cerber | hxxps://github[.]com/Endermanch

Analysis

max time kernel
572s
max time network
570s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
03-08-2024 12:36

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

https://github.com/Endermanch

Score

10^/10

cerber bootkit discovery evasion persistence privilege_escalation ransomware

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\_R_E_A_D___T_H_I_S___NHU8ANRB_.txt

Family

cerber

Ransom Note

Hi, I'am CRBR ENCRYPTOR ;) ----- ALL YOUR DOCUMENTS, PH0T0S, DATABASES AND OTHER IMPORTANT FILES HAVE BEEN ENCRYPTED! ----- The only one way to decrypt your files is to receive the private key and decryption program. To receive the private key and decryption program go to any decrypted folder, inside there is the special file (*_R_E_A_D___T_H_I_S_*) with complete instructions how to decrypt your files. If you cannot find any (*_R_E_A_D___T_H_I_S_*) file at your PC, follow the instructions below: ----- 1. Download "Tor Browser" from https://www.torproject.org/ and install it. 2. In the "Tor Browser" open your personal page here: http://xpcx6erilkjced3j.onion/D38B-7F00-3D0C-0098-BED0 Note! This page is available via "Tor Browser" only. ----- Also you can use temporary addresses on your personal page without using "Tor Browser". ----- 1. http://xpcx6erilkjced3j.1n5mod.top/D38B-7F00-3D0C-0098-BED0 2. http://xpcx6erilkjced3j.19kdeh.top/D38B-7F00-3D0C-0098-BED0 3. http://xpcx6erilkjced3j.1mpsnr.top/D38B-7F00-3D0C-0098-BED0 4. http://xpcx6erilkjced3j.18ey8e.top/D38B-7F00-3D0C-0098-BED0 5. http://xpcx6erilkjced3j.17gcun.top/D38B-7F00-3D0C-0098-BED0 ----- Note! These are temporary addresses! They will be available for a limited amount of time! -----

URLs

http://xpcx6erilkjced3j.onion/D38B-7F00-3D0C-0098-BED0

http://xpcx6erilkjced3j.1n5mod.top/D38B-7F00-3D0C-0098-BED0

http://xpcx6erilkjced3j.19kdeh.top/D38B-7F00-3D0C-0098-BED0

http://xpcx6erilkjced3j.1mpsnr.top/D38B-7F00-3D0C-0098-BED0

http://xpcx6erilkjced3j.18ey8e.top/D38B-7F00-3D0C-0098-BED0

http://xpcx6erilkjced3j.17gcun.top/D38B-7F00-3D0C-0098-BED0

Signatures

Cerber
Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.
ransomware cerber
Contacts a large (1114) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Modifies Windows Firewall 2 TTPs 2 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2828	netsh.exe
2444	netsh.exe

Drops startup file 1 IoCs

description	ioc	Process
File opened for modification	\??\c:\users\admin\appdata\roaming\microsoft\word\startup\	[email protected]

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\b:	[email protected]
File opened (read-only)	\??\e:	[email protected]
File opened (read-only)	\??\x:	[email protected]
File opened (read-only)	\??\z:	[email protected]
File opened (read-only)	\??\a:	[email protected]
File opened (read-only)	\??\g:	[email protected]
File opened (read-only)	\??\i:	[email protected]
File opened (read-only)	\??\k:	[email protected]
File opened (read-only)	\??\p:	[email protected]
File opened (read-only)	\??\q:	[email protected]
File opened (read-only)	\??\w:	[email protected]
File opened (read-only)	\??\j:	[email protected]
File opened (read-only)	\??\r:	[email protected]
File opened (read-only)	\??\s:	[email protected]
File opened (read-only)	\??\t:	[email protected]
File opened (read-only)	\??\v:	[email protected]
File opened (read-only)	\??\h:	[email protected]
File opened (read-only)	\??\l:	[email protected]
File opened (read-only)	\??\m:	[email protected]
File opened (read-only)	\??\n:	[email protected]
File opened (read-only)	\??\o:	[email protected]
File opened (read-only)	\??\u:	[email protected]
File opened (read-only)	\??\y:	[email protected]

Legitimate hosting services abused for malware hosting/C2 1 TTPs 10 IoCs

Web Service

T1102

flow	ioc
84	raw.githubusercontent.com
32	camo.githubusercontent.com
33	camo.githubusercontent.com
34	camo.githubusercontent.com
37	camo.githubusercontent.com
85	raw.githubusercontent.com
35	camo.githubusercontent.com
36	camo.githubusercontent.com
38	camo.githubusercontent.com
51	raw.githubusercontent.com

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	[email protected]

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\excel	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\microsoft sql server	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\powerpoint	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\powerpoint	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\steam	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\office	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\onenote	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\the bat!	[email protected]
File opened for modification	C:\Windows\System32\devmgmt.msc	mmc.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\outlook	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\onenote	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\word	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\the bat!	[email protected]
File created	\??\c:\windows\system32\driverstore\filerepository\display.inf_amd64_71aa85b0e2292a7a\display.PNF	chrome.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft sql server	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\onenote	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\powerpoint	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\office	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\desktop	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\bitcoin	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\excel	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\excel	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\thunderbird	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\documents	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\office	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\outlook	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\word	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\office	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\onenote	[email protected]
File created	C:\Windows\System32\DriverStore\FileRepository\display.inf_amd64_71aa85b0e2292a7a\display.PNF	chrome.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\bitcoin	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft sql server	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\excel	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\microsoft sql server	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\thunderbird	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\word	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\outlook	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\word	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\outlook	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\powerpoint	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\steam	[email protected]

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tmpC254.bmp"	[email protected]

Drops file in Program Files directory 20 IoCs

description	ioc	Process
File opened for modification	\??\c:\program files (x86)\office	[email protected]
File opened for modification	\??\c:\program files (x86)\bitcoin	[email protected]
File opened for modification	\??\c:\program files (x86)\microsoft sql server	[email protected]
File opened for modification	\??\c:\program files (x86)\microsoft\microsoft sql server	[email protected]
File opened for modification	\??\c:\program files (x86)\microsoft\onenote	[email protected]
File opened for modification	\??\c:\program files (x86)\outlook	[email protected]
File opened for modification	\??\c:\program files (x86)\the bat!	[email protected]
File opened for modification	\??\c:\program files (x86)\thunderbird	[email protected]
File opened for modification	\??\c:\program files (x86)\word	[email protected]
File opened for modification	\??\c:\program files\	[email protected]
File opened for modification	\??\c:\program files (x86)\microsoft\outlook	[email protected]
File opened for modification	\??\c:\program files (x86)\onenote	[email protected]
File opened for modification	\??\c:\program files (x86)\excel	[email protected]
File opened for modification	\??\c:\program files (x86)\microsoft\excel	[email protected]
File opened for modification	\??\c:\program files (x86)\microsoft\office	[email protected]
File opened for modification	\??\c:\program files (x86)\microsoft\powerpoint	[email protected]
File opened for modification	\??\c:\program files (x86)\microsoft\word	[email protected]
File opened for modification	\??\c:\program files (x86)\powerpoint	[email protected]
File opened for modification	\??\c:\program files (x86)\steam	[email protected]
File opened for modification	\??\c:\program files (x86)\	[email protected]

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\excel	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\excel	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\powerpoint	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\word	[email protected]
File created	C:\Windows\INF\c_scmvolume.PNF	mmc.exe
File created	C:\Windows\INF\ts_generic.PNF	mmc.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\steam	[email protected]
File created	C:\Windows\INF\digitalmediadevice.PNF	mmc.exe
File created	C:\Windows\INF\c_scmdisk.PNF	mmc.exe
File created	C:\Windows\INF\c_fsvirtualization.PNF	mmc.exe
File created	C:\Windows\INF\c_processor.PNF	mmc.exe
File created	C:\Windows\INF\c_extension.PNF	mmc.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\outlook	[email protected]
File created	C:\Windows\INF\c_ucm.PNF	mmc.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\word	[email protected]
File created	C:\Windows\INF\c_fsphysicalquotamgmt.PNF	mmc.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\steam	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\outlook	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\office	[email protected]
File created	C:\Windows\INF\c_fssystemrecovery.PNF	mmc.exe
File created	C:\Windows\INF\c_swcomponent.PNF	mmc.exe
File created	C:\Windows\INF\c_fsopenfilebackup.PNF	mmc.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\excel	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft sql server	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\office	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\office	[email protected]
File created	C:\Windows\INF\remoteposdrv.PNF	mmc.exe
File created	C:\Windows\INF\c_apo.PNF	mmc.exe
File created	C:\Windows\INF\c_fscompression.PNF	mmc.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\excel	[email protected]
File created	C:\Windows\INF\c_firmware.PNF	mmc.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft sql server	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\powerpoint	[email protected]
File created	C:\Windows\INF\c_smrdisk.PNF	mmc.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft sql server	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\office	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\outlook	[email protected]
File created	C:\Windows\INF\c_fssecurityenhancer.PNF	mmc.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\onenote	[email protected]
File created	C:\Windows\INF\c_media.PNF	mmc.exe
File created	C:\Windows\INF\c_linedisplay.PNF	mmc.exe
File created	C:\Windows\INF\c_proximity.PNF	mmc.exe
File created	C:\Windows\INF\c_volume.PNF	mmc.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\microsoft sql server	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\onenote	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\office	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\powerpoint	[email protected]
File created	C:\Windows\INF\c_mcx.PNF	mmc.exe
File created	C:\Windows\INF\c_fsquotamgmt.PNF	mmc.exe
File created	C:\Windows\INF\c_fscopyprotection.PNF	mmc.exe
File created	C:\Windows\INF\c_camera.PNF	mmc.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\desktop	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\microsoft sql server	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\onenote	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\onenote	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\office	[email protected]
File created	C:\Windows\INF\c_diskdrive.PNF	mmc.exe
File created	C:\Windows\INF\miradisp.PNF	mmc.exe
File created	C:\Windows\INF\c_fsundelete.PNF	mmc.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\bitcoin	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\localservice\documents	[email protected]
File created	C:\Windows\INF\c_smrvolume.PNF	mmc.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\bitcoin	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\microsoft sql server	[email protected]

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 18 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NOTEPAD.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mmc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	[email protected]

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3900	cmd.exe
5376	PING.EXE

Checks SCSI registry key(s) 3 TTPs 23 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	mmc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	mmc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	mmc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	mmc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A	mmc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	mmc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	mmc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\	mmc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	mmc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	mmc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	mmc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\	mmc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	mmc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	mmc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	mmc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	mmc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	mmc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A	mmc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	mmc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	mmc.exe

Enumerates system info in registry 2 TTPs 15 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
4356	taskkill.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133671622073265338"	chrome.exe

Modifies registry class 38 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	notepad.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1 = 560031000000000002598f66102057696e646f777300400009000400efbe874f774803598d652e00000000060000000001000000000000000000000000000000193a4600570069006e0064006f0077007300000016000000	notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	notepad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	notepad.exe
Key created	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings	[email protected]
Key created	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings	notepad.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	notepad.exe
Key created	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	notepad.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1\0\MRUListEx = ffffffff	notepad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\SniffedFolderType = "Generic"	notepad.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202	notepad.exe
Key created	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1	notepad.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1\0 = 5a0031000000000003599464100053797374656d33320000420009000400efbe874f7748035994642e000000b90c0000000001000000000000000000000000000000e21e7200530079007300740065006d0033003200000018000000	notepad.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1\MRUListEx = 00000000ffffffff	notepad.exe
Key created	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell	notepad.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	notepad.exe
Key created	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	notepad.exe
Key created	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	notepad.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202020202	notepad.exe
Key created	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6	notepad.exe
Key created	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings	[email protected]
Key created	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	notepad.exe
Key created	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg	notepad.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	notepad.exe
Key created	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1\0\NodeSlot = "6"	notepad.exe
Key created	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	notepad.exe
Key created	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	notepad.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 0100000000000000ffffffff	notepad.exe
Key created	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1\0	notepad.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
4976	NOTEPAD.EXE

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
5376	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2848	chrome.exe
2848	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
2332	chrome.exe
1824	[email protected]
1824	[email protected]
4500	[email protected]
4500	[email protected]
4524	[email protected]
4524	[email protected]
1824	[email protected]
1824	[email protected]
4524	[email protected]
4500	[email protected]
4524	[email protected]
4500	[email protected]
4680	[email protected]
4680	[email protected]
1532	[email protected]
1532	[email protected]
1532	[email protected]
1532	[email protected]
4680	[email protected]
4680	[email protected]
4500	[email protected]
4500	[email protected]
4524	[email protected]
4524	[email protected]
1824	[email protected]
1824	[email protected]
4500	[email protected]
4500	[email protected]
4680	[email protected]
4680	[email protected]
1532	[email protected]
1532	[email protected]
4680	[email protected]
4680	[email protected]
1532	[email protected]
4500	[email protected]
1532	[email protected]
4500	[email protected]
1824	[email protected]
1824	[email protected]
4524	[email protected]
4524	[email protected]
4680	[email protected]
4500	[email protected]
4500	[email protected]
4680	[email protected]
4680	[email protected]
4500	[email protected]
4680	[email protected]
4500	[email protected]
4524	[email protected]
4524	[email protected]
1532	[email protected]
1532	[email protected]
1824	[email protected]
1824	[email protected]
1532	[email protected]
4524	[email protected]

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
6064	mmc.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 32 IoCs

pid	Process
2848	chrome.exe
2848	chrome.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
5276	msedge.exe
5276	msedge.exe
5276	msedge.exe
5276	msedge.exe
5276	msedge.exe
5276	msedge.exe
5276	msedge.exe
5276	msedge.exe
5276	msedge.exe
5276	msedge.exe
5276	msedge.exe
5276	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2848	chrome.exe
Token: SeCreatePagefilePrivilege	2848	chrome.exe
Token: SeShutdownPrivilege	2848	chrome.exe
Token: SeCreatePagefilePrivilege	2848	chrome.exe
Token: SeShutdownPrivilege	2848	chrome.exe
Token: SeCreatePagefilePrivilege	2848	chrome.exe
Token: SeShutdownPrivilege	2848	chrome.exe
Token: SeCreatePagefilePrivilege	2848	chrome.exe
Token: SeShutdownPrivilege	2848	chrome.exe
Token: SeCreatePagefilePrivilege	2848	chrome.exe
Token: SeShutdownPrivilege	2848	chrome.exe
Token: SeCreatePagefilePrivilege	2848	chrome.exe
Token: SeShutdownPrivilege	2848	chrome.exe
Token: SeCreatePagefilePrivilege	2848	chrome.exe
Token: SeShutdownPrivilege	2848	chrome.exe
Token: SeCreatePagefilePrivilege	2848	chrome.exe
Token: SeShutdownPrivilege	2848	chrome.exe
Token: SeCreatePagefilePrivilege	2848	chrome.exe
Token: SeShutdownPrivilege	2848	chrome.exe
Token: SeCreatePagefilePrivilege	2848	chrome.exe
Token: SeShutdownPrivilege	2848	chrome.exe
Token: SeCreatePagefilePrivilege	2848	chrome.exe
Token: SeShutdownPrivilege	2848	chrome.exe
Token: SeCreatePagefilePrivilege	2848	chrome.exe
Token: SeShutdownPrivilege	2848	chrome.exe
Token: SeCreatePagefilePrivilege	2848	chrome.exe
Token: SeShutdownPrivilege	2848	chrome.exe
Token: SeCreatePagefilePrivilege	2848	chrome.exe
Token: SeShutdownPrivilege	2848	chrome.exe
Token: SeCreatePagefilePrivilege	2848	chrome.exe
Token: SeShutdownPrivilege	2848	chrome.exe
Token: SeCreatePagefilePrivilege	2848	chrome.exe
Token: SeShutdownPrivilege	2848	chrome.exe
Token: SeCreatePagefilePrivilege	2848	chrome.exe
Token: SeShutdownPrivilege	2848	chrome.exe
Token: SeCreatePagefilePrivilege	2848	chrome.exe
Token: SeShutdownPrivilege	2848	chrome.exe
Token: SeCreatePagefilePrivilege	2848	chrome.exe
Token: SeShutdownPrivilege	2848	chrome.exe
Token: SeCreatePagefilePrivilege	2848	chrome.exe
Token: SeShutdownPrivilege	2848	chrome.exe
Token: SeCreatePagefilePrivilege	2848	chrome.exe
Token: SeShutdownPrivilege	2848	chrome.exe
Token: SeCreatePagefilePrivilege	2848	chrome.exe
Token: SeShutdownPrivilege	2848	chrome.exe
Token: SeCreatePagefilePrivilege	2848	chrome.exe
Token: SeShutdownPrivilege	2848	chrome.exe
Token: SeCreatePagefilePrivilege	2848	chrome.exe
Token: SeShutdownPrivilege	2848	chrome.exe
Token: SeCreatePagefilePrivilege	2848	chrome.exe
Token: SeShutdownPrivilege	2848	chrome.exe
Token: SeCreatePagefilePrivilege	2848	chrome.exe
Token: SeShutdownPrivilege	2848	chrome.exe
Token: SeCreatePagefilePrivilege	2848	chrome.exe
Token: SeShutdownPrivilege	2848	chrome.exe
Token: SeCreatePagefilePrivilege	2848	chrome.exe
Token: SeShutdownPrivilege	2848	chrome.exe
Token: SeCreatePagefilePrivilege	2848	chrome.exe
Token: SeShutdownPrivilege	2848	chrome.exe
Token: SeCreatePagefilePrivilege	2848	chrome.exe
Token: SeShutdownPrivilege	2848	chrome.exe
Token: SeCreatePagefilePrivilege	2848	chrome.exe
Token: SeShutdownPrivilege	2848	chrome.exe
Token: SeCreatePagefilePrivilege	2848	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
3096	7zG.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
3900	7zG.exe
4508	7zG.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
5276	msedge.exe
5276	msedge.exe
5276	msedge.exe
5276	msedge.exe
5276	msedge.exe
5276	msedge.exe
5276	msedge.exe
5276	msedge.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2964	[email protected]
1824	[email protected]
4524	[email protected]
4500	[email protected]
1532	[email protected]
4680	[email protected]
2212	[email protected]
5344	mmc.exe
6064	mmc.exe
6064	mmc.exe
2212	[email protected]
4736	notepad.exe
2212	[email protected]
4524	[email protected]
4500	[email protected]
1532	[email protected]
1824	[email protected]
1532	[email protected]
1824	[email protected]
4524	[email protected]
4500	[email protected]
4500	[email protected]
4524	[email protected]
1824	[email protected]
1532	[email protected]
1532	[email protected]
1824	[email protected]
4500	[email protected]
4524	[email protected]
4524	[email protected]
4500	[email protected]
1532	[email protected]
1824	[email protected]
1532	[email protected]
1824	[email protected]
4500	[email protected]
4524	[email protected]
4500	[email protected]
4524	[email protected]
1824	[email protected]
1532	[email protected]
1532	[email protected]
1824	[email protected]
4524	[email protected]
4500	[email protected]
4500	[email protected]
1824	[email protected]
4524	[email protected]
1532	[email protected]
1532	[email protected]
4524	[email protected]
1824	[email protected]
4500	[email protected]
1532	[email protected]
4500	[email protected]
4524	[email protected]
1824	[email protected]
4500	[email protected]
1824	[email protected]
1532	[email protected]
4524	[email protected]
1824	[email protected]
1532	[email protected]
4500	[email protected]

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2848 wrote to memory of 2468	2848	chrome.exe	82
PID 2848 wrote to memory of 2468	2848	chrome.exe	82
PID 2848 wrote to memory of 4384	2848	chrome.exe	84
PID 2848 wrote to memory of 4384	2848	chrome.exe	84
PID 2848 wrote to memory of 4384	2848	chrome.exe	84
PID 2848 wrote to memory of 4384	2848	chrome.exe	84
PID 2848 wrote to memory of 4384	2848	chrome.exe	84
PID 2848 wrote to memory of 4384	2848	chrome.exe	84
PID 2848 wrote to memory of 4384	2848	chrome.exe	84
PID 2848 wrote to memory of 4384	2848	chrome.exe	84
PID 2848 wrote to memory of 4384	2848	chrome.exe	84
PID 2848 wrote to memory of 4384	2848	chrome.exe	84
PID 2848 wrote to memory of 4384	2848	chrome.exe	84
PID 2848 wrote to memory of 4384	2848	chrome.exe	84
PID 2848 wrote to memory of 4384	2848	chrome.exe	84
PID 2848 wrote to memory of 4384	2848	chrome.exe	84
PID 2848 wrote to memory of 4384	2848	chrome.exe	84
PID 2848 wrote to memory of 4384	2848	chrome.exe	84
PID 2848 wrote to memory of 4384	2848	chrome.exe	84
PID 2848 wrote to memory of 4384	2848	chrome.exe	84
PID 2848 wrote to memory of 4384	2848	chrome.exe	84
PID 2848 wrote to memory of 4384	2848	chrome.exe	84
PID 2848 wrote to memory of 4384	2848	chrome.exe	84
PID 2848 wrote to memory of 4384	2848	chrome.exe	84
PID 2848 wrote to memory of 4384	2848	chrome.exe	84
PID 2848 wrote to memory of 4384	2848	chrome.exe	84
PID 2848 wrote to memory of 4384	2848	chrome.exe	84
PID 2848 wrote to memory of 4384	2848	chrome.exe	84
PID 2848 wrote to memory of 4384	2848	chrome.exe	84
PID 2848 wrote to memory of 4384	2848	chrome.exe	84
PID 2848 wrote to memory of 4384	2848	chrome.exe	84
PID 2848 wrote to memory of 4384	2848	chrome.exe	84
PID 2848 wrote to memory of 3552	2848	chrome.exe	85
PID 2848 wrote to memory of 3552	2848	chrome.exe	85
PID 2848 wrote to memory of 2268	2848	chrome.exe	86
PID 2848 wrote to memory of 2268	2848	chrome.exe	86
PID 2848 wrote to memory of 2268	2848	chrome.exe	86
PID 2848 wrote to memory of 2268	2848	chrome.exe	86
PID 2848 wrote to memory of 2268	2848	chrome.exe	86
PID 2848 wrote to memory of 2268	2848	chrome.exe	86
PID 2848 wrote to memory of 2268	2848	chrome.exe	86
PID 2848 wrote to memory of 2268	2848	chrome.exe	86
PID 2848 wrote to memory of 2268	2848	chrome.exe	86
PID 2848 wrote to memory of 2268	2848	chrome.exe	86
PID 2848 wrote to memory of 2268	2848	chrome.exe	86
PID 2848 wrote to memory of 2268	2848	chrome.exe	86
PID 2848 wrote to memory of 2268	2848	chrome.exe	86
PID 2848 wrote to memory of 2268	2848	chrome.exe	86
PID 2848 wrote to memory of 2268	2848	chrome.exe	86
PID 2848 wrote to memory of 2268	2848	chrome.exe	86
PID 2848 wrote to memory of 2268	2848	chrome.exe	86
PID 2848 wrote to memory of 2268	2848	chrome.exe	86
PID 2848 wrote to memory of 2268	2848	chrome.exe	86
PID 2848 wrote to memory of 2268	2848	chrome.exe	86
PID 2848 wrote to memory of 2268	2848	chrome.exe	86
PID 2848 wrote to memory of 2268	2848	chrome.exe	86
PID 2848 wrote to memory of 2268	2848	chrome.exe	86
PID 2848 wrote to memory of 2268	2848	chrome.exe	86
PID 2848 wrote to memory of 2268	2848	chrome.exe	86
PID 2848 wrote to memory of 2268	2848	chrome.exe	86
PID 2848 wrote to memory of 2268	2848	chrome.exe	86
PID 2848 wrote to memory of 2268	2848	chrome.exe	86
PID 2848 wrote to memory of 2268	2848	chrome.exe	86
PID 2848 wrote to memory of 2268	2848	chrome.exe	86

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/Endermanch
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2848
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffbc755cc40,0x7ffbc755cc4c,0x7ffbc755cc58
  2⤵
  PID:2468
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1908,i,17912593704460638224,4040965231827936627,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=1900 /prefetch:2
  2⤵
  PID:4384
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1720,i,17912593704460638224,4040965231827936627,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2184 /prefetch:3
  2⤵
  PID:3552
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2236,i,17912593704460638224,4040965231827936627,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2208 /prefetch:8
  2⤵
  PID:2268
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3124,i,17912593704460638224,4040965231827936627,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3172 /prefetch:1
  2⤵
  PID:3664
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3132,i,17912593704460638224,4040965231827936627,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:2072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4836,i,17912593704460638224,4040965231827936627,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4848 /prefetch:8
  2⤵
  PID:4812
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5052,i,17912593704460638224,4040965231827936627,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5064 /prefetch:8
  2⤵
  PID:3120
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4668,i,17912593704460638224,4040965231827936627,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4408 /prefetch:8
  2⤵
  PID:804
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=5356,i,17912593704460638224,4040965231827936627,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4504 /prefetch:8
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  PID:2332
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5320,i,17912593704460638224,4040965231827936627,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4628 /prefetch:8
  2⤵
  PID:888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1452,i,17912593704460638224,4040965231827936627,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4628 /prefetch:8
  2⤵
  PID:4180

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:2244

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1172

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1968

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\" -an -ai#7zMap12867:78:7zEvent14873
1⤵
- Suspicious use of FindShellTrayWindow
PID:3096

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\" -an -ai#7zMap31593:70:7zEvent21766
1⤵
- Suspicious use of FindShellTrayWindow
PID:3900

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\" -an -ai#7zMap32545:70:7zEvent7917
1⤵
- Suspicious use of FindShellTrayWindow
PID:4508

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\" -an -ai#7zMap5103:70:7zEvent15734
1⤵
PID:4416

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\" -an -ai#7zMap24135:70:7zEvent5030
1⤵
PID:1172

C:\Users\Admin\AppData\Local\Temp\Temp1_MEMZ.zip\[email protected]
"C:\Users\Admin\AppData\Local\Temp\Temp1_MEMZ.zip\[email protected]"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2964
- C:\Users\Admin\AppData\Local\Temp\Temp1_MEMZ.zip\[email protected]
  "C:\Users\Admin\AppData\Local\Temp\Temp1_MEMZ.zip\[email protected]" /watchdog
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:1824
- C:\Users\Admin\AppData\Local\Temp\Temp1_MEMZ.zip\[email protected]
  "C:\Users\Admin\AppData\Local\Temp\Temp1_MEMZ.zip\[email protected]" /watchdog
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:4524
- C:\Users\Admin\AppData\Local\Temp\Temp1_MEMZ.zip\[email protected]
  "C:\Users\Admin\AppData\Local\Temp\Temp1_MEMZ.zip\[email protected]" /watchdog
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:4500
- C:\Users\Admin\AppData\Local\Temp\Temp1_MEMZ.zip\[email protected]
  "C:\Users\Admin\AppData\Local\Temp\Temp1_MEMZ.zip\[email protected]" /watchdog
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:1532
- C:\Users\Admin\AppData\Local\Temp\Temp1_MEMZ.zip\[email protected]
  "C:\Users\Admin\AppData\Local\Temp\Temp1_MEMZ.zip\[email protected]" /watchdog
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:4680
- C:\Users\Admin\AppData\Local\Temp\Temp1_MEMZ.zip\[email protected]
  "C:\Users\Admin\AppData\Local\Temp\Temp1_MEMZ.zip\[email protected]" /main
  2⤵
  - Writes to the Master Boot Record (MBR)
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:2212
- - C:\Windows\SysWOW64\notepad.exe
    "C:\Windows\System32\notepad.exe" \note.txt
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4972
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=the+memz+are+real
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of SendNotifyMessage
    PID:4516
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ffbcfb746f8,0x7ffbcfb74708,0x7ffbcfb74718
      4⤵
      PID:3048
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,11378784806053638435,16847486656809555663,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2
      4⤵
      PID:4660
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,11378784806053638435,16847486656809555663,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 /prefetch:3
      4⤵
      PID:2324
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2088,11378784806053638435,16847486656809555663,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2696 /prefetch:8
      4⤵
      PID:5000
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,11378784806053638435,16847486656809555663,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
      4⤵
      PID:2564
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,11378784806053638435,16847486656809555663,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
      4⤵
      PID:3200
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,11378784806053638435,16847486656809555663,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5032 /prefetch:1
      4⤵
      PID:748
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,11378784806053638435,16847486656809555663,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4008 /prefetch:1
      4⤵
      PID:1008
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,11378784806053638435,16847486656809555663,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5524 /prefetch:8
      4⤵
      PID:4460
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,11378784806053638435,16847486656809555663,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5524 /prefetch:8
      4⤵
      PID:4744
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,11378784806053638435,16847486656809555663,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5652 /prefetch:1
      4⤵
      PID:3900
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,11378784806053638435,16847486656809555663,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5888 /prefetch:1
      4⤵
      PID:2448
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,11378784806053638435,16847486656809555663,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5904 /prefetch:1
      4⤵
      PID:2784
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,11378784806053638435,16847486656809555663,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6104 /prefetch:1
      4⤵
      PID:3196
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,11378784806053638435,16847486656809555663,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6164 /prefetch:1
      4⤵
      PID:5392
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,11378784806053638435,16847486656809555663,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2660 /prefetch:1
      4⤵
      PID:5436
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=how+to+create+your+own+ransomware
    3⤵
    PID:3224
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffbcfb746f8,0x7ffbcfb74708,0x7ffbcfb74718
      4⤵
      PID:3248
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=how+to+create+your+own+ransomware
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of SendNotifyMessage
    PID:5276
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffbcfb746f8,0x7ffbcfb74708,0x7ffbcfb74718
      4⤵
      PID:5284
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,16620565343923385563,1298764868135335419,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:2
      4⤵
      PID:1508
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,16620565343923385563,1298764868135335419,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2432 /prefetch:3
      4⤵
      PID:2252
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,16620565343923385563,1298764868135335419,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2988 /prefetch:8
      4⤵
      PID:5688
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,16620565343923385563,1298764868135335419,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
      4⤵
      PID:5148
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,16620565343923385563,1298764868135335419,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
      4⤵
      PID:5156
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,16620565343923385563,1298764868135335419,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4348 /prefetch:1
      4⤵
      PID:3820
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,16620565343923385563,1298764868135335419,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3852 /prefetch:1
      4⤵
      PID:4600
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,16620565343923385563,1298764868135335419,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5256 /prefetch:8
      4⤵
      PID:4428
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,16620565343923385563,1298764868135335419,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5256 /prefetch:8
      4⤵
      PID:5740
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,16620565343923385563,1298764868135335419,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4144 /prefetch:1
      4⤵
      PID:5500
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,16620565343923385563,1298764868135335419,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5348 /prefetch:1
      4⤵
      PID:5596
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,16620565343923385563,1298764868135335419,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5708 /prefetch:1
      4⤵
      PID:1796
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,16620565343923385563,1298764868135335419,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5732 /prefetch:1
      4⤵
      PID:3436
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,16620565343923385563,1298764868135335419,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3012 /prefetch:1
      4⤵
      PID:1988
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,16620565343923385563,1298764868135335419,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5648 /prefetch:1
      4⤵
      PID:1656
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,16620565343923385563,1298764868135335419,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1968 /prefetch:1
      4⤵
      PID:1104
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,16620565343923385563,1298764868135335419,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5680 /prefetch:1
      4⤵
      PID:1684
- - C:\Windows\SysWOW64\mmc.exe
    "C:\Windows\system32\mmc.exe" "C:\Windows\System32\devmgmt.msc"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:5344
  - - C:\Windows\system32\mmc.exe
      "C:\Windows\System32\devmgmt.msc" "C:\Windows\System32\devmgmt.msc"
      4⤵
      Drops file in System32 directory
      Drops file in Windows directory
      Checks SCSI registry key(s)
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      PID:6064
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=the+memz+are+real
    3⤵
    PID:5216
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x128,0x12c,0x130,0xbc,0x134,0x7ffbcfb746f8,0x7ffbcfb74708,0x7ffbcfb74718
      4⤵
      PID:5948
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=is+illuminati+real
    3⤵
    PID:5992
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ffbcfb746f8,0x7ffbcfb74708,0x7ffbcfb74718
      4⤵
      PID:6048
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=how+to+send+a+virus+to+my+friend
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    PID:840
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffbcfb746f8,0x7ffbcfb74708,0x7ffbcfb74718
      4⤵
      PID:1552
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2232,17034646964995204428,6919585092698220178,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2240 /prefetch:2
      4⤵
      PID:5660
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2232,17034646964995204428,6919585092698220178,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2392 /prefetch:3
      4⤵
      PID:2132
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2232,17034646964995204428,6919585092698220178,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2916 /prefetch:8
      4⤵
      PID:1016
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,17034646964995204428,6919585092698220178,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:1
      4⤵
      PID:1216
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,17034646964995204428,6919585092698220178,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3404 /prefetch:1
      4⤵
      PID:4804
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,17034646964995204428,6919585092698220178,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4588 /prefetch:1
      4⤵
      PID:5296
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,17034646964995204428,6919585092698220178,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4084 /prefetch:1
      4⤵
      PID:3480
- - C:\Windows\SysWOW64\notepad.exe
    "C:\Windows\System32\notepad.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of SetWindowsHookEx
    PID:4736
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=internet+explorer+is+the+best+browser
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    PID:1888
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffbcfb746f8,0x7ffbcfb74708,0x7ffbcfb74718
      4⤵
      PID:3820
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,12486244242954106812,7643651618824734316,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
      4⤵
      PID:6024
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,12486244242954106812,7643651618824734316,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 /prefetch:3
      4⤵
      PID:1216
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,12486244242954106812,7643651618824734316,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2736 /prefetch:8
      4⤵
      PID:5984
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,12486244242954106812,7643651618824734316,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
      4⤵
      PID:3124
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,12486244242954106812,7643651618824734316,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
      4⤵
      PID:5648
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,12486244242954106812,7643651618824734316,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4916 /prefetch:1
      4⤵
      PID:5536
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,12486244242954106812,7643651618824734316,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5080 /prefetch:1
      4⤵
      PID:5764
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,12486244242954106812,7643651618824734316,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5260 /prefetch:8
      4⤵
      PID:3576
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,12486244242954106812,7643651618824734316,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5260 /prefetch:8
      4⤵
      PID:5132

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1180

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3120

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5128

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5940

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\" -an -ai#7zMap319:78:7zEvent28164
1⤵
PID:5572

C:\Users\Admin\AppData\Local\Temp\Temp1_Cerber 5.zip\[email protected]
"C:\Users\Admin\AppData\Local\Temp\Temp1_Cerber 5.zip\[email protected]"
1⤵
- Drops startup file
- Enumerates connected drives
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:5752
- C:\Windows\SysWOW64\netsh.exe
  C:\Windows\system32\netsh.exe advfirewall set allprofiles state on
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:2828
- C:\Windows\SysWOW64\netsh.exe
  C:\Windows\system32\netsh.exe advfirewall reset
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:2444
- C:\Windows\SysWOW64\mshta.exe
  "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\_R_E_A_D___T_H_I_S___9M1X_.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5204
- C:\Windows\SysWOW64\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\_R_E_A_D___T_H_I_S___QUBVS0_.txt
  2⤵
  - System Location Discovery: System Language Discovery
  - Opens file in notepad (likely ransom note)
  PID:4976
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /d /c taskkill /f /im "E" > NUL & ping -n 1 127.0.0.1 > NUL & del "C" > NUL && exit
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:3900
- - C:\WINDOWS\SysWOW64\taskkill.exe
    taskkill /f /im "E"
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:4356
- - C:\WINDOWS\SysWOW64\PING.EXE
    ping -n 1 127.0.0.1
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:5376

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x518 0x428
1⤵
PID:6044

C:\Windows\SysWOW64\werfault.exe
werfault.exe /h /shared Global\238834de92af43868c4c5c60a182c6c6 /t 5200 /p 5204
1⤵
PID:3720

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:6112

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5924

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5500

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5936

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
PID:2552

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Browser Information Discovery

T1217

Network Service Discovery

T1046

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\3d89a242-4f65-47ae-9b30-5a86aa70fb6d.tmp

Filesize
99KB

MD5
a22d52c7d5517f03a9caf4e48c971c0f

SHA1
8ed1b5e3097910deb1ee537687aea9ebf069a128

SHA256
bdb832d9233177366149fd8350acf9f7dba971735a4685ec7e02e5ef755cff3d

SHA512
292363c21ce5b3675dec4b30dac9dde922878e868570427bf32b8dedf29406c74a62c2b1f6e83c369bdff303ba582bffa6eba8c37fa8b388e77600552dacd6f0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\29dc2c29-1324-420b-940d-c0bb90a78a3d.tmp

Filesize
8KB

MD5
85a7f09eb9c870c3bef25c0637e767a1

SHA1
5b5405e404b28c494a5124919f862257175cd64d

SHA256
0421288c2fd9440e932a95440d7c64c4c2fba81ff19673cc1fcfb438a14e8299

SHA512
a60b89b458b93c06661d8bc3c16f0e6c0a34562dd73f965b845fbaef23b412fb2f81fdbe7302e4608483431b60eef3b4a7cacfb801aadfe46d1e57035e638ea8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000011

Filesize
18KB

MD5
2e23d6e099f830cf0b14356b3c3443ce

SHA1
027db4ff48118566db039d6b5f574a8ac73002bc

SHA256
7238196a5bf79e1b83cacb9ed4a82bf40b32cd789c30ef790e4eac0bbf438885

SHA512
165b1de091bfe0dd9deff0f8a3968268113d95edc9fd7a8081b525e0910f4442cfb3b4f5ac58ecfa41991d9dcabe5aa8b69f7f1c77e202cd17dd774931662717

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000025

Filesize
106KB

MD5
99f7b59bb69d6870454d0e3b02b058fc

SHA1
e8a23b7f7d941b128e378895861c79d501b2e5d1

SHA256
9d0dbc4343e9201276b332eb7a0de1c3efd103f86547080a5e6162ffc5f21e0c

SHA512
16bce0bba157c0b45b28a90375075739ef702a3f2709708a4adf4e6af99ee343cc2b25d752968b6053cbf5317dc30fbd6713bdae825de58d9f06bd2192ef92db

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
9f349b2f8983065024270de951c02fab

SHA1
5e8e06e023f452b03f25085f4f779688656bdcc3

SHA256
73336ca19ea40817da4fd3d306e7e6e43642366622fbc6f8d4f00ba6e1a0c886

SHA512
c41b63ed1985b7b9009b6109ba48d06f6450364be8c726c0565c673c3b8b3b29c5ae4f7d7fa692c47cf83fecf780f5fe6e8cd527be8971ac828a228be23a7d83

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
46e69c200a76e66a124c01443927ef4f

SHA1
865429117cfb4663aeedb9ee48d9d916734ce19f

SHA256
13df0a74c963a8a40242ffed085bc9c795bf244ce76c026537c4ffa578b1e8b2

SHA512
bdcd1fe5c8e13990727f11ea1ab2444f7d0b823e548eaf4c88fb1dc5677a17dac381c484c9cf4f813884ea5f4d80bfde09719352ceec394077376973fa93b3d4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
2ad3db830297325883709f21fdf5da86

SHA1
0b546d2a6b2605e5f6d0b0ff1c34878491806c8e

SHA256
bba75e849ffbb24f5426b62a31418a5044f3aa097e39008cfcee8a0ef0b78b5b

SHA512
fe48f9e249dd20532f78698675ef34ccaaa68ae3b6cf1b9341b5e89e87f8eb2dbaa15ce17122aed84543a461d5d6c519d19dcea4c97e3fdc0f8059bc8e707c08

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
fc05bf7b239dceebb537fbd2ec1e0c99

SHA1
565a7bbc4123b81df009bd06dc6634a2644a0158

SHA256
16812d99f72626af9d46ae234ddd85b7ae672067e4ad6f000499d23b59af1fb8

SHA512
7e393b40d4ef81e97297b99f2c08001166a8fe6b70e25c62842afeb68ae2c033e9e0fa6cbd0b4de18c9a6efde9c79ff4c51be81baa9ce2971907c8b1339d82a1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
dcced72bc14c527cb227f6038541e5b6

SHA1
7999431160842699fa1bca3210164b9ff84cffa1

SHA256
a28e22ac88aeccf41fd82838849c9e6603e9df30e20a38d0ed7ce17dc04d3eb0

SHA512
28f05ea1e24d6ce203663ba10d541d73dadfce265a6a55b7dc9f6371ce5b8ec4e91da9f707b20de7704bc9a7cbf602607ab9322c3d2fd52727826dc84c1ef75e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
ea2375d265a9fa9b8290d279bee1cb5a

SHA1
ab20e672cd3962ab03efdfb98298027c431700c5

SHA256
77e8837cc5ace155f8c12897703c514efe0c435d3652da4fce6f32a321334e81

SHA512
ea54f6cdd8a0c7065f791b397bcd8b158581eb84bf8dff57968737f874a1a5cef0d4d2ec50a694dbd953b95301e9f0b1a252b9df17ddcffec50f69d7f78ff1b2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
1002744fb59d058a7b1f19ce8ce8006c

SHA1
13b7695fb137f866eba1b36933eb75bc7bc0a884

SHA256
b5244f254a3b5966d65962a9d9256bbeed06edd74df1412962f6608539e37993

SHA512
d51283c562711fcec06ba0e641df61810cff2ecce40b8165b7e678f3f5a195ac9210d0f6b018b13487068f7bc4c69cdb564095d6860df2ef0c0ed6b10599aae9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
0b51646171af07c2eacaa61df77076db

SHA1
bd7d8684711b22273814c977f1140cf26fd05647

SHA256
d6f2adeb1249efc092cbdae65190b0fd3195eb4ff02a28ede38d414b6c6bc83a

SHA512
0ae236017967687ff1f60aeb019a5473ab9e0ba8a3b650d6ac4d7f03163fa4cc91828775584a7e1547042cd1be4af2db416c7ff32628d15801867af0d0700df7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
784a4589a8dcf99a2abaa386bc8b419d

SHA1
a03810dbefec0ca91ee19bdf9a586980081044c6

SHA256
fa5963c8723e00ee517640e810c1539656af01a2beb147cd09398dd290092824

SHA512
572f6eb2d26e5322c81afb907d4d1c4c6b7022d304305e653e3e218b801a58e1603263b31f37552584f66d7d82dc4f292837468b29d315b11d638968e2d76c4e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
774d979bd701e9c363a4858864cc3c12

SHA1
3eeb61f7e57037d02bb0d631c08a1936d46a9fab

SHA256
cd7e05c32fee2abc325691f09fef0934f9bc6477afb1d7a3f7cd247b85eec6e1

SHA512
ff546b786a94c31395488e876a6af2f14944365fc267e1981aa0503f63de8ce83e9cb4c0e3124eb4226be0dc58a06b1614a4a37f3bab4ac5b16fbab0ad57a7f7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
eb61f002be210d7ab1221381f7f84248

SHA1
18c2fbee838514d4fdd2e5deae69d746b11e9469

SHA256
c1508f72034eb96c388f6aa62a2ba60a9a6a92fdccaaa175e1dc718028fee8a5

SHA512
0ee1d5d83ecab4469fd8c3820cacbbe3484739d3e2fa3ea2b1bfdbd09c7b1a5e8d5a9df8e590e26079e4102ae92b1319a9e43d3169c77a9e7da2f2c809c64f2c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
f602ffa0fa91ebb1368aa4e4f23abc7d

SHA1
c699c7919822eb90ded627a7a14dc92733cd4a48

SHA256
f17808a44b455ed737fedef48e00403f74dc37a91c7037213c274377289542e0

SHA512
691bcf01870d94f18bab4367aca4e2c569710fce5aa99c58e876edb64c7363c47a4d5c392fa5092976e53a61b173daaf0615b10ddaa7bcb68a137d5854c5e0b7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
055ff9e5b0153a25c32fabb13406867e

SHA1
f5e296cdfb5e110c870a09bca9fac5970946e0f5

SHA256
28bbb1ea44507ba94cfaef19812f11f9df5144311d61405ee3d9c20c65581895

SHA512
ee65eb32aed4c4948af0ca2b6c4ab246f20153ddb8c8c4bf6d2df1549e660e2e68701a6bb8f8dd061858c190f32a1dd8c9ab470b90ea47de57a922c31ec1f7ce

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
e5a0ee789d095542cc49495c57b0da50

SHA1
42d65ecab2e7b9f0c77d2581c9398ed82c729ee7

SHA256
8e9259c4fa3252928627127dd9b9821db78c1b16b9aeb4ab519d54df472a3980

SHA512
59119a96e1067a17eb47dbd392e314a8553ada008bd6f01726649fed93ffd9ab58779a6c4e9dcc4e4c1fa18653ced3d9dff261275a597ce26ce7c5490aea8820

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
be1afd9696dab524ef3892d1e3f66a6f

SHA1
f8454e1591637e8bd40c10c2d6ce445e32dfc56e

SHA256
559c94febff8b65dcec3f55d7c2fa5de817c99ac7eb89536ffa3a1e7f782578e

SHA512
19aa255db6f43fdfeaf3d2f1f488085a3a2a4ca63860f935e1a9610f78d5bba011dc6d7f4fd0bb18f1f493fbe4f3de049668c902c6ce58e792fa0f104313cb37

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
c38e40bb41f27f73b52b68a57ca83dcc

SHA1
f857dc9167f7ffc2ae526e9d8e6a1934b29e856a

SHA256
878d023a085702fcc744b25b25be2def0c52065dee863aadd6fe759fad23ad2a

SHA512
1ef9e5b3a39a694ccda1087c98d95ba35f9b0d08a80f4677f245ea436908e5b0d497667851db8c320437c8e55c60eea486c14d91919de9d4539055f77c7f89e3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
b74a9c5736fb4303de3a30b5210a40d7

SHA1
0bdf58d0edd128ec77941d7d74acd49cb63a448b

SHA256
f32f82f20854aca4efa8a223a6246e7b447bcd40000c23f0579461525f0871d6

SHA512
410e73f5effc1aa095aa4a443dc5d9395fba1b8e85b6c5b3acfacac5cbcef35cbe645eb83a45c99db92d63101a3da2725986a2d2553aa96a7d82b6e1fa00b8da

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
273e1cdc2f81eb9b5ac870a330be0bba

SHA1
f291d3537468954a828f78ec5dd4a20332368bdb

SHA256
5f49b7910ae6a8aec31b7f701eac48522dd12001b8085c76eab2403b27da7ef1

SHA512
b016f0e37e014959f7ccbee64718cc218b93282aea8d6f11c042b953c75f6f457c5373605af4b347bf4646fbc19e7461f175066e4a1da24e876ae7d3a3e9f37d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
fd13993fb3e4397095d810e60a3e95e9

SHA1
22501c14830b72fcc57c19a464069b8e4d0dc259

SHA256
7e8332f6dd3d214b1a5ad24db881ecc20d0e4908d07b2aaab5a01599cd4bdc62

SHA512
c4a9b52b2f494df7461f73a47d3edc5382588de9f706d7c4eebaadf30c99168f5b1261fd97f2165bcbe5774b043f0308bf560a2fa09f82bb3be4d760a8d77319

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
a037605fa97b3a8e73eeeacf10ad31ef

SHA1
49299ccf83f5476b37122a94191c8bc9ef5033a7

SHA256
6f2ffd485a660922fa2f7a44ab902d217fca32bbe15695a264423ad7e5187bc3

SHA512
2e4d0274acdf2f95e6a1754658d4397bf10f05e48f91cc5670fda3e8c18ffd44f4e8c4c381cad855559f8897b87880dfb02c0b855faf8fa1c7614adb03594af3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
3b28e2e5c7d65f8d12c5cebd7283e797

SHA1
ec38c882fd21c06e44a7437d61c9d50dca69d32f

SHA256
cc56f27c279fd8d5cc4c2ecf406baf42be389bc633b51c7f0d22c60e640142ad

SHA512
39aa935c748c83f3f676fd576cad86a755ce9f32b1dbd0f9fae74e444c156b7086101d02e271292216a3dacd26af504739429f8569dc4df631633ea1c4bd28a3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
c155b128da41726ba1d22e03b471b78c

SHA1
f978c2725f98e03fbc45aea2e33652cf95f8ee8e

SHA256
443510af421e287105f1302873cc35cb5736e9766af4c51dedb6cc3acd9c81c5

SHA512
6652ac9edbdbbf5b49f898349e659cc7fb63a3452dba5ddc288d01d6afd0c8a5d94c1dc0765f57d0f767f67656ff1f1f2726bdda5ced38e4ddc1de47bbac93df

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
d0ba739ad36909f39718469427f8d990

SHA1
c18a046b99f70ba91142c92a45db8f124f53dcfc

SHA256
089d046237a6fa48b8e9369ab1400651b01798b9ca9bc314160c62cc7933d738

SHA512
7cdd6ca973698af2b5c4f9cc23f15855fcf00874a7c6d00dbe674aa9043fff0bae90bc31cb55c0155bcc5d49d750983b593972474ee7555646fdda88eb8c8b97

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
dea818fcd5920fc35fe4cfec40e37026

SHA1
7b4e6a4ff6228cf7ff2710eac512bc594e994154

SHA256
26a424bd6c186b6b36a8c941a9a3135e31664fcdf78f26357dc550c8f88011dd

SHA512
4845b1c76f36e7a0b5b122d6c57286548d102202599b9936e271d8c7981d75c6169b12c0255b895ca37a1c3896a0b115e7326c19915ff546c3608862770a45a3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
127971b4fd4e31051f39bdf91483a87b

SHA1
3ed0dbd51a361fac40de0f739f84352ed402af3b

SHA256
9e7bf49e436c252711ebc4c093d925f0d4fb462bc7ac6482cfc51f5578df5020

SHA512
fcc52817dd8079bbb5fcde60ecc9dd17f72f81a4679061f0590cf4956162270b729eaf5b90b0600a1ee918efec633d968558814f5aaea22894046cebfa6639d5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
37944cb8a51f9e8dcb288b4ebd30ed47

SHA1
2a5c3849972d1475a2245ccb5bd613e01e1ec0d5

SHA256
d4d919f7dafba8b06d69c9235cda0c862d40ccd8e149d24edc88a54aa7ceb4f8

SHA512
50a508e507defffdca6e99a2bee90a9fc5a93d9f3a06fd03c5c20444495f6aad26957d5c36efb6e6c0fb1b6417677fe55b3ff15b4fe7de305ca81a3a3c94426f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
eb6a9a27d298e28aa7bd2465fd54e82d

SHA1
2ffe8efdf64573d470050a832b270d8b82e274c3

SHA256
2fd351a4d2e2d1a7ae12a09d9680f601a5769b03fa6ce8a8e6814b3014d0c3ac

SHA512
0d4ea97e77f3af08ce518388a23101871e7c87b62deb443bd0016877df9ad28e663e48bf561d24245e20cf1b1b3741d528972f3fd54852982f125633db3cf50b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
7b32f34f4af06af7364ad0f513283cf8

SHA1
fda494fc3b725a0b1af89299ce5f75ec85f0b3d4

SHA256
b4431956fdda4ca1e8b0695a168bbc31e77bfb2a307787e9a2ec65eeaebe6204

SHA512
b6d6bf7d7728ed11f4b944319669604b5f804d9aca83779f7eae6d93934b6ebb393c24e4caa0e580ba7045ca4e29179a657d98bedb60fc0165478df72c393f51

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
88b1d833e03512ecf87f9e76ddb6dc8b

SHA1
56d706eb339e45391ed0c0367f6a94a453654759

SHA256
ed469cc7a02f443768bde1f63667b4ab9755146f53e159c2c507d32dade50388

SHA512
0febd1e29e0540beec543c12a0452d1b365b19c4dad9539c2af11cfd97654805f48699392cb2817df8e36e337d6282af57d7011822406aea2e93456706db49d3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
7009a2236c877e51f9ffc0f386ebbf4d

SHA1
4615d31eb7ea46cc9edecdd9ca7f47501096ad27

SHA256
9ae12c69d22011436ecc9e416c6d9c3c056e1b2c05548d7fb3920f4a0dc8397a

SHA512
9cb6f8d84dfcd5912c97de636327b19e1baf9829fb2842c5cae0eafb3e5b79ca18d7b9bfe62cfb296931cce0944eb27db918dd67ed864391b12e2f8e88abeee6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
e3fc5625e52459b33a1214d4d562b97e

SHA1
7864503d25117af5d0d848a4ad18ed5e1b10ad10

SHA256
f8685e93adfde486dc4677034d177d3da225d716532e98b2cc059157362d4f2c

SHA512
8e805f215f8f1a2a9900a8ab5626952e2322ed51f8a821de550fda3bc62093198b8e65d9d4157dda76c44644cdf321b1dfc3e648e309beac94906c056c56794b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
5798c572403e16b39c431269cd10ac81

SHA1
c3f720f6e9e9dd9debd31f017cc2262023aa383c

SHA256
3380c73633f8aa175c467bdd5aaa59d3255ca385e7dc12c93cb2ef91453a5192

SHA512
91d900974574c0d797c927a2d299902712da879cab46068154f952794d45423caf09794bd4183e0d275eb55fd055853ebe1069b5cef2745ce2bed334d9dc2a0c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
9f6d242b4d623e247fa8620175ba19d1

SHA1
3ad4c225332515f36e0db2547a93f4e9811fa4ca

SHA256
d83ce4ecba7fd678d38bb3a166937c41d86475f62b6cbeda17f34d01127170fe

SHA512
fe88fe18c570b2048609163cfbd82e7d2cfe40c41ed62d94a66fd2955b14a533085d7f67485efa33616a19d0adf54146b3051e77339d36c86006e623c6b2eabf

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
2bcb17513bcf87df089603b6afaa068e

SHA1
a3d33279041b0ce5972adfdff25f1f204f1271b8

SHA256
7b50ddcafc984d19f1b7b3e9424846622cfefed72d37dfa43921c3dc02cb3294

SHA512
687db68a8e61df97c05a87bf2b63b9ac10d2917896eb18cc804c5f55d7ba0290eafc247fe54cc7b17de69639122bac38e2db1c3270e4927f7517717806ba3941

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
f1645ba7bd10b2111ba447a4b2db88ca

SHA1
ac17f225f22502f4826003e529668fef726b11b8

SHA256
99e4e0029549ce2e65dc0c2381d191ba462712bfbc7bdcd83a69e9643d39750a

SHA512
19e8038867ab6a744aec8c6ea60584c7084c3a731d1b9a841dbc7de99181d71a48392df293999656f49bbde55ddc3965f80fd26321a7605fb6b83f694a68e0a7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
cd2d72c9dd0a4de047f5f67cceea8d33

SHA1
fd91074ba7c095b644777f737706c3194c064239

SHA256
7fd84b3ece6098cf9b2a71f1fa702110997ca77196a3cdb2c433606389300b87

SHA512
a4570f74ae83d97002422d9edf0956280d63269f0e352243147c0202c4dc0214e672ba6ecfe2f07c7e2f7b5b20800a8e6c35e041b45461fb0c934607f7a0bc7c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
b435e02ac8cfbb47ecc8010bc9dd0fd2

SHA1
af82f7586a9382cf50351cbc57ab9f26acfc7c38

SHA256
8ff6f3720b6dee202f95c5d62e64e53c5af9a6744f237007cee9d45e79e2d268

SHA512
330e3a3df5e6c133240ffa192e5af20852499a5ff46a06bfe5708016fc92cb2d9502f606517b9e4288db7cf948f81813398b0abae52139bb2c8e7af231b0a9dc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
7771b6443aaf540cf7d22300a9344468

SHA1
989f01248021e2e7a17b584a659bb0d4ae7a6b21

SHA256
4bc42aeab1ee372e9fa8dc344f8e859ec92d6c60b8812001434c3afc55024616

SHA512
a6e55f77e5ba9f4a79f5cd7b0aaf664ce3b8928c00ed83d439ae7eb22cc379eb9eca3b6dd570bbf5ba2eb2221aaecbf4499ba6cd5fb21e8ae3daaa3d824b5681

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
41b83740c7a35de66e2ac46eae861b01

SHA1
a910284393946c456d6e65fe2570d875c2be5eb4

SHA256
fae3d63e578e56bf86571f9c32783b80cc996d0f703d0382992c6e89305b1d73

SHA512
7e9ed4c8b26a40447c3d02d76fc1af72adcff59e54f2419110619b69f38db9757c84596ce5d5872cfb8798130b525f2543011bff41232298ec5bc3bccbf8cbb5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
b28d2b95b54c9d8c07c9abd1f33a770c

SHA1
56be759467c43b39fd5ea38e3365dc2001e5d315

SHA256
9b5e4fbb84f539b79364c58046a1bb7fd9dd04186ea685f875ed5ff8da16e5f1

SHA512
794354574709f855911eda91d1caeba854198924b4b5db7b3a1d662674cdad400bf1f37129f39cf0b07d3a7700b6a0c52418d4afa80b41f0817cb064ebc7339b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
5890ec7a2cc6388d689dea0a02b3dc15

SHA1
71124beff7e45bc276f24e4370168e6398e8e2ab

SHA256
a19c0e6c515b9d32d26a16eedb3ef39b920c85da64d436dba235b6035d74d1eb

SHA512
9b84bfc7dfb05c127b2b221a51c0e1865634c4f84bc34c369b2e7536953a348a96ee69e3e151a36fc9dab2cd2f36112a06499abb3c8b41397e69ec6d48f8d83c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
86cd6a41814d37f5477fc450fbf77997

SHA1
099359a371ce74f25354c3dcf19ffa06945f5d5f

SHA256
28d17e9d33ef64b74bf514f2780f734e12b0af652ed71fd10620613c131ea162

SHA512
95f0446765d5ccdb14cf02e608851c46021f742532c8341bf4de2512ea4257f4a5002ef7b579e1d08a289bd9c0f05adcb5af792893345867ea9e1d71b87492db

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
ce9508a9bd70371e4cc8be69e8a921a9

SHA1
a7cdbfc0ea21b873adf5bde89835af453634c7ad

SHA256
079ca8d624a74b7edaaaf35e136b8c722fcc93c1ea5e9ee5532ae62064752074

SHA512
2f1c8d0ae670846212dd01d5c95a921dc32d4ba50b1e3c78ee47c5fb6d39b5c5e7bdd7037f710aa8b461fe8c086659a1ec71a832eeff2e467d65cb70b131e801

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
00371558b87897e3850c5af830ae0aa5

SHA1
13e3e58fdf1a692e90296b8b938a7c8ce415c219

SHA256
99df68d103f5eb32f3a74c5e4e99189264fd683c4d8fbeb34a29637a17bb27e8

SHA512
2acce78a9fb41ef62ea069b362b426918c640e6f48c0f118bdd03d96ad77e76c6804a50b45cb5fd5be600bdc0c61d8696ccf08791d51331df988dc4d94e67f24

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
7bb18729b02bf9c705008dc6c6eb2670

SHA1
cee04330cf2a19833ef2779097b02553392eaa0f

SHA256
b740db1fc4b93fc88a1c70754a17d989deea46c8f212d6edf79dcebef95da57b

SHA512
115062533100f8fd191857adebfdcc36e4515349eac7d7f08bb8c163e05310fd1632fbcdc4fb20b719d0bafbca2284163d7307434ebcebadbdbf5b0a99a57f05

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
b494a79d70c17b6e5572022f6347f2b0

SHA1
e71146eb52706ed3b252627066ea898a9273a4db

SHA256
6ba3f79d7a1e1f6c85a9837655d5485c15cb4963942aa10addbf18fdee77d04f

SHA512
cc11f7efe1f6bd686c0ba65a7720a3071cc6a52590964e6c964103fd5595738eeb77373132f9c6585172c1c8789e02549d257d03d9b707a04a76dd2b8084c12b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
1b02bb6489fd5e41efd8e454cb243534

SHA1
a48db4525be1912b0377ce3c1cbc42f415e05617

SHA256
8d92cd2b2834822ebc6148b81bc40380ae6966139e3840a469da494b53ff8fd8

SHA512
64d612d3a13c632cd2a00532f722adb6fb8013093b2051a09df4bcff042f44d5a6627def7fd33cf4b72fbffe5bae2e782211625266d282100ba763948d2a06e2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
9f675374fe1b494daef897b782e23810

SHA1
b9aabb53df47f735b9e95319a985d2e2fcf0b433

SHA256
d9a39e76b5208cc90ef455a1a2e7e8fa1e3af27c4ef6f5f9736cdee6f6401cc9

SHA512
7825e168f5d8f886866262e3dc99478b163bcaf7babc92e6f09e2e0e1b3f4802f23667e8e56cf1abe2d8d8a886e01c128afd5786a40bee7d445be93a5f8505b7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
7779fb6eaafc77a668076ed0d70ec4d9

SHA1
c3e83fa2065bf293acef935ec68e99bf1e74d0a5

SHA256
2b6f8289a710be94cc4d167bf1206f496ce4df058edd399ff4b2e608dc57c20e

SHA512
c5f7a9f5b0327d746dae30b0807dd898dcf191ddf75b55212073f4d4f7d5c97ed42a4910eeefbc84db157ed6acbcce3a4ec360a8b22c15fe3e888ab3726344f5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
e1aba14ff4f451de27cdffa37fdf0479

SHA1
602466b59053673fb717b36b07a13e9a537bbcce

SHA256
edde583818cc774b0c210c260f3bccf74cd4851a6d309ae050af929216287916

SHA512
fa17051a88efa95e9d198ffe2da2fa9510eca251628c85acd29016a8a654b63024b6f51212b248201d0749ad3b4672c00ace5ffe7d62ab8f8465524f308ed707

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
0032d145a7ba7287eff58b0f898dd4f0

SHA1
dcd5bb2f3cecc6d7363bf9695ac3917ed31c51c4

SHA256
a7c30c90fae032e9e3ded417ad6a1002378d1ecd25df22ede75e85a03d027f8c

SHA512
b650577f3cd3349bf5f8ae42eb45271306b843aed110efd120b733cc562ff7fde28f7e9ed99c5a0de9c30f5f8dc2698bab123f316f661242c0a8d3337231e7dc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
928a319dcfd429c6246fb2bc65b210db

SHA1
f23c1de5f20aaf30093754e98dcca9b22d3652b2

SHA256
64b57ca059f88cc0869892f6a5a650cc71b8bee6925952a2661d193806709f7b

SHA512
3f57f4e488930863490e0524103cb07c3292e9b9ad25aa2e84f451cf0ded4c79fa9a5ccdffd8e0e2e6e3368571c92624bb70f28cb9052b8392a53e27f52a598c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
14dadd832de64e68c4a0b7a5acef7503

SHA1
38be78df979a6452ea57dd3d8ab0c40bcb098ef4

SHA256
4cdc8d31289eaa05b2ca4f6a6d9a2082fc0c5d8271ad5c6540b806a6a7244e37

SHA512
f53640a6aed31ae53fe15abd767fed09ae02dd9d80c2c92096e5407dbed9ae8dfabdf8833a5f10571b5470cb9a88f16577d913f43eb1245b6085f0421bf97d40

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
8b78f9455f24c202262488af7d902892

SHA1
48c36ccf32986ffdd533b0df436e328df95762fb

SHA256
3493ec7d86face698ca2eb19b7e367ac6eade12285aef0633cbdc664788326ca

SHA512
1d65f0d225bca0378f7184123ea333aa4b304f516c40808fc940fb98c05f2e47756742e99b9ab5586fee6d890f325c82e9b8db6434f5e37b4ae78f2f7783851b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
fac5a425be9d955052b37a697d23fbcb

SHA1
7256424d42e2a83c9555a13a9dda5295e5fbbc62

SHA256
cab065669e42de08ed8a595253b1edb1d6a46b1b745244ce22b3c6b3529f09fa

SHA512
8e8e065a9395360c48f8ff474dfb6c8a5b73ed61cd412c2cd7f6deb8b98219231922ba79a9c4782c29b9957b5ee8b499b4b069a083d3111298d7691318f43b8d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
b32df3aae29f7c7cbc92718d7b5c1288

SHA1
d0b850fc5cb24b28b83397e2df3812e15a6d8c6a

SHA256
526b91c9328f770e676c323df622af59c29eec7ff8afde25854e7c0287f818f9

SHA512
e1df5959b7f2ae47d9c5135abae0317e5b5dadc48f4980e08c3f4f68b88f09a33668f4606f4abc828cee2360958f3a9862fbce641b16c7239be9f3156dd2f3dd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
1bd95f67ae7b64a03605bb822fdfd8b0

SHA1
7ed51211d357b4efedd60642893efb02f8e8da37

SHA256
3766d79341eaa58e373aa6dde0e1ace0de00f5b03c063541998fd606fa0c6e1a

SHA512
5d011ef376f7be13be4566c8084e15f93f8b2930287a77f9597b02475af7f0f2112377409814aa1ef44e07bc5f61e680d25c1ca57e9c7a06dc8b80fe4d10edb4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
ba3dcae21eb988a92b227e808b9e970b

SHA1
a1f15c2097e2d2ed93c680cfcdb33d60a8a2373c

SHA256
5571e3e74b641a1990f0d41169194ce1203ca42154a9113baac79cabbb029250

SHA512
c764386ee310252b72bb2772ad8e99157f5e2e24edd20b40aa5510e3112ce6881e2d75b2ae7e7beeb96be372f29687eec3b193c18d9e4878d087b9acf75475f8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
c56833b9b6dc46633d5cf3e25969f419

SHA1
36792ec3689a34d9e3111410b18d56387c0409d7

SHA256
978a84cd5bfdeea3dc06e8f9781af872e12df16c8deb710e0723738ef5503e14

SHA512
4dc6b0046decd322924c51b717469b4fd53480914e7cede2b9c58fa99b37dbce39e991c8d1d282513cb545ea0907421c9488091200783f36989675820c2d8782

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
99KB

MD5
f501e42ea31b8afd92ab81028654f1be

SHA1
0f3ce9a1fb56ebb6de161d5d853e433952051ed9

SHA256
ea21f5ef6ae3b6c4dfc930483f0da65fedfd46de1768428501c8cde528043493

SHA512
dbb7632bf30cde7793257374d3fcc3424bb0cf5de2453181d4e1185bb5538a4f1682c2d9b7372ed72007fd3e68427c4a4bccb43943ab60c127d3898c9b783cd0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
99KB

MD5
1c2d25e3c9a0c2932f8d1fea95eafc4c

SHA1
a776b6a6432576c56b17bf0282f064328ea19264

SHA256
eed72a2cac7650518db76fcff130608b6155bcf1878ef814727953d91a81fdcc

SHA512
1edf8b3cb1f02ca026163a2670e4f577f5afc343cf55cc2a6692b701f8e5b69862e6bcd8e221d67c0495b03390537ccfd05474df485b5b6fd4c3f08b7745da19

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
5aef39fea413bcf8d167591674811275

SHA1
89a7e775cff49908cc535135163a4922e90695a4

SHA256
dffd2f5fef0fe5d6fff79d08c36c39ad6b342aa5ac77d366149178762d9abec2

SHA512
fc8ef46fbd0d5016dfa6217356111bbd1358fad956af8364c1ca82713004fbd083bf78a0ced0ef5843ac78c2fbfc5aee852095b12c12020f818354fc64c33aad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
650105e709f2c514c52bacddbfc1b443

SHA1
33ffdea28e6c6ca5de22119a52d40f0733e48ea1

SHA256
c106a308cc258338f2af33759d01433ab23c03ac7822075fe1848a0a25a7d8e6

SHA512
0c3b7d6f1e5474cbe7d66764fe8da7b7b9e90719fc7271938b687e1d76654e809c1556e1af7be900080dc58fe4e1d557c98e75f1d09effd80c34805f93ecc025

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
dd4f1b25affca3cea5603efff35cb02a

SHA1
32844a9c1aad2c46829eb3f8c15b33bce369d8e4

SHA256
ff40ee4949861ca2493971f16414aaf913cd4225ac59a936c72fef9e8d91a14d

SHA512
18a5ab63941c6654a06612c41a3d61615214925c5bebe617b2d14b0585424cd2593842a8b8f7e140a39069f7c362f04c41d1e3882f035f004b5cdbb02ea5b5b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
02fa8f4bc2096382fe37e5ed473ba302

SHA1
7d0ffaa140268c818ac175f37f3fb5269957fddc

SHA256
53ce1025072efb921f2ade0452e1ce7dc0935131ea9bbf529a9a9149df945dd8

SHA512
a485e1add0fdff100dcd0ceee2e4ccf565cbb1d53cf0aabbc13f44d0b208f39fc1991622b9aede4a1a2e21d1a4c97bc6d36ffe1da45993e48d1f64bd850a6db2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
38f59a47b777f2fc52088e96ffb2baaf

SHA1
267224482588b41a96d813f6d9e9d924867062db

SHA256
13569c5681c71dc42ab57d34879f5a567d7b94afe0e8f6d7c6f6c1314fb0087b

SHA512
4657d13e1bb7cdd7e83f5f2562f5598cca12edf839626ae96da43e943b5550fab46a14b9018f1bec90de88cc714f637605531ccda99deb9e537908ddb826113b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ab8ce148cb7d44f709fb1c460d03e1b0

SHA1
44d15744015155f3e74580c93317e12d2cc0f859

SHA256
014006a90e43ea9a1903b08b843a5aab8ad3823d22e26e5b113fad5f9fa620ff

SHA512
f685423b1eaee18a2a06030b4b2977335f62499c0041c142a92f6e6f846c2b9ce54324b6ae94efbbb303282dcda70e2b1597c748fddc251c0b3122a412c2d7c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\01398187-d246-4e5d-96e6-337f229f970b.tmp

Filesize
7KB

MD5
74bc20a5af72443a0c0696df746196aa

SHA1
ec1d0865e20a7426f104f26998ec806771c761aa

SHA256
ee1f4ed81097eb2cd07de1da67c0349152ff0eecb3802d1cfb19e1289949c661

SHA512
a2758874a9b84dabc7defff875afb3b5e90813fc22e70107e23aade701c8c144358353ed29b0362f0a7777f102963efc13b1c6204e5c4c07fd243cc23a2c891a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\5705cc15-93dc-4ab7-a559-19852877de72.tmp

Filesize
1B

MD5
5058f1af8388633f609cadb75a75dc9d

SHA1
3a52ce780950d4d969792a2559cd519d7ee8c727

SHA256
cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

SHA512
0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_0

Filesize
44KB

MD5
20dbf9fd65131ba461ac6e8bd2124af0

SHA1
74a10eaeb0353acc034780b7e5234335bd8f7598

SHA256
17abe796ea2212d5ec0f90480e58539039974f6c61397eb6024289178ad3fa8e

SHA512
84c8f781847767a9206e3048f67e5c36f02072e249132e825d76af22cd741f444b424ba81baedff3f9e70ffc60c309f2261f2f1caf7916d2004f22d88753d91d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_1

Filesize
264KB

MD5
3be66f824bf147e16c05f782fa4fb4c2

SHA1
9f570752686fe8a6d578a9f4e8f4887a767e6b62

SHA256
0f99bc3d31c8785731271dcdaf745042955e494def4f2c0a37e57e62515f603a

SHA512
3bf71fc4e52c9d8056f739878f5906ceedf42f89ea614c661f9ddf718ae2cca806070ec23fedb67c1b4751400042a0ced4110167bd4b1d87ee1dcd0db3497ed6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
209KB

MD5
3e552d017d45f8fd93b94cfc86f842f2

SHA1
dbeebe83854328e2575ff67259e3fb6704b17a47

SHA256
27d9c4613df7a3c04da0b79c13217aa69992b441acb7e44bf2a7578ca87d97d6

SHA512
e616436f2f15615429c7c5c37de3990c3e86c5e1da7d75a0f524fc458b75d44a5be1a3648a628d63e1cf8aa062e08b538f2f2bc9c6a0b42157beb24f82c571d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
8adcf6a35b73b09a67394af56d19c15a

SHA1
c86ec82b664b1371dcc5fb5f216181096a3c6a1f

SHA256
c464c63f8f8ad9794c3ccf13b3bd1eb4efc0c361043f3002ddda3c616500b12d

SHA512
9132ecf82e80d3403c74a82379de89304fbf712df8638409b0f5aeba3ed66bc8ddbd483d413b9f0a180850081e5120a9368ce125755a5e025c4aaa0faac6bf24

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
259c000f7772800a1766dc941041999a

SHA1
993fd8c349c330082fc9cce30e9e37fa7052e3a5

SHA256
ce75b7bb4d912c05f5e1655adf19a0229c70e33d8599faa1fe325e2b08398bc9

SHA512
86926591ed7c001efc7193d03c6defd7e3a85cd1c423828c197f68f8c8342e0792945fcfe22fca6a0268214c85ba940d027a196a9d48a9d5ce48f4fce93c5462

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
4e01ee37d728245ffd09e2a183a21f41

SHA1
3a7e62590993d61d225556cb0ab19f6d1d924506

SHA256
e78e2f14e5eaa6985d43bd1aba4d30a7fff063239a8f858a43d2321a83f18a20

SHA512
d027379de4076403158a16426d07a3c912f31cea7128411471db3bc97f5ffda8ac9523eac644959627dcaf811454a9854ea9df3da778f208f1b5a2bba0b43b81

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
b23fcfb8601f48e40c57856277509e87

SHA1
7024a288f3f172b3007e81c54f6debd90939e581

SHA256
aee98d81ab4dd296a5226a4cc0baf7b77b216903cb7c726941eefe5a775ad4f5

SHA512
cdf7d09764456bf05f052f3cab35bc9738c22b7c77f043809d89b80e66ef1746740a022c4ca21a23242b22d1afce0882769e9d109618110c0767d72a03222c30

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
d920705923d55c97d9a693fed7d913d0

SHA1
828448b901a8641002b4e784e01d6643d518bc0e

SHA256
e2a2f44251be96608f8a356f7888158d5b37900373f563cedb2c2ae53c430866

SHA512
0d699206737e57e405589e69f0285e519e3a5a1d205d6f8263d3c87c9ccaedaf5d1629b6d43a5497235516f9cad36d520b2eeea534c5b4f47f7df092554c71a0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
ec754a86ad49301d441fe261674583db

SHA1
4b0ec9f137705c5e84b2ccd3aa1299740c8e2b6a

SHA256
aa7ab6268e0c7b825b553638452a81f4181254f8c0288de6b8522a5b7372a9d5

SHA512
98eebf5f027d3c1dca52ecee6641cd59e748777a7bd6a652fe10d068cbb3d3e4a003a2940ccd07de844ce3515107a9656c2d35333557b354b80a5d61563830f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies

Filesize
20KB

MD5
ddf49fd9feb161ef7750bcb9b0545b20

SHA1
24d1bbfa8899278a0363d4f58138d2adc212ee51

SHA256
93760efcfbaa844b0c33616297e7e7b28bda199a0459c20d70974bba98281887

SHA512
4afab3fe2390bd5ec769657cde74a2af11db2b67d8684641b8c6b9abe4bd54487692c0bb09704d1c339684a4c0be96f36191c57466844c23a0a2de13997a2abe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons

Filesize
20KB

MD5
bc7f06144f164cca545a307de8439149

SHA1
21504e23c3c8af045274648655014785f498d94c

SHA256
ca55cb481f49383d87f39602ab66475af2c952fb3dafb26687d165515212f5ac

SHA512
2d695e389f3e156658afc15207d1b905faa6b0396ff8f2511f9743df75a352630eed70ebfdf6f36c1ce737acef823bca04931a3d0a5c8ae01c36b09d88d2cb0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
c704f24cd7450944df4d7af05592995b

SHA1
90c2875df213276371a58c38085e98e3c3f66e4f

SHA256
78ddd8c02d2fa1260e9779559967dbd16a60998d3c59317cd1d2b7665b91e771

SHA512
aa591da803fb3b58b35f0fac056655d3482aeca2ae59244a9d2b1c46a5f654fca8b5edca736f291716ec5c457db68a45f522f1693b86bedfb8235dc466a702c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History

Filesize
124KB

MD5
be84c1c8ffcc0ff1ef8c5fc36167bad2

SHA1
779507b3f5ce3dd4eb4ea4afd336c2bcdeb493fd

SHA256
93dee5e792cfe0f8d52ce55cc42603b5d22cc28440dcaf9de047b1c3963bd0db

SHA512
fcb7da44f328d9a3227d888eafd668bfa8dace7c87ef6db8b2af854542ee7e5948642cce44916f9cc0e99920089945c05baef6a1c020c8a58dff49bb86ae2778

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History Provider Cache

Filesize
6B

MD5
a9851aa4c3c8af2d1bd8834201b2ba51

SHA1
fa95986f7ebfac4aab3b261d3ed0a21b142e91fc

SHA256
e708be5e34097c8b4b6ecb50ead7705843d0dc4b0779b95ef57073d80f36c191

SHA512
41a1b4d650ff55b164f3db02c8440f044c4ec31d8ddbbbf56195d4e27473c6b1379dfad3581e16429650e2364791f5c19aae723efc11986bb986ef262538b818

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log

Filesize
546B

MD5
f3b36d0013fe068d769b763bffdd8a2a

SHA1
8465f1ac2028407c02d20c714cea987874efeec9

SHA256
c97f859e9ba692ea87b6680e78ea978e12b5e4e304b1041efb26ed4ba40b5cfc

SHA512
834daab0334fa0203a5bcdef3a042cfc317576280ee571fa9e240391d441f8f2c30f9df40b0ece8f77ce0dd0099b6fe1775efeedfdcd49bf3d899796d73e279c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Filesize
331B

MD5
47969e83961694614aba8a99518c3e14

SHA1
9430a914322403873c5a43ff40319e7c5498c22a

SHA256
51c8ec18df2edc4021930ca26a92b4982dd6a80824e7b7e19b93bad25770e9b7

SHA512
b09fb9f0e096cd1945b4e18187757c354eb8238fceacf9f21eb31c849421de942a77fbb249f118ee713de744a03ce38a003ce94c307f23ac20dfe3755909be90

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
940B

MD5
4aea1db01e1c7a81f896b0a1bb233b8b

SHA1
23a6570650c3c68ec0319d3f861af336692ba0c9

SHA256
e2c4abc149c925cc365e0056433c3cee413a9f0cbe188c7f138c8bf16f055042

SHA512
3bbe4fab76aae9f9f16c66fb5cecf9adcedeeab1b10a97b2ddd0de1d25153fa7a2b5338b8b16a21d92887cd85121fa4dc4b2c5457715b520a50786e5a31ced5a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
846B

MD5
b93df0494a8ab5b8480a60f7e00c1245

SHA1
f77606e7be44e079159c380e5e495847f0b53e3e

SHA256
c07e61578e92406cdef42fc5d40fd989a912c1abbb7d0d55871876a480f503ea

SHA512
d83a5316dd088337bfc7a0dffd4dd493f489f538694100377f9e323ef3e0af18a5df06cb985d845a7fe8c8e9ebc59c3e964f2a479885f3e4a57cc5e17f4f0f46

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
940B

MD5
a5e5a33e2a99adf9f8795251512ac1c6

SHA1
e4d84c58fcf982544879e94a21876c3f7289786b

SHA256
a6ef6face91d01b860e95b29270d26503bb0b7d20d5f8d191a77e214cc309f1d

SHA512
873008fae64f57f33d5856a1159e6d6f37dce7199a13213ec3f867aec73cbbd071bca07971dfeda27d9ab60da4e1f0991c4a56deb66a659e30f3ded814ed52bf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
940B

MD5
2539a833500184f3450f8bf736a40a02

SHA1
965796f32536505df66efe6e6f71b60d02d82b0b

SHA256
6185b7c5925b4347d7880d38e3cc31371242da0b6a4551f016399cbb48504d87

SHA512
1229eff7ed7d8286f01b500621b60b5fd32195e94c2e1ffff17d9b548d78744e1d8a11cf8f16cc45bde375453f098844d96abb2d9af1006e63d87455c68a864e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
24ba61992025a88007e570de38282acd

SHA1
d76331d2432c8548dc7c1ae650a7974f17988d27

SHA256
b6a7e6f68e40a45505b16278b5bdd42e26e5cbd17dc75e3ae63ba05dd7a42203

SHA512
e1a30984a24334295896936e8aa362ffca549a44acca226d5a4c8c4fa8053d3bbf67f1b55f487bcb7b162902b1dd731dd6dcf3af160a93c33137195ab344cca5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e52a46bcdb7600864696113b672b14ac

SHA1
4098efbf83657fced0c546befa9adf2c8d6e8906

SHA256
d7efb52fc4519e25e20934b1850eb444894f5964d1267365c17a72ddb20514f1

SHA512
248daddfa155748072bdcfb519d8c0ccb2952798a4ac362c09e23d372b5f97725b64335f34e715f5f9f69f51551e133ad02a0a5e976df423b771a3d831f2f5b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
b2b3c2d81cb425ef08d0c6217f11d34e

SHA1
5d8171fa5cfd9e5ab7935a30a32bfdf7baa82724

SHA256
11560d78c182c9d40757ce386f95c23e2d506258e6554abc1f81c03a5b87185a

SHA512
f6969bf42e711c0775c7fc3c1f5fc984defe462db7787e84a5c8b3136e3e653ea19f969649a8f147b8f6d5fadd980b138d1b68fd66111a0b982eb4ec4789126f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7dee83876a0c69d36294be0b57803998

SHA1
e1f1ae54ee5abb461a3864c7f91a32b0ec5be3da

SHA256
934c15641bb4757a7ec5ad28dd46071c9699fd22ba0d24d400a32be6b3495750

SHA512
24e49ce09f7cb78204714049d9375a5afbb6cee40ee98461b100a05f3b66f8344b9cb1c4b6f4f44b3c44c10ab0bfe25a9c6dd2dccb21f7598cfadf5176f6fa00

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
43ef03d4f4e076abdc88f21ed2273ee4

SHA1
0ffef7a78ae4ef51cc1006e7b5fbdcbda6441dbe

SHA256
ce6b7dead5a6cc825d2478283bb02b312ca7280b4dbbf38e7c4dea094953fe5a

SHA512
c5caaad855bcfc6238b1c046f3dbc0bbab59baec45bbab7912e8f4d41158e4946a94c7a320ad86548a005bed0a7ae5a4c282550ef05cf098c5c0c10074304e1c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
31cc79102d9bd755f7d696bcf1021647

SHA1
17b59b388745ed7b705320de54fca637d811bbfe

SHA256
c67d092f901bc5f2f26adcbd4bd707c704230d47e79d865e7007cda3e535f930

SHA512
96a86b82e62e0d1f1a9805465fd9644d897cac615d088bf1af71504dad7ec75e5ddec11dd127e65bdbb46e69d826e7f0f313738bae18476a83ea0c37f589dd33

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ddbfcba70ab6d8e0d91016d3fd496f29

SHA1
6817b1c7aec02123ca95eb49311f00d386594d9f

SHA256
d8d511430a14a3b1146c3112d468207cdd510f950cc1d43a44da7710cba7d7d0

SHA512
3997c3ef2a5b80afeaeb2c58cf643a26ceea624773f5de53fd28519fae738ef218adc22f8f0def74c6045f14d05febf43e74aa7f1aaebeb2202c7dd2dae60217

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
fc981d10559566e44fb085a358ed7df2

SHA1
40273734dbfa6db4eed494cdf291050a4b5a66c7

SHA256
1da416c26bb179e1be7f00302a9b76637de56da2986c0391b9f0b786f4ee63cd

SHA512
13c09a0f5a461f5ddb09ffd5b046d5157d15ef880d4a9b0588d7f1d222665c49a901ebf4c8352dd5779d74996336a9a2a8554b4caf52b139ab2deca464a61fec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
93da5d167237cb2d86c8f65f97706659

SHA1
69be3e6fa90171adc61838f65fd36ae48fdffd1c

SHA256
d42cde5ba9f8d2d3accadc90d92c7d3cc0a61f4d93e40d7c24482306f2215be7

SHA512
9810e121447f69bbfbcbd06430c5c4dafffb3a6fbbcebd2479eedef0653edc5c9fb16ee5412e5775195d1db6d143309c5fbbf78a8468d5be6e66c9caf22f4479

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
08c8cb6306fa119d0977aabf7d26a1ed

SHA1
205cf2a4aeefca99639b84b1e10f363ba3e0ffd7

SHA256
df4f81222c95ac47b277fd19799f2dc6e1a77afa6f79d0ed7fae99a2eb2ef1c0

SHA512
ddc438f8b51e7aab8e3f8d6223fd0920b3d9df5a0d9871b64cd07c051607fed32f7ba33370b0e0c418cbdbd61dddc4bf7440b168bbdbf3f19ae6bd738dd28669

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Filesize
1KB

MD5
11d426f6cd438863dc2205fb41c4cc4e

SHA1
e193c505fa8f4a68080e06468d4dcda4721e5b01

SHA256
1a3176ae8525b569223e23847e43d66297b3ed9f9ca50251b47aecd70a9954e9

SHA512
eca504a0b4bb745c95f4aff8b88e7008eb0715c811d7111cd71f0c2ab6fbef39a3591a0c0c656741e251f40cebf17e9f14ee1551b07a3f7c8325d492ed3b8077

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

Filesize
319B

MD5
c68c0d90dc4c65be1ad934928d5c0d5f

SHA1
2fd7d413cfe34a12e89581e6b7a55413946518b1

SHA256
f9d3109fda5a3b4c74e2df6006eb0da25dc20a4ec0d5607c39c3a9564d30f37b

SHA512
ea15c9c619a9b1e450850ffd10578b8406ef47a012d7bb41b0ec79a2faef9210a33417ec7785d09d2874e37539965dbdb287f26e238d8b310cbb94eaf9bb4dfc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Tabs_13367162567836212

Filesize
3KB

MD5
130d6464ff13ff7abde340f5ce5b6510

SHA1
5e3bcbceef51ea94c266c11f27fb9cdde1440379

SHA256
bc45993e489347a0cb2080d6266f1eb61f677b84b8eb18ef2a98c4b5cde56f65

SHA512
4f016bf3507b0f83c4cf3d5df7f5402e2cb1b68c190fa856977185e81102de2cf0a494949d3de3142cbf2f5c2a959bd585440e82832a73dc48cffea144f749d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log

Filesize
112B

MD5
4e6f6ec1fa2b5baaa475cb7dbf08d33a

SHA1
b1b55cacbad56b8c508c0b720ef099cfafee53e7

SHA256
4cc27c58776c1f8bbc141883f8302d7583f9833f05f161559e2c19656054aff6

SHA512
add55334d6ad2f79adb17de2f2f4bba183d850ac8fa33d26d968d0906a7f1e480a6fd493832229ac0e16f5527cbc4876b0e2973424bdbd69f4be47837c431c86

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Filesize
347B

MD5
2850cfbb7f39ade290236ba6aced75b1

SHA1
ae872c01422502e7dc7d48721b72f21851e37efc

SHA256
7a8a5842f8f24f1b578c0b4da3448a8614af4b608d03950c5c697406a902fc2c

SHA512
031f2950b9d6aab19ae5a2c8d0e0aca358412da32e2928845bf27f1d58d296bd6ad2f15e89acc249ed7034b2fb6d399ceae736c282f8e43f59dac385f3368ca7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Filesize
323B

MD5
ac47a7952fcdf161fac41c4057925e57

SHA1
8c002e7b0651b6cdcfbddc8a7bcdde928b56e32a

SHA256
25c82574f198a136f5f8584409b828072df985c3d48fb2d5502fdd39ab24f37d

SHA512
fa63de4dc9933054192f9d4ebea376dd23b1ae0d6f45b174a02b6aaaa6f00249741bee383524be137ad3eaebb0a8bdadf4e4d672e2004d2da7b4d011d6316ad8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Visited Links

Filesize
128KB

MD5
2d2a100b54a5011bef68ccd116ab576f

SHA1
9a1644be95a00fb83e8530c8eecd78ed50bdf060

SHA256
7320d0ebf849af528cc1b0820a235aceb1c8d131aed9b8d4ffcceb05a23032e8

SHA512
a033d577c1c7ebbbbd1ceeaa4da8e2fd64c1bb6eca50a428e5edd8df4e5f3e5fcccc94a07f874cd862b3a69fca7d3a78d27483eb88df52017d6b72b892e4a331

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c14dd93b-b024-445a-8dd1-6ee10972a5fa.tmp

Filesize
7KB

MD5
84a125fe56c71161273ef68341768393

SHA1
4e67c4c2b57621071e1196fd1fbc78ba522b9c8e

SHA256
eb808145e0f0829108844bb4ba83498e4b6deea740437c2cd084b3f8f15e2298

SHA512
7feb83ba7974d68fdb67feeaf003bc401f1b57b1e046b8ee6cd693cb20e12fd09e26038e9f2c08551e19e36c94c7a5cbb48c0211f54da1711a833ad01f62f7fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
aefd77f47fb84fae5ea194496b44c67a

SHA1
dcfbb6a5b8d05662c4858664f81693bb7f803b82

SHA256
4166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611

SHA512
b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
589c49f8a8e18ec6998a7a30b4958ebc

SHA1
cd4e0e2a5cb1fd5099ff88daf4f48bdba566332e

SHA256
26d067dbb5e448b16f93a1bb22a2541beb7134b1b3e39903346d10b96022b6b8

SHA512
e73566a037838d1f7db7e9b728eba07db08e079de471baca7c8f863c7af7beb36221e9ff77e0a898ce86d4ef4c36f83fb3af9c35e342061b7a5442ca3b9024d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db

Filesize
44KB

MD5
9195fab7e3f5f436808682104512452b

SHA1
b8445009dc6ba211de1bc5153c38c283931dd3d6

SHA256
fb016e085827b87b41c9c729f04fb1f15c07acc4aa396911eb4bb46420ac1000

SHA512
e90c1a7896d0a2571bd4997685f813f9d4e8e73cb0cff3449dab8c998273810c491eee4c9981bc262746b91755ec4eff883a882fbf8c550490f69eb66fc256a5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

Filesize
187B

MD5
66b07b60599c81269568393e31ac12c8

SHA1
216afcf9eaef59712e19e38ebd32e3cf61d366ef

SHA256
6c1015558911899fac53e9c58462ce7ef0e6ed83eb61b1f5b55d6ad8093e1d07

SHA512
682e0b03f64a22117f6fb143ba1ffb6155cf7953c8465290a0e045db33ccfa92abf1956977b9d88d3ec14bf170f0f35298196cf79b0dbe4bfba96e97d2911b29

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Filesize
319B

MD5
e060fecdeb0c229aaee99f4e385a7e66

SHA1
a40543d685c57f30d13bda29d4f73d4df6ffa034

SHA256
6024eb8ae5f605c43c897c417245e2895e3f3452c63e0dd7617c6c581e54587b

SHA512
695597f50057883b0177a79af1de318bd1670500c736edf5b77da6056c12a0bbcba727ca7c7d6d9f4d8309ba54bc5ca764fbf8a79b09fdfcfd04e7261800769c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Filesize
565B

MD5
b77ec71c14c0075ddba1abb0f067183f

SHA1
289344e88364b158f1db9d6ccfca373667e159cb

SHA256
1d2551fdd90a2011ecf6824c9fe660b792df1a61977c2f1cc4cf3014777faeeb

SHA512
d134c326d12b937189cff76c74fb71163b5d4e25fb7b4890778724846c5283748bcfc97bda8919b5399f35e2c74b1b1f013dbd3919c22a191a82db56b6875ef2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Filesize
337B

MD5
e67b2ff8218e1909eed1f442f86052a3

SHA1
c9d69ea434652ecbaed272ec7b44c25aefe0771d

SHA256
ecaf51dff18143a8c9f4a41d91d97a2b388679e24c0f41470869f2b2c9dde094

SHA512
51c040a46865bb3ad76ba388c373a228a19d763a5445af38d5b84b0ad7f721d63594941f0098fdafbbb9faad903575b803e3f5c3571a334ee8476dfe8a1e409d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_0

Filesize
44KB

MD5
ccf8cea8eff1eb1acbcf6cf23767f209

SHA1
848133e1057bf4335f298794275db92079bff625

SHA256
b0630bcfa13b1f2a8554008feeeeff4cc53905a355164e6d3025023718a77bb7

SHA512
806b07a199adec475b4b211d01d3f221fb6759042da7c3d62a3f1745d6374bf5b677ce5031fd69204ff7fab605464793b9e8d5360f8974da6c97cef5eb9d768b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_0

Filesize
44KB

MD5
4dfab4e3058c885c63123d35952fd2f8

SHA1
fdd46c4865be1d915ea2f5eb2d741feb3b5db37e

SHA256
2cd0ef05d9fc8341cce92cec64aac73b29e2942e56f9a36c96106e866afdab02

SHA512
96458d6b16689af3eb58c91ab1e2060e2564b612c1d5586be8879c79bb3f776a2b12dfe9c02c30154eccc0e8e8edd7b880588150f04163c7c0b10486f58c34b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_1

Filesize
264KB

MD5
44dc1fd5f78d61cc34fcc2529fed331a

SHA1
cc097a611bb1a5ec4337ed60cc8d46db7f56caab

SHA256
9f3c2fd6ffcfa56ff6f826259e6a0fb62e76d2b58ca50dd7455e0017dba16ba5

SHA512
494824299f3a2a9ad0158ecfba0b4a570e13d246164e2b009258bc6823e244f5e3677c2650bfcf1408a8e9ee6968c79719d436f42a5ba3e5d32d4ebcfe7199a2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_1

Filesize
264KB

MD5
be54c49cc79cfff917c09632ff90257f

SHA1
54d844ee7c840f1401a7c19f31ad3d3aba44ad36

SHA256
930f903a3478107b106fa48a1c5c9ccbebb4e02f62af9b406da06bff0eb057c6

SHA512
7ba60de4e639017617cb2f1c7ef8ddde9e2948502aa7df2f28de31eb9fe6716a8bd070239c220e0c254793814665801a4b866c0e4abffcb7bd48ada1b2aa25f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_3

Filesize
4.0MB

MD5
a9c9d864d566112d1172df3e2cdd41bb

SHA1
d032c8f559b60fe53f52f167cdb48132ffae116b

SHA256
20da814c78b1fa90c8104db41eacebcb5a9d1ac0e0780c8cf127b0f3142f70ca

SHA512
d1b39da5905bc35cc4737afa5d9d589bea693fb5baf95624bd957c707dea72d6e54909182bd5f670314d33543eaabde01ec8aaac78b0bc8f2db69cc2728854d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version

Filesize
11B

MD5
838a7b32aefb618130392bc7d006aa2e

SHA1
5159e0f18c9e68f0e75e2239875aa994847b8290

SHA256
ac3dd2221d90b09b795f1f72e72e4860342a4508fe336c4b822476eb25a55eaa

SHA512
9e350f0565cc726f66146838f9cebaaa38dd01892ffab9a45fe4f72e5be5459c0442e99107293a7c6f2412c71f668242c5e5a502124bc57cbf3b6ad8940cb3e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
19e629e9d0db8bace0ffadbfe84c84dc

SHA1
03011c27dfa65d0aadc0ce5b557337a1df1ddb9b

SHA256
ecea194781f628d269015e7206bdbacdf1fc71f2972248fd34e6d7ae0503e3b7

SHA512
17ead0ece17e293e76cdfb7c4503f8c793fa4dc4173dd7cc9c7c78b6774be70be1c72625eb410adcfbc93ac8d7af4ba6847a08d65c12a4274317a26ea19f6446

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
1d48aa450c9e2b0a3ebd07adb7fd9743

SHA1
1ff13855fb2ba953339675aadb224eb93ce14569

SHA256
2140966bd90099f31695799413692fe2a7473f0430bde433ea4aa0e303cc48c8

SHA512
add13423c25ca3cc0a5401adc788ef22b69a3de80b364796f25425bb0867d6ddcc774742a64d3cbfce8f4db56250b3545b57f2940a75f01c5c65444612995939

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
6e7130169d33b1fc77dc889f6cd818bb

SHA1
6ac4360fd25a45915ca945b1d51015e755df063d

SHA256
e912a2066341b920bc622f16801bab9c9df2512fc62739669bd627d025627853

SHA512
c7670042750f58cae92dd2a5407841515bd26d32ec94e5a8019983f2115a70f33190539def98e0931607c61fe559f6457da747ed8c362997ece0ef3db3868204

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
b0dcdb5c6d3f871c6c28a899d230e30f

SHA1
7cd6f0993d01332b659fd3251dde5dd010c0b753

SHA256
f6829e7a46144d7cfce7c1bf003f29cb1a2b43bf32dcc8c867a013b96583a566

SHA512
a9465da08201f3e4fc3091e001bde8ff3ba73bce0f8d4c383afedd049be5dc3d0a620f93a7937f1345d62cbaa3453cfedc0374d2739f438c17f75d78fa779df9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
f2d88cd288777b968f9ba3d44d6e8d6f

SHA1
c33d95c03316e2eb756714449e78656b44f3980c

SHA256
b4263ac5f23f44235a05d6facd56931860198943ab8c74e15eb9cc30a1eae7a4

SHA512
5f5d9ed90d41c1487be29ce4fe03e6e8d117934ac9b135778531d397b63b1d8cb7cade67853f3738257c947bce49c05962cb021d27cd699c30ae809297f15fbd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
1727568b7cc4ba94bc6c080309d4645d

SHA1
6df12528146f7f75180daf3d6cd4a12ce2d24b33

SHA256
f167a7707c0e91f5a8c278dfce453658d01931122a5bae4a52573f212ed6a980

SHA512
5c0b111d4cada7e9d2be5bd0229f14b9607ea1a6df2d94201f92abe62ca5dbc960f634dd0d0e83f9593ec22932f9230db146af1ed6e2a1318ba4ce3e81d88fdc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1

Filesize
264KB

MD5
75380c6fe60d29dfc1ab0636e736cb7a

SHA1
be68d03c18b92ef6104c636b761d4db2f6510248

SHA256
e4614040991c4b90ee784dc8823e5f9e70e03619a697f4426a0af8fd081d5c43

SHA512
2c5d7c3f37aea1412ec2254b442df0fd621323c807392391ab97a205fb1ec2c52d3371c8edbbe0b0570f039a727e9756c8f0240e1c7e3ab3a717c08cb2e6981b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1

Filesize
264KB

MD5
266ee0fc77417bf97009f27342431253

SHA1
dc3fe4b7cdfc7c212adfc9aa498f249b7c836749

SHA256
41ee6c96b55c08d906ffffd4a0012ba6d5138369c814829b05258bda353d51a2

SHA512
a3ebf69e5aedf2f8408577609903fd7cc45bcd71c0d73b1a3da4ef6e674449653fff77185f34e132ac806e1ca469c2c4696895a2110c87a4b9827f2dd7336770

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\_R_E_A_D___T_H_I_S___NHU8ANRB_.txt

Filesize
1KB

MD5
4f0c51786af969c72d384b0cc80f9155

SHA1
335c36ae1b1a75912a591c0a6a47d4822603ea7a

SHA256
fdc4e9631c1679c654363122a21007baaf03397539cbb51de8fca8a180a0ec2f

SHA512
78798571bfae8270a6b29d6f3bd4ed2c20226199bb839e3725f704a82c097719d451c68b31bcde0ee4976ea4916100cbdb8b5b69072cc2c1d8ac11ced669435c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\OneNote\16.0\_R_E_A_D___T_H_I_S___K9VP_.hta

Filesize
76KB

MD5
65ae065e2915ee29c07c48f0c3247984

SHA1
2f5e8668f1f940c332e3f199f2c22377426ff8b8

SHA256
696cfbbe684d6afa68b42003995d3a00f38f6e60b8d63d51aba97d8e68012dc4

SHA512
72f42bf1f290798b7aeb56e77e49c6d67342f2c906550472c82ff6214b02f48535109a9c45cdb6fe6ff9a7e8c14bde618ca95db622aebf7ba314ba57faf61bea

Download Submit
C:\Users\Admin\Downloads\Cerber 5.zip

Filesize
181KB

MD5
10d74de972a374bb9b35944901556f5f

SHA1
593f11e2aa70a1508d5e58ea65bec0ae04b68d64

SHA256
ab9f6ac4a669e6cbd9cfb7f7a53f8d2393cd9753cc1b1f0953f8655d80a4a1df

SHA512
1755be2bd1e2c9894865492903f9bf03a460fb4c952f84b748268bf050c3ece4185b612c855804c7600549170742359f694750a46e5148e00b5604aca5020218

Download Submit
C:\Users\Admin\Downloads\DeriaLock.zip

Filesize
210KB

MD5
016d1ca76d387ec75a64c6eb3dac9dd9

SHA1
b0a2b2d4d639c6bcc5b114b3fcbb56d7c7ddbcbe

SHA256
8037a333dfeca754a46e284b8c4b250127daef6d728834bf39497df03006e177

SHA512
f08653184d7caf48e971635699b17b9502addb33fb91cc6e0a563e6a000aeb57ac0a2edd5a9e21ef99a4770c0dbb65899150fa5842b0326976a299382f6be86e

Download Submit
C:\Users\Admin\Downloads\MEMZ.zip

Filesize
8KB

MD5
69977a5d1c648976d47b69ea3aa8fcaa

SHA1
4630cc15000c0d3149350b9ecda6cfc8f402938a

SHA256
61ca4d8dd992c763b47bebb9b5facb68a59ff0a594c2ff215aa4143b593ae9dc

SHA512
ba0671c72cd4209fabe0ee241b71e95bd9d8e78d77a893c94f87de5735fd10ea8b389cf4c48462910042c312ddff2f527999cd2f845d0c19a8673dbceda369fd

Download Submit
C:\note.txt

Filesize
218B

MD5
afa6955439b8d516721231029fb9ca1b

SHA1
087a043cc123c0c0df2ffadcf8e71e3ac86bbae9

SHA256
8e9f20f6864c66576536c0b866c6ffdcf11397db67fe120e972e244c3c022270

SHA512
5da21a31fbc4e8250dffed30f66b896bdf007ac91948140334fe36a3f010e1bac3e70a07e9f3eb9da8633189091fd5cadcabbaacd3e01da0fe7ae28a11b3dddf

Download Submit
memory/2552-2126-0x000001562F150000-0x000001562F151000-memory.dmp

Filesize
4KB

Download
memory/2552-2124-0x000001562F150000-0x000001562F151000-memory.dmp

Filesize
4KB

Download
memory/2552-2117-0x000001562F150000-0x000001562F151000-memory.dmp

Filesize
4KB

Download
memory/2552-2116-0x000001562F150000-0x000001562F151000-memory.dmp

Filesize
4KB

Download
memory/2552-2128-0x000001562F150000-0x000001562F151000-memory.dmp

Filesize
4KB

Download
memory/2552-2127-0x000001562F150000-0x000001562F151000-memory.dmp

Filesize
4KB

Download
memory/2552-2118-0x000001562F150000-0x000001562F151000-memory.dmp

Filesize
4KB

Download
memory/2552-2125-0x000001562F150000-0x000001562F151000-memory.dmp

Filesize
4KB

Download
memory/2552-2123-0x000001562F150000-0x000001562F151000-memory.dmp

Filesize
4KB

Download
memory/2552-2122-0x000001562F150000-0x000001562F151000-memory.dmp

Filesize
4KB

Download
memory/5752-1298-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5752-1779-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5752-1295-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5752-1724-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download

Analysis

Sharing

Errors

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads