Overview

overview

8

Static

static

3

9ad6dbbb06...a2.exe

windows10-2004-x64

7

9ad6dbbb06...a2.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    148s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    16/09/2026, 10:06

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    9ad6dbbb0600cc32d9de1530f0277395d2733d270e65a1f0be6e2182a9c354a2.exe
  • Size 14.2MB
  • Sample260916-l5hexsydng
  • SHA256 9ad6dbbb0600cc32d9de1530f0277395d2733d270e65a1f0be6e2182a9c354a2
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoveryexecutioninstallerpersistenceprivilege_escalation

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell and hide display window.

    execution
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 6 IoCs
  • Loads dropped DLL 27 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 5 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Inno Setup is an open-source installation builder for Windows applications. 4 IoCs

    Inno Setup installer

    installer
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Kills process with taskkill 1 IoCs
    defense_evasion
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 25 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 58 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9ad6dbbb0600cc32d9de1530f0277395d2733d270e65a1f0be6e2182a9c354a2.exe
    "C:\Users\Admin\AppData\Local\Temp\9ad6dbbb0600cc32d9de1530f0277395d2733d270e65a1f0be6e2182a9c354a2.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:1956
    • C:\Users\Admin\AppData\Local\Temp\RarSFX0\anytoiso_setup.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX0\anytoiso_setup.exe" /silent
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3452
      • C:\Users\Admin\AppData\Local\Temp\is-G6CUJAYRIT.tmp\anytoiso_setup.tmp
        "C:\Users\Admin\AppData\Local\Temp\is-G6CUJAYRIT.tmp\anytoiso_setup.tmp" /SL5="$A008E,10978600,915456,C:\Users\Admin\AppData\Local\Temp\RarSFX0\anytoiso_setup.exe" /silent
        3⤵
        • Executes dropped EXE
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2760
        • C:\Windows\SysWOW64\regsvr32.exe
          "C:\Windows\SysWOW64\regsvr32.exe" /s "C:\Program Files (x86)\AnyToISO\anyshellext_x86.dll"
          4⤵
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          PID:4224
        • C:\Windows\SysWOW64\regsvr32.exe
          "C:\Windows\SysWOW64\regsvr32.exe" /s "C:\Program Files (x86)\AnyToISO\anyshellext.dll"
          4⤵
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5788
          • C:\Windows\system32\regsvr32.exe
            /s "C:\Program Files (x86)\AnyToISO\anyshellext.dll"
            5⤵
            • Loads dropped DLL
            • Modifies registry class
            PID:5792
        • C:\Program Files (x86)\AnyToISO\anytoiso.exe
          "C:\Program Files (x86)\AnyToISO\anytoiso.exe" /msix_register
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: AddClipboardFormatListener
          • Suspicious use of WriteProcessMemory
          PID:3956
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -Command "try { Add-AppxPackage -Path 'C:\Program Files (x86)\AnyToISO\anyshellext2.msix' -ExternalLocation 'C:\Program Files (x86)\AnyToISO\' -ErrorAction Stop; exit 0 } catch { $_ | Out-File -FilePath 'C:\Program Files (x86)\AnyToISO\anyshellext2_install_error.log' -Encoding utf8; exit 1 }"
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1644
        • C:\Program Files (x86)\AnyToISO\anytoiso.exe
          "C:\Program Files (x86)\AnyToISO\anytoiso.exe"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: AddClipboardFormatListener
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of WriteProcessMemory
          PID:2684
          • C:\Program Files (x86)\AnyToISO\anytoiso_helper.exe
            "C:\Program Files (x86)\AnyToISO\anytoiso_helper.exe" /pid:2684
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:1428
    • C:\Windows\SysWOW64\taskkill.exe
      "C:\Windows\System32\taskkill.exe" /f /im "anytoiso.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:1916
    • C:\Users\Admin\AppData\Local\Temp\RarSFX0\Replace.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Replace.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      PID:1168
    • C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" add "HKCU\SOFTWARE\CrystalIdea Software\AnyToISO" /v "UpdateChecker_Auto" /t REG_DWORD /d "0" /f
      2⤵
      • System Location Discovery: System Language Discovery
      PID:5840
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://ftuapps.dev/
      2⤵
      • Drops file in Windows directory
      • Enumerates system info in registry
      • Modifies data under HKEY_USERS
      • Modifies registry class
      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:1896
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f4,0x2f8,0x2fc,0x2f0,0x304,0x7ffaefe3c188,0x7ffaefe3c194,0x7ffaefe3c1a0
        3⤵
          PID:2576
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1696,i,863735850259911996,18001697600284463492,262144 --field-trial-handle=2360,i,800737069787161991,4247736155115016820,262144 --variations-seed-version --mojo-platform-channel-handle=2356 /prefetch:2
          3⤵
            PID:4796
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1900,i,14861655430333198558,4907749881429710589,524288 --field-trial-handle=2360,i,800737069787161991,4247736155115016820,262144 --variations-seed-version --mojo-platform-channel-handle=2452 /prefetch:11
            3⤵
            • System Time Discovery
            PID:4564
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2480,i,2112737360544663553,3925306982383217521,524288 --field-trial-handle=2360,i,800737069787161991,4247736155115016820,262144 --variations-seed-version --mojo-platform-channel-handle=2744 /prefetch:13
            3⤵
              PID:5104
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3504,i,10565915501334083229,17541752391571014994,2097152 --field-trial-handle=2360,i,800737069787161991,4247736155115016820,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:1
              3⤵
                PID:3808
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3508,i,10964625379895367260,2697331183346286435,2097152 --field-trial-handle=2360,i,800737069787161991,4247736155115016820,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:1
                3⤵
                  PID:800
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4324,i,13195842968319292940,1080823316835476045,2097152 --field-trial-handle=2360,i,800737069787161991,4247736155115016820,262144 --variations-seed-version --mojo-platform-channel-handle=4484 /prefetch:1
                  3⤵
                    PID:1792
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4364,i,10285272433888595354,2515771130122876343,2097152 --field-trial-handle=2360,i,800737069787161991,4247736155115016820,262144 --variations-seed-version --mojo-platform-channel-handle=4980 /prefetch:9
                    3⤵
                      PID:452
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5416,i,6277960579782948820,12886441423829509212,524288 --field-trial-handle=2360,i,800737069787161991,4247736155115016820,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:14
                      3⤵
                        PID:5800
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5432,i,5463806084560166148,17543250102481191712,2097152 --field-trial-handle=2360,i,800737069787161991,4247736155115016820,262144 --variations-seed-version --mojo-platform-channel-handle=5448 /prefetch:1
                        3⤵
                          PID:2720
                        • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5000,i,3425874381738966528,14559569465098728087,524288 --field-trial-handle=2360,i,800737069787161991,4247736155115016820,262144 --variations-seed-version --mojo-platform-channel-handle=6260 /prefetch:14
                          3⤵
                            PID:5032
                          • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5000,i,3425874381738966528,14559569465098728087,524288 --field-trial-handle=2360,i,800737069787161991,4247736155115016820,262144 --variations-seed-version --mojo-platform-channel-handle=6260 /prefetch:14
                            3⤵
                              PID:716
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5464,i,11065654922942327109,15268417026685697741,524288 --field-trial-handle=2360,i,800737069787161991,4247736155115016820,262144 --variations-seed-version --mojo-platform-channel-handle=6396 /prefetch:14
                              3⤵
                                PID:1188
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5348,i,351250121403373605,17270152771483283857,524288 --field-trial-handle=2360,i,800737069787161991,4247736155115016820,262144 --variations-seed-version --mojo-platform-channel-handle=6464 /prefetch:14
                                3⤵
                                  PID:4556
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6736,i,12750996566437929679,3531846282112667137,524288 --field-trial-handle=2360,i,800737069787161991,4247736155115016820,262144 --variations-seed-version --mojo-platform-channel-handle=6732 /prefetch:14
                                  3⤵
                                    PID:3108
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6080,i,16030386236842180215,12071335286660997350,524288 --field-trial-handle=2360,i,800737069787161991,4247736155115016820,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:14
                                    3⤵
                                      PID:4996
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6260,i,1650876637652434906,1629832967034514141,524288 --field-trial-handle=2360,i,800737069787161991,4247736155115016820,262144 --variations-seed-version --mojo-platform-channel-handle=5020 /prefetch:14
                                      3⤵
                                        PID:5948
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6292,i,12557960151589167778,3335411901647170512,524288 --field-trial-handle=2360,i,800737069787161991,4247736155115016820,262144 --variations-seed-version --mojo-platform-channel-handle=7148 /prefetch:14
                                        3⤵
                                          PID:6032
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6200,i,17805763869490175412,13360097441897542317,524288 --field-trial-handle=2360,i,800737069787161991,4247736155115016820,262144 --variations-seed-version --mojo-platform-channel-handle=6332 /prefetch:14
                                          3⤵
                                            PID:5600
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7132,i,6244005255941323572,6200364390839717581,524288 --field-trial-handle=2360,i,800737069787161991,4247736155115016820,262144 --variations-seed-version --mojo-platform-channel-handle=3420 /prefetch:14
                                            3⤵
                                              PID:5044
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6208,i,4290513610413031997,10141937816322729203,524288 --field-trial-handle=2360,i,800737069787161991,4247736155115016820,262144 --variations-seed-version --mojo-platform-channel-handle=6188 /prefetch:14
                                              3⤵
                                                PID:4072
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5976,i,9039032976412337042,10518762547882900880,524288 --field-trial-handle=2360,i,800737069787161991,4247736155115016820,262144 --variations-seed-version --mojo-platform-channel-handle=6636 /prefetch:14
                                                3⤵
                                                  PID:6064
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7024,i,4495934410576629868,9468316007967015230,524288 --field-trial-handle=2360,i,800737069787161991,4247736155115016820,262144 --variations-seed-version --mojo-platform-channel-handle=6648 /prefetch:14
                                                  3⤵
                                                    PID:4752
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6204,i,12005668576817515941,16381056443693287231,262144 --field-trial-handle=2360,i,800737069787161991,4247736155115016820,262144 --variations-seed-version --mojo-platform-channel-handle=7024 /prefetch:10
                                                    3⤵
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    PID:5948
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                1⤵
                                                  PID:2316
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
                                                  1⤵
                                                    PID:5044

                                                  Network

                                                        MITRE ATT&CK Enterprise v16

                                                        Replay Monitor

                                                        Loading Replay Monitor...

                                                        Downloads

                                                        MSVCP140_2.dll
                                                        • Path C:\Program Files (x86)\AnyToISO\MSVCP140_2.dll
                                                        • Size 288KB
                                                        • SHA256 2a5365e03cc6e78b408dfca81537f3734bf3d7cf9cc13ae33204dfbc641dbe43
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        Qt6Core.dll
                                                        • Path C:\Program Files (x86)\AnyToISO\Qt6Core.dll
                                                        • Size 5.2MB
                                                        • SHA256 c702563ab4515b8ae1ed92576628adfbb41750c0adf985a6bd64d93fb8595093
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        Qt6Core5Compat.dll
                                                        • Path C:\Program Files (x86)\AnyToISO\Qt6Core5Compat.dll
                                                        • Size 756KB
                                                        • SHA256 279d6522632c8267863ea904a323733a9ed1fd9aaba397ba1a308bb4296686bb
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        Qt6Gui.dll
                                                        • Path C:\Program Files (x86)\AnyToISO\Qt6Gui.dll
                                                        • Size 7.1MB
                                                        • SHA256 fa3d50893988a8bb843b59f814aa2ced7a6e5b826e801485ae8629b0835ac3b9
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        Qt6Network.dll
                                                        • Path C:\Program Files (x86)\AnyToISO\Qt6Network.dll
                                                        • Size 3.1MB
                                                        • SHA256 fc855125a27de89152b6498e1e04f29f773f6be10085c4858d5d030df981c346
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        Qt6Widgets.dll
                                                        • Path C:\Program Files (x86)\AnyToISO\Qt6Widgets.dll
                                                        • Size 5.1MB
                                                        • SHA256 59868f66f9b70d626ef7610ebec8b4d2ca059966fa8c49259298e38ca3d92d9a
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        VCRUNTIME140.dll
                                                        • Path C:\Program Files (x86)\AnyToISO\VCRUNTIME140.dll
                                                        • Size 89KB
                                                        • SHA256 a9d7732a3c3de09f0601a7fa2555093dcb49f08e2fc62a86091461f0f38393ed
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        anyshellext.dll
                                                        • Path C:\Program Files (x86)\AnyToISO\anyshellext.dll
                                                        • Size 568KB
                                                        • SHA256 6f853955ac04ad9f6c0885fe3313294ee41c444385bbe83409116322b6aa10d2
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        anyshellext_x86.dll
                                                        • Path C:\Program Files (x86)\AnyToISO\anyshellext_x86.dll
                                                        • Size 489KB
                                                        • SHA256 7de8abe68a5e9a9f0c1af2d4dd6aeb421054154060dcf5b718f5ddcc0143775c
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        anytoiso.exe
                                                        • Path C:\Program Files (x86)\AnyToISO\anytoiso.exe
                                                        • Size 3.1MB
                                                        • SHA256 5a0fdb7a2997873d65f75d23f8da18c1aa96809c758f07d781f452b29953d05d
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        anytoiso_helper.exe
                                                        • Path C:\Program Files (x86)\AnyToISO\anytoiso_helper.exe
                                                        • Size 613KB
                                                        • SHA256 a17ec3c1b5c9a5d937d9e52743c45254214eee542a0f32a9ed94817154a0608f
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        English.xml
                                                        • Path C:\Program Files (x86)\AnyToISO\languages\English.xml
                                                        • Size 20KB
                                                        • SHA256 53018f315b478cfc2d69381fb7c59ab266c9fbe638ef96b8f32b93e80b6f94b7
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        msvcp140.dll
                                                        • Path C:\Program Files (x86)\AnyToISO\msvcp140.dll
                                                        • Size 437KB
                                                        • SHA256 97e71a3c697fb1ab3af777db39009e4602525e8c3aff0837ecc7031cba188165
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        msvcp140_1.dll
                                                        • Path C:\Program Files (x86)\AnyToISO\msvcp140_1.dll
                                                        • Size 33KB
                                                        • SHA256 01a58552686d0c6b9fd67a7ac81169fc0013aedf59a8efdc611f94907489a31c
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        qwindows.dll
                                                        • Path C:\Program Files (x86)\AnyToISO\platforms\qwindows.dll
                                                        • Size 713KB
                                                        • SHA256 f56cd786925ccc711d32d66e0c00b86ed509f1e90573d584816a0e046a2c99db
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        qmodernwindowsstyle.dll
                                                        • Path C:\Program Files (x86)\AnyToISO\styles\qmodernwindowsstyle.dll
                                                        • Size 193KB
                                                        • SHA256 35c41abf814e7bf16c5719d9ae2ed857da53563d9761e4ae194154c1306e47ab
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        qopensslbackend.dll
                                                        • Path C:\Program Files (x86)\AnyToISO\tls\qopensslbackend.dll
                                                        • Size 2.3MB
                                                        • SHA256 84c79768b145139e9fe932d2263a41e23dec4933f4b278c74f4ac49e54877271
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        settings.dat
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                        • Size 280B
                                                        • SHA256 2faa1b1440ef2e1a669881f74143ac7857706d1524c89e682f713c8f3d38ab23
                                                        • MD5 SHA1 SHA512 TLSH
                                                        Submit Download

                                                        settings.dat
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                        • Size 280B
                                                        • SHA256 4fc7dcf7387fe20ebfe8604da12039dc01420b7c4f9203598cac361fa8e97926
                                                        • MD5 SHA1 SHA512 TLSH
                                                        Submit Download

                                                        the-real-index
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                        • Size 3KB
                                                        • SHA256 009ac7199893f1b356058343363a29c9dfd979d68bb0a6b9086d99913c7913f6
                                                        • MD5 SHA1 SHA512 TLSH
                                                        Submit Download

                                                        the-real-index~RFe5b2008.TMP
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5b2008.TMP
                                                        • Size 3KB
                                                        • SHA256 3939b7669a90663e96c7fd0e574569c253a9da357ac9221a3f332612ecd527bf
                                                        • MD5 SHA1 SHA512 TLSH
                                                        Submit Download

                                                        SiteList-Enterprise.json
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
                                                        • Size 2B
                                                        • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                        • MD5 SHA1 SHA512
                                                        Submit Download

                                                        Edge Profile.ico
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
                                                        • Size 70KB
                                                        • SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        Network Persistent State
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                        • Size 6KB
                                                        • SHA256 303b848c8e33950dad588d02a610d8e3d8ee0e5df808eb3fb3771f59af3b0eb6
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        SCT Auditing Pending Reports
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
                                                        • Size 2B
                                                        • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                        • MD5 SHA1 SHA512
                                                        Submit Download

                                                        Sdch Dictionaries
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
                                                        • Size 40B
                                                        • SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
                                                        • MD5 SHA1 SHA512
                                                        Submit Download

                                                        Preferences
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                        • Size 12KB
                                                        • SHA256 0022df66d9450cf57afa5608b38e0dc77fed9c84a4242174770fed5a519a4556
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        Preferences
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                        • Size 12KB
                                                        • SHA256 c81c9db72777bb5552b757d11d8de3108aa00073ec5265f40909c163b438dca6
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        Preferences
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                        • Size 12KB
                                                        • SHA256 bb849c10e1191682aa13649ca4bfb0d5ae6233944c24f69c6509dbbab1f67420
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        Secure Preferences
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                                                        • Size 27KB
                                                        • SHA256 24a0acb2e87f8bf20788818d88ad3839a9cb37c53cd00b0dc9c3dba67c89ff67
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        fd9a7889-22e2-4bd7-abd9-d54953d9562e.tmp
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\fd9a7889-22e2-4bd7-abd9-d54953d9562e.tmp
                                                        • Size 22KB
                                                        • SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        Local State
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                        • Size 35KB
                                                        • SHA256 60f1a495913de24dcf4459526716fd72a3b31a20a202bb23747cca18ec2b78f5
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        Local State
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                        • Size 35KB
                                                        • SHA256 4fb5d9273bf40d5dbabde68b7f775fa2d140fea9f7279c3080d51ed3035bdbbd
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        Local State
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                        • Size 39KB
                                                        • SHA256 34d423d67d958f32e4381e82f14703dc41b38161df968bf9247054505673eaae
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        Local State
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                        • Size 39KB
                                                        • SHA256 89c7d078f3b63d06403903a5e34b849acd943fe44bc994c9e610564a8748d7e8
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        Local State
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                        • Size 40KB
                                                        • SHA256 1fe2c1940d696935a1c721e8056a9892950e0566f649699346e1630833c803dc
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        metadata.json
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                        • Size 252B
                                                        • SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
                                                        • MD5 SHA1 SHA512 TLSH
                                                        Submit Download

                                                        metadata.json
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                        • Size 372B
                                                        • SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
                                                        • MD5 SHA1 SHA512 TLSH
                                                        Submit Download

                                                        metadata.json
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                        • Size 132B
                                                        • SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
                                                        • MD5 SHA1 SHA512 TLSH
                                                        Submit Download

                                                        8387f528-c7c2-40a3-9128-30537cd1a47b.tmp
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\8387f528-c7c2-40a3-9128-30537cd1a47b.tmp
                                                        • Size 13B
                                                        • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
                                                        • MD5 SHA1 SHA512
                                                        Submit Download

                                                        CyberMania.url
                                                        • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\CyberMania.url
                                                        • Size 110B
                                                        • SHA256 3aa697f2559d375c31374fd5e7383ea542ad3daa8a714307240ed9762b376762
                                                        • MD5 SHA1 SHA512 TLSH
                                                        Submit Download

                                                        Replace.exe
                                                        • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\Replace.exe
                                                        • Size 2.1MB
                                                        • SHA256 9a7aea8ffc4053233dd859a97c764c7a0df484c1231b639f10bbbdd47c30e0ce
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        anytoiso_setup.exe
                                                        • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\anytoiso_setup.exe
                                                        • Size 12.5MB
                                                        • SHA256 3457d7163c567029eab0bba212baa051214959d4760c17685efa26f94b52f806
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        anytoiso_setup.tmp
                                                        • Path C:\Users\Admin\AppData\Local\Temp\is-G6CUJAYRIT.tmp\anytoiso_setup.tmp
                                                        • Size 4.9MB
                                                        • SHA256 dbae4c2c4e94cd2b0e468e7822861dedaae3dbcd096e438f6034c457d6ec4744
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        content_new.js
                                                        • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1896_1504444618\CRX_INSTALL\content_new.js
                                                        • Size 10KB
                                                        • SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        AnyToISO.lnk
                                                        • Path C:\Users\Admin\Desktop\AnyToISO.lnk
                                                        • Size 1KB
                                                        • SHA256 e2a0916dbbda8dd2529ea18a0fe3a58936a85141ac7e700466f9a6492db4cbe2
                                                        • MD5 SHA1 SHA512 TLSH
                                                        Submit Download

                                                        memory/1428-326-0x0000000000400000-0x0000000000498000-memory.dmp
                                                        Download

                                                        memory/1428-400-0x0000000000400000-0x0000000000498000-memory.dmp
                                                        Download

                                                        memory/1644-282-0x00000000033B0000-0x00000000033E6000-memory.dmp
                                                        Download

                                                        memory/1644-298-0x0000000007840000-0x0000000007860000-memory.dmp
                                                        Download

                                                        memory/1644-283-0x0000000005A70000-0x00000000060BA000-memory.dmp
                                                        Download

                                                        memory/1644-284-0x0000000006200000-0x0000000006222000-memory.dmp
                                                        Download

                                                        memory/1644-309-0x0000000007F90000-0x0000000007FB6000-memory.dmp
                                                        Download

                                                        memory/1644-308-0x0000000007EB0000-0x0000000007EB8000-memory.dmp
                                                        Download

                                                        memory/1644-305-0x0000000007E70000-0x0000000007E78000-memory.dmp
                                                        Download

                                                        memory/1644-307-0x0000000007E90000-0x0000000007E9A000-memory.dmp
                                                        Download

                                                        memory/1644-306-0x0000000007E80000-0x0000000007E86000-memory.dmp
                                                        Download

                                                        memory/1644-304-0x0000000007F00000-0x0000000007F2A000-memory.dmp
                                                        Download

                                                        memory/1644-303-0x0000000007E50000-0x0000000007E6A000-memory.dmp
                                                        Download

                                                        memory/1644-302-0x0000000008030000-0x0000000008234000-memory.dmp
                                                        Download

                                                        memory/1644-301-0x0000000007C40000-0x0000000007C5A000-memory.dmp
                                                        Download

                                                        memory/1644-300-0x00000000082C0000-0x000000000893C000-memory.dmp
                                                        Download

                                                        memory/1644-299-0x0000000007B50000-0x0000000007BF3000-memory.dmp
                                                        Download

                                                        memory/1644-286-0x00000000062A0000-0x0000000006306000-memory.dmp
                                                        Download

                                                        memory/1644-295-0x000000006C740000-0x000000006C78C000-memory.dmp
                                                        Download

                                                        memory/1644-294-0x0000000007880000-0x00000000078B6000-memory.dmp
                                                        Download

                                                        memory/1644-287-0x0000000006380000-0x00000000063E6000-memory.dmp
                                                        Download

                                                        memory/1644-292-0x00000000068F0000-0x000000000693C000-memory.dmp
                                                        Download

                                                        memory/1644-291-0x0000000006530000-0x000000000654E000-memory.dmp
                                                        Download

                                                        memory/1644-290-0x0000000006560000-0x00000000068BB000-memory.dmp
                                                        Download

                                                        memory/2760-293-0x0000000000E90000-0x0000000001391000-memory.dmp
                                                        Download

                                                        memory/2760-310-0x0000000000E80000-0x0000000000E81000-memory.dmp
                                                        Download

                                                        memory/2760-327-0x0000000000E90000-0x0000000001391000-memory.dmp
                                                        Download

                                                        memory/2760-20-0x0000000000E80000-0x0000000000E81000-memory.dmp
                                                        Download

                                                        memory/3452-328-0x0000000000380000-0x000000000046F000-memory.dmp
                                                        Download

                                                        memory/3452-285-0x0000000000380000-0x000000000046F000-memory.dmp
                                                        Download

                                                        memory/3452-14-0x0000000000380000-0x000000000046F000-memory.dmp
                                                        Download