hxxps://drive[.]google[.]com/file/d/1makjdn88CT_fmprgBq2kpIkUxwRVE3pQ/view

Analysis

user interaction
yes
max time kernel
67s
max time network
68s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/04/2026, 08:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://drive.google.com/file/d/1makjdn88CT_fmprgBq2kpIkUxwRVE3pQ/view
Sample260422-jz1cfafs21

Score

8^/10

discovery persistence privilege_escalation pyinstaller

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
115	3532	msedge.exe

Executes dropped EXE 6 IoCs

pid	Process
6068	kaee_fixer.exe
3972	kaee_fixer.exe
3980	kaee_fixer.exe
5388	kaee_fixer.exe
616	kaee_fixer.exe
3376	kaee_fixer.exe

Loads dropped DLL 18 IoCs

pid	Process
3980	kaee_fixer.exe
3980	kaee_fixer.exe
3980	kaee_fixer.exe
3980	kaee_fixer.exe
3980	kaee_fixer.exe
3980	kaee_fixer.exe
5388	kaee_fixer.exe
5388	kaee_fixer.exe
5388	kaee_fixer.exe
5388	kaee_fixer.exe
5388	kaee_fixer.exe
5388	kaee_fixer.exe
3376	kaee_fixer.exe
3376	kaee_fixer.exe
3376	kaee_fixer.exe
3376	kaee_fixer.exe
3376	kaee_fixer.exe
3376	kaee_fixer.exe

Unexpected DNS network traffic destination 4 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	flow	ioc	pid	Process
Destination IP	145	1.0.0.1	3872	netsh.exe
Destination IP	146	1.0.0.1	3872	netsh.exe
Destination IP	173	1.0.0.1	6096	netsh.exe
Destination IP	174	1.0.0.1	6096	netsh.exe

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
3	drive.google.com
4	drive.google.com
13	drive.google.com

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3760_1862966913\_locales\az\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3760_1862966913\_locales\en\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3760_1862966913\dasherSettingSchema.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3760_1862966913\_locales\is\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3760_1862966913\_locales\en_GB\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3760_1862966913\_locales\fi\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3760_1862966913\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3760_1862966913\_locales\fr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3760_1862966913\page_embed_script.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3760_1862966913\_locales\my\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3760_1862966913\_locales\te\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3760_1862966913\_locales\gu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3760_1862966913\_locales\ka\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3760_1862966913\_locales\as\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3760_1862966913\_locales\tr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3760_1862966913\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3760_1862966913\_locales\mn\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3760_1862966913\128.png	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3760_1862966913\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3760_1862966913\_locales\sq\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3760_1862966913\_locales\fil\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3760_1862966913\_locales\hu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3760_1862966913\_locales\sw\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3760_1862966913\_locales\th\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3760_1862966913\_locales\ta\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3760_1862966913\_locales\be\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3760_1862966913\_locales\cs\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3760_1862966913\_locales\mr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3760_1862966913\_locales\lt\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3760_1862966913\_locales\or\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3760_1862966913\_locales\hr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3760_1862966913\_locales\iw\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3760_1862966913\_locales\ro\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3760_1862966913\_locales\mk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3760_1862966913\_locales\pl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3760_1862966913\_locales\km\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3760_1862966913\_locales\hy\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3760_1862966913\_locales\ms\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3760_1862966913\_locales\sk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3760_1862966913\_locales\ar\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3760_1862966913\_locales\uz\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3760_1862966913\_locales\ca\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3760_1862966913\_locales\ja\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3760_1862966913\offscreendocument_main.js	msedge.exe
File created	C:\Program Files\msedge_url_fetcher_3760_139688275\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_104_1_0.crx	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3760_1862966913\_locales\el\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3760_1862966913\_locales\ru\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3760_1862966913\_locales\pa\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3760_1862966913\_locales\bg\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3760_1862966913\_locales\es_419\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3760_1862966913\_locales\hi\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3760_1862966913\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3760_1862966913\_locales\ur\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3760_1862966913\_locales\kn\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3760_1862966913\_locales\no\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3760_1862966913\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3760_1862966913\_locales\nl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3760_1862966913\_locales\lo\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3760_1862966913\_locales\uk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3760_1862966913\_locales\sl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3760_1862966913\_locales\gl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3760_1862966913\_locales\si\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3760_1862966913\_locales\id\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3760_1862966913\_locales\es\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
behavioral1/files/0x00080000000244ca-302.dat	pyinstaller

Event Triggered Execution: Netsh Helper DLL 1 TTPs 36 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3532	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 3 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
6020	ipconfig.exe
544	ipconfig.exe
4372	ipconfig.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134213188755521339"	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-721190819-434563495-2007910846-1000\{2F065046-0BB9-4166-B9A4-9CFCEB4FDACF}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe

Suspicious use of FindShellTrayWindow 41 IoCs

pid	Process
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
6068	kaee_fixer.exe
3980	kaee_fixer.exe
3972	kaee_fixer.exe
5388	kaee_fixer.exe
616	kaee_fixer.exe
3376	kaee_fixer.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3760 wrote to memory of 4868	3760	msedge.exe	85
PID 3760 wrote to memory of 3532	3760	msedge.exe	86
PID 3760 wrote to memory of 4320	3760	msedge.exe	87
PID 3760 wrote to memory of 3360	3760	msedge.exe	88
PID 3760 wrote to memory of 4320	3760	msedge.exe	87
PID 3760 wrote to memory of 4320	3760	msedge.exe	87
PID 3760 wrote to memory of 3360	3760	msedge.exe	88
PID 3760 wrote to memory of 4436	3760	msedge.exe	89
PID 3760 wrote to memory of 4436	3760	msedge.exe	89
PID 3760 wrote to memory of 4436	3760	msedge.exe	89
PID 3760 wrote to memory of 1824	3760	msedge.exe	90
PID 3760 wrote to memory of 1824	3760	msedge.exe	90
PID 3760 wrote to memory of 1824	3760	msedge.exe	90
PID 3760 wrote to memory of 4012	3760	msedge.exe	94
PID 3760 wrote to memory of 4012	3760	msedge.exe	94
PID 3760 wrote to memory of 4012	3760	msedge.exe	94
PID 3760 wrote to memory of 5280	3760	msedge.exe	95
PID 3760 wrote to memory of 5280	3760	msedge.exe	95
PID 3760 wrote to memory of 5392	3760	msedge.exe	96
PID 3760 wrote to memory of 5392	3760	msedge.exe	96
PID 3760 wrote to memory of 1260	3760	msedge.exe	98
PID 3760 wrote to memory of 2880	3760	msedge.exe	102
PID 3760 wrote to memory of 2880	3760	msedge.exe	102
PID 3760 wrote to memory of 2880	3760	msedge.exe	102
PID 3760 wrote to memory of 4620	3760	msedge.exe	103
PID 3760 wrote to memory of 4620	3760	msedge.exe	103
PID 3760 wrote to memory of 4620	3760	msedge.exe	103
PID 3760 wrote to memory of 5108	3760	msedge.exe	104
PID 3760 wrote to memory of 5108	3760	msedge.exe	104
PID 3760 wrote to memory of 5320	3760	msedge.exe	105
PID 3760 wrote to memory of 5320	3760	msedge.exe	105
PID 3760 wrote to memory of 5320	3760	msedge.exe	105
PID 3760 wrote to memory of 2584	3760	msedge.exe	106
PID 3760 wrote to memory of 6068	3760	msedge.exe	107
PID 3760 wrote to memory of 3972	3760	msedge.exe	110
PID 6068 wrote to memory of 3980	6068	kaee_fixer.exe	112
PID 3972 wrote to memory of 5388	3972	kaee_fixer.exe	113
PID 3980 wrote to memory of 5756	3980	kaee_fixer.exe	114
PID 3980 wrote to memory of 5696	3980	kaee_fixer.exe	115
PID 5388 wrote to memory of 2556	5388	kaee_fixer.exe	116
PID 5388 wrote to memory of 732	5388	kaee_fixer.exe	117
PID 3760 wrote to memory of 5808	3760	msedge.exe	120
PID 3760 wrote to memory of 5100	3760	msedge.exe	121
PID 3760 wrote to memory of 2836	3760	msedge.exe	122
PID 5388 wrote to memory of 3108	5388	kaee_fixer.exe	123
PID 3980 wrote to memory of 4380	3980	kaee_fixer.exe	124
PID 3108 wrote to memory of 1376	3108	cmd.exe	125
PID 4380 wrote to memory of 864	4380	cmd.exe	126
PID 3980 wrote to memory of 2600	3980	kaee_fixer.exe	127
PID 2600 wrote to memory of 5940	2600	cmd.exe	128
PID 5388 wrote to memory of 3464	5388	kaee_fixer.exe	129
PID 3760 wrote to memory of 2348	3760	msedge.exe	131
PID 3464 wrote to memory of 3008	3464	cmd.exe	130
PID 3760 wrote to memory of 2348	3760	msedge.exe	131
PID 3980 wrote to memory of 2776	3980	kaee_fixer.exe	132
PID 2776 wrote to memory of 3872	2776	cmd.exe	133
PID 3760 wrote to memory of 644	3760	msedge.exe	134
PID 3760 wrote to memory of 644	3760	msedge.exe	134
PID 5388 wrote to memory of 3280	5388	kaee_fixer.exe	135
PID 3280 wrote to memory of 3520	3280	cmd.exe	136
PID 5388 wrote to memory of 1040	5388	kaee_fixer.exe	137
PID 1040 wrote to memory of 6016	1040	cmd.exe	138
PID 3980 wrote to memory of 3056	3980	kaee_fixer.exe	139
PID 3056 wrote to memory of 5828	3056	cmd.exe	140

