Overview

overview

10

Static

static

3

2026-10-16...yn.exe

windows10-2004-x64

10

2026-10-16...yn.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    135s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    17/10/2026, 18:06

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-10-16_4b7f0844366da346345e9a752ecc3a2c_amadey_elex_hellokitty_luca-stealer_njrat_swisyn.exe
  • Size 1.8MB
  • Sample261017-wp4y4abv31
  • SHA256 f6393ebaeee7e4cd41224b3258b3d5b1c480ed017c6d222207b914fb830801c4
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoverypersistenceprivilege_escalation

Malware Config

Signatures

  • Modifies visibility of hidden/system files in Explorer 2 TTPs 2 IoCs
    defense_evasion
  • Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs
    persistence
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 20 IoCs
  • Loads dropped DLL 17 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks system information in the registry 2 TTPs 10 IoCs

    System information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Reads the TCP/IP host and domain name from the registry 1 TTPs 18 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 17 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 3 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Modifies data under HKEY_USERS 41 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 19 IoCs
  • System policy modification 1 TTPs 1 IoCs
    defense_evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-10-16_4b7f0844366da346345e9a752ecc3a2c_amadey_elex_hellokitty_luca-stealer_njrat_swisyn.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-10-16_4b7f0844366da346345e9a752ecc3a2c_amadey_elex_hellokitty_luca-stealer_njrat_swisyn.exe"
    1⤵
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4976
    • \??\c:\users\admin\appdata\local\temp\2026-10-16_4b7f0844366da346345e9a752ecc3a2c_amadey_elex_hellokitty_luca-stealer_njrat_swisyn.exe 
      c:\users\admin\appdata\local\temp\2026-10-16_4b7f0844366da346345e9a752ecc3a2c_amadey_elex_hellokitty_luca-stealer_njrat_swisyn.exe 
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2376
      • C:\Program Files (x86)\Microsoft\Temp\EUB3F4.tmp\MicrosoftEdgeUpdate.exe
        "C:\Program Files (x86)\Microsoft\Temp\EUB3F4.tmp\MicrosoftEdgeUpdate.exe" /installsource taggedmi /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers"
        3⤵
        • Event Triggered Execution: Image File Execution Options Injection
        • Executes dropped EXE
        • Loads dropped DLL
        • Checks system information in the registry
        • Reads the TCP/IP host and domain name from the registry
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3168
        • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
          "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Reads the TCP/IP host and domain name from the registry
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          PID:1308
        • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
          "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Reads the TCP/IP host and domain name from the registry
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          • Suspicious use of WriteProcessMemory
          PID:560
          • C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.265.7\MicrosoftEdgeUpdateComRegisterShell64.exe
            "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.265.7\MicrosoftEdgeUpdateComRegisterShell64.exe"
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Modifies registry class
            PID:5648
          • C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.265.7\MicrosoftEdgeUpdateComRegisterShell64.exe
            "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.265.7\MicrosoftEdgeUpdateComRegisterShell64.exe"
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Modifies registry class
            PID:3224
          • C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.265.7\MicrosoftEdgeUpdateComRegisterShell64.exe
            "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.265.7\MicrosoftEdgeUpdateComRegisterShell64.exe"
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Modifies registry class
            PID:6072
        • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
