teslacrypt | 0fc361656387dc2de7d8e77eeb991e5ce1de799d10c9ce69fe82468ebf6c7c35

Analysis

max time kernel
149s
max time network
148s
platform
windows11-21h2_x64
resource
win11-20250502-en
resource tags

arch:x64arch:x86image:win11-20250502-enlocale:en-usos:windows11-21h2-x64system
submitted
19/10/2025, 21:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2025-10-19_1c4529cb111c1ec7102999d0b989a268_amadey_darkgate_elex_smoke-loader_teslacrypt.exe
Size 252KB
Sample251019-1eqe6sdn2v
SHA256 0fc361656387dc2de7d8e77eeb991e5ce1de799d10c9ce69fe82468ebf6c7c35
MD5 1c4529cb111c1ec7102999d0b989a268
SHA1 25665c6bdb47f9a421dee55c20b77bf89b225b50
SHA512 0b98fb7b41692ee7d938d82c6810258ea7d4952cd26b4ac36f3c9b954653e9e1c6f64c9fc1dd723e4e3ff7528ee8b3838dca587c7e899e4120f6c378edf71a85
SSDEEP 3072:sM8SYgJAvWsDL2ToQz75W7VgiLXOSrNrQwk8rDDAoSloh0JsmodFtzK20TRpAl:RJhipNrQqAsh0Jsmn2+XAl
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

defense_evasion discovery execution teslacrypt impact persistence ransomware spyware stealer

Malware Config

Extracted

Path

C:\Users\_ReCoVeRy_+xfxyq.txt

teslacrypt

Ransom Note

NOT YOUR LANGUAGE? USE https://translate.google.com What happened to your files ? All of your files were protected by a strong encryption with RSA4096 More information about the encryption keys using RSA4096 can be found here: http://en.wikipedia.org/wiki/RSA_(cryptosystem) How did this happen ? !!! Specially for your PC was generated personal RSA4096 Key , both public and private. !!! ALL YOUR FILES were encrypted with the public key, which has been transferred to your computer via the Internet. !!! Decrypting of your files is only possible with the help of the private key and decrypt program , which is on our Secret Server What do I do ? So, there are two ways you can choose: wait for a miracle and get your price doubled, or start obtaining BITCOIN NOW! , and restore your data easy way. If You have really valuable data, you better not waste your time, because there is no other way to get your files, except make a payment. For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: 1 - http://sondr5344ygfweyjbfkw4fhsefv.heliofetch.at/39E9603AFBA0D76C 2 - http://pts764gt354fder34fsqw45gdfsavadfgsfg.kraskula.com/39E9603AFBA0D76C 3 - http://yyre45dbvn2nhbefbmh.begumvelic.at/39E9603AFBA0D76C If for some reasons the addresses are not available, follow these steps: 1 - Download and install tor-browser: http://www.torproject.org/projects/torbrowser.html.en 2 - After a successful installation, run the browser 3 - Type in the address bar: xlowfznrg4wf7dli.onion/39E9603AFBA0D76C 4 - Follow the instructions on the site IMPORTANT INFORMATION Your personal pages http://sondr5344ygfweyjbfkw4fhsefv.heliofetch.at/39E9603AFBA0D76C http://pts764gt354fder34fsqw45gdfsavadfgsfg.kraskula.com/39E9603AFBA0D76C http://yyre45dbvn2nhbefbmh.begumvelic.at/39E9603AFBA0D76C Your personal page Tor-Browser xlowfznrg4wf7dli.ONION/39E9603AFBA0D76C

URLs

http://sondr5344ygfweyjbfkw4fhsefv.heliofetch.at/39E9603AFBA0D76C
http://pts764gt354fder34fsqw45gdfsavadfgsfg.kraskula.com/39E9603AFBA0D76C
http://yyre45dbvn2nhbefbmh.begumvelic.at/39E9603AFBA0D76C
http://xlowfznrg4wf7dli.ONION/39E9603AFBA0D76C

Signatures

TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
ransomware teslacrypt
Teslacrypt family
teslacrypt
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047
Renames multiple (839) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops startup file 6 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\_ReCoVeRy_+xfxyq.txt	vaunppwpxndk.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\_ReCoVeRy_+xfxyq.html	vaunppwpxndk.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_ReCoVeRy_+xfxyq.png	vaunppwpxndk.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_ReCoVeRy_+xfxyq.txt	vaunppwpxndk.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_ReCoVeRy_+xfxyq.html	vaunppwpxndk.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\_ReCoVeRy_+xfxyq.png	vaunppwpxndk.exe

Executes dropped EXE 1 IoCs

pid	Process
1648	vaunppwpxndk.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-330179853-1108322181-418488014-1000\Software\Microsoft\Windows\CurrentVersion\Run\bkaljly = "C:\\Windows\\system32\\CMD.EXE /c start C:\\Windows\\vaunppwpxndk.exe"	vaunppwpxndk.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_1.0.38.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\_ReCoVeRy_+xfxyq.png	vaunppwpxndk.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\_ReCoVeRy_+xfxyq.txt	vaunppwpxndk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\Office Setup Controller\_ReCoVeRy_+xfxyq.png	vaunppwpxndk.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\my\_ReCoVeRy_+xfxyq.png	vaunppwpxndk.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\GenericMailSmallTile.scale-150.png	vaunppwpxndk.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.MicrosoftStickyNotes_4.0.2.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\Icons\StickyNotesMedTile.scale-125_contrast-white.png	vaunppwpxndk.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_1.0.6.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherAppList.targetsize-20_altform-unplated.png	vaunppwpxndk.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.40978.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-60_contrast-white.png	vaunppwpxndk.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsFeedbackHub_1.2103.1172.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\_ReCoVeRy_+xfxyq.png	vaunppwpxndk.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsFeedbackHub_1.2103.1172.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\_ReCoVeRy_+xfxyq.html	vaunppwpxndk.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsStore_12104.1001.1.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\Illustrations\_ReCoVeRy_+xfxyq.png	vaunppwpxndk.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_1.0.6.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\WeatherAppList.targetsize-60_contrast-white.png	vaunppwpxndk.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\TXP_3color_Dining_378.png	vaunppwpxndk.exe
File opened for modification	C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\react\lib-commonjs\components\ComboBox\ComboBox.styles.js	vaunppwpxndk.exe
File opened for modification	C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\theme\node_modules\@uifabric\utilities\lib\_ReCoVeRy_+xfxyq.html	vaunppwpxndk.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\contrast-white\HxA-Advanced-Dark.scale-300.png	vaunppwpxndk.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_1.0.38.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.targetsize-72.png	vaunppwpxndk.exe
File opened for modification	C:\Program Files\7-Zip\Lang\io.txt	vaunppwpxndk.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\hy\_ReCoVeRy_+xfxyq.html	vaunppwpxndk.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\WelcomeIllustration.png	vaunppwpxndk.exe
File opened for modification	C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\theme\lib-amd\effects\_ReCoVeRy_+xfxyq.html	vaunppwpxndk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft\OFFICE\_ReCoVeRy_+xfxyq.png	vaunppwpxndk.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\hu\_ReCoVeRy_+xfxyq.png	vaunppwpxndk.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.GetHelp_10.2008.32311.0_x64__8wekyb3d8bbwe\Assets\GetHelpAppList.targetsize-16_altform-unplated.png	vaunppwpxndk.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\Images\Square44x44Logo.targetsize-96_contrast-white.png	vaunppwpxndk.exe
File opened for modification	C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\react\lib-commonjs\components\DetailsList\DetailsList.styles.js	vaunppwpxndk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSIPC\et\_ReCoVeRy_+xfxyq.png	vaunppwpxndk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\PersonaSpy.js	vaunppwpxndk.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\vi\_ReCoVeRy_+xfxyq.txt	vaunppwpxndk.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_2.2106.2807.0_x64__8wekyb3d8bbwe\Assets\Store\SmallTile.scale-200.png	vaunppwpxndk.exe
File opened for modification	C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\theme\node_modules\@uifabric\merge-styles\lib-amd\IStyleOptions.js	vaunppwpxndk.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\en_GB\_ReCoVeRy_+xfxyq.txt	vaunppwpxndk.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.GamingApp_2105.900.24.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\Xbox_StoreLogo.scale-125_contrast-black.png	vaunppwpxndk.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Getstarted_10.2.41172.0_neutral_~_8wekyb3d8bbwe\microsoft.system.package.metadata\_ReCoVeRy_+xfxyq.png	vaunppwpxndk.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_4.1.2.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\_ReCoVeRy_+xfxyq.html	vaunppwpxndk.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\AttachmentPlaceholder-Light.png	vaunppwpxndk.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.2103.1172.0_x64__8wekyb3d8bbwe\Assets\FeedbackHubAppList.targetsize-40_altform-unplated.png	vaunppwpxndk.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.46.11001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubStoreLogo.scale-200.png	vaunppwpxndk.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_1.0.65.0_x64__8wekyb3d8bbwe\Images\contrast-white\PowerAutomateAppIcon.altform-lightunplated_targetsize-16.png	vaunppwpxndk.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_11.2104.2.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-black\_ReCoVeRy_+xfxyq.html	vaunppwpxndk.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.21012.10511.0_x64__8wekyb3d8bbwe\Assets\_ReCoVeRy_+xfxyq.png	vaunppwpxndk.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.21012.10511.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-black\_ReCoVeRy_+xfxyq.txt	vaunppwpxndk.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.21012.10511.0_x64__8wekyb3d8bbwe\Assets\contrast-white\_ReCoVeRy_+xfxyq.png	vaunppwpxndk.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_2.2106.2807.0_x64__8wekyb3d8bbwe\Assets\Images\contrast-white\_ReCoVeRy_+xfxyq.png	vaunppwpxndk.exe
File opened for modification	C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\react\lib-amd\PersonaCoin.js	vaunppwpxndk.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\fr\_ReCoVeRy_+xfxyq.txt	vaunppwpxndk.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.GamingApp_2105.900.24.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\Xbox_MedTile.scale-125.png	vaunppwpxndk.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppPackageWideTile.scale-100.png	vaunppwpxndk.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_21.21030.25003.0_x64__8wekyb3d8bbwe\Assets\PhotosLogoExtensions.targetsize-336.png	vaunppwpxndk.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\bg7.jpg	vaunppwpxndk.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.21012.10511.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-64_altform-unplated_contrast-white.png	vaunppwpxndk.exe
File opened for modification	C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\theme\node_modules\@uifabric\utilities\lib\renderFunction\composeRenderFunction.js	vaunppwpxndk.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\nn\LC_MESSAGES\_ReCoVeRy_+xfxyq.html	vaunppwpxndk.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.40978.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-256_altform-unplated_contrast-white.png	vaunppwpxndk.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Todos_0.33.33351.0_x64__8wekyb3d8bbwe\Assets\Square44x44Logo.targetsize-256_altform-unplated_contrast-black.png	vaunppwpxndk.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.2012.21.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-48_contrast-black.png	vaunppwpxndk.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxIdentityProvider_12.50.6001.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\_ReCoVeRy_+xfxyq.html	vaunppwpxndk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Bibliography\_ReCoVeRy_+xfxyq.png	vaunppwpxndk.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ScreenSketch_11.2104.2.0_neutral_split.scale-125_8wekyb3d8bbwe\SnippingTool\Assets\Wide310x150Logo.scale-125.png	vaunppwpxndk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Document Themes 16\_ReCoVeRy_+xfxyq.html	vaunppwpxndk.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\hr\_ReCoVeRy_+xfxyq.html	vaunppwpxndk.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\contrast-white\HxCalendarBadge.scale-100.png	vaunppwpxndk.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsNotepad_10.2102.13.0_x64__8wekyb3d8bbwe\Assets\contrast-white\NotepadAppList.targetsize-20_altform-unplated.png	vaunppwpxndk.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\AppxMetadata\_ReCoVeRy_+xfxyq.html	vaunppwpxndk.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4080_1029564495\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4080_1029564495\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4080_1029564495\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4080_1029564495\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4080_1508717365\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4080_1029564495\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4080_1029564495\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4080_1029564495\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4080_1029564495\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4080_1029564495\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4080_1029564495\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4080_1029564495\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4080_1029564495\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4080_1029564495\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4080_1029564495\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4080_1029564495\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4080_1029564495\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4080_1029564495\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4080_1029564495\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4080_1029564495\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4080_1029564495\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4080_1029564495\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4080_1029564495\_locales\tr\messages.json	msedge.exe
