95de4a72ca8bc89fcd9ec20eeab765d7250de9b538bd039cd70b82a2088348a8

Analysis

max time kernel
142s
max time network
132s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
12/06/2024, 01:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5dc09af1611205550b6a385cbae0c330.exe
Size 317KB
Sample240612-b72apsyblp
SHA256 95de4a72ca8bc89fcd9ec20eeab765d7250de9b538bd039cd70b82a2088348a8
MD5 5dc09af1611205550b6a385cbae0c330
SHA1 84493358a8402389a0c9e6bfd0866dc225d9b03d
SHA512 c98d9f592aca552c82cea0329572c6527d9e5782d57e4b0305f180071c61726309713eb3b7ca7ef80352408e59a4c1bdccc4c8de613db3a67b9e410579053438
SSDEEP 6144:PBa6C5aNsrKEwmfMtAkDhy0GCLFg/M5yVwC2amWyPNjx:4NaN2KEhMe+7GmFg/M9CXmjlF
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

defense_evasion execution impact persistence ransomware spyware stealer

Malware Config

Extracted

Path

C:\Program Files\7-Zip\Lang\restore_files_vvlwd.txt

Ransom Note

!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! What happened to your files ? All of your files were protected by a strong encryption with RSA-2048. More information about the encryption keys using RSA-2048 can be found here: http://en.wikipedia.org/wiki/RSA_(cryptosystem) What does this mean ? This means that the structure and data within your files have been irrevocably changed, you will not be able to work with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them. How did this happen ? Especially for you, on our server was generated the secret key pair RSA-2048 - public and private. All your files were encrypted with the public key, which has been transferred to your computer via the Internet. Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server. What do I do ? Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed. If you really value your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist. For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: 1. http://rtldkdh6.kghw88gh3eu.net/4905429B97F3A8 2. http://jsdf2wevw2.wrt23wqw34.net/4905429B97F3A8 3. https://7vhbukzxypxh3xfy.onion.to/4905429B97F3A8 If for some reasons the addresses are not available, follow these steps: 1. Download and install tor-browser: http://www.torproject.org/projects/torbrowser.html.en 2. After a successful installation, run the browser and wait for initialization. 3. Type in the address bar: 7vhbukzxypxh3xfy.onion/4905429B97F3A8 4. Follow the instructions on the site. IMPORTANT INFORMATION: Your personal pages: http://rtldkdh6.kghw88gh3eu.net/4905429B97F3A8 http://jsdf2wevw2.wrt23wqw34.net/4905429B97F3A8 https://7vhbukzxypxh3xfy.onion.to/4905429B97F3A8 Your personal page (using TOR): 7vhbukzxypxh3xfy.onion/4905429B97F3A8 Your personal identification number (if you open the site (or TOR 's) directly): 4905429B97F3A8

URLs

http://rtldkdh6.kghw88gh3eu.net/4905429B97F3A8
http://jsdf2wevw2.wrt23wqw34.net/4905429B97F3A8
https://7vhbukzxypxh3xfy.onion.to/4905429B97F3A8
http://7vhbukzxypxh3xfy.onion/4905429B97F3A8

