1cf4c72d3533ea0af0366ad3fbbaf95a5e55692ec91e459f3274ad3f9fbc8643

Analysis

max time kernel
150s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/05/2026, 02:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-23_1e23a67e18a14166fcb228b29e17fe74_elex_wannacry.exe
Size 876KB
Sample260523-cngmmadv4s
SHA256 1cf4c72d3533ea0af0366ad3fbbaf95a5e55692ec91e459f3274ad3f9fbc8643
MD5 1e23a67e18a14166fcb228b29e17fe74
SHA1 5b597ab5ff9a0a5eddef951900103a119742c4f5
SHA512 f645c19c4f55c50ef51918418612a8994054a4e19a33ac1e4a1017f6844454bfe7db00c14161191988d597cce7d3db0e4cbe640a5dcd361e705f6930e58508a3
SSDEEP 12288:j3zN+izByRbacF8XrHQC1qkjIjUG49+nTVSYzHWyRbacF8XrHQC1qkjIjUG49+nq:DzV0WT3VPGm+nZSYzHWT3VPGm+nZSkS
TLSH
T1B6159E196F33B561D940DAF710176EE7CFACAF006D2BD019252F96299C673A38E8D831
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery evasion execution impact persistence ransomware spyware stealer

Malware Config

Extracted

Path

C:\Program Files\7-Zip\Lang\HELP_RECOVER_instructions+xgv.txt

Ransom Note

__!@#!@#!__!@#!@#!__!@#!@#!__!@#!@#!__!@#!@#!__!@#!@#!__!@#!@#!__!@#!@#!__!@#!@#!__!@#!@#! NOT YOUR LANGUAGE? USE https://translate.google.com What happened to your files ? All of your files were protected by a strong encryption with RSA-4096. More information about the encryption keys using RSA-4096 can be found here: http://en.wikipedia.org/wiki/RSA_(cryptosystem) How did this happen ? !!! Specially for your PC was generated personal RSA-4096 KEY, both public and private. !!! ALL YOUR FILES were encrypted with the public key, which has been transferred to your computer via the Internet. Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server. What do I do ? So, there are two ways you can choose: wait for a miracle and get your price doubled, or start obtaining BITCOIN NOW! , and restore your data easy way. If You have really valuable data, you better not waste your time, because there is no other way to get your files, except make a payment. For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: 1. http://kk4nlsjn45hh334fsf.drossstoic.at/750BE6D945D9293 2. http://bb34dbsjneefnsdefjsn.golemmalik.su/750BE6D945D9293 3. http://i4sdmjn4fsdsdqfhu12l.orbyscabz.com/750BE6D945D9293 If for some reasons the addresses are not available, follow these steps: 1. Download and install tor-browser: http://www.torproject.org/projects/torbrowser.html.en 2. After a successful installation, run the browser and wait for initialization. 3. Type in the address bar: yez2o5lwqkmlv5lc.onion/750BE6D945D9293 4. Follow the instructions on the site. !!! IMPORTANT INFORMATION: !!! Your personal pages: http://kk4nlsjn45hh334fsf.drossstoic.at/750BE6D945D9293 http://bb34dbsjneefnsdefjsn.golemmalik.su/750BE6D945D9293 http://i4sdmjn4fsdsdqfhu12l.orbyscabz.com/750BE6D945D9293 !!! Your personal page Tor-Browser: yez2o5lwqkmlv5lc.onion/750BE6D945D9293 !!! Your personal identification ID: 750BE6D945D9293

URLs

http://kk4nlsjn45hh334fsf.drossstoic.at/750BE6D945D9293
http://bb34dbsjneefnsdefjsn.golemmalik.su/750BE6D945D9293
http://i4sdmjn4fsdsdqfhu12l.orbyscabz.com/750BE6D945D9293
http://yez2o5lwqkmlv5lc.onion/750BE6D945D9293

Signatures

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Modifies boot configuration data using bcdedit 1 TTPs 5 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
4228	bcdedit.exe
2660	bcdedit.exe
836	bcdedit.exe
1228	bcdedit.exe
3008	bcdedit.exe

Renames multiple (1027) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation	2026-05-23_1e23a67e18a14166fcb228b29e17fe74_elex_wannacry.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation	kfgkpjc.exe

Drops startup file 6 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\HELP_RECOVER_instructions+xgv.txt	kfgkpjc.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\HELP_RECOVER_instructions+xgv.html	kfgkpjc.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HELP_RECOVER_instructions+xgv.png	kfgkpjc.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HELP_RECOVER_instructions+xgv.txt	kfgkpjc.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HELP_RECOVER_instructions+xgv.html	kfgkpjc.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\HELP_RECOVER_instructions+xgv.png	kfgkpjc.exe

Executes dropped EXE 4 IoCs

pid	Process
3152	kfgkpjc.exe
5072	kfgkpjc.exe
5100	kfgkpjc.exe
4704	kfgkpjc.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\verif-8746 = "C:\\Users\\Admin\\AppData\\Roaming\\kfgkpjc.exe"	kfgkpjc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\verif-8746 = "C:\\Users\\Admin\\AppData\\Roaming\\kfgkpjc.exe"	kfgkpjc.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 3656 set thread context of 4980	3656	2026-05-23_1e23a67e18a14166fcb228b29e17fe74_elex_wannacry.exe	93
PID 3152 set thread context of 5072	3152	kfgkpjc.exe	103
PID 5100 set thread context of 4704	5100	kfgkpjc.exe	124

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\HELP_RECOVER_instructions+xgv.txt	kfgkpjc.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubSplashScreen.scale-200.png	kfgkpjc.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\HELP_RECOVER_instructions+xgv.png	kfgkpjc.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-48_contrast-white.png	kfgkpjc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-black_scale-180.png	kfgkpjc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSIPC\sr-Latn-RS\HELP_RECOVER_instructions+xgv.html	kfgkpjc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\HELP_RECOVER_instructions+xgv.png	kfgkpjc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\1033\HELP_RECOVER_instructions+xgv.html	kfgkpjc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\assembly\GAC_MSIL\Microsoft.AnalysisServices.SPClient.Interfaces\HELP_RECOVER_instructions+xgv.html	kfgkpjc.exe
File opened for modification	C:\Program Files\MountResolve.pdf	kfgkpjc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\kab\LC_MESSAGES\HELP_RECOVER_instructions+xgv.txt	kfgkpjc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\stream_extractor\HELP_RECOVER_instructions+xgv.png	kfgkpjc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientOSub2019_eula.txt	kfgkpjc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\BORDERS\HELP_RECOVER_instructions+xgv.html	kfgkpjc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\CANYON\HELP_RECOVER_instructions+xgv.png	kfgkpjc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Portal\1033\HELP_RECOVER_instructions+xgv.html	kfgkpjc.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Assets\Store\AppIcon.altform-unplated_targetsize-16.png	kfgkpjc.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Place\contrast-white\HELP_RECOVER_instructions+xgv.txt	kfgkpjc.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\Weather_LogoSmall.scale-200.png	kfgkpjc.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Viewpoints\Dark\HELP_RECOVER_instructions+xgv.txt	kfgkpjc.exe
File opened for modification	C:\Program Files\Common Files\System\ja-JP\HELP_RECOVER_instructions+xgv.html	kfgkpjc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSIPC\zh-CN\HELP_RECOVER_instructions+xgv.txt	kfgkpjc.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\loc_archives\en-gb\HELP_RECOVER_instructions+xgv.html	kfgkpjc.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteSectionMedTile.scale-125.png	kfgkpjc.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\Office365LogoWLockup.scale-180.png	kfgkpjc.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-white\WideTile.scale-125_contrast-white.png	kfgkpjc.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-20_altform-lightunplated.png	kfgkpjc.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\1850_40x40x32.png	kfgkpjc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\hy\LC_MESSAGES\HELP_RECOVER_instructions+xgv.txt	kfgkpjc.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Place\LTR\contrast-black\WideTile.scale-125.png	kfgkpjc.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-40.png	kfgkpjc.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxA-GoogleCloudCache.scale-150.png	kfgkpjc.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxCalendarWideTile.scale-200.png	kfgkpjc.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxMailSplashLogo.scale-300.png	kfgkpjc.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\ThankYou\HELP_RECOVER_instructions+xgv.png	kfgkpjc.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\MapsAppList.scale-200.png	kfgkpjc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\legal\jdk\HELP_RECOVER_instructions+xgv.html	kfgkpjc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Fonts\private\HELP_RECOVER_instructions+xgv.html	kfgkpjc.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\hi-IN\View3d\HELP_RECOVER_instructions+xgv.html	kfgkpjc.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\StoreLogo.scale-100.png	kfgkpjc.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteAppList.targetsize-60_altform-unplated.png	kfgkpjc.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-black\SmallTile.scale-150_contrast-black.png	kfgkpjc.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxA-Generic-Dark.scale-250.png	kfgkpjc.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Home\LTR\contrast-white\HELP_RECOVER_instructions+xgv.png	kfgkpjc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\ext\HELP_RECOVER_instructions+xgv.html	kfgkpjc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\HELP_RECOVER_instructions+xgv.html	kfgkpjc.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-40_contrast-black.png	kfgkpjc.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-48_contrast-black.png	kfgkpjc.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_neutral_~_8wekyb3d8bbwe\HELP_RECOVER_instructions+xgv.html	kfgkpjc.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\webviewCore.min.js	kfgkpjc.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxCalendarAppList.targetsize-96_altform-lightunplated.png	kfgkpjc.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\HELP_RECOVER_instructions+xgv.html	kfgkpjc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\services_discovery\HELP_RECOVER_instructions+xgv.txt	kfgkpjc.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_neutral_~_8wekyb3d8bbwe\HELP_RECOVER_instructions+xgv.txt	kfgkpjc.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\az-Latn-AZ\View3d\HELP_RECOVER_instructions+xgv.txt	kfgkpjc.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\HELP_RECOVER_instructions+xgv.html	kfgkpjc.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\ThirdPartyNotices.txt	kfgkpjc.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxCalendarAppList.targetsize-48_altform-unplated.png	kfgkpjc.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Work\LTR\contrast-black\LargeTile.scale-200.png	kfgkpjc.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Work\LTR\contrast-white\HELP_RECOVER_instructions+xgv.txt	kfgkpjc.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-black\AppPackageLargeTile.scale-125_contrast-black.png	kfgkpjc.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\sv-SE\View3d\HELP_RECOVER_instructions+xgv.html	kfgkpjc.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\LargeTile.scale-150.png	kfgkpjc.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\OutlookMailLargeTile.scale-100.png	kfgkpjc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-23_1e23a67e18a14166fcb228b29e17fe74_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kfgkpjc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kfgkpjc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NOTEPAD.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-23_1e23a67e18a14166fcb228b29e17fe74_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kfgkpjc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kfgkpjc.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4952	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Interacts with shadow copies 3 TTPs 2 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
1296	vssadmin.exe
2124	vssadmin.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134239761200425089"	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2937465464-4167303362-2236413517-1000\{AB7151D9-6C7F-4E27-829D-7C3931C4F1D4}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings	kfgkpjc.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
3240	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5072	kfgkpjc.exe
5072	kfgkpjc.exe
5072	kfgkpjc.exe
5072	kfgkpjc.exe
5072	kfgkpjc.exe
5072	kfgkpjc.exe
5072	kfgkpjc.exe
5072	kfgkpjc.exe
5072	kfgkpjc.exe
5072	kfgkpjc.exe
5072	kfgkpjc.exe
5072	kfgkpjc.exe
5072	kfgkpjc.exe
5072	kfgkpjc.exe
5072	kfgkpjc.exe
5072	kfgkpjc.exe
5072	kfgkpjc.exe
5072	kfgkpjc.exe
5072	kfgkpjc.exe
5072	kfgkpjc.exe
5072	kfgkpjc.exe
5072	kfgkpjc.exe
5072	kfgkpjc.exe
5072	kfgkpjc.exe
5072	kfgkpjc.exe
5072	kfgkpjc.exe
5072	kfgkpjc.exe
5072	kfgkpjc.exe
5072	kfgkpjc.exe
5072	kfgkpjc.exe
5072	kfgkpjc.exe
5072	kfgkpjc.exe
5072	kfgkpjc.exe
5072	kfgkpjc.exe
5072	kfgkpjc.exe
5072	kfgkpjc.exe
5072	kfgkpjc.exe
5072	kfgkpjc.exe
5072	kfgkpjc.exe
5072	kfgkpjc.exe
5072	kfgkpjc.exe
5072	kfgkpjc.exe
5072	kfgkpjc.exe
5072	kfgkpjc.exe
5072	kfgkpjc.exe
5072	kfgkpjc.exe
5072	kfgkpjc.exe
5072	kfgkpjc.exe
5072	kfgkpjc.exe
5072	kfgkpjc.exe
5072	kfgkpjc.exe
5072	kfgkpjc.exe
5072	kfgkpjc.exe
5072	kfgkpjc.exe
5072	kfgkpjc.exe
5072	kfgkpjc.exe
5072	kfgkpjc.exe
5072	kfgkpjc.exe
5072	kfgkpjc.exe
5072	kfgkpjc.exe
5072	kfgkpjc.exe
5072	kfgkpjc.exe
5072	kfgkpjc.exe
5072	kfgkpjc.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	4980	2026-05-23_1e23a67e18a14166fcb228b29e17fe74_elex_wannacry.exe
Token: SeDebugPrivilege	5072	kfgkpjc.exe
Token: SeBackupPrivilege	3776	vssvc.exe
Token: SeRestorePrivilege	3776	vssvc.exe
Token: SeAuditPrivilege	3776	vssvc.exe
Token: SeDebugPrivilege	4704	kfgkpjc.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1388	msedge.exe
1388	msedge.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3656	2026-05-23_1e23a67e18a14166fcb228b29e17fe74_elex_wannacry.exe
3152	kfgkpjc.exe
5100	kfgkpjc.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3656 wrote to memory of 4980	3656	2026-05-23_1e23a67e18a14166fcb228b29e17fe74_elex_wannacry.exe	93
PID 3656 wrote to memory of 4980	3656	2026-05-23_1e23a67e18a14166fcb228b29e17fe74_elex_wannacry.exe	93
PID 3656 wrote to memory of 4980	3656	2026-05-23_1e23a67e18a14166fcb228b29e17fe74_elex_wannacry.exe	93
PID 3656 wrote to memory of 4980	3656	2026-05-23_1e23a67e18a14166fcb228b29e17fe74_elex_wannacry.exe	93
PID 3656 wrote to memory of 4980	3656	2026-05-23_1e23a67e18a14166fcb228b29e17fe74_elex_wannacry.exe	93
PID 3656 wrote to memory of 4980	3656	2026-05-23_1e23a67e18a14166fcb228b29e17fe74_elex_wannacry.exe	93
PID 3656 wrote to memory of 4980	3656	2026-05-23_1e23a67e18a14166fcb228b29e17fe74_elex_wannacry.exe	93
PID 4980 wrote to memory of 3152	4980	2026-05-23_1e23a67e18a14166fcb228b29e17fe74_elex_wannacry.exe	94
PID 4980 wrote to memory of 532	4980	2026-05-23_1e23a67e18a14166fcb228b29e17fe74_elex_wannacry.exe	95
PID 3152 wrote to memory of 5072	3152	kfgkpjc.exe	103
PID 3152 wrote to memory of 5072	3152	kfgkpjc.exe	103
PID 3152 wrote to memory of 5072	3152	kfgkpjc.exe	103
PID 3152 wrote to memory of 5072	3152	kfgkpjc.exe	103
PID 3152 wrote to memory of 5072	3152	kfgkpjc.exe	103
PID 3152 wrote to memory of 5072	3152	kfgkpjc.exe	103
PID 3152 wrote to memory of 5072	3152	kfgkpjc.exe	103
PID 5072 wrote to memory of 4228	5072	kfgkpjc.exe	105
PID 5072 wrote to memory of 1296	5072	kfgkpjc.exe	107
PID 5072 wrote to memory of 2660	5072	kfgkpjc.exe	113
PID 5072 wrote to memory of 836	5072	kfgkpjc.exe	115
PID 5072 wrote to memory of 1228	5072	kfgkpjc.exe	118
PID 5072 wrote to memory of 3008	5072	kfgkpjc.exe	120
PID 5100 wrote to memory of 4704	5100	kfgkpjc.exe	124
PID 5100 wrote to memory of 4704	5100	kfgkpjc.exe	124
PID 5100 wrote to memory of 4704	5100	kfgkpjc.exe	124
PID 5100 wrote to memory of 4704	5100	kfgkpjc.exe	124
PID 5100 wrote to memory of 4704	5100	kfgkpjc.exe	124
PID 5100 wrote to memory of 4704	5100	kfgkpjc.exe	124
PID 5100 wrote to memory of 4704	5100	kfgkpjc.exe	124
PID 5072 wrote to memory of 3240	5072	kfgkpjc.exe	127
PID 5072 wrote to memory of 1388	5072	kfgkpjc.exe	128
PID 5072 wrote to memory of 2124	5072	kfgkpjc.exe	129
PID 1388 wrote to memory of 4192	1388	msedge.exe	130
PID 1388 wrote to memory of 4952	1388	msedge.exe	132
PID 1388 wrote to memory of 4956	1388	msedge.exe	133
PID 1388 wrote to memory of 4956	1388	msedge.exe	133
PID 1388 wrote to memory of 4956	1388	msedge.exe	133
PID 1388 wrote to memory of 2108	1388	msedge.exe	134
PID 1388 wrote to memory of 2108	1388	msedge.exe	134
PID 1388 wrote to memory of 392	1388	msedge.exe	135
PID 1388 wrote to memory of 392	1388	msedge.exe	135
PID 1388 wrote to memory of 1292	1388	msedge.exe	136
PID 1388 wrote to memory of 392	1388	msedge.exe	135
PID 1388 wrote to memory of 1292	1388	msedge.exe	136
PID 1388 wrote to memory of 1292	1388	msedge.exe	136
PID 1388 wrote to memory of 868	1388	msedge.exe	137
PID 1388 wrote to memory of 868	1388	msedge.exe	137
PID 1388 wrote to memory of 868	1388	msedge.exe	137
PID 1388 wrote to memory of 3704	1388	msedge.exe	138
PID 1388 wrote to memory of 3704	1388	msedge.exe	138
PID 1388 wrote to memory of 3704	1388	msedge.exe	138
PID 1388 wrote to memory of 5060	1388	msedge.exe	142
PID 1388 wrote to memory of 5060	1388	msedge.exe	142
PID 1388 wrote to memory of 1304	1388	msedge.exe	148
PID 1388 wrote to memory of 1304	1388	msedge.exe	148
PID 1388 wrote to memory of 5092	1388	msedge.exe	145
PID 1388 wrote to memory of 2512	1388	msedge.exe	146
PID 1388 wrote to memory of 5092	1388	msedge.exe	145
PID 1388 wrote to memory of 2512	1388	msedge.exe	146
PID 1388 wrote to memory of 1304	1388	msedge.exe	148
PID 1388 wrote to memory of 2016	1388	msedge.exe	149
PID 1388 wrote to memory of 2016	1388	msedge.exe	149
PID 1388 wrote to memory of 2988	1388	msedge.exe	150
PID 1388 wrote to memory of 2988	1388	msedge.exe	150

System policy modification 1 TTPs 2 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	kfgkpjc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1"	kfgkpjc.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-05-23_1e23a67e18a14166fcb228b29e17fe74_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-23_1e23a67e18a14166fcb228b29e17fe74_elex_wannacry.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3656
- C:\Users\Admin\AppData\Local\Temp\2026-05-23_1e23a67e18a14166fcb228b29e17fe74_elex_wannacry.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-05-23_1e23a67e18a14166fcb228b29e17fe74_elex_wannacry.exe"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4980
- - C:\Users\Admin\AppData\Roaming\kfgkpjc.exe
    C:\Users\Admin\AppData\Roaming\kfgkpjc.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3152
  - - C:\Users\Admin\AppData\Roaming\kfgkpjc.exe
      C:\Users\Admin\AppData\Roaming\kfgkpjc.exe
      4⤵
      Checks computer location settings
      Drops startup file
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:5072
    - - C:\Windows\SYSTEM32\bcdedit.exe
        
        bcdedit.exe /set {current} bootems off
        5⤵
        Modifies boot configuration data using bcdedit
        
        PID:4228
    - - C:\Windows\System32\vssadmin.exe
        
        "C:\Windows\System32\vssadmin.exe" delete shadows /all /Quiet
        5⤵
        Interacts with shadow copies
        
        PID:1296
    - - C:\Windows\SYSTEM32\bcdedit.exe
        
        bcdedit.exe /set {current} advancedoptions off
        5⤵
        Modifies boot configuration data using bcdedit
        
        PID:2660
    - - C:\Windows\SYSTEM32\bcdedit.exe
        
        bcdedit.exe /set {current} optionsedit off
        5⤵
        Modifies boot configuration data using bcdedit
        
        PID:836
    - - C:\Windows\SYSTEM32\bcdedit.exe
        
        bcdedit.exe /set {current} bootstatuspolicy IgnoreAllFailures
        5⤵
        Modifies boot configuration data using bcdedit
        
        PID:1228
    - - C:\Windows\SYSTEM32\bcdedit.exe
        
        bcdedit.exe /set {current} recoveryenabled off
        5⤵
        Modifies boot configuration data using bcdedit
        
        PID:3008
    - - C:\Windows\SysWOW64\NOTEPAD.EXE
        
        "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\help_recover_instructions.TXT
        5⤵
        System Location Discovery: System Language Discovery
        Opens file in notepad (likely ransom note)
        
        PID:3240
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\help_recover_instructions.HTM
        5⤵
        Checks processor information in registry
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Modifies registry class
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:1388
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x35c,0x7ffdc788c188,0x7ffdc788c194,0x7ffdc788c1a0
        6⤵
        
        PID:4192
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1824,i,464893425401418168,18348793050382224926,524288 --field-trial-handle=2096,i,11840040331869197929,3109526450259365735,262144 --variations-seed-version --mojo-platform-channel-handle=2416 /prefetch:3
        6⤵
        System Time Discovery
        
        PID:4952
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1656,i,17861168161914228596,6976939246912849864,262144 --field-trial-handle=2096,i,11840040331869197929,3109526450259365735,262144 --variations-seed-version --mojo-platform-channel-handle=2092 /prefetch:2
        6⤵
        
        PID:4956
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1948,i,8564550937235080341,7871078060385052132,524288 --field-trial-handle=2096,i,11840040331869197929,3109526450259365735,262144 --variations-seed-version --mojo-platform-channel-handle=1956 /prefetch:8
        6⤵
        
        PID:2108
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3464,i,15378149242247632749,12968713688199582560,2097152 --field-trial-handle=2096,i,11840040331869197929,3109526450259365735,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
        6⤵
        
        PID:392
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3468,i,13456873677572155299,546563341519282337,2097152 --field-trial-handle=2096,i,11840040331869197929,3109526450259365735,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
        6⤵
        
        PID:1292
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4212,i,11830689132334926725,11862308562128439073,2097152 --field-trial-handle=2096,i,11840040331869197929,3109526450259365735,262144 --variations-seed-version --mojo-platform-channel-handle=4224 /prefetch:1
        6⤵
        
        PID:868
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4284,i,17176071850913571197,7195029194561067652,2097152 --field-trial-handle=2096,i,11840040331869197929,3109526450259365735,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:2
        6⤵
        
        PID:3704
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5128,i,8791374531083544939,3353377565457265349,524288 --field-trial-handle=2096,i,11840040331869197929,3109526450259365735,262144 --variations-seed-version --mojo-platform-channel-handle=5136 /prefetch:8
        6⤵
        
        PID:5060
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5084,i,10706062436990244367,7156084710842328645,524288 --field-trial-handle=2096,i,11840040331869197929,3109526450259365735,262144 --variations-seed-version --mojo-platform-channel-handle=5292 /prefetch:8
        6⤵
        
        PID:1304
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5084,i,3124492040307963244,15202087793005196712,524288 --field-trial-handle=2096,i,11840040331869197929,3109526450259365735,262144 --variations-seed-version --mojo-platform-channel-handle=5356 /prefetch:8
        6⤵
        
        PID:5092
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5288,i,13520349387188489850,9273713423004314325,524288 --field-trial-handle=2096,i,11840040331869197929,3109526450259365735,262144 --variations-seed-version --mojo-platform-channel-handle=5392 /prefetch:8
        6⤵
        
        PID:2512
      - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5892,i,6077681805094884936,10645659336749147009,524288 --field-trial-handle=2096,i,11840040331869197929,3109526450259365735,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:8
        6⤵
        
        PID:3328
      - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5892,i,6077681805094884936,10645659336749147009,524288 --field-trial-handle=2096,i,11840040331869197929,3109526450259365735,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:8
        6⤵
        
        PID:1304
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6108,i,16796681371504220314,4846705040871214129,524288 --field-trial-handle=2096,i,11840040331869197929,3109526450259365735,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:8
        6⤵
        
        PID:2016
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6268,i,11525049588726518826,18287623931443438172,524288 --field-trial-handle=2096,i,11840040331869197929,3109526450259365735,262144 --variations-seed-version --mojo-platform-channel-handle=6272 /prefetch:8
        6⤵
        
        PID:2988
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6092,i,18421601666622909819,6040304631444573253,524288 --field-trial-handle=2096,i,11840040331869197929,3109526450259365735,262144 --variations-seed-version --mojo-platform-channel-handle=6072 /prefetch:8
        6⤵
        
        PID:4528
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6580,i,10878869523784834488,16864201790514698613,524288 --field-trial-handle=2096,i,11840040331869197929,3109526450259365735,262144 --variations-seed-version --mojo-platform-channel-handle=6596 /prefetch:8
        6⤵
        
        PID:1484
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6276,i,1763098022898011088,17390529827377782471,524288 --field-trial-handle=2096,i,11840040331869197929,3109526450259365735,262144 --variations-seed-version --mojo-platform-channel-handle=6588 /prefetch:8
        6⤵
        
        PID:4296
    - - C:\Windows\System32\vssadmin.exe
        
        "C:\Windows\System32\vssadmin.exe" delete shadows /all /Quiet
        5⤵
        Interacts with shadow copies
        
        PID:2124
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE
    3⤵
    - System Location Discovery: System Language Discovery
    PID:532

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3776

C:\Users\Admin\AppData\Roaming\kfgkpjc.exe
C:\Users\Admin\AppData\Roaming\kfgkpjc.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5100
- C:\Users\Admin\AppData\Roaming\kfgkpjc.exe
  C:\Users\Admin\AppData\Roaming\kfgkpjc.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:4704

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2264

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Direct Volume Access

T1006

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

HELP_RECOVER_instructions+xgv.html

Path C:\Program Files\7-Zip\Lang\HELP_RECOVER_instructions+xgv.html
Size 8KB
SHA256 a2bece32e5215a946f3b3966d21aa1d5d3fe760ecbe20d63d398553323107a8e
MD5 7b3e5d47365ebda0d4ca4a629544f2b7
SHA1 9ca1b2240b6195dd3585ad8eec8618efe8dd550d
SHA512 5bfb02a4691ef9c8afaf8423cd5d76a759242918699775545fb516d35c3fc6b13c22709b2382d64075ae684f652874732945ef81f16a8987c279c58fc09c86d6
SSDEEP 96:Pm1TQDl1ZAUmDrXtiEnqYEx/CWBTFtGQcFsu064v8+Y0dFKHBJYRLPs:Ougzr9JkhTGQc+u0TnihJYO
TLSH
T13402ED9B9E4C895183E1C67EFDB04A5EE23B7C4541FE05AC5492EB9C70E4523F20EE89
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HELP_RECOVER_instructions+xgv.png

Path C:\Program Files\7-Zip\Lang\HELP_RECOVER_instructions+xgv.png
Size 66KB
SHA256 da03d75fb3a120faddcbf6b58b32000322582b9423807694108af3c93a8ad486
MD5 39a36dbf8a5bfb12db315be49ad904da
SHA1 d6ddd4931394c6ec32dad389f345fc9bba8ff371
SHA512 9892db99c82a79e4a62e234b3e2c092d33cb6dc8aa5368854a8ec1a16439db3c78c31474af713e6f3c7195a3cd934a8c9262dc8b38c88493edea64ce8d779b1b
SSDEEP 1536:vLMB0S6vLa59Ew75lBYkiwpO17Z0duAYkde0ddU78z0:vwEDq9Ew/5iws17faddUK0
TLSH
T16463C0014D957C9ED9C77371B8DC27793222797456C960DC93322826AAB02BC4E2BD3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HELP_RECOVER_instructions+xgv.txt

Path C:\Program Files\7-Zip\Lang\HELP_RECOVER_instructions+xgv.txt
Size 2KB
SHA256 73fd359a1471b814a1da5fd5031e5c78fe0499585eff2df74c8f6b27de857f7b
MD5 077f1776cb08f82caf8552bcdaf106bd
SHA1 8d6d068329694a22c5f0d98d321b3b70b3b2b6d6
SHA512 0d38bb70e692bc76e63613e0813889fe93ad7e121a217b2af472719a94c01c11f861587237bac671582a09d3614dfef452a9f041280dcf22ecc3acf47be3cbd5
TLSH
T19641C74F6F5C92B00C990B957CF04681FF06506512AD05229C1FA43D2736C6EBB27FAB
MD5 SHA1 SHA512 TLSH

Submit Download

THIRDPARTYLICENSEREADME-JAVAFX.txt

Path C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt
Size 560B
SHA256 888e58b8c5d6edd481d555579ac53c7c508f161bc0e4b5dca44bc6946cfc7f68
MD5 bff4d326ba3f6f687caf20eaf8ad34cf
SHA1 181cf84d4f5cdc99a11d893775deb124ee5bf7da
SHA512 3806d18d0bf4eb893b992cfaa927c4e62ff0db6ddc9a1afa5e300ebcb8442fe96cbbd1b6d53c6918b0f6420eddb50dd845876b6fffc555c69685a4ab977cc99c
TLSH
T1ADF0543F2DA6957DF0BC04B18E021A5FC71496EABE7AB0CC549687F3D3E402F6008666
MD5 SHA1 SHA512 TLSH

Submit Download

THIRDPARTYLICENSEREADME.txt

Path C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt
Size 560B
SHA256 bb5bbfc93718158ac118b94557a4197256bbd2d39b037dad961dba4fe5bb0d52
MD5 f8eb8d5e5d9063422d535d5faa56d5f5
SHA1 82f372514613222eca2c9c1ab74eeed1ad92db05
SHA512 5f2a8d066332e0c07b9eea3f58e64da13683cbd3d841f04f2b96f3b1fe586e0ff44909295527e78dbd7c9b91e51f138519ad10298f130d2d2c7993c3606c97ef
TLSH
T174F0543F3C62847AF23A167384A5066EC52785FDBBFA3045556A8AF28BE04C7101459A
MD5 SHA1 SHA512 TLSH

Submit Download

ClientSub2019_eula.txt

Path C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub2019_eula.txt
Size 416B
SHA256 ab5186f7d0187510603ebe13b1bd4ddab55e2f3dc857a63139deacf9de907ed2
MD5 10e4547aaa10fe32faf6239e4b4ffae9
SHA1 8c121427b5383a66117e44ac192fe26f8de598b5
SHA512 24b0e00169e9975a300ed31b787dcc2ba88b7bfa0411a77a3f7c237b1030468611488bc45ded38f9b76a7da618dcb88df8e14ac59f0b7a88f39e2cba1031d4bc
TLSH
T132E0C07F0D514075F01C64764D021A9CA60689E1FFBE354C1814DAF0A2F01AB30282B7
MD5 SHA1 SHA512 TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 3b4e8a7493e47d173ac97c8bc0294a499febe7d1a689bf45257065c984c376ef
MD5 87fabd1f7b57e5a4f0e06d609dd9aa90
SHA1 948952c861e60c008bcfdb7eb34e4423fd30153e
SHA512 d8e5a27187e4309fe0d17ca3481d5c4acb823eaa4287eccca79411d23fb952de9557ca0e6872556c495e66447520c3b5bd769447983df82eb30de94234d14ac0
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7p:fwUQC5VwBIiElEd2K57P7p
TLSH
T12BB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7aa2bb81937fdcdafd5d33143cfe61093f5233469b36757de171e12cc0c6215f
MD5 6503f091cfa7258a2190ed65490b1bdd
SHA1 d722a7fd3cd82ec30e4846b9511ec1c22b9dacfd
SHA512 5f2a6a53348e4e1b7810b77abe2dd4c597357ba365cf029977f0efbbb203eab9dfb7771c9edb3561b6d22c8b7354c34611905cfbaab36c763b9d3334beb40b4c
TLSH
T1BAD012223A48F441DB4942709102CF453B26146024579A06E259D86D58B51D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3eacdfce7dc5d437b4447cf27ab297d2d39d13a22d53487691f060212cddb6b2
MD5 77a76342e47369b91c295856d0d136ad
SHA1 bac334fe99bd25a56aeb5cf09b273fd394730180
SHA512 5594ac61907f341c5e00a7e62a64d33fde684c855aa9b27d0c2756986334fbea5ebaf894d13dfedefe84d1f7ad65aaa17fb6b204714ed08460f06e4ed17ce733
TLSH
T1AAD012223A48F441DB4942709103CF453B26146024579A06E259D86D58B41D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 adeb0211bd1098c5af14135dd09efd1ca806a01a5c067324b11c1cb4f10bb4db
MD5 72d482bb4b124637e996a9b4391f8ab4
SHA1 d16ec2f42148c182ea97b1740ddf2f5745c3fa77
SHA512 f502b4989f3fe9296b6bd22a3f4a7fa1999c9317ebbd90309103803e84b2da50b5e8e1de1546652c56e437729e9aee564a37492623aa548b8da79c7f005115f2
TLSH
T1016109390D22C887E3B217B1D0E23FFC75F991B50A232DC9018499BE9A0FF63A139504
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a7e0b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a7e0b.TMP
Size 3KB
SHA256 89bd4d1bd0e41f849c234b731e27c6fa6e98357c370218390733dbdf0d839198
MD5 f08e35ef9f4c91a79259d3fa18990353
SHA1 1a3e55f009059d562c6cbd8db4740c2bcceb049c
SHA512 da6dde19d51b930a70c556a4127d35bba79fea4db19a594d5684e3342cbfae03b8e10a8d1005f8515c1399a4357f1953de582de7e0e8a3aba971fc09305ee46d
TLSH
T1F06109380D22C886E3B117B1D0E23FFC79F991B50E632DC9018499BE9A0FF63A139504
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 f97eed7175fdef9db27ae97466bacb267d1d6d37afd9a8b004052f5a3772921b
MD5 f716438af1874ee0ac695b0345bc48ac
SHA1 67c190ba4874176449b75a463580c806f5ef9755
SHA512 ed6e292abbda42f521ee6e49aa4ebbb5621d18dc813be3124a412bc62e1ec0e2ec0433539e812ef9c0c46393db4c0dcb260a2679e4f6f3ea6fb29d48f009f6ef
SSDEEP 192:sxZwRSyM/jK1Ml8MjN/fos89/xf3b6Idpd8HW6+WNGYL1mPIg4J:sxZwE7N/fos8pt3nOHbG9c
TLSH
T13952E9166A345977CCDBD20DFA55BF53D6F81472A2900D489AFCCA0C04E6AED2217C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 ab88a9c7ddd4c8faaa64c98a1dc1eefc056e85792971d349fb5649cb5aac5043
MD5 1aee2ebe1d8d211f0ac963cb48b88ada
SHA1 3bb4c755cbdba08b5be99749930bfe4ea06d905b
SHA512 a84d7b0c027ca83f4b973d9d73db7c2bdd26c350d3024a2a21bf1eabc0133a452d806667e5351ef3897dd45c3118e8b0518a32d5997fed9130cd5fc9b23b3003
SSDEEP 768:42s6pw07pLuLXx1WvxzWj8F1+UoAYDCx9Tuqh0VfUC9xbog/OVFywILlWwJN3roy:42s6pw4EXx1WvxzWju1jaoywILIsNkk1
TLSH
T175F20D3B6C0CCB7E4F804E9CEC2A7E9A6DE8018B9698C99447F9440C03C66EF55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 4fba0956ae8765b5648d8f86e5c46b3271ab0a17a2ea76b6c321bbb6e429e1d3
MD5 477e3c3f411f2e74392625bc883a723c
SHA1 65fcffe792885d744e528314c62505c2b12606f8
SHA512 a4cacaf353ebc37169a3a53786d453167fabea410951fc7775719dbe8cccc55eff69076672e34e3a1b3b41bf6a7030535bbe23ad1376519f93c5d9a65ecbc936
SSDEEP 96:KUAAKtePbJSKqoCe589p7nTkjn2PdhkKlBdzkRJpW7Y:iieBe589p7nTqn2lhFBdz6JpW7Y
TLSH
T115A1B35236B703123C3E2918E2A487268B82BA537428E92F779C50755E67E384DFC5ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 b5acaba6a5d7bfedbb6f842c04bf658eac6c27dc533d38afb5260ca68eb13fb1
MD5 3ecb6c7c568353788ae71871921ba4ce
SHA1 61e7b32078b55245ef909f202e914a1fec932002
SHA512 2c6031b3f062bb0fcf511cd8ace9c38d2e4a4343b1016045921d60d4149fec652945e00b29d45b88749f68bd980a7f0ce2b1b7472c2505ee4ef3b90c6c81ddfb
SSDEEP 384:nLtNnNnb9dsN6mZ8jwJa9wvzJrqaeSIiU16pL:LjZbb4v88hxeSIiW6pL
TLSH
T111927C3268389C6B99F7A454F65B37632FB511B79C882F84E5DC4F0D01EB69C2346C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 dea4f3b41b96ce6423426975f7058c49f5afa41226eb37b430debe3dcc376c74
MD5 5f2f638ca645a50952ebfe43eaec1768
SHA1 4de71eace49876f8ee5e9cb65d8b68c0503a0cd6
SHA512 ef23d7b70fd437095aea55d9a5bdfc2604698f775307c9d4b94c37b7c8784a8dc7cc38b35fae3535ae4c0b75d3844e4519639f86f15df4b44296eed098176923
SSDEEP 192:qONL6O7+3hQmiUyQMGttb0j3bvgGeN6U6:qONL61gGt9wXewU6
TLSH
T12F02E8357C6C6CBB8EF2AD45F98727235FA5117BA9A62F40D6E81E0C00D766C2343826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 6d714e1f92c95792f382ec005dcad7fe5510c5850c4549ede711cdfa1bc9b53f
MD5 433536d355b198df1f7eca8d9299188c
SHA1 178f371a9cdfc69548679c053e3a73b83081285a
SHA512 ee832e521d6c349b97af72a69b08720991270b3849483cc11e7e1c1cc28d36246875acc273a0fafc75bb330fa6dbd90be4841c5d2ad4e89fdf965aba24d38f5a
SSDEEP 192:qONr6O7+33QmiUymMrttb0j3bsuF0SJrqOGcNe//D3WU6:qONr6LYrt9wvzJrqgeSU6
TLSH
T1F9121975686C9C6759E3E045F9CB23636FB511B7EC8A6F40E1E84E0C00EB66C374AC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 dcf3439f31a296f8b472b8f425d2af74b58b85ebc1b0f6480ad97c9de2741d73
MD5 ecc3af30acbd7292304bcb6726e0251f
SHA1 d95582a6707a68ae509aa9f853b13deb060a4590
SHA512 fb5733d0a0163cf780edd161153ff79c0e6b76f4e03d1a0dc31860845c464712bbd4393e96fe3f0a0e822e6678cfc5f470f0837aef07b1a05d639026a4fe672f
TLSH
T1FD412968B6ED1148B3B77F56AFF6B8AE447E79362E06C49D10010E4E4B62A40CC71B37
MD5 SHA1 SHA512 TLSH

Submit Download

AppCache134231932473947527.txt

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache134231932473947527.txt
Size 77KB
SHA256 1b451027feb48152eb4f9221d1213ce0d164d090741c25087f02fcaac496f2e9
MD5 7ebff744ecead16b3c5ec5ab421e3cb8
SHA1 9e320aa5d11ef9115557e398681971074ebaceff
SHA512 6e4510909ee25785397ea4604c85e7416539be55ded7a3822bbf47f16dc48161a910b04be4fcb57c8dbccdf2d3673832b43b113a03cac0d519834e02780ed5fd
SSDEEP 1536:LfniGisVyNU5xh9eUS0Sztg+OJE88obdwVkWuAAiRpz:7zoUCNW+KGFuzg
TLSH
T18F7302EA95B244F6FB739390BD72F4AE1ED450283198D90A1F4CB30D0188DA19F56D3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppCache134231954698499680.txt

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache134231954698499680.txt
Size 84KB
SHA256 61707d95cbb5621a5bb04bb0ab38c1abe94dec3fb12228c0539cff855e218d82
MD5 ce7165501de9cc04dc66c77d255302f4
SHA1 d87b08f1b820aad8853da06ef9f43a69f2709823
SHA512 2abc29eade6d6dcdd8a2c8b8a2e810970168350ce6f304246d78114ec8b5592919f40619bcc9070ba27d8a7c320ac2e00aae21cd78428bb2215522880f78da58
SSDEEP 1536:epne5bsD5zfG+wqOI6MV0jfy6Jef2ziDQH1BeJAK7+91sNepULxaHhH:gne5Y/wqWMKbaOziDQH1KK9mepULmhH
TLSH
T1018312A0A910345CC416643993275C33F56EBFE2AF922AE4BBFD0195FA6411F41BB327
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

03b16281-85ee-400b-bdac-a123a034c19e.tmp

Path C:\Users\Admin\AppData\Local\Temp\03b16281-85ee-400b-bdac-a123a034c19e.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

d19d9e3f-e51e-487c-98ff-a7a8c40c6465.tmp

Path C:\Users\Admin\AppData\Local\Temp\d19d9e3f-e51e-487c-98ff-a7a8c40c6465.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1a87a117-4d82-4f0b-8266-68c698e7c232.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1388_1727147625\1a87a117-4d82-4f0b-8266-68c698e7c232.tmp
Size 147KB
SHA256 d766e75ceffe993aa1dadd5619b24043a0ebe9a9689a6796d19d88bf952683d4
MD5 a9f7675ff091bb15c88909424bab4a39
SHA1 90f753d8d7e4397de0f49631fcd9222a7f59148c
SHA512 ff1f89fb04ae9c9a4c6cf6b1475f5a77f1c4f90829acda95cb39889b6b15c3b4f0b3b822a668f8ec8520b002cc90dd397cc26d314ac8fd5f3e2c9826bd458df5
SSDEEP 3072:Ph3iICVe1DvTtr/3tOpPu8LdKBTJyU4AshzWnD7UVDvuZE4tkGL:PgTVWvTZPghwln0AD7UV8Eeky
TLSH
T12BE3E01D29E2846EC82B24F4BA4A718FC71ECF07910BE40F25D984A55C7474E17E2EED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1388_281998612\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kfgkpjc.exe

Path C:\Users\Admin\AppData\Roaming\kfgkpjc.exe
Size 876KB
SHA256 1cf4c72d3533ea0af0366ad3fbbaf95a5e55692ec91e459f3274ad3f9fbc8643
MD5 1e23a67e18a14166fcb228b29e17fe74
SHA1 5b597ab5ff9a0a5eddef951900103a119742c4f5
SHA512 f645c19c4f55c50ef51918418612a8994054a4e19a33ac1e4a1017f6844454bfe7db00c14161191988d597cce7d3db0e4cbe640a5dcd361e705f6930e58508a3
SSDEEP 12288:j3zN+izByRbacF8XrHQC1qkjIjUG49+nTVSYzHWyRbacF8XrHQC1qkjIjUG49+nq:DzV0WT3VPGm+nZSYzHWT3VPGm+nZSkS
TLSH
T1B6159E196F33B561D940DAF710176EE7CFACAF006D2BD019252F96299C673A38E8D831
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3152-19-0x0000000000400000-0x0000000000614000-memory.dmp

Download

memory/3152-11-0x0000000000400000-0x0000000000614000-memory.dmp

Download

memory/3656-1-0x00000000006B0000-0x00000000006B3000-memory.dmp

Download

memory/3656-0-0x00000000006B0000-0x00000000006B3000-memory.dmp

Download

memory/3656-4-0x00000000006B0000-0x00000000006B3000-memory.dmp

Download

memory/4704-7833-0x0000000000400000-0x0000000000486000-memory.dmp

Download

memory/4704-7706-0x0000000000400000-0x0000000000486000-memory.dmp

Download

memory/4980-5-0x0000000000400000-0x0000000000486000-memory.dmp

Download

memory/4980-12-0x0000000000400000-0x0000000000486000-memory.dmp

Download

memory/4980-6-0x0000000000400000-0x0000000000486000-memory.dmp

Download

memory/4980-3-0x0000000000400000-0x0000000000486000-memory.dmp

Download

memory/4980-2-0x0000000000400000-0x0000000000486000-memory.dmp

Download

memory/5072-12418-0x0000000000400000-0x0000000000486000-memory.dmp

Download

memory/5072-17-0x0000000000400000-0x0000000000486000-memory.dmp

Download

memory/5072-18-0x0000000000400000-0x0000000000486000-memory.dmp

Download

memory/5072-20-0x0000000000400000-0x0000000000486000-memory.dmp

Download

memory/5072-22-0x0000000000400000-0x0000000000486000-memory.dmp

Download

memory/5072-16-0x0000000000400000-0x0000000000486000-memory.dmp

Download

memory/5072-25-0x0000000000400000-0x0000000000486000-memory.dmp

Download

memory/5072-1001-0x0000000000400000-0x0000000000486000-memory.dmp

Download

memory/5072-1002-0x0000000000400000-0x0000000000486000-memory.dmp

Download

memory/5072-3958-0x0000000000400000-0x0000000000486000-memory.dmp

Download

memory/5072-12419-0x0000000000400000-0x0000000000486000-memory.dmp

Download

memory/5072-7148-0x0000000000400000-0x0000000000486000-memory.dmp

Download

memory/5072-12410-0x0000000000400000-0x0000000000486000-memory.dmp

Download

memory/5072-12409-0x0000000000400000-0x0000000000486000-memory.dmp

Download

memory/5072-10507-0x0000000000400000-0x0000000000486000-memory.dmp

Download

memory/5072-6223-0x0000000000400000-0x0000000000486000-memory.dmp

Download