teslacrypt | bae6b7432b1311616dceeacb7b75c18d7765cd11fe9ffee3b95920b9e36d839b

Analysis

max time kernel
149s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20251015-en
resource tags

arch:x64arch:x86image:win11-20251015-enlocale:en-usos:windows11-21h2-x64system
submitted
17/10/2025, 22:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bae6b7432b1311616dceeacb7b75c18d7765cd11fe9ffee3b95920b9e36d839b.exe
Size 251KB
Sample251017-178gfshr8z
SHA256 bae6b7432b1311616dceeacb7b75c18d7765cd11fe9ffee3b95920b9e36d839b
MD5 f07d644c92c9f340b171281695149216
SHA1 ab0d350ea796980d63611bbe1b556ab2cd98ec8e
SHA512 1821b95b94af44a51006b222f95de2df67886cd12318d4f50888e44b7d9a53f04d75c5856327923535a676ee96f40e53a451ff09cf46d8d7fef67acd918464ed
SSDEEP 3072:yP36YQgDABWbDFp7yz5hwXZwnt+XOCGNjYQohl5ZieMhJP7p9Ve3ESTRpA6:OZyTntxVYQE5ehJP7p9g3EcXA6
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

defense_evasion discovery execution teslacrypt impact persistence ransomware spyware stealer

Malware Config

Extracted

Path

C:\Program Files\7-Zip\Lang\Recovery+ghjly.txt

teslacrypt

Ransom Note

NOT YOUR LANGUAGE? USE https://translate.google.com What happened to your files ? All of your files were protected by a strong encryption with RSA-4096. More information about the encryption keys using RSA-4096 can be found here: http://en.wikipedia.org/wiki/RSA_(cryptosystem) How did this happen ? !!! Specially for your PC was generated personal RSA-4096 KEY, both public and private. !!! ALL YOUR FILES were encrypted with the public key, which has been transferred to your computer via the Internet. !!! Decrypting of your files is only possible with the help of the private key and decrypt program , which is on our Secret Server What do I do ? So, there are two ways you can choose: wait for a miracle and get your price doubled, or start obtaining BITCOIN NOW! , and restore your data easy way. If You have really valuable data, you better not waste your time, because there is no other way to get your files, except make a payment. For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: 1. http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/E77A4A838245536 2. http://tes543berda73i48fsdfsd.keratadze.at/E77A4A838245536 3. http://tt54rfdjhb34rfbnknaerg.milerteddy.com/E77A4A838245536 If for some reasons the addresses are not available, follow these steps: 1. Download and install tor-browser: http://www.torproject.org/projects/torbrowser.html.en 2. After a successful installation, run the browser 3. Type in the address bar: xlowfznrg4wf7dli.onion/E77A4A838245536 4. Follow the instructions on the site. ---------------- IMPORTANT INFORMATION------------------------ *-*-* Your personal pages: http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/E77A4A838245536 http://tes543berda73i48fsdfsd.keratadze.at/E77A4A838245536 http://tt54rfdjhb34rfbnknaerg.milerteddy.com/E77A4A838245536 *-*-* Your personal page Tor-Browser: xlowfznrg4wf7dli.ONION/E77A4A838245536

URLs

http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/E77A4A838245536
http://tes543berda73i48fsdfsd.keratadze.at/E77A4A838245536
http://tt54rfdjhb34rfbnknaerg.milerteddy.com/E77A4A838245536
http://xlowfznrg4wf7dli.ONION/E77A4A838245536

Signatures

TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
ransomware teslacrypt
Teslacrypt family
teslacrypt
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047
Renames multiple (906) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops startup file 6 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Recovery+ghjly.html	knypipcmjnia.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\Recovery+ghjly.png	knypipcmjnia.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\Recovery+ghjly.txt	knypipcmjnia.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\Recovery+ghjly.html	knypipcmjnia.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Recovery+ghjly.png	knypipcmjnia.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Recovery+ghjly.txt	knypipcmjnia.exe

Executes dropped EXE 1 IoCs

pid	Process
3688	knypipcmjnia.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3261906842-2611857369-1513979305-1000\Software\Microsoft\Windows\CurrentVersion\Run\ndkmchnueywy = "C:\\Windows\\system32\\cmd.exe /c start \"\" \"C:\\Windows\\knypipcmjnia.exe\""	knypipcmjnia.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\react\lib\components\GroupedList\GroupFooter.types.js	knypipcmjnia.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\jvm.hprof.txt	knypipcmjnia.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\COMPASS\Recovery+ghjly.png	knypipcmjnia.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\Assets\AppPackageLargeTile.scale-200.png	knypipcmjnia.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Getstarted_10.2.41172.0_x64__8wekyb3d8bbwe\Assets\TipsAppList.targetsize-30.png	knypipcmjnia.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_1.0.38.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.targetsize-60_altform-unplated.png	knypipcmjnia.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_2021.2104.2.0_neutral_~_8wekyb3d8bbwe\microsoft.system.package.metadata\Recovery+ghjly.html	knypipcmjnia.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsNotepad_10.2102.13.0_x64__8wekyb3d8bbwe\Assets\contrast-black\Recovery+ghjly.html	knypipcmjnia.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\control\Recovery+ghjly.html	knypipcmjnia.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Paint_10.2104.17.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\PaintSmallTile.scale-100.png	knypipcmjnia.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.41182.0_x64__8wekyb3d8bbwe\Assets\contrast-black\BadgeLogo.scale-200_contrast-black.png	knypipcmjnia.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.41182.0_x64__8wekyb3d8bbwe\Assets\StoreLogo.scale-400.png	knypipcmjnia.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.21012.10511.0_x64__8wekyb3d8bbwe\Images\Recovery+ghjly.txt	knypipcmjnia.exe
File opened for modification	C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\theme\node_modules\@fluentui\dom-utilities\lib\getParent.js	knypipcmjnia.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Functions\Recovery+ghjly.html	knypipcmjnia.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\Recovery+ghjly.html	knypipcmjnia.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\contrast-black\HxMailAppList.targetsize-64.png	knypipcmjnia.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\Images\LargeTile.scale-100_contrast-white.png	knypipcmjnia.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.21012.10511.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-30_contrast-black.png	knypipcmjnia.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\Recovery+ghjly.png	knypipcmjnia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\Recovery+ghjly.png	knypipcmjnia.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft SQL Server\130\Shared\Recovery+ghjly.png	knypipcmjnia.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppPackageAppList.targetsize-64_contrast-black.png	knypipcmjnia.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.GetHelp_10.2008.32311.0_x64__8wekyb3d8bbwe\Assets\GetHelpAppList.targetsize-36_altform-unplated.png	knypipcmjnia.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.People_10.1909.12456.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\Recovery+ghjly.png	knypipcmjnia.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_1.0.22.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\MapsAppList.targetsize-30_altform-lightunplated_contrast-white.png	knypipcmjnia.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_12008.1001.1.0_x64__8wekyb3d8bbwe\Microsoft.UI.Xaml\Recovery+ghjly.png	knypipcmjnia.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.2012.21.0_x64__8wekyb3d8bbwe\Assets\Standard.targetsize-24_contrast-white.png	knypipcmjnia.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.41182.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\Recovery+ghjly.html	knypipcmjnia.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.2012.21.0_x64__8wekyb3d8bbwe\Assets\Recovery+ghjly.txt	knypipcmjnia.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\HxA-Outlook.scale-125.png	knypipcmjnia.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\LinkedInboxLargeTile.scale-150.png	knypipcmjnia.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_1.0.38.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.targetsize-16_altform-lightunplated_contrast-white.png	knypipcmjnia.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000042\Recovery+ghjly.html	knypipcmjnia.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.GetHelp_10.2008.32311.0_x64__8wekyb3d8bbwe\Assets\contrast-white\GetHelpAppList.targetsize-72_altform-unplated_contrast-white.png	knypipcmjnia.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.2012.21.0_x64__8wekyb3d8bbwe\Assets\CalculatorSmallTile.scale-200_contrast-white.png	knypipcmjnia.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\LinkedInboxMediumTile.scale-100.png	knypipcmjnia.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_1.0.38.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.targetsize-20_altform-lightunplated.png	knypipcmjnia.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_1.0.6.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherAppList.targetsize-64_altform-lightunplated.png	knypipcmjnia.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.GamingApp_2105.900.24.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\Xbox_MedTile.scale-100_contrast-black.png	knypipcmjnia.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2020.503.58.0_x64__8wekyb3d8bbwe\Assets\contrast-white\CameraAppList.targetsize-96_altform-unplated.png	knypipcmjnia.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\contrast-black\OutlookMailLargeTile.scale-100.png	knypipcmjnia.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_1.0.22.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\contrast-white\MapsLargeTile.scale-100_contrast-white.png	knypipcmjnia.exe
File opened for modification	C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\theme\lib-amd\colors\Recovery+ghjly.png	knypipcmjnia.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Getstarted_10.2.41172.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\TipsLargeTile.scale-200_contrast-white.png	knypipcmjnia.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsStore_12104.1001.1.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\StoreMedTile.scale-200.png	knypipcmjnia.exe
File opened for modification	C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\theme\lib-amd\types\IScheme.js	knypipcmjnia.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\STRTEDGE\THMBNAIL.PNG	knypipcmjnia.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\gu\LC_MESSAGES\Recovery+ghjly.png	knypipcmjnia.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.40978.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\Recovery+ghjly.png	knypipcmjnia.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\Microsoft.Terminal.Settings.Editor\Recovery+ghjly.html	knypipcmjnia.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.50.24002.0_x64__8wekyb3d8bbwe\Assets\MixerBranding\Recovery+ghjly.txt	knypipcmjnia.exe
File opened for modification	C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\react\lib\components\DocumentCard\DocumentCardImage.types.js	knypipcmjnia.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.scale-180.png	knypipcmjnia.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.40978.0_x64__8wekyb3d8bbwe\Assets\SmallTile.scale-125.png	knypipcmjnia.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.41182.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-32_altform-unplated_contrast-black.png	knypipcmjnia.exe
File opened for modification	C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\theme\node_modules\@uifabric\merge-styles\Recovery+ghjly.html	knypipcmjnia.exe
File opened for modification	C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\theme\node_modules\@uifabric\utilities\Recovery+ghjly.txt	knypipcmjnia.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.contrast-white_scale-80.png	knypipcmjnia.exe
File opened for modification	C:\Program Files\Windows NT\TableTextService\Recovery+ghjly.html	knypipcmjnia.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsNotepad_10.2102.13.0_x64__8wekyb3d8bbwe\Assets\contrast-black\NotepadAppList.targetsize-64_altform-lightunplated.png	knypipcmjnia.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\Recovery+ghjly.png	knypipcmjnia.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ps\LC_MESSAGES\Recovery+ghjly.html	knypipcmjnia.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000009\Recovery+ghjly.txt	knypipcmjnia.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2684_936499239\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2684_936499239\manifest.fingerprint	msedge.exe
File created	C:\Windows\knypipcmjnia.exe	bae6b7432b1311616dceeacb7b75c18d7765cd11fe9ffee3b95920b9e36d839b.exe
File opened for modification	C:\Windows\knypipcmjnia.exe	bae6b7432b1311616dceeacb7b75c18d7765cd11fe9ffee3b95920b9e36d839b.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2684_936499239\arbitration_metadata.txt	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NOTEPAD.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bae6b7432b1311616dceeacb7b75c18d7765cd11fe9ffee3b95920b9e36d839b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	knypipcmjnia.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134052131759229856"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3261906842-2611857369-1513979305-1000_Classes\Local Settings	knypipcmjnia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3261906842-2611857369-1513979305-1000\{8E379784-3435-42A1-8EDF-45AC52398222}	msedge.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
5656	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3688	knypipcmjnia.exe
3688	knypipcmjnia.exe
3688	knypipcmjnia.exe
3688	knypipcmjnia.exe
3688	knypipcmjnia.exe
3688	knypipcmjnia.exe
3688	knypipcmjnia.exe
3688	knypipcmjnia.exe
3688	knypipcmjnia.exe
3688	knypipcmjnia.exe
3688	knypipcmjnia.exe
3688	knypipcmjnia.exe
3688	knypipcmjnia.exe
3688	knypipcmjnia.exe
3688	knypipcmjnia.exe
3688	knypipcmjnia.exe
3688	knypipcmjnia.exe
3688	knypipcmjnia.exe
3688	knypipcmjnia.exe
3688	knypipcmjnia.exe
3688	knypipcmjnia.exe
3688	knypipcmjnia.exe
3688	knypipcmjnia.exe
3688	knypipcmjnia.exe
3688	knypipcmjnia.exe
3688	knypipcmjnia.exe
3688	knypipcmjnia.exe
3688	knypipcmjnia.exe
3688	knypipcmjnia.exe
3688	knypipcmjnia.exe
3688	knypipcmjnia.exe
3688	knypipcmjnia.exe
3688	knypipcmjnia.exe
3688	knypipcmjnia.exe
3688	knypipcmjnia.exe
3688	knypipcmjnia.exe
3688	knypipcmjnia.exe
3688	knypipcmjnia.exe
3688	knypipcmjnia.exe
3688	knypipcmjnia.exe
3688	knypipcmjnia.exe
3688	knypipcmjnia.exe
3688	knypipcmjnia.exe
3688	knypipcmjnia.exe
3688	knypipcmjnia.exe
3688	knypipcmjnia.exe
3688	knypipcmjnia.exe
3688	knypipcmjnia.exe
3688	knypipcmjnia.exe
3688	knypipcmjnia.exe
3688	knypipcmjnia.exe
3688	knypipcmjnia.exe
3688	knypipcmjnia.exe
3688	knypipcmjnia.exe
3688	knypipcmjnia.exe
3688	knypipcmjnia.exe
3688	knypipcmjnia.exe
3688	knypipcmjnia.exe
3688	knypipcmjnia.exe
3688	knypipcmjnia.exe
3688	knypipcmjnia.exe
3688	knypipcmjnia.exe
3688	knypipcmjnia.exe
3688	knypipcmjnia.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2684	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5560	bae6b7432b1311616dceeacb7b75c18d7765cd11fe9ffee3b95920b9e36d839b.exe
Token: SeDebugPrivilege	3688	knypipcmjnia.exe
Token: SeIncreaseQuotaPrivilege	4240	WMIC.exe
Token: SeSecurityPrivilege	4240	WMIC.exe
Token: SeTakeOwnershipPrivilege	4240	WMIC.exe
Token: SeLoadDriverPrivilege	4240	WMIC.exe
Token: SeSystemProfilePrivilege	4240	WMIC.exe
Token: SeSystemtimePrivilege	4240	WMIC.exe
Token: SeProfSingleProcessPrivilege	4240	WMIC.exe
Token: SeIncBasePriorityPrivilege	4240	WMIC.exe
Token: SeCreatePagefilePrivilege	4240	WMIC.exe
Token: SeBackupPrivilege	4240	WMIC.exe
Token: SeRestorePrivilege	4240	WMIC.exe
Token: SeShutdownPrivilege	4240	WMIC.exe
Token: SeDebugPrivilege	4240	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4240	WMIC.exe
Token: SeRemoteShutdownPrivilege	4240	WMIC.exe
Token: SeUndockPrivilege	4240	WMIC.exe
Token: SeManageVolumePrivilege	4240	WMIC.exe
Token: 33	4240	WMIC.exe
Token: 34	4240	WMIC.exe
Token: 35	4240	WMIC.exe
Token: 36	4240	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4240	WMIC.exe
Token: SeSecurityPrivilege	4240	WMIC.exe
Token: SeTakeOwnershipPrivilege	4240	WMIC.exe
Token: SeLoadDriverPrivilege	4240	WMIC.exe
Token: SeSystemProfilePrivilege	4240	WMIC.exe
Token: SeSystemtimePrivilege	4240	WMIC.exe
Token: SeProfSingleProcessPrivilege	4240	WMIC.exe
Token: SeIncBasePriorityPrivilege	4240	WMIC.exe
Token: SeCreatePagefilePrivilege	4240	WMIC.exe
Token: SeBackupPrivilege	4240	WMIC.exe
Token: SeRestorePrivilege	4240	WMIC.exe
Token: SeShutdownPrivilege	4240	WMIC.exe
Token: SeDebugPrivilege	4240	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4240	WMIC.exe
Token: SeRemoteShutdownPrivilege	4240	WMIC.exe
Token: SeUndockPrivilege	4240	WMIC.exe
Token: SeManageVolumePrivilege	4240	WMIC.exe
Token: 33	4240	WMIC.exe
Token: 34	4240	WMIC.exe
Token: 35	4240	WMIC.exe
Token: 36	4240	WMIC.exe
Token: SeBackupPrivilege	2020	vssvc.exe
Token: SeRestorePrivilege	2020	vssvc.exe
Token: SeAuditPrivilege	2020	vssvc.exe
Token: SeIncreaseQuotaPrivilege	2008	WMIC.exe
Token: SeSecurityPrivilege	2008	WMIC.exe
Token: SeTakeOwnershipPrivilege	2008	WMIC.exe
Token: SeLoadDriverPrivilege	2008	WMIC.exe
Token: SeSystemProfilePrivilege	2008	WMIC.exe
Token: SeSystemtimePrivilege	2008	WMIC.exe
Token: SeProfSingleProcessPrivilege	2008	WMIC.exe
Token: SeIncBasePriorityPrivilege	2008	WMIC.exe
Token: SeCreatePagefilePrivilege	2008	WMIC.exe
Token: SeBackupPrivilege	2008	WMIC.exe
Token: SeRestorePrivilege	2008	WMIC.exe
Token: SeShutdownPrivilege	2008	WMIC.exe
Token: SeDebugPrivilege	2008	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2008	WMIC.exe
Token: SeRemoteShutdownPrivilege	2008	WMIC.exe
Token: SeUndockPrivilege	2008	WMIC.exe
Token: SeManageVolumePrivilege	2008	WMIC.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2684	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5560 wrote to memory of 3688	5560	bae6b7432b1311616dceeacb7b75c18d7765cd11fe9ffee3b95920b9e36d839b.exe	78
PID 5560 wrote to memory of 3688	5560	bae6b7432b1311616dceeacb7b75c18d7765cd11fe9ffee3b95920b9e36d839b.exe	78
PID 5560 wrote to memory of 3688	5560	bae6b7432b1311616dceeacb7b75c18d7765cd11fe9ffee3b95920b9e36d839b.exe	78
PID 5560 wrote to memory of 2004	5560	bae6b7432b1311616dceeacb7b75c18d7765cd11fe9ffee3b95920b9e36d839b.exe	79
PID 5560 wrote to memory of 2004	5560	bae6b7432b1311616dceeacb7b75c18d7765cd11fe9ffee3b95920b9e36d839b.exe	79
PID 5560 wrote to memory of 2004	5560	bae6b7432b1311616dceeacb7b75c18d7765cd11fe9ffee3b95920b9e36d839b.exe	79
PID 3688 wrote to memory of 4240	3688	knypipcmjnia.exe	81
PID 3688 wrote to memory of 4240	3688	knypipcmjnia.exe	81
PID 3688 wrote to memory of 5656	3688	knypipcmjnia.exe	135
PID 3688 wrote to memory of 5656	3688	knypipcmjnia.exe	135
PID 3688 wrote to memory of 5656	3688	knypipcmjnia.exe	135
PID 3688 wrote to memory of 2684	3688	knypipcmjnia.exe	136
PID 3688 wrote to memory of 2684	3688	knypipcmjnia.exe	136
PID 3688 wrote to memory of 2008	3688	knypipcmjnia.exe	137
PID 3688 wrote to memory of 2008	3688	knypipcmjnia.exe	137
PID 2684 wrote to memory of 1924	2684	msedge.exe	139
PID 2684 wrote to memory of 1924	2684	msedge.exe	139
PID 2684 wrote to memory of 5180	2684	msedge.exe	141
PID 2684 wrote to memory of 5180	2684	msedge.exe	141
PID 2684 wrote to memory of 1388	2684	msedge.exe	142
PID 2684 wrote to memory of 1388	2684	msedge.exe	142
PID 2684 wrote to memory of 1388	2684	msedge.exe	142
PID 2684 wrote to memory of 1388	2684	msedge.exe	142
PID 2684 wrote to memory of 1388	2684	msedge.exe	142
PID 2684 wrote to memory of 1388	2684	msedge.exe	142
PID 2684 wrote to memory of 1388	2684	msedge.exe	142
PID 2684 wrote to memory of 1388	2684	msedge.exe	142
PID 2684 wrote to memory of 1388	2684	msedge.exe	142
PID 2684 wrote to memory of 1388	2684	msedge.exe	142
PID 2684 wrote to memory of 1388	2684	msedge.exe	142
PID 2684 wrote to memory of 1388	2684	msedge.exe	142
PID 2684 wrote to memory of 1388	2684	msedge.exe	142
PID 2684 wrote to memory of 1388	2684	msedge.exe	142
PID 2684 wrote to memory of 1388	2684	msedge.exe	142
PID 2684 wrote to memory of 1388	2684	msedge.exe	142
PID 2684 wrote to memory of 1388	2684	msedge.exe	142
PID 2684 wrote to memory of 1388	2684	msedge.exe	142
PID 2684 wrote to memory of 1388	2684	msedge.exe	142
PID 2684 wrote to memory of 1388	2684	msedge.exe	142
PID 2684 wrote to memory of 1388	2684	msedge.exe	142
PID 2684 wrote to memory of 1388	2684	msedge.exe	142
PID 2684 wrote to memory of 1388	2684	msedge.exe	142
PID 2684 wrote to memory of 1388	2684	msedge.exe	142
PID 2684 wrote to memory of 1388	2684	msedge.exe	142
PID 2684 wrote to memory of 1388	2684	msedge.exe	142
PID 2684 wrote to memory of 1388	2684	msedge.exe	142
PID 2684 wrote to memory of 1388	2684	msedge.exe	142
PID 2684 wrote to memory of 1388	2684	msedge.exe	142
PID 2684 wrote to memory of 1388	2684	msedge.exe	142
PID 2684 wrote to memory of 1388	2684	msedge.exe	142
PID 2684 wrote to memory of 1388	2684	msedge.exe	142
PID 2684 wrote to memory of 1388	2684	msedge.exe	142
PID 2684 wrote to memory of 1388	2684	msedge.exe	142
PID 2684 wrote to memory of 1388	2684	msedge.exe	142
PID 2684 wrote to memory of 1388	2684	msedge.exe	142
PID 2684 wrote to memory of 1388	2684	msedge.exe	142
PID 2684 wrote to memory of 1388	2684	msedge.exe	142
PID 2684 wrote to memory of 1388	2684	msedge.exe	142
PID 2684 wrote to memory of 1388	2684	msedge.exe	142
PID 2684 wrote to memory of 1388	2684	msedge.exe	142
PID 2684 wrote to memory of 1388	2684	msedge.exe	142
PID 2684 wrote to memory of 1388	2684	msedge.exe	142
PID 2684 wrote to memory of 1388	2684	msedge.exe	142
PID 2684 wrote to memory of 1388	2684	msedge.exe	142

System policy modification 1 TTPs 2 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	knypipcmjnia.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1"	knypipcmjnia.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\bae6b7432b1311616dceeacb7b75c18d7765cd11fe9ffee3b95920b9e36d839b.exe
"C:\Users\Admin\AppData\Local\Temp\bae6b7432b1311616dceeacb7b75c18d7765cd11fe9ffee3b95920b9e36d839b.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5560
- C:\Windows\knypipcmjnia.exe
  C:\Windows\knypipcmjnia.exe
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:3688
- - C:\Windows\System32\wbem\WMIC.exe
    "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /nointeractive
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4240
- - C:\Windows\SysWOW64\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\RECOVERY.TXT
    3⤵
    - System Location Discovery: System Language Discovery
    - Opens file in notepad (likely ransom note)
    PID:5656
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\RECOVERY.HTM
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2684
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x2e4,0x2e8,0x2ec,0x2e0,0x35c,0x7ffc71c9f208,0x7ffc71c9f214,0x7ffc71c9f220
      4⤵
      PID:1924
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1764,i,4232671365449275078,101594041556171439,262144 --variations-seed-version --mojo-platform-channel-handle=2080 /prefetch:11
      4⤵
      PID:5180
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2044,i,4232671365449275078,101594041556171439,262144 --variations-seed-version --mojo-platform-channel-handle=2004 /prefetch:2
      4⤵
      PID:1388
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2488,i,4232671365449275078,101594041556171439,262144 --variations-seed-version --mojo-platform-channel-handle=2480 /prefetch:13
      4⤵
      PID:2168
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3388,i,4232671365449275078,101594041556171439,262144 --variations-seed-version --mojo-platform-channel-handle=3252 /prefetch:1
      4⤵
      PID:3272
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3396,i,4232671365449275078,101594041556171439,262144 --variations-seed-version --mojo-platform-channel-handle=3100 /prefetch:1
      4⤵
      PID:5112
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4840,i,4232671365449275078,101594041556171439,262144 --variations-seed-version --mojo-platform-channel-handle=4872 /prefetch:14
      4⤵
      PID:5468
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4964,i,4232671365449275078,101594041556171439,262144 --variations-seed-version --mojo-platform-channel-handle=4980 /prefetch:14
      4⤵
      PID:1224
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4936,i,4232671365449275078,101594041556171439,262144 --variations-seed-version --mojo-platform-channel-handle=4920 /prefetch:14
      4⤵
      PID:1656
  - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5496,i,4232671365449275078,101594041556171439,262144 --variations-seed-version --mojo-platform-channel-handle=5516 /prefetch:14
      4⤵
      PID:388
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5536,i,4232671365449275078,101594041556171439,262144 --variations-seed-version --mojo-platform-channel-handle=5548 /prefetch:14
      4⤵
      PID:696
    - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=1112
        5⤵
        
        PID:5788
  - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5496,i,4232671365449275078,101594041556171439,262144 --variations-seed-version --mojo-platform-channel-handle=5516 /prefetch:14
      4⤵
      PID:5484
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6044,i,4232671365449275078,101594041556171439,262144 --variations-seed-version --mojo-platform-channel-handle=6076 /prefetch:14
      4⤵
      PID:1976
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6176,i,4232671365449275078,101594041556171439,262144 --variations-seed-version --mojo-platform-channel-handle=6168 /prefetch:14
      4⤵
      PID:5340
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5588,i,4232671365449275078,101594041556171439,262144 --variations-seed-version --mojo-platform-channel-handle=6292 /prefetch:14
      4⤵
      PID:5128
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6112,i,4232671365449275078,101594041556171439,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:14
      4⤵
      PID:4140
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5640,i,4232671365449275078,101594041556171439,262144 --variations-seed-version --mojo-platform-channel-handle=5520 /prefetch:14
      4⤵
      PID:5960
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5612,i,4232671365449275078,101594041556171439,262144 --variations-seed-version --mojo-platform-channel-handle=5648 /prefetch:14
      4⤵
      PID:5340
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5528,i,4232671365449275078,101594041556171439,262144 --variations-seed-version --mojo-platform-channel-handle=6244 /prefetch:14
      4⤵
      PID:5008
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5068,i,4232671365449275078,101594041556171439,262144 --variations-seed-version --mojo-platform-channel-handle=5060 /prefetch:14
      4⤵
      PID:5388
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4728,i,4232671365449275078,101594041556171439,262144 --variations-seed-version --mojo-platform-channel-handle=872 /prefetch:14
      4⤵
      PID:5684
- - C:\Windows\System32\wbem\WMIC.exe
    "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /nointeractive
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2008
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c DEL C:\Windows\KNYPIP~1.EXE
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5848
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\AppData\Local\Temp\BAE6B7~1.EXE
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2004

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2020

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:5828

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:772

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

Recovery+ghjly.html

Path C:\Program Files\7-Zip\Lang\Recovery+ghjly.html
Size 11KB
SHA256 bcf62190e48cf9e81818044e72b1586bd466103c0868772a7945d905eaf8ee03
MD5 786764639abc11b2b6494fd076877039
SHA1 6e2a251a5ceaa4d45206eb41016c463e09f102bd
SHA512 c8f15aacdd1f43cb541b92e397a913e3fac6f1b50732a4c04a71e05497c8a1a457ed0618cd7dc226fe379936a4e3d63447639a12abe0ce4abcd28d0d0894705f
SSDEEP 96:B1N1Dl1Z+uGpGZH+leqLNq4LRixpcSPwmjjCwtCgLCeSC2Cp5CWsCGCPcCzC3CYR:Bzen+L2N3mxwkDz/tJk42/
MD5 SHA1 SHA512 SSDEEP

Submit Download

Recovery+ghjly.png

Path C:\Program Files\7-Zip\Lang\Recovery+ghjly.png
Size 63KB
SHA256 6ac322061d6aade511aee0d7c7eb9a96dc86bfe76ddb7ed7a415b619a8c1ba20
MD5 f06c8eb018699bfaf80643cfdb8186e1
SHA1 5a038f5e895aec5e488eaaf5c69e4855fe3fd86b
SHA512 7c947b158e9392d4ed3cdb876ae17102440bcc8be8d9a63db8dad3e655d4e11e970a8300c25c9188b2fe3f0080fd20fb24aff535598986c3312d0432db2c5897
SSDEEP 1536:fb706EbbrHsxjsXgcCN7SEmFNHnYsyqX3N9KUkQGGpRsosDFZZZZZZZZZZZZZZZw:3xET3gcCNuEsBY9C3KnMGDFZZZZZZZZy
MD5 SHA1 SHA512 SSDEEP

Submit Download

Recovery+ghjly.txt

Path C:\Program Files\7-Zip\Lang\Recovery+ghjly.txt
Size 1KB
SHA256 ba8fd3aaa41c65ddf24c7662047fed68de927e28d7b91448cd33e827b1f58096
MD5 579906c40fc120861f155384e60204ee
SHA1 075e499930f4a9dbf99a818344e4c06db966ca3e
SHA512 236b2a4fcde0f786812fe9dc191f1909f0c7cbbe3d3a186b3f5994bc046e6d8207bd4eab31364794e5faae8e668f36f15ce23bcdf8f2e78d709e918642de88c3
MD5 SHA1 SHA512

Submit Download

THIRDPARTYLICENSEREADME-JAVAFX.txt

Path C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt
Size 560B
SHA256 c9f0fad792640d107b0588fef7c7ebe870016fdbcd1345d858f6c94185cc18f3
MD5 a76ea90ab75b7039e6abb3fd65649cb2
SHA1 490e0e515be499318aad9131f6bf774018575ab6
SHA512 f840e98fcb94492c4c5d01974a8955f15e54eb1442804915258b163573d43a95db2bacb241754adf3f28a624da51bf021c02fb2507ab4799c72cf747fab3617f
MD5 SHA1 SHA512

Submit Download

THIRDPARTYLICENSEREADME.txt

Path C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt
Size 560B
SHA256 88eb384ae6e37e973ad8ba9b151b576903be6921fd030682fdf9af8610606744
MD5 e01476e1daa888174400496ba63df70c
SHA1 fd93eb0ecd8166eeb4d4c306e3394bbab0bcbc9d
SHA512 9f130b66361d8c086c46bec5c914cec12518f7c1dda846bbe961a89ad27cc7f5751caef81ef76ae89cd04777978c242e095b15804d42a89246daa5387c0a24c6
MD5 SHA1 SHA512

Submit Download

ClientSub2019_eula.txt

Path C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub2019_eula.txt
Size 416B
SHA256 9c3f813e2174ea6946681eab8277ec34ae27694d7c5222e2bafefdba745d9b76
MD5 913238215f9944f7ed60495f0239d675
SHA1 6c956083f8a79619ed2723cfbffc17a730817283
SHA512 98f6500ce6ef3ea43480754c2330fce9bcbb492bfab5a5791ef27031f2b2cc01f574119b9865120a782b5ba5346ff53945e43201e56217dfc698f58901de2bdd
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 277e71e9ceb89201713d4002f33a073d080eacca63f8c91b3275c33ecf247e93
MD5 f99f26dbfaddbe188d0aa34c55bb0428
SHA1 61b471e4c5b0066224ed9b2ca6e3592aeecce041
SHA512 25b9c4f0bb88dff3c390df044dffd262bb0f499c00ebcd9d0f15d171bf312e2babc94e4172a0df46372107b15552cc8dadc3210866c27ba9a0f06626d4386b8a
MD5 SHA1 SHA512

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
MD5 SHA1 SHA512 SSDEEP

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 108KB
SHA256 a5f47979e3d9dc7c49694d8e9e4dd8e98b45470f93161940daff0b96bfc84a91
MD5 3692b82273b09514a7212381ba0e0098
SHA1 5abf2cbf0bfd404c62a99944e2653830865eb23b
SHA512 d3611f1b0d1c4740eef4bb7d25dffc69de0afabb5f62164acb0d7e947175822cffdadfd607249028c6c6f9f39486e0e7dec0368f225793245ee820f59dcac4d7
SSDEEP 1536:IJcH74ohBGZqW3iPPDuVvpBI/S8tZsA62UYPq:PHSRiPjU1
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 02138d525f8f6df4ec2627e73d1130069684a3f42ccda3807091b35c4e1b8449
MD5 6e55ff997620a7ffb189cc864231aa37
SHA1 db0e43e36bd4cb77727edbce3265d677615ae321
SHA512 93f59e0fa522f65ff35d99c84998a3b055dd14fcaa8c0e7e0b21aff792fca09ac6dd5d616ae505acecf461afbc9714792f45b8d91bdc44cce7f2d48efecb66e1
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 0d09f8909b85fe97e3e06b99012beb02f032a6c45c07dd1953d7ee5464a35f1c
MD5 fc8d6acd30436ee886e8cb0773d285d8
SHA1 ef13f3b495c744a3cb50300a5f16eeca631fb1ea
SHA512 6446d7076e030723de1bff6849e620c0aaf000eb31a3e0ad84a3de1821baa3d51e01832dc9eeb84636db7b026bddd46c67f4e1a49a928522f298d2c3c3edb886
SSDEEP 192:sVERjyMh/K1Ml8M3pdshUjnfxh9aAgnzoZ8pEa/Y+WNrY0EwnD6hk1CGIgLJ:sVEjPpdsGnJvYzV/Sr5+hk8+d
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 37KB
SHA256 14b3c902e7594a169b3e432095cdcab29434b1110dbc3e5c250bff272c290247
MD5 9f6ec688596015192db290abb994fa9b
SHA1 f7a7a7c1c73c33cdb9e160893779ea3340a5016b
SHA512 14500a11af80c78fa591f71a9c547881b2a0678a34e8826499efffbc8ca9ff1e0b5508f3b7540dd6acd2b36c60fdcb7f703ad13cb3a4d17d83e9363e326839ca
SSDEEP 768:KXHuZ84t2CNX7pLuLWSMWRWY0Q0o8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3k6yLLy:KXHuZ84t2CNREWSMWRWY0Q0ou1jaKk6R
MD5 SHA1 SHA512 SSDEEP

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 22KB
SHA256 a31b9e12aac366c87062ad219cc496fbb88d6564cd1a1e7547dcba781485df52
MD5 3a7a37ebe536ac329222ffa1ad7cf72b
SHA1 5eaaef86b583aeac09896599fcfc99650963d48c
SHA512 215bcb87057dc076d4af376e367567950363d08d2a0fee72e2bbe61bfa60bbb8ee80b1985e6d83f0d5f8b14feb46947aac36a5cc2e79a4755594191a78c99c81
SSDEEP 96:dvKP2QKMmKF2aKSYKlSlKxKKZcUF2aUGmxH632ixKVq0Efi9AFKbqHKzTKXGsK8T:GN/bcUF2aUGmR632iIq0Efi9zAI7Wj
MD5 SHA1 SHA512 SSDEEP

Submit Download

CloudConfigLog

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog
Size 466B
SHA256 1a44868bfebd5db439faaf3e959ea004e5ca9629f48817ac6dab0e7d941b2a41
MD5 461138d42b90067ea1622e99943a265d
SHA1 8489e1c22588ccd867829e7851724a58eba28065
SHA512 aa46a90bb94f1a09616828e63a190b229311228dfe38cd7904193f4680f4236c8f93710f0d7e4ba5883e420836866788c932f41eee3ca5e97410961a70564894
MD5 SHA1 SHA512

Submit Download

arbitration_metadata.txt.mp3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Notifications\0.0.0.46\arbitration_metadata.txt.mp3
Size 344KB
SHA256 6c8fe786a45cb61812492a55daf8b05907913ade7160711169591ec7caef6bd7
MD5 ee5190ba4f3bd905e3463faf7c2674af
SHA1 b601f2b146fe29b6e925f5cad9f4c7c848bc9ce1
SHA512 fe52b3ae91cd2f4c6644944c8ad7a293f2fa60a71fda17cd582e485ad1fe03584dc9476037c7df364519a6bd63f55cfe5a4a2ea8235a9882498afd3ae6743433
SSDEEP 6144:xSKSijtlD6EnBFH1RWGzL9faHfK1lN7XvkiTes5jHQ1oDQshIA4s4Y+:xSKSm7D5NC8HXsiTes5jHtDQeD4J
MD5 SHA1 SHA512 SSDEEP

Submit Download

app-setup.js.mp3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18367.18366.1\app-setup.js.mp3
Size 576B
SHA256 6bd2e5d855e64f6f340b271912ddabdd2843441931fe1940a483a3d7fa60e33c
MD5 2f31eff5ec67e529faafb4e53ec6ad22
SHA1 1b73a074d1c1e88b1e958ae362fbca7e0fac5a5f
SHA512 8ce89c00d2845d05ec5f45d30a04b92f68075f81a7cdf8c711e2e58bf10ba7579966a2631089d0e11c445a6acac2c7e14a3f143422a96359dee712e635e0503f
MD5 SHA1 SHA512

Submit Download

bnpl.bundle.js.LICENSE.txt.mp3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18367.18366.1\bnpl\bnpl.bundle.js.LICENSE.txt.mp3
Size 2KB
SHA256 465b0b53639fbcabc1a85e10a1dbb8d17efc1435ccaefa95c5a42c9fd14e27c6
MD5 fe69d74cc2fb0509d6329bb8ec6b52df
SHA1 d6db91c1785a1ca0d752501d93827df4a3fb07e5
SHA512 1b56bc41c41b9939b359c64d1e0d9fab34f66e3a4938664ab5e7e71f860f11103cc5f13dad6fa574c593a7fd7ecbc5731e0a63519626cac5eccbe3f56ec5d5f0
MD5 SHA1 SHA512

Submit Download

bnpl.bundle.js.mp3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18367.18366.1\bnpl\bnpl.bundle.js.mp3
Size 691KB
SHA256 328cd23895bfe08e7201a43695562f3ce5f39cefe1e43cccf6a30105d1463a3e
MD5 50de3c11a905a41387a81262ee89211c
SHA1 498dde9ac9c6c1dacb62360f54f5bb235e991081
SHA512 581c9389d7c6ac06ab2897c73027a6ece3e342465c39ab0ba80fa82b7a4de62acf6c06bddb426205cee399fcb4af2b26c0e51dfe50cf80e3fd81217453d79162
SSDEEP 12288:tn/TIDQAApPGVi/cOB+ELbheNJv9lAkVc3AnYTDhYxnr9b1EB0W80ru7MuLoGf6D:tn/TpPB/c8+E/ovv9lA/An4NY++ZB4Wa
MD5 SHA1 SHA512 SSDEEP

Submit Download

bnpl_driver.js.mp3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18367.18366.1\bnpl_driver.js.mp3
Size 11KB
SHA256 c934226a3b4b6c30de9477340a5d2ff90306618e97bb676b6bea4582e5ed3423
MD5 3f4c39e40da4bde6784d2e4e47f54f9f
SHA1 916d2b4097e32c7930d21441df3c1a2a3f11c9b2
SHA512 96ca1f246bb241bf5d4d5707133e232af39136fba79fe45dcf2e2d559adf41a95d526f434dfd061ba3976306345ec542288ae5e332ffbe1b40eb367329440b90
SSDEEP 192:22EWE8GuHHEenPci25Tv6Nuzbek6ta0SgWvH4seWol+mzwnMG1jEHqFyajtEHqM2:22Er3IxP925TvvzikuaVoW71jEHqgatJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

buynow_driver.js.mp3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18367.18366.1\buynow_driver.js.mp3
Size 3KB
SHA256 7b6bbd38e53008b6db15182fe858a0e2dede4851b3b5e72ff6f5f75ada3b06c0
MD5 7353d26e3bf4442604141a19b881fd7e
SHA1 cdad311c714c64e34d1d3081173b62948b6c9d26
SHA512 eb6928240666906daa488c501fe23cab979e4e3983193ed1bbb031dc02226c3dbbfdda375d6ee96a61d97b793f33734aae183561635fa1399644a15c07bdbc2e
MD5 SHA1 SHA512

Submit Download

crypto.bundle.js.mp3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18367.18366.1\crypto.bundle.js.mp3
Size 496B
SHA256 0e0405cac6476f752731419be25a1743d294f972495e90eae51b079e9aee07ee
MD5 9197e65a85e2ea959e4972758909d96e
SHA1 adb04b1ba1771abd679a2c8aa0a44af8a6bf7107
SHA512 c3a6dbd4466e5b33f8d8b00a7c8656b4296bb9b472b4165495a0101c5525aaf63466a7604396714cfb4afffaf5414c16ecca96354907585f1b5f8c445f7aac20
MD5 SHA1 SHA512

Submit Download

driver-signature.txt.mp3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18367.18366.1\driver-signature.txt.mp3
Size 20KB
SHA256 96bd941e8356fe677c522c1f2a259c46d1f078247feb22225a3779eb07a2e162
MD5 4baefc057810ddd80be83d9fd788b783
SHA1 f8580f45b530d8f000509d1d3402611c57602a08
SHA512 6b2456c23c2778c6167e87ce032887bc0953f05f21b19d5b90494685294d2ba93732397bf8736b1fb0214ff184240e7086285a2a4d6de072cc8ef7d7e4e425ca
SSDEEP 384:jbmeQV47YVwIMvSq4kdQjhMQ2GE5nhV502mKSF+gjxGZfj84v5qPm8:/t415Mv/4YQCRhEdAS2Z54R
MD5 SHA1 SHA512 SSDEEP

Submit Download

edge_driver.js.mp3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18367.18366.1\edge_driver.js.mp3
Size 1.8MB
SHA256 c31fe21b9d58c9738ccbf77abf53ba219409fd073729566b527b85fd0f9d402a
MD5 c4ef717101bb0d224a7e2cf1ea34b104
SHA1 9da8ba11c4092494eb1a7181031c3193b8c9aedd
SHA512 dabd8f4e3ebc8ba3936dc9ed2e7543740341bd8f5bc1409f240c2c06772f909ef868774aca5b11d907524a1ac661cab2a5ebca7594d8f2543b38245225b784eb
SSDEEP 49152:FCoCKXSPJ+/D/UW4HezSJUo28vRci3cn3HoY+DaZYDbT:UoFSQ7/UW4HkSJ7s3HosZYfT
MD5 SHA1 SHA512 SSDEEP

Submit Download

hub-signature.txt.mp3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18367.18366.1\hub-signature.txt.mp3
Size 1KB
SHA256 eb49ace830f6387a4837e5457754acb5887adfe4dbcb8534550c3cc1aee76d84
MD5 45e78d6046f2622c00dbc75079257065
SHA1 8893cafdd1935d50fdb3dd9d6f1fdbe701b8e126
SHA512 cb3d7fa8a5c638e370ffc9f3b59fd638b7f05db04b4d2099abee89278644e520f6a6363fbe41f0b1852d2499aa0f42d0f3019ad03edb6da7f6f27e062e9f0729
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 116538f362c0b26fc22ca5665f2f92704885f06554b4738ad19756f8d9f9ac06
MD5 62e3dc1532c661882086815b8a882d54
SHA1 ba1a355eca896b98d7e15d041dff217076491b26
SHA512 aa9762be14e4cfce0785a4ee2c1731cfc32ec79d565f3bb5b314f09c3f80615725745dfddabd3d1b3fa962646d7093587ae679f8a533ae351268bc4bc8944e8f
SSDEEP 768:4F5BLv7I5wCPFdV6Zi63UCgcy39R3y5DHnUlvjuR+uocB1JfXjJ:QJUV6ZL3AAYjq+wlfXjJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 46KB
SHA256 f0c336624d2e523aebf408fc7df822896336043a5ce159ba03312160487f84dd
MD5 1d637744885877978c445a3463fa87c8
SHA1 aa8e042d5d2baaab4052c0d926b81fb100c5b3f1
SHA512 ec164984acde00d32ec4b13062e70370e0fec7e24a73caba1b40669d1f04a879d689eebbf7273b5d5407e3a8ed62680374aa5a91cf0f14ff313c808f69f6e428
SSDEEP 768:ICF5BLv7I5wCPFdV6Zi+3/CgfdRR3y5DHncTiitZmsaOusjSocB1Jfw2:jJUV6ZN3WumxmjclfD
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 6dd8c27bdfa588995b1d08ba54f21d35acf2b080cc7c44957d08a7b873a3284c
MD5 a32ce9abeee90d116c20f8f49d72f925
SHA1 d5da17b255d9ea156f01eba3c6ef4a0905ea622f
SHA512 b2fe0beea8e41cf24087796370b3c502039fd4bcc727f8a17470a89d9a5d4e973540bdf02d7cfbe0a58306a794ca52fbfe1f58d44cda0de333a990787f7955dc
SSDEEP 768:AF5BLv7I5wCPFdV6Zig3/CgfTRR3y5DHncTiiSZmsaOusjSocB1Jfw2:YJUV6Z13spmxmjclfD
MD5 SHA1 SHA512 SSDEEP

Submit Download

english_wikipedia.txt.mp3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ZxcvbnData\3.1.0.0\english_wikipedia.txt.mp3
Size 270KB
SHA256 bcab18cf011db7a22d3b415971f170e2440fd5668003dd62ce8822e8a22844c4
MD5 c356364b3d0045c7f1efe27e8c585498
SHA1 de39e9427522dbaa87c61488bd92b0c568c80233
SHA512 0524d01d99c49d361fdcf1a75f820b3d8dd24023ddf06db48d2ee4ac9245eceb95234f4fa1daa1d2869fc567a128b3177c9c334ac8fd956ddc708833b6bf05bd
SSDEEP 6144:FuNOUe5pXrVeBO6MWty9L5ZEvVO+akXXy0fBMm:Fu2pXrAOatyp5Z5tkHyk9
MD5 SHA1 SHA512 SSDEEP

Submit Download

76f3a360-3c48-4028-aa48-8a67105868d5.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2684_640607756\76f3a360-3c48-4028-aa48-8a67105868d5.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5 SHA1 SHA512 SSDEEP

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2684_936499239\manifest.json
Size 238B
SHA256 1bdda4a8fc3e2b965fbb52c9b23a9a34871bc345abfb332a87ea878f4472efbd
MD5 15b69964f6f79654cbf54953aad0513f
SHA1 013fb9737790b034195cdeddaa620049484c53a7
SHA512 7eeee58e06bba59b1ef874436035202416079617b7953593abf6d9af42a55088ab37f45fdee394166344f0186c0cb7092f55ed201c213737bb5d5318e9f47908
MD5 SHA1 SHA512

Submit Download

knypipcmjnia.exe

Path C:\Windows\knypipcmjnia.exe
Size 251KB
SHA256 bae6b7432b1311616dceeacb7b75c18d7765cd11fe9ffee3b95920b9e36d839b
MD5 f07d644c92c9f340b171281695149216
SHA1 ab0d350ea796980d63611bbe1b556ab2cd98ec8e
SHA512 1821b95b94af44a51006b222f95de2df67886cd12318d4f50888e44b7d9a53f04d75c5856327923535a676ee96f40e53a451ff09cf46d8d7fef67acd918464ed
SSDEEP 3072:yP36YQgDABWbDFp7yz5hwXZwnt+XOCGNjYQohl5ZieMhJP7p9Ve3ESTRpA6:OZyTntxVYQE5ehJP7p9g3EcXA6
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3688-6-0x0000000000771000-0x0000000000772000-memory.dmp

Download

memory/5484-12714-0x000001D212900000-0x000001D213900000-memory.dmp

Download

memory/5560-0-0x0000000001031000-0x0000000001032000-memory.dmp

Download