893591a131400eeeb7fcd8f27cf32dfcc218778586e8376dcdd51d539f6ea246

Analysis

max time kernel
150s
max time network
52s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
10/06/2024, 21:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
VirusShare_15ccc8b6c5d3da5aa04ac0070ce02341.exe
Size 351KB
Sample240610-1chmjs1crb
SHA256 893591a131400eeeb7fcd8f27cf32dfcc218778586e8376dcdd51d539f6ea246
MD5 15ccc8b6c5d3da5aa04ac0070ce02341
SHA1 622e79327ccb7e185a98b3d42b999dbdb0e78809
SHA512 20814ac6c67e2f970a2fd3d6b48f9950226847819d7b18408fe5ddbc7b99254d87f8d4ec0fbcb550cbd6ef2a2bac40382bc639961ca8be9b84ccd875723552ea
SSDEEP 6144:KaRueM6Ryfe3vIHbG6TK2h0j+UCsTt99/lYPGEX:JRo6kgCG4K60j+UCmPYPGEX
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

defense_evasion execution impact persistence ransomware spyware stealer

Malware Config

Extracted

Path

C:\Program Files\7-Zip\Lang\restore_files_xclsu.txt

Ransom Note

!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! What happened to your files ? All of your files were protected by a strong encryption with RSA-2048. More information about the encryption keys using RSA-2048 can be found here: http://en.wikipedia.org/wiki/RSA_(cryptosystem) What does this mean ? This means that the structure and data within your files have been irrevocably changed, you will not be able to work with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them. How did this happen ? Especially for you, on our server was generated the secret key pair RSA-2048 - public and private. All your files were encrypted with the public key, which has been transferred to your computer via the Internet. Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server. What do I do ? Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed. If you really value your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist. For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: 1. http://lk2gaflsgh.jgy658snfyfnvh.com/429B932BEC1DA1E 2. http://dg62wor94m.sdsfg834mfuuw.com/429B932BEC1DA1E 3. https://djdkduep62kz4nzx.onion.to/429B932BEC1DA1E If for some reasons the addresses are not available, follow these steps: 1. Download and install tor-browser: http://www.torproject.org/projects/torbrowser.html.en 2. After a successful installation, run the browser and wait for initialization. 3. Type in the address bar: djdkduep62kz4nzx.onion/429B932BEC1DA1E 4. Follow the instructions on the site. IMPORTANT INFORMATION: Your personal pages: http://lk2gaflsgh.jgy658snfyfnvh.com/429B932BEC1DA1E http://dg62wor94m.sdsfg834mfuuw.com/429B932BEC1DA1E https://djdkduep62kz4nzx.onion.to/429B932BEC1DA1E Your personal page (using TOR): djdkduep62kz4nzx.onion/429B932BEC1DA1E Your personal identification number (if you open the site (or TOR 's) directly): 429B932BEC1DA1E

URLs

http://lk2gaflsgh.jgy658snfyfnvh.com/429B932BEC1DA1E
http://dg62wor94m.sdsfg834mfuuw.com/429B932BEC1DA1E
https://djdkduep62kz4nzx.onion.to/429B932BEC1DA1E
http://djdkduep62kz4nzx.onion/429B932BEC1DA1E

Extracted

Path

C:\Program Files\7-Zip\Lang\restore_files_xclsu.html

Ransom Note

<html>  <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; } .ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;">  <center> <div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"> What happened  to your files? All of your files were protected by a strong encryption with RSA-2048 More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a> What  does this mean? This means that the  structure and data within your files have been irrevocably changed, you will not be able to work with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them. How did this happen? Especially for you, on our server was generated the secret key pair RSA-2048 - public and private. All your  files were encrypted with the public key,  which has been  transferred to your computer via the Internet.  Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!! What do I do? Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed. If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist. <div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr> 1.<a href="http://lk2gaflsgh.jgy658snfyfnvh.com/429B932BEC1DA1E" target="_blank">http://lk2gaflsgh.jgy658snfyfnvh.com/429B932BEC1DA1E</a> 2.<a href="http://dg62wor94m.sdsfg834mfuuw.com/429B932BEC1DA1E" target="_blank">http://dg62wor94m.sdsfg834mfuuw.com/429B932BEC1DA1E</a> 3.<a href="https://djdkduep62kz4nzx.onion.to/429B932BEC1DA1E" target="_blank">https://djdkduep62kz4nzx.onion.to/429B932BEC1DA1E</a> </div> <div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr> 1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a> 2. After a successful installation, run the browser and wait for initialization. 3. Type in the address bar: djdkduep62kz4nzx.onion/429B932BEC1DA1E 4. Follow the instructions on the site.</div> IMPORTANT INFORMATION: <div class="tb" style="width:790px;"> Your Personal PAGES: <a href="http://lk2gaflsgh.jgy658snfyfnvh.com/429B932BEC1DA1E" target="_blank">http://lk2gaflsgh.jgy658snfyfnvh.com/429B932BEC1DA1E</a> <a href="http://dg62wor94m.sdsfg834mfuuw.com/429B932BEC1DA1E" target="_blank">http://dg62wor94m.sdsfg834mfuuw.com/429B932BEC1DA1E</a> <a href="https://djdkduep62kz4nzx.onion.to/429B932BEC1DA1E" target="_blank"> https://djdkduep62kz4nzx.onion.to/429B932BEC1DA1E</a> Your Personal PAGE (using TOR): djdkduep62kz4nzx.onion/429B932BEC1DA1E Your personal code (if you open the site (or TOR 's) directly): 429B932BEC1DA1E </div></div></center></body></html>

URLs

https://djdkduep62kz4nzx.onion.to/429B932BEC1DA1E</a>

Signatures

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047
Renames multiple (889) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	VirusShare_15ccc8b6c5d3da5aa04ac0070ce02341.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	vcwtud.exe

Drops startup file 4 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\restore_files_xclsu.txt	vcwtud.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\restore_files_xclsu.html	vcwtud.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\restore_files_xclsu.txt	vcwtud.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\restore_files_xclsu.html	vcwtud.exe

Executes dropped EXE 1 IoCs

pid	Process
3628	vcwtud.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\vsadmin = "C"	vcwtud.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vsadmin = "C:\\Users\\Admin\\AppData\\Roaming\\vcwtud.exe"	vcwtud.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
3	ipinfo.io

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	vcwtud.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\be\restore_files_xclsu.txt	vcwtud.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\es\restore_files_xclsu.txt	vcwtud.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsFeedbackHub_1.1907.3152.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\InsiderHubAppList.scale-125.png	vcwtud.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsStore_11910.1002.5.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppTiles\contrast-white\LibrarySquare71x71Logo.scale-125_contrast-white.png	vcwtud.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\font\restore_files_xclsu.html	vcwtud.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\PrintAndShare\Glyph_0xeccf.png	vcwtud.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\audio_output\restore_files_xclsu.txt	vcwtud.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Assets\Store\AppIcon.altform-unplated_targetsize-32.png	vcwtud.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Wide310x150Logo.scale-100.png	vcwtud.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.targetsize-20_altform-unplated.png	vcwtud.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Home\contrast-white\WideTile.scale-200.png	vcwtud.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-40_contrast-white.png	vcwtud.exe
File opened for modification	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\restore_files_xclsu.txt	vcwtud.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\GenericMailBadge.scale-100.png	vcwtud.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Resources\RetailDemo\data\en-us\1.jpg	vcwtud.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\AppIcon.targetsize-32_altform-unplated.png	vcwtud.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\de-DE\restore_files_xclsu.txt	vcwtud.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\restore_files_xclsu.txt	vcwtud.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Assets\Store\Wide310x150Logo.scale-100.png	vcwtud.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\AppPackageAppList.targetsize-96_altform-unplated.png	vcwtud.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\kn-IN\View3d\restore_files_xclsu.html	vcwtud.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxCalendarSplashLogo.scale-200.png	vcwtud.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\visualization\restore_files_xclsu.html	vcwtud.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\YellowAbstractNote.scale-100.png	vcwtud.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.UI.Xaml.2.0_2.1810.18004.0_x64__8wekyb3d8bbwe\Microsoft.UI.Xaml\Assets\restore_files_xclsu.txt	vcwtud.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-60_altform-unplated_contrast-black.png	vcwtud.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxMailMediumTile.scale-400.png	vcwtud.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubAppList.targetsize-80_contrast-white.png	vcwtud.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsCalculator_10.1906.55.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\CalculatorAppList.contrast-white_scale-125.png	vcwtud.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\Logo.scale-125_contrast-black.png	vcwtud.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\sk-SK\restore_files_xclsu.html	vcwtud.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\restore_files_xclsu.txt	vcwtud.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\restore_files_xclsu.txt	vcwtud.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\ScreenSketchSquare44x44Logo.targetsize-36_contrast-white.png	vcwtud.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_neutral_split.scale-100_kzf8qxf38zg5c\restore_files_xclsu.txt	vcwtud.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example1.Diagnostics\restore_files_xclsu.html	vcwtud.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\include\win32\bridge\restore_files_xclsu.html	vcwtud.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\ja-JP\restore_files_xclsu.txt	vcwtud.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_neutral_split.scale-125_8wekyb3d8bbwe\restore_files_xclsu.txt	vcwtud.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.UI.Xaml.2.0_2.1810.18004.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\restore_files_xclsu.html	vcwtud.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\AppCS\Assets\FaceReco_Illustration_Cancel_SM.png	vcwtud.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubAppList.targetsize-64_contrast-high.png	vcwtud.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxIdentityProvider_12.50.6001.0_x64__8wekyb3d8bbwe\Assets\StoreLogo.scale-100.png	vcwtud.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\restore_files_xclsu.html	vcwtud.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-48_altform-unplated_contrast-black_devicefamily-colorfulunplated.png	vcwtud.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ta.txt	vcwtud.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\GRPHFLT\MS.PNG	vcwtud.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Home\RTL\contrast-white\restore_files_xclsu.html	vcwtud.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\ScreenSketchSquare44x44Logo.targetsize-48_altform-unplated_contrast-white_devicefamily-colorfulunplated.png	vcwtud.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.18.0_x64__8wekyb3d8bbwe\Assets\AppTiles\StoreLogo.png	vcwtud.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\LayersControl\Aerial.png	vcwtud.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\PrintAndShare\Glyph_0xe804.png	vcwtud.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Work\RTL\contrast-white\restore_files_xclsu.txt	vcwtud.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\restore_files_xclsu.html	vcwtud.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\sr\LC_MESSAGES\restore_files_xclsu.txt	vcwtud.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Assets\Store\SmallTile.scale-200.png	vcwtud.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteSectionMedTile.scale-200.png	vcwtud.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-256_altform-unplated.png	vcwtud.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Assets\AppTiles\StoreBadgeLogo.scale-200.png	vcwtud.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Resources\RetailDemo\restore_files_xclsu.txt	vcwtud.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\AppIcon.targetsize-48_contrast-white.png	vcwtud.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Images\restore_files_xclsu.txt	vcwtud.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Images\Stickers\Thumbnails\Sticker_Icon_MouseNose.png	vcwtud.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Interacts with shadow copies 2 TTPs 2 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

pid	Process
1092	vssadmin.exe
4392	vssadmin.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings	vcwtud.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
1488	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3628	vcwtud.exe
3628	vcwtud.exe
3628	vcwtud.exe
3628	vcwtud.exe
3628	vcwtud.exe
3628	vcwtud.exe
3628	vcwtud.exe
3628	vcwtud.exe
3628	vcwtud.exe
3628	vcwtud.exe
3628	vcwtud.exe
3628	vcwtud.exe
3628	vcwtud.exe
3628	vcwtud.exe
3628	vcwtud.exe
3628	vcwtud.exe
3628	vcwtud.exe
3628	vcwtud.exe
3628	vcwtud.exe
3628	vcwtud.exe
3628	vcwtud.exe
3628	vcwtud.exe
3628	vcwtud.exe
3628	vcwtud.exe
3628	vcwtud.exe
3628	vcwtud.exe
3628	vcwtud.exe
3628	vcwtud.exe
3628	vcwtud.exe
3628	vcwtud.exe
3628	vcwtud.exe
3628	vcwtud.exe
3628	vcwtud.exe
3628	vcwtud.exe
3628	vcwtud.exe
3628	vcwtud.exe
3628	vcwtud.exe
3628	vcwtud.exe
3628	vcwtud.exe
3628	vcwtud.exe
3628	vcwtud.exe
3628	vcwtud.exe
3628	vcwtud.exe
3628	vcwtud.exe
3628	vcwtud.exe
3628	vcwtud.exe
3628	vcwtud.exe
3628	vcwtud.exe
3628	vcwtud.exe
3628	vcwtud.exe
3628	vcwtud.exe
3628	vcwtud.exe
3628	vcwtud.exe
3628	vcwtud.exe
3628	vcwtud.exe
3628	vcwtud.exe
3628	vcwtud.exe
3628	vcwtud.exe
3628	vcwtud.exe
3628	vcwtud.exe
3628	vcwtud.exe
3628	vcwtud.exe
3628	vcwtud.exe
3628	vcwtud.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	3084	VirusShare_15ccc8b6c5d3da5aa04ac0070ce02341.exe
Token: SeDebugPrivilege	3628	vcwtud.exe
Token: SeBackupPrivilege	2208	vssvc.exe
Token: SeRestorePrivilege	2208	vssvc.exe
Token: SeAuditPrivilege	2208	vssvc.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3084 wrote to memory of 3628	3084	VirusShare_15ccc8b6c5d3da5aa04ac0070ce02341.exe	84
PID 3084 wrote to memory of 3628	3084	VirusShare_15ccc8b6c5d3da5aa04ac0070ce02341.exe	84
PID 3084 wrote to memory of 3628	3084	VirusShare_15ccc8b6c5d3da5aa04ac0070ce02341.exe	84
PID 3084 wrote to memory of 5000	3084	VirusShare_15ccc8b6c5d3da5aa04ac0070ce02341.exe	85
PID 3084 wrote to memory of 5000	3084	VirusShare_15ccc8b6c5d3da5aa04ac0070ce02341.exe	85
PID 3084 wrote to memory of 5000	3084	VirusShare_15ccc8b6c5d3da5aa04ac0070ce02341.exe	85
PID 3628 wrote to memory of 1092	3628	vcwtud.exe	88
PID 3628 wrote to memory of 1092	3628	vcwtud.exe	88
PID 3628 wrote to memory of 1488	3628	vcwtud.exe	93
PID 3628 wrote to memory of 1488	3628	vcwtud.exe	93
PID 3628 wrote to memory of 1488	3628	vcwtud.exe	93
PID 3628 wrote to memory of 4416	3628	vcwtud.exe	94
PID 3628 wrote to memory of 4416	3628	vcwtud.exe	94
PID 4416 wrote to memory of 4908	4416	msedge.exe	95
PID 4416 wrote to memory of 4908	4416	msedge.exe	95
PID 3628 wrote to memory of 4392	3628	vcwtud.exe	96
PID 3628 wrote to memory of 4392	3628	vcwtud.exe	96
PID 3628 wrote to memory of 1508	3628	vcwtud.exe	98
PID 3628 wrote to memory of 1508	3628	vcwtud.exe	98
PID 3628 wrote to memory of 1508	3628	vcwtud.exe	98
PID 4416 wrote to memory of 4468	4416	msedge.exe	100
PID 4416 wrote to memory of 4468	4416	msedge.exe	100
PID 4416 wrote to memory of 4468	4416	msedge.exe	100
PID 4416 wrote to memory of 4468	4416	msedge.exe	100
PID 4416 wrote to memory of 4468	4416	msedge.exe	100
PID 4416 wrote to memory of 4468	4416	msedge.exe	100
PID 4416 wrote to memory of 4468	4416	msedge.exe	100
PID 4416 wrote to memory of 4468	4416	msedge.exe	100
PID 4416 wrote to memory of 4468	4416	msedge.exe	100
PID 4416 wrote to memory of 4468	4416	msedge.exe	100
PID 4416 wrote to memory of 4468	4416	msedge.exe	100
PID 4416 wrote to memory of 4468	4416	msedge.exe	100
PID 4416 wrote to memory of 4468	4416	msedge.exe	100
PID 4416 wrote to memory of 4468	4416	msedge.exe	100
PID 4416 wrote to memory of 4468	4416	msedge.exe	100
PID 4416 wrote to memory of 4468	4416	msedge.exe	100
PID 4416 wrote to memory of 4468	4416	msedge.exe	100
PID 4416 wrote to memory of 4468	4416	msedge.exe	100
PID 4416 wrote to memory of 4468	4416	msedge.exe	100
PID 4416 wrote to memory of 4468	4416	msedge.exe	100
PID 4416 wrote to memory of 4468	4416	msedge.exe	100
PID 4416 wrote to memory of 4468	4416	msedge.exe	100
PID 4416 wrote to memory of 4468	4416	msedge.exe	100
PID 4416 wrote to memory of 4468	4416	msedge.exe	100
PID 4416 wrote to memory of 4468	4416	msedge.exe	100
PID 4416 wrote to memory of 4468	4416	msedge.exe	100
PID 4416 wrote to memory of 4468	4416	msedge.exe	100
PID 4416 wrote to memory of 4468	4416	msedge.exe	100
PID 4416 wrote to memory of 4468	4416	msedge.exe	100
PID 4416 wrote to memory of 4468	4416	msedge.exe	100
PID 4416 wrote to memory of 4468	4416	msedge.exe	100
PID 4416 wrote to memory of 4468	4416	msedge.exe	100
PID 4416 wrote to memory of 4468	4416	msedge.exe	100
PID 4416 wrote to memory of 4468	4416	msedge.exe	100
PID 4416 wrote to memory of 4468	4416	msedge.exe	100
PID 4416 wrote to memory of 4468	4416	msedge.exe	100
PID 4416 wrote to memory of 4468	4416	msedge.exe	100
PID 4416 wrote to memory of 4468	4416	msedge.exe	100
PID 4416 wrote to memory of 4468	4416	msedge.exe	100
PID 4416 wrote to memory of 4468	4416	msedge.exe	100
PID 4416 wrote to memory of 4132	4416	msedge.exe	101
PID 4416 wrote to memory of 4132	4416	msedge.exe	101
PID 4416 wrote to memory of 4884	4416	msedge.exe	102
PID 4416 wrote to memory of 4884	4416	msedge.exe	102

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1"	vcwtud.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	vcwtud.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\VirusShare_15ccc8b6c5d3da5aa04ac0070ce02341.exe
"C:\Users\Admin\AppData\Local\Temp\VirusShare_15ccc8b6c5d3da5aa04ac0070ce02341.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3084
- C:\Users\Admin\AppData\Roaming\vcwtud.exe
  C:\Users\Admin\AppData\Roaming\vcwtud.exe
  2⤵
  - Checks computer location settings
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Program Files directory
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:3628
- - C:\Windows\System32\vssadmin.exe
    "C:\Windows\System32\vssadmin.exe" delete shadows /all /Quiet
    3⤵
    - Interacts with shadow copies
    PID:1092
- - C:\Windows\SysWOW64\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\RESTORE_FILES.TXT
    3⤵
    - Opens file in notepad (likely ransom note)
    PID:1488
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\RESTORE_FILES.HTML
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:4416
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffac11846f8,0x7ffac1184708,0x7ffac1184718
      4⤵
      PID:4908
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,16669418425107641589,4733873359435862609,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:2
      4⤵
      PID:4468
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,16669418425107641589,4733873359435862609,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 /prefetch:3
      4⤵
      PID:4132
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,16669418425107641589,4733873359435862609,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2612 /prefetch:8
      4⤵
      PID:4884
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,16669418425107641589,4733873359435862609,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
      4⤵
      PID:1616
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,16669418425107641589,4733873359435862609,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
      4⤵
      PID:4948
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,16669418425107641589,4733873359435862609,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4776 /prefetch:8
      4⤵
      PID:224
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,16669418425107641589,4733873359435862609,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4776 /prefetch:8
      4⤵
      PID:4380
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,16669418425107641589,4733873359435862609,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4808 /prefetch:1
      4⤵
      PID:5048
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,16669418425107641589,4733873359435862609,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4128 /prefetch:1
      4⤵
      PID:4172
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,16669418425107641589,4733873359435862609,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4248 /prefetch:1
      4⤵
      PID:4016
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,16669418425107641589,4733873359435862609,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3504 /prefetch:1
      4⤵
      PID:1508
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,16669418425107641589,4733873359435862609,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2036 /prefetch:2
      4⤵
      PID:180
- - C:\Windows\System32\vssadmin.exe
    "C:\Windows\System32\vssadmin.exe" delete shadows /all /Quiet
    3⤵
    - Interacts with shadow copies
    PID:4392
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Roaming\vcwtud.exe >> NUL
    3⤵
    PID:1508
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\VIRUSS~1.EXE >> NUL
  2⤵
  PID:5000

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2208

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1856

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3504

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

restore_files_xclsu.html

Path C:\Program Files\7-Zip\Lang\restore_files_xclsu.html
Size 4KB
SHA256 cddaeee19f7e963d1e498c6ff4b4cc8ea2dd1e3975b9b32b7321bc67be4405a5
MD5 e5d4f0e877f6c04ef361d3e957fae87b
SHA1 ebd6d23fb7e0ac77f32e7e8c10afaffc6acbbb6d
SHA512 dd5c181709f1a43ae83f69663055815307f9b0fea4b4a18e0dd8078a41f79919b1d3aa00faad94b592e0013309710ba4c5bb9a553fc2dfe7034b1c8223c54d43
SSDEEP 96:/m1ARl1Zj9TXd30dCdTdQdQdJd5dLyd4edLHV2gDm5ziZwGY93c+g/FDd+oxZJg0:+yDJt3qMpQoLro4o7Ijimtc+g/TlD11
MD5 SHA1 SHA512 SSDEEP

Submit Download

restore_files_xclsu.txt

Path C:\Program Files\7-Zip\Lang\restore_files_xclsu.txt
Size 2KB
SHA256 6f87015ce8f183c204222c2d6d46fc527fdad07fa8cc48f0a7a4facbadf5cc5c
MD5 8f0c636868a5f252e27cdd38eb82b734
SHA1 38acabedfa8316c8dc5d5f76c4aa6839300c36a2
SHA512 351e1d6fb857feaf683e0691585abd9aaa42e4aecefd8775624e4b7a8de3f238c7f1f09f34ee1b92139af681227176cfbde43f44def1c70074644fe65530b086
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654
MD5 439b5e04ca18c7fb02cf406e6eb24167
SHA1 e0c5bb6216903934726e3570b7d63295b9d28987
SHA512 d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb
MD5 a8e767fd33edd97d306efb6905f93252
SHA1 a6f80ace2b57599f64b0ae3c7381f34e9456f9d3
SHA512 07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 781246e5e5630fecd4c798f0595017a34c6d76a6d0e9a070be5c4a5e46fa0624
MD5 a9df8ffc932984cdd2195551f126d385
SHA1 8322ffdfa49bf137eb4b5872ff0727323ca813ae
SHA512 6504bf89dc7d8f8358c8807157bdb6b1efdb13bedc76ff87a5320384fa1ae286934cb396bedbffb463b347b13b42e94f83a4d7febe4e0d1cb4d2320896b26211
SSDEEP 96:nQjkZgc1ZtwpvWMoiVmdeHBrzi3UWQyV+VDCziEwb:nQjkycbtGWMXo3ro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 9fdca5d69377818735c282c5009f9e18f5c7d90190b4dbd39e4e37558760ade5
MD5 fe302c07c0231a32151947d664427ee7
SHA1 03224a02282148957f2de8d6c8d2de5f67c100bb
SHA512 2e9f02ae5bd9070ac9cb7bf7a0887c60c3bbe96ec4250c7216af7deaccc6001cb7577d56e64f4dbc66e6b131b7263243c279bc6bc770b273263bd3724262a593
SSDEEP 96:nQjkZgc1ZdwpvWMoiVmdeHBrzi3UWQyV+VD7AiEwb:nQjkycbdGWMXo3rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 aeda25548b1e4a42b3fe60df1029cde1d1e352b5145313b7998956570a5c09b1
MD5 d4df15eaf10fcec7da4bd30d0dfc7221
SHA1 874ba43518577415aa3256b921c8cfaf6b325f32
SHA512 6297614adba4d07f69c15ff55bd2da94dec1b60cf12c2156383af87468c4f247ee89257be51a950f3ab9d7cd45777ddad669f393fcef0cfdcfaee564cd8b2df3
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupLHQe2RUrJMj20:A9iIxuERzA83h09RZxYLHO8Sy0
MD5 SHA1 SHA512 SSDEEP

Submit Download

vcwtud.exe

Path C:\Users\Admin\AppData\Roaming\vcwtud.exe
Size 351KB
SHA256 893591a131400eeeb7fcd8f27cf32dfcc218778586e8376dcdd51d539f6ea246
MD5 15ccc8b6c5d3da5aa04ac0070ce02341
SHA1 622e79327ccb7e185a98b3d42b999dbdb0e78809
SHA512 20814ac6c67e2f970a2fd3d6b48f9950226847819d7b18408fe5ddbc7b99254d87f8d4ec0fbcb550cbd6ef2a2bac40382bc639961ca8be9b84ccd875723552ea
SSDEEP 6144:KaRueM6Ryfe3vIHbG6TK2h0j+UCsTt99/lYPGEX:JRo6kgCG4K60j+UCmPYPGEX
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3084-13-0x0000000000400000-0x000000000074A000-memory.dmp

Download

memory/3084-15-0x0000000074760000-0x0000000074799000-memory.dmp

Download

memory/3084-0-0x0000000000D10000-0x0000000000D14000-memory.dmp

Download

memory/3084-5-0x0000000074760000-0x0000000074799000-memory.dmp

Download

memory/3084-4-0x0000000000DD0000-0x0000000000DD3000-memory.dmp

Download

memory/3084-1-0x0000000000400000-0x000000000074A000-memory.dmp

Download

memory/3628-3484-0x0000000000400000-0x000000000074A000-memory.dmp

Download

memory/3628-7639-0x0000000000400000-0x000000000074A000-memory.dmp

Download

memory/3628-7646-0x0000000000400000-0x000000000074A000-memory.dmp

Download

memory/3628-16-0x0000000074760000-0x0000000074799000-memory.dmp

Download

memory/3628-7648-0x0000000074760000-0x0000000074799000-memory.dmp

Download

memory/3628-14-0x0000000002440000-0x0000000002443000-memory.dmp

Download

memory/3628-10-0x0000000000400000-0x000000000074A000-memory.dmp

Download