df4e07d1ace596b6cef2cd8da8184b5a200edf5d766536190d6c7b93b8ed1fa9

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
18/10/2026, 12:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-18_7c60819a498ff65d03b6979e781dfd9a_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe
Size 45.1MB
Sample261018-ppewmsah83
SHA256 df4e07d1ace596b6cef2cd8da8184b5a200edf5d766536190d6c7b93b8ed1fa9
MD5 7c60819a498ff65d03b6979e781dfd9a
SHA1 cbae9a7094140e2627daf8fba790cd2511ad425b
SHA512 19bf926e96b0828121751254ef4d585a2de5f70223f3f98209405271e4aa36f05ba8e8ee16fa9865277168df4c1bb33802716c0bf1cfbb17c12590e49e3a6afe
SSDEEP 393216:s1Du8BtuBw2FEL3Z3aLUoQvo6LP/SgbSpYvKEh1EdKwlGQKPJuGsiTfREsrgCYfh:sMguj8Q4VfvVqFTrYzduVH
TLSH
T147A79C0773E600A5E5B3D1388AA74503E773B4635731DBDF329C06552FABAE09A7A720
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution spyware stealer

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4160	powershell.exe
4420	powershell.exe
4520	powershell.exe
1296	powershell.exe
1116	powershell.exe

Executes dropped EXE 19 IoCs

pid	Process
1968	chromelevator.exe
2688	chromelevator.exe
4476	chromelevator.exe
5036	chromelevator.exe
380	chromelevator.exe
1940	chromelevator.exe
4584	chromelevator.exe
4520	chromelevator.exe
1104	chromelevator.exe
2480	chromelevator.exe
5016	chromelevator.exe
1520	chromelevator.exe
4976	chromelevator.exe
3092	chromelevator.exe
3296	chromelevator.exe
452	chromelevator.exe
3740	chromelevator.exe
452	chromelevator.exe
4396	quex_elev_helper_v3.exe

Loads dropped DLL 1 IoCs

pid	Process
1668	2026-10-18_7c60819a498ff65d03b6979e781dfd9a_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Contacts third-party web service commonly abused for C2 1 TTPs 5 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
13	discord.com
14	discord.com
8	discord.com
9	discord.com
12	discord.com

Discovers running processes 1 TTPs 16 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
680	tasklist.exe
4552	tasklist.exe
4628	tasklist.exe
4976	tasklist.exe
3320	tasklist.exe
416	tasklist.exe
2480	tasklist.exe
412	tasklist.exe
3108	tasklist.exe
3160	tasklist.exe
4140	tasklist.exe
2100	tasklist.exe
320	tasklist.exe
872	tasklist.exe
1724	tasklist.exe
2308	tasklist.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\quex_elev_helper_v3.exe	2026-10-18_7c60819a498ff65d03b6979e781dfd9a_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-18_7c60819a498ff65d03b6979e781dfd9a_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-18_7c60819a498ff65d03b6979e781dfd9a_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
652	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry key 1 TTPs 24 IoCs

Modify Registry

T1112

pid	Process
2308	reg.exe
4160	reg.exe
4252	reg.exe
2156	reg.exe
2228	reg.exe
1800	reg.exe
1740	reg.exe
1740	reg.exe
680	reg.exe
808	reg.exe
3936	reg.exe
2168	reg.exe
4332	reg.exe
1940	reg.exe
1312	reg.exe
680	reg.exe
764	reg.exe
3028	reg.exe
3116	reg.exe
2672	reg.exe
748	reg.exe
712	reg.exe
408	reg.exe
2156	reg.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1116	powershell.exe
1116	powershell.exe
1116	powershell.exe
4160	powershell.exe
4160	powershell.exe
4160	powershell.exe
4420	powershell.exe
4420	powershell.exe
4520	powershell.exe
4520	powershell.exe
1296	powershell.exe
1296	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
4248	msedge.exe

Suspicious use of AdjustPrivilegeToken 21 IoCs

description	pid	Process
Token: SeDebugPrivilege	416	tasklist.exe
Token: SeDebugPrivilege	320	tasklist.exe
Token: SeDebugPrivilege	680	tasklist.exe
Token: SeDebugPrivilege	2480	tasklist.exe
Token: SeDebugPrivilege	412	tasklist.exe
Token: SeDebugPrivilege	3108	tasklist.exe
Token: SeDebugPrivilege	3160	tasklist.exe
Token: SeDebugPrivilege	872	tasklist.exe
Token: SeDebugPrivilege	4552	tasklist.exe
Token: SeDebugPrivilege	4628	tasklist.exe
Token: SeDebugPrivilege	4140	tasklist.exe
Token: SeDebugPrivilege	4976	tasklist.exe
Token: SeDebugPrivilege	2100	tasklist.exe
Token: SeDebugPrivilege	1116	powershell.exe
Token: SeDebugPrivilege	4160	powershell.exe
Token: SeDebugPrivilege	4420	powershell.exe
Token: SeDebugPrivilege	4520	powershell.exe
Token: SeDebugPrivilege	1296	powershell.exe
Token: SeDebugPrivilege	1724	tasklist.exe
Token: SeDebugPrivilege	2308	tasklist.exe
Token: SeDebugPrivilege	3320	tasklist.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1668 wrote to memory of 2560	1668	2026-10-18_7c60819a498ff65d03b6979e781dfd9a_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	88
PID 1668 wrote to memory of 416	1668	2026-10-18_7c60819a498ff65d03b6979e781dfd9a_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	90
PID 1668 wrote to memory of 4248	1668	2026-10-18_7c60819a498ff65d03b6979e781dfd9a_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	95
PID 1668 wrote to memory of 3900	1668	2026-10-18_7c60819a498ff65d03b6979e781dfd9a_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	96
PID 4248 wrote to memory of 2024	4248	msedge.exe	98
PID 1668 wrote to memory of 320	1668	2026-10-18_7c60819a498ff65d03b6979e781dfd9a_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	99
PID 1668 wrote to memory of 4612	1668	2026-10-18_7c60819a498ff65d03b6979e781dfd9a_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	101
PID 4248 wrote to memory of 652	4248	msedge.exe	103
PID 4248 wrote to memory of 4568	4248	msedge.exe	104
PID 4248 wrote to memory of 3080	4248	msedge.exe	105
PID 4248 wrote to memory of 4568	4248	msedge.exe	104
PID 4248 wrote to memory of 4568	4248	msedge.exe	104
PID 4248 wrote to memory of 3352	4248	msedge.exe	106
PID 4248 wrote to memory of 3080	4248	msedge.exe	105
PID 4248 wrote to memory of 3080	4248	msedge.exe	105
PID 4248 wrote to memory of 3352	4248	msedge.exe	106
PID 1668 wrote to memory of 680	1668	2026-10-18_7c60819a498ff65d03b6979e781dfd9a_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	134
PID 1668 wrote to memory of 3108	1668	2026-10-18_7c60819a498ff65d03b6979e781dfd9a_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	140
PID 1668 wrote to memory of 5080	1668	2026-10-18_7c60819a498ff65d03b6979e781dfd9a_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	112
PID 1668 wrote to memory of 2480	1668	2026-10-18_7c60819a498ff65d03b6979e781dfd9a_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	114
PID 1668 wrote to memory of 4244	1668	2026-10-18_7c60819a498ff65d03b6979e781dfd9a_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	118
PID 1668 wrote to memory of 116	1668	2026-10-18_7c60819a498ff65d03b6979e781dfd9a_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	120
PID 1668 wrote to memory of 412	1668	2026-10-18_7c60819a498ff65d03b6979e781dfd9a_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	122
PID 1668 wrote to memory of 4252	1668	2026-10-18_7c60819a498ff65d03b6979e781dfd9a_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	166
PID 1668 wrote to memory of 1940	1668	2026-10-18_7c60819a498ff65d03b6979e781dfd9a_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	126
PID 1668 wrote to memory of 4160	1668	2026-10-18_7c60819a498ff65d03b6979e781dfd9a_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	128
PID 1668 wrote to memory of 1312	1668	2026-10-18_7c60819a498ff65d03b6979e781dfd9a_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	130
PID 1668 wrote to memory of 2672	1668	2026-10-18_7c60819a498ff65d03b6979e781dfd9a_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	132
PID 1668 wrote to memory of 680	1668	2026-10-18_7c60819a498ff65d03b6979e781dfd9a_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	187
PID 1668 wrote to memory of 748	1668	2026-10-18_7c60819a498ff65d03b6979e781dfd9a_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	136
PID 1668 wrote to memory of 1180	1668	2026-10-18_7c60819a498ff65d03b6979e781dfd9a_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	138
PID 1668 wrote to memory of 3108	1668	2026-10-18_7c60819a498ff65d03b6979e781dfd9a_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	140
PID 1668 wrote to memory of 5020	1668	2026-10-18_7c60819a498ff65d03b6979e781dfd9a_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	142
PID 1668 wrote to memory of 3052	1668	2026-10-18_7c60819a498ff65d03b6979e781dfd9a_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	144
PID 1668 wrote to memory of 5072	1668	2026-10-18_7c60819a498ff65d03b6979e781dfd9a_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	146
PID 1668 wrote to memory of 212	1668	2026-10-18_7c60819a498ff65d03b6979e781dfd9a_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	148
PID 1668 wrote to memory of 5068	1668	2026-10-18_7c60819a498ff65d03b6979e781dfd9a_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	150
PID 1668 wrote to memory of 2944	1668	2026-10-18_7c60819a498ff65d03b6979e781dfd9a_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	152
PID 1668 wrote to memory of 3332	1668	2026-10-18_7c60819a498ff65d03b6979e781dfd9a_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	154
PID 1668 wrote to memory of 2736	1668	2026-10-18_7c60819a498ff65d03b6979e781dfd9a_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	156
PID 1668 wrote to memory of 3160	1668	2026-10-18_7c60819a498ff65d03b6979e781dfd9a_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	158
PID 1668 wrote to memory of 4988	1668	2026-10-18_7c60819a498ff65d03b6979e781dfd9a_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	160
PID 1668 wrote to memory of 1740	1668	2026-10-18_7c60819a498ff65d03b6979e781dfd9a_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	162
PID 1668 wrote to memory of 712	1668	2026-10-18_7c60819a498ff65d03b6979e781dfd9a_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	164
PID 1668 wrote to memory of 4252	1668	2026-10-18_7c60819a498ff65d03b6979e781dfd9a_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	166
PID 1668 wrote to memory of 764	1668	2026-10-18_7c60819a498ff65d03b6979e781dfd9a_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	168
PID 1668 wrote to memory of 2156	1668	2026-10-18_7c60819a498ff65d03b6979e781dfd9a_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	170
PID 1668 wrote to memory of 2228	1668	2026-10-18_7c60819a498ff65d03b6979e781dfd9a_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	172
PID 1668 wrote to memory of 4668	1668	2026-10-18_7c60819a498ff65d03b6979e781dfd9a_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	174
PID 1668 wrote to memory of 872	1668	2026-10-18_7c60819a498ff65d03b6979e781dfd9a_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	176
PID 1668 wrote to memory of 440	1668	2026-10-18_7c60819a498ff65d03b6979e781dfd9a_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	178
PID 1668 wrote to memory of 1968	1668	2026-10-18_7c60819a498ff65d03b6979e781dfd9a_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	181
PID 1668 wrote to memory of 4552	1668	2026-10-18_7c60819a498ff65d03b6979e781dfd9a_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	183
PID 1668 wrote to memory of 3384	1668	2026-10-18_7c60819a498ff65d03b6979e781dfd9a_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	185
PID 1668 wrote to memory of 680	1668	2026-10-18_7c60819a498ff65d03b6979e781dfd9a_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	187
PID 1668 wrote to memory of 808	1668	2026-10-18_7c60819a498ff65d03b6979e781dfd9a_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	189
PID 1668 wrote to memory of 1800	1668	2026-10-18_7c60819a498ff65d03b6979e781dfd9a_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	191
PID 1668 wrote to memory of 3936	1668	2026-10-18_7c60819a498ff65d03b6979e781dfd9a_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	193
PID 1668 wrote to memory of 3028	1668	2026-10-18_7c60819a498ff65d03b6979e781dfd9a_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	195
PID 1668 wrote to memory of 3116	1668	2026-10-18_7c60819a498ff65d03b6979e781dfd9a_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	197
PID 1668 wrote to memory of 4268	1668	2026-10-18_7c60819a498ff65d03b6979e781dfd9a_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	199
PID 1668 wrote to memory of 4628	1668	2026-10-18_7c60819a498ff65d03b6979e781dfd9a_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	201
PID 1668 wrote to memory of 4256	1668	2026-10-18_7c60819a498ff65d03b6979e781dfd9a_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	203
PID 1668 wrote to memory of 1052	1668	2026-10-18_7c60819a498ff65d03b6979e781dfd9a_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	205

C:\Users\Admin\AppData\Local\Temp\2026-10-18_7c60819a498ff65d03b6979e781dfd9a_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-18_7c60819a498ff65d03b6979e781dfd9a_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
PID:1668
- C:\Windows\system32\where.exe
  where.exe msedge.exe
  2⤵
  PID:2560
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq msedge.exe" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --disable-background-networking about:blank
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:4248
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ff84d6dc188,0x7ff84d6dc194,0x7ff84d6dc1a0
    3⤵
    PID:2024
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1796,i,5859918887741051567,4550722757440307154,524288 --field-trial-handle=2712,i,10913845579277010168,13037935511811978460,262144 --variations-seed-version --mojo-platform-channel-handle=2740 /prefetch:3
    3⤵
    - System Time Discovery
    PID:652
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=2984,i,14491517626880552344,3549632652530164025,2097152 --field-trial-handle=2712,i,10913845579277010168,13037935511811978460,262144 --variations-seed-version --mojo-platform-channel-handle=3000 /prefetch:2
    3⤵
    PID:4568
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1664,i,9287091687209673105,1260232183252438497,262144 --field-trial-handle=2712,i,10913845579277010168,13037935511811978460,262144 --variations-seed-version --mojo-platform-channel-handle=2708 /prefetch:2
    3⤵
    PID:3080
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2288,i,15286720676321882933,6343615012685506976,524288 --field-trial-handle=2712,i,10913845579277010168,13037935511811978460,262144 --variations-seed-version --mojo-platform-channel-handle=2768 /prefetch:8
    3⤵
    PID:3352
- C:\Windows\system32\where.exe
  where.exe msedge.exe
  2⤵
  PID:3900
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq msedge.exe" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:320
- C:\Windows\system32\where.exe
  where.exe msedge.exe
  2⤵
  PID:4612
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq msedge.exe" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:680
- C:\Windows\system32\where.exe
  where.exe opera.exe
  2⤵
  PID:3108
- C:\Windows\system32\where.exe
  where.exe msedge.exe
  2⤵
  PID:5080
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq msedge.exe" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:2480
- C:\Windows\system32\where.exe
  where.exe opera.exe
  2⤵
  PID:4244
- C:\Windows\system32\where.exe
  where.exe msedge.exe
  2⤵
  PID:116
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq msedge.exe" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:412
- C:\Windows\system32\where.exe
  where.exe browser.exe
  2⤵
  PID:4252
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Yandex\YandexBrowser /v InstallLocation
  2⤵
  - Modifies registry key
  PID:1940
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Yandex\YandexBrowser /v Path
  2⤵
  - Modifies registry key
  PID:4160
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Yandex\YandexBrowser /v InstallPath
  2⤵
  - Modifies registry key
  PID:1312
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\Yandex\YandexBrowser /v InstallLocation
  2⤵
  - Modifies registry key
  PID:2672
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\Yandex\YandexBrowser /v Path
  2⤵
  - Modifies registry key
  PID:680
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\Yandex\YandexBrowser /v InstallPath
  2⤵
  - Modifies registry key
  PID:748
- C:\Windows\system32\where.exe
  where.exe msedge.exe
  2⤵
  PID:1180
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq msedge.exe" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:3108
- C:\Windows\system32\where.exe
  where.exe epic.exe
  2⤵
  PID:5020
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\Epic Privacy Browser" /v InstallLocation
  2⤵
  PID:3052
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\Epic Privacy Browser" /v Path
  2⤵
  PID:5072
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\Epic Privacy Browser" /v InstallPath
  2⤵
  PID:212
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\WOW6432Node\Epic Privacy Browser" /v InstallLocation
  2⤵
  PID:5068
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\WOW6432Node\Epic Privacy Browser" /v Path
  2⤵
  PID:2944
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\WOW6432Node\Epic Privacy Browser" /v InstallPath
  2⤵
  PID:3332
- C:\Windows\system32\where.exe
  where.exe msedge.exe
  2⤵
  PID:2736
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq msedge.exe" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:3160
- C:\Windows\system32\where.exe
  where.exe chrome.exe
  2⤵
  PID:4988
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\CentBrowser /v InstallLocation
  2⤵
  - Modifies registry key
  PID:1740
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\CentBrowser /v Path
  2⤵
  - Modifies registry key
  PID:712
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\CentBrowser /v InstallPath
  2⤵
  - Modifies registry key
  PID:4252
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\CentBrowser /v InstallLocation
  2⤵
  - Modifies registry key
  PID:764
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\CentBrowser /v Path
  2⤵
  - Modifies registry key
  PID:2156
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\CentBrowser /v InstallPath
  2⤵
  - Modifies registry key
  PID:2228
- C:\Windows\system32\where.exe
  where.exe msedge.exe
  2⤵
  PID:4668
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq msedge.exe" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:872
- C:\Windows\system32\where.exe
  where.exe chrome.exe
  2⤵
  PID:440
- C:\Windows\system32\where.exe
  where.exe msedge.exe
  2⤵
  PID:1968
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq msedge.exe" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:4552
- C:\Windows\system32\where.exe
  where.exe vivaldi.exe
  2⤵
  PID:3384
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Vivaldi /v InstallLocation
  2⤵
  - Modifies registry key
  PID:680
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Vivaldi /v Path
  2⤵
  - Modifies registry key
  PID:808
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Vivaldi /v InstallPath
  2⤵
  - Modifies registry key
  PID:1800
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\Vivaldi /v InstallLocation
  2⤵
  - Modifies registry key
  PID:3936
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\Vivaldi /v Path
  2⤵
  - Modifies registry key
  PID:3028
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\Vivaldi /v InstallPath
  2⤵
  - Modifies registry key
  PID:3116
- C:\Windows\system32\where.exe
  where.exe msedge.exe
  2⤵
  PID:4268
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq msedge.exe" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:4628
- C:\Windows\system32\where.exe
  where.exe iridium.exe
  2⤵
  PID:4256
- C:\Windows\system32\where.exe
  where.exe msedge.exe
  2⤵
  PID:1052
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq msedge.exe" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:4140
- C:\Windows\system32\where.exe
  where.exe chrome.exe
  2⤵
  PID:396
- C:\Windows\system32\where.exe
  where.exe msedge.exe
  2⤵
  PID:1296
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq msedge.exe" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:4976
- C:\Windows\system32\where.exe
  where.exe browser.exe
  2⤵
  PID:2904
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\CocCoc\Browser /v InstallLocation
  2⤵
  - Modifies registry key
  PID:1740
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\CocCoc\Browser /v Path
  2⤵
  - Modifies registry key
  PID:2168
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\CocCoc\Browser /v InstallPath
  2⤵
  - Modifies registry key
  PID:408
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\CocCoc\Browser /v InstallLocation
  2⤵
  - Modifies registry key
  PID:4332
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\CocCoc\Browser /v Path
  2⤵
  - Modifies registry key
  PID:2156
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\CocCoc\Browser /v InstallPath
  2⤵
  - Modifies registry key
  PID:2308
- C:\Windows\system32\where.exe
  where.exe msedge.exe
  2⤵
  PID:2040
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq msedge.exe" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:2100
- C:\Users\Admin\AppData\Local\Temp\quex-chromelevator-1bdc4d29a166\chromelevator.exe
  C:\Users\Admin\AppData\Local\Temp\quex-chromelevator-1bdc4d29a166\chromelevator.exe -o C:\Users\Admin\AppData\Local\Temp\quex-cl-000000-1792327227573_1668 000000
  2⤵
  - Executes dropped EXE
  PID:1968
- C:\Users\Admin\AppData\Local\Temp\quex-chromelevator-1bdc4d29a166\chromelevator.exe
  C:\Users\Admin\AppData\Local\Temp\quex-chromelevator-1bdc4d29a166\chromelevator.exe --output-path C:\Users\Admin\AppData\Local\Temp\quex-cl-000000-1792327227573_1668 000000
  2⤵
  - Executes dropped EXE
  PID:2688
- C:\Users\Admin\AppData\Local\Temp\quex-chromelevator-1bdc4d29a166\chromelevator.exe
  C:\Users\Admin\AppData\Local\Temp\quex-chromelevator-1bdc4d29a166\chromelevator.exe 000000 -o C:\Users\Admin\AppData\Local\Temp\quex-cl-000000-1792327227573_1668
  2⤵
  - Executes dropped EXE
  PID:4476
- C:\Users\Admin\AppData\Local\Temp\quex-chromelevator-1bdc4d29a166\chromelevator.exe
  C:\Users\Admin\AppData\Local\Temp\quex-chromelevator-1bdc4d29a166\chromelevator.exe 000000 --output-path C:\Users\Admin\AppData\Local\Temp\quex-cl-000000-1792327227573_1668
  2⤵
  - Executes dropped EXE
  PID:5036
- C:\Users\Admin\AppData\Local\Temp\quex-chromelevator-1bdc4d29a166\chromelevator.exe
  C:\Users\Admin\AppData\Local\Temp\quex-chromelevator-1bdc4d29a166\chromelevator.exe 000000
  2⤵
  - Executes dropped EXE
  PID:380
- C:\Users\Admin\AppData\Local\Temp\quex-chromelevator-1bdc4d29a166\chromelevator.exe
  C:\Users\Admin\AppData\Local\Temp\quex-chromelevator-1bdc4d29a166\chromelevator.exe -o C:\Users\Admin\AppData\Local\Temp\quex-cl-00000-1792327228198_1668 00000
  2⤵
  - Executes dropped EXE
  PID:1940
- C:\Users\Admin\AppData\Local\Temp\quex-chromelevator-1bdc4d29a166\chromelevator.exe
  C:\Users\Admin\AppData\Local\Temp\quex-chromelevator-1bdc4d29a166\chromelevator.exe --output-path C:\Users\Admin\AppData\Local\Temp\quex-cl-00000-1792327228198_1668 00000
  2⤵
  - Executes dropped EXE
  PID:4584
- C:\Users\Admin\AppData\Local\Temp\quex-chromelevator-1bdc4d29a166\chromelevator.exe
  C:\Users\Admin\AppData\Local\Temp\quex-chromelevator-1bdc4d29a166\chromelevator.exe 00000 -o C:\Users\Admin\AppData\Local\Temp\quex-cl-00000-1792327228198_1668
  2⤵
  - Executes dropped EXE
  PID:4520
- C:\Users\Admin\AppData\Local\Temp\quex-chromelevator-1bdc4d29a166\chromelevator.exe
  C:\Users\Admin\AppData\Local\Temp\quex-chromelevator-1bdc4d29a166\chromelevator.exe 00000 --output-path C:\Users\Admin\AppData\Local\Temp\quex-cl-00000-1792327228198_1668
  2⤵
  - Executes dropped EXE
  PID:1104
- C:\Users\Admin\AppData\Local\Temp\quex-chromelevator-1bdc4d29a166\chromelevator.exe
  C:\Users\Admin\AppData\Local\Temp\quex-chromelevator-1bdc4d29a166\chromelevator.exe 00000
  2⤵
  - Executes dropped EXE
  PID:2480
- C:\Users\Admin\AppData\Local\Temp\quex-chromelevator-1bdc4d29a166\chromelevator.exe
  C:\Users\Admin\AppData\Local\Temp\quex-chromelevator-1bdc4d29a166\chromelevator.exe -o C:\Users\Admin\AppData\Local\Temp\quex-cl-edge-1792327228776_1668 edge
  2⤵
  - Executes dropped EXE
  PID:5016
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:4140
- C:\Users\Admin\AppData\Local\Temp\quex-chromelevator-1bdc4d29a166\chromelevator.exe
  C:\Users\Admin\AppData\Local\Temp\quex-chromelevator-1bdc4d29a166\chromelevator.exe -o C:\Users\Admin\AppData\Local\Temp\quex-cl-00000-1792327229292_1668 00000
  2⤵
  - Executes dropped EXE
  PID:1520
- C:\Users\Admin\AppData\Local\Temp\quex-chromelevator-1bdc4d29a166\chromelevator.exe
  C:\Users\Admin\AppData\Local\Temp\quex-chromelevator-1bdc4d29a166\chromelevator.exe --output-path C:\Users\Admin\AppData\Local\Temp\quex-cl-00000-1792327229292_1668 00000
  2⤵
  - Executes dropped EXE
  PID:4976
- C:\Users\Admin\AppData\Local\Temp\quex-chromelevator-1bdc4d29a166\chromelevator.exe
  C:\Users\Admin\AppData\Local\Temp\quex-chromelevator-1bdc4d29a166\chromelevator.exe 00000 -o C:\Users\Admin\AppData\Local\Temp\quex-cl-00000-1792327229292_1668
  2⤵
  - Executes dropped EXE
  PID:3092
- C:\Users\Admin\AppData\Local\Temp\quex-chromelevator-1bdc4d29a166\chromelevator.exe
  C:\Users\Admin\AppData\Local\Temp\quex-chromelevator-1bdc4d29a166\chromelevator.exe 00000 --output-path C:\Users\Admin\AppData\Local\Temp\quex-cl-00000-1792327229292_1668
  2⤵
  - Executes dropped EXE
  PID:3296
- C:\Users\Admin\AppData\Local\Temp\quex-chromelevator-1bdc4d29a166\chromelevator.exe
  C:\Users\Admin\AppData\Local\Temp\quex-chromelevator-1bdc4d29a166\chromelevator.exe 00000
  2⤵
  - Executes dropped EXE
  PID:452
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File C:\Users\Admin\AppData\Local\Temp\quex-sys-1792327229995_1668.ps1
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1116
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ot5gxwj4\ot5gxwj4.cmdline"
    3⤵
    PID:4664
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File C:\Users\Admin\AppData\Local\Temp\quex-dpapi-1792327230807_1668.ps1
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4160
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File C:\Users\Admin\AppData\Local\Temp\quex-dpapi-1792327231573_1668_LocalMachine.ps1
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4420
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File C:\Users\Admin\AppData\Local\Temp\quex-dpapi-1792327232120_1668.ps1
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4520
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File C:\Users\Admin\AppData\Local\Temp\quex-sys-1792327232776_1668.ps1
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1296
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\verpdf22\verpdf22.cmdline"
    3⤵
    PID:1848
- C:\Users\Admin\AppData\Local\Temp\quex-native\chromelevator.exe
  C:\Users\Admin\AppData\Local\Temp\quex-native\chromelevator.exe 00000 --output-path C:\Users\Admin\AppData\Local\Temp\quex-abe-1792327233292_1668
  2⤵
  - Executes dropped EXE
  PID:3740
- C:\Users\Admin\AppData\Local\Temp\quex-native\chromelevator.exe
  C:\Users\Admin\AppData\Local\Temp\quex-native\chromelevator.exe 00000
  2⤵
  - Executes dropped EXE
  PID:452
- C:\Windows\system32\where.exe
  where.exe msedge.exe
  2⤵
  PID:1568
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq msedge.exe" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:1724
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe /nologo /optimize+ /out:C:\Users\Admin\AppData\Local\Temp\quex_com_inject_v1.exe C:\Users\Admin\AppData\Local\Temp\quex-com-inj-1792327234089_1668.cs
  2⤵
  PID:3276
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /optimize+ /out:C:\Users\Admin\AppData\Local\Temp\quex_com_inject_v1.exe C:\Users\Admin\AppData\Local\Temp\quex-com-inj-1792327234089_1668.cs
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1744
- C:\Windows\system32\where.exe
  where.exe msedge.exe
  2⤵
  PID:4184
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq msedge.exe" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:2308
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe /nologo /optimize+ /out:C:\Users\Admin\AppData\Local\Temp\quex_proc_inject.exe C:\Users\Admin\AppData\Local\Temp\quex-procinj-1792327234823_1668.cs
  2⤵
  PID:2572
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /optimize+ /out:C:\Users\Admin\AppData\Local\Temp\quex_proc_inject.exe C:\Users\Admin\AppData\Local\Temp\quex-procinj-1792327234823_1668.cs
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2552
- C:\Windows\system32\where.exe
  where.exe msedge.exe
  2⤵
  PID:3312
- C:\Windows\system32\where.exe
  where.exe msedge.exe
  2⤵
  PID:3768
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq msedge.exe" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:3320
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe /nologo /optimize+ /out:C:\Users\Admin\AppData\Local\Temp\quex_inject_helper.exe C:\Users\Admin\AppData\Local\Temp\quex-inject-1792327235698_1668.cs
  2⤵
  PID:2056
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /optimize+ /out:C:\Users\Admin\AppData\Local\Temp\quex_inject_helper.exe C:\Users\Admin\AppData\Local\Temp\quex-inject-1792327235698_1668.cs
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2836
- C:\Windows\system32\where.exe
  where.exe msedge.exe
  2⤵
  PID:3236
- C:\Program Files (x86)\Microsoft\Edge\Application\quex_elev_helper_v3.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\quex_elev_helper_v3.exe" 00000 C:\Users\Admin\AppData\Local\Temp\quex-elev-in-1792327236182_1668.bin C:\Users\Admin\AppData\Local\Temp\quex-elev-out-1792327236182_1668.bin 32
  2⤵
  - Executes dropped EXE
  PID:4396

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1312

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

quex_elev_helper_v3.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\quex_elev_helper_v3.exe
Size 8KB
SHA256 5e751b9e860226c3ca859564cf4b33bd03b2d9164f636d866dc5598be17f9354
MD5 d1303200c57666719e917a6cc1dac5f2
SHA1 0c782c8e9d72d31703e67c5ec2c7cca470e39a76
SHA512 bb8e3e5de6e30f372392af7fc04d851f8c57cfa0e9838f9056107028dcadcf06f9756ab479e91adf9499d738a54c4e9bc3141b2fa0ba59f2f5ca876b3234363c
SSDEEP 96:5F0pZGJBazq5Ks1ePzwM5tDpm1T0owmNWct+6avyLdaJ3XOEgYjWDxF6jEG9WsQE:kfIYRdGoowmsct7a6AnhyDElWstp
TLSH
T13BF1F629ABF81137C82A83B2CEF68B01B774D1145A29AFEF6094B1973E5935109C7F70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 3b0068d29ae4b20c447227fbf410aa2deedfef6220ccc3f698f3c7707c032c55
MD5 2f57fde6b33e89a63cf0dfdd6e60a351
SHA1 445bf1b07223a04f8a159581a3d37d630273010f
SHA512 42857c5f111bfa163e9f4ea6b81a42233d0bbb0836ecc703ce7e8011b6f8a8eca761f39adc3ed026c9a2f99206d88bab9bddb42da9113e478a31a6382af5c220
TLSH
T15F51EE323375B1D8C9167F071E68198053BF4355EAA4AF1CB69C625EDD2640B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

07803ed7-f296-4e9f-b4db-535804918798.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\07803ed7-f296-4e9f-b4db-535804918798.tmp
Size 9KB
SHA256 df03cae11292cae50adf1c5a48309f9d48a093338213f3fef338803572d6c177
MD5 a9c5460b425403a27119732202234586
SHA1 06930be01cbe98d097a32937df56819fd2e357d7
SHA512 10ab391d77c35bd2fbebb913abdd95173b67176f638f068c7d3ed89bc0f77f2efec68aa940664fb4ba7ed694d1c6a7f15c0e5e58664a83cb3db637d97dfc78f7
SSDEEP 192:zbsNa6JUb2QmiUygkrh//2yw3JNoSJqyU9:zbsNa6+bSArh//S3wS/U9
TLSH
T18912F738BC787C7B9EA79D45F4877B239FA4016BE6952E84DAD81E1C01C729C1307D26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

51dd3523-8bcf-4bb9-a633-8acb118fe9ae.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\51dd3523-8bcf-4bb9-a633-8acb118fe9ae.tmp
Size 8KB
SHA256 70ab465157b6bb509f05d762482f741182f72c4cea4c21ec4e81372efc278218
MD5 86bc14987fa980fb6be120612f658cfe
SHA1 467e2db507e4e2a7b366b0249d60b05639322d05
SHA512 e1e744f044640246c4c4507fdb387aa8d443f6be6948508a6f548df380d1faa5887138513340bcb6034222045ff3d51756b32d664dc234e29911f4f5db1c687b
SSDEEP 96:4qONkdQsjpfbUqH5ih/cIPURHl8h4otop5ZYD5B7P4v+Y1xf//ojdDxv3ywxxPLD:jONJ6JUpQmiUyMfro//2yw3JNxVqyU6
TLSH
T130120838BC79BC779EE3AD45B48377139FA4016BEA952F84DAE81A1C05C725C1307D26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

759a5a58-30f8-4619-bcb6-d63efd3b7fff.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\759a5a58-30f8-4619-bcb6-d63efd3b7fff.tmp
Size 8KB
SHA256 84642650f9ea6fbb53753530141cf91f81cbf91c3c836678e89b4b094cba907b
MD5 7e6c0e84217892cd0de44b78287691c1
SHA1 974bdedbbd6381a1aae06019392950a4b7fe8235
SHA512 24c58bd81f46920f79f9a404223ebe94815db0505ca9a8b5a85c7a994919755c11f1481c48f5fb4f47e38a50978e87f961a36970550d58ee3866f4e1b45e52a6
SSDEEP 96:KqONkCQsjpfbUmjH5ih/cIPURHl8h4otop5ZaD5BKP4v+Y1xf//ojdDxv3ywlBCI:BONy6JUm0QmiUySfso//2ywlBCyNU6
TLSH
T13802F938BC687C7B9EF3AE45B48777239FA4106BAA912F84DAD81E1D01D715C1303C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

346ab844-a057-4924-a431-3e1e7b0c0df8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\346ab844-a057-4924-a431-3e1e7b0c0df8.tmp
Size 7KB
SHA256 b60e71507033ed6c5f3bb0656b1d8869c6f969a34a456cfb303415d7fd93db59
MD5 76630e83a511c7fc552d9da12073f39c
SHA1 f3f1b6a47bc227ff1342561c72d9ba95143f23b3
SHA512 08f786163c702ce205e4035117621348d9ad2fe5944898f1c6da4035a2b1ed653f27938630822876bf410166f0537ca8e1bf01c37d449a72a286d657f33adfc3
SSDEEP 96:sa2viEDWRk6+4scn0b9zxdahDxdHWTx6W6hfuH9EOx+WVoMfm+uecpYQj7Vc678k:sxvuFscGe2HW6+WNGYWxWxhgF
TLSH
T1BBF1C8526E38793F4CCBE11DBA36BB53D2FA512135D50A48AAFC8A5C05DA6CD230781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8a8af798-83f2-4c07-94ec-f1b83905ee9d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\8a8af798-83f2-4c07-94ec-f1b83905ee9d.tmp
Size 26KB
SHA256 4a004d0e2bef70671a0e87dccda3744616008cd2d1ebac93d9a996cde01ad08f
MD5 dce842c1fe841dcbcd9ef8855c126134
SHA1 981d5648cfc7984ae1b80e97526dc0adca312f6c
SHA512 df8012ce18d32b82597b8969937663942e361d57fe52c906c449d70edfc786cdae08635e6772a844be5f1e311eecee0cd424576687fda8a5f8bae3556bd17f06
SSDEEP 768:AiKlm7QWvUYe08F1+UoAYDCx9Tuqh0VfUC9xbog/OVh/LlpPsFXroFfa:AiKlm7QWvUYe0u1ja8/L/EFEFfa
TLSH
T146C2FA3B640CCB7E4FC05A9DDC5A6F976EA802C7A6588D4047FA984C02C77EA512B4DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

36769476-cf14-49e5-9ac1-1996315b6d96.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\36769476-cf14-49e5-9ac1-1996315b6d96.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

81224427-2b24-443f-8254-cc5b2c2ac7cd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\81224427-2b24-443f-8254-cc5b2c2ac7cd.tmp
Size 61B
SHA256 e1b77550222c2451772c958e44026abe518a2c8766862f331765788ddd196377
MD5 4df4574bfbb7e0b0bc56c2c9b12b6c47
SHA1 81efcbd3e3da8221444a21f45305af6fa4b71907
SHA512 78b14f60f2d80400fe50360cf303a961685396b7697775d078825a29b717081442d357c2039ad0984d4b622976b0314ede8f478cde320daec118da546cb0682a
TLSH
T139A00254944498FF4655836A05654463C7AA504780285E565B24115E42A25AD0450947
MD5 SHA1 SHA512 TLSH

Submit Download

8bce383a-3a6a-4c17-8284-98f13f6a133f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\8bce383a-3a6a-4c17-8284-98f13f6a133f.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

c71f2aad-12d7-4bc7-9638-a885df507cc4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c71f2aad-12d7-4bc7-9638-a885df507cc4.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e6a7ec46-0357-4202-bc68-662efd5162c9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\e6a7ec46-0357-4202-bc68-662efd5162c9.tmp
Size 9KB
SHA256 4ff93a24e087c4971a97caa2f9d042a73b0464949ed82a81884ecb1de7844aef
MD5 5f96bb1966fcd5b6afc5a3c31ed2536d
SHA1 57a3256c6abbcc8ce7106d9ba7b1292328478c8e
SHA512 8403e20629c0aeda49498cd8e46593576de9fc7af551bf17fcec08728b8c1355576c8bb59e1c81265e7c1b735ef5fb1fb65646f735e20f48fdc9d1c4c9bdf12e
SSDEEP 192:zbsNa6JUb2QmiUyxkrh//2yw3JNoSJqyU9:zbsNa6+bSprh//S3wS/U9
TLSH
T11A120838BC787C7B9EA79D45F4877B239FA4016BE6952E84DAD81E1C01C729C1307D26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 ed822addd2cd99de720e394e0fc74dc25b7e0f63743c341e35214f9bbc64b8a1
MD5 79fd1d39c97e53761608b7b840a52d64
SHA1 291d0838fc6fe4df99546597d1ae8ce5d67a7e89
SHA512 61083d283fff58c0962cce31fa119c8bb0671a8acff9c6ff0fb7a182826cdd5dce579e3b881537f02ff00dc366d696517b7152d100558a279a71b58217d52ca9
TLSH
T1D4117A37B39C8921CC96153A409D9C1172B583C7819EDF9F7BC4D215A07F588CB71194
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 96e9a28c905bd3dc25775f38bf861cff4d2a6ced3862ec968b61ea23392ac95d
MD5 c4872a761c81844779e70928ee0b94b5
SHA1 51252910046c45c2cc0636b8ce3fe288c1098404
SHA512 899e951c08d58dc4e6fcf475c29d4a9abfc5cedd3d0c6f25ec71819f361901dd66e320a8fcfb3256bc318179e653f44df9c2510db132cf9a9eac13f44fbc9dac
TLSH
T1BF21A837B3CC8A60CC86193A809DAD1136B683C7409EDE9F6FC0D214E0BF588CB711A0
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 40c0ac2dc249a834cd08f72dff01f56bfcca68c0f93521ba42508c6aed587f5d
MD5 1c7d1cbabee86329b97237edfc3fcd3b
SHA1 17ce715126b4ca6e64b758a86cd9a6b06c254818
SHA512 51ae2d7ab1b8038400182d975dad52f5c06ec76521f37c58661d138b77974a66c8aeca9f553bbb2eadbe1d3d5efbe4b68c013f82242db81c730df5f5d705ffd3
TLSH
T105218627B3DC8AA1CC86163A909DAD1136B693C7409ECECF6BC0C214E5AF598CB71190
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 bd5d317b3c48e16d4d72c9048233dd730288e065a4c54fd1de43d9cf84449800
MD5 957eec9c031a3d1a62f1a94bf9a0990b
SHA1 d5cb2c978f9f1db1791273ee2006d91dd53c9f3e
SHA512 5ba1b563feafa5e33d2c682db555faa02d967b67f40862ea87e8356ccc540825f0ba3c7d577cb4e871d6f8b6a66ac22af50b7def1387c3d568d30ca977dc8d3e
TLSH
T155218927B3DC89A0CC86153A40AD9C1136B793C7409ECEDF6BC4C214E1AF588CB61190
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_qnamse54.5bo.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_qnamse54.5bo.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

client.log

Path C:\Users\Admin\AppData\Local\Temp\config\client.log
Size 4KB
SHA256 dd0a77c943a11ab4b48d6c9e50db4cc4ec2b225afe359a04816748cbf81ef235
MD5 f40d0035c8c9d3880ee1afa082b21d0c
SHA1 36a4d27dc21c5ea8d2b1b4b73351e2a38f8224fe
SHA512 4cb89eaf4ae76c27479b753b91c79913eb06bd018b68716639a7e69288615a04c216f7eec41fd6c8909f05939b76b5862c625c34091428fa4ff8289ae9b31be1
SSDEEP 96:ouK13QA0J4VAy/oAadraUAadraTCD62JqQeEDp0Lz5Pouf:pjCadraVadrajrEIjf
TLSH
T1669151D14FEC8C6B508C61B6542CD3985CFFF81A32421E75A12CC37D518AE55AEEFA48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

node.napi.node

Path C:\Users\Admin\AppData\Local\Temp\pkg\da2172ce055fa47d6a0ea1c90654f530abed33f69a74d52fab06c4c7653b48fd\@primno\dpapi\prebuilds\win32-x64\node.napi.node
Size 137KB
SHA256 da2172ce055fa47d6a0ea1c90654f530abed33f69a74d52fab06c4c7653b48fd
MD5 04bfbfec8db966420fe4c7b85ebb506a
SHA1 939bb742a354a92e1dcd3661a62d69e48030a335
SHA512 4ea97a9a120ed5bee8638e0a69561c2159fc3769062d7102167b0e92b4f1a5c002a761bd104282425f6cee8d0e39dbe7e12ad4e4a38570c3f90f31b65072dd65
SSDEEP 3072:94PTD6FEzMju6bzJKjpEPeTOKvJhEnww+YbRYvPuq:94jQju6b9KilKvJurR8W
TLSH
T1B3D37D4BB3A500BBE176C639C8934A05E776B81517619B9F03A0475B1F237D1EE3EB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chromelevator.exe

Path C:\Users\Admin\AppData\Local\Temp\quex-chromelevator-1bdc4d29a166\chromelevator.exe
Size 1.4MB
SHA256 036e82f62f951d2bc5feb7ed7f7f7d45911500727027953fa090282d27e48f81
MD5 21a4aa7e8d93b48fcdb2252029abab24
SHA1 1bdc4d29a166bbcb52e9ff0f00eaeeb7944c4747
SHA512 bee0e8ba7ad906287cb1af7ed19c019704df13333853e373a1aac7b9fdf84662cd5b7b41c4f531e68a8535a5ecef24ca3f58f689caff5cd98bff362fb8a1acee
SSDEEP 24576:psDQfWex9NF3yWgT0rAhpkyJhkXxOMTLfdG8nAuuz5suusotl:p9zxR3fPr6TgXxOSzdGiHuz5msY
TLSH
T17D65021AFBA405FDE1B7D274CD524902D7B2F84A0760E78B03E459961F37AA09E3E712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

quex-dpapi-1792327230807_1668.ps1

Path C:\Users\Admin\AppData\Local\Temp\quex-dpapi-1792327230807_1668.ps1
Size 438B
SHA256 973230ef9659b7b054981296cc27eea105ddff832cc05333ce06945c04637681
MD5 664a7fc34efccc8b1bbeeb2f0cfd25cc
SHA1 e7d4d39f78131099e2b2374f6933e33057635901
SHA512 7db858c4a370da99641a8e3353af5a0cf90ca1317312feb1a262e54923e6db4a48055b9e78c34e17ebb1b0fbcf8a6253ae07e90d7dbab9ab2fb135ac01b395aa
TLSH
T18BF0DC20C38E5A5F04A8545622F2C0ECB63A843838CE2A24FF38C30871B8CCCC58488D
MD5 SHA1 SHA512 TLSH

Submit Download

quex-dpapi-1792327231573_1668_LocalMachine.ps1

Path C:\Users\Admin\AppData\Local\Temp\quex-dpapi-1792327231573_1668_LocalMachine.ps1
Size 462B
SHA256 276061944e79907e221153104cc293e853bdfca6b2e6053a8a2b00ff9183bc79
MD5 e3b7857bf127398ae9262812e5f87d21
SHA1 0ebca9f980d43b82ea5bc10a9379245782156539
SHA512 04b197fba18ca20c3aa8f2112fd7b590668970ceb21c86746d82f2814a746a464bec3233fad277014677fe43a85e56ca6276ba41b15667573b3594476801f1b3
TLSH
T1A7F02E1453EF5A8F04A8946A13F2C2CDA476843D794A2624FB7AC20DB6A498CD595486
MD5 SHA1 SHA512 TLSH

Submit Download

quex-dpapi-1792327232120_1668.ps1

Path C:\Users\Admin\AppData\Local\Temp\quex-dpapi-1792327232120_1668.ps1
Size 438B
SHA256 e0088be29bd846e029c34c53ff87c50e8c6e530aa840ec1aef22864e9ba579f5
MD5 af67df92393c9c0ab31c4acbc4479cbd
SHA1 41a029131f80b733405292b231092a3a30e11fed
SHA512 01f126f1240819481bb9b056b659b30f850fa4b646ffed49d8b58ed4d22caf2572bc5334b06a906a8d9c743908deeb8530fd38145d3eeadc0440056e90b162fb
TLSH
T197F0DC20438B9A8F0498546626F2C0ECB9368438388E2A24FB3CC20972B4C8CC58488D
MD5 SHA1 SHA512 TLSH

Submit Download

quex-dpapi-in-1792327230807_1668.bin

Path C:\Users\Admin\AppData\Local\Temp\quex-dpapi-in-1792327230807_1668.bin
Size 640B
SHA256 db0c2b29258458ea9db26c58065e1d54f112ae2f94ef1e73f13e7163e09aa012
MD5 7411ec4e0fd450644a22b18e5ab5f6ae
SHA1 313cff2f3c0ffe0153e8106630e5492b31056d82
SHA512 8e478bece4ff52f4d2d363e332158faf7d45e0445218329787c5ba55c3e261675cb9f0fd8d5687126fa37a66b82158e7247cd46c171d6eb730b20c4b7e7fa9fe
TLSH
T1FEF068144230068EA04B1B685D4309C8835BB62EB4E34EEFF660501815FEB0CD1677FB
MD5 SHA1 SHA512 TLSH

Submit Download

quex-sys-1792327229995_1668.ps1

Path C:\Users\Admin\AppData\Local\Temp\quex-sys-1792327229995_1668.ps1
Size 3KB
SHA256 e5d38914ec4e958e3d241047f5a2150735025421225e7a14a0420ee0a807ec34
MD5 a3b4b9a9d1f9f6fe504ab53570a96416
SHA1 a1b2d0f33bc1698be61d3ea9e6e6ebed3efbc6dd
SHA512 842fb30844f9d10e74cf248a1c4cfac69739ff1d18bf496a58dabb813b74714bb49dc57e6b6c6a89240b63601dbfb695e31adbb58f15b553e3d2f9db34ef2f12
TLSH
T1BE710F81A30663345962761D89CED09FFB22503603BF9D24BA7CCBB1AFC1535D1BA709
MD5 SHA1 SHA512 TLSH

Submit Download

quex-sys-1792327232776_1668.ps1

Path C:\Users\Admin\AppData\Local\Temp\quex-sys-1792327232776_1668.ps1
Size 3KB
SHA256 d97aac9633d4cee4fb20c3ae9fb5ecbdedddc90680f077fe9b7679ca5cc47371
MD5 6c6927f98a059d4f558f961fde684ba9
SHA1 82f7a19a5f56356c1e85ca918340e466a0c64c2a
SHA512 7ac2cc9ebcfc530cc6f6f097134d383ca808848306063299e07f5133492769a9f25eb8c87c2654289c408d553bd522fe5b7c51aa1d52a0bf6e3e5b7c9321d2ff
TLSH
T146710F81A306A3345962B61D89CED09FFB22503603BF9D24BA7CC7B1AFC1535D1BA709
MD5 SHA1 SHA512 TLSH

Submit Download

ot5gxwj4.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\ot5gxwj4\ot5gxwj4.0.cs
Size 3KB
SHA256 3bdb997485d4951b4ecdd5f31130a022e963deb3e4ff82addbc6464e15902540
MD5 42918e8a16961f0a2ab2313e725cbcb8
SHA1 6be27cbe442895e7fe7cb487771b91b8eb8ccf3e
SHA512 30c52861103957a109fa8e79d6a2d4811297f2c1bf0c2e756410305ef4c6368f364adbe8a39aba11540f6df63f439c52ed5a1b00eab2b0358c821ab91196fc0a
TLSH
T14C61F081A716633059A2761C89CED09FFB22502603BF9D68BA7CC7B1AFC1135D1BA709
MD5 SHA1 SHA512 TLSH

Submit Download

ot5gxwj4.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\ot5gxwj4\ot5gxwj4.cmdline
Size 369B
SHA256 ee018ed2f7ae8bee4c76a22b390c88380d259479a45cee9018983882b175ee14
MD5 32e7e7d7df3b0b3262cc2c68c5c450e1
SHA1 b62ab1ef1320f59b68cfb6ae9f7715f0d64638a6
SHA512 93e90b890a27b64ce6ed416229cf0b85d62a2eb695824cf6317f5ca8fc095bd1ad4743c38841dd89a58f3814945fae03b8c111cfde76de53fe45aae811e8e5f9
TLSH
T160E0C02A4247C37D03DD10072169D4ACD37247432B403F8460404C0EF25F003A7F1741
MD5 SHA1 SHA512 TLSH

Submit Download

quex-com-inj-1792327234089_1668.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\quex-com-inj-1792327234089_1668.cs
Size 9KB
SHA256 a776f218d6bb983ec33304c610154c70c4f92e8dc0944e77b4676e6afaad98b6
MD5 b8878d7f9d2acd788b99aa7edcf6a551
SHA1 0a29a2986aa6a117104857cc534f8da3998eb1b5
SHA512 3646722f7243ac4aa3ebb4272234c37990428d483e96845089be49a6156eba4448e46e776ffcc55d767131fc3f5de45d67720fa730c8b230bb926c10510e3473
SSDEEP 192:/YbSGLh+TjYoiWYjYQHfK7GHEiyaiQ2/sCDickQURJm+NddlmM0tQnWsCQW7:/YbewrjjfK7GHEr/vsRNRQOnWR
TLSH
T10212C6182456D5261993312CEDEE985CF21390B317FEFCA0BDFC97628F0506D92B97A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

quex-inject-1792327235698_1668.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\quex-inject-1792327235698_1668.cs
Size 4KB
SHA256 590efe97eb6a73676abdf2d706eb21771363341a458526339021b19d6583a0e7
MD5 d97c8e2c0a175826933006028604555f
SHA1 5ccfd83b137dba8eff23f4eb21017f9660388c20
SHA512 3760e62cc5ecefc2a8e5a2fdc0229845627d92a7f2796089862912d9f4ca4c8e7d3ee863bc9c3dc46f833f4117a87ccc43cd26277ae26639f7fdb5aad414325e
SSDEEP 96:CjPNM7YbxNbnZnjowQUafv5bFdKOyXqaiQL+FmqX3+v:tYbRXQzZK/qaiQL+N3s
TLSH
T10F81A4183883956A4B07706DDEEC4415A613A4770BBEFC94BDEDB9B08F4E01E13B5398
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

quex-procinj-1792327234823_1668.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\quex-procinj-1792327234823_1668.cs
Size 8KB
SHA256 a1fcb06eb666901b86c263ef5e3a03e40cf0d2788c398f43750d077e0b4c7f99
MD5 e3bf00d7f56a2d6f2dc1c3f27318f3f9
SHA1 7ad45ac71e1ffc6e9240ff940c1c6468179a531a
SHA512 be953c91aec920b00327e03f5323876675988d4f73a45b7399d4b0515b414386c92e26d7f97e414de29c2f54cdc20a82ea100f90658826d0977431730cc3d2a2
SSDEEP 192:ZJYbSBWTjwdtWY1QzZKNUaiQ0XZOkDickQ4+Qlkjw/p2CQW7:ZJYb3yrsZKNiZLPAf/Z
TLSH
T14C02B7142587E6661A97302CADDE981DF213907307FFEC50BDED96B0AF0A02D93B9758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

verpdf22.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\verpdf22\verpdf22.cmdline
Size 369B
SHA256 73a679cf09493f7e147eecb3bb7eebc5f3ec3eff1ed32e78b90cee5ab1d97e41
MD5 9c4fa0c819b24ac1d69dacd80d34257f
SHA1 229712cb709a945109e1f1a45a71ffa56a280f63
SHA512 a7628d3cd7f618a9243f611fcac6dc5778b6edd1813b6a054607b5c2afa32a8aa793c8804a26ee15ac0ed69989ebba44952da61db071eaa64347707060722aae
TLSH
T12FE0C63A4766C27E02FD104B226AC4ACE37207836E803FC49C40860EE0270183FE3782
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1116-196-0x0000021333E00000-0x000002133401C000-memory.dmp

Download

memory/1116-179-0x0000021333D50000-0x0000021333D72000-memory.dmp

Download

memory/1296-259-0x000001B4EC2F0000-0x000001B4EC50C000-memory.dmp

Download

memory/4160-209-0x0000023E7FBE0000-0x0000023E7FC30000-memory.dmp

Download

memory/4396-281-0x00000000000F0000-0x00000000000F8000-memory.dmp

Download

memory/4420-225-0x000002726D2A0000-0x000002726D4BC000-memory.dmp

Download

memory/4520-239-0x00000146F7900000-0x00000146F7B1C000-memory.dmp

Download