hxxps://cdn[.]discordapp[.]com/attachments/1566808050579415181/1566809932811210762/Aljaheem_Theme[.]rar?ex=6aee8235&is=6aed30b5&hm=7735767862d5a014d5dfc3b74f1e36a1ce3760809d5bb0812217aac873b3a5f6&

Analysis

user interaction
yes
max time kernel
359s
max time network
362s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260911-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260911-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
06/11/2026, 05:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
https://cdn.discordapp.com/attachments/1566808050579415181/1566809932811210762/Aljaheem_Theme.rar?ex=6aee8235&is=6aed30b5&hm=7735767862d5a014d5dfc3b74f1e36a1ce3760809d5bb0812217aac873b3a5f6&
Sample261106-gkc79aah88

Score

8^/10

defense_evasion discovery exploit persistence ransomware

Malware Config

Signatures

Possible privilege escalation attempt 6 IoCs

exploit

pid	Process
5936	takeown.exe
5620	takeown.exe
1132	icacls.exe
5452	takeown.exe
4912	takeown.exe
4996	icacls.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3202520547-175870679-441661622-1000\Control Panel\International\Geo\Nation	UltraUXThemePatcher_4.4.3.exe

Executes dropped EXE 1 IoCs

pid	Process
4708	UltraUXThemePatcher_4.4.3.exe

Loads dropped DLL 18 IoCs

pid	Process
4708	UltraUXThemePatcher_4.4.3.exe
4708	UltraUXThemePatcher_4.4.3.exe
4708	UltraUXThemePatcher_4.4.3.exe
4708	UltraUXThemePatcher_4.4.3.exe
4708	UltraUXThemePatcher_4.4.3.exe
4708	UltraUXThemePatcher_4.4.3.exe
4708	UltraUXThemePatcher_4.4.3.exe
4708	UltraUXThemePatcher_4.4.3.exe
4708	UltraUXThemePatcher_4.4.3.exe
4708	UltraUXThemePatcher_4.4.3.exe
4708	UltraUXThemePatcher_4.4.3.exe
4708	UltraUXThemePatcher_4.4.3.exe
4708	UltraUXThemePatcher_4.4.3.exe
4708	UltraUXThemePatcher_4.4.3.exe
4708	UltraUXThemePatcher_4.4.3.exe
4708	UltraUXThemePatcher_4.4.3.exe
4708	UltraUXThemePatcher_4.4.3.exe
4708	UltraUXThemePatcher_4.4.3.exe

Modifies file permissions 1 TTPs 6 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4996	icacls.exe
5936	takeown.exe
5620	takeown.exe
1132	icacls.exe
5452	takeown.exe
4912	takeown.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
File and Directory Permissions Modification: Windows File and Directory Permissions Modification 1 TTPs
defense_evasion

Windows File and Directory Permissions Modification
T1222.001

Drops file in System32 directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\uxinit.dll.new	UltraUXThemePatcher_4.4.3.exe
File opened for modification	C:\Windows\system32\uxinit.dll.old	UltraUXThemePatcher_4.4.3.exe
File created	C:\Windows\System32\themeui.dll.backup	UltraUXThemePatcher_4.4.3.exe
File created	C:\Windows\System32\themeui.dll.new	UltraUXThemePatcher_4.4.3.exe
File opened for modification	C:\Windows\system32\themeui.dll.new	UltraUXThemePatcher_4.4.3.exe
File opened for modification	C:\Windows\system32\themeui.dll.old	UltraUXThemePatcher_4.4.3.exe
File created	C:\Windows\System32\uxinit.dll.backup	UltraUXThemePatcher_4.4.3.exe
File created	C:\Windows\System32\uxinit.dll.new	UltraUXThemePatcher_4.4.3.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\UltraUXThemePatcher\Uninstall.exe	UltraUXThemePatcher_4.4.3.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UltraUXThemePatcher_4.4.3.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3168	msedge.exe
1768	chrome.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000a645ddb3f46203380000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c01200000000ffffffff000000002701010000883801a645ddb30000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d083020000000000c050dc000000ffffffff000000000700010000e84101a645ddb3000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000090d4de0000000000000005000000ffffffff000000000700010000486a6fa645ddb300000000000090d4de000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000090d4e30000000000000005000000ffffffff00000000070001000048ea71a645ddb300000000000090d4e300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe

Modifies registry class 11 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3202520547-175870679-441661622-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3202520547-175870679-441661622-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3202520547-175870679-441661622-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3202520547-175870679-441661622-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3202520547-175870679-441661622-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3202520547-175870679-441661622-1000_Classes\Local Settings	7zFM.exe
Key created	\REGISTRY\USER\S-1-5-21-3202520547-175870679-441661622-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3202520547-175870679-441661622-1000\{C4FD8A97-9E8D-4883-B5B8-53AB975E1663}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3202520547-175870679-441661622-1000_Classes\Local Settings	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3202520547-175870679-441661622-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3202520547-175870679-441661622-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4764	msedge.exe
4764	msedge.exe
2596	chrome.exe
2596	chrome.exe
3080	7zFM.exe
3080	7zFM.exe
3080	7zFM.exe
3080	7zFM.exe
3080	7zFM.exe
3080	7zFM.exe

Suspicious behavior: GetForegroundWindowSpam 3 IoCs

pid	Process
3080	7zFM.exe
5736	OpenWith.exe
2988	7zFM.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
2596	chrome.exe
2596	chrome.exe
2596	chrome.exe

Suspicious use of AdjustPrivilegeToken 27 IoCs

description	pid	Process
Token: SeRestorePrivilege	3080	7zFM.exe
Token: 35	3080	7zFM.exe
Token: SeSecurityPrivilege	3080	7zFM.exe
Token: SeShutdownPrivilege	2596	chrome.exe
Token: SeCreatePagefilePrivilege	2596	chrome.exe
Token: SeShutdownPrivilege	2596	chrome.exe
Token: SeCreatePagefilePrivilege	2596	chrome.exe
Token: SeSecurityPrivilege	3080	7zFM.exe
Token: SeSecurityPrivilege	3080	7zFM.exe
Token: SeSecurityPrivilege	3080	7zFM.exe
Token: SeRestorePrivilege	2988	7zFM.exe
Token: 35	2988	7zFM.exe
Token: SeSecurityPrivilege	2988	7zFM.exe
Token: SeBackupPrivilege	2900	vssvc.exe
Token: SeRestorePrivilege	2900	vssvc.exe
Token: SeAuditPrivilege	2900	vssvc.exe
Token: SeTakeOwnershipPrivilege	5620	takeown.exe
Token: SeTakeOwnershipPrivilege	4912	takeown.exe
Token: SeBackupPrivilege	1760	srtasks.exe
Token: SeRestorePrivilege	1760	srtasks.exe
Token: SeSecurityPrivilege	1760	srtasks.exe
Token: SeTakeOwnershipPrivilege	1760	srtasks.exe
Token: SeBackupPrivilege	1760	srtasks.exe
Token: SeRestorePrivilege	1760	srtasks.exe
Token: SeSecurityPrivilege	1760	srtasks.exe
Token: SeTakeOwnershipPrivilege	1760	srtasks.exe
Token: SeShutdownPrivilege	4708	UltraUXThemePatcher_4.4.3.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
3080	7zFM.exe
3080	7zFM.exe
2596	chrome.exe
2596	chrome.exe
2596	chrome.exe
2596	chrome.exe
2596	chrome.exe
2596	chrome.exe
2596	chrome.exe
2596	chrome.exe
2596	chrome.exe
2596	chrome.exe
2596	chrome.exe
2596	chrome.exe
2596	chrome.exe
2596	chrome.exe
2596	chrome.exe
2596	chrome.exe
2596	chrome.exe
2596	chrome.exe
2596	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
2596	chrome.exe
2596	chrome.exe
2596	chrome.exe
2596	chrome.exe
2596	chrome.exe
2596	chrome.exe
2596	chrome.exe
2596	chrome.exe
2596	chrome.exe
2596	chrome.exe
2596	chrome.exe
2596	chrome.exe
2596	chrome.exe
2596	chrome.exe
2596	chrome.exe
2596	chrome.exe
2596	chrome.exe
2596	chrome.exe
2596	chrome.exe
2596	chrome.exe
2596	chrome.exe
2596	chrome.exe
2596	chrome.exe
2596	chrome.exe
2596	chrome.exe
2596	chrome.exe
2596	chrome.exe
2596	chrome.exe
2596	chrome.exe
2596	chrome.exe
2596	chrome.exe
2596	chrome.exe

