ardamax | 9afadba0006723439d704c1bf3af6cb9e3b3e0d4796dd2fe89d8fbcc7d25c7af

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20250410-en
resource tags

arch:x64arch:x86image:win11-20250410-enlocale:en-usos:windows11-21h2-x64system
submitted
18/04/2025, 04:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_bca126cc681c07440b291fe71f5ab863.exe
Size

209KB
MD5

bca126cc681c07440b291fe71f5ab863
SHA1

f3caf966a3290b4ca7952a8a6dc023ef417ff897
SHA256

9afadba0006723439d704c1bf3af6cb9e3b3e0d4796dd2fe89d8fbcc7d25c7af
SHA512

5192b23d110f68197747f420e3fe32c37fb853f177820ca6d40b33f2aaf989eb847ecff1a6ef5d799499807d286f3611cf653fad46c1062364351b44f0b04ca6
SSDEEP

6144:dQJQEgZAppJtRWH7YumzfX4k6/Bpfs/scDI8T:duppBDumzfX85Rs/sDo

Score

10^/10

ardamax discovery keylogger persistence stealer

Malware Config

Signatures

Ardamax
A keylogger first seen in 2013.
keylogger stealer ardamax
Ardamax family
ardamax

Ardamax main executable 1 IoCs

resource	yara_rule
behavioral2/files/0x001900000002b2cd-143.dat	family_ardamax

Executes dropped EXE 1 IoCs

pid	Process
4644	akl.exe

Loads dropped DLL 2 IoCs

pid	Process
4776	JaffaCakes118_bca126cc681c07440b291fe71f5ab863.exe
4644	akl.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Ardamax Keylogger = "C:\\Program Files (x86)\\Ardamax Keylogger\\akl.exe"	akl.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 20 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Ardamax Keylogger	akl.exe
File opened for modification	C:\Program Files (x86)\Ardamax Keylogger\AKL.exe	JaffaCakes118_bca126cc681c07440b291fe71f5ab863.exe
File created	C:\Program Files (x86)\Ardamax Keylogger\kh.dll	JaffaCakes118_bca126cc681c07440b291fe71f5ab863.exe
File opened for modification	C:\Program Files (x86)\Ardamax Keylogger\il.dll	JaffaCakes118_bca126cc681c07440b291fe71f5ab863.exe
File created	C:\Program Files (x86)\Ardamax Keylogger\il.dll	JaffaCakes118_bca126cc681c07440b291fe71f5ab863.exe
File created	C:\Program Files (x86)\Ardamax Keylogger\menu.gif	JaffaCakes118_bca126cc681c07440b291fe71f5ab863.exe
File opened for modification	C:\Program Files (x86)\Ardamax Keylogger\AKL.chm	JaffaCakes118_bca126cc681c07440b291fe71f5ab863.exe
File created	C:\Program Files (x86)\Ardamax Keylogger\AKL.chm	JaffaCakes118_bca126cc681c07440b291fe71f5ab863.exe
File created	C:\Program Files (x86)\Ardamax Keylogger\Uninstall.exe	JaffaCakes118_bca126cc681c07440b291fe71f5ab863.exe
File opened for modification	C:\Program Files (x86)\Ardamax Keylogger\kh.dll	JaffaCakes118_bca126cc681c07440b291fe71f5ab863.exe
File opened for modification	C:\Program Files (x86)\Ardamax Keylogger\AKV.exe	JaffaCakes118_bca126cc681c07440b291fe71f5ab863.exe
File created	C:\Program Files (x86)\Ardamax Keylogger\AKV.exe	JaffaCakes118_bca126cc681c07440b291fe71f5ab863.exe
File opened for modification	C:\Program Files (x86)\Ardamax Keylogger\qs.html	JaffaCakes118_bca126cc681c07440b291fe71f5ab863.exe
File opened for modification	C:\Program Files (x86)\Ardamax Keylogger\menu.gif	JaffaCakes118_bca126cc681c07440b291fe71f5ab863.exe
File opened for modification	C:\Program Files (x86)\Ardamax Keylogger\license.txt	JaffaCakes118_bca126cc681c07440b291fe71f5ab863.exe
File opened for modification	C:\Program Files (x86)\Ardamax Keylogger\tray.gif	JaffaCakes118_bca126cc681c07440b291fe71f5ab863.exe
File created	C:\Program Files (x86)\Ardamax Keylogger\tray.gif	JaffaCakes118_bca126cc681c07440b291fe71f5ab863.exe
File created	C:\Program Files (x86)\Ardamax Keylogger\AKL.exe	JaffaCakes118_bca126cc681c07440b291fe71f5ab863.exe
File created	C:\Program Files (x86)\Ardamax Keylogger\license.txt	JaffaCakes118_bca126cc681c07440b291fe71f5ab863.exe
File created	C:\Program Files (x86)\Ardamax Keylogger\qs.html	JaffaCakes118_bca126cc681c07440b291fe71f5ab863.exe

Drops file in Windows directory 14 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2244_1570029716\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2244_1570029716\sets.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2244_1570029716\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2244_875198606\deny_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2244_875198606\deny_full_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2244_118261736\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2244_118261736\typosquatting_list.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2244_118261736\manifest.fingerprint	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2244_1570029716\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2244_1570029716\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2244_875198606\deny_etld1_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2244_875198606\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2244_875198606\manifest.fingerprint	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_bca126cc681c07440b291fe71f5ab863.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	akl.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133894250194194919"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2787523927-1212474705-3964982594-1000\{4DB6021A-89E6-4AF6-AD30-3E8A834CCB9F}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2528	msedge.exe
2528	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4644	akl.exe
2244	msedge.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
4644	akl.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4644	akl.exe
4644	akl.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4776 wrote to memory of 4644	4776	JaffaCakes118_bca126cc681c07440b291fe71f5ab863.exe	84
PID 4776 wrote to memory of 4644	4776	JaffaCakes118_bca126cc681c07440b291fe71f5ab863.exe	84
PID 4776 wrote to memory of 4644	4776	JaffaCakes118_bca126cc681c07440b291fe71f5ab863.exe	84
PID 4776 wrote to memory of 2244	4776	JaffaCakes118_bca126cc681c07440b291fe71f5ab863.exe	87
PID 4776 wrote to memory of 2244	4776	JaffaCakes118_bca126cc681c07440b291fe71f5ab863.exe	87
PID 2244 wrote to memory of 3008	2244	msedge.exe	88
PID 2244 wrote to memory of 3008	2244	msedge.exe	88
PID 2244 wrote to memory of 5840	2244	msedge.exe	89
PID 2244 wrote to memory of 5840	2244	msedge.exe	89
PID 2244 wrote to memory of 4032	2244	msedge.exe	90
PID 2244 wrote to memory of 4032	2244	msedge.exe	90
PID 2244 wrote to memory of 4032	2244	msedge.exe	90
PID 2244 wrote to memory of 4032	2244	msedge.exe	90
PID 2244 wrote to memory of 4032	2244	msedge.exe	90
PID 2244 wrote to memory of 4032	2244	msedge.exe	90
PID 2244 wrote to memory of 4032	2244	msedge.exe	90
PID 2244 wrote to memory of 4032	2244	msedge.exe	90
PID 2244 wrote to memory of 4032	2244	msedge.exe	90
PID 2244 wrote to memory of 4032	2244	msedge.exe	90
PID 2244 wrote to memory of 4032	2244	msedge.exe	90
PID 2244 wrote to memory of 4032	2244	msedge.exe	90
PID 2244 wrote to memory of 4032	2244	msedge.exe	90
PID 2244 wrote to memory of 4032	2244	msedge.exe	90
PID 2244 wrote to memory of 4032	2244	msedge.exe	90
PID 2244 wrote to memory of 4032	2244	msedge.exe	90
PID 2244 wrote to memory of 4032	2244	msedge.exe	90
PID 2244 wrote to memory of 4032	2244	msedge.exe	90
PID 2244 wrote to memory of 4032	2244	msedge.exe	90
PID 2244 wrote to memory of 4032	2244	msedge.exe	90
PID 2244 wrote to memory of 4032	2244	msedge.exe	90
PID 2244 wrote to memory of 4032	2244	msedge.exe	90
PID 2244 wrote to memory of 4032	2244	msedge.exe	90
PID 2244 wrote to memory of 4032	2244	msedge.exe	90
PID 2244 wrote to memory of 4032	2244	msedge.exe	90
PID 2244 wrote to memory of 4032	2244	msedge.exe	90
PID 2244 wrote to memory of 4032	2244	msedge.exe	90
PID 2244 wrote to memory of 4032	2244	msedge.exe	90
PID 2244 wrote to memory of 4032	2244	msedge.exe	90
PID 2244 wrote to memory of 4032	2244	msedge.exe	90
PID 2244 wrote to memory of 4032	2244	msedge.exe	90
PID 2244 wrote to memory of 4032	2244	msedge.exe	90
PID 2244 wrote to memory of 4032	2244	msedge.exe	90
PID 2244 wrote to memory of 4032	2244	msedge.exe	90
PID 2244 wrote to memory of 4032	2244	msedge.exe	90
PID 2244 wrote to memory of 4032	2244	msedge.exe	90
PID 2244 wrote to memory of 4032	2244	msedge.exe	90
PID 2244 wrote to memory of 4032	2244	msedge.exe	90
PID 2244 wrote to memory of 4032	2244	msedge.exe	90
PID 2244 wrote to memory of 4032	2244	msedge.exe	90
PID 2244 wrote to memory of 4032	2244	msedge.exe	90
PID 2244 wrote to memory of 4032	2244	msedge.exe	90
PID 2244 wrote to memory of 4032	2244	msedge.exe	90
PID 2244 wrote to memory of 4032	2244	msedge.exe	90
PID 2244 wrote to memory of 4032	2244	msedge.exe	90
PID 2244 wrote to memory of 4032	2244	msedge.exe	90
PID 2244 wrote to memory of 4032	2244	msedge.exe	90
PID 2244 wrote to memory of 4032	2244	msedge.exe	90
PID 2244 wrote to memory of 4032	2244	msedge.exe	90
PID 2244 wrote to memory of 4032	2244	msedge.exe	90
PID 2244 wrote to memory of 4032	2244	msedge.exe	90
PID 2244 wrote to memory of 5456	2244	msedge.exe	91
PID 2244 wrote to memory of 5456	2244	msedge.exe	91
PID 2244 wrote to memory of 5456	2244	msedge.exe	91
PID 2244 wrote to memory of 5456	2244	msedge.exe	91

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_bca126cc681c07440b291fe71f5ab863.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_bca126cc681c07440b291fe71f5ab863.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4776
- C:\Program Files (x86)\Ardamax Keylogger\akl.exe
  "C:\Program Files (x86)\Ardamax Keylogger\akl.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:4644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Program Files (x86)\Ardamax Keylogger\qs.html
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2244
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x2e4,0x2e8,0x2ec,0x2e0,0x2f8,0x7ffb7c13f208,0x7ffb7c13f214,0x7ffb7c13f220
    3⤵
    PID:3008
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1820,i,11703714772678664430,14753198961151106145,262144 --variations-seed-version --mojo-platform-channel-handle=2224 /prefetch:11
    3⤵
    PID:5840
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2188,i,11703714772678664430,14753198961151106145,262144 --variations-seed-version --mojo-platform-channel-handle=2184 /prefetch:2
    3⤵
    PID:4032
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2500,i,11703714772678664430,14753198961151106145,262144 --variations-seed-version --mojo-platform-channel-handle=2512 /prefetch:13
    3⤵
    PID:5456
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3456,i,11703714772678664430,14753198961151106145,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
    3⤵
    PID:4248
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3464,i,11703714772678664430,14753198961151106145,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
    3⤵
    PID:1996
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4652,i,11703714772678664430,14753198961151106145,262144 --variations-seed-version --mojo-platform-channel-handle=4880 /prefetch:14
    3⤵
    PID:2380
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4672,i,11703714772678664430,14753198961151106145,262144 --variations-seed-version --mojo-platform-channel-handle=4916 /prefetch:14
    3⤵
    PID:5684
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5452,i,11703714772678664430,14753198961151106145,262144 --variations-seed-version --mojo-platform-channel-handle=5460 /prefetch:14
    3⤵
    PID:5480
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5696,i,11703714772678664430,14753198961151106145,262144 --variations-seed-version --mojo-platform-channel-handle=5704 /prefetch:14
    3⤵
    PID:2848
  - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\cookie_exporter.exe
      cookie_exporter.exe --cookie-json=1128
      4⤵
      PID:5176
- - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5792,i,11703714772678664430,14753198961151106145,262144 --variations-seed-version --mojo-platform-channel-handle=5724 /prefetch:14
    3⤵
    PID:1724
- - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5792,i,11703714772678664430,14753198961151106145,262144 --variations-seed-version --mojo-platform-channel-handle=5724 /prefetch:14
    3⤵
    PID:4784
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=732,i,11703714772678664430,14753198961151106145,262144 --variations-seed-version --mojo-platform-channel-handle=5876 /prefetch:14
    3⤵
    PID:4464
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6092,i,11703714772678664430,14753198961151106145,262144 --variations-seed-version --mojo-platform-channel-handle=5844 /prefetch:14
    3⤵
    PID:1988
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5484,i,11703714772678664430,14753198961151106145,262144 --variations-seed-version --mojo-platform-channel-handle=5560 /prefetch:14
    3⤵
    PID:2012
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4940,i,11703714772678664430,14753198961151106145,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:14
    3⤵
    PID:4528
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4972,i,11703714772678664430,14753198961151106145,262144 --variations-seed-version --mojo-platform-channel-handle=5000 /prefetch:14
    3⤵
    PID:1176
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5984,i,11703714772678664430,14753198961151106145,262144 --variations-seed-version --mojo-platform-channel-handle=5104 /prefetch:14
    3⤵
    PID:4832
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5008,i,11703714772678664430,14753198961151106145,262144 --variations-seed-version --mojo-platform-channel-handle=4996 /prefetch:14
    3⤵
    PID:1236
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=6172,i,11703714772678664430,14753198961151106145,262144 --variations-seed-version --mojo-platform-channel-handle=5004 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2528

