teslacrypt | bc68d520b6c682bbb9a601766f0487095033dbeaae87e3d9ce0f460c119a5ee2

Analysis

max time kernel
148s
max time network
145s
platform
windows11-21h2_x64
resource
win11-20251231-en
resource tags

arch:x64arch:x86image:win11-20251231-enlocale:en-usos:windows11-21h2-x64system
submitted
06/01/2026, 11:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-01-06_a0e62a985e26323a2e5deea581d29df2_amadey_darkgate_elex_smoke-loader_teslacrypt.exe
Size 632KB
Sample260106-nn8a5ayqgp
SHA256 bc68d520b6c682bbb9a601766f0487095033dbeaae87e3d9ce0f460c119a5ee2
MD5 a0e62a985e26323a2e5deea581d29df2
SHA1 acb8234b139c2a7c0824e99f7daa1895f3e94887
SHA512 63dfbd6ed06f53440d7f2df46a471bf9f1ad8e0a34e6945f2ea15ab13df3a83da032dd12765b4c29a2da363ff7c6e7bbf79c9640098c6088b50eb5d8177623f7
SSDEEP 3072:YP36YQgDABWbDFp7yz5dwjtYjt+XOCGNjYQMhLwZil6hdZrz5kbJnCgo5QTRpA:cZKjjtxVYQuwFhdZrz5UC5aXA
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

defense_evasion discovery execution teslacrypt impact persistence ransomware spyware stealer

Malware Config

Extracted

Path

C:\Program Files\7-Zip\Lang\_RECOVERY_+ucecm.txt

teslacrypt

Ransom Note

NOT YOUR LANGUAGE? USE https://translate.google.com What happened to your files ? All of your files were protected by a strong encryption with AES More information about the encryption keys using AES can be found here: http://en.wikipedia.org/wiki/AES How did this happen ? !!! Specially for your PC was generated personal AES KEY, both public and private. !!! ALL YOUR FILES were encrypted with the public key, which has been transferred to your computer via the Internet. !!! Decrypting of your files is only possible with the help of the private key and decrypt program , which is on our Secret Server What do I do ? So, there are two ways you can choose: wait for a miracle and get your price doubled, or start obtaining BITCOIN NOW! , and restore your data easy way. If You have really valuable data, you better not waste your time, because there is no other way to get your files, except make a payment. For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: 1. http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/7D3E3CC09FA0FFF5 2. http://tes543berda73i48fsdfsd.keratadze.at/7D3E3CC09FA0FFF5 3. http://tt54rfdjhb34rfbnknaerg.milerteddy.com/7D3E3CC09FA0FFF5 If for some reasons the addresses are not available, follow these steps: 1. Download and install tor-browser: http://www.torproject.org/projects/torbrowser.html.en 2. After a successful installation, run the browser 3. Type in the address bar: xlowfznrg4wf7dli.onion/7D3E3CC09FA0FFF5 4. Follow the instructions on the site. ---------------- IMPORTANT INFORMATION------------------------ *-*-* Your personal pages: http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/7D3E3CC09FA0FFF5 http://tes543berda73i48fsdfsd.keratadze.at/7D3E3CC09FA0FFF5 http://tt54rfdjhb34rfbnknaerg.milerteddy.com/7D3E3CC09FA0FFF5 *-*-* Your personal page Tor-Browser: xlowfznrg4wf7dli.ONION/7D3E3CC09FA0FFF5

URLs

http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/7D3E3CC09FA0FFF5
http://tes543berda73i48fsdfsd.keratadze.at/7D3E3CC09FA0FFF5
http://tt54rfdjhb34rfbnknaerg.milerteddy.com/7D3E3CC09FA0FFF5
http://xlowfznrg4wf7dli.ONION/7D3E3CC09FA0FFF5

Signatures

TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
ransomware teslacrypt
Teslacrypt family
teslacrypt
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047
Renames multiple (889) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops startup file 6 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\_RECOVERY_+ucecm.txt	bciafqfopqhn.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\_RECOVERY_+ucecm.html	bciafqfopqhn.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_RECOVERY_+ucecm.png	bciafqfopqhn.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_RECOVERY_+ucecm.txt	bciafqfopqhn.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_RECOVERY_+ucecm.html	bciafqfopqhn.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\_RECOVERY_+ucecm.png	bciafqfopqhn.exe

