86ded7a5081fb2c312b25d62febfa0f6f49cc49bc1516a92316639824b0888b3

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/07/2026, 11:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-31_c1f917fb76b426d475b1884e6a5d5ff9_amadey_darkgate_elex_hijackloader_luca-stealer_mespinoza_njrat.exe
Size 4.8MB
Sample260731-m7zbwseq2s
SHA256 86ded7a5081fb2c312b25d62febfa0f6f49cc49bc1516a92316639824b0888b3
MD5 c1f917fb76b426d475b1884e6a5d5ff9
SHA1 604d3522c7b38be642e26200d3d4bc7fd9b9c350
SHA512 41695c47f93c54b760ed7ed1948e0cdf954c0dc24f9479e8a7e0b5066cfc19a3e9ec64c65e2cf55e109c4e8857776e804e010f491453ae5f1cf19bcf9f4258cb
SSDEEP 98304:Ontlj6666666666666666666666666666666x666666666666666fwwwwwwwwwwo:64Xx0djW+UyQ6rjnHqtJRn7ZrHzq8QVs
TLSH
T139368E81F3616134D8BBAAB12D3C6B5609183D67AB31C6DF59C83C7A1E708C21A3DB57
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery persistence ransomware spyware stealer

Malware Config

Signatures

Downloads MZ/PE file 2 IoCs

flow	pid	Process
13	3956	2026-07-31_c1f917fb76b426d475b1884e6a5d5ff9_amadey_darkgate_elex_hijackloader_luca-stealer_mespinoza_njrat.exe
82	5552	msedge.exe

Executes dropped EXE 4 IoCs

pid	Process
4496	2026-07-31_c1f917fb76b426d475b1884e6a5d5ff9_amadey_darkgate_elex_hijackloader_luca-stealer_mespinoza_njrat.exe
4700	Assistant_130.0.5847.41_Setup.exe_sfx.exe
244	assistant_installer.exe
4584	assistant_installer.exe

Loads dropped DLL 9 IoCs

pid	Process
3956	2026-07-31_c1f917fb76b426d475b1884e6a5d5ff9_amadey_darkgate_elex_hijackloader_luca-stealer_mespinoza_njrat.exe
4116	2026-07-31_c1f917fb76b426d475b1884e6a5d5ff9_amadey_darkgate_elex_hijackloader_luca-stealer_mespinoza_njrat.exe
4496	2026-07-31_c1f917fb76b426d475b1884e6a5d5ff9_amadey_darkgate_elex_hijackloader_luca-stealer_mespinoza_njrat.exe
244	assistant_installer.exe
244	assistant_installer.exe
4584	assistant_installer.exe
4584	assistant_installer.exe
5196	2026-07-31_c1f917fb76b426d475b1884e6a5d5ff9_amadey_darkgate_elex_hijackloader_luca-stealer_mespinoza_njrat.exe
4588	2026-07-31_c1f917fb76b426d475b1884e6a5d5ff9_amadey_darkgate_elex_hijackloader_luca-stealer_mespinoza_njrat.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 4 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	2026-07-31_c1f917fb76b426d475b1884e6a5d5ff9_amadey_darkgate_elex_hijackloader_luca-stealer_mespinoza_njrat.exe
File opened (read-only)	\??\E:	2026-07-31_c1f917fb76b426d475b1884e6a5d5ff9_amadey_darkgate_elex_hijackloader_luca-stealer_mespinoza_njrat.exe
File opened (read-only)	\??\F:	2026-07-31_c1f917fb76b426d475b1884e6a5d5ff9_amadey_darkgate_elex_hijackloader_luca-stealer_mespinoza_njrat.exe
File opened (read-only)	\??\E:	2026-07-31_c1f917fb76b426d475b1884e6a5d5ff9_amadey_darkgate_elex_hijackloader_luca-stealer_mespinoza_njrat.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5452_262822677\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5452_262822677\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5452_262822677\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5452_262822677\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5452_262822677\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5452_262822677\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5452_262822677\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5452_262822677\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5452_270137451\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5452_262822677\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5452_262822677\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5452_262822677\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5452_262822677\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5452_262822677\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5452_262822677\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5452_262822677\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5452_262822677\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5452_262822677\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5452_262822677\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5452_262822677\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5452_262822677\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5452_262822677\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5452_262822677\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5452_262822677\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5452_262822677\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5452_262822677\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5452_262822677\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5452_262822677\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5452_262822677\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5452_262822677\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5452_262822677\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5452_262822677\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5452_262822677\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5452_262822677\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5452_262822677\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5452_262822677\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5452_262822677\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5452_262822677\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5452_262822677\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5452_262822677\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5452_262822677\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5452_262822677\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5452_262822677\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5452_262822677\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5452_262822677\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5452_262822677\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5452_262822677\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5452_270137451\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_5452_2012870970\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_108_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5452_262822677\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5452_262822677\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5452_262822677\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5452_262822677\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5452_262822677\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5452_262822677\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5452_262822677\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5452_262822677\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5452_262822677\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5452_262822677\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5452_262822677\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5452_996676680\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5452_262822677\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5452_262822677\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5452_262822677\_locales\be\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-31_c1f917fb76b426d475b1884e6a5d5ff9_amadey_darkgate_elex_hijackloader_luca-stealer_mespinoza_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-31_c1f917fb76b426d475b1884e6a5d5ff9_amadey_darkgate_elex_hijackloader_luca-stealer_mespinoza_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	assistant_installer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-31_c1f917fb76b426d475b1884e6a5d5ff9_amadey_darkgate_elex_hijackloader_luca-stealer_mespinoza_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-31_c1f917fb76b426d475b1884e6a5d5ff9_amadey_darkgate_elex_hijackloader_luca-stealer_mespinoza_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Assistant_130.0.5847.41_Setup.exe_sfx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	assistant_installer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-31_c1f917fb76b426d475b1884e6a5d5ff9_amadey_darkgate_elex_hijackloader_luca-stealer_mespinoza_njrat.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5552	msedge.exe

Enumerates system info in registry 2 TTPs 5 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	assistant_installer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	assistant_installer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134299696777140737"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1738198120-2966725515-3980530802-1000\{FB1E5F68-D9A8-41A4-A46B-0A791D136964}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
5452	msedge.exe
5452	msedge.exe
5452	msedge.exe
5452	msedge.exe
5452	msedge.exe
5452	msedge.exe
5452	msedge.exe

Suspicious use of FindShellTrayWindow 13 IoCs

pid	Process
5452	msedge.exe
5452	msedge.exe
5452	msedge.exe
5452	msedge.exe
5452	msedge.exe
5452	msedge.exe
5452	msedge.exe
5452	msedge.exe
5452	msedge.exe
5452	msedge.exe
5452	msedge.exe
5452	msedge.exe
5452	msedge.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3956	2026-07-31_c1f917fb76b426d475b1884e6a5d5ff9_amadey_darkgate_elex_hijackloader_luca-stealer_mespinoza_njrat.exe
3956	2026-07-31_c1f917fb76b426d475b1884e6a5d5ff9_amadey_darkgate_elex_hijackloader_luca-stealer_mespinoza_njrat.exe
3956	2026-07-31_c1f917fb76b426d475b1884e6a5d5ff9_amadey_darkgate_elex_hijackloader_luca-stealer_mespinoza_njrat.exe

Suspicious use of WriteProcessMemory 60 IoCs

description	pid	Process	procid_target
PID 3956 wrote to memory of 4116	3956	2026-07-31_c1f917fb76b426d475b1884e6a5d5ff9_amadey_darkgate_elex_hijackloader_luca-stealer_mespinoza_njrat.exe	89
PID 3956 wrote to memory of 4496	3956	2026-07-31_c1f917fb76b426d475b1884e6a5d5ff9_amadey_darkgate_elex_hijackloader_luca-stealer_mespinoza_njrat.exe	90
PID 3956 wrote to memory of 4700	3956	2026-07-31_c1f917fb76b426d475b1884e6a5d5ff9_amadey_darkgate_elex_hijackloader_luca-stealer_mespinoza_njrat.exe	92
PID 3956 wrote to memory of 244	3956	2026-07-31_c1f917fb76b426d475b1884e6a5d5ff9_amadey_darkgate_elex_hijackloader_luca-stealer_mespinoza_njrat.exe	93
PID 244 wrote to memory of 4584	244	assistant_installer.exe	94
PID 3956 wrote to memory of 5196	3956	2026-07-31_c1f917fb76b426d475b1884e6a5d5ff9_amadey_darkgate_elex_hijackloader_luca-stealer_mespinoza_njrat.exe	95
PID 5196 wrote to memory of 4588	5196	2026-07-31_c1f917fb76b426d475b1884e6a5d5ff9_amadey_darkgate_elex_hijackloader_luca-stealer_mespinoza_njrat.exe	96
PID 3956 wrote to memory of 5452	3956	2026-07-31_c1f917fb76b426d475b1884e6a5d5ff9_amadey_darkgate_elex_hijackloader_luca-stealer_mespinoza_njrat.exe	97
PID 5452 wrote to memory of 2156	5452	msedge.exe	98
PID 5452 wrote to memory of 5556	5452	msedge.exe	99
PID 5452 wrote to memory of 5552	5452	msedge.exe	100
PID 5452 wrote to memory of 5556	5452	msedge.exe	99
PID 5452 wrote to memory of 5556	5452	msedge.exe	99
PID 5452 wrote to memory of 2896	5452	msedge.exe	101
PID 5452 wrote to memory of 2896	5452	msedge.exe	101
PID 5452 wrote to memory of 5896	5452	msedge.exe	103
PID 5452 wrote to memory of 5896	5452	msedge.exe	103
PID 5452 wrote to memory of 5896	5452	msedge.exe	103
PID 5452 wrote to memory of 5980	5452	msedge.exe	104
PID 5452 wrote to memory of 5980	5452	msedge.exe	104
PID 5452 wrote to memory of 5980	5452	msedge.exe	104
PID 5452 wrote to memory of 1936	5452	msedge.exe	105
PID 5452 wrote to memory of 2584	5452	msedge.exe	106
PID 5452 wrote to memory of 1936	5452	msedge.exe	105
PID 5452 wrote to memory of 1936	5452	msedge.exe	105
PID 5452 wrote to memory of 2584	5452	msedge.exe	106
PID 5452 wrote to memory of 2584	5452	msedge.exe	106
PID 5452 wrote to memory of 6036	5452	msedge.exe	107
PID 5452 wrote to memory of 6036	5452	msedge.exe	107
PID 5452 wrote to memory of 1488	5452	msedge.exe	108
PID 5452 wrote to memory of 1488	5452	msedge.exe	108
PID 5452 wrote to memory of 1488	5452	msedge.exe	108
PID 5452 wrote to memory of 2432	5452	msedge.exe	110
PID 5452 wrote to memory of 2432	5452	msedge.exe	110
PID 5452 wrote to memory of 3776	5452	msedge.exe	111
PID 5452 wrote to memory of 3776	5452	msedge.exe	111
PID 5452 wrote to memory of 3776	5452	msedge.exe	111
PID 5452 wrote to memory of 5328	5452	msedge.exe	113
PID 5452 wrote to memory of 1148	5452	msedge.exe	112
PID 5452 wrote to memory of 5328	5452	msedge.exe	113
PID 5452 wrote to memory of 1148	5452	msedge.exe	112
PID 5452 wrote to memory of 1584	5452	msedge.exe	115
PID 5452 wrote to memory of 3596	5452	msedge.exe	116
PID 5452 wrote to memory of 3596	5452	msedge.exe	116
PID 5452 wrote to memory of 5852	5452	msedge.exe	117
PID 5452 wrote to memory of 5852	5452	msedge.exe	117
PID 5452 wrote to memory of 3836	5452	msedge.exe	121
PID 5452 wrote to memory of 5332	5452	msedge.exe	122
PID 5452 wrote to memory of 5332	5452	msedge.exe	122
PID 5452 wrote to memory of 4944	5452	msedge.exe	123
PID 5452 wrote to memory of 4944	5452	msedge.exe	123
PID 5452 wrote to memory of 2144	5452	msedge.exe	124
PID 5452 wrote to memory of 1144	5452	msedge.exe	125
PID 5452 wrote to memory of 4476	5452	msedge.exe	126
PID 5452 wrote to memory of 3608	5452	msedge.exe	127
PID 5452 wrote to memory of 3608	5452	msedge.exe	127
PID 5452 wrote to memory of 3176	5452	msedge.exe	131
PID 5452 wrote to memory of 3176	5452	msedge.exe	131
PID 5452 wrote to memory of 3392	5452	msedge.exe	132
PID 5452 wrote to memory of 3392	5452	msedge.exe	132

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-07-31_c1f917fb76b426d475b1884e6a5d5ff9_amadey_darkgate_elex_hijackloader_luca-stealer_mespinoza_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-31_c1f917fb76b426d475b1884e6a5d5ff9_amadey_darkgate_elex_hijackloader_luca-stealer_mespinoza_njrat.exe"
1⤵
- Downloads MZ/PE file
- Loads dropped DLL
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3956
- C:\Users\Admin\AppData\Local\Temp\2026-07-31_c1f917fb76b426d475b1884e6a5d5ff9_amadey_darkgate_elex_hijackloader_luca-stealer_mespinoza_njrat.exe
  C:\Users\Admin\AppData\Local\Temp\2026-07-31_c1f917fb76b426d475b1884e6a5d5ff9_amadey_darkgate_elex_hijackloader_luca-stealer_mespinoza_njrat.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=106.0.4998.28 --initial-client-data=0x320,0x324,0x328,0x2fc,0x32c,0x74ca9530,0x74ca953c,0x74ca9548
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4116
- C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\2026-07-31_c1f917fb76b426d475b1884e6a5d5ff9_amadey_darkgate_elex_hijackloader_luca-stealer_mespinoza_njrat.exe
  "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\2026-07-31_c1f917fb76b426d475b1884e6a5d5ff9_amadey_darkgate_elex_hijackloader_luca-stealer_mespinoza_njrat.exe" --version
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4496
- C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202607311207111\assistant\Assistant_130.0.5847.41_Setup.exe_sfx.exe
  "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202607311207111\assistant\Assistant_130.0.5847.41_Setup.exe_sfx.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4700
- C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202607311207111\assistant\assistant_installer.exe
  "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202607311207111\assistant\assistant_installer.exe" --version
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Enumerates system info in registry
  - Suspicious use of WriteProcessMemory
  PID:244
- - C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202607311207111\assistant\assistant_installer.exe
    "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202607311207111\assistant\assistant_installer.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=130.0.5847.41 --initial-client-data=0x24c,0x250,0x254,0x228,0x258,0x294040,0x29404c,0x294058
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:4584
- C:\Users\Admin\AppData\Local\Temp\2026-07-31_c1f917fb76b426d475b1884e6a5d5ff9_amadey_darkgate_elex_hijackloader_luca-stealer_mespinoza_njrat.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-07-31_c1f917fb76b426d475b1884e6a5d5ff9_amadey_darkgate_elex_hijackloader_luca-stealer_mespinoza_njrat.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=1 --general-interests=1 --general-location=1 --personalized-content=1 --personalized-ads=1 --launchopera=1 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=0 --run-at-startup=1 --show-intro-overlay --server-tracking-data=server_tracking_data --initial-pid=3956 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_20260731120711" --session-guid=23f94aa4-e958-4397-b48e-5d77b1ac9394 --server-tracking-blob=OTMwYTgzMDZlZmU1YmQ1NDQ4ZWNhMDZhNzMwNGYyNzkzNzcxNThjNGFjYmE0MzM1OGMxZDYxMDZmY2Q5NjM2ZDp7ImNvdW50cnkiOiJVUyIsImh0dHBfcmVmZXJyZXIiOiJodHRwczovL25ldC5nZW8ub3BlcmEuY29tL29wZXJhL3N0YWJsZS93aW5kb3dzP2h0dHBfcmVmZXJyZXI9aHR0cDovL3NvZnR3YXJlLmluZm9ybWVyLmNvbS9tYW5hZ2UvaW5kZXgucGhwJnV0bV9zb3VyY2U9c29mdHdhcmUuaW5mb3JtZXIuY29tX3ZpYV9vcGVyYV9jb20mdXRtX21lZGl1bT1yb2MmdXRtX2NhbXBhaWduPShyZWZlcnJhbClfdmlhX29wZXJhX2NvbSZ1dG1fY29udGVudD0vbWFuYWdlL2luZGV4LnBocCIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijp7Im5hbWUiOiJvcGVyYSJ9LCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cz9odHRwX3JlZmVycmVyPWh0dHA6Ly9zb2Z0d2FyZS5pbmZvcm1lci5jb20vbWFuYWdlL2luZGV4LnBocCZ1dG1fc291cmNlPXNvZnR3YXJlLmluZm9ybWVyLmNvbV92aWFfb3BlcmFfY29tJnV0bV9tZWRpdW09cm9jJnV0bV9jYW1wYWlnbj0ocmVmZXJyYWwpX3ZpYV9vcGVyYV9jb20mdXRtX2NvbnRlbnQ9L21hbmFnZS9pbmRleC5waHAiLCJzeXN0ZW0iOnsicGxhdGZvcm0iOnsiYXJjaCI6Ing4Nl82NCIsIm9wc3lzIjoiV2luZG93cyIsIm9wc3lzLXZlcnNpb24iOiIxMSIsInBhY2thZ2UiOiJFWEUifX0sInRpbWVzdGFtcCI6IjE3MDQ1MDE4NzYuMDQxMiIsInVzZXJhZ2VudCI6Ik1vemlsbGEvNS4wIChYMTE7IExpbnV4IGk2ODY7IHJ2OjguMCkgR2Vja28vMjAxMDAxMDEgRmlyZWZveC84LjAiLCJ1dG0iOnsiY2FtcGFpZ24iOiIocmVmZXJyYWwpX3ZpYV9vcGVyYV9jb20iLCJjb250ZW50IjoiL21hbmFnZS9pbmRleC5waHAiLCJtZWRpdW0iOiJyb2MiLCJzb3VyY2UiOiJzb2Z0d2FyZS5pbmZvcm1lci5jb21fdmlhX29wZXJhX2NvbSJ9LCJ1dWlkIjoiYzA0YTg1ZmYtMzI2Yi00YTMzLTk4NzYtMGEzOWM3YTlkNWE3In0= --desktopshortcut=1 --wait-for-package --initial-proc-handle=C807000000000000
  2⤵
  - Loads dropped DLL
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5196
- - C:\Users\Admin\AppData\Local\Temp\2026-07-31_c1f917fb76b426d475b1884e6a5d5ff9_amadey_darkgate_elex_hijackloader_luca-stealer_mespinoza_njrat.exe
    C:\Users\Admin\AppData\Local\Temp\2026-07-31_c1f917fb76b426d475b1884e6a5d5ff9_amadey_darkgate_elex_hijackloader_luca-stealer_mespinoza_njrat.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=106.0.4998.28 --initial-client-data=0x318,0x31c,0x32c,0x2f4,0x330,0x71ed9530,0x71ed953c,0x71ed9548
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:4588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://download.opera.com/download/get/?partner=www&opsys=Windows&utm_source=netinstaller&arch=x64
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5452
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x318,0x7ffeba08c188,0x7ffeba08c194,0x7ffeba08c1a0
    3⤵
    PID:2156
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1580,i,5642370075940412538,16761862380687977058,262144 --field-trial-handle=2252,i,12122926354690070471,10966943325439154566,262144 --variations-seed-version --mojo-platform-channel-handle=2248 /prefetch:2
    3⤵
    PID:5556
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1896,i,14757624303759871873,2311462153261854372,524288 --field-trial-handle=2252,i,12122926354690070471,10966943325439154566,262144 --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:11
    3⤵
    - Downloads MZ/PE file
    - System Time Discovery
    PID:5552
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2528,i,18331723270416239470,5139954580454726346,524288 --field-trial-handle=2252,i,12122926354690070471,10966943325439154566,262144 --variations-seed-version --mojo-platform-channel-handle=3224 /prefetch:13
    3⤵
    PID:2896
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3464,i,15378807914666612088,827762111769796784,2097152 --field-trial-handle=2252,i,12122926354690070471,10966943325439154566,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:1
    3⤵
    PID:5896
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3556,i,7503271647643012002,8707236242269894149,2097152 --field-trial-handle=2252,i,12122926354690070471,10966943325439154566,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:1
    3⤵
    PID:5980
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4272,i,2961869691781317846,11129646255637159914,2097152 --field-trial-handle=2252,i,12122926354690070471,10966943325439154566,262144 --variations-seed-version --mojo-platform-channel-handle=1588 /prefetch:9
    3⤵
    PID:1936
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4260,i,12794429971955963548,14238616290183892346,2097152 --field-trial-handle=2252,i,12122926354690070471,10966943325439154566,262144 --variations-seed-version --mojo-platform-channel-handle=4380 /prefetch:1
    3⤵
    PID:2584
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5216,i,4248307616031221212,519120386136367919,524288 --field-trial-handle=2252,i,12122926354690070471,10966943325439154566,262144 --variations-seed-version --mojo-platform-channel-handle=3728 /prefetch:14
    3⤵
    PID:6036
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=2508,i,17428800458647668094,14812166883659195346,2097152 --field-trial-handle=2252,i,12122926354690070471,10966943325439154566,262144 --variations-seed-version --mojo-platform-channel-handle=5504 /prefetch:1
    3⤵
    PID:1488
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5720,i,2052334023913119828,1966089519232878784,524288 --field-trial-handle=2252,i,12122926354690070471,10966943325439154566,262144 --variations-seed-version --mojo-platform-channel-handle=5792 /prefetch:14
    3⤵
    PID:2432
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=3708,i,198462475333102898,17123817416643436899,2097152 --field-trial-handle=2252,i,12122926354690070471,10966943325439154566,262144 --variations-seed-version --mojo-platform-channel-handle=5820 /prefetch:1
    3⤵
    PID:3776
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5800,i,4842480093643706455,10062076939209357389,524288 --field-trial-handle=2252,i,12122926354690070471,10966943325439154566,262144 --variations-seed-version --mojo-platform-channel-handle=5824 /prefetch:14
    3⤵
    PID:1148
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5804,i,11775429342822863837,7237539212730661061,524288 --field-trial-handle=2252,i,12122926354690070471,10966943325439154566,262144 --variations-seed-version --mojo-platform-channel-handle=5852 /prefetch:14
    3⤵
    PID:5328
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3660,i,1048616358560594619,13252769040526123286,524288 --field-trial-handle=2252,i,12122926354690070471,10966943325439154566,262144 --variations-seed-version --mojo-platform-channel-handle=5484 /prefetch:14
    3⤵
    PID:420
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3660,i,1048616358560594619,13252769040526123286,524288 --field-trial-handle=2252,i,12122926354690070471,10966943325439154566,262144 --variations-seed-version --mojo-platform-channel-handle=5484 /prefetch:14
    3⤵
    PID:1584
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6848,i,14518770883861661550,11669261113212134559,524288 --field-trial-handle=2252,i,12122926354690070471,10966943325439154566,262144 --variations-seed-version --mojo-platform-channel-handle=6860 /prefetch:14
    3⤵
    PID:3596
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6844,i,17603547892870373830,5775047952900190426,524288 --field-trial-handle=2252,i,12122926354690070471,10966943325439154566,262144 --variations-seed-version --mojo-platform-channel-handle=7000 /prefetch:14
    3⤵
    PID:5852
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7280,i,8586251021122562798,7820750059430544774,524288 --field-trial-handle=2252,i,12122926354690070471,10966943325439154566,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:14
    3⤵
    PID:3836
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5728,i,7184209213514602049,13300070128811695564,524288 --field-trial-handle=2252,i,12122926354690070471,10966943325439154566,262144 --variations-seed-version --mojo-platform-channel-handle=5516 /prefetch:14
    3⤵
    PID:5332
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5480,i,7026720918450564584,15006139172786568733,524288 --field-trial-handle=2252,i,12122926354690070471,10966943325439154566,262144 --variations-seed-version --mojo-platform-channel-handle=5080 /prefetch:14
    3⤵
    PID:4944
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4964,i,15409160389160825721,12267624368365350035,524288 --field-trial-handle=2252,i,12122926354690070471,10966943325439154566,262144 --variations-seed-version --mojo-platform-channel-handle=3660 /prefetch:14
    3⤵
    PID:2144
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3620,i,13270738761251499618,6344250429953701881,524288 --field-trial-handle=2252,i,12122926354690070471,10966943325439154566,262144 --variations-seed-version --mojo-platform-channel-handle=4956 /prefetch:14
    3⤵
    PID:1144
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6752,i,11202459874231833591,18039643127923068422,524288 --field-trial-handle=2252,i,12122926354690070471,10966943325439154566,262144 --variations-seed-version --mojo-platform-channel-handle=6708 /prefetch:14
    3⤵
    PID:4476
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6080,i,16507072979125590867,15585800498747951308,524288 --field-trial-handle=2252,i,12122926354690070471,10966943325439154566,262144 --variations-seed-version --mojo-platform-channel-handle=5984 /prefetch:14
    3⤵
    PID:3608
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6448,i,12545213288439759069,12271556128861191742,524288 --field-trial-handle=2252,i,12122926354690070471,10966943325439154566,262144 --variations-seed-version --mojo-platform-channel-handle=6072 /prefetch:14
    3⤵
    PID:3176
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=916,i,4580051420179786170,11053805420735507153,524288 --field-trial-handle=2252,i,12122926354690070471,10966943325439154566,262144 --variations-seed-version --mojo-platform-channel-handle=6164 /prefetch:14
    3⤵
    PID:3392

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3476

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1396

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5748

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ac1b1f93ff87eb876027f4166d705375c0f5d3d22dcb03f6a66f6100e88dd10f
MD5 b99f03c5cfe71b03836f8b5fcf09425b
SHA1 8a5078499c0b5ea40183efb77f9c1028c196409c
SHA512 6b9feec4ead7bf05f67d0d480907e21a3b770d8d12dedd2b0d785904186eac7448583e61abacb23582948de55c8ea2043bfd6908efd7faecdd82cee91404cfe6
TLSH
T16DD02BE037909D18C440353163D0122091006C30880923090100A02C8D3E2C3054F0BE
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c95a47aec5edba88214fad580cb869417b6620a91d8ee97e2d0b7801d3372be5
MD5 aad5f2ca0dd16bb2ea6c7757ea569c50
SHA1 5228b0b132542be004ea1bb32f3748964d065af5
SHA512 9d59c0291d741bd9d6cf50c22972d4baef00e7c1a48d6a3311a6cc82c04ceeba6e2be9458334cb954878915cc9eb91a8fd8bc4a47c966d57a2a05d6ee8211640
TLSH
T1D4D09BE177A19D18C545353567D1522591416D31451927194241E13D9D7E2C3455F0AA
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 eacd107cabfc5cc24242ac56f17ab71f36d324fc058211a5bb430fc10252d4e3
MD5 0547ed814ba76f7d9354dd7a5a87e450
SHA1 165fcb1138dfa4758cc25a99c0e00fb927fa4756
SHA512 fb09ec3706323e73e495cbe1572df2ba9169a1aace2b4492b62e287f3490936d870118deee4e97287e322fff105acd330d0d3bf2648dc8d80bcae3835ac90500
TLSH
T1127187B7633A05D9EB20857190D5886835F0C68DD29FBE8AC4EC5DF9A40AF0562F281F
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59ed06.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59ed06.TMP
Size 3KB
SHA256 19136f330120516fcc2cd8f6eabc97594e95aa257e7a9677c2e31ac5ca81a618
MD5 5221db6a4229bf7d93efc50900a36e19
SHA1 5e372077bb0f0984f1b12b6e81834eec17738fce
SHA512 a28ab2a90f64a41de34b7349f1afd9cbaf179f7a1748c785bb8139e14354ee81d79d034c1746f7dbb1a61bec973f452ae712768643e0464b63436f63da9a74fd
TLSH
T14F6183B7A32906D9EB20C53190E5846835F4CA4DC24FBE9EC0ED5DFAA406F0552F281F
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 73a81fe280fb28cbc85d899a82b0f8c7d11c23cc397960127cf6d5bebcfd9094
MD5 00ba2527ee3d1ecf9e65d4797f8e623c
SHA1 c1880189f20ab450924d8e682d840d47ef0f0cf3
SHA512 84d4480e9da8b9dbfbfbf5e8f2af3a2e5be290aaa3bfb30ff32841677b8fe8730b7d8d8c5dfe368f6b005a84a0024ae46239b0ee369d1d708f9b75d49ef42c55
SSDEEP 96:Dap9poJpXJDjaCozRipKpublpmyp+JGpWntp+hiwQ:DabCJxJDjaCoVigQlhMJGIntAhiT
TLSH
T178917EF7C3E8962DC95256F0A6147F1BCE1E0954C32C3D6A84E49E1BA3E3471E24175E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 a96e67e8c43eca38e44a45a44774a224c2c169592a35026f976cf4effd847cb7
MD5 56bb37d35e26ef75ed42769f73452db0
SHA1 3cde48c35de8854f461692d25d6b1a6c93ffdc0d
SHA512 8f46cb5cd5b611fbe2209cf4ff1246412e40bc9ca57aa5e6311539290f5b8b4b2ef8f137dbeed9f2b673742c674839e33682fcd0423f5126fb86574df79a3124
SSDEEP 192:sxR+HRITH/fKsxiwG8zoA8pXyJ/g6+WN1hoH/2tqBtQoo1CYoGwPIgDFZJ:sxR+H8H/fKsxipte/5w/d/v1
TLSH
T15342875A6968597B4CCBD21DFB65BF53D2F91032E1D41E48A6FC860C04E66DD620780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 1ef6afccce126ed8ad4fbb2f79da011e6171ff9d3662f7e0f01b77d4e5a89a0b
MD5 4a2a544df2d1c87e2c09a846d7eab28d
SHA1 750f99d2815252498a02ee61171356c04fe122e9
SHA512 c772177180ba5ddcf4ba9abe68658dc453fd6ce2bffe205a8627d763567246fb7956e9984d0e15c7c5b23c1a383ab178d1b591261845db58eba7c0154719567c
SSDEEP 192:sxR+HRITH/fKsxWcZe21T/zoA8pXyJ/g6+WN1hoH/2tqBtQoo4CYoGwPIgDfNtlJ:sxR+H8H/fKsxWirTWe/5w/A/vH
TLSH
T1A342A75AA929597B8CCBD21DFB55BF63D2F95032E1941E44A7FC8B0C04E7ADD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 ff968177d874bf4dcf49ad597c36ed36b47a6826822e7474dcee61a5d8044a10
MD5 34803f2352a4c3b1109270353259218e
SHA1 df05be8e7e8192d179b29dd8f3a211acff1c502e
SHA512 a6973c20255bfdb2cccfb560d3698da593d66e6a6f46b4f4fd255b18455ca8767a1f72c37b5727f51a1943a892ec723d7937ee753d849b385ead8eba8c2452e4
SSDEEP 192:sxR+MRITH/fKs2iwG8zoA8pXyJ/g6+WN1hoH/2tqBtQoo1CYoGwPIgVRJ:sxR+M8H/fKs2ipte/5w/d/vV
TLSH
T1BD42975B6968597B4CCBD21DFB65BF63D2F91032A1D42E48A6FC860C04E7ADD620780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 619744bb040d90b662d73e8922299c85f07278fbb34597d36fee0f8ccf6c7f95
MD5 0fc9e3787173c3f251a693df371eae5c
SHA1 7557675ed5ef8903674fdd18c9fcc780d0a8920e
SHA512 fee7c9ddde88760d06cd33bbcd41a9b00b29712273e853d9e117db105e4ed19e18ceaf45f4a47c7b4a802f295ebb7574e9c651f51f4d394f6736265f4b5a37c2
SSDEEP 768:j26HWo7pLuL7MRWgs2f028F1+UoAYDCx9Tuqh0VfUC9xbog/OVkVuwqro9XFe0UI:j26HWUE7MRWgs2f02u1jan4wB1eE
TLSH
T15FC2CB7B740CCABF4F800ADDEC197E9F6D6802CB9698CD8047FE951C02C6BEA51164DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a592d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a592d.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 72bc0fb7d0b200aef05d417f2f9dc26ce949070b630b6087e1456098ac290c48
MD5 276c0815e09632b5ee3280400284d22a
SHA1 43488e7f3b0568f9fbe64b8377ade143bff277c9
SHA512 94c89a44f9a81d982dbd6f107c80cb91c5a6d891f3e05bc197596e1ced2a673a33fbe6dc5750ed25557393bf665424a0b47885eb0d5ca9bbe0996e9b6efa7c01
SSDEEP 768:Be3wu/TBOWBbatcONXyer1IRCzni9Eb9M9:Be3ZnSIqnPb+9
TLSH
T1F9F2CF31E4559E334CE6E396B1467793BEF82077D5C84B84EAE99F0E0593A1E130A81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 7306d508be36c029d8747d295b91abd14515adeb722510ca39c34db2bd71a001
MD5 dbed3ccb7c719f752524884bd37cdf2b
SHA1 319ed5f327a6348ac2cae65c2d8ea488696c8fde
SHA512 05b98ca81a968f3308d9885964b4f77767f5f69d339b8f93d208fc7c6dba901b833f2d4b1af45c882cdc32092d8430a08e420d23871903cc7887470946d3a7ff
SSDEEP 768:LFbk3mwgxtpsOWBbat/ONXyer1IRCzni9Eb9M9:9k3oVSIqnPb+9
TLSH
T1E8039D36D895CE3B9CE6A3D6F2467743EEF410A7C6C88AC4EAD95F4D009359E030AC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 a365273585274ba88e5db73eb97658ff3deb329a6ffd784970b94a5dd5951289
MD5 f806e522e590ec07cf1728e6fcddbc21
SHA1 7d0ae1551353402b6c09b462f48a158a632a5381
SHA512 ba2c6a4ce7ddaffe7e156058d5df510b3f4b02746bef51d49ea8db8473f1bc106bfd7d036530e8262d6d6fb585c05b19d4405d46910d7050741ba68e32aeed62
SSDEEP 768:We39u/TBOWBbatXONXyer1IRCzni9Eb9M9:We3oaSIqnPb+9
TLSH
T127F2CF31E4659E334CE6E396B1467393BEF82077D5C44B84EAE99F0E059392E170B81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 0a55131c3e12695d5a822dcda02628dc99748302606bc97ad52539278ff2ff40
MD5 858ca58c00be4be05767269a3c05761e
SHA1 e76f2fd5c6897fca5e9414a0ec3fbe1b893ba6ec
SHA512 7ca2236a6fbc2fe0ce13323a6114d4459aeb1ab9690ecad4c8ac9318328e6cc34ce926317562fb0641c172c690eebcd938ff906f4322f51067ab9e0f0b32972d
SSDEEP 768:hrv+4UNbdz3D6/TBOWBoONXyer1IRCzniBGeVH1SK7:hbsbV3mESIqnNEH1l
TLSH
T16E03BF32E4A89E338DE2A3C6B14776137FF86057D6800790EDDA1F4E069B59D230B957
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 aa44db8bfe3c612811cded65e943f20644148d38d4bcdc8f60adfc8ec84fffd9
MD5 a4e97a2feb278078d130dff85f41f583
SHA1 7fe8329d5a37990b3ea4b1b73f6962ba506d48b5
SHA512 3a66d77a51409b47ac983605864fdde5d8b2daf74ece2fbf6eb48c71ac2878d18c82d0a7fde396ff136a0c8eacc370fb9b1fa39f3f12a099a2c8e7d172f4d21e
SSDEEP 768:Wrv+4UNbdo3Bu/TBOWBbatUONXyer1IRCzni9Ek:Wbsbe3cpSIqnPk
TLSH
T14003BE31E1699E334CE6A396B1477393BFB820A3C5C40B50EDE95B8E058799E270F917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

771e1b12-d3f4-4267-b73a-fbac0df0c3dd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\771e1b12-d3f4-4267-b73a-fbac0df0c3dd.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 ea13d57b11af249f90704dbcafd354c5e80b10358db7edb9eaf8f6fd597eb1d4
MD5 ae3a19c226264ff6cb64877f1e7e7243
SHA1 f993431dbd09200fd92b7a04ee6711a54ad95cc9
SHA512 97e5dbf0663585afbb5e0f2b5a36192624eb2c898462abef65225987df632d30f74f05ac5a71175c4c59f75d9ae6d2e640d168e479cb26b9a6857c71efda029a
TLSH
T1C1C02B85CB1E0C854E78153D48420B2727819F0030508534445A490C41741CE00888CF
MD5 SHA1 SHA512 TLSH

Submit Download

2026-07-31_c1f917fb76b426d475b1884e6a5d5ff9_amadey_darkgate_elex_hijackloader_luca-stealer_mespinoza_njrat.exe

Path C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\2026-07-31_c1f917fb76b426d475b1884e6a5d5ff9_amadey_darkgate_elex_hijackloader_luca-stealer_mespinoza_njrat.exe
Size 4.8MB
SHA256 86ded7a5081fb2c312b25d62febfa0f6f49cc49bc1516a92316639824b0888b3
MD5 c1f917fb76b426d475b1884e6a5d5ff9
SHA1 604d3522c7b38be642e26200d3d4bc7fd9b9c350
SHA512 41695c47f93c54b760ed7ed1948e0cdf954c0dc24f9479e8a7e0b5066cfc19a3e9ec64c65e2cf55e109c4e8857776e804e010f491453ae5f1cf19bcf9f4258cb
SSDEEP 98304:Ontlj6666666666666666666666666666666x666666666666666fwwwwwwwwwwo:64Xx0djW+UyQ6rjnHqtJRn7ZrHzq8QVs
TLSH
T139368E81F3616134D8BBAAB12D3C6B5609183D67AB31C6DF59C83C7A1E708C21A3DB57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Assistant_130.0.5847.41_Setup.exe_sfx.exe

Path C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202607311207111\assistant\Assistant_130.0.5847.41_Setup.exe_sfx.exe
Size 2.8MB
SHA256 71a4cc628fd1716fd994689c4808d2ebbc00e8bd2ecb7600b9921baa8916c752
MD5 3b028b1188ac321e66add16f8ebadbec
SHA1 086bcb2b1c0d300be15c1390841aadadcec4eac7
SHA512 17c390e0df8e29ff9ad43e581db298ada2d8378fbb890dc5f4b17df8fbe21134f99ab203ea4752a419215d289c128a1d8bc14721bde80042e5bb4c3901dffb72
SSDEEP 49152:+kinoIZOrzV7AlDfo7eT/uAtH00raHx774jx4aGhcr0glyGIGE1HVyVNW272DS/Z:+kiocQzV89Tmeradk2ha0gdIT11yVQ2w
TLSH
T167D5233275A48C34D62312321CE0FAEDA5BE72701E6347DB73A42B1F9EB01979A1D562
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

assistant_installer.exe

Path C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202607311207111\assistant\assistant_installer.exe
Size 2.4MB
SHA256 63187b388e01fb05d8c29957e1c566324af67aff2f7a2e3da9132248c79375a8
MD5 b0408fa2a406f483e42c3ac102d35e9b
SHA1 fbaca900ad54abc65ec2cb34d63727c87132d16b
SHA512 2e8b9af626fff68ecd0204d6a3151b4518749143ec78a2f8f99f959399d1c8ea59987f99c38c9e48fe38b518fd8c91381356daf3f17944fa3432337b882e5401
SSDEEP 49152:wJv8lBbu91xwyiZSwRDzWEibQojjHLQDpizF:wR8lBbu91xwyiZSwRWEKQWjHLOpc
TLSH
T10AC5AE12A86094B5D8563132321DEB3E9A30BE1657354DDBDB90BCC1BBB86E2353734B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dbgcore.DLL

Path C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202607311207111\assistant\dbgcore.DLL
Size 222KB
SHA256 7bb46348c2ec97ef9ee7a8e0ae28c8e069513e8acaee2689134a2d906b5fdecf
MD5 b26ebc5cde9b1726ee9f9534dd6107d0
SHA1 de00af3ec4de63a158bcd50c6e95b046669d3353
SHA512 2e01c65b58369c1f5f4081cf377c3fedd87ae5fca63cfbc44dd7859a1e10a849d1bbdbb592349d793166f577dbd954cd8660f625dcbc9adc4d936d6a44f062bf
SSDEEP 6144:FASh0NdOEQzFh0ekr6nzwBaQGdppLIg2dFl96Fl:4MHZn1n+P96Fl
TLSH
T14C247C2269401533DCEF12F062AF363A96AEDD90239490C359A05BDDD6D4BC12E3D6EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dbghelp.dll

Path C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202607311207111\assistant\dbghelp.dll
Size 1.8MB
SHA256 6fd2b4bfc275ed306ce09008ff8437818b3373e69e4b3db3cbb79be91b2b9308
MD5 021b11c0fc1a09e49a2046ef07d1747a
SHA1 4b955c1e7150db4f07528929fc529fde9738a2b3
SHA512 6ca94fdf2b92928859152aa23f31df46944eeeac7988f6bb5d647341843d8d2aa91c2c810d17c8b58a03c99e4ca7d7e1ae6b6c2d9ea5029616d870b89794d6c8
SSDEEP 49152:xEDlXSohR86M5NKBlv/2yOFVnzM9F0KM7:uFhR86MHyl0fb
TLSH
T128856B20E784813CE4EA1177E67C7A7D85ADE524073440CBAAC45BA978297D32F387DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4c546dbe-6329-42a9-bb67-8ffe9484b804.tmp

Path C:\Users\Admin\AppData\Local\Temp\4c546dbe-6329-42a9-bb67-8ffe9484b804.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

Opera_installer_2607311107085543956.dll

Path C:\Users\Admin\AppData\Local\Temp\Opera_installer_2607311107085543956.dll
Size 4.3MB
SHA256 877ee1927e6995183b505c23c14cc78c789ff62b7333002d15cf39875276d00e
MD5 d132c7759f666451faeb686623cc2eb4
SHA1 c0363749b6142cbeffe81b5bb9206dd30bc02970
SHA512 57512431598bc8da785aff5409ffefc69f3f4957ec4eff0752a067c260ef8fc963ecd8021e2412782f74a889aea670dbbfec7c8d275b697664de28731bcd7c18
SSDEEP 98304:06666666666666666666666666666666x666666666666666fwwwwwwwwwwwwww/:O4Xx0djW+UyQ6rjnHqtJRn7ZrHzq8QVL
TLSH
T1DB267E81F3716134E8BBAAB12C3C6B5609183D679B31C6DF59D83C765A708C22A3DB17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5452_74871310\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports\settings.dat
Size 40B
SHA256 587c18405794b8e9ccd84035df00d8819244aaf4ac646d956356966fc18d54b0
MD5 910802cb4b05a99452ed3a6aa79620ef
SHA1 e74e7ea85391230ad45f36234977b8f09f7f26da
SHA512 98098a68f3aaa56ca0c11b80c80116a8c331828f2b3a00fb961ad384a6651ce51a7c9d38933b2a6172fb70eecd9d61c2e42b470bce39cf53d886aa6fc37dddea
MD5 SHA1 SHA512

Submit Download

memory/3956-0-0x0000000000190000-0x000000000066B000-memory.dmp

Download

memory/4116-4-0x0000000000190000-0x000000000066B000-memory.dmp

Download

memory/4496-11-0x0000000000340000-0x000000000081B000-memory.dmp

Download

memory/4588-79-0x0000000000190000-0x000000000066B000-memory.dmp

Download

memory/5196-75-0x0000000000190000-0x000000000066B000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads