0dbdd0647ed4fd09782320641a04a442a7ca787d4b3b2bec668365e8b75f4efb

Analysis

max time kernel
150s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/07/2026, 04:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-11_4d745e313d1446d6cfa77676b73bfe31_elex_wannacry.exe
Size 313KB
Sample260711-e9q5asbx7m
SHA256 0dbdd0647ed4fd09782320641a04a442a7ca787d4b3b2bec668365e8b75f4efb
MD5 4d745e313d1446d6cfa77676b73bfe31
SHA1 a46fa08f3ebab669d302ce8b527e8cb38de44f4c
SHA512 066b1572d3b0ae99396136f3a6e7dd51aa08c1c9becd341d54d8e69c7232b5a94dfc5c930a34fa91338058dfd04ef9198c1906ad632673b36abd969fec46d8e5
SSDEEP 6144:0Xs953eDflJoIu0AvgupsN2T4ixpEsWYGBZk9Gz8u:RpeDkIYIupLT4gWYGMGwu
TLSH
T16C64AE2BB84030B9CDFF95B1CDD7D8494758CBB0D2219D3B2C49A58E8A4576AFF081E6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution impact persistence ransomware spyware stealer

Malware Config

Extracted

Path

C:\Program Files\7-Zip\Lang\restore_files_eyong.txt

Ransom Note

!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! What happened to your files ? All of your files were protected by a strong encryption with RSA-2048. More information about the encryption keys using RSA-2048 can be found here: http://en.wikipedia.org/wiki/RSA_(cryptosystem) What does this mean ? This means that the structure and data within your files have been irrevocably changed, you will not be able to work with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them. How did this happen ? Especially for you, on our server was generated the secret key pair RSA-2048 - public and private. All your files were encrypted with the public key, which has been transferred to your computer via the Internet. Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server. What do I do ? Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed. If you really value your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist. For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: 1. http://kwe2342fsd.rt546sdf234re.com/9A1C1AA5DE56C5 2. http://awoeinf832as.wo49i277rnw.com/9A1C1AA5DE56C5 3. https://wls3uapur3zjm5gm.onion.to/9A1C1AA5DE56C5 If for some reasons the addresses are not available, follow these steps: 1. Download and install tor-browser: http://www.torproject.org/projects/torbrowser.html.en 2. After a successful installation, run the browser and wait for initialization. 3. Type in the address bar: wls3uapur3zjm5gm.onion/9A1C1AA5DE56C5 4. Follow the instructions on the site. IMPORTANT INFORMATION: Your personal pages: http://kwe2342fsd.rt546sdf234re.com/9A1C1AA5DE56C5 http://awoeinf832as.wo49i277rnw.com/9A1C1AA5DE56C5 https://wls3uapur3zjm5gm.onion.to/9A1C1AA5DE56C5 Your personal page (using TOR): wls3uapur3zjm5gm.onion/9A1C1AA5DE56C5 Your personal identification number (if you open the site (or TOR 's) directly): 9A1C1AA5DE56C5

URLs

http://kwe2342fsd.rt546sdf234re.com/9A1C1AA5DE56C5
http://awoeinf832as.wo49i277rnw.com/9A1C1AA5DE56C5
https://wls3uapur3zjm5gm.onion.to/9A1C1AA5DE56C5
http://wls3uapur3zjm5gm.onion/9A1C1AA5DE56C5

Extracted

Path

C:\Program Files\7-Zip\Lang\restore_files_eyong.html

Ransom Note

<html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; } .ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center> <div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"> What happened  to your files? All of your files were protected by a strong encryption with RSA-2048 More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a> What  does this mean? This means that the  structure and data within your files have been irrevocably changed, you will not be able to work with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them. How did this happen? Especially for you, on our server was generated the secret key pair RSA-2048 - public and private. All your  files were encrypted with the public key,  which has been  transferred to your computer via the Internet.  Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!. What do I do? Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed. If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist. <div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr> 1.<a href="http://kwe2342fsd.rt546sdf234re.com/9A1C1AA5DE56C5" target="_blank">http://kwe2342fsd.rt546sdf234re.com/9A1C1AA5DE56C5</a> 2.<a href="http://awoeinf832as.wo49i277rnw.com/9A1C1AA5DE56C5" target="_blank">http://awoeinf832as.wo49i277rnw.com/9A1C1AA5DE56C5</a> 3.<a href="https://wls3uapur3zjm5gm.onion.to/9A1C1AA5DE56C5" target="_blank">https://wls3uapur3zjm5gm.onion.to/9A1C1AA5DE56C5</a> </div> <div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a> 2. After a successful installation, run the browser and wait for initialization. 3. Type in the address bar: wls3uapur3zjm5gm.onion/9A1C1AA5DE56C5 4. Follow the instructions on the site.</div> IMPORTANT INFORMATION: <div class="tb" style="width:790px;"> Your Personal PAGES: <a href="http://kwe2342fsd.rt546sdf234re.com/9A1C1AA5DE56C5" target="_blank">http://kwe2342fsd.rt546sdf234re.com/9A1C1AA5DE56C5</a> <a href="http://awoeinf832as.wo49i277rnw.com/9A1C1AA5DE56C5" target="_blank">http://awoeinf832as.wo49i277rnw.com/9A1C1AA5DE56C5</a> <a href="https://wls3uapur3zjm5gm.onion.to/9A1C1AA5DE56C5" target="_blank"> https://wls3uapur3zjm5gm.onion.to/9A1C1AA5DE56C5</a> Your Personal PAGE (using TOR): wls3uapur3zjm5gm.onion/9A1C1AA5DE56C5 Your personal code (if you open the site (or TOR 's) directly): 9A1C1AA5DE56C5 </div></div></center></body></html>

URLs

https://wls3uapur3zjm5gm.onion.to/9A1C1AA5DE56C5</a>

Signatures

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047
Renames multiple (1018) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops startup file 4 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\restore_files_eyong.html	vcwqlg.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\restore_files_eyong.txt	vcwqlg.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\restore_files_eyong.html	vcwqlg.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\restore_files_eyong.txt	vcwqlg.exe

Executes dropped EXE 2 IoCs

pid	Process
3880	vcwqlg.exe
4588	vcwqlg.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\admvss_ms = "C:\\Users\\Admin\\AppData\\Roaming\\vcwqlg.exe"	vcwqlg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\admvss_ms = "C"	vcwqlg.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	ipinfo.io

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\DESIGNER\restore_files_eyong.html	vcwqlg.exe
File opened for modification	C:\Program Files\Common Files\System\Ole DB\restore_files_eyong.txt	vcwqlg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ug\restore_files_eyong.txt	vcwqlg.exe
File opened for modification	C:\Program Files\Windows Defender\ja-JP\restore_files_eyong.txt	vcwqlg.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mn.txt	vcwqlg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\ca_MASCULINE.pak	vcwqlg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ca\restore_files_eyong.html	vcwqlg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\hy-AM\restore_files_eyong.html	vcwqlg.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSIPC\hi\restore_files_eyong.html	vcwqlg.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\restore_files_eyong.txt	vcwqlg.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\SHELLNEW\EXCEL12.XLSX	vcwqlg.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SecHealthUI_1000.26100.1.0_x64__8wekyb3d8bbwe\Assets\contrast-white\WindowsSecurityAppList.scale-200_contrast-white.png	vcwqlg.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SecHealthUI_1000.26100.1.0_x64__8wekyb3d8bbwe\Assets\contrast-white\WindowsSecuritySplashScreen.scale-200_contrast-white.png	vcwqlg.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\restore_files_eyong.txt	vcwqlg.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\LyncVDI_Eula.txt	vcwqlg.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.contrast-white_scale-80.png	vcwqlg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\restore_files_eyong.txt	vcwqlg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ff\restore_files_eyong.txt	vcwqlg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ms\LC_MESSAGES\restore_files_eyong.txt	vcwqlg.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\restore_files_eyong.html	vcwqlg.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\zh-Hans\restore_files_eyong.html	vcwqlg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\es-419_NEUTER.pak	vcwqlg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\mr_NEUTER.pak	vcwqlg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\javafx-src.zip	vcwqlg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\restore_files_eyong.txt	vcwqlg.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OutlookLogo.contrast-black_scale-140.png	vcwqlg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\lg\restore_files_eyong.txt	vcwqlg.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SecHealthUI_1000.26100.1.0_x64__8wekyb3d8bbwe\Assets\contrast-black\WindowsSecurityAppList.targetsize-48_contrast-black.png	vcwqlg.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ne.txt	vcwqlg.exe
File opened for modification	C:\Program Files\Common Files\System\ado\ja-JP\restore_files_eyong.txt	vcwqlg.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\restore_files_eyong.txt	vcwqlg.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSIPC\lt\restore_files_eyong.txt	vcwqlg.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TEXTCONV\restore_files_eyong.html	vcwqlg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\fur\LC_MESSAGES\restore_files_eyong.txt	vcwqlg.exe
File opened for modification	C:\Program Files\Microsoft Office\root\loc\restore_files_eyong.txt	vcwqlg.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSIPC\th\restore_files_eyong.txt	vcwqlg.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	vcwqlg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ast\LC_MESSAGES\restore_files_eyong.html	vcwqlg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\gl\restore_files_eyong.html	vcwqlg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\zu\restore_files_eyong.html	vcwqlg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\css\restore_files_eyong.html	vcwqlg.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SecHealthUI_1000.26100.1.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\restore_files_eyong.html	vcwqlg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\am-ET\restore_files_eyong.txt	vcwqlg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\restore_files_eyong.html	vcwqlg.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ko\restore_files_eyong.html	vcwqlg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\gu_MASCULINE.pak	vcwqlg.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\1033\restore_files_eyong.txt	vcwqlg.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\ECHO\restore_files_eyong.html	vcwqlg.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\EXPEDITN\restore_files_eyong.html	vcwqlg.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\VBA\VBA7.1\1033\restore_files_eyong.html	vcwqlg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\lb-LU\restore_files_eyong.html	vcwqlg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\en-US_MASCULINE.pak	vcwqlg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\include\restore_files_eyong.html	vcwqlg.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSIPC\cs\restore_files_eyong.txt	vcwqlg.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSIPC\he\restore_files_eyong.txt	vcwqlg.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\CancelFluent.png	vcwqlg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ach\LC_MESSAGES\restore_files_eyong.html	vcwqlg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\en_GB\LC_MESSAGES\restore_files_eyong.html	vcwqlg.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC	vcwqlg.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	vcwqlg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ach\LC_MESSAGES\restore_files_eyong.txt	vcwqlg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\fr\restore_files_eyong.html	vcwqlg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ps\restore_files_eyong.html	vcwqlg.exe
File opened for modification	C:\Program Files\Windows NT\TableTextService\restore_files_eyong.html	vcwqlg.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5388_650775855\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5388_650775855\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5388_1935610035\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5388_65258815\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5388_65258815\protocols.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-11_4d745e313d1446d6cfa77676b73bfe31_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcwqlg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcwqlg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NOTEPAD.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4264	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Interacts with shadow copies 3 TTPs 2 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
5756	vssadmin.exe
4904	vssadmin.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134282183656237329"	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	vcwqlg.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings	vcwqlg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	NOTEPAD.EXE
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1738198120-2966725515-3980530802-1000\{CF6A696E-7742-44FF-B14D-F33C0DB205A4}	msedge.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
3184	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3880	vcwqlg.exe
3880	vcwqlg.exe
3880	vcwqlg.exe
3880	vcwqlg.exe
3880	vcwqlg.exe
3880	vcwqlg.exe
3880	vcwqlg.exe
3880	vcwqlg.exe
3880	vcwqlg.exe
3880	vcwqlg.exe
3880	vcwqlg.exe
3880	vcwqlg.exe
3880	vcwqlg.exe
3880	vcwqlg.exe
3880	vcwqlg.exe
3880	vcwqlg.exe
3880	vcwqlg.exe
3880	vcwqlg.exe
3880	vcwqlg.exe
3880	vcwqlg.exe
3880	vcwqlg.exe
3880	vcwqlg.exe
3880	vcwqlg.exe
3880	vcwqlg.exe
3880	vcwqlg.exe
3880	vcwqlg.exe
3880	vcwqlg.exe
3880	vcwqlg.exe
3880	vcwqlg.exe
3880	vcwqlg.exe
3880	vcwqlg.exe
3880	vcwqlg.exe
3880	vcwqlg.exe
3880	vcwqlg.exe
3880	vcwqlg.exe
3880	vcwqlg.exe
3880	vcwqlg.exe
3880	vcwqlg.exe
3880	vcwqlg.exe
3880	vcwqlg.exe
3880	vcwqlg.exe
3880	vcwqlg.exe
3880	vcwqlg.exe
3880	vcwqlg.exe
3880	vcwqlg.exe
3880	vcwqlg.exe
3880	vcwqlg.exe
3880	vcwqlg.exe
3880	vcwqlg.exe
3880	vcwqlg.exe
3880	vcwqlg.exe
3880	vcwqlg.exe
3880	vcwqlg.exe
3880	vcwqlg.exe
3880	vcwqlg.exe
3880	vcwqlg.exe
3880	vcwqlg.exe
3880	vcwqlg.exe
3880	vcwqlg.exe
3880	vcwqlg.exe
3880	vcwqlg.exe
3880	vcwqlg.exe
3880	vcwqlg.exe
3880	vcwqlg.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
5388	msedge.exe
5388	msedge.exe
5388	msedge.exe
5388	msedge.exe
5388	msedge.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	2804	2026-07-11_4d745e313d1446d6cfa77676b73bfe31_elex_wannacry.exe
Token: SeDebugPrivilege	3880	vcwqlg.exe
Token: SeBackupPrivilege	4272	vssvc.exe
Token: SeRestorePrivilege	4272	vssvc.exe
Token: SeAuditPrivilege	4272	vssvc.exe
Token: SeDebugPrivilege	4588	vcwqlg.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5388	msedge.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 2804 wrote to memory of 3880	2804	2026-07-11_4d745e313d1446d6cfa77676b73bfe31_elex_wannacry.exe	87
PID 2804 wrote to memory of 5904	2804	2026-07-11_4d745e313d1446d6cfa77676b73bfe31_elex_wannacry.exe	88
PID 3880 wrote to memory of 5756	3880	vcwqlg.exe	90
PID 3880 wrote to memory of 3184	3880	vcwqlg.exe	99
PID 3880 wrote to memory of 5388	3880	vcwqlg.exe	100
PID 5388 wrote to memory of 5000	5388	msedge.exe	101
PID 3880 wrote to memory of 4904	3880	vcwqlg.exe	102
PID 5388 wrote to memory of 4228	5388	msedge.exe	104
PID 5388 wrote to memory of 4264	5388	msedge.exe	105
PID 5388 wrote to memory of 4228	5388	msedge.exe	104
PID 5388 wrote to memory of 4228	5388	msedge.exe	104
PID 5388 wrote to memory of 1144	5388	msedge.exe	106
PID 5388 wrote to memory of 1144	5388	msedge.exe	106
PID 5388 wrote to memory of 4376	5388	msedge.exe	110
PID 5388 wrote to memory of 4376	5388	msedge.exe	110
PID 5388 wrote to memory of 972	5388	msedge.exe	109
PID 5388 wrote to memory of 4376	5388	msedge.exe	110
PID 5388 wrote to memory of 972	5388	msedge.exe	109
PID 5388 wrote to memory of 972	5388	msedge.exe	109
PID 5388 wrote to memory of 2020	5388	msedge.exe	111
PID 5388 wrote to memory of 5044	5388	msedge.exe	112
PID 5388 wrote to memory of 2020	5388	msedge.exe	111
PID 5388 wrote to memory of 2020	5388	msedge.exe	111
PID 5388 wrote to memory of 5044	5388	msedge.exe	112
PID 5388 wrote to memory of 5044	5388	msedge.exe	112
PID 5388 wrote to memory of 3816	5388	msedge.exe	113
PID 5388 wrote to memory of 3816	5388	msedge.exe	113
PID 5388 wrote to memory of 2864	5388	msedge.exe	114
PID 5388 wrote to memory of 5016	5388	msedge.exe	115
PID 5388 wrote to memory of 2864	5388	msedge.exe	114
PID 5388 wrote to memory of 5016	5388	msedge.exe	115
PID 5388 wrote to memory of 3956	5388	msedge.exe	117
PID 5388 wrote to memory of 308	5388	msedge.exe	120
PID 5388 wrote to memory of 308	5388	msedge.exe	120
PID 5388 wrote to memory of 4100	5388	msedge.exe	121
PID 5388 wrote to memory of 4100	5388	msedge.exe	121
PID 3880 wrote to memory of 4180	3880	vcwqlg.exe	123
PID 5388 wrote to memory of 5040	5388	msedge.exe	125
PID 5388 wrote to memory of 5688	5388	msedge.exe	126
PID 5388 wrote to memory of 2716	5388	msedge.exe	127
PID 5388 wrote to memory of 6000	5388	msedge.exe	128
PID 5388 wrote to memory of 6000	5388	msedge.exe	128
PID 5388 wrote to memory of 4540	5388	msedge.exe	132
PID 5388 wrote to memory of 4540	5388	msedge.exe	132
PID 5388 wrote to memory of 6012	5388	msedge.exe	133
PID 5388 wrote to memory of 6012	5388	msedge.exe	133
PID 5388 wrote to memory of 2008	5388	msedge.exe	134
PID 5388 wrote to memory of 2008	5388	msedge.exe	134

System policy modification 1 TTPs 2 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	vcwqlg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1"	vcwqlg.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-07-11_4d745e313d1446d6cfa77676b73bfe31_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-11_4d745e313d1446d6cfa77676b73bfe31_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2804
- C:\Users\Admin\AppData\Roaming\vcwqlg.exe
  C:\Users\Admin\AppData\Roaming\vcwqlg.exe
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:3880
- - C:\Windows\System32\vssadmin.exe
    "C:\Windows\System32\vssadmin.exe" delete shadows /all /Quiet
    3⤵
    - Interacts with shadow copies
    PID:5756
- - C:\Windows\SysWOW64\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\RESTORE_FILES.TXT
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Opens file in notepad (likely ransom note)
    PID:3184
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\RESTORE_FILES.HTML
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5388
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ff806d1c188,0x7ff806d1c194,0x7ff806d1c1a0
      4⤵
      PID:5000
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1644,i,7424925103919459927,9911678871253320879,262144 --field-trial-handle=2300,i,9212706747471061518,14390903529562765942,262144 --variations-seed-version --mojo-platform-channel-handle=2296 /prefetch:2
      4⤵
      PID:4228
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1884,i,8733815195411529227,6953712289233221491,524288 --field-trial-handle=2300,i,9212706747471061518,14390903529562765942,262144 --variations-seed-version --mojo-platform-channel-handle=2340 /prefetch:11
      4⤵
      System Time Discovery
      PID:4264
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2536,i,14686374793442144198,3940979806113131901,524288 --field-trial-handle=2300,i,9212706747471061518,14390903529562765942,262144 --variations-seed-version --mojo-platform-channel-handle=2540 /prefetch:13
      4⤵
      PID:1144
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3620,i,17649828119151250930,12759213924945143886,2097152 --field-trial-handle=2300,i,9212706747471061518,14390903529562765942,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:1
      4⤵
      PID:972
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3628,i,15828299845846520744,1826507497601723056,2097152 --field-trial-handle=2300,i,9212706747471061518,14390903529562765942,262144 --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:1
      4⤵
      PID:4376
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4376,i,10890715396987300111,12066858243645347015,2097152 --field-trial-handle=2300,i,9212706747471061518,14390903529562765942,262144 --variations-seed-version --mojo-platform-channel-handle=4956 /prefetch:1
      4⤵
      PID:2020
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4388,i,12144889844947210784,1051709802120636639,2097152 --field-trial-handle=2300,i,9212706747471061518,14390903529562765942,262144 --variations-seed-version --mojo-platform-channel-handle=5012 /prefetch:9
      4⤵
      PID:5044
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5424,i,6724551222701918822,4726047404784777551,524288 --field-trial-handle=2300,i,9212706747471061518,14390903529562765942,262144 --variations-seed-version --mojo-platform-channel-handle=5416 /prefetch:14
      4⤵
      PID:3816
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5492,i,440415288798942291,7997210805005200057,524288 --field-trial-handle=2300,i,9212706747471061518,14390903529562765942,262144 --variations-seed-version --mojo-platform-channel-handle=5600 /prefetch:14
      4⤵
      PID:2864
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5488,i,6509632933943182020,3847351467265206016,524288 --field-trial-handle=2300,i,9212706747471061518,14390903529562765942,262144 --variations-seed-version --mojo-platform-channel-handle=5576 /prefetch:14
      4⤵
      PID:5016
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5964,i,5205413159447711054,9983105528122897048,524288 --field-trial-handle=2300,i,9212706747471061518,14390903529562765942,262144 --variations-seed-version --mojo-platform-channel-handle=5980 /prefetch:14
      4⤵
      PID:4176
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5964,i,5205413159447711054,9983105528122897048,524288 --field-trial-handle=2300,i,9212706747471061518,14390903529562765942,262144 --variations-seed-version --mojo-platform-channel-handle=5980 /prefetch:14
      4⤵
      PID:3956
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6212,i,14945294519845795097,16977451605576339589,524288 --field-trial-handle=2300,i,9212706747471061518,14390903529562765942,262144 --variations-seed-version --mojo-platform-channel-handle=6264 /prefetch:14
      4⤵
      PID:308
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6368,i,9981023506602457432,7241828047743093339,524288 --field-trial-handle=2300,i,9212706747471061518,14390903529562765942,262144 --variations-seed-version --mojo-platform-channel-handle=6576 /prefetch:14
      4⤵
      PID:4100
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4380,i,721978707004516254,17142901862344049285,524288 --field-trial-handle=2300,i,9212706747471061518,14390903529562765942,262144 --variations-seed-version --mojo-platform-channel-handle=5240 /prefetch:14
      4⤵
      PID:5040
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4824,i,5903100931421798468,9715486920989484528,524288 --field-trial-handle=2300,i,9212706747471061518,14390903529562765942,262144 --variations-seed-version --mojo-platform-channel-handle=5228 /prefetch:14
      4⤵
      PID:5688
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4960,i,7164096031256460152,2775818478556628465,524288 --field-trial-handle=2300,i,9212706747471061518,14390903529562765942,262144 --variations-seed-version --mojo-platform-channel-handle=5280 /prefetch:14
      4⤵
      PID:2716
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6580,i,1017531488403999299,9545585046287932617,524288 --field-trial-handle=2300,i,9212706747471061518,14390903529562765942,262144 --variations-seed-version --mojo-platform-channel-handle=3884 /prefetch:14
      4⤵
      PID:6000
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3860,i,16197323880697348355,12797734363262899173,524288 --field-trial-handle=2300,i,9212706747471061518,14390903529562765942,262144 --variations-seed-version --mojo-platform-channel-handle=5680 /prefetch:14
      4⤵
      PID:4540
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=920,i,376076451157005573,7385592883007869027,524288 --field-trial-handle=2300,i,9212706747471061518,14390903529562765942,262144 --variations-seed-version --mojo-platform-channel-handle=5840 /prefetch:14
      4⤵
      PID:6012
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2928,i,10129041893992466853,715247468805483542,524288 --field-trial-handle=2300,i,9212706747471061518,14390903529562765942,262144 --variations-seed-version --mojo-platform-channel-handle=5432 /prefetch:14
      4⤵
      PID:2008
- - C:\Windows\System32\vssadmin.exe
    "C:\Windows\System32\vssadmin.exe" delete shadows /all /Quiet
    3⤵
    - Interacts with shadow copies
    PID:4904
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Roaming\vcwqlg.exe >> NUL
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4180
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE >> NUL
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5904

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4272

C:\Users\Admin\AppData\Roaming\vcwqlg.exe
C:\Users\Admin\AppData\Roaming\vcwqlg.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4588

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4676

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3468

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1840

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Direct Volume Access

T1006

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

restore_files_eyong.html

Path C:\Program Files\7-Zip\Lang\restore_files_eyong.html
Size 4KB
SHA256 3eb2ff3b0aa3851c8342195c4953a49a539f2f6416b69e7b3d9ec8669d58b4b3
MD5 148ab8a3728c4b5e9272de3e154097e6
SHA1 05da00bd5430f4265911b9b51e4dcc1ec0226e85
SHA512 04a9297fb7c3e466d9456ab8e40daad51e2be61ff220c7388227059b5528e38bdc2a6604ef16a14125baf898e48c0ab6f7e1e38791c8af2fdc01a7a96e12ebc6
SSDEEP 96:719pRl1Zjjd2TXd30dCdddWdQAdBQdJd5dcdzyd4edLHV3g9m5z9Zw5zY93cSD8i:7xDZYt3qMvQQ20Lrig4o7tB9mIcSD8bu
TLSH
T115A1B6B3DF4990725710C745FA52EBE2F53241E85AAD5F4CA4AA4A6130EC632C72E3CC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

restore_files_eyong.txt

Path C:\Program Files\7-Zip\Lang\restore_files_eyong.txt
Size 2KB
SHA256 6c8078ea1b6913b1ff33dd3ac023cc4ba3d3e8b8ce75108c550f4c4afb963585
MD5 45317d2b44ef5c6d221304de18f494f8
SHA1 00c0ed04a844e7dae0f28c4eb73cfb95b35301d7
SHA512 c7efaa43cf44d1c694e16d573657f8bc89ec2adfea2713a62986d3c655ba1c8be2a1f8d3781be41a273e89bb69059879096bc110a37dd3752e2429a4a349160c
TLSH
T1B241B64F3D5453F11EA8430239956DC1FF2A00AC276DC2499C8F88182395517A3BB9D8
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c95a47aec5edba88214fad580cb869417b6620a91d8ee97e2d0b7801d3372be5
MD5 aad5f2ca0dd16bb2ea6c7757ea569c50
SHA1 5228b0b132542be004ea1bb32f3748964d065af5
SHA512 9d59c0291d741bd9d6cf50c22972d4baef00e7c1a48d6a3311a6cc82c04ceeba6e2be9458334cb954878915cc9eb91a8fd8bc4a47c966d57a2a05d6ee8211640
TLSH
T1D4D09BE177A19D18C545353567D1522591416D31451927194241E13D9D7E2C3455F0AA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ac1b1f93ff87eb876027f4166d705375c0f5d3d22dcb03f6a66f6100e88dd10f
MD5 b99f03c5cfe71b03836f8b5fcf09425b
SHA1 8a5078499c0b5ea40183efb77f9c1028c196409c
SHA512 6b9feec4ead7bf05f67d0d480907e21a3b770d8d12dedd2b0d785904186eac7448583e61abacb23582948de55c8ea2043bfd6908efd7faecdd82cee91404cfe6
TLSH
T16DD02BE037909D18C440353163D0122091006C30880923090100A02C8D3E2C3054F0BE
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 2d0ea88ebb75da03dd5f504f83da4948f013bd1a073b80d34e451618b676e11d
MD5 7a57e66215fd55d9e0861a789af392d6
SHA1 b435d8324cb00c51753a2bfb3bee5c0384378891
SHA512 69f4d67e7cff8a83fa9a77b5dbd0fa6c860cdd3d45787e542b9c77518744115c874c8264e48da7ceb3437686d0b8d97a83860f81a9ec4e63f4fa7f6b806cb88a
TLSH
T1A9316E708F342AFFDBAF85B657E24A9D33B1885F37032E5123646EB48A85377211001E
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59f3bd.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59f3bd.TMP
Size 1KB
SHA256 198c5b8f237660cb2e1259b812e24a13bb3c9e8fac3a732d900b607c992db839
MD5 ebcb237234a7f7bbb6aa4d1296ae3108
SHA1 378f29629dc01e9b22bc82bb745c4326369b9618
SHA512 fe2ed6c2096685a4d68f57e4af7ae2eee919eafa3bb08f2c5fb6f4c384b45ea975f689891682d69e31dd9cea38b77e32a461f431bb8b3554d9718176740ebe10
TLSH
T1393161708F342AFFDBAF45B657E24A5C33B5884F37032E5123645DB04A45377211001E
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

aa0fd597-146f-496a-92a4-2352ae2894b8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\aa0fd597-146f-496a-92a4-2352ae2894b8.tmp
Size 2KB
SHA256 59d7a2d6ba51ec74e3fedef5b31115aece6009019645871f275598158b98691e
MD5 7fa01cdd4d4a240552e7cd50111be696
SHA1 ca64f60d14c6078f85dab7a07b3a9834051b88b9
SHA512 dc9b79e35413dd96f879cb141ab517f1e8b6f1808336dd2bf74d01b3e48bd452a56cf4b6c1049aaeec98e93d6120774b514f5592ec9322f0c38111b9c72d9167
TLSH
T1FC41BEF7C3E4856E991156F0AA187E1BCE1D0914832C3D5AC9E4EF1BA3E2471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 0403326b77c0ab14a09c806a292491e0d0ec18b922b3668576f5dca569c1a5dd
MD5 f5b7bd045b78753dbc6a2882fe96cb60
SHA1 13d3b24d124ac23a14fd41d3f863012560beccd8
SHA512 8ac8a3b81ec4e671e3573ecb146a2a458259dbe9f3cbfad8bd3af2129f4127694ee6619a5c061b82621d8f0e5fcfbaaed991c9e9e605f083d710dfb70639e953
SSDEEP 192:sxRjRlyM/jK1Ml8wCh/fxscSvJZaVzoA8p4c/g6+WNIYoXCYxGtIgtJ:sxRjt8h/fxsfvHpN/5IyN3
TLSH
T14E52EA156A24597B9CDBD20DFA517F93D6F81573A2901E44AAFCCA0C00E7AED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 5c51d068983319f01c65f9be148c4593fde39cda8604990c3f5bd469bb8ba6a4
MD5 d21982b922c23afc91e2f30efe931d9d
SHA1 235f83a7d024296feb4f56e6c54e0c01ca788f03
SHA512 224d8e37c1ae224d661e029476f05d95a5e6520c6d4a54322d18fd30a20a524bc415246e80983d84d93a0978718d2a51d7140f05bb7fe169b9dcfe917a64a9b7
SSDEEP 192:sxR4RlyM/jK1Ml8wCh/fxsvkSvJZaVzoA8p4c/g6+WNIYoXCYxGtIgDWJ:sxR4t8h/fxsvnvHpN/5IyNO
TLSH
T13452EB156A24597B9CDBD20DFA517F93D6F81473A2911E44AAFCCA0C01E7AED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 3635e4300bf4b87a1282a7210fee34f3087e92e57b80f499261f0cf63b0c70e8
MD5 316168fa8bb89f026fa1cbb07148a41e
SHA1 92c6456988a18194d622c140032fc422dc8060bd
SHA512 2c2caa44af8b562a815b13cab6ee6193c592e5d8d04a24743170a33c6fdd0dc94d8e64c085a9e468d0d7146678bf30bfc4f022e9e3a52697743186dad6f2ccbc
SSDEEP 768:jXwHno7pLuL7gRWgs2fJ28F1+UoAYDCx9Tuqh0VfUC9xbog/OV6EpVuG6rockOeb:jXwHnUE7gRWgs2fJ2u1jaBEp4Gxdvt
TLSH
T1B0E2FC7B680CCBBE4F404A9CEC29BD9E6DA801CB96D8CD5447FA440C03C6AEB55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 2bbe1233d72203415475203eeb98d5074ab547ea67e9b44135f469568f83190a
MD5 a8bb192c0015cee34334bb9b42b2ec24
SHA1 95cb431ed73a0597e35d27a0ebd8705a0f98854b
SHA512 971be38f824d4823d389f9a9bb0683b4fc27c68fd7a005bdcb2fa77b0e7555a6c5e40793429baa1e474cd5e94ac1316e163518895d3e6c2be87304f1e9bed9eb
SSDEEP 96:KRENE8EzEnE9EXErE/WEzEoEWgEvE/K4EugERE/cEVEtEgEDEbEUHEuEDESEOEoV:CENE8EzEnE9EXErE+EzEoEHEvEFEugE+
TLSH
T1CEA1D950B03A4381393D760CD5788D5E81D2B892345DB5AB3BA90665CF5FE538EFC8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a8ee3.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a8ee3.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 cddc37c0cf05e56780c70f5d6a129cf90d12501276f88465425c482c367d91c5
MD5 23de2211de6e165736c0b31e66ff76b9
SHA1 d4edabe8723bb2e8e22a5e13630809d1bdd5a5aa
SHA512 ff04ee3bbf44062698b53d1189251ac954a2117e02c0852b99892423ae73e5acff985b66f7dedf55d52fccf7eef65da01c39f6ad4f97416894648f9eae8c3f89
SSDEEP 768:hrv+4UNbdz3u8/TBOWZAPONXyer1IRCzniBZeVH1SK7:hbsbV39CSIqnSEH1l
TLSH
T10203BF32E4A89E338DE2A3C5B14777437FB86057C6840B90EDEA2F4E069B59D130B957
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 375aeb61a2eb58f0a14c286c30461a9134e4993ecd489afcf3372423743174cb
MD5 591cb4e56e6945099348b5e7dc102ed6
SHA1 31c30b699eb09f2d1418e7fc8c1840a16a775380
SHA512 52039f6518383e93a35bb8ad4ed3296dd238db10cf10a221750363e99ad08a4abf300c0b774e60c5ef5b2c3d7280dec6d5e6afa3e9701fcf0b01c7773a9a9e8e
SSDEEP 768:rrv+4UNbd737CG/TBOWZAGyONXyer1IRCzni9Q9Zk:rbsbR3z8SIqnb7k
TLSH
T1CC03BF31E0A9DE334DE6A286B14777837FB8206789C10B50EEEA5F8D058759E270F917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 dfef246310725d0fc9520331e5086b34f3f06c9472b49bc181b643f2d4098fa6
MD5 07489f010f47b9bbf2e08a258dff7bc4
SHA1 6e0b1e1568ee4a8ff2a33ba1566031f1a0e9fc4a
SHA512 5e9d4168cab9c257fb322c917de7ab78fb1194bfaa1bfc40b7c9fd01f5d1d7932d2554084c81d8227e5a139e943d1b7be0854228e4221715d0e464f793034699
SSDEEP 768:Mj+9F3xlG/TBOWZAGyONXyer1IRCzni9Qb9Ma:L9F3q8SIqnbb+a
TLSH
T1B4F2BE31E4969E234CD2A3D6B24B3793BFF821B785810E44EEE96F4D068765E170B41A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 a4d822c3871a90262de3e8a726ace263b317d3b01165b299bf919e52c53ed649
MD5 8f9855b90af2a1fa5ce8b819f25c6426
SHA1 dd1eddf204add32d25e1fbb42170fe6bca1e9867
SHA512 81a536c3fb7fed4e1051af4a3d0fcae096fa013d0c040fefc6af166867bb2a9e9ac0ff66057d17a716e25590831fd0a6eb195ec94e0bfcc73c6dd8761ffd074c
SSDEEP 768:hF1j+9v3ZwgGl1VsOWZAGZONXyer1IRCzni9Qb9Ma:g9v3c+SIqnbb+a
TLSH
T160039C36D495CE279CE297D6B34A7787AEF421A785C98EC0EED95F4D01C319E030B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5388_1678186824\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcwqlg.exe

Path C:\Users\Admin\AppData\Roaming\vcwqlg.exe
Size 313KB
SHA256 0dbdd0647ed4fd09782320641a04a442a7ca787d4b3b2bec668365e8b75f4efb
MD5 4d745e313d1446d6cfa77676b73bfe31
SHA1 a46fa08f3ebab669d302ce8b527e8cb38de44f4c
SHA512 066b1572d3b0ae99396136f3a6e7dd51aa08c1c9becd341d54d8e69c7232b5a94dfc5c930a34fa91338058dfd04ef9198c1906ad632673b36abd969fec46d8e5
SSDEEP 6144:0Xs953eDflJoIu0AvgupsN2T4ixpEsWYGBZk9Gz8u:RpeDkIYIupLT4gWYGMGwu
TLSH
T16C64AE2BB84030B9CDFF95B1CDD7D8494758CBB0D2219D3B2C49A58E8A4576AFF081E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ApproveAdd.pdf.abc

Path C:\Users\Admin\Desktop\ApproveAdd.pdf.abc
Size 348KB
SHA256 254075b5782fa014b8dc1c47e7deca45ee6c4f2b0079cb0e89f2e2490b5ec837
MD5 d1757f566fac39981378bbff005b6f4d
SHA1 1ae25d881c20f1a4c9f85fc2101443b66b3a4472
SHA512 7a505400ea4e421e22bdaf3e5b8988e69fabec42cf46ebdfe67a7f307dbefc87dd3f403b30cb76c780ca06a4559b8b432c81d30fb4cf53b29faef442484d11a7
SSDEEP 6144:cVyPCm9xWb+SempHR3/qf1WqH9EUMrRFALAS6b9A2veRTQ8oHPsT2JX:cVyPCm9xW6k8PH99AAUlWRTvwPsT2JX
TLSH
T1717423DD653289E1D86A806674EDBDC4B0E158C8F26B842293165F2E94ECFEDDC9307C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CompressNew.dwg.abc

Path C:\Users\Admin\Desktop\CompressNew.dwg.abc
Size 224KB
SHA256 46f0b2927cf38482fc9c25307a3f20513446327369895ba81f8bec2f53fd549e
MD5 ca64cc9d5eea4c61519764b69a3a1182
SHA1 5ea8b718c9a7bbe6b6ccfda764a91dc2017217e9
SHA512 0866b42d23f2e13579bcc6350ca69cd61b734f9288af789e2a77d7dca7635da8fe4c9bda1e281e8ac02f76971b5247d5477a7484d4da6d567d5a021c72be4599
SSDEEP 3072:QAQXIRmjuhreEf36QJjiKqJ2LeUbNHA1WSB1xwtO2/Uip8GQpn72duPYADtJVj1X:KjKHf6QJ+6eMNbwjwZ/j07auPFtX1T7
TLSH
T1DA3423BA6493C55096D3CD4B0ECBECF2E88E3153CE2D8A219720F73F5512319D4A620D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ConvertToRepair.xlsx.abc

Path C:\Users\Admin\Desktop\ConvertToRepair.xlsx.abc
Size 11KB
SHA256 e48659bc954500956114909526417f8dd396408630636de391fefd9f586dd3b6
MD5 2b368681b2ff612e9500dec916f52ec5
SHA1 7f37b361f6f75ceb356cf9a10b26aefb543cee7a
SHA512 90cc708f9ec3d187dd6621379dff76029a2e6bfef6573e0d395bdbaa04125af2506adeafae1432de8235413fbf443602c1379833ac90237c16040ec68ac81fe6
SSDEEP 192:vm4jM2NG8x/YM9rmK5fxg0rD/bTiIChwtEXbzs8Z4ha10VQl4eMpg5eNJ:OEM8yQBHGtwaXU8W7VG4npg6
TLSH
T1AF42C0F9839FA595E3494BE0C4C42CC560C8859033A76476EBA3F4B99B23F5D315CA91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DisconnectRead.docx.abc

Path C:\Users\Admin\Desktop\DisconnectRead.docx.abc
Size 16KB
SHA256 4f5ccec2d8fe76b3abd7ac8e5ede3e6bb3843acfc966e2b9479264176fcae7e8
MD5 6ca3e1507d1cf2dcd73eb06868daf36a
SHA1 2c2a8287c1c83b0772529e8df951d2f4123fdb85
SHA512 f3daa2e46c31ae14a63d5c2f9b7861c803de65a61667cb0eb58a8f9625bc6f23ec6753d9716d323c19cd0f110ddd883717fcc85a36027b93ec464d3324633919
SSDEEP 384:0VgLbkbaRmYJgm3zWh3ZEFyhcYLiOXSvoTl1:e8b00WkyhrxCvS
TLSH
T17E72D15873467554E7DD6254D7DC6931EE8190A91E203E7A87F503E2C883DFC9A1B40E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ProtectStep.avi.abc

Path C:\Users\Admin\Desktop\ProtectStep.avi.abc
Size 271KB
SHA256 023f36f0bc36cb34e8ee9cafd91d87389cb574ea5182f01ac76ee7aff73ad0d5
MD5 073475865a10fef3fc079df97203b9ad
SHA1 7ae35ed7358be500c92e4def3bc9b0c5faed087b
SHA512 20a28b41c746721835314d915fa8343ab521fea023ea817d65ebb90a930a65706e08201496fcb3ada11b05fb09eb9fedeac6957850c6a2712ba17b3858b95405
SSDEEP 6144:B3xj+pkbLq01pnU2F820oOoQEXlbE6b+99eKHwYdzQFj6LDSszliyal:B3Q+bW6pU2F820dEXlwBsKHrdzQFj6PU
TLSH
T1574423C543B3321BEB12E37A597D9CFEC5C16132CE97A95A4E6A8D14BA9D0CD309CC48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RESTORE_FILES.BMP

Path C:\Users\Admin\Desktop\RESTORE_FILES.BMP
Size 2.3MB
SHA256 5679bc4811f076246cef9007a990f4d8b28b0cd037a2b88455f36b8e88d7a175
MD5 9da78f3c9dc6a7c88b2b6d4c7bdc5ceb
SHA1 71cb5c036fcb6107e92bd66e839ed1977dd23baa
SHA512 dd9dfcffa7f6f2a32a41513439e9fe411ab7d0ee5f1b3286dfe340afd084070b83979b730bbe8a6c12cdd005ec5476ad5ed9ab8dbdc98587280f748755209015
SSDEEP 3072:8MmODzqSNaTpfHAXqDM7E0sYVL5zqOHNHhNAXP/b0sQUE3zqTbhEAXMSdzqjIAXe:
TLSH
T1EAB505BAA5D05423F40EE0364A36C8EC1A6A7D4ECD96025B937B7647907EC2477C78CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SaveSend.xlsx.abc

Path C:\Users\Admin\Desktop\SaveSend.xlsx.abc
Size 9KB
SHA256 81feb2b2d1a0c406d863995e41755bf34babe738632aa81cd90e1ea08c59a73e
MD5 3d903b69a2608af56fee2761abb6007a
SHA1 00eb74ee7a82c72c3575783472302f27970fb1e0
SHA512 c8bca05ddc57a24c7df83c13929d210ee2b8b15d4119417b97085671c0a6e602cb082317f7f88a9b62984ecb6b07787d40e1048baaf3c4ce03faae5fc6de5a48
SSDEEP 192:XKOnN/du2H2GZfIbfcDP0zlXRd6nFHx2q9CeCL8r4LGL0GE50s7T0sdVRVe4v7FV:XKOn9du44SalXrMFR2XXQr4LGLVY7Tzj
TLSH
T15E22D0C92BC3906B5E74B3A86102FEA02F1D167373D8EA309CB7DDB484E151B0DA12D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchRestart.xlsx.abc

Path C:\Users\Admin\Desktop\SearchRestart.xlsx.abc
Size 14KB
SHA256 f07bd06bc267fb76396b4be0408e2ddf8b7c9bf3bfe18adcea7195a8701047cb
MD5 2d693460fd0c9f42d1997f4a09ec3e9c
SHA1 abc810339818a58293f1127918a37aa12bb44499
SHA512 4967462eb4b1fc11b607ee636821891a8f9f67dc84d9668733ba4327dffda5c178a08e1cc60bce98763ce5068583a46dae651d398f0bd6b49bb8fda81263544f
SSDEEP 384:0jNlPsZy3BUHGaDyg1h7na62KCn6LZovaXTzk/41INDMe:0jrh3izDygnjC6ZTzkgGb
TLSH
T11462D08F6567219685E101E2867B89D09E3F303C7D672BCFE2B4234EB262548C783D60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SubmitReceive.docx.abc

Path C:\Users\Admin\Desktop\SubmitReceive.docx.abc
Size 20KB
SHA256 7895a8730cbf2bdf50ef28d379348e374306fcda8344e23ea8302129e7bc1c8e
MD5 eccb0506e67f8d76c5b9c249f6a366de
SHA1 0a3556fa838da197c7b0532d3b085ad8a5ec2ca8
SHA512 3382f2c0fa86cd5178a82621b1b5d01e735d55d8cf2d4f6311ec36b6a4d01f5b50c54eb001e2a5626a03ba0317945f52bc1b36a6183a06ff9406f02bac661ae5
SSDEEP 384:QgbeubZkfrQsOrB1jO9PXGL5jWhdNGMZeWdIgGCci0V52Pu8o8MNp1A:HJ6sjrXq1XnLUMXCvCr02PBo7p+
TLSH
T1C692E0AB089FE6CBB13E798304825C579FCB8D44638D1F931AEDA90408F10986352F7D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UpdateClear.m3u.abc

Path C:\Users\Admin\Desktop\UpdateClear.m3u.abc
Size 472KB
SHA256 e730184711ec75f7e3e40876881c172bb1dd1d51d4640040a834fc895e41189e
MD5 2b3870ca5bbb2a9512d0d10c738c55e6
SHA1 6bdd786ce3f5df9d72404bad3c837f433792aa5f
SHA512 024a56d91f125da99690607e4fddd3796c86a470e754560ab3b7387a0e912a2a478a0a460d55fa933314971cfd9bdea0f1c72357e67f70d726254eb33aceb41e
SSDEEP 12288:8V8Iv0bN796AycLogw2FV4z2VoStgfOEi:EQbN56h5gw2H4ie3fi
TLSH
T1F0A42356DEC62BB184DD35500FC0BA90894D75B5FF31178282AD0FB86C59BE8DE748E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UpdateDisconnect.m3u.abc

Path C:\Users\Admin\Desktop\UpdateDisconnect.m3u.abc
Size 178KB
SHA256 61c3fb4f5e6e5b770d47aeaea94ae0e0b421998c5785d647c94a33fbd2e39db2
MD5 986d007843b290c6f7999cc2ac249306
SHA1 8de7009a164c4fdf0b69c29f7732ad01025008ec
SHA512 90f2bf92e4fd37f322c8cd2128d84100725c8f1efbce51a02121ccff43019e9c7a0eb051623069a5c54df3558ba1c2ad04659f5bc51c32ce3565e707cab1ecf3
SSDEEP 3072:Li3Q9PDSHwuUby6XbpFc4POqdsrqtimMxC4hgRL71qLGX8z4gzXbGNWgOjM+:LwiPDSHwJbtXdW4pdOLdc5q46iwg6M+
TLSH
T12C0423C899AE887C43D97C0FBD8956ADB069342199F145CAF882A636E1938335633D37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WatchWait.docm.abc

Path C:\Users\Admin\Desktop\WatchWait.docm.abc
Size 395KB
SHA256 adb6d38c8a7a96a503aa3b91cb15422d48fe78ea1794e15093d103e197226c98
MD5 bfe19e52bcb499a5e7dc7ab64ef22c79
SHA1 d06541c637e63eb3864a92c519b440a7f755d778
SHA512 e46488a4523997355c952ac932f30e715b2f70e60c44f9b8e23c0e82623eef54cbbf3d00353355d81b51313e97a8931d38116ed4e02252eb308b8592eb7874a9
SSDEEP 12288:7cjyjXdCaf4IqemM1J9l271Ywrv3uFb3x3e:9XZQwLL9l271Ywrvmb39e
TLSH
T186842306D226D1862EA4A0C825386CBA5509B4E37381EE93D1137FBF35BD3E6DE49734
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2804-5-0x0000000000C20000-0x0000000000C24000-memory.dmp

Download

memory/2804-13-0x0000000000400000-0x0000000000732000-memory.dmp

Download

memory/2804-14-0x0000000074080000-0x00000000740BB000-memory.dmp

Download

memory/2804-6-0x0000000074080000-0x00000000740BB000-memory.dmp

Download

memory/2804-0-0x0000000000C10000-0x0000000000C13000-memory.dmp

Download

memory/2804-1-0x0000000000400000-0x0000000000732000-memory.dmp

Download

memory/3880-7243-0x0000000000400000-0x0000000000732000-memory.dmp

Download

memory/3880-8-0x0000000000400000-0x0000000000732000-memory.dmp

Download

memory/3880-12-0x00000000024D0000-0x00000000024D4000-memory.dmp

Download

memory/3880-7328-0x0000000074080000-0x00000000740BB000-memory.dmp

Download

memory/3880-7327-0x0000000000400000-0x0000000000732000-memory.dmp

Download

memory/3880-15-0x0000000074080000-0x00000000740BB000-memory.dmp

Download

memory/3880-7080-0x0000000000400000-0x0000000000732000-memory.dmp

Download

memory/3880-2381-0x0000000000400000-0x0000000000732000-memory.dmp

Download

memory/3880-5795-0x0000000000400000-0x0000000000732000-memory.dmp

Download

memory/4588-23-0x0000000000400000-0x0000000000732000-memory.dmp

Download

memory/4588-63-0x0000000074080000-0x00000000740BB000-memory.dmp

Download

memory/4588-77-0x0000000074080000-0x00000000740BB000-memory.dmp

Download

memory/4588-76-0x0000000000400000-0x0000000000732000-memory.dmp

Download