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Program Files (x86)\Ardamax Keylogger\akl.exe
1⤵
PID:1460

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:976

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
  2⤵
  PID:3672

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Ardamax Keylogger\AKL.exe

Filesize
228KB

MD5
4f0592beb14e55d9295afbc005faef07

SHA1
dd0533f0d0d8eae441cba614a40d896fb7398930

SHA256
239e59fc07c7cd95f8f95f9356d916aedf75b844f08d8e500a5143275c50e49d

SHA512
9235efb1072e887ef92761a6d8c579d004583f00ad2743343f2fccace95bc3a75b16fb3220274ab372d7185f8203c5ae7a15f8a070ed86ee8d6804d4b3c261eb

Download Submit
C:\Program Files (x86)\Ardamax Keylogger\kh.dll

Filesize
4KB

MD5
c0aec89e4dc32fb0455b5ba72ab60bcf

SHA1
810895f5aec20559c76e1139d91f964235234539

SHA256
ebac4c23d288b3714702b907be613c94a8611fcac6cec78c2b1bfc9833c3c051

SHA512
cfd86c5561dbb695bdd934c39b298d12269a6571799dd8b2c1eb3ce8904c5c4afc0958a505882d2b38c7d973703042585fa8eb9ff928f143335d3f808aece4ab

Download Submit
C:\Program Files (x86)\Ardamax Keylogger\menu.gif

Filesize
5KB

MD5
0ef0d1b48f660aed3ab882c57c07c9e8

SHA1
4ad368b47a4ffce1c230d9dd3e2811d627be9e45

SHA256
a001314e9773e57930d18c8644e18ed1bc7a5629253f71c9b03c3ba27c866d52

SHA512
1ac18accd811970effdf9573e5ff4267e11382809d063daf0acf47690605fbf25b1e992be58e5236a6f73d1e0ba9025f481a4aa3e8a0fe5e884b383fd061b588

