ardamax | 11f5b5ebfc2f25bf32e675728d4faa069311cefb66825f32106adf237d70a2e7

Analysis

max time kernel
150s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20250207-en
resource tags

arch:x64arch:x86image:win10v2004-20250207-enlocale:en-usos:windows10-2004-x64system
submitted
08-02-2025 09:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_c1afd5d05b62a7b9fbbdf7935775c5c8.exe
Size

1.3MB
MD5

c1afd5d05b62a7b9fbbdf7935775c5c8
SHA1

641c7c01c6b93b72d761748a16c0fd416889fe40
SHA256

11f5b5ebfc2f25bf32e675728d4faa069311cefb66825f32106adf237d70a2e7
SHA512

5cd2d62ecbcc31f607e4139ea69a9a3d778d8f9f93e35eb9d3f669f1ea8a4f695fa6312090a502dc39353cdc143dfb8739fd6af8e745e3888e731041a7865992
SSDEEP

24576:bswyOQUyohQ9BO7Qtj6VUBYaff0Lo0Udkw/J8nPXJUF/8zhYWf:bpJQUt+UQtjOU2aff0c0Udkwnqm2

Score

10^/10

ardamax discovery keylogger persistence stealer

Malware Config

Signatures

Ardamax
A keylogger first seen in 2013.
keylogger stealer ardamax
Ardamax family
ardamax

Ardamax main executable 1 IoCs

resource	yara_rule
behavioral2/files/0x0010000000023c29-154.dat	family_ardamax

Adds policy Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2499155680-3253481302-763015360-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2499155680-3253481302-763015360-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\WindowsUptade = "C:\\Program Files (x86)\\WindowsUptade\\winuptade.exe.exe"	iexplore.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	iexplore.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\WindowsUptade = "C:\\Program Files (x86)\\WindowsUptade\\winuptade.exe.exe"	iexplore.exe

Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{2QC7VJIW-12CR-3VO0-0HYY-F3I775DYWLEN}	iexplore.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2QC7VJIW-12CR-3VO0-0HYY-F3I775DYWLEN}\StubPath = "C:\\Program Files (x86)\\WindowsUptade\\winuptade.exe.exe Restart"	iexplore.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{2QC7VJIW-12CR-3VO0-0HYY-F3I775DYWLEN}	POL.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2QC7VJIW-12CR-3VO0-0HYY-F3I775DYWLEN}\StubPath = "C:\\Program Files (x86)\\WindowsUptade\\winuptade.exe.exe Restart"	POL.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
42	5720	Process not Found

Executes dropped EXE 4 IoCs

pid	Process
464	silent_akl.exe
4348	POL.exe
1136	NEW.exe
5060	NEW.exe

Loads dropped DLL 4 IoCs

pid	Process
464	silent_akl.exe
4348	POL.exe
1840	iexplore.exe
1840	iexplore.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\POL Agent = "C:\\Program Files (x86)\\POL\\POL.exe"	POL.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUptade = "C:\\Program Files (x86)\\WindowsUptade\\winuptade.exe.exe"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2499155680-3253481302-763015360-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsUptade = "C:\\Program Files (x86)\\WindowsUptade\\winuptade.exe.exe"	iexplore.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1136 set thread context of 5060	1136	NEW.exe	101

Drops file in Program Files directory 19 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\POL\POL.003	silent_akl.exe
File created	C:\Program Files (x86)\POL\POL.007	silent_akl.exe
File created	C:\Program Files (x86)\POL\POL.chm	silent_akl.exe
File created	C:\Program Files (x86)\WindowsUptade\winuptade.exe.exe	iexplore.exe
File opened for modification	C:\Program Files (x86)\WindowsUptade\	iexplore.exe
File created	C:\Program Files (x86)\POL\POL.exe	silent_akl.exe
File created	C:\Program Files (x86)\POL\POL.006	silent_akl.exe
File created	C:\Program Files (x86)\POL\POL.001	POL.exe
File opened for modification	C:\Program Files (x86)\WindowsUptade\winuptade.exe.exe	iexplore.exe
File opened for modification	C:\Program Files (x86)\WindowsUptade\plugin.dat	iexplore.exe
File created	C:\Program Files (x86)\WindowsUptade\logs.dat	iexplore.exe
File created	C:\Program Files (x86)\POL\POL.004	silent_akl.exe
File created	C:\Program Files (x86)\POL\qs.html	silent_akl.exe
File created	C:\Program Files (x86)\POL\tray.gif	silent_akl.exe
File created	C:\Program Files (x86)\POL\Uninstall.exe	silent_akl.exe
File opened for modification	C:\Program Files (x86)\POL	POL.exe
File opened for modification	C:\Program Files (x86)\WindowsUptade\logs.dat	iexplore.exe
File created	C:\Program Files (x86)\POL\AKV.exe	silent_akl.exe
File created	C:\Program Files (x86)\POL\menu.gif	silent_akl.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NEW.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NEW.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	iexplore.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_c1afd5d05b62a7b9fbbdf7935775c5c8.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	silent_akl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	POL.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
5872	MicrosoftEdgeUpdate.exe

