b36a2baa72dd52cada3a676f654dd04ae98b8c366139fb36eb6267e4c5ffa90c

Analysis

max time kernel
149s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260617-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/06/2026, 22:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-28_5a47fae51de3c356bbb6fb95e6051891_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
Size 3.2MB
Sample260628-2ckmksft81
SHA256 b36a2baa72dd52cada3a676f654dd04ae98b8c366139fb36eb6267e4c5ffa90c
MD5 5a47fae51de3c356bbb6fb95e6051891
SHA1 d2fcdff01bf300c081b80e636f4a9918ade914dd
SHA512 242382a97a28d52570bd2fd269b185ebaa22bea90b2d7071ff0e22e4f4fa065530bc8149d13a65c9f5ca4f308ea8a088bd650a64923a06bd299ef2550ab9c89d
SSDEEP 49152:M36fZMj9ZmMKwQUJ821Nt6nyCnJtFpgtSOYoCTtQPsg9IgY1K4W1REZ1C1YXRTqJ:M36fZ290BPWjEZ1cyi
TLSH
T19DF5590262F95138F2FB2B70B93C56690EBA7E426F39C5DF8344185C0E746E099B5B27
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery persistence ransomware spyware stealer

Malware Config

Signatures

Detects executables containing base64 encoded User Agent 1 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c4c9-12.dat	INDICATOR_SUSPICIOUS_EXE_B64_Encoded_UserAgent

Downloads MZ/PE file 1 IoCs

flow	pid	Process
84	1308	msedge.exe

Executes dropped EXE 4 IoCs

pid	Process
4308	2026-06-28_5a47fae51de3c356bbb6fb95e6051891_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
2728	_sfx.exe
1312	assistant_installer.exe
5912	assistant_installer.exe

Loads dropped DLL 9 IoCs

pid	Process
1420	2026-06-28_5a47fae51de3c356bbb6fb95e6051891_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
1100	2026-06-28_5a47fae51de3c356bbb6fb95e6051891_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
4308	2026-06-28_5a47fae51de3c356bbb6fb95e6051891_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
1312	assistant_installer.exe
1312	assistant_installer.exe
5912	assistant_installer.exe
5912	assistant_installer.exe
3704	2026-06-28_5a47fae51de3c356bbb6fb95e6051891_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
2848	2026-06-28_5a47fae51de3c356bbb6fb95e6051891_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 4 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	2026-06-28_5a47fae51de3c356bbb6fb95e6051891_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened (read-only)	\??\E:	2026-06-28_5a47fae51de3c356bbb6fb95e6051891_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened (read-only)	\??\F:	2026-06-28_5a47fae51de3c356bbb6fb95e6051891_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened (read-only)	\??\E:	2026-06-28_5a47fae51de3c356bbb6fb95e6051891_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe

Drops file in Windows directory 7 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5524_1662226086\nav_config.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5524_282189848\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5524_1220779017\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5524_1220779017\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5524_1662226086\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-28_5a47fae51de3c356bbb6fb95e6051891_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-28_5a47fae51de3c356bbb6fb95e6051891_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	_sfx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	assistant_installer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-28_5a47fae51de3c356bbb6fb95e6051891_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-28_5a47fae51de3c356bbb6fb95e6051891_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	assistant_installer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-28_5a47fae51de3c356bbb6fb95e6051891_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1308	msedge.exe
1860	msedge.exe

Enumerates system info in registry 2 TTPs 8 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	assistant_installer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	assistant_installer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134271592014077360"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-28459746-3881314244-166055492-1000\{CE05BF68-C0C3-4EFC-8778-E65A9B6A0649}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-28459746-3881314244-166055492-1000\{D00C0244-FB4C-4A55-8980-E35E0712D7C7}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5524	msedge.exe
5524	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
5184	msedge.exe
5184	msedge.exe
5184	msedge.exe
5184	msedge.exe
5184	msedge.exe
5184	msedge.exe

Suspicious use of FindShellTrayWindow 13 IoCs

pid	Process
5184	msedge.exe
5184	msedge.exe
5184	msedge.exe
5184	msedge.exe
5184	msedge.exe
5184	msedge.exe
5184	msedge.exe
5184	msedge.exe
5184	msedge.exe
5184	msedge.exe
5184	msedge.exe
5184	msedge.exe
5184	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1420	2026-06-28_5a47fae51de3c356bbb6fb95e6051891_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1420 wrote to memory of 1100	1420	2026-06-28_5a47fae51de3c356bbb6fb95e6051891_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe	89
PID 1420 wrote to memory of 4308	1420	2026-06-28_5a47fae51de3c356bbb6fb95e6051891_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe	90
PID 1420 wrote to memory of 2728	1420	2026-06-28_5a47fae51de3c356bbb6fb95e6051891_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe	91
PID 1420 wrote to memory of 1312	1420	2026-06-28_5a47fae51de3c356bbb6fb95e6051891_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe	92
PID 1312 wrote to memory of 5912	1312	assistant_installer.exe	93
PID 1420 wrote to memory of 3704	1420	2026-06-28_5a47fae51de3c356bbb6fb95e6051891_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe	94
PID 3704 wrote to memory of 2848	3704	2026-06-28_5a47fae51de3c356bbb6fb95e6051891_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe	95
PID 1420 wrote to memory of 5184	1420	2026-06-28_5a47fae51de3c356bbb6fb95e6051891_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe	96
PID 5184 wrote to memory of 4568	5184	msedge.exe	97
PID 5184 wrote to memory of 1308	5184	msedge.exe	98
PID 5184 wrote to memory of 4804	5184	msedge.exe	99
PID 5184 wrote to memory of 4804	5184	msedge.exe	99
PID 5184 wrote to memory of 436	5184	msedge.exe	100
PID 5184 wrote to memory of 436	5184	msedge.exe	100
PID 5184 wrote to memory of 436	5184	msedge.exe	100
PID 5184 wrote to memory of 3216	5184	msedge.exe	102
PID 5184 wrote to memory of 3216	5184	msedge.exe	102
PID 5184 wrote to memory of 3216	5184	msedge.exe	102
PID 5184 wrote to memory of 4752	5184	msedge.exe	103
PID 5184 wrote to memory of 4752	5184	msedge.exe	103
PID 5184 wrote to memory of 4752	5184	msedge.exe	103
PID 5184 wrote to memory of 1144	5184	msedge.exe	104
PID 5184 wrote to memory of 1144	5184	msedge.exe	104
PID 5184 wrote to memory of 1144	5184	msedge.exe	104
PID 5184 wrote to memory of 5732	5184	msedge.exe	105
PID 5184 wrote to memory of 5732	5184	msedge.exe	105
PID 5184 wrote to memory of 5732	5184	msedge.exe	105
PID 5184 wrote to memory of 5512	5184	msedge.exe	106
PID 5184 wrote to memory of 5512	5184	msedge.exe	106
PID 5184 wrote to memory of 2124	5184	msedge.exe	108
PID 5184 wrote to memory of 2124	5184	msedge.exe	108
PID 5184 wrote to memory of 2124	5184	msedge.exe	108
PID 5184 wrote to memory of 2904	5184	msedge.exe	109
PID 5184 wrote to memory of 2904	5184	msedge.exe	109
PID 5184 wrote to memory of 4636	5184	msedge.exe	110
PID 5184 wrote to memory of 4636	5184	msedge.exe	110
PID 5184 wrote to memory of 4892	5184	msedge.exe	111
PID 5184 wrote to memory of 4892	5184	msedge.exe	111
PID 5184 wrote to memory of 964	5184	msedge.exe	112
PID 5184 wrote to memory of 964	5184	msedge.exe	112
PID 5184 wrote to memory of 964	5184	msedge.exe	112
PID 5184 wrote to memory of 5364	5184	msedge.exe	115
PID 5184 wrote to memory of 5364	5184	msedge.exe	115
PID 5184 wrote to memory of 3408	5184	msedge.exe	118
PID 5184 wrote to memory of 4760	5184	msedge.exe	119
PID 5524 wrote to memory of 4676	5524	msedge.exe	120
PID 5524 wrote to memory of 2436	5524	msedge.exe	121
PID 5524 wrote to memory of 1860	5524	msedge.exe	122
PID 5524 wrote to memory of 2436	5524	msedge.exe	121
PID 5524 wrote to memory of 2436	5524	msedge.exe	121
PID 5524 wrote to memory of 1512	5524	msedge.exe	123
PID 5524 wrote to memory of 1512	5524	msedge.exe	123
PID 5524 wrote to memory of 1812	5524	msedge.exe	126
PID 5524 wrote to memory of 2636	5524	msedge.exe	127
PID 5524 wrote to memory of 2636	5524	msedge.exe	127
PID 5524 wrote to memory of 480	5524	msedge.exe	128
PID 5524 wrote to memory of 480	5524	msedge.exe	128
PID 5524 wrote to memory of 1140	5524	msedge.exe	129
PID 5524 wrote to memory of 1140	5524	msedge.exe	129
PID 5524 wrote to memory of 5488	5524	msedge.exe	130
PID 5524 wrote to memory of 3020	5524	msedge.exe	131
PID 5524 wrote to memory of 5876	5524	msedge.exe	132
PID 5524 wrote to memory of 1968	5524	msedge.exe	135
PID 5524 wrote to memory of 1968	5524	msedge.exe	135