Download Submit
C:\Program Files (x86)\Ardamax Keylogger\qs.html

Filesize
1KB

MD5
da9de559f7a4f35fe72c9b6d115e017c

SHA1
34a2fd2290a6bdaaf08495f9c89ca66489828510

SHA256
c40c04a36754e564213ba5f0fc09379806de17d45dca95038876ecc144695a5e

SHA512
91259ac8fca0c115b5193892d097098ca74684dc29943ee38cbe4ac79e3a917a524b8fe54723080ef21938f3730b812b33645b6da385a5b1ad9a74a0117a5ba0

Download Submit
C:\Program Files (x86)\Ardamax Keylogger\tray.gif

Filesize
547B

MD5
f8042de6eac16488d35b374ee4ae0e9a

SHA1
50ca327d1d992d725abe0d4d805687e0e20bf2cd

SHA256
6c11ad24defbbb47ca85662764f925476d36c89e24e0cadb9fbff003e0ba6376

SHA512
00e5e5372520a9aa827a7026d890e3fa5363b668be0a91cc41a4a3109acbac9674cc088aecdb742f8cef84d650aef5fab0014fa14a53fca555eeed35a2e3cd6c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
34d09b852bf4a5ef1d936591501926ca

SHA1
88ff0b1c2a5664765e11e47843a5ac8e1782ed0c

SHA256
52bd897dfdfca849d627b36a49b976eef861b1a7af075527c8f247adb862dc20

SHA512
dc63eebf94384dc9580f5e3c9291047e8d410f8fc1f746d180673f445a9bbe746608c01cbf10a38f2f935cfa5c8bb89864f87cabd8fece809dcaa1fa137f71d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps

Filesize
107KB

MD5
2b66d93c82a06797cdfd9df96a09e74a

SHA1
5f7eb526ee8a0c519b5d86c845fea8afd15b0c28

SHA256
d4c064db769b3c109da2ed80a53fbab00987c17421a47921e41e213781d67954

SHA512
95e45c0aea0e704be5f512dffaae377d4abef78da99b3bca769264d69be20f2570daf2f47905645217e1b2696e42b101f26149219f148b4d6dd97a6c2868b6f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
9ed50f6ebea1c1ad42cb4c82c0762bab

SHA1
52feba397cd01d496269a6f12197fa0ceb913e86

SHA256
d4960130558602eea257363d6b05d98600aa4128c82ff4cdfcc50e50a1647415

SHA512
ea7d227adf49159dbbc39be4325fba580e65c93dd7989ae13e06dedc810cab84733f1212f80914116c04b5d1e2c723e391b7688bd67a7d0ab300c63bac3ab2d1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
40B

MD5
20d4b8fa017a12a108c87f540836e250

SHA1
1ac617fac131262b6d3ce1f52f5907e31d5f6f00

SHA256
6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

SHA512
507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
15KB

MD5
82cd37732917f73c80e951e41120d082

SHA1
5ea74bbefa1f3ac695f44e9495468314ce781b6e

SHA256
5c410aec3565e2026a6d2a696cb4d7d5201141d6ef4f7d88504d761562bfd0c6

SHA512
f7973b09ddcc1b03a656771ba559fae995062819f701b6d738a8e7d64b0874d8dce2a808a0c8880350f192f24938c443ce44a7aaf6b019192272558c0c17618e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
37KB

MD5
ecac1b67191c633b6681cec7f8ba443a

SHA1
cde6a5c57eaad9e44a596b9608942c489b5c1ba7

SHA256
4d841f64577f5e9a0bc344be76e8d03c7710bf2058de82d7d8ca690adfdf66f7

SHA512
2b6edb5e159d19c86e299605da1e7f5d270a3b4d343e764972ea4f9f5c074db452b7beddfcea8425e393b191dc0c2e7b580cf2586b7ed30ce337a58b9f9ca921

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

Filesize
22KB

MD5
95968578dbf6e8541da5156c9ed1a5b7

SHA1
c700d43068c8c90647140dfd6c8a89f1cb243219

SHA256
78c838146ea87b5b92691f5934bbf0bd96d1ef9722e4a5584f7c102d1a6a6e1a

SHA512
bb1746e12424d37e884a4d1f5a65587bd20c0f2eed9c830ba9c6cfb46cc2693c54a7f5620613c4a8b82cbe06f4e352b5064242d310dec1e0ab5b91015eebdd30

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
900B

MD5
b2c6453ff402eb4c3539b533fc7a9193

SHA1
de312e0132f4072b7adf44f492d697e0e222ec69

SHA256
96b5a332669fedca7f65265b43ea6597ae4d703e3102d79a3f9a445e3f6a98a0

SHA512
5147c5499d4baa49105c991273a6a0d2f0e764be8ed33fbb8af40ba411ea5a807fc826c4416deb7d923a1a6daa29bd1cd25d1a90416944834dc6bca214553cdb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
467B

MD5
3b1695dd05895ae4fa41d8c6dc3dbf9c

SHA1
7128e4bae98633a85ddf9c71ab86288acc9f2788

SHA256
99d0a1e37a09474fae2bfc2a2a757277e5487f04d32df8c23c7a8d7a475f2311

SHA512
4ed62531c8160a975972a8d5551ebf23750534466a0b1a281c712637e1beed568c1962d4b453c96b3b33dfb6ed0a003a4eb2072769e1ac86e2113f850d543f64

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
20KB

MD5
5009866ce6630b6db17631ab0722d6c8

SHA1
e47200490fb117cb60e287390e81acf373c01ff2

SHA256
e13841108129174f95008d3c9731afa81909698c11a63f897ccf08e41af0358d

SHA512
21018c7318511ef02060aa019dfb1339c54777450efba9745783bb3d494ccab85c169fee9281756705b68cc0bc53df422869551ae6f2903e835de2ddf7d438d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig

Filesize
22KB

MD5
3f8927c365639daa9b2c270898e3cf9d

SHA1
c8da31c97c56671c910d28010f754319f1d90fa6

SHA256
fc80d48a732def35ab6168d8fd957a6f13f3c912d7f9baf960c17249e4a9a1f2

SHA512
d75b93f30989428883cb5e76f6125b09f565414cf45d59053527db48c6cf2ac7f54ed9e8f6a713c855cd5d89531145592ef27048cf1c0f63d7434cfb669dbd72

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
54KB

MD5
ba464da43c99d5aa0b9ced53be4a3904

SHA1
4e5fca85dd567c9ac072710502eb7a33fa835505

SHA256
00ad6c18f86d71c083a8ade51bddb533e45825db5428a9cd9916c4174e6ba2ac

SHA512
7addeff80be1a6e577e47a3dc6908214dfd1b021dd92cf15b356db654b77f178ae92bc3ca24c4fb4067231319a122fda74858901a114737652b847e1818d7a63

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
40KB

MD5
dcdf07b7fce12e39d467e283c40fd882

SHA1
e601217e11226995725f3b35d66b353c53f7aa27

SHA256
3dddc3cab4a53447a0314ad116a48d23966eea456a114a6112831caf0b370965

SHA512
96d4445944c2dd0878f57a3926281b175845ee86c35413e2602cc81af8c76d5ecc09fe8d4bfc4fdb1695fe8fae47183e221b6616e81fe549b22bb3bc7220d332

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
40KB

MD5
6c062def3d9ebb893d626d0c2fe97987

SHA1
00b2c30da5e34db1c7d04e69703ec797d1083bbd

SHA256
18795b0bc2ce2adef32082c7151c7dd57952abba5e82311adb2a10f6d3d89187

SHA512
53bc250d0b36c12b94efd7d1d18d48385f82a0a69d6998e00aa9aae57bb13abc684e311eced53cc83d135b0c9961a0ae32238ea37180d8e2f249bd4d6978c0dc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
49KB

MD5
66dcc260eabfe951e50f0fddd91bc3fe

SHA1
bf48c95578b8e95a807e5ed8a6143786fe920a76

SHA256
6a2ba78a10cc0894139a71b4cbcf4e6fb6b764af2ca13e32d8f693edbebaef12

SHA512
25ec408e2514ac1d6a7333d430303c26d1d86547f2cd252fa20fceeff71af601bf27db62189e6ae209c6917ef5c25bdab77dd4e8522e6dca5b5ae09388cd0555

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2025.4.17.1\typosquatting_list.pb

Filesize
623KB

MD5
5ab9b7f0cc325613a81d9ebcd04aaf2f

SHA1
c7599611befa76f7897067fe24dabb823762d1e8

SHA256
578117941516ab6624486eec10922aa8fa56526e45fab4422c722784654eb8d0

SHA512
fd20a7a9a4f83211edba010a3dd4c372b0d74e5e9a7c62978fa471e3dfa671beab8c379b6f74a13c2d38b40b4ac95c68544e4128f6b2a50bd383c1a5f1d97ebd

Download Submit
C:\Users\Admin\AppData\Local\Temp\nswA450.tmp\InstallOptions.dll

Filesize
12KB

MD5
4c7d97d0786ff08b20d0e8315b5fc3cb

SHA1
bb6f475e867b2bf55e4cd214bd4ef68e26d70f6c

SHA256
75e20f4c5eb00e9e5cb610273023e9d2c36392fa3b664c264b736c7cc2d1ac84

SHA512
f37093fd5cdda74d8f7376c60a05b442f884e9d370347c7c39d84eca88f23fbea6221da2e57197acd78c817a74703c49fb28b89d41c3e34817cc9301b0b6485a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nswA450.tmp\ioSpecial.ini

Filesize
745B

MD5
fe21adde499d565415b1f64655256ccb

SHA1
2846d996c6761b97acf4aaaf179d626170a2f346

SHA256
f96218f6f5ba35a350699cfb791e7def6cfe58869ff4a94ebe12ea1f4eb51b75

SHA512
102fa119cf6e6f915102ea9cece78378fe57a6a75b9e721ac4cb00c460708797cba5592e602454b1a3190e987a29c8904e432bc675e75ea590da01caa0f47778

Download Submit
C:\Users\Admin\AppData\Local\Temp\nswA450.tmp\ioSpecial.ini

Filesize
736B

MD5
c9f312d95c6d06e5d2af5ba35cb1635d

SHA1
d0bca694b6f99ec6adf7818afc159292d2fadd4b

SHA256
de745b59c7cb696f869638d309ac6b4495196c4c38eaa1030a58d6e7fe3f2bd3

SHA512
807e0cf48da44b6d7813ce5287c8353c8ae6bd1d29b75692404cc0b2bf5f9e192324ea23211cabc999089c2d60d30f36393c9fae57330bb26183574275b463da

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2244_118261736\manifest.json

Filesize
118B

MD5
b6c3a53fb568b72d31dec81b067c9ff0

SHA1
77728097bac348a4717aa95d4e8009d225482293

SHA256
602e1e0e0c8d630ec9f04f3f70b54ab0281942f4107e77047774fbdfa2d1acab

SHA512
b4d2204d7d30f7e09dd41bfcfe1ed4bfbee28357b49caf26d2a58f3c8346196f153616758eb86b1f03eabf02180506cbc36b23156fc47ce1c0b6922a7a4f718a

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2244_875198606\deny_domains.list

Filesize
12B

MD5
085a334bdb7c8e27b7d925a596bfc19a

SHA1
1e4ad53dc335af5c6a8da2e4b4a175f37fafe2f2

SHA256
f51a7acfffec56d6751561966d947d3fd199b74528c07dabdcf5fcb33d5b2e85

SHA512
c883cb43c97a136825c6fd143f539210c234c66f9b76dfd8431f6ff014094e20b9410d7462aadee2344df8ca158def6b9a807e7cadbdfa947f6f8592e7283e34

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2244_875198606\manifest.json

Filesize
176B

MD5
6607494855f7b5c0348eecd49ef7ce46

SHA1
2c844dd9ea648efec08776757bc376b5a6f9eb71

SHA256
37c30639ea04878b9407aecbcea4848b033e4548d5023ce5105ea79cab2c68dd

SHA512
8cb60725d958291b9a78c293992768cb03ff53ab942637e62eb6f17d80e0864c56a9c8ccafbc28246e9ce1fdb248e8d071d76764bcaf0243397d0f0a62b4d09a

Download Submit