NSIS installer 4 IoCs

installer

resource	yara_rule
behavioral2/files/0x0009000000023d67-5.dat	nsis_installer_1
behavioral2/files/0x0009000000023d67-5.dat	nsis_installer_2
behavioral2/files/0x000b000000023c6e-222.dat	nsis_installer_1
behavioral2/files/0x000b000000023c6e-222.dat	nsis_installer_2

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 32 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{94F1B03E-9DEF-420B-1996-517CF3E313E4}\InprocServer32\	POL.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{94F1B03E-9DEF-420B-1996-517CF3E313E4}\ProgID	POL.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{94F1B03E-9DEF-420B-1996-517CF3E313E4}\Programmable	POL.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F71E2610-5E03-7988-0385-50956A11F756}\1.0\0\win32	POL.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{94F1B03E-9DEF-420B-1996-517CF3E313E4}\InprocServer32	POL.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{94F1B03E-9DEF-420B-1996-517CF3E313E4}\Version	POL.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{94F1B03E-9DEF-420B-1996-517CF3E313E4}\VersionIndependentProgID\ = "IMAPI2.MsftDiscFormat2Data"	POL.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{94F1B03E-9DEF-420B-1996-517CF3E313E4}\ProgID\	POL.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F71E2610-5E03-7988-0385-50956A11F756}	POL.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F71E2610-5E03-7988-0385-50956A11F756}\1.0\ = "Windows Media Player"	POL.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F71E2610-5E03-7988-0385-50956A11F756}\1.0\FLAGS	POL.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{94F1B03E-9DEF-420B-1996-517CF3E313E4}\Version\	POL.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{94F1B03E-9DEF-420B-1996-517CF3E313E4}\VersionIndependentProgID	POL.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{94F1B03E-9DEF-420B-1996-517CF3E313E4}\InprocServer32\ = "C:\\Windows\\SysWOW64\\imapi2.dll"	POL.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F71E2610-5E03-7988-0385-50956A11F756}\1.0\0\win32\ = "%SystemRoot%\\SysWow64\\wmp.dll"	POL.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F71E2610-5E03-7988-0385-50956A11F756}\1.0\FLAGS\ = "0"	POL.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F71E2610-5E03-7988-0385-50956A11F756}\	POL.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F71E2610-5E03-7988-0385-50956A11F756}\1.0\0\win32\	POL.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{94F1B03E-9DEF-420B-1996-517CF3E313E4}\ProgID\ = "IMAPI2.MsftDiscFormat2Data.1"	POL.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F71E2610-5E03-7988-0385-50956A11F756}\1.0	POL.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F71E2610-5E03-7988-0385-50956A11F756}\1.0\	POL.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{94F1B03E-9DEF-420B-1996-517CF3E313E4}\TypeLib	POL.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{94F1B03E-9DEF-420B-1996-517CF3E313E4}\TypeLib\	POL.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{94F1B03E-9DEF-420B-1996-517CF3E313E4}\VersionIndependentProgID\	POL.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{94F1B03E-9DEF-420B-1996-517CF3E313E4}	POL.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{94F1B03E-9DEF-420B-1996-517CF3E313E4}\ = "Nesaf object"	POL.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F71E2610-5E03-7988-0385-50956A11F756}\1.0\0	POL.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F71E2610-5E03-7988-0385-50956A11F756}\1.0\0\	POL.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{94F1B03E-9DEF-420B-1996-517CF3E313E4}\Version\ = "1.0"	POL.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{94F1B03E-9DEF-420B-1996-517CF3E313E4}\Programmable\	POL.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F71E2610-5E03-7988-0385-50956A11F756}\1.0\FLAGS\	POL.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{94F1B03E-9DEF-420B-1996-517CF3E313E4}\TypeLib\ = "{F71E2610-5E03-7988-0385-50956A11F756}"	POL.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
1520	msedge.exe
1520	msedge.exe
4956	msedge.exe
4956	msedge.exe
5060	NEW.exe
5060	NEW.exe
5060	NEW.exe
5060	NEW.exe
5060	NEW.exe
5060	NEW.exe
5348	identity_helper.exe
5348	identity_helper.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1840	iexplore.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	5060	NEW.exe
Token: SeDebugPrivilege	5060	NEW.exe
Token: 33	4348	POL.exe
Token: SeIncBasePriorityPrivilege	4348	POL.exe
Token: SeDebugPrivilege	5060	NEW.exe
Token: SeDebugPrivilege	5060	NEW.exe
Token: SeDebugPrivilege	1840	iexplore.exe
Token: SeDebugPrivilege	1840	iexplore.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4348	POL.exe

Suspicious use of SendNotifyMessage 25 IoCs

pid	Process
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4348	POL.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
1136	NEW.exe
4348	POL.exe
4348	POL.exe
4348	POL.exe
4348	POL.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5020 wrote to memory of 464	5020	JaffaCakes118_c1afd5d05b62a7b9fbbdf7935775c5c8.exe	86
PID 5020 wrote to memory of 464	5020	JaffaCakes118_c1afd5d05b62a7b9fbbdf7935775c5c8.exe	86
PID 5020 wrote to memory of 464	5020	JaffaCakes118_c1afd5d05b62a7b9fbbdf7935775c5c8.exe	86
PID 464 wrote to memory of 4348	464	silent_akl.exe	94
PID 464 wrote to memory of 4348	464	silent_akl.exe	94
PID 464 wrote to memory of 4348	464	silent_akl.exe	94
PID 464 wrote to memory of 4956	464	silent_akl.exe	95
PID 464 wrote to memory of 4956	464	silent_akl.exe	95
PID 4956 wrote to memory of 3968	4956	msedge.exe	96
PID 4956 wrote to memory of 3968	4956	msedge.exe	96
PID 5020 wrote to memory of 1136	5020	JaffaCakes118_c1afd5d05b62a7b9fbbdf7935775c5c8.exe	97
PID 5020 wrote to memory of 1136	5020	JaffaCakes118_c1afd5d05b62a7b9fbbdf7935775c5c8.exe	97
PID 5020 wrote to memory of 1136	5020	JaffaCakes118_c1afd5d05b62a7b9fbbdf7935775c5c8.exe	97
PID 4956 wrote to memory of 2256	4956	msedge.exe	98
PID 4956 wrote to memory of 2256	4956	msedge.exe	98
PID 4956 wrote to memory of 2256	4956	msedge.exe	98
PID 4956 wrote to memory of 2256	4956	msedge.exe	98
PID 4956 wrote to memory of 2256	4956	msedge.exe	98
PID 4956 wrote to memory of 2256	4956	msedge.exe	98
PID 4956 wrote to memory of 2256	4956	msedge.exe	98
PID 4956 wrote to memory of 2256	4956	msedge.exe	98
PID 4956 wrote to memory of 2256	4956	msedge.exe	98
PID 4956 wrote to memory of 2256	4956	msedge.exe	98
PID 4956 wrote to memory of 2256	4956	msedge.exe	98
PID 4956 wrote to memory of 2256	4956	msedge.exe	98
PID 4956 wrote to memory of 2256	4956	msedge.exe	98
PID 4956 wrote to memory of 2256	4956	msedge.exe	98
PID 4956 wrote to memory of 2256	4956	msedge.exe	98
PID 4956 wrote to memory of 2256	4956	msedge.exe	98
PID 4956 wrote to memory of 2256	4956	msedge.exe	98
PID 4956 wrote to memory of 2256	4956	msedge.exe	98
PID 4956 wrote to memory of 2256	4956	msedge.exe	98
PID 4956 wrote to memory of 2256	4956	msedge.exe	98
PID 4956 wrote to memory of 2256	4956	msedge.exe	98
PID 4956 wrote to memory of 2256	4956	msedge.exe	98
PID 4956 wrote to memory of 2256	4956	msedge.exe	98
PID 4956 wrote to memory of 2256	4956	msedge.exe	98
PID 4956 wrote to memory of 2256	4956	msedge.exe	98
PID 4956 wrote to memory of 2256	4956	msedge.exe	98
PID 4956 wrote to memory of 2256	4956	msedge.exe	98
PID 4956 wrote to memory of 2256	4956	msedge.exe	98
PID 4956 wrote to memory of 2256	4956	msedge.exe	98
PID 4956 wrote to memory of 2256	4956	msedge.exe	98
PID 4956 wrote to memory of 2256	4956	msedge.exe	98
PID 4956 wrote to memory of 2256	4956	msedge.exe	98
PID 4956 wrote to memory of 2256	4956	msedge.exe	98
PID 4956 wrote to memory of 2256	4956	msedge.exe	98
PID 4956 wrote to memory of 2256	4956	msedge.exe	98
PID 4956 wrote to memory of 2256	4956	msedge.exe	98
PID 4956 wrote to memory of 2256	4956	msedge.exe	98
PID 4956 wrote to memory of 2256	4956	msedge.exe	98
PID 4956 wrote to memory of 2256	4956	msedge.exe	98
PID 4956 wrote to memory of 2256	4956	msedge.exe	98
PID 4956 wrote to memory of 1520	4956	msedge.exe	99
PID 4956 wrote to memory of 1520	4956	msedge.exe	99
PID 4956 wrote to memory of 1884	4956	msedge.exe	100
PID 4956 wrote to memory of 1884	4956	msedge.exe	100
PID 4956 wrote to memory of 1884	4956	msedge.exe	100
PID 4956 wrote to memory of 1884	4956	msedge.exe	100
PID 4956 wrote to memory of 1884	4956	msedge.exe	100
PID 4956 wrote to memory of 1884	4956	msedge.exe	100
PID 4956 wrote to memory of 1884	4956	msedge.exe	100
PID 4956 wrote to memory of 1884	4956	msedge.exe	100
PID 4956 wrote to memory of 1884	4956	msedge.exe	100

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:612
- C:\Windows\system32\fontdrvhost.exe
  "fontdrvhost.exe"
  2⤵
  PID:780
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:60

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:672

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:788

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p
1⤵
PID:796
- C:\Windows\system32\wbem\unsecapp.exe
  C:\Windows\system32\wbem\unsecapp.exe -Embedding
  2⤵
  PID:2976
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
  2⤵
  PID:3752
- C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
  2⤵
  PID:3880
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:3948
- C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
  2⤵
  PID:4032
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:3452
- C:\Windows\system32\SppExtComObj.exe
  C:\Windows\system32\SppExtComObj.exe -Embedding
  2⤵
  PID:1476
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
  2⤵
  PID:4792
- C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
  "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca
  2⤵
  PID:3172
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:3328
- C:\Windows\system32\backgroundTaskHost.exe
  "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca
  2⤵
  PID:4756
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:2592
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:4244
- C:\Windows\System32\CompPkgSrv.exe
  C:\Windows\System32\CompPkgSrv.exe -Embedding
  2⤵
  PID:2964
- C:\Windows\System32\CompPkgSrv.exe
  C:\Windows\System32\CompPkgSrv.exe -Embedding
  2⤵
  PID:2764

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS -p
1⤵
PID:900

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:956

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:740

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:1036

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p
1⤵
PID:1040

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1108

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1116

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1160
- C:\Windows\system32\taskhostw.exe
  taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
  2⤵
  PID:3088
- C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ua /installsource scheduler
  2⤵
  PID:5068
- C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /c
  2⤵
  PID:632

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1168

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1260

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1304

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1356

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1440

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1468
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:2356

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1480

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1492

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1620

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1692

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1704

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1792

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1800

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:1892

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1904

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:1952

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:1960

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:1348

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p
1⤵
PID:1680

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:1824

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2264

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2288

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2296

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2308

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
PID:2444

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2516

C:\Windows\sysmon.exe
C:\Windows\sysmon.exe
1⤵
PID:2540

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2556

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2572

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:1008

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker
1⤵
PID:3180

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:3352

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3436
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c1afd5d05b62a7b9fbbdf7935775c5c8.exe
  "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c1afd5d05b62a7b9fbbdf7935775c5c8.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5020
- - C:\Users\Admin\AppData\Local\Temp\silent_akl.exe
    "C:\Users\Admin\AppData\Local\Temp\silent_akl.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:464
  - - C:\Program Files (x86)\POL\POL.exe
      "C:\Program Files (x86)\POL\POL.exe"
      4⤵
      Boot or Logon Autostart Execution: Active Setup
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of SetWindowsHookEx
      PID:4348
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Program Files (x86)\POL\qs.html
      4⤵
      Enumerates system info in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:4956
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe6f1a46f8,0x7ffe6f1a4708,0x7ffe6f1a4718
        5⤵
        
        PID:3968
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,8250037771016316409,8928049488854485201,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:2
        5⤵
        
        PID:2256
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,8250037771016316409,8928049488854485201,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 /prefetch:3
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1520
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,8250037771016316409,8928049488854485201,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2564 /prefetch:8
        5⤵
        
        PID:1884
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,8250037771016316409,8928049488854485201,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
        5⤵
        
        PID:448
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,8250037771016316409,8928049488854485201,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
        5⤵
        
        PID:2192
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,8250037771016316409,8928049488854485201,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5024 /prefetch:8
        5⤵
        
        PID:5888
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,8250037771016316409,8928049488854485201,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5024 /prefetch:8
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:5348
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,8250037771016316409,8928049488854485201,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5088 /prefetch:1
        5⤵
        
        PID:5356
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,8250037771016316409,8928049488854485201,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5108 /prefetch:1
        5⤵
        
        PID:5308
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,8250037771016316409,8928049488854485201,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4828 /prefetch:1
        5⤵
        
        PID:6036
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,8250037771016316409,8928049488854485201,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5168 /prefetch:1
        5⤵
        
        PID:6084
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,8250037771016316409,8928049488854485201,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5316 /prefetch:2
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1612
- - C:\Users\Admin\AppData\Local\Temp\NEW.exe
    "C:\Users\Admin\AppData\Local\Temp\NEW.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1136
  - - C:\Users\Admin\AppData\Local\Temp\NEW.exe
      C:\Users\Admin\AppData\Local\Temp\NEW.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5060
    - - C:\Program Files (x86)\Internet Explorer\iexplore.exe
        
        "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
        5⤵
        Adds policy Run key to start application
        Boot or Logon Autostart Execution: Active Setup
        Loads dropped DLL
        Adds Run key to start application
        Drops file in Program Files directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        
        PID:1840

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3548

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:4736

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:3692

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:436

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
1⤵
PID:2136

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
PID:4620

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:2248

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:4884

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7OTcyOUJBNEMtMTg2NS00RDNELUJDQzEtNUM1RTM1Njg3QjEzfSIgdXNlcmlkPSJ7OEJEREIwMzEtRjQ0RC00RTRDLTk5RTQtQzM0MTY5MTQxM0EzfSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7ODM0MUU4QzYtM0E2Mi00MEYzLUIzMEItMTU1NzI5MzNDNzdEfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjIiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90O0UreGJBejZZNnNVMTI4OWJTNnFsNFZSTGJramZCVUdUTUpzanJIcjQ0aUk9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjEyMy4wLjYzMTIuMTIzIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSIyIiBpbnN0YWxsZGF0ZXRpbWU9IjE3Mzg5NDQ0OTciIG9vYmVfaW5zdGFsbF90aW1lPSIxMzM4MzQxNjkzODEzMjAwMDAiPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIyMTc5ODYyIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1MDk5NTM1MDM3Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
1⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
PID:5872

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\POL\AKV.exe

Filesize
457KB

MD5
752e814c2a5d197b8065501e786683c9

SHA1
c7b5840ab79ec308d0aca9a8f07d59730b31ad99

SHA256
5b387c65f0c677d415a3ec75fc314ecf4825b85cc8316575267ece340810c3f7

SHA512
af4bad6716f4f57e776145eb68f64d31c0fb2146b02ccb3dcda1a864215b9aeaa80abd5314d999a0bef721185c62f38463da6caba1eb7eb95c86c22691c510bf

Download Submit
C:\Program Files (x86)\POL\POL.003

Filesize
4KB

MD5
b89311bdf4e6640cc9051e629476cbe4

SHA1
ced30235482232b045cd5d8004e8ead01b30f9ca

SHA256
db0e9d83d8a5309ae4ab4747ff6ce506a2f85b01a598caad697a69b3ddb557a1

SHA512
8e71c2238e23cd793feb061736d00f8aea0002f79e2632093529ed6242f9af2a99baa598d58c04bbc9c02715d7f18955ae88334e39caa2978e88904cf27911d4

Download Submit
C:\Program Files (x86)\POL\POL.004

Filesize
14KB

MD5
f8d18c97818ded4af98e1e6826e7678c

SHA1
d306778e454f5dc3eb8d7bfdf434dbcd3cb4fb01

SHA256
b1af1a31a22fb5a4eb5631526f1ad446ef5910c91987eb5c09be9935bdf23f33

SHA512
95e24d6b6d8c7665965906629255de887358b53fcfd9b70b6cbdde09cace93665b5bb9332ea6e959be10d5458fc8e5167235fae4e6a6260f5b304fc3b5addc01

Download Submit
C:\Program Files (x86)\POL\POL.006

Filesize
8KB

MD5
911a5a213762001178a48b2ceefa1880

SHA1
de9b25ac58e893397ab9ad3331bd922bbd5043ae

SHA256
273375c7be87b6da793320ee25ea08967bf8cb43e6213e4af94955e565afabc9

SHA512
cc4f95dc64085033a6f5308d61bce83991a8949ec89513fa0428527b6c20f40bc4ce0b323da3020f405f29bf3fcf703722082247f591568d39e8e355543f04c9

Download Submit
C:\Program Files (x86)\POL\POL.007

Filesize
5KB

MD5
2183e6a435b000fc6e85b712513c3480

SHA1
c088b82494aaeca23a5acfaf83f55597bd0bdc6e

SHA256
9a1a58cea0b0cfe3479d29bb39b0a5af0ee75fbd94254529ad28f2e54aec30e5

SHA512
94ffbd46b10cf71ea59d3d44ceece691d7d50e8e111e330d44346f1e56e62d7a3b5c375917494fff89966d0ea5fc562d45b14b983269eba72b2831abce7a1afe

Download Submit
C:\Program Files (x86)\POL\POL.chm

Filesize
33KB

MD5
8e4c5c3fee759991597ebc2d855ad4e4

SHA1
b3da123c6300a330b8c869b1ba807115e42c6eab

SHA256
e97a9f0dd54d6013280cbb032e63b9cfcc976886a46eeeac07a45af2fc545547

SHA512
30a126b57b538f3429a66785521ce30e8dfe4e617d84381e9f5a0feae5956576aaf00253ea41170e12813f2637edd11c5ce643c08dd4920bf30d8bf94b95208e

Download Submit
C:\Program Files (x86)\POL\POL.exe

Filesize
647KB

MD5
b314bd03990cf08f3ca04dd98ece3e9c

SHA1
760dca4682edbefb1bb8636bf1011207b763a7b0

SHA256
c6b1edc51c705e8f46ab7b2ddc03378e0f2bdcc4948578eff870aad6d421acd1

SHA512
b331dff33995e4e2c7e926cd4f0ea2d40da972924d05d28fe0db2f8de92d0cad5a48ce95819f7243c7efadce11d1ecf17e093c1a7bed9497520123c8715fa47a

Download Submit
C:\Program Files (x86)\POL\Uninstall.exe

Filesize
43KB

MD5
4bbbf32667e8d9aca25b74536c022802

SHA1
128ce5fb0d058cc9126da94a2f9799b2275dfa22

SHA256
df3a520beb7b22566981849512cfba209d108d65505b49f38ad054aad9940c17

SHA512
5a850f7d6ef5293aba4594370eb59116d78b31f07f663dfc737bb35992e8c2fc351935f30af512f319af5f26f0538029624b442eca00a9f00409a23f263d9d72

Download Submit
C:\Program Files (x86)\POL\menu.gif

Filesize
22KB

MD5
20fe009bce33b78dd40b48bc5f8accc6

SHA1
cd614d9b9e088eecb7e63722f61a39a0cf0ec196

SHA256
979c4b395172a53794b18d996df95c75c68d70ec3573aba66cdfe28c8d1cf0eb

SHA512
f6be54be78bfdf770c7c131c5d108b0b33376886b9b4a66598e2c92543a2e83ffafdaea36b9d749784a978d4327cdf52ce0ac6feb9a28d683162b0b3f2f40a37

Download Submit
C:\Program Files (x86)\POL\qs.html

Filesize
1KB

MD5
40d00fa24b9cc44fbf2d724842808473

SHA1
c0852aa2fb916c051652a8b2142ffb9d8c7ac87a

SHA256
35b0f1bb808e1623ad534fbc1e72cea25ac28f71340e9c543f01d1bfdd094035

SHA512
9eb750e08ca9750988290626ae8ed32a2ecfa7c8ca021b3e26b3da0a94de952b991a9a6a0ad5729d7d5ccf7b3b36fb36fd24047f705d0468ad04908ba8a7154c

