xworm | 6001832efcbd72550f2260533a2da63a28265979af180b60d80cfbbf917d99f6

Analysis

geolocation tags

asiadelhiinindia
user interaction
yes
max time kernel
290s
max time network
364s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
17/10/2026, 21:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
MvDlpOti.html
Size 3KB
Sample261017-1d9gnady21
SHA256 6001832efcbd72550f2260533a2da63a28265979af180b60d80cfbbf917d99f6
MD5 bee2ecad568cca3bbba7dcb9f3ced48b
SHA1 927852d4fc04ce2952187f54179d0f651be57179
SHA512 b759f1f046960c2c9bc20b1f874fadaf76ec9caa7321fcb0bcaf5ffe7b7a7828a84ca4b7d3a0030c08aa20966fe2394fc071b5b1b5de0ae938043b8a2b96ca1b
TLSH
T1656142038840C8279165A3347AD2F508CA68D183D35DADA9B29E119E5AC7FA1C7F72F5
MD5 SHA1 SHA512 TLSH

Score

10^/10

defense_evasion discovery execution xworm persistence privilege_escalation ransomware rat trojan

Malware Config

Extracted

Family

xworm

Version

XWorm V6.0 | @PakReverseLab

185.234.75.68:49752

Attributes

Install_directory
%AppData%
install_file
Xclient.exe
localhost
127.0.0.1

Signatures

Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral1/files/0x00050000000238f9-351.dat	family_xworm
behavioral1/memory/1632-359-0x0000000000C00000-0x0000000000C16000-memory.dmp	family_xworm

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Control Panel\International\Geo\Nation	st-setup-1.8.40.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Control Panel\International\Geo\Nation	stem.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Control Panel\International\Geo\Nation	63h 2.exe

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xclient.lnk	stem.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xclient.lnk	stem.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 4 IoCs

pid	Process
1260	st-setup-1.8.40.exe
1632	stem.exe
3508	st-setup-1.8.30.exe
1448	63h 2.exe

Loads dropped DLL 3 IoCs

pid	Process
3508	st-setup-1.8.30.exe
3508	st-setup-1.8.30.exe
3508	st-setup-1.8.30.exe

Modifies system executable filetype association 2 TTPs 34 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\print\command	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\runasuser	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shellex\ContextMenuHandlers	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\DefaultIcon	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runas\command	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\DropHandler	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\print	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shellex\{8895b1c6-b41f-4c1c-a562-0d564250836f}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\DefaultIcon	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\edit\command	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shellex	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runasuser\command	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\ContextMenuHandlers\Compatibility	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\edit	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\ContextMenuHandlers	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\runas\command	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\runas	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shellex\DropHandler	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runas	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runasuser	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\runasuser\command	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shellex\ContextMenuHandlers\Compatibility	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\ContextMenuHandlers\PintoStartScreen	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shellex\DropHandler	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\DefaultIcon	reg.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
137	api.gofile.io
133	api.gofile.io

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
144	ip-api.com

Enumerates video capture drivers 2 TTPs 1 IoCs

Queries the legacy Video for Windows capture drivers. This is commonly abused by RATs to check for available webcams on the system before reporting to their C2.

discovery defense_evasion

Peripheral Device Discovery

T1120

Video Capture

T1125

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32\msvideo9	stem.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4908	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	stem.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	stem.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2772	msedge.exe
5008	chrome.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5512D110-5CC6-11CF-8D67-00AA00BDCE1D}\MiscStatus	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\CLSID\{CAFEEFAC-0018-0000-0152-ABCDEFFEDCBC}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063076-0000-0000-C000-000000000046}\TypeLib	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000C0341-0000-0000-C000-000000000046}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3834F60F-EE8C-455D-A441-D766675D6D3B}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.MOD\ShellEx\{e357fccd-a995-4576-b01f-234630154e96}	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\CLSID\{CAFEEFAC-0017-0000-0059-ABCDEFFEDCBC}\InprocServer32	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\CLSID\{CAFEEFAC-0017-0000-0192-ABCDEFFEDCBC}\InprocServer32	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{f414c261-6ac0-11cf-b6d1-00aa00bbbb58}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Excel.SheetBinaryMacroEnabled.12\shell\OpenAsReadOnly	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Extensions\ContractId\Windows.BackgroundTasks\PackageId\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\ActivatableClassId\Microsoft.MSPaint.AppXsv2dcpk8benyqtwsxk6vqhkfqwjz2x3q.mca\C	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00020872-0000-0000-C000-000000000046}\TypeLib	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{51973C16-CB0C-11D0-B5C9-00A0244A0E7A}\ProxyStubClsid32	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\CLSID\{47E6DCAF-41F8-441C-BD0E-A50D5FE6C4D1}\ProgID	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\CLSID\{CAFEEFAC-0017-0000-0365-ABCDEFFEDCBC}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Excel.SheetBinaryMacroEnabled.12\Protocol\StdFileEditing\RequestDataFormats	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Extensions\ContractId\Windows.Launch\PackageId\E2A4F912-2574-4A75-9BB0-0D023378592B_10.0.19041.1023_neutral_neutral_cw5n1h2txyewy\ActivatableClassId	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.p7c	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\CLSID\{CAFEEFAC-0016-0000-0084-ABCDEFFEDCBA}\InprocServer32	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\cmdfile\shellex\{8895b1c6-b41f-4c1c-a562-0d564250836f}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000244B1-0000-0000-C000-000000000046}\TypeLib	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3050F6DC-98B5-11CF-BB82-00AA00BDCE0B}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{10072CEC-8CC1-11D1-986E-00A0C955B42E}\Implemented Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4}	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\CLSID\{CAFEEFAC-0018-0000-0192-ABCDEFFEDCBA}\InprocServer32	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00020867-0000-0000-C000-000000000046}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0002447F-0000-0000-C000-000000000046}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630FF-0000-0000-C000-000000000046}\TypeLib	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0199568A-F46D-4B53-99F6-F637E08314B2}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{51973C12-CB0C-11D0-B5C9-00A0244A0E7A}	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\CLSID\{CAFEEFAC-0015-0000-0021-ABCDEFFEDCBC}\InprocServer32	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\CLSID\{CAFEEFAC-0015-0000-0041-ABCDEFFEDCBB}\InprocServer32	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\CLSID\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBB}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{70dba485-cd56-4f15-9f82-86b1460e09a8}	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\CLSID\{CAFEEFAC-0014-0002-0099-ABCDEFFEDCBB}\InprocServer32	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\CLSID\{CAFEEFAC-0017-0000-0219-ABCDEFFEDCBB}\InprocServer32	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\DataCtl.DataCtl\CurVer	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8A624388-AA27-43e0-89F8-2A12BFF7BCCD}\DataFormats\GetSet	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\CLSID\{CAFEEFAC-0013-0001-0039-ABCDEFFEDCBA}	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\CLSID\{CAFEEFAC-0016-0000-0125-ABCDEFFEDCBA}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000244BB-0000-0000-C000-000000000046}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4A5AF829-CA32-4B01-AAE4-4C53D260E75C}\ProxyStubClsid32	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{720D4AC0-7533-11D0-A5D6-28DB04C10000}\InprocServer32	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\CLSID\{CAFEEFAC-0016-0000-0117-ABCDEFFEDCBC}	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\CLSID\{CAFEEFAC-0018-0000-0171-ABCDEFFEDCBB}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00020A01-0000-0000-C000-000000000046}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006302B-0000-0000-C000-000000000046}\ProxyStubClsid32	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\AFormAut.App.1\CLSID	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630B1-0000-0000-C000-000000000046}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630C8-0000-0000-C000-000000000046}\ProxyStubClsid32	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0002E187-0000-0000-C000-000000000046}	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\CLSID\{CAFEEFAC-0016-0000-0162-ABCDEFFEDCBA}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{305106ED-98B5-11CF-BB82-00AA00BDCE0B}	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\CLSID\{CAFEEFAC-0016-0000-0122-ABCDEFFEDCBA}\InprocServer32	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\CLSID\{CAFEEFAC-0016-0000-0203-ABCDEFFEDCBA}\InprocServer32	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\CLSID\{CAFEEFAC-0017-0000-0389-ABCDEFFEDCBA}	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\CLSID\{CAFEEFAC-0018-0000-0128-ABCDEFFEDCBC}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F8CF7A98-2C45-4c8d-9151-2D716989DDAB}\EnableFullPage\.vst	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E6E137869FA5154CACEBDBFD35F2529\SourceList\Media	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063107-0000-0000-C000-000000000046}\TypeLib	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000C172A-0000-0000-C000-000000000046}\TypeLib	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\.erf	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\AcroExch.XDPDoc\DefaultIcon	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{00020900-0000-0000-C000-000000000046}\ProgID	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C100BEDB-D33A-4a4b-BF23-BBEF4663D017}\InProcServer32	reg.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4416	msedge.exe
4416	msedge.exe
5644	chrome.exe
5644	chrome.exe
1632	stem.exe
1632	stem.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeRestorePrivilege	2616	7zG.exe
Token: 35	2616	7zG.exe
Token: SeSecurityPrivilege	2616	7zG.exe
Token: SeSecurityPrivilege	2616	7zG.exe
Token: SeDebugPrivilege	1632	stem.exe
Token: SeDebugPrivilege	1632	stem.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
2616	7zG.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1632	stem.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 4648 wrote to memory of 5196	4648	msedge.exe	84
PID 4648 wrote to memory of 2772	4648	msedge.exe	85
PID 4648 wrote to memory of 2876	4648	msedge.exe	86
PID 4648 wrote to memory of 2876	4648	msedge.exe	86
PID 4648 wrote to memory of 2876	4648	msedge.exe	86
PID 4648 wrote to memory of 5040	4648	msedge.exe	87
PID 4648 wrote to memory of 5040	4648	msedge.exe	87
PID 4648 wrote to memory of 5744	4648	msedge.exe	89
PID 4648 wrote to memory of 2644	4648	msedge.exe	90
PID 4648 wrote to memory of 5744	4648	msedge.exe	89
PID 4648 wrote to memory of 5744	4648	msedge.exe	89
PID 4648 wrote to memory of 2644	4648	msedge.exe	90
PID 4648 wrote to memory of 2644	4648	msedge.exe	90
PID 4648 wrote to memory of 3676	4648	msedge.exe	93
PID 4648 wrote to memory of 3676	4648	msedge.exe	93
PID 4648 wrote to memory of 2832	4648	msedge.exe	94
PID 4648 wrote to memory of 2832	4648	msedge.exe	94
PID 4648 wrote to memory of 3972	4648	msedge.exe	96
PID 4648 wrote to memory of 5952	4648	msedge.exe	125
PID 4648 wrote to memory of 4436	4648	msedge.exe	126
PID 4648 wrote to memory of 4588	4648	msedge.exe	127
PID 4648 wrote to memory of 3616	4648	msedge.exe	139
PID 4648 wrote to memory of 3616	4648	msedge.exe	139
PID 4648 wrote to memory of 4068	4648	msedge.exe	140
PID 4648 wrote to memory of 4068	4648	msedge.exe	140
PID 4648 wrote to memory of 3228	4648	msedge.exe	143
PID 4648 wrote to memory of 3228	4648	msedge.exe	143
PID 4648 wrote to memory of 4416	4648	msedge.exe	144
PID 4648 wrote to memory of 3404	4648	msedge.exe	152
PID 4648 wrote to memory of 3404	4648	msedge.exe	152
PID 1260 wrote to memory of 1632	1260	st-setup-1.8.40.exe	153
PID 1260 wrote to memory of 3508	1260	st-setup-1.8.40.exe	154
PID 1632 wrote to memory of 1448	1632	stem.exe	158
PID 1448 wrote to memory of 4908	1448	63h 2.exe	160
PID 4908 wrote to memory of 6116	4908	cmd.exe	162

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\MvDlpOti.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x268,0x7ff8ae91c188,0x7ff8ae91c194,0x7ff8ae91c1a0
  2⤵
  PID:5196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1820,i,11299813447956485763,4300529661222741017,524288 --field-trial-handle=2276,i,17868032840691979084,17810575120204682830,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1668,i,11137484429734663850,5314243973422627053,262144 --field-trial-handle=2276,i,17868032840691979084,17810575120204682830,262144 --variations-seed-version --mojo-platform-channel-handle=2264 /prefetch:2
  2⤵
  PID:2876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2508,i,14218249112503736159,10437031699314760295,524288 --field-trial-handle=2276,i,17868032840691979084,17810575120204682830,262144 --variations-seed-version --mojo-platform-channel-handle=2648 /prefetch:8
  2⤵
  PID:5040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3560,i,15737165354467381571,10533182132048117628,2097152 --field-trial-handle=2276,i,17868032840691979084,17810575120204682830,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:1
  2⤵
  PID:5744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3572,i,575802075916638827,16282161467215148021,2097152 --field-trial-handle=2276,i,17868032840691979084,17810575120204682830,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:1
  2⤵
  PID:2644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4980,i,17911292606871886180,7243687358803414859,524288 --field-trial-handle=2276,i,17868032840691979084,17810575120204682830,262144 --variations-seed-version --mojo-platform-channel-handle=5008 /prefetch:8
  2⤵
  PID:3676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4984,i,6385304114952045821,8891649053068916923,524288 --field-trial-handle=2276,i,17868032840691979084,17810575120204682830,262144 --variations-seed-version --mojo-platform-channel-handle=5052 /prefetch:8
  2⤵
  PID:2832
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5756,i,14668166090418505760,10638960642184828454,524288 --field-trial-handle=2276,i,17868032840691979084,17810575120204682830,262144 --variations-seed-version --mojo-platform-channel-handle=5764 /prefetch:8
  2⤵
  PID:2812
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5756,i,14668166090418505760,10638960642184828454,524288 --field-trial-handle=2276,i,17868032840691979084,17810575120204682830,262144 --variations-seed-version --mojo-platform-channel-handle=5764 /prefetch:8
  2⤵
  PID:3972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5768,i,8116966428565016251,14217985102518595066,524288 --field-trial-handle=2276,i,17868032840691979084,17810575120204682830,262144 --variations-seed-version --mojo-platform-channel-handle=5828 /prefetch:8
  2⤵
  PID:5952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6120,i,6568476091909613770,2275519875549030469,524288 --field-trial-handle=2276,i,17868032840691979084,17810575120204682830,262144 --variations-seed-version --mojo-platform-channel-handle=5824 /prefetch:8
  2⤵
  PID:4436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4036,i,15027226431661545087,9600638828691448997,524288 --field-trial-handle=2276,i,17868032840691979084,17810575120204682830,262144 --variations-seed-version --mojo-platform-channel-handle=6080 /prefetch:8
  2⤵
  PID:4588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4996,i,16306806826855833028,5319198203639580984,524288 --field-trial-handle=2276,i,17868032840691979084,17810575120204682830,262144 --variations-seed-version --mojo-platform-channel-handle=5080 /prefetch:8
  2⤵
  PID:3616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5712,i,15184863677433319646,5758736089474061687,524288 --field-trial-handle=2276,i,17868032840691979084,17810575120204682830,262144 --variations-seed-version --mojo-platform-channel-handle=5388 /prefetch:8
  2⤵
  PID:4068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5180,i,7227980996971086231,8806534943160241844,524288 --field-trial-handle=2276,i,17868032840691979084,17810575120204682830,262144 --variations-seed-version --mojo-platform-channel-handle=2864 /prefetch:8
  2⤵
  PID:3228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5804,i,460205316830038803,16354573563928368536,262144 --field-trial-handle=2276,i,17868032840691979084,17810575120204682830,262144 --variations-seed-version --mojo-platform-channel-handle=6012 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5640,i,3312170477565413423,8618002197340620657,524288 --field-trial-handle=2276,i,17868032840691979084,17810575120204682830,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:8
  2⤵
  PID:3404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1308,i,11700381536179958353,15108397190331058384,524288 --field-trial-handle=2276,i,17868032840691979084,17810575120204682830,262144 --variations-seed-version --mojo-platform-channel-handle=6076 /prefetch:8
  2⤵
  PID:2288

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4992

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3984

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
PID:4672
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ff88dd2c728,0x7ff88dd2c734,0x7ff88dd2c740
  2⤵
  PID:5200
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1700,i,3962354715755831213,2538377548942072029,262144 --field-trial-handle=1924,i,15394373500465390599,15454211895989287091,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1920 /prefetch:2
  2⤵
  PID:6028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2052,i,12174819215303604790,4673519282894518203,524288 --field-trial-handle=1924,i,15394373500465390599,15454211895989287091,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2064 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2416,i,2905189453121495409,2694162867713086148,524288 --field-trial-handle=1924,i,15394373500465390599,15454211895989287091,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2428 /prefetch:8
  2⤵
  PID:5708
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --metrics-shmem-handle=3260,i,2575579211054138392,17298114226672230592,2097152 --field-trial-handle=1924,i,15394373500465390599,15454211895989287091,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:2100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --metrics-shmem-handle=3300,i,13398615040940159361,1322621349317905011,2097152 --field-trial-handle=1924,i,15394373500465390599,15454211895989287091,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:1336
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --metrics-shmem-handle=4476,i,15987120596974010995,8923718433532445391,2097152 --field-trial-handle=1924,i,15394373500465390599,15454211895989287091,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4492 /prefetch:2
  2⤵
  PID:1844
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --metrics-shmem-handle=4768,i,1935525664832875834,5181837314654112458,2097152 --field-trial-handle=1924,i,15394373500465390599,15454211895989287091,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4744 /prefetch:1
  2⤵
  PID:1912
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5544,i,16012467093037864340,7796619661479683766,524288 --field-trial-handle=1924,i,15394373500465390599,15454211895989287091,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5540 /prefetch:8
  2⤵
  PID:2636
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5904,i,16865431208036621618,15015470927367953479,524288 --field-trial-handle=1924,i,15394373500465390599,15454211895989287091,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5844 /prefetch:8
  2⤵
  PID:2184
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5900,i,18005916088173948753,6023084128084577416,524288 --field-trial-handle=1924,i,15394373500465390599,15454211895989287091,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4780 /prefetch:8
  2⤵
  PID:5404
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5896,i,10964037835137363389,12003203930757873896,524288 --field-trial-handle=1924,i,15394373500465390599,15454211895989287091,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5956 /prefetch:8
  2⤵
  PID:3160
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --metrics-shmem-handle=6096,i,6502412098858087456,17946748982908378089,2097152 --field-trial-handle=1924,i,15394373500465390599,15454211895989287091,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6084 /prefetch:1
  2⤵
  PID:2400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=3540,i,12783762508111147260,5821294863051282106,262144 --field-trial-handle=1924,i,15394373500465390599,15454211895989287091,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3556 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5644
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5944,i,17006486749236755890,1104051457131566902,524288 --field-trial-handle=1924,i,15394373500465390599,15454211895989287091,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3544 /prefetch:8
  2⤵
  PID:2364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=3584,i,15850313171108585496,8897068972974705498,524288 --field-trial-handle=1924,i,15394373500465390599,15454211895989287091,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3596 /prefetch:8
  2⤵
  PID:4692
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=5964,i,7707976095260842324,16639227971849797560,524288 --field-trial-handle=1924,i,15394373500465390599,15454211895989287091,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3584 /prefetch:8
  2⤵
  PID:2628

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:456

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1036

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4384

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\" -an -ai#7zMap12910:92:7zEvent18992
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2616

C:\Users\Admin\Downloads\st-setup-1.8.40.exe
"C:\Users\Admin\Downloads\st-setup-1.8.40.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1260
- C:\Users\Admin\AppData\Roaming\stem.exe
  "C:\Users\Admin\AppData\Roaming\stem.exe"
  2⤵
  - Checks computer location settings
  - Creates a file in the Startup directory
  - Executes dropped EXE
  - Enumerates video capture drivers
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1632
- - C:\ProgramData\63h 2.exe
    "C:\ProgramData\63h 2.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1448
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /k reg delete HKCR /f
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:4908
    - - C:\Windows\system32\reg.exe
        
        reg delete HKCR /f
        5⤵
        Modifies system executable filetype association
        Modifies registry class
        
        PID:6116
- - C:\Windows\SYSTEM32\shutdown.exe
    shutdown.exe /f /r /t 0
    3⤵
    PID:4676
- C:\Users\Admin\AppData\Roaming\st-setup-1.8.30.exe
  "C:\Users\Admin\AppData\Roaming\st-setup-1.8.30.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:3508

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x51c 0x4f8
1⤵
PID:844

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa386f855 /state1:0x41c64e6d
1⤵
PID:3676

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Component Object Model Hijacking

T1546.015

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Video Capture

T1125

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

63h 2.exe

Path C:\ProgramData\63h 2.exe
Size 11KB
SHA256 ce8c71661f7b8b6f0c32dd0cb079fe8f8bdbc63f769dc38ea9ab698d4a9c60fd
MD5 410635d6c7e0cf69f0f2786be600bae6
SHA1 72d96f76dfeceeaafd5093dcd54a6bb7dbf41ceb
SHA512 0775629a833cffffe87ffd604c2334ca11cf79f8d6c28bf43d3ea8e3d1d70a3914af4a58ecebd597b96252740d353df74ec7e142c5d573dd0c9bce361b360058
SSDEEP 192:elv7OJmKbpVwr0nyM5rnF3HRq1eb7vptT5avt2rXbEILcOmtP:eBOppVw4yMNRxaeb7DT5It2rXLcOO
TLSH
T107321B4AFBD6C434C169073925B7CF26AA70F4554A33EB9E2DDD417B6F6674402102F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2c0ef191-fd43-47a8-a21b-7844b00d5e69.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\2c0ef191-fd43-47a8-a21b-7844b00d5e69.tmp
Size 4KB
SHA256 9653b90b3d02f78e3b463782727375a803d7762d573a6f62d33517f677ac5e11
MD5 5f171cf642e1cc5f29a0943ad4004193
SHA1 33db58379e9eca63a3a82416566c39758e0701f2
SHA512 9d568390dcfa46f92df7975f815a04a94524e945042c0306ab3fb4e988be526e67f43e9ea7836fa385dca7939ca67ed78b13086a6df146593843e6ed88dd2c86
SSDEEP 48:YALlqvqhDh5Jgyieh9aXYfoKsN4s5gmzsNfsvosiFKsYg4S+ymsx+sPjhhnONzst:DYwZVvaIS5WOSFy3S+yH1jhcW
TLSH
T16981AEF7C7E8856DC91156F4AB246E1FCE6D1A24432C3C66C8D49E1B93E2872E24074E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

311bf785-f92e-4bdc-958a-845cfdc67e96.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\311bf785-f92e-4bdc-958a-845cfdc67e96.tmp
Size 3KB
SHA256 e937631129acc1c9da812561d782c0862450d6d60f59ec76cad55ec291872877
MD5 ce68e33214a361d520309e53d251862d
SHA1 b199243aa3eb434888aceb6715800483a7a54906
SHA512 0c018ab6957b654728a11bd62f3b07626e30cc03f41c27ec9cfcb0a5bbd780f44d16462b67db2ff7bbcf13c01e71547157822803a0e244a11b2a303646313ca6
TLSH
T10D71AEF7C7E8956DC91166F4EB246E1FCE6D1A24432C3C66C8D4AE1B53E2872E24074E
MD5 SHA1 SHA512 TLSH

Submit Download

38112a9a-4431-41d1-a5b8-1c1179279033.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\38112a9a-4431-41d1-a5b8-1c1179279033.tmp
Size 3KB
SHA256 4c84c11d23b4df401e0ff1ac029ecfa9bf48c310ff6b9db1c02352caf7a336bf
MD5 0ac4ba722fc1d669a808753abc495093
SHA1 eb54b56612341dd84443c3c105fa4c1ccf1dad66
SHA512 7bfcd0faee9d91b39bf6a4c1376d753db118a97e5239aad7fcbffa9437e6d3a853114669375e3175f7d0d864620c5b1ca7ebc2a5f732919b4db6e3b16a000d21
TLSH
T1B671ADF7C7E8956DC911A6F4AB146E2FCE6D1A24432C3C66C8D4AE1B53E2872D24074F
MD5 SHA1 SHA512 TLSH

Submit Download

4b0c41da-b000-44b4-bad7-0e937bd26a58.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\4b0c41da-b000-44b4-bad7-0e937bd26a58.tmp
Size 2KB
SHA256 d78297d8cbeab2929cd6b57184ffc15b639d455e1bcb5ddd65e773b0e3b90cb9
MD5 7246c98abe52d206265444e852bbca9b
SHA1 4ea415576222c0f8ae40f88a5895c66843d02f2c
SHA512 4876cfbc0498fe235aa8f1e278cf07855608eb68f26adc2207bb78efa7d11a41d0e5b66815f0e69deb206ca60ddac40b9cd95067d8c74ab5e4593ddeaa2a3b89
TLSH
T16251ACF7C7E4956DC91166F4AB107E2FDE6D1A14031C3C6688D4AE1B53E2872D20178F
MD5 SHA1 SHA512 TLSH

Submit Download

3b3b829a-9b7a-4a42-b86d-91ab8dd77aaa.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\3b3b829a-9b7a-4a42-b86d-91ab8dd77aaa.tmp
Size 25KB
SHA256 693c09734e88d4348e287549f69ff586efd868ae857ce1a1345235979026de44
MD5 2946fcf50caac54c35c69fd04516e150
SHA1 b576222e80f987cbf596a461f16d4c06ae67b74f
SHA512 f76633c2e143e364f76fc50b1ca8955062d2f79c8b01cbad34d1b78cd08a89d5ccd948d7ca32be9ae0be865640f7f7408c4475bc8869430bca03e06c2cdfd115
SSDEEP 384:ntiFhQkUSvp3sNp8TUNTUlI4laKMO8vw2fiBCfkhEyjPiZJ8SgHgL/7IzNyii:kFTp34wgT5oBCfkhDjiZiSglyii
TLSH
T102C23932E898DEABEDE74AC5A74E3A43EEE04213C98C5AD4D6D91D1C00872ED530BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8a0349ee-f2fa-4e1a-b07d-34d163b6bd59.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\8a0349ee-f2fa-4e1a-b07d-34d163b6bd59.tmp
Size 25KB
SHA256 857bac6dd8d608fce1377d568280a6d7d47cd6e9d3a29ee2708699252f616526
MD5 a78a52eee58a268df91d47b9f1240cd9
SHA1 b7d3c22914fb2a564ea1ca0fe3e09e8717066609
SHA512 0704b81c0f15ef9cc18444cdc98068f412e9633b588d80e20962cae10efc036ecea45b0bcd122190a02d3c2e11d4b9b3519aca8a3729a2134784c63ced4e1961
SSDEEP 384:nFiFhQkUSvp3sNp8TUNTUlI4ZaKMO8vw2fiBCfkhEyjPiZJ8SgHgL/7IzNyii:MFTp34wgn5oBCfkhDjiZiSglyii
TLSH
T120C22932EC98DEABEDE75AD5A74E3A43EEE04213C98C5AD4D6D91D1C00872ED130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2f67a665126f0d437497b394b50cc87ce72773b6abd85385bb78adf0ad326302
MD5 a98f4348736e1c7c5e70799864c15774
SHA1 fa2e3725e970aab935f77d155b649177f50be7d6
SHA512 c1dd68c743d45af6f713c7d8fade4a675abe4d224e86b956c5aaf959ccda0a92b9824b0e784a0ee9992843bfc2a7a73f85267479d6e5ffa0aa5827760492419d
TLSH
T19ED02B20B6A87654E006343C0114428C31CE5570140BB400809413A40FC261201C4069
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3c1c88a1dc8e5439a1a520e9db930955bf4755654f664147c54e6cba8b43ed4c
MD5 22184503a294aa98846d9a4c3975971b
SHA1 44809070563819cceeff10eeef861544783faf98
SHA512 5d29c381872b72159a2d05366e0578c0ad56eb5ef51240db505660b787e0b3b88212c74bad2c16783f95846d95fdad86172cdc01a84d34426cca804e937a679d
TLSH
T1F4D02B24B2AC7654E01A343C0114428C30CE5970140BB400805413940FC261201C4069
MD5 SHA1 SHA512 TLSH

Submit Download

594f1dfa-5d93-4c9f-bf58-7cd8e9c59886.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\594f1dfa-5d93-4c9f-bf58-7cd8e9c59886.tmp
Size 414B
SHA256 325ba86f911c68fab3671226c9f9de5d59ffbf1e6bfc5ab875b9774b9c7dca6a
MD5 95e46c5f4cf82dbca647d738c487eb5d
SHA1 af347e06234f4ad0513193c3a539a6580091b928
SHA512 9b9d34639bf8cef7ae8ac50e400bcb7039f5986aa035371786af4565ffeecf039d85e9e9ae43def5e24881096066b572967781ff396d13479bff7d7c405acc53
TLSH
T140E02BAAC811EC3B09FD0B7C50940645E74023272A42984B3B3D94088FF06364685C6C
MD5 SHA1 SHA512 TLSH

Submit Download

5cf17d0c-eb54-4a25-944e-390ab7ed4516.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\5cf17d0c-eb54-4a25-944e-390ab7ed4516.tmp
Size 11KB
SHA256 a4e154cb26613b38fdce3044c11f60263e6c4a057917628b4807343a56c2da26
MD5 c9bed99dd2550178940d0fa54713146d
SHA1 ca847fc6995c638bf41489a18eeafac5c5eb9eb4
SHA512 219f88c9e6a4c16799b9d384622417e9d51060da521da0743153782ffbdb8134c8263a55a272256f6551dc27ea67963cafcbc0da1666e41e71cb7b08b5dd47f8
SSDEEP 192:sxZ6R4KG/fmsORaQZLl80zodpHVHW6+WNGYorZfSfBIg5Xt6J:sxZ6LG/fmsOEO2H1HbGDSVlt2
TLSH
T18342D8556D28A93B8CC7D21DFA59BF53D3F91033A0860E48AAFC8A1C15EB6DD620740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

96ed1e14-218c-4ba6-a973-9fa32c3115ab.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\96ed1e14-218c-4ba6-a973-9fa32c3115ab.tmp
Size 11KB
SHA256 472c9a7ae8abfb7723ac7af10aad649720cf015a3a90aeb4942312890eaa4776
MD5 f7e2d6013c9033a93f8a4649a4c913ae
SHA1 b3a0b15da3960a8a05e319d150f3f2333536d1b6
SHA512 a86517c45b85e5a2f0b058ffdad05a0c96d120d8a869a8d7db6b7e1e6d8a6911f9e47ab141d170768dad0a8c119e179bdd77219849979dada274816abaaeea2f
SSDEEP 192:sxZ6R47G/fmsDRaQZLl80zodpHVHW6+WNGYorYfSfBIgjt6J:sxZ6yG/fmsDEO2H1HbGgSVjt2
TLSH
T1DA42C6556D28A97B8CC7D21DFA59BF53D3F91033A0950E48AAFC8A1C15EB6CD620740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 d67eb35104885fcd8b39a5715d6be46a77b0c73e99d14d85da724c5739c24bc2
MD5 4db2a7e557a53ec4abff30b34cd3521f
SHA1 3805f11f9576c39db27433834d687b98ec5b5c7d
SHA512 a383e361892554d0cf76458f3223976534f3cd7410b68cb9052a1b274b42ad8ac5f7be3d078a77d47bdd0ef9b5ae93144f11f08b36995b9de360ce45ef609249
TLSH
T16AE07DC80ACCC22EA319648B41F8633DCBC43B5BD2CC698E1B80C5887247B40BBC2790
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 0c77d90e86aac554f723a128d0d1da651e821f36d1fca7d4f06fcb6494d30572
MD5 7c96d6779353697942ed58268395c9c7
SHA1 32da45f3cd9b1368c1558c82d3eac0a213ac6053
SHA512 a83ee242a73299597df06126f381f9189a7cdbd89e51ab0696a251a03231a0416b50ef6faabce84c183d1c3ae422786cc79edf741da3eefe8377903d75e0e909
TLSH
T1DCE026E40BC8C22EA328648B4178430DC3C0375FD3C86A1F37C0C589700A690AE83A90
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 b774508a5dafd5f235d108cda76ea27b2084fc0f275aca18011907573f28ca65
MD5 5bf46273a8420d73438186a2e797295b
SHA1 e31b4f2af17bf41a3331591ea0417de0426ee76d
SHA512 851622bb685c9c36cf36e7da61e88316b95fb579890a2077f8de989bd24b85964011d513e2ec18c1d6017c0cf372125369d56bd343144a944caf6e7825fa9bcb
TLSH
T1C5E078F548D5C21D5304748B01F4430DC3D0B67BD3C47A4D7780C558704A7407AC1D65
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 ebf66c48095f1cd436adb478e71c2622b07a4be5f2190e7b66d88fdedbbe51f6
MD5 9519eb6c63b9613fdf2afb2d7b67a729
SHA1 0040db576a682f7b770fc2ed0f7293e16fe83626
SHA512 d99be15f846f3c7bd51729ce9eba935066c821e783624b5e3d59faead4e39ecaf482caba349bf975e471c8900e69ad3e193156e5d596472d345cd067b78f9e1f
TLSH
T1B5E07DC814C8C32EA34A645FC37C47ACC7C13A5ADACA690E7748D98C7245280F7D36D0
MD5 SHA1 SHA512 TLSH

Submit Download

8428549a-3f15-439b-9242-6f731a6214dd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\8428549a-3f15-439b-9242-6f731a6214dd.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

02407ce1-28c4-4af5-8085-b687e316c684.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\02407ce1-28c4-4af5-8085-b687e316c684.tmp
Size 1KB
SHA256 1238cab4becffe4d5b9df684a1940bab13f7a2672e698984b0a1d44e1ede11bb
MD5 d1fd98df7e15fb19013bf79ebadc91b4
SHA1 cea664a538aa7044d6f74d6d3f7e7e1950dc8c25
SHA512 904b04706a909bbe46b11cc361347d416d32ad2e1d0860bdcffda6d4ce406e2389b8ac5de6a4a047c41b44b347313cd558c200e61afe60ae9865cb4f64123988
TLSH
T15C31AFF787F4856E8A0196F0AA18AE2BCE2D0515432C7D9A85E4AF2783E3471E04165F
MD5 SHA1 SHA512 TLSH

Submit Download

3db12b06-cdb8-49eb-80f1-57e7a56bdb14.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\3db12b06-cdb8-49eb-80f1-57e7a56bdb14.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

be3dbd1a-91b1-4346-ba4a-e14e2be5d0f0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\be3dbd1a-91b1-4346-ba4a-e14e2be5d0f0.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync App Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 d6a18cd3e65046924c2b99747ee65e10e08b6cd4f326b26bd2412e025fbd3c02
MD5 a65ff67d84cc34c566ab60ac47ce697b
SHA1 0011cd50f4dc90725f7cfeb4bb6b9297e95677ea
SHA512 43c5079759131216a68877ce5073c4dd95c798975a90e1feb63eb07947e9b76a0e1c4f4f8abf47fe3c0dc172e2bf3c5ca6f7e60639312112ea0f226b8717ff8e
SSDEEP 96:KM8wKFqmq2sK3qsrWKIcKKsAKVK66QKTywO3aKoErbWKY0KGnuKc82DOhVLZZdgs:ST/2dXOJhJlpfnpp3tNXVrN3AvDF
TLSH
T12BB2331571BB421039FE291C92B5972E064272733219E66B7FBD00B68E6BF085DFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

b08c8ddc-a3fd-4263-ab8c-6d3d7e1bf87f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b08c8ddc-a3fd-4263-ab8c-6d3d7e1bf87f.tmp
Size 11KB
SHA256 93528f88f737008ca3779f1e619c822c88a7f09a14b43a52b7e2fb7a84ca0bc9
MD5 6b7561177f7f010c71f7fde685e29f12
SHA1 827951457c83359cb6ed0341362148b8dded1691
SHA512 fa4c19eb42a9c91c8beaf54b7c247cde3acfbf074f06e5a2da32e713836f9a7a31510ddc83b2f566422a204552ef264aa3c186c7a0091ada751f0c93ef2425df
SSDEEP 192:sxZ6R4KG/fmsO0QZLl80zodpHVHW6+WNGYoiZfSfBIg5Xt6J:sxZ6LG/fmsO0O2H1HbGESVlt2
TLSH
T15C42C8556D28A93B8CC7D21DEA59BF53D3F91033A0960E48AAFC8A1C15EB6DD620740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c4534939-08db-47d1-bcbb-d738e845a458.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c4534939-08db-47d1-bcbb-d738e845a458.tmp
Size 27KB
SHA256 b889e5382c9e415bcf4e5e68d2959c49597a0b5dcecea8a5067e3c14924f16f9
MD5 355b4edfda2a0287b0e92e6bb13bfc45
SHA1 654be442ee8176e74f3cbcc353b26ad58f0793b3
SHA512 d5ac6b4b1c43a1693926a1f4b0344b0e9c9c7b4f201b20fbb4e5c9a919e780eab5d79897f6e3aca7afe239b52cbfa08377837a95a157097e70915d91fefeb0cb
SSDEEP 768:Px6r8j+WviyUK8F1+UoAYDCx9Tuqh0VfUC9xbog/OVXpLlvVajYroorbgnov:Px6r8j+WviyUKu1jaqpLd4jjovgK
TLSH
T1D4C2E93B640CCB7E4FC41E9DDC1A6F972D9802C796588D408BFA954C02C77EA912A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e8bd1cf5-5b26-4a12-bc9c-ea8ab0c5a21d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e8bd1cf5-5b26-4a12-bc9c-ea8ab0c5a21d.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

c2e806dd-78b7-453b-b25c-03e7475dc274.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\c2e806dd-78b7-453b-b25c-03e7475dc274.tmp
Size 26KB
SHA256 e5b520371a54618cfa18a5538110583d56f2ee27b6449a38c1b52bb5da6602fe
MD5 4b7880331fcb10a5e784dc130cdb9678
SHA1 e0955fe772c05a2c608d49cc5ce67ee2d06beffc
SHA512 727f76a6e556ca3413409f2730c0583d7b98021d069b7b1ad205ebb8bec9c1635a8f6c2f063a1ec3dd76266c51a8ee84f89bc8e7ef3659e98e7bf7d637a48685
SSDEEP 384:n8iFiZcI63sNd8TUNTUlIm2aKM+Dsw2fiBCfkhEyjEiZJ8sa+VYwSgL/7IzLon:nFQ63Iwgc2LBCfkhDQiZihgAc
TLSH
T1F8C23A32EC94D9ABECE74BD5AB4A3A03DDF4426396CCAAD4D5D81D1D00DB1AD1307C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cb8e83f7-cafe-4f39-82ad-97135660c1ac.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\cb8e83f7-cafe-4f39-82ad-97135660c1ac.tmp
Size 25KB
SHA256 9faefc5be60ed40b8ebba67e602d12ed540e63c3f1a9d8ad4c1b09f87a92ee49
MD5 0793f6d139f8a5cc35d8ca61c1c58b05
SHA1 1310eb5210fd19493c47d15d1f84452a9e1253e8
SHA512 bcff44d13cf3212f3afdceabd628b1eb64fe4d39a6ffbb270da65956788e444a91cb70bb3fdc868f86958dc8adb9bbe5e4c601e8cf8476ecada28460d75be150
SSDEEP 384:nKiFiZcI63sNB8TUNTUlIm2aKMix4w2fiBCfkhEyPFZ4sa+VYwSgL/7IzLon:BFQ63UwgcanBCfkhDPFZ4hgAc
TLSH
T15DC24B36EC94D9ABE8FB4FDAAB4A7A13DEF0016395DC5AC4D6D91D1D00871AD0307C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

de034c5b-3e49-43ad-b685-63360d0a527c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\de034c5b-3e49-43ad-b685-63360d0a527c.tmp
Size 25KB
SHA256 a58c2692c9b713e97f6c74c7ad8195f974f2aefb969bff0552d6583fc4f8ca16
MD5 fe05d797664110c314f13f70241ad17e
SHA1 8433bcd31052530c24a44f8a4894b5bab24cc66b
SHA512 c76b09b84c08be1fd9f45ee4fc45450b546747c346066d231da5c096593bb908a7f23cf30ee32f504464b1abdfd12d5022d3d98063de9806479e7a908ac2fe23
SSDEEP 384:n0iFhQkUSvT83sNp8TUNTUlI4laKMO8vw2fiBCfkhEyjamZJ8SgHgL/7IzNyii:PFTw34wgT5oBCfkhDOmZiSglyii
TLSH
T18FC22936E898DEABEDE74AC5B74E3A43EEE04213C98C5AD4D6D91D5C00872ED530BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fc48719d-9325-4cdf-b5e0-0e5010f8921f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\fc48719d-9325-4cdf-b5e0-0e5010f8921f.tmp
Size 25KB
SHA256 3952d615ea103da779133fd840e4f5f9b0da1c454e4d9963fdfe609160117fb7
MD5 7e3caeb832b28ff84891772f3c917342
SHA1 5311fa25c3429ee5c8242a682817b948e4bef2af
SHA512 41056422bf2afef71b9cc568e2f2afdac39e9553d5bf9e598f518e0941a2520eeb000703e80fe348765cd21626de5b5926bf0a0907b31c1b1ace03943a8891c4
SSDEEP 384:nFiFiZcIP3sNp8TUNTUlI40VaKMS8vw2fiBCfkhEyjPiZJ8SgHgL/7Iz5ot:MFQP34wgXURoBCfkhDjiZiSgRy
TLSH
T194C22A32ECA4DAABECEB5AC9B74A3A03DEF44123D58C9AD4D5D91D1D00971EE130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 651571113fb83dab052dcc8b4ecc6710bd6aa9768a5f6438c42f78974806f32a
MD5 f2a319f35954a47b4d4bc649f60e7ce4
SHA1 e7aa41796291e61b6f113f58bc930cc1702dc477
SHA512 60a3e7db4a6b08ef84252393a7a7d68907fbe61028e30dff8ce0720545f400e2ba520639e11e36ab146ae87a04a7cb31956fc7c46acefc515376ad3f023c6350
TLSH
T1B241255DBAE91148B3B77E1AABF6A87E487BB9272E46C06D00110D4F0766E40CD62737
MD5 SHA1 SHA512 TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nso60CB.tmp\System.dll
Size 12KB
SHA256 9d81c2e901e59350e33f0c33f44e033e727a4d962e245ecb23561da8feccdfad
MD5 67fc1324e53b1f3854557f23b0c22654
SHA1 d36528a0468951a90a67a8e71881eee655d65c7c
SHA512 0fe91fd5e2267c3f21712f0a921539a13868e57e0f5444d86704a3e3ca15e383130ece5433ff9948e8772c777c401270ccfa99eab65527039333946ff662f4e4
SSDEEP 192:K5zfH361apH705aW7DSGb6KVFEc+Js68XDEKjbR493oJZnxxYCBm9:K5zfX61apHg5a+SIJFESACGISCm9
TLSH
T1D4424B5AEB72207BD01385BD9795E107D335B8DA79E0974F0AE8AA3A2F137902C5434E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

modern-wizard.bmp

Path C:\Users\Admin\AppData\Local\Temp\nso60CB.tmp\modern-wizard.bmp
Size 150KB
SHA256 16e0edc9f47e6e95a9bcad15adbdc46be774fbcd045dd526fc16fc38fdc8d49b
MD5 3614a4be6b610f1daf6c801574f161fe
SHA1 6edee98c0084a94caa1fe0124b4c19f42b4e7de6
SHA512 06e0eff28dfd9a428b31147b242f989ce3e92474a3f391ba62ac8d0d05f1a48f4cf82fd27171658acbd667eaffb94cb4e1baf17040dc3b6e8b27f39b843ca281
SSDEEP 48:ZQEM+jeAwtwVUoYxq+HQiNE/7o+f3cbqBtpozK8lHl/GGKOFHNPf33zFYsvwL:ZkWeftwV1enu/7ozCeu8RGGvP/jFYsv
TLSH
T1F8E3E9AEB933693ECD9911B41164A7FD8B306C5C7A40666E411FF8DC0FF31CA3569852
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsDialogs.dll

Path C:\Users\Admin\AppData\Local\Temp\nso60CB.tmp\nsDialogs.dll
Size 10KB
SHA256 abd16682aa1531229e5aa727dda379050f66bd788c12fe61a38551f96dfcacb5
MD5 b9cf10930a5144fdda9479613ee3c84b
SHA1 5110556ff6ed1559c73cdd444f6e2408db570653
SHA512 bb9947763fea6915e90e662438d1247678576ff944f9918dcbb0c93d669f8a0dd7dd60db95f53e52faf1e0d3d627789cbcd6196441113556acaa6711b6b6f350
SSDEEP 192:VvvwccHJBa8oStSigfl6dblJDBUorNuCjLUoaTOt37Eezqm:VvvwVPa8oStSTUDiorNRjwoT7EeWm
TLSH
T15C22E85BFAA4D2EEC4974136D5BB5B06CBB170125692DA4E0B3096897F233433A2D74C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

st-setup-1.8.30.exe

Path C:\Users\Admin\AppData\Roaming\st-setup-1.8.30.exe
Size 10.6MB
SHA256 41ec92bc311daf40b22b2497d044b12d9ba0266da84d8581255d7cc9e059135f
MD5 54cceb7c9c0c50a9d2f0b1b4f173eb33
SHA1 ffc28139e6c2d2eeeb27bc39f2ab20e4b8b4c08e
SHA512 41a589e7ea52d1a8730a4f12ef3db6e5738cb426f38483e8dc178e42d3ef58e1459cc61cccab800891f38fc9e6e3eccc76c46c2782108d084d91234b1f43b53d
SSDEEP 196608:CW3Cqh6Vk9faCb3TiZEZmpJh+k4tlrP8Kl6n6D0MhCWuhfdeU7YD:7CDQaC28nl78Kg6zCWCdFs
TLSH
T1C0B633942474E24DE0BA0031EC61EF66DDF4B09A5B058A1E4299CB6577E4BE34C2FECD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

stem.exe

Path C:\Users\Admin\AppData\Roaming\stem.exe
Size 64KB
SHA256 673a2ff5eac094310dd48b47b2edc7e04199990499a19f5f3565c71771b48e10
MD5 837c9b629134515d87dba6466da3bfc1
SHA1 a825edc627c04df45a617a0ded14e94291504bff
SHA512 7ee7fa7587f7251e534b3cd2986515cf01351e11f99bc3a74a33c01915b913f2f740d068a691aa0301469190207bf4452ed1b4e4087566286ca60eb9bfcf0e78
SSDEEP 1536:Xipzk7ARdq0m/mRXrQzDeCBmCu8pbZquUCO/yXm5ONri63:XwIcbq0ej7bZMSm5ONrb
TLSH
T1D2537C587BA5452AE1FFAFB10CF23222C671F7139903C61F65D9058A2A2778ACD413E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

st-setup-1.8.40.exe

Path C:\Users\Admin\Downloads\st-setup-1.8.40.exe
Size 10.9MB
SHA256 1c435f251f9a27156578016f962a9f86dd0cba0e85a39a45db905b3f42286cd8
MD5 e5f680e55363a67f0255516a8380cf16
SHA1 50cd3a075b464ffd2ea86a127f9c3b96f0d37a7c
SHA512 342fdc005b33dedf63e1d4568c8cfe56b09e0bff7348e127e88ac71d4fa79bf9b3472204cc28bb65828e623b7028a17f67c1fdcd45be314fbe61ac09fe34f525
SSDEEP 196608:vayBabZfEEZ190KIWxC6I89NAv6Ah1VPN0fU7lhDK7zGx4XqgqSDOb+e4d:iMLEZ19F7juvFUfURJOXTX7e4d
TLSH
T12DC633A525060ABDEFE0B934EFDD62A563A61D81007B49CF13D43F8B3537E03BA99095
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1260-340-0x0000000000D50000-0x0000000001848000-memory.dmp

Download

memory/1448-417-0x0000000000770000-0x000000000077A000-memory.dmp

Download

memory/1632-359-0x0000000000C00000-0x0000000000C16000-memory.dmp

Download

memory/1632-401-0x000000001CE90000-0x000000001D0EA000-memory.dmp

Download

memory/1632-402-0x000000001D820000-0x000000001DD48000-memory.dmp

Download

memory/1632-405-0x000000001D2F0000-0x000000001D486000-memory.dmp

Download

memory/3972-204-0x0000021563AE0000-0x0000021564AE0000-memory.dmp

Download

Analysis

Sharing

Errors

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads