ac38fb42adffa1445836f20becfa4d0091b2170936db36ac1bb0cd18a1160027

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
06/06/2026, 22:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-06_55b07f7f1759b457bd3c5ae05d774a95_amadey_darkgate_elex_smoke-loader_teslacrypt.exe
Size 254KB
Sample260606-2af7dadv21
SHA256 ac38fb42adffa1445836f20becfa4d0091b2170936db36ac1bb0cd18a1160027
MD5 55b07f7f1759b457bd3c5ae05d774a95
SHA1 d8c83632cb45b0936b328d34fbc5df14a521a052
SHA512 4e4123ec6d8f70199a2c1b42a7ac605f578aaf6775685ce4a1c8a77f3e9ce0d3bb3b2ca6a8b7d715bc9c3988a06281f83314b46a4431058d4b96b167ccacf81b
SSDEEP 3072:Z6BPlzCGAAX0Tt/pjJIn82zwAB/qIgkVpvIFPrJP2G8/Ev99DDyJGjuQeDTRpb8m:ynyoqIfAlR2H/Ev9FeGjsXb8
TLSH
T145449D026613D072D4BB04729BACEBB2A4A95D34472D91CBBB406EB41E35BE6777C343
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution impact persistence ransomware spyware stealer

Malware Config

Extracted

Path

C:\Program Files\7-Zip\Lang\_ReCoVeRy_+ygnye.txt

Ransom Note

NOT YOUR LANGUAGE? USE https://translate.google.com What happened to your files ? All of your files were protected by a strong encryption with RSA4096 More information about the encryption keys using RSA4096 can be found here: http://en.wikipedia.org/wiki/RSA_(cryptosystem) How did this happen ? !!! Specially for your PC was generated personal RSA4096 Key , both public and private. !!! ALL YOUR FILES were encrypted with the public key, which has been transferred to your computer via the Internet. !!! Decrypting of your files is only possible with the help of the private key and decrypt program , which is on our Secret Server What do I do ? So , there are two ways you can choose: wait for a miracle and get your price doubled , or start obtaining BITCOIN NOW !!!!! , and restore your data easy way If You have really valuable data, you better not waste your time, because there is no other way to get your files , except make a payment For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below * http://rbg4hfbilrf7to452p89hrfq.boonmower.com/7159D32A6568A65 * http://irhng84nfaslbv243ljtblwqjrb.pinnafaon.at/7159D32A6568A65 * http://t54ndnku456ngkwsudqer.wallymac.com/7159D32A6568A65 If for some reasons the addresses are not available, follow these steps * Download and install tor-browser: http://www.torproject.org/projects/torbrowser.html.en * After a successful installation, run the browser * Type in the address bar: xlowfznrg4wf7dli.onion/7159D32A6568A65 * Follow the instructions on the site IMPORTANT INFORMATION Your personal pages http://rbg4hfbilrf7to452p89hrfq.boonmower.com/7159D32A6568A65 http://irhng84nfaslbv243ljtblwqjrb.pinnafaon.at/7159D32A6568A65 http://t54ndnku456ngkwsudqer.wallymac.com/7159D32A6568A65

URLs

http://rbg4hfbilrf7to452p89hrfq.boonmower.com/7159D32A6568A65
http://irhng84nfaslbv243ljtblwqjrb.pinnafaon.at/7159D32A6568A65
http://t54ndnku456ngkwsudqer.wallymac.com/7159D32A6568A65
http://xlowfznrg4wf7dli.onion/7159D32A6568A65

Signatures

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047
Renames multiple (980) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	2026-06-06_55b07f7f1759b457bd3c5ae05d774a95_amadey_darkgate_elex_smoke-loader_teslacrypt.exe
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	tktgbpctoumq.exe

Drops startup file 6 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\_ReCoVeRy_+ygnye.html	tktgbpctoumq.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_ReCoVeRy_+ygnye.png	tktgbpctoumq.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_ReCoVeRy_+ygnye.txt	tktgbpctoumq.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_ReCoVeRy_+ygnye.html	tktgbpctoumq.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\_ReCoVeRy_+ygnye.png	tktgbpctoumq.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\_ReCoVeRy_+ygnye.txt	tktgbpctoumq.exe

Executes dropped EXE 1 IoCs

pid	Process
4164	tktgbpctoumq.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\aroinics_svc = "C:\\Windows\\SYSTEM32\\CMD.EXE /C START C:\\Windows\\tktgbpctoumq.exe"	tktgbpctoumq.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Edge.GameAssist_1.0.3456.0_x64__8wekyb3d8bbwe\AppxMetadata\_ReCoVeRy_+ygnye.html	tktgbpctoumq.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\sw-KE\View3d\_ReCoVeRy_+ygnye.html	tktgbpctoumq.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteWideTile.scale-100.png	tktgbpctoumq.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\_ReCoVeRy_+ygnye.png	tktgbpctoumq.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.34.28001.0_x64__8wekyb3d8bbwe\Assets\_ReCoVeRy_+ygnye.png	tktgbpctoumq.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\en-US\_ReCoVeRy_+ygnye.txt	tktgbpctoumq.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\sl.pak	tktgbpctoumq.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\_ReCoVeRy_+ygnye.png	tktgbpctoumq.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Home\contrast-black\_ReCoVeRy_+ygnye.html	tktgbpctoumq.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Images\Stickers\_ReCoVeRy_+ygnye.html	tktgbpctoumq.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Images\_ReCoVeRy_+ygnye.html	tktgbpctoumq.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteMediumTile.scale-200.png	tktgbpctoumq.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Transit\contrast-white\_ReCoVeRy_+ygnye.txt	tktgbpctoumq.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubAppList.targetsize-60.png	tktgbpctoumq.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-40_altform-unplated_contrast-white.png	tktgbpctoumq.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxMailBadge.scale-400.png	tktgbpctoumq.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\en-US\_ReCoVeRy_+ygnye.html	tktgbpctoumq.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Windows.Photos_2019.19071.12548.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\ShareProvider_CopyLink24x24.scale-100.png	tktgbpctoumq.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Assets\Images\contrast-standard\theme-light\_ReCoVeRy_+ygnye.txt	tktgbpctoumq.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Edge.GameAssist_1.0.3456.0_x64__8wekyb3d8bbwe\Assets\UnknownErrorIllustration.theme-light.png	tktgbpctoumq.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe\Assets\logo.scale-200_contrast-white.png	tktgbpctoumq.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\ja-JP\View3d\_ReCoVeRy_+ygnye.html	tktgbpctoumq.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-black\AppList.scale-100_contrast-black.png	tktgbpctoumq.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxMailSplashLogo.scale-100.png	tktgbpctoumq.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\_ReCoVeRy_+ygnye.html	tktgbpctoumq.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Bibliography\_ReCoVeRy_+ygnye.txt	tktgbpctoumq.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ms\_ReCoVeRy_+ygnye.txt	tktgbpctoumq.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedStoreLogo.scale-100_contrast-black.png	tktgbpctoumq.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\_ReCoVeRy_+ygnye.html	tktgbpctoumq.exe
File opened for modification	C:\Program Files\Common Files\System\ado\de-DE\_ReCoVeRy_+ygnye.txt	tktgbpctoumq.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppPackageSmallTile.scale-400_contrast-black.png	tktgbpctoumq.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_x64__8wekyb3d8bbwe\Assets\NewNotePlaceholder-dark.png	tktgbpctoumq.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNotePageWideTile.scale-125.png	tktgbpctoumq.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteReplay_white.png	tktgbpctoumq.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\CardUIBkg.scale-150.HCBlack.png	tktgbpctoumq.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Sort\_ReCoVeRy_+ygnye.png	tktgbpctoumq.exe
File opened for modification	C:\Program Files\MSBuild\_ReCoVeRy_+ygnye.png	tktgbpctoumq.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.People_10.1902.633.0_neutral_split.scale-125_8wekyb3d8bbwe\_ReCoVeRy_+ygnye.html	tktgbpctoumq.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ZuneVideo_10.19071.19011.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\Movie-TVStoreLogo.scale-125_contrast-white.png	tktgbpctoumq.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\_ReCoVeRy_+ygnye.png	tktgbpctoumq.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\183.png	tktgbpctoumq.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_2019.904.1644.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\_ReCoVeRy_+ygnye.html	tktgbpctoumq.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-256_contrast-black.png	tktgbpctoumq.exe
File opened for modification	C:\Program Files\Java\_ReCoVeRy_+ygnye.png	tktgbpctoumq.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\_ReCoVeRy_+ygnye.html	tktgbpctoumq.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\_ReCoVeRy_+ygnye.html	tktgbpctoumq.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Microsoft.Membership.MeControl\Assets\_ReCoVeRy_+ygnye.html	tktgbpctoumq.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\contrast-black\MixedRealityPortalAppList.targetsize-48_altform-unplated_contrast-black.png	tktgbpctoumq.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxA-Advanced-Light.scale-200.png	tktgbpctoumq.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Car\RTL\contrast-black\_ReCoVeRy_+ygnye.html	tktgbpctoumq.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\_ReCoVeRy_+ygnye.txt	tktgbpctoumq.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\AppPackageAppList.targetsize-80_altform-unplated.png	tktgbpctoumq.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\zh-TW\_ReCoVeRy_+ygnye.png	tktgbpctoumq.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_neutral_~_8wekyb3d8bbwe\microsoft.system.package.metadata\_ReCoVeRy_+ygnye.png	tktgbpctoumq.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxCalendarAppList.scale-150.png	tktgbpctoumq.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\IC_WelcomeBanner.scale-400.png	tktgbpctoumq.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\contrast-white\_ReCoVeRy_+ygnye.html	tktgbpctoumq.exe
File opened for modification	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\_ReCoVeRy_+ygnye.png	tktgbpctoumq.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\br\_ReCoVeRy_+ygnye.txt	tktgbpctoumq.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsCalculator_10.1906.55.0_neutral_split.scale-125_8wekyb3d8bbwe\microsoft.system.package.metadata\_ReCoVeRy_+ygnye.txt	tktgbpctoumq.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\210x173\75.jpg	tktgbpctoumq.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\it-IT\_ReCoVeRy_+ygnye.txt	tktgbpctoumq.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteAppList.targetsize-16_altform-unplated.png	tktgbpctoumq.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.contrast-white_targetsize-24.png	tktgbpctoumq.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\tktgbpctoumq.exe	2026-06-06_55b07f7f1759b457bd3c5ae05d774a95_amadey_darkgate_elex_smoke-loader_teslacrypt.exe
File opened for modification	C:\Windows\tktgbpctoumq.exe	2026-06-06_55b07f7f1759b457bd3c5ae05d774a95_amadey_darkgate_elex_smoke-loader_teslacrypt.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tktgbpctoumq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NOTEPAD.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-06_55b07f7f1759b457bd3c5ae05d774a95_amadey_darkgate_elex_smoke-loader_teslacrypt.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2100	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134252582083928750"	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings	tktgbpctoumq.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-889581200-2041691093-2048517887-1000\{90A2E84B-6AD3-4431-B723-0689EEAFD4A7}	msedge.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
3484	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4164	tktgbpctoumq.exe
4164	tktgbpctoumq.exe
4164	tktgbpctoumq.exe
4164	tktgbpctoumq.exe
4164	tktgbpctoumq.exe
4164	tktgbpctoumq.exe
4164	tktgbpctoumq.exe
4164	tktgbpctoumq.exe
4164	tktgbpctoumq.exe
4164	tktgbpctoumq.exe
4164	tktgbpctoumq.exe
4164	tktgbpctoumq.exe
4164	tktgbpctoumq.exe
4164	tktgbpctoumq.exe
4164	tktgbpctoumq.exe
4164	tktgbpctoumq.exe
4164	tktgbpctoumq.exe
4164	tktgbpctoumq.exe
4164	tktgbpctoumq.exe
4164	tktgbpctoumq.exe
4164	tktgbpctoumq.exe
4164	tktgbpctoumq.exe
4164	tktgbpctoumq.exe
4164	tktgbpctoumq.exe
4164	tktgbpctoumq.exe
4164	tktgbpctoumq.exe
4164	tktgbpctoumq.exe
4164	tktgbpctoumq.exe
4164	tktgbpctoumq.exe
4164	tktgbpctoumq.exe
4164	tktgbpctoumq.exe
4164	tktgbpctoumq.exe
4164	tktgbpctoumq.exe
4164	tktgbpctoumq.exe
4164	tktgbpctoumq.exe
4164	tktgbpctoumq.exe
4164	tktgbpctoumq.exe
4164	tktgbpctoumq.exe
4164	tktgbpctoumq.exe
4164	tktgbpctoumq.exe
4164	tktgbpctoumq.exe
4164	tktgbpctoumq.exe
4164	tktgbpctoumq.exe
4164	tktgbpctoumq.exe
4164	tktgbpctoumq.exe
4164	tktgbpctoumq.exe
4164	tktgbpctoumq.exe
4164	tktgbpctoumq.exe
4164	tktgbpctoumq.exe
4164	tktgbpctoumq.exe
4164	tktgbpctoumq.exe
4164	tktgbpctoumq.exe
4164	tktgbpctoumq.exe
4164	tktgbpctoumq.exe
4164	tktgbpctoumq.exe
4164	tktgbpctoumq.exe
4164	tktgbpctoumq.exe
4164	tktgbpctoumq.exe
4164	tktgbpctoumq.exe
4164	tktgbpctoumq.exe
4164	tktgbpctoumq.exe
4164	tktgbpctoumq.exe
4164	tktgbpctoumq.exe
4164	tktgbpctoumq.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4976	2026-06-06_55b07f7f1759b457bd3c5ae05d774a95_amadey_darkgate_elex_smoke-loader_teslacrypt.exe
Token: SeDebugPrivilege	4164	tktgbpctoumq.exe
Token: SeIncreaseQuotaPrivilege	3172	WMIC.exe
Token: SeSecurityPrivilege	3172	WMIC.exe
Token: SeTakeOwnershipPrivilege	3172	WMIC.exe
Token: SeLoadDriverPrivilege	3172	WMIC.exe
Token: SeSystemProfilePrivilege	3172	WMIC.exe
Token: SeSystemtimePrivilege	3172	WMIC.exe
Token: SeProfSingleProcessPrivilege	3172	WMIC.exe
Token: SeIncBasePriorityPrivilege	3172	WMIC.exe
Token: SeCreatePagefilePrivilege	3172	WMIC.exe
Token: SeBackupPrivilege	3172	WMIC.exe
Token: SeRestorePrivilege	3172	WMIC.exe
Token: SeShutdownPrivilege	3172	WMIC.exe
Token: SeDebugPrivilege	3172	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3172	WMIC.exe
Token: SeRemoteShutdownPrivilege	3172	WMIC.exe
Token: SeUndockPrivilege	3172	WMIC.exe
Token: SeManageVolumePrivilege	3172	WMIC.exe
Token: 33	3172	WMIC.exe
Token: 34	3172	WMIC.exe
Token: 35	3172	WMIC.exe
Token: 36	3172	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3172	WMIC.exe
Token: SeSecurityPrivilege	3172	WMIC.exe
Token: SeTakeOwnershipPrivilege	3172	WMIC.exe
Token: SeLoadDriverPrivilege	3172	WMIC.exe
Token: SeSystemProfilePrivilege	3172	WMIC.exe
Token: SeSystemtimePrivilege	3172	WMIC.exe
Token: SeProfSingleProcessPrivilege	3172	WMIC.exe
Token: SeIncBasePriorityPrivilege	3172	WMIC.exe
Token: SeCreatePagefilePrivilege	3172	WMIC.exe
Token: SeBackupPrivilege	3172	WMIC.exe
Token: SeRestorePrivilege	3172	WMIC.exe
Token: SeShutdownPrivilege	3172	WMIC.exe
Token: SeDebugPrivilege	3172	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3172	WMIC.exe
Token: SeRemoteShutdownPrivilege	3172	WMIC.exe
Token: SeUndockPrivilege	3172	WMIC.exe
Token: SeManageVolumePrivilege	3172	WMIC.exe
Token: 33	3172	WMIC.exe
Token: 34	3172	WMIC.exe
Token: 35	3172	WMIC.exe
Token: 36	3172	WMIC.exe
Token: SeBackupPrivilege	628	vssvc.exe
Token: SeRestorePrivilege	628	vssvc.exe
Token: SeAuditPrivilege	628	vssvc.exe
Token: SeIncreaseQuotaPrivilege	3336	WMIC.exe
Token: SeSecurityPrivilege	3336	WMIC.exe
Token: SeTakeOwnershipPrivilege	3336	WMIC.exe
Token: SeLoadDriverPrivilege	3336	WMIC.exe
Token: SeSystemProfilePrivilege	3336	WMIC.exe
Token: SeSystemtimePrivilege	3336	WMIC.exe
Token: SeProfSingleProcessPrivilege	3336	WMIC.exe
Token: SeIncBasePriorityPrivilege	3336	WMIC.exe
Token: SeCreatePagefilePrivilege	3336	WMIC.exe
Token: SeBackupPrivilege	3336	WMIC.exe
Token: SeRestorePrivilege	3336	WMIC.exe
Token: SeShutdownPrivilege	3336	WMIC.exe
Token: SeDebugPrivilege	3336	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3336	WMIC.exe
Token: SeRemoteShutdownPrivilege	3336	WMIC.exe
Token: SeUndockPrivilege	3336	WMIC.exe
Token: SeManageVolumePrivilege	3336	WMIC.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3384	msedge.exe
3384	msedge.exe

Suspicious use of WriteProcessMemory 54 IoCs

description	pid	Process	procid_target
PID 4976 wrote to memory of 4164	4976	2026-06-06_55b07f7f1759b457bd3c5ae05d774a95_amadey_darkgate_elex_smoke-loader_teslacrypt.exe	88
PID 4976 wrote to memory of 2640	4976	2026-06-06_55b07f7f1759b457bd3c5ae05d774a95_amadey_darkgate_elex_smoke-loader_teslacrypt.exe	89
PID 4164 wrote to memory of 3172	4164	tktgbpctoumq.exe	91
PID 4164 wrote to memory of 3484	4164	tktgbpctoumq.exe	116
PID 4164 wrote to memory of 3384	4164	tktgbpctoumq.exe	117
PID 4164 wrote to memory of 3336	4164	tktgbpctoumq.exe	118
PID 3384 wrote to memory of 4880	3384	msedge.exe	120
PID 3384 wrote to memory of 2100	3384	msedge.exe	122
PID 3384 wrote to memory of 2576	3384	msedge.exe	123
PID 3384 wrote to memory of 4668	3384	msedge.exe	124
PID 3384 wrote to memory of 2576	3384	msedge.exe	123
PID 3384 wrote to memory of 4668	3384	msedge.exe	124
PID 3384 wrote to memory of 4668	3384	msedge.exe	124
PID 3384 wrote to memory of 1548	3384	msedge.exe	134
PID 3384 wrote to memory of 1112	3384	msedge.exe	126
PID 3384 wrote to memory of 1548	3384	msedge.exe	134
PID 3384 wrote to memory of 1548	3384	msedge.exe	134
PID 3384 wrote to memory of 1112	3384	msedge.exe	126
PID 3384 wrote to memory of 1112	3384	msedge.exe	126
PID 3384 wrote to memory of 3556	3384	msedge.exe	127
PID 3384 wrote to memory of 3556	3384	msedge.exe	127
PID 3384 wrote to memory of 3556	3384	msedge.exe	127
PID 3384 wrote to memory of 3568	3384	msedge.exe	128
PID 3384 wrote to memory of 3568	3384	msedge.exe	128
PID 3384 wrote to memory of 3568	3384	msedge.exe	128
PID 3384 wrote to memory of 2196	3384	msedge.exe	130
PID 3384 wrote to memory of 2196	3384	msedge.exe	130
PID 4164 wrote to memory of 3968	4164	tktgbpctoumq.exe	141
PID 3384 wrote to memory of 1548	3384	msedge.exe	134
PID 3384 wrote to memory of 1548	3384	msedge.exe	134
PID 3384 wrote to memory of 2440	3384	msedge.exe	136
PID 3384 wrote to memory of 4764	3384	msedge.exe	137
PID 3384 wrote to memory of 2440	3384	msedge.exe	136
PID 3384 wrote to memory of 4764	3384	msedge.exe	137
PID 3384 wrote to memory of 276	3384	msedge.exe	139
PID 3384 wrote to memory of 2572	3384	msedge.exe	140
PID 3384 wrote to memory of 2572	3384	msedge.exe	140
PID 3384 wrote to memory of 3968	3384	msedge.exe	141
PID 3384 wrote to memory of 3968	3384	msedge.exe	141
PID 3384 wrote to memory of 568	3384	msedge.exe	142
PID 3384 wrote to memory of 568	3384	msedge.exe	142
PID 3384 wrote to memory of 4276	3384	msedge.exe	143
PID 3384 wrote to memory of 4276	3384	msedge.exe	143
PID 3384 wrote to memory of 5152	3384	msedge.exe	144
PID 3384 wrote to memory of 5152	3384	msedge.exe	144
PID 3384 wrote to memory of 5004	3384	msedge.exe	147
PID 3384 wrote to memory of 3788	3384	msedge.exe	148
PID 3384 wrote to memory of 568	3384	msedge.exe	149
PID 3384 wrote to memory of 5700	3384	msedge.exe	151
PID 3384 wrote to memory of 5700	3384	msedge.exe	151
PID 3384 wrote to memory of 5900	3384	msedge.exe	155
PID 3384 wrote to memory of 5900	3384	msedge.exe	155
PID 3384 wrote to memory of 3988	3384	msedge.exe	156
PID 3384 wrote to memory of 3988	3384	msedge.exe	156

System policy modification 1 TTPs 2 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	tktgbpctoumq.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1"	tktgbpctoumq.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-06-06_55b07f7f1759b457bd3c5ae05d774a95_amadey_darkgate_elex_smoke-loader_teslacrypt.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-06_55b07f7f1759b457bd3c5ae05d774a95_amadey_darkgate_elex_smoke-loader_teslacrypt.exe"
1⤵
- Checks computer location settings
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4976
- C:\Windows\tktgbpctoumq.exe
  C:\Windows\tktgbpctoumq.exe
  2⤵
  - Checks computer location settings
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:4164
- - C:\Windows\System32\wbem\WMIC.exe
    "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /nointeractive
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3172
- - C:\Windows\SysWOW64\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\_ReCoVeRy_.TXT
    3⤵
    - System Location Discovery: System Language Discovery
    - Opens file in notepad (likely ransom note)
    PID:3484
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\_ReCoVeRy_.HTM
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3384
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c8,0x2cc,0x2d0,0x2c4,0x35c,0x7ffca861c188,0x7ffca861c194,0x7ffca861c1a0
      4⤵
      PID:4880
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1808,i,11015463375984088088,845164357251294743,524288 --field-trial-handle=2660,i,13179874233902329661,6450700933448845938,262144 --variations-seed-version --mojo-platform-channel-handle=2688 /prefetch:3
      4⤵
      System Time Discovery
      PID:2100
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2312,i,12611628779035120549,5607629829022244214,524288 --field-trial-handle=2660,i,13179874233902329661,6450700933448845938,262144 --variations-seed-version --mojo-platform-channel-handle=2696 /prefetch:8
      4⤵
      PID:2576
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1648,i,4408967343410010238,15580545238403769499,262144 --field-trial-handle=2660,i,13179874233902329661,6450700933448845938,262144 --variations-seed-version --mojo-platform-channel-handle=2656 /prefetch:2
      4⤵
      PID:4668
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3460,i,14688987922003911899,14942288692459838197,2097152 --field-trial-handle=2660,i,13179874233902329661,6450700933448845938,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
      4⤵
      PID:1548
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3464,i,4531149374659721014,1492235647573948282,2097152 --field-trial-handle=2660,i,13179874233902329661,6450700933448845938,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
      4⤵
      PID:1112
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4172,i,12941423838037112076,15985270032857257990,2097152 --field-trial-handle=2660,i,13179874233902329661,6450700933448845938,262144 --variations-seed-version --mojo-platform-channel-handle=4196 /prefetch:1
      4⤵
      PID:3556
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4176,i,259790511294776797,4524554956066883795,2097152 --field-trial-handle=2660,i,13179874233902329661,6450700933448845938,262144 --variations-seed-version --mojo-platform-channel-handle=4200 /prefetch:2
      4⤵
      PID:3568
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5104,i,14097469457501470738,4354975149827297874,524288 --field-trial-handle=2660,i,13179874233902329661,6450700933448845938,262144 --variations-seed-version --mojo-platform-channel-handle=5080 /prefetch:8
      4⤵
      PID:2196
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5116,i,10019026691291980440,14360406386313649214,524288 --field-trial-handle=2660,i,13179874233902329661,6450700933448845938,262144 --variations-seed-version --mojo-platform-channel-handle=5272 /prefetch:8
      4⤵
      PID:1548
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5292,i,15505146191012612040,17955638785105643662,524288 --field-trial-handle=2660,i,13179874233902329661,6450700933448845938,262144 --variations-seed-version --mojo-platform-channel-handle=5344 /prefetch:8
      4⤵
      PID:2440
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5312,i,5066363902931423133,15055246067662616308,524288 --field-trial-handle=2660,i,13179874233902329661,6450700933448845938,262144 --variations-seed-version --mojo-platform-channel-handle=5384 /prefetch:8
      4⤵
      PID:4764
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5988,i,8542142168286002101,8020175106558310074,524288 --field-trial-handle=2660,i,13179874233902329661,6450700933448845938,262144 --variations-seed-version --mojo-platform-channel-handle=6008 /prefetch:8
      4⤵
      PID:4276
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5988,i,8542142168286002101,8020175106558310074,524288 --field-trial-handle=2660,i,13179874233902329661,6450700933448845938,262144 --variations-seed-version --mojo-platform-channel-handle=6008 /prefetch:8
      4⤵
      PID:276
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6108,i,8965287581696588919,15913747052329773474,524288 --field-trial-handle=2660,i,13179874233902329661,6450700933448845938,262144 --variations-seed-version --mojo-platform-channel-handle=6112 /prefetch:8
      4⤵
      PID:2572
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6132,i,6106412767658762012,10068559506743593628,524288 --field-trial-handle=2660,i,13179874233902329661,6450700933448845938,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:8
      4⤵
      PID:3968
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6148,i,16686304777977454641,11159216452088585689,524288 --field-trial-handle=2660,i,13179874233902329661,6450700933448845938,262144 --variations-seed-version --mojo-platform-channel-handle=6140 /prefetch:8
      4⤵
      PID:568
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6108,i,10059446754745305481,14476407838902143089,524288 --field-trial-handle=2660,i,13179874233902329661,6450700933448845938,262144 --variations-seed-version --mojo-platform-channel-handle=6096 /prefetch:8
      4⤵
      PID:4276
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6572,i,11863703616342135117,13288033786177124903,524288 --field-trial-handle=2660,i,13179874233902329661,6450700933448845938,262144 --variations-seed-version --mojo-platform-channel-handle=6588 /prefetch:8
      4⤵
      PID:5152
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4296,i,4149270171672049845,5944701162575262140,524288 --field-trial-handle=2660,i,13179874233902329661,6450700933448845938,262144 --variations-seed-version --mojo-platform-channel-handle=6500 /prefetch:8
      4⤵
      PID:5004
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4288,i,10714787598352226112,5567449995849278126,524288 --field-trial-handle=2660,i,13179874233902329661,6450700933448845938,262144 --variations-seed-version --mojo-platform-channel-handle=6560 /prefetch:8
      4⤵
      PID:3788
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4444,i,13406023148414157042,14440646102264114333,524288 --field-trial-handle=2660,i,13179874233902329661,6450700933448845938,262144 --variations-seed-version --mojo-platform-channel-handle=4476 /prefetch:8
      4⤵
      PID:568
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1160,i,17186613580161352297,10459660910566645006,524288 --field-trial-handle=2660,i,13179874233902329661,6450700933448845938,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:8
      4⤵
      PID:5700
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5920,i,13940246612270352666,6442257945888715545,524288 --field-trial-handle=2660,i,13179874233902329661,6450700933448845938,262144 --variations-seed-version --mojo-platform-channel-handle=5488 /prefetch:8
      4⤵
      PID:5900
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5680,i,16357513221094164759,11162359233858668957,524288 --field-trial-handle=2660,i,13179874233902329661,6450700933448845938,262144 --variations-seed-version --mojo-platform-channel-handle=4632 /prefetch:8
      4⤵
      PID:3988
- - C:\Windows\System32\wbem\WMIC.exe
    "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /nointeractive
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3336
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c DEL C:\Windows\TKTGBP~1.EXE
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3968
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2640

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:628

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4332

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

_ReCoVeRy_+ygnye.html

Path C:\Program Files\7-Zip\Lang\_ReCoVeRy_+ygnye.html
Size 11KB
SHA256 2d9e79cdc62651a10ff938ba3b5534a4e6081b0d7869a50eeac456a1d94c6c0d
MD5 4e4dc1af604d615bde939a905e7f2e4b
SHA1 be8631b2c1a9380956cbb5680ff7588bd3ef71b3
SHA512 cb444869655ccb782ec48293cb66087e071c234948f476ca031393311c8f93deda2267b8420517533ee3588f340dd672e94495a94d31b452b7d645b2344ab7ac
SSDEEP 96:B1NdADl1ZMOJtERWRg9Guvzc38POGaMkC0cMRCV60a0zEKwd8/9/NwZoH2YMlfo3:BCJCn/Hp+AO8NqgBQvjvm+EOUvMyr
TLSH
T1453282293DBCE462315CC15170ACB19DC9F64847906AB08CC6FAB5C83B65DB94B3F2E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ReCoVeRy_+ygnye.png

Path C:\Program Files\7-Zip\Lang\_ReCoVeRy_+ygnye.png
Size 61KB
SHA256 531eb71f450618da79d03571a9b4988dcd3c7bdeb54b7bf72c6fd65978644e65
MD5 2e97c6cf165cdb7fbbe72ae861e97f31
SHA1 9b22f49b1346c1dc8dd98dfe303dfe3dc97691cb
SHA512 1bdd069cbd412a3cebea357752861c28f77e9290e8389bd21ca21fa06762997fd6d4d36c0482985d4444a4df1730adc6097fa0ade505eadf66636c46225e067a
SSDEEP 1536:Qmb2wbDP8ivT1Ip44B1KGTKl8wABIAFp8cucaCYGZEZZZZZZZZZZZZZZZZZZZZZy:QuJJ1m1K0qAFpGcaCfaZZZZZZZZZZZZo
TLSH
T10053BFC19AE24C2FDC4D6272B504D5E8B622F63991F521CC32E3890DEAB7DE1655233E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ReCoVeRy_+ygnye.txt

Path C:\Program Files\7-Zip\Lang\_ReCoVeRy_+ygnye.txt
Size 1KB
SHA256 a11532e029f7737729acab5ed0c5ecf349aff8effb6cbea4842e1e719e8fab0a
MD5 ec0e3215b9a475733805759d0064c13f
SHA1 d8e5ada87173a570497b6207a59325c289365d04
SHA512 ffcb957db9d55d49a785dee524b89bdd0397d288ed14336aee9c5480f0de06b8b744e2763067600e9c1304c392a0f1df481537a76826d6cac7facfacc983442d
TLSH
T12731978FDA156612091143823EF89A01F71500D4336885263CEF451D2B67B7EEE3BABB
MD5 SHA1 SHA512 TLSH

Submit Download

THIRDPARTYLICENSEREADME-JAVAFX.txt

Path C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt
Size 560B
SHA256 e3a316cd0be576df6f20918d603309f67fe0a9a1e264cb7c8ca39e890d080978
MD5 0e41f6dd8acd507924844037c2e89998
SHA1 7db8a627b09c70043fde97b530abbfcc464a838e
SHA512 bc4000e125c07dc0aaaa465f2a3e180fe4456f62dabed64be5cfccd6102ce8f3ce748094ebfef27834fbf37fa125c7859517dd7edc3eb56acdb0eb8adb9d0e40
TLSH
T1E8F005532C445556D7E85BB8C5C664055F0799D17138F16C5594C44F44F48F03D85DE0
MD5 SHA1 SHA512 TLSH

Submit Download

THIRDPARTYLICENSEREADME.txt

Path C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt
Size 560B
SHA256 2f0475bd30b8a5b5072c5514cd033efd1e7101e2e985f39ef37ba680327b2489
MD5 eb8538abc1123b9d65eb3146e7d2c400
SHA1 a1f44f742583bab3c1d481eed60eda348ea5021a
SHA512 9c117b00c9198812d5a74676d40660d441082b6f6237734bef840114207658b80c2b821e9f590d3d16ec4c5c2eb501593a5689cf3fe7e362e78e944f8692cfe9
TLSH
T12AF054176444625AC7D85A369486B85F4E0AB9E173B8F18C86D4A88F50E81F8BEC5DE0
MD5 SHA1 SHA512 TLSH

Submit Download

ClientSub2019_eula.txt

Path C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub2019_eula.txt
Size 416B
SHA256 baf73415eb00c951c548e4521744465303bf8cd85ec5c5a16208f15e5cc1f908
MD5 fee5816c8be74908874f9d0323b88e6e
SHA1 24abc5f67caf998c95ed2841ba3357f8c8c23f17
SHA512 db18202f380cb9f6b0dac3b38bf9bdd67276c1412d654d7574817201c0d8ed6d20c48348f6cafeeec33c3a79007f0b3a5936a8ea9f516693bae63ef6e174bebe
TLSH
T15CE060032804E04FCEC80AB110C3B44F4E06D8C0E230F70807C8808F18A40E03A89EE1
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping3384_1767714722\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping3384_470930218\manifest.json
Size 135B
SHA256 ba5c9096d20a482aaa1aa9e5f98ad6127d3e97c2f21de84f7c78d9b8073c8e26
MD5 fbebd68ecaa98928909421f66909c054
SHA1 99d787d90f7ed2e5ad924f9c5668eb988b5a6c07
SHA512 749a3b2be47fe28399dc763888654a3e8d397e06e8d3c3af3965bb45846a1336e6ab4ca82c82c3df846b34a2afafa2156f2690e9bf347ab175408dc0171c61cc
TLSH
T158C04C668D51DEAB00A747A56B295315E23B4B4B5044800A7AF5429C1A288964171944
MD5 SHA1 SHA512 TLSH

Submit Download

protocols.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.10\protocols.json
Size 3KB
SHA256 4fd800e7b1a5fb24b13fac2e31946d205012b7c28d8c61580b0669b2fa3517cc
MD5 1de85fec2dfcc28011a7c2aaab95eb5f
SHA1 80e8c954bfbe8f7ee5a2335c8d969ae033935dc3
SHA512 9c7dd37eb0c094b6aa05201e7c71a8f33b9db81284223bcfa595a44a6ac95d5a6820ab6f07b7aa8d26bf207454e94277bf35332e9c009ee63f083752b6b51750
TLSH
T1D1611DB79A3048090E3412B86B19B35DF63E029F1AD598EB76BE568F1F710F7245C54C
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 701082e4ac35f878dc5ff6eb27989aae9d20d9b5662643e20b3acd1720b367fc
MD5 2b3686986ce1fd99f079eb226e8b0a8b
SHA1 0d2cdee36351378b91ed7f6ecdb43457fe4d7b5d
SHA512 937da61c495fd21a02bb76a63556dec83ce132f1d1830ff8d9af6212d15f1844766dd4abadd15ea61b48f8ae03b52baca44c99117714c705da840dbff8f116dd
TLSH
T182D09B303A58A98BD54360F1A4104B41153755572053D7757521508E9E99095B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 11d3c4c52f9fc9cd2b10a22b48769759f994fd6364f9a0fc145f4cd2c2a22e9d
MD5 4751cf705a737c4226029624bf43b9a8
SHA1 fd8cf726ee3f8f75b97147829de5553530caa82c
SHA512 46e3fedbf7fa14bdc2b3aad129f2879a9d24252f5d7bd9b55766bc32a6b82ea77aaf193bcdbdf4423e3b67ef84955e589b6077609344091ef72204c1d50b0dab
TLSH
T17ED09B307A58A58BD14360F1A4114B4115375557205397757521508E9E98055B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 8d0d026ae3e2a52791c0a1d5f6aa0329ea2c56cf5c964a95c6d7373fbb4fca62
MD5 4c3fdae63caf47eedccc28ac3c07bbfc
SHA1 b42759a805f9c2c45fd4ee80f07dc5ab0ccef249
SHA512 bcb61ae89cfdaccd59d3fdd1c6679505e9f993aa73f7c993dc9a5c948a3ece8a98194e1e6fff960fd3e980ab2dcd9fd67926274d94f0ce52d6da5f0829b35601
TLSH
T18C61D4BE0586EDF6E3D13A3190C03A8738F180E8FD63FD5D02E348B5641AB118A6A4CD
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe595857.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe595857.TMP
Size 3KB
SHA256 b890b7a505cf56ee1705b705c314efca9c08749609a7cd52757e82e870652b51
MD5 9ad626c9b9fee5b2c65ecde4905707cc
SHA1 2f63927e6fef14470dc3b1904a0387be50aaf2ce
SHA512 dacca2e621e1b17038dc9b88a839cad436478a1285d58b1501cb5383608c44a8197a0b1c2c3444715ea845404f959ec9450514fb7fb8d2c34e6cf5fabc2ca7e4
TLSH
T17061B2BE0586EDF6E3D13A3190C03B8738F180E8F823BD5D01E348B5641AB114A6A4CD
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 f38c3cd735f7d33758d86f696607d1ef6e97da364191c0778096e1750e3841d2
MD5 87664154ae2f453dd1f830979fd43744
SHA1 e59a56274c334a900a5cdc5c8b57a0a827aab1a1
SHA512 53812604cffd4ad30663dbdee1cbab8296a41c79919fca791f5e3bb9ddb08e43d0eafda8b7cb06d5fc08c4956012ef3b67e2e900d702b0a600f161194e1d120f
TLSH
T1E441AEF3C3E8856DD91196F0BA287E2BCE1D0954832C3D5AC8E4EF5BA3E2871E14154E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 13d965730fa640982f1000a9c6b13a515100b8acc8ee2f975d783e9df0d574a6
MD5 6a4db08e5d9d55bf3e218dbf79bb4f8d
SHA1 d82b9f817202585f7ee20ffe45a61cfbb7dfc19e
SHA512 b43144f05c9ff7deb33639d036bf1c151273a6578100fd26c27afd896352c90cc4b6d778d8c667673a7db5bdce05a9f71b157b65f563f5ebfba128d02a391e9b
SSDEEP 192:sxZzRhyM/jK1Ml8MiU/fYsFoBbWwluIdpdoHW6+WNGY9I30+Ig4J:sxZzrqU/fYsFoAwh2HbGvc
TLSH
T17952F916AA3499B7CCDBD20DBA517B53D6F4557292940D489EFCDA0C04E6BEC2203C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 e844cd882b035e5c3a748d995fbc128d1fed2f1c52b2bf7be042d0853986b265
MD5 61b61dc62749bad1c8a27e8b050175ed
SHA1 a921f2417cc3eebf0c0b6f6a3ec1b79483622e50
SHA512 d465b7d03109883dd41042a07c71a15267ef488c62b3fe51150d0221d456a1bad5b9d590f582a558c8fd14c34afb978fc8e33a7fac819f29296d7479db438876
SSDEEP 768:ABcv2cpLyd7pLuLXowWvu+Z+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVFreFLlwmWN8:ABcv20UEXowWvu+Z+u1jasreFLeRNM3b
TLSH
T11FF2FA3B6C0CCB7E4F844E9CED2A7E8E6DE802CB5698895447FA844C03C66EB51175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 73fef792f3255883ebdeb81f15f834473dfebdbba323221f8cb42fcee2998c1c
MD5 bfcd88c49dc0ebe3ba4a0bd96ff5d39e
SHA1 889c4fe76ed8aa8234ec3ee42f92127f61a13c57
SHA512 724676d6eea9ebabdb987add3010c808835ec56cf2bf2d2300bbb180d766d0343b55fe7eab1d7de5d4fa09915d9376f6301744ac8827f925e908e4f42a419def
SSDEEP 96:KaRklRnHnqlPKZThqKLfTzqHxJSrBDCygKTyayysKHKOx:mTfHX7x
TLSH
T1E8919206307F12C2387E284C93A9892A5E427563741AA5BF7FB844D24E67E156EFCCDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59f301.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59f301.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 10a658746d659b130b632dfaccfaa3f5414dda11a529776f395b0802fe0d0835
MD5 ef0fceac3b89ef61693eafcfd066c231
SHA1 a55fa31f613c6fec1becedb903b2c1158b6dfaad
SHA512 2c99a7253e277b36ff404e7ec445ca0248366f08e7db82bb5a8f9a7be1a24b443a47cbfda7188294735e4acfc0a19986cfdf8781c74a2a3952377f8ae9b100d5
SSDEEP 384:nCtNnNnb9+sNAD7Xzit7Due+CXOmep3Jr7hQs7O1j6Y1Kny7Av9:CjZbEf8NvO9p3h7hQsIanyMv9
TLSH
T1A2927D32A5395CA70E97A654F54B3693AFB850E7D8842FD0E9DC6F0D05D7BCC130A82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 c39f1579290529bf1639370b15d5ddbb97e860ca09a1000df1fe5429ca902b6a
MD5 d543d9fb38a34f7c50486ca826cacc77
SHA1 5a1a523f0795e7dbeadba6d9d022be9d3065b9bf
SHA512 88298de5b804316bf8aed32e342229f6e4c8d72c518b7a30618276dc2870fae9f08f8d3e220e24de9e1e0740d96027a643473f6645fa9f8fefc022cc6c7b35dd
SSDEEP 384:nutNnNnb9+sNAG7Xzit7Due+CXOmep3Jr7hQs7O1j6Y1Kny7Av9:ujZbEC8NvO9p3h7hQsIanyMv9
TLSH
T1C5928D32A5395CA70E97A644F54B3693AFB850E7D8842FD0E9DC6F0D05D7BCC130A82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 febb38718f8ea72f429ccdf0b70cf036d70c5c0c4212911b3c9cd0e37b3b1daa
MD5 a97f040f82cd58be35efe790220f67bc
SHA1 a02827b97de5c5f31743472b21e81d396c67a005
SHA512 feeb0ff0bfdae0f013deac22c2e0b070ac31266ba330bcac55f2ad7adb7f4e694471cef4e14163d056884917ceb4621fc559a19b35dc4a1bee9d4016da80c816
SSDEEP 192:JONh6v+YLzQmiUyBsWh+CG6Om9opwSJrHWCHhbqg8U6:JONh6vzRBWh+CXOmep3Jr3hQU6
TLSH
T1B0123B35B8389CA75EE7A555F48737A79EA820B7ED462F80D5D42F0C01D778C270E82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 d97dcd2a4a0d8e5ecaa4c009858b67ffa78924289bf02f33ac6e448738da7241
MD5 ef5db273b03839c9632239ccadedaf8c
SHA1 41b2acb93335b0fe5cbeb0aeff6cf02b2fc7d15b
SHA512 93dfc8403d55f6c0a59d2f3008c814b76f162a72fcbd087ed64fda124449be71b6a84d17dbd3e58337cb455c4ca5568ccb2271739641541ce4effcf1838178e1
SSDEEP 192:JONO6v+YLNQmiUyFsZh+CG6Om9oEusqlU6:JONO6vz/TZh+CXOme6aU6
TLSH
T1E802D935BD285CBB9FB25E45F98737175FA4117BE9962F80D9E41F0C01D764C2306826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 3b5fc78a2c94d6eeb7beb0d5d76aa10e0b55222de601285eba97745d97f50bfa
MD5 36a97166252ae9b8a8f6758d9dfd4a6e
SHA1 9c12a1101f193e67a1a7a276f1e5775b5af8a822
SHA512 2c2e6222f598f5df93ae6f455f27f8676dca730f3262211d9860978f5d9233d0b7404593fecffceed1f0a2db392630ccf182664677395a34eb09cf7f3762f65c
SSDEEP 384:nxiF1tNnNnb9/zsNA8TUNTUlIlG7Xzit7DuZDfpS+CXOmep3JrehQs7O1j6Y1Knr:YF1jZbB1wg08SSvO9p3hehQsIanyMv9
TLSH
T12DB24B36D965CEABADE75BC1F7463697DEE411A388882DD4D9C86E0C01C7ADC130BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 7de03c7feb7eed7661fc712a9670f5c4d7968ea4dbd9102a7e2d78ce67e842a8
MD5 2a6173c931110287b5c32541ce332aab
SHA1 a9247141627bb4767056e2fddbd580559ca4af8f
SHA512 84018a520e2b6b83c0b337149f307582ac811f1492afc6240fb1c39b4feb045d8d73ad808c45a1313041a2cc46975b8dcbd2a67295d83ec20626f2cc5ae3d193
TLSH
T176411A5CBAEA1108B7B76F569FF7A49D447EB8362E0BD55E10110E4F0A23B40C861737
MD5 SHA1 SHA512 TLSH

Submit Download

AppCache134231845991903562.txt

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache134231845991903562.txt
Size 79KB
SHA256 bea6a7c12a068286133b7e1544f9b771006a4d9d409319b759eaedce9a42533b
MD5 3d484d4c8b038c7d8ee93159c79fc081
SHA1 a337a177baa1c904078d6fdcfb0a5f4f9ae55442
SHA512 2174ac48127093971fbf9eb2108c5f956888dba9e5e8b56bd096ee7562018fa9ae5c46141046a9f19bb2f7ce141f2dd7f39f506c02d2d8e36683775cedf3de7c
SSDEEP 1536:AkyGcyQzeGZf65Ao7OQcTUH4RYkegLxw3vHuOxEK0xUcSwnhdyp6Y+g412:fBQCjSTUYl9lw3vOCJQUcScU+I
TLSH
T16883024B4DD665FEF62084472ABA32119D20A414A241D16AAF5F28DFCF1F3DC4BE3E60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0a322309-ab15-42e1-80f1-143eb6211184.tmp

Path C:\Users\Admin\AppData\Local\Temp\0a322309-ab15-42e1-80f1-143eb6211184.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

fbb6f527-025b-44da-bbc5-0242567e25af.tmp

Path C:\Users\Admin\AppData\Local\Temp\fbb6f527-025b-44da-bbc5-0242567e25af.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3384_291701576\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7212b762-bc00-4292-a852-8f7b69b20289.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3384_95591973\7212b762-bc00-4292-a852-8f7b69b20289.tmp
Size 147KB
SHA256 d766e75ceffe993aa1dadd5619b24043a0ebe9a9689a6796d19d88bf952683d4
MD5 a9f7675ff091bb15c88909424bab4a39
SHA1 90f753d8d7e4397de0f49631fcd9222a7f59148c
SHA512 ff1f89fb04ae9c9a4c6cf6b1475f5a77f1c4f90829acda95cb39889b6b15c3b4f0b3b822a668f8ec8520b002cc90dd397cc26d314ac8fd5f3e2c9826bd458df5
SSDEEP 3072:Ph3iICVe1DvTtr/3tOpPu8LdKBTJyU4AshzWnD7UVDvuZE4tkGL:PgTVWvTZPghwln0AD7UV8Eeky
TLSH
T12BE3E01D29E2846EC82B24F4BA4A718FC71ECF07910BE40F25D984A55C7474E17E2EED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AssertMerge.dwg.mp3

Path C:\Users\Admin\Desktop\AssertMerge.dwg.mp3
Size 344KB
SHA256 04fc285c62b27ebf7f8daad306cd18d0c5138cacf222d513770afa1d29a032fe
MD5 5b16021c583fc8de2bfef14e2029586c
SHA1 8083f208afd18337fa49b9ef40892fbb2ac99517
SHA512 0d4f1dd62c0f93336cac934addd7e2fc6e170644b0b09545795c2e71d61bf81ae664ad8c2ed86ce977fb9b9cb8f2fd1208a0b38b611d547a8e9718869cc168b4
SSDEEP 6144:gIoHTh4ZMpEde3Jo4kAjwI99IymlVrUqsCg5KB/kKz7lyDlGfz5Oz91bS9Dw:PozhyMpX5QUwQmltH1g5ykKz7lyZGFOh
TLSH
T1D17423B95AA2B3E2A1B5F74212D0A27D970DD704DF6D1807EC010B8EA9670BD7C11E87
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EditResize.doc.mp3

Path C:\Users\Admin\Desktop\EditResize.doc.mp3
Size 418KB
SHA256 2cb3ca9d07d5dd60da7e627eb759ca5f9b1aaf54684d433fda6a7502af57b400
MD5 ee5aa942c7abc460e55727f8780645d3
SHA1 161dec45406afda1731b8876b15dea0a60ec8d76
SHA512 e649343ab91a01c7df1c6631598318b9eb7a0db6e50d6d368ece1f983c48075c9671255f93696639eb67a230a00e45f3d5eb325c8ed2f36cb680f2a8f2735031
SSDEEP 6144:DDZQGfyBWo+aZ8jBH3wazyo4MMABIvYZyyHYfumygzqnDX6SkW7zFMXYxaq/w0zD:BlKBWtHzEyiCJjgzQDXgW76XYxaQjtV7
TLSH
T17394238CE99A5890D9917E21311AE9FBAAB796FED702DC22C3F31308DDD813466D8570
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ExportExit.avi.mp3

Path C:\Users\Admin\Desktop\ExportExit.avi.mp3
Size 214KB
SHA256 1c6313bb225230781594788bf5208aee12de58194e2e73092a5e80540a7aea4e
MD5 0775e085b2f11a5f369ab9f28e50f549
SHA1 514ddfc8723df1092a627c2bd7ffab417142d5eb
SHA512 fc4ce7ecd4ed4bf3647e5d61e1ecaf7295a85654d8c57dcfd107d4e6995aa645c0a140a864083a78c8ed704f15c770569b55dad1137caf4bb6ebc67b456fa3be
SSDEEP 6144:bmtnJQ8SCdO/kvAtgG0P6tku9vPTKAkDKde7K4VJwvJZsQ:bEJQ8SZ/kItgG7fqKUVzwvYQ
TLSH
T1B7242334A754900E3A7F207620C3D32835ED78A6E517DB6D5695B3DDEE06D2BE0838A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FormatCheckpoint.wps.mp3

Path C:\Users\Admin\Desktop\FormatCheckpoint.wps.mp3
Size 474KB
SHA256 f75a30fcec0a2b0ba53d07ba54b5cdc253520044f1da0a1ef6a119522c086816
MD5 66dd051cc1dedbe73acbc6148cffce65
SHA1 bce064418e92136530d6f4420e08da08b4fc3427
SHA512 7258cffbd5a93e1a194817a6b07feaaa3fb94e37e9b5465111e88e9c802ba2471c025ef3ea786318e24be581a220348bd6073bf673e33ec0a7707bdde6aaf693
SSDEEP 12288:8MZl5zzFRke3Z0Gh/JWcpe1KcV1/FsRjxLEErl/:1Zl5n/keaGRJWcMEIzCZ/
TLSH
T143A423E0B173A034ED2F7F253C54E099DAA066C4B37B917C896582CA87E85633E5B53C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GetEnable.xlsx.mp3

Path C:\Users\Admin\Desktop\GetEnable.xlsx.mp3
Size 10KB
SHA256 c2f6fb905b840799111e764b63cca1a05067de233f64d8f9177fd89bfb7784cd
MD5 b9fe3f72f3abdc2f12742cde3b1d6dac
SHA1 1e5f4f7a46ff7bd4c45f585d7fea3468e9f8c7df
SHA512 c67663d7eaf567e53f2c1718d512473985231e3ee2522da2c367d241ea9c5b7db988655fd0ee69b8e7666c1d1614792450857b51e9393700f8cfd8be32b6d68d
SSDEEP 192:S4rKX543uWLt61tGXqgrRwCh7dVLGxNYufOBV5W2Zt7G:S4mp4A1tGh57dcYPBDk
TLSH
T10022C04F28412068FC019AB9F2882D768A8F27B2F7F1EEA33C85754254C6B4784187F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tktgbpctoumq.exe

Path C:\Windows\tktgbpctoumq.exe
Size 254KB
SHA256 ac38fb42adffa1445836f20becfa4d0091b2170936db36ac1bb0cd18a1160027
MD5 55b07f7f1759b457bd3c5ae05d774a95
SHA1 d8c83632cb45b0936b328d34fbc5df14a521a052
SHA512 4e4123ec6d8f70199a2c1b42a7ac605f578aaf6775685ce4a1c8a77f3e9ce0d3bb3b2ca6a8b7d715bc9c3988a06281f83314b46a4431058d4b96b167ccacf81b
SSDEEP 3072:Z6BPlzCGAAX0Tt/pjJIn82zwAB/qIgkVpvIFPrJP2G8/Ev99DDyJGjuQeDTRpb8m:ynyoqIfAlR2H/Ev9FeGjsXb8
TLSH
T145449D026613D072D4BB04729BACEBB2A4A95D34472D91CBBB406EB41E35BE6777C343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4164-6-0x0000000000671000-0x0000000000672000-memory.dmp

Download

memory/4976-0-0x0000000000571000-0x0000000000572000-memory.dmp

Download