Download Submit
C:\Program Files (x86)\POL\tray.gif

Filesize
7KB

MD5
0ac69330c3b9181b8a109fddb91fa128

SHA1
ef9698ccce041ce8ba3f4af37d0c2b577f19b375

SHA256
e675fecb791ed568aae7f1c24b159f7c0f7e23fe8a7ce76f72b3dd1a4ac00e9d

SHA512
3a74c04baf3e1e842c0a2568a6480e4ece05baef31171397763de638c6e5b0d26255cf1d7802ea53c355563b8e4b600d24d04afb5168fbc54f66414445327749

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Ardamax Keylogger\Help.lnk

Filesize
975B

MD5
e7e66d05d204a3d9fff93cc2b4d72f94

SHA1
54e26254e4d504d41da514fb339ca522f88bb0b5

SHA256
fee5faefa91277cf97166ddb40bf250a552263f3a6436675416e6c0b68e0f082

SHA512
6857a75d833ba84ea66371a9f362ce0507f63c73e833dc99fc12f3c5be35062c003de4fc140ad04e74d7c31f6e5255c27990dd51d4e2ffc4d7f2b4434c930f14

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Ardamax Keylogger\Log Viewer.lnk

Filesize
1KB

MD5
ff19071fe5a6079219dbee439fda23cd

SHA1
8131cc483407d12b1b920be872d9c4bf084f5bc2

SHA256
700749224e4121485edbf28359854ec47d47f231cefe0c832296a109c5d3b4c9

SHA512
0dfd4d079de7a2e5241839b4478cad1c9918b4b8760944a48918f3f5aee211eae9a6412f83f08824da6fd7393bb13c04bedc30c6de9836344a8a22eea68e6175

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fc7e2abfae997eac3dd58ba7132b3a2a

SHA1
ed7e80b26252b600acc6d89b985f4235b0fb03fb

SHA256
be084d16cf52949ceb38b98ebc8761cd5bf1a6ac9e8c247efc12bb669f5f023a

SHA512
a504e52646c4be5ee0f0d979b0d7a539228ab638394c658d1a88eff86f6db4091146b176484388afa6967a296af7ea97b4d2678577ea85f83d721ef2fe63f928

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
aa50e46aef7f210bf65d44c570031714

SHA1
41993bb24a2c4cffdb5ea9bd4eeb825bf6b6fa79

SHA256
857a7702a47be49f185619891e5c74e34b4bb2515279033f3b5a0a9be2da839d

SHA512
dd5a1e88b2000957e3ddf057329a24dbbfc5408857cd1432799f20c21b967b627627bf1a3caa23e9698bb8133b7033d925487bcf46d864186a707176f8969029

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4428c7a064ad3818c1cc30ed44a415e8

SHA1
55c06a613c05b89d372192ac5969be1ad5fe8640

SHA256
2a2b7bca0d9b5f470f66c213e51da20fbc3a3d67021c3bea961af6e37accd3e8

SHA512
b2487ed5b78dcd8a710008a72b87c209367ed9b60807a87ba349ea72592a36ba45610ecd231c0fa90217d0d071123957129669833e3bbf398bef47095e943419

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2e6cbf6879922af50bf9b80b8b974d9c

SHA1
c670e14371530a6ea0d6c29415beacc3ab108d9b

SHA256
d0966ec9b671340c65607614878db4570639220b39f9169da713242eb59ea25c

SHA512
e2909d131fbc6b730ce537d515993e4bfa3354363348741c1bc384fb9c93b0f3eb46b27e88d52ad5640d87a5b440ced00897d75891170bbe70262e8f26c403c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
5932f73c8986232276d4a263590bcf75

SHA1
e13282e9b1e69eb6fed804124f8427da5679ac03

SHA256
0351d2de5f70a61c765d1831a17e53b487f3e07fc63198fa9d1ace275663f54b

SHA512
8a076613221b11780caebbe5468d2881ea03a9b85c3509caf64743d00636ba8db70ae5a3fe6c911db77185e0f056f8f6efe6c23749b41c3e939f898ac4719f6e

Download Submit
C:\Users\Admin\AppData\Local\Temp\NEW.exe

Filesize
596KB

MD5
26c11f7c1f70bc17bb73f3161837072e

SHA1
688fcac954fa1da8f30a2573330bd6d26fc9a716

SHA256
5f303338c34c661a18362ab3700513f4162c5b15cc3f54fde3df6f659e863939

SHA512
bae88331f064d0dc7fc7e9b9fd26d1ea14cf6e5b4a206fbf23c240db2ae4d3ca9760a8fccefd7463bf609a2d43126e0036866386fb0ec1ca61f6a0645da523f8

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsa8678.tmp\InstallOptions.dll

Filesize
14KB

MD5
3809b1424d53ccb427c88cabab8b5f94

SHA1
bc74d911216f32a9ca05c0d9b61a2aecfc0d1c0e

SHA256
426efd56da4014f12ec8ee2e268f86b848bbca776333d55482cb3eb71c744088

SHA512
626a1c5edd86a71579e42bac8df479184515e6796fa21cb4fad6731bb775641d25f8eb8e86b939b9db9099453e85c572c9ea7897339a3879a1b672bc9226fcee

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsa8678.tmp\ioSpecial.ini

Filesize
795B

MD5
476a122f0c94b4c34486c48656d90aa2

SHA1
02fc9b1b56259ab0433e59688bde32d3f264f2c6

SHA256
ff3b08c9f641c2532a45a50805099631c0fb70a6d2b37594eb634ecfd1b111d5

SHA512
88ffe1b59214681e2ef8563cfeeaa9a5afffcd9080828fb899fd511802a1434d9bc4dad87fb3a1c965bd0751e6b08029f472c36f3fa13cf59f652e631c5c2861

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsa8678.tmp\ioSpecial.ini

Filesize
719B

MD5
27c37df1acfdcc650d1db95903482b52

SHA1
a21d6111475871226a9b2d7b508acd4e46efe05e

SHA256
e520c55dcd25b23812ba3c16929e8e312e04d943039e38551266716df0fc6f24

SHA512
c398f8e65dd70a65a19678bc3091e54b5de97b7ddb9b6ada85aaa991add945b254ffabf3e9ae54847cad5feb523ed955587082addbba2ccdc6d0858c617cbe51

Download Submit
C:\Users\Admin\AppData\Local\Temp\silent_akl.exe

Filesize
860KB

MD5
a373fc95d538fec7894ed1b336c81ef2

SHA1
14c862baf3812688c6ff2cf324eb3a2e34627381

SHA256
69593ad7cf2bc0fc3b384309f4e4e32fb81432f6fdffdda5c19b8469efb43b47

SHA512
0a8a388971d802c7f56252b90af6261b690d7ca5aaf48bb5bee57ca9b0e2134ed7c8748f15eee27bf522cf801a43e335b6bce1d6038adb103dbfc6ebabc901fd

Download Submit
memory/1136-191-0x0000000000400000-0x0000000000496000-memory.dmp

Filesize
600KB

Download
memory/1136-206-0x0000000000400000-0x0000000000496000-memory.dmp

Filesize
600KB

Download
memory/4348-174-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/4348-157-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/4348-163-0x0000000000493000-0x0000000000494000-memory.dmp

Filesize
4KB

Download
memory/4348-431-0x0000000000493000-0x0000000000494000-memory.dmp

Filesize
4KB

Download
memory/4348-224-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/4348-388-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/4348-164-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/5060-234-0x0000000010410000-0x0000000010441000-memory.dmp

Filesize
196KB

Download
memory/5060-269-0x0000000000590000-0x000000000059A000-memory.dmp

Filesize
40KB

Download
memory/5060-276-0x00000000022D0000-0x00000000022DA000-memory.dmp

Filesize
40KB

Download
memory/5060-283-0x00000000022E0000-0x00000000022EA000-memory.dmp

Filesize
40KB

Download
memory/5060-290-0x00000000022F0000-0x00000000022FA000-memory.dmp

Filesize
40KB

Download
memory/5060-297-0x0000000010450000-0x000000001045A000-memory.dmp

Filesize
40KB

Download
memory/5060-262-0x0000000000580000-0x000000000058A000-memory.dmp

Filesize
40KB

Download
memory/5060-255-0x0000000000570000-0x000000000057A000-memory.dmp

Filesize
40KB

Download
memory/5060-240-0x0000000000480000-0x000000000048A000-memory.dmp

Filesize
40KB

Download
memory/5060-203-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5060-205-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5060-215-0x0000000010410000-0x0000000010441000-memory.dmp

Filesize
196KB

Download