cerber | hxxp://f

Resubmissions

29-02-2024 15:22

240229-sry9vadd77 10

Analysis

max time kernel
385s
max time network
382s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
29-02-2024 15:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://f

Score

10^/10

cerber discovery evasion ransomware

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\_R_E_A_D___T_H_I_S___3ZO9108_.hta

Family

cerber

Ransom Note

<!DOCTYPE html> <html lang="en"> <head> <meta charset="utf-8"> <title>CERBER RANSOMWARE: Instructions</title> <HTA:APPLICATION APPLICATIONNAME="TB2jPFiBdK" SCROLL="yes" SINGLEINSTANCE="yes" WINDOWSTATE="maximize"> <style type="text/css"> a { color: #04a; text-decoration: none; } a:hover { text-decoration: underline; } body { background-color: #e7e7e7; color: #222; font-family: "Lucida Sans Unicode", "Lucida Grande", sans-serif; font-size: 13pt; line-height: 19pt; } body, h1 { margin: 0; padding: 0; } hr { color: #bda; height: 2pt; margin: 1.5%; } h1 { color: #555; font-size: 14pt; } ol { padding-left: 2.5%; } ol li { padding-bottom: 13pt; } small { color: #555; font-size: 11pt; } ul { list-style-type: none; margin: 0; padding: 0; } .button { color: #04a; cursor: pointer; } .button:hover { text-decoration: underline; } .container { background-color: #fff; border: 2pt solid #c7c7c7; margin: 5%; min-width: 850px; padding: 2.5%; } .header { border-bottom: 2pt solid #c7c7c7; margin-bottom: 2.5%; padding-bottom: 2.5%; } .h { display: none; } .hr { background: #bda; display: block; height: 2pt; margin-top: 1.5%; margin-bottom: 1.5%; overflow: hidden; width: 100%; } .info { background-color: #efe; border: 2pt solid #bda; display: inline-block; padding: 1.5%; text-align: center; } .updating { color: red; display: none; padding-left: 35px; background: url("data:image/gif;base64,R0lGODlhGQAZAKIEAMzMzJmZmTMzM2ZmZgAAAAAAAAAAAAAAACH/C05FVFNDQVBFMi4wAwEAAAAh+QQFAAAEACwAAAAAGQAZAAADVki63P4wSEiZvLXemRf4yhYoQ0l9aMiVLISCDms+L/DIwwnfc+c3qZ9g6Hn5hkhF7YgUKI2dpvNpExJ/WKquSoMCvd9geDeuBpcuGFrcQWep5Df7jU0AACH5BAUAAAQALAoAAQAOABQAAAMwSLDU/iu+Gdl0FbTAqeXg5YCdSJCBuZVqKw5wC8/qHJv2IN+uKvytn9AnFBCHx0cCACH5BAUAAAQALAoABAAOABQAAAMzSLoEzrC5F9Wk9YK6Jv8gEYzgaH4myaVBqYbfIINyHdcDI+wKniu7YG+2CPI4RgFI+EkAACH5BAUAAAQALAQACgAUAA4AAAMzSLrcBNDJBeuUNd6WwXbWtwnkFZwMqUpnu6il06IKLChDrsxBGufAHW0C1IlwxeMieEkAACH5BAUAAAQALAEACgAUAA4AAAM0SLLU/lAtFquctk6aIe5gGA1kBpwPqVZn66hl1KINPDRB3sxAGufAHc0C1IkIxcARZ4QkAAAh+QQFAAAEACwBAAQADgAUAAADMUhK0vurSfiko8oKHC//yyCCYvmVI4cOZAq+UCCDcv3VM4cHCuDHOZ/wI/xxigDQMAEAIfkEBQAABAAsAQABAA4AFAAAAzNIuizOkLgZ13xraHVF1puEKWBYlUP1pWrLBLALz+0cq3Yg324PAUAXcNgaBlVGgPAISQAAIfkEBQAABAAsAQABABQADgAAAzRIujzOMBJHpaXPksAVHoogMlzpZWK6lF2UjgobSK9AtjSs7QTg8xCfELgQ/og9I1IxXCYAADs=") left no-repeat; } #change_language { float: right; } #change_language, #texts div { display: none; } </style> </head> <body> <div class="container"> <div class="header"> <a id="change_language" href="#" onclick="return changeLanguage1();" title="English">☑ English</a> <h1>CERBER RANSOMWARE</h1> Instructions </div> <div id="languages"> ☑ Select your language <ul> <li><a href="#" title="English" onclick="return sh_bl('en');">English</a></li> <li><a href="#" title="Arabic" onclick="return sh_bl('ar');">العربية</a></li> <li><a href="#" title="Chinese" onclick="return sh_bl('zh');">中文</a></li> <li><a href="#" title="Dutch" onclick="return sh_bl('nl');">Nederlands</a></li> <li><a href="#" title="French" onclick="return sh_bl('fr');">Français</a></li> <li><a href="#" title="German" onclick="return sh_bl('de');">Deutsch</a></li> <li><a href="#" title="Italian" onclick="return sh_bl('it');">Italiano</a></li> <li><a href="#" title="Japanese" onclick="return sh_bl('ja');">日本語</a></li> <li><a href="#" title="Korean" onclick="return sh_bl('ko');">한국어</a></li> <li><a href="#" title="Polish" onclick="return sh_bl('pl');">Polski</a></li> <li><a href="#" title="Portuguese" onclick="return sh_bl('pt');">Português</a></li> <li><a href="#" title="Spanish" onclick="return sh_bl('es');">Español</a></li> <li><a href="#" title="Turkish" onclick="return sh_bl('tr');">Türkçe</a></li> </ul> </div> <div id="texts"> <div id="en"> Can't yotj4Eu find the necessary files? Is the cZYyzPontent of your files not readable? It is normal beJazCMzV7Ecause the files' names and the data in your files have been encrypqDc46VQKted by "Ce9lohrber Ransomware". It meJans your files are NOT damagesOd! Your files are modified only. This modification is reversible. FUrom now it is not poss8npxmzWpible to use your files until they will be decrypted. The only way to decXJqSSeO1rypt your files safely is to buy the special decryption software "CSerber Decryptor". Any attempts to restBore your files with the thirnd-party software will be fatal for your files! <hr> You can procllppKvCweed with purchasing of the decryption softwt48Vare at your personal page: PlesdLtzwjykase wait...<a class="url" href="http://p27dokhpz2n7nvgr.12hygy.top/A33D-2056-61EA-0446-9668" target="_blank">http://p27dokhpz2n7nvgr.12hygy.top/A33D-2056-61EA-0446-9668</a><hr><a href="http://p27dokhpz2n7nvgr.14ewqv.top/A33D-2056-61EA-0446-9668" target="_blank">http://p27dokhpz2n7nvgr.14ewqv.top/A33D-2056-61EA-0446-9668</a><hr><a href="http://p27dokhpz2n7nvgr.14vvrc.top/A33D-2056-61EA-0446-9668" target="_blank">http://p27dokhpz2n7nvgr.14vvrc.top/A33D-2056-61EA-0446-9668</a><hr><a href="http://p27dokhpz2n7nvgr.129p1t.top/A33D-2056-61EA-0446-9668" target="_blank">http://p27dokhpz2n7nvgr.129p1t.top/A33D-2056-61EA-0446-9668</a><hr><a href="http://p27dokhpz2n7nvgr.1apgrn.top/A33D-2056-61EA-0446-9668" target="_blank">http://p27dokhpz2n7nvgr.1apgrn.top/A33D-2056-61EA-0446-9668</a> If tdbil9ahis page cannot be opened  cli0Kgq4yhdck here  to get a new addr9tess of your personal page. If the addref9Ne8ss of your personal page is the same as befoQOOEX5mvPre after you tried to get a new one, you c5Can try to get a new address in one hour. At thzmRHBg4Zis page you will receive the complete instrtIpnnVGZmuctions how to buy the decryptiqlvHAbon software for restoring all your files. Also at this page you will be able to resgRMxtore any one file for free to be sure "Cerbe4er Decryptor" will help you. <hr> If your per9hUGmPYsonal page is not availaAeUble for a long period there is another way to open your personal page - insta8Lllation and use of Tor Browser: <ol> <li>run your InteN0frnet browser (if you do not know what it is run the Internet Explorer);</li> <li>entzOestN5nIHer or copy the address <a href="https://www.torproject.org/download/download-easy.html.en" target="_blank">https://www.torproject.org/download/download-easy.html.en</a> into the address bar of your browser and press ENTER;</li> <li>wait for the site load1iwGPing;</li> <li>on the site you will be offered to dolYHwnload Tor Browser; download and run it, follow the installation instructions, wait until the installation is completed;</li> <li>rufNF4u21S4Ln Tor Browser;</li> <li>connect with the buttP4niFUon "Connect" (if you use the English version);</li> <li>a normal Internet broUeSb6vJseawser window will be opened after the initialization;</li> <li>type or copy the add6W3ress http://p27dokhpz2n7nvgr.onion/A33D-2056-61EA-0446-9668 in this browser address bar;</li> <li>pre3j81ss ENTER;</li> <li>the site shoIPIlc07Culd be loaded; if for some reason the site is not loQYbT0ading wait for a moment and try again.</li> </ol> If you have any pryY1SYNIoblems during installation or use of Tor Browser, please, visit <a href="https://www.youtube.com/results?search_query=Install+Tor+Browser+Windows" target="_blank">https://www.youtube.com</a> and type request in the searcbth bar "Install Tor Browser Windows" and you will find a lot of training videos about Tor Browser installation and use. <hr> AdditXoQNowngional information: You will fiUMWnd the instruL3U0NDctions ("*_READ_THIS_FILE_*.hta") for re2TmNyXRCMstoring your files in any fViTT3D7Golder with your encBXTrypted files. The instrv5uctions "*_READ_THIS_FILE_*.hta" in the fLoldercusis with your encryBrvD2Tpted files are not virNhDIYnnDuses! The instrucOOof5QWStions "*_READ_THIS_FILE_*.hta" will he7esilWlp you to decS17zeHvGWrypt your files. RemembekzpxUBsIr! The worst siohQrxO09Ntuation already happsBJened and now the future of your files deY0bU63wjpends on your determushination and speed of your actions. </div> <div id="ar" style="direction: rtl;"> لا يمكنك العثور على الملفات الضرورية؟ هل محتوى الملفات غير قابل للقراءة؟ هذا أمر طبيعي لأن أسماء الملفات والبيانات في الملفات قد تم تشفيرها بواسطة "Cerber Ransomware". وهذا يعني أن الملفات الخاصة بك ليست تالفة! فقد تم تعديل ملفاتك فقط. ويمكن التراجع عن هذا. ومن الآن فإنه لا يكن استخدام الملفات الخاصة بك حتى يتم فك تشفيرها. الطريقة الوحيدة لفك تشفير ملفاتك بأمان هو أن تشتري برنامج فك التشفير المتخصص "Cerber Decryptor". إن أية محاولات لاستعادة الملفات الخاصة بك بواسطة برامج من طرف ثالث سوف تكون مدمرة لملفاتك! <hr> يمكنك الشروع في شراء برنامج فك التشفير من صفحتك الشخصية: أرجو الإنتظار...<a class="url" href="http://p27dokhpz2n7nvgr.12hygy.top/A33D-2056-61EA-0446-9668" target="_blank">http://p27dokhpz2n7nvgr.12hygy.top/A33D-2056-61EA-0446-9668</a><hr><a href="http://p27dokhpz2n7nvgr.14ewqv.top/A33D-2056-61EA-0446-9668" target="_blank">http://p27dokhpz2n7nvgr.14ewqv.top/A33D-2056-61EA-0446-9668</a><hr><a href="http://p27dokhpz2n7nvgr.14vvrc.top/A33D-2056-61EA-0446-9668" target="_blank">http://p27dokhpz2n7nvgr.14vvrc.top/A33D-2056-61EA-0446-9668</a><hr><a href="http://p27dokhpz2n7nvgr.129p1t.top/A33D-2056-61EA-0446-9668" target="_blank">http://p27dokhpz2n7nvgr.129p1t.top/A33D-2056-61EA-0446-9668</a><hr><a href="http://p27dokhpz2n7nvgr.1apgrn.top/A33D-2056-61EA-0446-9668" target="_blank">http://p27dokhpz2n7nvgr.1apgrn.top/A33D-2056-61EA-0446-9668</a> في حالة تعذر فتح هذه الصفحة  انقر هنا  لإنشاء عنوان جديد لصفحتك الشخصية. في هذه الصفحة سوف تتلقى تعليمات كاملة حول كيفية شراء برنامج فك التشفير لاستعادة جميع الملفات الخاصة بك. في هذه الصفحة أيضًا سوف تتمكن من استعادة ملف واحد بشكل مجاني للتأكد من أن "Cerber Decryptor" سوف يساعدك. <hr> إذا كانت صفحتك الشخصية غير متاحة لفترة طويلة فإن ثمّة طريقة أخرى لفتح صفحتك الشخصية - تحميل واستخدام متصفح Tor: <ol> <li>قم بتشغيل متصفح الإنترنت الخاص بك (إذا كنت لا تعرف ما هو قم بتشغيل إنترنت إكسبلورر);</li> <li>قم بكتابة أو نسخ العنوان <a href="https://www.torproject.org/download/download-easy.html.en" target="_blank">https://www.torproject.org/download/download-easy.html.en</a> إلى شريط العنوان في المستعرض الخاص بك ثم اضغط ENTER;</li> <li>انتظر لتحميل الموقع;</li> <li>سوف يعرض عليك الموقع تحميل متصفح Tor. قم بتحميله وتشغيله، واتبع تعليمات التثبيت، وانتظر حتى اكتمال التثبيت;</li> <li>قم بتشغيل متصفح Tor;</li> <li>اضغط على الزر "Connect" (إذا كنت تستخدم النسخة الإنجليزية);</li> <li>سوف تُفتح نافذة متصفح الإنترنت العادي بعد البدء;</li> <li>قم بكتابة أو نسخ العنوان http://p27dokhpz2n7nvgr.onion/A33D-2056-61EA-0446-9668 في شريط العنوان في المتصفح;</li> <li>اضغط ENTER;</li> <li>يجب أن يتم تحميل الموقع؛ إذا لم يتم تحميل الموقع لأي سبب، انتظر للحظة وحاول مرة أخرى.</li> </ol> إذا كان لديك أية مشكلات أثناء عملية التثبيت أو استخدام متصفح Tor، يُرجى زيارة <a href="https://www.youtube.com/results?search_query=Install+Tor+Browser+Windows" target="_blank">https://www.youtube.com</a> واكتب الطلب "install tor browser windows" أو "تثبيت نوافذ متصفح Tor" في شريط البحث، وسوف تجد الكثير من أشرطة الفيديو للتدريب حول تثبيت متصفح Tor واستخدامه. <hr> معلومات إضr68Qافية: سsWFipm9MXوف تجد إرشادات استعادة الملفات الخاصة بك ("*_READ_THIS_FILE_*") في أي مجلد مع ملفاتك المشفرة. الإرشGiwادات ("*_READ_THIS_FILE_*") الموجودة في المجلدات مع ملفاتك المشفرة ليست فيروسات والإرشادات ("*_READ_THIS_FILE_*") سوف تساعدك على فك تشفير الملفات الخاصة بك. تذكر أن أسوأ موAiBTEqNn3pقف قد حدث بالفعل، والآن مستقبل ملفاتك يعتمد على عزيمتك وسرعة الإجراءات الخاصة بك. </div> <div id="zh"> 您找不到所需的文件？ 您文件的内容无法阅读？ 这是正常的，因为您文件的文件名和数据已经被“Cerber Ransomware”加密了。 这意味着您的文件并没有损坏！您的文件只是被修改了�

Extracted

Path

C:\Users\Admin\AppData\Roaming\Microsoft\OneNote\16.0\_R_E_A_D___T_H_I_S___2L4796_.txt

Family

cerber

Ransom Note

CERBER RANSOMWARE ----- YOUR DOCUMENTS, PH0TOS, DATABASES AND OTHER IMPORTANT FILES HAVE BEEN ENCRYPTED! ----- The only way to decrypt y0ur files is to receive the private key and decryption program. To receive the private key and decryption program go to any decrypted folder, inside there is the special file (*_READ_THIS_FILE_*) with complete instructions how to decrypt your files. If you cannot find any (*_READ_THIS_FILE_*) file at your PC, follow the instructions below: ----- 1. Download "Tor Browser" from https://www.torproject.org/ and install it. 2. In the "Tor Browser" open your personal page here: http://p27dokhpz2n7nvgr.onion/A33D-2056-61EA-0446-9668 Note! This page is available via "Tor Browser" only. ----- Also you can use temporary addresses on your personal page without using "Tor Browser". ----- 1. http://p27dokhpz2n7nvgr.12hygy.top/A33D-2056-61EA-0446-9668 2. http://p27dokhpz2n7nvgr.14ewqv.top/A33D-2056-61EA-0446-9668 3. http://p27dokhpz2n7nvgr.14vvrc.top/A33D-2056-61EA-0446-9668 4. http://p27dokhpz2n7nvgr.129p1t.top/A33D-2056-61EA-0446-9668 5. http://p27dokhpz2n7nvgr.1apgrn.top/A33D-2056-61EA-0446-9668 ----- Note! These are temporary addresses! They will be available for a limited amount of time! -----

URLs

http://p27dokhpz2n7nvgr.onion/A33D-2056-61EA-0446-9668

http://p27dokhpz2n7nvgr.12hygy.top/A33D-2056-61EA-0446-9668

http://p27dokhpz2n7nvgr.14ewqv.top/A33D-2056-61EA-0446-9668

http://p27dokhpz2n7nvgr.14vvrc.top/A33D-2056-61EA-0446-9668

http://p27dokhpz2n7nvgr.129p1t.top/A33D-2056-61EA-0446-9668

http://p27dokhpz2n7nvgr.1apgrn.top/A33D-2056-61EA-0446-9668

Signatures

Cerber
Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.
ransomware cerber
Contacts a large (1132) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Modifies Windows Firewall 2 TTPs 2 IoCs
evasion

Windows Service
T1543.003

Disable or Modify System Firewall
T1562.004

Processes:

netsh.exenetsh.exe

pid process

1632 netsh.exe
4556 netsh.exe
Drops startup file 1 IoCs

Processes:

cerber.exe

description ioc process

File opened for modification \??\c:\users\admin\appdata\roaming\microsoft\word\startup\ cerber.exe
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

163 raw.githubusercontent.com
164 raw.githubusercontent.com

pid	process
1632	netsh.exe
4556	netsh.exe

description	ioc	process
File opened for modification	\??\c:\users\admin\appdata\roaming\microsoft\word\startup\	cerber.exe

flow	ioc
163	raw.githubusercontent.com
164	raw.githubusercontent.com

Drops file in System32 directory 38 IoCs

Processes:

cerber.exe

description	ioc	process
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\microsoft sql server	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\onenote	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\powerpoint	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\outlook	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\office	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\powerpoint	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\the bat!	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft sql server	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\onenote	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\outlook	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\outlook	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\word	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\thunderbird	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\thunderbird	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\documents	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft sql server	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\word	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\office	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\excel	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\excel	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\office	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\powerpoint	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\onenote	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\powerpoint	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\word	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\excel	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\microsoft sql server	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\office	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\word	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\bitcoin	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\bitcoin	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\steam	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\desktop	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\excel	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\onenote	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\outlook	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\steam	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\the bat!	cerber.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

cerber.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tmpF35A.bmp"	cerber.exe

Drops file in Program Files directory 20 IoCs

Processes:

cerber.exe

description	ioc	process
File opened for modification	\??\c:\program files (x86)\microsoft\excel	cerber.exe
File opened for modification	\??\c:\program files (x86)\microsoft\office	cerber.exe
File opened for modification	\??\c:\program files (x86)\microsoft\onenote	cerber.exe
File opened for modification	\??\c:\program files (x86)\steam	cerber.exe
File opened for modification	\??\c:\program files (x86)\word	cerber.exe
File opened for modification	\??\c:\program files (x86)\microsoft sql server	cerber.exe
File opened for modification	\??\c:\program files (x86)\microsoft\microsoft sql server	cerber.exe
File opened for modification	\??\c:\program files (x86)\microsoft\outlook	cerber.exe
File opened for modification	\??\c:\program files (x86)\microsoft\word	cerber.exe
File opened for modification	\??\c:\program files (x86)\office	cerber.exe
File opened for modification	\??\c:\program files (x86)\onenote	cerber.exe
File opened for modification	\??\c:\program files (x86)\the bat!	cerber.exe
File opened for modification	\??\c:\program files\	cerber.exe
File opened for modification	\??\c:\program files (x86)\bitcoin	cerber.exe
File opened for modification	\??\c:\program files (x86)\outlook	cerber.exe
File opened for modification	\??\c:\program files (x86)\	cerber.exe
File opened for modification	\??\c:\program files (x86)\excel	cerber.exe
File opened for modification	\??\c:\program files (x86)\microsoft\powerpoint	cerber.exe
File opened for modification	\??\c:\program files (x86)\powerpoint	cerber.exe
File opened for modification	\??\c:\program files (x86)\thunderbird	cerber.exe

Drops file in Windows directory 64 IoCs

Processes:

cerber.exe

description	ioc	process
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\the bat!	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\documents	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\bitcoin	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\powerpoint	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\powerpoint	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\excel	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft sql server	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\office	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\onenote	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\steam	cerber.exe
File opened for modification	C:\Windows\SysWOW64	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\outlook	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\powerpoint	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\desktop	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\office	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\onenote	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\steam	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\word	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft sql server	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\word	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\word	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\outlook	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\powerpoint	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\onenote	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\outlook	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\bitcoin	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\bitcoin	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\microsoft sql server	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\powerpoint	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\documents	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft sql server	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\excel	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\office	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\onenote	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\powerpoint	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\excel	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft sql server	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\excel	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\the bat!	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\excel	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\microsoft sql server	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\outlook	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\word	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\steam	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\thunderbird	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\thunderbird	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\microsoft sql server	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\office	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\word	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\desktop	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\excel	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\outlook	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\word	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\the bat!	cerber.exe
File opened for modification	\??\c:\windows\	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\outlook	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\powerpoint	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\thunderbird	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\word	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\onenote	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\office	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\powerpoint	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\office	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\word	cerber.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exemsedge.exemsedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Kills process with taskkill 1 IoCs
evasion

Processes:

taskkill.exe

pid process

2956 taskkill.exe

pid	process
2956	taskkill.exe

Modifies data under HKEY_USERS 2 IoCs

Processes:

chrome.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133536937514709025"	chrome.exe

Modifies registry class 5 IoCs

Processes:

msedge.exemsedge.execerber.exeOpenWith.exeOpenWith.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3270530367-132075249-2153716227-1000\{441BA1FC-2273-43D8-9830-C2A338A1A91B}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings	cerber.exe
Key created	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings	OpenWith.exe

Opens file in notepad (likely ransom note) 1 IoCs
ransomware

Processes:

NOTEPAD.EXE

pid process

3844 NOTEPAD.EXE
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

1120 PING.EXE

pid	process
3844	NOTEPAD.EXE

pid	process
1120	PING.EXE

Suspicious behavior: EnumeratesProcesses 22 IoCs

Processes:

msedge.exemsedge.exechrome.exemsedge.exemsedge.exeidentity_helper.exemsedge.exechrome.exemsedge.exemsedge.exe

pid	process
964	msedge.exe
964	msedge.exe
4956	msedge.exe
4956	msedge.exe
2648	chrome.exe
2648	chrome.exe
3356	msedge.exe
3356	msedge.exe
2820	msedge.exe
2820	msedge.exe
2420	identity_helper.exe
2420	identity_helper.exe
5080	msedge.exe
5080	msedge.exe
4840	chrome.exe
4840	chrome.exe
2692	msedge.exe
2692	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

OpenWith.exe

pid process

3648 OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 23 IoCs

Processes:

msedge.exechrome.exemsedge.exe

pid	process
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
2648	chrome.exe
2648	chrome.exe
2648	chrome.exe
2648	chrome.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

chrome.exe

description	pid	process
Token: SeShutdownPrivilege	2648	chrome.exe
Token: SeCreatePagefilePrivilege	2648	chrome.exe
Token: SeShutdownPrivilege	2648	chrome.exe
Token: SeCreatePagefilePrivilege	2648	chrome.exe
Token: SeShutdownPrivilege	2648	chrome.exe
Token: SeCreatePagefilePrivilege	2648	chrome.exe
Token: SeShutdownPrivilege	2648	chrome.exe
Token: SeCreatePagefilePrivilege	2648	chrome.exe
Token: SeShutdownPrivilege	2648	chrome.exe
Token: SeCreatePagefilePrivilege	2648	chrome.exe
Token: SeShutdownPrivilege	2648	chrome.exe
Token: SeCreatePagefilePrivilege	2648	chrome.exe
Token: SeShutdownPrivilege	2648	chrome.exe
Token: SeCreatePagefilePrivilege	2648	chrome.exe
Token: SeShutdownPrivilege	2648	chrome.exe
Token: SeCreatePagefilePrivilege	2648	chrome.exe
Token: SeShutdownPrivilege	2648	chrome.exe
Token: SeCreatePagefilePrivilege	2648	chrome.exe
Token: SeShutdownPrivilege	2648	chrome.exe
Token: SeCreatePagefilePrivilege	2648	chrome.exe
Token: SeShutdownPrivilege	2648	chrome.exe
Token: SeCreatePagefilePrivilege	2648	chrome.exe
Token: SeShutdownPrivilege	2648	chrome.exe
Token: SeCreatePagefilePrivilege	2648	chrome.exe
Token: SeShutdownPrivilege	2648	chrome.exe
Token: SeCreatePagefilePrivilege	2648	chrome.exe
Token: SeShutdownPrivilege	2648	chrome.exe
Token: SeCreatePagefilePrivilege	2648	chrome.exe
Token: SeShutdownPrivilege	2648	chrome.exe
Token: SeCreatePagefilePrivilege	2648	chrome.exe
Token: SeShutdownPrivilege	2648	chrome.exe
Token: SeCreatePagefilePrivilege	2648	chrome.exe
Token: SeShutdownPrivilege	2648	chrome.exe
Token: SeCreatePagefilePrivilege	2648	chrome.exe
Token: SeShutdownPrivilege	2648	chrome.exe
Token: SeCreatePagefilePrivilege	2648	chrome.exe
Token: SeShutdownPrivilege	2648	chrome.exe
Token: SeCreatePagefilePrivilege	2648	chrome.exe
Token: SeShutdownPrivilege	2648	chrome.exe
Token: SeCreatePagefilePrivilege	2648	chrome.exe
Token: SeShutdownPrivilege	2648	chrome.exe
Token: SeCreatePagefilePrivilege	2648	chrome.exe
Token: SeShutdownPrivilege	2648	chrome.exe
Token: SeCreatePagefilePrivilege	2648	chrome.exe
Token: SeShutdownPrivilege	2648	chrome.exe
Token: SeCreatePagefilePrivilege	2648	chrome.exe
Token: SeShutdownPrivilege	2648	chrome.exe
Token: SeCreatePagefilePrivilege	2648	chrome.exe
Token: SeShutdownPrivilege	2648	chrome.exe
Token: SeCreatePagefilePrivilege	2648	chrome.exe
Token: SeShutdownPrivilege	2648	chrome.exe
Token: SeCreatePagefilePrivilege	2648	chrome.exe
Token: SeShutdownPrivilege	2648	chrome.exe
Token: SeCreatePagefilePrivilege	2648	chrome.exe
Token: SeShutdownPrivilege	2648	chrome.exe
Token: SeCreatePagefilePrivilege	2648	chrome.exe
Token: SeShutdownPrivilege	2648	chrome.exe
Token: SeCreatePagefilePrivilege	2648	chrome.exe
Token: SeShutdownPrivilege	2648	chrome.exe
Token: SeCreatePagefilePrivilege	2648	chrome.exe
Token: SeShutdownPrivilege	2648	chrome.exe
Token: SeCreatePagefilePrivilege	2648	chrome.exe
Token: SeShutdownPrivilege	2648	chrome.exe
Token: SeCreatePagefilePrivilege	2648	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

msedge.exechrome.exemsedge.exe

pid	process
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
2648	chrome.exe
2648	chrome.exe
2648	chrome.exe
2648	chrome.exe
2648	chrome.exe
2648	chrome.exe
2648	chrome.exe
2648	chrome.exe
2648	chrome.exe
2648	chrome.exe
2648	chrome.exe
2648	chrome.exe
2648	chrome.exe
2648	chrome.exe
2648	chrome.exe
2648	chrome.exe
2648	chrome.exe
2648	chrome.exe
2648	chrome.exe
2648	chrome.exe
2648	chrome.exe
2648	chrome.exe
2648	chrome.exe
2648	chrome.exe
2648	chrome.exe
2648	chrome.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe

Suspicious use of SendNotifyMessage 64 IoCs

Processes:

msedge.exechrome.exemsedge.exe

pid	process
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
2648	chrome.exe
2648	chrome.exe
2648	chrome.exe
2648	chrome.exe
2648	chrome.exe
2648	chrome.exe
2648	chrome.exe
2648	chrome.exe
2648	chrome.exe
2648	chrome.exe
2648	chrome.exe
2648	chrome.exe
2648	chrome.exe
2648	chrome.exe
2648	chrome.exe
2648	chrome.exe
2648	chrome.exe
2648	chrome.exe
2648	chrome.exe
2648	chrome.exe
2648	chrome.exe
2648	chrome.exe
2648	chrome.exe
2648	chrome.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe

Suspicious use of SetWindowsHookEx 19 IoCs

Processes:

OpenWith.exeOpenWith.exe131.exe131.exe131.exe

pid	process
3648	OpenWith.exe
3648	OpenWith.exe
3648	OpenWith.exe
3648	OpenWith.exe
3648	OpenWith.exe
3648	OpenWith.exe
3648	OpenWith.exe
3648	OpenWith.exe
3648	OpenWith.exe
3648	OpenWith.exe
3648	OpenWith.exe
3648	OpenWith.exe
3648	OpenWith.exe
3648	OpenWith.exe
3648	OpenWith.exe
1864	OpenWith.exe
1424	131.exe
448	131.exe
4396	131.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 4956 wrote to memory of 3788	4956	msedge.exe	msedge.exe
PID 4956 wrote to memory of 3788	4956	msedge.exe	msedge.exe
PID 4956 wrote to memory of 4404	4956	msedge.exe	msedge.exe
PID 4956 wrote to memory of 4404	4956	msedge.exe	msedge.exe
PID 4956 wrote to memory of 4404	4956	msedge.exe	msedge.exe
PID 4956 wrote to memory of 4404	4956	msedge.exe	msedge.exe
PID 4956 wrote to memory of 4404	4956	msedge.exe	msedge.exe
PID 4956 wrote to memory of 4404	4956	msedge.exe	msedge.exe
PID 4956 wrote to memory of 4404	4956	msedge.exe	msedge.exe
PID 4956 wrote to memory of 4404	4956	msedge.exe	msedge.exe
PID 4956 wrote to memory of 4404	4956	msedge.exe	msedge.exe
PID 4956 wrote to memory of 4404	4956	msedge.exe	msedge.exe
PID 4956 wrote to memory of 4404	4956	msedge.exe	msedge.exe
PID 4956 wrote to memory of 4404	4956	msedge.exe	msedge.exe
PID 4956 wrote to memory of 4404	4956	msedge.exe	msedge.exe
PID 4956 wrote to memory of 4404	4956	msedge.exe	msedge.exe
PID 4956 wrote to memory of 4404	4956	msedge.exe	msedge.exe
PID 4956 wrote to memory of 4404	4956	msedge.exe	msedge.exe
PID 4956 wrote to memory of 4404	4956	msedge.exe	msedge.exe
PID 4956 wrote to memory of 4404	4956	msedge.exe	msedge.exe
PID 4956 wrote to memory of 4404	4956	msedge.exe	msedge.exe
PID 4956 wrote to memory of 4404	4956	msedge.exe	msedge.exe
PID 4956 wrote to memory of 4404	4956	msedge.exe	msedge.exe
PID 4956 wrote to memory of 4404	4956	msedge.exe	msedge.exe
PID 4956 wrote to memory of 4404	4956	msedge.exe	msedge.exe
PID 4956 wrote to memory of 4404	4956	msedge.exe	msedge.exe
PID 4956 wrote to memory of 4404	4956	msedge.exe	msedge.exe
PID 4956 wrote to memory of 4404	4956	msedge.exe	msedge.exe
PID 4956 wrote to memory of 4404	4956	msedge.exe	msedge.exe
PID 4956 wrote to memory of 4404	4956	msedge.exe	msedge.exe
PID 4956 wrote to memory of 4404	4956	msedge.exe	msedge.exe
PID 4956 wrote to memory of 4404	4956	msedge.exe	msedge.exe
PID 4956 wrote to memory of 4404	4956	msedge.exe	msedge.exe
PID 4956 wrote to memory of 4404	4956	msedge.exe	msedge.exe
PID 4956 wrote to memory of 4404	4956	msedge.exe	msedge.exe
PID 4956 wrote to memory of 4404	4956	msedge.exe	msedge.exe
PID 4956 wrote to memory of 4404	4956	msedge.exe	msedge.exe
PID 4956 wrote to memory of 4404	4956	msedge.exe	msedge.exe
PID 4956 wrote to memory of 4404	4956	msedge.exe	msedge.exe
PID 4956 wrote to memory of 4404	4956	msedge.exe	msedge.exe
PID 4956 wrote to memory of 4404	4956	msedge.exe	msedge.exe
PID 4956 wrote to memory of 4404	4956	msedge.exe	msedge.exe
PID 4956 wrote to memory of 964	4956	msedge.exe	msedge.exe
PID 4956 wrote to memory of 964	4956	msedge.exe	msedge.exe
PID 4956 wrote to memory of 3888	4956	msedge.exe	msedge.exe
PID 4956 wrote to memory of 3888	4956	msedge.exe	msedge.exe
PID 4956 wrote to memory of 3888	4956	msedge.exe	msedge.exe
PID 4956 wrote to memory of 3888	4956	msedge.exe	msedge.exe
PID 4956 wrote to memory of 3888	4956	msedge.exe	msedge.exe
PID 4956 wrote to memory of 3888	4956	msedge.exe	msedge.exe
PID 4956 wrote to memory of 3888	4956	msedge.exe	msedge.exe
PID 4956 wrote to memory of 3888	4956	msedge.exe	msedge.exe
PID 4956 wrote to memory of 3888	4956	msedge.exe	msedge.exe
PID 4956 wrote to memory of 3888	4956	msedge.exe	msedge.exe
PID 4956 wrote to memory of 3888	4956	msedge.exe	msedge.exe
PID 4956 wrote to memory of 3888	4956	msedge.exe	msedge.exe
PID 4956 wrote to memory of 3888	4956	msedge.exe	msedge.exe
PID 4956 wrote to memory of 3888	4956	msedge.exe	msedge.exe
PID 4956 wrote to memory of 3888	4956	msedge.exe	msedge.exe
PID 4956 wrote to memory of 3888	4956	msedge.exe	msedge.exe
PID 4956 wrote to memory of 3888	4956	msedge.exe	msedge.exe
PID 4956 wrote to memory of 3888	4956	msedge.exe	msedge.exe
PID 4956 wrote to memory of 3888	4956	msedge.exe	msedge.exe
PID 4956 wrote to memory of 3888	4956	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://f
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4956

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffec85f46f8,0x7ffec85f4708,0x7ffec85f4718
2⤵
PID:3788

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,15123359521206590662,3634012242104291609,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:964

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,15123359521206590662,3634012242104291609,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:2
2⤵
PID:4404

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2072,15123359521206590662,3634012242104291609,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2896 /prefetch:8
2⤵
PID:3888

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,15123359521206590662,3634012242104291609,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
2⤵
PID:1640

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,15123359521206590662,3634012242104291609,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
2⤵
PID:4408

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,15123359521206590662,3634012242104291609,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4196 /prefetch:1
2⤵
PID:3236

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1392

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4452

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2648

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffeb99f9758,0x7ffeb99f9768,0x7ffeb99f9778
2⤵
PID:932

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1892 --field-trial-handle=1944,i,5485088283039671830,12905178671769058269,131072 /prefetch:8
2⤵
PID:892

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1740 --field-trial-handle=1944,i,5485088283039671830,12905178671769058269,131072 /prefetch:2
2⤵
PID:452

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2188 --field-trial-handle=1944,i,5485088283039671830,12905178671769058269,131072 /prefetch:8
2⤵
PID:4324

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3052 --field-trial-handle=1944,i,5485088283039671830,12905178671769058269,131072 /prefetch:1
2⤵
PID:1068

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3016 --field-trial-handle=1944,i,5485088283039671830,12905178671769058269,131072 /prefetch:1
2⤵
PID:2844

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4620 --field-trial-handle=1944,i,5485088283039671830,12905178671769058269,131072 /prefetch:1
2⤵
PID:468

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5108 --field-trial-handle=1944,i,5485088283039671830,12905178671769058269,131072 /prefetch:8
2⤵
PID:1760

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5160 --field-trial-handle=1944,i,5485088283039671830,12905178671769058269,131072 /prefetch:8
2⤵
PID:5048

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5140 --field-trial-handle=1944,i,5485088283039671830,12905178671769058269,131072 /prefetch:8
2⤵
PID:2416

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=5488 --field-trial-handle=1944,i,5485088283039671830,12905178671769058269,131072 /prefetch:1
2⤵
PID:2460

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3324 --field-trial-handle=1944,i,5485088283039671830,12905178671769058269,131072 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4840

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:2176

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2820

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffec85f46f8,0x7ffec85f4708,0x7ffec85f4718
2⤵
PID:3464

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2036,13871773871703196058,9786164387036361325,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2312 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3356

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2036,13871773871703196058,9786164387036361325,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2040 /prefetch:2
2⤵
PID:3592

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2036,13871773871703196058,9786164387036361325,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2744 /prefetch:8
2⤵
PID:3052

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,13871773871703196058,9786164387036361325,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3468 /prefetch:1
2⤵
PID:1932

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,13871773871703196058,9786164387036361325,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3448 /prefetch:1
2⤵
PID:4812

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,13871773871703196058,9786164387036361325,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4576 /prefetch:1
2⤵
PID:5012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,13871773871703196058,9786164387036361325,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5100 /prefetch:1
2⤵
PID:2296

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2036,13871773871703196058,9786164387036361325,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5456 /prefetch:8
2⤵
PID:1536

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2036,13871773871703196058,9786164387036361325,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5456 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2420

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,13871773871703196058,9786164387036361325,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5692 /prefetch:1
2⤵
PID:2856

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,13871773871703196058,9786164387036361325,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5820 /prefetch:1
2⤵
PID:2056

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2036,13871773871703196058,9786164387036361325,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5732 /prefetch:8
2⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:5080

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2036,13871773871703196058,9786164387036361325,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5680 /prefetch:8
2⤵
PID:2592

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,13871773871703196058,9786164387036361325,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5196 /prefetch:1
2⤵
PID:4160

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,13871773871703196058,9786164387036361325,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3576 /prefetch:1
2⤵
PID:4732

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,13871773871703196058,9786164387036361325,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6052 /prefetch:1
2⤵
PID:208

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,13871773871703196058,9786164387036361325,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4248 /prefetch:1
2⤵
PID:2604

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,13871773871703196058,9786164387036361325,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4240 /prefetch:1
2⤵
PID:2944

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,13871773871703196058,9786164387036361325,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5180 /prefetch:1
2⤵
PID:2168

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,13871773871703196058,9786164387036361325,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6052 /prefetch:1
2⤵
PID:2004

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,13871773871703196058,9786164387036361325,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3708 /prefetch:1
2⤵
PID:4992

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2036,13871773871703196058,9786164387036361325,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=4132 /prefetch:8
2⤵
PID:3252

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,13871773871703196058,9786164387036361325,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5096 /prefetch:1
2⤵
PID:316

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2036,13871773871703196058,9786164387036361325,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5840 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2692

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2036,13871773871703196058,9786164387036361325,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2692 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2100

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,13871773871703196058,9786164387036361325,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1292 /prefetch:1
2⤵
PID:3484

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2856

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2248

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4812

C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.Cerber.zip\cerber.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.Cerber.zip\cerber.exe"
1⤵
- Drops startup file
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
PID:1668

C:\Windows\SysWOW64\netsh.exe
C:\Windows\system32\netsh.exe advfirewall set allprofiles state on
2⤵
- Modifies Windows Firewall
PID:1632

C:\Windows\SysWOW64\netsh.exe
C:\Windows\system32\netsh.exe advfirewall reset
2⤵
- Modifies Windows Firewall
PID:4556

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\_R_E_A_D___T_H_I_S___NAINN0Z3_.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
2⤵
PID:3828

C:\Windows\SysWOW64\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\_R_E_A_D___T_H_I_S___D60O2OC_.txt
2⤵
- Opens file in notepad (likely ransom note)
PID:3844

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe"
2⤵
PID:876

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "cerber.exe"
3⤵
- Kills process with taskkill
PID:2956

C:\Windows\SysWOW64\PING.EXE
ping -n 1 127.0.0.1
3⤵
- Runs ping.exe
PID:1120

C:\Windows\SysWOW64\werfault.exe
werfault.exe /h /shared Global\5eb363b156a84ea0b103249bf835e2af /t 1728 /p 3828
1⤵
PID:1424

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3648

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1864

C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.Mamba.zip\131.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.Mamba.zip\131.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:1424

C:\Users\Admin\Desktop\131.exe
"C:\Users\Admin\Desktop\131.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:448

C:\Users\Admin\Desktop\131.exe
"C:\Users\Admin\Desktop\131.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:4396

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Network Service Discovery

T1046

Query Registry

T1012

System Information Discovery

T1082

Remote System Discovery

T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

T1102

Impact

Defacement

T1491

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000001
Filesize
195KB

MD5
89d79dbf26a3c2e22ddd95766fe3173d

SHA1
f38fd066eef4cf4e72a934548eafb5f6abb00b53

SHA256
367ef9ec8dc07f84fed51cac5c75dc1ac87688bbf8f5da8e17655e7917bd7b69

SHA512
ab7ce168e6f59e2250b82ec62857c2f2b08e5a548de85ac82177ac550729287ead40382a7c8a92fbce7f53b106d199b1c8adbb770e47287fc70ea0ea858faba6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
168B

MD5
2fda3677c6db82897dce70a496ea0b26

SHA1
c1202001d9cb75b8981b37b27689338f2ffaaaac

SHA256
c619b344e5d7036bbd98d21d08ac7c6d1744366431a88149d405c9f56473cbd1

SHA512
a80f7e7111a840bb90a10bca517a368e6d5fa84ecd1a018deba98620e748d23b2ddfb390fc23a470b31ce3ef96436893b926993b9e856ff259fcc490307e8e86

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
168B

MD5
66f41d4374391003381e4c1f204c841f

SHA1
588e8766c4bcf37cf7958c66857c0ab703412525

SHA256
774c09fc66c0a65d453abd001fd28d02364fa7b79b07e51d2481a659dd562cb4

SHA512
b11762fa36e5044804812a4739a324a5c6a9b1629bd6d5b4106a1cf2e61aa5eb1e4b4edc002ffab60c757aae49a87c7091e015cc7f781f2181e6a254c51addcf

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Filesize
1KB

MD5
f957bca20edda47adedd269d3bced437

SHA1
5d9aecb307ef8f350a40cef8071b857cbed15d55

SHA256
25860a313ac009175b9f51d9d43c9a543ef2e50f0ccb9a6346d3a5feee9e0e5c

SHA512
687ccc784fc62defe0e644d916ea044d0a90560a152b34e8feea55e5fed759075b572d7fcb19e25d471e92c74baffbec18d25ffc7084878be1ed74156b2e0246

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Filesize
2KB

MD5
aea59811db05ac4c36c693a15d55cc8e

SHA1
5607a911fc0e2a2cdbb59f5ee8ae7e0a37f9be40

SHA256
bce835581da9d7931bf026d8c68edd95e548d198e3df6c03687a68fe8c4a7977

SHA512
231d2238b0b19ccd201d5be2f86becd4ffeddd462848d1ddf2a898a4bd48ca047da463f362af017626eaed146f31da8f431cb7d77843b93408cb983462aed412

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
371B

MD5
0f3fefe630bdfae6a36e8e8d5e274d7c

SHA1
1b6ab32f85e454537f7bfd5130a2261b4e9fdbb6

SHA256
4548f7db8df042f7e8e8b3a284d0b8401eb359dbedceb59666b3b832c1e31976

SHA512
7f231493b09656ba43f94bbadc54aa0833949c088b39aece6e6cbf4ff409162b2b2a88d8de32c7057d0a1a1614483c6b0ff1ceb3f72df8347a556ca053ff9af8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
371B

MD5
2b9bb035eb90a14a8f7b91d6e6c45f3f

SHA1
4ea60ad3090037ba2e4937b75368a000158840aa

SHA256
48f7e1d69eded2d5ae0b0af60a901e67a5c7102d818a080a0430afa217c74094

SHA512
7e00e3d11058f6ea03ca14be9bfed460fcab2438504381aeb4daccdba201de74eca64a4182722c57443dc262401f0b2360dbcc0932721cda736f7f91bd6f28ce

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
6KB

MD5
1b919017b7ded4a18eb9e8e80cc48d34

SHA1
edd2606233b74462d7f2d8444fa512eeecebc164

SHA256
ec88aff2f0bec225b8ef1458df28b5187f7ed1e6821de22d96dc6ec2e44f3aa2

SHA512
15ca7cf7970fe593490a3577a9bc5c3812ac3ef959b431bd822fcb3a129cf7c3acad16cdd8cbe1ffeb4349a0399eca127eeae2a79a7da8391645e69f5d5c50bd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
6KB

MD5
25e21dbbdd6e13037b0c65245a9efdad

SHA1
093f1b5c5d880fb9172ef7458c8a3c9b06920f2d

SHA256
5a23406991f3a9ea7ac9f8eb3a12db480626a97f91f361e0fa5c0b33b9b3e9b4

SHA512
2b9df7d38ea5099440c45ccec08051758b760d07e712fed475868dbbb3908f14778dd46353d0cfc62efef23f935a7c4fe8131a92f12a324835936bb9c7bcbcc8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
6KB

MD5
151aacf7142aa2fb6293a35eeafee297

SHA1
6aafe65c5f426ec240cce9b1ba309b8ab482604a

SHA256
3476d7ffe905821cba7ccb4e18b60aa3659067a14df4a00d763f1d6d6818a027

SHA512
5e927bf53d1bb59942f9cdc239cf6f71f407b0f2f60267a386044d5d1ebc9c6fa18ab9a49f04c3f539b76e67a3a677b89941d01903babe509a50b83d057116a4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
6KB

MD5
634c2de74a6613dfefcae07cca044e08

SHA1
2f385d813bdc47c27ebafb93fbe9ee2195a6def4

SHA256
36d86e095f8c192157cf77ac1940683b1fd3547fc1f018f34fa15ebc6a0cf119

SHA512
61c356cf2713a257282f52ce4aac182e51c640769d539ee898b0ff9d2d02b1babf39b756d057e1695c294ea535bb89f9fa5114353cacddc17f0382c3c8d1f2f2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Filesize
15KB

MD5
445db10cdb1ea07dad7b48745178515c

SHA1
afea8a60a00a462284dd38c5b11a710930accec5

SHA256
9e9c87c4960e46bf7551e6c86297703aebaf56242800578785048fe02e1023d7

SHA512
0b36ea51716d6cb7d3f9e5973f7ef728047b97c114252431eafe4fb2b7efd1a8379b5e0cee93c6b607cc644461de3ace3aa881bc5cfb10d8b20ef1399ae9336f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\fbbb6156-2228-4d27-938d-3886cc3ef0a4.tmp
Filesize
6KB

MD5
882a0a6fafa7e75c70fc8733f476f115

SHA1
f1264f64de98f67dda9a7df1c3ffa68fc785be78

SHA256
ee98bd4e13de6ea05bb9155fee2396af3778474104ad07243db2e31a27e9f662

SHA512
8a8d3b1db21e37cb198e1804c3eb0162205acb5ac9711fdb9781f38dbb55d3e59d55104696711350f5653973c7f1d4c717b589abf2e8cf7bf495f05f157db082

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
254KB

MD5
bae8871619a8f858183b59d4d009de22

SHA1
800cde7ce8537228162d121734c79565eaa76d00

SHA256
ea2fbd53e5195dd10e22a6845ae614a0661b12f14132a80d7e86708f986a3b54

SHA512
d2f8f1cb13d81bbfd5bcd888bd304cfcf21f2a544211e517e1822852bb22adcdd87f2c105d08fa05ec94dd6e32fe2a2474e1fe1a3cde1a4e08575a1380285108

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json
Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
cbec32729772aa6c576e97df4fef48f5

SHA1
6ec173d5313f27ba1e46ad66c7bbe7c0a9767dba

SHA256
d34331aa91a21e127bbe68f55c4c1898c429d9d43545c3253d317ffb105aa24e

SHA512
425b3638fed70da3bc16bba8b9878de528aca98669203f39473b931f487a614d3f66073b8c3d9bc2211e152b4bbdeceb2777001467954eec491f862912f3c7a0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
34e3f8a801e516ffe03376f78a8f4185

SHA1
27c4fbc447793098152e84f8dfa5a502e1971558

SHA256
699f84eb9111da3d1f36a677b68ba1f8fbaae03771efdc638e0b535e38dbd979

SHA512
189d30a8718d675f1a895a74755a1c1b2b052948e3794bc6da48e1e6d5cdf3e1d3cf8a3fe5a09c960a91ffe25d35621b180db00c06426c0c578300bcfe409e11

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
279e783b0129b64a8529800a88fbf1ee

SHA1
204c62ec8cef8467e5729cad52adae293178744f

SHA256
3619c3b82a8cbdce37bfd88b66d4fdfcd728a1112b05eb26998bea527d187932

SHA512
32730d9124dd28c196bd4abcfd6a283a04553f3f6b050c057264bc883783d30d6602781137762e66e1f90847724d0e994bddf6e729de11a809f263f139023d3b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\47c89acb-b967-4d9d-aa83-a5c2efffc53a.tmp
Filesize
1B

MD5
5058f1af8388633f609cadb75a75dc9d

SHA1
3a52ce780950d4d969792a2559cd519d7ee8c727

SHA256
cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

SHA512
0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_0
Filesize
44KB

MD5
6683977906106c429b1ab0874fd792ce

SHA1
6adc5bf6c58f8ac4f2afd18e092be3dca763fb46

SHA256
9832d382517b3c1a7a9b50932f7e8d9c09af145bbc88aff3bf2323323acb1907

SHA512
ec6006d0f4a7bc38b62001f10dfa2e210936e2f81e85a6b7328b484057be9151d0e17eae2e24404830b8ecb2c9f202782c0255ce198e6d34f3bb8ca4ff14f608

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_1
Filesize
264KB

MD5
1917337f5d7f11afd4e320db7da3b9fb

SHA1
de6144f34add8f3e1379b9c3ba53b869fc882793

SHA256
31e635108b429c5582064809a8c7de81860057d3aee636bb2637ff4ad42af5ef

SHA512
18a6e9aed275427de372748534ef5505139f917f30b2aaa267de56a837cf49ed7f79325d0466eea817742de9ec3206ec3d4231d661565c7888435f8c3c69ac25

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000011
Filesize
20KB

MD5
8b2813296f6e3577e9ac2eb518ac437e

SHA1
6c8066353b4d463018aa1e4e9bb9bf2e9a7d9a86

SHA256
befb3b0471067ac66b93fcdba75c11d743f70a02bb9f5eef7501fa874686319d

SHA512
a1ed4d23dfbe981bf749c2008ab55a3d76e8f41801a09475e7e0109600f288aa20036273940e8ba70a172dec57eec56fe7c567cb941ba71edae080f2fdcc1e0c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000015
Filesize
59KB

MD5
063fe934b18300c766e7279114db4b67

SHA1
d7e71855cf6e8d1e7fbaa763223857f50cd1d4bd

SHA256
8745914e0214bcd9d2e6a841f0679a81084ef3fc3d99125876bee26653f4253e

SHA512
9d0dfc21306b3a56c2ecdf1265392271969e3765e161e117c8765125b34793e24458217cf6514b364f351f47e65baaaf5856be0d13406a789f844d6ba8c7075f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000017
Filesize
153KB

MD5
2f3c7b5f9221520efbdb40dc21658819

SHA1
df12f010d51fe1214d9aca86b0b95fa5832af5fd

SHA256
3ba36c441b5843537507d844eca311044121e3bb7a5a60492a71828c183b9e99

SHA512
d9ed3dccd44e05a7fde2b48c8428057345022a3bcea32b5bdd42b1595e7d6d55f2018a2d444e82380b887726377ab68fa119027c24ac1dadc50d7918cc123d7b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000018
Filesize
28KB

MD5
b61de4c8c3c3a79f3d0eb839f206c485

SHA1
fbf741475be23d6cb0c6147397c305fee2c45e0a

SHA256
f7dc65d6317d95c8c85ad0d9714ed9271bf969bf7a8adf1eef04a9edc845829b

SHA512
71aac5c20ad910dd33850afea210b3dbfbac4f6835e93a4bb7723b3b42090aa94a6c78d7ea5c508130e5de3fa45a0c7439426075c6d38b39a8b4b7dd5d8dc2a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000019
Filesize
19KB

MD5
9c9826fe7f73c9653a44e461bd02aa59

SHA1
a5a393937e2f6d0295e076d7681c055e6164a666

SHA256
08608aa6f907b9e5b93fe2db70c630c4d0d31199752a0880b129d52cb0213d17

SHA512
f7f2d655bc1df5166329e97732c959c7ec4b9adbd298e44ccb603991982485b64783b88e910dc0d3c3a18d14a0465f885dcfecb14847c1cdeaace62c301f111c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Filesize
3KB

MD5
15bce88cec9a96e26c5ef4a48648caca

SHA1
678c8b3b2ae0afb0f0604268d217609150406683

SHA256
5f7bec0b85e15af0db08e2009ddfda887f6cbf2384e8153cdf1cc4cd97f0cb15

SHA512
45973cfe06ea35490369fdf4511a2a45356fd0d1781bb95597bbb51d32203d23d2892058dfea83cd91b5e2cfbec33906c8fc58a6b676c1a97722a499512b7b7d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
3KB

MD5
7aad912a88d80bccaa7488a3d1708b1d

SHA1
f0c5fc123b33080b54aa6a0d77176cfa7299429b

SHA256
7a55dc788348b996f23e5805c6e1889a042af50ca975a66829382ebbf04f1780

SHA512
9f6856c7670aa0027033bc3df74a3b55e15ceb8c157a0af4486bfbe09166e95c9347da7c82f664b1299ca63cf6e97838ab1e78f122da51eff69b11988967b169

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Filesize
319B

MD5
04efc2ad4f22b662049b4c6d59850da1

SHA1
940a7eb7b028c5d1c9b0a170f85dd72eefbf96bf

SHA256
75b6468ddea76fb50906a5d16c9f39b255aaa897c3d6ad52d4d9b21eb9f3f5e7

SHA512
f79832a521bb5323782b11c8e1a532070b5eeb77a12e30557af9ac79995fda0e73cd252f88acc82d655cdf412037b31b3e809b3dc1ef51dbd82fb7ab9f3dc442

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History Provider Cache
Filesize
6B

MD5
a9851aa4c3c8af2d1bd8834201b2ba51

SHA1
fa95986f7ebfac4aab3b261d3ed0a21b142e91fc

SHA256
e708be5e34097c8b4b6ecb50ead7705843d0dc4b0779b95ef57073d80f36c191

SHA512
41a1b4d650ff55b164f3db02c8440f044c4ec31d8ddbbbf56195d4e27473c6b1379dfad3581e16429650e2364791f5c19aae723efc11986bb986ef262538b818

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Filesize
331B

MD5
d9db1a2e218cf497a35674ae5fb50829

SHA1
39a191d6c91702986b620805ad6a5120b85bbcc9

SHA256
cc0de23553f2e64f07bfa0fc4ba851739c842aad215d8dd5e3cca92ac970014b

SHA512
4963e1bdd7e09f0a7bd811ab4af299e971df56d1b080126e09c6f017fbed27bed08e51e03032008416f6fca2670194154fb7fa0421bb7694dab753d7498124d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
1KB

MD5
88c813c2e19f600d1ab902ccc98bff43

SHA1
0a25c6365c0bdac8c41fd3e994d185549de20242

SHA256
68ef04f2d53362d8cfa8ef7c129ec05a75513579a7535b6091a5cc03dcb6ec69

SHA512
315d216df050d9c2eeb90f8c21270b8437f3ea32250c76155b29afa9d6919a9430d7c1eca10c731e0c6088c72dd2a3fe5f896f7d3618153b4ca6de79feca52e8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
1KB

MD5
a917a8751781ffc6f619d16dc7f7475d

SHA1
288fa204c7a7f9b6a309eae137344f843d6ad681

SHA256
064f9cb78a94f25816e3155fc755f77b34852ecb9c1b036555919b55aeac5be5

SHA512
088eac303d6813fbfc652a5b1371cbe0ba09f9be4508324a461a081eb95af90b861b6a65d18f7a1f1a250a17ea342e750614b189caa2fa48f652b69026b5675b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
fc490e3fd7c3b43ceabaa7505a2fbc6d

SHA1
66874d63c41999fe622738703c7f9de67cd9550b

SHA256
bf2c46e1dc8104d4ecbc563558a12a375f1b78958accc65290d4b29e0b75edf7

SHA512
ac453b2007340bccbc5049da1d9dc0e0a154aa4783f12d872105eb27684f05b3b2d6c5adc9c1a925aad31adfbdba19b517a9ddd75811b9948d5e371d771b5d15

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
642f683bbc59f3af9d86b34063ea5b76

SHA1
b9d70e2a28d7dcae54331cbd5394926ba3204d22

SHA256
41f8197803d0088ff056c83df8c8953e5feb368f558588306fc08e7387b49a24

SHA512
c02544cc77c3e9bb0f223d5e75c384990dd7c1494abda42e4660ca470dbdd5d328e6d9ef52d68cb62ef60206c16d459909b581f5c3fca3cc01ab8fc86fdefe40

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
7KB

MD5
5ad4e1047161f5fab8efe344bff2adf5

SHA1
284fb0c47120caaa5a9fb7cf6ca7d30c838ddb41

SHA256
67f179cf4ed88d5e41e3fa1c39bf688fab92f9a938bf0860291442585bba3d18

SHA512
5c3e990adfdec3f814fc3f8c953bf22fab5637ab8dac5f66d395ed636519ddc21096feab60837817f8b089c69382c6c7361e2800f2c81b7c99322e76895ab311

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
7KB

MD5
6d947c62c007d4adc8d4ff968e6ff677

SHA1
c29c6d52c27848afc0067c465b37aa27314c2fd9

SHA256
5f83c8f6efb48e0a3e6260f224b1fcafec7e2f825c8ac25293540992d5e4f547

SHA512
359b0b735c6454829c6d4140e14c1bed32e8026e0da644dd8e138318cebcf56e14cfcd0c54f62bf13fb232ce7ff66f0be35318eba71c2f31274ddfe387af0347

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
f294f3a54bf172cb61ac50390748d028

SHA1
ecb2f2038ee347fc2c7cf86f8b56618a168376c3

SHA256
38f9ac4505a870b677a4077659d81215ce3311d0cbf58c51bd1144aff1fbfc68

SHA512
17fd5aabf4ba4c7f55df8e76ecba133ae45f8d0d30c4290fea2daa26372541982a64ca5377eb453b3857c577d5a5e5db3ba89a42607cbbabd6f2906f1f698661

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
7KB

MD5
4926f9640016730c02d202251726370c

SHA1
722bf8d8dbfd3591e47330d29fa56e80ccaf3e96

SHA256
5ad8d36fcc3a5cf673e3184d3c194dfd5e55f55255b6666c1a835f7848aa1bfb

SHA512
ec76085d80407b5089e9f03d99ba6ee030be16917d6cba91be737d2570a27ca0070ea299502245b85030a8cd6344226146e92b9f37dd15a8c7fa7a4fa1155fc6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log
Filesize
175B

MD5
6153ae3a389cfba4b2fe34025943ec59

SHA1
c5762dbae34261a19ec867ffea81551757373785

SHA256
93c2b2b9ce1d2a2f28fac5aadc19c713b567df08eaeef4167b6543a1cd094a61

SHA512
f2367664799162966368c4a480df6eb4205522eaae32d861217ba8ed7cfabacbfbb0f7c66433ff6d31ec9638da66e727e04c2239d7c6a0d5fd3356230e09ab6c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG
Filesize
319B

MD5
4ef5f230d73678d72f675eba528691ab

SHA1
449018be0a8e5493330b00269b65ce1ed05b1ccc

SHA256
d818c87b2ac97586ae4b703ed7cb6bdd88a012c760895de6967aa2cefe5ed3af

SHA512
1825eca1c128ed65bf57a1d9cb8f491bc6d5fc9f2e625a4282945406441652759bcb128262aca9038d54f7110fc6fd9e4f05e1fc323e68820919eb6f1966bb39

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Session_13353693745168827
Filesize
1KB

MD5
cc9ea6a18497ad072b3c8bb995cf5f2b

SHA1
5278bb4e49db97d78f15e9a3e1d4c09478094c5c

SHA256
ddd3eb4ce586f3db5da80eeb26f9e6e31ebd3a5db824cf4f59655fb2b0e70473

SHA512
86f257a9ae41f6f09d47021ce6fae50d55150f29023b0ca67584873219275c8d953921aa008c2784cfc37ab0885543b278ae12d19154e906f73849cc6784f461

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Tabs_13353693745249827
Filesize
1KB

MD5
191a071a3d4f4d604de6f49590019f14

SHA1
364d5bf2a2325b73023484814f43dafb80ae1dd3

SHA256
5be63c158db1930d32189aff17ecaa89fd087ccbe6932a904950a5696c98a95e

SHA512
e32c22955a389209e12a2bd4e077d091bd689cb9cdff3767666b47351fbda2de77d664dff77fae8aa1c9acc1aba8103b93339f39cd9def938da9ea84439fb508

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Filesize
347B

MD5
34049f39cc1367ea4fc34bdac90c40c2

SHA1
917f2a94309ce9abceadde2dfc09aa5543f83704

SHA256
3729e82483f558fbc295af906b1fb310002e62935b9330969d0ac7db71186254

SHA512
c8afddf38ad0819693cdc38d71643d5ecca15fd57d4608409fb7400adf7f12043d136982a50cf11c10cd6dfaf2dcc82326db8ee9a5dac7bc7ca73d01c1b64952

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Filesize
323B

MD5
d39455b712a2a1719b6cdb616a97aa8e

SHA1
38f310004566f945321d7c97d382799eceb35c87

SHA256
6fab444c2e7536cc10082c14c4459d77251b261b4d59a346f332c4d0f5057949

SHA512
25b041e9981b6c9c08d3b6362360e4204b21eb9140c3877fa571aa33087a9055db7f40cabb472d8eb3632c10408b6e1b863f31450dde702e775368887b101373

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
1KB

MD5
df6a3d9a110be73c0bd71be44f0adc8a

SHA1
0b354398ef4f97db93017982b51b5d2c6062d887

SHA256
2fc36d0baae9dc959af9b98f79575d4b18bcfd36c694dbeef7e6d495415f1443

SHA512
4a2eb8dcdfbf9eaf5bf20ca07afd797445fb6341e69092f8c5eff2476605de5e74ebdc005f215de62bd861d165222f86437aef3386a6f6e02c12faf53f39799f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
1KB

MD5
7de8f03470de867e0f28641427ba0576

SHA1
0a02aa3d4446a10781a5aee5f5dc03345eabce12

SHA256
a23fdad7558a3f1f0e501fcb4f5fae07bda15d2df7ad23b09e05c2b978bb127d

SHA512
563d9ba74c9466852adc9c8abf14a45fdb65107656ea9b25231579a8dbe3339f07f1d7d91c56fdc1f3b718105a9d4ab66dc60a3b3e945a898f1d3825d8e79962

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
1KB

MD5
0042969810736f12abac6ad2bc4e1161

SHA1
7788654c7931ce245f6d148df56168e02302795b

SHA256
3b5dac158ac7f29104549b256e35dc7b23adc4e182eca27c129fa45e0063aade

SHA512
8b54dce36ef0fbfcbb9ff8761c3050cda06d887c634d54ad6db723400f655555ee79b54c685d670d404cd3e0c44322dd55bed5112dccbab644aae3d003fb9d93

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
1KB

MD5
ddf7f5d80db1356633ebd22acf238444

SHA1
bd70ca29ab35b5cfdd767b42351f79aadbb6215c

SHA256
bebe72e700765506ca9aa823977e8f6c0fbafe21f5d303f485f454bd0e7c0b95

SHA512
c4499951489d16de2cc99c35ea07960aec01cd88463c63a5b63cb75e0df53ddf486bd6778b0b64b90ce1b0354ee439e2f8327299ebd6c7c5c628288adc730ff0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
1KB

MD5
a389ad3b89a5758d5c7068047e86574f

SHA1
f609768c38284db1ea2ca0b53c0a991af7823621

SHA256
1597cdea26b6f2e272d71318b5738bf6881e989cc3a20e4d8b99c47f66cbc13f

SHA512
4852a9a840eceac280bda9debc7a498f7cf782fb090f8f7574dd68a3d681b88466a11eaa57bfc8fdab5a84128a317ead8a5c00611b4af09ebd2906d9be515eb4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe599dfb.TMP
Filesize
1KB

MD5
2c4b773818c0b39d5ef3fde2b25e4f9f

SHA1
bdfd750d643998f6ebb28b46d484605cfbcd6abf

SHA256
c89e7c983bc564fd88ee650a0e30473fced14f4e590da396c7d3deb271019f1e

SHA512
d091df65c73c6498543110cde3f0a6521fcbd71bdfecad911fb88538eacf93df242e770e690c2708ed7df7ced0e37af898728ca8e0282cdddb31e30ec41ce012

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a41c79da-7efb-446d-9c9e-42e893843742.tmp
Filesize
6KB

MD5
d455f1b234e6b7dbd6e03ffe327f6d50

SHA1
77697873ae28a946e3615348f44431ceb548c0d3

SHA256
c7b27fa03d85d1a209052080fc0c847e80c1b01172356fa734caa636470b70b7

SHA512
6dfa778dbf79a52e98965f84008ceb8a4c56d522905e2ddbd3a8299bdb806c47b2fe92af31c8a709a84de6007ab40b97e2e3f35c0154e43df4c0e63be7854772

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db
Filesize
44KB

MD5
49e051a1819b422d903ce4ea00741d83

SHA1
27b5de448a28764617677d2f799ef33cf1177355

SHA256
4898cd4d5a463519b718e15068b451db9f518da5b852979141d6ddea93f0945b

SHA512
1d65b8c2b17a086af4fd42ab08d43594d08934128f6f44557d29dc12bb7f1d2b2536a60fcd95d4e4eecb1ef28f4e3b2dedb62e3a116b6bbabecd384965eb8f6a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Filesize
319B

MD5
5c7ed0eee918b06fd9c3b9dfc4a7b4b3

SHA1
511770c735c62ca268dc7b366c2e8c2d9771c07a

SHA256
e3fce1a3d70a54fe0af5e9fd1fe34405358d9a37a28d416d783bdc5728590c9e

SHA512
fe064e42d3325688375dfd4c5687a313c0193dfbfc9774eea3837cf3e53ace2286d770f605c80bc5fdc382e614c53ae095c3c123d67c7d473410d984083d9d8a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Filesize
594B

MD5
97e70662c4fa3f484b758eb5de9618a0

SHA1
769b6c20767d19f4e5cd9545564e63c4ca5928b2

SHA256
6e901b176e9a392d846c7078129af802df79e9061609e61edccc49e570c52bea

SHA512
417cd27ea698fdec066438627f513ea154a594cc1afef227ff6b178ac6bf5fcb9588b3be43cc633ff9d13f69c6fe9754d39458128c17cd665f258096f2fb0a7c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Filesize
337B

MD5
1cff901b9b4e211f68f34e73ba89af54

SHA1
7e0946a96f504f6c0428bd7f165dd7e60172b787

SHA256
f5daa73efa27639301f2a5a114c1fb379ac358036e90405abc152c591f88127a

SHA512
5e80bf28ebd3b6a108df97ec7e0f3a1a023486a5c866eeae3fe27ed13b1edd58593f4d4c5b20f589abd6fd89e1e1f75b59c1b7c3774a46f80919ffbb8919cd98

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_0
Filesize
44KB

MD5
bebf5eecf6ddc85f2e16c0b26b3aacdd

SHA1
d3a93e6261a40c8d64b8861133bc35e7ce6744b2

SHA256
56c7023af31eb8ac090ca87907c60247cdcf162ac28ff5c597bdc9873a0c4d38

SHA512
cb8a104dd8e687edefd10c58a353d75d1ca04cc63a51a7ca2a0286005135410bf3684f9db3639998255ba8ca7cd005e365debce127a645b829b612fb6bb1df7a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_1
Filesize
264KB

MD5
34e3aaa9600ce9105c94939a03c6691e

SHA1
477634b2d1ae9af6912bb540e0e7f0f0c9cc2bed

SHA256
c1923a07ef2d1ad2f8e5cf3f32f25153dd239b5a81bf55a75ffd572ffab22377

SHA512
15e4f19513593e02dd4d2572a925b0de3b21f0e2d03593cc52faac0b4588fae6b49573158cefa2a3593ec4e79d4be0824485af54092ea5c5fdf042a591b3ee75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_3
Filesize
4.0MB

MD5
863545d297d288d09e15f85d31d50718

SHA1
78c2046e11746a63bec4997090671573d91456f9

SHA256
a3b153833effad5b4862470c6e5ab0909056bc7aae657b5725c9365bfbfb709a

SHA512
531a2d4d91ac2c3dc9d6e2b70330d7516e544094f923cf9f8669493e9c35e61dab7a531c7f4c5fb0d66a532b647ded24d859a894a13b401e19a82730273bd2b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Filesize
11B

MD5
838a7b32aefb618130392bc7d006aa2e

SHA1
5159e0f18c9e68f0e75e2239875aa994847b8290

SHA256
ac3dd2221d90b09b795f1f72e72e4860342a4508fe336c4b822476eb25a55eaa

SHA512
9e350f0565cc726f66146838f9cebaaa38dd01892ffab9a45fe4f72e5be5459c0442e99107293a7c6f2412c71f668242c5e5a502124bc57cbf3b6ad8940cb3e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
12KB

MD5
f36095b158fc0312ed46b24d952081fd

SHA1
4e3fac04a7202150ce0a927cb140e4191f8cc297

SHA256
9c972b9bc5478233fa21835a5a06a7ce80db5f2502d4aee7b53fab2681b8824f

SHA512
18a45c1b5d4ff7e66faf318b8611bf0a4ee3593d3c7a61b16cd8de30843b285fbd72d5136bffb841c8c069425f48b1cb4b582a02c169593500694432bd11a62a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
6ad5459779c3eb91008ed7df890037cd

SHA1
335be6781ec3cbe254a86a0f8f6a853be8998820

SHA256
c1653a7bd5062f44338e3bed48e3af84f1bc1f0f5876e6f090ec04df3e41e6cd

SHA512
c90bbdff27569d6ae96f7d6f744f67e25b7cf4003c30813d026e9667dd3c7e7b77b2f99702ec4c47c842a36f5c306ba3353818a330eaa2429d2f53e3cf621e32

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
f026af82443328e79a2dad279a3a0199

SHA1
b988517f71cfbbcfca4e33d9caa1df124e631e43

SHA256
e2ad78f100ddd1d4655f29347c37af4fcedce104288eff83a52338a73133a818

SHA512
d9aa6a48bf9563f4a1727dca06adbdc9ddd73f7916dafac60d56d80307f5094ce95a66008d8c7927e97b01481dad579e79d59d67d3c47ab85207e59c21f88c3b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
12KB

MD5
575aea35e04e1daf9233d1b9692658fd

SHA1
9e1acb97bae6109e7ea0e919e067b78e39c8d07c

SHA256
d7a48d2c67cf042b4a3e448453cf31067a6664256bc34b59772002b1594f1dc1

SHA512
2c7581fd636557d3d96dc704a8afb40f45b5724c83e0dc8a971f2e677ba03c0f07c6216d47014885e4052c04e9ceb80d05807e5a0deda9283e2e02b115229a85

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1
Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\edge_shutdown_ms.txt
Filesize
3B

MD5
47981763dfafcf0b0527949e6c180cac

SHA1
23d6f7da9abf8d31c1b000c51338a81f5364b74f

SHA256
22e946e35d40e3c5d3154bcd70884e62c0b8523c770b86faf5aa3f816bdef3f4

SHA512
c2b3bacc9d9341450d09973d1271f1933c75ad5938e9aa612e2f46e9c7315374d88c410a9ab4b51e53d590ddf9017afdf742ef92e887c4faf795774634c33913

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\_R_E_A_D___T_H_I_S___3ZO9108_.hta
Filesize
75KB

MD5
b062c7ad44bdb691f9c6284e87d3f9b4

SHA1
467b7b1f1d186116eb41f180d26c67e826b8b740

SHA256
aa3cdeaff5dd968f6ca87541a84376f74c8b0806ba2698b5684bdc393cbb1b57

SHA512
e5b133c6f65c4a229fdae6c1773e445f264f998ac15b0b5329afe3d56830714ecd657b1970ecbc427b087d6e3796a3b3641721738aa3267742b261f6dedbf394

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\9cd93bc6dcf544bae69531052e64647ec02f2bb4.tbres
Filesize
4KB

MD5
ba7566debae1509beb0ac47056d73df3

SHA1
ef0a63052e7b977cec6ccddc96daadf869301b6a

SHA256
8fe9df551d60c89674383b331d52d7c5ff9a4e8d8b0b8e3147eded6425785dbd

SHA512
427ca8d5b2ebacb44b58d44c80accb8fc2658db2e1ed84ef04934c90385d003fc07d50b232e39941a6a885d79f36ab4eb3b63d7f03ff01f9835a94c2b98fa990

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\OneNote\16.0\_R_E_A_D___T_H_I_S___2L4796_.txt
Filesize
1KB

MD5
484055f960c64b8d51e86a66cf397985

SHA1
30f53a6107c202a8b4c6a3b0ce4134fde39857f9

SHA256
ea2d4b1d3f7a9e779dcaa0baefec8f5f8f5788ad69b8147bf425fc3fef7b7471

SHA512
6cce5bbe2fbeaf37b0cd1f82463df6c7d0d210de9e9dd964ae30072c9a6e83b83a29f70da7b73e6556e254f2f88ababe4d8e67cd7d1c5347c0d3b03b1b355f1a

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 840102.crdownload
Filesize
15.1MB

MD5
e88a0140466c45348c7b482bb3e103df

SHA1
c59741da45f77ed2350c72055c7b3d96afd4bfc1

SHA256
bab1853454ca6fdd3acd471254101db1b805b601e309a49ec7b4b1fbcfc47ad7

SHA512
2dc9682f4fb6ea520acc505bdbe7671ab7251bf9abd25a5275f0c543a6157d7fa5325b9dce6245e035641ab831d646f0e14f6649f9464f5e97431ab1bf7da431

Download Submit
\??\pipe\LOCAL\crashpad_4956_YYHGNXTVWRRJCQSJ
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/1668-958-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1668-962-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1668-968-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1668-955-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1668-1306-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1668-1342-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1668-1344-0x0000000000440000-0x0000000000451000-memory.dmp

Filesize
68KB

Download
memory/1668-954-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1668-953-0x00000000021F0000-0x0000000002221000-memory.dmp

Filesize
196KB

Download