ardamax | 8c870eec48bc4ea1aca1f0c63c8a82aaadaf837f197708a7f0321238da8b6b75

Analysis

max time kernel
106s
max time network
100s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2024 14:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ArdamaxKeylogger_E33AF9E602CBB7AC3634C2608150DD18.exe
Size

783KB
MD5

e33af9e602cbb7ac3634c2608150dd18
SHA1

8f6ec9bc137822bc1ddf439c35fedc3b847ce3fe
SHA256

8c870eec48bc4ea1aca1f0c63c8a82aaadaf837f197708a7f0321238da8b6b75
SHA512

2ae5003e64b525049535ebd5c42a9d1f6d76052cccaa623026758aabe5b1d1b5781ca91c727f3ecb9ac30b829b8ce56f11b177f220330c704915b19b37f8f418
SSDEEP

12288:0E9uQlDTt8c/wtocu3HhGSrIilDhlPnRq/iI7UOvqF8dtbcZl36VBqWPH:FuqD2cYWzBGZohlE/zUD8/bgl2qW/

Score

10^/10

ardamax discovery keylogger persistence stealer

Malware Config

Signatures

Ardamax
A keylogger first seen in 2013.
keylogger stealer ardamax
Ardamax family
ardamax

Ardamax main executable 1 IoCs

resource	yara_rule
behavioral1/files/0x000a000000023bab-12.dat	family_ardamax

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	ArdamaxKeylogger_E33AF9E602CBB7AC3634C2608150DD18.exe