File opened for modification	C:\Windows\vaunppwpxndk.exe	2025-10-19_1c4529cb111c1ec7102999d0b989a268_amadey_darkgate_elex_smoke-loader_teslacrypt.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4080_1029564495\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4080_1029564495\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4080_1029564495\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4080_1029564495\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4080_1029564495\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4080_1029564495\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4080_1029564495\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4080_1029564495\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4080_1029564495\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4080_1029564495\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4080_1029564495\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\vaunppwpxndk.exe	2025-10-19_1c4529cb111c1ec7102999d0b989a268_amadey_darkgate_elex_smoke-loader_teslacrypt.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_4080_2073731177\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_96_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4080_1029564495\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4080_1029564495\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4080_1029564495\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4080_1029564495\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4080_1029564495\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4080_1029564495\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4080_1029564495\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4080_1029564495\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4080_1029564495\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4080_1029564495\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4080_1029564495\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4080_1029564495\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4080_1029564495\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4080_1029564495\offscreendocument_main.js	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4080_1029564495\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4080_1029564495\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4080_1508717365\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4080_1029564495\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4080_1029564495\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4080_1029564495\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4080_1029564495\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4080_1029564495\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4080_1029564495\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4080_1029564495\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4080_1029564495\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4080_1029564495\_locales\mn\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2025-10-19_1c4529cb111c1ec7102999d0b989a268_amadey_darkgate_elex_smoke-loader_teslacrypt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vaunppwpxndk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NOTEPAD.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134053833026506471"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-330179853-1108322181-418488014-1000\{0F6F5021-8CA4-409D-9DCE-230D3FF41B81}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-330179853-1108322181-418488014-1000_Classes\Local Settings	vaunppwpxndk.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
5924	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1648	vaunppwpxndk.exe
1648	vaunppwpxndk.exe
1648	vaunppwpxndk.exe
1648	vaunppwpxndk.exe
1648	vaunppwpxndk.exe
1648	vaunppwpxndk.exe
1648	vaunppwpxndk.exe
1648	vaunppwpxndk.exe
1648	vaunppwpxndk.exe
1648	vaunppwpxndk.exe
1648	vaunppwpxndk.exe
1648	vaunppwpxndk.exe
1648	vaunppwpxndk.exe
1648	vaunppwpxndk.exe
1648	vaunppwpxndk.exe
1648	vaunppwpxndk.exe
1648	vaunppwpxndk.exe
1648	vaunppwpxndk.exe
1648	vaunppwpxndk.exe
1648	vaunppwpxndk.exe
1648	vaunppwpxndk.exe
1648	vaunppwpxndk.exe
1648	vaunppwpxndk.exe
1648	vaunppwpxndk.exe
1648	vaunppwpxndk.exe
1648	vaunppwpxndk.exe
1648	vaunppwpxndk.exe
1648	vaunppwpxndk.exe
1648	vaunppwpxndk.exe
1648	vaunppwpxndk.exe
1648	vaunppwpxndk.exe
1648	vaunppwpxndk.exe
1648	vaunppwpxndk.exe
1648	vaunppwpxndk.exe
1648	vaunppwpxndk.exe
1648	vaunppwpxndk.exe
1648	vaunppwpxndk.exe
1648	vaunppwpxndk.exe
1648	vaunppwpxndk.exe
1648	vaunppwpxndk.exe
1648	vaunppwpxndk.exe
1648	vaunppwpxndk.exe
1648	vaunppwpxndk.exe
1648	vaunppwpxndk.exe
1648	vaunppwpxndk.exe
1648	vaunppwpxndk.exe
1648	vaunppwpxndk.exe
1648	vaunppwpxndk.exe
1648	vaunppwpxndk.exe
1648	vaunppwpxndk.exe
1648	vaunppwpxndk.exe
1648	vaunppwpxndk.exe
1648	vaunppwpxndk.exe
1648	vaunppwpxndk.exe
1648	vaunppwpxndk.exe
1648	vaunppwpxndk.exe
1648	vaunppwpxndk.exe
1648	vaunppwpxndk.exe
1648	vaunppwpxndk.exe
1648	vaunppwpxndk.exe
1648	vaunppwpxndk.exe
1648	vaunppwpxndk.exe
1648	vaunppwpxndk.exe
1648	vaunppwpxndk.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4080	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5280	2025-10-19_1c4529cb111c1ec7102999d0b989a268_amadey_darkgate_elex_smoke-loader_teslacrypt.exe
Token: SeDebugPrivilege	1648	vaunppwpxndk.exe
Token: SeIncreaseQuotaPrivilege	1556	WMIC.exe
Token: SeSecurityPrivilege	1556	WMIC.exe
Token: SeTakeOwnershipPrivilege	1556	WMIC.exe
Token: SeLoadDriverPrivilege	1556	WMIC.exe
Token: SeSystemProfilePrivilege	1556	WMIC.exe
Token: SeSystemtimePrivilege	1556	WMIC.exe
Token: SeProfSingleProcessPrivilege	1556	WMIC.exe
Token: SeIncBasePriorityPrivilege	1556	WMIC.exe
Token: SeCreatePagefilePrivilege	1556	WMIC.exe
Token: SeBackupPrivilege	1556	WMIC.exe
Token: SeRestorePrivilege	1556	WMIC.exe
Token: SeShutdownPrivilege	1556	WMIC.exe
Token: SeDebugPrivilege	1556	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1556	WMIC.exe
Token: SeRemoteShutdownPrivilege	1556	WMIC.exe
Token: SeUndockPrivilege	1556	WMIC.exe
Token: SeManageVolumePrivilege	1556	WMIC.exe
Token: 33	1556	WMIC.exe
Token: 34	1556	WMIC.exe
Token: 35	1556	WMIC.exe
Token: 36	1556	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1556	WMIC.exe
Token: SeSecurityPrivilege	1556	WMIC.exe
Token: SeTakeOwnershipPrivilege	1556	WMIC.exe
Token: SeLoadDriverPrivilege	1556	WMIC.exe
Token: SeSystemProfilePrivilege	1556	WMIC.exe
Token: SeSystemtimePrivilege	1556	WMIC.exe
Token: SeProfSingleProcessPrivilege	1556	WMIC.exe
Token: SeIncBasePriorityPrivilege	1556	WMIC.exe
Token: SeCreatePagefilePrivilege	1556	WMIC.exe
Token: SeBackupPrivilege	1556	WMIC.exe
Token: SeRestorePrivilege	1556	WMIC.exe
Token: SeShutdownPrivilege	1556	WMIC.exe
Token: SeDebugPrivilege	1556	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1556	WMIC.exe
Token: SeRemoteShutdownPrivilege	1556	WMIC.exe
Token: SeUndockPrivilege	1556	WMIC.exe
Token: SeManageVolumePrivilege	1556	WMIC.exe
Token: 33	1556	WMIC.exe
Token: 34	1556	WMIC.exe
Token: 35	1556	WMIC.exe
Token: 36	1556	WMIC.exe
Token: SeBackupPrivilege	5332	vssvc.exe
Token: SeRestorePrivilege	5332	vssvc.exe
Token: SeAuditPrivilege	5332	vssvc.exe
Token: SeIncreaseQuotaPrivilege	5788	WMIC.exe
Token: SeSecurityPrivilege	5788	WMIC.exe
Token: SeTakeOwnershipPrivilege	5788	WMIC.exe
Token: SeLoadDriverPrivilege	5788	WMIC.exe
Token: SeSystemProfilePrivilege	5788	WMIC.exe
Token: SeSystemtimePrivilege	5788	WMIC.exe
Token: SeProfSingleProcessPrivilege	5788	WMIC.exe
Token: SeIncBasePriorityPrivilege	5788	WMIC.exe
Token: SeCreatePagefilePrivilege	5788	WMIC.exe
Token: SeBackupPrivilege	5788	WMIC.exe
Token: SeRestorePrivilege	5788	WMIC.exe
Token: SeShutdownPrivilege	5788	WMIC.exe
Token: SeDebugPrivilege	5788	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5788	WMIC.exe
Token: SeRemoteShutdownPrivilege	5788	WMIC.exe
Token: SeUndockPrivilege	5788	WMIC.exe
Token: SeManageVolumePrivilege	5788	WMIC.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4080	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5280 wrote to memory of 1648	5280	2025-10-19_1c4529cb111c1ec7102999d0b989a268_amadey_darkgate_elex_smoke-loader_teslacrypt.exe	78
PID 5280 wrote to memory of 1648	5280	2025-10-19_1c4529cb111c1ec7102999d0b989a268_amadey_darkgate_elex_smoke-loader_teslacrypt.exe	78
PID 5280 wrote to memory of 1648	5280	2025-10-19_1c4529cb111c1ec7102999d0b989a268_amadey_darkgate_elex_smoke-loader_teslacrypt.exe	78
PID 5280 wrote to memory of 3180	5280	2025-10-19_1c4529cb111c1ec7102999d0b989a268_amadey_darkgate_elex_smoke-loader_teslacrypt.exe	79
PID 5280 wrote to memory of 3180	5280	2025-10-19_1c4529cb111c1ec7102999d0b989a268_amadey_darkgate_elex_smoke-loader_teslacrypt.exe	79
PID 5280 wrote to memory of 3180	5280	2025-10-19_1c4529cb111c1ec7102999d0b989a268_amadey_darkgate_elex_smoke-loader_teslacrypt.exe	79
PID 1648 wrote to memory of 1556	1648	vaunppwpxndk.exe	81
PID 1648 wrote to memory of 1556	1648	vaunppwpxndk.exe	81
PID 1648 wrote to memory of 5924	1648	vaunppwpxndk.exe	140
PID 1648 wrote to memory of 5924	1648	vaunppwpxndk.exe	140
PID 1648 wrote to memory of 5924	1648	vaunppwpxndk.exe	140
PID 1648 wrote to memory of 4080	1648	vaunppwpxndk.exe	141
PID 1648 wrote to memory of 4080	1648	vaunppwpxndk.exe	141
PID 1648 wrote to memory of 5788	1648	vaunppwpxndk.exe	142
PID 1648 wrote to memory of 5788	1648	vaunppwpxndk.exe	142
PID 4080 wrote to memory of 2572	4080	msedge.exe	144
PID 4080 wrote to memory of 2572	4080	msedge.exe	144
PID 4080 wrote to memory of 5180	4080	msedge.exe	147
PID 4080 wrote to memory of 5180	4080	msedge.exe	147
PID 4080 wrote to memory of 2684	4080	msedge.exe	148
PID 4080 wrote to memory of 2684	4080	msedge.exe	148
PID 4080 wrote to memory of 2684	4080	msedge.exe	148
PID 4080 wrote to memory of 2684	4080	msedge.exe	148
PID 4080 wrote to memory of 2684	4080	msedge.exe	148
PID 4080 wrote to memory of 2684	4080	msedge.exe	148
PID 4080 wrote to memory of 2684	4080	msedge.exe	148
PID 4080 wrote to memory of 2684	4080	msedge.exe	148
PID 4080 wrote to memory of 2684	4080	msedge.exe	148
PID 4080 wrote to memory of 2684	4080	msedge.exe	148
PID 4080 wrote to memory of 2684	4080	msedge.exe	148
PID 4080 wrote to memory of 2684	4080	msedge.exe	148
PID 4080 wrote to memory of 2684	4080	msedge.exe	148
PID 4080 wrote to memory of 2684	4080	msedge.exe	148
PID 4080 wrote to memory of 2684	4080	msedge.exe	148
PID 4080 wrote to memory of 2684	4080	msedge.exe	148
PID 4080 wrote to memory of 2684	4080	msedge.exe	148
PID 4080 wrote to memory of 2684	4080	msedge.exe	148
PID 4080 wrote to memory of 2684	4080	msedge.exe	148
PID 4080 wrote to memory of 2684	4080	msedge.exe	148
PID 4080 wrote to memory of 2684	4080	msedge.exe	148
PID 4080 wrote to memory of 2684	4080	msedge.exe	148
PID 4080 wrote to memory of 2684	4080	msedge.exe	148
PID 4080 wrote to memory of 2684	4080	msedge.exe	148
PID 4080 wrote to memory of 2684	4080	msedge.exe	148
PID 4080 wrote to memory of 2684	4080	msedge.exe	148
PID 4080 wrote to memory of 2684	4080	msedge.exe	148
PID 4080 wrote to memory of 2684	4080	msedge.exe	148
PID 4080 wrote to memory of 2684	4080	msedge.exe	148
PID 4080 wrote to memory of 2684	4080	msedge.exe	148
PID 4080 wrote to memory of 2684	4080	msedge.exe	148
PID 4080 wrote to memory of 2684	4080	msedge.exe	148
PID 4080 wrote to memory of 2684	4080	msedge.exe	148
PID 4080 wrote to memory of 2684	4080	msedge.exe	148
PID 4080 wrote to memory of 2684	4080	msedge.exe	148
PID 4080 wrote to memory of 2684	4080	msedge.exe	148
PID 4080 wrote to memory of 2684	4080	msedge.exe	148
PID 4080 wrote to memory of 2684	4080	msedge.exe	148
PID 4080 wrote to memory of 2684	4080	msedge.exe	148
PID 4080 wrote to memory of 2684	4080	msedge.exe	148
PID 4080 wrote to memory of 2684	4080	msedge.exe	148
PID 4080 wrote to memory of 2684	4080	msedge.exe	148
PID 4080 wrote to memory of 2684	4080	msedge.exe	148
PID 4080 wrote to memory of 2684	4080	msedge.exe	148
PID 4080 wrote to memory of 2684	4080	msedge.exe	148

System policy modification 1 TTPs 2 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	vaunppwpxndk.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1"	vaunppwpxndk.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2025-10-19_1c4529cb111c1ec7102999d0b989a268_amadey_darkgate_elex_smoke-loader_teslacrypt.exe
"C:\Users\Admin\AppData\Local\Temp\2025-10-19_1c4529cb111c1ec7102999d0b989a268_amadey_darkgate_elex_smoke-loader_teslacrypt.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5280
- C:\Windows\vaunppwpxndk.exe
  C:\Windows\vaunppwpxndk.exe
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:1648
- - C:\Windows\System32\wbem\WMIC.exe
    "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /nointeractive
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1556
- - C:\Windows\SysWOW64\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\_ReCoVeRy_.TXT
    3⤵
    - System Location Discovery: System Language Discovery
    - Opens file in notepad (likely ransom note)
    PID:5924
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\_ReCoVeRy_.HTM
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4080
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x2e4,0x2e8,0x2ec,0x2e0,0x34c,0x7ff93150f208,0x7ff93150f214,0x7ff93150f220
      4⤵
      PID:2572
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1796,i,16092986578719357771,15410509384578538018,262144 --variations-seed-version --mojo-platform-channel-handle=2248 /prefetch:11
      4⤵
      PID:5180
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2212,i,16092986578719357771,15410509384578538018,262144 --variations-seed-version --mojo-platform-channel-handle=2208 /prefetch:2
      4⤵
      PID:2684
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2500,i,16092986578719357771,15410509384578538018,262144 --variations-seed-version --mojo-platform-channel-handle=2508 /prefetch:13
      4⤵
      PID:4964
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3396,i,16092986578719357771,15410509384578538018,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
      4⤵
      PID:3036
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3404,i,16092986578719357771,15410509384578538018,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
      4⤵
      PID:2808
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4772,i,16092986578719357771,15410509384578538018,262144 --variations-seed-version --mojo-platform-channel-handle=4780 /prefetch:14
      4⤵
      PID:692
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4920,i,16092986578719357771,15410509384578538018,262144 --variations-seed-version --mojo-platform-channel-handle=4864 /prefetch:14
      4⤵
      PID:4292
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4776,i,16092986578719357771,15410509384578538018,262144 --variations-seed-version --mojo-platform-channel-handle=4768 /prefetch:14
      4⤵
      PID:4472
  - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5308,i,16092986578719357771,15410509384578538018,262144 --variations-seed-version --mojo-platform-channel-handle=5740 /prefetch:14
      4⤵
      PID:5612
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5792,i,16092986578719357771,15410509384578538018,262144 --variations-seed-version --mojo-platform-channel-handle=5804 /prefetch:14
      4⤵
      PID:4704
    - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=1128
        5⤵
        
        PID:4420
  - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5308,i,16092986578719357771,15410509384578538018,262144 --variations-seed-version --mojo-platform-channel-handle=5740 /prefetch:14
      4⤵
      PID:2528
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5816,i,16092986578719357771,15410509384578538018,262144 --variations-seed-version --mojo-platform-channel-handle=5944 /prefetch:14
      4⤵
      PID:800
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5896,i,16092986578719357771,15410509384578538018,262144 --variations-seed-version --mojo-platform-channel-handle=6120 /prefetch:14
      4⤵
      PID:2088
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6076,i,16092986578719357771,15410509384578538018,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:14
      4⤵
      PID:5744
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6248,i,16092986578719357771,15410509384578538018,262144 --variations-seed-version --mojo-platform-channel-handle=6296 /prefetch:14
      4⤵
      PID:5672
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=732,i,16092986578719357771,15410509384578538018,262144 --variations-seed-version --mojo-platform-channel-handle=6552 /prefetch:14
      4⤵
      PID:4348
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4980,i,16092986578719357771,15410509384578538018,262144 --variations-seed-version --mojo-platform-channel-handle=6488 /prefetch:14
      4⤵
      PID:320
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6040,i,16092986578719357771,15410509384578538018,262144 --variations-seed-version --mojo-platform-channel-handle=6576 /prefetch:14
      4⤵
      PID:796
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6572,i,16092986578719357771,15410509384578538018,262144 --variations-seed-version --mojo-platform-channel-handle=6608 /prefetch:14
      4⤵
      PID:4924
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5960,i,16092986578719357771,15410509384578538018,262144 --variations-seed-version --mojo-platform-channel-handle=6496 /prefetch:14
      4⤵
      PID:3768
- - C:\Windows\System32\wbem\WMIC.exe
    "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /nointeractive
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5788
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c DEL C:\Windows\VAUNPP~1.EXE
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4720
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\AppData\Local\Temp\2025-1~1.EXE
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3180

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5332

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:5640

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3760

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

THIRDPARTYLICENSEREADME-JAVAFX.txt

Path C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt
Size 560B
SHA256 f18677b2130963aaf0c152613e5542c85b107b2b42f668d75c275da785061ae1
MD5 33dd198eb9c230b5db320451bbb1d617
SHA1 7d6d00d88dac196697cd2bf818e090daf45bd799
SHA512 92be9a0447ff8c4267d021b55ee005e066060504b580e66476a10b084eae5e50d2917607d9b754c3b9c65c33b01067ab131a778fa96f45afb6d4d3ca9913c297
MD5 SHA1 SHA512

Submit Download

THIRDPARTYLICENSEREADME.txt

Path C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt
Size 560B
SHA256 fbc4f6d601d6749e0b257567430ab08ed084e5cdef2684eeec0ac0a503ebe050
MD5 df3b999c8ffe998601368c7de4a68b28
SHA1 5f1781c3646fe4dc916ea421b396d6e0568429b0
SHA512 f4868d86c938fae027c877fd90fce6abb31419a553b259ec93ea3c150886de56ba4d9bc94b9268e1ab3984c7d9b267840c7c10abfaf0c33911c843941c76f2f0
MD5 SHA1 SHA512

Submit Download

ClientSub2019_eula.txt

Path C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub2019_eula.txt
Size 416B
SHA256 9f2c2ac9ffb75bf0e39b8b20de1ddf678210aef3166b6505db27690762cab3a3
MD5 41e6cd09db23e9d8dbcdc456cc57a645
SHA1 535f23e85816c6c5c3aabfbcda8ce786f5ed3199
SHA512 3f5db3ccc5dec3a37bacb66cd195a8fe4a1d1ed11e774794a743a68b42bb6ee0c2b18d14849958952293b87817f55b9d663f3265e87168cf93b319365504a750
MD5 SHA1 SHA512

Submit Download

protocols.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.10\protocols.json
Size 3KB
SHA256 4fd800e7b1a5fb24b13fac2e31946d205012b7c28d8c61580b0669b2fa3517cc
MD5 1de85fec2dfcc28011a7c2aaab95eb5f
SHA1 80e8c954bfbe8f7ee5a2335c8d969ae033935dc3
SHA512 9c7dd37eb0c094b6aa05201e7c71a8f33b9db81284223bcfa595a44a6ac95d5a6820ab6f07b7aa8d26bf207454e94277bf35332e9c009ee63f083752b6b51750
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c1db9209bc374a2f86cd95b7346b358838349df213bbf2e5a06533baaa399d8b
MD5 abed9e3e2618edc08b0b4a9bf347482b
SHA1 4b8e21f266a1b3861e89185599ab6b265e0c308b
SHA512 11ac46f03cb60b91cc665ca07d95cef83b62e58ef3e2c0e57aad330a2f44ddffcc94b6bc031f690502171ae756869ec4b1c8cfd689529ed13915f42ea2cc1bc5
MD5 SHA1 SHA512

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_1\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
MD5 SHA1 SHA512 SSDEEP

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 108KB
SHA256 a5f47979e3d9dc7c49694d8e9e4dd8e98b45470f93161940daff0b96bfc84a91
MD5 3692b82273b09514a7212381ba0e0098
SHA1 5abf2cbf0bfd404c62a99944e2653830865eb23b
SHA512 d3611f1b0d1c4740eef4bb7d25dffc69de0afabb5f62164acb0d7e947175822cffdadfd607249028c6c6f9f39486e0e7dec0368f225793245ee820f59dcac4d7
SSDEEP 1536:IJcH74ohBGZqW3iPPDuVvpBI/S8tZsA62UYPq:PHSRiPjU1
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 be72146ef111e35afce717a226dd0bc9d54ad72ed76b8cbd9aef1cca28651533
MD5 f72c5083b4316db60bad44be4efaccd9
SHA1 e34da5724924de6e016a983aaedb95ba621c13a9
SHA512 d85ae2be54eba3ae85087e8e2f15005c712fb5ebef8ec3f7e835a5e85ee3d7e323eecb2b784c3f9585948b3e6c5b115100449342dc1d3c23adddfbc99c4db861
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 37KB
SHA256 ef2567e6f046602c92479cae0a697da8f3863ab14c114130188f207d132f3872
MD5 1d41f280a1400c1f8c913ac331e10b98
SHA1 18681ed4e75289fa9cace56c34be4ae5b1b8843f
SHA512 f456c876223bbcbdae8aa8e431a69a3ae80c0092b04f50f434f832bb6f0a857c945fc95b26c4a8fa4908216b793d83ba71eeaf0de8c1939612e60dcfacd42563
SSDEEP 768:+Y8dM8jQ2sx7pLmLl1/WRWDpQ3V8F1+UoAYDCx9Tuqh0VfUC9xbog/OV30YUuLlM:+Y8dM8jQ2sn8l1/WRWDpQ3Vu1jaK0YU/
MD5 SHA1 SHA512 SSDEEP

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 22KB
SHA256 85300d8ebfdae06a64391fa1b90a29ffd87474f1764f016daa60b9de9cf30cd0
MD5 dc0f39b9e948f28ef7b028959950fdf1
SHA1 b89d8c19a7b799bf293388d8b4d6141c3d16ef49
SHA512 0287804f9b705e6f0c9876a84724015e23b5193fe8c5181185acde1cde41004dbd36694e32e496d860b99e2fd904d606f8624e2a6588012aefaa8bc26ae6418b
SSDEEP 192:2CM1L7oH7NtNmFSbLz5BDKparjwv8TP5xBSxmPP/ddvutuFJd1Enb13XQ7mnjJrV:q
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ahokoikenoafgppiblgpenaaaolecifn\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ahokoikenoafgppiblgpenaaaolecifn\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

ec9b6f25-7911-4239-93d8-dd6f1dc5f9e3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ec9b6f25-7911-4239-93d8-dd6f1dc5f9e3.tmp
Size 15KB
SHA256 e1c3987bf154a3c0e09072f962eca7c62fb16afb79e6115d5cad73573136aba7
MD5 67b8b30907b3b7444a5ed22bdf90f2c1
SHA1 dc4ed95feb259cf29988cabc68ee281235ed3058
SHA512 739382f25793ab4eb15f63cfba1db61b1f12256f60d8878224d388281218f9a67d761a9488f2812ace5eba973764fb72af93263314effe4b6f5479dd7a442fe5
SSDEEP 192:sVOR1yMh/Ky0Ml8M3pZ/2sbvrgI8nwg05TCzoZ8pkNS/Y+WNrY0JqvyaLAIgyWJ:sVOFLPpZ/2s7rgbwL5TAAS/Sr548V
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.txt.mp3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\EADPData Component\4.0.3.10\data.txt.mp3
Size 113KB
SHA256 ef41ea7811178251d52365e44367e258d1bded17d88bbb45fbe5933e1a1b7758
MD5 456c76b5f39aebf76961b7ae4345c81c
SHA1 eee8a17c878f9fe2911c29d1a6161e3a8dd08198
SHA512 211bef338d9ec3cf9e3d13e123f8ea662380c97cb0a3f1e779d281934f126043648b45ab0efe817112534732cfcd57701ce28cb10cb449f0d9d390e74521c51e
SSDEEP 3072:56eB8hzICxXozUWvJ+/XDOlKt91z6SxY8tvsd1UoLTzR8kF2Zb:Y7zpR0aKlKtbzPxjtmBzjF2Zb
MD5 SHA1 SHA512 SSDEEP

Submit Download

CloudConfigLog

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog
Size 471B
SHA256 8ca31362d77d86f3cd4841ab056b99bc0466adfb0a5585372b2bd7763a8b37e4
MD5 2ad7316245b0a6ac82ec8faa08265216
SHA1 0a48f19ddf24fa4ad3140fae2ef3f5c7c9692178
SHA512 1910916a3592266c870411dcc187b5706348c5c179668ac1024885f424e3d5c8a710a966857812164c28f3de0fdfca2dba0a351013ad3785c9531ad7bf266c0b
MD5 SHA1 SHA512

Submit Download

CloudConfigLog

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog
Size 5KB
SHA256 ac514955d1cb4fc053b53d9e218ef59f5ed3387474a53a0b1a52d6f4bdc52ec6
MD5 e76f2600416d7c8daa16ed653bfe3367
SHA1 c395379d073fbbfc0cf916ea23eb8b84bac762fd
SHA512 38936be97757fb55fb827489424c18aae6fdce35324839879405cf5c43ce14c7358beded899f38bc114888d95f5c4ffb7384de11e637123c577d1e212c6a6597
SSDEEP 96:K5JR+0+IC+H+DQ+B+XST+STk0I0ZeNcUynwxF7wyP7ymjbR:K5XST+STktWejyKFcyPOmj1
MD5 SHA1 SHA512 SSDEEP

Submit Download

CloudConfigLog

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog
Size 908B
SHA256 afce1aa79c6a652030a8752689091527fdc2d80b676f5580b6f140b1228b960c
MD5 1d3d2bb7724903af6dcd9cfdf3e677ea
SHA1 b9379fa8ef4ebecc26231800848bd2710f9a1a37
SHA512 7759f1403b1ecb68a72ff09bad39cec4409858cb464ec8ca8259f760d2eabc168278a589dae6e28a4e446ab27d88f9342cf4a03d84db0cf87a2fdd6be074b35d
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 4503345ee70aa9ca0f90012b665743d7c13ec7052e7a943222287973b752b9c7
MD5 3bca8411b45106afaa963d562c371631
SHA1 78857d33a65e7061ca18a3540c304f01e7e85325
SHA512 a6a7e9af6613a30730a0b87be76f87144a3483afb756445d462de7b22543027e5e8f5822e0337ba2d7b65e413e526da962783d05d226c0d13d113d57d28b56ff
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/uz:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbA0
MD5 SHA1 SHA512 SSDEEP

Submit Download

arbitration_metadata.txt.mp3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Notifications\0.0.0.46\arbitration_metadata.txt.mp3
Size 344KB
SHA256 c7b37ea6b5cf99d4aa5704679ddc805b33ff7119e8a0cf076b194975b6eae83f
MD5 f75fc7a3b36fb86834b8581297af9d70
SHA1 30c22e198fb95ea766a74ac1e1f66b699b1e713e
SHA512 be70852b98a8f4d7c9e113e9589353d6af5905a0653f4b891fb746633cec4953d57979a48e0a4fd6e07e1ccd8b9cd17c66239868c36ccbdb95d2d229082f1b9c
SSDEEP 6144:W1SIYG5PmGMfcqj+2ANjARx+F3NBCb2if52BIx/LcrPaQaUZNcC0fux:kSIYYqHu4+F3NkbF52BIJcrPbwU
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 d68386996081a9ab0250e03ae277b1f1cbb564701187b9ee6561e469d60cbceb
MD5 e03e961501e1a2ed40ac93a29074f140
SHA1 6e3a5c8e1863f6f3fcd1badddc6b07ff81bda178
SHA512 194286a4972a14701c78cd1ac307a5a892916be30508f8bed786433f4d51fc9bcaa6efeeed712cad39edb25fed49bf8b2d820f71e62f87f4d5cf6bbba541bdc4
SSDEEP 768:mQiE6esE8lDldUGz3UwgkQCuDQQ9jmRsA9wey5wv8hDK9wPLJJ4tVQQ9IY6gp:+eB85d73ekQsnawUhm9ELz43QPY6gp
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 033d95861b2f9e39f070976280078959d8f8c8b1aafbeef857169afca31ce899
MD5 01b7fb9e326267c37030243884a86a5a
SHA1 e16fb9898dd62ed1774beababf814f3b6627cf96
SHA512 22ffd08d19d130ab5b03a43e4336b32f6201fdad097f186d567fe2aeb1043bc9910c2afee0620c58ac438a3fefac274db184595183540d5c944ce31c1234f8e3
SSDEEP 768:GQiE6esE8lDldUGz3UwgkQCPhQ9jmRsA94LZfEN7DK9wPLJJ4tVQQ9IY6gp:eeB85d735QsD7m9ELz43QPY6gp
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 45KB
SHA256 6cfa5f75af6d4ab25e9ed2c50ea87303f604ec603c52dd6a8f44fecea273fe9f
MD5 62a6e468abe3c91cf34788a216b40fae
SHA1 efe17b31cc3678a4e54571c7c09fe5952a581281
SHA512 e62c868fdbd87d85de58894b6ee90406e726c682cd3464e00359c9dd3066471f3f59eb798aedbb260decd42c55f5e9a599db7e8fd67fe8292c86cf9b385d979d
SSDEEP 768:vQiE6esE8lDldUGH3/wgHQCaSQ9jmRsA94LZfENohWgECIY66iDK9wPLJJ4tVQQo:7eB85dv37QsD2WLY66im9ELz43Qr
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 45KB
SHA256 6a580e68e045f9ec87df379a765e22900c736b279ebf9e6a6f6365b61b145a99
MD5 e8ff4f3a7e89ca55797d2506167796e1
SHA1 1ad7f4998be5dceaa2bc5972547a83080ed28685
SHA512 25c3f5b6b05bf7de9ad25292f6421790cf57db4bedf2b7667311696f16a0570503386ad71ddf78182ca2ad19191d0d64e82b40b91162055a4b27c762c32484a0
SSDEEP 768:XF5BLv7I5wCPFdV6ZiM3/Cg6QC6SQ9jmRsA94LZfyNohWgECIY6ADK9wPLJJ4tVk:PJUV6Zz3KQs/2WLY6Am9ELz43Qx
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 44KB
SHA256 a5d112d5c560b2c09b10140a13cfaae29d97ce05b5ca9b2ca4e60602602d23e1
MD5 4355fe2452e784627fc78646b4128108
SHA1 afd2b7757febcf498571e45496fa64b9783d3f9a
SHA512 9714b81b446306e9de6e79d482dfdbe3611879798b67832d99730563058b0e3a8770e750520eff34ce45cd9844d109a17f378208474f4f273ad8d12e7c5f14de
SSDEEP 768:vQ5BLv7I5wCPFdV6Ziu3/wgHQCkSQ9jmRsA94LZfENohWgECIY6ADK9wPLJJ4tVk:qJUV6ZL3BQsN2WLY6Am9ELz43Qx
MD5 SHA1 SHA512 SSDEEP

Submit Download

ghbmnnjooekpmoecnnnilnnbdlolhkhi_1.23b8196b76670ffac8063a91542118344bda24d7b2fa4a4c0dd146c4ee6b31b9

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\ghbmnnjooekpmoecnnnilnnbdlolhkhi_1.23b8196b76670ffac8063a91542118344bda24d7b2fa4a4c0dd146c4ee6b31b9
Size 161KB
SHA256 23b8196b76670ffac8063a91542118344bda24d7b2fa4a4c0dd146c4ee6b31b9
MD5 d6a332ceaa785f20d7cf0ef7b9fc4790
SHA1 65f275d0b2d7b017fc8727298498dd43833d0940
SHA512 d79eba8bc96fe187f1284e7c3adf9323bd0525f73daba3e6f97013297588119256aa1af82ddccbdff5483b466f22b1846ee2f44afeb84fecd7f2c6951b7aa659
SSDEEP 3072:D0siC87t5FyUgTnPw2Aee5WZ/2gtjccLyD1FLrhHopoqxPVv+J09vXOj:3MTyJrP7xe8/RyDf/mpoGX9vXOj
MD5 SHA1 SHA512 SSDEEP

Submit Download

f8687686-7156-492b-91da-1f6a2d57a2f5.tmp

Path C:\Users\Admin\AppData\Local\Temp\f8687686-7156-492b-91da-1f6a2d57a2f5.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

31585ae0-4962-42c7-ade6-be6870de7e72.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4080_1153457722\31585ae0-4962-42c7-ade6-be6870de7e72.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5 SHA1 SHA512 SSDEEP

Submit Download

offscreendocument_main.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir912_933738940\CRX_INSTALL\offscreendocument_main.js
Size 123KB
SHA256 e65e611c9d970ae707210195a82f76e6e97cc1b8464dd60dcb472a51157b2a3f
MD5 b769f4b83039751170af58ef578b4b02
SHA1 e31590fd4a73c8dbf5f41f9f220ef27d072422fa
SHA512 6d0973929f74c913017d0b9c4b74d907502c2c9c954728e2c65bcecbfb83c9c76731e1a0e39bd369c72d2793c5b4cfb46a1ee56aa71a398ace9d34c5044f7121
SSDEEP 3072:L0QzhFvXKlO39/qz/j+lsnyL9HWlzI5eiw1vg7anfG2IUEV0OUIJP:Lbz/8O1Q/isoHXI5Fg7afpIUEV2U
MD5 SHA1 SHA512 SSDEEP

Submit Download

page_embed_script.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir912_933738940\CRX_INSTALL\page_embed_script.js
Size 720B
SHA256 e9e3d5641e332a6187ec501f9b72eccb1dc80cba32bdecc74d8d6da93d37a7a4
MD5 25d84d71970c7efc86a048f01359f1f8
SHA1 be28ec33f4302f3df31f6db845caf6aba212b5ee
SHA512 231903892f10e3779bcd1b0aeb3d63a93915bd0952608a30b23c186f877d07aa9a5bf772ebc564426382562f1a4e2d14eda9b412e311afcfe97f96aac6380f8b
MD5 SHA1 SHA512

Submit Download

service_worker_bin_prod.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir912_933738940\CRX_INSTALL\service_worker_bin_prod.js
Size 131KB
SHA256 76e5216d3ab5c409e1f3b8432d0f0b7bf1bace2d381e147061fcc9b2ea42f111
MD5 54530ad50f534cfd26764e0cc3380709
SHA1 4d0fe6fa0a232ccb204abcfa4175bc8e8319adce
SHA512 223947d8c04abe59b04271f22b2e9cdf90a154f8175774af13fe6f13d04427326f30da499694dac2d2c2102a1807d6e6a8c22a6ecfbd7dacf6ae60260426e51e
SSDEEP 3072:4FI5mTjiOy5r8jxVzPKYjLnn7r8nyqRNMRvAvdm/iEWFg9:4La5rmPeY/7Wy7vAvYipa9
MD5 SHA1 SHA512 SSDEEP

Submit Download

_ReCoVeRy_+xfxyq.html

Path C:\Users\_ReCoVeRy_+xfxyq.html
Size 12KB
SHA256 ed614636e6ab42e80b8f8b15704669ee741d49e5daf8dd35259f26cd969c21ef
MD5 cb8685c6a591cf554e9e87611b2fdde8
SHA1 bc50339c176147bb797904d07ab4c8c8486aeb7e
SHA512 6e3b254249767ad6e97fc8f875a9fbacfbd1f153006a7d8bcc3772b7aa5a18dae4b1a7e9fee49231d137286d205b8aef541aea01283bae867454241fbe2f092e
SSDEEP 96:B1NpqDl1ZVIek1xw+QEka7TtiWNuvSKSDojIYUJLfIiPEt8/4VP8IcOzKs:BJm1s1xt157pfOjuIig820/S
MD5 SHA1 SHA512 SSDEEP

Submit Download

_ReCoVeRy_+xfxyq.png

Path C:\Users\_ReCoVeRy_+xfxyq.png
Size 65KB
SHA256 9c931f64c1d4243008988672a762aa0d8abf0fcecb08e3ea0cc4303744d49965
MD5 fa66e81c16241094bc5e9871aa946ca3
SHA1 606b8f2f56fb533759868b3c10787dec9a101495
SHA512 0efd600928a2091f751f4406482578f46d397ea678902c213fb853a00d530e1b90d6dae81247be38a1d073d4be9e948b69f28dcd56a4159e519cf12901ee393b
SSDEEP 1536:rBgnVlfzJMC/hwLkeuyCm7hUn99bZVcqB4CWJISF:rBgVNJ//hwQTmFkLVmGGKq
MD5 SHA1 SHA512 SSDEEP

Submit Download

_ReCoVeRy_+xfxyq.txt

Path C:\Users\_ReCoVeRy_+xfxyq.txt
Size 1KB
SHA256 c57c1c6fd0205750044e4f86e5800cea91488f8e4000cad0f268d1da5232e97f
MD5 380edd78ca3540a8de8cf5ee1444741b
SHA1 51df0012732bfacaa9e12f7c21f45a41bf3cffe7
SHA512 d32bebb34ad61c3fc84bb1ca5f08aa6a9e7ac19851755e90655e9ed1793bd3e8f0a942aef8e0952bbaa57abbea7655cc415bd236f96c30e871b23d4ccb5a7657
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4080_1508717365\manifest.json
Size 135B
SHA256 ba5c9096d20a482aaa1aa9e5f98ad6127d3e97c2f21de84f7c78d9b8073c8e26
MD5 fbebd68ecaa98928909421f66909c054
SHA1 99d787d90f7ed2e5ad924f9c5668eb988b5a6c07
SHA512 749a3b2be47fe28399dc763888654a3e8d397e06e8d3c3af3965bb45846a1336e6ab4ca82c82c3df846b34a2afafa2156f2690e9bf347ab175408dc0171c61cc
MD5 SHA1 SHA512

Submit Download

vaunppwpxndk.exe

Path C:\Windows\vaunppwpxndk.exe
Size 252KB
SHA256 0fc361656387dc2de7d8e77eeb991e5ce1de799d10c9ce69fe82468ebf6c7c35
MD5 1c4529cb111c1ec7102999d0b989a268
SHA1 25665c6bdb47f9a421dee55c20b77bf89b225b50
SHA512 0b98fb7b41692ee7d938d82c6810258ea7d4952cd26b4ac36f3c9b954653e9e1c6f64c9fc1dd723e4e3ff7528ee8b3838dca587c7e899e4120f6c378edf71a85
SSDEEP 3072:sM8SYgJAvWsDL2ToQz75W7VgiLXOSrNrQwk8rDDAoSloh0JsmodFtzK20TRpAl:RJhipNrQqAsh0Jsmn2+XAl
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1648-6-0x0000000000EB1000-0x0000000000EB2000-memory.dmp

Download

memory/2528-12754-0x00000208B09A0000-0x00000208B19A0000-memory.dmp

Download

memory/5280-0-0x00000000006E1000-0x00000000006E2000-memory.dmp

Download