8ac142724a7c601af12d77f2cf76
MD5 0a4843bbccd518246d64fe7b904b8253
SHA1 3d54bc33421c32373661ec9c88faf2b0a6b3925f
SHA512 13ccf3b55dc7b5446411623b8cceb934ebd47455af56a2cbc006aa559bc89587274b485b351aa223b726d6e341c395227b7e9f037d626690106e4a7151410547
TLSH
T13DD01212721101B4C81033332422620C1801C10B400A4046543C855D1E485600F02455
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Adobe\webview2\2026-10-22_38ee80186f38eba6402e9f32ea241521_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Action Predictor

Path C:\Users\Admin\AppData\Local\Adobe\webview2\2026-10-22_38ee80186f38eba6402e9f32ea241521_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe\EBWebView\Default\Network Action Predictor
Size 12KB
SHA256 ae640a646ac9d95a3bc3cf09ae1a74b155ed5ef7c10c4baa4b71cdc15776bbd2
MD5 aaa925effa2b68b0378d6d7081da09db
SHA1 11337d86e33418504fc1e1b9ab8303c6d88fff58
SHA512 4eb728759c3ef15526b3b8996eac7a1d1f813dcad7628ec3ae10d45baff2d4b52b3b729c7dfc7e6408578b923c55042a70adbbe643c55ff27149377cd698e4f4
SSDEEP 3:lSWbNFl/sl+ltl4ltllOlkH5/XWEEabIDWzdWuAzTgdWj3FtFIjHXllv1Xll:l9bNFlEs1okk9DEPDadUTgd81S
TLSH
T1BF424C85FB806420D6286EF254924B795E76C98595524A9309600190AC974DCCC75959
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

44d9ca4f-541d-48dc-934c-eb582a2c9ab1.tmp

Path C:\Users\Admin\AppData\Local\Adobe\webview2\2026-10-22_38ee80186f38eba6402e9f32ea241521_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe\EBWebView\Default\Network\44d9ca4f-541d-48dc-934c-eb582a2c9ab1.tmp
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

8810eedf-f79c-4a7c-8e06-847918cfc8bc.tmp

Path C:\Users\Admin\AppData\Local\Adobe\webview2\2026-10-22_38ee80186f38eba6402e9f32ea241521_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe\EBWebView\Default\Network\8810eedf-f79c-4a7c-8e06-847918cfc8bc.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Adobe\webview2\2026-10-22_38ee80186f38eba6402e9f32ea241521_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

c7b574d9-bc9f-4bba-ac1b-d3fbbd28f47f.tmp

Path C:\Users\Admin\AppData\Local\Adobe\webview2\2026-10-22_38ee80186f38eba6402e9f32ea241521_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe\EBWebView\Default\Network\c7b574d9-bc9f-4bba-ac1b-d3fbbd28f47f.tmp
Size 230B
SHA256 27c739561615160aaec0e7ed7f318ddb661114fd768ee1f72dcccbe4e82ea588
MD5 75ad241bc81224195f620e20abcad795
SHA1 ee4b68e146b88c8b3c128a837611f006e512bab3
SHA512 d47860e196e7b0a406bbda570f28058ad5c36d6991b3523074345e144e093a9e81416ca2f147ca3210932d591351ebd2f3fd5335b55087d091815b5476ebd1b5
TLSH
T1EFD0A77A466019FE075543A05928B81BCEBE5003021CFDBA95347B6A83761B8901458B
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Adobe\webview2\2026-10-22_38ee80186f38eba6402e9f32ea241521_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

aee4ae81-651b-4c38-b62b-1f3f851fb7eb.tmp

Path C:\Users\Admin\AppData\Local\Adobe\webview2\2026-10-22_38ee80186f38eba6402e9f32ea241521_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe\EBWebView\Default\aee4ae81-651b-4c38-b62b-1f3f851fb7eb.tmp
Size 6KB
SHA256 1ef6fb9647ec30edac8ce6f1a6394fab4ef0c2a4670130e9e26bdea3040e23c0
MD5 c1cba587b3acd432c5c0bc0bd07ce45e
SHA1 8b144efcbb9f08e42d7e4e234efd959f0139a9ce
SHA512 dbd30ea8c98bc377f83a80103c6148e5a1ec7db283e8e48480f600a07b3791e2b67afb8312568747182eb198b2a4f3c6aa0726df0b428b59475c61c09a9621a4
SSDEEP 96:stNb/dAFpCb93kPo5h16Zd7s7/x+6Mhmuecmx+e/K+g628XM1C7K:st5S86os7sV+Fix+1sG6K
TLSH
T18FD1A6025E64787B4CCAE509FA29BB43E2F5603270D11D58EBFC4A6C04EB5DC630B90B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

efc7d60d-0f86-471c-a1ae-33eca04ffd8a.tmp

Path C:\Users\Admin\AppData\Local\Adobe\webview2\2026-10-22_38ee80186f38eba6402e9f32ea241521_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe\EBWebView\Default\efc7d60d-0f86-471c-a1ae-33eca04ffd8a.tmp
Size 6KB
SHA256 96e15a55455a0926edc2d2c7c631f14edb448f2b17fd8b0c3c517494ebaaefc2
MD5 f05bc02219ba8dcdeed7da4c44b99e19
SHA1 c2fbb160d4e700c41d832cc5588bc3ff64b2ab82
SHA512 afe098d818b37e313a94a28c1aed1891d3f518b26c814c4aec0de04b2ec523cedfdf38f0e418c5e0e780a0b8b1839d1d0be3f614f109b9b4fbf3e5fe621e85a2
SSDEEP 96:stNb/dAFgGCb93kPo5h16Zd7s7/x+6Mhmuecmx+e/K+gg28XM1C7K:st5SK6os7sV+Fix+1WG6K
TLSH
T1CAD1A6025E64787B8CCBE519FA29BB53E2F5603260D11E58EBFC496C04EB5DC631790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Adobe\webview2\2026-10-22_38ee80186f38eba6402e9f32ea241521_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe\EBWebView\Local State
Size 1KB
SHA256 ad8c664f20e23ee3ce7954b62f14c560886c2773abf40f98ca88fa85294cd736
MD5 c32051cc341b09b54566aa578c1f9d72
SHA1 739d354a20177dbbdf8c8c337db5afd30d3418e6
SHA512 fe711ff1db1f795925d83ca052c195d68f6c61064366772cabb19ef804c99631e6c5900a19f64b126b703c4de75966bcf98fadd14f7abe6ce68a05f8122f6c19
TLSH
T1772165B15CF59B32ADB657466147FA479D30302B82904F4092DD4F1C01EA1DC966AC32
MD5 SHA1 SHA512 TLSH

Submit Download

WAM.log

Path C:\Users\Admin\AppData\Local\Temp\CreativeCloud\ACC\WAM.log
Size 1KB
SHA256 9611d5fa4ed73e14cad0d1cb0d64071771907665ba06e6936e4350d10178779f
MD5 ade48e8ae895532a7fb333cf313b3eaf
SHA1 62cad789a70132f18e07aaf4045f6ae654d2a229
SHA512 202b63f79b55cb654aab33f5873900d190b01caaa73d2f49d38af42e003adad14a56ebb6aa7038e10df3b6a3cd69be3de873f3444279bf9df549564f9b7aea7c
TLSH
T12B414D1B66EB5D18F5F2EB456EF6E111E5377CFA6C35871813A0054E0B6EA00B4A037A
MD5 SHA1 SHA512 TLSH

Submit Download

CCDInstaller.js

Path C:\Users\Admin\AppData\Local\Temp\{56F19309-2B46-4801-912E-CC5C916CDE2C}\CCDInstaller.js
Size 1.8MB
SHA256 b3cd90e4b56fa44d062d9b061f48f88cfb4372f64ed2f71da40e04aeb004bfda
MD5 02fd165c6436aa8bd7c66b6cdfaf0538
SHA1 f76364bc78aaa44ed404edabc3ec52d8357ad213
SHA512 972d85183ed0cc36904636a74c4351ff170f6346f80f2d8724d8141d285104ee5946e81c0fb9d855f399ff3d865f19c9494d72a27d481240106e9e966cbdcae0
SSDEEP 12288:ZiG9838Pp42Tino9x9LYzKzX58x5MX8kkWd634OpHdVFbDgxMNEk+DRUbA24hQLT:7TC6x9L5zX5wU8kkWA/bDgxDRV24y
TLSH
T1DB95F77F74A5A872AF8030D6009BB40FB7753539738084A89955CF9C92E6B8D4B0BE5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

89cffd95-861a-43bc-842d-fb2f995e4ece.tmp

Path C:\Users\Admin\AppData\Local\Temp\{56F19309-2B46-4801-912E-CC5C916CDE2C}\EBWebView\89cffd95-861a-43bc-842d-fb2f995e4ece.tmp
Size 3KB
SHA256 6966288ac0fd7f32c992bdb57abf1f32dc68feae1a3e082b4e011b6b89b8dfcb
MD5 f891830885e2ec1c2e9cab97fc3d5a0b
SHA1 e8fcd0f1099dded59831d39711dc74dcd7d1737b
SHA512 ddd5e63e9dac31f5510b90e72442ce49f5b32ad6c1d3d3a0bdb9cf9d50f465e04112bec276b174fc8d407048d14872ed2ad81f84f1db248c9f25000516d74e0e
TLSH
T1177182266971AA275EB7DA48B9867B03EB646027E9853FD9CAED0F0C01D72CC1342C17
MD5 SHA1 SHA512 TLSH

Submit Download

8ed15e5c-614d-43b9-8ae5-5c27dcb1579c.tmp

Path C:\Users\Admin\AppData\Local\Temp\{56F19309-2B46-4801-912E-CC5C916CDE2C}\EBWebView\8ed15e5c-614d-43b9-8ae5-5c27dcb1579c.tmp
Size 3KB
SHA256 aec8d9953a72fc55f3e1c0fe490e7bb9dc13127a8f0a510212ab6bff307129dd
MD5 0f81c9cea0108f021f9ecc69b3c517de
SHA1 4499aea89c99b25bc4337428f95e4ee4e160c1b5
SHA512 4819508e7c488df7d642397e28d6e389979a07aa155e312de38ccb05e8a0add2cc009b6bdc222950810184b23e4a553bc4efd829305cac979df273acf6e2a219
TLSH
T1D96162366D70E6375EB7DA55B8872B16EBA56027E9813F95CAEC0F0C01D72D82342C17
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\{56F19309-2B46-4801-912E-CC5C916CDE2C}\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 68151bfe0f8f5b6abfb4187794f9f2c99d1835d2c235ede175bdace997afb141
MD5 6cec2e6001fd0e626b9031e42414edea
SHA1 7814ed9b570a717e5b38f054e66bf84eae6f9ca2
SHA512 bf705ad8744574999ebbe179a1e3d23a44c6576eeac056880adbe49f0cdb8468774f28d07538878e58fa3c9a572e3d610240ddce2265eea2543cc3fdf814b0fe
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\{56F19309-2B46-4801-912E-CC5C916CDE2C}\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 eea9d2be68904d10447288fe0d4b259a2838753555ed8d015f0de0f84d41ea79
MD5 17d93cdb390c311ea5d04fe05abcdb2b
SHA1 e2c6ba04d886a924559ac6fda07edfc7875c08e8
SHA512 d5e25c7e8e87663a7afeacf7adfc6cd3cb9dba47ff4d14ac6def7053dc7e5db4f6327473d24a12359256df84c822e2e7fc40225b0867dc321ad33137c1361882
TLSH
T1B5D0122237020738C01035730112AE480D00C10B80494005D42D865E2A580540F02442
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Temp\{56F19309-2B46-4801-912E-CC5C916CDE2C}\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

8391aa7f-ef0c-4e25-9285-c8e47eee33d6.tmp

Path C:\Users\Admin\AppData\Local\Temp\{56F19309-2B46-4801-912E-CC5C916CDE2C}\EBWebView\Default\8391aa7f-ef0c-4e25-9285-c8e47eee33d6.tmp
Size 6KB
SHA256 f6d7e6d04288082fcf5f4178cabd2cd5318519f7bcbade33b6add1b7cb1fa5ff
MD5 d37af0a7f3b3a0debf3c26daadbce68d
SHA1 31a417207a79974eda8f32a7145c679211d19847
SHA512 5e69d9846eb50a9e374ad284983681b5fe6f534f974c7ec0d9a1a01fcd4237c140326cf3b3230612809d69d2d41c0af7128b8cd374a71a8e93e91004c831d1a9
SSDEEP 96:stK/dAJr3GsSpb96kk5o5h16Zvss7/x+6MhmuecDro1eje/K+gT28XM1C7K:stySA2voqssV+FvroQj1ZG6K
TLSH
T14BD1A7025E78787B4CC6E119FA29BB43E2F5607161D11E58EBFC4A6C04E76DD631780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Temp\{56F19309-2B46-4801-912E-CC5C916CDE2C}\EBWebView\Default\Code Cache\js\index-dir\temp-index
Size 264B
SHA256 be2b9ea13f0af83c9604a1b41ad84810b45946bb89c5c3102dd63371d8949fdc
MD5 bb09881c60e7c7a3472bac323b85fd5f
SHA1 26fcdaf631c52240545ab1d839770abf40471046
SHA512 d9f1357b5b99f5f347e748b4f23e51c18e29e34f22540f3a6691b0976a53f39e06dc1987058d91417db1e7b568eb3bab1ae4380ba4f3b1464cf0eeaed9f04f8c
TLSH
T11BD012540447411AC71122725DCE7345777ADD3552BB0E0E74A41E3758F6B84F676710
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\{56F19309-2B46-4801-912E-CC5C916CDE2C}\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 bc4ac379f45bd5449cc06ede7f72d42ed5a838fd5fac4a5d7b6ec46656a078df
MD5 287435b6b883a7edfbfb5551244c5afa
SHA1 853c72742e34ae02cef147ea330dc6019e59e476
SHA512 f777d0bdb94496ec5aee8f4264e1ef985f9a01bb86b6a903e978bf589a21cb0af0ce29ff4613e4619dc9e5eda7cbbf3533471cbd9892b913dab904eaaa800629
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\{56F19309-2B46-4801-912E-CC5C916CDE2C}\EBWebView\Default\Code Cache\wasm\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\{56F19309-2B46-4801-912E-CC5C916CDE2C}\EBWebView\Default\DawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\{56F19309-2B46-4801-912E-CC5C916CDE2C}\EBWebView\Default\DawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\{56F19309-2B46-4801-912E-CC5C916CDE2C}\EBWebView\Default\DawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\{56F19309-2B46-4801-912E-CC5C916CDE2C}\EBWebView\Default\DawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

ca28d00a-caa2-4743-a2e8-4ff2260eaada.tmp

Path C:\Users\Admin\AppData\Local\Temp\{56F19309-2B46-4801-912E-CC5C916CDE2C}\EBWebView\Default\Network\ca28d00a-caa2-4743-a2e8-4ff2260eaada.tmp
Size 1KB
SHA256 a275629e01517accd9aca3648af5cf01b99fc7eada2a3ea98933f1cadc71f2db
MD5 400d2b051d7882f8bc19525ab588155d
SHA1 86ac634eda0758a392a7d3161e02804cdb66d2df
SHA512 6bf745441c7dd82203417e7b085599a110a8aae8c945b68c9488aa6486def96c4c84060cf0b400b06b6eb8406cd5dd98e9f295e1b5898ba6488dc43a75a8a86e
TLSH
T1054118F783B8052D8A5291F45B18DE1FCF9E1811876CEA39C9D55E9393E14B1E210B4B
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Temp\{56F19309-2B46-4801-912E-CC5C916CDE2C}\EBWebView\Default\Preferences
Size 5KB
SHA256 beb8939c666bcd40093fd6814e7bb1b53a986f0ba623af9fa6ec52577c5212ec
MD5 329867c9c22e895843c53ca181451055
SHA1 3218b84ed6943a5933ee5d85ba26ff928ab4badd
SHA512 e90ec328781bf71aaadedc8edbcee06f69ee463c95723003c1963cefc6ddd5deef7c6666fbecdbb1c7c61c256772386bc78337b39be76d1f4a8de1eb6ff8f39b
SSDEEP 96:rK/dAJrQsSpb96kkldo616Zvss7/x+6MhmuecDro1eje/K+gV28XM1C7K:rySG2BoZssV+FvroQj1jG6K
TLSH
T1E4C1B6025E78687F4CC6E109FA29BA47E2F5606171D12E58EBFC8A6C08D75DC631B80B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ccfac8f3-5933-4da3-88f7-452786a597d4.tmp

Path C:\Users\Admin\AppData\Local\Temp\{56F19309-2B46-4801-912E-CC5C916CDE2C}\EBWebView\Default\ccfac8f3-5933-4da3-88f7-452786a597d4.tmp
Size 6KB
SHA256 2180419dac8d2e0f0b57161b8b1bc2e411c10136897eda208c5b55506edf8884
MD5 81c32005a23f2e5023046db6a8c69537
SHA1 29ec7b6bf0739a7f4b87870d8e43957eaa4905d3
SHA512 f565dcaf06694865c46fd8da44e5d49557c356fe12ea78e88a325e7a6980c2407a65f354cbf8df2530bda2ba42d15c0e984872e68ef82ba485cde80217ebcb8a
SSDEEP 96:stK/dAJrQsSpb96kk5o5h16Zvss7/x+6MhmuecDro1eje/K+gV28XM1C7K:stySG2voqssV+FvroQj1jG6K
TLSH
T169D1A6025E78787B4CCAE109FA25BA47E2F5607171D11E58EBFC8A6C08E75DC631B907
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\{56F19309-2B46-4801-912E-CC5C916CDE2C}\EBWebView\Local State
Size 1KB
SHA256 10041fa018e6546f60ef0e228542e81ffb0244c144cf953b4fa290b99ae5a619
MD5 64600d7969e2689bbae6899eff2e193c
SHA1 01620737d3afe3fca8cf38d83d086f3a8d89745a
SHA512 0c4cd0df25cdae5dcc1405afffcdadc2320fb4353cc9cdbe95a2b95ae5c29916eb85ee7483a1ab44e5d6201099b71dba01631ffb548ce76d6583b624feb0ab46
TLSH
T1512162B2D8B0A733AD67539AA147AD878E30202A86816E0099DE4F0C01D31CCE616C37
MD5 SHA1 SHA512 TLSH

Submit Download

fb2a618c-9781-419c-9a34-4d03dfd6c605.tmp

Path C:\Users\Admin\AppData\Local\Temp\{56F19309-2B46-4801-912E-CC5C916CDE2C}\EBWebView\fb2a618c-9781-419c-9a34-4d03dfd6c605.tmp
Size 2KB
SHA256 b5c33d50122874cea1f90533065e69dc3c072afd9de57d71f80fa3156e74ae4c
MD5 0bcbdd42853172c97d463f31c57de9d4
SHA1 45a5023730a09fca341edaa08d2c79ee7d38f38b
SHA512 e3bd911c8798babcd4a0d176120b6e7a57699f50260521004bd3c67a8a1df8b3dcb4b62a7601c1a68b880597ac970b8fa126426cde9536a4bf3071590e9a6adc
TLSH
T17E5162736C21A7379EB78758A94B7E53CE396065AA922F50DAED0F0C01C719C6342C3B
MD5 SHA1 SHA512 TLSH

Submit Download

index.css

Path C:\Users\Admin\AppData\Local\Temp\{56F19309-2B46-4801-912E-CC5C916CDE2C}\index.css
Size 923KB
SHA256 cdd337f639e76f36fa41002b26e9a4f8c819d196747983283e25e3049fe5028e
MD5 e09f799bb69cecaf3987bc12cf65dd24
SHA1 ea57b540f246e00bd1e4bb7df3824bd8fa129a6c
SHA512 90a877a6024d996646055f496907276e4746cecab334b701f0d44d11b1d636984a049c74310606b7f0487549eb4b454318ba3b2e02ebc1121ff57970d885e1a4
SSDEEP 12288:oUxDxiaHbr3Gq5XRi5i6jE/5acgsu0wxT63kaSROcdOLeK+CnjG1VWzWhHuajOGh:oEBP3/5XSo/5F5K65SROcwLeKVYgzWIK
TLSH
T14D15CEE0D6A04D1D74378C3AA1CEA75E5514C28E55889FDBAE83ECF540CA696CF2270F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.html

Path C:\Users\Admin\AppData\Local\Temp\{56F19309-2B46-4801-912E-CC5C916CDE2C}\index.html
Size 426B
SHA256 886c0ab69e6e9d9d5b5909451640ea587accfcdf11b8369cad8542d1626ac375
MD5 a28ab17b18ff254173dfeef03245efd0
SHA1 c6ce20924565644601d4e0dd0fba9dde8dea5c77
SHA512 9371a699921b028bd93c35f9f2896d9997b906c8aba90dd4279abba0ae1909a8808a43bf829584e552ccfe534b2c991a5a7e3e3de7618343f50b1c47cff269d6
TLSH
T1A9E0225B1D924C1C62701BB4D9E2F82DCA45B64AA743AE2074C5256B6FB2B88CCCB64D
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.fingerprint

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3932_1415060507\manifest.fingerprint
Size 66B
SHA256 946f3a9e019b0d80f5671de782f295132341f663f74aebad7628f22e528d6d52
MD5 3fb5233616491df0ec229ba9f42efdb8
SHA1 18a8116e2df9805accd7901d2321c3fa92da1af4
SHA512 e9b17ac626bf6508db9a686825411e90d316a0f1dacbf63dbec5baaaf6b96af4dbc9a7332975b6d5c16c43757d79fddca6b888ea97bc07a8dffb1b3a06366b4d
TLSH
T1F8A022A0C302202228A00E0A82E20223200EA80CE880002328AC8E2A080833B00A8200
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3932_455623748\manifest.json
Size 76B
SHA256 0d664bc422a696452111b9a48e7da9043c03786c8d5401282cff9d77bcc34b11
MD5 ba25fcf816a017558d3434583e9746b8
SHA1 be05c87f7adf6b21273a4e94b3592618b6a4a624
SHA512 3763bd77675221e323faa5502023dc677c08911a673db038e4108a2d4d71b1a6c0727a65128898bb5dfab275e399f4b7ed19ca2194a8a286e8f9171b3536546f
TLSH
T170A022833A0EC03B008283B0202383C08BBCAA28380E080E082338C0CAC2BB80000B28
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5544_1866557274\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

Other

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5544_533444249\Sigma\Other
Size 34B
SHA256 2b4a47b82cbe70e34407c7df126a24007aff8b45d5716db384d27cc1f3b30707
MD5 cd0395742b85e2b669eaec1d5f15b65b
SHA1 43c81d1c62fc7ff94f9364639c9a46a0747d122e
SHA512 4df2ce734e2f7bc5f02bb7845ea801b57dcf649565dd94b1b71f578b453ba0a17c61ccee73e7cff8f23cdd6aa37e55be5cb15f4767ff88a9a06de3623604fbf0
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5544_533444249\manifest.json
Size 132B
SHA256 de864bf0ab8abacfba536d4e9764eca658f903bd2457f955e128c4ee181c7e58
MD5 c9209ab189a035569ba3c65d7375d220
SHA1 1987aaec8f436325415fe36c168c9a37829523f9
SHA512 60495e096f78de05c6025a9d7b69aef9dce0d08ec1abbd4ccba206827a8c25d8449f54f93637599649762ec09a034d32fc8afc06199b1b57cd010ff1a0c850c0
TLSH
T17FC092615802797A14DEB7F00D29CB926AB3CB2E18A4650546F5C228ED2DCDFB5B330B
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.fingerprint

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5544_586221744\manifest.fingerprint
Size 66B
SHA256 e84df839eb3dee2a10ba66de65c372c6e2bba0cbab46a39af041f4eeaab1ffe8
MD5 06d2b48de0edcb3e022ed639f0fb0085
SHA1 32f93d5a76998c407087269794026d1ea028828f
SHA512 3c883d4c342f95f28e4a76c73ce7151e8a76d6f5b2c86f90a9ee7f9976ae7e1be94c963489b326d2ff5f7c6423b29552d9aa09b65c17396c2f66ce271fe19506
TLSH
T1F3A022E32CE8880EACEC0AAB020A0AFA0ECC8000020280C80008080220028F0008CA8C
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5544_586221744\manifest.json
Size 135B
SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
MD5 616eb6b585f16811dc5db5063e088cd7
SHA1 fc50aa7b747f9367d2b177eab7ab12cdafdeea85
SHA512 cdaf55640f0279c1cee06338912a07bc8bc8cb3780f70202363e25b327eb94a524c0acdd25cc2b22fbb1895d32af888857b17b3f0d7a2064f51ccdf1bab57f79
TLSH
T1BFC04C668D41DEAB00A647A56B295315E23B4B4B5044400A7AB5429C1A285964271844
MD5 SHA1 SHA512 TLSH

Submit Download

protocols.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5544_586221744\protocols.json
Size 3KB
SHA256 2edf732da5fd827859e7a1a5b69a4a622cfc416f60a6ae04154d5aad3a1bccec
MD5 5e2067a92dcfcb05537479c384a89725
SHA1 eeed29b07d865ac4d46629fddadad629d0ad4e2b
SHA512 c96c5f9cb7a169ad91b070b567cf9fa8f35951ccc5aa930e97dbeccbeac27f7e9dde1379138c9ba6b0d10339f9cb053ef21f19f06d7560f97d5d23a27c8ed4f6
TLSH
T17D7184B7862088194E360AB4AA0DF10DF93702DF2AF598D3B27D455F1F712BB3946249
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1076-576-0x00007FFA52800000-0x00007FFA52801000-memory.dmp

Download

memory/1076-575-0x00007FFA53120000-0x00007FFA53121000-memory.dmp

Download

memory/1256-438-0x000001DB18D10000-0x000001DB18DE3000-memory.dmp

Download

memory/1324-709-0x00000194E1190000-0x00000194E1191000-memory.dmp

Download

memory/1324-706-0x00000194E1190000-0x00000194E1191000-memory.dmp

Download

memory/1460-0-0x0000000000120000-0x0000000000B8E000-memory.dmp

Download

memory/2884-437-0x000001C2D7800000-0x000001C2D78D3000-memory.dmp

Download

memory/2884-215-0x00007FFA53E40000-0x00007FFA53E41000-memory.dmp

Download

memory/4364-716-0x000001FDCE440000-0x000001FDCE441000-memory.dmp

Download

memory/4364-715-0x000001FDCE440000-0x000001FDCE441000-memory.dmp

Download

memory/4364-712-0x000001FDCE440000-0x000001FDCE441000-memory.dmp

Download

memory/4364-714-0x000001FDCE440000-0x000001FDCE441000-memory.dmp

Download

memory/4364-717-0x000001FDCE440000-0x000001FDCE441000-memory.dmp

Download

memory/4364-713-0x000001FDCE440000-0x000001FDCE441000-memory.dmp

Download

memory/5040-217-0x00007FFA53E40000-0x00007FFA53E41000-memory.dmp

Download