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://drive.google.com/file/d/1makjdn88CT_fmprgBq2kpIkUxwRVE3pQ/view
1⤵
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffc0606c188,0x7ffc0606c194,0x7ffc0606c1a0
  2⤵
  PID:4868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1824,i,7814224775511997519,12394801905879940947,524288 --field-trial-handle=2332,i,16127423868819458990,8241196743882040982,262144 --variations-seed-version --mojo-platform-channel-handle=2372 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:3532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1676,i,7471467315384750528,11926489045216727852,262144 --field-trial-handle=2332,i,16127423868819458990,8241196743882040982,262144 --variations-seed-version --mojo-platform-channel-handle=2324 /prefetch:2
  2⤵
  PID:4320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2392,i,12339992006868906715,6066708925383439798,524288 --field-trial-handle=2332,i,16127423868819458990,8241196743882040982,262144 --variations-seed-version --mojo-platform-channel-handle=2388 /prefetch:8
  2⤵
  PID:3360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3408,i,4819732290333233345,8088826866918635856,2097152 --field-trial-handle=2332,i,16127423868819458990,8241196743882040982,262144 --variations-seed-version --mojo-platform-channel-handle=3440 /prefetch:1
  2⤵
  PID:4436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3424,i,6167571034004654607,6249263753042844604,2097152 --field-trial-handle=2332,i,16127423868819458990,8241196743882040982,262144 --variations-seed-version --mojo-platform-channel-handle=3456 /prefetch:1
  2⤵
  PID:1824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4920,i,6386932134954053635,12477210417163752517,2097152 --field-trial-handle=2332,i,16127423868819458990,8241196743882040982,262144 --variations-seed-version --mojo-platform-channel-handle=4928 /prefetch:2
  2⤵
  PID:4012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5140,i,16028133779874365679,8758924370721352098,524288 --field-trial-handle=2332,i,16127423868819458990,8241196743882040982,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:8
  2⤵
  PID:5280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5136,i,1185044927720398786,11890630462601567702,524288 --field-trial-handle=2332,i,16127423868819458990,8241196743882040982,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:8
  2⤵
  PID:5392
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5896,i,10444522747214701556,8123644363016755375,524288 --field-trial-handle=2332,i,16127423868819458990,8241196743882040982,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:8
  2⤵
  PID:1176
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5896,i,10444522747214701556,8123644363016755375,524288 --field-trial-handle=2332,i,16127423868819458990,8241196743882040982,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:8
  2⤵
  PID:1260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=6320,i,7400123635952184192,7151213293145977706,2097152 --field-trial-handle=2332,i,16127423868819458990,8241196743882040982,262144 --variations-seed-version --mojo-platform-channel-handle=6300 /prefetch:1
  2⤵
  PID:2880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6420,i,16468485957408588333,12446175862141701931,2097152 --field-trial-handle=2332,i,16127423868819458990,8241196743882040982,262144 --variations-seed-version --mojo-platform-channel-handle=6416 /prefetch:1
  2⤵
  PID:4620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6336,i,8418438328985298492,3040527410763342136,524288 --field-trial-handle=2332,i,16127423868819458990,8241196743882040982,262144 --variations-seed-version --mojo-platform-channel-handle=6308 /prefetch:8
  2⤵
  PID:5108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6180,i,1421871314690264406,12160872578543916655,2097152 --field-trial-handle=2332,i,16127423868819458990,8241196743882040982,262144 --variations-seed-version --mojo-platform-channel-handle=6304 /prefetch:1
  2⤵
  PID:5320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7024,i,4565205851391578935,16017895891443026333,524288 --field-trial-handle=2332,i,16127423868819458990,8241196743882040982,262144 --variations-seed-version --mojo-platform-channel-handle=6368 /prefetch:8
  2⤵
  PID:2584
- C:\Users\Admin\Downloads\kaee_fixer.exe
  "C:\Users\Admin\Downloads\kaee_fixer.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:6068
- - C:\Users\Admin\Downloads\kaee_fixer.exe
    "C:\Users\Admin\Downloads\kaee_fixer.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3980
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c title kaee FIXER - ULTIMATE EDITION
      4⤵
      PID:5756
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c cls
      4⤵
      PID:5696
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "netsh interface ip set dns name="Wi-Fi" source=static addr=1.1.1.1"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4380
    - - C:\Windows\system32\netsh.exe
        
        netsh interface ip set dns name="Wi-Fi" source=static addr=1.1.1.1
        5⤵
        Event Triggered Execution: Netsh Helper DLL
        
        PID:864
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "netsh interface ip set dns name="Ethernet" source=static addr=1.1.1.1"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2600
    - - C:\Windows\system32\netsh.exe
        
        netsh interface ip set dns name="Ethernet" source=static addr=1.1.1.1
        5⤵
        Event Triggered Execution: Netsh Helper DLL
        
        PID:5940
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "netsh interface ip add dns name="Ethernet" addr=1.0.0.1 index=2"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2776
    - - C:\Windows\system32\netsh.exe
        
        netsh interface ip add dns name="Ethernet" addr=1.0.0.1 index=2
        5⤵
        Unexpected DNS network traffic destination
        Event Triggered Execution: Netsh Helper DLL
        
        PID:3872
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "netsh interface ip set dns name="Yerel Ağ Bağlantısı" source=static addr=1.1.1.1"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3056
    - - C:\Windows\system32\netsh.exe
        
        netsh interface ip set dns name="Yerel Ağ Bağlantısı" source=static addr=1.1.1.1
        5⤵
        Event Triggered Execution: Netsh Helper DLL
        
        PID:5828
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ipconfig /flushdns >nul
      4⤵
      PID:1904
    - - C:\Windows\system32\ipconfig.exe
        
        ipconfig /flushdns
        5⤵
        Gathers network information
        
        PID:6020
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c pause >nul
      4⤵
      PID:5496
- C:\Users\Admin\Downloads\kaee_fixer.exe
  "C:\Users\Admin\Downloads\kaee_fixer.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3972
- - C:\Users\Admin\Downloads\kaee_fixer.exe
    "C:\Users\Admin\Downloads\kaee_fixer.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:5388
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c title kaee FIXER - ULTIMATE EDITION
      4⤵
      PID:2556
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c cls
      4⤵
      PID:732
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "netsh interface ip set dns name="Wi-Fi" source=static addr=1.1.1.1"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3108
    - - C:\Windows\system32\netsh.exe
        
        netsh interface ip set dns name="Wi-Fi" source=static addr=1.1.1.1
        5⤵
        Event Triggered Execution: Netsh Helper DLL
        
        PID:1376
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "netsh interface ip set dns name="Ethernet" source=static addr=1.1.1.1"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3464
    - - C:\Windows\system32\netsh.exe
        
        netsh interface ip set dns name="Ethernet" source=static addr=1.1.1.1
        5⤵
        Event Triggered Execution: Netsh Helper DLL
        
        PID:3008
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "netsh interface ip add dns name="Ethernet" addr=1.0.0.1 index=2"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3280
    - - C:\Windows\system32\netsh.exe
        
        netsh interface ip add dns name="Ethernet" addr=1.0.0.1 index=2
        5⤵
        Event Triggered Execution: Netsh Helper DLL
        
        PID:3520
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "netsh interface ip set dns name="Yerel Ağ Bağlantısı" source=static addr=1.1.1.1"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1040
    - - C:\Windows\system32\netsh.exe
        
        netsh interface ip set dns name="Yerel Ağ Bağlantısı" source=static addr=1.1.1.1
        5⤵
        Event Triggered Execution: Netsh Helper DLL
        
        PID:6016
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ipconfig /flushdns >nul
      4⤵
      PID:436
    - - C:\Windows\system32\ipconfig.exe
        
        ipconfig /flushdns
        5⤵
        Gathers network information
        
        PID:544
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c pause >nul
      4⤵
      PID:2332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7228,i,17367940325718307125,5838485139945367228,524288 --field-trial-handle=2332,i,16127423868819458990,8241196743882040982,262144 --variations-seed-version --mojo-platform-channel-handle=7216 /prefetch:8
  2⤵
  PID:5808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7204,i,10623964010900690362,5601098703106022793,524288 --field-trial-handle=2332,i,16127423868819458990,8241196743882040982,262144 --variations-seed-version --mojo-platform-channel-handle=7184 /prefetch:8
  2⤵
  PID:5100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7224,i,18399659290494415312,13087104715870685004,524288 --field-trial-handle=2332,i,16127423868819458990,8241196743882040982,262144 --variations-seed-version --mojo-platform-channel-handle=7296 /prefetch:8
  2⤵
  PID:2836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7296,i,9281775066056983056,2973826161459124250,524288 --field-trial-handle=2332,i,16127423868819458990,8241196743882040982,262144 --variations-seed-version --mojo-platform-channel-handle=7192 /prefetch:8
  2⤵
  PID:2348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7304,i,14632074418390115963,3740914806593701317,524288 --field-trial-handle=2332,i,16127423868819458990,8241196743882040982,262144 --variations-seed-version --mojo-platform-channel-handle=7128 /prefetch:8
  2⤵
  PID:644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6672,i,7189146830384067582,14828785710743460188,524288 --field-trial-handle=2332,i,16127423868819458990,8241196743882040982,262144 --variations-seed-version --mojo-platform-channel-handle=6668 /prefetch:8
  2⤵
  PID:2524

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2460

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1040

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5348

C:\Users\Admin\Downloads\kaee_fixer.exe
"C:\Users\Admin\Downloads\kaee_fixer.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:616
- C:\Users\Admin\Downloads\kaee_fixer.exe
  "C:\Users\Admin\Downloads\kaee_fixer.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:3376
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c title kaee FIXER - ULTIMATE EDITION
    3⤵
    PID:4080
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:3976
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "netsh interface ip set dns name="Wi-Fi" source=static addr=1.1.1.1"
    3⤵
    PID:4744
  - - C:\Windows\system32\netsh.exe
      netsh interface ip set dns name="Wi-Fi" source=static addr=1.1.1.1
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      PID:4728
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "netsh interface ip set dns name="Ethernet" source=static addr=1.1.1.1"
    3⤵
    PID:5100
  - - C:\Windows\system32\netsh.exe
      netsh interface ip set dns name="Ethernet" source=static addr=1.1.1.1
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      PID:5196
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "netsh interface ip add dns name="Ethernet" addr=1.0.0.1 index=2"
    3⤵
    PID:2072
  - - C:\Windows\system32\netsh.exe
      netsh interface ip add dns name="Ethernet" addr=1.0.0.1 index=2
      4⤵
      Unexpected DNS network traffic destination
      Event Triggered Execution: Netsh Helper DLL
      PID:6096
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "netsh interface ip set dns name="Yerel Ağ Bağlantısı" source=static addr=1.1.1.1"
    3⤵
    PID:2764
  - - C:\Windows\system32\netsh.exe
      netsh interface ip set dns name="Yerel Ağ Bağlantısı" source=static addr=1.1.1.1
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      PID:5232
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ipconfig /flushdns >nul
    3⤵
    PID:3096
  - - C:\Windows\system32\ipconfig.exe
      ipconfig /flushdns
      4⤵
      Gathers network information
      PID:4372
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c pause >nul
    3⤵
    PID:5368

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 030978901609c12837a9b1afdcd1ee9f12ef19339fd94725f17a7cdb1e945f36
MD5 35e76198d1c2c61d3c2a49119ba65747
SHA1 a5ae8329c9e762bed0a3d6bc5584e8faf6d26a77
SHA512 8b21ab6c5e29ab0ea7652b7adadb04a05eb734a52faa779252fbec4acd45079c7ad3f83f36227a419f0a59fc94eb1cf408bcd782459cf4691b6eb727be746fd3
TLSH
T136D0800925B7DC74D059847018977B4D7555CD6B4D4657163473283D1C4B4504D911DB
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 827caedd6ba67a465e2378da508ebf9f7e5dc38b9ff3d1086fe8a0b10ad23634
MD5 6a7649ad8529021b8a0bf012adb69564
SHA1 bc6cb8e64c0f5c84a887a19005280de2e2ff95dd
SHA512 316ecd29696eeae0002f91778818c1c4166e5bbf8440eddea3560a6ea0fb49f25e4e33c48c2d7c73eb08507c015f5aa7eb4187e6558ebdc4cd44c5bd980d8c3a
TLSH
T133D0800529B3DC74D055847018D77B4D7665CD6B4D4657163473283D1C4B4504D911DB
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 38b6c65afe43417a0a77ee2fe410c8c373985351a8748557d716759d98fcdc68
MD5 809809042a834318eb848b9d3517cd80
SHA1 343d3b29251aae0a9a2460c9d28be57b9dee0794
SHA512 485396589bc09bcbadc09b28cf9bd51a93edc96c19bb2f9830d99dc93e4ecf89b1d9aded6d7cd6409009195e8ae6df09c56cfca12c5608104721ce52617a7a69
TLSH
T184E02BAAC862EC2709FD171960905646F75413873782485F3E3C93088FB593B458EC5C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 712a5dbfb27ea208634d90827fe9dcecdb658faeb7ccdc867358ff2bba85b587
MD5 6a9f51038fbe596b0d96b9a490ea2033
SHA1 de0e4d2eaa73e182aad4fb3b1fa5fc706e6e0879
SHA512 9588092d46a20d4632cf686aa5181d1372bacd9eeeddebb362d8cb7ac6b162c5ea3d7328d4202d962077d617b1aff0494921b8584cda8f5938979e47b5b7781c
TLSH
T1868128C7CEA78129E7E461B797D514C0B2B04769414B3E1639F96C3E9AB6FA31145480
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe589c0c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe589c0c.TMP
Size 3KB
SHA256 092d6d84e4bd4f12fef7f4abf9c6f83f6e426fabff2b04b46d208e2176e49413
MD5 b2c140f52fb3ff40d8f91c253387b3e0
SHA1 cd82fc868026664e4f8fdc16839bb60ff758760d
SHA512 5f123c0e46ed95de69fdd4a269fdb777ff57ddc987d32720b090dc75d12b05740a2235968f724a2b003c395b05875054471b4890654d553166a1a161edec9ca1
TLSH
T1A361F6C7DF838429E7E461B7A7D510C1B6B4873A418B3E267DF96C7D8AB5F934140484
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 8515314955659329c75e42f7ee7e6e715f43510990155ec3b31c0f3c3372f9b1
MD5 c612455449911d5c03b62fbfce127dee
SHA1 864196bc561a13a0f7fe8bb2c3a0d1c18fb58700
SHA512 a36bd460cac8b7f534b4c77a8bfaf4d3b008f1cbd3ffd757019140ae20ae57721d9d4f7be5dcf79584373f9fb675db5ee03ebc5ecc7f73d13dfcfb4e46ec5ca0
SSDEEP 192:sxZaRhyMqZ/K1Ml8MkU/f4sA92ruV5O0qrjQzzodppAHW6+WNyIn/YKWtlmChwIE:sxZaaMU/f4sA9LFiRKHb1/amC+jD
TLSH
T1BE72E8196A38597B8CDBD209FA45BB53D7F91523D1900E48AAFCCA1C04E6ADD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 dd0a70c8262f9fffaa29a3c47bb251db65778f31df82fcf17811ef0cc80ea8be
MD5 de534f352eb6f4f78938351048be601f
SHA1 3b9384e0f1d22c0ebd92f48b0840520a04ef4ccf
SHA512 b5a1b3fa608063aba9f0582efb84c2e38322557293231b7403af1c0b61a99adf67c3f5b2c3ddb0105df22de1a2cca2635f98993a83589e9d81f5dbdc8e2dd81d
SSDEEP 768:DcgLiPo7pLuLXLeWvaShq8F1+UoAYDCx9Tuqh0VfUC9xbog/OVlXMKJLlhzCpUrM:DcgLiPUE7eWvaShqu1jaEMKJLDOp//
TLSH
T15BF20C3B6C0CCB7E4F844E9CDC2ABE8E6DE8028B9698C95447FA444C03C66EB55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 7ea84663d5745243f20e5e39f444d62a55f52310a4fd8f7f26b73a57e0fc3b12
MD5 0acbbf13774583853f8535aa2457601a
SHA1 fd01a51de1e88bee6978e6f4ea387d84e6b7ff19
SHA512 40f379604496638ab42ca9ade525a856ae4f9df161ee7e886c26faa586718ab5303d4c9df2589710304653e39c06e7d975a1389b29b98f8e854a1f6b5711d844
TLSH
T185A00216918E5442CD2C86F9215525412BF1485D011322114490D4DDED915D05DC1113
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 a7e9af3328318aaf6a8a112fce77d78b332c4636aa1ccc23012747f3bf96431c
MD5 c17edc46cd3f96104cef5e62e761aedd
SHA1 48997a2eb74e248715126341e634d41631455281
SHA512 fccc357abb6ef6d5b13dfc294c8ce8bbe537c4b7aeba32c4c254b2bcfa265dad7fe9b92988631200c254b8facae0a331b9a918aae7bdb2e9ccb2deb0a3d29428
TLSH
T157B00235911E7086C45C0FB590D6648877740D398246272269E8ECFFDC676C0699A54B
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5880b4.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5880b4.TMP
Size 72B
SHA256 be951fb9055beded6215000b04bf4eab50af5eb566a6cc35e27d69fe891a1339
MD5 1dc73e4fb7dcd972177a447541a228fa
SHA1 adb5afc7a1736ec242b1b65f24e361f62db80858
SHA512 2f05ff15d3d12c977b87a7e62c6d9f52df5f943a75f134047793647be07c38772a53b91166f35385b2bde455d503dbedd8465d7376ab6269f2ed6fe341e5ca01
TLSH
T113A00220834B1401C60805BA101526401760CE591404135254A098DDECA18C56FC5103
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync App Settings\dcaajljecejllikfgbhjdgeognacjkkp\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync App Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 c832d5699b6bad33ddab6ef24d547d4d58d752806e3c451b9c2d3a83fbfb71ed
MD5 4eafc8063320dc847279a3eae54431f3
SHA1 b6ddd546d23fd0924144f81a588e35abb05cc703
SHA512 acdc40a28cfa99073adb893f8f1a6fa2081c31a1162d981b2b1cf841c70196477cd9d5a9ad189a5210462caf9299726eefef655a508c910860659bcd07042b0c
SSDEEP 192:kBhNHfIVfhRXF4B6W4KqV2j6Ok4pYLQobOyzcp/KLNz3BlrjV:krN/INhx+kcxKBzxlXV
TLSH
T19CB24A11317A02C13A7E399E8595B42F26C230A33198B53B7BB954A60F6BE20DDFD4DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 3e9645860198380fb90e2a641ab0c87fcb411ae94023eeca917adf68182a1640
MD5 704aee4f88ee9377d1cde152b3f23429
SHA1 8b1a75bb3c405520746a99c5cf4a2741b227e009
SHA512 2ffe7db55f0474c224f3ec62d51a52e7aa8c8b12c617921fa463b90d12393ccb91fa7a5f03d2a0c2717e504f795aaffc6f5ac9bc491aa47ee1e35ea108fef779
SSDEEP 768:u5Fayv3CwgHtUuYVpU1tRYk1me/06sXjg:Pyv3Ytm2mkEe/9
TLSH
T156C24A36EC94DDABEDEB9FC9A7497A07EEE00267C58C4AD4DAD80D1E009719D130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 c25b4340494cce063ebe1aa43f4f400ecd7c066d00eb668dfb2e690a1f84df7d
MD5 48c38a3882720120db80e6518b585f26
SHA1 de3b22e3e5ffe6b25e856a01d9044760971646b7
SHA512 512c560197423bb3c4a576c6e268a1d3fd4a6baaf0d5b94f3e99082590c4afa3e5d29cae5c3fa0941b8299033558c26c71199d78ed4a8c6a01254d4d50a5b803
SSDEEP 384:nZyiFcjccCs+Bt0S3m3sNJ8TUNTUlI4PZTPgUr2OwfjYVpoF35J+lkSBFf1+rN12:Z5FaccQG3Mwg2Br6YVpUOkSlSwT
TLSH
T145C2393698A4DD7BFDE78F96B3597643EEF001A786885AE4D9C84D1D00871DD130BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 3e2ae4dccca71f8d43df27d64f2d8172af885cd0c9077d28cebff0875f84c54e
MD5 de76fc096b976e24193a9ee1a812253c
SHA1 7ac4f7c4509a07061e92f234d20385ddeb13b707
SHA512 953d884123afbd7dc8af120243f07154b788565cd7272dbf31bd881365dbf700410c94d0aa27970375a6ddc786f798ba1341080e14d73195a39bf8bd5ec67f88
SSDEEP 384:nZyiFIjccCs+Bt0S3u3sNJ8TUNTUlI4PZTPYUr2OwfjYVpoF35J+xkSBFf1+rN12:Z5F2ccQO3Mwg2pr6YVpUOkSlSwT
TLSH
T101C23A3698A4DD7BFDE78F96B3597643EEF001A786885AE4D9C84D1D00871DD130BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 a1eb029b2ac235dbd30c6324466a8ec38df80ace1125e4580515b09fed230803
MD5 565d7c0c1af5e268767e7b98b58fd079
SHA1 f87015e89338ae000f7b66ce357d136752748db7
SHA512 e88d5665ed240c1915cb89a543e1541a001d7e1fa5d0601e09825327dd617a4342a1f3f0053f545af9d6e9d0fedeeab9435442cb9edd628f052ce8232ea96525
SSDEEP 384:nFyiFJjccCs+Bt0S3P3sNJ8TUNTUlI4DZTPQ7qOwfjYVpoF35J+lkSBFf1+rN1kh:F5FJccQv3MwgyieYVpUOkSlSwT
TLSH
T139C2393698A4DD7BFDE78F96A3597643EEF001A786885AE8D9C80D1D00871DD130BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 c387fbd25f52dbc27ae5911d231db02a50ca48a5bd6ad8295db8bc6bd033bf51
MD5 f3c0605579bafa7bd3b917f93f1695f3
SHA1 2622cb4eca48db469f35c60727368535a0c0e124
SHA512 077b6afbb77f1a666c9631ec3f2da91c4a5d00eedad5258709e3112ebf1f8472392a8bf46984e726cf3fef1d9094820ac5f9fb3b1aa3f229e13db0ed6c83726c
SSDEEP 768:T5Fayv3cwgHbUhYVpUtkRYk1me/06sXjg:+yv3ebf3mkEe/9
TLSH
T138C23A76E894DDABEDE69FD6E70A7A03EEF00267C58C4AE4DAD80D1D009719D130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 57342552c23c6c2c734c07b68391f2552f66ed231b8ef03471fc47a5d76e677f
MD5 23445c9faf7881c54ecce78160f5d572
SHA1 d2f702139316093e996d0db37e5379dd08b92fe7
SHA512 152be40fd566e9a516fc80f353d2d1c4c7b97b13c7eba4546ef334489f41ca9a7dd614ff1c7cb18b35ba3a824597a9f1b7ad4e30e060440a1f743fd0c3010844
SSDEEP 384:nFyiFavqM73sNJ8TUNTUlI4TZTPT7qOwfjYVpoF35J+ck5wpYSrN1k+5vI+io:F5FayM3MwgIreYVpUxkapYuWo
TLSH
T1C5B22976E8A4D96BEDE79F86B71A7A43EEF001A7C58C4AE4DAD80D1D00871DD130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
Size 147KB
SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
MD5 9c670f04d98ab7404f16423f6ee6cdfa
SHA1 8d01079b2d065731df8a7ef52f447cd4b7add353
