af2cc010c1af53936c588a3d451daabfd7452001a6a3c0caa2c368f6d3dd33ee

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260630-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260630-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/07/2026, 10:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-06_b9b5f3175171224d07a6d5b3f6cfe78f_amadey_elex_loda_rhadamanthys_smoke-loader.exe
Size 2.3MB
Sample260706-l626qahv8k
SHA256 af2cc010c1af53936c588a3d451daabfd7452001a6a3c0caa2c368f6d3dd33ee
MD5 b9b5f3175171224d07a6d5b3f6cfe78f
SHA1 c29ac55936e9be833c48cf02b63f0d8a9bfedbc0
SHA512 8e933340628b6bd9fed911432b90becd5976ab74688c3d943f65eb8a826a96a4e73c645735f9ae3a68fd41058bdcf5a27c9f0274f34565d02d921c5da3f4c5cf
SSDEEP 49152:YtrqOMudxX6O8H0okebyif8jzNKsn/lONXKl2:WWOBdxX6yZeb8XzMXg
TLSH
T125B5AF92F245ACE9E80325B59C7DCA2124477E7D4AB9560E358F722995B338330B7E0F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5708	CCC1.tmp

Loads dropped DLL 1 IoCs

pid	Process
5780	msedge.exe

Drops file in Windows directory 7 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5780_70049775\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5780_70049775\typosquatting_list.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5780_1462552098\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5780_1462552098\well_known_domains.dll	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5780_1850764036\data.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5780_1850764036\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-06_b9b5f3175171224d07a6d5b3f6cfe78f_amadey_elex_loda_rhadamanthys_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CCC1.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
5708	CCC1.tmp

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3568	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134278061825258580"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1749168396-1890032557-311772428-1000\{4284F3C2-328C-4973-B67F-2AC400206361}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5368	msedge.exe
5368	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
5780	msedge.exe
5780	msedge.exe
5780	msedge.exe
5780	msedge.exe
5780	msedge.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
5708	CCC1.tmp

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5780	msedge.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 5524 wrote to memory of 5708	5524	2026-07-06_b9b5f3175171224d07a6d5b3f6cfe78f_amadey_elex_loda_rhadamanthys_smoke-loader.exe	89
PID 5708 wrote to memory of 5780	5708	CCC1.tmp	90
PID 5780 wrote to memory of 2976	5780	msedge.exe	91
PID 5780 wrote to memory of 564	5780	msedge.exe	92
PID 5780 wrote to memory of 3568	5780	msedge.exe	93
PID 5780 wrote to memory of 564	5780	msedge.exe	92
PID 5780 wrote to memory of 564	5780	msedge.exe	92
PID 5780 wrote to memory of 6360	5780	msedge.exe	95
PID 5780 wrote to memory of 6360	5780	msedge.exe	95
PID 5780 wrote to memory of 6576	5780	msedge.exe	96
PID 5780 wrote to memory of 6576	5780	msedge.exe	96
PID 5780 wrote to memory of 6576	5780	msedge.exe	96
PID 5780 wrote to memory of 7040	5780	msedge.exe	97
PID 5780 wrote to memory of 7040	5780	msedge.exe	97
PID 5780 wrote to memory of 7040	5780	msedge.exe	97
PID 5780 wrote to memory of 1940	5780	msedge.exe	98
PID 5780 wrote to memory of 1940	5780	msedge.exe	98
PID 5780 wrote to memory of 1940	5780	msedge.exe	98
PID 5780 wrote to memory of 5456	5780	msedge.exe	99
PID 5780 wrote to memory of 5456	5780	msedge.exe	99
PID 5780 wrote to memory of 5456	5780	msedge.exe	99
PID 5780 wrote to memory of 4480	5780	msedge.exe	100
PID 5780 wrote to memory of 4464	5780	msedge.exe	101
PID 5780 wrote to memory of 4480	5780	msedge.exe	100
PID 5780 wrote to memory of 4464	5780	msedge.exe	101
PID 5780 wrote to memory of 2576	5780	msedge.exe	103
PID 5780 wrote to memory of 3116	5780	msedge.exe	107
PID 5780 wrote to memory of 6868	5780	msedge.exe	108
PID 5780 wrote to memory of 6988	5780	msedge.exe	109
PID 5780 wrote to memory of 5948	5780	msedge.exe	110
PID 5780 wrote to memory of 5948	5780	msedge.exe	110
PID 5780 wrote to memory of 4492	5780	msedge.exe	113
PID 5780 wrote to memory of 4492	5780	msedge.exe	113
PID 5780 wrote to memory of 6828	5780	msedge.exe	114
PID 5780 wrote to memory of 6828	5780	msedge.exe	114
PID 5780 wrote to memory of 5368	5780	msedge.exe	115
PID 5780 wrote to memory of 4460	5780	msedge.exe	116
PID 5780 wrote to memory of 4460	5780	msedge.exe	116

C:\Users\Admin\AppData\Local\Temp\2026-07-06_b9b5f3175171224d07a6d5b3f6cfe78f_amadey_elex_loda_rhadamanthys_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-06_b9b5f3175171224d07a6d5b3f6cfe78f_amadey_elex_loda_rhadamanthys_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5524
- C:\Users\Admin\AppData\Local\Temp\CCC1.tmp
  "C:\Users\Admin\AppData\Local\Temp\CCC1.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-07-06_b9b5f3175171224d07a6d5b3f6cfe78f_amadey_elex_loda_rhadamanthys_smoke-loader.exe 13E8EB47402C51A17555F37BB34549B7F1A97A0863799C0193C30FB1819B2E27DD6D50ADD50643BC67B1E61A2C6F7D24B948B114D8D01618AC2FF96C07E6B0BA
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:5708
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\2026-07-06_b9b5f3175171224d07a6d5b3f6cfe78f_amadey_elex_loda_rhadamanthys_smoke-loader.pdf
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5780
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x318,0x7ff9ae8ec188,0x7ff9ae8ec194,0x7ff9ae8ec1a0
      4⤵
      PID:2976
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1684,i,15441156919019432477,2777566894818510104,262144 --field-trial-handle=2320,i,3113105248371395052,2518981670217786497,262144 --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:2
      4⤵
      PID:564
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1896,i,4277603972381353021,4029979543230786826,524288 --field-trial-handle=2320,i,3113105248371395052,2518981670217786497,262144 --variations-seed-version --mojo-platform-channel-handle=2384 /prefetch:11
      4⤵
      System Time Discovery
      PID:3568
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2548,i,10008300185897430875,11775251159229310179,524288 --field-trial-handle=2320,i,3113105248371395052,2518981670217786497,262144 --variations-seed-version --mojo-platform-channel-handle=3140 /prefetch:13
      4⤵
      PID:6360
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3564,i,9014314483264734779,2182627965950385672,2097152 --field-trial-handle=2320,i,3113105248371395052,2518981670217786497,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:1
      4⤵
      PID:6576
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3568,i,4872964767535837381,5771087881096138051,2097152 --field-trial-handle=2320,i,3113105248371395052,2518981670217786497,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:1
      4⤵
      PID:7040
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --init-isolate-as-foreground --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=5056,i,5259983204621641832,9471003914613163133,2097152 --field-trial-handle=2320,i,3113105248371395052,2518981670217786497,262144 --variations-seed-version --mojo-platform-channel-handle=4424 /prefetch:9
      4⤵
      PID:1940
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --renderer-sub-type=pdf-renderer --pdf-renderer --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags="--ms-user-locale= --jitless" --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=5320,i,10059034872597076339,11400563366929872786,2097152 --field-trial-handle=2320,i,3113105248371395052,2518981670217786497,262144 --variations-seed-version --mojo-platform-channel-handle=5332 /prefetch:15
      4⤵
      PID:5456
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5540,i,10862527641923826889,8665340350789388597,524288 --field-trial-handle=2320,i,3113105248371395052,2518981670217786497,262144 --variations-seed-version --mojo-platform-channel-handle=5584 /prefetch:14
      4⤵
      PID:4480
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5548,i,10374330531577579261,4861030824788100344,524288 --field-trial-handle=2320,i,3113105248371395052,2518981670217786497,262144 --variations-seed-version --mojo-platform-channel-handle=5604 /prefetch:14
      4⤵
      PID:4464
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6296,i,12719692638846435127,127460587211785825,524288 --field-trial-handle=2320,i,3113105248371395052,2518981670217786497,262144 --variations-seed-version --mojo-platform-channel-handle=6308 /prefetch:14
      4⤵
      PID:1264
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6296,i,12719692638846435127,127460587211785825,524288 --field-trial-handle=2320,i,3113105248371395052,2518981670217786497,262144 --variations-seed-version --mojo-platform-channel-handle=6308 /prefetch:14
      4⤵
      PID:2576
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6716,i,4279948876593076375,4969339304309395269,524288 --field-trial-handle=2320,i,3113105248371395052,2518981670217786497,262144 --variations-seed-version --mojo-platform-channel-handle=6684 /prefetch:14
      4⤵
      PID:3116
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6196,i,2456598712060056737,2758137405153378962,524288 --field-trial-handle=2320,i,3113105248371395052,2518981670217786497,262144 --variations-seed-version --mojo-platform-channel-handle=6852 /prefetch:14
      4⤵
      PID:6868
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6308,i,339653152371047795,10625174224910820351,524288 --field-trial-handle=2320,i,3113105248371395052,2518981670217786497,262144 --variations-seed-version --mojo-platform-channel-handle=6776 /prefetch:14
      4⤵
      PID:6988
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5708,i,15762854523771606392,4817814700057525967,524288 --field-trial-handle=2320,i,3113105248371395052,2518981670217786497,262144 --variations-seed-version --mojo-platform-channel-handle=5692 /prefetch:14
      4⤵
      PID:5948
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6920,i,137874734930302156,10391401783071027019,524288 --field-trial-handle=2320,i,3113105248371395052,2518981670217786497,262144 --variations-seed-version --mojo-platform-channel-handle=6280 /prefetch:14
      4⤵
      PID:4492
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=920,i,10127542719452688776,10103186958252076728,524288 --field-trial-handle=2320,i,3113105248371395052,2518981670217786497,262144 --variations-seed-version --mojo-platform-channel-handle=7028 /prefetch:14
      4⤵
      PID:6828
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6324,i,16813495396311706216,12457385552842934841,262144 --field-trial-handle=2320,i,3113105248371395052,2518981670217786497,262144 --variations-seed-version --mojo-platform-channel-handle=6912 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5368
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6240,i,10558562419087726173,6647105404106505166,524288 --field-trial-handle=2320,i,3113105248371395052,2518981670217786497,262144 --variations-seed-version --mojo-platform-channel-handle=5664 /prefetch:14
      4⤵
      PID:4460