Executes dropped EXE 1 IoCs

pid	Process
4804	bciafqfopqhn.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3050491965-2933534114-1688612772-1000\Software\Microsoft\Windows\CurrentVersion\Run\ywefyxcoebga = "C:\\Windows\\system32\\cmd.exe /c start \"\" \"C:\\Windows\\bciafqfopqhn.exe\""	bciafqfopqhn.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\AppIcon.targetsize-30.png	bciafqfopqhn.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.21012.10511.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-24_altform-unplated.png	bciafqfopqhn.exe
File opened for modification	C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\react\node_modules\tslib\modules\_RECOVERY_+ucecm.html	bciafqfopqhn.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_1.0.36.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AlarmsStoreLogo.scale-100_contrast-black.png	bciafqfopqhn.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\Office Setup Controller\_RECOVERY_+ucecm.html	bciafqfopqhn.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\fy\LC_MESSAGES\_RECOVERY_+ucecm.png	bciafqfopqhn.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft SQL Server\130\_RECOVERY_+ucecm.html	bciafqfopqhn.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\Assets\AppPackageAppList.targetsize-80_altform-unplated.png	bciafqfopqhn.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_4.0.2.0_x64__8wekyb3d8bbwe\Assets\Icons\StickyNotesAppList.targetsize-32_altform-unplated.png	bciafqfopqhn.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_11.2104.2.0_x64__8wekyb3d8bbwe\Assets\SnipSketchAppList.targetsize-30_altform-unplated.png	bciafqfopqhn.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\contrast-black\HxMailAppList.scale-200.png	bciafqfopqhn.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.2103.1172.0_x64__8wekyb3d8bbwe\Assets\contrast-white\FeedbackHubSplashScreen.scale-200_altform-colorful.png	bciafqfopqhn.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.2103.1172.0_x64__8wekyb3d8bbwe\Assets\FeedbackHubAppList.targetsize-60_altform-lightunplated.png	bciafqfopqhn.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FPA_f14\_RECOVERY_+ucecm.png	bciafqfopqhn.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\QUAD\_RECOVERY_+ucecm.png	bciafqfopqhn.exe
File opened for modification	C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\_RECOVERY_+ucecm.html	bciafqfopqhn.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_2.2106.2807.0_x64__8wekyb3d8bbwe\Assets\Store\AppIcon.targetsize-48_altform-lightunplated.png	bciafqfopqhn.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppPackageLargeTile.scale-200_contrast-white.png	bciafqfopqhn.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.32731.0_x64__8wekyb3d8bbwe\Assets\contrast-black\SplashScreen.scale-200_contrast-black.png	bciafqfopqhn.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\contrast-white\HxCalendarWideTile.scale-150.png	bciafqfopqhn.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\BadgeLogo.scale-100.png	bciafqfopqhn.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\bg3.jpg	bciafqfopqhn.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSIPC\ms\_RECOVERY_+ucecm.html	bciafqfopqhn.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.2012.21.0_neutral_split.scale-100_8wekyb3d8bbwe\_RECOVERY_+ucecm.txt	bciafqfopqhn.exe
File opened for modification	C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\react\lib-amd\components\GroupedList\GroupHeader.styles.js	bciafqfopqhn.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\en-US\_RECOVERY_+ucecm.html	bciafqfopqhn.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\sr.pak	bciafqfopqhn.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\Resources\_RECOVERY_+ucecm.html	bciafqfopqhn.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Windows.Photos_21.21030.25003.0_neutral_split.scale-125_8wekyb3d8bbwe\microsoft.system.package.metadata\_RECOVERY_+ucecm.png	bciafqfopqhn.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\contrast-white\HxCalendarSplashLogo.scale-200.png	bciafqfopqhn.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_1.0.38.0_x64__8wekyb3d8bbwe\AppxMetadata\_RECOVERY_+ucecm.png	bciafqfopqhn.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_1.0.36.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\_RECOVERY_+ucecm.html	bciafqfopqhn.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\tr.pak	bciafqfopqhn.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_neutral_split.scale-100_8wekyb3d8bbwe\microsoft.system.package.metadata\_RECOVERY_+ucecm.png	bciafqfopqhn.exe
File opened for modification	C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\react\lib-commonjs\ResizeGroup.js	bciafqfopqhn.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.GamingApp_2105.900.24.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\Xbox_WideTile.scale-125_contrast-black.png	bciafqfopqhn.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\contrast-black\HxA-Advanced-Dark.scale-100.png	bciafqfopqhn.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\contrast-black\HxA-Yahoo-Light.scale-400.png	bciafqfopqhn.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.21012.10511.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-32_altform-unplated_contrast-white.png	bciafqfopqhn.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\_RECOVERY_+ucecm.html	bciafqfopqhn.exe
File opened for modification	C:\Program Files\Common Files\System\Ole DB\de-DE\_RECOVERY_+ucecm.png	bciafqfopqhn.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\Resources\1033\_RECOVERY_+ucecm.png	bciafqfopqhn.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\cmm\_RECOVERY_+ucecm.txt	bciafqfopqhn.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\deploy\_RECOVERY_+ucecm.html	bciafqfopqhn.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.YourPhone_0.19051.7.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppTiles\contrast-white\SplashScreen.scale-125_contrast-white.png	bciafqfopqhn.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_1.0.38.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.targetsize-64_altform-unplated.png	bciafqfopqhn.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\th_NEUTER.pak	bciafqfopqhn.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.scale-80.png	bciafqfopqhn.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.GamingApp_2105.900.24.0_x64__8wekyb3d8bbwe\AppxMetadata\_RECOVERY_+ucecm.html	bciafqfopqhn.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Paint_10.2104.17.0_x64__8wekyb3d8bbwe\Assets\contrast-white\PaintStoreLogo.scale-400.png	bciafqfopqhn.exe
File opened for modification	C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\theme\node_modules\@fluentui\dom-utilities\lib-commonjs\getVirtualParent.js	bciafqfopqhn.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ScreenSketch_11.2104.2.0_neutral_split.scale-125_8wekyb3d8bbwe\_RECOVERY_+ucecm.txt	bciafqfopqhn.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsStore_12104.1001.1.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppTiles\_RECOVERY_+ucecm.txt	bciafqfopqhn.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\_RECOVERY_+ucecm.txt	bciafqfopqhn.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_1.0.36.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.targetsize-256_altform-lightunplated.png	bciafqfopqhn.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\contrast-white\HxCalendarAppList.targetsize-30_altform-unplated.png	bciafqfopqhn.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.2103.1172.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-black\FeedbackHubAppList.scale-100.png	bciafqfopqhn.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_1.0.22.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\_RECOVERY_+ucecm.png	bciafqfopqhn.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FPA_f4\_RECOVERY_+ucecm.png	bciafqfopqhn.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\HxMailAppList.scale-100.png	bciafqfopqhn.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.MicrosoftOfficeHub_18.2104.12721.0_neutral_split.scale-125_8wekyb3d8bbwe\Images\Square310x310Logo.scale-125.png	bciafqfopqhn.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsNotepad_10.2102.13.0_x64__8wekyb3d8bbwe\Assets\NotepadAppList.targetsize-48_altform-lightunplated.png	bciafqfopqhn.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.21012.10511.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-32.png	bciafqfopqhn.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.contrast-black_scale-80.png	bciafqfopqhn.exe

Drops file in Windows directory 23 IoCs

description	ioc	Process
File created	C:\Windows\bciafqfopqhn.exe	2026-01-06_a0e62a985e26323a2e5deea581d29df2_amadey_darkgate_elex_smoke-loader_teslacrypt.exe
File opened for modification	C:\Windows\bciafqfopqhn.exe	2026-01-06_a0e62a985e26323a2e5deea581d29df2_amadey_darkgate_elex_smoke-loader_teslacrypt.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3760_1112301559\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3760_762568055\data.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3760_1224832809\passwords.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3760_1224832809\surnames.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3760_1224832809\us_tv_and_film.txt	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3760_568069753\content_new.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3760_568069753\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3760_1224832809\ranked_dicts	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3760_568069753\content.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3760_762568055\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3760_514350778\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3760_1224832809\female_names.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3760_1224832809\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3760_1224832809\model.markov	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3760_568069753\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3760_1112301559\arbitration_metadata.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3760_514350778\typosquatting_list.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3760_1224832809\english_wikipedia.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3760_1224832809\male_names.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3760_1224832809\test.txt	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-01-06_a0e62a985e26323a2e5deea581d29df2_amadey_darkgate_elex_smoke-loader_teslacrypt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bciafqfopqhn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NOTEPAD.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5032	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134122244406711953"	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3050491965-2933534114-1688612772-1000_Classes\Local Settings	bciafqfopqhn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3050491965-2933534114-1688612772-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3050491965-2933534114-1688612772-1000\{F36D5B3C-35AC-4C4E-950A-32160A8BA57B}	msedge.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
1468	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4804	bciafqfopqhn.exe
4804	bciafqfopqhn.exe
4804	bciafqfopqhn.exe
4804	bciafqfopqhn.exe
4804	bciafqfopqhn.exe
4804	bciafqfopqhn.exe
4804	bciafqfopqhn.exe
4804	bciafqfopqhn.exe
4804	bciafqfopqhn.exe
4804	bciafqfopqhn.exe
4804	bciafqfopqhn.exe
4804	bciafqfopqhn.exe
4804	bciafqfopqhn.exe
4804	bciafqfopqhn.exe
4804	bciafqfopqhn.exe
4804	bciafqfopqhn.exe
4804	bciafqfopqhn.exe
4804	bciafqfopqhn.exe
4804	bciafqfopqhn.exe
4804	bciafqfopqhn.exe
4804	bciafqfopqhn.exe
4804	bciafqfopqhn.exe
4804	bciafqfopqhn.exe
4804	bciafqfopqhn.exe
4804	bciafqfopqhn.exe
4804	bciafqfopqhn.exe
4804	bciafqfopqhn.exe
4804	bciafqfopqhn.exe
4804	bciafqfopqhn.exe
4804	bciafqfopqhn.exe
4804	bciafqfopqhn.exe
4804	bciafqfopqhn.exe
4804	bciafqfopqhn.exe
4804	bciafqfopqhn.exe
4804	bciafqfopqhn.exe
4804	bciafqfopqhn.exe
4804	bciafqfopqhn.exe
4804	bciafqfopqhn.exe
4804	bciafqfopqhn.exe
4804	bciafqfopqhn.exe
4804	bciafqfopqhn.exe
4804	bciafqfopqhn.exe
4804	bciafqfopqhn.exe
4804	bciafqfopqhn.exe
4804	bciafqfopqhn.exe
4804	bciafqfopqhn.exe
4804	bciafqfopqhn.exe
4804	bciafqfopqhn.exe
4804	bciafqfopqhn.exe
4804	bciafqfopqhn.exe
4804	bciafqfopqhn.exe
4804	bciafqfopqhn.exe
4804	bciafqfopqhn.exe
4804	bciafqfopqhn.exe
4804	bciafqfopqhn.exe
4804	bciafqfopqhn.exe
4804	bciafqfopqhn.exe
4804	bciafqfopqhn.exe
4804	bciafqfopqhn.exe
4804	bciafqfopqhn.exe
4804	bciafqfopqhn.exe
4804	bciafqfopqhn.exe
4804	bciafqfopqhn.exe
4804	bciafqfopqhn.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4700	2026-01-06_a0e62a985e26323a2e5deea581d29df2_amadey_darkgate_elex_smoke-loader_teslacrypt.exe
Token: SeDebugPrivilege	4804	bciafqfopqhn.exe
Token: SeIncreaseQuotaPrivilege	4852	WMIC.exe
Token: SeSecurityPrivilege	4852	WMIC.exe
Token: SeTakeOwnershipPrivilege	4852	WMIC.exe
Token: SeLoadDriverPrivilege	4852	WMIC.exe
Token: SeSystemProfilePrivilege	4852	WMIC.exe
Token: SeSystemtimePrivilege	4852	WMIC.exe
Token: SeProfSingleProcessPrivilege	4852	WMIC.exe
Token: SeIncBasePriorityPrivilege	4852	WMIC.exe
Token: SeCreatePagefilePrivilege	4852	WMIC.exe
Token: SeBackupPrivilege	4852	WMIC.exe
Token: SeRestorePrivilege	4852	WMIC.exe
Token: SeShutdownPrivilege	4852	WMIC.exe
Token: SeDebugPrivilege	4852	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4852	WMIC.exe
Token: SeRemoteShutdownPrivilege	4852	WMIC.exe
Token: SeUndockPrivilege	4852	WMIC.exe
Token: SeManageVolumePrivilege	4852	WMIC.exe
Token: 33	4852	WMIC.exe
Token: 34	4852	WMIC.exe
Token: 35	4852	WMIC.exe
Token: 36	4852	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4852	WMIC.exe
Token: SeSecurityPrivilege	4852	WMIC.exe
Token: SeTakeOwnershipPrivilege	4852	WMIC.exe
Token: SeLoadDriverPrivilege	4852	WMIC.exe
Token: SeSystemProfilePrivilege	4852	WMIC.exe
Token: SeSystemtimePrivilege	4852	WMIC.exe
Token: SeProfSingleProcessPrivilege	4852	WMIC.exe
Token: SeIncBasePriorityPrivilege	4852	WMIC.exe
Token: SeCreatePagefilePrivilege	4852	WMIC.exe
Token: SeBackupPrivilege	4852	WMIC.exe
Token: SeRestorePrivilege	4852	WMIC.exe
Token: SeShutdownPrivilege	4852	WMIC.exe
Token: SeDebugPrivilege	4852	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4852	WMIC.exe
Token: SeRemoteShutdownPrivilege	4852	WMIC.exe
Token: SeUndockPrivilege	4852	WMIC.exe
Token: SeManageVolumePrivilege	4852	WMIC.exe
Token: 33	4852	WMIC.exe
Token: 34	4852	WMIC.exe
Token: 35	4852	WMIC.exe
Token: 36	4852	WMIC.exe
Token: SeBackupPrivilege	5524	vssvc.exe
Token: SeRestorePrivilege	5524	vssvc.exe
Token: SeAuditPrivilege	5524	vssvc.exe
Token: SeIncreaseQuotaPrivilege	2664	WMIC.exe
Token: SeSecurityPrivilege	2664	WMIC.exe
Token: SeTakeOwnershipPrivilege	2664	WMIC.exe
Token: SeLoadDriverPrivilege	2664	WMIC.exe
Token: SeSystemProfilePrivilege	2664	WMIC.exe
Token: SeSystemtimePrivilege	2664	WMIC.exe
Token: SeProfSingleProcessPrivilege	2664	WMIC.exe
Token: SeIncBasePriorityPrivilege	2664	WMIC.exe
Token: SeCreatePagefilePrivilege	2664	WMIC.exe
Token: SeBackupPrivilege	2664	WMIC.exe
Token: SeRestorePrivilege	2664	WMIC.exe
Token: SeShutdownPrivilege	2664	WMIC.exe
Token: SeDebugPrivilege	2664	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2664	WMIC.exe
Token: SeRemoteShutdownPrivilege	2664	WMIC.exe
Token: SeUndockPrivilege	2664	WMIC.exe
Token: SeManageVolumePrivilege	2664	WMIC.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3760	msedge.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 4700 wrote to memory of 4804	4700	2026-01-06_a0e62a985e26323a2e5deea581d29df2_amadey_darkgate_elex_smoke-loader_teslacrypt.exe	77
PID 4700 wrote to memory of 2008	4700	2026-01-06_a0e62a985e26323a2e5deea581d29df2_amadey_darkgate_elex_smoke-loader_teslacrypt.exe	78
PID 4804 wrote to memory of 4852	4804	bciafqfopqhn.exe	80
PID 4804 wrote to memory of 1468	4804	bciafqfopqhn.exe	87
PID 4804 wrote to memory of 3760	4804	bciafqfopqhn.exe	88
PID 4804 wrote to memory of 2664	4804	bciafqfopqhn.exe	89
PID 3760 wrote to memory of 404	3760	msedge.exe	91
PID 3760 wrote to memory of 5032	3760	msedge.exe	93
PID 3760 wrote to memory of 5036	3760	msedge.exe	94
PID 3760 wrote to memory of 5036	3760	msedge.exe	94
PID 3760 wrote to memory of 5036	3760	msedge.exe	94
PID 3760 wrote to memory of 2488	3760	msedge.exe	95
PID 3760 wrote to memory of 2488	3760	msedge.exe	95
PID 3760 wrote to memory of 5484	3760	msedge.exe	98
PID 3760 wrote to memory of 5596	3760	msedge.exe	97
PID 3760 wrote to memory of 5484	3760	msedge.exe	98
PID 3760 wrote to memory of 5484	3760	msedge.exe	98
PID 3760 wrote to memory of 5596	3760	msedge.exe	97
PID 3760 wrote to memory of 5596	3760	msedge.exe	97
PID 3760 wrote to memory of 3472	3760	msedge.exe	99
PID 3760 wrote to memory of 2044	3760	msedge.exe	100
PID 3760 wrote to memory of 3472	3760	msedge.exe	99
PID 3760 wrote to memory of 2044	3760	msedge.exe	100
PID 3760 wrote to memory of 3188	3760	msedge.exe	101
PID 3760 wrote to memory of 2656	3760	msedge.exe	103
PID 3188 wrote to memory of 3612	3188	msedge.exe	104
PID 3760 wrote to memory of 568	3760	msedge.exe	107
PID 3760 wrote to memory of 568	3760	msedge.exe	107
PID 4804 wrote to memory of 6088	4804	bciafqfopqhn.exe	108
PID 3760 wrote to memory of 4172	3760	msedge.exe	110
PID 3760 wrote to memory of 2832	3760	msedge.exe	111
PID 3760 wrote to memory of 2028	3760	msedge.exe	112
PID 3760 wrote to memory of 2780	3760	msedge.exe	113
PID 3760 wrote to memory of 2780	3760	msedge.exe	113
PID 3760 wrote to memory of 896	3760	msedge.exe	115
PID 3760 wrote to memory of 896	3760	msedge.exe	115
PID 3760 wrote to memory of 5972	3760	msedge.exe	116
PID 3760 wrote to memory of 5972	3760	msedge.exe	116
PID 3760 wrote to memory of 1844	3760	msedge.exe	117
PID 3760 wrote to memory of 1844	3760	msedge.exe	117
PID 3760 wrote to memory of 2888	3760	msedge.exe	118
PID 3760 wrote to memory of 2888	3760	msedge.exe	118

System policy modification 1 TTPs 2 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	bciafqfopqhn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1"	bciafqfopqhn.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-01-06_a0e62a985e26323a2e5deea581d29df2_amadey_darkgate_elex_smoke-loader_teslacrypt.exe
"C:\Users\Admin\AppData\Local\Temp\2026-01-06_a0e62a985e26323a2e5deea581d29df2_amadey_darkgate_elex_smoke-loader_teslacrypt.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4700
- C:\Windows\bciafqfopqhn.exe
  C:\Windows\bciafqfopqhn.exe
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:4804
- - C:\Windows\System32\wbem\WMIC.exe
    "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /nointeractive
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4852
- - C:\Windows\SysWOW64\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\RECOVERY.TXT
    3⤵
    - System Location Discovery: System Language Discovery
    - Opens file in notepad (likely ransom note)
    PID:1468
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\RECOVERY.HTM
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3760
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x368,0x7ffbf352c188,0x7ffbf352c194,0x7ffbf352c1a0
      4⤵
      PID:404
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1760,i,2720738120650491764,5067078985426393919,524288 --field-trial-handle=2156,i,15337437502420227882,14816738947055797227,262144 --variations-seed-version --mojo-platform-channel-handle=2200 /prefetch:11
      4⤵
      System Time Discovery
      PID:5032
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1632,i,8549312038403345198,439511216668620740,262144 --field-trial-handle=2156,i,15337437502420227882,14816738947055797227,262144 --variations-seed-version --mojo-platform-channel-handle=2152 /prefetch:2
      4⤵
      PID:5036
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2560,i,2755131126559705642,17763716743830019590,524288 --field-trial-handle=2156,i,15337437502420227882,14816738947055797227,262144 --variations-seed-version --mojo-platform-channel-handle=2744 /prefetch:13
      4⤵
      PID:2488
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3452,i,5768862019045124924,15701963043653896604,2097152 --field-trial-handle=2156,i,15337437502420227882,14816738947055797227,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
      4⤵
      PID:5596
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3456,i,11967531074006765752,4226366709142051192,2097152 --field-trial-handle=2156,i,15337437502420227882,14816738947055797227,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
      4⤵
      PID:5484
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4884,i,13242617124312812694,10887321680102583449,524288 --field-trial-handle=2156,i,15337437502420227882,14816738947055797227,262144 --variations-seed-version --mojo-platform-channel-handle=4948 /prefetch:14
      4⤵
      PID:3472
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4888,i,9447555731584786175,8152130507848718653,524288 --field-trial-handle=2156,i,15337437502420227882,14816738947055797227,262144 --variations-seed-version --mojo-platform-channel-handle=5008 /prefetch:14
      4⤵
      PID:2044
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5780,i,15095674586232372045,6544106511564128688,524288 --field-trial-handle=2156,i,15337437502420227882,14816738947055797227,262144 --variations-seed-version --mojo-platform-channel-handle=5784 /prefetch:14
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3188
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=1128
        5⤵
        
        PID:3612
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5828,i,1246754351663334527,5388291075819402844,524288 --field-trial-handle=2156,i,15337437502420227882,14816738947055797227,262144 --variations-seed-version --mojo-platform-channel-handle=5844 /prefetch:14
      4⤵
      PID:4296
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5828,i,1246754351663334527,5388291075819402844,524288 --field-trial-handle=2156,i,15337437502420227882,14816738947055797227,262144 --variations-seed-version --mojo-platform-channel-handle=5844 /prefetch:14
      4⤵
      PID:2656
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5828,i,8389307102812163769,14129190164876204723,524288 --field-trial-handle=2156,i,15337437502420227882,14816738947055797227,262144 --variations-seed-version --mojo-platform-channel-handle=6316 /prefetch:14
      4⤵
      PID:568
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6412,i,7857585237819632293,11966427729180908977,524288 --field-trial-handle=2156,i,15337437502420227882,14816738947055797227,262144 --variations-seed-version --mojo-platform-channel-handle=6424 /prefetch:14
      4⤵
      PID:4172
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6400,i,3545746609097462607,9595438640753739454,524288 --field-trial-handle=2156,i,15337437502420227882,14816738947055797227,262144 --variations-seed-version --mojo-platform-channel-handle=6372 /prefetch:14
      4⤵
      PID:2832
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6384,i,6960298425182444326,5479947129411443325,524288 --field-trial-handle=2156,i,15337437502420227882,14816738947055797227,262144 --variations-seed-version --mojo-platform-channel-handle=6480 /prefetch:14
      4⤵
      PID:2028
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5280,i,14024403680315515044,4177186828881913077,524288 --field-trial-handle=2156,i,15337437502420227882,14816738947055797227,262144 --variations-seed-version --mojo-platform-channel-handle=5056 /prefetch:14
      4⤵
      PID:2780
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5040,i,6920311534243973797,3492710613570551865,524288 --field-trial-handle=2156,i,15337437502420227882,14816738947055797227,262144 --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:14
      4⤵
      PID:896
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5124,i,738364552258083122,12605971316897881888,524288 --field-trial-handle=2156,i,15337437502420227882,14816738947055797227,262144 --variations-seed-version --mojo-platform-channel-handle=2416 /prefetch:14
      4⤵
      PID:5972
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5028,i,2036009131310032550,15541011323778639061,524288 --field-trial-handle=2156,i,15337437502420227882,14816738947055797227,262144 --variations-seed-version --mojo-platform-channel-handle=5012 /prefetch:14
      4⤵
      PID:1844
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5048,i,12062232673093752297,16520040189897233903,524288 --field-trial-handle=2156,i,15337437502420227882,14816738947055797227,262144 --variations-seed-version --mojo-platform-channel-handle=5020 /prefetch:14
      4⤵
      PID:2888
- - C:\Windows\System32\wbem\WMIC.exe
    "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /nointeractive
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2664
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c DEL C:\Windows\BCIAFQ~1.EXE
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6088
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2008

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5524

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2796

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

_RECOVERY_+ucecm.html

Path C:\Program Files\7-Zip\Lang\_RECOVERY_+ucecm.html
Size 11KB
SHA256 8fa7f0e67b85daf82dc627f80e992fb6fb10655bf4c9fbf57aae76f24c68d802
MD5 43b52c2b455b0c58a15e9d33cef7c2c4
SHA1 86d09f39952a86602fdb461b7df13c861a4d232f
SHA512 99f9dde8a3defc3219e327c64552c3b2ccfb678113330d9503600c1258701696c0b5ee5dcbfd622aeeab70dc5c96245d3d216173f6715583441ba131e94f440a
SSDEEP 96:B1N1Dl1Z+uGpGFoAqLNq4LRi6pcSPwmjjC9ExCNEfC/EIC2Cp5CWsCGCPcCzC3C4:Bzenw2N3TxwZEiECEBtJkUkN
MD5 SHA1 SHA512 SSDEEP

Submit Download

_RECOVERY_+ucecm.png

Path C:\Program Files\7-Zip\Lang\_RECOVERY_+ucecm.png
Size 62KB
SHA256 da3dbea98805de0e1f16610cf05ee97ef3fdff817fa450edf9dc63e8cb9344bc
MD5 e5eb40833ac1a3a9f94803e26271b719
SHA1 f3a2e516dfebb9e7b9577f5684a13902323822bc
SHA512 34b10c7c88afeafd1433bc828a4fb12b952634131a2ef5e7541395b8d2e7d97f0cdf041a9ea4aab7c3379bfc74ce58d86e20bc56834b146c3bab41b45e75b781
SSDEEP 1536:ejwEQbiDv/QYIM224qUskbj45UPlWyMvx+X:xb+/QVRsB+91qxS
MD5 SHA1 SHA512 SSDEEP

Submit Download

_RECOVERY_+ucecm.txt

Path C:\Program Files\7-Zip\Lang\_RECOVERY_+ucecm.txt
Size 1KB
SHA256 f2bb9f3ac7e70947e629ac5ecaa908f80cac625cea225608b21f3bb844343546
MD5 4938b1032dd00102560a3443ac20f8d2
SHA1 979d9226444dc8948e23ac2e06fa419c471bcae6
SHA512 7cbef53dffa1e5c323680bee6cf5b0c5dd1412f61427bbcc13e495796b938e5b29128a7af8d88d8bc79bf4477d3e3a477dc7da945b7f89023b05ac26d379cd6b
MD5 SHA1 SHA512

Submit Download

THIRDPARTYLICENSEREADME-JAVAFX.txt

Path C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt
Size 560B
SHA256 1ac914956ac0ced09a4ecb3943cd817fba4be930b9dd120d51c6bb8d649525c0
MD5 b84150adf5d1e89f0da786c82533deb2
SHA1 31e21bcd6b0a079ce3585a1896e1eb824450d31a
SHA512 21c5601dbf2ab27119030a11cb016e610c4afd985fb31f5955bb8026765baedd79b84c330e1814bb2623861ddcb6bec57844e613587b05115aa90a0105f12674
MD5 SHA1 SHA512

Submit Download

THIRDPARTYLICENSEREADME.txt

Path C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt
Size 560B
SHA256 90804f9ecd2f5fecf58472783f19d7d61ce3badd7b9b0d58fde13d400863ec24
MD5 5dcdec364370d4423783bdd061b78183
SHA1 a241105a70d66e38931c7c6b398603ea59c52a64
SHA512 ff91bd52ce99b0c9c62c087aa82eb38c98425ccf3f6c6cc6326c0d07c815b2e54603321e1f9c0004db622f621db7ada99ccda5b0b979461cdbc779cff804ad15
MD5 SHA1 SHA512

Submit Download

ClientSub2019_eula.txt

Path C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub2019_eula.txt
Size 416B
SHA256 769477cdfc1bd581ae74bc5dffec66a702112f7b8902aba403260c3bffcbea55
MD5 a6bf46e107d5b69d9e660f4f105100a8
SHA1 3a9db34bcc1f929e4251521d54601092812db8d2
SHA512 30b8777fd116cce733e6891dd7ef02a3fdea1aec9fb49c391c3d0eed9f42adb4009d1e77610998f154f47beaffd01b9205097e16908c70b1ed048fb7e90449f5
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a3d8be9c5843468212f844553829d2f0d692733cd3f258db161f13f295f2f64c
MD5 ca3c84bf6a9cde515eafc7f686b9c6f6
SHA1 e15532ff9afefddb9183c0d44b94ce3cf3e084c3
SHA512 d5e3335a36a2adff73058c4596debd04be4a75bdd66d6cfe7582fceb19b32e8079181d96b71dc317bf97536d472f7539935c4a017686da3009fd8474a229c304
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ad2841f3f4e3da42f05537d8fd8e27cf35b0c2820f1e64d9022e4476aa427631
MD5 eaa6bd436a36dc592476caefacc160a0
SHA1 b6a51d3b7f3a5f8769eb8e7a68f1fe5513038e83
SHA512 c62eeb80dba3f4c8e99c9b9340d530147e60fc8bbdea1ba57ed7e187108ffa61135a68705cbff2cba6e110bf5bcfa3ef6c124fb7e9fc36d81dc41dd0e91c7924
MD5 SHA1 SHA512

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 9cea72381df33fea51e8242b09d50ead72ca6c207a35182ceab4efe158691332
MD5 c6910d7895ad4550da407289ed3b6ae6
SHA1 7d5b966adc4908c70423610815036d48ee5226dd
SHA512 d817044235274b14892e7504e7c7b14bea2899b95fd628522e57a3fdb7c4395af2c866ea23e5c51da629533cb065fa8089da27a0bb61e78d53aad0fc72175142
MD5 SHA1 SHA512

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 108KB
SHA256 84ab2d00a9c76d63c3edf4fd0139236f6b94e49bd7889e4f5f63f19941bc1ed1
MD5 902622d177776fafc9f85d74f2ab73b8
SHA1 deb767db94129ecffdcd2ff94970687033409107
SHA512 d219535bf4fd4b1561c34b2e0c9f3938de8a86a85aba4d19f31b413483d01cb6afe611077620907839f4340475f1468c2097318751aeef4a61c64a75751aea2e
SSDEEP 1536:IdcH74ohBGZqW3iPPDuVvpBI/S8tZsA62UYPq:vHSRiPjU1
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 6b1bfffdea5d522ed618b293bfc3482c6d15f4a21a31275e1068a734b6a4b120
MD5 2f1aba2213ac28aaf20e6e7d791fcdcd
SHA1 7f7fbe2ffe5f3920ea6c6ad51145c85e1557a3eb
SHA512 1ad932770bfa6d76d42336f845c9435410d2d210d51e14d5b14d9e0145762644f7de70a708f0e71e9d24a7613ed6803403a0583171356ef70f3ba897d0e0fc43
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 55d5bac868ec0b9b812ff96f55b00e2a6579ec3bbba878c7731e494cf7945f47
MD5 dcae55e5b7dacfe2d6513d3c49a720f4
SHA1 0f81b29fd676017f7b9081dee08ec6ec88f37bea
SHA512 4e02dcd399928f189be1359089ec1fc84f41925574c075ea4b295fbd2a33176b412e2c678a12b02203624c32e6bde1c8417ff6a0e46774d03726d6bd25cbb199
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 0e4f151abfa57a4018e747525e6b505c9bd5f5fdafdfc6b3dcd23f359fb637ce
MD5 4da2689d4c8f77184fdb61124b785e2a
SHA1 8ac5d0c7e1184a4ae285f08bf4d9c4ea0149eae1
SHA512 a69e70f634a7c4f0e96dbce3399fd0b33586fe29f047cdde0c5f18a92abf70a7de73eb645787728c25f302e40a2c2b67253a28ebcbe4598546ed1f1cfb004798
SSDEEP 192:sxZwRIyMqZ/K1Ml8s9U/fusYfUOevSegiiEzzodpEn/W6+WNGY0etuzvPIgjWJ:sxZw11U/fusKUcQw+/bG564Hji
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 37KB
SHA256 a2a24d859cdced64ab29a1437ffd788337b0e2c277561f7173616932dfb99ee5
MD5 a462432a206c836d5a3c56d97b0e9015
SHA1 c15c965d7bec9fc8cabea30caa05cd4ad4de9f5d
SHA512 a4d556db2d8039f081caf1923b4580d6ac0003dbbf5465a11ae31fa7b99ea738b844e6631d79fb97f2e2cbb2d50ef39cb0881db793bc41c8b50c7479ae2434ae
SSDEEP 768:BiqWm8Ae2ye7pLuLUtpWRmtHQKv8F1+UoAYDCx9Tuqh0VfUC9xbog/OV30kscLlr:BiqWm8Ae2yeEUtpWRmtHQKvu1jaK0ksg
MD5 SHA1 SHA512 SSDEEP

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 24KB
SHA256 58de3cc05c459ecbb47dbad4e8387a0f5f089b87588674df1d205e9f4e2ee60d
MD5 8f4dec6b044f1e89cf9a929ec8015122
SHA1 bc365f618881fe3a049f11f04e550c2d893aa917
SHA512 435a3f84bf060c274320a5e60f4633859c8eca407bee68e5578d68761aba0e3ee64148f806da1902e46e5c2fbd367311624ad64c8a39c719443f406d9a3ce5a8
SSDEEP 192:R0pimk2Ktifm+8+XorM0HyakWu/UQukEDwl0I6oXuNme9IkcxKuseCl6n+mUmXAW:UbR3xHuN8LslxNN6fZ9n
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\EADPData Component\4.0.3.22\data.txt
Size 141KB
SHA256 70ad51bc46a17ccd1d5fbea9533d803734e0bc24dcfd2960ffc8d74f6b80d052
MD5 29834a02896906d4a7b8263eded8983b
SHA1 d908a7685fdeae9f3bc3a5e3e13e94c4ecc41569
SHA512 7a1c913db010df0bc36dfd479232c3f5c6117c5dad8b21056a3743b59bb52e47bd969f48792ba712e7cf2700a03ae4ecb92d35083c1a7742977f75cab22edc01
SSDEEP 3072:p4byvwQpaFzpRKXu9XmkfFTVZKuuGiNIPf9dzwZ5:abyvw8aF9ou93rZKuuNNKw5
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.txt.mp3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\EADPData Component\4.0.3.22\data.txt.mp3
Size 141KB
SHA256 c102f5c34a7dcc7edf2bff55fb3a18e5aff8d78925673cce82dce2d829fbe327
MD5 8279a87d6c6e1d70c14649ab5b8c2bdc
SHA1 83a556dbc01007041835f905aff670047da30fc3
SHA512 15cecbc4d42d18977ff88b1051a28b3f680e336b6e85250edcef5c66cde9d8902f43ece8c34c5413db0941cd521b780b776b73a432856c5e36a4ac92a930f68f
SSDEEP 3072:6/+EKk17K/68rYBZyXg4me6pQtRdU6WMVYN79a8wA0u2:6KI7uNM3yX9/6etRCNMVQ79aHu2
MD5 SHA1 SHA512 SSDEEP

Submit Download

arbitration_metadata.txt.mp3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Notifications\0.0.0.46\arbitration_metadata.txt.mp3
Size 344KB
SHA256 bf1340faca0cb6c2f9b9ad977edf37e6334df04d2480b50ccf55d078536f9f3b
MD5 d6e632240fd6f0b02bae61fce40f0e81
SHA1 c341cfe324d80ef3687a07c269b31fee73ee04e8
SHA512 1ce843d278071cc4a751105c322fc9e50b38c8f44c844251a9c9f379fc8a27a1b9863d0d4a779fee30c5ad2deeb458693bccaf8bf3d774bcc85fe21c84a40fd9
SSDEEP 6144:tkJo3KfuTBvTUrunxsiQehPAsSQtgaz5bbiD2gxc2x+w7+KMSMSG/sj+iIU:tM0JTNnse9tDo+i5MSMS8sj+k
MD5 SHA1 SHA512 SSDEEP

Submit Download

auto_open_controller.js.mp3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\2.1.91.0\auto_open_controller.js.mp3
Size 1.2MB
SHA256 e1bf00a0d9a0ea540828c8f100a3890096b8af70686bfae8503a773ca2c31f83
MD5 76e01892d2f2bb952f1b8f646d623936
SHA1 89d309645709a0aa8894d56bf4610510ce1c9887
SHA512 ce98dc488ef671e8da47a44982a249c6eea296272cc2a4fbaed38027d1476deb37ee51707308328d30056f4737286837da31c795d160646966e3ae4fe63c29e9
SSDEEP 24576:Remmrq80cMSl9i6fNNTryh0Z09DGSJkwKNgHpSAqkiS1n:/o0cD1/Tju9CSFKuIA+W
MD5 SHA1 SHA512 SSDEEP

Submit Download

edge_checkout_page_validator.js.mp3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\2.1.91.0\edge_checkout_page_validator.js.mp3
Size 983KB
SHA256 db6b9b57d348f0a39e179e3a62c395058f100fba3e74f4f56b05e92ca755e70c
MD5 a4aad40016a28a974d88fd83defe1f74
SHA1 452b24f20ce99be56d6f5ec0185cf0c6d243777b
SHA512 67ab34d986eb9981771819f6a11b2bfa61b1d54a7641d259507980c8e58ee88d2acb83db2600938d7c335a9b79a9dadfbce75a22384e0a0f7e097ab477247cf6
SSDEEP 24576:vllXclHIb8KFezT1x9fEwIEn5wyc3SOd8yx3M:v30052T79fzIS+ykDM
MD5 SHA1 SHA512 SSDEEP

Submit Download

edge_confirmation_page_validator.js.mp3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\2.1.91.0\edge_confirmation_page_validator.js.mp3
Size 983KB
SHA256 b912bb88f8b87b3a3d144e56e4d9fe4ac46ad19969bc878724665ed5c6cf517f
MD5 a0feffc5dd53d24ef79a05bdc7226274
SHA1 fc11a1a6759953b2d5efd3f33a91321914f00be9
SHA512 13ab1ac65cad995a0409d4271fcd9f6864ab86d597fd30198c12d2c107698a8e6a6b0cee64ffb7f2d1ad701797f1c1bcd0935d442496fa35acc89f3a4f5d9ca6
SSDEEP 24576:1llXclHIb8KFezT1x9fEwIEn5wyc3SOd8yx3W:130052T79fzIS+ykDW
MD5 SHA1 SHA512 SSDEEP

Submit Download

edge_driver.js.mp3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\2.1.91.0\edge_driver.js.mp3
Size 1.0MB
SHA256 ba268afcfabe885891aed312f2af64af17ddb413271186883b4aa0d396c5a979
MD5 7cdb666564f776bb2353a46876f17122
SHA1 a1e46648ba4cf1211de5ae4073846c84bd0e122b
SHA512 0141ab99dd12a25c578a5d4952cc5bc026fa4bc34bec284cd9b6f636b47b5458870647b335ccdc9eb03837f37fc53d074e2484ce6d2ccc39eb25e56e2288af85
SSDEEP 12288:Zv1DLpYo166BnzwIXtxo4Eah7R1wpHFQtIuFDb87z/ol5rD7sy83o1n9DZqT/b43:rDN/s6mII22pwIObmmP7t/ZmT4RgC
MD5 SHA1 SHA512 SSDEEP

Submit Download

edge_tracking_page_validator.js.mp3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\2.1.91.0\edge_tracking_page_validator.js.mp3
Size 62KB
SHA256 dc81f2fdbece79a1e807f9ad1f0005a9a11971da93494ee0b51fb4d17c439965
MD5 9571f7cebb02cb8ec626de6470fcb814
SHA1 93b524924551e7cabb9ff061acd60eaa9c241b6f
SHA512 e739038d9ba196a9053a91c1aff7e47fde12070ad8ca2c036f96568714802643808f2fbb674664f5f27417646deeade6b795405f1540399dd0d8b2e8eaf15ebe
SSDEEP 1536:1BAt5oo9i2kZbFB5Cd4AG+stchgaIQKMaUHJbyo20O0AaC0:4Z9i2kjBcdAmhHmM1JbyH/0
MD5 SHA1 SHA512 SSDEEP

Submit Download

product_page.js.mp3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\2.1.91.0\product_page.js.mp3
Size 988KB
SHA256 6085819fdb55a8f36abf39f98f3e02c6c65d0641d9d03ae824cafcb780af88df
MD5 01b7eaaffd9c7ff4c532637fd2ea1c44
SHA1 daf9d43b9df6fbea49f7c4b184940b78040dda5e
SHA512 b4cab7b1b0c7384ff53769c77635809930de6a8c759b7289f3649d703fbec61fe81fc93231acb566c4b5e6c21ab13997518071c71725108af9673fec326437cf
SSDEEP 24576:4FV6mEgJqufCaoznX4uJRS9StZ7m3kIDrLI:4FNEgJ8amXnGStU3FjI
MD5 SHA1 SHA512 SSDEEP

Submit Download

shopping_iframe_driver.js.mp3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\2.1.91.0\shopping_iframe_driver.js.mp3
Size 22KB
SHA256 28397957132f64e67ce74e1c5d29f048720faba6e69aec80fce9594c08797852
MD5 2bc890f2d85d42e3cdc7e18b285c6c20
SHA1 19dd8bb75441315eeb47cdc9cb8388d7aba6daa3
SHA512 6d8e872bf2dac962acd7d484fbf75c6488ff612bf258bb7ea2a22f90535ca09c0b34b2aef0a3af2e9c6e1d4a08d60ef66663102e530c9c120c81fd0f222db70e
SSDEEP 384:1tYi43kxwHLX+bnofAJZ9MeNRPmQR/FseFocQrzE32225RYYmfkp4TMcq7:glkxwyrr3vRuQRricQrno/u4Xq7
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 3061148e89323d0a6fb071b0774a458fd0d9278f52280b84cd0a71482c0f8d28
MD5 5e04f955b4ebf5dbd3f7b36b0e117e10
SHA1 4d9e430e22607d19046d4eb511072454147a730a
SHA512 681173119cebdd19ebd686d22cc388ae9ff284dc441ec1df073aa12b4c6db7f24cfe3f1cc7723a8fcc9b834a162857051a196ab3b38da12e99972e18c1bab250
SSDEEP 384:ndiFavqMg38NT8TUNTUlIxTpwnoZESjlfVKuKgbR/TqKd9cxatk0vI+su:UFayv3Qwg1G0KuHbdTqSUy+u
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 6dddccc0db6d8fd8294996208733ee726df214f380c57bda1e14aeba0c4a7dfe
MD5 7f0f35d8cf40a98cf1e33d0661e61638
SHA1 090186423cb8bbfe8119115de5063d320754f683
SHA512 3f2990996267d657559ab8e943b7fd79d3172468599c5a9e007b2ff6303efc0edeb4b70a815dcff89fa96e94e9ef3789f27a9ef26623f4b6e949cfcd3c999753
SSDEEP 384:n8iFavqMg38N/8TUNTUlIR6pw5KajlfVKuK/Pf6GnHe3kW/TtxqqUxcxatk0vI+3:nFayv3EwgWcKuGiGHM9txzDyRH
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 cbff3733627b20ea86d24de9310cc2f9e53ba091b58519db758c59f76cb4a1db
MD5 477e8338d4f2a2e05e2116317fe5345e
SHA1 f4e9d4fd10a7301c52bdc60727728b18a9445aaa
SHA512 a526268c3d19f30ebcd81b3c53716e08ed35453b1786bc58e5bf821acfbdff25a198da80afc35189a197452d499ec3e0343b36dee45a386f528f05e1bc08df12
SSDEEP 384:nWiFavqMg38N/8TUNTUlIR6pw5KajlfVKuK/Pf6GnHe3kW/TtxqqUxcxatk0vI+3:9Fayv3EwgWcKuGiGHM9txzDyRH
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 7892fe44059f8ec83bde867bb20596f242831c277224d90c2f1a7699b27a91f1
MD5 de7288fd036240d47671ae94ef1c0be2
SHA1 c0c00fa2ceeee5faaf824aa6629158751d4f1f97
SHA512 70f1573d8a36ce678d811fde86806760ec77ba1dd834ff3a9e87545a7c6869508a663bc9f23f23c28bf6b621a04212bb8d2ca055bc628a29f91638a128bcaf2e
SSDEEP 384:nviFavqM738N/8TUNTUlIR6pw59zajlfVKuK/Df6GnHe3kW/TtxqqUxcxatk0vIg:6FayC3EwgFcKuWiGHM9txzDyRH
MD5 SHA1 SHA512 SSDEEP

Submit Download

typosquatting_list.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2026.1.6.1\typosquatting_list.pb
Size 1.5MB
SHA256 3e1a602ebafb225276733520ec4302cd73cfb7347dafeb26a35cf7200b7b3422
MD5 0a806472219dfa65a6322786b410c364
SHA1 ad98cc8571e9c6c1dee9e3163446c340b5f0ecdd
SHA512 1c20689828872d7b9444de8a0624333daf1810b87499d318d340d7fba0addb661c59a1bf6a97e1b19d1a691b01a4acea0703894ea7f567473f7f45a738c7f011
SSDEEP 12288:bGGPyZNnFDxw30GmKeG1yVO7sjGf2tY9cHNH165Kqhuu9bz+:tPKIbmKeG1HsjGgF+5Kv
MD5 SHA1 SHA512 SSDEEP

Submit Download

english_wikipedia.txt.mp3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ZxcvbnData\3.2.0.0\english_wikipedia.txt.mp3
Size 270KB
SHA256 bb6716f8dc6145c95a1aae96c5ec42e807e751a2944bbc0c2600fd1347df6f85
MD5 4857e944d811ffd70480d94ff3a57d9d
SHA1 69c6228e2a405947e4f6ee30c5132b28e812846b
SHA512 aee5d7b6ab85eba88292c34835e54e7b04b8f75decd51a1e2ffab4d0fd7e417662d537aac4e7c875b03b5adf027e6bd1624ffb41b5fb74ef2102fa2c45355cdc
SSDEEP 6144:Lc/JEHEUrZMnXWepRFGwmoeU3N/MTeHOoDLlk+n+RRDS8u3jo:LeJWEUrmnXWozG7oeU3N/dBDJkml8u3M
MD5 SHA1 SHA512 SSDEEP

Submit Download

female_names.txt.mp3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ZxcvbnData\3.2.0.0\female_names.txt.mp3
Size 26KB
SHA256 5dee268a3c6a7dda792ac47f9249cb733d46f5caf6614908fd8375e90c2df056
MD5 9167b58242b09da655ff9ab614724a6c
SHA1 d2ff3a4c753dca22fef7e62c3ff4b5cb52410c71
SHA512 d7e400e920711f404988a556b8b291be942489e38a3de5e45e1a9ccd2cef3d38823ca478ffef962c283a6a03fae568fd5a0884b1672ae77b08a0c0d2224f84ec
SSDEEP 768:NgCdntkud3t5TdTEguZ3uRiMrN/SsQkb7MIbXOp0f4HI:NFxWud9TEg83ukE/I+swMI
MD5 SHA1 SHA512 SSDEEP

Submit Download

male_names.txt.mp3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ZxcvbnData\3.2.0.0\male_names.txt.mp3
Size 6KB
SHA256 b4e9ba64202183fc03cae529d03570e3d56d185187268718ebccfd13fe464d2c
MD5 16dd80ca2d198c7896e96fd8a406ae5e
SHA1 211d4b92c71d6c774e2c2b03fa198759190554b5
SHA512 c0db29a66c072add58641c48de57111a0418a8006d49fcba5d5ca0308f7148928dd9aaca2f180b2ad0b211e41ab8798362c37981c4975443cb3585aa894658ac
SSDEEP 192:1lRJoEF6kV5qsUl++a56WZ1YJQifFumhgDiVP2s0Q7KdfWc:1HF6kV5qsexUYJRf5hgGd/7Kd+c
MD5 SHA1 SHA512 SSDEEP

Submit Download

passwords.txt.mp3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ZxcvbnData\3.2.0.0\passwords.txt.mp3
Size 233KB
SHA256 5ec1c4804b3f73b3852c13aa152b9b64af968b2fe383da2909bc8ccfb8fb1f3e
MD5 67b231ecfcde7118fc0f0a47f8271174
SHA1 72a069033d0871e2585b1e21a5efd9e263d278f8
SHA512 689aa165b773dc8cba75d91f7c041b0a866827f42d7bb383de7eef029922bbcf9a7f4378650402c6a05640a01bbcbef30fa8146dc5c0e2459657efaecad48dd2
SSDEEP 3072:vIhrD/gddhb3KKnZ6OgMbufF9OjRd2cFB5roblQXzLuW7JsbJX+Mbn6tir94PFlA:AVDKhzLggqAd2czmyqPoEslzRQxVXl
MD5 SHA1 SHA512 SSDEEP

Submit Download

ranked_dicts

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ZxcvbnData\3.2.0.0\ranked_dicts
Size 865KB
SHA256 5820d0bf9cfc363ff929492b1eb6df430039f4ac0e212a5b5411f7c2614f79d0
MD5 959460a18173908111523bbf4c39073e
SHA1 c42a9a7042f6d87a6a9de7f9bf378f1fe9485fcc
SHA512 291decc0f58cf71d7929a52d2c21a07590c02bcd202b73fb20391d6d0c7dcbe3aec24e02606f22dbd589ee2546a0eb8414c232f74ec646a1f26496c280705600
SSDEEP 12288:8WG0mOflZV35OtQm/b1Ed7pJPR3cjqKMjgP/pwH6sKFbEb3d4CPLsVQCcekWpH6m:k0m0lH35mVb1AJPtOl/06s6Wd4iBSsG
MD5 SHA1 SHA512 SSDEEP

Submit Download

surnames.txt.mp3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ZxcvbnData\3.2.0.0\surnames.txt.mp3
Size 74KB
SHA256 68e07aadf36f4ded8171a84a5bba517fdc76418488a1cf9b4bcb69273099b118
MD5 7675688eae2998de933258eed867556f
SHA1 dcfc1521e6bdb6f149d0741398eaf1eef556b75f
SHA512 0ed5a6367f176d5293ab3b70abf940c1d0ef19011856b5e651dc0d5a5c0108badb8cf426f2d2dfe241dea74ee4c183d615e4fe544db8d1104a93d471ebd03649
SSDEEP 1536:eLeljiLfCs8svIIZ2AtAXw02APt7dURtBArX52CHJ6djijsh9:eL62J2AuA05Pt7dC+rXlo+jE
MD5 SHA1 SHA512 SSDEEP

Submit Download

us_tv_and_film.txt.mp3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ZxcvbnData\3.2.0.0\us_tv_and_film.txt.mp3
Size 159KB
SHA256 2125af17cfba79ca2db6da4e823df49fc438e6b5ebf6b228f73eb50fc0ca6d7e
MD5 bba619915a3a8f20871400cbebd5744f
SHA1 3986fbfac8b31e9d41ec70675cb37d508511c0c8
SHA512 d8525018a05f0a128a21678ec65d486983f11b7d0ffbd593e7d0df34d6d354530226fbfddfc10f2fa4060aaeb71e9c3c8c68d17d11ffd10cbffc65550d618656
SSDEEP 3072:wX4l+SwdOu7m5XoAg4RayK6GYgXrtRmKAUYPZdkoa4Qd5kX8Gk:woEXOO+Xhg4QyNGYgXrtrGPZra4QdKXm
MD5 SHA1 SHA512 SSDEEP

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 e3f3da1846d9bde094c6bd115d7097ae98b0cb06767556e6319dc3158ed18a00
MD5 63af97260785680aeebb4ae73660f282
SHA1 8c3bf793a47829f7f824e44ad49c2c1133ef21e1
SHA512 630d3acd40c27a5766af2bfc84d8ca022e629cd62a425b040b4550af93ade5e338a40db891e81138e1bdc739c5072dfac97f4893cb8bfae1895f83bcfead810e
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 d66c7c80938248300906322a0955b670b7627aee67c06ea033e7dd3fa460210e
MD5 ac70be3159c694b9d8971dafc2979600
SHA1 cc839e1e624073b0356887b2568e5a760681f856
SHA512 1d4dbd6091f4a8b0ad849287d64457d3c9f2819f1ace41ce90a5cf49f4c038ea7337b8c80df8104f3ae1125594c2a91918b18f01008390cb97a849ca4bd52c30
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3760_392557856\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
MD5 SHA1 SHA512 SSDEEP

Submit Download

arbitration_metadata.txt

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3760_1112301559\arbitration_metadata.txt
Size 343KB
SHA256 07d3423beb505d69a9ed17c71e96a88509c41117e6ab9d6014cffe81c46fe7c2
MD5 6b8740e0662b67555214c91c8781268b
SHA1 606536ad8540063e58d34c86b1aa226e80aaaf1c
SHA512 46022d1ca0ff6cc25e93b8b65355993cf774a9297dc6262b992eef18e530ded6b6941d0be830cff76fcd355d7d375ec6cb4ffb34a756273de8b63a103fd5448c
SSDEEP 3072:uuGUDP7IjAyFyc2hKN1YbxGTz5Yv2zfbzLsXpi7:uuBDDI0yFyc2hKN1YbxGTziv2zfbz37
MD5 SHA1 SHA512 SSDEEP

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3760_1112301559\manifest.json
Size 238B
SHA256 1bdda4a8fc3e2b965fbb52c9b23a9a34871bc345abfb332a87ea878f4472efbd
MD5 15b69964f6f79654cbf54953aad0513f
SHA1 013fb9737790b034195cdeddaa620049484c53a7
SHA512 7eeee58e06bba59b1ef874436035202416079617b7953593abf6d9af42a55088ab37f45fdee394166344f0186c0cb7092f55ed201c213737bb5d5318e9f47908
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3760_1224832809\manifest.json
Size 69B
SHA256 c0622dadf4ec10ce5f4a64e3f24956b750345dcc194d0bd3ff73cfce1bf6081e
MD5 fb0d9796a86299d3689982f7a949dc6e
SHA1 6179cd612ac0dcc44d0659c7c99d1e0aecbf206e
SHA512 e3e1a18be661da9d450a30a37d24dc08dc8de628a104ce0f4197214ce6f27a2bf9de3eca1c1697fcfa3c601787ca7a6b5e30a5fe3d6ae3b2c10f1ab34af22fd0
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3760_514350778\manifest.json
Size 117B
SHA256 38b6bec84d1954b09b76f806bd2095f2ca2750e03f4a0ce8f6b8d41c53c726de
MD5 a2614553c42d2d30f915faf446afe34e
SHA1 de8b20f7893c9f4d85dfc79b9558b34415f879e8
SHA512 e3368641c51b5c9ea68a407e3c214eabdc9a9a7f6b39ce127c9e672a1ef14f626cc29e85c8b39970eba5fc61602c62568d9442d01a05e850151d6de9a19b3e9d
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3760_762568055\manifest.json
Size 53B
SHA256 667e4afcbfade3a2c4273c35cddadc6bb93f4a3e7eb00f33e07ba6584ec7e06e
MD5 a2b4b4bc3083d58540807e1513c70979
SHA1 40d61c77d79e5bb5efbd444fbc26e1a89027d1af
SHA512 2181a7978adfcd722c56ddaf2508166ee38bdb1de43044c4efe3c93089ffcb6c8ea2b50891641fc78c415352d87aff84720a5901e7d847377296f8e5820be359
MD5 SHA1 SHA512

Submit Download

bciafqfopqhn.exe

Path C:\Windows\bciafqfopqhn.exe
Size 632KB
SHA256 bc68d520b6c682bbb9a601766f0487095033dbeaae87e3d9ce0f460c119a5ee2
MD5 a0e62a985e26323a2e5deea581d29df2
SHA1 acb8234b139c2a7c0824e99f7daa1895f3e94887
SHA512 63dfbd6ed06f53440d7f2df46a471bf9f1ad8e0a34e6945f2ea15ab13df3a83da032dd12765b4c29a2da363ff7c6e7bbf79c9640098c6088b50eb5d8177623f7
SSDEEP 3072:YP36YQgDABWbDFp7yz5dwjtYjt+XOCGNjYQMhLwZil6hdZrz5kbJnCgo5QTRpA:cZKjjtxVYQuwFhdZrz5UC5aXA
MD5 SHA1 SHA512 SSDEEP

Submit Download