SHA512 102cee76d9dfcfe91e044f529672fbec042b50c5db55a3cc137197b2013dd7f81e47f50dbb0db96cb621c5732610e1eb553c4146837c11075c7c4dbd67546a3b
SSDEEP 3072:F7R0M+jCozOtDTsjMcT0JnFjkbxnEbm/+OdGmlVVklFHEpCm+:F7WxxzyDTM0JnRkb5bJdGmJkvkpx+
TLSH
T12DE3E16D3DE6DE1FC41B58F53E64708BC80E8F0B820A644FB64988345A60B5D1BD6AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 54f761e00d363bd15db7bae3cc55144c80148a5fa1db7c3c2049e0e406a9142c
MD5 b1ac780361002049b0a10a7fd30fd809
SHA1 0ee0a7dc27fd175ab7abd6e5649890be3e2795b5
SHA512 1bd8b1d2dc30bc62728d3d08085a446e8c037b02499687affa9a0bb18c6bdfee19104eabdcd8a52c2d0b542046abf26b7fdf81815037d4923e31231b0dfb7d60
TLSH
T156C02B5538F9488C2FA5257ED238092E12E4C912310022B0002ED804103465C13A0C2F
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 4fd1748880ca4f6a4fc9ea5c19db9fcd2b3345326e72e84c9d9768e90b3058ac
MD5 3916c276ae99ccdc4a62c12d228159cb
SHA1 601daf6640aeedaa019e73c9896e03296070e9a2
SHA512 b76d3f7cefe55cfba5348ba2d01fe3bbae93926a1e05a56c37040dd69708c45af051ab6590e20b0adb6885acd89d43349aaeb78ce0a53501c1e52ef4f84b9122
TLSH
T16541F798B6EE1108B3B76E5A9BF3A86D447EBC372F4BD46D00110E4F0A63A41C961737
MD5 SHA1 SHA512 TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI39722\VCRUNTIME140.dll
Size 117KB
SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
MD5 32da96115c9d783a0769312c0482a62d
SHA1 2ea840a5faa87a2fe8d7e5cb4367f2418077d66b
SHA512 616c78b4a24761d4640ae2377b873f7779322ef7bc26f8de7da0d880b227c577ed6f5ed794fc733468477b2fcdb7916def250e5dc63e79257616f99768419087
SSDEEP 1536:Z9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaLjTz164zEd:ZEnsvReGsWyxLizXFkecbd1aPTzW
TLSH
T10DC38C8572A002FBD16AC274C1A36A17FB75B94487B0A7CF03B58A650F53BE09E3D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI39722\_ctypes.pyd
Size 124KB
SHA256 0e56107a891100535f2da79d85a5ae65ff1227b4765bd108f8593ac1a1110d81
MD5 9314ab9707985aaf6e234b5c1fc3c3c6
SHA1 e8ba1f40f800397e3e6a7f95ffe2b9f63bf812ed
SHA512 a8436ccbc32dd31694d3a66072fa76933a2ecf0ef5eaa0b79380e6c53c8e8bd0bfaf7fe9341c17ced215792f3990f4ef220049da92dd4991ebc1d83ef3d41484
SSDEEP 3072:SxVJxKqXCjbqPzMM+kffELENy/Zq4e4lIWLPhG:UHxKsCbqbffELCya4c
TLSH
T197C35B0B739410A6EBA35178C5B36F07E7B1B42B171183CF02A4C6992F637A36E6E715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_decimal.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI39722\_decimal.pyd
Size 255KB
SHA256 aeacfead2befcc0768063a037bb64bd32109ae09cb144e5f571b04dd7965db9d
MD5 240a03069d6968741b703d026337ad2c
SHA1 42e6298c697e48d062db8835bafb976ef76b1f73
SHA512 60b99cd5f1c66514fcd674f3400dabe84f4cff55a0d5ff5959879d226f3dbe85d325630a4a5583e54e8af313216fb3288d9a466d285973078675677dd6470117
SSDEEP 6144:MsO6Ms4BvOcJ3TXFIZK1qGh9qWM53pLW1A8A/ctJuHI:4BvOcJ3BIZ/Gk6A/kJuH
TLSH
T105446B56A2490DA4EE738074889BDA57FBB278960320D78F43B48A973F577A3137D348
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI39722\libcrypto-3.dll
Size 5.0MB
SHA256 ccfffddcd3defb8d899026298af9af43bc186130f8483d77e97c93233d5f27d7
MD5 ae5b2e9a3410839b31938f24b6fc5cd8
SHA1 9f9a14efc15c904f408a0d364d55a144427e4949
SHA512 36ea760a7b56ea74174882155eddfb8726828240fcfc6b34d90ecdb7e50a7e632374dcbc9b2889081c0973cc51f50967e7d692498c4abd1f2cba3f7fe8d659cc
SSDEEP 98304:M3+lrVT/8LpQmNPMRLuPWv1CPwDvt3uFlDCJ:6yrVT/8LvPMRLui1CPwDvt3uFlDCJ
TLSH
T1F8368B6AA7A80148E4BAC13CC9534617D2B1F85A57B097CF18A1967D0F37FDA2B3E740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI39722\select.pyd
Size 32KB
SHA256 d4d7181b11db0bd22a6cd5cda6f8583d1f5c77615fd0a6ca33350619d6e0438a
MD5 74b93bc6c37d47011f92024f060c6784
SHA1 0e9cd2e881ad58818fc75b1fda765841995a92dd
SHA512 7c92a9c3d676ebf5211b93c7e44cbc77e17925d2ccaba97aa9b52d3fb4050e746ea4a86e82f9553717ddeffade3aaf518563a442578899bc05d65cac57031b58
SSDEEP 768:gFOLHfEDnlIWQGiOytxJEKrLy2Ip4MTxf1mltPRVugwH:gFOL/EDnlIWQG9ytH/9gfIZRsXH
TLSH
T146E27D8AAB245087F963CA7186A2CE43F939B7E3471146CF30A5D2991E237C1B73A355
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI39722\unicodedata.pyd
Size 1.1MB
SHA256 208ee1cd3cbad0828433ca7246b05be2b1ff5569983d27d296c0b38888585488
MD5 24921918fa1451e9424881aa2867b175
SHA1 799de1d302eaa9622d2367bb2df5b71a98fca9a5
SHA512 3c44cff1efe1b0484d9ae9cac5576b737253eca9a4e86a7fcd534fc563e2a705c23d9fd9ca0eb41f61729622a532ecefc25c12b4c95dd3290ebcb3286519fecd