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-06-28_5a47fae51de3c356bbb6fb95e6051891_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-28_5a47fae51de3c356bbb6fb95e6051891_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe"
1⤵
- Loads dropped DLL
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1420
- C:\Users\Admin\AppData\Local\Temp\2026-06-28_5a47fae51de3c356bbb6fb95e6051891_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
  C:\Users\Admin\AppData\Local\Temp\2026-06-28_5a47fae51de3c356bbb6fb95e6051891_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=57.0.3098.110 --initial-client-data=0x2b4,0x2c4,0x2c8,0x2c0,0x2cc,0x74c3d5e0,0x74c3d5f0,0x74c3d5fc
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1100
- C:\Users\Admin\AppData\Local\Temp\Opera Installer\2026-06-28_5a47fae51de3c356bbb6fb95e6051891_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
  "C:\Users\Admin\AppData\Local\Temp\Opera Installer\2026-06-28_5a47fae51de3c356bbb6fb95e6051891_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe" --version
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4308
- C:\Users\Admin\AppData\Local\Temp\Opera Installer\opera_package_202606282326181\assistant\_sfx.exe
  "C:\Users\Admin\AppData\Local\Temp\Opera Installer\opera_package_202606282326181\assistant\_sfx.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2728
- C:\Users\Admin\AppData\Local\Temp\Opera Installer\opera_package_202606282326181\assistant\assistant_installer.exe
  "C:\Users\Admin\AppData\Local\Temp\Opera Installer\opera_package_202606282326181\assistant\assistant_installer.exe" --version
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Enumerates system info in registry
  - Suspicious use of WriteProcessMemory
  PID:1312
- - C:\Users\Admin\AppData\Local\Temp\Opera Installer\opera_package_202606282326181\assistant\assistant_installer.exe
    "C:\Users\Admin\AppData\Local\Temp\Opera Installer\opera_package_202606282326181\assistant\assistant_installer.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=130.0.5847.41 --initial-client-data=0x24c,0x250,0x254,0x228,0x258,0xc14040,0xc1404c,0xc14058
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:5912
- C:\Users\Admin\AppData\Local\Temp\2026-06-28_5a47fae51de3c356bbb6fb95e6051891_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-06-28_5a47fae51de3c356bbb6fb95e6051891_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe" --backend --install --import-browser-data=1 --enable-stats=1 --enable-installer-stats=1 --launchopera=1 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=0 --startmenushortcut=1 --desktopshortcut=1 --quicklaunchshortcut=1 --pintotaskbar=1 --server-tracking-data=server_tracking_data --initial-pid=1420 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\Opera Installer\opera_package_20260628232618" --session-guid=da9a3e47-a645-488e-90d6-c6a172455629 --server-tracking-blob=OTU5YmMyMjNjNDdkYjdmMmVjNDQyMzA1ZWQzM2UzZTg5MTI2MmViNWNlYjBlZjMwMTdmNzU0NDVjY2IwM2Y0NTp7ImNvdW50cnkiOiJVUyIsImh0dHBfcmVmZXJyZXIiOiJodHRwczovL3d3dy5vcGVyYS5jb20vY29tcHV0ZXIvdGhhbmtzP25pPXN0YWJsZSZvcz13aW5kb3dzIiwiaW5zdGFsbGVyX25hbWUiOiJPcGVyYVNldHVwLmV4ZSIsInByb2R1Y3QiOiJvcGVyYSIsInF1ZXJ5IjoiL29wZXJhL3N0YWJsZS93aW5kb3dzP2h0dHBfcmVmZXJyZXI9aHR0cHM6Ly9zdXBlcmJpei5zZS5wbC90ZWNobm9sb2dpZS9kb2JyZS1wcm9ncmFteS1vcGVyYS0xMTEwLXphLWRhcm1vLWRvLXBvYnJhbmlhLWRvd25sb2FkLW9wZXJhLTExMTAtYWEtWGNaeS1xOWlULVg5WkEuaHRtbCZ1dG1fc291cmNlPXN1cGVyYml6LnNlLnBsX3ZpYV9vcGVyYV9jb20mdXRtX21lZGl1bT1yb2MmdXRtX2NhbXBhaWduPShyZWZlcnJhbClfdmlhX29wZXJhX2NvbV9odHRwcyZ1dG1fY29udGVudD0vdGVjaG5vbG9naWUvZG9icmUtcHJvZ3JhbXktb3BlcmEtMTExMC16YS1kYXJtby1kby1wb2JyYW5pYS1kb3dubG9hZC1vcGVyYS0xMTEwLWFhLVhjWnktcTlpVC1YOVpBLmh0bWwmdXRtX2xhc3RwYWdlPW9wZXJhLmNvbS9kb3dubG9hZCZ1dG1fdHJ5YWdhaW49eWVzIiwidGltZXN0YW1wIjoiMTU0NzAxNDE3Ni4yODEzIiwidXNlcmFnZW50IjoiTW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzY1LjAuMzMyNS4xODEgU2FmYXJpLzUzNy4zNiIsInV0bSI6eyJjYW1wYWlnbiI6IihyZWZlcnJhbClfdmlhX29wZXJhX2NvbV9odHRwcyIsImNvbnRlbnQiOiIvdGVjaG5vbG9naWUvZG9icmUtcHJvZ3JhbXktb3BlcmEtMTExMC16YS1kYXJtby1kby1wb2JyYW5pYS1kb3dubG9hZC1vcGVyYS0xMTEwLWFhLVhjWnktcTlpVC1YOVpBLmh0bWwiLCJsYXN0cGFnZSI6Im9wZXJhLmNvbS9kb3dubG9hZCIsIm1lZGl1bSI6InJvYyIsInNvdXJjZSI6InN1cGVyYml6LnNlLnBsX3ZpYV9vcGVyYV9jb20iLCJ0cnlhZ2FpbiI6InllcyJ9LCJ1dWlkIjoiOGYwYjcyZDMtYmFiNi00MDM0LWFmMzYtYjFlN2M4ODAxMzA1In0= --wait-for-package --initial-proc-handle=DC09000000000000
  2⤵
  - Loads dropped DLL
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3704
- - C:\Users\Admin\AppData\Local\Temp\2026-06-28_5a47fae51de3c356bbb6fb95e6051891_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
    C:\Users\Admin\AppData\Local\Temp\2026-06-28_5a47fae51de3c356bbb6fb95e6051891_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=57.0.3098.110 --initial-client-data=0x2a4,0x2b8,0x2bc,0x2b0,0x2c0,0x71fcd5e0,0x71fcd5f0,0x71fcd5fc
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:2848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.opera.com/download/get/?partner=www&opsys=Windows&utm_source=netinstaller
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5184
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f4,0x2f8,0x2fc,0x2f0,0x31c,0x7ffabad8c188,0x7ffabad8c194,0x7ffabad8c1a0
    3⤵
    PID:4568
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1800,i,4444257325492061946,13793641236500387895,524288 --field-trial-handle=2820,i,2905748933193984084,974850858951112212,262144 --variations-seed-version --mojo-platform-channel-handle=2848 /prefetch:11
    3⤵
    - Downloads MZ/PE file
    - System Time Discovery
    PID:1308
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2400,i,2918468247792385399,10298700074590443755,524288 --field-trial-handle=2820,i,2905748933193984084,974850858951112212,262144 --variations-seed-version --mojo-platform-channel-handle=2984 /prefetch:13
    3⤵
    PID:4804
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1648,i,14435810839966913807,11902332235679797293,262144 --field-trial-handle=2820,i,2905748933193984084,974850858951112212,262144 --variations-seed-version --mojo-platform-channel-handle=2816 /prefetch:2
    3⤵
    PID:436
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3604,i,10990823309492493271,1283599980780412879,2097152 --field-trial-handle=2820,i,2905748933193984084,974850858951112212,262144 --variations-seed-version --mojo-platform-channel-handle=3660 /prefetch:1
    3⤵
    PID:3216
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3608,i,829746772108761882,1598641657031702077,2097152 --field-trial-handle=2820,i,2905748933193984084,974850858951112212,262144 --variations-seed-version --mojo-platform-channel-handle=3680 /prefetch:1
    3⤵
    PID:4752
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4320,i,519196919432584892,3990783212659303432,2097152 --field-trial-handle=2820,i,2905748933193984084,974850858951112212,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:1
    3⤵
    PID:1144
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4300,i,1092304884869176807,15445638698518759593,2097152 --field-trial-handle=2820,i,2905748933193984084,974850858951112212,262144 --variations-seed-version --mojo-platform-channel-handle=4328 /prefetch:9
    3⤵
    PID:5732
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5456,i,11435657094864678924,8748103564614471487,524288 --field-trial-handle=2820,i,2905748933193984084,974850858951112212,262144 --variations-seed-version --mojo-platform-channel-handle=4688 /prefetch:14
    3⤵
    PID:5512
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5428,i,6398427997102197124,12319986409040941548,2097152 --field-trial-handle=2820,i,2905748933193984084,974850858951112212,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:1
    3⤵
    PID:2124
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5536,i,5775084223323695259,16518088612070809705,524288 --field-trial-handle=2820,i,2905748933193984084,974850858951112212,262144 --variations-seed-version --mojo-platform-channel-handle=5520 /prefetch:14
    3⤵
    PID:2904
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5540,i,2316892208141629505,5169318408533981524,524288 --field-trial-handle=2820,i,2905748933193984084,974850858951112212,262144 --variations-seed-version --mojo-platform-channel-handle=5464 /prefetch:14
    3⤵
    PID:4636
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5920,i,4373790733346755358,5183389207865461147,524288 --field-trial-handle=2820,i,2905748933193984084,974850858951112212,262144 --variations-seed-version --mojo-platform-channel-handle=6100 /prefetch:14
    3⤵
    PID:4892
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6076,i,5445021588462644492,8305663761812152877,2097152 --field-trial-handle=2820,i,2905748933193984084,974850858951112212,262144 --variations-seed-version --mojo-platform-channel-handle=6120 /prefetch:1
    3⤵
    PID:964
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7048,i,7683624915022881001,11938237354540143820,524288 --field-trial-handle=2820,i,2905748933193984084,974850858951112212,262144 --variations-seed-version --mojo-platform-channel-handle=6416 /prefetch:14
    3⤵
    PID:5364
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7056,i,7746061662910835557,7510583153031223070,524288 --field-trial-handle=2820,i,2905748933193984084,974850858951112212,262144 --variations-seed-version --mojo-platform-channel-handle=7404 /prefetch:14
    3⤵
    PID:4288
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7056,i,7746061662910835557,7510583153031223070,524288 --field-trial-handle=2820,i,2905748933193984084,974850858951112212,262144 --variations-seed-version --mojo-platform-channel-handle=7404 /prefetch:14
    3⤵
    PID:3408
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4388,i,6612801061688148089,18310576110350851403,524288 --field-trial-handle=2820,i,2905748933193984084,974850858951112212,262144 --variations-seed-version --mojo-platform-channel-handle=4348 /prefetch:14
    3⤵
    PID:4760

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5708

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x344,0x348,0x34c,0x340,0x3d8,0x7ffabad8c188,0x7ffabad8c194,0x7ffabad8c1a0
  2⤵
  PID:4676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1836,i,9555699579717538174,12068907511442164335,262144 --field-trial-handle=2896,i,16481569993913986907,4517272068758899591,262144 --variations-seed-version --mojo-platform-channel-handle=2892 /prefetch:2
  2⤵
  PID:2436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2056,i,8877675362183756531,12034380446769258545,524288 --field-trial-handle=2896,i,16481569993913986907,4517272068758899591,262144 --variations-seed-version --mojo-platform-channel-handle=3020 /prefetch:11
  2⤵
  - System Time Discovery
  PID:1860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2396,i,13354525764234648448,9907135373789574265,524288 --field-trial-handle=2896,i,16481569993913986907,4517272068758899591,262144 --variations-seed-version --mojo-platform-channel-handle=3080 /prefetch:13
  2⤵
  PID:1512
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4524,i,5569942521286200683,1142039737381363869,524288 --field-trial-handle=2896,i,16481569993913986907,4517272068758899591,262144 --variations-seed-version --mojo-platform-channel-handle=4560 /prefetch:14
  2⤵
  PID:3204
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4524,i,5569942521286200683,1142039737381363869,524288 --field-trial-handle=2896,i,16481569993913986907,4517272068758899591,262144 --variations-seed-version --mojo-platform-channel-handle=4560 /prefetch:14
  2⤵
  PID:1812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4888,i,3909675531376701228,5877458228708193101,524288 --field-trial-handle=2896,i,16481569993913986907,4517272068758899591,262144 --variations-seed-version --mojo-platform-channel-handle=4996 /prefetch:14
  2⤵
  PID:2636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4972,i,9301955236564838714,10884272857400699623,524288 --field-trial-handle=2896,i,16481569993913986907,4517272068758899591,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:14
  2⤵
  PID:480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5204,i,8809428213182965485,5003683959153006840,524288 --field-trial-handle=2896,i,16481569993913986907,4517272068758899591,262144 --variations-seed-version --mojo-platform-channel-handle=5208 /prefetch:14
  2⤵
  PID:1140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4524,i,8260582729391282274,9825179298423684889,524288 --field-trial-handle=2896,i,16481569993913986907,4517272068758899591,262144 --variations-seed-version --mojo-platform-channel-handle=4620 /prefetch:14
  2⤵
  PID:5488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4608,i,8388129876225996221,15177879203576867562,524288 --field-trial-handle=2896,i,16481569993913986907,4517272068758899591,262144 --variations-seed-version --mojo-platform-channel-handle=5296 /prefetch:14
  2⤵
  PID:3020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4636,i,15932128116570588238,6337627497601581667,524288 --field-trial-handle=2896,i,16481569993913986907,4517272068758899591,262144 --variations-seed-version --mojo-platform-channel-handle=5308 /prefetch:14
  2⤵
  PID:5876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3340,i,16430085592586378260,9583639150467425106,524288 --field-trial-handle=2896,i,16481569993913986907,4517272068758899591,262144 --variations-seed-version --mojo-platform-channel-handle=5336 /prefetch:14
  2⤵
  PID:1968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5272,i,11444194412860460740,15626243441431755295,524288 --field-trial-handle=2896,i,16481569993913986907,4517272068758899591,262144 --variations-seed-version --mojo-platform-channel-handle=4524 /prefetch:14
  2⤵
  PID:5496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5060,i,17240880451158987078,8588999129450685814,524288 --field-trial-handle=2896,i,16481569993913986907,4517272068758899591,262144 --variations-seed-version --mojo-platform-channel-handle=5052 /prefetch:14
  2⤵
  PID:5488

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:124

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2859fe4a-c839-4493-a967-c33d9c0acc2b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\2859fe4a-c839-4493-a967-c33d9c0acc2b.tmp
Size 38KB
SHA256 161aeada903c958805dca0c490f286d07605d38a7048728d2bc033724c46abb9
MD5 2b1a76b222b8ec1f5f0684973e939d8b
SHA1 1b5791f43428e7a412546a02aeaad7650e7e703f
SHA512 8c3ad029bdb643fcabaa9980c89d5fae7059b3a533c6f12cf13acc88d5270924a8d50b41d9e73401507cb3f3e59ef3662ba98b5e4207b4c4d3b55297dada9b65
SSDEEP 768:UjaeqD4MlshiLdMmQ3ZDgaff1f5yJ5p3EFlnNMLmK2yjWtTzTb:UqcjhIdMH3Tf1fep3EFlSCxyj2v
TLSH
T18E03D03A98A05C778CB696C5760B77976DB04293DB913B49DCCC7A0E40AB3DE230B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b778cc535cfe9ef8131b9d727f221c5d63c7f15bcd4cd19db345f2c97bdf5594
MD5 a4b8f3b6133ca4686118d40b6c8d4ea7
SHA1 cbca41492cec17181764c1371da84a0e0481f93f
SHA512 65135f099a2e372c9a11538ad8ff73abdfa24612895545773034b613318a9166b5560e41026d2ec245dda6b088efde1566126dae35182ddcb3fe795a786554ad
TLSH
T1B7D0C0743F42F108C04904F08534EF101337B81230839900F070C80E84E40C0A3C9053
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b4edbbe62f29386512f6cd1726c675b23fdeee21a26a2896a394ff9b87143167
MD5 c0060c375421fc206e85d98fc2ea6677
SHA1 2189b0dd881564dfef39585cc2cffda4dcd3ec91
SHA512 338dc8a4791fbbe759582d4a8fd55c1a6245fcc722bff11ff926118daa91041d62e98b05cb2e63b22ea119d41a557c511dcfb12592ab416dab9980af0b5ca713
TLSH
T1F2D0C0703F42F008C04904F08534EF101337B81230839900F170C80E84E40C0A3C8043
MD5 SHA1 SHA512 TLSH

Submit Download

0a3c4481-b34b-4875-9e08-4a8ddf17a61c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\0a3c4481-b34b-4875-9e08-4a8ddf17a61c.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 66785bbf77aeef376df04b10a72a094e35c1819f6bb05c34d243c88ffbb8c0f6
MD5 61e0de0f3ea09b9384995de0397147ac
SHA1 7c67f3029d18d3a81b688a6f104778a2e6286595
SHA512 4a9a8f2581809f9705fb655b0e568e6befaebd3f59f7979c22e253ddfb7fdf4deb65d3ef1c982b60c864af132fe2aad17988d9cbf99dc9fc2ab3df63d6e00de5
SSDEEP 384:ylzUmecG9XZLRoUNUI90HsxCh72N7A8zZK19:yloncIRoUD9QsxCaKL
TLSH
T1A013073EB2B16C26DAC2453D9A0F5A72377DC3BAC9E45393473E75307B513A2A80E158
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 aeffac7f99c077293852a553e9e75bb83b2e3159c4c4324666ab9810ac8a8c9b
MD5 254ad81b52af0af198a6ca241b619433
SHA1 45b6d6cdb7fb856d0f1cc5de467ed89c12cd0fb4
SHA512 9f603bc216fc7fa1cae70c393d8d3f4964e1cc538a43fdf4c1df0fa797799013c6a186cfd65edec4e8eaec3d2c1cb783a3d30a776128bd677f83b50f5b67489d
SSDEEP 1536:/xhL/QVL/w1zL81aAgykdzmN+yMBTlZ1LBg3NzTP/PZ+GL/BL/9L/tN5:/xhL/QL/YnQN2qL/BL/9L/tN5
TLSH
T1DC446FF74951A01ACFA842F5E2133A3DE17B464D7CD1F8E9E2384C912925F32B6BDA44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 2dfa1f2ff39a020d8b713568a525cebf4f29eaf9f3ee4ae0515d817c9682d816
MD5 8da0444f835031a77ef243c9f6fa915e
SHA1 dac4b4d7e0c11f5ba2305e10895237fad55ac88c
SHA512 15c663d3ecebd2f5cb23ddc1515bb05b9052df86d434bdfb59944f388bf1b64a7fd941b68967d0a23a96eeab7a17747f80720ddcb577f36fac864139a4842af0
TLSH
T173710BEB45B209BCEB6CE5BA14CA24D53BB3DD82024F6F15409412F47A4D3C038838A4
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log
Size 285B
SHA256 fff9c841af450dfefe7f284f645d4a26b048e6bd5709ad766b308172bc260a53
MD5 785c71b68bf89a0e9973e06d76434ab1
SHA1 2eb96ed892a724f5f223fe37abbd075d448d45e3
SHA512 a84d94a4b22d325a41b84c193a2e279bc3969085d87eda3fad0dc1032989bd26e67aba7cefa085838590e5aef8958c40e22a000d158fd80782b614dcdbc55030
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 322B
SHA256 3b3daee417722364f72c79f9b6231c714673f185108feda0dc44cb475049daee
MD5 959856a6c576b4f86d5be9befdf06ee4
SHA1 63f87e53ac7af44bbf54aeec8f14d20b323cf966
SHA512 3a6b18d79af9e39a1cfa93972be0660b70ac5c9578357fbb7987ca77a5943e3c663c25d4b99d197c4cc9c5dab7a3dcd19fbf309f8d3950900dbd0540e8c9a365
TLSH
T13AE0260554C8C329A51468E7C678530D9AD0348BB2CBB987170ACC407243B4AF3C7AD0
MD5 SHA1 SHA512 TLSH

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons
Size 20KB
SHA256 94c411a43c001b727da3ea1fa28a6a39e1952587545db8974318ffdafde9a817
MD5 e266dae42a4bc56575b61a16c5be33e1
SHA1 004cc8e0a03040febd226c2cacbf02ee5326f2ff
SHA512 a5b63df35a05213df9e537d2840f37797116ff87e285ec935d5cb44da22bc67d9c4a64c259d7caff5b744c8c300e88eb0d1b22a998ce6c068e24e83efa5b8001
SSDEEP 96:6BCxRNipNP3nOm3phBDVfOsdXMF7Qsn2N1gbN8JnOmD:waRMpR3nrphXXad2TgbSJnX
TLSH
T1F1929397CE347823EF115B7A612F20B9CA3B932D1E91EDD873A554219CB060391764BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 224KB
SHA256 fb89352bd19a7fae4eef3510b6d08290cbf9b19fd1a5e980a6c18a2b66f9b324
MD5 cc4e861792e78c350b40dd349ea1a46c
SHA1 0a6db06d131753dbcaea66ab48b9d243247ba4a1
SHA512 3fb75b21940e108e942e36d0316a8e41e3b06f1fa9c12cf5263896152eb44bd76cfceab9c9ee03e53c0fd1acdbdabac938a4d15a9d21c292bdfa2ffa8006dda3
SSDEEP 192:3paE9qzUO2bqH+bF+UI3iWGVoWN3qL/V3+hJXVVV63:yIkUI3ijVoWN3qL/KA
TLSH
T1AE24315F5F202721CD7D927668EB44A36C6DF03F8B5366DA6C611474CEE2642A02C8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 334B
SHA256 6f0f80d1ef21905b31d332683607d3c307686a212539a6a1c6585e7cbc33aacb
MD5 aa540b7b60c83575f59a5354b5e87dcc
SHA1 d5d9bb00b424f30cf3b90a5c2f68e7b32de66b5b
SHA512 3afe8e59efd0bb02f8eed1b4bbcab10feace105a5898bf64ae0565d80f4780ed9fcd10a68c71335631603ebf1082c43f84debdf6457cabc71669563cb90e4043
TLSH
T13FE0D8A295DED32A6144305BC2146708E7F0341FD6CBAA465B049895B987504E3C15D6
MD5 SHA1 SHA512 TLSH

Submit Download

75c75750-67c5-4721-86f6-1c6ed64fd7e2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\75c75750-67c5-4721-86f6-1c6ed64fd7e2.tmp
Size 1KB
SHA256 3a76192a52c68df233bc839e230bc4a115b1d6702c17bd85cecffe3b2d5fe4b2
MD5 b0b2de032db9001ae58f0f014a5b14a7
SHA1 a2c1d293d7b15656d86a1de9252c7526f1c457cd
SHA512 45f38484780a05768476e9362c75e0b154e5149b1d974905b81f4046fad74daadec1f781ced3a2a353127856641452b87c6c4426492dbd3b9676246221937f99
TLSH
T1AB41AFF3C7E8866D890156F4BB143E2BCE1D0954832C3D5AC9E4AF5F93E2871D14099E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 f490d35100c4039ba36bf0608c7c3f8686bb409b39c1a4e6f1435f6b0e57bd68
MD5 d7347c8723348f73bdeebc81f23f637a
SHA1 300d4faa20dab4a762809acde1de5d768f322017
SHA512 77005b6c21893e78793b9085b00061e45cdcdf0611d298c8cbf75dfbd893240c9ce1f853bdd236654a859bd45a9e8d6cbc30ded6fbe1971d31e565877b9aa803
SSDEEP 192:sxR0Rcls/fZszXHcGqkzoA8pXyE/g6+WN1h1S/2t+tMAXYM8YuqdGFIgViJ:sxR0Qs/fZsbHfKH/5o/nMqKQ
TLSH
T14942C9566928A97B9CCBD21DBB55BF23D2F95032B1D45E48B6FC870C04E76DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 526cece6d200fdc8608aefa2c315597aeff1afde34c5b0d253a047650f31f646
MD5 1b4328229d33c158d2717b193226bd40
SHA1 c1d5a1de31ccd7185bd0ff1d48b84b61b0fd4422
SHA512 fa575c09782091bbbe4e6ea68922869103c70ff02c2dc06b61b7654a57844de5a37e026b4928ae993bedf6e74ff667568db87f31db09235ee273607a60ec5b2d
SSDEEP 192:sxR0Rcls/fZs7fJZLXMzoA8pXyE/g6+WN1h1S/2t+tMAX7M8YuqwGFIgVWJ:sxR0Qs/fZs7fHJH/5o/nXqdo
TLSH
T13742C8566D28993B9CCBD219BB55BF63D2F95032B1D05E48B6FC860C05EB6DD220380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 f70196dcdb96f0d9ae6453af8bf77a623831076124c5adb03cd766cc3626a862
MD5 92b169c4b39a44b9fb4bf8f3129dce36
SHA1 def4d1b6a2ce4d2a8fe4287ea02a0274b663a5fa
SHA512 a8d25b8fc63a18eb928cc027bd1487db55e76738c8ad9426a6c5461e6065dcac4f62a09d9aceb2d5f7f6cd32da4b96dd9ca76be9e573a5f05939c7e1b2df3393
SSDEEP 192:sxRXRcls/fZswpJZLXMzoA8pXyE/g6+WN1h1S/2t+tMAX7MYYuqwGFIgvWJ:sxRXQs/fZswpHJH/5o/nVqd6
TLSH
T10342D8576928993B9CCBD219BB55BF23D2F95032A1D45E48B7FC8B0C05EB6DD220380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 25d40f1bf989ec269f89c17abe5fe9ae19c7392c94a6229cb5b29cd7a81397d7
MD5 23b945595aa34d1f06ea8c1c6d393a7a
SHA1 9265af0ccc0a4f89604222ccea761f0731d5dbfa
SHA512 a8d55c981c75de1e6d243a15ee7409e75d3a58ea882bd7bd8f1015c292283b65482aa2d84fd2427d3282fe9d2d1abd7fec04508cd7d94e0f2ef7508fde46ad49
SSDEEP 192:sxRXRcls/fZswfJZLXMzoA8pXyE/g6+WN1h1S/2t+tMAX7M8YuqwGFIgVWJ:sxRXQs/fZswfHJH/5o/nXqdo
TLSH
T1D942C8566938993B9CCBD219BB55BF63D2F95032B1D05E48B6FC8A0C05EB6DD220380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 8cfe737b502a723c998501ec3f8d47b0d944db4c559a2defe973baaf98bcf86d
MD5 3e7e6ec64ea519509419a94087e512d3
SHA1 840dd5b1aa7362e85ed7fac8c01957e3d9653993
SHA512 5f85dc66d2ed860bbac92f57bcb172ecc9a3617f3385956b46a123f7906cde579777b04cedf7fad8e62ac0622a62021a0389a5168ffd6adca71089e95a531e2f
SSDEEP 768:jnWuaA7pLuL7m7WgNVf338F1+UoAYDCx9Tuqh0VfUC9xbog/OVxBJYkronqS:jnWuaME7m7WgNVf33u1jamHYvnqS
TLSH
T1FDC2CB7B640CCB7E4F804ADDE8197A9A6DA802CB9698CD8047FDD51C02C6BEF511A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 338B
SHA256 d83f5317efe7610dc6e651fbacbc11b957509e794015f46d98b40e8d4aa46e07
MD5 da3bf74e13199eb857ec6bee83f5469d
SHA1 e85e672c7732bab85aaed3e6fdf084037b4ebcb6
SHA512 7bf8ed4feeb7d4dbd2f418df60a8868d12b5180b6353c0a9be8f9a65878d4a3d35356ff78e4a99c6b58538b5b4fcdf2e13514df93984dad565d54da3db754e9b
TLSH
T16EE0266095C9D37EB11524838734830CBBE4B81BD6CABD462F04D850B683E05F2D3992
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 350B
SHA256 4afb8158079171aecbcc1d0af1bc2570d41ff2101c86686d4e18c49973ef35cf
MD5 fe24bdb008c3ffacd4b9e5460aeb937c
SHA1 aca6d3eed747f4dd92daa649ea58c6da288581ce
SHA512 03d052a6c9afaf36c433bf5a0e93c6e0b332383cae718043a02b2ab961cb74a67be8dfd39c8f8bc69f30909951eabadc1b6f850e303aa9718bd2b9752324d580
TLSH
T169E0D83066C9C32A714D20878224E34CA1F3F407D6CAB9652F08A5407347A80BB83551
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\000003.log
Size 175B
SHA256 80d1388b9a7150eb0291175fe693dd7b6bce910c3e4fff51e94841d31d771dbe
MD5 cb63c64828a27af7253afb7c7d986654
SHA1 8a54aeb86f79cc69e6f11278d874cebd328ae466
SHA512 e0dbdd6931c9272e0b52bb2ef7895121f6324379f584899343342a057737a9837cc476842ea781a1de5c17a20c06e0a7d24c0ed6ea41fdd95bb99296e8810f9a
TLSH
T135C09BD55F903023FDCA5D3D0DAB53041720C4752F74CF57D28430901C0A285FF61145
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 326B
SHA256 68fb9831addb556fe3be4521dfd65e292d241fd7a34a7119ab536703f31f7111
MD5 cfc0101b373c55c5bdb4622596fbcf8c
SHA1 12d2fa677439821ec7b34bc2630acfe583a4ea09
SHA512 b3b36659696328f6d131579d2c7787bad4bae6dace17eada56d411b7e232a15cfb874da0a0bc5ee1cd648583f68c694902e0ea990fb55d8b343e69b9c2aee3a6
TLSH
T112E0D8B095D4C77D61017087C6A4A70CAAE0781B93C6B989570864407642601B3E5DD1
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 e657a84384a6f5c548c9ba68010ae494cb9ad7526086664d4134efdb00cbcfbd
MD5 4080722a6d78b948b8a54c385fbd0fb9
SHA1 9914997e069d3b8315538abc228b84697e448c76
SHA512 6d67fd9fa727e55bd10bebb7124bfa3979acca5c9158079eec494859c6ee33cdd5394acd4c0f6c59c22c0d208397ccf3d2467e54503a2bf2742896a273fade39
SSDEEP 48:KsmIvKvaMTyxqIPKjCwXpI1KCAQ3y1FINKOQ44:KsmQKvaqiqsKjCYpyKCACeFOKOQP
TLSH
T129B12006307F2300397F2A0D8599A56E568270B7719BA47B7BA920E11F27E019FFDDC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 3KB
SHA256 76f9d9074986f2883b2df4bb2854a054bd4bff6b83d116dffa7af4ec48dc7091
MD5 55ea662de93a79edfdc6afed0dc44e9d
SHA1 e4ebf2e09c692e59664ae0adadf8ef9368779848
SHA512 4efabe8d243a1b1786972f25657e9b8910f0b64fecd24f0bcb2101b4389d1556e341fbd1471ca08526c9af7a15a3f3fd88fb861fbd7ffe3e4082341682693970
TLSH
T1665130D7D66002A2DB22AA7E147A7B8AC32BFC9F4D01ABECC3A530485430276D951607
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 319B
SHA256 dbedeab0ccba666848004efcab4865a4784ac81e93c5198be4d3cbd46d6deba0
MD5 c76e3818bdd843b0ed3327e1a4eb5433
SHA1 a9c6fa450b06a8d58b190a38ffbef97a2f40e382
SHA512 e78c1568da1e5c2e3dee84e5f62e0832b966b1626502fe5ebb5c47e29b15a0a70b35fb92cdde0dc0c133673ba92a3798fb3c1cac3ce65b1addd25ca6348c2fb7
TLSH
T1C2E02051F5C4C35E7156309F4114474892C13407EACBE9C91F04C844B543B41F3E6551
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 2cde53fc0f87bdf623c979fccd43074790f1fa6ccbe29214b256ed014d1f1c66
MD5 ec032810ccf44d77a2cef4cc78308e2d
SHA1 efe87acd74fffdaf94a79020f3dcfbf799b4341d
SHA512 12afbc19dc4404c693632a3578ad8b59d163e2ae4c5df53c5c7e62329d350aab3aaf3ca05bfbe915aec28baee01b27233441771b18f650d2575b3e14b2430520
TLSH
T1A121D256F330C108E15A827AA47F9B351738E8028FBCDC0F85B924346EB1B040D4B6E4
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 337B
SHA256 cb5dda4c6f7a4626af00a8ca05f78f5fd7be64c3ea6f8b90b084bfc6c02cb5fa
MD5 253926fbdf961b0b6ce5a27f21fdc5c1
SHA1 70804e3442a79b23adcf2056b5bd3d671944d651
SHA512 25603d3bbfe6927e3891367e0b6d017a8870be090bdb0ffcf64c6258c33e143efdccbf2ac963d64e7230136f2ec75023ac78321e41aff73d46bf9db3389064db
TLSH
T120E0D890B4C4C36F6152209B4164874892D13807FEC67FC51F008C486683642F786651
MD5 SHA1 SHA512 TLSH

Submit Download

a557eb2d-14a3-4287-83f7-9d12a9cdd0cb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\a557eb2d-14a3-4287-83f7-9d12a9cdd0cb.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 c20dffa95f50facbfe861158f81b2dbdc7aee288893ed38aeaf072f1e535572b
MD5 e6dbad488b5d6edbf898f2c7ea7074ab
SHA1 a8e7f3a69a1466cdc1653f89a3d16c5d822fcbac
SHA512 a5fb2ba30b63dc3dec607f0de3f065378c6af8fb7cca73ed7046cefbead5d9b7f38a89637db305a5184e2a066d3ffd386c6446be5b8d48fb096171f1d80a637e
SSDEEP 768:Bj+9c3d/mgaff1fOfyyJ5p3EFlnNMLmt2hAXyhVpn12bfZ2l:c9c3Of1fOf3p3EFlSCEhay/zyZ2l
TLSH
T1F503BE39DCA04D7B4C9AA784364B2757ACA48273D3A42658CACC2F0E81F77DC730B916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 401e9133800feb77c4764fc9c8ad4b3e98b94cc01dc88d51aee0e0de1eed5138
MD5 9bd61db01c799b32a179db93de768e24
SHA1 d0a1089db61169597fbe20716baa7875d4c0e239
SHA512 61ee7d3e915783a702515d5749920f397b7e2c1bf35ce9d1334ceb305ee3d03d18e4b9dbcb87c90ee2cc523ddb15f9c16008ca7dd68abf94da5ed0bf0d3c9491
SSDEEP 768:Gj+9c3k/mgaff1fOfCfrIyJ5p3EFlnNMLmtIzn12bfZ2l:V9c3Jf1fOfCfVp3EFlSCCByZ2l
TLSH
T166F2BF31A8A05D639DD6CB85B64B778BAEE44263D7C42A58C8D86F0E41C77DD230782B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 65KB
SHA256 4bbb5191e2289efdca4001355180ffe86738ea7a8c9fb41745744a398b24e47a
MD5 26dad9b6d820a6a14e73d4ff102ffdd1
SHA1 72c16a8431b48a0a8bc04f2b3ff06a1a3f53f94b
SHA512 2be608a7f39bf37ea437f72056b6ed80eadb8a791a035fe541271f238312509b930f4e902cee260c906d39e7bdc8e0e825dd822991265f7b87cd17a37aa7032c
SSDEEP 1536:L9c3sp3EFlSCbN7yM66FLPsMA4wKCZhay/hyZ2l:LMsREnLbpolVhaAYZ2l
TLSH
T1DA637CF988D38A7AD89D9B87137D6E4658BCC173B1582588F7D81E0CCDA62BFD306811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 189c5886e49de6661f3b5042a23d2745817088da6995003220b4139629a1e5a2
MD5 e171ff13232a93887afab03e22b3586b
SHA1 02b96bb77cdad80fcd8c14636244b72299a4ce6c
SHA512 814381f982397856153d3eb80f4b57301e9cc405ed8b104c8ab4f9af0e72ad4878ddab5f9109d0d98f55811c6483dd379cfe2a8ab5de5b108172fdd83a203cde
SSDEEP 768:3jaeqD4MlshiLdMm63/gmgaff1fOfFyJ5p3EFlnNMLmOgyjWtTsTE:3qcjhIdMV3vf1fOfyp3EFlSCjyj2r
TLSH
T1EC13C035A8B09C678DB6E685765777D7ADB006A3CA813E59DCC86B0E00973DE230F817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 c004dc0024614ea0c8ea74ccccfaab6a4b4af88c0d55a7b04f367c477f55631c
MD5 612bc2bddb8ac232d7f6851f28570424
SHA1 6889044efa0ccbb896858796abf0e42b144c3fd4
SHA512 4b6b96136520c510f6e9e49fac5c6e435c15ab91513bb3073607711e9c32ce1f1b7a6ec3d7f3da70efd7a2688950f4eb3798278b38757ca2f1977291f4d18d7c
SSDEEP 768:9j+9c3d/mgaff1fOfCfrIyJ5p3EFlnNMLmtIzn12bfZ2l:49c3Of1fOfCfVp3EFlSCCByZ2l
TLSH
T112F2BF31A8A01D639D96DF85B64B778BAEE44263D3C42A58C8D86F0E41D77DD230782B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 3dc9043838386f5363ac96a01477cf3163b5118b80191576a11b32ce9894314c
MD5 cdddc745a8c954dc438c931889999bdb
SHA1 7908f975b6815460caa2bc3438efbd8fc8d36211
SHA512 3d2d4852aa2ac6cb0b9b6cbca9f04366afd48d362d869be877ef324c16d72ff119b5842891baa2b6b99df2de2db8d3be5c23f0f97f8943bd74195996bcb66a0a
TLSH
T159A02407C473C00FF4144051C45C034114F4C047011DD0115070D33714D40CF03F5C35
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

dd823ca4-1a7c-437b-bb31-5b3d88236ada.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\dd823ca4-1a7c-437b-bb31-5b3d88236ada.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

7a034a99-0045-4370-9230-4946e4d462f2.tmp

Path C:\Users\Admin\AppData\Local\Temp\7a034a99-0045-4370-9230-4946e4d462f2.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-06-28_5a47fae51de3c356bbb6fb95e6051891_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe

Path C:\Users\Admin\AppData\Local\Temp\Opera Installer\2026-06-28_5a47fae51de3c356bbb6fb95e6051891_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
Size 3.2MB
SHA256 b36a2baa72dd52cada3a676f654dd04ae98b8c366139fb36eb6267e4c5ffa90c
MD5 5a47fae51de3c356bbb6fb95e6051891
SHA1 d2fcdff01bf300c081b80e636f4a9918ade914dd
SHA512 242382a97a28d52570bd2fd269b185ebaa22bea90b2d7071ff0e22e4f4fa065530bc8149d13a65c9f5ca4f308ea8a088bd650a64923a06bd299ef2550ab9c89d
SSDEEP 49152:M36fZMj9ZmMKwQUJ821Nt6nyCnJtFpgtSOYoCTtQPsg9IgY1K4W1REZ1C1YXRTqJ:M36fZ290BPWjEZ1cyi
TLSH
T19DF5590262F95138F2FB2B70B93C56690EBA7E426F39C5DF8344185C0E746E099B5B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_sfx.exe

Path C:\Users\Admin\AppData\Local\Temp\Opera Installer\opera_package_202606282326181\assistant\_sfx.exe
Size 2.8MB
SHA256 71a4cc628fd1716fd994689c4808d2ebbc00e8bd2ecb7600b9921baa8916c752
MD5 3b028b1188ac321e66add16f8ebadbec
SHA1 086bcb2b1c0d300be15c1390841aadadcec4eac7
SHA512 17c390e0df8e29ff9ad43e581db298ada2d8378fbb890dc5f4b17df8fbe21134f99ab203ea4752a419215d289c128a1d8bc14721bde80042e5bb4c3901dffb72
SSDEEP 49152:+kinoIZOrzV7AlDfo7eT/uAtH00raHx774jx4aGhcr0glyGIGE1HVyVNW272DS/Z:+kiocQzV89Tmeradk2ha0gdIT11yVQ2w
TLSH
T167D5233275A48C34D62312321CE0FAEDA5BE72701E6347DB73A42B1F9EB01979A1D562
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

assistant_installer.exe

Path C:\Users\Admin\AppData\Local\Temp\Opera Installer\opera_package_202606282326181\assistant\assistant_installer.exe
Size 2.4MB
SHA256 63187b388e01fb05d8c29957e1c566324af67aff2f7a2e3da9132248c79375a8
MD5 b0408fa2a406f483e42c3ac102d35e9b
SHA1 fbaca900ad54abc65ec2cb34d63727c87132d16b
SHA512 2e8b9af626fff68ecd0204d6a3151b4518749143ec78a2f8f99f959399d1c8ea59987f99c38c9e48fe38b518fd8c91381356daf3f17944fa3432337b882e5401
SSDEEP 49152:wJv8lBbu91xwyiZSwRDzWEibQojjHLQDpizF:wR8lBbu91xwyiZSwRWEKQWjHLOpc
TLSH
T10AC5AE12A86094B5D8563132321DEB3E9A30BE1657354DDBDB90BCC1BBB86E2353734B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dbgcore.DLL

Path C:\Users\Admin\AppData\Local\Temp\Opera Installer\opera_package_202606282326181\assistant\dbgcore.DLL
Size 222KB
SHA256 7bb46348c2ec97ef9ee7a8e0ae28c8e069513e8acaee2689134a2d906b5fdecf
MD5 b26ebc5cde9b1726ee9f9534dd6107d0
SHA1 de00af3ec4de63a158bcd50c6e95b046669d3353
SHA512 2e01c65b58369c1f5f4081cf377c3fedd87ae5fca63cfbc44dd7859a1e10a849d1bbdbb592349d793166f577dbd954cd8660f625dcbc9adc4d936d6a44f062bf
SSDEEP 6144:FASh0NdOEQzFh0ekr6nzwBaQGdppLIg2dFl96Fl:4MHZn1n+P96Fl
TLSH
T14C247C2269401533DCEF12F062AF363A96AEDD90239490C359A05BDDD6D4BC12E3D6EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dbghelp.dll

Path C:\Users\Admin\AppData\Local\Temp\Opera Installer\opera_package_202606282326181\assistant\dbghelp.dll
Size 1.8MB
SHA256 6fd2b4bfc275ed306ce09008ff8437818b3373e69e4b3db3cbb79be91b2b9308
MD5 021b11c0fc1a09e49a2046ef07d1747a
SHA1 4b955c1e7150db4f07528929fc529fde9738a2b3
SHA512 6ca94fdf2b92928859152aa23f31df46944eeeac7988f6bb5d647341843d8d2aa91c2c810d17c8b58a03c99e4ca7d7e1ae6b6c2d9ea5029616d870b89794d6c8
SSDEEP 49152:xEDlXSohR86M5NKBlv/2yOFVnzM9F0KM7:uFhR86MHyl0fb
TLSH
T128856B20E784813CE4EA1177E67C7A7D85ADE524073440CBAAC45BA978297D32F387DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Opera_installer_2606282226174931420.dll

Path C:\Users\Admin\AppData\Local\Temp\Opera_installer_2606282226174931420.dll
Size 2.5MB
SHA256 a2a53fa56e8b04fdca9d3e8ac996db83c32aa0b980fb771182ce8ceaed23a742
MD5 70d5427bbfbc113dd7d5088ad63dce60
SHA1 abe64915a9b582b7fa7fd5e51c40175d33f21f4f
SHA512 c70f0c0f64ae818f395828ed88792290ac74511cb4ac5805580626d73ce3dbb34b011ffe8f281c3d35dddcd301aa43832433053048e686e506977817e64cb547
SSDEEP 49152:kj9ZmMKwQUJ821Nt6nyCnJtFpgtSOYoCTtQPsg9IgY1K4W1REZ1C1YXRTqy/t:+90BPWjEZ1cy
TLSH
T1D7C57C0262E55038F1FB2B70A93CA7294E797E026F39C9DF93841C5C1E746E0997672B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5524_772090885\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports\settings.dat
Size 40B
SHA256 4ee3023e0969cac13a800b449ef9fc8d424877d5c6f63092c4f0ef388e22d1c1
MD5 20b86823efcd6aa0f0c65b679a4f74ee
SHA1 94e72fa701dddd5b53b34ba27378de183f411883
SHA512 76df59a2278399ce4e83c3bacbc24af755b2c4795018c3c36704406065231c112c0805d687b9e1ebdc109f4fe41ec61ef6670d02aa031c2fbbfe0baeb25c301d
MD5 SHA1 SHA512

Submit Download

memory/1100-4-0x0000000000700000-0x0000000000A3E000-memory.dmp

Download

memory/1420-0-0x0000000000700000-0x0000000000A3E000-memory.dmp

Download

memory/2848-71-0x0000000000700000-0x0000000000A3E000-memory.dmp

Download

memory/3704-67-0x0000000000700000-0x0000000000A3E000-memory.dmp

Download

memory/4308-13-0x0000000000930000-0x0000000000C6E000-memory.dmp

Download