          "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4yNjUuNyIgc2hlbGxfdmVyc2lvbj0iMS4zLjI2NS43IiBpc21hY2hpbmU9IjEiIHNlc3Npb25pZD0ie0NDRjA1QUU4LUM3RjgtNDAzOC04QjQzLUREREEyNUExOEM0NH0iIHVzZXJpZD0ie0YyRjBGNDBFLUI4NTctNDE5OS1BMEJDLTJCQTgxOURFOUU5OX0iIGluc3RhbGxzb3VyY2U9InRhZ2dlZG1pIiByZXF1ZXN0aWQ9IntBRTkwRDI1RS1ENUUyLTQzMTgtQUE2My05MTNFOTkxMjU4MEF9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iMTYiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4yNjEwMC4xNzQyIiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iMTkxIiBpc193aXA9IjAiIGlzX2luX2xvY2tkb3duX21vZGU9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSJEQURZIiBwcm9kdWN0X25hbWU9IkRhZHkgc3VwZXIgcG93ZXJmdWwgUEMiLz48ZXhwIGV0YWc9IiZxdW90O3M4RmFudndmTWNkNjZnN0xWMlBlYVNSN1dVT3YwbHVGNGh2aWlyVG9rK009JnF1b3Q7Ii8-PGFwcCBhcHBpZD0ie0YzQzRGRTAwLUVGRDUtNDAzQi05NTY5LTM5OEEyMEYxQkE0QX0iIHZlcnNpb249IjEuMy4xOTUuNjUiIG5leHR2ZXJzaW9uPSIxLjMuMjY1LjciIGxhbmc9IiIgYnJhbmQ9IiIgY2xpZW50PSIiPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjYxMDQ0MDMxMTQiIGluc3RhbGxfdGltZV9tcz0iMTE4MyIvPjwvYXBwPjwvcmVxdWVzdD4
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Checks system information in the registry
          • Reads the TCP/IP host and domain name from the registry
          • System Location Discovery: System Language Discovery
          • System Network Configuration Discovery: Internet Connection Discovery
          PID:2916
        • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
          "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers" /installsource taggedmi /sessionid "{CCF05AE8-C7F8-4038-8B43-DDDA25A18C44}"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Reads the TCP/IP host and domain name from the registry
          • System Location Discovery: System Language Discovery
          PID:2656
    • C:\Windows\Resources\Themes\icsys.icn.exe
      C:\Windows\Resources\Themes\icsys.icn.exe
      2⤵
      • Executes dropped EXE
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1412
      • \??\c:\windows\resources\themes\explorer.exe
        c:\windows\resources\themes\explorer.exe
        3⤵
        • Modifies visibility of hidden/system files in Explorer
        • Executes dropped EXE
        • Adds Run key to start application
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2836
        • \??\c:\windows\resources\spoolsv.exe
          c:\windows\resources\spoolsv.exe SE
          4⤵
          • Executes dropped EXE
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:4116
          • \??\c:\windows\resources\svchost.exe
            c:\windows\resources\svchost.exe
            5⤵
            • Modifies visibility of hidden/system files in Explorer
            • Executes dropped EXE
            • Adds Run key to start application
            • Drops file in System32 directory
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:4248
            • \??\c:\windows\resources\spoolsv.exe
              c:\windows\resources\spoolsv.exe PR
              6⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of SetWindowsHookEx
              PID:5080
  • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
    "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:4344
    • C:\Windows\SysWOW64\wermgr.exe
      "C:\Windows\system32\wermgr.exe" "-outproc" "0" "4344" "884" "840" "844" "0" "0" "0" "0" "0" "0" "0" "0"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2896
  • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
    "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Checks system information in the registry
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    • Modifies data under HKEY_USERS
    • Suspicious use of WriteProcessMemory
    PID:1756
    • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4yNjUuNyIgc2hlbGxfdmVyc2lvbj0iMS4zLjI2NS43IiBpc21hY2hpbmU9IjEiIHNlc3Npb25pZD0ie0NDRjA1QUU4LUM3RjgtNDAzOC04QjQzLUREREEyNUExOEM0NH0iIHVzZXJpZD0ie0YyRjBGNDBFLUI4NTctNDE5OS1BMEJDLTJCQTgxOURFOUU5OX0iIGluc3RhbGxzb3VyY2U9ImxpbWl0ZWQiIHJlcXVlc3RpZD0iezMyOTk1MUEyLTk5NDEtNEE0OS1CMUE5LTE5NEM0NDk1RUEwOX0iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgbG9naWNhbF9jcHVzPSI4IiBwaHlzbWVtb3J5PSIxNiIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjI2MTAwLjE3NDIiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSIxOTEiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IkRBRFkiIHByb2R1Y3RfbmFtZT0iRGFkeSBzdXBlciBwb3dlcmZ1bCBQQyIvPjxleHAgZXRhZz0iJnF1b3Q7czhGYW52d2ZNY2Q2Nmc3TFYyUGVhU1I3V1VPdjBsdUY0aHZpaXJUb2srTT0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7OEE2OUQzNDUtRDU2NC00NjNjLUFGRjEtQTY5RDlFNTMwRjk2fSIgdmVyc2lvbj0iMTQwLjAuNzMzOS44MSIgbmV4dHZlcnNpb249IiIgbGFuZz0iIiBicmFuZD0iIiBjbGllbnQ9IiIgaW5zdGFsbGFnZT0iMzYiIGluc3RhbGxkYXRldGltZT0iMTc4OTE0MjM2MyIgb29iZV9pbnN0YWxsX3RpbWU9IjEzNDMzNjE0NTE5MzkyMDAwMCI-PGV2ZW50IGV2ZW50dHlwZT0iMzEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9Ijg2MDY1OTQzIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI2MTExMTAyMTY4Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks system information in the registry