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4188

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2908

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 aebb6c70ab7a24d554d6f6ac0f891eea8d0143d763ae26afd14158a62471d32c
MD5 4df2b013f915bbf768a35e9c1e788fe1
SHA1 5f99dfa4310596930be8e393c0de83bb374a10f7
SHA512 5285653806cab96614917acfa4a3f6992cd581c9ad8eb14808de784b888ecfebb44f82a0a32c756a63c062605216d2535eed0d53eb14c4498ab3ae12d2d005b5
TLSH
T148D080E077697941C32534F274158740F7555471646BCA41B0D4D10C8D7555AA7C6257
MD5 SHA1 SHA512 TLSH

Submit Download

2de8508e-4fe1-404c-b76b-384ac95e41aa.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2de8508e-4fe1-404c-b76b-384ac95e41aa.tmp
Size 414B
SHA256 1f8243265e796d2f2651ad963ab087b79c12afab83da4e18b391ff88c8eda21c
MD5 e038104cb30f853d4fb4c17d93d811bd
SHA1 fd60f18b9de22295125c43e8f69d0bb409d9e4e0
SHA512 80a02ea233087329d60395883bcea2f3da0ceeeb470966e0ea39af14d3eb10d17a1e1de9cb90f04c3b5a5aab52eae358823b9066867a21e71295bab997049157
TLSH
T1D6E02BAAC921AC2708FC6B6C70954641E650132627508D4F3A3D810CCFB2B7B426682C
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 a95c14956efe20f5699495e36b6d5640fc313ce4d8685c83fd55142fd680eebb
MD5 cc6a343006ff605df07ea0e6b99603a5
SHA1 2dff965540569ac496ea0952c4fc2a00b9a1c9ac
SHA512 1a5d813a47e9e94fea928eb914354562ef5c470641eb623aafa2303434f8a49a5dd424ecd4657e2412bb1b6e8da3d46f887f4d497ca28cd0338b5d70cad2a610
TLSH
T1316119523FEE1AB2EB7A047672D257887570F1E60D4F6F5102BCA07BC835389EB59480
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

81e7550b-491e-415a-8c1d-24d51edb46b7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\81e7550b-491e-415a-8c1d-24d51edb46b7.tmp
Size 2KB
SHA256 7cc856269a3eeb671f87bd8560a36d7456506481b10a567c71031469ed27f211
MD5 f02ecc858b89422f27897001aaceeefb
SHA1 a4bb2fbcdf50071e48f969b7eec00b0a15eae2d2
SHA512 2ad384e256a60ec112112960a77ee51f8c45b08f0cfe68b8b01cc66d5644aa77a93079bf8b8c64f63e571b02aa0a66b71e8caeaee6784c4f5945881f94f82131
TLSH
T19E41BFF783E4856ECA1196F0AA186E2BCE1C0915832C7D5AC9E0AF1B93E3471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 3cffddcd7e3c61286d48b70ce2e6b384d238e0d0824c35089e139b33b146db4a
MD5 b509b2bf3de049d3ddb24b33a8116241
SHA1 0871d00485445133775abfd841f05bced57c62d4
SHA512 2cbc8e579d946320c65e7e55fa7c56075d95d3eba4f56deae561a30898c526f1fef6b17f35fabe4c0dcd2f6a089de3af5aa8492988a0f058f0cb1fa19909df84
SSDEEP 192:sxRjRByMqZjK1Ml8wcN/fjVs8jBpstZKOOZDDzoA8pev/g6+WNIYAPOwGhDTfy+F:sxRj6CN/fJs8jfsDeZG0/5IjOBfyje
TLSH
T18B72D8166934997B8CDBD218FA457F53D7F81133A2905E44AAFC8A0C05E7AEC221383F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 ab73c873b28e524ff257fc8fe0b8bba66965cbbcbfda33067e56ae1ee40fe2ba
MD5 92df07be91e83e13c6537bf45381990c
SHA1 877aa3bb76057dcd5d4c714fb79c12e05f4f6331
SHA512 ef3aa61c8e499f2d281c01bbad216c61885ed19c82c1c184d5d2c2f4b934635669037f46bc7ed854b30d42676425ff77084ac3d704b6a22f9dcaac432bbe2846
SSDEEP 192:sxRjRByMqZjK1Ml8UQAcN/fjVsljBpZtZKOOZDDzoA8pev/g6+WNIYAaOwGhDTfO:sxRj6q/N/fJsljfZDeZG0/5I+OBfyjr
TLSH
T1ED72D8166934997B8CDBD218FA857F53D6F81573A1905E44AAFC8B0C05E7AEC221383F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 6d326c84cf1961b2504ee54c17ffdcfa37ebc4d71c549a916602c2e31349b4ce
MD5 be24b92ef203ad097c89e78c2a79726a
SHA1 533480ba51e86de29a2e9b739bb45b3e0dee0503
SHA512 eb879b1a67a991829e5b466edd3b88fd7e22dc1815bfff937db87e479b79aaef9ab5f6918c5b75246cedd5e3b6d5ac14592f25a00e695ff978d872b5b7b18eed
SSDEEP 768:DckYJT7pLuL7glWg1NfgB8F1+UoAYDCx9Tuqh0VfUC9xbog/OVbSVhHgurop/jq:DckYJFE7glWg1NfgBu1jaASVdglpu
TLSH
T131E2EB7B680CCB7F4F804A9CEC297D9A6DA801CF96D8C95447FA840C03C67EB551A5EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 eaf8163c55ac6da2ccdc57911d6983b3ac185d45075617618ad8d983c0717e71
MD5 fbb2b2c38cd913afcffc71f5f4a2cdbb
SHA1 ae4d5acba70877c71e35c2393207b1bf823d5216
SHA512 81526ecca130ec1ec88e44e41e67a19a1546b03eae224eefb03f07b48d26d09ea28997d5e3c49a80941d546dc8b9b2f70e63b371e086e55a90b15c6f45de0910
SSDEEP 192:E61PhSGGXWL8MMLOi70MjSEJB3BPorbu/drtBZnZd/x9/oNJ/9q:E+PKFT3JoPuVr/ZZdJR
TLSH
T1A1B20511763A32C1387D390881A4942F52C23563321AE96B7BBC64EA4F66E41DFFD9C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 a34369d8ded6527bc1251f9f8825ae1e39bdcfb54ba57828cde48cda2b4802b4
MD5 31cf1f384b56e2d3fa94489bf061d259
SHA1 2a93d3210f20d27106d77799baddadbfa31878af
SHA512 a866a9dbf4e578be507956252432541b49bf91f0ab1f3b10652a4d99b48090a48775c96c939731c5d393836a8af552f334ab0f4848a24e5f16be25890df0b1e3
SSDEEP 384:nniF1tNn/s3n9Sy8N58TUNTUlIR/B1iiEvZsttfUGVk+pbGgaC4fmn15wbAjEji3:iF1j+9XgwgI15GVKC4fmn12bfc
TLSH
T14DC23932EC94DEA7ADE68FC9B70A7646EEE001A395D85ED4D9D90D4D01D32DD030BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 d8d11999014e0ab8514b22bd5f0023ab2d484007ec35f9b62416dc274bcfdfeb
MD5 51e3353e8c9b5d156ea26597cdcfaf5c
SHA1 60f2d4aea857b7ba23bbb233d67b82dc14f35c12
SHA512 e9b13a9b7952697c00022b83cb8cbf475d3675ea922996ce2084302137c8ec85cf202f8cd8c3bafeecac8f9a836de605bfc9cd691d66e0baa5fba932d5b79225
SSDEEP 384:nMiF1tNn/s3n9Sz8N28TUNTUlIRlB1HQSvsttfUGVk+pbGgaCC4+FFqOObjI9G6H:3F1j+9urwgH1/GVKCC4eFq29MC
TLSH
T1C3D25B32EC95CEB7ADE68BD9B34A3A46DEE401A385885EC4D9C95E4C01C71DD130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 c01770d22120fbf60bd441711548acc0adf97ad6f322e944315ec2405ab33c5c
MD5 260d65a684cb137ebd80704fe94cd852
SHA1 70ac1b6b93a1c1c3309d32aab90ef3e45062bd70
SHA512 7804ba057a4c3012c8602ca3cde531156b689ff1c0c6804de7c4e2531945f42ae0719fd2a601fcb6536fd8c2381603d2ae6a94e63ff3f5bd96c3a7d2034b79eb
SSDEEP 384:nqiF1tNn/s3n9Sb8N28TUNTUlIRlB1HQSvsttfUGVk+pbGgaCC4+FJqOObjI9G6H:hF1j+9+rwgH1/GVKCC4eJq29MC
TLSH
T1E5D25B32EC95CEB7ADE68BD9B74A3A46DEE401A385885EC4D9C95E4C01C71DD130BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 a1522b3b1e05469b6d69927e854f7f264e3899706899612a82b0a80fd0d548a4
MD5 029bd0f30a0ecec07ce3ae1d82abdb35
SHA1 65e3021df7fb981dbc54201aa6c8b9027f475122
SHA512 9fb796ae2a87874f33bea2b821f3e85c6d6f2e93768ea0257d19e065940e6e1ee36a4b6aac27336df554127ee38858213cf1fda01856cbcd1d563128c42008fb
SSDEEP 384:nniF1tNn/s3n9Sz8N28TUNTUlIRlB1HxSvsttfUGVk+pbGgaCC4+FFqOObjI9G6H:iF1j+9urwgH8/GVKCC4eFq29MC
TLSH
T10ED25B32EC95CEA7ADE68BD9B34A3A46DEE401A385C89EC4D9C95E4C01C71DD130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

well_known_domains.dll

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Well Known Domains\1.2.0.0\well_known_domains.dll
Size 572KB
SHA256 2778063e5ded354d852004e80492edb3a0f731b838bb27ba3a233bc937592f6e
MD5 f5f5b37fd514776f455864502c852773
SHA1 8d5ed434173fd77feb33cb6cb0fad5e2388d97c6
SHA512 b0931f1cae171190e6ec8880f4d560cc7b3d5bffe1db11525bd133eaf51e2e0b3c920ea194d6c7577f95e7b4b4380f7845c82eb2898ad1f5c35d4550f93a14b6
SSDEEP 6144:XbBXgDO9CyiiKPFv3GPkDNiTHoIDiXkCBIvzVXCfwX5pWr+W1gUe3h576:XbBQDwi5FvGPkDNirYBIvzVXCoXWiWr
TLSH
T130C49E02B7D846A8D07AD0748A574642EA76BC950F74A6DF02E0B27D2F77BE45B3E310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 4d5670932f3ce5ef24a5a2b09688aa01d9e29aa9dbf38a41657475c6a0dd32ff
MD5 a9a750236f34f93d46d6737207470c32
SHA1 429dab153b8d2e9f41601d9408658ef738ab55d7
SHA512 99efdd60d7d53ff11ac891d7ded487a71defa60ea81344da0c2ea358ea1ef91edfaccf320aa0f5cc1737f40751cf56f43b16807ca381fc227d9b52829a132c45
TLSH
T1813161E0993C4AD1D0BD497FB09B34EC94ECD626F494343D2888E9A8972EB0D258043F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 c44ec296e261fa8f541a38d2ebf2a2e93253384d1ad11b71f8a3ddc1f93c02cf
MD5 035eb15b0e4438df625176d0f35894fa
SHA1 7ec7e0c2f17dcb4b128e105b7c2bdc4673eb3f50
SHA512 fb8a6447076bda689cd6051dc094c09520e730fd4673ce5a36de3e61d6b41025f25cf320f7a247c5f9e7f922689bec3d1df29da93083e2a30f076c19b533569b
TLSH
T184315EE099380AC2C4BD4DBFB09B25FC94E89622F49434392898EC68962DA0D258083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 21d9d488a28b0c8d6f072390823c8770b5f8c0157c9d2e45efe1661309105220
MD5 4e01209cc3781bc42a12705bea7b7e9f
SHA1 b8a34df8ab7743f724b044949010483bcc7874e1
SHA512 100c7cf709ba1e2e437a5ebbfdb971b05ff9717dbcbd7a7573e648ca9e639db6752ee594340a1bb028bd0c020d140d58e9b3c691ea8c9ee8e69a94c75df03dd6
TLSH
T1F33142E09D381ED1C4BD4D6FF49B25FC94D8D622F494343D2898F8A5962DA09658083F
MD5 SHA1 SHA512 TLSH

Submit Download

2026-07-06_b9b5f3175171224d07a6d5b3f6cfe78f_amadey_elex_loda_rhadamanthys_smoke-loader.pdf

Path C:\Users\Admin\AppData\Local\Temp\2026-07-06_b9b5f3175171224d07a6d5b3f6cfe78f_amadey_elex_loda_rhadamanthys_smoke-loader.pdf
Size 79KB
SHA256 5cdd2389735c189adc9da595f138d3c86f39098cb09e79c9690a9f27652f839f
MD5 f85927360cab91ea9612682b7d0548a1
SHA1 2b17068ad3f0f968efd876428b8bf0923857b712
SHA512 80b0315d7603b7efa65b50b8f04a18edce9629f415d8c4bd2c678c5075da6caf2c68233728b7a6d4ab447e1ab321ed6866c1c07bcddb57959f4fc524be279501
SSDEEP 1536:uAakttWK/7ZBUq1LHYl4n3qJibwiXYKO9szkEutO+2+Xm7:ucttXDzUqVak52CzhutO+27
TLSH
T1B383F2390F637AEDD99025C13B213C0AFF4DF5F97AC9120ACAEC505324A8F65999B84D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CCC1.tmp

Path C:\Users\Admin\AppData\Local\Temp\CCC1.tmp
Size 2.3MB
SHA256 054b7f875ebbe31bc444d783648b9a97b23ff4f79371729eb7dd5d9339394186
MD5 8ddd71b0431673f696704c2db8a908cb
SHA1 78fac40f2be4d6d9512a8ccaa580c4eb77c12755
SHA512 7bb8aa0f2f74431e59af3c6615cf151123847ef055365a6f64930abcebf1650b4196da5b58d719c08fc2f7c84a01871f4b5a83e6257aef85caea4ab4af5a684b
SSDEEP 49152:YtrqOMudxX6qXBzbQBeCAi08DPcYsRz/Kl2:WWOBdxX6QzyLZlA7z/g
TLSH
T131B5AF92F245ACE9E80715B59C7DCA2124077E7D4AB9560E358F772A85B338230B7E0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download