hxxps://9[.]stg[.]html-load[.]com/session/un4/h6a/ni8/4gz/www[.]scribd[.]com/otg/qwhvi331tyxywywvy7qzfqbyrcyry7s5mznqzfqbyr7n3ywvqzbyntvyczyevfycyoy8syp6myyytykvsyhyyypyyysaayiby19v8yvsy9l6txlafy9ys1cyfm76iparzytpayvbc6y9ymy8yl6y0yfyopyympaylyv13fyy4yhygcy4yhymy248ygi3wygy3ymy97cymcyosymayay3yma88y2y5syoygy6ylky4ymmy5yi8bbyayl7ykpy8ymuy7rpyzcyjyay7omyjyyy7mpsuf0ymsykytmyp9esgk7yjsvy553aqay6y04yg7y1y9y41ylvpsyhyg05y4a1inysrbzy9yicyl1p3y10pybuuy8y1m37bcpymxeyig7yjy4vylymp60p30y0ymy3srp6ypy0yhoyoysyi4t3nykqvymwyly3yhy7xykyat9yop3y25yyoxy3ytpa6cy3ysc12y15yoyjy7pyqkgy5xpsgyyypyip3y4p6rvkylcy1y39fy7yyy8yky0y1y9yhbag5ymyfbp6jumwey3owy7qyu3p31psuvymymbylzy4y1yuf3fyopagyksygyazylapyy6yktyarygpy3kyku3rgy7p392yop6pvqaly6lysy4qyjyay2yoy29psopapvtgy0wmgky4yljyfy0yfyyy6y5zykf6pap6yfyjp6yoy6ylmy1paps7gy9lyjgyap6y6yiy261p6p3ygqypyy7payayv8v8rymltkypv9y2y9u8p3nqkyu5p3yuy8pvyfy6p62ymy34p6wpvy8ylsyypypve0y7o50yay4yoysjey8kpvygeyjy2fzp3tyfc7yfyvysyvyhypa07a0pvykxy5iy0yvqt4vym9y5qyvc6yky4yiay5nml3wuqyamyyyaygyka2yjtymy46y7y1jz5yfyj6ymy9y2fymps6bxyafpavymysyysymyajy5y8y4f4yisy2oxypty9yhsy2ovyiysocyarypo4ym8cyayfy6y4m8ymnpa9y25sy2ykgaty9yhsy2o8mty9yhsy2y0yksty9yhsy26ykytysocyaby6cm8ymxa6y25sy2yiopaty9yhsy2y0onty9yhsy2oyiyity9yhsy22y0ity9yhsy2omgty9yhsy2y6psyvysocya9mv4ym8cyajcvsy2y0yinty9yhsy2y6yixty9yhsy2y0uyoty9yhsy2y0lyoty9yypvy2ayly8yoyly3y3cysy4y9ymyucy7ypcfyhcsyoymcy3yoymyoylsy1cy4yoymay3yoymcy3yoscymyhsc2ymy9y8yyky6ayg1pvb6jf3ytjygzay5cymmy4yvy7y4wy53flp3ygy3ysymyocytpvyoayay3yoaysymylymys8yly9yvpyp3yfcy5ymny3y5y4ausayhyhwop6ytpsym4p349ylymyayapyzpyy3gyg8ylyuypy3syh5u3ytjygzayppyypy7cay24ep6pyy8yhwyfymwyofymyky0y0y0y0y0y0y0y0y0y0y0yfy25y2y1bymy6cygyo6cp3y2y6ympyymqspaymcsymyiy2pvy2cy2qy2tiqy9ysymy48youy4ay5ry42y5upv0ytygy2y9y2gspsymucy28icpsyoy9ymymymymy2ymys0iy2y4cs4ypylq4ytygpv9ypubaysymys0ysymby8ymgyjxysyo6fymy9yly9ysymyasysymyayoysy9y3y3ymy9yevnyceyecqzfy7ycy4ymy3vy3y9smyoiypy3clyso3ytjygzayppyypy7cay24ep6pyy8yhwy4ymy4pvymy8ymymy4cy36yoy1yly0y2ay4ye75jyceyeqfy7ycyoymy9y8iay3ymy9yp6iky4pvkpvy6ylyle8bpayhy4y4y0yyp6kpyyfcyjyaxyvysrtyfnytyu49sy2fa4yoym6psy4y2jk9yvlyhyfy81ym8y7pyly2vy8yjy1vyyu5yt17y4p6spyykxgyayaqy9sykrymyipsykj9y9yf6rp6y3owyvpay8y7twy19ya4y9yipyv3z4yky50ysyhy8p6zyib9y6yy8gbp69ezy10pauy4ya5kyoy9y4tyjj8uym8vesly6y6yuy6yfgytoyuyy5ytap3p3p6ypyfwl2vyyjy6paylyje33yj7y8iyfymep3euymygyyysmyplq0p6yap3yp07xgy4y3ylbj56s3ry0yy4yhypyk9pv6y8y1xy9syy7yi2vylyh6gznzjg2arz10n3y5znbpyz33y2l4ys6yfyt8p6ey2yy9ljps3y1gy8ykp6y0y1ykryoyusb5eym0ypfyap68rpypyy7vxfyhy6wypyay20y45qykpaz9ip3y28zyly55fyf142yy4cy2yetfcycymytylo6y0wfvby5xy1cpvx3psyfcsypb6ytmqyv5psyfp6by9yeqzfn73ycqvyi15myioyfykyk69y6o229koy69wyegxyc6ye7mycyfyevy75gzyci331tyxywywm5fzy7j0gnqf1nyrqsjywgnqf1nywz1yzkyjqvj1vfc7y0fy7yzkyl96wy6yfekweoyfyz9ovy7cgs51y0fy7yzkyl9weo69yf6ooyfy6yz9o1zvqnjn73y0fy7yzkylaaayrtqgfmy7yrqsjyz9oqgnv3flny0fy7yzkylyfey6yk6yfoweoy69yz9om5fyzkyly4ymy3vy3y9smyoiypy3clyso3ytjygzayppyypy7cay24ep6pyy8yhwy4ymy4pvymy8ymymy4cy36yoy1yly0y2ay4yz9ocvy7y0ts5gqnyzkyl2yz9ocvy7y0qvj1vfc7fy7yzkyl96wy6yfekweoyfyz9ocqzfy7yzkyly4ymy3vy3y9smyoiypy3clyso3ytjygzayppyypy7cay24ep6pyy8yhwy4ymy4pvymy8ymymy4cy36yoy1yly0y2ay4yevtyin43gvycyzyky2yz99qs7xfcy37y7n4yz99yzkymwyzykyl

Resubmissions

29/09/2026, 14:42

260929-r3da3ssdke

29/09/2026, 12:49

260929-p2efmsst4p8

Analysis

user interaction
yes
max time kernel
148s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
29/09/2026, 12:49

Sharing

Copy URL Twitter E-mail

Behavioral task

behavioral1

Sample

https://9.stg.html-load.com/session/un4/h6a/ni8/4gz/www.scribd.com/otg/qwhvi331tyxywywvy7qzfqbyrcyry7s5mznqzfqbyr7n3ywvqzbyntvyczyevfycyoy8syp6myyytykvsyhyyypyyysaayiby19v8yvsy9l6txlafy9ys1cyfm76iparzytpayvbc6y9ymy8yl6y0yfyopyympaylyv13fyy4yhygcy4yhymy248ygi3wygy3ymy97cymcyosymayay3yma88y2y5syoygy6ylky4ymmy5yi8bbyayl7ykpy8ymuy7rpyzcyjyay7omyjyyy7mpsuf0ymsykytmyp9esgk7yjsvy553aqay6y04yg7y1y9y41ylvpsyhyg05y4a1inysrbzy9yicyl1p3y10pybuuy8y1m37bcpymxeyig7yjy4vylymp60p30y0ymy3srp6ypy0yhoyoysyi4t3nykqvymwyly3yhy7xykyat9yop3y25yyoxy3ytpa6cy3ysc12y15yoyjy7pyqkgy5xpsgyyypyip3y4p6rvkylcy1y39fy7yyy8yky0y1y9yhbag5ymyfbp6jumwey3owy7qyu3p31psuvymymbylzy4y1yuf3fyopagyksygyazylapyy6yktyarygpy3kyku3rgy7p392yop6pvqaly6lysy4qyjyay2yoy29psopapvtgy0wmgky4yljyfy0yfyyy6y5zykf6pap6yfyjp6yoy6ylmy1paps7gy9lyjgyap6y6yiy261p6p3ygqypyy7payayv8v8rymltkypv9y2y9u8p3nqkyu5p3yuy8pvyfy6p62ymy34p6wpvy8ylsyypypve0y7o50yay4yoysjey8kpvygeyjy2fzp3tyfc7yfyvysyvyhypa07a0pvykxy5iy0yvqt4vym9y5qyvc6yky4yiay5nml3wuqyamyyyaygyka2yjtymy46y7y1jz5yfyj6ymy9y2fymps6bxyafpavymysyysymyajy5y8y4f4yisy2oxypty9yhsy2ovyiysocyarypo4ym8cyayfy6y4m8ymnpa9y25sy2ykgaty9yhsy2o8mty9yhsy2y0yksty9yhsy26ykytysocyaby6cm8ymxa6y25sy2yiopaty9yhsy2y0onty9yhsy2oyiyity9yhsy22y0ity9yhsy2omgty9yhsy2y6psyvysocya9mv4ym8cyajcvsy2y0yinty9yhsy2y6yixty9yhsy2y0uyoty9yhsy2y0lyoty9yypvy2ayly8yoyly3y3cysy4y9ymyucy7ypcfyhcsyoymcy3yoymyoylsy1cy4yoymay3yoymcy3yoscymyhsc2ymy9y8yyky6ayg1pvb6jf3ytjygzay5cymmy4yvy7y4wy53flp3ygy3ysymyocytpvyoayay3yoaysymylymys8yly9yvpyp3yfcy5ymny3y5y4ausayhyhwop6ytpsym4p349ylymyayapyzpyy3gyg8ylyuypy3syh5u3ytjygzayppyypy7cay24ep6pyy8yhwyfymwyofymyky0y0y0y0y0y0y0y0y0y0y0yfy25y2y1bymy6cygyo6cp3y2y6ympyymqspaymcsymyiy2pvy2cy2qy2tiqy9ysymy48youy4ay5ry42y5upv0ytygy2y9y2gspsymucy28icpsyoy9ymymymymy2ymys0iy2y4cs4ypylq4ytygpv9ypubaysymys0ysymby8ymgyjxysyo6fymy9yly9ysymyasysymyayoysy9y3y3ymy9yevnyceyecqzfy7ycy4ymy3vy3y9smyoiypy3clyso3ytjygzayppyypy7cay24ep6pyy8yhwy4ymy4pvymy8ymymy4cy36yoy1yly0y2ay4ye75jyceyeqfy7ycyoymy9y8iay3ymy9yp6iky4pvkpvy6ylyle8bpayhy4y4y0yyp6kpyyfcyjyaxyvysrtyfnytyu49sy2fa4yoym6psy4y2jk9yvlyhyfy81ym8y7pyly2vy8yjy1vyyu5yt17y4p6spyykxgyayaqy9sykrymyipsykj9y9yf6rp6y3owyvpay8y7twy19ya4y9yipyv3z4yky50ysyhy8p6zyib9y6yy8gbp69ezy10pauy4ya5kyoy9y4tyjj8uym8vesly6y6yuy6yfgytoyuyy5ytap3p3p6ypyfwl2vyyjy6paylyje33yj7y8iyfymep3euymygyyysmyplq0p6yap3yp07xgy4y3ylbj56s3ry0yy4yhypyk9pv6y8y1xy9syy7yi2vylyh6gznzjg2arz10n3y5znbpyz33y2l4ys6yfyt8p6ey2yy9ljps3y1gy8ykp6y0y1ykryoyusb5eym0ypfyap68rpypyy7vxfyhy6wypyay20y45qykpaz9ip3y28zyly55fyf142yy4cy2yetfcycymytylo6y0wfvby5xy1cpvx3psyfcsypb6ytmqyv5psyfp6by9yeqzfn73ycqvyi15myioyfykyk69y6o229koy69wyegxyc6ye7mycyfyevy75gzyci331tyxywywm5fzy7j0gnqf1nyrqsjywgnqf1nywz1yzkyjqvj1vfc7y0fy7yzkyl96wy6yfekweoyfyz9ovy7cgs51y0fy7yzkyl9weo69yf6ooyfy6yz9o1zvqnjn73y0fy7yzkylaaayrtqgfmy7yrqsjyz9oqgnv3flny0fy7yzkylyfey6yk6yfoweoy69yz9om5fyzkyly4ymy3vy3y9smyoiypy3clyso3ytjygzayppyypy7cay24ep6pyy8yhwy4ymy4pvymy8ymymy4cy36yoy1yly0y2ay4yz9ocvy7y0ts5gqnyzkyl2yz9ocvy7y0qvj1vfc7fy7yzkyl96wy6yfekweoyfyz9ocqzfy7yzkyly4ymy3vy3y9smyoiypy3clyso3ytjygzayppyypy7cay24ep6pyy8yhwy4ymy4pvymy8ymymy4cy36yoy1yly0y2ay4yevtyin43gvycyzyky2yz99qs7xfcy37y7n4yz99yzkymwyzykyl

Resource

win10v2004-20260911-en

windows10-2004-x64

19 signatures

150 seconds

discovery

Report Analysis Logs

General

Target
https://9.stg.html-load.com/session/un4/h6a/ni8/4gz/www.scribd.com/otg/qwhvi331tyxywywvy7qzfqbyrcyry7s5mznqzfqbyr7n3ywvqzbyntvyczyevfycyoy8syp6myyytykvsyhyyypyyysaayiby19v8yvsy9l6txlafy9ys1cyfm76iparzytpayvbc6y9ymy8yl6y0yfyopyympaylyv13fyy4yhygcy4yhymy248ygi3wygy3ymy97cymcyosymayay3yma88y2y5syoygy6ylky4ymmy5yi8bbyayl7ykpy8ymuy7rpyzcyjyay7omyjyyy7mpsuf0ymsykytmyp9esgk7yjsvy553aqay6y04yg7y1y9y41ylvpsyhyg05y4a1inysrbzy9yicyl1p3y10pybuuy8y1m37bcpymxeyig7yjy4vylymp60p30y0ymy3srp6ypy0yhoyoysyi4t3nykqvymwyly3yhy7xykyat9yop3y25yyoxy3ytpa6cy3ysc12y15yoyjy7pyqkgy5xpsgyyypyip3y4p6rvkylcy1y39fy7yyy8yky0y1y9yhbag5ymyfbp6jumwey3owy7qyu3p31psuvymymbylzy4y1yuf3fyopagyksygyazylapyy6yktyarygpy3kyku3rgy7p392yop6pvqaly6lysy4qyjyay2yoy29psopapvtgy0wmgky4yljyfy0yfyyy6y5zykf6pap6yfyjp6yoy6ylmy1paps7gy9lyjgyap6y6yiy261p6p3ygqypyy7payayv8v8rymltkypv9y2y9u8p3nqkyu5p3yuy8pvyfy6p62ymy34p6wpvy8ylsyypypve0y7o50yay4yoysjey8kpvygeyjy2fzp3tyfc7yfyvysyvyhypa07a0pvykxy5iy0yvqt4vym9y5qyvc6yky4yiay5nml3wuqyamyyyaygyka2yjtymy46y7y1jz5yfyj6ymy9y2fymps6bxyafpavymysyysymyajy5y8y4f4yisy2oxypty9yhsy2ovyiysocyarypo4ym8cyayfy6y4m8ymnpa9y25sy2ykgaty9yhsy2o8mty9yhsy2y0yksty9yhsy26ykytysocyaby6cm8ymxa6y25sy2yiopaty9yhsy2y0onty9yhsy2oyiyity9yhsy22y0ity9yhsy2omgty9yhsy2y6psyvysocya9mv4ym8cyajcvsy2y0yinty9yhsy2y6yixty9yhsy2y0uyoty9yhsy2y0lyoty9yypvy2ayly8yoyly3y3cysy4y9ymyucy7ypcfyhcsyoymcy3yoymyoylsy1cy4yoymay3yoymcy3yoscymyhsc2ymy9y8yyky6ayg1pvb6jf3ytjygzay5cymmy4yvy7y4wy53flp3ygy3ysymyocytpvyoayay3yoaysymylymys8yly9yvpyp3yfcy5ymny3y5y4ausayhyhwop6ytpsym4p349ylymyayapyzpyy3gyg8ylyuypy3syh5u3ytjygzayppyypy7cay24ep6pyy8yhwyfymwyofymyky0y0y0y0y0y0y0y0y0y0y0yfy25y2y1bymy6cygyo6cp3y2y6ympyymqspaymcsymyiy2pvy2cy2qy2tiqy9ysymy48youy4ay5ry42y5upv0ytygy2y9y2gspsymucy28icpsyoy9ymymymymy2ymys0iy2y4cs4ypylq4ytygpv9ypubaysymys0ysymby8ymgyjxysyo6fymy9yly9ysymyasysymyayoysy9y3y3ymy9yevnyceyecqzfy7ycy4ymy3vy3y9smyoiypy3clyso3ytjygzayppyypy7cay24ep6pyy8yhwy4ymy4pvymy8ymymy4cy36yoy1yly0y2ay4ye75jyceyeqfy7ycyoymy9y8iay3ymy9yp6iky4pvkpvy6ylyle8bpayhy4y4y0yyp6kpyyfcyjyaxyvysrtyfnytyu49sy2fa4yoym6psy4y2jk9yvlyhyfy81ym8y7pyly2vy8yjy1vyyu5yt17y4p6spyykxgyayaqy9sykrymyipsykj9y9yf6rp6y3owyvpay8y7twy19ya4y9yipyv3z4yky50ysyhy8p6zyib9y6yy8gbp69ezy10pauy4ya5kyoy9y4tyjj8uym8vesly6y6yuy6yfgytoyuyy5ytap3p3p6ypyfwl2vyyjy6paylyje33yj7y8iyfymep3euymygyyysmyplq0p6yap3yp07xgy4y3ylbj56s3ry0yy4yhypyk9pv6y8y1xy9syy7yi2vylyh6gznzjg2arz10n3y5znbpyz33y2l4ys6yfyt8p6ey2yy9ljps3y1gy8ykp6y0y1ykryoyusb5eym0ypfyap68rpypyy7vxfyhy6wypyay20y45qykpaz9ip3y28zyly55fyf142yy4cy2yetfcycymytylo6y0wfvby5xy1cpvx3psyfcsypb6ytmqyv5psyfp6by9yeqzfn73ycqvyi15myioyfykyk69y6o229koy69wyegxyc6ye7mycyfyevy75gzyci331tyxywywm5fzy7j0gnqf1nyrqsjywgnqf1nywz1yzkyjqvj1vfc7y0fy7yzkyl96wy6yfekweoyfyz9ovy7cgs51y0fy7yzkyl9weo69yf6ooyfy6yz9o1zvqnjn73y0fy7yzkylaaayrtqgfmy7yrqsjyz9oqgnv3flny0fy7yzkylyfey6yk6yfoweoy69yz9om5fyzkyly4ymy3vy3y9smyoiypy3clyso3ytjygzayppyypy7cay24ep6pyy8yhwy4ymy4pvymy8ymymy4cy36yoy1yly0y2ay4yz9ocvy7y0ts5gqnyzkyl2yz9ocvy7y0qvj1vfc7fy7yzkyl96wy6yfekweoyfyz9ocqzfy7yzkyly4ymy3vy3y9smyoiypy3clyso3ytjygzayppyypy7cay24ep6pyy8yhwy4ymy4pvymy8ymymy4cy36yoy1yly0y2ay4yevtyin43gvycyzyky2yz99qs7xfcy37y7n4yz99yzkymwyzykyl
Sample260929-p2efmsst4p

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
105	376	msedge.exe

Executes dropped EXE 5 IoCs

pid	Process
5020	GuideFinderSetup.exe
5768	7za.exe
5288	GuideFinderSetup.exe
6044	uninstall.exe
2408	Un.exe

Loads dropped DLL 9 IoCs

pid	Process
5020	GuideFinderSetup.exe
5020	GuideFinderSetup.exe
5020	GuideFinderSetup.exe
5020	GuideFinderSetup.exe
5020	GuideFinderSetup.exe
5288	GuideFinderSetup.exe
5288	GuideFinderSetup.exe
5288	GuideFinderSetup.exe
2408	Un.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Ark\bin\data\locale\oc\kf6_entry.desktop	7za.exe
File created	C:\Program Files\Ark\bin\data\locale\sc\LC_MESSAGES\iso_639_3.mo	7za.exe
File created	C:\Program Files\Ark\bin\QtQuick\Controls\FluentWinUI3\dark\images\[email protected]	7za.exe
File opened for modification	C:\Program Files\Ark\share\locale\ga	7za.exe
File opened for modification	C:\Program Files\Ark\bin\data\locale\fa\LC_MESSAGES\kcompletion6_qt.qm	7za.exe
File created	C:\Program Files\Ark\bin\data\locale\ms\LC_MESSAGES\solid6_qt.qm	7za.exe
File created	C:\Program Files\Ark\libexec\gpg-preset-passphrase.exe	7za.exe
File created	C:\Program Files\Ark\bin\data\locale\be@latin\LC_MESSAGES\kwidgetsaddons6_qt.qm	7za.exe
File opened for modification	C:\Program Files\Ark\bin\data\locale\de\LC_MESSAGES\iso_639-5.mo	7za.exe
File created	C:\Program Files\Ark\bin\data\locale\et\LC_MESSAGES\kconfig6_qt.qm	7za.exe
File created	C:\Program Files\Ark\bin\data\locale\sl\LC_MESSAGES\kconfig6_qt.qm	7za.exe
File opened for modification	C:\Program Files\Ark\bin\data\locale\sr@ijekavian\LC_MESSAGES\kjobwidgets6_qt.qm	7za.exe
File created	C:\Program Files\Ark\bin\QtQuick\Controls\FluentWinUI3\dark\images\[email protected]	7za.exe
File created	C:\Program Files\Ark\bin\QtQuick\Controls\FluentWinUI3\light\images\[email protected]	7za.exe
File opened for modification	C:\Program Files\Ark\share\locale\ab\LC_MESSAGES\glib20.mo	7za.exe
File opened for modification	C:\Program Files\Ark\bin\QtQuick\Controls\FluentWinUI3\light\images\[email protected]	7za.exe
File opened for modification	C:\Program Files\Ark\bin\icutest.dll	7za.exe
File opened for modification	C:\Program Files\Ark\bin\Qt\labs\StyleKit\impl\labsstylekitimplplugin.dll	7za.exe
File opened for modification	C:\Program Files\Ark\bin\data\locale\kn\LC_MESSAGES\kcompletion6_qt.qm	7za.exe
File created	C:\Program Files\Ark\bin\data\locale\mn\LC_MESSAGES\iso_4217.mo	7za.exe
File created	C:\Program Files\Ark\bin\QtQuick\NativeStyle\controls\DefaultDial.qml	7za.exe
File opened for modification	C:\Program Files\Ark\bin\data\locale\ga\LC_MESSAGES\solid6_qt.qm	7za.exe
File created	C:\Program Files\Ark\bin\asprintf-0.dll	7za.exe
File opened for modification	C:\Program Files\Ark\bin\data\locale\ha\LC_MESSAGES\kservice6.mo	7za.exe
File created	C:\Program Files\Ark\bin\data\locale\tr\LC_MESSAGES\solid6_qt.qm	7za.exe
File opened for modification	C:\Program Files\Ark\bin\Qt\labs\StyleKit\ProgressBar.qml	7za.exe
File created	C:\Program Files\Ark\bin\QtQuick\Controls\Fusion\ToolSeparator.qml	7za.exe
File opened for modification	C:\Program Files\Ark\bin\girepository-2.0-0.dll	7za.exe
File created	C:\Program Files\Ark\bin\mpicalc.exe	7za.exe
File opened for modification	C:\Program Files\Ark\bin\data\locale\bn_IN\LC_MESSAGES	7za.exe
File opened for modification	C:\Program Files\Ark\bin\data\iso-codes\json\schema-3166-3.json	7za.exe
File opened for modification	C:\Program Files\Ark\bin\data\locale\be@latin\LC_MESSAGES\kwidgetsaddons6_qt.qm	7za.exe
File created	C:\Program Files\Ark\bin\data\locale\ve\LC_MESSAGES\iso_3166_2.mo	7za.exe
File opened for modification	C:\Program Files\Ark\bin\QtQuick\Dialogs\quickimpl\qml\+Fusion\FileDialog.qml	7za.exe
File opened for modification	C:\Program Files\Ark\share\qt6\wayland\protocols\fractional-scale\fractional-scale-v1.xml	7za.exe
File opened for modification	C:\Program Files\Ark\bin\data\locale\es\LC_MESSAGES\iso_3166-3.mo	7za.exe
File opened for modification	C:\Program Files\Ark\bin\data\locale\fr\LC_MESSAGES\kitemviews6_qt.qm	7za.exe
File opened for modification	C:\Program Files\Ark\bin\data\locale\lb\LC_MESSAGES\ki18n6.mo	7za.exe
File opened for modification	C:\Program Files\Ark\share\poppler\cMap\Adobe-Japan1\Adobe-Japan1-H-Host	7za.exe
File created	C:\Program Files\Ark\share\vpl\examples\api2x\hello-encode\CMakeLists.txt	7za.exe
File created	C:\Program Files\Ark\bin\brotlienc.dll	7za.exe
File created	C:\Program Files\Ark\bin\data\locale\fa\LC_MESSAGES\iso_3166-1.mo	7za.exe
File opened for modification	C:\Program Files\Ark\bin\data\locale\fr\LC_MESSAGES\libgpg-error.mo	7za.exe
File opened for modification	C:\Program Files\Ark\bin\data\locale\nn\LC_MESSAGES\kiconthemes6.mo	7za.exe
File opened for modification	C:\Program Files\Ark\bin\data\locale\gu\LC_MESSAGES\kcompletion6_qt.qm	7za.exe
File created	C:\Program Files\Ark\bin\data\locale\si\LC_MESSAGES\kcoreaddons6_qt.qm	7za.exe
File created	C:\Program Files\Ark\bin\data\locale\tig\LC_MESSAGES\iso_639_3.mo	7za.exe
File opened for modification	C:\Program Files\Ark\bin\data\locale\tt\LC_MESSAGES\kitemviews6_qt.qm	7za.exe
File opened for modification	C:\Program Files\Ark\bin\data\locale\lo\LC_MESSAGES\iso_3166.mo	7za.exe
File opened for modification	C:\Program Files\Ark\bin\data\locale\pa\LC_MESSAGES\kconfig6_qt.qm	7za.exe
File opened for modification	C:\Program Files\Ark\bin\data\locale\sq\LC_MESSAGES\kdoctools6.mo	7za.exe
File created	C:\Program Files\Ark\bin\QtQuick\Controls\FluentWinUI3\light\images\[email protected]	7za.exe
File created	C:\Program Files\Ark\bin\QtQuick\Controls\Imagine\GroupBox.qml	7za.exe
File opened for modification	C:\Program Files\Ark\bin\data\locale\or	7za.exe
File created	C:\Program Files\Ark\bin\data\kf6\searchproviders\google_code.desktop	7za.exe
File created	C:\Program Files\Ark\bin\data\locale\fr\LC_MESSAGES\iso_639-2.mo	7za.exe
File created	C:\Program Files\Ark\bin\data\locale\gd\LC_MESSAGES\solid6_qt.qm	7za.exe
File opened for modification	C:\Program Files\Ark\bin\data\locale\mr\LC_MESSAGES\kjobwidgets6_qt.qm	7za.exe
File created	C:\Program Files\Ark\bin\data\locale\se\LC_MESSAGES\kconfigwidgets6.mo	7za.exe
File created	C:\Program Files\Ark\bin\data\locale\sl\LC_MESSAGES\gettext-tools.mo	7za.exe
File opened for modification	C:\Program Files\Ark\share\poppler\cMap\Adobe-GB1\Adobe-GB1-H-Host	7za.exe
File opened for modification	C:\Program Files\Ark\bin\data\locale\ga\LC_MESSAGES\kio6.mo	7za.exe
File opened for modification	C:\Program Files\Ark\bin\data\locale\uz\LC_MESSAGES\kparts6.mo	7za.exe
File created	C:\Program Files\Ark\bin\org\kde\config\qmldir	7za.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Un.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GuideFinderSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GuideFinderSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uninstall.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
376	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-240542094-4193773837-3211495583-1000\{98E315B1-40E9-46B0-9141-40DE2F8FDA2F}	msedge.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1988	msedge.exe
1988	msedge.exe
5656	mspaint.exe
5656	mspaint.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeRestorePrivilege	5768	7za.exe
Token: 35	5768	7za.exe
Token: SeSecurityPrivilege	5768	7za.exe
Token: SeSecurityPrivilege	5768	7za.exe

Suspicious use of FindShellTrayWindow 44 IoCs

pid	Process
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
5656	mspaint.exe
5656	mspaint.exe
5656	mspaint.exe
5656	mspaint.exe

Suspicious use of WriteProcessMemory 45 IoCs

description	pid	Process	procid_target
PID 4764 wrote to memory of 5008	4764	msedge.exe	85
PID 4764 wrote to memory of 376	4764	msedge.exe	86
PID 4764 wrote to memory of 1152	4764	msedge.exe	87
PID 4764 wrote to memory of 1928	4764	msedge.exe	88
PID 4764 wrote to memory of 1152	4764	msedge.exe	87
PID 4764 wrote to memory of 1152	4764	msedge.exe	87
PID 4764 wrote to memory of 1928	4764	msedge.exe	88
PID 4764 wrote to memory of 3288	4764	msedge.exe	89
PID 4764 wrote to memory of 3288	4764	msedge.exe	89
PID 4764 wrote to memory of 4508	4764	msedge.exe	90
PID 4764 wrote to memory of 3288	4764	msedge.exe	89
PID 4764 wrote to memory of 4508	4764	msedge.exe	90
PID 4764 wrote to memory of 4508	4764	msedge.exe	90
PID 4764 wrote to memory of 3808	4764	msedge.exe	91
PID 4764 wrote to memory of 4888	4764	msedge.exe	92
PID 4764 wrote to memory of 3808	4764	msedge.exe	91
PID 4764 wrote to memory of 3808	4764	msedge.exe	91
PID 4764 wrote to memory of 4888	4764	msedge.exe	92
PID 4764 wrote to memory of 4888	4764	msedge.exe	92
PID 4764 wrote to memory of 1760	4764	msedge.exe	98
PID 4764 wrote to memory of 1760	4764	msedge.exe	98
PID 4764 wrote to memory of 1760	4764	msedge.exe	98
PID 4764 wrote to memory of 4404	4764	msedge.exe	99
PID 4764 wrote to memory of 2324	4764	msedge.exe	100
PID 4764 wrote to memory of 4404	4764	msedge.exe	99
PID 4764 wrote to memory of 2324	4764	msedge.exe	100
PID 4764 wrote to memory of 2644	4764	msedge.exe	105
PID 4764 wrote to memory of 1872	4764	msedge.exe	110
PID 4764 wrote to memory of 1872	4764	msedge.exe	110
PID 4764 wrote to memory of 1872	4764	msedge.exe	110
PID 4764 wrote to memory of 3744	4764	msedge.exe	111
PID 4764 wrote to memory of 2720	4764	msedge.exe	112
PID 4764 wrote to memory of 3744	4764	msedge.exe	111
PID 4764 wrote to memory of 2720	4764	msedge.exe	112
PID 4764 wrote to memory of 2720	4764	msedge.exe	112
PID 4764 wrote to memory of 3172	4764	msedge.exe	114
PID 4764 wrote to memory of 4800	4764	msedge.exe	118
PID 4764 wrote to memory of 2364	4764	msedge.exe	119
PID 4764 wrote to memory of 4240	4764	msedge.exe	120
PID 4764 wrote to memory of 5020	4764	msedge.exe	122
PID 5020 wrote to memory of 5768	5020	GuideFinderSetup.exe	130
PID 4764 wrote to memory of 5796	4764	msedge.exe	132
PID 4764 wrote to memory of 5796	4764	msedge.exe	132
PID 4764 wrote to memory of 1988	4764	msedge.exe	140
PID 6044 wrote to memory of 2408	6044	uninstall.exe	153