Executes dropped EXE 1 IoCs

pid	Process
2324	DPBJ.exe

Loads dropped DLL 4 IoCs

pid	Process
3204	ArdamaxKeylogger_E33AF9E602CBB7AC3634C2608150DD18.exe
2324	DPBJ.exe
2324	DPBJ.exe
2324	DPBJ.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DPBJ Agent = "C:\\Windows\\SysWOW64\\28463\\DPBJ.exe"	DPBJ.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\28463\Nov_23_2024__14_31_09.jpg	DPBJ.exe
File created	C:\Windows\SysWOW64\28463\Nov_23_2024__14_31_10.jpg	DPBJ.exe
File created	C:\Windows\SysWOW64\28463\Nov_23_2024__14_31_34.jpg	DPBJ.exe
File created	C:\Windows\SysWOW64\28463\Nov_23_2024__14_32_01.jpg	DPBJ.exe
File created	C:\Windows\SysWOW64\28463\Nov_23_2024__14_32_05.jpg	DPBJ.exe
File created	C:\Windows\SysWOW64\28463\Nov_23_2024__14_30_39.jpg	DPBJ.exe
File created	C:\Windows\SysWOW64\28463\Nov_23_2024__14_30_56.jpg	DPBJ.exe
File created	C:\Windows\SysWOW64\28463\Nov_23_2024__14_30_54.jpg	DPBJ.exe
File created	C:\Windows\SysWOW64\28463\Nov_23_2024__14_31_36.jpg	DPBJ.exe
File created	C:\Windows\SysWOW64\28463\Nov_23_2024__14_31_44.jpg	DPBJ.exe
File created	C:\Windows\SysWOW64\28463\Nov_23_2024__14_31_57.jpg	DPBJ.exe
File created	C:\Windows\SysWOW64\28463\Nov_23_2024__14_30_45.jpg	DPBJ.exe
File created	C:\Windows\SysWOW64\28463\Nov_23_2024__14_30_49.jpg	DPBJ.exe
File created	C:\Windows\SysWOW64\28463\Nov_23_2024__14_31_04.jpg	DPBJ.exe
File created	C:\Windows\SysWOW64\28463\Nov_23_2024__14_31_16.jpg	DPBJ.exe
File created	C:\Windows\SysWOW64\28463\Nov_23_2024__14_31_21.jpg	DPBJ.exe
File created	C:\Windows\SysWOW64\28463\Nov_23_2024__14_31_23.jpg	DPBJ.exe
File created	C:\Windows\SysWOW64\28463\Nov_23_2024__14_31_29.jpg	DPBJ.exe
File created	C:\Windows\SysWOW64\28463\Nov_23_2024__14_31_33.jpg	DPBJ.exe
File opened for modification	C:\Windows\SysWOW64\28463	DPBJ.exe
File created	C:\Windows\SysWOW64\28463\Nov_23_2024__14_31_02.jpg	DPBJ.exe
File created	C:\Windows\SysWOW64\28463\Nov_23_2024__14_32_06.jpg	DPBJ.exe
File created	C:\Windows\SysWOW64\28463\Nov_23_2024__14_31_52.jpg	DPBJ.exe
File created	C:\Windows\SysWOW64\28463\Nov_23_2024__14_31_59.jpg	DPBJ.exe
File created	C:\Windows\SysWOW64\28463\Nov_23_2024__14_30_58.jpg	DPBJ.exe
File created	C:\Windows\SysWOW64\28463\Nov_23_2024__14_31_01.jpg	DPBJ.exe
File created	C:\Windows\SysWOW64\28463\Nov_23_2024__14_31_18.jpg	DPBJ.exe
File created	C:\Windows\SysWOW64\28463\Nov_23_2024__14_32_03.jpg	DPBJ.exe
File created	C:\Windows\SysWOW64\28463\Nov_23_2024__14_30_44.jpg	DPBJ.exe
File created	C:\Windows\SysWOW64\28463\Nov_23_2024__14_30_47.jpg	DPBJ.exe
File created	C:\Windows\SysWOW64\28463\Nov_23_2024__14_30_55.jpg	DPBJ.exe
File created	C:\Windows\SysWOW64\28463\Nov_23_2024__14_30_57.jpg	DPBJ.exe
File created	C:\Windows\SysWOW64\28463\Nov_23_2024__14_32_00.jpg	DPBJ.exe
File created	C:\Windows\SysWOW64\28463\Nov_23_2024__14_32_02.jpg	DPBJ.exe
File created	C:\Windows\SysWOW64\28463\DPBJ.009.tmp	DPBJ.exe
File created	C:\Windows\SysWOW64\28463\Nov_23_2024__14_30_36.jpg	DPBJ.exe
File created	C:\Windows\SysWOW64\28463\Nov_23_2024__14_30_38.jpg	DPBJ.exe
File created	C:\Windows\SysWOW64\28463\Nov_23_2024__14_31_07.jpg	DPBJ.exe
File created	C:\Windows\SysWOW64\28463\Nov_23_2024__14_31_15.jpg	DPBJ.exe
File created	C:\Windows\SysWOW64\28463\Nov_23_2024__14_31_28.jpg	DPBJ.exe
File created	C:\Windows\SysWOW64\28463\Nov_23_2024__14_31_30.jpg	DPBJ.exe
File created	C:\Windows\SysWOW64\28463\Nov_23_2024__14_31_31.jpg	DPBJ.exe
File created	C:\Windows\SysWOW64\28463\DPBJ.006	ArdamaxKeylogger_E33AF9E602CBB7AC3634C2608150DD18.exe
File opened for modification	C:\Windows\SysWOW64\28463\DPBJ.009	DPBJ.exe
File created	C:\Windows\SysWOW64\28463\Nov_23_2024__14_31_32.jpg	DPBJ.exe
File created	C:\Windows\SysWOW64\28463\Nov_23_2024__14_31_54.jpg	DPBJ.exe
File created	C:\Windows\SysWOW64\28463\Nov_23_2024__14_30_51.jpg	DPBJ.exe
File created	C:\Windows\SysWOW64\28463\Nov_23_2024__14_30_52.jpg	DPBJ.exe
File created	C:\Windows\SysWOW64\28463\Nov_23_2024__14_31_42.jpg	DPBJ.exe
File created	C:\Windows\SysWOW64\28463\Nov_23_2024__14_31_51.jpg	DPBJ.exe
File created	C:\Windows\SysWOW64\28463\DPBJ.001	ArdamaxKeylogger_E33AF9E602CBB7AC3634C2608150DD18.exe
File created	C:\Windows\SysWOW64\28463\Nov_23_2024__14_30_42.jpg	DPBJ.exe
File created	C:\Windows\SysWOW64\28463\Nov_23_2024__14_31_05.jpg	DPBJ.exe
File created	C:\Windows\SysWOW64\28463\Nov_23_2024__14_31_11.jpg	DPBJ.exe
File created	C:\Windows\SysWOW64\28463\Nov_23_2024__14_31_06.jpg	DPBJ.exe
File created	C:\Windows\SysWOW64\28463\Nov_23_2024__14_31_13.jpg	DPBJ.exe
File created	C:\Windows\SysWOW64\28463\Nov_23_2024__14_31_38.jpg	DPBJ.exe
File created	C:\Windows\SysWOW64\28463\Nov_23_2024__14_31_49.jpg	DPBJ.exe
File created	C:\Windows\SysWOW64\28463\Nov_23_2024__14_31_50.jpg	DPBJ.exe
File created	C:\Windows\SysWOW64\28463\key.bin	ArdamaxKeylogger_E33AF9E602CBB7AC3634C2608150DD18.exe
File created	C:\Windows\SysWOW64\28463\Nov_23_2024__14_30_35.jpg	DPBJ.exe
File created	C:\Windows\SysWOW64\28463\Nov_23_2024__14_30_43.jpg	DPBJ.exe
File created	C:\Windows\SysWOW64\28463\Nov_23_2024__14_31_12.jpg	DPBJ.exe
File created	C:\Windows\SysWOW64\28463\Nov_23_2024__14_30_48.jpg	DPBJ.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DPBJ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ArdamaxKeylogger_E33AF9E602CBB7AC3634C2608150DD18.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 30 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{778E0312-DFF6-448D-1D9A-0CECE8E53E86}	DPBJ.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{2C30D0F4-968F-0F07-7A40-C34E42A5C3C5}\1.0\FLAGS	DPBJ.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{778E0312-DFF6-448D-1D9A-0CECE8E53E86}\TypeLib	DPBJ.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{778E0312-DFF6-448D-1D9A-0CECE8E53E86}\LocalServer32	DPBJ.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{778E0312-DFF6-448D-1D9A-0CECE8E53E86}\TypeLib\ = "{2C30D0F4-968F-0F07-7A40-C34E42A5C3C5}"	DPBJ.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{778E0312-DFF6-448D-1D9A-0CECE8E53E86}\VersionIndependentProgID\ = "FileSyncCustomStatesProvider.FileSyncCustomStatesProvider"	DPBJ.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{778E0312-DFF6-448D-1D9A-0CECE8E53E86}\ = "Taseffat.Ajikevir"	DPBJ.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{778E0312-DFF6-448D-1D9A-0CECE8E53E86}\LocalServer32\	DPBJ.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{2C30D0F4-968F-0F07-7A40-C34E42A5C3C5}\1.0\0	DPBJ.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{778E0312-DFF6-448D-1D9A-0CECE8E53E86}\ProgID	DPBJ.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{2C30D0F4-968F-0F07-7A40-C34E42A5C3C5}	DPBJ.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{778E0312-DFF6-448D-1D9A-0CECE8E53E86}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\18.151.0729.0013\\FileCoAuth.exe"	DPBJ.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{2C30D0F4-968F-0F07-7A40-C34E42A5C3C5}\	DPBJ.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{2C30D0F4-968F-0F07-7A40-C34E42A5C3C5}\1.0\	DPBJ.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{2C30D0F4-968F-0F07-7A40-C34E42A5C3C5}\1.0\ = "iextag 1.0 Type Library"	DPBJ.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{778E0312-DFF6-448D-1D9A-0CECE8E53E86}\TypeLib\	DPBJ.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{778E0312-DFF6-448D-1D9A-0CECE8E53E86}\VersionIndependentProgID\	DPBJ.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{778E0312-DFF6-448D-1D9A-0CECE8E53E86}\ProgID\ = "FileSyncCustomStatesProvider.FileSyncCustomStatesProvider.1"	DPBJ.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{2C30D0F4-968F-0F07-7A40-C34E42A5C3C5}\1.0\0\win32\	DPBJ.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{2C30D0F4-968F-0F07-7A40-C34E42A5C3C5}\1.0\0\win64\ = "C:\\Windows\\SysWow64\\iepeers.dll"	DPBJ.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{2C30D0F4-968F-0F07-7A40-C34E42A5C3C5}\1.0\FLAGS\ = "0"	DPBJ.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{778E0312-DFF6-448D-1D9A-0CECE8E53E86}\ProgID\	DPBJ.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{2C30D0F4-968F-0F07-7A40-C34E42A5C3C5}\1.0	DPBJ.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{2C30D0F4-968F-0F07-7A40-C34E42A5C3C5}\1.0\0\	DPBJ.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{2C30D0F4-968F-0F07-7A40-C34E42A5C3C5}\1.0\0\win32	DPBJ.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{2C30D0F4-968F-0F07-7A40-C34E42A5C3C5}\1.0\0\win64	DPBJ.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{2C30D0F4-968F-0F07-7A40-C34E42A5C3C5}\1.0\0\win64\	DPBJ.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{2C30D0F4-968F-0F07-7A40-C34E42A5C3C5}\1.0\0\win32\ = "C:\\Windows\\SysWOW64\\iepeers.dll"	DPBJ.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{2C30D0F4-968F-0F07-7A40-C34E42A5C3C5}\1.0\FLAGS\	DPBJ.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{778E0312-DFF6-448D-1D9A-0CECE8E53E86}\VersionIndependentProgID	DPBJ.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4468	msedge.exe
4468	msedge.exe
3468	msedge.exe
3468	msedge.exe
756	identity_helper.exe
756	identity_helper.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2324	DPBJ.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	2324	DPBJ.exe
Token: SeIncBasePriorityPrivilege	2324	DPBJ.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
2324	DPBJ.exe
2324	DPBJ.exe
2324	DPBJ.exe
2324	DPBJ.exe
2324	DPBJ.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3204 wrote to memory of 2324	3204	ArdamaxKeylogger_E33AF9E602CBB7AC3634C2608150DD18.exe	82
PID 3204 wrote to memory of 2324	3204	ArdamaxKeylogger_E33AF9E602CBB7AC3634C2608150DD18.exe	82
PID 3204 wrote to memory of 2324	3204	ArdamaxKeylogger_E33AF9E602CBB7AC3634C2608150DD18.exe	82
PID 3468 wrote to memory of 2336	3468	msedge.exe	91
PID 3468 wrote to memory of 2336	3468	msedge.exe	91
PID 3468 wrote to memory of 2800	3468	msedge.exe	92
PID 3468 wrote to memory of 2800	3468	msedge.exe	92
PID 3468 wrote to memory of 2800	3468	msedge.exe	92
PID 3468 wrote to memory of 2800	3468	msedge.exe	92
PID 3468 wrote to memory of 2800	3468	msedge.exe	92
PID 3468 wrote to memory of 2800	3468	msedge.exe	92
PID 3468 wrote to memory of 2800	3468	msedge.exe	92
PID 3468 wrote to memory of 2800	3468	msedge.exe	92
PID 3468 wrote to memory of 2800	3468	msedge.exe	92
PID 3468 wrote to memory of 2800	3468	msedge.exe	92
PID 3468 wrote to memory of 2800	3468	msedge.exe	92
PID 3468 wrote to memory of 2800	3468	msedge.exe	92
PID 3468 wrote to memory of 2800	3468	msedge.exe	92
PID 3468 wrote to memory of 2800	3468	msedge.exe	92
PID 3468 wrote to memory of 2800	3468	msedge.exe	92
PID 3468 wrote to memory of 2800	3468	msedge.exe	92
PID 3468 wrote to memory of 2800	3468	msedge.exe	92
PID 3468 wrote to memory of 2800	3468	msedge.exe	92
PID 3468 wrote to memory of 2800	3468	msedge.exe	92
PID 3468 wrote to memory of 2800	3468	msedge.exe	92
PID 3468 wrote to memory of 2800	3468	msedge.exe	92
PID 3468 wrote to memory of 2800	3468	msedge.exe	92
PID 3468 wrote to memory of 2800	3468	msedge.exe	92
PID 3468 wrote to memory of 2800	3468	msedge.exe	92
PID 3468 wrote to memory of 2800	3468	msedge.exe	92
PID 3468 wrote to memory of 2800	3468	msedge.exe	92
PID 3468 wrote to memory of 2800	3468	msedge.exe	92
PID 3468 wrote to memory of 2800	3468	msedge.exe	92
PID 3468 wrote to memory of 2800	3468	msedge.exe	92
PID 3468 wrote to memory of 2800	3468	msedge.exe	92
PID 3468 wrote to memory of 2800	3468	msedge.exe	92
PID 3468 wrote to memory of 2800	3468	msedge.exe	92
PID 3468 wrote to memory of 2800	3468	msedge.exe	92
PID 3468 wrote to memory of 2800	3468	msedge.exe	92
PID 3468 wrote to memory of 2800	3468	msedge.exe	92
PID 3468 wrote to memory of 2800	3468	msedge.exe	92
PID 3468 wrote to memory of 2800	3468	msedge.exe	92
PID 3468 wrote to memory of 2800	3468	msedge.exe	92
PID 3468 wrote to memory of 2800	3468	msedge.exe	92
PID 3468 wrote to memory of 2800	3468	msedge.exe	92
PID 3468 wrote to memory of 4468	3468	msedge.exe	93
PID 3468 wrote to memory of 4468	3468	msedge.exe	93
PID 3468 wrote to memory of 3188	3468	msedge.exe	94
PID 3468 wrote to memory of 3188	3468	msedge.exe	94
PID 3468 wrote to memory of 3188	3468	msedge.exe	94
PID 3468 wrote to memory of 3188	3468	msedge.exe	94
PID 3468 wrote to memory of 3188	3468	msedge.exe	94
PID 3468 wrote to memory of 3188	3468	msedge.exe	94
PID 3468 wrote to memory of 3188	3468	msedge.exe	94
PID 3468 wrote to memory of 3188	3468	msedge.exe	94
PID 3468 wrote to memory of 3188	3468	msedge.exe	94
PID 3468 wrote to memory of 3188	3468	msedge.exe	94
PID 3468 wrote to memory of 3188	3468	msedge.exe	94
PID 3468 wrote to memory of 3188	3468	msedge.exe	94
PID 3468 wrote to memory of 3188	3468	msedge.exe	94
PID 3468 wrote to memory of 3188	3468	msedge.exe	94
PID 3468 wrote to memory of 3188	3468	msedge.exe	94
PID 3468 wrote to memory of 3188	3468	msedge.exe	94
PID 3468 wrote to memory of 3188	3468	msedge.exe	94

C:\Users\Admin\AppData\Local\Temp\ArdamaxKeylogger_E33AF9E602CBB7AC3634C2608150DD18.exe
"C:\Users\Admin\AppData\Local\Temp\ArdamaxKeylogger_E33AF9E602CBB7AC3634C2608150DD18.exe"
1⤵
- Checks computer location settings
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3204
- C:\Windows\SysWOW64\28463\DPBJ.exe
  "C:\Windows\system32\28463\DPBJ.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2324

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffaa2a346f8,0x7ffaa2a34708,0x7ffaa2a34718
  2⤵
  PID:2336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2180,14708019125828611569,11941165712288543954,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2192 /prefetch:2
  2⤵
  PID:2800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2180,14708019125828611569,11941165712288543954,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2244 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2180,14708019125828611569,11941165712288543954,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2784 /prefetch:8
  2⤵
  PID:3188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,14708019125828611569,11941165712288543954,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3416 /prefetch:1
  2⤵
  PID:1920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,14708019125828611569,11941165712288543954,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3436 /prefetch:1
  2⤵
  PID:2704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,14708019125828611569,11941165712288543954,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4240 /prefetch:1
  2⤵
  PID:3940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,14708019125828611569,11941165712288543954,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5048 /prefetch:1
  2⤵
  PID:2624
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2180,14708019125828611569,11941165712288543954,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4008 /prefetch:8
  2⤵
  PID:3896
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2180,14708019125828611569,11941165712288543954,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4008 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,14708019125828611569,11941165712288543954,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4040 /prefetch:1
  2⤵
  PID:3604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,14708019125828611569,11941165712288543954,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5628 /prefetch:1
  2⤵
  PID:3592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,14708019125828611569,11941165712288543954,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5416 /prefetch:1
  2⤵
  PID:2704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,14708019125828611569,11941165712288543954,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3416 /prefetch:1
  2⤵
  PID:3424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,14708019125828611569,11941165712288543954,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5256 /prefetch:1
  2⤵
  PID:1728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,14708019125828611569,11941165712288543954,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3564 /prefetch:1
  2⤵
  PID:2396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,14708019125828611569,11941165712288543954,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5212 /prefetch:1
  2⤵
  PID:3004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,14708019125828611569,11941165712288543954,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5840 /prefetch:1
  2⤵
  PID:4972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,14708019125828611569,11941165712288543954,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5408 /prefetch:1
  2⤵
  PID:3532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,14708019125828611569,11941165712288543954,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5464 /prefetch:1
  2⤵
  PID:4536

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3660

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:864

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ba6ef346187b40694d493da98d5da979

SHA1
643c15bec043f8673943885199bb06cd1652ee37

SHA256
d86eec91f295dfda8ed1c5fa99de426f2fe359282c7ebf67e3a40be739475d73

SHA512
2e6cc97330be8868d4b9c53be7e12c558f6eb1ac2c4080a611ba6c43561d0c5bb4791b8a11a8c2371599f0ba73ed1d9a7a2ea6dee2ae6a080f1912e0cb1f656c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b8880802fc2bb880a7a869faa01315b0

SHA1
51d1a3fa2c272f094515675d82150bfce08ee8d3

SHA256
467b8cd4aacac66557712f9843023dcedefcc26efc746f3e44157bc8dac73812

SHA512
e1c6dba2579357ba70de58968b167d2c529534d24bff70568144270c48ac18a48ee2af2d58d78ae741e5a36958fa78a57955bd2456f1df00b781fc1002e123d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\82ec7ed0-db27-47b2-8cc2-ca5ac1fae6b3.tmp

Filesize
6KB

MD5
316ae6aaa246133242c0efb88eb2ec71

SHA1
ce8d216bd16cb00f690b1f1653cd09bdfe2ad272

SHA256
903df833842b34697bfec3a49d22668c139c6a1367ee3a4e6c68763104a769ff

SHA512
1b06ed68c717c53bb32334445bb9b8697a9fe582f0491a71df164d6f3477c31849759a829994411ec028a2f7ff004590f3e81f88ead5cb1eb5c2eed21aca3c89

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
0da5f872c0e49e441263e6b8f42b82ef

SHA1
fb7887367f50e13a6049ccfdc1eaebcdade73e5c

SHA256
ef88977a663da0111d3493c34e0eab7d41ecf88ad9bf0e322f0e027b867ad8c0

SHA512
14498ae8083d2f17a390a65636463fc498d36e57c69360e0d0831d87ee7c0f26a4c1fe59850b60e9450a7642ef62b8aa0cbc3540be533bf7ea8681b031291217

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
766B

MD5
9e89203c50bb3f2c5290ba635ae12943

SHA1
4643d1b64434ce3685df763742be0d95a3f17a7c

SHA256
d676a720815e83203b814edcd5d790bca06d0291dbc966abd9b9986049fd7251

SHA512
c7af7b5f8addc2f9b65f2bef118132a89e23e7b2c49f478dbd5868e85a497359240489a213cd9defcf50c6174a1c38b020ebfe11e5ec8d1cdb389f1093c2753a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d748772c880b54e6b70da6d5795ad2df

SHA1
6d53061db994192ffa88e22183b52c78fb850e71

SHA256
e220cc55ba77a6d554bafe75a494d7aff7eea56336b0dc39c287ef4556ac685a

SHA512
7d684fb5e5f6c03ea41ea9ac8019863908a269b213828c0c77f8bd4d6e846d12f1956c5fca0c71427d8e94a21522c70bcc58955759354f37f0170046bf14a60e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
11b2bb3cf1a9a845ff1ac71480b48c5f

SHA1
a793216aeb0283b82949b60f3080ffeda5e19a1a

SHA256
8e7254bd88bbf4cdac802b4af73726675461995f062e4b38c65921aee6745f3f

SHA512
419cd4b864b3a68eff3543122b857e015d99aa376189e91abc51bc2644a1df2dca636af578a1716f396a3024a53370b90837ab2796c5d868605fb3dcf7811457

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
9de189c1ff41fb44e49c5d4fbd070558

SHA1
cedbd0e9a670fccf25837b8e4d52ce6cfe2ef766

SHA256
eb370d8863d63fb9c9818ae34d437d6046ae70d8070c01e953e402cd9f78914d

SHA512
22b187268f02571cec18977b12848744b3c8f2e5857da4df3a51e87c77fa5c3f2a19708461a653cfe648e1f733a8a7804b51835522470b795a962974059f7c39

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
d3f7b14e4b54313890235c7bc8c7baec

SHA1
b7d5edf92d11ac3f883712dacb1a01184e091838

SHA256
d5ffb687d0d2f774d57d2e1faa0bcf4e5042176e7e98e01c2a8e6fa8ace1d997

SHA512
599b12e200178c71b75d100c9c2f7b2cb2fa7d25f0cad1fda42049086f947583708556e1d68a5f711c07055cb06fb58be64697fbfbce9365fd547f3310ba071d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe582824.TMP

Filesize
1KB

MD5
7bc405c49d8375f30fffa17c640ebfa8

SHA1
e9f1324f4083cfb9b3bee6b87841138f8b0d5e7d

SHA256
7e95cbdeafe0afbc409faa1a48e50dcfa2221475ed7202fd2a063a04533bd68e

SHA512
7b1b6690dd42bbdc73b343c620f3aca50cc200c8391a1028dd0c52da630b306c0f4cb929478dda4f9e5d17e0dff7ac9a970408da0ee68a3f558a152425cd825a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
c33cbfd2d129ecabaaffa8f94bf29af6

SHA1
e6f25b37dd215985650dbb1a7b7a2d19e5876605

SHA256
21beee146f5f26eb0207adf635a421e025ed78faebeed26ba5286ee5b110fe33

SHA512
83eb47d5035205ca96ab051f1aaeb3af46cf4a93ed7e93e70ef71abdabfbd8ba358d4efc70718482d198878f5d350e4371d2191dc24b5261555b999825d7df89

Download Submit
C:\Users\Admin\AppData\Local\Temp\@7BF6.tmp

Filesize
4KB

MD5
d73d89b1ea433724795b3d2b524f596c

SHA1
213514f48ece9f074266b122ee2d06e842871c8c

SHA256
8aef975a94c800d0e3e4929999d05861868a7129b766315c02a48a122e3455d6

SHA512
8b73be757ad3e0f2b29c0b130918e8f257375f9f3bf7b9609bac24b17369de2812341651547546af238936d70f38f050d6984afd16d47b467bcbba4992e42f41

Download Submit
C:\Windows\SysWOW64\28463\AKV.exe

Filesize
457KB

MD5
97eee85d1aebf93d5d9400cb4e9c771b

SHA1
26fa2bf5fce2d86b891ac0741a6999bff31397de

SHA256
30df6c8cbd255011d80fa6e959179d47c458bc4c4d9e78c4cf571aa611cd7d24

SHA512
8cecc533c07c91c67b93a7ae46102a0aae7f4d3d88d04c250231f0bcd8e1f173daf06e94b5253a66db3f2a052c51e62154554368929294178d2b3597c1cca7e6

Download Submit
C:\Windows\SysWOW64\28463\DPBJ.001

Filesize
492B

MD5
7a0f1fa20fd40c047b07379da5290f2b

SHA1
e0fb8305de6b661a747d849edb77d95959186fca

SHA256
b0ad9e9d3d51e8434cc466bec16e2b94fc2d03bab03b48ccf57db86ae8e2c9b6

SHA512
bb5b3138b863811a8b9dcba079ac8a2828dae73943a1cc1d107d27faca509fda9f03409db7c23d5d70b48d299146de14b656314a24b854f3ae4fdb6ef6770346

Download Submit
C:\Windows\SysWOW64\28463\DPBJ.006

Filesize
8KB

MD5
35b24c473bdcdb4411e326c6c437e8ed

SHA1
ec1055365bc2a66e52de2d66d24d742863c1ce3d

SHA256
4530fcc91e4d0697a64f5e24d70e2b327f0acab1a9013102ff04236841c5a617

SHA512
32722f1484013bbc9c1b41b3fdaf5cd244ec67facaa2232be0e90455719d664d65cae1cd670adf5c40c67f568122d910b30e3e50f7cc06b0350a6a2d34d371de

Download Submit
C:\Windows\SysWOW64\28463\DPBJ.007

Filesize
5KB

MD5
a8e19de6669e831956049685225058a8

SHA1
6d2546d49d92b18591ad4fedbc92626686e7e979

SHA256
34856528d8b7e31caa83f350bc4dbc861120dc2da822a9eb896b773bc7e1f564

SHA512
5c407d4aa5731bd62c2a1756127f794382dc5e2b214298acfa68698c709fbbe3f2aa8dbdcbef02ed2a49f8f35969959946e9f727895bdca4500d16e84f4ef2e8

Download Submit
C:\Windows\SysWOW64\28463\DPBJ.009

Filesize
1.6MB

MD5
50972c0ff3f1bd871625cd8c354b7ccb

SHA1
024bc33ff854b7946d37d99bfd8e0dacc4188f7a

SHA256
3b7dc674322e6ec07395832f7a543baada7edb802c1e516af6e1f67133166673

SHA512
583d0e85134a63c12d203f1870d754d9144170d9222725d1eb7f882be678e5c1a40c1b6a40dfb14e3cb6d53961613b96a6fa57b7d04b3d58a3dcc9508bae9fd0

Download Submit
C:\Windows\SysWOW64\28463\DPBJ.exe

Filesize
646KB

MD5
b863a9ac3bcdcde2fd7408944d5bf976

SHA1
4bd106cd9aefdf2b51f91079760855e04f73f3b0

SHA256
0fe8e3cd44a89c15dec75ff2949bac1a96e1ea7e0040f74df3230569ac9e37b0

SHA512
4b30c3b119c1e7b2747d2745b2b79c61669a33b84520b88ab54257793e3ed6e76378dea2b8ff048cb1822187ffdc20e921d658bb5b0482c23cfa7d70f4e7aa1a

Download Submit
C:\Windows\SysWOW64\28463\Nov_23_2024__14_30_39.jpg

Filesize
122KB

MD5
8b57ab61472ec500f3e80d2baae501e4

SHA1
84b8e595ef47f331642c9c3cd0a5b32c7ba86025

SHA256
fc04678487c4098a0046dcceed44ff26c1f0bb36ed40be8cc0ea3226e50ab4b4

SHA512
16c6a2700f6be69fbf9b35560a1f687845e0f6516d8a8df4ba52e67d6961675d88167b1adc47394db36caa28242fe7181eaa4ed136807497bd8d7534111581ea

Download Submit
C:\Windows\SysWOW64\28463\Nov_23_2024__14_30_44.jpg

Filesize
144KB

MD5
c8ea22acce1eb3333bee70801363c2a7

SHA1
a9aaf87e06d46805c9c8b260e8ee579f76f33773

SHA256
0faba666db3568c47b130772ed2650fb02da71a0a26a5ecf20a7ce1624ff56b7

SHA512
59901978c6384e2a02968660a890c4c6f32b8cd9615207407d358e464bfd3139ad5972341ebbe1434a1bb4309684441f79999679b32873f19026908b371f1299

Download Submit
C:\Windows\SysWOW64\28463\Nov_23_2024__14_30_48.jpg

Filesize
134KB

MD5
8c0aa71ea4b381e9236dcafdcc7f5c74

SHA1
605acb1113cedcb20ef29984d8f33596864ba4d7

SHA256
914975b8c4be6181d4634c2a0f4856b0d73909b16f441e098f0cf05cf11ce41b

SHA512
4228cc7ad4307ea044b7d5bbbf30270da8241db5e83459853e893d017ce7a95b96e4ffc83bf1b5965a99846fc20a61bd726077c71893d5fd630e6438c0010c3d

Download Submit
C:\Windows\SysWOW64\28463\Nov_23_2024__14_30_52.jpg

Filesize
139KB

MD5
486e68f271f07515b406db774f44c514

SHA1
a821f2f873073211b9700ea4a19936bf62c9f5bc

SHA256
403397014717ee9d3c5f0c89cad7b4062ab3032eee1e1a775fdf87faad8336eb

SHA512
89c0bca12846634315b8baf669cffc6786dffd1e298bd6a9bda0436f72e56c8a701ed65718aa3604ee737078c11f0fa41243df6de28376a5b57d5c46831688f1

Download Submit
C:\Windows\SysWOW64\28463\Nov_23_2024__14_31_01.jpg

Filesize
126KB

MD5
7663cfc0af159171d2edbdf13ea3df9b

SHA1
459cad73397dbcc2a34ce672f23c2fa5a4485e45

SHA256
a65751c990b422a10288e62e0512691264bba060afe471168ae1e3440a8d949a

SHA512
1f872a58df775dca518e4e40d51e19201ce79a2edf83e2afccbbf7e05f4a09ad2bcb60b2b20a1191f6abf9a67f91786d223029ff458f92169fef3823e1df745b

Download Submit
C:\Windows\SysWOW64\28463\key.bin

Filesize
106B

MD5
639d75ab6799987dff4f0cf79fa70c76

SHA1
be2678476d07f78bb81e8813c9ee2bfff7cc7efb

SHA256
fc42ab050ffdfed8c8c7aac6d7e4a7cad4696218433f7ca327bcfdf9f318ac98

SHA512
4b511d0330d7204af948ce7b15615d745e8d4ea0a73bbece4e00fb23ba2635dd99e4fa54a76236d6f74bdbcdba57d32fd4c36b608d52628e72d11d5ed6f8cde2

Download Submit
memory/2324-24-0x0000000002550000-0x0000000002551000-memory.dmp

Filesize
4KB

Download
memory/2324-52-0x00000000033A0000-0x00000000033A1000-memory.dmp

Filesize
4KB

Download
memory/2324-49-0x00000000022F0000-0x000000000234A000-memory.dmp

Filesize
360KB

Download
memory/2324-47-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/2324-33-0x0000000000530000-0x0000000000531000-memory.dmp

Filesize
4KB

Download
memory/2324-79-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/2324-34-0x0000000003370000-0x0000000003371000-memory.dmp

Filesize
4KB

Download
memory/2324-35-0x00000000006B0000-0x00000000006B1000-memory.dmp

Filesize
4KB

Download
memory/2324-36-0x00000000033B0000-0x00000000033B1000-memory.dmp

Filesize
4KB

Download
memory/2324-212-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/2324-23-0x0000000002500000-0x0000000002501000-memory.dmp

Filesize
4KB

Download
memory/2324-25-0x0000000002540000-0x0000000002541000-memory.dmp

Filesize
4KB

Download
memory/2324-26-0x0000000002560000-0x0000000002561000-memory.dmp

Filesize
4KB

Download
memory/2324-394-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/2324-27-0x0000000002520000-0x0000000002521000-memory.dmp

Filesize
4KB

Download
memory/2324-28-0x00000000024E0000-0x00000000024E1000-memory.dmp

Filesize
4KB

Download
memory/2324-29-0x0000000003360000-0x0000000003361000-memory.dmp

Filesize
4KB

Download
memory/2324-30-0x0000000003350000-0x0000000003353000-memory.dmp

Filesize
12KB

Download
memory/2324-31-0x00000000033A0000-0x00000000033A1000-memory.dmp

Filesize
4KB

Download
memory/2324-32-0x00000000033A0000-0x00000000033A1000-memory.dmp

Filesize
4KB

Download
memory/2324-577-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/2324-21-0x00000000022F0000-0x000000000234A000-memory.dmp

Filesize
360KB

Download
memory/2324-20-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/2324-805-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download