1c71c3d724b5f95250a2aaa9586dfe944f8e03a1f1a42595e587135765504308

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
12/06/2024, 02:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
74260f752c8e840e81c93ec569799192.exe
Size 299KB
Sample240612-cj4llaydml
SHA256 1c71c3d724b5f95250a2aaa9586dfe944f8e03a1f1a42595e587135765504308
MD5 74260f752c8e840e81c93ec569799192
SHA1 73b421ec4219ce876e9a8c00634d91c57bfa6b66
SHA512 2ad34f8aa63f86e9e1a6fecb004b63ed5c32e5284db6c74eabf932cef509dbe771a0e339df186784f570792d47c2b05bae5d4cdca3441c98f04d27c7fef9dbba
SSDEEP 6144:pUShNcrfV4bYNUQPFzfsMk0q9mQQv7nsz1zflPx2Xz5T9yFnZ/JGVOqgYHo544NG:DIrfV4bYNUQPFzfsMk0q9mQQv7nsz1zM
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

defense_evasion execution impact persistence ransomware spyware stealer

Malware Config

Extracted

Path

C:\Program Files\7-Zip\Lang\restore_files_fvhwd.txt

Ransom Note

!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! What happened to your files ? All of your files were protected by a strong encryption with RSA-2048. More information about the encryption keys using RSA-2048 can be found here: http://en.wikipedia.org/wiki/RSA_(cryptosystem) What does this mean ? This means that the structure and data within your files have been irrevocably changed, you will not be able to work with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them. How did this happen ? Especially for you, on our server was generated the secret key pair RSA-2048 - public and private. All your files were encrypted with the public key, which has been transferred to your computer via the Internet. Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server. What do I do ? Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed. If you really value your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist. For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: 1. http://rtldkdh6.kghw88gh3eu.net/44FD35D97FA1F46 2. http://jsdf2wevw2.wrt23wqw34.net/44FD35D97FA1F46 3. https://7vhbukzxypxh3xfy.onion.to/44FD35D97FA1F46 If for some reasons the addresses are not available, follow these steps: 1. Download and install tor-browser: http://www.torproject.org/projects/torbrowser.html.en 2. After a successful installation, run the browser and wait for initialization. 3. Type in the address bar: 7vhbukzxypxh3xfy.onion/44FD35D97FA1F46 4. Follow the instructions on the site. IMPORTANT INFORMATION: Your personal pages: http://rtldkdh6.kghw88gh3eu.net/44FD35D97FA1F46 http://jsdf2wevw2.wrt23wqw34.net/44FD35D97FA1F46 https://7vhbukzxypxh3xfy.onion.to/44FD35D97FA1F46 Your personal page (using TOR): 7vhbukzxypxh3xfy.onion/44FD35D97FA1F46 Your personal identification number (if you open the site (or TOR 's) directly): 44FD35D97FA1F46

URLs

http://rtldkdh6.kghw88gh3eu.net/44FD35D97FA1F46
http://jsdf2wevw2.wrt23wqw34.net/44FD35D97FA1F46
https://7vhbukzxypxh3xfy.onion.to/44FD35D97FA1F46
http://7vhbukzxypxh3xfy.onion/44FD35D97FA1F46

Signatures

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047
Renames multiple (877) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	74260f752c8e840e81c93ec569799192.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	vcwpuf.exe

Drops startup file 4 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\restore_files_fvhwd.txt	vcwpuf.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\restore_files_fvhwd.html	vcwpuf.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\restore_files_fvhwd.txt	vcwpuf.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\restore_files_fvhwd.html	vcwpuf.exe

Executes dropped EXE 1 IoCs

pid	Process
2068	vcwpuf.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\helper_xgcv = "C:\\Users\\Admin\\AppData\\Roaming\\vcwpuf.exe"	vcwpuf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\helper_xgcv = "C"	vcwpuf.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
3	ipinfo.io

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\Standard.targetsize-20_contrast-black.png	vcwpuf.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Work\LTR\restore_files_fvhwd.html	vcwpuf.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ca@valencia\restore_files_fvhwd.txt	vcwpuf.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppTiles\contrast-white\MapsWideTile.scale-125.png	vcwpuf.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsStore_11910.1002.5.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppTiles\contrast-black\SplashScreen.scale-125.png	vcwpuf.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\images\Square44x44Logo.scale-200.png	vcwpuf.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\MixedRealityPortalAppList.targetsize-16_altform-unplated.png	vcwpuf.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\ScreenSketchSplashScreen.scale-100_contrast-white.png	vcwpuf.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Toolkit\Images\dash.png	vcwpuf.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.46.11001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubLargeTile.scale-200.png	vcwpuf.exe
File opened for modification	C:\Program Files\7-Zip\Lang\gu.txt	vcwpuf.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Car\LTR\restore_files_fvhwd.html	vcwpuf.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\9.png	vcwpuf.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\SplashScreen.scale-400.png	vcwpuf.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteAppList.targetsize-54_altform-unplated.png	vcwpuf.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\AppIcon.targetsize-24_contrast-black.png	vcwpuf.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-white\Logo.scale-100_contrast-white.png	vcwpuf.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteSectionSmallTile.scale-200.png	vcwpuf.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\restore_files_fvhwd.txt	vcwpuf.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\AppIcon.targetsize-24_altform-unplated.png	vcwpuf.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.PPT	vcwpuf.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.scale-80.png	vcwpuf.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\RNApp\app\uwp\restore_files_fvhwd.txt	vcwpuf.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-40_altform-fullcolor.png	vcwpuf.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxMailSplashLogo.scale-100.png	vcwpuf.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.46.11001.0_neutral_split.scale-100_8wekyb3d8bbwe\microsoft.system.package.metadata\restore_files_fvhwd.html	vcwpuf.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AlbumMediumTile.scale-100.png	vcwpuf.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsSoundRecorder_10.1906.1972.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\VoiceRecorderSmallTile.contrast-black_scale-200.png	vcwpuf.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteNewNoteWideTile.scale-150.png	vcwpuf.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\TimerWideTile.contrast-black_scale-100.png	vcwpuf.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.contrast-white_targetsize-96_altform-unplated.png	vcwpuf.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxMailAppList.targetsize-24.png	vcwpuf.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxMailAppList.targetsize-24.png	vcwpuf.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubSmallTile.scale-200_contrast-white.png	vcwpuf.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Voices\en-US\restore_files_fvhwd.html	vcwpuf.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VC\restore_files_fvhwd.txt	vcwpuf.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\lt\restore_files_fvhwd.html	vcwpuf.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxApp_48.49.31001.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\GamesXboxHubSplashScreen.scale-200_contrast-white.png	vcwpuf.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\SlowMotionEditor\UserControls\restore_files_fvhwd.html	vcwpuf.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxCalendarAppList.scale-200.png	vcwpuf.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxA-Exchange.scale-250.png	vcwpuf.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\restore_files_fvhwd.html	vcwpuf.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-64_altform-unplated_contrast-black.png	vcwpuf.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-white\SplashScreen.scale-400_contrast-white.png	vcwpuf.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\BadgeLogo.scale-100.png	vcwpuf.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\CalculatorStoreLogo.contrast-black_scale-100.png	vcwpuf.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\restore_files_fvhwd.html	vcwpuf.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\fr\restore_files_fvhwd.txt	vcwpuf.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.contrast-black_targetsize-48.png	vcwpuf.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxA-Exchange.scale-200.png	vcwpuf.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxMailLargeTile.scale-200.png	vcwpuf.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\BadgeLogo.scale-200.png	vcwpuf.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-64_altform-unplated_contrast-white.png	vcwpuf.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\RNApp\app\uwp\images\avatar_128x.png	vcwpuf.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-60_altform-unplated.png	vcwpuf.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\restore_files_fvhwd.txt	vcwpuf.exe
File opened for modification	C:\Program Files\Common Files\System\de-DE\restore_files_fvhwd.html	vcwpuf.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsFeedbackHub_1.1907.3152.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\Retail\restore_files_fvhwd.html	vcwpuf.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Work\LTR\contrast-white\MedTile.scale-125.png	vcwpuf.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Archive.zip	vcwpuf.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\restore_files_fvhwd.txt	vcwpuf.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\restore_files_fvhwd.html	vcwpuf.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\restore_files_fvhwd.txt	vcwpuf.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.contrast-white_targetsize-80.png	vcwpuf.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Interacts with shadow copies 2 TTPs 2 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

pid	Process
3500	vssadmin.exe
2976	vssadmin.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings	vcwpuf.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
1572	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2068	vcwpuf.exe
2068	vcwpuf.exe
2068	vcwpuf.exe
2068	vcwpuf.exe
2068	vcwpuf.exe
2068	vcwpuf.exe
2068	vcwpuf.exe
2068	vcwpuf.exe
2068	vcwpuf.exe
2068	vcwpuf.exe
2068	vcwpuf.exe
2068	vcwpuf.exe
2068	vcwpuf.exe
2068	vcwpuf.exe
2068	vcwpuf.exe
2068	vcwpuf.exe
2068	vcwpuf.exe
2068	vcwpuf.exe
2068	vcwpuf.exe
2068	vcwpuf.exe
2068	vcwpuf.exe
2068	vcwpuf.exe
2068	vcwpuf.exe
2068	vcwpuf.exe
2068	vcwpuf.exe
2068	vcwpuf.exe
2068	vcwpuf.exe
2068	vcwpuf.exe
2068	vcwpuf.exe
2068	vcwpuf.exe
2068	vcwpuf.exe
2068	vcwpuf.exe
2068	vcwpuf.exe
2068	vcwpuf.exe
2068	vcwpuf.exe
2068	vcwpuf.exe
2068	vcwpuf.exe
2068	vcwpuf.exe
2068	vcwpuf.exe
2068	vcwpuf.exe
2068	vcwpuf.exe
2068	vcwpuf.exe
2068	vcwpuf.exe
2068	vcwpuf.exe
2068	vcwpuf.exe
2068	vcwpuf.exe
2068	vcwpuf.exe
2068	vcwpuf.exe
2068	vcwpuf.exe
2068	vcwpuf.exe
2068	vcwpuf.exe
2068	vcwpuf.exe
2068	vcwpuf.exe
2068	vcwpuf.exe
2068	vcwpuf.exe
2068	vcwpuf.exe
2068	vcwpuf.exe
2068	vcwpuf.exe
2068	vcwpuf.exe
2068	vcwpuf.exe
2068	vcwpuf.exe
2068	vcwpuf.exe
2068	vcwpuf.exe
2068	vcwpuf.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	3432	74260f752c8e840e81c93ec569799192.exe
Token: SeDebugPrivilege	2068	vcwpuf.exe
Token: SeBackupPrivilege	3768	vssvc.exe
Token: SeRestorePrivilege	3768	vssvc.exe
Token: SeAuditPrivilege	3768	vssvc.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3432 wrote to memory of 2068	3432	74260f752c8e840e81c93ec569799192.exe	87
PID 3432 wrote to memory of 2068	3432	74260f752c8e840e81c93ec569799192.exe	87
PID 3432 wrote to memory of 2068	3432	74260f752c8e840e81c93ec569799192.exe	87
PID 3432 wrote to memory of 2904	3432	74260f752c8e840e81c93ec569799192.exe	88
PID 3432 wrote to memory of 2904	3432	74260f752c8e840e81c93ec569799192.exe	88
PID 3432 wrote to memory of 2904	3432	74260f752c8e840e81c93ec569799192.exe	88
PID 2068 wrote to memory of 3500	2068	vcwpuf.exe	90
PID 2068 wrote to memory of 3500	2068	vcwpuf.exe	90
PID 2068 wrote to memory of 1572	2068	vcwpuf.exe	95
PID 2068 wrote to memory of 1572	2068	vcwpuf.exe	95
PID 2068 wrote to memory of 1572	2068	vcwpuf.exe	95
PID 2068 wrote to memory of 2280	2068	vcwpuf.exe	96
PID 2068 wrote to memory of 2280	2068	vcwpuf.exe	96
PID 2280 wrote to memory of 1408	2280	msedge.exe	97
PID 2280 wrote to memory of 1408	2280	msedge.exe	97
PID 2068 wrote to memory of 2976	2068	vcwpuf.exe	98
PID 2068 wrote to memory of 2976	2068	vcwpuf.exe	98
PID 2068 wrote to memory of 3292	2068	vcwpuf.exe	100
PID 2068 wrote to memory of 3292	2068	vcwpuf.exe	100
PID 2068 wrote to memory of 3292	2068	vcwpuf.exe	100
PID 2280 wrote to memory of 1924	2280	msedge.exe	102
PID 2280 wrote to memory of 1924	2280	msedge.exe	102
PID 2280 wrote to memory of 1924	2280	msedge.exe	102
PID 2280 wrote to memory of 1924	2280	msedge.exe	102
PID 2280 wrote to memory of 1924	2280	msedge.exe	102
PID 2280 wrote to memory of 1924	2280	msedge.exe	102
PID 2280 wrote to memory of 1924	2280	msedge.exe	102
PID 2280 wrote to memory of 1924	2280	msedge.exe	102
PID 2280 wrote to memory of 1924	2280	msedge.exe	102
PID 2280 wrote to memory of 1924	2280	msedge.exe	102
PID 2280 wrote to memory of 1924	2280	msedge.exe	102
PID 2280 wrote to memory of 1924	2280	msedge.exe	102
PID 2280 wrote to memory of 1924	2280	msedge.exe	102
PID 2280 wrote to memory of 1924	2280	msedge.exe	102
PID 2280 wrote to memory of 1924	2280	msedge.exe	102
PID 2280 wrote to memory of 1924	2280	msedge.exe	102
PID 2280 wrote to memory of 1924	2280	msedge.exe	102
PID 2280 wrote to memory of 1924	2280	msedge.exe	102
PID 2280 wrote to memory of 1924	2280	msedge.exe	102
PID 2280 wrote to memory of 1924	2280	msedge.exe	102
PID 2280 wrote to memory of 1924	2280	msedge.exe	102
PID 2280 wrote to memory of 1924	2280	msedge.exe	102
PID 2280 wrote to memory of 1924	2280	msedge.exe	102
PID 2280 wrote to memory of 1924	2280	msedge.exe	102
PID 2280 wrote to memory of 1924	2280	msedge.exe	102
PID 2280 wrote to memory of 1924	2280	msedge.exe	102
PID 2280 wrote to memory of 1924	2280	msedge.exe	102
PID 2280 wrote to memory of 1924	2280	msedge.exe	102
PID 2280 wrote to memory of 1924	2280	msedge.exe	102
PID 2280 wrote to memory of 1924	2280	msedge.exe	102
PID 2280 wrote to memory of 1924	2280	msedge.exe	102
PID 2280 wrote to memory of 1924	2280	msedge.exe	102
PID 2280 wrote to memory of 1924	2280	msedge.exe	102
PID 2280 wrote to memory of 1924	2280	msedge.exe	102
PID 2280 wrote to memory of 1924	2280	msedge.exe	102
PID 2280 wrote to memory of 1924	2280	msedge.exe	102
PID 2280 wrote to memory of 1924	2280	msedge.exe	102
PID 2280 wrote to memory of 1924	2280	msedge.exe	102
PID 2280 wrote to memory of 1924	2280	msedge.exe	102
PID 2280 wrote to memory of 1924	2280	msedge.exe	102
PID 2280 wrote to memory of 1208	2280	msedge.exe	103
PID 2280 wrote to memory of 1208	2280	msedge.exe	103
PID 2280 wrote to memory of 4544	2280	msedge.exe	104
PID 2280 wrote to memory of 4544	2280	msedge.exe	104

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	vcwpuf.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1"	vcwpuf.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\74260f752c8e840e81c93ec569799192.exe
"C:\Users\Admin\AppData\Local\Temp\74260f752c8e840e81c93ec569799192.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3432
- C:\Users\Admin\AppData\Roaming\vcwpuf.exe
  C:\Users\Admin\AppData\Roaming\vcwpuf.exe
  2⤵
  - Checks computer location settings
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Program Files directory
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:2068
- - C:\Windows\System32\vssadmin.exe
    "C:\Windows\System32\vssadmin.exe" delete shadows /all /Quiet
    3⤵
    - Interacts with shadow copies
    PID:3500
- - C:\Windows\SysWOW64\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\RESTORE_FILES.TXT
    3⤵
    - Opens file in notepad (likely ransom note)
    PID:1572
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\RESTORE_FILES.HTML
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:2280
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fff671246f8,0x7fff67124708,0x7fff67124718
      4⤵
      PID:1408
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1976,7727764472180738795,8945872846281610706,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1988 /prefetch:2
      4⤵
      PID:1924
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1976,7727764472180738795,8945872846281610706,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 /prefetch:3
      4⤵
      PID:1208
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1976,7727764472180738795,8945872846281610706,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2836 /prefetch:8
      4⤵
      PID:4544
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1976,7727764472180738795,8945872846281610706,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3144 /prefetch:1
      4⤵
      PID:2940
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1976,7727764472180738795,8945872846281610706,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:1
      4⤵
      PID:4160
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1976,7727764472180738795,8945872846281610706,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4716 /prefetch:8
      4⤵
      PID:3352
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1976,7727764472180738795,8945872846281610706,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4716 /prefetch:8
      4⤵
      PID:1932
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1976,7727764472180738795,8945872846281610706,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3988 /prefetch:1
      4⤵
      PID:3852
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1976,7727764472180738795,8945872846281610706,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4228 /prefetch:1
      4⤵
      PID:2296
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1976,7727764472180738795,8945872846281610706,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4104 /prefetch:1
      4⤵
      PID:844
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1976,7727764472180738795,8945872846281610706,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5144 /prefetch:1
      4⤵
      PID:3212
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1976,7727764472180738795,8945872846281610706,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1836 /prefetch:2
      4⤵
      PID:3876
- - C:\Windows\System32\vssadmin.exe
    "C:\Windows\System32\vssadmin.exe" delete shadows /all /Quiet
    3⤵
    - Interacts with shadow copies
    PID:2976
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Roaming\vcwpuf.exe >> NUL
    3⤵
    PID:3292
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\74260F~1.EXE >> NUL
  2⤵
  PID:2904

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3768

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3436

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1616

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

restore_files_fvhwd.html

Path C:\Program Files\7-Zip\Lang\restore_files_fvhwd.html
Size 5KB
SHA256 e2ea4d6b74eccdf155e78a8b27de0bfc19135ecf8a5ddf1f23b27a826c367ad6
MD5 692ead5f9e6f59c44d57faef558483cd
SHA1 f62202a29697ea172f2557c6d4746fd221d0f781
SHA512 e7bc5edf33fdde454cd50a23d3e65616330d907525cfcd1eaa119bffec35492c72d376e3fde3b3730f8e850c57a1b970bbee4f15b68510e2378e0f90e253ecd2
SSDEEP 96:qfm1hxwDl1Zj9TXd30dCdTdQdQdJd5dLyd4edLHV2gDm5ziZwGUtKRDbFFX4QiKs:qeLyDJt3qMpQoLro4o7Ijim6RDb7fZeF
MD5 SHA1 SHA512 SSDEEP

Submit Download

restore_files_fvhwd.txt

Path C:\Program Files\7-Zip\Lang\restore_files_fvhwd.txt
Size 2KB
SHA256 9657e9b617fec9d1e72968e41cbe30bca6302ad4c8964038374d91ecc086d040
MD5 6332fe539b42716b81cf13ee6b15fa31
SHA1 5626f69ab15b641b6c454404c1a88c01b94f76fd
SHA512 fc4485959776caf1159efec2dd4cd44623f9bc798c25b8fc9cb6cd498da99e81b61dfde361a38f2f8fd8e9c4698fccdfe4bfbb0295ce42110444ae996716e3e8
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654
MD5 439b5e04ca18c7fb02cf406e6eb24167
SHA1 e0c5bb6216903934726e3570b7d63295b9d28987
SHA512 d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb
MD5 a8e767fd33edd97d306efb6905f93252
SHA1 a6f80ace2b57599f64b0ae3c7381f34e9456f9d3
SHA512 07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 44f3da2de119103d14c597062340d488e18bfe4bcd4fb108b373e4f677ffd5ab
MD5 7d9ebf5226319ce4418203895a78c473
SHA1 eadd528aaf5e535050c5fa53997856e24bd0eb61
SHA512 5bc1126f1d0ab9cd51e6e3c2801c366a1a2e775d4a377ed7896e63458a5a877b3dbe88b54a8f216d3d2a0af62040bf1fd324c3493aae326ccd6dafa58af28006
SSDEEP 96:nykZM1btwpvWMoiVmdeHBrz0gUWQyV+VDCziEwb:nykqltGWMX6gro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 284055607d5c4031dbab5cdcebdc821f2c10561ffc60fda16e1a871f7acfcbae
MD5 c220b0e158be468b2546b3302352cba9
SHA1 42fcd3e49964f8b748fd29caaae4a9f3da4acf8f
SHA512 16f1722915cb7b8cf87032655a97655beb3fa3a3bc1e79c9c3f43f7a39b9d25077abcf0b7d37349f7aaec50df2c622f7b00dadd59c5c269518220179417dcfa1
SSDEEP 96:nykZM1bdwpvWMoiVmdeHBrz0gUWQyV+VD7AiEwb:nykqldGWMX6grg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 f7da97ef3106a18e74e3dd351187a4d736891b7cf1d81a618155351dccb070d5
MD5 f45160a96c438738389e323096a8878f
SHA1 f8233d1deb8a35ce8ce81a95bb1eba6714643d36
SHA512 3cad93a95f728ad6cf6a30cd7a1c47df9650c9b1b68436d942afe9747bd927684630351a468aa8f3d298a265c6b80252f60335d55605601c6d5350234e5f163f
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup7Hee2RUTbMj2m:A9iIxuERzA83h09RZxY7HAlym
MD5 SHA1 SHA512 SSDEEP

Submit Download

vcwpuf.exe

Path C:\Users\Admin\AppData\Roaming\vcwpuf.exe
Size 299KB
SHA256 1c71c3d724b5f95250a2aaa9586dfe944f8e03a1f1a42595e587135765504308
MD5 74260f752c8e840e81c93ec569799192
SHA1 73b421ec4219ce876e9a8c00634d91c57bfa6b66
SHA512 2ad34f8aa63f86e9e1a6fecb004b63ed5c32e5284db6c74eabf932cef509dbe771a0e339df186784f570792d47c2b05bae5d4cdca3441c98f04d27c7fef9dbba
SSDEEP 6144:pUShNcrfV4bYNUQPFzfsMk0q9mQQv7nsz1zflPx2Xz5T9yFnZ/JGVOqgYHo544NG:DIrfV4bYNUQPFzfsMk0q9mQQv7nsz1zM
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2068-13-0x0000000000E00000-0x0000000000E03000-memory.dmp

Download

memory/2068-3486-0x0000000000400000-0x00000000007FE000-memory.dmp

Download

memory/2068-7615-0x0000000000400000-0x00000000007FE000-memory.dmp

Download

memory/2068-16-0x0000000074A10000-0x0000000074A49000-memory.dmp

Download

memory/2068-7628-0x0000000074A10000-0x0000000074A49000-memory.dmp

Download

memory/2068-7627-0x0000000000400000-0x00000000007FE000-memory.dmp

Download

memory/2068-10-0x0000000000400000-0x00000000007FE000-memory.dmp

Download

memory/3432-15-0x0000000074A10000-0x0000000074A49000-memory.dmp

Download

memory/3432-14-0x0000000000400000-0x00000000007FE000-memory.dmp

Download

memory/3432-0-0x0000000000890000-0x0000000000894000-memory.dmp

Download

memory/3432-5-0x0000000074A10000-0x0000000074A49000-memory.dmp

Download

memory/3432-4-0x00000000008F0000-0x00000000008F3000-memory.dmp

Download

memory/3432-1-0x0000000000400000-0x00000000007FE000-memory.dmp

Download