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://9.stg.html-load.com/session/un4/h6a/ni8/4gz/www.scribd.com/otg/qwhvi331tyxywywvy7qzfqbyrcyry7s5mznqzfqbyr7n3ywvqzbyntvyczyevfycyoy8syp6myyytykvsyhyyypyyysaayiby19v8yvsy9l6txlafy9ys1cyfm76iparzytpayvbc6y9ymy8yl6y0yfyopyympaylyv13fyy4yhygcy4yhymy248ygi3wygy3ymy97cymcyosymayay3yma88y2y5syoygy6ylky4ymmy5yi8bbyayl7ykpy8ymuy7rpyzcyjyay7omyjyyy7mpsuf0ymsykytmyp9esgk7yjsvy553aqay6y04yg7y1y9y41ylvpsyhyg05y4a1inysrbzy9yicyl1p3y10pybuuy8y1m37bcpymxeyig7yjy4vylymp60p30y0ymy3srp6ypy0yhoyoysyi4t3nykqvymwyly3yhy7xykyat9yop3y25yyoxy3ytpa6cy3ysc12y15yoyjy7pyqkgy5xpsgyyypyip3y4p6rvkylcy1y39fy7yyy8yky0y1y9yhbag5ymyfbp6jumwey3owy7qyu3p31psuvymymbylzy4y1yuf3fyopagyksygyazylapyy6yktyarygpy3kyku3rgy7p392yop6pvqaly6lysy4qyjyay2yoy29psopapvtgy0wmgky4yljyfy0yfyyy6y5zykf6pap6yfyjp6yoy6ylmy1paps7gy9lyjgyap6y6yiy261p6p3ygqypyy7payayv8v8rymltkypv9y2y9u8p3nqkyu5p3yuy8pvyfy6p62ymy34p6wpvy8ylsyypypve0y7o50yay4yoysjey8kpvygeyjy2fzp3tyfc7yfyvysyvyhypa07a0pvykxy5iy0yvqt4vym9y5qyvc6yky4yiay5nml3wuqyamyyyaygyka2yjtymy46y7y1jz5yfyj6ymy9y2fymps6bxyafpavymysyysymyajy5y8y4f4yisy2oxypty9yhsy2ovyiysocyarypo4ym8cyayfy6y4m8ymnpa9y25sy2ykgaty9yhsy2o8mty9yhsy2y0yksty9yhsy26ykytysocyaby6cm8ymxa6y25sy2yiopaty9yhsy2y0onty9yhsy2oyiyity9yhsy22y0ity9yhsy2omgty9yhsy2y6psyvysocya9mv4ym8cyajcvsy2y0yinty9yhsy2y6yixty9yhsy2y0uyoty9yhsy2y0lyoty9yypvy2ayly8yoyly3y3cysy4y9ymyucy7ypcfyhcsyoymcy3yoymyoylsy1cy4yoymay3yoymcy3yoscymyhsc2ymy9y8yyky6ayg1pvb6jf3ytjygzay5cymmy4yvy7y4wy53flp3ygy3ysymyocytpvyoayay3yoaysymylymys8yly9yvpyp3yfcy5ymny3y5y4ausayhyhwop6ytpsym4p349ylymyayapyzpyy3gyg8ylyuypy3syh5u3ytjygzayppyypy7cay24ep6pyy8yhwyfymwyofymyky0y0y0y0y0y0y0y0y0y0y0yfy25y2y1bymy6cygyo6cp3y2y6ympyymqspaymcsymyiy2pvy2cy2qy2tiqy9ysymy48youy4ay5ry42y5upv0ytygy2y9y2gspsymucy28icpsyoy9ymymymymy2ymys0iy2y4cs4ypylq4ytygpv9ypubaysymys0ysymby8ymgyjxysyo6fymy9yly9ysymyasysymyayoysy9y3y3ymy9yevnyceyecqzfy7ycy4ymy3vy3y9smyoiypy3clyso3ytjygzayppyypy7cay24ep6pyy8yhwy4ymy4pvymy8ymymy4cy36yoy1yly0y2ay4ye75jyceyeqfy7ycyoymy9y8iay3ymy9yp6iky4pvkpvy6ylyle8bpayhy4y4y0yyp6kpyyfcyjyaxyvysrtyfnytyu49sy2fa4yoym6psy4y2jk9yvlyhyfy81ym8y7pyly2vy8yjy1vyyu5yt17y4p6spyykxgyayaqy9sykrymyipsykj9y9yf6rp6y3owyvpay8y7twy19ya4y9yipyv3z4yky50ysyhy8p6zyib9y6yy8gbp69ezy10pauy4ya5kyoy9y4tyjj8uym8vesly6y6yuy6yfgytoyuyy5ytap3p3p6ypyfwl2vyyjy6paylyje33yj7y8iyfymep3euymygyyysmyplq0p6yap3yp07xgy4y3ylbj56s3ry0yy4yhypyk9pv6y8y1xy9syy7yi2vylyh6gznzjg2arz10n3y5znbpyz33y2l4ys6yfyt8p6ey2yy9ljps3y1gy8ykp6y0y1ykryoyusb5eym0ypfyap68rpypyy7vxfyhy6wypyay20y45qykpaz9ip3y28zyly55fyf142yy4cy2yetfcycymytylo6y0wfvby5xy1cpvx3psyfcsypb6ytmqyv5psyfp6by9yeqzfn73ycqvyi15myioyfykyk69y6o229koy69wyegxyc6ye7mycyfyevy75gzyci331tyxywywm5fzy7j0gnqf1nyrqsjywgnqf1nywz1yzkyjqvj1vfc7y0fy7yzkyl96wy6yfekweoyfyz9ovy7cgs51y0fy7yzkyl9weo69yf6ooyfy6yz9o1zvqnjn73y0fy7yzkylaaayrtqgfmy7yrqsjyz9oqgnv3flny0fy7yzkylyfey6yk6yfoweoy69yz9om5fyzkyly4ymy3vy3y9smyoiypy3clyso3ytjygzayppyypy7cay24ep6pyy8yhwy4ymy4pvymy8ymymy4cy36yoy1yly0y2ay4yz9ocvy7y0ts5gqnyzkyl2yz9ocvy7y0qvj1vfc7fy7yzkyl96wy6yfekweoyfyz9ocqzfy7yzkyly4ymy3vy3y9smyoiypy3clyso3ytjygzayppyypy7cay24ep6pyy8yhwy4ymy4pvymy8ymymy4cy36yoy1yly0y2ay4yevtyin43gvycyzyky2yz99qs7xfcy37y7n4yz99yzkymwyzykyl
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7fff704bc188,0x7fff704bc194,0x7fff704bc1a0
  2⤵
  PID:5008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1800,i,17922725772843863836,1443234412751295021,524288 --field-trial-handle=2344,i,663136691667267328,1691319755502815220,262144 --variations-seed-version --mojo-platform-channel-handle=2928 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1892,i,1191887181926544972,8829378223354680308,262144 --field-trial-handle=2344,i,663136691667267328,1691319755502815220,262144 --variations-seed-version --mojo-platform-channel-handle=2348 /prefetch:2
  2⤵
  PID:1152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2360,i,6358912359912051795,1343582286976643329,524288 --field-trial-handle=2344,i,663136691667267328,1691319755502815220,262144 --variations-seed-version --mojo-platform-channel-handle=2936 /prefetch:8
  2⤵
  PID:1928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3440,i,5185173370766542518,5179563476547978093,2097152 --field-trial-handle=2344,i,663136691667267328,1691319755502815220,262144 --variations-seed-version --mojo-platform-channel-handle=3448 /prefetch:1
  2⤵
  PID:3288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3456,i,14425386134120127641,15192703612153894011,2097152 --field-trial-handle=2344,i,663136691667267328,1691319755502815220,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:4508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4120,i,9913609541699436316,17691498113424202075,2097152 --field-trial-handle=2344,i,663136691667267328,1691319755502815220,262144 --variations-seed-version --mojo-platform-channel-handle=4132 /prefetch:1
  2⤵
  PID:3808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4152,i,1733626818003757427,12129215194058376759,2097152 --field-trial-handle=2344,i,663136691667267328,1691319755502815220,262144 --variations-seed-version --mojo-platform-channel-handle=4172 /prefetch:2
  2⤵
  PID:4888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5080,i,12957447272088037271,13531038532959646890,2097152 --field-trial-handle=2344,i,663136691667267328,1691319755502815220,262144 --variations-seed-version --mojo-platform-channel-handle=5100 /prefetch:1
  2⤵
  PID:1760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5268,i,17742137255279433075,5090600922970633782,524288 --field-trial-handle=2344,i,663136691667267328,1691319755502815220,262144 --variations-seed-version --mojo-platform-channel-handle=5320 /prefetch:8
  2⤵
  PID:4404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5220,i,7273612739365986379,11845111059130782016,524288 --field-trial-handle=2344,i,663136691667267328,1691319755502815220,262144 --variations-seed-version --mojo-platform-channel-handle=5296 /prefetch:8
  2⤵
  PID:2324
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5872,i,8151548844169524727,5461308492689161729,524288 --field-trial-handle=2344,i,663136691667267328,1691319755502815220,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:8
  2⤵
  PID:2424
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5872,i,8151548844169524727,5461308492689161729,524288 --field-trial-handle=2344,i,663136691667267328,1691319755502815220,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:8
  2⤵
  PID:2644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6216,i,17125285869744959907,17250819749000464757,2097152 --field-trial-handle=2344,i,663136691667267328,1691319755502815220,262144 --variations-seed-version --mojo-platform-channel-handle=6212 /prefetch:1
  2⤵
  PID:1872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5104,i,6251207665443954419,479799136382640161,524288 --field-trial-handle=2344,i,663136691667267328,1691319755502815220,262144 --variations-seed-version --mojo-platform-channel-handle=6432 /prefetch:8
  2⤵
  PID:3744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=5116,i,16409449034287719218,5606322609183468513,2097152 --field-trial-handle=2344,i,663136691667267328,1691319755502815220,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:1
  2⤵
  PID:2720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6836,i,16736490175196767521,1924191466295243681,524288 --field-trial-handle=2344,i,663136691667267328,1691319755502815220,262144 --variations-seed-version --mojo-platform-channel-handle=5080 /prefetch:8
  2⤵
  PID:3172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=116,i,10847092768746994019,840050257068372402,524288 --field-trial-handle=2344,i,663136691667267328,1691319755502815220,262144 --variations-seed-version --mojo-platform-channel-handle=5976 /prefetch:8
  2⤵
  PID:4800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5916,i,17347477649868260390,6029683762889431859,524288 --field-trial-handle=2344,i,663136691667267328,1691319755502815220,262144 --variations-seed-version --mojo-platform-channel-handle=560 /prefetch:8
  2⤵
  PID:2364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5920,i,15545028130180322506,17031422166100814896,524288 --field-trial-handle=2344,i,663136691667267328,1691319755502815220,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:8
  2⤵
  PID:4240
- C:\Users\Admin\Downloads\GuideFinderSetup.exe
  "C:\Users\Admin\Downloads\GuideFinderSetup.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5020
- - C:\Program Files\Ark\7za.exe
    "C:\Program Files\Ark\7za.exe" x -r -y "C:\Program Files\Ark\ark-release_26.04-2592-windows-cl-msvc2022-x86_64.7z" -o"C:\Program Files\Ark"
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - Suspicious use of AdjustPrivilegeToken
    PID:5768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6496,i,1231482652660782131,5456211856360108510,524288 --field-trial-handle=2344,i,663136691667267328,1691319755502815220,262144 --variations-seed-version --mojo-platform-channel-handle=6648 /prefetch:8
  2⤵
  PID:5796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7128,i,5939984270754610967,14646713766783674684,262144 --field-trial-handle=2344,i,663136691667267328,1691319755502815220,262144 --variations-seed-version --mojo-platform-channel-handle=7140 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1988

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3992

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5664

C:\Users\Admin\Downloads\GuideFinderSetup.exe
"C:\Users\Admin\Downloads\GuideFinderSetup.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:5288

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Program Files\Ark\craft.ico"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:5656

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
PID:5628

C:\Program Files\Ark\uninstall.exe
"C:\Program Files\Ark\uninstall.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6044
- C:\Users\Admin\AppData\Local\Temp\~nsu1.tmp\Un.exe
  "C:\Users\Admin\AppData\Local\Temp\~nsu1.tmp\Un.exe" _?=C:\Program Files\Ark\
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2408

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7za.exe

Path C:\Program Files\Ark\7za.exe
Size 1.3MB
SHA256 ba1257afc94509c62d211609b0ccdd0444a02ae3e8e6f5d2d0cd4d1658c57811
MD5 23bd0f61c3cb67f35952c9248a534e83
SHA1 8e5f5e7183cbca065f01e9c6accb53e604c42a40
SHA512 c25d1093982d2aef3e1bf360676af10ffe6329fad768b54337ce9ede2f8d0534ba9aa26c53958385c3f50fca3a59eddfef7a2c8e8616f50c5a7aa7488d3f3c95
SSDEEP 24576:9flhaJP/Hp18iHvgtFhRhABfzXRZ3bBWI7Lf26:9raJ3HpaiHE0f3bH
TLSH
T1F5552A66F9748275D0B3C0BAC6D29B9AEE713085173096C74289C76C3F17BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

combobox-background.png

Path C:\Program Files\Ark\bin\QtQuick\Controls\FluentWinUI3\dark\images\combobox-background.png
Size 310B
SHA256 4a094c584b7e0dc23291d778861ead37d087ef0e43574e8d43bae27239648298
MD5 363b737d758196d26bc9a43d3230b36d
SHA1 2d82a3dc128168bae89f1ebec712739df0299260
SHA512 c1c9566e0692733b0d24af5420edebd965fed9959370b331615384e7b961ad7076d914169054d857ebf7b3b0f484d1bcf5400c3f98637afbfa7189fb40123bea
TLSH
T176E02BC1F2404C6AE44D713AC56ED0C1FC614E39DD1F4068963939AD4B35B09C248999
MD5 SHA1 SHA512 TLSH

Submit Download