0fc9e7f70e46b63ad5c664f211218340aadf8f5692c0a22d7fea809cc04431ca

Analysis

max time kernel
148s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/07/2026, 04:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-08_198c083eabd97cf92ab4ee964aec9dcf_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
Size 3.2MB
Sample260708-fl4k6abt2x
SHA256 0fc9e7f70e46b63ad5c664f211218340aadf8f5692c0a22d7fea809cc04431ca
MD5 198c083eabd97cf92ab4ee964aec9dcf
SHA1 c284bd69707577b7f120802928de70877cd1ae6c
SHA512 e8ed40e633329e311d962b6761390d2546e83c0ca39ef2adac85c9f40eba5a8e71b7ee6a7cbd880515a8eda51a7933b689511cd36def75413ead5584c4933e40
SSDEEP 49152:m34fZW7pR+wt7drl4nDSr0lGDuCZxBJCSGHq1pgG3nmmWZGDSW+SuhnikcBFA5Vs:m34fZUpZt7dmmOcDA5VSZ
TLSH
T17BF55A0266FE6134F2FB2B30A83C56690EBA7E526F39C5DF9744185C0D706E099B1B27
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery persistence ransomware spyware stealer

Malware Config

Signatures

Detects executables containing base64 encoded User Agent 1 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c4d1-12.dat	INDICATOR_SUSPICIOUS_EXE_B64_Encoded_UserAgent

Downloads MZ/PE file 1 IoCs

flow	pid	Process
109	864	msedge.exe

Executes dropped EXE 4 IoCs

pid	Process
5204	2026-07-08_198c083eabd97cf92ab4ee964aec9dcf_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
5560	_sfx.exe
5536	assistant_installer.exe
6092	assistant_installer.exe

Loads dropped DLL 9 IoCs

pid	Process
4908	2026-07-08_198c083eabd97cf92ab4ee964aec9dcf_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
1020	2026-07-08_198c083eabd97cf92ab4ee964aec9dcf_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
5204	2026-07-08_198c083eabd97cf92ab4ee964aec9dcf_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
5536	assistant_installer.exe
5536	assistant_installer.exe
6092	assistant_installer.exe
6092	assistant_installer.exe
2928	2026-07-08_198c083eabd97cf92ab4ee964aec9dcf_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
2556	2026-07-08_198c083eabd97cf92ab4ee964aec9dcf_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 4 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	2026-07-08_198c083eabd97cf92ab4ee964aec9dcf_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened (read-only)	\??\F:	2026-07-08_198c083eabd97cf92ab4ee964aec9dcf_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened (read-only)	\??\E:	2026-07-08_198c083eabd97cf92ab4ee964aec9dcf_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened (read-only)	\??\F:	2026-07-08_198c083eabd97cf92ab4ee964aec9dcf_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-08_198c083eabd97cf92ab4ee964aec9dcf_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-08_198c083eabd97cf92ab4ee964aec9dcf_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-08_198c083eabd97cf92ab4ee964aec9dcf_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	assistant_installer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	assistant_installer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-08_198c083eabd97cf92ab4ee964aec9dcf_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-08_198c083eabd97cf92ab4ee964aec9dcf_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	_sfx.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
864	msedge.exe

Enumerates system info in registry 2 TTPs 5 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	assistant_installer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	assistant_installer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134279603457722727"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-515251955-468707340-1782030364-1000\{84D54777-E0E1-49F6-BD36-711E4DFB0AE6}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1140	msedge.exe
1140	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
6052	msedge.exe
6052	msedge.exe
6052	msedge.exe
6052	msedge.exe
6052	msedge.exe
6052	msedge.exe
6052	msedge.exe

Suspicious use of FindShellTrayWindow 11 IoCs

pid	Process
6052	msedge.exe
6052	msedge.exe
6052	msedge.exe
6052	msedge.exe
6052	msedge.exe
6052	msedge.exe
6052	msedge.exe
6052	msedge.exe
6052	msedge.exe
6052	msedge.exe
6052	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4908	2026-07-08_198c083eabd97cf92ab4ee964aec9dcf_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe

Suspicious use of WriteProcessMemory 53 IoCs

description	pid	Process	procid_target
PID 4908 wrote to memory of 1020	4908	2026-07-08_198c083eabd97cf92ab4ee964aec9dcf_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe	88
PID 4908 wrote to memory of 5204	4908	2026-07-08_198c083eabd97cf92ab4ee964aec9dcf_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe	89
PID 4908 wrote to memory of 5560	4908	2026-07-08_198c083eabd97cf92ab4ee964aec9dcf_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe	90
PID 4908 wrote to memory of 5536	4908	2026-07-08_198c083eabd97cf92ab4ee964aec9dcf_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe	91
PID 5536 wrote to memory of 6092	5536	assistant_installer.exe	92
PID 4908 wrote to memory of 2928	4908	2026-07-08_198c083eabd97cf92ab4ee964aec9dcf_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe	93
PID 4908 wrote to memory of 6052	4908	2026-07-08_198c083eabd97cf92ab4ee964aec9dcf_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe	94
PID 2928 wrote to memory of 2556	2928	2026-07-08_198c083eabd97cf92ab4ee964aec9dcf_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe	95
PID 6052 wrote to memory of 252	6052	msedge.exe	96
PID 6052 wrote to memory of 864	6052	msedge.exe	97
PID 6052 wrote to memory of 5716	6052	msedge.exe	98
PID 6052 wrote to memory of 5716	6052	msedge.exe	98
PID 6052 wrote to memory of 5716	6052	msedge.exe	98
PID 6052 wrote to memory of 1096	6052	msedge.exe	99
PID 6052 wrote to memory of 1096	6052	msedge.exe	99
PID 6052 wrote to memory of 2540	6052	msedge.exe	101
PID 6052 wrote to memory of 4988	6052	msedge.exe	102
PID 6052 wrote to memory of 2540	6052	msedge.exe	101
PID 6052 wrote to memory of 2540	6052	msedge.exe	101
PID 6052 wrote to memory of 4988	6052	msedge.exe	102
PID 6052 wrote to memory of 4988	6052	msedge.exe	102
PID 6052 wrote to memory of 1280	6052	msedge.exe	103
PID 6052 wrote to memory of 1280	6052	msedge.exe	103
PID 6052 wrote to memory of 1280	6052	msedge.exe	103
PID 6052 wrote to memory of 852	6052	msedge.exe	104
PID 6052 wrote to memory of 852	6052	msedge.exe	104
PID 6052 wrote to memory of 852	6052	msedge.exe	104
PID 6052 wrote to memory of 3296	6052	msedge.exe	105
PID 6052 wrote to memory of 3296	6052	msedge.exe	105
PID 6052 wrote to memory of 564	6052	msedge.exe	107
PID 6052 wrote to memory of 564	6052	msedge.exe	107
PID 6052 wrote to memory of 1852	6052	msedge.exe	108
PID 6052 wrote to memory of 1852	6052	msedge.exe	108
PID 6052 wrote to memory of 5876	6052	msedge.exe	110
PID 6052 wrote to memory of 4476	6052	msedge.exe	113
PID 6052 wrote to memory of 4476	6052	msedge.exe	113
PID 6052 wrote to memory of 936	6052	msedge.exe	114
PID 6052 wrote to memory of 936	6052	msedge.exe	114
PID 6052 wrote to memory of 1264	6052	msedge.exe	116
PID 6052 wrote to memory of 1264	6052	msedge.exe	116
PID 6052 wrote to memory of 1264	6052	msedge.exe	116
PID 6052 wrote to memory of 5404	6052	msedge.exe	117
PID 6052 wrote to memory of 1560	6052	msedge.exe	118
PID 6052 wrote to memory of 5404	6052	msedge.exe	117
PID 6052 wrote to memory of 1560	6052	msedge.exe	118
PID 6052 wrote to memory of 1560	6052	msedge.exe	118
PID 6052 wrote to memory of 5228	6052	msedge.exe	119
PID 6052 wrote to memory of 2656	6052	msedge.exe	120
PID 6052 wrote to memory of 2224	6052	msedge.exe	121
PID 6052 wrote to memory of 4516	6052	msedge.exe	122
PID 6052 wrote to memory of 2064	6052	msedge.exe	123
PID 6052 wrote to memory of 2064	6052	msedge.exe	123
PID 6052 wrote to memory of 1140	6052	msedge.exe	127

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-07-08_198c083eabd97cf92ab4ee964aec9dcf_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-08_198c083eabd97cf92ab4ee964aec9dcf_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe"
1⤵
- Loads dropped DLL
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4908
- C:\Users\Admin\AppData\Local\Temp\2026-07-08_198c083eabd97cf92ab4ee964aec9dcf_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
  C:\Users\Admin\AppData\Local\Temp\2026-07-08_198c083eabd97cf92ab4ee964aec9dcf_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=57.0.3098.76 --initial-client-data=0x2b0,0x2c0,0x2c4,0x2bc,0x2c8,0x752b75a0,0x752b75b0,0x752b75bc
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1020
- C:\Users\Admin\AppData\Local\Temp\Opera Installer\2026-07-08_198c083eabd97cf92ab4ee964aec9dcf_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
  "C:\Users\Admin\AppData\Local\Temp\Opera Installer\2026-07-08_198c083eabd97cf92ab4ee964aec9dcf_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe" --version
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:5204
- C:\Users\Admin\AppData\Local\Temp\Opera Installer\opera_package_202607080558391\assistant\_sfx.exe
  "C:\Users\Admin\AppData\Local\Temp\Opera Installer\opera_package_202607080558391\assistant\_sfx.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5560
- C:\Users\Admin\AppData\Local\Temp\Opera Installer\opera_package_202607080558391\assistant\assistant_installer.exe
  "C:\Users\Admin\AppData\Local\Temp\Opera Installer\opera_package_202607080558391\assistant\assistant_installer.exe" --version
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Enumerates system info in registry
  - Suspicious use of WriteProcessMemory
  PID:5536
- - C:\Users\Admin\AppData\Local\Temp\Opera Installer\opera_package_202607080558391\assistant\assistant_installer.exe
    "C:\Users\Admin\AppData\Local\Temp\Opera Installer\opera_package_202607080558391\assistant\assistant_installer.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=130.0.5847.41 --initial-client-data=0x24c,0x250,0x254,0x228,0x258,0x1004040,0x100404c,0x1004058
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:6092
- C:\Users\Admin\AppData\Local\Temp\2026-07-08_198c083eabd97cf92ab4ee964aec9dcf_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-07-08_198c083eabd97cf92ab4ee964aec9dcf_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe" --backend --install --import-browser-data=1 --enable-stats=1 --enable-installer-stats=1 --launchopera=1 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --startmenushortcut=1 --desktopshortcut=1 --quicklaunchshortcut=1 --pintotaskbar=1 --server-tracking-data=server_tracking_data --initial-pid=4908 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\Opera Installer\opera_package_20260708055839" --session-guid=5eb87381-d9af-412e-b4fc-1b71db64a951 --server-tracking-blob="ZDk1OTBmZGQ0NGMyOWEzYjQ2NDU4ZjRlODAyYTk2MDlhYTc0MTYwZjQ3MjliYWUwZGM2YmE1NmI0YTlkMGY2OTp7ImNvdW50cnkiOiJCUiIsImh0dHBfcmVmZXJyZXIiOiJodHRwczovL3d3dy5vcGVyYS5jb20vcHQtYnIvY29tcHV0ZXIvdGhhbmtzP25pPXN0YWJsZSZvcz13aW5kb3dzIiwiaW5zdGFsbGVyX25hbWUiOiJPcGVyYVNldHVwLmV4ZSIsInByb2R1Y3QiOiJvcGVyYSIsInF1ZXJ5IjoiL29wZXJhL3N0YWJsZS93aW5kb3dzP2h0dHBfcmVmZXJyZXI9aHR0cHM6Ly93d3cuZ29vZ2xlLmNvbS5ici8mdXRtX3NvdXJjZT1nb29nbGVfdmlhX29wZXJhX2NvbSZ1dG1fbWVkaXVtPW9zZSZ1dG1fY2FtcGFpZ249Z29vZ2xlX29zZV92aWFfb3BlcmFfY29tX2h0dHBzJnV0bV9sYXN0cGFnZT1vcGVyYS5jb20vJmRsX3Rva2VuPTcxNzI5ODczIiwidGltZXN0YW1wIjoiMTU0NDE5MzYxNy45NTgwIiwidXNlcmFnZW50IjoiTW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzcwLjAuMzUzOC4xMTAgU2FmYXJpLzUzNy4zNiIsInV0bSI6eyJjYW1wYWlnbiI6Imdvb2dsZV9vc2VfdmlhX29wZXJhX2NvbV9odHRwcyIsImxhc3RwYWdlIjoib3BlcmEuY29tLyIsIm1lZGl1bSI6Im9zZSIsInNvdXJjZSI6Imdvb2dsZV92aWFfb3BlcmFfY29tIn0sInV1aWQiOiI5YjU1ZjA5YS0zMjhlLTRlZjktYmIzNS1mZWNlNDMwYmFmODUifQ== " --wait-for-package --initial-proc-handle=7409000000000000
  2⤵
  - Loads dropped DLL
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2928
- - C:\Users\Admin\AppData\Local\Temp\2026-07-08_198c083eabd97cf92ab4ee964aec9dcf_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
    C:\Users\Admin\AppData\Local\Temp\2026-07-08_198c083eabd97cf92ab4ee964aec9dcf_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=57.0.3098.76 --initial-client-data=0x2a0,0x2bc,0x2c8,0x2ac,0x2cc,0x71eb75a0,0x71eb75b0,0x71eb75bc
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:2556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.opera.com/download/get/?partner=www&opsys=Windows&utm_source=netinstaller
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:6052
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x318,0x7fffc07dc188,0x7fffc07dc194,0x7fffc07dc1a0
    3⤵
    PID:252
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1856,i,14340556253579281715,17890403293442877183,524288 --field-trial-handle=2536,i,10848257784819395745,1625165234018481504,262144 --variations-seed-version --mojo-platform-channel-handle=2564 /prefetch:11
    3⤵
    - Downloads MZ/PE file
    - System Time Discovery
    PID:864
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1592,i,10296699004646616761,16162464282296379214,262144 --field-trial-handle=2536,i,10848257784819395745,1625165234018481504,262144 --variations-seed-version --mojo-platform-channel-handle=2532 /prefetch:2
    3⤵
    PID:5716
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2348,i,281981279548049500,18228565868308448468,524288 --field-trial-handle=2536,i,10848257784819395745,1625165234018481504,262144 --variations-seed-version --mojo-platform-channel-handle=2576 /prefetch:13
    3⤵
    PID:1096
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3540,i,12653803976559346939,6976372217814795703,2097152 --field-trial-handle=2536,i,10848257784819395745,1625165234018481504,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:1
    3⤵
    PID:2540
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3544,i,4788660608204535976,7476726653039189595,2097152 --field-trial-handle=2536,i,10848257784819395745,1625165234018481504,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:1
    3⤵
    PID:4988
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4280,i,9127762173958153876,10468251684274111118,2097152 --field-trial-handle=2536,i,10848257784819395745,1625165234018481504,262144 --variations-seed-version --mojo-platform-channel-handle=4620 /prefetch:1
    3⤵
    PID:1280
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4304,i,9459363855441057733,3874717042006846795,2097152 --field-trial-handle=2536,i,10848257784819395745,1625165234018481504,262144 --variations-seed-version --mojo-platform-channel-handle=4944 /prefetch:9
    3⤵
    PID:852
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5328,i,13307370593369046025,7207337011556341660,524288 --field-trial-handle=2536,i,10848257784819395745,1625165234018481504,262144 --variations-seed-version --mojo-platform-channel-handle=3748 /prefetch:14
    3⤵
    PID:3296
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5420,i,18319206287685847137,11521531342782496872,524288 --field-trial-handle=2536,i,10848257784819395745,1625165234018481504,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:14
    3⤵
    PID:564
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5424,i,10244654702828442679,1185417024417601979,524288 --field-trial-handle=2536,i,10848257784819395745,1625165234018481504,262144 --variations-seed-version --mojo-platform-channel-handle=5472 /prefetch:14
    3⤵
    PID:1852
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6148,i,1400774190493043559,2792193854350951159,524288 --field-trial-handle=2536,i,10848257784819395745,1625165234018481504,262144 --variations-seed-version --mojo-platform-channel-handle=6164 /prefetch:14
    3⤵
    PID:2424
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6148,i,1400774190493043559,2792193854350951159,524288 --field-trial-handle=2536,i,10848257784819395745,1625165234018481504,262144 --variations-seed-version --mojo-platform-channel-handle=6164 /prefetch:14
    3⤵
    PID:5876
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6336,i,1365270219782005521,4002687551452828755,524288 --field-trial-handle=2536,i,10848257784819395745,1625165234018481504,262144 --variations-seed-version --mojo-platform-channel-handle=6332 /prefetch:14
    3⤵
    PID:4476
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6464,i,7357570173101569187,8817634995106616546,524288 --field-trial-handle=2536,i,10848257784819395745,1625165234018481504,262144 --variations-seed-version --mojo-platform-channel-handle=6712 /prefetch:14
    3⤵
    PID:936
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=4388,i,352932388962174153,935994433949588698,2097152 --field-trial-handle=2536,i,10848257784819395745,1625165234018481504,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:1
    3⤵
    PID:1264
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6448,i,2572641212610881873,3199571624662930627,524288 --field-trial-handle=2536,i,10848257784819395745,1625165234018481504,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:14
    3⤵
    PID:5404
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=5204,i,14699683385951363147,3617946661095426550,2097152 --field-trial-handle=2536,i,10848257784819395745,1625165234018481504,262144 --variations-seed-version --mojo-platform-channel-handle=6416 /prefetch:1
    3⤵
    PID:1560
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6908,i,16026827984910014737,7330667800727116864,524288 --field-trial-handle=2536,i,10848257784819395745,1625165234018481504,262144 --variations-seed-version --mojo-platform-channel-handle=6912 /prefetch:14
    3⤵
    PID:5228
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6880,i,12770236807779360445,6440698128956664553,524288 --field-trial-handle=2536,i,10848257784819395745,1625165234018481504,262144 --variations-seed-version --mojo-platform-channel-handle=7020 /prefetch:14
    3⤵
    PID:2656
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6916,i,6698115145384906703,14222407455463398948,524288 --field-trial-handle=2536,i,10848257784819395745,1625165234018481504,262144 --variations-seed-version --mojo-platform-channel-handle=7064 /prefetch:14
    3⤵
    PID:2224
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5396,i,15803168878388535447,6353423264892600242,524288 --field-trial-handle=2536,i,10848257784819395745,1625165234018481504,262144 --variations-seed-version --mojo-platform-channel-handle=5480 /prefetch:14
    3⤵
    PID:4516
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5380,i,6225547983845143092,3988335216597888219,524288 --field-trial-handle=2536,i,10848257784819395745,1625165234018481504,262144 --variations-seed-version --mojo-platform-channel-handle=5656 /prefetch:14
    3⤵
    PID:2064
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5924,i,149716265502059642,17735714625381277040,262144 --field-trial-handle=2536,i,10848257784819395745,1625165234018481504,262144 --variations-seed-version --mojo-platform-channel-handle=6072 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1140

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2444

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5896

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c1d0eccd9de1dbbf6cbedcb541fa52903c78d66d4d260136bc73243b056beb74
MD5 12c06f300a4b88646d6fda378a48455e
SHA1 86d58840d0666ad8999198dad1983a8cfd61fd18
SHA512 76e813720fc8cd4d829570b1b32d711d2d751540dea1fcac581dd9a5963c4e3161cffa07350cc8d5477fa02d0eb7b1c29b8ffb567f85b5a94259654ff2af3928
TLSH
T118D092A8BB40ED0ECA91287B25B59A19B6509831FC56061A8866B0E88C517831A1B0FE
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b2d903efec8d558eba6ee4ac12873ce1439014705e9d819ff4dfcffa10c4b270
MD5 d9964ad138b9b56ea7891b8576b8a6ce
SHA1 e8153c0a553b8b81a07f1bbc77037f1700b79956
SHA512 7028c8597edeb715bb44be72ae48ceb181161e73b5380897f449df22a8c2b5302f664d632f2373c4c7a712d85a4b0ca70a4a062d6af265eefcac45dd99a660f1
TLSH
T1FCD092A4BB40EC0ECA91287B25B69A19B6409831BC56061A8966B0F88C517831A1B0EE
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 23cd020e3b1a0ae394e3075df0c2bbfab9b783c0feefc3839ca483b97cc74789
MD5 a40555d31894098904187373f359cd80
SHA1 b2e1496930acc5b56aa39cea170348fe3435b34d
SHA512 eebdb8fd68c57186ff670ffd58d36601f429eb647baaa630eeec957cc83abfdb2a54b028f0991cc4de211d37bb8193bbde2bdc898c308755b3102c51999c08fd
TLSH
T1B8619447031746E9D7A6C5771CE11289B534E4A782CBDDB0A3AAA5764C3E3B4BF32530
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 5406cc4784b3a63032454617ea68c364ad8ec70025e39ac8036fbb6373da03da
MD5 b96d1b471c539a3708d361fa37d8e874
SHA1 c7082ff0676319c1839374a668be8c59f9bede3d
SHA512 3e381803515d3c585e503988787c74e2a6e90cb25155fb1d0feadd1fbe256b06d2385d329fd3c5bd569ba1548f93a47cc277dfc1a5ebd242804cf44885f1d95e
TLSH
T1D371BA47031746E9DBA6C5736CE51244B434E45682CBDEB1A3AAA1760C3E7B8BF36220
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe599958.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe599958.TMP
Size 3KB
SHA256 e202b2a4181f0bbf6817e49a106aaf5d245b228acb68bb821a5c89d072c4fac3
MD5 6c9a30a806a66bddbcf520b8d63591cf
SHA1 6f5e3e018953cfa4034b3b75ffdc45e2226bb25b
SHA512 6a5338de1af9eae6d8e02a5ded3220155dd86cb61db119a2acb1052ebd693539e23159f46195eaba48c41e507a0b703f029dbce8d0a3b7f2ed225ca8993301c0
TLSH
T14061A547031706E9D7A6C5731CE11289B434E4AB82CBDEB0A3AA95764C3E3B4BF72130
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 722198be85b0aa4ad16881f71e021b36a931b299dc8a5186709af61a7ec813de
MD5 d25e1c1036e2b046914b6436ade52218
SHA1 19809257422861a9d0b716e2acf9bc1bb6d88b7c
SHA512 0ceed6912610fc1b9b35111ec5e847c522681a6a3034ecc13803181300c377b4c7ad3e7a187bd73552ebcd6bb48509129f7a6c6cbf8c0debc913272a247f4845
TLSH
T1C6819EF7C3E9862DC91156F4A7246E1BCE5E0524832C3D6AC9D4AF1BA3E2471E241B4E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 6cf5e5f02beecd418a8a22821759fd3fff9e154453b9a8f1ae30b26e37136369
MD5 f184804f27aebabb612ae356c5c55eab
SHA1 415bbfe6d9c291d8a7929ca96abf4d3af642adbd
SHA512 320d58e95ea0f0fae58b44c4a3af40effa5a91de6ebeede6d390e6485187a08ba01560e0e94ad6e69612bd0f15d0881417d672b7928a7e379a7916153e9e19ec
SSDEEP 192:sxRH/yM/jK1Ml8wTm/fHsdkXkZuCzoA8p5ys/g6+WN1hJN/2tet8FndtzG0IgDmJ:sxRH7Fm/fHsdcauPZ/5T/O1e
TLSH
T11162E816AA345977DCDBD21DFA95BB63D6F8117292901E44AAFCCA0C01E7ADD2203C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 23753f4ea1ff0af0b9e39fd6630880ec9938a2e681bad36d6ce6ec0785af5a50
MD5 a51b1d6441ff5cb90d81c19581d4c8fb
SHA1 ac62e26c733df0b51e930b4131c06279c5ff7e72
SHA512 620f1e03a9b610b734f4c1f6d58bbe95b7e4e2305f7e0846ed5ba7be85ac49c8e09f6b8f2c265ca98a3fef5689f509a0eecdf2f4da2d3709e70bf7f4c27fb3a4
SSDEEP 192:sxRA/yM/jK1Ml8wCm/fHsDkJkZunzoA8pi/g6+WNIYnOtzG0IgtJ:sxRA58m/fHsDmauOi/5IX13
TLSH
T1A152C8156A285977CCDBD30DFA95BB53D6F81573A2901E44AAFCCA0C01E7ADD221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 9c6b5a9b3c1b39036fb899f522125c0d044626083e166845dd69fd567285db36
MD5 bac60a0c06cfec97aa53e749ff4bbf67
SHA1 da1a3773acbd45271ea300cb2023e0f9c746b52e
SHA512 0022357d68019f7abf43d17dae4bda4f0fcab56293d1f87d9a4a4f4ae5241f677be56bc5e3d4caaece96f4954628be290d4500a9f2385b0241e38043bc42c132
SSDEEP 192:sxRH/yM/jK1Ml8wTm/fHsdkXkZuCzoA8pXys/g6+WN1hJN/2tet8FndtzG0IgDmJ:sxRH5Fm/fHsdcauPP/5T/O1e
TLSH
T15762D816AA3459779CDBD21DFB95BB63D6F8116292901E44AAFCCA0C01E7ADD2203C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 35d460c580a603f1688ad6e239ba32eb374e3ef5081fca4194ef41c61790ac92
MD5 5850650949e987edc84f9d0de9c98519
SHA1 0adb06df1b8885119d7e44219d82dac9e64b0c38
SHA512 b4005bdfcbe470e13af273a3e48b2122a4961434ecde0a4d923e8cc8813e91dcc88fca13f17c35431b4b696c7df8af899d81cf76957c604b940e0ea18e350507
SSDEEP 192:sxRH/yM/jK1Ml8wCm/fHsdkJkZunzoA8pi/g6+WNIYnOtzG0IgDwJ:sxRH58m/fHsdmauOi/5IX1w
TLSH
T13C52C916AA245977CCDBD30DFA95BB53D6F81572A2901E44AAFC8A0C01E7ADD221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 38d43113d9d4e18c3e4540def6579372140cf7cc3ab8829436cbd6879de9fa73
MD5 bae7640a5c7cef130baaa6ac1f340253
SHA1 0639498e21441495d8b2d6eb7193e83ae1549f92
SHA512 b7e5b808d7c8b2ed24dd49450f8f56c40b74382a5ae1b81fb8b4e4dbfdd6d64f046420b307dcb98e5a74ad7925354265a14aa944a17794504f4b57bcd6855297
SSDEEP 768:Jl6hhs7pLuL7b2WgqcfHw8F1+UoAYDCx9Tuqh0VfUC9xbog/OVRF3Xgu5roMriB2:Jl6hhQE7b2WgqcfHwu1jaGF3QuyMrN
TLSH
T1FDE2EB3B780CCB7E4F804A9CEC297D9A6DE801CB96D8CD5447FA894C03C66EB511A5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

138aca9d-4221-4b4b-b967-1dd645a98cf4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\138aca9d-4221-4b4b-b967-1dd645a98cf4.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 3bd50c955759f37d1faf8a6cfa4ff76d0493dc78d54ffa89bff3099e78215057
MD5 11f17da4390f65185e442a1ba3994fab
SHA1 f548245c21e8255957d750901f2b1229ffd32f9e
SHA512 1e1cc33eb4302524dddb80053f2ba355a311adc5fde1b9659f4ac6949d9d3e561d70a4d5a831860c347cc7676c9ef690a21bdfe404d31d41113e1be7375d0cfe
SSDEEP 768:Kj+9t3b9jYreNSLf1fGqZX7DGFzoqPcNMCNFxMjtD:p9t3upf1fZZ3WkqPajyD
TLSH
T1D1F2AFB5ACA54C674CD6C28DB75B3B97DFE012A341801E94D9ED6F0E46CB3AD030B925
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 abcaee6db7a711c102ccc566777e7be38c35a3fcc7bb23a4347228b6b042cadb
MD5 559ff325c2d3e816f7d18439c1862f87
SHA1 bbec31b77ee3269ed76eaeaa774c1ea58357226b
SHA512 c5a76b9b9bea5c59e452f5143a357fd1e7dde1ca5c05c81daa881438a81be4b1f78aa43ea0dfd97fa06100b81fa0df90aeaee4bb2247685b9c93bf551046c2e4
SSDEEP 768:Rrv+4UNbdH38LjYreNSLf1fGqsX7DGFzoqPcNMCNFx5r:RbsbZ3/pf1fZs3WkqPaj5r
TLSH
T1BB03BFB4ACB889374CE7D288B75B3A53BFB4116345850B94D8E92F4D468F2EE130BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 681cb3c642b9927d4e1e5b60b362fdab728b6ebad20dd1d347196364bbfee50a
MD5 9548601ad5b58adf4d0d8d1034cdf35f
SHA1 7e7633b46cbc999f58464b61ba10feab9fde5f78
SHA512 51d02f1458a9b9799dc096c3c5070eef1acdf1e07d0cd216f23fb562b983cbe1f05bbeb940fd0565e10bddf60b118a3adf2358e3e4a3b46cd3a38cba95784b3d
SSDEEP 768:3F1j+9a3AwgAvsVf1fGqQX7DGFzoqPcNMCNFxMjtD:+9a3af1fZQ3WkqPajyD
TLSH
T1F8134AF598D3893AD89E838BA73D2E469EBCC16371845994BBD81E0DCD871BFC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a2c0fd75-d62b-48ab-9807-ef75d74034c8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\a2c0fd75-d62b-48ab-9807-ef75d74034c8.tmp
Size 38KB
SHA256 a8959a3a6bd4babe8c8ebe1066870f91c8ec08d8080ce7e94e442e042fd63fb9
MD5 302ecf6482b96d909f77d283e966b4f7
SHA1 7c8bbc76c32e6d69a30bbf7b874b7658fadc744e
SHA512 09b8a61726501ad2423c673bf7fdd460ce67f1e317aebf1b01e83c6b1f075e16d9d74a3b0ad926afe2bd3da0461057d8e887e8b1ff5b80a667eccdd35a9ff7a9
SSDEEP 768:Vrv+4UNbda3rCYreNSLf1fSX7DGFzoqPcNMCNZpeVH1SkM:Vbsb431pf1fS3WkqPafEH1Y
TLSH
T19403BFB5A8A495374CE3C6C8B75B36076FF4016746800B94D8EE2F0E879F5AD130B92A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

66962c50-691d-4c48-b8f4-4675344a0f4a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\66962c50-691d-4c48-b8f4-4675344a0f4a.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

2026-07-08_198c083eabd97cf92ab4ee964aec9dcf_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe

Path C:\Users\Admin\AppData\Local\Temp\Opera Installer\2026-07-08_198c083eabd97cf92ab4ee964aec9dcf_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
Size 3.2MB
SHA256 0fc9e7f70e46b63ad5c664f211218340aadf8f5692c0a22d7fea809cc04431ca
MD5 198c083eabd97cf92ab4ee964aec9dcf
SHA1 c284bd69707577b7f120802928de70877cd1ae6c
SHA512 e8ed40e633329e311d962b6761390d2546e83c0ca39ef2adac85c9f40eba5a8e71b7ee6a7cbd880515a8eda51a7933b689511cd36def75413ead5584c4933e40
SSDEEP 49152:m34fZW7pR+wt7drl4nDSr0lGDuCZxBJCSGHq1pgG3nmmWZGDSW+SuhnikcBFA5Vs:m34fZUpZt7dmmOcDA5VSZ
TLSH
T17BF55A0266FE6134F2FB2B30A83C56690EBA7E526F39C5DF9744185C0D706E099B1B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_sfx.exe

Path C:\Users\Admin\AppData\Local\Temp\Opera Installer\opera_package_202607080558391\assistant\_sfx.exe
Size 2.8MB
SHA256 71a4cc628fd1716fd994689c4808d2ebbc00e8bd2ecb7600b9921baa8916c752
MD5 3b028b1188ac321e66add16f8ebadbec
SHA1 086bcb2b1c0d300be15c1390841aadadcec4eac7
SHA512 17c390e0df8e29ff9ad43e581db298ada2d8378fbb890dc5f4b17df8fbe21134f99ab203ea4752a419215d289c128a1d8bc14721bde80042e5bb4c3901dffb72
SSDEEP 49152:+kinoIZOrzV7AlDfo7eT/uAtH00raHx774jx4aGhcr0glyGIGE1HVyVNW272DS/Z:+kiocQzV89Tmeradk2ha0gdIT11yVQ2w
TLSH
T167D5233275A48C34D62312321CE0FAEDA5BE72701E6347DB73A42B1F9EB01979A1D562
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

assistant_installer.exe

Path C:\Users\Admin\AppData\Local\Temp\Opera Installer\opera_package_202607080558391\assistant\assistant_installer.exe
Size 2.4MB
SHA256 63187b388e01fb05d8c29957e1c566324af67aff2f7a2e3da9132248c79375a8
MD5 b0408fa2a406f483e42c3ac102d35e9b
SHA1 fbaca900ad54abc65ec2cb34d63727c87132d16b
SHA512 2e8b9af626fff68ecd0204d6a3151b4518749143ec78a2f8f99f959399d1c8ea59987f99c38c9e48fe38b518fd8c91381356daf3f17944fa3432337b882e5401
SSDEEP 49152:wJv8lBbu91xwyiZSwRDzWEibQojjHLQDpizF:wR8lBbu91xwyiZSwRWEKQWjHLOpc
TLSH
T10AC5AE12A86094B5D8563132321DEB3E9A30BE1657354DDBDB90BCC1BBB86E2353734B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dbgcore.DLL

Path C:\Users\Admin\AppData\Local\Temp\Opera Installer\opera_package_202607080558391\assistant\dbgcore.DLL
Size 222KB
SHA256 7bb46348c2ec97ef9ee7a8e0ae28c8e069513e8acaee2689134a2d906b5fdecf
MD5 b26ebc5cde9b1726ee9f9534dd6107d0
SHA1 de00af3ec4de63a158bcd50c6e95b046669d3353
SHA512 2e01c65b58369c1f5f4081cf377c3fedd87ae5fca63cfbc44dd7859a1e10a849d1bbdbb592349d793166f577dbd954cd8660f625dcbc9adc4d936d6a44f062bf
SSDEEP 6144:FASh0NdOEQzFh0ekr6nzwBaQGdppLIg2dFl96Fl:4MHZn1n+P96Fl
TLSH
T14C247C2269401533DCEF12F062AF363A96AEDD90239490C359A05BDDD6D4BC12E3D6EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dbghelp.dll

Path C:\Users\Admin\AppData\Local\Temp\Opera Installer\opera_package_202607080558391\assistant\dbghelp.dll
Size 1.8MB
SHA256 6fd2b4bfc275ed306ce09008ff8437818b3373e69e4b3db3cbb79be91b2b9308
MD5 021b11c0fc1a09e49a2046ef07d1747a
SHA1 4b955c1e7150db4f07528929fc529fde9738a2b3
SHA512 6ca94fdf2b92928859152aa23f31df46944eeeac7988f6bb5d647341843d8d2aa91c2c810d17c8b58a03c99e4ca7d7e1ae6b6c2d9ea5029616d870b89794d6c8
SSDEEP 49152:xEDlXSohR86M5NKBlv/2yOFVnzM9F0KM7:uFhR86MHyl0fb
TLSH
T128856B20E784813CE4EA1177E67C7A7D85ADE524073440CBAAC45BA978297D32F387DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Opera_installer_2607080458374784908.dll

Path C:\Users\Admin\AppData\Local\Temp\Opera_installer_2607080458374784908.dll
Size 2.4MB
SHA256 2f60182dd162e86e569e356087eae1e9204531b55d5635d418b0e33dd93b3e05
MD5 ac87ac9c6e9c0f7c7668b1bf2c886cb9
SHA1 bbce8a3a288ffd62f89a412720084e1205f7411f
SHA512 3458c511376a8875cac821c49899a35c800c01886b7af1a3a234b4741c3c4d170bf2443d61d0c018aae8e72ff50f494006ff1342cad048749675e64657291e07
SSDEEP 49152:+7pR+wt7drl4nDSr0lGDuCZxBJCSGHq1pgG3nmmWZGDSW+SuhnikcBFA5VI7Y+mD:MpZt7dmmOcDA5VS
TLSH
T1FEC57C0166E96038F5FB2770683CA7294E797E025F39C9DF97841C5C1E705E0AAB272B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir6052_1866107580\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports\settings.dat
Size 40B
SHA256 8bbac7c6fefba3028c21c24248bdcc013b1825a0656d419779e8e60d3b78ef09
MD5 f6d987bf1a8d8e60b32ec0fa608546fc
SHA1 29f06ffff2fafebd3eeede083eda3d2ccad7e628
SHA512 f7a73890c9b77ee110c884413d65e94c0b4cb886b91aa5d844af2dd1a47f021ba098e0054223ffc51fab7ea38b8e9f21e4a7260aa40ca24c5c2b3b2ff93d2a21
MD5 SHA1 SHA512

Submit Download

memory/1020-4-0x0000000000C70000-0x0000000000FA9000-memory.dmp

Download

memory/2556-71-0x0000000000C70000-0x0000000000FA9000-memory.dmp

Download

memory/2928-67-0x0000000000C70000-0x0000000000FA9000-memory.dmp

Download

memory/4908-0-0x0000000000C70000-0x0000000000FA9000-memory.dmp

Download

memory/5204-13-0x0000000000590000-0x00000000008C9000-memory.dmp

Download