Suspicious use of SetWindowsHookEx 19 IoCs

pid	Process
5736	OpenWith.exe
5736	OpenWith.exe
5736	OpenWith.exe
5736	OpenWith.exe
5736	OpenWith.exe
5736	OpenWith.exe
5736	OpenWith.exe
5736	OpenWith.exe
5736	OpenWith.exe
5736	OpenWith.exe
5736	OpenWith.exe
5736	OpenWith.exe
5736	OpenWith.exe
5736	OpenWith.exe
5736	OpenWith.exe
5736	OpenWith.exe
5736	OpenWith.exe
4708	UltraUXThemePatcher_4.4.3.exe
5800	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4356 wrote to memory of 2912	4356	msedge.exe	82
PID 4356 wrote to memory of 3168	4356	msedge.exe	83
PID 4356 wrote to memory of 1724	4356	msedge.exe	84
PID 4356 wrote to memory of 1724	4356	msedge.exe	84
PID 4356 wrote to memory of 1724	4356	msedge.exe	84
PID 4356 wrote to memory of 3576	4356	msedge.exe	85
PID 4356 wrote to memory of 3576	4356	msedge.exe	85
PID 4356 wrote to memory of 5092	4356	msedge.exe	86
PID 4356 wrote to memory of 688	4356	msedge.exe	87
PID 4356 wrote to memory of 688	4356	msedge.exe	87
PID 4356 wrote to memory of 688	4356	msedge.exe	87
PID 4356 wrote to memory of 5092	4356	msedge.exe	86
PID 4356 wrote to memory of 5092	4356	msedge.exe	86
PID 4356 wrote to memory of 1488	4356	msedge.exe	89
PID 4356 wrote to memory of 1488	4356	msedge.exe	89
PID 4356 wrote to memory of 1488	4356	msedge.exe	89
PID 4356 wrote to memory of 3672	4356	msedge.exe	90
PID 4356 wrote to memory of 3672	4356	msedge.exe	90
PID 4356 wrote to memory of 3672	4356	msedge.exe	90
PID 4356 wrote to memory of 2376	4356	msedge.exe	93
PID 4356 wrote to memory of 4980	4356	msedge.exe	94
PID 4356 wrote to memory of 2376	4356	msedge.exe	93
PID 4356 wrote to memory of 4980	4356	msedge.exe	94
PID 4356 wrote to memory of 1808	4356	msedge.exe	95
PID 4356 wrote to memory of 1808	4356	msedge.exe	95
PID 4356 wrote to memory of 4280	4356	msedge.exe	96
PID 4356 wrote to memory of 4280	4356	msedge.exe	96
PID 4356 wrote to memory of 4280	4356	msedge.exe	96
PID 4356 wrote to memory of 4164	4356	msedge.exe	98
PID 4356 wrote to memory of 5104	4356	msedge.exe	99
PID 4356 wrote to memory of 3304	4356	msedge.exe	112
PID 4356 wrote to memory of 4400	4356	msedge.exe	113
PID 4356 wrote to memory of 1320	4356	msedge.exe	114
PID 4356 wrote to memory of 2188	4356	msedge.exe	115
PID 4356 wrote to memory of 2188	4356	msedge.exe	115
PID 4356 wrote to memory of 216	4356	msedge.exe	116
PID 4356 wrote to memory of 216	4356	msedge.exe	116
PID 4356 wrote to memory of 560	4356	msedge.exe	117
PID 4356 wrote to memory of 560	4356	msedge.exe	117
PID 4356 wrote to memory of 4764	4356	msedge.exe	120
PID 2596 wrote to memory of 1796	2596	chrome.exe	128
PID 2596 wrote to memory of 4352	2596	chrome.exe	129
PID 2596 wrote to memory of 4352	2596	chrome.exe	129
PID 2596 wrote to memory of 1768	2596	chrome.exe	130
PID 2596 wrote to memory of 5052	2596	chrome.exe	131
PID 2596 wrote to memory of 5052	2596	chrome.exe	131
PID 2596 wrote to memory of 4404	2596	chrome.exe	133
PID 2596 wrote to memory of 3584	2596	chrome.exe	134
PID 2596 wrote to memory of 4404	2596	chrome.exe	133
PID 2596 wrote to memory of 3584	2596	chrome.exe	134
PID 2596 wrote to memory of 4916	2596	chrome.exe	135
PID 2596 wrote to memory of 4916	2596	chrome.exe	135
PID 2596 wrote to memory of 4476	2596	chrome.exe	136
PID 2596 wrote to memory of 4476	2596	chrome.exe	136
PID 4356 wrote to memory of 5580	4356	msedge.exe	137
PID 4356 wrote to memory of 5588	4356	msedge.exe	138
PID 4356 wrote to memory of 5580	4356	msedge.exe	137
PID 4356 wrote to memory of 5588	4356	msedge.exe	138
PID 4356 wrote to memory of 5684	4356	msedge.exe	139
PID 4356 wrote to memory of 5684	4356	msedge.exe	139
PID 3080 wrote to memory of 5780	3080	7zFM.exe	140
PID 3080 wrote to memory of 5068	3080	7zFM.exe	142
PID 3080 wrote to memory of 5952	3080	7zFM.exe	146
PID 2988 wrote to memory of 4708	2988	7zFM.exe	153

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://cdn.discordapp.com/attachments/1566808050579415181/1566809932811210762/Aljaheem_Theme.rar?ex=6aee8235&is=6aed30b5&hm=7735767862d5a014d5dfc3b74f1e36a1ce3760809d5bb0812217aac873b3a5f6&
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7ffe2c44c188,0x7ffe2c44c194,0x7ffe2c44c1a0
  2⤵
  PID:2912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1960,i,7629052117596273971,7724374712581095320,524288 --field-trial-handle=2196,i,14803383424606358783,9340747248773499345,262144 --variations-seed-version --mojo-platform-channel-handle=2232 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1656,i,7926890040114090394,14334317149884608104,262144 --field-trial-handle=2196,i,14803383424606358783,9340747248773499345,262144 --variations-seed-version --mojo-platform-channel-handle=2192 /prefetch:2
  2⤵
  PID:1724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2556,i,9917805822665085030,2861423444136315095,524288 --field-trial-handle=2196,i,14803383424606358783,9340747248773499345,262144 --variations-seed-version --mojo-platform-channel-handle=2528 /prefetch:8
  2⤵
  PID:3576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3368,i,14572493330013877971,4550247202026126198,2097152 --field-trial-handle=2196,i,14803383424606358783,9340747248773499345,262144 --variations-seed-version --mojo-platform-channel-handle=3428 /prefetch:1
  2⤵
  PID:5092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3372,i,9704442040665702100,12005434254868529652,2097152 --field-trial-handle=2196,i,14803383424606358783,9340747248773499345,262144 --variations-seed-version --mojo-platform-channel-handle=3432 /prefetch:1
  2⤵
  PID:688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4136,i,538608575484417743,4105701313656076170,2097152 --field-trial-handle=2196,i,14803383424606358783,9340747248773499345,262144 --variations-seed-version --mojo-platform-channel-handle=4212 /prefetch:1
  2⤵
  PID:1488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4148,i,5966532802914428576,3637001954948437280,2097152 --field-trial-handle=2196,i,14803383424606358783,9340747248773499345,262144 --variations-seed-version --mojo-platform-channel-handle=4216 /prefetch:2
  2⤵
  PID:3672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5088,i,11563361698734730028,16434247484029449266,524288 --field-trial-handle=2196,i,14803383424606358783,9340747248773499345,262144 --variations-seed-version --mojo-platform-channel-handle=5116 /prefetch:8
  2⤵
  PID:2376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5096,i,6435425663101530139,14970754527439301966,524288 --field-trial-handle=2196,i,14803383424606358783,9340747248773499345,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:8
  2⤵
  PID:4980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5780,i,8735286426796051430,9060935301572961373,524288 --field-trial-handle=2196,i,14803383424606358783,9340747248773499345,262144 --variations-seed-version --mojo-platform-channel-handle=5836 /prefetch:8
  2⤵
  PID:1808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5808,i,16237535283016837159,3323955203781980341,2097152 --field-trial-handle=2196,i,14803383424606358783,9340747248773499345,262144 --variations-seed-version --mojo-platform-channel-handle=5856 /prefetch:1
  2⤵
  PID:4280
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6348,i,17967445578412626160,3190992228032919861,524288 --field-trial-handle=2196,i,14803383424606358783,9340747248773499345,262144 --variations-seed-version --mojo-platform-channel-handle=6392 /prefetch:8
  2⤵
  PID:3720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6408,i,12176069918026505016,17783436710940141994,524288 --field-trial-handle=2196,i,14803383424606358783,9340747248773499345,262144 --variations-seed-version --mojo-platform-channel-handle=6556 /prefetch:8
  2⤵
  PID:4164
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6348,i,17967445578412626160,3190992228032919861,524288 --field-trial-handle=2196,i,14803383424606358783,9340747248773499345,262144 --variations-seed-version --mojo-platform-channel-handle=6392 /prefetch:8
  2⤵
  PID:5104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4668,i,16304475747940039186,12103903448189981469,524288 --field-trial-handle=2196,i,14803383424606358783,9340747248773499345,262144 --variations-seed-version --mojo-platform-channel-handle=4744 /prefetch:8
  2⤵
  PID:3304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4732,i,16969102327780548124,4957186893772664970,524288 --field-trial-handle=2196,i,14803383424606358783,9340747248773499345,262144 --variations-seed-version --mojo-platform-channel-handle=4580 /prefetch:8
  2⤵
  PID:4400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4736,i,1803146808698049795,3495513687413888525,524288 --field-trial-handle=2196,i,14803383424606358783,9340747248773499345,262144 --variations-seed-version --mojo-platform-channel-handle=4676 /prefetch:8
  2⤵
  PID:1320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2784,i,14899118359785906312,16795163274878253466,524288 --field-trial-handle=2196,i,14803383424606358783,9340747248773499345,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:8
  2⤵
  PID:2188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5080,i,8963064020010044434,18242497187024859797,524288 --field-trial-handle=2196,i,14803383424606358783,9340747248773499345,262144 --variations-seed-version --mojo-platform-channel-handle=5148 /prefetch:8
  2⤵
  PID:216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6212,i,10640585852910073907,13941289349941382019,524288 --field-trial-handle=2196,i,14803383424606358783,9340747248773499345,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:8
  2⤵
  PID:560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5196,i,9915081310306675009,9028133834497857617,262144 --field-trial-handle=2196,i,14803383424606358783,9340747248773499345,262144 --variations-seed-version --mojo-platform-channel-handle=6760 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5584,i,16382957046221039948,603048738313006594,524288 --field-trial-handle=2196,i,14803383424606358783,9340747248773499345,262144 --variations-seed-version --mojo-platform-channel-handle=5564 /prefetch:8
  2⤵
  PID:5580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4652,i,13123116942894459289,9364359944572382698,524288 --field-trial-handle=2196,i,14803383424606358783,9340747248773499345,262144 --variations-seed-version --mojo-platform-channel-handle=4664 /prefetch:8
  2⤵
  PID:5588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6600,i,12428650447346055662,1872832426843507607,524288 --field-trial-handle=2196,i,14803383424606358783,9340747248773499345,262144 --variations-seed-version --mojo-platform-channel-handle=5056 /prefetch:8
  2⤵
  PID:5684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4980,i,64026847500626995,4884331483376361257,524288 --field-trial-handle=2196,i,14803383424606358783,9340747248773499345,262144 --variations-seed-version --mojo-platform-channel-handle=1084 /prefetch:8
  2⤵
  PID:2364

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4340

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4752

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\Aljaheem Theme.rar"
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3080
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\themecpl.dll,OpenThemeAction C:\Users\Admin\AppData\Local\Temp\7zO80CD019B\x.theme
  2⤵
  PID:5780
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\themecpl.dll,OpenThemeAction C:\Users\Admin\AppData\Local\Temp\7zO80C09A9B\xLinux.theme
  2⤵
  PID:5068
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\themecpl.dll,OpenThemeAction C:\Users\Admin\AppData\Local\Temp\7zO80CE718B\xLinuxNA.theme
  2⤵
  PID:5952

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2596
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x238,0x23c,0x240,0x214,0x244,0x7ffe2a0fc728,0x7ffe2a0fc734,0x7ffe2a0fc740
  2⤵
  PID:1796
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1740,i,10996612303343622813,7222043454806786271,262144 --field-trial-handle=2032,i,8858061903224561266,14792525821563385953,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=2028 /prefetch:2
  2⤵
  PID:4352
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1624,i,3496275453745675372,15005083436107719968,524288 --field-trial-handle=2032,i,8858061903224561266,14792525821563385953,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=2308 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2400,i,13784928121213182651,7629077649472257746,524288 --field-trial-handle=2032,i,8858061903224561266,14792525821563385953,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=2572 /prefetch:8
  2⤵
  PID:5052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3236,i,16186615764124474111,16751675525120483948,2097152 --field-trial-handle=2032,i,8858061903224561266,14792525821563385953,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:4404
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3260,i,2545525777675776408,5661842468786670507,2097152 --field-trial-handle=2032,i,8858061903224561266,14792525821563385953,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:3584
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4532,i,8173411804389317859,5492790105035417458,2097152 --field-trial-handle=2032,i,8858061903224561266,14792525821563385953,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=4548 /prefetch:1
  2⤵
  PID:4916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4708,i,15260365819642845064,3340656572256001607,524288 --field-trial-handle=2032,i,8858061903224561266,14792525821563385953,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=4732 /prefetch:8
  2⤵
  PID:4476

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2068

C:\Windows\System32\rundll32.exe
rundll32.exe uxtheme.dll,#64 C:\Windows\Resources\Themes\Aero\Aero.msstyles?NormalColor?NormalSize
1⤵
PID:4984

C:\Windows\System32\rundll32.exe
rundll32.exe uxtheme.dll,#64 C:\Windows\Resources\Themes\Aero\Aero.msstyles?NormalColor?NormalSize
1⤵
PID:6012

C:\Windows\System32\rundll32.exe
rundll32.exe uxtheme.dll,#64 C:\Windows\Resources\Themes\Aero\Aero.msstyles?NormalColor?NormalSize
1⤵
PID:400

C:\Windows\system32\werfault.exe
werfault.exe /hc /shared Global\da214e37b09d494bab3e0ab8d611daf5 /t 5824 /p 5316
1⤵
PID:6052

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:5736

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\Aljaheem Theme.rar"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2988
- C:\Users\Admin\AppData\Local\Temp\7zOCAB9252D\UltraUXThemePatcher_4.4.3.exe
  "C:\Users\Admin\AppData\Local\Temp\7zOCAB9252D\UltraUXThemePatcher_4.4.3.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:4708
- - C:\Windows\system32\takeown.exe
    "C:\Windows\system32\takeown.exe" /f "C:\Windows\system32\themeui.dll"
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:5620
- - C:\Windows\system32\icacls.exe
    "C:\Windows\system32\icacls.exe" "C:\Windows\system32\themeui.dll" /grant Admin:F
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:1132
- - C:\Windows\system32\takeown.exe
    "C:\Windows\system32\takeown.exe" /f "C:\Windows\system32\themeui.dll"
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:5452
- - C:\Windows\system32\takeown.exe
    "C:\Windows\system32\takeown.exe" /f "C:\Windows\system32\uxinit.dll"
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:4912
- - C:\Windows\system32\icacls.exe
    "C:\Windows\system32\icacls.exe" "C:\Windows\system32\uxinit.dll" /grant Admin:F
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:4996
- - C:\Windows\system32\takeown.exe
    "C:\Windows\system32\takeown.exe" /f "C:\Windows\system32\uxinit.dll"
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:5936

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:2900

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1760

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa39df855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:5800

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5076

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Windows File and Directory Permissions Modification

T1222.001

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

6393b946-f71a-4aa0-a89f-f42a287a491d.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\6393b946-f71a-4aa0-a89f-f42a287a491d.tmp
Size 131KB
SHA256 f4efde7269b972dbcdf6d741f5ce295bc8f5ccfe85824021b2c2fbe3937a425f
MD5 0bf41c8521c8f76361b584b22e7cb403
SHA1 f56010cd7ec881358d21f65e7fa14ce53d65a8a2
SHA512 ce36ef8eed89f70af5356551cd71d0de7910cdf98ad783cdbb942ca30e099a4a087867d132a3b75c1735bba4908594434538788458d488266f0094d63d2a496f
SSDEEP 3072:5IvyBkjartaCS+uW8lH5W+f1K49XLWb9TBAPi4NXbHKji+ZLzB:lPtbmf1K49XLWbEPi4NTKlLzB
TLSH
T1A5D312613E41BCB4A9EEDB21B1902A15EAB8D94B953D3BE61CDE3F4805E36D9C304C13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 815cdb68bcd8d05ebe6ef92b9edc202dd952ce11452877735c62a4fe87a2297c
MD5 3e3f056184711d849315f1a7d5dcbf8c
SHA1 51f75e4451b56fe04bef5fab64f7bdd88c545f7d
SHA512 dff6b24439443de78407074a54d6419f5dcc96efeafed4e80edd7190f395e4a0203857cef17f2b22aee9cc10c0adf00f55c74dc0993a66067951a9fa0b0573c8
MD5 SHA1 SHA512

Submit Download

a0e2fb67-899f-46c5-991e-ea3a15018836.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\a0e2fb67-899f-46c5-991e-ea3a15018836.tmp
Size 1KB
SHA256 df784c8bcfa2467d8ab977690a0391e8bcdee2841a6cd88ef6c2e7eca15c8d61
MD5 d5b3473462451a970aec16f6e9a3e09d
SHA1 cbe63f5b8817a04e112774adf82ffefa8fefe1bf
SHA512 0376e80c6ea53c165da7396378d09edfcca73485bcf73aa0e560ae5645357ae6db4d7620e3894b4845853923039cf876eb0cd91e2fa94ff110bc58891b6630b6
TLSH
T14A318DF793E4997D850196F4AA116F1FCE790925131C3C66C9D8AE1B53F28B2D10074E
MD5 SHA1 SHA512 TLSH

Submit Download

c8b377d9-2ee1-48ec-ad6f-48994b4600ed.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\c8b377d9-2ee1-48ec-ad6f-48994b4600ed.tmp
Size 523B
SHA256 05eae3498279a7dbc660db2beae1ca5992df01d80e966acc3096078fdd1ae640
MD5 1289ccdfc41fc5141a48ed86d6fd2dd5
SHA1 bf9987e7750e94795ebce4c0b52d452b044c0ff9
SHA512 9940747a0ef20cc9908ac6629e34fd403d515ce58c59ce7452b38f37dc7566faf6f5b9648db94df8d6343c30f3ab8525193f2be12b4546f2558b24bd652659ee
TLSH
T13AF050F7E6697427507D05FF1D44BC096CB2E436164054F0CE9A425CA0C28A31B16487
MD5 SHA1 SHA512 TLSH

Submit Download

a4df9324-9265-4af7-b3fe-fa710406ec22.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\a4df9324-9265-4af7-b3fe-fa710406ec22.tmp
Size 11KB
SHA256 98a55c3396e401196e459490fffd5527b8f5cd546ff4d76d5b2ba40eba31e3c2
MD5 9076f4c420933555a834a0ace892a431
SHA1 274f1ae8d804d3a5824ab7b65abf3c9bae69fb86
SHA512 bd54880e3b3849ab7473a74a3a1ebfc4e51db68cd1d7080db8d64da1ae8df74a76ca754b6a8a1efed1cbd32cc0107dc18ea04a793989efd927ab5aea588ebd89
SSDEEP 192:esH4K6Cc7KxkXqK4I40pUZNCgVLHrKHfFKslE/E+XzKD/BE+ErUkKN9Y5Y43HK6r:lHjJc7KxkXqKf/pUZNCgVLH2Hfgsl1+3
TLSH
T1FD32E927A88D6E3F0FE8D50DC8126F8BADF5029772640C2852FB9D0803A57CA115A5FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

da393d9e-5924-44a0-b526-5b2a3490485f.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\da393d9e-5924-44a0-b526-5b2a3490485f.tmp
Size 10KB
SHA256 e331a381efc7f98e170571933f3230f64d6514fcb941f77909eefccb979abc41
MD5 487a611cead9c608d82dbc38749e1008
SHA1 a8c293858eca537faa8cc7f1dde17cd9099cfbcd
SHA512 21938932db2984062c57eed928ec3b55c7c3216c29b9df4094d6ac9fc2c1a0ff6f0472219d9307cee9bc9688de0dd5b863e88ce2a86796e4e305fd15f3aabac3
SSDEEP 192:9R0Uf9Hqv7aqpAPRp2f9LHsb+WNn1V0xcP6PyIsnAUge:9R0Uf1mrUX45wH0g0e
TLSH
T1CD22712EAD68757F5CDAC22AFA657797D3F9102134902E84E6FC892C25E75CC2227807
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GrShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

e14dbd6e-33e3-433f-86c2-130dfea6ef01.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\e14dbd6e-33e3-433f-86c2-130dfea6ef01.tmp
Size 132KB
SHA256 34625692de1faf0c770e949db1570ea6b8c78d8e215d5457f315979684cddbb2
MD5 8e7756fdafcd161adfe0b62e4046e311
SHA1 35ab7ca9200ca26855f729d1c7bf901066a1d5e7
SHA512 0f8a6600e1a888f324d9a372f57f4964475a969f60222073bc68ffb415c6384a4624d8b84c31cbead144543a02c547b732001cc58641317e6f09798bc3ce0276
SSDEEP 3072:+tIvyBkjartaCS+uW8lH5W+f1K49XLWb9TBAPi4NXbHKji+ZLzo:+pPtbmf1K49XLWbEPi4NTKlLzo
TLSH
T1D2D302217D51BCB4A9EEDB21A1502A16EAB8D94B993D3BE61CDE3F4805E36D9C304C13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

346c0e9d-5e26-41cf-b9eb-dd14e96f28ff.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\346c0e9d-5e26-41cf-b9eb-dd14e96f28ff.tmp
Size 21KB
SHA256 7814820128b42e663dd23098f43cee5653916529e7bd2246f9e61f005d3c9ecb
MD5 526bd2565f19e579f58b82319ee1bf2f
SHA1 ac72a2f0137745b9a00348f821705160b3ad4429
SHA512 5dbd865ae4ef459dc642e083bccf7f545b62dcaabbf4159f4caaccb6f02203393e4228dc650c8273962b16f471d77c6be9db88af092843083f432baef8c214cc
SSDEEP 384:siFRQkUSvQKsNm8TUNTUlIlAFiLLuLwYlF4WykJ+ybh9PGH7vBEDXNIIlk:XFD1twgvLLWv1Z9PGH75EDdLy
TLSH
T1C1A27D729898AD3F5DE79A54F14E3613DEB4812BCAD46F90E6CA9A1C01DB1CC134BE11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4d1590a6-029b-45cb-b886-113967bcc8ad.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\4d1590a6-029b-45cb-b886-113967bcc8ad.tmp
Size 21KB
SHA256 c8b7f2a7c2c093031d0947e86d11eec737054869a83a66decd0d9444bd7c5e7e
MD5 fac131b84786176ba2492090a9daf9de
SHA1 b63f79d09e63858b1631049274841f4c12cd8b1e
SHA512 39dd076b591bfaba808df18457721742309c85a073801cebdbad5d5f164d338fbd9f368a808446ac9d312979d18b164f699111dff3f35886e5caea41aa16b8d5
SSDEEP 384:siFtQkUSvQWsNV8TUNTUlIlAFiLLuL7YlF4WykJ+ybhCqPGH7vBEDXNIIlk:XFXxkwgvLLdv1ZCqPGH75EDdLy
TLSH
T193A27D729898AD3F5DE79A54F24E3613DEB4812BCAD45F90E6CE9A1C01DB1CC134BE11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6cf00c3b-e8f1-4d50-966e-c2900c33e334.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\6cf00c3b-e8f1-4d50-966e-c2900c33e334.tmp
Size 18KB
SHA256 5f6f4c8d4da988e6d335434fb1ff8940af511f1b098ed6d98731fd44bf808e27
MD5 9aa9cb4f096dff96cf48c0b3c1fc78e6
SHA1 aad7aadd2e8ca5055c7d63ee12b35dd4123769f1
SHA512 ead060f6744506251e60d369112cecef53b7395354c6295326bd233979070ca3c40cb776cb77234b546c59b42b599b40d0c3fed9a09ad0499f92de3f60564c27
SSDEEP 384:tQkUSvJsNLAFiLLuL7YlF4WykJ+ybhCPGH7vBEDXNIIlk:XJALLdv1ZCPGH75EDdLy
TLSH
T1FD828D75A87C6C3B1DE3E515F14A3613DEB4812BDBD81F90E5DEAB1C05DA2C8234BA12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

86b0cf75-1e41-48c3-a44f-5cba35f82008.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\86b0cf75-1e41-48c3-a44f-5cba35f82008.tmp
Size 18KB
SHA256 857c9e02d2e075a6f6f32d19111e90eefbe7ba739ac5e801232d39fb59b3364e
MD5 775c2de6042e8f8803aac54d6a48a3b4
SHA1 b72ba3f29938bd6820adfc855ad209d40f3cef7e
SHA512 170a091509963ca901675cc79b4b01add2d877a48ed397a1bf647350ae172f8a1bc15a11294972fa236732795c1b0291f6b96c6cefdca1156829fd1472a3635c
SSDEEP 384:3QkUSvJsNLAUiLLuL7YlF4WykJ+ybhCPGH7vBEDXNIIlk:JJFLLdv1ZCPGH75EDdLy
TLSH
T151828D75A87C6C3B1DE3A515F14E3613DEB4812BDBC81F90E5DEAB1C05DA2C8234BA12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e540ff94479edeafbd2f52590dd9a8011e45e365c17d276ef0a72a73cf8703b0
MD5 34381c2be9e66e3a3f2106d98929cb65
SHA1 9dbace176fd9f60199e5fcdc1cf19399a18947dc
SHA512 715895995299450f87643e3c2823927f88e88c79d2e3fc83048a5aabc884b75a08b9125c07807996b45cd41a0667c3bd0cf692e72178d58addd93f4d0b89b947
TLSH
T1C7D022B0E3302230EAE8B23200E0C3328802EA020F883F000003E008ACF8BB020C330A
MD5 SHA1 SHA512 TLSH

Submit Download

1a78a407-3d8f-42c9-b1b9-4fc6413029cf.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1a78a407-3d8f-42c9-b1b9-4fc6413029cf.tmp
Size 10KB
SHA256 d3d8bf49c311dcadc1d5910a543f98e7bd44e265f7db42a2a907a8e3e6b28c6d
MD5 6b2cad2227ecb3388d0a9e0a8bdc1b14
SHA1 143e73eb860de9cf7ead36af5b264f944907fa40
SHA512 d91762eaccdca64428a2f237f84f463a68a7db6d258042a8fbb802af553f963db4d307b461867e0b3ce6a669876032596c14e34f75e59a43b370b17291772226
SSDEEP 192:sxZdRfn//fOGs7p+5IdpLHW6+WNGYt//aj0Ig5rJ:sxZdV//fBs7p+SLHbGeT
TLSH
T1D822C7526E28797B9CC7E20DBB157F53E6F9503260901E48AAFCCA1C09F7ADD224750B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

28dc5ba3-5849-4662-9bac-f5b79f0b4c6e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\28dc5ba3-5849-4662-9bac-f5b79f0b4c6e.tmp
Size 9KB
SHA256 648a4e08725b14620823af7744a2825e5686203062d7615d1fdaf1e837bd72a7
MD5 14e50f72da6ceb9484c65e790be04e59
SHA1 2e87f47963474fcf6886a85fcb598e8c8170690b
SHA512 71de4a77e2513cf39ad37ae9d322f39d47b77248d2f16aa3ea8618a474722d1c9e1e7b143567b9dc107e5915a2edae9544c958fda9a6c81e62d5d84ebd78993a
SSDEEP 192:sxZdRfn//fOGsO+5IdpJHW6+WNGYt2/LT0IgrJ:sxZdV//fBsO+SJHbGU9
TLSH
T12C22B7516E28A97B8CC7D20EBB257F53E6F9543261D01E48AAFC861C09F66DD220750F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

48f8ded7-db80-4d3e-b7a6-03863d760946.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\48f8ded7-db80-4d3e-b7a6-03863d760946.tmp
Size 10KB
SHA256 0f0d2340340219a4d33dc4142f7d960117cad481b4f2b51d2c217e1c58f72e5b
MD5 9e3d98ed4a5dd8a4aa02dd65f4ef26eb
SHA1 08cab6278d5dd0857855ed41255fdc2623678883
SHA512 6c3267a2e945504809aa5c58911d25978e67d6a8cece636ba1a476c8cb1aacff5fb71afa9e1a456eabb6935af1499e91ecb7b63a188a4100e7a1ee81bb414a88
SSDEEP 192:sxZdRf5//fOGs7p+5IdpLHW6+WNGYt//aj0Ig5rJ:sxZd7//fBs7p+SLHbGeT
TLSH
T13F22C7526E28797B9CC7E20DBB157F53E6F9503260901E48AAFCC61C09F7ADD224750B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

82de127f-cb7c-49c7-922d-9e38e51798d8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\82de127f-cb7c-49c7-922d-9e38e51798d8.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 d5979aec573fca8e1d4c8f738021b917e7d98a4a0d9b94f586c4e3a9443a3fc9
MD5 8205d6e78dfc74190b67269f62a4059b
SHA1 ce669b260a7186447fc08f7e2853ec1df497c318
SHA512 4f21f69ac85bcffddda7a32997755ae0f230ffc2a2c6bf0213faf297b65e460dc96804ceed42dae483698cfebdb7579f10863db8d1f7c966bc7b997d1b4588c2
TLSH
T1D6E026CF08C8C22FB608A68752A8830CC280371B93C06D0E2740C48D7002058EEE7BB5
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 d1f11268b75a53d7be9c0f434d59f73f46ab16ed0a9376849376d40e3ea94c54
MD5 15af6f315012cf130e5fc84fe59e0880
SHA1 857d31e5a9cc1dd9a740cf2075efb4ca5b583611
SHA512 b551c0825acdf833eefcd472d87d55120114da1e4e1b9f6b82748425b34e8376171bfeaa145e2fc008c99ca72f778e561a9f9de3aca17dc5c347089b3393acc4
TLSH
T1A4E07D8518C8C23FB3486B4B43EC630C82E03A1BD3C0ED8E2784CC8C7401054F2C6AE1
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 0ad8718e866de1e89d96f01906365dc5dcff371f333ed16e1573810c6b3b1272
MD5 aa73c32e034d05fc52a7db24350cb6a4
SHA1 411469e1b91f2f960cc7db12790b338bc967d0a1
SHA512 658cd6bd099cca8da7b8a7078ddb167ce3f95fce28b467eded3e0032fcd1e510f9a9ef87e21e76eff8d0f9db1285c29fd2ce63a806706764005b72466b161fbc
TLSH
T11DE020C50CC4C27D7617644B4298874C81C0361B97C4690D1740CC8C784305066D7E62
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 623412ee13dc2a85ebaf29ec528d57dbcad3c4bf8d1ee5b103727e24c57235b7
MD5 5aaf1fa6c932962bac881cc44af6df6f
SHA1 bb46579d05f3c276ad1bd6c7b5af74407e84a9d0
SHA512 5af7ef0682f9eefa9737edb2deae225d50f642b6b3e02881310bd93991e5f577e24768f499545fc547235af9d864905baac036fb233f7a78b9b4adad35a6b469
TLSH
T157E026950AC9C22EB24A645B83A8574CC290761F97C0798E6B4CC88870434B4F2EEAA1
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 5cf8e511e6ce1e9d13611ed4f683b997fae228dca2649726e0bffa3c9bca06c8
MD5 d7a3aaeab6f6c2e22a22dac3bb2488bb
SHA1 b21724e9610c6eb820376f0aa6a9c72626299754
SHA512 34c2618265354ee4e8131ad3e6a52a2ea2f7c8c5a9f29591f01b5c17ffa313455ec26116412234c4293c2b275dbdf75e4315a3e855bd22f65db5c1451e9e34b3
TLSH
T13B6183959982509DEFB43330B9C9D08BFA7C898164AFDE63349CE7B9B4467745284CCC
MD5 SHA1 SHA512 TLSH

Submit Download

81c5a1de-e827-41dc-838e-aaff68c5481b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\81c5a1de-e827-41dc-838e-aaff68c5481b.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

1402fe1c-60eb-49ae-bf9b-a30fcd592c66.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\1402fe1c-60eb-49ae-bf9b-a30fcd592c66.tmp
Size 1KB
SHA256 de28be62cdfc45850a70192eeaeb0d5c38e0c2f1f2f9ca20f34e1bcef9652e69
MD5 ca79166b21cd3d3ed8a13993cf9da626
SHA1 53a19b2c4f309f2adf2360a65d36c58d8a284d28
SHA512 e64f64c0ae806a1f27f5469e26b1b73497465c57044f387d18adf620b73088572829f541a0e819707409b106baccf5e6be0eccb61fea6f006046014ecb8cc65c
TLSH
T15F217BF3C2D5866ECD051AF06A14BE1BCE2D055583183C1A89D4EF6BD7E3066E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

5dd16797-6af3-4dfe-8188-55bfda62dd2e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\5dd16797-6af3-4dfe-8188-55bfda62dd2e.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

ab411e54-9265-46b7-bddd-22e00fe2ff74.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\ab411e54-9265-46b7-bddd-22e00fe2ff74.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 dadb882388a80fb8e050c174f37e787e6ac3c117dd27b996b1a1f567630bfc0a
MD5 0931069c25c57e11aa415780666fbe36
SHA1 0bef89c1c05842b352dcf362a5b108c0fce79dc5
SHA512 d5b51cdb0c22229a02e2c1a2d7672544adf5b6cacd3ac304e13f8a76461fefb9b11ef8ee68524d091e9410a515d2197b2751e24378cd9fe94baedfc6e9a0c235
SSDEEP 96:KQbCKooiAoZqeo6axL+7sh2xKp4hIxVgYz2Y20Kf6a9:MpxJ39
TLSH
T1AB91930074BB42903A7E2D4C8178AA2A464230A73025E53B7BFE54A39F2BF045DFDCD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b7fbd78c-6a24-4f7c-9f13-30c1da308b82.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b7fbd78c-6a24-4f7c-9f13-30c1da308b82.tmp
Size 10KB
SHA256 edddb0b27e188c158c0d483a0111608b6db06295f6502469bcec3122d11bcf19
MD5 65dea87f24b6444242734603bd6953f1
SHA1 de20d6847f7cbe23ee7816b5b7e4e4d02b7b708e
SHA512 f098c79d03df8de8e38b04fd531473f10fe747961ed9ef7edb4020fb0431b5b82fdedf3e75fafa569028345185b58954ab785297065de6c3904d8e66478a7b5b
SSDEEP 192:sxZdRfn//fOGs7q+5IdpJHW6+WNGYt2/LT0Ig5xJ:sxZdV//fBs7q+SJHbGUd
TLSH
T19222C6526E28B97B8CC7D20EBB257F53E6F9503261D01E48AAFC861C09F66DD224750F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d5b16611-c71d-4e66-ae97-743359088630.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d5b16611-c71d-4e66-ae97-743359088630.tmp
Size 27KB
SHA256 186b2e430b628c51371e1203c9ec7083cb8de8d2eddc68e199ed68aa07ea0408
MD5 11e1eca200ec7998b89cfc3fca0789d6
SHA1 5f74734befa41616ce223c7acf6702f945a0678a
SHA512 1a76b412a3a79dab366b7f42ab2e442276cba1d0ebd92f19996c93565916964d5569f92778ff9a7aa86ad8a960dc7bdcccd4c3f9578c353e2dc83f99d7609d2b
SSDEEP 768:DHOtS3IWvUgqc8F1+UoAYDCx9Tuqh0VfUC9xbog/OVp3LlTtsbgrocwv:DHOtS3IWvUgqcu1ja83LNWbrcwv
TLSH
T1ABC2F93B680CCB7E4FC01E9DDC6A6F973E9802C7A6689D4047F9994C02D77EA51264CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fdb97065-1c6e-4bd7-a554-1c4bcd6d65ed.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\fdb97065-1c6e-4bd7-a554-1c4bcd6d65ed.tmp
Size 10KB
SHA256 c2f5a72332325c375b095951f13371189a15b1a5de134002eeb4c6652a86a029
MD5 ebf9c36b114294e1e17df834ba0b5145
SHA1 6cf0c295c0f277712babec84051e1a612038de12
SHA512 f4c29301bb915c69b625993f6c02cde5d157aaec443dba296ca614a10545d11635d9acbfd1c09787af986c2bc9b9f64a0df7588938bd2b40f52430a0287036e7
SSDEEP 192:sxZdRfn//fOGs7p+5IdpJHW6+WNGYtT/BT0Ig5rJ:sxZdV//fBs7p+SJHbGFT
TLSH
T1E622C7516E28A97B8CC7E20DBB257F53E6F9503260911E48AAFCCA1C09F76CD224750F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fec56edb-5cb7-4dac-8f03-eb51999e017a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\fec56edb-5cb7-4dac-8f03-eb51999e017a.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8a7a971a-7c7e-4a23-b703-a3fc23ff64e0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\8a7a971a-7c7e-4a23-b703-a3fc23ff64e0.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

b8c791fd-bb6e-49f2-ad2b-295a05e9fdeb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\b8c791fd-bb6e-49f2-ad2b-295a05e9fdeb.tmp
Size 8KB
SHA256 a818d729ae4566d87894f4210d389bc4ed8c338ed0d3787f6dfa8f9d24655a69
MD5 24e9db5ee4d0d0a125445ae9003ed058
SHA1 f49529d0e02b163a7762b841601c80c511a0ee1f
SHA512 87244be4b19828eaad00b764407e0128d1cfef1dcaee87dfbbadc25d98aeb1a31be1294885b128c801a9257154271c8f48e66a8062423f3abf2dc4d6cbd4abd8
SSDEEP 192:8ONG6v6mGdQmiUyXLaXe4WykAm+ybhqpojeqnGU6:8ONG6Cb1Xe4WykJ+ybhXPGU6
TLSH
T1EB122A34B8A8AC3B5DD3A555F48736139EA4423BEB886F90D5DC6B1C06EF69C430B912
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ef9ba34a-dd73-4d51-9cc8-57cf00567904.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ef9ba34a-dd73-4d51-9cc8-57cf00567904.tmp
Size 8KB
SHA256 29befb892ea0ce06d7671b2de20e1ba4c8dfa15ba3758087bc5e9775a801d4e8
MD5 047dabf0aea2516a41a7414e8b2f9672
SHA1 6a8d66a2950e49e269c3ab0daa654c3b78b669d8
SHA512 61af990109f083d760873c6e5d0aa18bf09712f2d62b25a0ef83cdeb25ccae746afba9ef40de09bde2fd8796d3b5e5b7964780f0a78370ea0fa77815cf412bb3
SSDEEP 192:3ONB6v6mtdQmiUyEaRe4WykAm+a1bjHZL9U6:3ONB6C8ARe4WykJ+IzU6
TLSH
T1A202FA34BCAC687B9EE39E55F4873B139FA4013FAA942F84DAD85A0C01D768C1347923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e6287fe7-ac20-40e5-b976-4857fc172e35.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e6287fe7-ac20-40e5-b976-4857fc172e35.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 d956f61525d39f9423b8421f9a92a2316ac8c91eb58f4edfadb6b0ccbb48fdba
MD5 4bd9d694116edb6909f8bdce318d1b0c
SHA1 e678f208bc4b366bfcb9eb5e773ce76327b686f0
SHA512 4dcbc2c41423e41659d3a4f3b83da03cb7a51a3784985a6da527a2b57c963d5678ea40b1cbf53b469e11319e407a8e418d486bea9b78fc88900c6c92170eb667
TLSH
T13F41D358B6F92148B7B77E5AABF6A86E44BEBD372F06D45D10110E4F0A26A00C871737
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 019cec7420033bc41da8b174d8fbc1d590a586a51deabb484baee6afa9542a7b
MD5 40bfac17df3d9ca92d950a8e80a29dc6
SHA1 6f3ea05456958eb99c285607eee357ca64176373
SHA512 0fa47fe82d87bfcd06e45c96e0ad869089b714add9d7f4a2ca532493de5e32eabf44f4925b5c9d6b975dd095a022a3b6ac03dc069cdc83514a4ad87becc9e5a8
TLSH
T106413758B6E92148B7B76E1AABF7686E447F7C672F06C49E10120E4F0A22B40C871737
MD5 SHA1 SHA512 TLSH

Submit Download

Custom.theme

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Themes\Custom.theme
Size 527B
SHA256 70e4633b4402b18eb9fd8e146da93fddf6bc0f4f1d5fbcc194478a06fbc18491
MD5 d5d42e7471d331f3d3429b515c404c23
SHA1 c54db0c1ee8a062c65e84e4c8f3a89d169b1fe13
SHA512 381c9b45b42bed98d55242fe3f1c8cba87cf9c11c0f621d9383591dfc399bf07a4ffaeba1b86415224746b44be8e9af92202a34c97385b05b0d940a47da3f73d
TLSH
T1F2F07527F80989C09877229F3030DC45F4363B2B40A07A1828ECB4347B9A47C277F497
MD5 SHA1 SHA512 TLSH

Submit Download

Custom.theme

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Themes\Custom.theme
Size 512B
SHA256 c9c09f6ed2610e71cdd9402012c0eeb86297f1f4f6a2b8d4ccc8549423861e9a
MD5 bf51f00062d3c71ee0f7f5e728812541
SHA1 1b8d47a8928e5e19d57745d4a56657ac2b81122c
SHA512 dee3c37650de578fb50ef052831dba2b8469381fd47415bffffa00f46223b9a6c3fac1f32aa3f96a2c5168a24b97b560bb436e17b34f276cc266d55529005f51
TLSH
T118F00526D40D88C49C77259F5010DC45F4653B2B41A1765925DCB438BB9946C677F057
MD5 SHA1 SHA512 TLSH

Submit Download

Custom.theme

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Themes\Custom.theme
Size 1KB
SHA256 1bd2f46e602ac2815dcd5a74569992c7a552753dfbfa953ece5c7a0d0793046d
MD5 1a20c4c75b1e71574543dedcb427082b
SHA1 ac6c0e0bd9744e7899a86283f8a794b0c78d7867
SHA512 492424c183d5ea1d7db0c49979e09cd277f52f19aed66c0e419cb2aedc648c71ab6fd267e885cfb3a80489e2ddc8bcd84eec3e940c809aa17792da4e1f961181
TLSH
T15641D630F308CE13EEE271AF75C4C40FB2BC741A8984F3451CC0A065F68711A83B88A9
MD5 SHA1 SHA512 TLSH

Submit Download

Custom.theme

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Themes\Custom.theme
Size 1KB
SHA256 c8d6d3e46b84e1387b659b20872befd16b6c1a66aff20711cdd0b9eb438eb317
MD5 b31546eb893cfc3d101fd0736f2a5ee1
SHA1 e0337b089953b7e27fe701db213387fbb1930657
SHA512 cf5d63626e7bb8bbbb150981699268a616c2e51557f6d57c51b6a353db1ad4ec69c5bafb254a06cc79f11af9b49a8174bda240281214f26b58cdc2411dd58abe
TLSH
T1B741C730F308CA53EEE275AF75C4C40FB2BC741A8994F7452CC0A069F69751A83B88B9
MD5 SHA1 SHA512 TLSH

Submit Download

Custom.theme

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Themes\Custom.theme
Size 1KB
SHA256 bfa71a3ecc7bac3023517a8c2443088e766316ee90533e8d131af4d407b05e17
MD5 04dd430bbaebf7f15a8f46f8aed4dbc2
SHA1 71c994672828ddaee684468f88e055e630a953db
SHA512 c05dca2060b72b5ec32b8d47185e829bfeb2b4da98d9400023745f43a439ef4ddd7ceed65e09de823664ade2a85bc2c03c1c9b01a11d0e2c3ba55b6639ba08d7
TLSH
T1D841C730F308CA53EEE275AF75C4C40FB2BC741A8994F7452CC0A069F68751A83B88B9
MD5 SHA1 SHA512 TLSH

Submit Download

Custom.theme

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Themes\Custom.theme
Size 1KB
SHA256 78402c314397a2cb156f3d899f33739f50712532c406774d24b22eecfe253602
MD5 ca1dc5947aa5ba9d91306d7a03cc2dff
SHA1 8df5cb4d48aa54b76b4f689a2021d6b9944ce191
SHA512 f97b264eec736e4ced0ab2cf97ff04e3b9f4296b747b0491cb749f03b402c94cbcd7eb1ccf8ef336150135e06e67de28b03cfc3f1a81cc05f5a47381a128dddd
TLSH
T16E41C730F208CE439ED271AE75C4C84FB2BC75668984F6452CC0A069F68711A83B99B9
MD5 SHA1 SHA512 TLSH

Submit Download

x.theme

Path C:\Users\Admin\AppData\Local\Temp\7zO80CD019B\x.theme
Size 602B
SHA256 2e9c42550a52d44bbd89d921d4b69c84eb85d0ba73d5e9acfa9ac14177a87b23
MD5 c6de50b84336f5b677af2729581a411e
SHA1 db69ef6fee39de340829e6e2a98312533d1c8c20
SHA512 8ee47a8045d5242ea066d2c175a4042bfeb0f183e6abf00c6e59217c020fb389fd11a2e1bcebb8e8c2a1116d4315e97990450cbae5a75d83611fc68f7eeb9320
TLSH
T1E4F0DD27D10A89C4AC37226F9020DC07B055371E42A5F2489AC8547CBB968646B7E05D
MD5 SHA1 SHA512 TLSH

Submit Download

UltraUXThemePatcher_4.4.3.exe

Path C:\Users\Admin\AppData\Local\Temp\7zOCAB9252D\UltraUXThemePatcher_4.4.3.exe
Size 159KB
SHA256 431675fcbb448567fafc83fee2b93c620ab7a7f5d3d7a7c7b922fec52d58deb2
MD5 8992718c128b589e19216ef1609c50c3
SHA1 dee042937934ae88ba0adb59752ef5ed13edb0ad
SHA512 b517d678e8590fc100a9aae590f6d37d440452cfab97397a8b62f592a164598cbc0f5a21f65bab22e3c623faeff205d1b137d1f6d104a4792b472682767d65c9
SSDEEP 3072:qHadUuK8JdwYsawEuGstcRY/Ehsd8uKK0+GFlXtTkYgW7O14yaVHoxlL2iV:qHadpdwMct24E7FlXtTkY5qy5NsJ
TLSH
T14AF3F14073E0C967E4A606316DBB9F770FFABD211595970B1B80AF2E7C33B50D91AA90
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SysRestore.dll

Path C:\Users\Admin\AppData\Local\Temp\nsd107F.tmp\SysRestore.dll
Size 5KB
SHA256 c686b4df9b4db50fc1ddb7be4cd50d4b1d75894288f4dc50571b79937d7c0d7e
MD5 4310bd09fc2300b106f0437b6e995330
SHA1 c6790a68e410d4a619b9b59e7540b702a98ad661
SHA512 49e286ccd285871db74867810c9cf243e3c1522ce7b4c0d1d01bafe72552692234cf4b4d787b900e9c041b8a2c12f193b36a6a35c64ffd5deef0e1be9958b1f7
SSDEEP 48:S5SLAPmT5fqaB2WB2BtBAQPcPzRcCB0E3ngT2p2UlE41qSK1Gx:ASQM57LAfuQULRxB0E3gKU941LKQx
TLSH
T125B12277D7D089B2D182073A44C749E72666D165239045EF456BAC3A39622E7EC3C7C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsd107F.tmp\System.dll
Size 12KB
SHA256 23d618a0293c78ce00f7c6e6dd8b8923621da7dd1f63a070163ef4c0ec3033d6
MD5 192639861e3dc2dc5c08bb8f8c7260d5
SHA1 58d30e460609e22fa0098bc27d928b689ef9af78
SHA512 6e573d8b2ef6ed719e271fd0b2fd9cd451f61fc9a9459330108d6d7a65a0f64016303318cad787aa1d5334ba670d8f1c7c13074e1be550b4a316963ecc465cdc
SSDEEP 192:ljHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZqE0QPi:R/Qlt7wiij/lMRv/9V4bfr
TLSH
T1B1427C1297B089F2F551493419667F2A6FBEAC5C13F405A3CFE304C63D212CB9839243
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

modern-wizard.bmp

Path C:\Users\Admin\AppData\Local\Temp\nsd107F.tmp\modern-wizard.bmp
Size 201KB
SHA256 aea40659bdb08337064640ea8b4f171881d37456b37b3e2899349ac04f0889c5
MD5 5f728e4e6b970db76c64be8ca3cafc87
SHA1 b7481efd9f6938903214451d792a8b13a645c922
SHA512 2cc4e870290f8faddc8eca1a03a1efb34711b3951e263a79f259fd998a9a1f957dbf58c110c5fe64febd414ec7a22e125353f9d5c363866bd0d4298452fdadc8
SSDEEP 768:/ou/hmB0wVZLLsg0fjA9hmgr+IYesuqftVraywBZM6mJRmYUt+Bmm:AUh8xVJHnaomftVraywfrmJRnUamm
TLSH
T18A146C591B3104EA54595E4AB8333A7A1BBB8CF90BB6028E35EFF1353A7B7634C07605
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsDialogs.dll

Path C:\Users\Admin\AppData\Local\Temp\nsd107F.tmp\nsDialogs.dll
Size 9KB
SHA256 89a82c4849c21dfe765052681e1fad02d2d7b13c8b5075880c52423dca72a912
MD5 b7d61f3f56abf7b7ff0d4e7da3ad783d
SHA1 15ab5219c0e77fd9652bc62ff390b8e6846c8e3e
SHA512 6467c0de680fadb8078bdaa0d560d2b228f5a22d4d8358a1c7d564c6ebceface5d377b870eaf8985fbee727001da569867554154d568e3b37f674096bbafafb8
SSDEEP 96:ooEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YMNqkzfFc:ooEvCu5e81785qHFcU0PuAw0uyyIFc
TLSH
T16A12F992E2A454B3C5D6523B35AA2F2DCBBD5329B0927C01C7738E4D393957A6E38343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsisFile.dll

Path C:\Users\Admin\AppData\Local\Temp\nsd107F.tmp\nsisFile.dll
Size 5KB
SHA256 a820a32e5ce89e3e336afc71aa1bf42a357ec542c2bc6e50c6255c1333812587
MD5 b7d0d765c151d235165823b48554e442
SHA1 fe530e6c6fd60392d4ce611b21ec9daad3f1bc84
SHA512 5d801c24dfa1b7326f72f9c0acf3a330ef0cc3fce25ceee200bb12eab8c2b653025602e610e0cecda1e7cbd851ce1b66252531220b557a378ddb0b4a1741fa66
SSDEEP 48:a+guelvxkcuEkVy5wM4zL5stbmaN0QpUFdAwsj1gAtl/lSFc/H9UhV0n:3CBxIEkVQwzR2300URs5ldSFcv9c
TLSH
T191B1D83B69A097F2E0044673177B2EC76CB2A16433C9012F4B531A207E51937EDAEB47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EIOYYY7NK60R63ZBX3WB.temp

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\EIOYYY7NK60R63ZBX3WB.temp
Size 3KB
SHA256 c13f8b7bcfa98bb871d37c37f7fd5868d36ebaa634ab7f3c325fe6937f9a397d
MD5 906f2cda87b610120fcd457cfba40ad8
SHA1 3ab33e8c69337073b77088654c5e0fbf88630d72
SHA512 9c6b1fb6ac5db5d6f84129a9412fc2e774fa06be03a8bfe61324e70bc7f88ca55d27ce4a07c40698d9283d6bc93fb5b16aa8a5deca81286bf4fbd9691d683829
TLSH
T19681BE006BE71A15F3F78AB395737B10AF3BBD069A154F4D109486084CB3B05A5ADBB7
MD5 SHA1 SHA512 TLSH

Submit Download

ccba5a5986c77e43.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
Size 3KB
SHA256 33768e05557d36ad756572774571201f68c13c4770954858abaf459aff424153
MD5 94a1892b56c3d7399032524eb423ca23
SHA1 5285bfa7d836caf2cd146e72c68c5f0c5bef2c33
SHA512 c5b1f137c10d0c240c82b357828f1c5bc6e90ebb697cb61467014e9f35b163658c62b3e71e9424f566821cfeeef91119c0b453d30ddcda917ed0b1277ef4e3ce
TLSH
T14081BE006BE71A15F3F78AB395737B10AF3BBD069A154F4D009446084CB3B05A5ADBB7
MD5 SHA1 SHA512 TLSH

Submit Download

Aljaheem Theme.rar

Path C:\Users\Admin\Downloads\Aljaheem Theme.rar
Size 6.7MB
SHA256 c2faa32f93874b30e1f051f184f2c7ded3fb1167cdf6cb017830a01fae21ae9a
MD5 b8c4ee0ff12b989bc4c5f0774ac0d7a3
SHA1 991bbba350965de0e5f88bb3f982585b0e0dc212
SHA512 d9e006fc6186bff675b8011e2f2035dad97fb6f97dff33fe2790676871b0ffdba58a2e308b224edf2119af3bcbcaf1615948d0ec257c2164cbcd2d749c1065e2
SSDEEP 196608:r226HG9rEOKDihpijvFS77HtRV27ftLIszOulj8EK/Lgo:d6m9x/ijNS77HLVo1FXoEuko
TLSH
T1A0663335EE950D69F73C2592509E1F11085EF33D8844929EEF7B1BE0EA82AC54BBF490
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

themeui.dll

Path C:\Windows\System32\themeui.dll
Size 474KB
SHA256 2e9a98f96430efb7df055f9e7a29b31bd662ed05690ac9594ce893a118c75f52
MD5 66ea4f7fa6ca164d6a0d79be0579719b
SHA1 7eb3a56a6b172a259f05d12ccb3ba6f94bbcab44
SHA512 2a79ffeb4a7b2fa8f1e349ec312fdd8107336579babb496916e5be027292ea0a449cf5ea0478887a96adfc6c2681ff1d58646727bbceb859d3d9953880ef58b7
SSDEEP 12288:cVXspoht8WfA0Ap5Y/UW5saaN09ikftZkQZrpfWDnH6cDKHsYV:cVXsWPJ2q8W5saaNGZbhWracDKHsYV
TLSH
T153A46C5D22FD22D4E676E13CCA138616E9723434271292DF16A0C1BD5F27EE8B93AF11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uxinit.dll

Path C:\Windows\System32\uxinit.dll
Size 117KB
SHA256 353a59ae5d049c1add78b66c7b44b4f4777bbf7b20f8bc5c2f3a064f457b79d5
MD5 0896f2773c44c42f1beb170ffe4606f2
SHA1 b306014be22e4017bfc0ba258b971ba9aef37dfb
SHA512 90012b2c6fa3fd1b0d24ec9e586dbcef1499153891d39079f4286a80dcca8b03077dbafeef15b016851b48700e326e5c0ee530c59e168096c323ef40570e51d4
SSDEEP 1536:4hd2i4bL5byVHXC0VOp0psLTzO84sukk+2UQEbflRJoALoLAqumv7nKOfASIjN+5:4bqVy8al0Akkvc9oALoB+O1IjN+02
TLSH
T146C3291E72A920A9D57B92BCC5434605E3B27434231267EF06E0C6BD5F13BE8AE39F51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xLinux.theme

Path C:\Windows\resources\Themes\xLinux.theme
Size 622B
SHA256 fe83a5ae79e2168eaaa5a1cd320a52dec0c0b9f9c39ad4f8e0e3149d10c2a946
MD5 b741c5768118ed410603c414add23724
SHA1 a86a414464b5ade990e67e1bdcab810b45b1145f
SHA512 aabdd2211a9a7e50cf2cee6303c23f85879a0c8296591e1ef6213e84792f83ea30795d522eb990b74b61eeca948178178f171e695345cadffec98573308b8931
TLSH
T1B8F09E27E10949C4AC36226F70209C07B055771A42A1F6489ACC54B8BB968B4777E49D
MD5 SHA1 SHA512 TLSH

Submit Download

xLinuxNA.theme

Path C:\Windows\resources\Themes\xLinuxNA.theme
Size 630B
SHA256 8511f0b15face8ed9b32295e5e5dbb7c64fc7c8ce6d55e6e4adfc1b75d052956
MD5 f5dc90aaa4da0d27f0c8f931dec8c782
SHA1 9d47521fa1cdd64c242f5b5ba836343e38d5955b
SHA512 96aa1d481831c81bea23d9cbaecf8556c66b7032d9e46e205ef5948ec0cd03aaf09e7db0eef2f6779457f19a9b175d8c797cabcdb6be30d13d644b71520a2e71
TLSH
T14DF09E27E50949C5AC36226F6020AC07B055375A42A1EA88DACC54B8BBD7CA4277E49D
MD5 SHA1 SHA512 TLSH

Submit Download

xMac.theme

Path C:\Windows\resources\Themes\xMac.theme
Size 614B
SHA256 1b1175c52615130fb551521c8bd04ee7d3eb19f48e4c69b10882c67d69881504
MD5 6d033114c1b95afd214ff7287640e19b
SHA1 ef2630b965889ed17ecf545b0cb380350a9e70ae
SHA512 7d6205a4af58c8e4698119e8abf5f3749ee1e97486438a0785221b207363fce27d0fc8e031c441cacab6abee90d206d816dfc5e17ecedbf0d3abc171eba2d843
TLSH
T114F0DD27D10A89C8AC37337F9020DC17B055371E42E1F349DBC854B8B79A9646B7E05D
MD5 SHA1 SHA512 TLSH

Submit Download

xMacNA.theme

Path C:\Windows\resources\Themes\xMacNA.theme
Size 622B
SHA256 d75855c4466f7dd0d884864a8aa2cdbebcbe610332cf66e799366ed360fa668a
MD5 16c06212be92816a411fa8facd056a7f
SHA1 bce349ea07b2d770c428fd50a4532184b2348654
SHA512 c9dad1cce6407c8a0fa1f0ba19454fadd7bed11738b83a57f98192ac349c5d2d94b21642a2d6aef5c6c14b700b962d6cb4f5b48751635ae88e75073fb46025f4
TLSH
T1CBF0F927C20A49C8AC36226F9020DC03B0557B0B42A1E249DAC89478B7AA9642B3E02D
MD5 SHA1 SHA512 TLSH

Submit Download

xNA.theme

Path C:\Windows\resources\Themes\xNA.theme
Size 608B
SHA256 739569420da56d330b97091e0838856b9c663847f401c8aec54e794b97cc95cc
MD5 bd458786ec38f96b7c96e86bb2ac8032
SHA1 722656287616908a773ccff7e120c88039eb6da2
SHA512 51b28e68bfc97149e73e9d1ffd966551b61e292ca5459482b518d1be7d408e71f770cd079e8c5598df33b298558282cf710e2b8fe4740e32aef094342fd8c39f
TLSH
T136F0DD27D10A49C4AC37226F9020DC07B0553B5A42E5F6489AC864B8B7EB9786B7E05D
MD5 SHA1 SHA512 TLSH

Submit Download

xWin.theme

Path C:\Windows\resources\Themes\xWin.theme
Size 614B
SHA256 078be5bba6c19b0b2047eb6d57f6d01a5dbed4f7a7f5e90082148fdfb1eecb4f
MD5 e41637666dcc8f9c789070eced532d1e
SHA1 392dea2cbfc1ffb86b956c7ada522e6752077328
SHA512 fd01baa58317b68700b5bfaa390c57b000e0248c99e7cd42e4b2c7d165572e70454f31dc18712f8d80add5c2a4de104f81cce3e5d9e78b087759e76af2ab170a
TLSH
T11AF0DD27D10A49C4EC7723AF9020DC07B055371A82B2F248EAC854B8FB968787B7E05D
MD5 SHA1 SHA512 TLSH

Submit Download

xWinNA.theme

Path C:\Windows\resources\Themes\xWinNA.theme
Size 622B
SHA256 d7b161f2fedcc6b4946776812caeb99666f676643993ae3ec1450c6be027d6d6
MD5 f2912612ac4ced5c952023828c496fad
SHA1 3a1a12a81758ae2ddc93e766fe9c41d66435ef03
SHA512 7a3114b4dd8d21e55e44acc19a9ecef4fe652c94db8decc62ddd7856bd0cbe1013d36a0ab0e354cfcc431e54e651f855c551e79568ed4bcada9dd01d078ed4d3
TLSH
T106F09927D10A49C5AC77226FA0209C07B055375A82A1F6889BE854B8F7AB8646B7E05D
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads