cerber | hxxps://www[.]youtube[.]com/redirect?event=backstage_event&redir_token=QUFFLUhqbWR4TlBCa2Z4UjZDcWVESmJwcS1zWXJXTF8wZ3xBQ3Jtc0tsenF4LUpxV25MeGNlZlFEcHVqX1pHM3hrY0FDbUN3Y3pWajIzUllwV0g5X2hta3B2dEJTV3BzSmp5QVUwazBFeWR4TVRQYTNoMWlXMlpiaDRKRFBQWUIyMThWbWozWUsxd1FGMHBseVE3TjUzV2hhcw&q=https%3A%2F%2Fwww[.]dropbox[.]com%2Fscl%2Ffi%2Frlx6kz3gzrwup8laoyijg%2FAdobe-A-tivator[.]rar%3Frlkey%3Diui2ku44r3td0rvm46r0pbvw5%26st%3D4ua9ggn4%26dl%3D1

Analysis

max time kernel
369s
max time network
393s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
06-08-2024 16:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.youtube.com/redirect?event=backstage_event&redir_token=QUFFLUhqbWR4TlBCa2Z4UjZDcWVESmJwcS1zWXJXTF8wZ3xBQ3Jtc0tsenF4LUpxV25MeGNlZlFEcHVqX1pHM3hrY0FDbUN3Y3pWajIzUllwV0g5X2hta3B2dEJTV3BzSmp5QVUwazBFeWR4TVRQYTNoMWlXMlpiaDRKRFBQWUIyMThWbWozWUsxd1FGMHBseVE3TjUzV2hhcw&q=https%3A%2F%2Fwww.dropbox.com%2Fscl%2Ffi%2Frlx6kz3gzrwup8laoyijg%2FAdobe-A-tivator.rar%3Frlkey%3Diui2ku44r3td0rvm46r0pbvw5%26st%3D4ua9ggn4%26dl%3D1

Score

10^/10

cerber discovery evasion persistence privilege_escalation ransomware

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Roaming\Microsoft\OneNote\16.0\_R_E_A_D___T_H_I_S___28JSD_.hta

Family

cerber

Ransom Note

<!DOCTYPE html> <html lang="en"> <head> <meta charset="utf-8"> <title>CERBER RANSOMWARE: Instructions</title> <HTA:APPLICATION APPLICATIONNAME="j" SCROLL="yes" SINGLEINSTANCE="yes" WINDOWSTATE="maximize"> <style type="text/css"> a { color: #04a; text-decoration: none; } a:hover { text-decoration: underline; } body { background-color: #e7e7e7; color: #222; font-family: "Lucida Sans Unicode", "Lucida Grande", sans-serif; font-size: 13pt; line-height: 19pt; } body, h1 { margin: 0; padding: 0; } hr { color: #bda; height: 2pt; margin: 1.5%; } h1 { color: #555; font-size: 14pt; } ol { padding-left: 2.5%; } ol li { padding-bottom: 13pt; } small { color: #555; font-size: 11pt; } ul { list-style-type: none; margin: 0; padding: 0; } .button { color: #04a; cursor: pointer; } .button:hover { text-decoration: underline; } .container { background-color: #fff; border: 2pt solid #c7c7c7; margin: 5%; min-width: 850px; padding: 2.5%; } .header { border-bottom: 2pt solid #c7c7c7; margin-bottom: 2.5%; padding-bottom: 2.5%; } .h { display: none; } .hr { background: #bda; display: block; height: 2pt; margin-top: 1.5%; margin-bottom: 1.5%; overflow: hidden; width: 100%; } .info { background-color: #efe; border: 2pt solid #bda; display: inline-block; padding: 1.5%; text-align: center; } .updating { color: red; display: none; padding-left: 35px; background: url("data:image/gif;base64,R0lGODlhGQAZAKIEAMzMzJmZmTMzM2ZmZgAAAAAAAAAAAAAAACH/C05FVFNDQVBFMi4wAwEAAAAh+QQFAAAEACwAAAAAGQAZAAADVki63P4wSEiZvLXemRf4yhYoQ0l9aMiVLISCDms+L/DIwwnfc+c3qZ9g6Hn5hkhF7YgUKI2dpvNpExJ/WKquSoMCvd9geDeuBpcuGFrcQWep5Df7jU0AACH5BAUAAAQALAoAAQAOABQAAAMwSLDU/iu+Gdl0FbTAqeXg5YCdSJCBuZVqKw5wC8/qHJv2IN+uKvytn9AnFBCHx0cCACH5BAUAAAQALAoABAAOABQAAAMzSLoEzrC5F9Wk9YK6Jv8gEYzgaH4myaVBqYbfIINyHdcDI+wKniu7YG+2CPI4RgFI+EkAACH5BAUAAAQALAQACgAUAA4AAAMzSLrcBNDJBeuUNd6WwXbWtwnkFZwMqUpnu6il06IKLChDrsxBGufAHW0C1IlwxeMieEkAACH5BAUAAAQALAEACgAUAA4AAAM0SLLU/lAtFquctk6aIe5gGA1kBpwPqVZn66hl1KINPDRB3sxAGufAHc0C1IkIxcARZ4QkAAAh+QQFAAAEACwBAAQADgAUAAADMUhK0vurSfiko8oKHC//yyCCYvmVI4cOZAq+UCCDcv3VM4cHCuDHOZ/wI/xxigDQMAEAIfkEBQAABAAsAQABAA4AFAAAAzNIuizOkLgZ13xraHVF1puEKWBYlUP1pWrLBLALz+0cq3Yg324PAUAXcNgaBlVGgPAISQAAIfkEBQAABAAsAQABABQADgAAAzRIujzOMBJHpaXPksAVHoogMlzpZWK6lF2UjgobSK9AtjSs7QTg8xCfELgQ/og9I1IxXCYAADs=") left no-repeat; } #change_language { float: right; } #change_language, #texts div { display: none; } </style> </head> <body> <div class="container"> <div class="header"> <a id="change_language" href="#" onclick="return changeLanguage1();" title="English">☑ English</a> <h1>CERBER RANSOMWARE</h1> Instructions </div> <div id="languages"> ☑ Select your language <ul> <li><a href="#" title="English" onclick="return sh_bl('en');">English</a></li> <li><a href="#" title="Arabic" onclick="return sh_bl('ar');">العربية</a></li> <li><a href="#" title="Chinese" onclick="return sh_bl('zh');">中文</a></li> <li><a href="#" title="Dutch" onclick="return sh_bl('nl');">Nederlands</a></li> <li><a href="#" title="French" onclick="return sh_bl('fr');">Français</a></li> <li><a href="#" title="German" onclick="return sh_bl('de');">Deutsch</a></li> <li><a href="#" title="Italian" onclick="return sh_bl('it');">Italiano</a></li> <li><a href="#" title="Japanese" onclick="return sh_bl('ja');">日本語</a></li> <li><a href="#" title="Korean" onclick="return sh_bl('ko');">한국어</a></li> <li><a href="#" title="Polish" onclick="return sh_bl('pl');">Polski</a></li> <li><a href="#" title="Portuguese" onclick="return sh_bl('pt');">Português</a></li> <li><a href="#" title="Spanish" onclick="return sh_bl('es');">Español</a></li> <li><a href="#" title="Turkish" onclick="return sh_bl('tr');">Türkçe</a></li> </ul> </div> <div id="texts"> <div id="en"> Can't yo9h48oUqTu find the necessary files? Is the celjuefEontent of your files not readable? It is normal beVblZnyszcause the files' names and the data in your files have been encryp9ated by "CeKzrber Ransomware". It mejnrX65P1Hrans your files are NOT damageGkd! Your files are modified only. This modification is reversible. FvxGNXPOrom now it is not poss2lDZible to use your files until they will be decrypted. The only way to decugyHTM6nt4rypt your files safely is to buy the special decryption software "Cxqubh9MXmPerber Decryptor". Any attempts to rest6QbZY4WjN8ore your files with the thirHLWodBBdid-party software will be fatal for your files! <hr> You can procaoAeed with purchasing of the decryption softwccnptHuare at your personal page: Pleq2eFwMVosase wait...<a class="url" href="http://p27dokhpz2n7nvgr.12hygy.top/65B1-1F63-C661-0446-920C" target="_blank">http://p27dokhpz2n7nvgr.12hygy.top/65B1-1F63-C661-0446-920C</a><hr><a href="http://p27dokhpz2n7nvgr.14ewqv.top/65B1-1F63-C661-0446-920C" target="_blank">http://p27dokhpz2n7nvgr.14ewqv.top/65B1-1F63-C661-0446-920C</a><hr><a href="http://p27dokhpz2n7nvgr.14vvrc.top/65B1-1F63-C661-0446-920C" target="_blank">http://p27dokhpz2n7nvgr.14vvrc.top/65B1-1F63-C661-0446-920C</a><hr><a href="http://p27dokhpz2n7nvgr.129p1t.top/65B1-1F63-C661-0446-920C" target="_blank">http://p27dokhpz2n7nvgr.129p1t.top/65B1-1F63-C661-0446-920C</a><hr><a href="http://p27dokhpz2n7nvgr.1apgrn.top/65B1-1F63-C661-0446-920C" target="_blank">http://p27dokhpz2n7nvgr.1apgrn.top/65B1-1F63-C661-0446-920C</a> If tDIDmwrwPnhis page cannot be opened  cliNtxEdg5ck here  to get a new addrtyess of your personal page. If the addrezWdA5hdss of your personal page is the same as befozre after you tried to get a new one, you cDIKOran try to get a new address in one hour. At thjFXQW0Ais page you will receive the complete instrX8B88Tuctions how to buy the decryptipQZRWl8on software for restoring all your files. Also at this page you will be able to resPYUEvsLlvtore any one file for free to be sure "CerbeNYWtbr Decryptor" will help you. <hr> If your perbsonal page is not availa5dHYKble for a long period there is another way to open your personal page - instaUwHTK01ollation and use of Tor Browser: <ol> <li>run your IntesRrnet browser (if you do not know what it is run the Internet Explorer);</li> <li>enth0q7er or copy the address <a href="https://www.torproject.org/download/download-easy.html.en" target="_blank">https://www.torproject.org/download/download-easy.html.en</a> into the address bar of your browser and press ENTER;</li> <li>wait for the site loadGCYging;</li> <li>on the site you will be offered to do3H0Bt8e3nXwnload Tor Browser; download and run it, follow the installation instructions, wait until the installation is completed;</li> <li>rufLZeWB13xn Tor Browser;</li> <li>connect with the butt5on "Connect" (if you use the English version);</li> <li>a normal Internet broLp6OINAFTwser window will be opened after the initialization;</li> <li>type or copy the addDTwjWucYress http://p27dokhpz2n7nvgr.onion/65B1-1F63-C661-0446-920C in this browser address bar;</li> <li>pre7qxpq0RDRss ENTER;</li> <li>the site shotHBEuld be loaded; if for some reason the site is not loxOAkading wait for a moment and try again.</li> </ol> If you have any prBIboblems during installation or use of Tor Browser, please, visit <a href="https://www.youtube.com/results?search_query=Install+Tor+Browser+Windows" target="_blank">https://www.youtube.com</a> and type request in the searc0H6Dh bar "Install Tor Browser Windows" and you will find a lot of training videos about Tor Browser installation and use. <hr> AdditZg5xzz6nqional information: You will fiU6nd the instrukGCebVctions ("*_READ_THIS_FILE_*.hta") for reudr3HGimrstoring your files in any fjcEiolder with your enctrypted files. The instr6UNu1nSH5uctions "*_READ_THIS_FILE_*.hta" in the fAxdXIIolderlgVs with your encryJ1M9vEpted files are not virnuGGEHuses! The instrucvPtions "*_READ_THIS_FILE_*.hta" will heC0YRo2CG7lp you to dec0mNBQAKWxTrypt your files. RemembeHgyyQz3r! The worst siK4dyJStuation already happEs4yL5ened and now the future of your files dexjXv1pends on your determPbhLJyrcJination and speed of your actions. </div> <div id="ar" style="direction: rtl;"> لا يمكنك العثور على الملفات الضرورية؟ هل محتوى الملفات غير قابل للقراءة؟ هذا أمر طبيعي لأن أسماء الملفات والبيانات في الملفات قد تم تشفيرها بواسطة "Cerber Ransomware". وهذا يعني أن الملفات الخاصة بك ليست تالفة! فقد تم تعديل ملفاتك فقط. ويمكن التراجع عن هذا. ومن الآن فإنه لا يكن استخدام الملفات الخاصة بك حتى يتم فك تشفيرها. الطريقة الوحيدة لفك تشفير ملفاتك بأمان هو أن تشتري برنامج فك التشفير المتخصص "Cerber Decryptor". إن أية محاولات لاستعادة الملفات الخاصة بك بواسطة برامج من طرف ثالث سوف تكون مدمرة لملفاتك! <hr> يمكنك الشروع في شراء برنامج فك التشفير من صفحتك الشخصية: أرجو الإنتظار...<a class="url" href="http://p27dokhpz2n7nvgr.12hygy.top/65B1-1F63-C661-0446-920C" target="_blank">http://p27dokhpz2n7nvgr.12hygy.top/65B1-1F63-C661-0446-920C</a><hr><a href="http://p27dokhpz2n7nvgr.14ewqv.top/65B1-1F63-C661-0446-920C" target="_blank">http://p27dokhpz2n7nvgr.14ewqv.top/65B1-1F63-C661-0446-920C</a><hr><a href="http://p27dokhpz2n7nvgr.14vvrc.top/65B1-1F63-C661-0446-920C" target="_blank">http://p27dokhpz2n7nvgr.14vvrc.top/65B1-1F63-C661-0446-920C</a><hr><a href="http://p27dokhpz2n7nvgr.129p1t.top/65B1-1F63-C661-0446-920C" target="_blank">http://p27dokhpz2n7nvgr.129p1t.top/65B1-1F63-C661-0446-920C</a><hr><a href="http://p27dokhpz2n7nvgr.1apgrn.top/65B1-1F63-C661-0446-920C" target="_blank">http://p27dokhpz2n7nvgr.1apgrn.top/65B1-1F63-C661-0446-920C</a> في حالة تعذر فتح هذه الصفحة  انقر هنا  لإنشاء عنوان جديد لصفحتك الشخصية. في هذه الصفحة سوف تتلقى تعليمات كاملة حول كيفية شراء برنامج فك التشفير لاستعادة جميع الملفات الخاصة بك. في هذه الصفحة أيضًا سوف تتمكن من استعادة ملف واحد بشكل مجاني للتأكد من أن "Cerber Decryptor" سوف يساعدك. <hr> إذا كانت صفحتك الشخصية غير متاحة لفترة طويلة فإن ثمّة طريقة أخرى لفتح صفحتك الشخصية - تحميل واستخدام متصفح Tor: <ol> <li>قم بتشغيل متصفح الإنترنت الخاص بك (إذا كنت لا تعرف ما هو قم بتشغيل إنترنت إكسبلورر);</li> <li>قم بكتابة أو نسخ العنوان <a href="https://www.torproject.org/download/download-easy.html.en" target="_blank">https://www.torproject.org/download/download-easy.html.en</a> إلى شريط العنوان في المستعرض الخاص بك ثم اضغط ENTER;</li> <li>انتظر لتحميل الموقع;</li> <li>سوف يعرض عليك الموقع تحميل متصفح Tor. قم بتحميله وتشغيله، واتبع تعليمات التثبيت، وانتظر حتى اكتمال التثبيت;</li> <li>قم بتشغيل متصفح Tor;</li> <li>اضغط على الزر "Connect" (إذا كنت تستخدم النسخة الإنجليزية);</li> <li>سوف تُفتح نافذة متصفح الإنترنت العادي بعد البدء;</li> <li>قم بكتابة أو نسخ العنوان http://p27dokhpz2n7nvgr.onion/65B1-1F63-C661-0446-920C في شريط العنوان في المتصفح;</li> <li>اضغط ENTER;</li> <li>يجب أن يتم تحميل الموقع؛ إذا لم يتم تحميل الموقع لأي سبب، انتظر للحظة وحاول مرة أخرى.</li> </ol> إذا كان لديك أية مشكلات أثناء عملية التثبيت أو استخدام متصفح Tor، يُرجى زيارة <a href="https://www.youtube.com/results?search_query=Install+Tor+Browser+Windows" target="_blank">https://www.youtube.com</a> واكتب الطلب "install tor browser windows" أو "تثبيت نوافذ متصفح Tor" في شريط البحث، وسوف تجد الكثير من أشرطة الفيديو للتدريب حول تثبيت متصفح Tor واستخدامه. <hr> معلومات إضSsافية: سgERوف تجد إرشادات استعادة الملفات الخاصة بك ("*_READ_THIS_FILE_*") في أي مجلد مع ملفاتك المشفرة. الإرشBLادات ("*_READ_THIS_FILE_*") الموجودة في المجلدات مع ملفاتك المشفرة ليست فيروسات والإرشادات ("*_READ_THIS_FILE_*") سوف تساعدك على فك تشفير الملفات الخاصة بك. تذكر أن أسوأ موZv0YHKWj2قف قد حدث بالفعل، والآن مستقبل ملفاتك يعتمد على عزيمتك وسرعة الإجراءات الخاصة بك. </div> <div id="zh"> 您找不到所需的文件？ 您文件的内容无法阅读？ 这是正常的，因为您文件的文件名和数据已经被“Cerber Ransomware”加密了。 这意味着您的文件并没有损坏！您的文件

Extracted

Path

C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\_R_E_A_D___T_H_I_S___WKMX_.txt

Family

cerber

Ransom Note

CERBER RANSOMWARE ----- YOUR DOCUMENTS, PH0TOS, DATABASES AND OTHER IMPORTANT FILES HAVE BEEN ENCRYPTED! ----- The only way to decrypt y0ur files is to receive the private key and decryption program. To receive the private key and decryption program go to any decrypted folder, inside there is the special file (*_READ_THIS_FILE_*) with complete instructions how to decrypt your files. If you cannot find any (*_READ_THIS_FILE_*) file at your PC, follow the instructions below: ----- 1. Download "Tor Browser" from https://www.torproject.org/ and install it. 2. In the "Tor Browser" open your personal page here: http://p27dokhpz2n7nvgr.onion/65B1-1F63-C661-0446-920C Note! This page is available via "Tor Browser" only. ----- Also you can use temporary addresses on your personal page without using "Tor Browser". ----- 1. http://p27dokhpz2n7nvgr.12hygy.top/65B1-1F63-C661-0446-920C 2. http://p27dokhpz2n7nvgr.14ewqv.top/65B1-1F63-C661-0446-920C 3. http://p27dokhpz2n7nvgr.14vvrc.top/65B1-1F63-C661-0446-920C 4. http://p27dokhpz2n7nvgr.129p1t.top/65B1-1F63-C661-0446-920C 5. http://p27dokhpz2n7nvgr.1apgrn.top/65B1-1F63-C661-0446-920C ----- Note! These are temporary addresses! They will be available for a limited amount of time! -----

URLs

http://p27dokhpz2n7nvgr.onion/65B1-1F63-C661-0446-920C

http://p27dokhpz2n7nvgr.12hygy.top/65B1-1F63-C661-0446-920C

http://p27dokhpz2n7nvgr.14ewqv.top/65B1-1F63-C661-0446-920C

http://p27dokhpz2n7nvgr.14vvrc.top/65B1-1F63-C661-0446-920C

http://p27dokhpz2n7nvgr.129p1t.top/65B1-1F63-C661-0446-920C

http://p27dokhpz2n7nvgr.1apgrn.top/65B1-1F63-C661-0446-920C

Signatures

Cerber
Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.
ransomware cerber
Contacts a large (1118) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Modifies Windows Firewall 2 TTPs 2 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
1832	netsh.exe
2780	netsh.exe

Drops startup file 1 IoCs

description	ioc	Process
File opened for modification	\??\c:\users\admin\appdata\roaming\microsoft\word\startup\	cerber.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 6 IoCs

Web Service

T1102

flow	ioc
75	camo.githubusercontent.com
76	raw.githubusercontent.com
71	camo.githubusercontent.com
72	raw.githubusercontent.com
73	camo.githubusercontent.com
74	camo.githubusercontent.com

Drops file in System32 directory 38 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\excel	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\office	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\outlook	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\word	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft sql server	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\excel	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\microsoft sql server	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\office	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\onenote	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\word	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\powerpoint	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\powerpoint	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\office	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\onenote	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\outlook	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\powerpoint	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\thunderbird	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\steam	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\the bat!	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\the bat!	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\desktop	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\bitcoin	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\excel	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\microsoft sql server	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\outlook	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\bitcoin	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\onenote	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\powerpoint	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\office	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\outlook	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\word	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\documents	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft sql server	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\excel	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\word	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\onenote	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\steam	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\thunderbird	cerber.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tmp4C81.bmp"	cerber.exe

Drops file in Program Files directory 20 IoCs

description	ioc	Process
File opened for modification	\??\c:\program files (x86)\onenote	cerber.exe
File opened for modification	\??\c:\program files (x86)\powerpoint	cerber.exe
File opened for modification	\??\c:\program files\	cerber.exe
File opened for modification	\??\c:\program files (x86)\	cerber.exe
File opened for modification	\??\c:\program files (x86)\bitcoin	cerber.exe
File opened for modification	\??\c:\program files (x86)\excel	cerber.exe
File opened for modification	\??\c:\program files (x86)\microsoft\onenote	cerber.exe
File opened for modification	\??\c:\program files (x86)\microsoft\outlook	cerber.exe
File opened for modification	\??\c:\program files (x86)\the bat!	cerber.exe
File opened for modification	\??\c:\program files (x86)\word	cerber.exe
File opened for modification	\??\c:\program files (x86)\microsoft\excel	cerber.exe
File opened for modification	\??\c:\program files (x86)\microsoft\powerpoint	cerber.exe
File opened for modification	\??\c:\program files (x86)\microsoft\word	cerber.exe
File opened for modification	\??\c:\program files (x86)\office	cerber.exe
File opened for modification	\??\c:\program files (x86)\microsoft\microsoft sql server	cerber.exe
File opened for modification	\??\c:\program files (x86)\outlook	cerber.exe
File opened for modification	\??\c:\program files (x86)\steam	cerber.exe
File opened for modification	\??\c:\program files (x86)\thunderbird	cerber.exe
File opened for modification	\??\c:\program files (x86)\microsoft sql server	cerber.exe
File opened for modification	\??\c:\program files (x86)\microsoft\office	cerber.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\outlook	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\powerpoint	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\word	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\office	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\steam	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\word	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\documents	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\excel	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\powerpoint	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\office	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\onenote	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\outlook	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\desktop	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\onenote	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\onenote	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\powerpoint	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft sql server	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\microsoft sql server	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\office	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\office	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\outlook	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\outlook	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\onenote	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\steam	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\excel	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\the bat!	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\desktop	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\the bat!	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft sql server	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\onenote	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\steam	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\the bat!	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\bitcoin	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\word	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\thunderbird	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\word	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\thunderbird	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\microsoft sql server	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\outlook	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\outlook	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\the bat!	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\thunderbird	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\excel	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\excel	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\office	cerber.exe
File opened for modification	\??\c:\windows\	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\office	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\onenote	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\word	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\excel	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft sql server	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft sql server	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\excel	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\steam	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\documents	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\bitcoin	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\powerpoint	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\word	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\microsoft sql server	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\onenote	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\word	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\outlook	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\word	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\excel	cerber.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cerber.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NOTEPAD.EXE

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2180	PING.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
968	taskkill.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-786284298-625481688-3210388970-1000\{77CC9C85-3C70-4162-8E71-A7684848396C}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings	cerber.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
1092	NOTEPAD.EXE

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2180	PING.EXE

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
3748	msedge.exe
3748	msedge.exe
1668	msedge.exe
1668	msedge.exe
3380	identity_helper.exe
3380	identity_helper.exe
4464	msedge.exe
4464	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
3220	msedge.exe
3220	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

pid	Process
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeRestorePrivilege	1724	7zG.exe
Token: 35	1724	7zG.exe
Token: SeSecurityPrivilege	1724	7zG.exe
Token: SeRestorePrivilege	3464	7zG.exe
Token: 35	3464	7zG.exe
Token: SeSecurityPrivilege	3464	7zG.exe
Token: SeSecurityPrivilege	3464	7zG.exe
Token: SeShutdownPrivilege	4648	cerber.exe
Token: SeCreatePagefilePrivilege	4648	cerber.exe
Token: SeDebugPrivilege	968	taskkill.exe

Suspicious use of FindShellTrayWindow 46 IoCs

pid	Process
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1724	7zG.exe
3464	7zG.exe
1668	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
1652	OpenWith.exe
1652	OpenWith.exe
1652	OpenWith.exe
1652	OpenWith.exe
1652	OpenWith.exe
3396	OpenWith.exe
3396	OpenWith.exe
3396	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1668 wrote to memory of 224	1668	msedge.exe	83
PID 1668 wrote to memory of 224	1668	msedge.exe	83
PID 1668 wrote to memory of 4524	1668	msedge.exe	84
PID 1668 wrote to memory of 4524	1668	msedge.exe	84
PID 1668 wrote to memory of 4524	1668	msedge.exe	84
PID 1668 wrote to memory of 4524	1668	msedge.exe	84
PID 1668 wrote to memory of 4524	1668	msedge.exe	84
PID 1668 wrote to memory of 4524	1668	msedge.exe	84
PID 1668 wrote to memory of 4524	1668	msedge.exe	84
PID 1668 wrote to memory of 4524	1668	msedge.exe	84
PID 1668 wrote to memory of 4524	1668	msedge.exe	84
PID 1668 wrote to memory of 4524	1668	msedge.exe	84
PID 1668 wrote to memory of 4524	1668	msedge.exe	84
PID 1668 wrote to memory of 4524	1668	msedge.exe	84
PID 1668 wrote to memory of 4524	1668	msedge.exe	84
PID 1668 wrote to memory of 4524	1668	msedge.exe	84
PID 1668 wrote to memory of 4524	1668	msedge.exe	84
PID 1668 wrote to memory of 4524	1668	msedge.exe	84
PID 1668 wrote to memory of 4524	1668	msedge.exe	84
PID 1668 wrote to memory of 4524	1668	msedge.exe	84
PID 1668 wrote to memory of 4524	1668	msedge.exe	84
PID 1668 wrote to memory of 4524	1668	msedge.exe	84
PID 1668 wrote to memory of 4524	1668	msedge.exe	84
PID 1668 wrote to memory of 4524	1668	msedge.exe	84
PID 1668 wrote to memory of 4524	1668	msedge.exe	84
PID 1668 wrote to memory of 4524	1668	msedge.exe	84
PID 1668 wrote to memory of 4524	1668	msedge.exe	84
PID 1668 wrote to memory of 4524	1668	msedge.exe	84
PID 1668 wrote to memory of 4524	1668	msedge.exe	84
PID 1668 wrote to memory of 4524	1668	msedge.exe	84
PID 1668 wrote to memory of 4524	1668	msedge.exe	84
PID 1668 wrote to memory of 4524	1668	msedge.exe	84
PID 1668 wrote to memory of 4524	1668	msedge.exe	84
PID 1668 wrote to memory of 4524	1668	msedge.exe	84
PID 1668 wrote to memory of 4524	1668	msedge.exe	84
PID 1668 wrote to memory of 4524	1668	msedge.exe	84
PID 1668 wrote to memory of 4524	1668	msedge.exe	84
PID 1668 wrote to memory of 4524	1668	msedge.exe	84
PID 1668 wrote to memory of 4524	1668	msedge.exe	84
PID 1668 wrote to memory of 4524	1668	msedge.exe	84
PID 1668 wrote to memory of 4524	1668	msedge.exe	84
PID 1668 wrote to memory of 4524	1668	msedge.exe	84
PID 1668 wrote to memory of 3748	1668	msedge.exe	85
PID 1668 wrote to memory of 3748	1668	msedge.exe	85
PID 1668 wrote to memory of 3132	1668	msedge.exe	86
PID 1668 wrote to memory of 3132	1668	msedge.exe	86
PID 1668 wrote to memory of 3132	1668	msedge.exe	86
PID 1668 wrote to memory of 3132	1668	msedge.exe	86
PID 1668 wrote to memory of 3132	1668	msedge.exe	86
PID 1668 wrote to memory of 3132	1668	msedge.exe	86
PID 1668 wrote to memory of 3132	1668	msedge.exe	86
PID 1668 wrote to memory of 3132	1668	msedge.exe	86
PID 1668 wrote to memory of 3132	1668	msedge.exe	86
PID 1668 wrote to memory of 3132	1668	msedge.exe	86
PID 1668 wrote to memory of 3132	1668	msedge.exe	86
PID 1668 wrote to memory of 3132	1668	msedge.exe	86
PID 1668 wrote to memory of 3132	1668	msedge.exe	86
PID 1668 wrote to memory of 3132	1668	msedge.exe	86
PID 1668 wrote to memory of 3132	1668	msedge.exe	86
PID 1668 wrote to memory of 3132	1668	msedge.exe	86
PID 1668 wrote to memory of 3132	1668	msedge.exe	86
PID 1668 wrote to memory of 3132	1668	msedge.exe	86
PID 1668 wrote to memory of 3132	1668	msedge.exe	86
PID 1668 wrote to memory of 3132	1668	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/redirect?event=backstage_event&redir_token=QUFFLUhqbWR4TlBCa2Z4UjZDcWVESmJwcS1zWXJXTF8wZ3xBQ3Jtc0tsenF4LUpxV25MeGNlZlFEcHVqX1pHM3hrY0FDbUN3Y3pWajIzUllwV0g5X2hta3B2dEJTV3BzSmp5QVUwazBFeWR4TVRQYTNoMWlXMlpiaDRKRFBQWUIyMThWbWozWUsxd1FGMHBseVE3TjUzV2hhcw&q=https%3A%2F%2Fwww.dropbox.com%2Fscl%2Ffi%2Frlx6kz3gzrwup8laoyijg%2FAdobe-A-tivator.rar%3Frlkey%3Diui2ku44r3td0rvm46r0pbvw5%26st%3D4ua9ggn4%26dl%3D1
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xd8,0x100,0x104,0xe4,0x108,0x7ff82f8846f8,0x7ff82f884708,0x7ff82f884718
  2⤵
  PID:224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1932,15117843335250078076,17591947520713463577,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2020 /prefetch:2
  2⤵
  PID:4524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1932,15117843335250078076,17591947520713463577,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2508 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1932,15117843335250078076,17591947520713463577,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2752 /prefetch:8
  2⤵
  PID:3132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,15117843335250078076,17591947520713463577,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
  2⤵
  PID:3160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,15117843335250078076,17591947520713463577,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3392 /prefetch:1
  2⤵
  PID:4240
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1932,15117843335250078076,17591947520713463577,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5204 /prefetch:8
  2⤵
  PID:216
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1932,15117843335250078076,17591947520713463577,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5204 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,15117843335250078076,17591947520713463577,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4788 /prefetch:1
  2⤵
  PID:4632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,15117843335250078076,17591947520713463577,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5324 /prefetch:1
  2⤵
  PID:2748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,15117843335250078076,17591947520713463577,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4080 /prefetch:1
  2⤵
  PID:1080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,15117843335250078076,17591947520713463577,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:4492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,15117843335250078076,17591947520713463577,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5356 /prefetch:1
  2⤵
  PID:4108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,15117843335250078076,17591947520713463577,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5752 /prefetch:1
  2⤵
  PID:1936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,15117843335250078076,17591947520713463577,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,15117843335250078076,17591947520713463577,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5276 /prefetch:1
  2⤵
  PID:1768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,15117843335250078076,17591947520713463577,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5696 /prefetch:1
  2⤵
  PID:1352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1932,15117843335250078076,17591947520713463577,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5488 /prefetch:8
  2⤵
  PID:4608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1932,15117843335250078076,17591947520713463577,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=3372 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:4464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,15117843335250078076,17591947520713463577,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4260 /prefetch:1
  2⤵
  PID:4068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,15117843335250078076,17591947520713463577,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:3900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,15117843335250078076,17591947520713463577,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3436 /prefetch:1
  2⤵
  PID:1696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1932,15117843335250078076,17591947520713463577,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1972 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,15117843335250078076,17591947520713463577,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6712 /prefetch:1
  2⤵
  PID:4596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=1932,15117843335250078076,17591947520713463577,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6452 /prefetch:8
  2⤵
  PID:2332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1932,15117843335250078076,17591947520713463577,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6656 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3220

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2376

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:700

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:732

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1652

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3396

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Ransomware-master\Ransomware-master\etc\Ransomware.Locky\Locky~\" -ad -an -ai#7zMap25973:178:7zEvent21002
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1724

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Ransomware-master\Ransomware-master\etc\Ransomware.Locky\" -an -ai#7zMap22543:178:7zEvent17389
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3464

C:\Users\Admin\Downloads\Ransomware-master\Ransomware-master\etc\Ransomware.Cerber\cerber.exe
"C:\Users\Admin\Downloads\Ransomware-master\Ransomware-master\etc\Ransomware.Cerber\cerber.exe"
1⤵
- Drops startup file
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4648
- C:\Windows\SysWOW64\netsh.exe
  C:\Windows\system32\netsh.exe advfirewall set allprofiles state on
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:1832
- C:\Windows\SysWOW64\netsh.exe
  C:\Windows\system32\netsh.exe advfirewall reset
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:2780
- C:\Windows\SysWOW64\mshta.exe
  "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\_R_E_A_D___T_H_I_S___3PAU_.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1520
- C:\Windows\SysWOW64\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\_R_E_A_D___T_H_I_S___07YT7K5_.txt
  2⤵
  - System Location Discovery: System Language Discovery
  - Opens file in notepad (likely ransom note)
  PID:1092
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2248
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im "cerber.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:968
- - C:\Windows\SysWOW64\PING.EXE
    ping -n 1 127.0.0.1
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:2180

C:\Users\Admin\Downloads\Ransomware-master\Ransomware-master\etc\Ransomware.Cerber\cerber.exe
"C:\Users\Admin\Downloads\Ransomware-master\Ransomware-master\etc\Ransomware.Cerber\cerber.exe"
1⤵
PID:3176

C:\Users\Admin\Downloads\Ransomware-master\Ransomware-master\etc\Ransomware.Cerber\cerber.exe
"C:\Users\Admin\Downloads\Ransomware-master\Ransomware-master\etc\Ransomware.Cerber\cerber.exe"
1⤵
PID:1788

C:\Users\Admin\Downloads\Ransomware-master\Ransomware-master\etc\Ransomware.Cerber\cerber.exe
"C:\Users\Admin\Downloads\Ransomware-master\Ransomware-master\etc\Ransomware.Cerber\cerber.exe"
1⤵
PID:4364

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Network Service Discovery

T1046

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d7114a6cd851f9bf56cf771c37d664a2

SHA1
769c5d04fd83e583f15ab1ef659de8f883ecab8a

SHA256
d2c75c7d68c474d4b8847b4ba6cfd09fe90717f46dd398c86483d825a66e977e

SHA512
33bdae2305ae98e7c0de576de5a6600bd70a425e7b891d745cba9de992036df1b3d1df9572edb0f89f320e50962d06532dae9491985b6b57fd37d5f46f7a2ff8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
719923124ee00fb57378e0ebcbe894f7

SHA1
cc356a7d27b8b27dc33f21bd4990f286ee13a9f9

SHA256
aa22ab845fa08c786bd3366ec39f733d5be80e9ac933ed115ff048ff30090808

SHA512
a207b6646500d0d504cf70ee10f57948e58dab7f214ad2e7c4af0e7ca23ce1d37c8c745873137e6c55bdcf0f527031a66d9cc54805a0eac3678be6dd497a5bbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
098af1ff57cb35a25a0149ba2fe0302c

SHA1
b56bc2bb19af2367fd3e552c66e96c249af6c706

SHA256
0384a4add30d1d33b6d948860e7915cf3901df796e11a0f1000f17581df8bf54

SHA512
6e80fdba26741e36ac6e9d0affdec426becfc1b5698ed27ca92cbe42c7880ca7e60aabac4cc9b820bb7464dfe02254e274b0bc3069e6e07a9e3ed142b43e14e4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
f094bb0bfd46348a52a24350005f009e

SHA1
52bf61da72f9bf761c1bdf95dbbb7f388d6abed2

SHA256
8f1c504088962a6127d5e5f869ee8321664d0eb44ede7a136445acf10b144118

SHA512
e2ead0aed3e4cd6b7c44190ba6d684467041fc592dbdacb5682947434339e7e2962eb7802e101ffa265e7c23f8bd2d4654bcd7b7f718340503b5d001a1f47654

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
c874b5fb41e90815593528d021849f18

SHA1
24d8c0960296c5771c4bef0d175d99c615641079

SHA256
4e05174e2e494503a46d57094d2aa67741393a670ea0f1e842d0a59f20b212e7

SHA512
32d21b5682a73c06a74d939c64b4181d4716b8d5cd2eb33ef66aa534297a4b3a05296b6b673e965bfd3bdf2c4e262962652dd0d794b0c0ef75a7feb2e3597c6e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
2682069549af7566c087b0638cbad7da

SHA1
413ea369c9c5063c3fe2e4f632c03526a1197e54

SHA256
3409ff3b5300575821112cba3bf6520e09e38b9750691ded92cce6f777850cf8

SHA512
6ee2104ab025059738540b02473956324c06eb7cf0233b638ec42174217a1ec16c356e017762888a77a710cb5f1832c98966dec71c03ac426ab9298d427f342d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
f98b8720c714fd7046db8c51b7143e57

SHA1
9728e6275334546548fc5950b5c906ba8a5f1f2d

SHA256
3179363998ef533e366b2cd927e401f676b0e00f1ca8d249cea323f1f916093b

SHA512
93479a1c23d866b4c836d871cf5d7ab5df841e2f3bb824f47fa6a846c64e07e59596ca81bda6c58005b31fb395f7364805e736c4980806cc8477829fcb9e27c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
9eb6dc89e23d35642049c401db12bfda

SHA1
15eb97f1ae9dd628f657ee07b5c2d45d96fcb9e2

SHA256
58cab3ec1f03a92e8c94792441700ae58060c99d73fe2957782079b40c9cc47b

SHA512
afeabf181448e9c88681ec92d35dbbc4320a9a480c550e2f29713984eca5416478d20689c28bf5c49dfce459cca90046b360af7fc87ea4b7a0854295dba2876f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5193c7d5e473d6595f943f12278d4a7f

SHA1
eb547b2bcca57214aec4565c623bfa8fe6cc56a2

SHA256
95e2d342b44d4706f182dc7cc4b3f910ceec7bea684caac85dd765b829d5a370

SHA512
594af268b2893c9a7f02d2e507d5037e2665c6c82980fc1d672a61ef28709faeed769686ca74750e817f2f9d51566b8c747bf73af5ad15c3dbe29af0fb1e5a90

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
fc0270d2b89a602303caffa32109912b

SHA1
bc9b4de34347bd849fa7f51f8f779eb182c53d4a

SHA256
d3112782b9f7c89183d99c546251be717b0e56c3a8b91ce25b02444a7a38c2fe

SHA512
d7c9cf2ab82823f00beb2db7fb60297bcd98e86300f573b291a9be9212fca770cd6d2c79c11070f9f68854f54e95ae3e5f260eab3225f68affef8141238df3bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
86f04237b6aeedc3e008a92c15fe0038

SHA1
cc97138a2ca674a898d13c037773754b836fef73

SHA256
fb4c34e8ab66e4073fd10b6b59ea53b43c3214ab510c9ed2d5a2f2b710b6f1fe

SHA512
3c38976d410e97d95f379540dc49de1a8d713c9ff61daec1297ac87d8a23ea35375b48fd520fbaaf4065f04cd82fd9a84f9aa15b6e82afe587a81b3c7ac80d23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
07ecec4ee72ba09184ff2298b75b93b5

SHA1
5841952a1ddc8bb2459b28827f187404d4ff8a42

SHA256
9350721fc0ec4efb39ee359adcb3e5c925026b06e9f382ea3bfd7d1d57e57cf1

SHA512
f56aec215d4d81d66a52016b8ef2f0bc400396692f336ebebd21ef6287ebc54d1ff0239060f1c3ef31fd637c9d5482f2eec683051b0caf9fba2b850a0c5ccb05

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d33b097b62225f5bd58edf6594b9d779

SHA1
534eda5e37267bd72a9e8ae5097dae71913c8b63

SHA256
7359246895d1712373ebc44c05b6a6de1b91422600eb8095948dac53e5c973cf

SHA512
b87e4546eb6e097b238dbd687de5cd118de8251025d204b21366da2e5d16503f5ac0245d38bdac0f5a6d414d4a507ae24b37766c3a2ca59a61bfcc119ca4010b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
acc25482647dbdea276ea6b8d401bcd7

SHA1
8f57dcf301ecd836e65ad8f4969def5ce2f0ba75

SHA256
50cb30d460db782a7557a4d0412fd72a7c13ae1781fe07a9cd7d75246e69ee15

SHA512
31f678cdf5d7bf7ca4a15d7a6ab308514f62d584f2852a2c738e8106bd240b2feb1e2042ca7ed2081b785e2a9ba4d35f0fadf74c9246ed00bf01f4b8d153833a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
e100ba0b5e59567b1f483b74f4a9306d

SHA1
7cbfc67a650095b26b149d537791b47a9899f344

SHA256
a35b0fe34da0de9c3d6cccd741d94c9b7d815451ba80d7c2aacda6fe8d195d29

SHA512
7d22e07a5220ff7aae1ec302c1e71da292a8cf457754a2c342a523ba63230a5a01a3b36835704c334b4557205d5a47745d17bb90d278037825de4eb699a80edd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
4d4af2e9aacc4fb5a61c05033a0927a0

SHA1
8aba4589a9ea59bf9a52ace7eba06fee6210a510

SHA256
151f03ffe5aece0c2b2154762429278faed7040018721b44493835c680751f0b

SHA512
f8e52f2528a79fc356e39ff2d42339bfde9a3132b52067fe2867af32ec48e609a56524ba86312215db0e30d4eabffec081506e93fb01f55ad342766e52eba586

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
3eab0b8092669fcfccc2cdf9392e238c

SHA1
ea07349b63411b70413c5fbd8cb3e3aba525d156

SHA256
5ef09eebb3a4df0cf5a38bbd5f8c1cda0aa66fa99d3689060dd619cfcf68f230

SHA512
b6d098f444c957438224781316dc6eb6eae28aa4073e5ce7fba834ee6c6800681d6b9276712183919b23b1289954095f2a071157f416e6c7a12bb5b6c00dbab4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
1536bbbeb7d5dbd736d87f90eed2ea25

SHA1
dc330c8e63a02cb6d877ac35aed6596fe6c192ac

SHA256
5ebff81c7e71bb81bd12e919ec91fffd7fadfaaefcc8127807d25bfd64cc1069

SHA512
7632eb935758a7cc0e5b7613179b5875a441c95ce245f7f3d20fdad0ced4e16c6f6c351a958c416125e14ef3f121f96f552a9ff6d8c065fd3a4219719011e4df

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
f6afd0ee2524d3b5c8219164f2add4f0

SHA1
04449fcf869fc889813b7323e3acc4c80cbb200b

SHA256
ff4e9739648c1b6a418165fcf7ae100ca0af442abc40d44d5d6d953f2cd6085b

SHA512
d451d7a1a3fbdeaf7e52d32ce123ea0d19a2c2dda09a023f863f9f88df3c2071dd7d7c9ecc248eae80ad8b70a5171ef9591958182861dcd975b82a6844508f38

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
ce836397cbf04600e3a07acd1d3789fd

SHA1
f1fd743a104e77e3e172e26a1e8d2421ac3f9934

SHA256
6dad67887e5f9775765ba3ddcdb87f0d4dfa33802e4fbb94585946a2ca2c4c65

SHA512
28e2f4e7ce6797241266b8c4edcd02115d60e684d7d6994fe666ed19d67b3601490b38a0389871235d222fdae7cf22fb46749d9004c9d22b744099249b60d62b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
2632abd54bdec5a4431b6a17f08eebf3

SHA1
f6e3148be2a35df647f644e0656d2cb5fd21375e

SHA256
5d27b9851969802dd78c66de11fe6b4f61b7ba3e6f843d19ec08d06b6201c470

SHA512
2a0a028fd2469842bf38a1df3cb983698c234bac9ea30a9fb21a606ec7e41ceec303ce1e4e0951f182e9302c44e233863305514c7f9c4c97d7179e9a722117ec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
390aa1c67db0b63cd713ffd52a424e6b

SHA1
2657254bf640aed216fdc922b6fe0b1db18055bc

SHA256
dde6cf86e3962e68d917743b451e324608c638c0f6494b5df2c9d0f9d7c9bb69

SHA512
845fbc950368f00736c2e034811d7d1330cea5396b111278d18231fa3effe99a59573b433d9e7b7cdffddc3b56c907abb525e79bbcb8f6f1ff534a516035b7e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
2916bc6badbc358a0b30b528d41896e5

SHA1
a5ee73cd5599844b62a27c2ddfac85420e11a1e0

SHA256
d99b8f8dbac2ca2300b44a3598eb5b1e076e82ebc3b326077512986838aa1fcd

SHA512
b0304964de5ca0debc87291a73ba4383fd4d344309d5f8d78c96ea38cc2271d09313fe6a3a9d36f35741f0e4a4daa971bb89b5c8791744e8d4db738cc60cc5b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
9916c0ccf35691d6f0778e8f574dba6b

SHA1
74cab464db4e56284f43b63b8a6796ad2b27ed3f

SHA256
d7113343d879983bbd2028c9e0540cb9c3452cb7f2cebb83df5f128a01f9a10c

SHA512
106e71b2333ab5d88d0e194361a4810fb61350e62c752efab2f93e40e09191e7b96c3cd244054abd2b7897db3cb53c623f23270aa1b861a4bbd545fc5b8be6a2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
b25c151fdcb2af6ccfda9ddaf4062666

SHA1
439cae2f2dff4bee348f699e14a519be0f77355e

SHA256
2f29e7bcb32db3f42e33c9c6d868481342f846c18789b06effae56785ae7a1d7

SHA512
8933b9645a77ebb3dccecfe70d8f82d3c19c2ed019a580de5691845ff22273b0109356920db7db18c841690b0df8f1879a68407d647cd44e75e300ba9f1efc49

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
d12c5fd1b28c044b0399fd73a493666c

SHA1
ed6103611b04dc66e2db83d6fd7b4a5a9cbb93db

SHA256
7a52121256dab2e267c4ace502ee4e436b9610c950fff5eb7d33310f41b58be4

SHA512
1af5019d43704fd857775ea595c2da4f968b50234d8ef010682213b7d73008b57c84272b6d00de11c2e81d9a83cba82a32a1d3e6bfb99ff5f9e92350ef4ec4d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57f925.TMP

Filesize
204B

MD5
a284287f95a216c56b9aeddc7e69284b

SHA1
fe281f71beb302fda00500144285737bcccf8baa

SHA256
83f42c85468ef1d34ed33ac5e93bd8f4b3b85ff0335b9a2d1c22eedaac2868bb

SHA512
0ba35d4fc5f081a3753c74cf2e530727b8cc4e7f61c3be2d15a710b810b1f26b794b5d8db237700f2ea9a2b26881b5968a95a8458f223d0b25118a789208aa92

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
5b2d588334d5a91e7d5093bedc3d34a6

SHA1
8214bf41964e259cba545b45d93030f9d652a8b5

SHA256
4263f2f2b567a4e36c4cce8cbfeec4621e071d2715c7a38cd8cc5061e84d5fd0

SHA512
43b49be75dd63ef6a3c685e10441fa4fe76f2390512dbe21effce0db1b2e50786191ce3fff939a647d06182a025e1d0817849bf516392d542a871bc3dc758bb4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
e9420e8103010f7cdf73a7bbcf8614d4

SHA1
d60079ed3d01d91a85a3c2222b7b9a6b6ad451d8

SHA256
c267dffcc8b2d135a2cd1142c727b625eb81d1ebb0b638a80b6f58306feb4dde

SHA512
c9c5a810da055ffd3ebf62140cf1fa73ac0cd9576c4ec3d7377f7aa12c5baed4a849c2d3121ae408661e6a1791c5e62b696288c155620558556b5ed83eeeebaf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
18e17e6bf9516665c6486b00ff19eb16

SHA1
141c09392cd7297e1c0e4eafe76377650a44c8a6

SHA256
6cdaab0a2754f3b13b02b1f2b02fa3f5505dc41f1f5e9456380001f4c6a3b8e5

SHA512
c01a46863644fae31aa97b55bb9c332dfb85d50bb5d61a923165d91b68028efe6ea8be265610ae0903c3a9f5d301e902017d2f945d10669d8f4d5040401540a4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\_R_E_A_D___T_H_I_S___WKMX_.txt

Filesize
1KB

MD5
51e863482c60e3b736425e79793b872c

SHA1
eb43fdaa00706de035bb7f946675c34df511e532

SHA256
9c5570b66cc6d48ec4e87011f60a34c3998d7aa8e661ed500556cf86569b8a0f

SHA512
bc48753a06bd7595e7e9f4e6e738ac7f0bca254b7069a7b1436221828a70fcb6d1b919976bbcbdfd95426dbfc33ffc36e0e6d27c9e581df7244d18a95cca75f4

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\OneNote\16.0\_R_E_A_D___T_H_I_S___28JSD_.hta

Filesize
75KB

MD5
d19c4c83da6594e03b935c2e076ae179

SHA1
de1156ec5a7b96aee28956d70a4d086e3a839551

SHA256
aff62b9be93e2ca9a18e39b29e32781bbbb8412899a91c3e09b42fd6a881d20a

SHA512
c2c12250f871cd2dc13a9e290df3e042d75ed8b77b2840f290853ee3b930a8087531cfc63501098bd0ee121fc739b35fa03080f23ac09338266a5c7032629008

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 890163.crdownload

Filesize
12.9MB

MD5
30da61eabe92b48ce784f7ee31f5ec44

SHA1
4922cfc2c10b5d92b2fb199fc6a2aaed095035e0

SHA256
2e156957ffdc73801662b89b1f6773434c4d13bb4b9bc1670827e399ad64aa7e

SHA512
648a9e6ddce09e5bf5da680f8d031afe3224b236cea9598e64e0d592f64ec0bed61e0ff089a931772d0f758a42a463e7ee6ea7ef117ad1c1453dbc2240b9f209

Download Submit
memory/3176-762-0x0000000000440000-0x0000000000451000-memory.dmp

Filesize
68KB

Download
memory/4648-773-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4648-1148-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4648-1117-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4648-769-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4648-761-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download