df4e07d1ace596b6cef2cd8da8184b5a200edf5d766536190d6c7b93b8ed1fa9

Analysis

max time kernel
150s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/10/2026, 12:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-18_7c60819a498ff65d03b6979e781dfd9a_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe
Size 45.1MB
Sample261018-ppewmsah83
SHA256 df4e07d1ace596b6cef2cd8da8184b5a200edf5d766536190d6c7b93b8ed1fa9
MD5 7c60819a498ff65d03b6979e781dfd9a
SHA1 cbae9a7094140e2627daf8fba790cd2511ad425b
SHA512 19bf926e96b0828121751254ef4d585a2de5f70223f3f98209405271e4aa36f05ba8e8ee16fa9865277168df4c1bb33802716c0bf1cfbb17c12590e49e3a6afe
SSDEEP 393216:s1Du8BtuBw2FEL3Z3aLUoQvo6LP/SgbSpYvKEh1EdKwlGQKPJuGsiTfREsrgCYfh:sMguj8Q4VfvVqFTrYzduVH
TLSH
T147A79C0773E600A5E5B3D1388AA74503E773B4635731DBDF329C06552FABAE09A7A720
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution spyware stealer

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
5948	powershell.exe
4164	powershell.exe
5936	powershell.exe
3684	powershell.exe
4236	powershell.exe

Executes dropped EXE 19 IoCs

pid	Process
1348	chromelevator.exe
6004	chromelevator.exe
1740	chromelevator.exe
5332	chromelevator.exe
2436	chromelevator.exe
6096	chromelevator.exe
5008	chromelevator.exe
5676	chromelevator.exe
3392	chromelevator.exe
5288	chromelevator.exe
4500	chromelevator.exe
5980	chromelevator.exe
4796	chromelevator.exe
108	chromelevator.exe
3540	chromelevator.exe
5132	chromelevator.exe
2708	chromelevator.exe
4452	chromelevator.exe
1620	quex_elev_helper_v3.exe

Loads dropped DLL 1 IoCs

pid	Process
3636	2026-10-18_7c60819a498ff65d03b6979e781dfd9a_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Contacts third-party web service commonly abused for C2 1 TTPs 5 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	discord.com
8	discord.com
9	discord.com
10	discord.com
13	discord.com

Discovers running processes 1 TTPs 16 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
5092	tasklist.exe
5380	tasklist.exe
1204	tasklist.exe
4824	tasklist.exe
1444	tasklist.exe
5484	tasklist.exe
4764	tasklist.exe
3692	tasklist.exe
2972	tasklist.exe
5320	tasklist.exe
2400	tasklist.exe
5128	tasklist.exe
2612	tasklist.exe
3748	tasklist.exe
3944	tasklist.exe
6104	tasklist.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\quex_elev_helper_v3.exe	2026-10-18_7c60819a498ff65d03b6979e781dfd9a_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-18_7c60819a498ff65d03b6979e781dfd9a_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-18_7c60819a498ff65d03b6979e781dfd9a_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1920	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry key 1 TTPs 24 IoCs

Modify Registry

T1112

pid	Process
260	reg.exe
3684	reg.exe
2052	reg.exe
5756	reg.exe
1284	reg.exe
2980	reg.exe
5928	reg.exe
2160	reg.exe
2920	reg.exe
4540	reg.exe
3576	reg.exe
4512	reg.exe
3272	reg.exe
4392	reg.exe
2552	reg.exe
4156	reg.exe
5348	reg.exe
4956	reg.exe
3044	reg.exe
564	reg.exe
3188	reg.exe
4640	reg.exe
5936	reg.exe
3448	reg.exe

Suspicious behavior: EnumeratesProcesses 15 IoCs

pid	Process
4164	powershell.exe
4164	powershell.exe
4164	powershell.exe
5936	powershell.exe
5936	powershell.exe
5936	powershell.exe
3684	powershell.exe
3684	powershell.exe
3684	powershell.exe
4236	powershell.exe
4236	powershell.exe
4236	powershell.exe
5948	powershell.exe
5948	powershell.exe
5948	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
1628	msedge.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	5128	tasklist.exe
Token: SeDebugPrivilege	4764	tasklist.exe
Token: SeDebugPrivilege	2612	tasklist.exe
Token: SeDebugPrivilege	3692	tasklist.exe
Token: SeDebugPrivilege	3748	tasklist.exe
Token: SeDebugPrivilege	3944	tasklist.exe
Token: SeDebugPrivilege	4824	tasklist.exe
Token: SeDebugPrivilege	1444	tasklist.exe
Token: SeDebugPrivilege	5320	tasklist.exe
Token: SeDebugPrivilege	2972	tasklist.exe
Token: SeDebugPrivilege	6104	tasklist.exe
Token: SeDebugPrivilege	2400	tasklist.exe
Token: SeDebugPrivilege	4164	powershell.exe
Token: SeDebugPrivilege	5936	powershell.exe
Token: SeDebugPrivilege	3684	powershell.exe
Token: SeDebugPrivilege	4236	powershell.exe
Token: SeDebugPrivilege	5948	powershell.exe
Token: SeDebugPrivilege	5092	tasklist.exe
Token: SeDebugPrivilege	5380	tasklist.exe
Token: SeDebugPrivilege	1204	tasklist.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3636 wrote to memory of 2956	3636	2026-10-18_7c60819a498ff65d03b6979e781dfd9a_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	89
PID 3636 wrote to memory of 5128	3636	2026-10-18_7c60819a498ff65d03b6979e781dfd9a_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	91
PID 3636 wrote to memory of 1628	3636	2026-10-18_7c60819a498ff65d03b6979e781dfd9a_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	94
PID 3636 wrote to memory of 2800	3636	2026-10-18_7c60819a498ff65d03b6979e781dfd9a_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	95
PID 1628 wrote to memory of 5344	1628	msedge.exe	97
PID 3636 wrote to memory of 4764	3636	2026-10-18_7c60819a498ff65d03b6979e781dfd9a_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	98
PID 1628 wrote to memory of 1920	1628	msedge.exe	101
PID 1628 wrote to memory of 5396	1628	msedge.exe	102
PID 1628 wrote to memory of 5396	1628	msedge.exe	102
PID 1628 wrote to memory of 5204	1628	msedge.exe	103
PID 1628 wrote to memory of 5204	1628	msedge.exe	103
PID 1628 wrote to memory of 5204	1628	msedge.exe	103
PID 1628 wrote to memory of 5012	1628	msedge.exe	104
PID 1628 wrote to memory of 5012	1628	msedge.exe	104
PID 1628 wrote to memory of 5012	1628	msedge.exe	104
PID 3636 wrote to memory of 6068	3636	2026-10-18_7c60819a498ff65d03b6979e781dfd9a_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	105
PID 3636 wrote to memory of 2612	3636	2026-10-18_7c60819a498ff65d03b6979e781dfd9a_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	107
PID 3636 wrote to memory of 4984	3636	2026-10-18_7c60819a498ff65d03b6979e781dfd9a_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	109
PID 3636 wrote to memory of 4996	3636	2026-10-18_7c60819a498ff65d03b6979e781dfd9a_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	111
PID 3636 wrote to memory of 3692	3636	2026-10-18_7c60819a498ff65d03b6979e781dfd9a_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	113
PID 3636 wrote to memory of 1480	3636	2026-10-18_7c60819a498ff65d03b6979e781dfd9a_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	206
PID 3636 wrote to memory of 1168	3636	2026-10-18_7c60819a498ff65d03b6979e781dfd9a_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	118
PID 3636 wrote to memory of 3748	3636	2026-10-18_7c60819a498ff65d03b6979e781dfd9a_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	120
PID 3636 wrote to memory of 5764	3636	2026-10-18_7c60819a498ff65d03b6979e781dfd9a_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	122
PID 3636 wrote to memory of 3272	3636	2026-10-18_7c60819a498ff65d03b6979e781dfd9a_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	223
PID 3636 wrote to memory of 1284	3636	2026-10-18_7c60819a498ff65d03b6979e781dfd9a_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	126
PID 3636 wrote to memory of 4392	3636	2026-10-18_7c60819a498ff65d03b6979e781dfd9a_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	128
PID 3636 wrote to memory of 2552	3636	2026-10-18_7c60819a498ff65d03b6979e781dfd9a_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	130
PID 3636 wrote to memory of 4956	3636	2026-10-18_7c60819a498ff65d03b6979e781dfd9a_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	227
PID 3636 wrote to memory of 4156	3636	2026-10-18_7c60819a498ff65d03b6979e781dfd9a_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	134
PID 3636 wrote to memory of 5368	3636	2026-10-18_7c60819a498ff65d03b6979e781dfd9a_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	136
PID 3636 wrote to memory of 3944	3636	2026-10-18_7c60819a498ff65d03b6979e781dfd9a_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	138
PID 3636 wrote to memory of 3200	3636	2026-10-18_7c60819a498ff65d03b6979e781dfd9a_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	140
PID 3636 wrote to memory of 3564	3636	2026-10-18_7c60819a498ff65d03b6979e781dfd9a_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	142
PID 3636 wrote to memory of 4240	3636	2026-10-18_7c60819a498ff65d03b6979e781dfd9a_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	144
PID 3636 wrote to memory of 5476	3636	2026-10-18_7c60819a498ff65d03b6979e781dfd9a_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	146
PID 3636 wrote to memory of 3240	3636	2026-10-18_7c60819a498ff65d03b6979e781dfd9a_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	148
PID 3636 wrote to memory of 4616	3636	2026-10-18_7c60819a498ff65d03b6979e781dfd9a_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	150
PID 3636 wrote to memory of 2836	3636	2026-10-18_7c60819a498ff65d03b6979e781dfd9a_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	152
PID 3636 wrote to memory of 5000	3636	2026-10-18_7c60819a498ff65d03b6979e781dfd9a_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	154
PID 3636 wrote to memory of 4824	3636	2026-10-18_7c60819a498ff65d03b6979e781dfd9a_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	156
PID 3636 wrote to memory of 1132	3636	2026-10-18_7c60819a498ff65d03b6979e781dfd9a_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	158
PID 3636 wrote to memory of 3188	3636	2026-10-18_7c60819a498ff65d03b6979e781dfd9a_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	160
PID 3636 wrote to memory of 3044	3636	2026-10-18_7c60819a498ff65d03b6979e781dfd9a_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	162
PID 3636 wrote to memory of 564	3636	2026-10-18_7c60819a498ff65d03b6979e781dfd9a_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	164
PID 3636 wrote to memory of 2980	3636	2026-10-18_7c60819a498ff65d03b6979e781dfd9a_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	166
PID 3636 wrote to memory of 5928	3636	2026-10-18_7c60819a498ff65d03b6979e781dfd9a_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	168
PID 3636 wrote to memory of 4640	3636	2026-10-18_7c60819a498ff65d03b6979e781dfd9a_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	170
PID 3636 wrote to memory of 1616	3636	2026-10-18_7c60819a498ff65d03b6979e781dfd9a_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	172
PID 3636 wrote to memory of 1444	3636	2026-10-18_7c60819a498ff65d03b6979e781dfd9a_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	174
PID 3636 wrote to memory of 2332	3636	2026-10-18_7c60819a498ff65d03b6979e781dfd9a_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	176
PID 3636 wrote to memory of 4164	3636	2026-10-18_7c60819a498ff65d03b6979e781dfd9a_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	266
PID 3636 wrote to memory of 5320	3636	2026-10-18_7c60819a498ff65d03b6979e781dfd9a_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	180
PID 3636 wrote to memory of 3820	3636	2026-10-18_7c60819a498ff65d03b6979e781dfd9a_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	182
PID 3636 wrote to memory of 2160	3636	2026-10-18_7c60819a498ff65d03b6979e781dfd9a_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	184
PID 3636 wrote to memory of 5936	3636	2026-10-18_7c60819a498ff65d03b6979e781dfd9a_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	269
PID 3636 wrote to memory of 3448	3636	2026-10-18_7c60819a498ff65d03b6979e781dfd9a_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	188
PID 3636 wrote to memory of 260	3636	2026-10-18_7c60819a498ff65d03b6979e781dfd9a_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	190
PID 3636 wrote to memory of 2920	3636	2026-10-18_7c60819a498ff65d03b6979e781dfd9a_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	192
PID 3636 wrote to memory of 3684	3636	2026-10-18_7c60819a498ff65d03b6979e781dfd9a_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	271
PID 3636 wrote to memory of 3452	3636	2026-10-18_7c60819a498ff65d03b6979e781dfd9a_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	196
PID 3636 wrote to memory of 2972	3636	2026-10-18_7c60819a498ff65d03b6979e781dfd9a_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	198
PID 3636 wrote to memory of 4236	3636	2026-10-18_7c60819a498ff65d03b6979e781dfd9a_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	273
PID 3636 wrote to memory of 4224	3636	2026-10-18_7c60819a498ff65d03b6979e781dfd9a_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	202

C:\Users\Admin\AppData\Local\Temp\2026-10-18_7c60819a498ff65d03b6979e781dfd9a_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-18_7c60819a498ff65d03b6979e781dfd9a_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
PID:3636
- C:\Windows\system32\where.exe
  where.exe msedge.exe
  2⤵
  PID:2956
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq msedge.exe" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:5128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --disable-background-networking about:blank
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:1628
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x28c,0x7ffe1e9ac188,0x7ffe1e9ac194,0x7ffe1e9ac1a0
    3⤵
    PID:5344
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1912,i,1889859109291746337,5436582934733397411,524288 --field-trial-handle=2196,i,881100851392519620,1342048556869752418,262144 --variations-seed-version --mojo-platform-channel-handle=2860 /prefetch:11
    3⤵
    - System Time Discovery
    PID:1920
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2464,i,7617239288180252670,15143122209788389068,524288 --field-trial-handle=2196,i,881100851392519620,1342048556869752418,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:13
    3⤵
    PID:5396
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3048,i,16461465551203331000,15510013843122311437,2097152 --field-trial-handle=2196,i,881100851392519620,1342048556869752418,262144 --variations-seed-version --mojo-platform-channel-handle=3788 /prefetch:9
    3⤵
    PID:5204
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1588,i,3976264075532246536,8881378996262169935,262144 --field-trial-handle=2196,i,881100851392519620,1342048556869752418,262144 --variations-seed-version --mojo-platform-channel-handle=2192 /prefetch:2
    3⤵
    PID:5012
- C:\Windows\system32\where.exe
  where.exe msedge.exe
  2⤵
  PID:2800
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq msedge.exe" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:4764
- C:\Windows\system32\where.exe
  where.exe msedge.exe
  2⤵
  PID:6068
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq msedge.exe" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:2612
- C:\Windows\system32\where.exe
  where.exe opera.exe
  2⤵
  PID:4984
- C:\Windows\system32\where.exe
  where.exe msedge.exe
  2⤵
  PID:4996
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq msedge.exe" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:3692
- C:\Windows\system32\where.exe
  where.exe opera.exe
  2⤵
  PID:1480
- C:\Windows\system32\where.exe
  where.exe msedge.exe
  2⤵
  PID:1168
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq msedge.exe" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:3748
- C:\Windows\system32\where.exe
  where.exe browser.exe
  2⤵
  PID:5764
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Yandex\YandexBrowser /v InstallLocation
  2⤵
  - Modifies registry key
  PID:3272
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Yandex\YandexBrowser /v Path
  2⤵
  - Modifies registry key
  PID:1284
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Yandex\YandexBrowser /v InstallPath
  2⤵
  - Modifies registry key
  PID:4392
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\Yandex\YandexBrowser /v InstallLocation
  2⤵
  - Modifies registry key
  PID:2552
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\Yandex\YandexBrowser /v Path
  2⤵
  - Modifies registry key
  PID:4956
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\Yandex\YandexBrowser /v InstallPath
  2⤵
  - Modifies registry key
  PID:4156
- C:\Windows\system32\where.exe
  where.exe msedge.exe
  2⤵
  PID:5368
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq msedge.exe" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:3944
- C:\Windows\system32\where.exe
  where.exe epic.exe
  2⤵
  PID:3200
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\Epic Privacy Browser" /v InstallLocation
  2⤵
  PID:3564
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\Epic Privacy Browser" /v Path
  2⤵
  PID:4240
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\Epic Privacy Browser" /v InstallPath
  2⤵
  PID:5476
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\WOW6432Node\Epic Privacy Browser" /v InstallLocation
  2⤵
  PID:3240
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\WOW6432Node\Epic Privacy Browser" /v Path
  2⤵
  PID:4616
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\WOW6432Node\Epic Privacy Browser" /v InstallPath
  2⤵
  PID:2836
- C:\Windows\system32\where.exe
  where.exe msedge.exe
  2⤵
  PID:5000
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq msedge.exe" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:4824
- C:\Windows\system32\where.exe
  where.exe chrome.exe
  2⤵
  PID:1132
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\CentBrowser /v InstallLocation
  2⤵
  - Modifies registry key
  PID:3188
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\CentBrowser /v Path
  2⤵
  - Modifies registry key
  PID:3044
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\CentBrowser /v InstallPath
  2⤵
  - Modifies registry key
  PID:564
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\CentBrowser /v InstallLocation
  2⤵
  - Modifies registry key
  PID:2980
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\CentBrowser /v Path
  2⤵
  - Modifies registry key
  PID:5928
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\CentBrowser /v InstallPath
  2⤵
  - Modifies registry key
  PID:4640
- C:\Windows\system32\where.exe
  where.exe msedge.exe
  2⤵
  PID:1616
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq msedge.exe" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:1444
- C:\Windows\system32\where.exe
  where.exe chrome.exe
  2⤵
  PID:2332
- C:\Windows\system32\where.exe
  where.exe msedge.exe
  2⤵
  PID:4164
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq msedge.exe" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:5320
- C:\Windows\system32\where.exe
  where.exe vivaldi.exe
  2⤵
  PID:3820
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Vivaldi /v InstallLocation
  2⤵
  - Modifies registry key
  PID:2160
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Vivaldi /v Path
  2⤵
  - Modifies registry key
  PID:5936
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Vivaldi /v InstallPath
  2⤵
  - Modifies registry key
  PID:3448
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\Vivaldi /v InstallLocation
  2⤵
  - Modifies registry key
  PID:260
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\Vivaldi /v Path
  2⤵
  - Modifies registry key
  PID:2920
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\Vivaldi /v InstallPath
  2⤵
  - Modifies registry key
  PID:3684
- C:\Windows\system32\where.exe
  where.exe msedge.exe
  2⤵
  PID:3452
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq msedge.exe" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:2972
- C:\Windows\system32\where.exe
  where.exe iridium.exe
  2⤵
  PID:4236
- C:\Windows\system32\where.exe
  where.exe msedge.exe
  2⤵
  PID:4224
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq msedge.exe" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:6104
- C:\Windows\system32\where.exe
  where.exe chrome.exe
  2⤵
  PID:1480
- C:\Windows\system32\where.exe
  where.exe msedge.exe
  2⤵
  PID:4828
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq msedge.exe" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:2400
- C:\Windows\system32\where.exe
  where.exe browser.exe
  2⤵
  PID:3708
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\CocCoc\Browser /v InstallLocation
  2⤵
  - Modifies registry key
  PID:2052
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\CocCoc\Browser /v Path
  2⤵
  - Modifies registry key
  PID:5756
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\CocCoc\Browser /v InstallPath
  2⤵
  - Modifies registry key
  PID:4540
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\CocCoc\Browser /v InstallLocation
  2⤵
  - Modifies registry key
  PID:3576
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\CocCoc\Browser /v Path
  2⤵
  - Modifies registry key
  PID:4512
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3272
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\CocCoc\Browser /v InstallPath
  2⤵
  - Modifies registry key
  PID:5348
- C:\Windows\system32\where.exe
  where.exe msedge.exe
  2⤵
  PID:904
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4956
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq msedge.exe" /FO CSV /NH
  2⤵
  - Discovers running processes
  PID:5484
- C:\Users\Admin\AppData\Local\Temp\quex-chromelevator-1bdc4d29a166\chromelevator.exe
  C:\Users\Admin\AppData\Local\Temp\quex-chromelevator-1bdc4d29a166\chromelevator.exe -o C:\Users\Admin\AppData\Local\Temp\quex-cl-000000-1792327233038_3636 000000
  2⤵
  - Executes dropped EXE
  PID:1348
- C:\Users\Admin\AppData\Local\Temp\quex-chromelevator-1bdc4d29a166\chromelevator.exe
  C:\Users\Admin\AppData\Local\Temp\quex-chromelevator-1bdc4d29a166\chromelevator.exe --output-path C:\Users\Admin\AppData\Local\Temp\quex-cl-000000-1792327233038_3636 000000
  2⤵
  - Executes dropped EXE
  PID:6004
- C:\Users\Admin\AppData\Local\Temp\quex-chromelevator-1bdc4d29a166\chromelevator.exe
  C:\Users\Admin\AppData\Local\Temp\quex-chromelevator-1bdc4d29a166\chromelevator.exe 000000 -o C:\Users\Admin\AppData\Local\Temp\quex-cl-000000-1792327233038_3636
  2⤵
  - Executes dropped EXE
  PID:1740
- C:\Users\Admin\AppData\Local\Temp\quex-chromelevator-1bdc4d29a166\chromelevator.exe
  C:\Users\Admin\AppData\Local\Temp\quex-chromelevator-1bdc4d29a166\chromelevator.exe 000000 --output-path C:\Users\Admin\AppData\Local\Temp\quex-cl-000000-1792327233038_3636
  2⤵
  - Executes dropped EXE
  PID:5332
- C:\Users\Admin\AppData\Local\Temp\quex-chromelevator-1bdc4d29a166\chromelevator.exe
  C:\Users\Admin\AppData\Local\Temp\quex-chromelevator-1bdc4d29a166\chromelevator.exe 000000
  2⤵
  - Executes dropped EXE
  PID:2436
- C:\Users\Admin\AppData\Local\Temp\quex-chromelevator-1bdc4d29a166\chromelevator.exe
  C:\Users\Admin\AppData\Local\Temp\quex-chromelevator-1bdc4d29a166\chromelevator.exe -o C:\Users\Admin\AppData\Local\Temp\quex-cl-00000-1792327233839_3636 00000
  2⤵
  - Executes dropped EXE
  PID:6096
- C:\Users\Admin\AppData\Local\Temp\quex-chromelevator-1bdc4d29a166\chromelevator.exe
  C:\Users\Admin\AppData\Local\Temp\quex-chromelevator-1bdc4d29a166\chromelevator.exe --output-path C:\Users\Admin\AppData\Local\Temp\quex-cl-00000-1792327233839_3636 00000
  2⤵
  - Executes dropped EXE
  PID:5008
- C:\Users\Admin\AppData\Local\Temp\quex-chromelevator-1bdc4d29a166\chromelevator.exe
  C:\Users\Admin\AppData\Local\Temp\quex-chromelevator-1bdc4d29a166\chromelevator.exe 00000 -o C:\Users\Admin\AppData\Local\Temp\quex-cl-00000-1792327233839_3636
  2⤵
  - Executes dropped EXE
  PID:5676
- C:\Users\Admin\AppData\Local\Temp\quex-chromelevator-1bdc4d29a166\chromelevator.exe
  C:\Users\Admin\AppData\Local\Temp\quex-chromelevator-1bdc4d29a166\chromelevator.exe 00000 --output-path C:\Users\Admin\AppData\Local\Temp\quex-cl-00000-1792327233839_3636
  2⤵
  - Executes dropped EXE
  PID:3392
- C:\Users\Admin\AppData\Local\Temp\quex-chromelevator-1bdc4d29a166\chromelevator.exe
  C:\Users\Admin\AppData\Local\Temp\quex-chromelevator-1bdc4d29a166\chromelevator.exe 00000
  2⤵
  - Executes dropped EXE
  PID:5288
- C:\Users\Admin\AppData\Local\Temp\quex-chromelevator-1bdc4d29a166\chromelevator.exe
  C:\Users\Admin\AppData\Local\Temp\quex-chromelevator-1bdc4d29a166\chromelevator.exe -o C:\Users\Admin\AppData\Local\Temp\quex-cl-edge-1792327234209_3636 edge
  2⤵
  - Executes dropped EXE
  PID:4500
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:1040
- C:\Users\Admin\AppData\Local\Temp\quex-chromelevator-1bdc4d29a166\chromelevator.exe
  C:\Users\Admin\AppData\Local\Temp\quex-chromelevator-1bdc4d29a166\chromelevator.exe -o C:\Users\Admin\AppData\Local\Temp\quex-cl-00000-1792327234861_3636 00000
  2⤵
  - Executes dropped EXE
  PID:5980
- C:\Users\Admin\AppData\Local\Temp\quex-chromelevator-1bdc4d29a166\chromelevator.exe
  C:\Users\Admin\AppData\Local\Temp\quex-chromelevator-1bdc4d29a166\chromelevator.exe --output-path C:\Users\Admin\AppData\Local\Temp\quex-cl-00000-1792327234861_3636 00000
  2⤵
  - Executes dropped EXE
  PID:4796
- C:\Users\Admin\AppData\Local\Temp\quex-chromelevator-1bdc4d29a166\chromelevator.exe
  C:\Users\Admin\AppData\Local\Temp\quex-chromelevator-1bdc4d29a166\chromelevator.exe 00000 -o C:\Users\Admin\AppData\Local\Temp\quex-cl-00000-1792327234861_3636
  2⤵
  - Executes dropped EXE
  PID:108
- C:\Users\Admin\AppData\Local\Temp\quex-chromelevator-1bdc4d29a166\chromelevator.exe
  C:\Users\Admin\AppData\Local\Temp\quex-chromelevator-1bdc4d29a166\chromelevator.exe 00000 --output-path C:\Users\Admin\AppData\Local\Temp\quex-cl-00000-1792327234861_3636
  2⤵
  - Executes dropped EXE
  PID:3540
- C:\Users\Admin\AppData\Local\Temp\quex-chromelevator-1bdc4d29a166\chromelevator.exe
  C:\Users\Admin\AppData\Local\Temp\quex-chromelevator-1bdc4d29a166\chromelevator.exe 00000
  2⤵
  - Executes dropped EXE
  PID:5132
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File C:\Users\Admin\AppData\Local\Temp\quex-sys-1792327235468_3636.ps1
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4164
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\scq1djmo\scq1djmo.cmdline"
    3⤵
    PID:4700
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File C:\Users\Admin\AppData\Local\Temp\quex-dpapi-1792327236231_3636.ps1
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5936
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File C:\Users\Admin\AppData\Local\Temp\quex-dpapi-1792327236934_3636_LocalMachine.ps1
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3684
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File C:\Users\Admin\AppData\Local\Temp\quex-dpapi-1792327237664_3636.ps1
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4236
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File C:\Users\Admin\AppData\Local\Temp\quex-sys-1792327238292_3636.ps1
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5948
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\atnggtni\atnggtni.cmdline"
    3⤵
    PID:1088
- C:\Users\Admin\AppData\Local\Temp\quex-native\chromelevator.exe
  C:\Users\Admin\AppData\Local\Temp\quex-native\chromelevator.exe 00000 --output-path C:\Users\Admin\AppData\Local\Temp\quex-abe-1792327238892_3636
  2⤵
  - Executes dropped EXE
  PID:2708
- C:\Users\Admin\AppData\Local\Temp\quex-native\chromelevator.exe
  C:\Users\Admin\AppData\Local\Temp\quex-native\chromelevator.exe 00000
  2⤵
  - Executes dropped EXE
  PID:4452
- C:\Windows\system32\where.exe
  where.exe msedge.exe
  2⤵
  PID:1928
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq msedge.exe" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:5092
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe /nologo /optimize+ /out:C:\Users\Admin\AppData\Local\Temp\quex_com_inject_v1.exe C:\Users\Admin\AppData\Local\Temp\quex-com-inj-1792327239416_3636.cs
  2⤵
  PID:4732
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /optimize+ /out:C:\Users\Admin\AppData\Local\Temp\quex_com_inject_v1.exe C:\Users\Admin\AppData\Local\Temp\quex-com-inj-1792327239416_3636.cs
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3748
- C:\Windows\system32\where.exe
  where.exe msedge.exe
  2⤵
  PID:5484
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq msedge.exe" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:5380
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe /nologo /optimize+ /out:C:\Users\Admin\AppData\Local\Temp\quex_proc_inject.exe C:\Users\Admin\AppData\Local\Temp\quex-procinj-1792327240068_3636.cs
  2⤵
  PID:940
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /optimize+ /out:C:\Users\Admin\AppData\Local\Temp\quex_proc_inject.exe C:\Users\Admin\AppData\Local\Temp\quex-procinj-1792327240068_3636.cs
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5152
- C:\Windows\system32\where.exe
  where.exe msedge.exe
  2⤵
  PID:1520
- C:\Windows\system32\where.exe
  where.exe msedge.exe
  2⤵
  PID:1776
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq msedge.exe" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:1204
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe /nologo /optimize+ /out:C:\Users\Admin\AppData\Local\Temp\quex_inject_helper.exe C:\Users\Admin\AppData\Local\Temp\quex-inject-1792327240643_3636.cs
  2⤵
  PID:4116
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /optimize+ /out:C:\Users\Admin\AppData\Local\Temp\quex_inject_helper.exe C:\Users\Admin\AppData\Local\Temp\quex-inject-1792327240643_3636.cs
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4968
- C:\Windows\system32\where.exe
  where.exe msedge.exe
  2⤵
  PID:5508
- C:\Program Files (x86)\Microsoft\Edge\Application\quex_elev_helper_v3.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\quex_elev_helper_v3.exe" 00000 C:\Users\Admin\AppData\Local\Temp\quex-elev-in-1792327240905_3636.bin C:\Users\Admin\AppData\Local\Temp\quex-elev-out-1792327240905_3636.bin 32
  2⤵
  - Executes dropped EXE
  PID:1620

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2780

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4e397a93-3ea2-453e-ac74-ec2af249a70f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\4e397a93-3ea2-453e-ac74-ec2af249a70f.tmp
Size 39KB
SHA256 0a9607ca7d68a0c6d6cd18b09a38addc43223fe4195503de4d1371fab2c1e737
MD5 8c124ffd8875bd37e69ecd2fdad3cb51
SHA1 abf387eb245f88b591513ce15e228be6b8cd53da
SHA512 e666656bc8a7d839729485fcf2d8b3b9d05a1d199b496a92ff58dd5b63a16af0389dc6882fd7d34745078c720f58712c5afffcf582437b17c8fde5071fdc0990
SSDEEP 768:A/UxvxjgC+H3UkAOoP7S+/9OA9at01j0iq00+IaXvISHxR8:tZj3+H3UdSzCHq00NafIST8
TLSH
T1FE03CF30ECA59D73ADF6B784730AA3879FF41567C1C669E08DE9290E05836AD1307C67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

64a80b12-e514-4827-9710-67f87c0afbc2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\64a80b12-e514-4827-9710-67f87c0afbc2.tmp
Size 37KB
SHA256 6790d0a424e272faee66496f301586910d4775f43b235230a4d4fa3e70123e5b
MD5 3dc6ce8ad6ef32639626edcd36bec4cb
SHA1 2385c07d5209269452fd978c2882fd41fe5b02d9
SHA512 0767d510b70cdb40d3b6330b8cd5959585da8b9c483a0648b47df1f6cab451a0aec6018634d076c80de8ff2acccbfdc0316aac46d84953d8d501928733bd28a0
SSDEEP 768:X/UxvxjgC+H3VlSOoO/9OA9at01j0iq00+Ia2SSHxRz:KZj3+H3VsCHq00NaRSTz
TLSH
T13603BF31ECA19D739CF7B384770A63979FF44563C6C96A9049ED2E0E01876AD13078A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 fc0a38b9bd67def6f8a6da7a4a5956bc201e5aac4ba6f906946e52f5b14e13c2
MD5 1f96c275206494cbaa7386b7e675b940
SHA1 e11ab12226c05e6b54c67a266c2f75cfeb24b04a
SHA512 a117c9e9ceb3447431daa46611f5c54ed75796456b4251af5e1ed3f62b5c6cbe9ebccf949569237178ca2ca7feba8c9acb69940a8457c36a9156ef8fd98eb09c
TLSH
T188D02B3671684D13E0805278007111613882F405DF0601C01322982609902483010180
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0d0352bb5f4b47f3d1ca8042212dfbae37957031d48d7789bd6cd7b4b6cbbe31
MD5 32b3e4b238ee2f76e0152ca1b1ff9944
SHA1 78d56bdababf57c069ac4ad713ad9cdc3e3f04a0
SHA512 3e7b72969f35c769b07f0760fb1a06022e37e68e88be1bff45e02463b5358a671e4f84f6bad11b043a01370573d062084b864866961ee86cb12eceb980874f69
TLSH
T178D02B3A71584E13E0805274007011613892F405EF0601C01322581609902483011184
MD5 SHA1 SHA512 TLSH

Submit Download

16c6b562-d79d-43d8-9d77-ea0ad9f81bed.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\16c6b562-d79d-43d8-9d77-ea0ad9f81bed.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

34e12111-bcd3-498d-9376-6aae5adae733.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\34e12111-bcd3-498d-9376-6aae5adae733.tmp
Size 27KB
SHA256 fbf627c67708f2a98cd047f76d13edec407899a0b18db28af076b6bf7fe10b7c
MD5 43754da1366c05660d786ff36fb9b5e7
SHA1 8a5f690ed5ab8864ca7c1043ddf55f0086f35215
SHA512 d6570a77cf715f68fb813c7ff38c8e58e02f4a7ebe55f75245dc3acee626dc9ae003869ce13da975c1aaf701c41ff79b537ce643c11dc1e2ef4542f610a3266c
SSDEEP 768:p/wWhO7pLuLbOnWg/Xf1p8F1+UoAYDCx9Tuqh0VfUC9xbog/OVtH3mmroF7jH:p/wWhOEbOnWg/Xf1pu1jaIXmdF7jH
TLSH
T1ECC2E93B740CCA7F4F904ADDDC197F9B6DA802CB5698CD8047FA985C02C67EA52164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6725402b-81fa-432f-849b-cc78bdcd72b7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\6725402b-81fa-432f-849b-cc78bdcd72b7.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 97b889c3d63804c63b497630b659684f54c77b901720b728ec194cdaa7ef836c
MD5 016551d3db8599aa84ff007fce76a8c1
SHA1 6d17a8d67371b00bbadc1a8f58044f6cf365aabb
SHA512 44f5fadd5e072efcb8854de72cd34889b6936e56f8e8f2011da2b7d6d76ce63cd9efea28aa890e61c22aba7c0e25349c73d24be91eab0a200a78f7f28f8c6a6d
SSDEEP 96:sa2RZciEDj5s/CscmbbDHP7zorWE5hW6hfu/7EOx+WVoMhm+uecpYQjEK+gf6Sdu:sxRKr5jsvzzoVg/g6+WNIYo5qukwIgEJ
TLSH
T15C228415AE68A93B8CCBD21DFB65BF53D2FD1032A1951B48EAFC861C04E66DD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b8a1b0df-aa89-451c-810c-7b418cc89f35.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\b8a1b0df-aa89-451c-810c-7b418cc89f35.tmp
Size 38KB
SHA256 bfc4ad5ff455031c04f98ff30950bc77418aafe4c9f7bf4892be71327db970fb
MD5 7e1bbde408462348386773fc0b33d4df
SHA1 d9f7297334fb3a2bd844baf262dc1b73dc0e3ffd
SHA512 7b56a810ecd03c1469611a4880fc1a347c9fd4d8a2ff630ff787aa15f58431f35c4764cdde0121562eb837249d2f6ac0c0aa086f91fa1fa5b3728b5e4aa40402
SSDEEP 768:c/UxvxjgC+H3UWyOoP7S+/9OA9at01j0iq00+IaXmISHxRz:JZj3+H3UFSzCHq00NaWISTz
TLSH
T15003CF30ECA19D73ADF6B784720AA3879FF41567C1C659E08DE9290E05837AD1307C67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 452eb598b2884fd99242cb5db005e3ac8e31bc9e3d58fe88ad0dd79ba08fbfd1
MD5 33f7a6fe6a1ea0bc7232e4b50743aaab
SHA1 f6389fac11178ade648f5f722858ade7790e8676
SHA512 64fed57e8e59a8d4c52029e5b9a9e95959a860dd2b01f96eda9e0484d0ae4572a4759db8892bacc9ddc3f3b2def74d2f9da00853aedc08b55520c731ed45658a
TLSH
T12C115733F3CC8724DC9A413650CEAC1136B687DB409ECE6BBB84D548B42F299DE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 0f9f30f84196faa1b02a6a4d017611be94e7c9db3dfb5de3fe07b41938d91518
MD5 fa9d8db08f1d0e201cafd9beeaf5d658
SHA1 ae220cf52d4f027d7820984002fbc7f5daed6a6e
SHA512 353d9219acee6b881c61f2aca1937daccfad0812efb3607069ed5eaf942f87358bf3842613f560414c6b557476fe72f68a8c0506b09aa257da1f36bda20bb433
TLSH
T11D218933F3CC8664DC8A413654CEAC1136B687D7409ECEABAB84D118F42F288DEA11A0
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 41392cd4496bf56527a5b254fd28d00f2caab79ff0f364f1e064b05369f864fd
MD5 a4176458b3bf09fafae40368a7c66d17
SHA1 7a3c018dd41576968f066ff8f7f54b0eeacc88f5
SHA512 577a4808abf9b6f5284c0228b43e84ca28848f7391dd1e38a319dd06454f43c05a6bcced97621aa624d1858654a0fe9625c800c79f72bd08b94f92d82d8fe3fc
TLSH
T1D1217B33F3CC8624DC4A407A50DEAC1136B6C7D7409ECE6BABC5D658F42F198DEA1060
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 b71e61efa29c854809a7198e5e69c0fd3238acae374f9e2201234fed9768d8ec
MD5 a25f9d28de2e35e232f2a81ba2990719
SHA1 ef410d71bf0f0784ace2c42cc04e625249cd1f11
SHA512 9a45da9305bafd9ff38aa1fde62f148c258154b9a1138bcdb4b456256856515f1aa8f6c96ae8d978d698061aff3753021ad81c442f5da3a097d172f7f28f67f1
TLSH
T16621AF33F3CC8654DC8A403A54DEAC1536B6C7D740DECEAB6B84D114F42F298DEA1160
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_xonhtv3b.kuc.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xonhtv3b.kuc.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

client.log

Path C:\Users\Admin\AppData\Local\Temp\config\client.log
Size 4KB
SHA256 76834f0ba14d50e1262f8456e7f769724cb8dbb70e2bf7591bc1d31c95ba25ed
MD5 aa5a5eac5c1bd2817c2d061043348e4b
SHA1 63c647263f5f1166069ea9ffa669a17c1c4f6db8
SHA512 68cd8dcd5d3ba97bb36c7169efa96ebe72557e4687b5eaa5592309767bb804b446fa179fbfccda26e6f6b93be8637955dafc0a3ada832d7cbba43e2b4af0c0f1
SSDEEP 96:oREzDl0nAAe/lAadrabAadraTCD62JqQeEDp0Lz5PoupB:e9VadraUadrajrEIjb
TLSH
T1C39121854FACCC6B508C71A6541CD3945DAFFC2A32421EB9B12CC33D5049A95AEEF945
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

node.napi.node

Path C:\Users\Admin\AppData\Local\Temp\pkg\da2172ce055fa47d6a0ea1c90654f530abed33f69a74d52fab06c4c7653b48fd\@primno\dpapi\prebuilds\win32-x64\node.napi.node
Size 137KB
SHA256 da2172ce055fa47d6a0ea1c90654f530abed33f69a74d52fab06c4c7653b48fd
MD5 04bfbfec8db966420fe4c7b85ebb506a
SHA1 939bb742a354a92e1dcd3661a62d69e48030a335
SHA512 4ea97a9a120ed5bee8638e0a69561c2159fc3769062d7102167b0e92b4f1a5c002a761bd104282425f6cee8d0e39dbe7e12ad4e4a38570c3f90f31b65072dd65
SSDEEP 3072:94PTD6FEzMju6bzJKjpEPeTOKvJhEnww+YbRYvPuq:94jQju6b9KilKvJurR8W
TLSH
T1B3D37D4BB3A500BBE176C639C8934A05E776B81517619B9F03A0475B1F237D1EE3EB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chromelevator.exe

Path C:\Users\Admin\AppData\Local\Temp\quex-chromelevator-1bdc4d29a166\chromelevator.exe
Size 1.4MB
SHA256 036e82f62f951d2bc5feb7ed7f7f7d45911500727027953fa090282d27e48f81
MD5 21a4aa7e8d93b48fcdb2252029abab24
SHA1 1bdc4d29a166bbcb52e9ff0f00eaeeb7944c4747
SHA512 bee0e8ba7ad906287cb1af7ed19c019704df13333853e373a1aac7b9fdf84662cd5b7b41c4f531e68a8535a5ecef24ca3f58f689caff5cd98bff362fb8a1acee
SSDEEP 24576:psDQfWex9NF3yWgT0rAhpkyJhkXxOMTLfdG8nAuuz5suusotl:p9zxR3fPr6TgXxOSzdGiHuz5msY
TLSH
T17D65021AFBA405FDE1B7D274CD524902D7B2F84A0760E78B03E459961F37AA09E3E712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

quex-dpapi-1792327236231_3636.ps1

Path C:\Users\Admin\AppData\Local\Temp\quex-dpapi-1792327236231_3636.ps1
Size 438B
SHA256 c5ddf8f250ad7530d91fad935c32429db5c96318d3220e9ae4f83ab1d76f855c
MD5 4db32ceb42d572e6c1228c6f085e1c56
SHA1 5715bd9f16ee293f95fff4299dba7ae382c2e732
SHA512 9dcce46c2700107aa32eb194ccfcb9ae2c685f02c017ad5a1d92ced210684345a340ce7dca9e82f83c69f0d87961c7a2d430907b7a14b7d2aa23b445c50f0556
TLSH
T161F02320039E5A4F0598545712F2C0DDB13684393C8F3A24FF38C20871B5CCCD68888E
MD5 SHA1 SHA512 TLSH

Submit Download

quex-dpapi-1792327236934_3636_LocalMachine.ps1

Path C:\Users\Admin\AppData\Local\Temp\quex-dpapi-1792327236934_3636_LocalMachine.ps1
Size 462B
SHA256 5927fbec79570dfe63a435e044153a19582284631ae8305170c20e19a0eeeaf7
MD5 22ab4f0bb4ae90d8cc111658fb61d1e3
SHA1 333db3d916eb2c878f742ec934e6dc57f23e2699
SHA512 6400c89f1d72fc32979e8fcba482122b3494f7b0a48f8f1551e3a5c0ae8adf619de38c1ff4d7cf2cedaa238add18b33d4efbeb8d829fc35231e48d8e77c9376c
TLSH
T107F0D41003AB57CA05A8A84617F6C1CD7036843D684F3728BB7EC21DB264C8CE594896
MD5 SHA1 SHA512 TLSH

Submit Download

quex-dpapi-1792327237664_3636.ps1

Path C:\Users\Admin\AppData\Local\Temp\quex-dpapi-1792327237664_3636.ps1
Size 438B
SHA256 cba704791160d668ac2b16c92ab5813b8b38836de7aecfdf3f0dceb72cca5e16
MD5 fe4a3ba5fd3bcfe37b006f087796bf8d
SHA1 26f6ad7f6d03be354bcc4e2c7dcc87e226b0e726
SHA512 1a332b556df0dbfb030501c9888a09a13703de348bb558eb8f16e7e8a6a17e963e396913ef25e7583748daa73d15c6652ee8100cdb2286552beddc169fd8282c
TLSH
T131F05C24538A5A4F0869545612F2D1DDB5368439398E2A24FF78C20972B4D8CD699889
MD5 SHA1 SHA512 TLSH

Submit Download

quex-dpapi-in-1792327236231_3636.bin

Path C:\Users\Admin\AppData\Local\Temp\quex-dpapi-in-1792327236231_3636.bin
Size 640B
SHA256 2a5b8cb900374ad69f8c703a29577cfd8adef20bb218c261d2b4b6063b59c710
MD5 6918537e705d35681490e3cabe9f7fa2
SHA1 e52f662ccb9680b7106f127001f2c06893e8b604
SHA512 a1b5e6e8956a31d1655900cc7e63f0f2de63bc5bce1801df357e50bcfbddd2bb49e12a58f18d588185a5065fa7d910e8bbbbd3a36750e8656ed8934d730f273a
TLSH
T12CF0BD3316356685F14BEEB46C5B744041B3BC43733311058405D11E49595D5843F3C5
MD5 SHA1 SHA512 TLSH

Submit Download

quex_elev_helper_v3.exe

Path C:\Users\Admin\AppData\Local\Temp\quex-native\quex_elev_helper_v3.exe
Size 8KB
SHA256 5e751b9e860226c3ca859564cf4b33bd03b2d9164f636d866dc5598be17f9354
MD5 d1303200c57666719e917a6cc1dac5f2
SHA1 0c782c8e9d72d31703e67c5ec2c7cca470e39a76
SHA512 bb8e3e5de6e30f372392af7fc04d851f8c57cfa0e9838f9056107028dcadcf06f9756ab479e91adf9499d738a54c4e9bc3141b2fa0ba59f2f5ca876b3234363c
SSDEEP 96:5F0pZGJBazq5Ks1ePzwM5tDpm1T0owmNWct+6avyLdaJ3XOEgYjWDxF6jEG9WsQE:kfIYRdGoowmsct7a6AnhyDElWstp
TLSH
T13BF1F629ABF81137C82A83B2CEF68B01B774D1145A29AFEF6094B1973E5935109C7F70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

quex-sys-1792327235468_3636.ps1

Path C:\Users\Admin\AppData\Local\Temp\quex-sys-1792327235468_3636.ps1
Size 3KB
SHA256 91acb0c5494dea6e2cda030382a6235b5d8029c6aea170eb2d15c4d95b530b27
MD5 9132c9ef08957e3bcf1e3e6efd585e28
SHA1 63e6a92d26a4fbf39e1d807c9e938cbdcacb4d97
SHA512 76e16f29e936f798ce7afeea66c258bfa4381bac63f4c8e7dbe8214c12380241886dd28b8acd81c93cac3e55cc47ecf7fdb25b27ef7915a7f0c3b4d480b6ffa7
TLSH
T1CE710F81A30663345962761D89CED09FFB22503603BF9D24BA7CC7B1AFC1535D1BA749
MD5 SHA1 SHA512 TLSH

Submit Download

quex-sys-1792327238292_3636.ps1

Path C:\Users\Admin\AppData\Local\Temp\quex-sys-1792327238292_3636.ps1
Size 3KB
SHA256 756eb2a3a080736ddea83456d3c092063d87203ad489ce56c1628766d70633bd
MD5 ac6f9d9f646d5f14d3cfbf0c00c3ea4a
SHA1 7cce0e097003ca0e3a1d7d4e39d6189405bdb151
SHA512 90abf0aeb5a1e86a6a63f8e60efd532e3f55770f581a54adc4ceab330c08e1000f61f268be34185347b8bdea7f005897776178a17b6c323c19ce6d17855d3e7c
TLSH
T1E2710F81A306A3345962761D89CED09FFB22503603BF9D24BA7CC7B1AFC1535D1BA709
MD5 SHA1 SHA512 TLSH

Submit Download

atnggtni.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\atnggtni\atnggtni.cmdline
Size 369B
SHA256 57aa6aadb9f6cd3c54b7593c088f76d987703df93b9c9bffe1337ebed00b6867
MD5 e9ebee634b4d728575e7c84d1fd7fb65
SHA1 43d03c86d0f4e7cafae2e3369179a926a0a800ea
SHA512 fb8813bd799490d44a229bdbdbe8019fd46159858b70cc4bb7f47e999064d8208ada064eb67f94d74a7d66b7dc0f5b0b65439f47c63c5a7659e45817369c466e
TLSH
T14AE0203F5297CB7D3AED10172269CDACC2720B472A417FC855924D5ED03700467D1755
MD5 SHA1 SHA512 TLSH

Submit Download

quex-com-inj-1792327239416_3636.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\quex-com-inj-1792327239416_3636.cs
Size 9KB
SHA256 a776f218d6bb983ec33304c610154c70c4f92e8dc0944e77b4676e6afaad98b6
MD5 b8878d7f9d2acd788b99aa7edcf6a551
SHA1 0a29a2986aa6a117104857cc534f8da3998eb1b5
SHA512 3646722f7243ac4aa3ebb4272234c37990428d483e96845089be49a6156eba4448e46e776ffcc55d767131fc3f5de45d67720fa730c8b230bb926c10510e3473
SSDEEP 192:/YbSGLh+TjYoiWYjYQHfK7GHEiyaiQ2/sCDickQURJm+NddlmM0tQnWsCQW7:/YbewrjjfK7GHEr/vsRNRQOnWR
TLSH
T10212C6182456D5261993312CEDEE985CF21390B317FEFCA0BDFC97628F0506D92B97A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

quex-inject-1792327240643_3636.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\quex-inject-1792327240643_3636.cs
Size 4KB
SHA256 590efe97eb6a73676abdf2d706eb21771363341a458526339021b19d6583a0e7
MD5 d97c8e2c0a175826933006028604555f
SHA1 5ccfd83b137dba8eff23f4eb21017f9660388c20
SHA512 3760e62cc5ecefc2a8e5a2fdc0229845627d92a7f2796089862912d9f4ca4c8e7d3ee863bc9c3dc46f833f4117a87ccc43cd26277ae26639f7fdb5aad414325e
SSDEEP 96:CjPNM7YbxNbnZnjowQUafv5bFdKOyXqaiQL+FmqX3+v:tYbRXQzZK/qaiQL+N3s
TLSH
T10F81A4183883956A4B07706DDEEC4415A613A4770BBEFC94BDEDB9B08F4E01E13B5398
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

quex-procinj-1792327240068_3636.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\quex-procinj-1792327240068_3636.cs
Size 8KB
SHA256 a1fcb06eb666901b86c263ef5e3a03e40cf0d2788c398f43750d077e0b4c7f99
MD5 e3bf00d7f56a2d6f2dc1c3f27318f3f9
SHA1 7ad45ac71e1ffc6e9240ff940c1c6468179a531a
SHA512 be953c91aec920b00327e03f5323876675988d4f73a45b7399d4b0515b414386c92e26d7f97e414de29c2f54cdc20a82ea100f90658826d0977431730cc3d2a2
SSDEEP 192:ZJYbSBWTjwdtWY1QzZKNUaiQ0XZOkDickQ4+Qlkjw/p2CQW7:ZJYb3yrsZKNiZLPAf/Z
TLSH
T14C02B7142587E6661A97302CADDE981DF213907307FFEC50BDED96B0AF0A02D93B9758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scq1djmo.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\scq1djmo\scq1djmo.0.cs
Size 3KB
SHA256 3bdb997485d4951b4ecdd5f31130a022e963deb3e4ff82addbc6464e15902540
MD5 42918e8a16961f0a2ab2313e725cbcb8
SHA1 6be27cbe442895e7fe7cb487771b91b8eb8ccf3e
SHA512 30c52861103957a109fa8e79d6a2d4811297f2c1bf0c2e756410305ef4c6368f364adbe8a39aba11540f6df63f439c52ed5a1b00eab2b0358c821ab91196fc0a
TLSH
T14C61F081A716633059A2761C89CED09FFB22502603BF9D68BA7CC7B1AFC1135D1BA709
MD5 SHA1 SHA512 TLSH

Submit Download

scq1djmo.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\scq1djmo\scq1djmo.cmdline
Size 369B
SHA256 b8ade49dabed7666431e8a9865855de8f79ddb667f38afbc56f92205e9006f3f
MD5 0324f81f357da8ead601522d67af7082
SHA1 c7f4900b3a72d12fba72b2e22a62fc94ef6e12e7
SHA512 078fbc84fbb7dc047c8bbca97e0efdd4b818605ae9bd0ae4b75f06514f0e8c6649f5caff5ac5cf945cf6db03cef2a53a0de8c2aaea6117f165473c2aa1e7e1da
TLSH
T190E0C02A5247CA7D13EE100731EBE4ACC27207436D513F84504044ADD01740A27D1FA9
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1620-218-0x0000000000230000-0x0000000000238000-memory.dmp

Download

memory/4164-152-0x0000026CF3220000-0x0000026CF3242000-memory.dmp

Download

memory/5936-167-0x0000011D2D7B0000-0x0000011D2D800000-memory.dmp

Download