9b0939fa4c00061cb9588ae8d30679fe92d46e38f48af6c7bad1317c5e93d2e0

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
10/06/2024, 10:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
VirusShare_24ef7dbc0af02da64c4b08f54c82db33.exe
Size 368KB
Sample240610-mvfc9agg62
SHA256 9b0939fa4c00061cb9588ae8d30679fe92d46e38f48af6c7bad1317c5e93d2e0
MD5 24ef7dbc0af02da64c4b08f54c82db33
SHA1 f3d6f41f21e0dc1d26e42ff80b76308a6fcb112b
SHA512 6b9a258be7ed09ad876c3b9a4329e9af56c06ab74cc1aa4d8db1b99dc8bd70311b301be4c80f5f00c3f8ac1630dd21b152c1210b8c9c8b32251061d7eae5aa2e
SSDEEP 6144:4BVsLLdsgLTCEUyQETKuSkPZ5PMVhewjAn6EYIW2gBsKTp0aLXWoRRBJY9HJJRws:rV3hLQET9P5UP06E+HsKl0aLNbs
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

defense_evasion execution impact persistence ransomware spyware stealer

Malware Config

Extracted

Path

C:\Program Files\7-Zip\Lang\+-xxx-HELP-xxx-+qkqlg-+.txt

Ransom Note

---------------------------------------------------- NOT YOUR LANGUAGE? USE https://translate.google.com What's the matter with your files? Your data was secured using a strong encryption with RSA4096. Use the link down below to find additional information on the encryption keys using RSA-4096 https://en.wikipedia.org/wiki/RSA_(cryptosystem) What exactly that means? It means that on a structural level your files have been transformed . You won't be able to use , read , see or work with them anymore . In other words they are useless , however , there is a possibility to restore them with our help . What exactly happened to your files ??? *** Two personal RSA-4096 keys were generated for your PC/Laptop; one key is public, another key is private. *** All your data and files were encrypted by the means of the public key , which you received over the web . *** In order to decrypt your data and gain access to your computer you need a private key and a decryption software, which can be found on one of our secret servers. What should you do next ? There are several options for you to consider : *** You can wait for a while until the price of a private key will raise, so you will have to pay twice as much to access your files or *** You can start getting BitCoins right now and get access to your data quite fast . In case you have valuable files , we advise you to act fast as there is no other option rather than paying in order to get back your data. In order to obtain specific instructions , please access your personal homepage by choosing one of the few addresses down below : http://9hrds.wolfcrap.at/8CF7CD669A598CEC http://6g4ds.froekuge.com/8CF7CD669A598CEC http://vewrb.italisumo.at/8CF7CD669A598CEC If you can't access your personal homepage or the addresses are not working, complete the following steps: *** Download TOR Browser - http://www.torproject.org/projects/torbrowser.html.en *** Install TOR Browser and open TOR Browser *** Insert the following link in the address bar: k7tlx3ghr3m4n2tu.onion/8CF7CD669A598CEC *** Follow instructions on your screen !!! *** *** *** *** *** *** *** IMPORTANT INFORMATION *** *** *** *** *** *** Your personal homepages http://9hrds.wolfcrap.at/8CF7CD669A598CEC http://6g4ds.froekuge.com/8CF7CD669A598CEC http://vewrb.italisumo.at/8CF7CD669A598CEC Your personal homepage Tor-Browser k7tlx3ghr3m4n2tu.onion/8CF7CD669A598CEC Your personal ID 8CF7CD669A598CEC

URLs

http://9hrds.wolfcrap.at/8CF7CD669A598CEC
http://6g4ds.froekuge.com/8CF7CD669A598CEC
http://vewrb.italisumo.at/8CF7CD669A598CEC
http://k7tlx3ghr3m4n2tu.onion/8CF7CD669A598CEC

Signatures

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	VirusShare_24ef7dbc0af02da64c4b08f54c82db33.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	fwcechb.exe

Drops startup file 6 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\+-xxx-HELP-xxx-+qkqlg-+.txt	fwcechb.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\+-xxx-HELP-xxx-+qkqlg-+.html	fwcechb.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\+-xxx-HELP-xxx-+qkqlg-+.png	fwcechb.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\+-xxx-HELP-xxx-+qkqlg-+.txt	fwcechb.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\+-xxx-HELP-xxx-+qkqlg-+.html	fwcechb.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\+-xxx-HELP-xxx-+qkqlg-+.png	fwcechb.exe

Executes dropped EXE 2 IoCs

pid	Process
1644	fwcechb.exe
5036	fwcechb.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svc-jkru = "C:\\Windows\\system32\\cmd /C start \" \" \"C:\\Users\\Admin\\Documents\\fwcechb.exe\""	fwcechb.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 968 set thread context of 4848	968	VirusShare_24ef7dbc0af02da64c4b08f54c82db33.exe	94
PID 1644 set thread context of 5036	1644	fwcechb.exe	98

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\+-xxx-HELP-xxx-+qkqlg-+.png	fwcechb.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteSplashLogo.scale-125.png	fwcechb.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxCalendarBadge.scale-150.png	fwcechb.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxCalendarLogoExtensions.scale-16.png	fwcechb.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\ExchangeMediumTile.scale-150.png	fwcechb.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsStore_11910.1002.5.0_neutral_split.scale-125_8wekyb3d8bbwe\microsoft.system.package.metadata\+-xxx-HELP-xxx-+qkqlg-+.txt	fwcechb.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\EmptySearch-Dark.scale-125.png	fwcechb.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxCalendarAppList.targetsize-32.png	fwcechb.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\LinkedInboxWideTile.scale-100.png	fwcechb.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\nl-NL\+-xxx-HELP-xxx-+qkqlg-+.png	fwcechb.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-black_scale-180.png	fwcechb.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSIPC\ar\+-xxx-HELP-xxx-+qkqlg-+.html	fwcechb.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSIPC\ru\+-xxx-HELP-xxx-+qkqlg-+.txt	fwcechb.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\MapsAppList.targetsize-36_altform-unplated_contrast-white.png	fwcechb.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.NET.Native.Framework.2.2_2.2.27405.0_x64__8wekyb3d8bbwe\logo.png	fwcechb.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteAppList.scale-200.png	fwcechb.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\bg6_thumb.png	fwcechb.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Place\LTR\+-xxx-HELP-xxx-+qkqlg-+.html	fwcechb.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\OutlookMailLargeTile.scale-125.png	fwcechb.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.34.28001.0_x64__8wekyb3d8bbwe\Assets\MixerBranding\+-xxx-HELP-xxx-+qkqlg-+.html	fwcechb.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\pl-PL\+-xxx-HELP-xxx-+qkqlg-+.png	fwcechb.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\RNApp\app\uwp\images\commerce\+-xxx-HELP-xxx-+qkqlg-+.html	fwcechb.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\en\+-xxx-HELP-xxx-+qkqlg-+.png	fwcechb.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ko\LC_MESSAGES\+-xxx-HELP-xxx-+qkqlg-+.html	fwcechb.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Win10\MicrosoftSolitaireAppList.targetsize-48_altform-unplated.png	fwcechb.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\PhotosApp\+-xxx-HELP-xxx-+qkqlg-+.html	fwcechb.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxIdentityProvider_12.50.6001.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\+-xxx-HELP-xxx-+qkqlg-+.txt	fwcechb.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\Attribution\holiday_weather.png	fwcechb.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteSectionGroupSmallTile.scale-100.png	fwcechb.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteSectionSmallTile.scale-125.png	fwcechb.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\ScreenSketchWide310x150Logo.scale-200_contrast-white.png	fwcechb.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\FlagToastQuickAction.scale-80.png	fwcechb.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-60_contrast-white.png	fwcechb.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\+-xxx-HELP-xxx-+qkqlg-+.html	fwcechb.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-black\WideTile.scale-125_contrast-black.png	fwcechb.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\Standard.targetsize-16_contrast-white.png	fwcechb.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxMailLargeTile.scale-100.png	fwcechb.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Microsoft.Membership.MeControl\+-xxx-HELP-xxx-+qkqlg-+.png	fwcechb.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\it-IT\+-xxx-HELP-xxx-+qkqlg-+.png	fwcechb.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\SmallTile.scale-200.png	fwcechb.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\+-xxx-HELP-xxx-+qkqlg-+.txt	fwcechb.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_flat_10_000000_40x100.png	fwcechb.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Car\RTL\contrast-black\WideTile.scale-100.png	fwcechb.exe
File opened for modification	C:\Program Files\7-Zip\+-xxx-HELP-xxx-+qkqlg-+.txt	fwcechb.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\SmallTile.scale-200.png	fwcechb.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\iadata\+-xxx-HELP-xxx-+qkqlg-+.txt	fwcechb.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\CardUIBkg.scale-100.HCWhite.png	fwcechb.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-32_altform-unplated_contrast-black.png	fwcechb.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\InsiderHubSmallTile.scale-100_contrast-black.png	fwcechb.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\ODBC\+-xxx-HELP-xxx-+qkqlg-+.html	fwcechb.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxApp_48.49.31001.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\GamesXboxHubLargeTile.scale-200_contrast-white.png	fwcechb.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\+-xxx-HELP-xxx-+qkqlg-+.png	fwcechb.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-48_altform-unplated.png	fwcechb.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_neutral_~_8wekyb3d8bbwe\microsoft.system.package.metadata\+-xxx-HELP-xxx-+qkqlg-+.png	fwcechb.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.targetsize-80_altform-unplated_contrast-white.png	fwcechb.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\PlaceCard\+-xxx-HELP-xxx-+qkqlg-+.html	fwcechb.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxCalendarAppList.targetsize-48.png	fwcechb.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-32_contrast-white.png	fwcechb.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-white\OrientationControlInnerCircle.png	fwcechb.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\+-xxx-HELP-xxx-+qkqlg-+.png	fwcechb.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\tr-TR\View3d\+-xxx-HELP-xxx-+qkqlg-+.html	fwcechb.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftEdge.Stable_92.0.902.67_neutral__8wekyb3d8bbwe\Logo.png	fwcechb.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\Assets\Images\SkypeAppList.targetsize-48_altform-unplated_contrast-white.png	fwcechb.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_neutral_split.scale-100_8wekyb3d8bbwe\microsoft.system.package.metadata\+-xxx-HELP-xxx-+qkqlg-+.txt	fwcechb.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Interacts with shadow copies 2 TTPs 2 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

pid	Process
4236	vssadmin.exe
1348	vssadmin.exe

Modifies data under HKEY_USERS 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\trueimg	fwcechb.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings	fwcechb.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5036	fwcechb.exe
5036	fwcechb.exe
5036	fwcechb.exe
5036	fwcechb.exe
5036	fwcechb.exe
5036	fwcechb.exe
5036	fwcechb.exe
5036	fwcechb.exe
5036	fwcechb.exe
5036	fwcechb.exe
5036	fwcechb.exe
5036	fwcechb.exe
5036	fwcechb.exe
5036	fwcechb.exe
5036	fwcechb.exe
5036	fwcechb.exe
5036	fwcechb.exe
5036	fwcechb.exe
5036	fwcechb.exe
5036	fwcechb.exe
5036	fwcechb.exe
5036	fwcechb.exe
5036	fwcechb.exe
5036	fwcechb.exe
5036	fwcechb.exe
5036	fwcechb.exe
5036	fwcechb.exe
5036	fwcechb.exe
5036	fwcechb.exe
5036	fwcechb.exe
5036	fwcechb.exe
5036	fwcechb.exe
5036	fwcechb.exe
5036	fwcechb.exe
5036	fwcechb.exe
5036	fwcechb.exe
5036	fwcechb.exe
5036	fwcechb.exe
5036	fwcechb.exe
5036	fwcechb.exe
5036	fwcechb.exe
5036	fwcechb.exe
5036	fwcechb.exe
5036	fwcechb.exe
5036	fwcechb.exe
5036	fwcechb.exe
5036	fwcechb.exe
5036	fwcechb.exe
5036	fwcechb.exe
5036	fwcechb.exe
5036	fwcechb.exe
5036	fwcechb.exe
5036	fwcechb.exe
5036	fwcechb.exe
5036	fwcechb.exe
5036	fwcechb.exe
5036	fwcechb.exe
5036	fwcechb.exe
5036	fwcechb.exe
5036	fwcechb.exe
5036	fwcechb.exe
5036	fwcechb.exe
5036	fwcechb.exe
5036	fwcechb.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	5036	fwcechb.exe
Token: SeBackupPrivilege	4900	vssvc.exe
Token: SeRestorePrivilege	4900	vssvc.exe
Token: SeAuditPrivilege	4900	vssvc.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 968 wrote to memory of 4848	968	VirusShare_24ef7dbc0af02da64c4b08f54c82db33.exe	94
PID 968 wrote to memory of 4848	968	VirusShare_24ef7dbc0af02da64c4b08f54c82db33.exe	94
PID 968 wrote to memory of 4848	968	VirusShare_24ef7dbc0af02da64c4b08f54c82db33.exe	94
PID 968 wrote to memory of 4848	968	VirusShare_24ef7dbc0af02da64c4b08f54c82db33.exe	94
PID 968 wrote to memory of 4848	968	VirusShare_24ef7dbc0af02da64c4b08f54c82db33.exe	94
PID 968 wrote to memory of 4848	968	VirusShare_24ef7dbc0af02da64c4b08f54c82db33.exe	94
PID 968 wrote to memory of 4848	968	VirusShare_24ef7dbc0af02da64c4b08f54c82db33.exe	94
PID 968 wrote to memory of 4848	968	VirusShare_24ef7dbc0af02da64c4b08f54c82db33.exe	94
PID 968 wrote to memory of 4848	968	VirusShare_24ef7dbc0af02da64c4b08f54c82db33.exe	94
PID 968 wrote to memory of 4848	968	VirusShare_24ef7dbc0af02da64c4b08f54c82db33.exe	94
PID 4848 wrote to memory of 1644	4848	VirusShare_24ef7dbc0af02da64c4b08f54c82db33.exe	95
PID 4848 wrote to memory of 1644	4848	VirusShare_24ef7dbc0af02da64c4b08f54c82db33.exe	95
PID 4848 wrote to memory of 1644	4848	VirusShare_24ef7dbc0af02da64c4b08f54c82db33.exe	95
PID 4848 wrote to memory of 5096	4848	VirusShare_24ef7dbc0af02da64c4b08f54c82db33.exe	96
PID 4848 wrote to memory of 5096	4848	VirusShare_24ef7dbc0af02da64c4b08f54c82db33.exe	96
PID 4848 wrote to memory of 5096	4848	VirusShare_24ef7dbc0af02da64c4b08f54c82db33.exe	96
PID 1644 wrote to memory of 5036	1644	fwcechb.exe	98
PID 1644 wrote to memory of 5036	1644	fwcechb.exe	98
PID 1644 wrote to memory of 5036	1644	fwcechb.exe	98
PID 1644 wrote to memory of 5036	1644	fwcechb.exe	98
PID 1644 wrote to memory of 5036	1644	fwcechb.exe	98
PID 1644 wrote to memory of 5036	1644	fwcechb.exe	98
PID 1644 wrote to memory of 5036	1644	fwcechb.exe	98
PID 1644 wrote to memory of 5036	1644	fwcechb.exe	98
PID 1644 wrote to memory of 5036	1644	fwcechb.exe	98
PID 1644 wrote to memory of 5036	1644	fwcechb.exe	98
PID 5036 wrote to memory of 4236	5036	fwcechb.exe	99
PID 5036 wrote to memory of 4236	5036	fwcechb.exe	99
PID 5036 wrote to memory of 4304	5036	fwcechb.exe	104
PID 5036 wrote to memory of 4304	5036	fwcechb.exe	104
PID 5036 wrote to memory of 4304	5036	fwcechb.exe	104
PID 5036 wrote to memory of 3808	5036	fwcechb.exe	105
PID 5036 wrote to memory of 3808	5036	fwcechb.exe	105
PID 3808 wrote to memory of 284	3808	msedge.exe	106
PID 3808 wrote to memory of 284	3808	msedge.exe	106
PID 5036 wrote to memory of 1348	5036	fwcechb.exe	107
PID 5036 wrote to memory of 1348	5036	fwcechb.exe	107
PID 3808 wrote to memory of 4832	3808	msedge.exe	109
PID 3808 wrote to memory of 4832	3808	msedge.exe	109
PID 3808 wrote to memory of 4832	3808	msedge.exe	109
PID 3808 wrote to memory of 4832	3808	msedge.exe	109
PID 3808 wrote to memory of 4832	3808	msedge.exe	109
PID 3808 wrote to memory of 4832	3808	msedge.exe	109
PID 3808 wrote to memory of 4832	3808	msedge.exe	109
PID 3808 wrote to memory of 4832	3808	msedge.exe	109
PID 3808 wrote to memory of 4832	3808	msedge.exe	109
PID 3808 wrote to memory of 4832	3808	msedge.exe	109
PID 3808 wrote to memory of 4832	3808	msedge.exe	109
PID 3808 wrote to memory of 4832	3808	msedge.exe	109
PID 3808 wrote to memory of 4832	3808	msedge.exe	109
PID 3808 wrote to memory of 4832	3808	msedge.exe	109
PID 3808 wrote to memory of 4832	3808	msedge.exe	109
PID 3808 wrote to memory of 4832	3808	msedge.exe	109
PID 3808 wrote to memory of 4832	3808	msedge.exe	109
PID 3808 wrote to memory of 4832	3808	msedge.exe	109
PID 3808 wrote to memory of 4832	3808	msedge.exe	109
PID 3808 wrote to memory of 4832	3808	msedge.exe	109
PID 3808 wrote to memory of 4832	3808	msedge.exe	109
PID 3808 wrote to memory of 4832	3808	msedge.exe	109
PID 3808 wrote to memory of 4832	3808	msedge.exe	109
PID 3808 wrote to memory of 4832	3808	msedge.exe	109
PID 3808 wrote to memory of 4832	3808	msedge.exe	109
PID 3808 wrote to memory of 4832	3808	msedge.exe	109
PID 3808 wrote to memory of 4832	3808	msedge.exe	109

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\VirusShare_24ef7dbc0af02da64c4b08f54c82db33.exe
"C:\Users\Admin\AppData\Local\Temp\VirusShare_24ef7dbc0af02da64c4b08f54c82db33.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:968
- C:\Users\Admin\AppData\Local\Temp\VirusShare_24ef7dbc0af02da64c4b08f54c82db33.exe
  "C:\Users\Admin\AppData\Local\Temp\VirusShare_24ef7dbc0af02da64c4b08f54c82db33.exe"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:4848
- - C:\Users\Admin\Documents\fwcechb.exe
    C:\Users\Admin\Documents\fwcechb.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:1644
  - - C:\Users\Admin\Documents\fwcechb.exe
      C:\Users\Admin\Documents\fwcechb.exe
      4⤵
      Checks computer location settings
      Drops startup file
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Program Files directory
      Modifies data under HKEY_USERS
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:5036
    - - C:\Windows\System32\vssadmin.exe
        
        "C:\Windows\System32\vssadmin.exe" Delete Shadows /All /Quiet
        5⤵
        Interacts with shadow copies
        
        PID:4236
    - - C:\Windows\SysWOW64\NOTEPAD.EXE
        
        "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\+-xxx-HELP-xxx-+qkqlg-+.txt
        5⤵
        
        PID:4304
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\+-xxx-HELP-xxx-+qkqlg-+.html
        5⤵
        Enumerates system info in registry
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:3808
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffba9d46f8,0x7fffba9d4708,0x7fffba9d4718
        6⤵
        
        PID:284
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,13729430731162634224,6158674536674857495,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
        6⤵
        
        PID:4832
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,13729430731162634224,6158674536674857495,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 /prefetch:3
        6⤵
        
        PID:792
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,13729430731162634224,6158674536674857495,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2872 /prefetch:8
        6⤵
        
        PID:3696
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,13729430731162634224,6158674536674857495,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
        6⤵
        
        PID:492
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,13729430731162634224,6158674536674857495,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
        6⤵
        
        PID:4752
      - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,13729430731162634224,6158674536674857495,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5132 /prefetch:8
        6⤵
        
        PID:4440
      - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,13729430731162634224,6158674536674857495,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5132 /prefetch:8
        6⤵
        
        PID:4112
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,13729430731162634224,6158674536674857495,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5216 /prefetch:1
        6⤵
        
        PID:2108
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,13729430731162634224,6158674536674857495,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5232 /prefetch:1
        6⤵
        
        PID:3232
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,13729430731162634224,6158674536674857495,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5672 /prefetch:1
        6⤵
        
        PID:4868
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,13729430731162634224,6158674536674857495,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5660 /prefetch:1
        6⤵
        
        PID:4292
    - - C:\Windows\System32\vssadmin.exe
        
        "C:\Windows\System32\vssadmin.exe" Delete Shadows /All /Quiet
        5⤵
        Interacts with shadow copies
        
        PID:1348
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\DOCUME~1\fwcechb.exe >> NUL
        5⤵
        
        PID:2584
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\AppData\Local\Temp\VIRUSS~1.EXE >> NUL
    3⤵
    PID:5096

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4900

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3664

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1832

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

+-xxx-HELP-xxx-+qkqlg-+.html

Path C:\Program Files\7-Zip\Lang\+-xxx-HELP-xxx-+qkqlg-+.html
Size 6KB
SHA256 2ccaf4a3db33961934a9a24fef82b30800a86b2b8427e35e7b699d7fd6bffbb8
MD5 83ba433a69b2dffa1184fec03ee54fed
SHA1 51b3c97277c9a94f1af6f3ea239e34a925216471
SHA512 ec7788f08ed858a3fe0da00dd41fb14582bfe14747b6c34f4409bd054b81cef34a05c1dc09509e124294df51021c8dce2e6588a9dde19606298bcc87ba4e127b
SSDEEP 192:uqcpqMYjB2JcDDdEBuzcdlu8xb6kbEqxJurZ:6BYt2Jiddziu8xb6komg1
MD5 SHA1 SHA512 SSDEEP

Submit Download

+-xxx-HELP-xxx-+qkqlg-+.png

Path C:\Program Files\7-Zip\Lang\+-xxx-HELP-xxx-+qkqlg-+.png
Size 75KB
SHA256 d05ab8faf254ad7862072962e86b06dc03d57c9088565b0adbf10841e743c56d
MD5 be8e4cc7aabf53d66da43eaee0923be1
SHA1 5280fadc90420736500f471a5df8d881193527ce
SHA512 62afbd3e24f2d36e9a2911e5eb64bd9da0fa9bc15ea84fc392fada9aa9cb9e4b513d21b87429b9898e66c902d76f5d06577c04311e7fb4b54c202135f0f4c99d
SSDEEP 1536:jI7Go2kt2Z/IKrNWztHJJqq3XbhxFbYqzAahJ2mPw+y437IV88Mae+XIPeMV:jcGkwVI+Q3xi8AahJFH78feLPeW
MD5 SHA1 SHA512 SSDEEP

Submit Download

+-xxx-HELP-xxx-+qkqlg-+.txt

Path C:\Program Files\7-Zip\Lang\+-xxx-HELP-xxx-+qkqlg-+.txt
Size 2KB
SHA256 91fd530659a634d2e002a06b6920e7cd5ed3f9046f57c510f2fef06d2ccab666
MD5 57dab982a2c56bbf6924d8139943c8b4
SHA1 5a465169957cc6de6b01739916dbeaa3c2c1c4b2
SHA512 d04390954f7bd34290934fd794453a5675995d64a4cb961ba90721174f2f4504e02881b5f05482ee9dd5e365f1c2b0fbf9cd39c027761f8327924b370def7967
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654
MD5 439b5e04ca18c7fb02cf406e6eb24167
SHA1 e0c5bb6216903934726e3570b7d63295b9d28987
SHA512 d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb
MD5 a8e767fd33edd97d306efb6905f93252
SHA1 a6f80ace2b57599f64b0ae3c7381f34e9456f9d3
SHA512 07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 07ffbaeb25528a2bb97ed92fd81b6edbdfea2b53f42007c7f231a4849a166722
MD5 e12ca16a73e23e795b459707cd9acdb7
SHA1 ca087d1a09fec0f380a0a2a4e0c393e97feaa106
SHA512 a73f3a4ae29cd1b9b992c582cf07c7f70703eccfc5a5aeb19b7c6b6ce10805183f732514871f0b62f551ac4c4a602827bf7aa162bfd34aaf95bca65ced6c64fe
SSDEEP 96:nFAkhKL1mBwpvWMoiVmdeHBrzSdUWQyV+VDCziEwb:nFAk6wBGWMXsdro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 14ce8bbe0f8182de6f4d6f8bf4f91e709a7b0398d1326e5a8f0255ffd788b814
MD5 300b70651317f39346d465af2447f6ff
SHA1 4b15d7ac2b306f288d23526a1983186df83a6287
SHA512 c6a2b6ea241565f855d9b015157b0da63efb87c1dfaf2506f476c70c62d6218d0f6c4bdafd0353ef6f6e8874c65e8e23a5cca11605f2f84cb131f01e97052e36
SSDEEP 96:nFAksKL1mZwpvWMoiVmdeHBrzSdUWQyV+VD7AiEwb:nFAkRwZGWMXsdrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 d516fcd8d5fbb36c77506e7403c4f874e6808434f2fc8ca1a0d9e2b270beb1f0
MD5 b5f435f95c175368ca68d97d75b3b94a
SHA1 dbcc03c5b45d746770b7594ac619ebc99647972d
SHA512 5d333b0fa10fd35bc28076ea700e44bdb95839d9b840eb4cbf4754a2365a569075d360c8051dae7292f7a7dad3a4e45055d4ea969d1029686a6f593a9a7db81d
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupRHZe2RU1Mj2d3z2OMDCRHo:A9iIxuERzA83h09RZxYRHNTydaOMWRHo
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppCache133596482251867970.txt

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133596482251867970.txt
Size 75KB
SHA256 b2317636ba0e87474bc1781340ed8be06b859cc24eaaf5c765d64a5de479da8f
MD5 243d52406695c430b6c8f9789adb087b
SHA1 3e33dcccbdabd3e2ba4ad3a2c58948565edb4ce4
SHA512 58baa2c850e28c8759f57e94e8ab3121105e88cb5cb619fd990e7fa0aedb46da894e218c28c09c21d0a705a5e42023c62d72a9152eabd4aea0c71c1a1eb92559
SSDEEP 1536:xrqaQ0F/VW1hcJROi9LJXtC/+IOnMTNruDXj5ArBnrMXIvgQ:xrNjVVInGLemIRNGXj5CvgQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

fwcechb.exe

Path C:\Users\Admin\Documents\fwcechb.exe
Size 368KB
SHA256 9b0939fa4c00061cb9588ae8d30679fe92d46e38f48af6c7bad1317c5e93d2e0
MD5 24ef7dbc0af02da64c4b08f54c82db33
SHA1 f3d6f41f21e0dc1d26e42ff80b76308a6fcb112b
SHA512 6b9a258be7ed09ad876c3b9a4329e9af56c06ab74cc1aa4d8db1b99dc8bd70311b301be4c80f5f00c3f8ac1630dd21b152c1210b8c9c8b32251061d7eae5aa2e
SSDEEP 6144:4BVsLLdsgLTCEUyQETKuSkPZ5PMVhewjAn6EYIW2gBsKTp0aLXWoRRBJY9HJJRws:rV3hLQET9P5UP06E+HsKl0aLNbs
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/968-0-0x0000000000620000-0x0000000000626000-memory.dmp

Download

memory/968-4-0x0000000000620000-0x0000000000626000-memory.dmp

Download

memory/968-1-0x0000000000620000-0x0000000000626000-memory.dmp

Download

memory/1644-13-0x0000000000400000-0x00000000004CA000-memory.dmp

Download

memory/4848-17-0x0000000075570000-0x00000000755A9000-memory.dmp

Download

memory/4848-16-0x0000000000400000-0x0000000000473000-memory.dmp

Download

memory/4848-2-0x0000000000400000-0x0000000000473000-memory.dmp

Download

memory/4848-3-0x0000000000400000-0x0000000000473000-memory.dmp

Download

memory/4848-5-0x0000000000400000-0x0000000000473000-memory.dmp

Download

memory/4848-6-0x0000000000400000-0x0000000000473000-memory.dmp

Download

memory/4848-7-0x0000000075570000-0x00000000755A9000-memory.dmp

Download

memory/5036-3810-0x0000000000400000-0x0000000000473000-memory.dmp

Download

memory/5036-21-0x0000000000400000-0x0000000000473000-memory.dmp

Download

memory/5036-6548-0x0000000000400000-0x0000000000473000-memory.dmp

Download

memory/5036-20-0x0000000000400000-0x0000000000473000-memory.dmp

Download

memory/5036-9219-0x0000000000400000-0x0000000000473000-memory.dmp

Download

memory/5036-9492-0x0000000000400000-0x0000000000473000-memory.dmp

Download

memory/5036-9493-0x0000000000400000-0x0000000000473000-memory.dmp

Download

memory/5036-9501-0x0000000000400000-0x0000000000473000-memory.dmp

Download

memory/5036-9502-0x0000000000400000-0x0000000000473000-memory.dmp

Download

memory/5036-3811-0x0000000000400000-0x0000000000473000-memory.dmp

Download

memory/5036-22-0x0000000000400000-0x0000000000473000-memory.dmp

Download

memory/5036-28-0x0000000000400000-0x0000000000473000-memory.dmp

Download

memory/5036-1812-0x0000000000400000-0x0000000000473000-memory.dmp

Download

memory/5036-9546-0x0000000000400000-0x0000000000473000-memory.dmp

Download

memory/5036-9547-0x0000000075340000-0x0000000075379000-memory.dmp

Download

memory/5036-519-0x0000000000400000-0x0000000000473000-memory.dmp

Download

memory/5036-23-0x0000000075340000-0x0000000075379000-memory.dmp

Download

memory/5036-24-0x0000000000400000-0x0000000000473000-memory.dmp

Download

memory/5036-26-0x0000000000400000-0x0000000000473000-memory.dmp

Download