Extracted

Path

C:\Program Files\7-Zip\Lang\restore_files_vvlwd.html

Ransom Note

<html>  <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; } .ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;">  <center> <div style="text-align:left; font-family:Arial;  font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"> What happened  to your files? All of your files were protected by a strong encryption with RSA-2048 More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a> What  does this mean? This means that the  structure and data within your files have been irrevocably changed, you will not be able to work with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them. How did this happen? Especially for you, on our server was generated the secret key pair RSA-2048 - public and private. All your  files were encrypted with the public key,  which has been  transferred to your computer via the Internet.  Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!! What do I do? Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed. If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist. <div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr> 1.<a href="http://rtldkdh6.kghw88gh3eu.net/4905429B97F3A8" target="_blank">http://rtldkdh6.kghw88gh3eu.net/4905429B97F3A8</a> 2.<a href="http://jsdf2wevw2.wrt23wqw34.net/4905429B97F3A8" target="_blank">http://jsdf2wevw2.wrt23wqw34.net/4905429B97F3A8</a> 3.<a href="https://7vhbukzxypxh3xfy.onion.to/4905429B97F3A8" target="_blank">https://7vhbukzxypxh3xfy.onion.to/4905429B97F3A8</a> </div> <div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr> 1.  Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a> 2.  After a successful installation, run the browser and wait for initialization. 3.  Type in the address bar: 7vhbukzxypxh3xfy.onion/4905429B97F3A8 4.  Follow the instructions on the site.</div> IMPORTANT INFORMATION: <div class="tb" style="width:790px;"> Your Personal PAGES: <a href="http://rtldkdh6.kghw88gh3eu.net/4905429B97F3A8" target="_blank">http://rtldkdh6.kghw88gh3eu.net/4905429B97F3A8</a> <a href="http://jsdf2wevw2.wrt23wqw34.net/4905429B97F3A8" target="_blank">http://jsdf2wevw2.wrt23wqw34.net/4905429B97F3A8</a> <a href="https://7vhbukzxypxh3xfy.onion.to/4905429B97F3A8" target="_blank"> https://7vhbukzxypxh3xfy.onion.to/4905429B97F3A8</a> Your Personal PAGE  (using TOR): 7vhbukzxypxh3xfy.onion/4905429B97F3A8 Your personal code  (if you open the site (or TOR 's) directly): 4905429B97F3A8 </div></div></center></body></html>

URLs

https://7vhbukzxypxh3xfy.onion.to/4905429B97F3A8</a>

Signatures

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047
Renames multiple (918) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Control Panel\International\Geo\Nation	5dc09af1611205550b6a385cbae0c330.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Control Panel\International\Geo\Nation	vcwecx.exe

Drops startup file 4 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\restore_files_vvlwd.txt	vcwecx.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\restore_files_vvlwd.html	vcwecx.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\restore_files_vvlwd.txt	vcwecx.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\restore_files_vvlwd.html	vcwecx.exe

Executes dropped EXE 1 IoCs

pid	Process
1160	vcwecx.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\helper_xgcv = "C:\\Users\\Admin\\AppData\\Roaming\\vcwecx.exe"	vcwecx.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\helper_xgcv = "C"	vcwecx.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
3	ipinfo.io
29	ipinfo.io

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Place\LTR\contrast-black\MedTile.scale-100.png	vcwecx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\Ratings\Yelp4.scale-200.png	vcwecx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\Assets\Audio\Skype_Dtmf_4.m4a	vcwecx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-60_altform-unplated_contrast-white.png	vcwecx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\restore_files_vvlwd.html	vcwecx.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxA-Google.scale-200.png	vcwecx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-30_altform-lightunplated.png	vcwecx.exe
File opened for modification	C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\restore_files_vvlwd.html	vcwecx.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ie\LC_MESSAGES\restore_files_vvlwd.html	vcwecx.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\lv\LC_MESSAGES\restore_files_vvlwd.html	vcwecx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\MapsAppList.targetsize-40_altform-unplated.png	vcwecx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\MapsAppList.targetsize-16.png	vcwecx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe\Assets\tinytile.targetsize-16_altform-unplated_contrast-black.png	vcwecx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\MediumGray.png	vcwecx.exe
File opened for modification	C:\Program Files\dotnet\host\fxr\8.0.2\restore_files_vvlwd.html	vcwecx.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\restore_files_vvlwd.html	vcwecx.exe
File opened for modification	C:\Program Files\MSBuild\restore_files_vvlwd.txt	vcwecx.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Place\RTL\contrast-white\LargeTile.scale-125.png	vcwecx.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsSoundRecorder_10.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\VoiceRecorderMedTile.contrast-white_scale-125.png	vcwecx.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Transit\contrast-black\MedTile.scale-125.png	vcwecx.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsSoundRecorder_10.1906.1972.0_neutral_split.scale-200_8wekyb3d8bbwe\microsoft.system.package.metadata\restore_files_vvlwd.html	vcwecx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\InsiderHubSplashWideTile.scale-100.png	vcwecx.exe
File opened for modification	C:\Program Files\Common Files\System\msadc\fr-FR\restore_files_vvlwd.txt	vcwecx.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\images\restore_files_vvlwd.html	vcwecx.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSIPC\eu\restore_files_vvlwd.html	vcwecx.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\el\restore_files_vvlwd.txt	vcwecx.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\ja-JP\restore_files_vvlwd.html	vcwecx.exe
File opened for modification	C:\Program Files\Windows Media Player\de-DE\restore_files_vvlwd.html	vcwecx.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\StopwatchMedTile.contrast-white_scale-125.png	vcwecx.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxMailSplashLogo.scale-100.png	vcwecx.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Redshift\lib\OpenSSL64.DllA\restore_files_vvlwd.txt	vcwecx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\GetStartedMedTile.scale-200.png	vcwecx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-white\SplashScreen.scale-100_contrast-white.png	vcwecx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteNewNoteWideTile.scale-100.png	vcwecx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\LargeTile.scale-200_contrast-white.png	vcwecx.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxA-Generic-Dark.scale-300.png	vcwecx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Car\RTL\contrast-black\WideTile.scale-200.png	vcwecx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-white\Movie-TVStoreLogo.scale-200_contrast-white.png	vcwecx.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsFeedbackHub_1.1907.3152.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\InsiderHubAppList.scale-125_contrast-white.png	vcwecx.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ZuneVideo_10.19071.19011.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\Logo.scale-125_contrast-white.png	vcwecx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-24_altform-unplated.png	vcwecx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\notificationsUI\fabric.components.min.css	vcwecx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_neutral_split.scale-100_kzf8qxf38zg5c\Assets\Images\SkypeMedTile.scale-100.png	vcwecx.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\EmptyCalendarSearch.scale-200.png	vcwecx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\restore_files_vvlwd.html	vcwecx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\eu-ES\View3d\restore_files_vvlwd.html	vcwecx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\ScreenSketchSquare71x71Logo.scale-100_contrast-black.png	vcwecx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-black\MedTile.scale-100_contrast-black.png	vcwecx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.targetsize-80_altform-fullcolor.png	vcwecx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.contrast-white_targetsize-30.png	vcwecx.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxA-Yahoo-Dark.scale-400.png	vcwecx.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Functions\Assertions\restore_files_vvlwd.html	vcwecx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Fonts\restore_files_vvlwd.txt	vcwecx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\az-Latn-AZ\restore_files_vvlwd.txt	vcwecx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-40.png	vcwecx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-36_contrast-black.png	vcwecx.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxA-Generic-Light.scale-125.png	vcwecx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_neutral_~_8wekyb3d8bbwe\restore_files_vvlwd.html	vcwecx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.contrast-black_targetsize-20_altform-unplated.png	vcwecx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.contrast-black_targetsize-72_altform-unplated.png	vcwecx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\AppxMetadata\restore_files_vvlwd.txt	vcwecx.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\restore_files_vvlwd.html	vcwecx.exe
File opened for modification	C:\Program Files\Windows Multimedia Platform\restore_files_vvlwd.html	vcwecx.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Car\LTR\restore_files_vvlwd.html	vcwecx.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Interacts with shadow copies 2 TTPs 2 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

pid	Process
4752	vssadmin.exe
2096	vssadmin.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings	vcwecx.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
4524	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1160	vcwecx.exe
1160	vcwecx.exe
1160	vcwecx.exe
1160	vcwecx.exe
1160	vcwecx.exe
1160	vcwecx.exe
1160	vcwecx.exe
1160	vcwecx.exe
1160	vcwecx.exe
1160	vcwecx.exe
1160	vcwecx.exe
1160	vcwecx.exe
1160	vcwecx.exe
1160	vcwecx.exe
1160	vcwecx.exe
1160	vcwecx.exe
1160	vcwecx.exe
1160	vcwecx.exe
1160	vcwecx.exe
1160	vcwecx.exe
1160	vcwecx.exe
1160	vcwecx.exe
1160	vcwecx.exe
1160	vcwecx.exe
1160	vcwecx.exe
1160	vcwecx.exe
1160	vcwecx.exe
1160	vcwecx.exe
1160	vcwecx.exe
1160	vcwecx.exe
1160	vcwecx.exe
1160	vcwecx.exe
1160	vcwecx.exe
1160	vcwecx.exe
1160	vcwecx.exe
1160	vcwecx.exe
1160	vcwecx.exe
1160	vcwecx.exe
1160	vcwecx.exe
1160	vcwecx.exe
1160	vcwecx.exe
1160	vcwecx.exe
1160	vcwecx.exe
1160	vcwecx.exe
1160	vcwecx.exe
1160	vcwecx.exe
1160	vcwecx.exe
1160	vcwecx.exe
1160	vcwecx.exe
1160	vcwecx.exe
1160	vcwecx.exe
1160	vcwecx.exe
1160	vcwecx.exe
1160	vcwecx.exe
1160	vcwecx.exe
1160	vcwecx.exe
1160	vcwecx.exe
1160	vcwecx.exe
1160	vcwecx.exe
1160	vcwecx.exe
1160	vcwecx.exe
1160	vcwecx.exe
1160	vcwecx.exe
1160	vcwecx.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	968	5dc09af1611205550b6a385cbae0c330.exe
Token: SeDebugPrivilege	1160	vcwecx.exe
Token: SeBackupPrivilege	1596	vssvc.exe
Token: SeRestorePrivilege	1596	vssvc.exe
Token: SeAuditPrivilege	1596	vssvc.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 968 wrote to memory of 1160	968	5dc09af1611205550b6a385cbae0c330.exe	83
PID 968 wrote to memory of 1160	968	5dc09af1611205550b6a385cbae0c330.exe	83
PID 968 wrote to memory of 1160	968	5dc09af1611205550b6a385cbae0c330.exe	83
PID 968 wrote to memory of 812	968	5dc09af1611205550b6a385cbae0c330.exe	84
PID 968 wrote to memory of 812	968	5dc09af1611205550b6a385cbae0c330.exe	84
PID 968 wrote to memory of 812	968	5dc09af1611205550b6a385cbae0c330.exe	84
PID 1160 wrote to memory of 2096	1160	vcwecx.exe	86
PID 1160 wrote to memory of 2096	1160	vcwecx.exe	86
PID 1160 wrote to memory of 4524	1160	vcwecx.exe	92
PID 1160 wrote to memory of 4524	1160	vcwecx.exe	92
PID 1160 wrote to memory of 4524	1160	vcwecx.exe	92
PID 1160 wrote to memory of 460	1160	vcwecx.exe	93
PID 1160 wrote to memory of 460	1160	vcwecx.exe	93
PID 460 wrote to memory of 1048	460	msedge.exe	94
PID 460 wrote to memory of 1048	460	msedge.exe	94
PID 1160 wrote to memory of 4752	1160	vcwecx.exe	95
PID 1160 wrote to memory of 4752	1160	vcwecx.exe	95
PID 460 wrote to memory of 3828	460	msedge.exe	97
PID 460 wrote to memory of 3828	460	msedge.exe	97
PID 460 wrote to memory of 3828	460	msedge.exe	97
PID 460 wrote to memory of 3828	460	msedge.exe	97
PID 460 wrote to memory of 3828	460	msedge.exe	97
PID 460 wrote to memory of 3828	460	msedge.exe	97
PID 460 wrote to memory of 3828	460	msedge.exe	97
PID 460 wrote to memory of 3828	460	msedge.exe	97
PID 460 wrote to memory of 3828	460	msedge.exe	97
PID 460 wrote to memory of 3828	460	msedge.exe	97
PID 460 wrote to memory of 3828	460	msedge.exe	97
PID 460 wrote to memory of 3828	460	msedge.exe	97
PID 460 wrote to memory of 3828	460	msedge.exe	97
PID 460 wrote to memory of 3828	460	msedge.exe	97
PID 460 wrote to memory of 3828	460	msedge.exe	97
PID 460 wrote to memory of 3828	460	msedge.exe	97
PID 460 wrote to memory of 3828	460	msedge.exe	97
PID 460 wrote to memory of 3828	460	msedge.exe	97
PID 460 wrote to memory of 3828	460	msedge.exe	97
PID 460 wrote to memory of 3828	460	msedge.exe	97
PID 460 wrote to memory of 3828	460	msedge.exe	97
PID 460 wrote to memory of 3828	460	msedge.exe	97
PID 460 wrote to memory of 3828	460	msedge.exe	97
PID 460 wrote to memory of 3828	460	msedge.exe	97
PID 460 wrote to memory of 3828	460	msedge.exe	97
PID 460 wrote to memory of 3828	460	msedge.exe	97
PID 460 wrote to memory of 3828	460	msedge.exe	97
PID 460 wrote to memory of 3828	460	msedge.exe	97
PID 460 wrote to memory of 3828	460	msedge.exe	97
PID 460 wrote to memory of 3828	460	msedge.exe	97
PID 460 wrote to memory of 3828	460	msedge.exe	97
PID 460 wrote to memory of 3828	460	msedge.exe	97
PID 460 wrote to memory of 3828	460	msedge.exe	97
PID 460 wrote to memory of 3828	460	msedge.exe	97
PID 460 wrote to memory of 3828	460	msedge.exe	97
PID 460 wrote to memory of 3828	460	msedge.exe	97
PID 460 wrote to memory of 3828	460	msedge.exe	97
PID 460 wrote to memory of 3828	460	msedge.exe	97
PID 460 wrote to memory of 3828	460	msedge.exe	97
PID 460 wrote to memory of 3828	460	msedge.exe	97
PID 460 wrote to memory of 3832	460	msedge.exe	98
PID 460 wrote to memory of 3832	460	msedge.exe	98
PID 460 wrote to memory of 768	460	msedge.exe	99
PID 460 wrote to memory of 768	460	msedge.exe	99
PID 460 wrote to memory of 768	460	msedge.exe	99
PID 460 wrote to memory of 768	460	msedge.exe	99
PID 460 wrote to memory of 768	460	msedge.exe	99

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	vcwecx.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1"	vcwecx.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\5dc09af1611205550b6a385cbae0c330.exe
"C:\Users\Admin\AppData\Local\Temp\5dc09af1611205550b6a385cbae0c330.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:968
- C:\Users\Admin\AppData\Roaming\vcwecx.exe
  C:\Users\Admin\AppData\Roaming\vcwecx.exe
  2⤵
  - Checks computer location settings
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Program Files directory
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:1160
- - C:\Windows\System32\vssadmin.exe
    "C:\Windows\System32\vssadmin.exe" delete shadows /all /Quiet
    3⤵
    - Interacts with shadow copies
    PID:2096
- - C:\Windows\SysWOW64\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\RESTORE_FILES.TXT
    3⤵
    - Opens file in notepad (likely ransom note)
    PID:4524
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\RESTORE_FILES.HTML
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:460
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffccef246f8,0x7ffccef24708,0x7ffccef24718
      4⤵
      PID:1048
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2004,14634063197303578057,17330843601537245421,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2076 /prefetch:2
      4⤵
      PID:3828
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2004,14634063197303578057,17330843601537245421,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
      4⤵
      PID:3832
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2004,14634063197303578057,17330843601537245421,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2760 /prefetch:8
      4⤵
      PID:768
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,14634063197303578057,17330843601537245421,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3136 /prefetch:1
      4⤵
      PID:3920
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,14634063197303578057,17330843601537245421,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3144 /prefetch:1
      4⤵
      PID:840
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2004,14634063197303578057,17330843601537245421,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4520 /prefetch:8
      4⤵
      PID:2204
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2004,14634063197303578057,17330843601537245421,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4520 /prefetch:8
      4⤵
      PID:4876
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,14634063197303578057,17330843601537245421,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4584 /prefetch:1
      4⤵
      PID:4500
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,14634063197303578057,17330843601537245421,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4168 /prefetch:1
      4⤵
      PID:2628
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,14634063197303578057,17330843601537245421,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5168 /prefetch:1
      4⤵
      PID:4752
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,14634063197303578057,17330843601537245421,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5180 /prefetch:1
      4⤵
      PID:964
- - C:\Windows\System32\vssadmin.exe
    "C:\Windows\System32\vssadmin.exe" delete shadows /all /Quiet
    3⤵
    - Interacts with shadow copies
    PID:4752
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Roaming\vcwecx.exe >> NUL
    3⤵
    PID:2988
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\5DC09A~1.EXE >> NUL
  2⤵
  PID:812

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1596

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4244

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2608

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

restore_files_vvlwd.html

Path C:\Program Files\7-Zip\Lang\restore_files_vvlwd.html
Size 5KB
SHA256 f91d6a1761bec55318f230a7f4e3e20e8d400e657cfb6ad6c6e7c53c6712c27f
MD5 71d3229ff9e74e412eb7df24790e82b6
SHA1 1ef44dac0b9f4a8e389cf59f30f9dd006790942e
SHA512 a04951554ba6489e0b27188d8964eeab76faaf2292cf6c440597f1decfb6ee37fa990d2bf13141549c15e2750d39823776e44dbb114d617b14e18c38835634f2
SSDEEP 96:/m1AwDl1Zj9TXd30dCdTdQdQdJd5dLyd4edLHV2gDm5ziZwGY93cYNYF7d+o7Ms5:+RDJt3qMpQoLro4o7IjimtcYNYbOyl
MD5 SHA1 SHA512 SSDEEP

Submit Download

restore_files_vvlwd.txt

Path C:\Program Files\7-Zip\Lang\restore_files_vvlwd.txt
Size 2KB
SHA256 d63cb7cc15a76bfbd03fe6ee531cf61bbfe6a5b6c250a73b405f883497edbf19
MD5 da71dfd22ee63326205ede0830c0cbb4
SHA1 1a46c4ac4689c526c2b30a6196dea75027b2d265
SHA512 f502e41d7ce2b5d10f481b66fb2054cea6bf2e9246eef88a0e6fb5d18f771a3ae7bb7152399683a2d1658d9646bc510748b5b71e3e734cbe36523bd913edd6e3
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 dfad4e020a946f85523604816a0a9781091ee4669c870db2cabab027f8b6f280
MD5 b4a74bc775caf3de7fc9cde3c30ce482
SHA1 c6ed3161390e5493f71182a6cb98d51c9063775d
SHA512 55578e254444a645f455ea38480c9e02599ebf9522c32aca50ff37aad33976db30e663d35ebe31ff0ecafb4007362261716f756b3a0d67ac3937ca62ff10e25f
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 a055d69c6aba59e97e632d118b7960a5fdfbe35cfdfaa0de14f194fc6f874716
MD5 c5abc082d9d9307e797b7e89a2f755f4
SHA1 54c442690a8727f1d3453b6452198d3ec4ec13df
SHA512 ad765cddbf89472988de5356db5e0ee254ca3475491c6034fba1897c373702ab7cfa4bd21662ab862eebb48a757c3eb86b1f8ed58629751f71863822a59cd26c
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 80b6907b6d810fc4e9c86984960f91895cf45c86ba260e43ee0c7d1f7faee4dc
MD5 7f1ace74d000ddd61f4d39118a75335d
SHA1 165816dd25120009827d51e8a3fe1bb250b309ab
SHA512 8707d163de373b72e8db6e74101e7b405d50c7fea362e69a0923f6a6766ee9dd7bdb7aba6b4dd053408fa649f6ddd2ca0f1867e117354419c3b71f25cfbdd0e5
SSDEEP 96:n9kfRfY1DJaNeEcwpvWMoiVmdeHnazeUWQyV+VDCziEwb:n9kCtJaNebGWMXoero
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 cef5d78c5cb1fa9fcba597bd3d0e002f7693f5575b80246f59d04555fe792d58
MD5 6c493785d6ee854ba546e5df8c144928
SHA1 c34e4de6a817bd29ab29b3dc0fd7c0775c7f6c12
SHA512 eff808033c1816b52e9514ac23c2560c131419718edaf22751a324d091bba0a01b762cb7197d00168513dea43c12b0601a044db852bf056e0cfce7d079cb6b61
SSDEEP 96:n9kfRfY1DJaveEcwpvWMoiVmdeHnazeUWQyV+VD7AiEwb:n9kCtJavebGWMXoerg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 a17c6c04c566a6d9e75336e740088b729bfccadeef8abfc6ef0bba218ff28f27
MD5 888068e502f0f9a574c64792c56373c2
SHA1 48a0377488853f08e5d17a0befb15dea34f7959a
SHA512 97ba9bab0435f1e59b589815c7bb5fdac63898afc98971af242affa1383d45b47d19418c2af41361c5577e585ddf018fdecdef3a6dd5b771675b4b9dc21a8123
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupeSHe2RUYUti:A9iIxuERzA83h09RZxYzvii
MD5 SHA1 SHA512 SSDEEP

Submit Download

vcwecx.exe

Path C:\Users\Admin\AppData\Roaming\vcwecx.exe
Size 317KB
SHA256 95de4a72ca8bc89fcd9ec20eeab765d7250de9b538bd039cd70b82a2088348a8
MD5 5dc09af1611205550b6a385cbae0c330
SHA1 84493358a8402389a0c9e6bfd0866dc225d9b03d
SHA512 c98d9f592aca552c82cea0329572c6527d9e5782d57e4b0305f180071c61726309713eb3b7ca7ef80352408e59a4c1bdccc4c8de613db3a67b9e410579053438
SSDEEP 6144:PBa6C5aNsrKEwmfMtAkDhy0GCLFg/M5yVwC2amWyPNjx:4NaN2KEhMe+7GmFg/M9CXmjlF
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/968-15-0x0000000074660000-0x0000000074699000-memory.dmp

Download

memory/968-0-0x0000000000700000-0x0000000000704000-memory.dmp

Download

memory/968-14-0x0000000000400000-0x0000000000580000-memory.dmp

Download

memory/968-5-0x0000000074660000-0x0000000074699000-memory.dmp

Download

memory/968-4-0x0000000000710000-0x0000000000713000-memory.dmp

Download

memory/968-1-0x0000000000400000-0x0000000000580000-memory.dmp

Download

memory/1160-4249-0x0000000000400000-0x0000000000580000-memory.dmp

Download

memory/1160-7752-0x0000000000400000-0x0000000000580000-memory.dmp

Download

memory/1160-7709-0x0000000000400000-0x0000000000580000-memory.dmp

Download

memory/1160-16-0x0000000074660000-0x0000000074699000-memory.dmp

Download

memory/1160-13-0x0000000000A90000-0x0000000000A93000-memory.dmp

Download

memory/1160-11-0x0000000000400000-0x0000000000580000-memory.dmp

Download

memory/1160-7816-0x0000000000400000-0x0000000000580000-memory.dmp

Download

memory/1160-7827-0x0000000000400000-0x0000000000580000-memory.dmp

Download

memory/1160-7848-0x0000000074660000-0x0000000074699000-memory.dmp

Download

memory/1160-7847-0x0000000000400000-0x0000000000580000-memory.dmp

Download