      • Reads the TCP/IP host and domain name from the registry
      • System Location Discovery: System Language Discovery
      • System Network Configuration Discovery: Internet Connection Discovery
      PID:5608
    • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{D657FF59-4507-4EF0-8997-8836E4AB850A}\MicrosoftEdge_X64_155.0.4283.62.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{D657FF59-4507-4EF0-8997-8836E4AB850A}\MicrosoftEdge_X64_155.0.4283.62.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:3900
      • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{D657FF59-4507-4EF0-8997-8836E4AB850A}\EDGEMITMP_3A4E6.tmp\setup.exe
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{D657FF59-4507-4EF0-8997-8836E4AB850A}\EDGEMITMP_3A4E6.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{D657FF59-4507-4EF0-8997-8836E4AB850A}\MicrosoftEdge_X64_155.0.4283.62.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
        3⤵
        • Executes dropped EXE
        • Drops file in Program Files directory
        • Drops file in Windows directory
        PID:5244
    • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4yNjUuNyIgc2hlbGxfdmVyc2lvbj0iMS4zLjI2NS43IiBpc21hY2hpbmU9IjEiIHNlc3Npb25pZD0ie0NDRjA1QUU4LUM3RjgtNDAzOC04QjQzLUREREEyNUExOEM0NH0iIHVzZXJpZD0ie0YyRjBGNDBFLUI4NTctNDE5OS1BMEJDLTJCQTgxOURFOUU5OX0iIGluc3RhbGxzb3VyY2U9InRhZ2dlZG1pIiByZXF1ZXN0aWQ9IntBNkQ4OEQyNS1GQUI1LTQ1OTctQkZFRi04RUJGNDZFRTMwRTJ9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iMTYiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4yNjEwMC4xNzQyIiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iMTkxIiBpc193aXA9IjAiIGlzX2luX2xvY2tkb3duX21vZGU9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSJEQURZIiBwcm9kdWN0X25hbWU9IkRhZHkgc3VwZXIgcG93ZXJmdWwgUEMiLz48ZXhwIGV0YWc9IiZxdW90O0hodkhJV3BVTlpUTW5WMlZUMWxlM2Y1WUpROU9Tb1RENk14SERsQTg5UGc9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0ie0YzMDE3MjI2LUZFMkEtNDI5NS04QkRGLTAwQzNBOUE3RTRDNX0iIHZlcnNpb249IiIgbmV4dHZlcnNpb249IjE1NS4wLjQyODMuNjIiIGxhbmc9IiIgYnJhbmQ9IiIgY2xpZW50PSIiIGV4cGVyaW1lbnRzPSJjb25zZW50PWZhbHNlIiBpbnN0YWxsYWdlPSIzNSI-PHVwZGF0ZWNoZWNrLz48ZXZlbnQgZXZlbnR0eXBlPSI5IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI2MTE5NTIzOTY2IiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iNSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNjExOTY5NzY2NyIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjY0MDA0ODQzMzAiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiIGRvd25sb2FkZXI9ImJpdHMiIHVybD0iaHR0cDovL21zZWRnZS5mLnRsdS5kbC5kZWxpdmVyeS5tcC5taWNyb3NvZnQuY29tL2ZpbGVzdHJlYW1pbmdzZXJ2aWNlL2ZpbGVzLzQ3Nzc0NWEwLWUxZjAtNDdlYy05Yjc2LTk2NjhlM2FhYjNmYz9QMT0xNzkyODY1MjEzJmFtcDtQMj00MDQmYW1wO1AzPTImYW1wO1A0PWNzeTJab2k1dFZ2SVdZbU90Sk5RSGRjSyUyYnpwem95VzZ5MDVEbldLbnRRd1VUJTJiWkp1NjVGNHFucEJqaHBHeVBWZGtIb0ZUczgzWDd6SDlGOFZrSXdpUSUzZCUzZCIgc2VydmVyX2lwX2hpbnQ9IiIgY2RuX2NpZD0iLTEiIGNkbl9jY2M9IiIgY2RuX21zZWRnZV9yZWY9IiIgY2RuX2F6dXJlX3JlZl9vcmlnaW5fc2hpZWxkPSIiIGNkbl9jYWNoZT0iIiBjZG5fcDNwPSIiIGRvd25sb2FkZWQ9IjIwNzY5NTIyNCIgdG90YWw9IjIwNzY5NTIyNCIgZG93bmxvYWRfdGltZV9tcz0iMTk3MzkiLz48ZXZlbnQgZXZlbnR0eXBlPSIxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI2NDAwNzk3MjgyIiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iNiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNjQxODk2MzI4NiIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjE5Njc1NyIgc3lzdGVtX3VwdGltZV90aWNrcz0iNjc3NDQ5MjAxMSIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIgdXBkYXRlX2NoZWNrX3RpbWVfbXM9IjQwMiIgZG93bmxvYWRfdGltZV9tcz0iMjgwOTgiIGRvd25sb2FkZWQ9IjIwNzY5NTIyNCIgdG90YWw9IjIwNzY5NTIyNCIgcGFja2FnZV9jYWNoZV9yZXN1bHQ9IjAiIGluc3RhbGxfdGltZV9tcz0iMzU1NDkiLz48L2FwcD48L3JlcXVlc3Q-
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks system information in the registry
      • Reads the TCP/IP host and domain name from the registry
      • System Location Discovery: System Language Discovery
      • System Network Configuration Discovery: Internet Connection Discovery
      PID:4396
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k GPSvcGroup
    1⤵
      PID:2648

    Network

          MITRE ATT&CK Enterprise v16

          Reconnaissance

          Resource Development

          Initial Access

          Execution

          Persistence

          Boot or Logon Autostart Execution

          1
          T1547

          Registry Run Keys / Startup Folder

          1
          T1547.001

          Event Triggered Execution

          2
          T1546

          Component Object Model Hijacking

          1
          T1546.015

          Image File Execution Options Injection

          1
          T1546.012

          Privilege Escalation

          Boot or Logon Autostart Execution

          1
          T1547

          Registry Run Keys / Startup Folder

          1
          T1547.001

          Event Triggered Execution

          2
          T1546

          Component Object Model Hijacking

          1
          T1546.015

          Image File Execution Options Injection

          1
          T1546.012

          Defense Evasion

          Hide Artifacts

          1
          T1564

          Hidden Files and Directories

          1
          T1564.001

          Modify Registry

          3
          T1112

          Credential Access

          Discovery

          Query Registry

          2
          T1012

          System Information Discovery

          2
          T1082

          System Location Discovery

          1
          T1614

          System Language Discovery

          1
          T1614.001

          System Network Configuration Discovery

          2
          T1016

          Internet Connection Discovery

          1
          T1016.001

          Lateral Movement

          Collection

          Command and Control

          Exfiltration

          Impact

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          msedge_7z.data
          • Path C:\Program Files (x86)\Microsoft\EdgeCore\155.0.4283.62\Installer\msedge_7z.data
          • Size 6KB
          • SHA256 bcae04974789ea9d1a8c2a6ec9dd0b65b67fae6be15d67aa538015a9f08803e2
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          CopilotUpdate.exe
          • Path C:\Program Files (x86)\Microsoft\Temp\EUB3F4.tmp\CopilotUpdate.exe
          • Size 22KB
          • SHA256 c4b93c8914446e60b0ab0a95a81134b9dccea4088b428c1b56384885ddb15277
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          EdgeUpdate.dat
          • Path C:\Program Files (x86)\Microsoft\Temp\EUB3F4.tmp\EdgeUpdate.dat
          • Size 12KB
          • SHA256 3d7ec761bef1b1af418b909f1c81ce577c769722957713fdafbc8131b0a0c7d3
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          MicrosoftEdgeComRegisterShellARM64.exe
          • Path C:\Program Files (x86)\Microsoft\Temp\EUB3F4.tmp\MicrosoftEdgeComRegisterShellARM64.exe
          • Size 195KB
          • SHA256 4616ea00cf17485607e34f738fbe40b9571a08a656190538640fecb7daa45e71
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          MicrosoftEdgeUpdate.exe
          • Path C:\Program Files (x86)\Microsoft\Temp\EUB3F4.tmp\MicrosoftEdgeUpdate.exe
          • Size 201KB
          • SHA256 04f2bf85ea2b6b6464d92cf196b64174cbf2e4c9ee304dc7de00c1de5622fda8
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          MicrosoftEdgeUpdateComRegisterShell64.exe
          • Path C:\Program Files (x86)\Microsoft\Temp\EUB3F4.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe
          • Size 228KB
          • SHA256 bdade7618d53e7899ba1bc9fb7f70608e7032a7cf0fade343539e118e98e7311
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          MicrosoftEdgeUpdateCore.exe
          • Path C:\Program Files (x86)\Microsoft\Temp\EUB3F4.tmp\MicrosoftEdgeUpdateCore.exe
          • Size 336KB
          • SHA256 a2a67171284e86fe842a0d729c82091a2396a2263decb1963939a54afe0b201a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          NOTICE.TXT
          • Path C:\Program Files (x86)\Microsoft\Temp\EUB3F4.tmp\NOTICE.TXT
          • Size 4KB
          • SHA256 91d3fc490565ded7621ff5198960e501b6db857d5dd45af2fe7c3ecd141145f5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          msedgeupdate.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EUB3F4.tmp\msedgeupdate.dll
          • Size 2.3MB
          • SHA256 6b42ecfabe7145ccc5ed754fd27938cd440a29b28120bf3aec38dda02dfcc4a0
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          msedgeupdateres_af.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EUB3F4.tmp\msedgeupdateres_af.dll
          • Size 29KB
          • SHA256 424e82dbe295a557858d469c9302d787bdc96a6bd9742e0b4b263b5975c94385
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          msedgeupdateres_am.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EUB3F4.tmp\msedgeupdateres_am.dll
          • Size 24KB
          • SHA256 c610d7ae19e7b1ac1d5be386cf52d8262a94e79c75b590ce2b19f7eb01b6862e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          msedgeupdateres_ar.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EUB3F4.tmp\msedgeupdateres_ar.dll
          • Size 26KB
          • SHA256 ca0a488e0c8368fb39ec7f24173b09ce25b1a1a62e3d51d9b516432d27ddb7a9
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          msedgeupdateres_as.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EUB3F4.tmp\msedgeupdateres_as.dll
          • Size 28KB
          • SHA256 e12160c1f4f920c8fa244e61b4d751c6d0c3e62d04655d1976cb89e6a8b59631
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          msedgeupdateres_az.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EUB3F4.tmp\msedgeupdateres_az.dll
          • Size 29KB
          • SHA256 5fe242e67a30d6316d3cdce11b5a18197dab14de9ccbe30b21df7c179d72e360
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          msedgeupdateres_bg.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EUB3F4.tmp\msedgeupdateres_bg.dll
          • Size 29KB
          • SHA256 4345fed196eac2807e8143d8415ffce9db6828c8397146259722d8cf6b209361
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          msedgeupdateres_bn-IN.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EUB3F4.tmp\msedgeupdateres_bn-IN.dll
          • Size 29KB
          • SHA256 bdf5a8cddc26497fec7509391582976ba93783ae7f8b7e4f2138b7a3049c2ebc
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          msedgeupdateres_bn.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EUB3F4.tmp\msedgeupdateres_bn.dll
          • Size 29KB
          • SHA256 dca2156ba388dec955fa97045f9350c47303562eaeb4779e31344ffd6959841a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          msedgeupdateres_bs.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EUB3F4.tmp\msedgeupdateres_bs.dll
          • Size 28KB
          • SHA256 d88f8588aadd558a1050d9719a0914006ee620f105911003c458e98279fb13df
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          msedgeupdateres_ca-Es-VALENCIA.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EUB3F4.tmp\msedgeupdateres_ca-Es-VALENCIA.dll
          • Size 30KB
          • SHA256 ebba1f84995b1c19c6b70547ae62a2691031d0d39ba70d73a4800e9599e8c0d2
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          msedgeupdateres_ca.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EUB3F4.tmp\msedgeupdateres_ca.dll
          • Size 30KB
          • SHA256 21b89c57908615b05c18e576250a243d2d91a5867368d7f21f2c50f73eeb7ff5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          msedgeupdateres_cs.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EUB3F4.tmp\msedgeupdateres_cs.dll
          • Size 28KB
          • SHA256 f9e89347f899f9fc4b6ab767613c7bd44de890d9365ba0f577c1c1b844aba6e6
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          msedgeupdateres_cy.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EUB3F4.tmp\msedgeupdateres_cy.dll
          • Size 28KB
          • SHA256 ff0eac8bb34b8494aa5527ea16faa0122eaf8a94b93572c61681ca4141ea56db
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          msedgeupdateres_da.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EUB3F4.tmp\msedgeupdateres_da.dll
          • Size 28KB
          • SHA256 1523cf4884cbd2576a050cc4bc099b537ee6a9abd6cebd712da1fa5e7b80b80d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          msedgeupdateres_de.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EUB3F4.tmp\msedgeupdateres_de.dll
          • Size 30KB
          • SHA256 52df583b70c71f22a926665f3982199458d4a1a87792daeba387d9377e7711c9
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          msedgeupdateres_el.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EUB3F4.tmp\msedgeupdateres_el.dll
          • Size 30KB
          • SHA256 6a6a1ddcd8926b017d3ee964c568cf22d8d8544ab4dc6d40a791869638dbafaf
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          msedgeupdateres_en-GB.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EUB3F4.tmp\msedgeupdateres_en-GB.dll
          • Size 27KB
          • SHA256 a96c2f4b33f3e5d12523932f6ec4fdf8c6e3e08fd4fb68850c45d32ba0dcd401
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          msedgeupdateres_en.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EUB3F4.tmp\msedgeupdateres_en.dll
          • Size 27KB
          • SHA256 a705bf633dd6f91947ba1072c07d2e97a346761c861f49306cf704587e8b56d2
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          msedgeupdateres_es-419.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EUB3F4.tmp\msedgeupdateres_es-419.dll
          • Size 29KB
          • SHA256 024799763054d47b5729d344b19566d346bc1e81bef01b266acf23b17958ea5e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          msedgeupdateres_es.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EUB3F4.tmp\msedgeupdateres_es.dll
          • Size 28KB
          • SHA256 296fe6b6a2788f88f56d5f9c187dd039f89a70e304c493efcbf5e95d60508464
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          msedgeupdateres_et.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EUB3F4.tmp\msedgeupdateres_et.dll
          • Size 28KB
          • SHA256 6d1108d634c46a7d0e8180a01048fa14acc96118439b5795bbd2a863cc986d98
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          msedgeupdateres_eu.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EUB3F4.tmp\msedgeupdateres_eu.dll
          • Size 28KB
          • SHA256 d960479a21a14b10c9b1de62acaa836e18bc19c950c8eadd358ef8fa5d088315
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          msedgeupdateres_fa.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EUB3F4.tmp\msedgeupdateres_fa.dll
          • Size 27KB
          • SHA256 31f3b7b3b5c04dcbd74ab5374dd73b12b7689ed63ad6a54a127a972c73e5220f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          msedgeupdateres_fi.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EUB3F4.tmp\msedgeupdateres_fi.dll
          • Size 28KB
          • SHA256 d88459bb5b9f2a2c637c70b129459603a2348f7e1b48feeb0a784268a13db249
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          msedgeupdateres_fil.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EUB3F4.tmp\msedgeupdateres_fil.dll
          • Size 29KB
          • SHA256 8e8e57c7ec75ccf66a75a180ee9cd24987f377fb9cef4146edbd1bfcf9187154
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          msedgeupdateres_fr-CA.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EUB3F4.tmp\msedgeupdateres_fr-CA.dll
          • Size 30KB
          • SHA256 b733ad851fb70524c635b354baa7091bfa3ba9c1d06b145c2d41f8712468ba9d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          msedgeupdateres_fr.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EUB3F4.tmp\msedgeupdateres_fr.dll
          • Size 30KB
          • SHA256 4e780403d4b319e4d4c5fe1bb5252ed3368be609b55a1967dc20a4f000c4c25c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          msedgeupdateres_ga.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EUB3F4.tmp\msedgeupdateres_ga.dll
          • Size 28KB
          • SHA256 7750d0baab16b97c221777e424d8b7558404040eb878953323385270e1b74def
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          msedgeupdateres_gd.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EUB3F4.tmp\msedgeupdateres_gd.dll
          • Size 30KB
          • SHA256 78c8d4be2e6d60f72e84b12ffb9c4ad06a0cb00b6aa1b82c639437490e683e7d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          msedgeupdateres_gl.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EUB3F4.tmp\msedgeupdateres_gl.dll
          • Size 28KB
          • SHA256 209761ba116f6ee37ced110696523cd80d063c2ef488062cc0919d49a022d1e8
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          msedgeupdateres_gu.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EUB3F4.tmp\msedgeupdateres_gu.dll
          • Size 28KB
          • SHA256 ef79a6d6ffc460a2a66073da7a74d11ada83f3840b22a69219dd2d7bac4f217e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          msedgeupdateres_hi.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EUB3F4.tmp\msedgeupdateres_hi.dll
          • Size 28KB
          • SHA256 5ae671995a1a93501f7fa34bc975070a6954c5daf5123cf96ee81a609631cbff
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          msedgeupdateres_hr.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EUB3F4.tmp\msedgeupdateres_hr.dll
          • Size 29KB
          • SHA256 1cbe6cca5114fb28ba70e6630dd63f125f0744092e75685e06efc2d47036f996
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          msedgeupdateres_hu.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EUB3F4.tmp\msedgeupdateres_hu.dll
          • Size 29KB
          • SHA256 6a7da8dc031f14271952f4ed1511fca36ff1e06c636787e0237d1af978831948
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          msedgeupdateres_id.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EUB3F4.tmp\msedgeupdateres_id.dll
          • Size 28KB
          • SHA256 0c407a26b814dc95a027b75fd12fd71b33b9aad51c062587bfe24eb08a506f16
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          msedgeupdateres_is.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EUB3F4.tmp\msedgeupdateres_is.dll
          • Size 28KB
          • SHA256 bdbb06f8ed405731896fcc16b26ba3796cd9ef2b66cc580a3840bb49e118a00f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          msedgeupdateres_it.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EUB3F4.tmp\msedgeupdateres_it.dll
          • Size 30KB
          • SHA256 162152c241eea80a03df4d334080e9cf0cdd38652e68668042e55c9e2f461a90
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          msedgeupdateres_iw.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EUB3F4.tmp\msedgeupdateres_iw.dll
          • Size 25KB
          • SHA256 4fcc63efcba81c0c44da32e97a20a78e1c14f824f19f4c8662fe098ae618cbe2
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          msedgeupdateres_ja.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EUB3F4.tmp\msedgeupdateres_ja.dll
          • Size 24KB
          • SHA256 2126941bcd7b2f30b68f3439f91d352b2232b774998b1031b97a63b2e055bd97
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          msedgeupdateres_ka.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EUB3F4.tmp\msedgeupdateres_ka.dll
          • Size 29KB
          • SHA256 ac94ecc6b99d1f96fac4454c882962e2537f496c3b303bb83592f88043bf63cc
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          msedgeupdateres_kk.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EUB3F4.tmp\msedgeupdateres_kk.dll
          • Size 28KB
          • SHA256 c555efab5b463c06b866efa2907b2f4dd3bc9e6af0d7a0b36a631740f6be1735
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          msedgeupdateres_km.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EUB3F4.tmp\msedgeupdateres_km.dll
          • Size 27KB
          • SHA256 d65e91a82e69e05e8085cb366a9cafdb3e9e9b838a22980c19985ed68945463f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          msedgeupdateres_kn.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EUB3F4.tmp\msedgeupdateres_kn.dll
          • Size 29KB
          • SHA256 c239cfe08cd71fa7081bc2ce52df22af3d1abcad2a009d8d31733efdd8edf60e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          msedgeupdateres_ko.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EUB3F4.tmp\msedgeupdateres_ko.dll
          • Size 23KB
          • SHA256 f236b1556e37400017847a127051dbacc85314b66bde67ba42b0cd51f0ddc042
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          msedgeupdateres_kok.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EUB3F4.tmp\msedgeupdateres_kok.dll
          • Size 28KB
          • SHA256 effdac8dbe4d57c4fba7d86f9c4ec7a0b59d5df13f5fd6c5c3facfc77fe71239
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          msedgeupdateres_lb.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EUB3F4.tmp\msedgeupdateres_lb.dll
          • Size 30KB
          • SHA256 b8cf4a5802e47b2197f2c055aa53777ccf6696bd5aae1741d0a8f1fd85d105a1
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          msedgeupdateres_lo.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EUB3F4.tmp\msedgeupdateres_lo.dll
          • Size 27KB
          • SHA256 379df21e89a9f5fb8dfa6aabd761073267dcb2d744e8a1253cf968f3a17ec76f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          msedgeupdateres_lt.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EUB3F4.tmp\msedgeupdateres_lt.dll
          • Size 28KB
          • SHA256 a607eb4f0f6c3a172875556ecad4bd4e939fd67e034c8f6597736a74b217e839
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          msedgeupdateres_lv.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EUB3F4.tmp\msedgeupdateres_lv.dll
          • Size 28KB
          • SHA256 b9faa1cfadf7cdaf77d05a01493a65c4a89ab398cd2e3db36559002a42038c5d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          msedgeupdateres_mi.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EUB3F4.tmp\msedgeupdateres_mi.dll
          • Size 28KB
          • SHA256 a82d8c2567e86c0b6213134aed54c196d1c4e2cf2d525611be5d13386d691c28
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          msedgeupdateres_mk.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EUB3F4.tmp\msedgeupdateres_mk.dll
          • Size 29KB
          • SHA256 dbaa7024a604848e7034f773b9339a36f69a12d8447aace3de91053eb8818f51
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          msedgeupdateres_ml.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EUB3F4.tmp\msedgeupdateres_ml.dll
          • Size 30KB
          • SHA256 920cef12ed0141c03a498ea948035da724a3ab092187b6d6c89afa7d6318c49b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          MicrosoftEdgeUpdate.log
          • Path C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log
          • Size 135KB
          • SHA256 e2045a0c2a8b5131d34c403c456b94cde76100093bac6c3592439f12f7696da5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          2026-10-16_4b7f0844366da346345e9a752ecc3a2c_amadey_elex_hellokitty_luca-stealer_njrat_swisyn.exe 
          • Path C:\Users\Admin\AppData\Local\Temp\2026-10-16_4b7f0844366da346345e9a752ecc3a2c_amadey_elex_hellokitty_luca-stealer_njrat_swisyn.exe 
          • Size 1.7MB
          • SHA256 17debf797a6c737959bc588236e897936ffac1af5f7e515e674ab32f9edfe719
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          explorer.exe
          • Path C:\Windows\Resources\Themes\explorer.exe
          • Size 135KB
          • SHA256 5e55c588db064b32f9b23d611ae075e08c87d36c69fe5915e2790de7c1272478
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          memory/1412-328-0x0000000000400000-0x000000000041F000-memory.dmp
          Download

          memory/2836-374-0x0000000000400000-0x000000000041F000-memory.dmp
          Download

          memory/3168-293-0x0000000074390000-0x00000000745E6000-memory.dmp
          Download

          memory/3168-292-0x0000000000E70000-0x0000000000EA5000-memory.dmp
          Download

          memory/3168-346-0x0000000074390000-0x00000000745E6000-memory.dmp
          Download

          memory/3168-371-0x0000000000E70000-0x0000000000EA5000-memory.dmp
          Download

          memory/4116-327-0x0000000000400000-0x000000000041F000-memory.dmp
          Download

          memory/4248-375-0x0000000000400000-0x000000000041F000-memory.dmp
          Download

          memory/4976-304-0x0000000000400000-0x000000000041F000-memory.dmp
          Download

          memory/4976-0-0x0000000000400000-0x000000000041F000-memory.dmp
          Download

          memory/5080-326-0x0000000000400000-0x000000000041F000-memory.dmp
          Download