SSDEEP 12288:4SfHdcM6hbwCjJ43w9hIpCQvb0QN8MdIEQ+U2BNNmD+99Ffcivk:4SfXVCjfk7bPNfv42BN6yzUivk
TLSH
T140355BC5BB828E66E87B31B944D1212F1360C273476B573BB25513294C8B3B74EE69EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI60682\_bz2.pyd
Size 84KB
SHA256 65f610646d10d5babea080e060d244b546ec52c54012e5e937dc72dcc2e2e7bc
MD5 2be172c3086efe56c7e1d3279142295a
SHA1 910e0d7ec11d1efda15d03ef826423834aa59fe3
SHA512 37f84d9e6d766d8a97ccf0bd3c1a2a07f528cf45290762ef1f45e603cb513f43befec046693cf2e029366cca1682cd2753e54c53431773aba63c840bafcbf369
SSDEEP 1536:5Qioz7CmAZG1OwJYrmbdmmv0KV06G68u+SSnrO+pIWCVeytH/9vfIZRE2:dozW2vJYanvEd3rlpIWCVWZb
TLSH
T184839E82F36857F6F49B91B986810797F770BA55071093BFF288C2992F03B816E5C35A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI60682\_hashlib.pyd
Size 67KB
SHA256 03d233dbace599168eaffec823de6ed7beec8c2a4ebfe9b8a3d8e042a59af3ba
MD5 72b2f8cdf8d6b1dbbdd4e0c0bacf849e
SHA1 54d10c68abecefa52f866bd13779544616c6b286
SHA512 827bd7f6aaad7184b3bce810d027055e15818208c8b167ef467bfb21d83103ff24f6d90fe0a500297a93d66d5cddd41eb1cb632f124171b042506a417d5eb15c
SSDEEP 1536:gksa/wmb96DB9qWptC8SBIWOIuytH/9SfIW44z4r:gHH9qWptClBIWOIBW4IQ
TLSH
T1B3639E0AB6944194D9A78175C9A39F53F9F1F28217206BEF4268C0CD2F233C3A77A756
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI60682\_lzma.pyd
Size 157KB
SHA256 e3deecc1f59a3b811c608861decd84de1e8df8bafd5e2b39188861318c5a38cf
MD5 7c25a079b992919cc97221955dac050c
SHA1 d12d4e0f36bad9c578dcb69436fc2a7505feb316
SHA512 ac7e3a3c7b8f766a0e0811718a048f0f8a4340374023fcfc7df0454e030521cd52314c23e80de118f24755046d77bac17d5abee634e7e5fe950b97f53bf5a64d
SSDEEP 3072:tfXToXxWCKqZGOPenZCIlznfF9mNoxe6FK0GIHMJpIWZ1iW4I+:troXxSBOMvNYOxzxGIHm
TLSH
T10CF34B96B394F0D5F7328C38D6628F53E7F5785A0320929A01CC976D2B1FB759A2A313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI60682\_socket.pyd
Size 83KB
SHA256 3efa4636cf9e350856f6927d67a4c2564bf9bd2758a00bbf17d3aece5b60016d
MD5 0106ee3f61a54d922190b3a01c81a453
SHA1 420bd90297b2df30f00813e4ee17177fa0c77c3b
SHA512 393bb603efa2f1fb783f2a9b898911af0882ff5919c2b3cf615845a349662b7b64d276398187b11f2c5c07a022459dd8d8b41c0ce331bc31c5f088056da7083c
SSDEEP 1536:BdcydNg46ARGrwISALqwXV9/s+S+pzgMX49IEuDQ6JnlIWLwhmytH/9hjCfIbp:B6ydCA0c6qwXV9/sT+pzgV9IbDTJnlIR
TLSH
T193835A10A6A051FAEB63D075C2639F63FBB4B6C12395935F1092C65E1F33782AE39B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI60682\base_library.zip
Size 1.3MB
SHA256 31d76bc7d49f07c7b57fba4a43ad4d9521cf6a4bf5f4d0d8d61bb696423b6ad1
MD5 895b60297e48d58b010ac498168cf3b2
SHA1 e4d551dff1dd51b75f424392700fc8bb12467a26
SHA512 c0e200eb80c3c732b7f4efdeb19b5241837a3f83ce6e248971ea4504b9615eaed955282976736f55f4bd155e89e7dc82b3e6c5d5f9afa9d559977904d7ab8e10
SSDEEP 12288:9rmn9bRrynVTVihlyixmpvQXMHYR8lJGUm29W3L/sQIa2/HNHbP1dmBNqa:969bwho8lJGU19wd2/HJbP1dmSa
TLSH
T1F455D6817A92A5B3FC84F3BA04260A0EA3658571BF44C747389FC5E56F8F2E49E914DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI60682\libffi-8.dll
Size 38KB
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
TLSH
T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python312.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI60682\python312.dll
Size 6.6MB
SHA256 9a0e3435aaa680d868150f87ab3e388ad2eebc22f87e036155c7b4eda8cd2120
MD5 de50496cece613ec7ebedbf9f2aefecd
SHA1 6cd49527f647f7ea96872b89bb4fde20afbada1b
SHA512 a8d22a6f6140280ff36476cdc7cda4a3ebc46f0ac63b2a3c44fbd5f45aa3d343121e63b092b320d1dd8dbb7bc586a679bbcf738f485f36502a34592521aaf7a8
SSDEEP 98304:2nZOqBIZAopgdKJUskfih6ZizvmHDMiEXAbBu:IoJedKJnkf8ivs
TLSH
T12C666B15729CC0A9C96795B8CC13C28EE7B27C117F51434B30ABB71E2F733A1966A789
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kaee_fixer.exe

Path C:\Users\Admin\Downloads\kaee_fixer.exe
Size 7.0MB
SHA256 9f013bae710dc90dbc81d8e1aad984192ac97ce85a17d778a4975b3e8f126efe
MD5 a3f678b1272c3e5a23ab896fc598f472
SHA1 6348888aae08877f619a8548f0f8c603ac7c94d8
SHA512 d18da2d30efb6110a03d537160994a442287d53ed421e0b2ce0b8b59400226bc5e57ec835f072d9cf835d99592a83162badfe53448c15770b403299dea994459
SSDEEP 196608:OR2eknurHMuhHToAUPNfGU5vXvcLOdIIZ+:OEnuJhHTodRGkX0yZA
TLSH
T1207633ABB3D459F9FDB7E23CCA134255A77538421731C5DB02D886A23E375B02A39722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads