cerber | hxxps://github[.]com/Endermanch/MalwareDatabase/blob/master/ransomwares/

Analysis

max time kernel
282s
max time network
280s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
14-08-2024 20:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/Endermanch/MalwareDatabase/blob/master/ransomwares/

Score

10^/10

cerber defense_evasion discovery evasion persistence privilege_escalation ransomware upx

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\_R_E_A_D___T_H_I_S___GSJ6UEGA_.txt

Family

cerber

Ransom Note

Hi, I'am CRBR ENCRYPTOR ;) ----- ALL YOUR DOCUMENTS, PH0T0S, DATABASES AND OTHER IMPORTANT FILES HAVE BEEN ENCRYPTED! ----- The only one way to decrypt your files is to receive the private key and decryption program. To receive the private key and decryption program go to any decrypted folder, inside there is the special file (*_R_E_A_D___T_H_I_S_*) with complete instructions how to decrypt your files. If you cannot find any (*_R_E_A_D___T_H_I_S_*) file at your PC, follow the instructions below: ----- 1. Download "Tor Browser" from https://www.torproject.org/ and install it. 2. In the "Tor Browser" open your personal page here: http://xpcx6erilkjced3j.onion/B151-9FC2-E0D9-0098-B5ED Note! This page is available via "Tor Browser" only. ----- Also you can use temporary addresses on your personal page without using "Tor Browser". ----- 1. http://xpcx6erilkjced3j.1n5mod.top/B151-9FC2-E0D9-0098-B5ED 2. http://xpcx6erilkjced3j.19kdeh.top/B151-9FC2-E0D9-0098-B5ED 3. http://xpcx6erilkjced3j.1mpsnr.top/B151-9FC2-E0D9-0098-B5ED 4. http://xpcx6erilkjced3j.18ey8e.top/B151-9FC2-E0D9-0098-B5ED 5. http://xpcx6erilkjced3j.17gcun.top/B151-9FC2-E0D9-0098-B5ED ----- Note! These are temporary addresses! They will be available for a limited amount of time! -----

URLs

http://xpcx6erilkjced3j.onion/B151-9FC2-E0D9-0098-B5ED

http://xpcx6erilkjced3j.1n5mod.top/B151-9FC2-E0D9-0098-B5ED

http://xpcx6erilkjced3j.19kdeh.top/B151-9FC2-E0D9-0098-B5ED

http://xpcx6erilkjced3j.1mpsnr.top/B151-9FC2-E0D9-0098-B5ED

http://xpcx6erilkjced3j.18ey8e.top/B151-9FC2-E0D9-0098-B5ED

http://xpcx6erilkjced3j.17gcun.top/B151-9FC2-E0D9-0098-B5ED

Signatures

Cerber
Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.
ransomware cerber

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Users\\Admin\\Downloads\\Birele\\[email protected]"	[email protected]

Contacts a large (1113) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Modifies Windows Firewall 2 TTPs 2 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
956	netsh.exe
3588	netsh.exe

Drops startup file 1 IoCs

description	ioc	Process
File opened for modification	\??\c:\users\admin\appdata\roaming\microsoft\word\startup\	[email protected]

Impair Defenses: Safe Mode Boot 1 TTPs 5 IoCs

defense_evasion

Safe Mode Boot

T1562.009

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\ProfSvc	[email protected]
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\Power	[email protected]
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\iai2c.sys	[email protected]
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\WinDefend	[email protected]
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\UserManager	[email protected]

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/3544-745-0x0000000000400000-0x0000000000438000-memory.dmp	upx
behavioral1/memory/3544-746-0x0000000000400000-0x0000000000438000-memory.dmp	upx
behavioral1/memory/3544-750-0x0000000000400000-0x0000000000438000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Software\Microsoft\Windows\CurrentVersion\Run\system = "C:\\Users\\Admin\\Downloads\\Birele\\[email protected]"	[email protected]

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\g:	[email protected]
File opened (read-only)	\??\i:	[email protected]
File opened (read-only)	\??\j:	[email protected]
File opened (read-only)	\??\s:	[email protected]
File opened (read-only)	\??\b:	[email protected]
File opened (read-only)	\??\e:	[email protected]
File opened (read-only)	\??\m:	[email protected]
File opened (read-only)	\??\q:	[email protected]
File opened (read-only)	\??\v:	[email protected]
File opened (read-only)	\??\w:	[email protected]
File opened (read-only)	\??\z:	[email protected]
File opened (read-only)	\??\a:	[email protected]
File opened (read-only)	\??\l:	[email protected]
File opened (read-only)	\??\n:	[email protected]
File opened (read-only)	\??\r:	[email protected]
File opened (read-only)	\??\t:	[email protected]
File opened (read-only)	\??\x:	[email protected]
File opened (read-only)	\??\k:	[email protected]
File opened (read-only)	\??\o:	[email protected]
File opened (read-only)	\??\p:	[email protected]
File opened (read-only)	\??\u:	[email protected]
File opened (read-only)	\??\y:	[email protected]
File opened (read-only)	\??\h:	[email protected]

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
115	raw.githubusercontent.com
116	raw.githubusercontent.com

Drops file in System32 directory 38 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\office	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\outlook	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\word	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\excel	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft sql server	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft sql server	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\office	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\powerpoint	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\bitcoin	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\bitcoin	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\powerpoint	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\powerpoint	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\onenote	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\the bat!	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\microsoft sql server	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\office	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\excel	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\microsoft sql server	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\onenote	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\office	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\powerpoint	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\the bat!	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\excel	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\excel	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\word	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\documents	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\steam	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\outlook	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\thunderbird	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\desktop	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\word	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\onenote	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\thunderbird	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\word	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\outlook	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\steam	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\onenote	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\outlook	[email protected]

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tmpD284.bmp"	[email protected]

Drops file in Program Files directory 20 IoCs

description	ioc	Process
File opened for modification	\??\c:\program files (x86)\microsoft sql server	[email protected]
File opened for modification	\??\c:\program files (x86)\outlook	[email protected]
File opened for modification	\??\c:\program files\	[email protected]
File opened for modification	\??\c:\program files (x86)\excel	[email protected]
File opened for modification	\??\c:\program files (x86)\thunderbird	[email protected]
File opened for modification	\??\c:\program files (x86)\bitcoin	[email protected]
File opened for modification	\??\c:\program files (x86)\microsoft\office	[email protected]
File opened for modification	\??\c:\program files (x86)\microsoft\onenote	[email protected]
File opened for modification	\??\c:\program files (x86)\microsoft\powerpoint	[email protected]
File opened for modification	\??\c:\program files (x86)\microsoft\word	[email protected]
File opened for modification	\??\c:\program files (x86)\onenote	[email protected]
File opened for modification	\??\c:\program files (x86)\powerpoint	[email protected]
File opened for modification	\??\c:\program files (x86)\the bat!	[email protected]
File opened for modification	\??\c:\program files (x86)\microsoft\excel	[email protected]
File opened for modification	\??\c:\program files (x86)\word	[email protected]
File opened for modification	\??\c:\program files (x86)\microsoft\microsoft sql server	[email protected]
File opened for modification	\??\c:\program files (x86)\microsoft\outlook	[email protected]
File opened for modification	\??\c:\program files (x86)\office	[email protected]
File opened for modification	\??\c:\program files (x86)\steam	[email protected]
File opened for modification	\??\c:\program files (x86)\	[email protected]

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\bitcoin	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\excel	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\excel	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\onenote	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\word	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\localservice\desktop	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\bitcoin	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\excel	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\outlook	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\outlook	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\word	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\desktop	[email protected]
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\excel	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\office	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\outlook	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\word	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\steam	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\thunderbird	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\onenote	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\onenote	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\outlook	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\outlook	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\steam	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\the bat!	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft sql server	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\powerpoint	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\steam	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\the bat!	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\localservice\documents	[email protected]
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File opened for modification	\??\c:\windows\	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\outlook	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\powerpoint	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\office	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\powerpoint	[email protected]
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdge.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\excel	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\word	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\office	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\onenote	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\steam	[email protected]
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\excel	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\microsoft sql server	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\outlook	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\word	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\the bat!	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\office	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\office	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\bitcoin	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\office	[email protected]
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\microsoft sql server	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\onenote	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\powerpoint	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\powerpoint	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\thunderbird	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\bitcoin	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft sql server	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\onenote	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\word	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\documents	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\excel	[email protected]

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NOTEPAD.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3508	cmd.exe
4100	PING.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Kills process with taskkill 2 IoCs

evasion

pid	Process
4336	taskkill.exe
4704	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133681427714918552"	chrome.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\Total\ = "124"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Privacy\ClearBrowsingHistoryOnStart = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\EdpDomStorage\bing.com	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\www.bing.com\ = "0"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3\{A8A88C49-5EB2-4990-A1A2-087602 = 1a3761592352350c7a5f20172f1e1a190e2b017313371312141a152a	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Cookies	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = acf4f2ce8ceeda01	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = ae559bca8ceeda01	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Extensible Cache	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Explorer	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\LastClosedHeight = "599"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\Total\ = "1867"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = cde166ca8ceeda01	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\CIStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\EdpDomStorage\Total	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\bing.com\Total = "23"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = ecf479ca8ceeda01	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 0957f5ce8ceeda01	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\Total	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DummyPath	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionLow = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VersionHigh = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionHigh = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 483156ca8ceeda01	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus\DynamicCodePolicy = 00000000	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\bing.com\NumberOfSubdomains = "1"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Revision = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Content	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\EdpDomStorage	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\History	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DummyPath\dummySetting = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\TreeView = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3\{AEBA21FA-782A-4A90-978D-B72164 = 1a3761592352350c7a5f20172f1e1a190e2b017313371312141a152a	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\DisallowDefaultBrowserPrompt = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\EdpDomStorage\bing.com\NumberOfSubdomain = "0"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DXFeatureLevel = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListDOSTime = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\ACGStatus	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = faa6e4ce8ceeda01	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore\LastCleanup = 1cad88d38ceeda01	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-SubSysId = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\Main	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\bing.com\Total = "6033"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\IETld\LowMic	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-Revision = "0"	MicrosoftEdge.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
868	NOTEPAD.EXE

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4100	PING.EXE

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2540	chrome.exe
2540	chrome.exe
2040	chrome.exe
2040	chrome.exe

Suspicious behavior: MapViewOfSection 8 IoCs

pid	Process
4992	MicrosoftEdgeCP.exe
4992	MicrosoftEdgeCP.exe
4992	MicrosoftEdgeCP.exe
4992	MicrosoftEdgeCP.exe
4992	MicrosoftEdgeCP.exe
4992	MicrosoftEdgeCP.exe
4992	MicrosoftEdgeCP.exe
4992	MicrosoftEdgeCP.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3556	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	3556	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	3556	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	3556	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	168	MicrosoftEdge.exe
Token: SeDebugPrivilege	168	MicrosoftEdge.exe
Token: SeShutdownPrivilege	2540	chrome.exe
Token: SeCreatePagefilePrivilege	2540	chrome.exe
Token: SeShutdownPrivilege	2540	chrome.exe
Token: SeCreatePagefilePrivilege	2540	chrome.exe
Token: SeShutdownPrivilege	2540	chrome.exe
Token: SeCreatePagefilePrivilege	2540	chrome.exe
Token: SeShutdownPrivilege	2540	chrome.exe
Token: SeCreatePagefilePrivilege	2540	chrome.exe
Token: SeShutdownPrivilege	2540	chrome.exe
Token: SeCreatePagefilePrivilege	2540	chrome.exe
Token: SeShutdownPrivilege	2540	chrome.exe
Token: SeCreatePagefilePrivilege	2540	chrome.exe
Token: SeShutdownPrivilege	2540	chrome.exe
Token: SeCreatePagefilePrivilege	2540	chrome.exe
Token: SeShutdownPrivilege	2540	chrome.exe
Token: SeCreatePagefilePrivilege	2540	chrome.exe
Token: SeShutdownPrivilege	2540	chrome.exe
Token: SeCreatePagefilePrivilege	2540	chrome.exe
Token: SeShutdownPrivilege	2540	chrome.exe
Token: SeCreatePagefilePrivilege	2540	chrome.exe
Token: SeShutdownPrivilege	2540	chrome.exe
Token: SeCreatePagefilePrivilege	2540	chrome.exe
Token: SeShutdownPrivilege	2540	chrome.exe
Token: SeCreatePagefilePrivilege	2540	chrome.exe
Token: SeShutdownPrivilege	2540	chrome.exe
Token: SeCreatePagefilePrivilege	2540	chrome.exe
Token: SeShutdownPrivilege	2540	chrome.exe
Token: SeCreatePagefilePrivilege	2540	chrome.exe
Token: SeShutdownPrivilege	2540	chrome.exe
Token: SeCreatePagefilePrivilege	2540	chrome.exe
Token: SeShutdownPrivilege	2540	chrome.exe
Token: SeCreatePagefilePrivilege	2540	chrome.exe
Token: SeShutdownPrivilege	2540	chrome.exe
Token: SeCreatePagefilePrivilege	2540	chrome.exe
Token: SeShutdownPrivilege	2540	chrome.exe
Token: SeCreatePagefilePrivilege	2540	chrome.exe
Token: SeShutdownPrivilege	2540	chrome.exe
Token: SeCreatePagefilePrivilege	2540	chrome.exe
Token: SeShutdownPrivilege	2540	chrome.exe
Token: SeCreatePagefilePrivilege	2540	chrome.exe
Token: SeShutdownPrivilege	2540	chrome.exe
Token: SeCreatePagefilePrivilege	2540	chrome.exe
Token: SeShutdownPrivilege	2540	chrome.exe
Token: SeCreatePagefilePrivilege	2540	chrome.exe
Token: SeShutdownPrivilege	2540	chrome.exe
Token: SeCreatePagefilePrivilege	2540	chrome.exe
Token: SeShutdownPrivilege	2540	chrome.exe
Token: SeCreatePagefilePrivilege	2540	chrome.exe
Token: SeShutdownPrivilege	2540	chrome.exe
Token: SeCreatePagefilePrivilege	2540	chrome.exe
Token: SeShutdownPrivilege	2540	chrome.exe
Token: SeCreatePagefilePrivilege	2540	chrome.exe
Token: SeShutdownPrivilege	2540	chrome.exe
Token: SeCreatePagefilePrivilege	2540	chrome.exe
Token: SeShutdownPrivilege	2540	chrome.exe
Token: SeCreatePagefilePrivilege	2540	chrome.exe
Token: SeShutdownPrivilege	2540	chrome.exe
Token: SeCreatePagefilePrivilege	2540	chrome.exe

Suspicious use of FindShellTrayWindow 56 IoCs

pid	Process
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
4264	7zG.exe
708	7zG.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe

Suspicious use of SetWindowsHookEx 11 IoCs

pid	Process
168	MicrosoftEdge.exe
4992	MicrosoftEdgeCP.exe
3556	MicrosoftEdgeCP.exe
4992	MicrosoftEdgeCP.exe
2936	MicrosoftEdgeCP.exe
168	MicrosoftEdge.exe
168	MicrosoftEdge.exe
168	MicrosoftEdge.exe
168	MicrosoftEdge.exe
168	MicrosoftEdge.exe
168	MicrosoftEdge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4992 wrote to memory of 3560	4992	MicrosoftEdgeCP.exe	77
PID 4992 wrote to memory of 3560	4992	MicrosoftEdgeCP.exe	77
PID 4992 wrote to memory of 3560	4992	MicrosoftEdgeCP.exe	77
PID 4992 wrote to memory of 708	4992	MicrosoftEdgeCP.exe	88
PID 4992 wrote to memory of 708	4992	MicrosoftEdgeCP.exe	88
PID 4992 wrote to memory of 708	4992	MicrosoftEdgeCP.exe	88
PID 4992 wrote to memory of 708	4992	MicrosoftEdgeCP.exe	88
PID 4992 wrote to memory of 708	4992	MicrosoftEdgeCP.exe	88
PID 4992 wrote to memory of 708	4992	MicrosoftEdgeCP.exe	88
PID 2540 wrote to memory of 4792	2540	chrome.exe	91
PID 2540 wrote to memory of 4792	2540	chrome.exe	91
PID 2540 wrote to memory of 1852	2540	chrome.exe	93
PID 2540 wrote to memory of 1852	2540	chrome.exe	93
PID 2540 wrote to memory of 1852	2540	chrome.exe	93
PID 2540 wrote to memory of 1852	2540	chrome.exe	93
PID 2540 wrote to memory of 1852	2540	chrome.exe	93
PID 2540 wrote to memory of 1852	2540	chrome.exe	93
PID 2540 wrote to memory of 1852	2540	chrome.exe	93
PID 2540 wrote to memory of 1852	2540	chrome.exe	93
PID 2540 wrote to memory of 1852	2540	chrome.exe	93
PID 2540 wrote to memory of 1852	2540	chrome.exe	93
PID 2540 wrote to memory of 1852	2540	chrome.exe	93
PID 2540 wrote to memory of 1852	2540	chrome.exe	93
PID 2540 wrote to memory of 1852	2540	chrome.exe	93
PID 2540 wrote to memory of 1852	2540	chrome.exe	93
PID 2540 wrote to memory of 1852	2540	chrome.exe	93
PID 2540 wrote to memory of 1852	2540	chrome.exe	93
PID 2540 wrote to memory of 1852	2540	chrome.exe	93
PID 2540 wrote to memory of 1852	2540	chrome.exe	93
PID 2540 wrote to memory of 1852	2540	chrome.exe	93
PID 2540 wrote to memory of 1852	2540	chrome.exe	93
PID 2540 wrote to memory of 1852	2540	chrome.exe	93
PID 2540 wrote to memory of 1852	2540	chrome.exe	93
PID 2540 wrote to memory of 1852	2540	chrome.exe	93
PID 2540 wrote to memory of 1852	2540	chrome.exe	93
PID 2540 wrote to memory of 1852	2540	chrome.exe	93
PID 2540 wrote to memory of 1852	2540	chrome.exe	93
PID 2540 wrote to memory of 1852	2540	chrome.exe	93
PID 2540 wrote to memory of 1852	2540	chrome.exe	93
PID 2540 wrote to memory of 1852	2540	chrome.exe	93
PID 2540 wrote to memory of 1852	2540	chrome.exe	93
PID 2540 wrote to memory of 1852	2540	chrome.exe	93
PID 2540 wrote to memory of 1852	2540	chrome.exe	93
PID 2540 wrote to memory of 1852	2540	chrome.exe	93
PID 2540 wrote to memory of 1852	2540	chrome.exe	93
PID 2540 wrote to memory of 1852	2540	chrome.exe	93
PID 2540 wrote to memory of 1852	2540	chrome.exe	93
PID 2540 wrote to memory of 1852	2540	chrome.exe	93
PID 2540 wrote to memory of 1852	2540	chrome.exe	93
PID 2540 wrote to memory of 4316	2540	chrome.exe	94
PID 2540 wrote to memory of 4316	2540	chrome.exe	94
PID 2540 wrote to memory of 1648	2540	chrome.exe	95
PID 2540 wrote to memory of 1648	2540	chrome.exe	95
PID 2540 wrote to memory of 1648	2540	chrome.exe	95
PID 2540 wrote to memory of 1648	2540	chrome.exe	95
PID 2540 wrote to memory of 1648	2540	chrome.exe	95
PID 2540 wrote to memory of 1648	2540	chrome.exe	95
PID 2540 wrote to memory of 1648	2540	chrome.exe	95
PID 2540 wrote to memory of 1648	2540	chrome.exe	95
PID 2540 wrote to memory of 1648	2540	chrome.exe	95
PID 2540 wrote to memory of 1648	2540	chrome.exe	95
PID 2540 wrote to memory of 1648	2540	chrome.exe	95
PID 2540 wrote to memory of 1648	2540	chrome.exe	95
PID 2540 wrote to memory of 1648	2540	chrome.exe	95

C:\Windows\system32\LaunchWinApp.exe
"C:\Windows\system32\LaunchWinApp.exe" "https://github.com/Endermanch/MalwareDatabase/blob/master/ransomwares/"
1⤵
PID:3060

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:168

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:4976

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4992

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3556

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:3560

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2936

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:1108

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:4452

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:2360

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:708

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2540
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ff862269758,0x7ff862269768,0x7ff862269778
  2⤵
  PID:4792
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1532 --field-trial-handle=1808,i,13867024816727279508,2367550324017339111,131072 /prefetch:2
  2⤵
  PID:1852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1844 --field-trial-handle=1808,i,13867024816727279508,2367550324017339111,131072 /prefetch:8
  2⤵
  PID:4316
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2012 --field-trial-handle=1808,i,13867024816727279508,2367550324017339111,131072 /prefetch:8
  2⤵
  PID:1648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2876 --field-trial-handle=1808,i,13867024816727279508,2367550324017339111,131072 /prefetch:1
  2⤵
  PID:1984
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2888 --field-trial-handle=1808,i,13867024816727279508,2367550324017339111,131072 /prefetch:1
  2⤵
  PID:3312
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4432 --field-trial-handle=1808,i,13867024816727279508,2367550324017339111,131072 /prefetch:1
  2⤵
  PID:4236
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4640 --field-trial-handle=1808,i,13867024816727279508,2367550324017339111,131072 /prefetch:1
  2⤵
  PID:4488
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2620 --field-trial-handle=1808,i,13867024816727279508,2367550324017339111,131072 /prefetch:8
  2⤵
  PID:516
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3864 --field-trial-handle=1808,i,13867024816727279508,2367550324017339111,131072 /prefetch:8
  2⤵
  PID:3564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3024 --field-trial-handle=1808,i,13867024816727279508,2367550324017339111,131072 /prefetch:8
  2⤵
  PID:5024
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=3712 --field-trial-handle=1808,i,13867024816727279508,2367550324017339111,131072 /prefetch:1
  2⤵
  PID:4140
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2044 --field-trial-handle=1808,i,13867024816727279508,2367550324017339111,131072 /prefetch:8
  2⤵
  PID:5100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3740 --field-trial-handle=1808,i,13867024816727279508,2367550324017339111,131072 /prefetch:8
  2⤵
  PID:3728
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5336 --field-trial-handle=1808,i,13867024816727279508,2367550324017339111,131072 /prefetch:8
  2⤵
  PID:4208
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5516 --field-trial-handle=1808,i,13867024816727279508,2367550324017339111,131072 /prefetch:8
  2⤵
  PID:656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5676 --field-trial-handle=1808,i,13867024816727279508,2367550324017339111,131072 /prefetch:8
  2⤵
  PID:4948
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4828 --field-trial-handle=1808,i,13867024816727279508,2367550324017339111,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2040

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:5116

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
PID:1020

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3376

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\" -an -ai#7zMap15908:78:7zEvent25423
1⤵
- Suspicious use of FindShellTrayWindow
PID:4264

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\" -an -ai#7zMap21256:78:7zEvent12151
1⤵
- Suspicious use of FindShellTrayWindow
PID:708

C:\Users\Admin\Downloads\Cerber 5\[email protected]
"C:\Users\Admin\Downloads\Cerber 5\[email protected]"
1⤵
- Drops startup file
- Enumerates connected drives
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2912
- C:\Windows\SysWOW64\netsh.exe
  C:\Windows\system32\netsh.exe advfirewall set allprofiles state on
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:956
- C:\Windows\SysWOW64\netsh.exe
  C:\Windows\system32\netsh.exe advfirewall reset
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:3588
- C:\Windows\SysWOW64\mshta.exe
  "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\_R_E_A_D___T_H_I_S___0DLMN_.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
  2⤵
  - System Location Discovery: System Language Discovery
  PID:800
- C:\Windows\SysWOW64\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\_R_E_A_D___T_H_I_S___WNST4Q66_.txt
  2⤵
  - System Location Discovery: System Language Discovery
  - Opens file in notepad (likely ransom note)
  PID:868
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /d /c taskkill /f /im "E" > NUL & ping -n 1 127.0.0.1 > NUL & del "C" > NUL && exit
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:3508
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im "E"
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:4704
- - C:\Windows\SysWOW64\PING.EXE
    ping -n 1 127.0.0.1
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:4100

C:\Users\Admin\Downloads\Birele\[email protected]
"C:\Users\Admin\Downloads\Birele\[email protected]"
1⤵
- Modifies WinLogon for persistence
- Impair Defenses: Safe Mode Boot
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:3544
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM explorer.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  PID:4336

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Safe Mode Boot

T1562.009

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Network Service Discovery

T1046

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
e7cc4b4854329d3b449cad5d71af1275

SHA1
9c72a80b93b78f8b50eff402b53dd9f8fd871c7d

SHA256
725b3444ac57c0c595a3a14e9252ecc84f74af6d20a4d642be7a981efc6e7d30

SHA512
a94660fb11ac538f44a5fa3b780686e0e53cd7b607f6531ca82c7f46bd374361679c4e8feca26bc0e6d8f217af16bbe823c761f8e26eb2b9d265e2239266f6d4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1018B

MD5
8327df760f732cebbad6b18c5b07d09b

SHA1
50588f717482bc5e4491f295174a2ea0b12d59ac

SHA256
cc55da2e7fdd990c6b5fd64cc07f44b659ab3c4cff07d8bf920f6d925a34e247

SHA512
31d17391d2521e42f4f5531381c5a0580232b98888d41206ec1c7a2ebc8cd947822f36f286645f0258b05c446fe124d2ee7dfb33852ec375fd7bed71f4180059

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
d43d2793d5502075b3340a9c3425b425

SHA1
4077db9123029854bbe26b8e7b7c1b071c920cba

SHA256
57c1deb20eab7b4fb4a0624fa9b4362c3f6fd0d2a8a83f5bcf3679494632ad0c

SHA512
821c6ccb7382b861d38b121051e16defca1b02d139b026785c56f9df1afe8deeac1b53df36c7f8189ebe5676df4c7a1f656bdaee23a978071c7b56adee2e28f7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
81492cf4a1cf0458b608671fd9795f21

SHA1
4e71bcb33bd252b8f4c09607c2b4ede010aaa753

SHA256
b4aaa736f26fd02f18452fb5ae6dd7f6dcd104dc68206d98abb34049d1d7fce0

SHA512
7242a08a3eb57e2f12486ec6909a60d6c2e2209113346cc8c8faa7c1d29151fc8868ef86d01f2aceb216ced1138d71db6407cc7b44568e10e9c1aa0c5888049e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
70ade28d98e63d48d03100ce95f3b702

SHA1
4f469545320329d3907d2fb98899254a6bed3d7c

SHA256
6c3313b1ded2475d0b3c1c78ebfabb572543aea07d3a14e4f590a56e06f625e4

SHA512
e6e056142cefad8ef4eb44f0565e3169f1ddf174573cb406f08d6ed018c02b752cb6d57fdc6179989b817546e77cf75989b0d95f6764d2f2e4102627ec4f62dc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
7e09ffd136e067a6662b128c7bab7e2e

SHA1
f837a17479813113f4e2efe0323021b25668a942

SHA256
9434e1873a8194a0da1602a0f2071a2e79485bd4bc167d4b90dac1144ab89c93

SHA512
464a7cdb2cdf97e3d79cbbf8594d75158ee37bf0d22310d7db8a9f885f23b8b879daf3726fc8209ed286b2d8e4f445f8a49c1051dd1467180c310651277e301a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
497d0264c60a95c6063d1787705068cc

SHA1
157c0ec15f89507bfd6b83a4821b3f012dd24932

SHA256
6f455d799e3b165bf102b5253de012e130ffc26d168b8ffbd9162b9a5c2b6d1e

SHA512
f180b0fc66444b5f7db1fbd30021b78a5653c839f246f25201058621c6074a1cb853051e7b97a167e033f4f6bf451954a87eb66aee470f18a1b40aaf3d6829eb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
5d43f2216c51f7f1429d3d805f49a7ad

SHA1
86e9a59c403b66aba824eb29b7069a5e806f089a

SHA256
ff77ddabf8fe30886dfbbf79e648942576369cac9dfa1037b14726e1b6d2517e

SHA512
c93b1adfbd608a57152e6832c7229709d759f60a9cbe41bf1ece1e5ffc9275c90379a8e51082d9abb203648bdc181028e97a9e524a62939d1d3ba18c6f1ebb84

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
7c3834af33eec79054a915042f65ef72

SHA1
dc3a3312393ce210d821e4faf2ca68ca6e907ba8

SHA256
3a3909df2893297fad1caf0813943a48f8714a96af0aa75be6d6ba6dfe2abe0c

SHA512
8219ee3b8fb3d064d745effb01c9b267198ac483f46bdff88e45e5bcb64ff564555bf2f5a25a8b86e56cd2cef1dbab375578d5b6129c475cce7c016ff45c7ce3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
5687b7d9c83df57aad15debe8e0934e2

SHA1
1f6af28c2400286b3c230719d68e39ee865b5147

SHA256
7fa4698720b87be6d87a8d341ac81abbe4e0cfc952cb9726bd3e6568604592ce

SHA512
3eb5e6e1923e5eb9eee554fa8ddef75d7df18a513edbf04cdd842c0b0b7e329e16f6135478c13fd12997a8bd8a6616a087dd04b8452e66a9fa38e5c0d3fcb7c6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
b52525f2a24ac1592786914ddf85ceed

SHA1
5877123bda6e1151f296316a66b7de6ff83d627a

SHA256
272dd3bed899f3f4ae6eee744d7a271b13be59d6e74c62f4d73f4ed6df85bc46

SHA512
06d80309bea7465422556b7aaddad0f4f9ede512a3e1066b03b8e164d7055779c7ef776ddc84d5e47fc07d70f9d125da94ee0c922ca6dd17742178cd8fd8e216

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
b5162f52162cfe1868d2964996ccecea

SHA1
c65afc2920a866445a4917da07df59bce0d6ebf1

SHA256
841f2bfa8500ea2826a7437efbf7bfe8b3bc5f46c98923a3d306f908ed492af4

SHA512
d79bf7a66685cf9b66650e3c01343809a565843893455d28ce494112fd5e272857af3e41ff6b331548a167f25fc21bfbb2c723aa2073b8a50de727df8e7331df

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
976f7f71cbd528604f21d9f072be454d

SHA1
2482799b55ee6fd112724afc95a741ab918a5a1f

SHA256
8aa4657760dd4388a49924e0479c366dd4c4cc8e05b4c846cb8c6eb8e2565504

SHA512
d457608519c84e49af59f451db3f6262dfb92c2578f8df478cf947f63ae3f2340c0b0e9f028e39e177cee4852c69f92e209701508f84491df6ca74506fa0d6ad

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
12KB

MD5
3934b82b787a10bc082bae2abb31bca3

SHA1
88d52cf1ca7d768a324bf8f8179adf7b2c5ca067

SHA256
1c0b6690091183e200cead48acfaf48751c2d003626ac40f2037a240b4f2ce6f

SHA512
cd501ba192e69d68f37157f7ef62aa2e0277da91bfe885b5ebea1437e2569abdbf9af49036de8fb6fc53fb2604c9cc78fac1bf03ac53bafc09b35345744cfb68

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
293KB

MD5
6a1ceab37dde683e1668ea49532d425f

SHA1
0e18abde377ddfb62ea8d023f82142d1f4ea32f8

SHA256
a65c18ab3a869e2d122e7d4e721340e26d9a2addc203559d4963ccde8166d3c9

SHA512
5db076830f8dca9b3f7ef0154fd93c1d6fb71556b166451051698f9a6f557536f4a9be180b530e6f0f56c94f482f1088b1ac8e1e56331add08e8ebcf1c6dee56

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
293KB

MD5
4624948b829580da1b891f515a194539

SHA1
9cf684d81e21d60387fdf90bf4bf17b6c071d1f1

SHA256
123451e2de1989b0c9c29501282390c1ea7167e05f74e4e388bc598f6aa91917

SHA512
fd56d58d8186535536939bb7d77e22d7b3a5fc74d133c342b5421382dede77c081e2754e4f2d7614ca01b707fdefd2fbaf26b8c4a7d10d7500c1cb5a08903761

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
102KB

MD5
e366d77e84003cacb91e78af31811d02

SHA1
9d9eefc1e2566ce5d3d11c419e31b2ae4d210d72

SHA256
f7b64c9321fd2f84043d1cb0e8f94d312c4f68845caae029ccf92c786e569fb0

SHA512
193ea0d2febdc04ae66dd935806b802f09566876f9087e213bcbe196e31c2aaad598b75c6ed0145977e8c3543718fb369ccb39ad382078e760588bf74ff9ba5b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe58be69.TMP

Filesize
95KB

MD5
e6e198e0153f65e0838354b03930b90c

SHA1
e904d7363892c47238e94c2b031f1e15488ca5da

SHA256
c9da56b9adeb190b2d92d952a2dd338934822343ce382f29d87b400bef43e89f

SHA512
43ceb0ea068cbbe7a09174f125e9fa7b8520d472929045e18c3cd51cd42e032b4cfaf4dd060dda3c6021e37f743ee1860a393a0385e6c7784a957afc06e53498

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\_R_E_A_D___T_H_I_S___GSJ6UEGA_.txt

Filesize
1KB

MD5
fc1d6b1210e77187d4dcc1a92b3b5d16

SHA1
e6fdbcfd91f722dd3b700dc08941a95dc66cf094

SHA256
87a59d73da8546714f7ae4967b2b02c7948558ff1e768fb96d8e5bb684d46ab1

SHA512
d1fdbb8cbdaea716fafa85ca74ce64ef64f53fdf8f5f599666f112b8990254df2b353b504e313152bf080ebdb0fc6a9a1686e645a5f748410e73c56c62bfefc7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\_R_E_A_D___T_H_I_S___J7N4_.hta

Filesize
76KB

MD5
e94dd51ed348b17f57bb04a45a44e0f6

SHA1
8dffb62b579d0ffd7e56803fdc71bc75b3dc9710

SHA256
12cf487aae073af77765cac754b068af0e5a9922c97b85fc8101dc914b579e52

SHA512
cb342e8845ca5ca79965a293ec0465cd58f81158c9c00d589989542b1f24230bd107dad2d6399c705302446a9d7ab7d6aeb8cb28e7d4fd4dcd9f17f462e2f2d0

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\Temp\~DFD2F6EBF67634A452.TMP

Filesize
24KB

MD5
d3cdb7663712ddb6ef5056c72fe69e86

SHA1
f08bf69934fb2b9ca0aba287c96abe145a69366c

SHA256
3e8c2095986b262ac8fccfabda2d021fc0d3504275e83cffe1f0a333f9efbe15

SHA512
c0acd65db7098a55dae0730eb1dcd8aa94e95a71f39dd40b087be0b06afc5d1bb310f555781853b5a78a8803dba0fb44df44bd2bb14baeca29c7c7410dffc812

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\54O1QU9C\primer-bbda46ca867f[1].css

Filesize
333KB

MD5
77d264a65da1bdf6226a7b14304b56dc

SHA1
8925706abc2ab2aa391b2b6a9cc58b4dc8ba841f

SHA256
a2b62581aa107332cdab817fa60dcf7387d60e10fef392a98827abdc8e57ea75

SHA512
bbda46ca867f036551a1712a90c927f0b16dd413900a1c25dd022c8e80c54864989365097d4309b027f0067f0e57647357d19e48237da8b180079b74c9b702ce

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\54O1QU9C\primer-primitives-8500c2c7ce5f[1].css

Filesize
8KB

MD5
e9c08b9ba681ad6606bd18f264e73ef6

SHA1
04d1e96739d82e07587f10bd2d953c8e70b93d9d

SHA256
b08c9718118f5b814e632ac3dc0d8e009e5dc2913df183f0ed322e6817e997df

SHA512
8500c2c7ce5fdad5fa01aa92156964108335c704a127ce290d201395009914c814ac6e08a467e45d1ca0fc75b2269b7f09a6d437939d91c9513c659a80cf472e

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\BZ32ECSX\code-34406d39e629[1].css

Filesize
31KB

MD5
ee14556fc6c8c5e35d7acf63edb7c840

SHA1
6e106d8fb2bcdbf90a553b2db5ad3faf8b5b1d35

SHA256
e98b22b626274eb24481f138c7aed6681b3ade70d4427bc0cb05ceccd9ef4a61

SHA512
34406d39e629a65f5162757c5142f9b02149d2d18caedf15a528315a5dddccc86f3445c852f7e42a2979004b3c07ffe62c1b0c13cf5b60f6b8a06e5836027b67

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\BZ32ECSX\global-6f01bc73955b[1].css

Filesize
285KB

MD5
d6812d1d48e66ed6a712831148f3368f

SHA1
2f5467552f20463a132e84586927777ddc40f4f3

SHA256
d7a08128a2e72d4a5afc37419dbc3d0cb64b1d874bc28a5129cf47b115a994b5

SHA512
6f01bc73955b50e5482a3d1f6f49d4e5696c416d5e5a93f1ca65072200ba40c1034813cbadb83830baa46589a562e0f2255107adc4d3a055218e5aa6dbd78ce6

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\BZ32ECSX\ransomwares[1].htm

Filesize
284KB

MD5
832178911bff8316359c439b18ebc9cc

SHA1
4d2aa6ab3c6ad79f22ce4ccacfff6abf58bf3664

SHA256
8e9d1a5e3bbe84f4de641801fed2ca79a76dcc8d98b77e63971fa6aa637e25c6

SHA512
75d880d378f121190b756b79e274e3532bfebab3ee4bb1f9e4649a91a312d8510dcfe91630986b2d00fd33eba4d5d343cc6b8e12152b4341e4023a1081709d4f

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\BZ32ECSX\repository-992e95451f25[1].css

Filesize
29KB

MD5
ba1468dd22fb87a14c2e6e2204531deb

SHA1
ade22d3c001f90fb4998709fa1062c2964742ab1

SHA256
d47b5116f66ce8d8840e44fbcee18453ec46cd6a12f863308a1f456380c35707

SHA512
992e95451f25275a9263e398d325f64591772d9ac887be883b8ad97e09008bd31a0e2f59f62c0cc97a983cbaba7b20bd4ae49748a834c1862323bac59e318bf9

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\O9W2TVUS\dark-6b1e37da2254[1].css

Filesize
48KB

MD5
96ba1deb375c1c66bb092fa0a1765be1

SHA1
03f188ec52d09882b8403ed57d7aa73a224ddd62

SHA256
d6bc29d6a4e33c7f4da1d4b8060cce6dedf384d7334b71661c277e985ef8c156

SHA512
6b1e37da22544d5626c6f78691a8d8f723c49c95a782f5195f4b00b0e1b9d4408402c25d5915e097ef31273c3c8d06d81d1ba1bb08e12677941b8b1f24d92848

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\O9W2TVUS\light-efd2f2257c96[1].css

Filesize
48KB

MD5
b8473fdb0f4749de99341662aec850f2

SHA1
f593c957a26528558217837aead34cf718d27443

SHA256
8aabc55d211fc93acb563c9cf30732577212a998196f73b067f9795c8d1ef72b

SHA512
efd2f2257c96c12eba6da741c677030ac63c34a925846080ec606e5a974706726479bd5babea6dd0ac7e8e421704263787986fb07a9c384994cf403bf8bc3dee

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\S58XOXZK\app_assets_modules_github_onfocus_ts-ui_packages_trusted-types-policies_policy_ts-ui_packages-6fe316-9d50d6f10c3d[1].js

Filesize
8KB

MD5
68bf738bbe44db97fd2a1d1938b71130

SHA1
d9974d77d8e043244205080d6edbee1d203fed50

SHA256
99c010c6044b291ba2433e143e654cf95f625092f1744d8f2ba47a7fc5e0f24f

SHA512
9d50d6f10c3df9a1649a6b61f25d8d648e4beac1edd8e04512815376fc70ce24c7cad38b5901e9ca9806cb2bc3b365cae134281b7290a31f6d0e53bf287caf42

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\S58XOXZK\element-registry-64006a43c0df[1].js

Filesize
48KB

MD5
84cedc156ad5e355898940bfb009482e

SHA1
a5ebb27116ab6f5bfabcba86de0cdb4ac0725520

SHA256
261e1a525aeed59fe03c896409cbc79038e42c8afae89cc0609f275e7119af9d

SHA512
64006a43c0df22351ce5a5a886097bb1cef6d2873e8994db51beb1d581e72233ab49a38f4135484bde0fb184cbb7a8932194391c4f58e72f38c5a9f65011cab0

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\S58XOXZK\environment-cd098098ff2e[1].js

Filesize
13KB

MD5
c946fb5a94c699f0b69bbcf7e85dd938

SHA1
81f6899e9f2d5e0357cb42792801c38f31e455a6

SHA256
29dba15e8182dbf52cd9dbde2287d57fdde0f6fb2e4dcfa0ee8381ee099f752d

SHA512
cd098098ff2e8f8b50d62e959c8a4190fc01fd7f96b651005059d18e0ac9e0c24ebeec4011308e7dead2614f83f2d3626ec5bf14e3eb1be8eb159042dd7432e6

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\S58XOXZK\github-cf4e90581e80[1].css

Filesize
125KB

MD5
17dd5ff830e3a3b0d60eba96196eef76

SHA1
d191b957af007ae7ae2fdfd8b20d0ab3fc1ea274

SHA256
42681431f54d4e9bbdc102af4d2f3de9c5409507dc6f89abed7813f6461cf3bf

SHA512
cf4e90581e80a8f0d3aa169f580d171911d61d894301808bf51e7c2facfc6b0e5338f22f1af3253d20c94e4e56ca905fc5d0e1d8ce46fbcd03ed976d18ff86d4

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\S58XOXZK\github-elements-b5a402753026[1].js

Filesize
36KB

MD5
f9cc152ec6d75ea78f11fe32f50ee7c8

SHA1
416e6d5b3e363f8503eb9df01bb358a77b534b42

SHA256
c5a7eb1092465b4d26ccea3e2108bcd3efb1ee6e9b03f7bda5e9a9eabcbfe95a

SHA512
b5a40275302676715b2a28d24c5eaf987bad9f588849a22e5bb0e44b9afc434ec13274df89e94b794ea9678c5325f464eff2f39df1e4fc395edf353d248b1f06

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\S58XOXZK\vendors-node_modules_braintree_browser-detection_dist_browser-detection_js-node_modules_stack-68835d-a18220f1db8d[1].js

Filesize
22KB

MD5
0cb967b7b9603edacb27a261ba59bb63

SHA1
ff39f99d51916d3bea1fd5ae853abf93ffe35b2b

SHA256
f4ceffa8ba23288e7d15bdde1bb227559443380c041d0febf6bcd525946bec41

SHA512
a18220f1db8d086f2cae618e9196599eff46935aa7bcbc601276acf10bfa09b700b37122aa00d227e61c1b1257b7304ec064221d8926c330789b2ad3ca0f2824

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\S58XOXZK\vendors-node_modules_dompurify_dist_purify_js-89a69c248502[1].js

Filesize
20KB

MD5
36f04458790e19bb99bd77a1cdc16295

SHA1
8f25cd75135fec8c088728f53d39dcc21d375fdf

SHA256
cfac43b55a6b86258b9d3495eff18f26f598313a14cf76a3dbb1e3e7fd341f00

SHA512
89a69c2485029e3393d81637b2eeac776d0765835e6ffcdddb1394f4421c5236b5cfee873568736d8a233b6c9bafe6ea828d2b718133aae8f0d22f220165fb9e

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\S58XOXZK\vendors-node_modules_github_auto-complete-element_dist_index_js-node_modules_github_details-d-ed9a97-841122a1e9d4[1].js

Filesize
17KB

MD5
d50f30bd48bf15a39fb0de84d338b063

SHA1
c974701a469b2ae91195cc57a42c3157c0210646

SHA256
21c5e70f201ea5ebcaff6f1244e6a7fbfca84d1878cd41d4400696bbbe09af5a

SHA512
841122a1e9d49b8484e68dc82869b7835e54a9d632909ec4f0c386ba843d2eaf20416c75c19c4a250a8cf22de8ef43f1fff6d77d29630132266c6f533c487e2f

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\S58XOXZK\vendors-node_modules_github_catalyst_lib_index_js-node_modules_github_clipboard-copy-element_-782ca5-54763cd55b96[1].js

Filesize
8KB

MD5
80708c39dbd42e80616bc4a61b51c1bb

SHA1
a87eb08671b07a1c2689a6caca2486727af9ae3e

SHA256
10e085fffc04da9cbf0a46c8a6e120d34947c4ed859f05e26cb0abaae312e094

SHA512
54763cd55b96117e15652c12e9ca5e8ec71e58eabbd9537a7e6c833ec124199eae23091ef59275513f2cacf055e9ae69d7683474fc31f81ef823578118c462ba

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\S58XOXZK\vendors-node_modules_github_catalyst_lib_index_js-node_modules_github_hydro-analytics-client_-7901e7-dc88587c14ed[1].js

Filesize
15KB

MD5
b247dd2cc69bbd255b535a6793786c59

SHA1
6433c5ebe6bcb68416a388c9f6aa19e57f32421c

SHA256
a50da36863a10de8b274419938a69586cb071c4e557b70c72ee3801dd2cb2d1c

SHA512
dc88587c14ed4956f03adfd5f928d5f7b869a9e9fb45ec01cedc6675c711efb2219e129177323f28b4008433ecdd3c4ef5ae09799935e8f164c9d8db03e9c6f4

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\S58XOXZK\vendors-node_modules_github_filter-input-element_dist_index_js-node_modules_github_remote-inp-b7d8f4-2355048ff048[1].js

Filesize
18KB

MD5
c6175500bbb3bf8dc98aa0d4229caab6

SHA1
59fa80835b3a054500c80573c5403dbe3b6c72dc

SHA256
936cc4f56aef6760208636c671f028f76a6a896b1a113df7f64b4fe10ac9cbfc

SHA512
2355048ff0483d1b53126ffa8506d15da3baf9cac2570b99cf6c1d019b4702231500ec72485e529b4ab8250631e664d080818ec91cf9339770528948489f92a8

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\S58XOXZK\vendors-node_modules_github_mini-throttle_dist_index_js-node_modules_delegated-events_dist_in-3efda3-701acb69193f[1].js

Filesize
22KB

MD5
a693601ad5e308513903deba2de13192

SHA1
67798204da9fa7579572048e4082f4a661081f10

SHA256
1b9356bc6a944ef62aded9240620165198d67511e7ca1d83141a497887ea5c99

SHA512
701acb69193fb70e56de2b560c510e72690a4e3c93407f1823a812dce3f82641606fb82781bf9423017e5ecdb04866d9833111ed3137fdef978298b329b054e3

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\S58XOXZK\vendors-node_modules_github_mini-throttle_dist_index_js-node_modules_smoothscroll-polyfill_di-75db2e-686488490524[1].js

Filesize
15KB

MD5
e3f26045b6c949207e83b64a3049fb97

SHA1
93d1e9454d48afdfd846149723dcf845804552e2

SHA256
0aec79ad0107317829bd0d38cd83a44a1e3a14c9c62b7d1590298c4caa56ac0a

SHA512
68648849052442cf704c50e9abae2eccc3c289c388c4e4a7f32071d2878cb6c1bdca49a401fa820469a90658543fa1ff92649d232fcf0f94955a2872ff0899a1

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\S58XOXZK\vendors-node_modules_github_relative-time-element_dist_index_js-f9b958f5f2df[1].js

Filesize
15KB

MD5
46afaaf3a6253f2ce9568db9e301ec8a

SHA1
b365c36e165567048bad614c98baa22bef4b9b91

SHA256
7ef807f7b9fe45ec17faa06e235c7adac46227f7589b91653fe4e0ae3a7a0ff4

SHA512
f9b958f5f2df5e85cfb021de43dac548c271eab2ddfa4463c213d7bf311b7ea3b7b93b7231de9834db884bbe53b012b3a1dde85eef9c6daaf46609aeb446fdb4

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\S58XOXZK\vendors-node_modules_github_selector-observer_dist_index_esm_js-f690fd9ae3d5[1].js

Filesize
9KB

MD5
e131f8c9b77918aeb94fd82199a423d6

SHA1
71eaae086cd44a8904f39d27fb5387bb957976f0

SHA256
01f9a0ec0bb24312ae0395b6aa238f8d910dc35c08ef5a25a1e9cd8feac83c32

SHA512
f690fd9ae3d5a240e479fea97ac82940f136f3f2e0262cac840345f2b956123117ca94424dc354d90d13f1c0169c24b19526505bb2fad70c8c364899474a9495

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\S58XOXZK\vendors-node_modules_github_text-expander-element_dist_index_js-cd48220d74d5[1].js

Filesize
14KB

MD5
69f387b852329683c3f4856ccb905f60

SHA1
a58ffa40abbb4c6f5ef0545c1ffb932c21d73cc1

SHA256
d9cdb2e9f9c648237f22c43f8f12e85d8944c75ab325352059c3e53516635167

SHA512
cd48220d74d52b956312b2c59ec764d2d559e73c51789f9d649e108925f79ae3c910744161904b2840894bfcff64507971d5a19f921e5190a710bda4eceb63e2

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\S58XOXZK\vendors-node_modules_oddbird_popover-polyfill_dist_popover_js-56729c905fe2[1].js

Filesize
9KB

MD5
2eb9961e08f81bdca617ddb67c2fb708

SHA1
15cb6d7ffe93324b38bb62bcc4ff14d1a57f94bb

SHA256
0f2cd40ad364711db1fee03cf9f6ca04fc56f5c3ba497dc476c5879e129d968b

SHA512
56729c905fe263a6b7978bc67c09b8dab69592e21aa9addba78866790bdb2dbd85e41e6a6663d511e73a8edeb75933b549b3c393a465748790a6fd50b337cee9

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\S58XOXZK\vendors-node_modules_primer_behaviors_dist_esm_anchored-position_js-node_modules_github_combo-aea225-dcf5851b6d7d[1].js

Filesize
22KB

MD5
556926c8c4f4c260199af81f6ee8f769

SHA1
6f2f2fe4ae2a9d7004cfe457360a421662e324cb

SHA256
d071d751492d02b4b56e30b993b533adb192bc5796fbd6b184614288db5152be

SHA512
dcf5851b6d7d7cf28ba9563f7abc4fe35a7c14d493469042e65002726dd9b7b8d82a794d0ccba75113c11acc57cf67dc3b6ec628f6a6588e2aca44d29602f30c

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\S58XOXZK\vendors-node_modules_primer_behaviors_dist_esm_focus-zone_js-c9086a4fb62b[1].js

Filesize
8KB

MD5
19e28fe2dcffe5582e6352b53d0b22ce

SHA1
1e656d3443915c4e4bc9782f4366b4eebcf45720

SHA256
345e3daa928a64bc11b3778cfb36228d0025c260defa0b78e4c0ebe66c419737

SHA512
c9086a4fb62b90cd43e0a47621528a23582de79c4bdb1b2eac386f8e331c5ac891aa69975fdfb487a4cf508852c1c3ebc2df24e00ffca5443fb6e22f3b3ee99c

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\S58XOXZK\wp-runtime-b54e61ff9651[1].js

Filesize
52KB

MD5
eaf7b2e81c14549107b00a0d738d6a0b

SHA1
13bded9846bacb624cc7ac8f3060a82ee500b6db

SHA256
80bd1b0d95017278199a560f067ea76bccd2a8c808caba867f00b7f5f5e0a6c6

SHA512
b54e61ff9651de628f382bc713ac138001902c18898833a4d8b33e7cd1088a31655ba802ac4d37a30d6205d661af5032500da22481986c211db8eb5051a1b020

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\59D76868C250B3240414CE3EFBB12518_9B13CC1B0E800F96F1A2CB0E125BA520

Filesize
471B

MD5
d4e1c6ec4c83b05f70dfb8610e8394f0

SHA1
3b43f239cfae3a5a7c7f97116a9dd331c533e1ff

SHA256
14af373d8ca74179d920f1f983fa5e017e5589e91bed3f8750b3f1f65606aa07

SHA512
658acda29bdcbd177aeb08d37454a8f977cdd98820434ae2ae50babb6ca574e45a0ef93468f95f987e0f3348f970f72705b4649b3988679dcbbc9a851a073e95

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\A66A8DB907BADC9D16AD67B2FBFFDD5C

Filesize
280B

MD5
3fe1f7d25165ed35f2d2e6a21f7f424a

SHA1
ed43b14e2ca280aa6d26d7ec3c432f347d49ab22

SHA256
84008d9eeb2c23c3450a067e00fba1a75f6a349099b680e193948f2888407e97

SHA512
41d0646bfb92b8e95cc23d4774453f0b3a3a189df7011c187b9d8f77436f0c04c235fabe8c52dcc125d97e87e62bf1050e2e626faea2b78bac9757522aed15eb

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_89854CA6A0F0936A4D2ECA78845CEA25

Filesize
1KB

MD5
217c9d2c26169bdf488388824de40ab3

SHA1
e970b9aa0f9167a631687be49ebe5e2eb33cb051

SHA256
5d70dd6ef20c747c7d56604663415ae497196d5624c705cd840bab8d23202321

SHA512
36fc2cf016569232addad691f02af705b4c183d675bbe399e359ec7c191d79c461b3863c4011646ad0a4a8a1995b2313a1dcedd52dd7e5b68dcc07ad749b5d98

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\D0E1C4B6144E7ECAB3F020E4A19EFC29_B5F77004C894173A10E3A199871D2D90

Filesize
979B

MD5
a70f46c2b96793585aabcec65c918458

SHA1
697ef66dd7cb5b4ac834b0f05d9728e06b376ed8

SHA256
5ff2aa81382591e38b6f868b5a408ac51c29dcac927bb339d1920f27ab267993

SHA512
8a43984a9f6964976db2c05c695e90721c0604afb8fef86c16163b222bbf2c8e507669e3a61cf585bc0ffcb13a87f042b27868d6bb0d8fd385f3b827fd498082

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419

Filesize
471B

MD5
e62509308f690320d0faa1f8188ed94b

SHA1
52a4a9aa8df906bc35645e960f23241eaaead4a3

SHA256
78dc4ce83ddea81f7776d40bbd34dba92b71c188214068dbf8e92f151ae07df1

SHA512
0fd5c8d2c2a271d8bd8f869bdbc3cceeda2bd019e7b4fc9ca77287c3daa2793832bf9fea530945f1242face0bbf6517372d73d5236cb140a8dacdc32ae14918a

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\59D76868C250B3240414CE3EFBB12518_9B13CC1B0E800F96F1A2CB0E125BA520

Filesize
408B

MD5
e57232012f2738da12c21d484d0ab0f2

SHA1
2f8461911c7f6f8ed84b3d74036230d5e875e642

SHA256
498dcd7e4630d03baa76b48c9011c81884e26d580461f96260236d0c85d53b66

SHA512
f24f9d0b44e21cc806a83b671a881db586e7a26b2f4ec7a975eea1b5b448d44cf81db13d2c9b5d9fc2bbba093c956c8759c2253e39a2352272d96413a8b55ca1

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\A66A8DB907BADC9D16AD67B2FBFFDD5C

Filesize
480B

MD5
4a3551bbe00afba50facab598958e11f

SHA1
4776460ac688f4289fa237730d7770b0f7894929

SHA256
5d31b26be9356e71cf31c61980563037fadd8acad868b881b4fb253d4a919acd

SHA512
2233708a5014dd76a43cc31aaec994c7d075c730968cc63e8581bcfad7fde933141eabd6b686e8111608750a1f3c80882c8e0ada8fa5c438df9e0139a3b1a898

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_89854CA6A0F0936A4D2ECA78845CEA25

Filesize
482B

MD5
9585ba6ed96c11f7911af42bfff03b1c

SHA1
0acb37821f73b54fa327b8db411e8b0fa53e4d4c

SHA256
3882821e97c55f35c1d073fdcb226dbae84350c04172c0b52fc563ca638ba57b

SHA512
5186454967dea0d3a024cceb52be1eb6f099c734ad4b2573850f7bc8ade635e3a15a455fd8588bd202512ab72c8786879ff9453fa365cd85c983de6eb58d21d6

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\D0E1C4B6144E7ECAB3F020E4A19EFC29_B5F77004C894173A10E3A199871D2D90

Filesize
480B

MD5
e9b53f7867fa300e8c979d7edd22b347

SHA1
4b8644f59b53a46ab3c32d3180c211baf7e44517

SHA256
c6f19d9064c15cb0fe49206017f50c52547fc78e1c609cc6dbf106a14818b373

SHA512
dfe5c3020f8ac6a9340d2a05809d713e2c29e1fdb02770113f43815721c00f18360705444a6d746cf56bcdb8b16ff256314f7162dd9e63d16796a9e6369d9d95

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419

Filesize
412B

MD5
d3dcb05abcee624db03b094b1cbbdcb3

SHA1
6e263663dfdb883278ea2c9514095b1b5298d51f

SHA256
4de78d3db8a109995801874f2558bc5c36555e627f63fd05cfccf9eeeae5a72a

SHA512
b13e4765934128780ea1402ec5c814e77f3f6aadcddf20f5b460934157cb0e95849943cb566bf0606c78da9811498329147b063323e6701c2383d913c5182de6

Download Submit
C:\Users\Admin\Downloads\Birele.zip

Filesize
113KB

MD5
6ca327b67f1a2b2a4fbb7f342e15e7bf

SHA1
aab4a7d8199e8416ad8649fede35b846fc96f082

SHA256
460a3e3a039c2d0bb2c76017b41403bf3e92727269f49b08778d33108278b58f

SHA512
b7a7574ca52885e531aca71ebe52f7832f8a2436cda047e7686936fe0337eae7c4ebcc57df27c26316871d4167ea4e6794beb933f7c13efb0addac0d400e4d9a

Download Submit
C:\Users\Admin\Downloads\Cerber 5.zip

Filesize
181KB

MD5
10d74de972a374bb9b35944901556f5f

SHA1
593f11e2aa70a1508d5e58ea65bec0ae04b68d64

SHA256
ab9f6ac4a669e6cbd9cfb7f7a53f8d2393cd9753cc1b1f0953f8655d80a4a1df

SHA512
1755be2bd1e2c9894865492903f9bf03a460fb4c952f84b748268bf050c3ece4185b612c855804c7600549170742359f694750a46e5148e00b5604aca5020218

Download Submit
C:\Users\Admin\Downloads\PolyRansom.zip

Filesize
130KB

MD5
7a5ab2552c085f01a4d3c5f9d7718b99

SHA1
e148ca4cce695c19585b7815936f8e05be22eb77

SHA256
ed8d4bb55444595fabb8172ee24fa2707ab401324f6f4d6b30a3cf04a51212d4

SHA512
33a0fe5830e669d9fafbc6dbe1c8d1bd13730552fba5798530eeb652bb37dcbc614555187e2cfd055f3520e5265fc4b1409de88dccd4ba9fe1e12d3c793ef632

Download Submit
C:\Users\Admin\Downloads\ViraLock.zip

Filesize
132KB

MD5
6a47990541c573d44444f9ad5aa61774

SHA1
f230fff199a57a07a972e2ee7169bc074d9e0cd5

SHA256
b161c762c5894d820cc10d9027f2404a6fec3bc9f8fd84d23ff1daef98493115

SHA512
fe8a4fd268106817efc0222c94cb26ad4ae0a39f99aacaa86880b8a2caa83767ffe8a3dd5b0cdcc38b61f1b4d0196064856bd0191b9c2d7a8d8297c864a7716d

Download Submit
memory/168-16-0x0000021ABA720000-0x0000021ABA730000-memory.dmp

Filesize
64KB

Download
memory/168-360-0x0000021AB98E0000-0x0000021AB98E2000-memory.dmp

Filesize
8KB

Download
memory/168-363-0x0000021AB9840000-0x0000021AB9841000-memory.dmp

Filesize
4KB

Download
memory/168-0-0x0000021ABA620000-0x0000021ABA630000-memory.dmp

Filesize
64KB

Download
memory/168-35-0x0000021AB9810000-0x0000021AB9812000-memory.dmp

Filesize
8KB

Download
memory/168-367-0x0000021AB79F0000-0x0000021AB79F1000-memory.dmp

Filesize
4KB

Download
memory/708-321-0x0000013F1E030000-0x0000013F1E032000-memory.dmp

Filesize
8KB

Download
memory/708-323-0x0000013F1E050000-0x0000013F1E052000-memory.dmp

Filesize
8KB

Download
memory/708-327-0x0000013F1E090000-0x0000013F1E092000-memory.dmp

Filesize
8KB

Download
memory/708-318-0x0000013F0D310000-0x0000013F0D410000-memory.dmp

Filesize
1024KB

Download
memory/708-317-0x0000013F0D310000-0x0000013F0D410000-memory.dmp

Filesize
1024KB

Download
memory/2912-753-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2912-748-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2936-199-0x000002AA21400000-0x000002AA21500000-memory.dmp

Filesize
1024KB

Download
memory/2936-283-0x000002AA31B10000-0x000002AA31B30000-memory.dmp

Filesize
128KB

Download
memory/2936-278-0x000002AA31780000-0x000002AA317A0000-memory.dmp

Filesize
128KB

Download
memory/3544-745-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/3544-750-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/3544-746-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/3556-42-0x0000025A6AE00000-0x0000025A6AF00000-memory.dmp

Filesize
1024KB

Download
memory/3556-44-0x0000025A6AE00000-0x0000025A6AF00000-memory.dmp

Filesize
1024KB

Download
memory/3556-43-0x0000025A6AE00000-0x0000025A6AF00000-memory.dmp

Filesize
1024KB

Download
memory/3560-61-0x0000020081AB0000-0x0000020081AB2000-memory.dmp

Filesize
8KB

Download
memory/3560-64-0x0000020081F00000-0x0000020081F02000-memory.dmp

Filesize
8KB

Download
memory/3560-69-0x00000200822A0000-0x00000200823A0000-memory.dmp

Filesize
1024KB

Download
memory/3560-66-0x0000020081F20000-0x0000020081F22000-memory.dmp

Filesize
8KB

Download
memory/4452-256-0x0000020CEA900000-0x0000020CEAA00000-memory.dmp

Filesize
1024KB

Download