hiddentear | fe330320459637d8dd2b5d84d07925c38ec264152ffd3b1760a4d44d76536caa

Resubmissions

20/07/2026, 20:13

260720-yzn2qsfx2x10

20/07/2026, 19:57

260720-ypf85sft8v10

20/07/2026, 19:49

260720-yjtx2sdw6m8

20/07/2026, 19:43

260720-yfk6qse16x9

Analysis

geolocation tags

eueuropefrfrance
user interaction
yes
max time kernel
520s
max time network
523s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 19:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
$PLUGINSDIR/StartMenu.dll
Size 7KB
Sample260720-ypf85sft8v
SHA256 fe330320459637d8dd2b5d84d07925c38ec264152ffd3b1760a4d44d76536caa
MD5 b9b71990b37e04a56cadbcbfa694f30f
SHA1 3b7627deb793446d6b12b7b94266cc592982a5c2
SHA512 b4aa947aba471ce0ba37ab859391f6a157887c882c920a3081d482f63a83317ae75b428ebae226f835798517abb676114ee42bf13bd4c4291cebbb5e9658f2e5
SSDEEP 96:VIt3J2Gl0eVe0+Cfo0UkXt6+o69UiGdPh5/utta/x3lkCTcaqHCI:ShE+A0+sF6piUFkA1lncviI
TLSH
T1FFF1C776F3D20673F9AB427428632F231B2AF521576581A7890316CE7A61DE3FD34B11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

bootkit defense_evasion discovery hiddentear persistence ransomware

Malware Config

Signatures

Family: HiddenTear, Cryptear
HiddenTear aka Cryptear is an open-source ransomware available on Github since 2015, with many versions in the wild.
ransomware hiddentear

Detects HiddenTear Ransomware 2 IoCs

resource	yara_rule
behavioral3/files/0x000d00000001c5d9-528.dat	family_hiddentear
behavioral3/memory/4808-547-0x0000000000810000-0x000000000087E000-memory.dmp	family_hiddentear

Disables Task Manager via registry modification
defense_evasion

Downloads MZ/PE file 2 IoCs

flow	pid	Process
116	3116	msedge.exe
116	3116	msedge.exe

Executes dropped EXE 2 IoCs

pid	Process
4808	$uckyLocker.exe
5824	Petya.A.exe

Contacts third-party web service commonly abused for C2 1 TTPs 6 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
111	raw.githubusercontent.com
112	raw.githubusercontent.com
113	raw.githubusercontent.com
114	raw.githubusercontent.com
115	raw.githubusercontent.com
116	raw.githubusercontent.com

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	Petya.A.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\LogFiles\WMI\FaceTelManually.etl	svchost.exe
File opened for modification	C:\WINDOWS\SYSTEM32\WINBIODATABASE\51F39552-1075-4199-B513-0C10EA185DB0.DAT	svchost.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Control Panel\Desktop\Wallpaper = "0"	$uckyLocker.exe

Drops file in Windows directory 23 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping548_681403784\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping548_1571875613\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping548_1571875613\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping548_1571875613\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping548_2022025791\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping548_2022025791\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping548_1224060364\classification.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping548_1224060364\travel-facilitated-booking-bing.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping548_898129664\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping548_1571875613\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping548_1224060364\automation.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping548_1224060364\extraction.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping548_2071720105\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping548_898129664\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping548_2022025791\sets.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping548_2022025791\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping548_2071720105\keys.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping548_1084844402\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping548_681403784\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping548_1224060364\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping548_1224060364\travel-facilitated-booking-kayak.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping548_2071720105\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping548_2071720105\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5252	4916	WerFault.exe	89

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	$uckyLocker.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3116	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134290513007503728"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-189034102-168398478-1159367937-1000\{EB9C822D-21A6-45B3-B1EB-16E4D01371C6}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1076	msedge.exe
1076	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	716	svchost.exe
Token: SeShutdownPrivilege	5824	Petya.A.exe

Suspicious use of FindShellTrayWindow 17 IoCs

pid	Process
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
808	SecHealthUI.exe
2352	SecHealthUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4120 wrote to memory of 4916	4120	rundll32.exe	89
PID 548 wrote to memory of 1792	548	msedge.exe	96
PID 548 wrote to memory of 3116	548	msedge.exe	97
PID 548 wrote to memory of 3952	548	msedge.exe	98
PID 548 wrote to memory of 3952	548	msedge.exe	98
PID 548 wrote to memory of 3952	548	msedge.exe	98
PID 548 wrote to memory of 5668	548	msedge.exe	99
PID 548 wrote to memory of 5668	548	msedge.exe	99
PID 548 wrote to memory of 2124	548	msedge.exe	101
PID 548 wrote to memory of 3012	548	msedge.exe	102
PID 548 wrote to memory of 2124	548	msedge.exe	101
PID 548 wrote to memory of 2124	548	msedge.exe	101
PID 548 wrote to memory of 3012	548	msedge.exe	102
PID 548 wrote to memory of 3012	548	msedge.exe	102
PID 548 wrote to memory of 3092	548	msedge.exe	103
PID 548 wrote to memory of 4124	548	msedge.exe	104
PID 548 wrote to memory of 3092	548	msedge.exe	103
PID 548 wrote to memory of 3092	548	msedge.exe	103
PID 548 wrote to memory of 4124	548	msedge.exe	104
PID 548 wrote to memory of 4124	548	msedge.exe	104
PID 548 wrote to memory of 5848	548	msedge.exe	107
PID 548 wrote to memory of 5848	548	msedge.exe	107
PID 548 wrote to memory of 5848	548	msedge.exe	107
PID 548 wrote to memory of 5068	548	msedge.exe	108
PID 548 wrote to memory of 5068	548	msedge.exe	108
PID 548 wrote to memory of 3948	548	msedge.exe	109
PID 548 wrote to memory of 3948	548	msedge.exe	109
PID 548 wrote to memory of 5300	548	msedge.exe	110
PID 548 wrote to memory of 5300	548	msedge.exe	110
PID 548 wrote to memory of 5376	548	msedge.exe	112
PID 548 wrote to memory of 1680	548	msedge.exe	113
PID 548 wrote to memory of 1680	548	msedge.exe	113
PID 548 wrote to memory of 1140	548	msedge.exe	114
PID 548 wrote to memory of 1140	548	msedge.exe	114
PID 548 wrote to memory of 6080	548	msedge.exe	118
PID 548 wrote to memory of 6080	548	msedge.exe	118
PID 548 wrote to memory of 3636	548	msedge.exe	119
PID 548 wrote to memory of 3636	548	msedge.exe	119
PID 548 wrote to memory of 3636	548	msedge.exe	119
PID 548 wrote to memory of 1284	548	msedge.exe	121
PID 548 wrote to memory of 1284	548	msedge.exe	121
PID 548 wrote to memory of 1284	548	msedge.exe	121
PID 548 wrote to memory of 5724	548	msedge.exe	122
PID 548 wrote to memory of 5724	548	msedge.exe	122
PID 548 wrote to memory of 5724	548	msedge.exe	122
PID 548 wrote to memory of 1600	548	msedge.exe	123
PID 548 wrote to memory of 1600	548	msedge.exe	123
PID 548 wrote to memory of 1600	548	msedge.exe	123
PID 548 wrote to memory of 1060	548	msedge.exe	124
PID 548 wrote to memory of 1060	548	msedge.exe	124
PID 548 wrote to memory of 5244	548	msedge.exe	125
PID 548 wrote to memory of 5244	548	msedge.exe	125
PID 548 wrote to memory of 5244	548	msedge.exe	125
PID 548 wrote to memory of 3676	548	msedge.exe	126
PID 548 wrote to memory of 2920	548	msedge.exe	127
PID 548 wrote to memory of 2920	548	msedge.exe	127
PID 548 wrote to memory of 3176	548	msedge.exe	128
PID 548 wrote to memory of 4296	548	msedge.exe	129
PID 548 wrote to memory of 2672	548	msedge.exe	130
PID 548 wrote to memory of 4808	548	msedge.exe	131
PID 548 wrote to memory of 2320	548	msedge.exe	133
PID 548 wrote to memory of 2320	548	msedge.exe	133
PID 548 wrote to memory of 5440	548	msedge.exe	138
PID 548 wrote to memory of 5440	548	msedge.exe	138

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\StartMenu.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4120
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\StartMenu.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4916
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4916 -s 560
    3⤵
    - Program crash
    PID:5252

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4916 -ip 4916
1⤵
PID:1376

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\UnblockWait.mht
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffc82b2c188,0x7ffc82b2c194,0x7ffc82b2c1a0
  2⤵
  PID:1792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2184,i,17141090950710197351,12009370432999766258,524288 --field-trial-handle=2344,i,9533666874669399345,4673886771136324983,262144 --variations-seed-version --mojo-platform-channel-handle=2380 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:3116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1860,i,14040463164606472662,5907377969588708988,262144 --field-trial-handle=2344,i,9533666874669399345,4673886771136324983,262144 --variations-seed-version --mojo-platform-channel-handle=2340 /prefetch:2
  2⤵
  PID:3952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2752,i,14096187945718106623,17512440731236876272,524288 --field-trial-handle=2344,i,9533666874669399345,4673886771136324983,262144 --variations-seed-version --mojo-platform-channel-handle=2896 /prefetch:13
  2⤵
  PID:5668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3604,i,6134222296447605902,5164859206875034443,2097152 --field-trial-handle=2344,i,9533666874669399345,4673886771136324983,262144 --variations-seed-version --mojo-platform-channel-handle=3824 /prefetch:1
  2⤵
  PID:2124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3608,i,7618149595037942288,9902411097962739962,2097152 --field-trial-handle=2344,i,9533666874669399345,4673886771136324983,262144 --variations-seed-version --mojo-platform-channel-handle=3828 /prefetch:1
  2⤵
  PID:3012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4328,i,4153523582591681314,8378825422120275457,2097152 --field-trial-handle=2344,i,9533666874669399345,4673886771136324983,262144 --variations-seed-version --mojo-platform-channel-handle=4444 /prefetch:1
  2⤵
  PID:3092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4336,i,1240851931990238416,1236895990944509430,2097152 --field-trial-handle=2344,i,9533666874669399345,4673886771136324983,262144 --variations-seed-version --mojo-platform-channel-handle=4448 /prefetch:9
  2⤵
  PID:4124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5340,i,9015883169893499509,14400956558957053165,2097152 --field-trial-handle=2344,i,9533666874669399345,4673886771136324983,262144 --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:1
  2⤵
  PID:5848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5060,i,11452048276651628476,4568386246267823389,524288 --field-trial-handle=2344,i,9533666874669399345,4673886771136324983,262144 --variations-seed-version --mojo-platform-channel-handle=3832 /prefetch:14
  2⤵
  PID:5068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3984,i,1397353134818706680,4691788553717155706,524288 --field-trial-handle=2344,i,9533666874669399345,4673886771136324983,262144 --variations-seed-version --mojo-platform-channel-handle=5496 /prefetch:14
  2⤵
  PID:3948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3568,i,15583199268275159654,13708386889354272126,524288 --field-trial-handle=2344,i,9533666874669399345,4673886771136324983,262144 --variations-seed-version --mojo-platform-channel-handle=5580 /prefetch:14
  2⤵
  PID:5300
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6092,i,9667464060184605844,3207339569221916687,524288 --field-trial-handle=2344,i,9533666874669399345,4673886771136324983,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:14
  2⤵
  PID:3424
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6092,i,9667464060184605844,3207339569221916687,524288 --field-trial-handle=2344,i,9533666874669399345,4673886771136324983,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:14
  2⤵
  PID:5376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6316,i,1113573665249651380,10992458505400436766,524288 --field-trial-handle=2344,i,9533666874669399345,4673886771136324983,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:14
  2⤵
  PID:1680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6628,i,14330780330523935544,13490483990666045101,524288 --field-trial-handle=2344,i,9533666874669399345,4673886771136324983,262144 --variations-seed-version --mojo-platform-channel-handle=6372 /prefetch:14
  2⤵
  PID:1140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6836,i,9259550123912376489,11519965328126766121,524288 --field-trial-handle=2344,i,9533666874669399345,4673886771136324983,262144 --variations-seed-version --mojo-platform-channel-handle=6788 /prefetch:14
  2⤵
  PID:6080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6116,i,16664033613831070412,2137765489162811078,2097152 --field-trial-handle=2344,i,9533666874669399345,4673886771136324983,262144 --variations-seed-version --mojo-platform-channel-handle=6396 /prefetch:1
  2⤵
  PID:3636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6960,i,12889624243762610590,5678050564819431247,2097152 --field-trial-handle=2344,i,9533666874669399345,4673886771136324983,262144 --variations-seed-version --mojo-platform-channel-handle=6732 /prefetch:1
  2⤵
  PID:1284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=5136,i,7498453474385138558,16149744697166150193,2097152 --field-trial-handle=2344,i,9533666874669399345,4673886771136324983,262144 --variations-seed-version --mojo-platform-channel-handle=4736 /prefetch:1
  2⤵
  PID:5724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=4788,i,4263179358735729154,17838655738907494799,2097152 --field-trial-handle=2344,i,9533666874669399345,4673886771136324983,262144 --variations-seed-version --mojo-platform-channel-handle=3820 /prefetch:1
  2⤵
  PID:1600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7252,i,13100652221818187065,15109474288176732440,524288 --field-trial-handle=2344,i,9533666874669399345,4673886771136324983,262144 --variations-seed-version --mojo-platform-channel-handle=7136 /prefetch:14
  2⤵
  PID:1060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=7256,i,15207069059127150479,12648868555675322794,2097152 --field-trial-handle=2344,i,9533666874669399345,4673886771136324983,262144 --variations-seed-version --mojo-platform-channel-handle=7248 /prefetch:1
  2⤵
  PID:5244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7536,i,10312514696611525688,10748201169442481969,524288 --field-trial-handle=2344,i,9533666874669399345,4673886771136324983,262144 --variations-seed-version --mojo-platform-channel-handle=4760 /prefetch:14
  2⤵
  PID:3676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7756,i,4956907281869118722,2372967339450100072,524288 --field-trial-handle=2344,i,9533666874669399345,4673886771136324983,262144 --variations-seed-version --mojo-platform-channel-handle=7752 /prefetch:14
  2⤵
  PID:2920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1276,i,5883951149633385691,13712654449853359436,524288 --field-trial-handle=2344,i,9533666874669399345,4673886771136324983,262144 --variations-seed-version --mojo-platform-channel-handle=1284 /prefetch:14
  2⤵
  PID:3176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1372,i,3202551988073777182,1697666192858382032,524288 --field-trial-handle=2344,i,9533666874669399345,4673886771136324983,262144 --variations-seed-version --mojo-platform-channel-handle=1236 /prefetch:14
  2⤵
  PID:4296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7752,i,1283217128883190425,5521332854479698777,524288 --field-trial-handle=2344,i,9533666874669399345,4673886771136324983,262144 --variations-seed-version --mojo-platform-channel-handle=7868 /prefetch:14
  2⤵
  PID:2672
- C:\Users\Admin\Downloads\$uckyLocker.exe
  "C:\Users\Admin\Downloads\$uckyLocker.exe"
  2⤵
  - Executes dropped EXE
  - Sets desktop wallpaper using registry
  - System Location Discovery: System Language Discovery
  PID:4808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5660,i,13947978309909986702,6437486386797244409,524288 --field-trial-handle=2344,i,9533666874669399345,4673886771136324983,262144 --variations-seed-version --mojo-platform-channel-handle=7344 /prefetch:14
  2⤵
  PID:2320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7436,i,1390750435891833178,11445023215568233398,524288 --field-trial-handle=2344,i,9533666874669399345,4673886771136324983,262144 --variations-seed-version --mojo-platform-channel-handle=1480 /prefetch:14
  2⤵
  PID:5440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4864,i,8795595353282445760,2437972285136371736,524288 --field-trial-handle=2344,i,9533666874669399345,4673886771136324983,262144 --variations-seed-version --mojo-platform-channel-handle=920 /prefetch:14
  2⤵
  PID:3020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5716,i,11635768265810698200,6116831864786291716,262144 --field-trial-handle=2344,i,9533666874669399345,4673886771136324983,262144 --variations-seed-version --mojo-platform-channel-handle=7908 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6624,i,11460849031247674827,8412983463818817551,524288 --field-trial-handle=2344,i,9533666874669399345,4673886771136324983,262144 --variations-seed-version --mojo-platform-channel-handle=3848 /prefetch:14
  2⤵
  PID:3400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6040,i,12034504576776043230,12680941804577678959,524288 --field-trial-handle=2344,i,9533666874669399345,4673886771136324983,262144 --variations-seed-version --mojo-platform-channel-handle=6052 /prefetch:14
  2⤵
  PID:2696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6356,i,15538005002217043508,16475885446178314905,524288 --field-trial-handle=2344,i,9533666874669399345,4673886771136324983,262144 --variations-seed-version --mojo-platform-channel-handle=920 /prefetch:14
  2⤵
  PID:4396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6064,i,4815663290039762378,8015814377001671328,524288 --field-trial-handle=2344,i,9533666874669399345,4673886771136324983,262144 --variations-seed-version --mojo-platform-channel-handle=3944 /prefetch:14
  2⤵
  PID:2924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5752,i,2115989262345505437,13643507262614768394,524288 --field-trial-handle=2344,i,9533666874669399345,4673886771136324983,262144 --variations-seed-version --mojo-platform-channel-handle=5832 /prefetch:14
  2⤵
  PID:4468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4864,i,11945971435520965056,11096639810440404644,524288 --field-trial-handle=2344,i,9533666874669399345,4673886771136324983,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:14
  2⤵
  PID:4276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1420,i,8607850531121031361,12297527218983672580,524288 --field-trial-handle=2344,i,9533666874669399345,4673886771136324983,262144 --variations-seed-version --mojo-platform-channel-handle=7780 /prefetch:14
  2⤵
  PID:5012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --metrics-shmem-handle=7988,i,10430120599120014173,3592988747838340220,2097152 --field-trial-handle=2344,i,9533666874669399345,4673886771136324983,262144 --variations-seed-version --mojo-platform-channel-handle=7196 /prefetch:1
  2⤵
  PID:5296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4688,i,2958334258335521560,9285879663988434800,524288 --field-trial-handle=2344,i,9533666874669399345,4673886771136324983,262144 --variations-seed-version --mojo-platform-channel-handle=8000 /prefetch:14
  2⤵
  PID:4452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6048,i,14009296675644584244,5756036883275488929,524288 --field-trial-handle=2344,i,9533666874669399345,4673886771136324983,262144 --variations-seed-version --mojo-platform-channel-handle=5512 /prefetch:14
  2⤵
  PID:4592
- C:\Users\Admin\Downloads\Petya.A.exe
  "C:\Users\Admin\Downloads\Petya.A.exe"
  2⤵
  - Executes dropped EXE
  - Writes to the Master Boot Record (MBR)
  - Suspicious use of AdjustPrivilegeToken
  PID:5824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6064,i,311940310144500862,14582865406703399349,524288 --field-trial-handle=2344,i,9533666874669399345,4673886771136324983,262144 --variations-seed-version --mojo-platform-channel-handle=7776 /prefetch:14
  2⤵
  PID:2892

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1500

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4260

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1056

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /7
1⤵
PID:868

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:1600

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
PID:3708
- C:\Windows\system32\Netplwiz.exe
  netplwiz
  2⤵
  PID:2752

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /7
1⤵
PID:1624

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /7
1⤵
PID:3092

C:\Program Files\WindowsApps\Microsoft.SecHealthUI_1000.26100.1.0_x64__8wekyb3d8bbwe\SecHealthUI.exe
"C:\Program Files\WindowsApps\Microsoft.SecHealthUI_1000.26100.1.0_x64__8wekyb3d8bbwe\SecHealthUI.exe" -ServerName:SecHealthUI.AppX8tam42xc7v2czs3s1nt0nkxvfjtepzp9.mca
1⤵
- Suspicious use of SetWindowsHookEx
PID:808

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {E041C90B-68BA-42C9-991E-477B73A75C90} -Embedding
1⤵
PID:1268

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k WbioSvcGroup -s WbioSrvc
1⤵
- Drops file in System32 directory
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:716

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1588

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:2040

C:\Program Files\WindowsApps\Microsoft.SecHealthUI_1000.26100.1.0_x64__8wekyb3d8bbwe\SecHealthUI.exe
"C:\Program Files\WindowsApps\Microsoft.SecHealthUI_1000.26100.1.0_x64__8wekyb3d8bbwe\SecHealthUI.exe" -ServerName:SecHealthUI.AppX8tam42xc7v2czs3s1nt0nkxvfjtepzp9.mca
1⤵
- Suspicious use of SetWindowsHookEx
PID:2352

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {E041C90B-68BA-42C9-991E-477B73A75C90} -Embedding
1⤵
PID:5928

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7add6572365d752d8c3a090b9a256c43e3c5ff716f29ed7aa3c53dc57a08ba60
MD5 0da70f521ac5aee3489abf6e3eb4e375
SHA1 0f3cd9919820116ecc86bab93f4712c08485dc56
SHA512 a9cddd04863b2ac842fe4f91265c19a41d8b7442be8f07a91747705beca52c1e1d563e3c46cf68e1b73606695624f13ca69a8246653c2535d0684ced42c37d33
TLSH
T182D09BD479045D78C4C1353231A673155A616435DA5C46481051F3AACD65141667F5AD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ffe13798c5910685872d371e84c30baa9eefaaa5db1419603eb30d473d7b2e37
MD5 03c111f9396889c77f6d9883c5df333f
SHA1 be65300843096dba92c5695fd35e2dffcbb7eb0a
SHA512 a77dfe3b48fcb72648f1adfafbf0d0fcd4d88690dcf41609a03e1d6b645d1336b6e322931b2205673283b920d20ed0225c6aa320a83a2d3a410771f18d120c19
TLSH
T1B1D09BD079145D78C4C1353231A773155A516435865C46481151F3BACD65141667E59D
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 490dc75207149cf9496762fcee3e40935b18352c4d057131ffd51f19a8d1ed73
MD5 2dd2ab1b0799d1c008e607740650437b
SHA1 f54c115123dfd85f816f4ed70c13bd95ffe34993
SHA512 edd585679343692dbf69d4c0f47364843b7ee5d291b4c362f2098b10aa9d0664aaec9c31e3d48e8c14bdaae0c4cfa795e9cdd33f6ba7d79f6c4e63a0668f2e31
TLSH
T1B2E026A446CAC37FE704764BC26CB78C8681BA4E92C879AA370884A47001044F3A27B0
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 6KB
SHA256 005ec707635c35dccbafe32fa353ee63a8a9c89218f5e33e40e7001d79c78e32
MD5 2ec3ae5654a14a80e61cf9754c8ccd7c
SHA1 7472e87ed1909902af27fdb36e69eda24ff2cedb
SHA512 0b18a96b461ac83abd5056ec61ff6b5c1c51cd035ad1a66efab36e050deaafdc5c9940401946959a605164f6cc3999808a254fa9bc8fda4c49b405aa83f1c238
SSDEEP 96:wivQAbR24AqCX4V1k9wot22W2HQfLhG4vdKs6DU/1kIAuuKU7YMPuDhKF6bGyeD6:e2n3CJfHQUoUEw6N
TLSH
T1B4E193899A665593DB14793024E7E8463EF181F80A371F63E228BCB858C7FA440F902F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_github.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 75fdbe4f1847953dfbaff10c4f575129ac2ed236b2d9e03bf85dfbc0167017e6
MD5 8127bfa58ed5b8079dece3cd4e3960e6
SHA1 789094a305cdbcb25269bdee50626b6b0c1a1642
SHA512 4ff35a17cd12da43b96cc626182819e120bce52ff7fd53dd4fbe27a1e96251c4c96333c875a9e8f2458cdef1a829e7f302aad9224c0893da3476bd8ead3e3fbe
SSDEEP 96:D5OgB3GmxMzaSjh2zyn2EevdGmrmnBmZmDmtZgBwBmO+mH:D8gB3GmxMzaSjh2mn2XvdGmrmBmZmDmd
TLSH
T165A1AEF787E5862DDA1155F0AA18BE1BCE2D0954831C3C6AC4E4BE1BD3F3471E141A6E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 ff9ff2ac71812f314134c5e579b7167a0133532632438fd706863bcde4b64096
MD5 0b6c830b1b66e6000c982de52520c01e
SHA1 fafdde187d4122d1c76954053ec12a2ef6e32202
SHA512 bac18aa7c657e32fef828a49156b4f5ec68cf3bf881b47f9aaf76ae743348a400ac3e0298c14476dddf98ea22ffed33c9ba7e67b5bc1d6bfda98c0601deb5036
TLSH
T11CD02223232270B9AA7C3F91606ABCCFC33710280883EDDA50D0B89D06BB86E1917260
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 34646ed2baea50af10696d727898de9e06d7f46bb890edae33cb170047ff0ac1
MD5 cb0999ee1f2698022e6735bee4870310
SHA1 2b241b342f0ab1b237756e8f65dadc614b209047
SHA512 808ce5cbe990ff139c55c4d78a29b182d89d7ce1db5804b4ebf0fb7607d713edadda3c524aa3702ec4acb33cb9d1accaa3bc7fd5d35609d913b56a0f158889b8
SSDEEP 192:sxRnRVC7/fUsehFsZRCVZzoA8p4c/g6+WNIYlBi7GDIgtJ:sxRn27/fUsehFSRCVkF/5ITY3
TLSH
T1B832B6166E28AD3B8CCBE21DBA557F53D2F95133A1D41E48B6FC8A0C04E76DE520781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 9dfbd4202faaf95b511746b4aaca06345c8c37779efc95ce6456be6b93ac5f7d
MD5 85b8bc9038bc01c83c70a8ea9078b85c
SHA1 19a908d2b8542fdec1a78ad12ec8f427fdbcbd91
SHA512 7953d217345a331347b15cce942fd345fcc76aaf70e51063ece483f0f0d5bc70e050a1bc2d4dc0f5e84eedcf2a6fcef7f6fc8e6f59ad801a09b06c391ca19892
SSDEEP 384:sxRcOm17/fUs4hFSRCWKO/5022/sUYsyAAlzF:s4Om17/fqFEfD/5GnAlzF
TLSH
T1DA62B6576924DD778CC6D219BE75BF12D3FA1033E9911E4CAAFCCA0C009A6ED620781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 a3d2ce90aeca052f5809738b55c8f24e872c9eaf7f95a0b1257bc47e90f0e78c
MD5 58fe064198929e943d7a15b387825cdb
SHA1 ebd1969c0740470b3c1dfc8dea931381249b3b27
SHA512 a00aa1944f3aecd57b8ffe10a8257b03e0d4f63c60ec861cba76c1eed7236db864f435a26724e91a838a6a00490798418e97cdac8deaf0226640b55f1bb4ed1a
SSDEEP 384:sxRcOm47/fUs4hNSRCWKO/5Bl22/gYdyAAlzF:s4Om47/fqNEfD/5xgdlzF
TLSH
T12072B55769249D778CC6D119BE757F12E3FA1023D9911E4CAAFCCA1C00AB6ED630781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 291cf8254b71c88dc7e1bc022beba432acb72f28cddcecbfa6a843fd3d40ad1c
MD5 30109c64c044839af0ba3f092bc1ea81
SHA1 4a78fddb9d1f16db249ec108d83ff15a082a1e3b
SHA512 0b1298b5f46802baa9dd9edd68d9d3606108840f0cdd78a9b9817ac706a1abe1e746f6b2f3498d8086b492018684b77d450190f325f9c886904b4861ff2256d8
SSDEEP 384:sxRc8m47/fUs4hNSRCWKO/5Bl22/gYdyAAlzF:s48m47/fqNEfD/5xgdlzF
TLSH
T16172B557A9249D778DC6D119BE757F12E3FA1023D8911E8CAAFCCA1C00AB6ED630741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 d1dba0586dad2ab7ce90f92db54fd3fb3b15fa49a00ea4906a4a772349e455d1
MD5 53adc6f0440f82400d34dbe3fbee9822
SHA1 6a495772faf61aad0a93f69b4a0fae4780081525
SHA512 bc4777da3599f8c2dc27d55269655cb453a0ac9c013ad93538ccf39ab14bb52a6e6ad3c01ffc3e8984e4404e76e756bad50ed3c9ada5a6fffa759a5de160f160
SSDEEP 768:dofA3j7pLuL7AxWgg+fJJ8F1+UoAYDCx9Tuqh0VfUC9xbog/OVIrN131LropE:dofA3VE7AxWgg+fJJu1jaXrNl14pE
TLSH
T1D2D2DA7B640CCA7E4FC04ADDEC19BA9F6DA802CB9698C94047FD951C02C6BEB51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 cd2ee136b163e5040035a03193af72013acd71be99ce452c69b6661b75439144
MD5 7c4fbe9eac89159aeace3080a6b55a13
SHA1 063f07abef9ffa8531a26111f192e85935f4a978
SHA512 6f40814f138936c7818dbf8b88b8150261d30e87d98921e564dd3137a3c5ebd02b0323f8e18dd3ded81e23aa897775a207b5f53ce9cf659d4d66a3782f1c3896
SSDEEP 96:KRdqjXNn7vWj4mgfvK4+gBvcldQzLkHGbqGAoouWYN1gmuK4bgUucumFEPyEKXKq:CdqjXNn7Oj4XfV+gBkldQzLkHGbqGAo6
TLSH
T170918740327B42813C3E694C85F89C5FE2C274A6741AA56B7BB801A15F67E43ADFCCD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5dd99a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5dd99a.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 d9115f9e291dbda768516011c91d4cb82aab216c5921bc178abc3f757ec157fb
MD5 7496ef7dd6d5416999da423bda9cbc60
SHA1 cfd93a4d2b2e40687f39675e57b8a21b9f13a3d1
SHA512 d7865b086c3faaf1494f03718dfdf6552593ffebbe60fb43f5a77ab693372d8d9514ba0890b27023f2e095eda98c822e28749daa421d95e904a9a1eb39aca942
SSDEEP 768:vj+9B3ZuHNL8NiJbhLNHXmTWTbc+HGIjao4u7:C9B3GNqaeWn1mIjZ4w
TLSH
T126F2BE71ACA69E679DEA8BC8750B7A466EF5026380C82D88CDDD7F4D018765D031BC3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 44KB
SHA256 ab4862abc530ac759561fbf0d63634aed305713ff199689f8eaa3f6c94100349
MD5 42adc2eaf45d8f1b8683492b42d1c404
SHA1 3ecaa885ef0a3aebc2c1afb96cfe6f81676bde93
SHA512 54df356ffbd81f2e3950be01dffe5d47e6b7db28d5d85219788960edf34db2ae231dd7f02fcdc9f668d58c6d9919fee0c7de9801c676784eedb43008ffbf8109
SSDEEP 768:RFKj+9g3GwgBuxuekIyh8rcbh9NHXmTWTbc+HGIjao4u7:Z9g3J6XeWn1mIjZ4w
TLSH
T11D1318F598D78A77D9EE4B87673E6E459ABDC153B0881884BBC81D4CCC8617FC306826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 1c66be3d60395f0fec18e52c6befbeab1dc0bc1591ca274d67d557bd4282aac8
MD5 7616d79a39eebf7fb90fe8f071fe55e1
SHA1 4f8fbd0ea8d964fddf7a1d368ab291238b45b9d1
SHA512 0919a89224dfa67c1dbef7eab3351c430620405ff86df2cf51de8b533e274cde25858bf289fc509c419ac89e39672b48798952958dc662b68ad139a4593832b1
SSDEEP 768:RFLj+9g3KwgguHuekIyL8IcbhxNHXmTWTbc+HGIjao4u7:O9g3I6oeWn1mIjZ4w
TLSH
T1311328F598D78A37D9EE4B87673D6E455ABDC163B0881884BBC82E4CCC8617FC306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 4cbfea747ba5337603f0cbb0128de6d23f41d1fc7296f595a50ea74d04b0cd43
MD5 27b3a34cf234b526960afbd9d7c33744
SHA1 129a425848c05ea2b3c6837b8a9b7dd5d3e44142
SHA512 e214933bcb7585e200d4f6bf35dd31ae2a1472251fb433eb545fed379d739bda498c579b7673513f8f678c62b0b141743702c49f90d8258be936473f9bad7e58
SSDEEP 768:arv+4UNbdM358d7EiJbh3NHXmTWTbc+/eeVH1SvyZ:absb+32dYIeWn12EH1dZ
TLSH
T1DD03BF319CA98F37ADF65788718BBA573EB9016389C40A84C9C96B4E428748D170BD3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 67c2b7f9d6e6c2f04c11e0a2813428e770d2cad642eb71b9e0c52c92ad4f6eae
MD5 3bf35f45be2710389009fd5f7cff99cb
SHA1 ffa2a5036b705aa853f76bc972513e8a58df1d88
SHA512 6d43012132cfb9b6f7789611b436c526929a5d0393f5434d67db36fe6a7a67e8694000eab05606ff8924368e9ff40af36086f8e7a6aa0633ec9cefcf28cb2ba6
SSDEEP 768:+j+933ZusNL8NiJbhoNHXmTWTbc+HGIjao4u7:9933VNq/eWn1mIjZ4w
TLSH
T179F2BF71ACA69E679DEA8BC8750B7A866EF5026380C81D88CDDD7F4D018765D031BC3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 4ecc1d71eed6689d4bbdcb3791362e010336111525ef9d40fbec42285d7a0a6f
MD5 35b8426dd7d1706770180af64aaf3f65
SHA1 1d13da622ecc8431b7418f913566f6c1159aa7be
SHA512 0f26ede98ac1b7088b797a5cd8745a14eccf16b60bf38d07edcf705dafb1e5864cf5bbf39987e90e578a90ed0f6ea96e6b06f4508f6f470b204987d32a33703c
SSDEEP 768:wj+963wuWvLmiJbhoNHXmTWTbc+HGIjao4u7:P963ivK/eWn1mIjZ4w
TLSH
T184F2BF71ACA59E779EEA8BC8750B7A866EF5026380C82D88CDDD7F4D018755D031BC2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 b65f58510a36e2dd54f23ea2345f961f6e3a6884a350c4fc9988486721ceeac7
MD5 5a53e0d6d81b9edda743e86946008e49
SHA1 39c1d30eb5e27bd2b4c58119119c2d350ccb144f
SHA512 8e57577258fa104a6370d23a34962aa82e3d7ee6e0a284c3adda66c06410c17faf72d6873625bd7f4516e4ca7f21dfb0000489fb8aea1744752c26c27c8ad003
TLSH
T17BE00113A30044BFC03C03301087163036F3A02213F302054A5002782D133106F70BC0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 3b24758d435f5f3339adfe363c9c3fbeaf15697f92510a2e49acf96fc2a61a6b
MD5 9c8dca8d11195b2f2edbc0c49112fb84
SHA1 225e3ef8bacf352537b33675d4f4cf03d215585f
SHA512 125783022e349acc0af4185a03be6e273721999e7c24293025b432117d2f5031848802d5c2de6f549e92c9e3c16eab70002dcf2f7b536b823ceaba15a14698d8
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter~RFe5d5806.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe5d5806.TMP
Size 392B
SHA256 38abbfbee239c53c246ea19e242b924786a6661c5b8a3243dda88909b31343d4
MD5 ca2e35c8da98785869096a0d054ff023
SHA1 299c6ddf07782ddd1fb8f78b756dcb0b2f0a7b7a
SHA512 41d25fe9f0a8b6afd7a67f4433b1a6d2beae4c85803c8f15ead3084b5cff8bbaba056fe0a6801675af6e643b354825395e4f2aa6156d44dc9a45b11d75665980
MD5 SHA1 SHA512

Submit Download

2be15bcf-e3f2-49c6-96d6-d3078f95c7a9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\2be15bcf-e3f2-49c6-96d6-d3078f95c7a9.tmp
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 612B
SHA256 98d9b184e4c7220b5aaf7ae412b0c1b3f32e3dc4933afcf852538b8082017b9e
MD5 c20138f2b92ee0645ce99eebc563daa6
SHA1 8e20392ea25dec3d3cef957c8ebbe1a0c589ea3b
SHA512 151098a27cb44d715d48210b12b95a9d1341beb7ca1de3096edc0434ba70c3d274e446604c7692d7a4d92af7b41872166747a30fd452fd0279407a6993fc02c0
TLSH
T15DF00CD28C3E21C2C5EA0F7ED04B2AF884D46507F0887439088DEAD4C17A80F118247E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 9107e613905835c00077a499d2faa20bb70b974e6309d1f2f33ae52933318f07
MD5 2012d4de563c653f56f62ccbf46db598
SHA1 fb24881003593f1ceb79019e52ce5ee9e94c889c
SHA512 c03d6584395c1c97c75af7dc6df57df358d3957035521bb6833c538679683aebe0410bb12586472b84dc98111e703984dd37868464fa9c66fdafb423e763b555
TLSH
T10CF00E829C3E25C086E90F7FE44725F840C46517B0883879088DE9D8813A40F11414BE
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 732B
SHA256 a5548ca519cf47ecb420c8f1299a8a50517fa463459a704ef2ff17c4db35117a
MD5 b2c40634bbfa57be0d4fad8adfbd6ccb
SHA1 6f8b9ba2f40d9aa42d217ed2bc6dbcdedd1763ad
SHA512 3cfbef4e4a4a7d8fa1530c69ea34fbc3b84627888361a9d201b21e6ead15f5d4e51fea8bc95edd07415b6d2d06a3c19beb1bcea3195e05a6d8af4939b95f77b5
TLSH
T1220110D29C7E26C2C5AA0FBFD08B26EC44C4A516F098747A1CCCF9D4823980E148243E
MD5 SHA1 SHA512 TLSH

Submit Download

c1418dc6-3bf9-40b6-be65-47c3f1d30859.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\c1418dc6-3bf9-40b6-be65-47c3f1d30859.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir548_1626591139\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ExitFormat.doc.WINDOWS

Path C:\Users\Admin\Desktop\ExitFormat.doc.WINDOWS
Size 611KB
SHA256 bd7b91956056ab3c1e957f2f4a6f12dee597a7fa6e5db8d996ac7682037d58ea
MD5 7cd543cf2df8ab4a8acaab5e9090dc20
SHA1 ada0e2eed611de2e64b1cc744b49514213c7105b
SHA512 fc353e165390b7eac1961d9668a9481b196f2eaa05423706771b99047248f8185be688a3c7eaffc102069d374f7c5efab7f60e964cbc8fb4c3d6408e8b606955
SSDEEP 12288:ekDnNnHcwnCrL/rrZjCFmk3QxPswefbFb0S9dubpg32fFqK/yKj5VbHUcpKq:ekLNn7Wrpuo9PsVFb0S9upU2tP/VHUc5
TLSH
T166D423EAFDEFFD8E1510A5BF98C89E7AA002F54401B4660D7718DF10E0AE5F36A16191
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

READ_IT.txt

Path C:\Users\Admin\Desktop\READ_IT.txt
Size 108B
SHA256 6bd70f8e5afcaf2bac76a5e40649be7ad4d59fb10d37e4f18ed3b1027b714b9a
MD5 d845190db42d07b1f4a34292d8f335c7
SHA1 fa97f5c6d4aa832a0a1451730e8ba2a32b2f9339
SHA512 9d9310f6885084665a54cba5c33ce55d2de89978b82d59c70746f1e9ca2abdd094713e562f802f5e723654824ab872b9ab453cb32e279b5960edc196f683a08c
TLSH
T198B092C2DCB8DE91205213C2208229002B2E8908344C62278E2540678004EA623EE738
MD5 SHA1 SHA512 TLSH

Submit Download

RenameRestart.xlsx.WINDOWS

Path C:\Users\Admin\Desktop\RenameRestart.xlsx.WINDOWS
Size 9KB
SHA256 6a8734ea71a634af16e587bd8d9786181c919439e7bffe56e64fa584c470f1f2
MD5 5f26b89b3c9dd661832a80c3dcc73a76
SHA1 db0918bbc5d8d79a6d397c0759cd55481b9a1f30
SHA512 423d632badcead5c5c13fcda694ccfdb105791a2bdce632f38d85b4ef7962752ecf955b0b5b699fb3b2ed7cae676b0a1bc71807d303e19dcb46c0be897e877c2
SSDEEP 192:PDXQxsF9KnmVqAJshfuPk9CkfI3ZrOzM3e4o4BbcYJtb:MKvw6BJkuPk9Ckg3ZrOIO4o4SY
TLSH
T19F22AFD6F74C4425EDA89953A239B09A15C7897830D7D936D430A7D305CC746C33C783
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RequestConvertTo.xlsx.WINDOWS

Path C:\Users\Admin\Desktop\RequestConvertTo.xlsx.WINDOWS
Size 940KB
SHA256 0c71f24f9412fe64705cde7b0ce9f36887db039b824cc25043c0fd44bf6758e4
MD5 510595d270d1720c5b9e41f4fe1f7a0c
SHA1 7718d74a867bc66c774e132fb7e1c780de58e036
SHA512 624bb5fd7cbf7b01496a8cf1283bfa1b3c159c6111b57ca25f4fc9477a3785beaef6547bcebb3221e515cc3a0a69d2203117f5e6ea84e79048c4f76a95e1a4ac
SSDEEP 12288:scRzGgr6JHP0dP05TQ+6+fdUPvEIBzPlUtAEeW2m/kuTNvqTsCwNQAuZpTtfN9AG:sudrn0iX+fdUnDGZpFTcsCU9uZpWjwt
TLSH
T18F2533773C0A407144AD3860C6C95DDA1571CAF8A8A7858BF309D21B8ABEE771E37DC6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RestartUse.html.WINDOWS

Path C:\Users\Admin\Desktop\RestartUse.html.WINDOWS
Size 470KB
SHA256 9ee2cf50264a95b30ffc7afedb7d9aad508bb75564c1dd3f0becb43f12ddaa80
MD5 2130c287053588001e5833393373ee4f
SHA1 1456708148de776e98aa3bb948141140b5518340
SHA512 b313150643e1aacf9c6d63816ca2aaced53a288566ea96ca2a388d1914e56848f18ff3a18ae56f349070bf7de18f9777cb0595fccff64149c4cc7e466f5a464b
SSDEEP 12288:Qfl9dri3gstHenFQnJ9RgTLrrpRiUGJ5q8HPHkIh:Qtvri3gstHngT7ibrVHjh
TLSH
T13BA4236F775446EB2D67B8EE84DC368210E32FC441A0AE09BFCBC5544362D594FAB28D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartOpen.odt.WINDOWS

Path C:\Users\Admin\Desktop\StartOpen.odt.WINDOWS
Size 658KB
SHA256 ea89e05e12dde987573b1c39eb80e6159ba480f4bdc8ad98d18adee51a4fc268
MD5 64a074cd8be7ff4ce5ef049e5655a15f
SHA1 ac2e376b1f3d9a155b6efb7db4dcd62b8b254ccb
SHA512 eabeaa7cc716f5572e90f0d540a32e858e278dce3152d262dad3cddafa0952bc411674708244c09248c2cdfbcf379ffc5019c26c1714e20401bbeca959d2f942
SSDEEP 12288:uOp5gYvT3neUHDRKCJ6eoyEaltbxer7YHsP0oZeOvl/Wk0:/g4THjklHclttQ7YHssEeOBB0
TLSH
T19BE4239AB0E001C7ADE4D9412486DC3798428FB1587BD95FC3954E82EF0DACA9F9DF18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

$uckyLocker.exe.crdownload

Path C:\Users\Admin\Downloads\$uckyLocker.exe.crdownload
Size 414KB
SHA256 86e0eac8c5ce70c4b839ef18af5231b5f92e292b81e440193cdbdc7ed108049f
MD5 c850f942ccf6e45230169cc4bd9eb5c8
SHA1 51c647e2b150e781bd1910cac4061a2cee1daf89
SHA512 2b3890241b8c8690aab0aed347daa778aba20f29f76e8b79b02953b6252324317520b91ea60d3ef73e42ad403f7a6e0e3f2a057799f21ed447dae7096b2f47d9
SSDEEP 6144:Av+lDAAB6fm00rx/Qdd1QkfRLT+vLtls6LEmynPsVpw/pcPk19:RdAAB6Mk1HfRLqzPlLEmynPsVpwBT
TLSH
T117946BE0AB45C4A5D8679A79843BDAA37533A24D9C68890D3D92FF0B7D733470023D9B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Petya.A.exe

Path C:\Users\Admin\Downloads\Petya.A.exe
Size 225KB
SHA256 26b4699a7b9eeb16e76305d843d4ab05e94d43f3201436927e13b3ebafa90739
MD5 af2379cc4d607a45ac44d62135fb7015
SHA1 39b6d40906c7f7f080e6befa93324dddadcbd9fa
SHA512 69899c47d0b15f92980f79517384e83373242e045ca696c6e8f930ff6454219bf609e0d84c2f91d25dfd5ef3c28c9e099c4a3a918206e957be806a1c2e0d3e99
SSDEEP 6144:DCyjXhd1mialK+qoNr8PxtZE6x5v+k6f:rjXhd8ZlKOrMZE6x5b6f
TLSH
T1FF349C2276E0847DFAB306378CFD36759ABDF9714931890B33C50A0E79605E1A63A763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICENSE

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping548_2071720105\LICENSE
Size 1KB
SHA256 3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b
MD5 ee002cb9e51bb8dfa89640a406a1090a
SHA1 49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2
SHA512 d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c
TLSH
T17D31535723840B9306DA2B4566AEBDC4B0DDC02D7F27AE05186EF394537B52ED8B3443
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4808-550-0x00000000053A0000-0x00000000053AA000-memory.dmp

Download

memory/4808-548-0x0000000005A40000-0x0000000005FFA000-memory.dmp

Download

memory/4808-549-0x00000000053C0000-0x0000000005452000-memory.dmp

Download

memory/4808-547-0x0000000000810000-0x000000000087E000-memory.dmp

Download

Resubmissions

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads