cerber | hxxps://github[.]com/kh4sh3i/Ransomware-Samples

Analysis

max time kernel
1005s
max time network
1007s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
10-09-2024 09:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/kh4sh3i/Ransomware-Samples

Score

10^/10

cerber discovery evasion persistence privilege_escalation ransomware

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\_R_E_A_D___T_H_I_S___BB2Y_.txt

Family

cerber

Ransom Note

CERBER RANSOMWARE ----- YOUR DOCUMENTS, PH0TOS, DATABASES AND OTHER IMPORTANT FILES HAVE BEEN ENCRYPTED! ----- The only way to decrypt y0ur files is to receive the private key and decryption program. To receive the private key and decryption program go to any decrypted folder, inside there is the special file (*_READ_THIS_FILE_*) with complete instructions how to decrypt your files. If you cannot find any (*_READ_THIS_FILE_*) file at your PC, follow the instructions below: ----- 1. Download "Tor Browser" from https://www.torproject.org/ and install it. 2. In the "Tor Browser" open your personal page here: http://p27dokhpz2n7nvgr.onion/09F4-1611-336A-0446-9777 Note! This page is available via "Tor Browser" only. ----- Also you can use temporary addresses on your personal page without using "Tor Browser". ----- 1. http://p27dokhpz2n7nvgr.12hygy.top/09F4-1611-336A-0446-9777 2. http://p27dokhpz2n7nvgr.14ewqv.top/09F4-1611-336A-0446-9777 3. http://p27dokhpz2n7nvgr.14vvrc.top/09F4-1611-336A-0446-9777 4. http://p27dokhpz2n7nvgr.129p1t.top/09F4-1611-336A-0446-9777 5. http://p27dokhpz2n7nvgr.1apgrn.top/09F4-1611-336A-0446-9777 ----- Note! These are temporary addresses! They will be available for a limited amount of time! -----

URLs

http://p27dokhpz2n7nvgr.onion/09F4-1611-336A-0446-9777

http://p27dokhpz2n7nvgr.12hygy.top/09F4-1611-336A-0446-9777

http://p27dokhpz2n7nvgr.14ewqv.top/09F4-1611-336A-0446-9777

http://p27dokhpz2n7nvgr.14vvrc.top/09F4-1611-336A-0446-9777

http://p27dokhpz2n7nvgr.129p1t.top/09F4-1611-336A-0446-9777

http://p27dokhpz2n7nvgr.1apgrn.top/09F4-1611-336A-0446-9777

Extracted

Path

C:\Users\Admin\AppData\Roaming\Microsoft\OneNote\16.0\_R_E_A_D___T_H_I_S___M0R3RZ5D_.hta

Family

cerber

Ransom Note

<!DOCTYPE html> <html lang="en"> <head> <meta charset="utf-8"> <title>CERBER RANSOMWARE: Instructions</title> <HTA:APPLICATION APPLICATIONNAME="bvFHe0N" SCROLL="yes" SINGLEINSTANCE="yes" WINDOWSTATE="maximize"> <style type="text/css"> a { color: #04a; text-decoration: none; } a:hover { text-decoration: underline; } body { background-color: #e7e7e7; color: #222; font-family: "Lucida Sans Unicode", "Lucida Grande", sans-serif; font-size: 13pt; line-height: 19pt; } body, h1 { margin: 0; padding: 0; } hr { color: #bda; height: 2pt; margin: 1.5%; } h1 { color: #555; font-size: 14pt; } ol { padding-left: 2.5%; } ol li { padding-bottom: 13pt; } small { color: #555; font-size: 11pt; } ul { list-style-type: none; margin: 0; padding: 0; } .button { color: #04a; cursor: pointer; } .button:hover { text-decoration: underline; } .container { background-color: #fff; border: 2pt solid #c7c7c7; margin: 5%; min-width: 850px; padding: 2.5%; } .header { border-bottom: 2pt solid #c7c7c7; margin-bottom: 2.5%; padding-bottom: 2.5%; } .h { display: none; } .hr { background: #bda; display: block; height: 2pt; margin-top: 1.5%; margin-bottom: 1.5%; overflow: hidden; width: 100%; } .info { background-color: #efe; border: 2pt solid #bda; display: inline-block; padding: 1.5%; text-align: center; } .updating { color: red; display: none; padding-left: 35px; background: url("data:image/gif;base64,R0lGODlhGQAZAKIEAMzMzJmZmTMzM2ZmZgAAAAAAAAAAAAAAACH/C05FVFNDQVBFMi4wAwEAAAAh+QQFAAAEACwAAAAAGQAZAAADVki63P4wSEiZvLXemRf4yhYoQ0l9aMiVLISCDms+L/DIwwnfc+c3qZ9g6Hn5hkhF7YgUKI2dpvNpExJ/WKquSoMCvd9geDeuBpcuGFrcQWep5Df7jU0AACH5BAUAAAQALAoAAQAOABQAAAMwSLDU/iu+Gdl0FbTAqeXg5YCdSJCBuZVqKw5wC8/qHJv2IN+uKvytn9AnFBCHx0cCACH5BAUAAAQALAoABAAOABQAAAMzSLoEzrC5F9Wk9YK6Jv8gEYzgaH4myaVBqYbfIINyHdcDI+wKniu7YG+2CPI4RgFI+EkAACH5BAUAAAQALAQACgAUAA4AAAMzSLrcBNDJBeuUNd6WwXbWtwnkFZwMqUpnu6il06IKLChDrsxBGufAHW0C1IlwxeMieEkAACH5BAUAAAQALAEACgAUAA4AAAM0SLLU/lAtFquctk6aIe5gGA1kBpwPqVZn66hl1KINPDRB3sxAGufAHc0C1IkIxcARZ4QkAAAh+QQFAAAEACwBAAQADgAUAAADMUhK0vurSfiko8oKHC//yyCCYvmVI4cOZAq+UCCDcv3VM4cHCuDHOZ/wI/xxigDQMAEAIfkEBQAABAAsAQABAA4AFAAAAzNIuizOkLgZ13xraHVF1puEKWBYlUP1pWrLBLALz+0cq3Yg324PAUAXcNgaBlVGgPAISQAAIfkEBQAABAAsAQABABQADgAAAzRIujzOMBJHpaXPksAVHoogMlzpZWK6lF2UjgobSK9AtjSs7QTg8xCfELgQ/og9I1IxXCYAADs=") left no-repeat; } #change_language { float: right; } #change_language, #texts div { display: none; } </style> </head> <body> <div class="container"> <div class="header"> <a id="change_language" href="#" onclick="return changeLanguage1();" title="English">☑ English</a> <h1>CERBER RANSOMWARE</h1> Instructions </div> <div id="languages"> ☑ Select your language <ul> <li><a href="#" title="English" onclick="return sh_bl('en');">English</a></li> <li><a href="#" title="Arabic" onclick="return sh_bl('ar');">العربية</a></li> <li><a href="#" title="Chinese" onclick="return sh_bl('zh');">中文</a></li> <li><a href="#" title="Dutch" onclick="return sh_bl('nl');">Nederlands</a></li> <li><a href="#" title="French" onclick="return sh_bl('fr');">Français</a></li> <li><a href="#" title="German" onclick="return sh_bl('de');">Deutsch</a></li> <li><a href="#" title="Italian" onclick="return sh_bl('it');">Italiano</a></li> <li><a href="#" title="Japanese" onclick="return sh_bl('ja');">日本語</a></li> <li><a href="#" title="Korean" onclick="return sh_bl('ko');">한국어</a></li> <li><a href="#" title="Polish" onclick="return sh_bl('pl');">Polski</a></li> <li><a href="#" title="Portuguese" onclick="return sh_bl('pt');">Português</a></li> <li><a href="#" title="Spanish" onclick="return sh_bl('es');">Español</a></li> <li><a href="#" title="Turkish" onclick="return sh_bl('tr');">Türkçe</a></li> </ul> </div> <div id="texts"> <div id="en"> Can't yoDDSUBu find the necessary files? Is the cFontent of your files not readable? It is normal beqcause the files' names and the data in your files have been encrypKjAmF98qZted by "Cedrber Ransomware". It melFtK6Zans your files are NOT damageFQE9nvr8Ugd! Your files are modified only. This modification is reversible. FuuRUSwta3rom now it is not possXEDXGCGNfible to use your files until they will be decrypted. The only way to decsoB26rypt your files safely is to buy the special decryption software "CwfC170Rerber Decryptor". Any attempts to restmore your files with the thirSFBNESiBd-party software will be fatal for your files! <hr> You can proc46OhSsC8eed with purchasing of the decryption softwWFDaplmare at your personal page: PlevWr0Z2ase wait...<a class="url" href="http://p27dokhpz2n7nvgr.12hygy.top/09F4-1611-336A-0446-9777" target="_blank">http://p27dokhpz2n7nvgr.12hygy.top/09F4-1611-336A-0446-9777</a><hr><a href="http://p27dokhpz2n7nvgr.14ewqv.top/09F4-1611-336A-0446-9777" target="_blank">http://p27dokhpz2n7nvgr.14ewqv.top/09F4-1611-336A-0446-9777</a><hr><a href="http://p27dokhpz2n7nvgr.14vvrc.top/09F4-1611-336A-0446-9777" target="_blank">http://p27dokhpz2n7nvgr.14vvrc.top/09F4-1611-336A-0446-9777</a><hr><a href="http://p27dokhpz2n7nvgr.129p1t.top/09F4-1611-336A-0446-9777" target="_blank">http://p27dokhpz2n7nvgr.129p1t.top/09F4-1611-336A-0446-9777</a><hr><a href="http://p27dokhpz2n7nvgr.1apgrn.top/09F4-1611-336A-0446-9777" target="_blank">http://p27dokhpz2n7nvgr.1apgrn.top/09F4-1611-336A-0446-9777</a> If tFTYPyhis page cannot be opened  clinx4a9E1azck here  to get a new addrjTiyess of your personal page. If the addre5uss of your personal page is the same as befooQvWZEFore after you tried to get a new one, you cyehAxYb3ban try to get a new address in one hour. At thW2BiEis page you will receive the complete instrVrtm3uctions how to buy the decryptikUEvngaVon software for restoring all your files. Also at this page you will be able to resF8tore any one file for free to be sure "Cerbenr Decryptor" will help you. <hr> If your perCEhL0ksonal page is not availalouyyFTdkble for a long period there is another way to open your personal page - instazM4ebhw4tllation and use of Tor Browser: <ol> <li>run your InteikFqfirnet browser (if you do not know what it is run the Internet Explorer);</li> <li>entq1TTkfer or copy the address <a href="https://www.torproject.org/download/download-easy.html.en" target="_blank">https://www.torproject.org/download/download-easy.html.en</a> into the address bar of your browser and press ENTER;</li> <li>wait for the site loadOgC2u0jing;</li> <li>on the site you will be offered to dowlvMAownload Tor Browser; download and run it, follow the installation instructions, wait until the installation is completed;</li> <li>ruN9xkTKxi24n Tor Browser;</li> <li>connect with the buttpsC9qMP6Lon "Connect" (if you use the English version);</li> <li>a normal Internet bro1eLs5ucgwser window will be opened after the initialization;</li> <li>type or copy the addI6Kihress http://p27dokhpz2n7nvgr.onion/09F4-1611-336A-0446-9777 in this browser address bar;</li> <li>preYtZQ2vDss ENTER;</li> <li>the site shoDuld be loaded; if for some reason the site is not lo4bading wait for a moment and try again.</li> </ol> If you have any prJDDuHjoblems during installation or use of Tor Browser, please, visit <a href="https://www.youtube.com/results?search_query=Install+Tor+Browser+Windows" target="_blank">https://www.youtube.com</a> and type request in the searcSh bar "Install Tor Browser Windows" and you will find a lot of training videos about Tor Browser installation and use. <hr> AdditazLc8z4ional information: You will fiNLRnd the instruoCIFnh7ctions ("*_READ_THIS_FILE_*.hta") for reqj0CeGnuistoring your files in any f5NSBd5Pfolder with your enc2vrypted files. The instrwdEYarREuctions "*_READ_THIS_FILE_*.hta" in the fJ8MolderMRs with your encryIxRpted files are not virvWuses! The instruco6ztions "*_READ_THIS_FILE_*.hta" will hennkR81XPZblp you to dece6Jvqnirypt your files. RemembesC867I9r! The worst si14LMnMyrtuation already happRlngened and now the future of your files de1eulDpends on your determjjmOTAlfhination and speed of your actions. </div> <div id="ar" style="direction: rtl;"> لا يمكنك العثور على الملفات الضرورية؟ هل محتوى الملفات غير قابل للقراءة؟ هذا أمر طبيعي لأن أسماء الملفات والبيانات في الملفات قد تم تشفيرها بواسطة "Cerber Ransomware". وهذا يعني أن الملفات الخاصة بك ليست تالفة! فقد تم تعديل ملفاتك فقط. ويمكن التراجع عن هذا. ومن الآن فإنه لا يكن استخدام الملفات الخاصة بك حتى يتم فك تشفيرها. الطريقة الوحيدة لفك تشفير ملفاتك بأمان هو أن تشتري برنامج فك التشفير المتخصص "Cerber Decryptor". إن أية محاولات لاستعادة الملفات الخاصة بك بواسطة برامج من طرف ثالث سوف تكون مدمرة لملفاتك! <hr> يمكنك الشروع في شراء برنامج فك التشفير من صفحتك الشخصية: أرجو الإنتظار...<a class="url" href="http://p27dokhpz2n7nvgr.12hygy.top/09F4-1611-336A-0446-9777" target="_blank">http://p27dokhpz2n7nvgr.12hygy.top/09F4-1611-336A-0446-9777</a><hr><a href="http://p27dokhpz2n7nvgr.14ewqv.top/09F4-1611-336A-0446-9777" target="_blank">http://p27dokhpz2n7nvgr.14ewqv.top/09F4-1611-336A-0446-9777</a><hr><a href="http://p27dokhpz2n7nvgr.14vvrc.top/09F4-1611-336A-0446-9777" target="_blank">http://p27dokhpz2n7nvgr.14vvrc.top/09F4-1611-336A-0446-9777</a><hr><a href="http://p27dokhpz2n7nvgr.129p1t.top/09F4-1611-336A-0446-9777" target="_blank">http://p27dokhpz2n7nvgr.129p1t.top/09F4-1611-336A-0446-9777</a><hr><a href="http://p27dokhpz2n7nvgr.1apgrn.top/09F4-1611-336A-0446-9777" target="_blank">http://p27dokhpz2n7nvgr.1apgrn.top/09F4-1611-336A-0446-9777</a> في حالة تعذر فتح هذه الصفحة  انقر هنا  لإنشاء عنوان جديد لصفحتك الشخصية. في هذه الصفحة سوف تتلقى تعليمات كاملة حول كيفية شراء برنامج فك التشفير لاستعادة جميع الملفات الخاصة بك. في هذه الصفحة أيضًا سوف تتمكن من استعادة ملف واحد بشكل مجاني للتأكد من أن "Cerber Decryptor" سوف يساعدك. <hr> إذا كانت صفحتك الشخصية غير متاحة لفترة طويلة فإن ثمّة طريقة أخرى لفتح صفحتك الشخصية - تحميل واستخدام متصفح Tor: <ol> <li>قم بتشغيل متصفح الإنترنت الخاص بك (إذا كنت لا تعرف ما هو قم بتشغيل إنترنت إكسبلورر);</li> <li>قم بكتابة أو نسخ العنوان <a href="https://www.torproject.org/download/download-easy.html.en" target="_blank">https://www.torproject.org/download/download-easy.html.en</a> إلى شريط العنوان في المستعرض الخاص بك ثم اضغط ENTER;</li> <li>انتظر لتحميل الموقع;</li> <li>سوف يعرض عليك الموقع تحميل متصفح Tor. قم بتحميله وتشغيله، واتبع تعليمات التثبيت، وانتظر حتى اكتمال التثبيت;</li> <li>قم بتشغيل متصفح Tor;</li> <li>اضغط على الزر "Connect" (إذا كنت تستخدم النسخة الإنجليزية);</li> <li>سوف تُفتح نافذة متصفح الإنترنت العادي بعد البدء;</li> <li>قم بكتابة أو نسخ العنوان http://p27dokhpz2n7nvgr.onion/09F4-1611-336A-0446-9777 في شريط العنوان في المتصفح;</li> <li>اضغط ENTER;</li> <li>يجب أن يتم تحميل الموقع؛ إذا لم يتم تحميل الموقع لأي سبب، انتظر للحظة وحاول مرة أخرى.</li> </ol> إذا كان لديك أية مشكلات أثناء عملية التثبيت أو استخدام متصفح Tor، يُرجى زيارة <a href="https://www.youtube.com/results?search_query=Install+Tor+Browser+Windows" target="_blank">https://www.youtube.com</a> واكتب الطلب "install tor browser windows" أو "تثبيت نوافذ متصفح Tor" في شريط البحث، وسوف تجد الكثير من أشرطة الفيديو للتدريب حول تثبيت متصفح Tor واستخدامه. <hr> معلومات إضWJ2GnZEOافية: سI3KXzTQ19pوف تجد إرشادات استعادة الملفات الخاصة بك ("*_READ_THIS_FILE_*") في أي مجلد مع ملفاتك المشفرة. الإرش0mAavUmLادات ("*_READ_THIS_FILE_*") الموجودة في المجلدات مع ملفاتك المشفرة ليست فيروسات والإرشادات ("*_READ_THIS_FILE_*") سوف تساعدك على فك تشفير الملفات الخاصة بك. تذكر أن أسوأ موLsYfuقف قد حدث بالفعل، والآن مستقبل ملفاتك يعتمد على عزيمتك وسرعة الإجراءات الخاصة بك. </div> <div id="zh"> 您找不到所需的文件？ 您文件的内容无法阅读？ 这是正常的，因为您文件的文件名和数据已经被“Cerber Ransomware”加密了。 这意味着您的文件并没有损坏！您的��

Signatures

Cerber
Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.
ransomware cerber
Contacts a large (1137) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Downloads MZ/PE file

Modifies Windows Firewall 2 TTPs 2 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
1708	netsh.exe
4844	netsh.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service

T1102

flow	ioc
33	raw.githubusercontent.com
39	raw.githubusercontent.com
135	raw.githubusercontent.com
179	raw.githubusercontent.com

Drops file in System32 directory 38 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\the bat!	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\microsoft sql server	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\powerpoint	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\office	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\onenote	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\onenote	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\steam	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\word	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\excel	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\excel	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\microsoft sql server	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\outlook	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\powerpoint	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\outlook	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\onenote	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\word	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\steam	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\the bat!	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\desktop	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\powerpoint	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\excel	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\outlook	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\bitcoin	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\onenote	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\outlook	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\thunderbird	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\bitcoin	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\office	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\documents	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\powerpoint	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\thunderbird	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft sql server	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft sql server	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\excel	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\office	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\word	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\office	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\word	cerber.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tmp9C8F.bmp"	cerber.exe

Drops file in Program Files directory 20 IoCs

description	ioc	Process
File opened for modification	\??\c:\program files (x86)\microsoft\excel	cerber.exe
File opened for modification	\??\c:\program files (x86)\office	cerber.exe
File opened for modification	\??\c:\program files (x86)\steam	cerber.exe
File opened for modification	\??\c:\program files (x86)\bitcoin	cerber.exe
File opened for modification	\??\c:\program files (x86)\powerpoint	cerber.exe
File opened for modification	\??\c:\program files (x86)\the bat!	cerber.exe
File opened for modification	\??\c:\program files (x86)\microsoft\word	cerber.exe
File opened for modification	\??\c:\program files (x86)\thunderbird	cerber.exe
File opened for modification	\??\c:\program files\	cerber.exe
File opened for modification	\??\c:\program files (x86)\	cerber.exe
File opened for modification	\??\c:\program files (x86)\microsoft sql server	cerber.exe
File opened for modification	\??\c:\program files (x86)\microsoft\microsoft sql server	cerber.exe
File opened for modification	\??\c:\program files (x86)\microsoft\onenote	cerber.exe
File opened for modification	\??\c:\program files (x86)\microsoft\outlook	cerber.exe
File opened for modification	\??\c:\program files (x86)\word	cerber.exe
File opened for modification	\??\c:\program files (x86)\excel	cerber.exe
File opened for modification	\??\c:\program files (x86)\microsoft\office	cerber.exe
File opened for modification	\??\c:\program files (x86)\microsoft\powerpoint	cerber.exe
File opened for modification	\??\c:\program files (x86)\onenote	cerber.exe
File opened for modification	\??\c:\program files (x86)\outlook	cerber.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\onenote	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\the bat!	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\thunderbird	cerber.exe
File opened for modification	\??\c:\windows\	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\microsoft sql server	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\word	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\desktop	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\powerpoint	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\powerpoint	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\onenote	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\steam	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft sql server	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft sql server	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\word	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\outlook	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\documents	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\excel	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\office	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\microsoft sql server	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\powerpoint	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\steam	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\the bat!	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\documents	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\bitcoin	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\excel	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\excel	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\outlook	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\powerpoint	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\word	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\outlook	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\excel	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft sql server	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\office	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\word	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\onenote	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\outlook	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\the bat!	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\thunderbird	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\thunderbird	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\word	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\bitcoin	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\microsoft sql server	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\thunderbird	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\excel	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\powerpoint	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\office	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\outlook	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\excel	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\onenote	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\word	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\office	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\onenote	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\outlook	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\word	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\onenote	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\steam	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\bitcoin	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\microsoft sql server	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\powerpoint	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\steam	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\desktop	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft sql server	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\office	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\the bat!	cerber.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cerber.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NOTEPAD.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
532	PING.EXE

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
3588	taskkill.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133704340512275659"	chrome.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings	cerber.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2412658365-3084825385-3340777666-1000\{525C32ED-27F7-4F2B-9ABC-67C273F0C999}	msedge.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
852	NOTEPAD.EXE

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
532	PING.EXE

Suspicious behavior: EnumeratesProcesses 30 IoCs

pid	Process
3032	chrome.exe
3032	chrome.exe
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe
4496	msedge.exe
4496	msedge.exe
4852	msedge.exe
4852	msedge.exe
4768	identity_helper.exe
4768	identity_helper.exe
2348	msedge.exe
2348	msedge.exe
1012	msedge.exe
1012	msedge.exe
4724	msedge.exe
4724	msedge.exe
3576	identity_helper.exe
3576	identity_helper.exe
4076	msedge.exe
4076	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3020	msedge.exe
3020	msedge.exe
4844	msedge.exe
4844	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 35 IoCs

pid	Process
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3032	chrome.exe
Token: SeCreatePagefilePrivilege	3032	chrome.exe
Token: SeShutdownPrivilege	3032	chrome.exe
Token: SeCreatePagefilePrivilege	3032	chrome.exe
Token: SeShutdownPrivilege	3032	chrome.exe
Token: SeCreatePagefilePrivilege	3032	chrome.exe
Token: SeShutdownPrivilege	3032	chrome.exe
Token: SeCreatePagefilePrivilege	3032	chrome.exe
Token: SeShutdownPrivilege	3032	chrome.exe
Token: SeCreatePagefilePrivilege	3032	chrome.exe
Token: SeShutdownPrivilege	3032	chrome.exe
Token: SeCreatePagefilePrivilege	3032	chrome.exe
Token: SeShutdownPrivilege	3032	chrome.exe
Token: SeCreatePagefilePrivilege	3032	chrome.exe
Token: SeShutdownPrivilege	3032	chrome.exe
Token: SeCreatePagefilePrivilege	3032	chrome.exe
Token: SeShutdownPrivilege	3032	chrome.exe
Token: SeCreatePagefilePrivilege	3032	chrome.exe
Token: SeShutdownPrivilege	3032	chrome.exe
Token: SeCreatePagefilePrivilege	3032	chrome.exe
Token: SeShutdownPrivilege	3032	chrome.exe
Token: SeCreatePagefilePrivilege	3032	chrome.exe
Token: SeShutdownPrivilege	3032	chrome.exe
Token: SeCreatePagefilePrivilege	3032	chrome.exe
Token: SeShutdownPrivilege	3032	chrome.exe
Token: SeCreatePagefilePrivilege	3032	chrome.exe
Token: SeShutdownPrivilege	3032	chrome.exe
Token: SeCreatePagefilePrivilege	3032	chrome.exe
Token: SeShutdownPrivilege	3032	chrome.exe
Token: SeCreatePagefilePrivilege	3032	chrome.exe
Token: SeShutdownPrivilege	3032	chrome.exe
Token: SeCreatePagefilePrivilege	3032	chrome.exe
Token: SeShutdownPrivilege	3032	chrome.exe
Token: SeCreatePagefilePrivilege	3032	chrome.exe
Token: SeShutdownPrivilege	3032	chrome.exe
Token: SeCreatePagefilePrivilege	3032	chrome.exe
Token: SeShutdownPrivilege	3032	chrome.exe
Token: SeCreatePagefilePrivilege	3032	chrome.exe
Token: SeShutdownPrivilege	3032	chrome.exe
Token: SeCreatePagefilePrivilege	3032	chrome.exe
Token: SeShutdownPrivilege	3032	chrome.exe
Token: SeCreatePagefilePrivilege	3032	chrome.exe
Token: SeShutdownPrivilege	3032	chrome.exe
Token: SeCreatePagefilePrivilege	3032	chrome.exe
Token: SeShutdownPrivilege	3032	chrome.exe
Token: SeCreatePagefilePrivilege	3032	chrome.exe
Token: SeShutdownPrivilege	3032	chrome.exe
Token: SeCreatePagefilePrivilege	3032	chrome.exe
Token: SeShutdownPrivilege	3032	chrome.exe
Token: SeCreatePagefilePrivilege	3032	chrome.exe
Token: SeShutdownPrivilege	3032	chrome.exe
Token: SeCreatePagefilePrivilege	3032	chrome.exe
Token: SeShutdownPrivilege	3032	chrome.exe
Token: SeCreatePagefilePrivilege	3032	chrome.exe
Token: SeShutdownPrivilege	3032	chrome.exe
Token: SeCreatePagefilePrivilege	3032	chrome.exe
Token: SeShutdownPrivilege	3032	chrome.exe
Token: SeCreatePagefilePrivilege	3032	chrome.exe
Token: SeShutdownPrivilege	3032	chrome.exe
Token: SeCreatePagefilePrivilege	3032	chrome.exe
Token: SeShutdownPrivilege	3032	chrome.exe
Token: SeCreatePagefilePrivilege	3032	chrome.exe
Token: SeShutdownPrivilege	3032	chrome.exe
Token: SeCreatePagefilePrivilege	3032	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3032 wrote to memory of 3692	3032	chrome.exe	82
PID 3032 wrote to memory of 3692	3032	chrome.exe	82
PID 3032 wrote to memory of 3188	3032	chrome.exe	83
PID 3032 wrote to memory of 3188	3032	chrome.exe	83
PID 3032 wrote to memory of 3188	3032	chrome.exe	83
PID 3032 wrote to memory of 3188	3032	chrome.exe	83
PID 3032 wrote to memory of 3188	3032	chrome.exe	83
PID 3032 wrote to memory of 3188	3032	chrome.exe	83
PID 3032 wrote to memory of 3188	3032	chrome.exe	83
PID 3032 wrote to memory of 3188	3032	chrome.exe	83
PID 3032 wrote to memory of 3188	3032	chrome.exe	83
PID 3032 wrote to memory of 3188	3032	chrome.exe	83
PID 3032 wrote to memory of 3188	3032	chrome.exe	83
PID 3032 wrote to memory of 3188	3032	chrome.exe	83
PID 3032 wrote to memory of 3188	3032	chrome.exe	83
PID 3032 wrote to memory of 3188	3032	chrome.exe	83
PID 3032 wrote to memory of 3188	3032	chrome.exe	83
PID 3032 wrote to memory of 3188	3032	chrome.exe	83
PID 3032 wrote to memory of 3188	3032	chrome.exe	83
PID 3032 wrote to memory of 3188	3032	chrome.exe	83
PID 3032 wrote to memory of 3188	3032	chrome.exe	83
PID 3032 wrote to memory of 3188	3032	chrome.exe	83
PID 3032 wrote to memory of 3188	3032	chrome.exe	83
PID 3032 wrote to memory of 3188	3032	chrome.exe	83
PID 3032 wrote to memory of 3188	3032	chrome.exe	83
PID 3032 wrote to memory of 3188	3032	chrome.exe	83
PID 3032 wrote to memory of 3188	3032	chrome.exe	83
PID 3032 wrote to memory of 3188	3032	chrome.exe	83
PID 3032 wrote to memory of 3188	3032	chrome.exe	83
PID 3032 wrote to memory of 3188	3032	chrome.exe	83
PID 3032 wrote to memory of 3188	3032	chrome.exe	83
PID 3032 wrote to memory of 3188	3032	chrome.exe	83
PID 3032 wrote to memory of 1412	3032	chrome.exe	84
PID 3032 wrote to memory of 1412	3032	chrome.exe	84
PID 3032 wrote to memory of 1260	3032	chrome.exe	85
PID 3032 wrote to memory of 1260	3032	chrome.exe	85
PID 3032 wrote to memory of 1260	3032	chrome.exe	85
PID 3032 wrote to memory of 1260	3032	chrome.exe	85
PID 3032 wrote to memory of 1260	3032	chrome.exe	85
PID 3032 wrote to memory of 1260	3032	chrome.exe	85
PID 3032 wrote to memory of 1260	3032	chrome.exe	85
PID 3032 wrote to memory of 1260	3032	chrome.exe	85
PID 3032 wrote to memory of 1260	3032	chrome.exe	85
PID 3032 wrote to memory of 1260	3032	chrome.exe	85
PID 3032 wrote to memory of 1260	3032	chrome.exe	85
PID 3032 wrote to memory of 1260	3032	chrome.exe	85
PID 3032 wrote to memory of 1260	3032	chrome.exe	85
PID 3032 wrote to memory of 1260	3032	chrome.exe	85
PID 3032 wrote to memory of 1260	3032	chrome.exe	85
PID 3032 wrote to memory of 1260	3032	chrome.exe	85
PID 3032 wrote to memory of 1260	3032	chrome.exe	85
PID 3032 wrote to memory of 1260	3032	chrome.exe	85
PID 3032 wrote to memory of 1260	3032	chrome.exe	85
PID 3032 wrote to memory of 1260	3032	chrome.exe	85
PID 3032 wrote to memory of 1260	3032	chrome.exe	85
PID 3032 wrote to memory of 1260	3032	chrome.exe	85
PID 3032 wrote to memory of 1260	3032	chrome.exe	85
PID 3032 wrote to memory of 1260	3032	chrome.exe	85
PID 3032 wrote to memory of 1260	3032	chrome.exe	85
PID 3032 wrote to memory of 1260	3032	chrome.exe	85
PID 3032 wrote to memory of 1260	3032	chrome.exe	85
PID 3032 wrote to memory of 1260	3032	chrome.exe	85
PID 3032 wrote to memory of 1260	3032	chrome.exe	85
PID 3032 wrote to memory of 1260	3032	chrome.exe	85

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/kh4sh3i/Ransomware-Samples
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xfc,0x100,0x104,0xf8,0x108,0x7ffab967cc40,0x7ffab967cc4c,0x7ffab967cc58
  2⤵
  PID:3692
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1888,i,13546739569419157717,5789955925797932020,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=1884 /prefetch:2
  2⤵
  PID:3188
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1716,i,13546739569419157717,5789955925797932020,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2160 /prefetch:3
  2⤵
  PID:1412
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2240,i,13546739569419157717,5789955925797932020,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2452 /prefetch:8
  2⤵
  PID:1260
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3124,i,13546739569419157717,5789955925797932020,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3168 /prefetch:1
  2⤵
  PID:712
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3132,i,13546739569419157717,5789955925797932020,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:380
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4856,i,13546739569419157717,5789955925797932020,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4860 /prefetch:8
  2⤵
  PID:776
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4088,i,13546739569419157717,5789955925797932020,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3864 /prefetch:1
  2⤵
  PID:1960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=5116,i,13546739569419157717,5789955925797932020,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4500 /prefetch:1
  2⤵
  PID:4804
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=5084,i,13546739569419157717,5789955925797932020,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5232 /prefetch:1
  2⤵
  PID:3832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=3244,i,13546739569419157717,5789955925797932020,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:2008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=4600,i,13546739569419157717,5789955925797932020,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=728 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1568

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:1492

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1792

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:560

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x120,0x124,0x128,0x11c,0x12c,0x7ffab91b46f8,0x7ffab91b4708,0x7ffab91b4718
  2⤵
  PID:3972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,5110821287213692598,2818358716113720714,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2184 /prefetch:2
  2⤵
  PID:3576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,5110821287213692598,2818358716113720714,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2296 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,5110821287213692598,2818358716113720714,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2664 /prefetch:8
  2⤵
  PID:4960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,5110821287213692598,2818358716113720714,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3392 /prefetch:1
  2⤵
  PID:2312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,5110821287213692598,2818358716113720714,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3412 /prefetch:1
  2⤵
  PID:1384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,5110821287213692598,2818358716113720714,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2292 /prefetch:1
  2⤵
  PID:5048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,5110821287213692598,2818358716113720714,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4292 /prefetch:1
  2⤵
  PID:5052
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,5110821287213692598,2818358716113720714,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3420 /prefetch:8
  2⤵
  PID:4888
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,5110821287213692598,2818358716113720714,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3420 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,5110821287213692598,2818358716113720714,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4828 /prefetch:1
  2⤵
  PID:2916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2128,5110821287213692598,2818358716113720714,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5368 /prefetch:8
  2⤵
  PID:2308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,5110821287213692598,2818358716113720714,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5284 /prefetch:1
  2⤵
  PID:4364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2128,5110821287213692598,2818358716113720714,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5764 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2348

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1820

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4756

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0x7c,0x108,0x7ffab91b46f8,0x7ffab91b4708,0x7ffab91b4718
  2⤵
  PID:5060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,16720250141818857807,1399927918830166875,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:2
  2⤵
  PID:1188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,16720250141818857807,1399927918830166875,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,16720250141818857807,1399927918830166875,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2900 /prefetch:8
  2⤵
  PID:1696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,16720250141818857807,1399927918830166875,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:1
  2⤵
  PID:2604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,16720250141818857807,1399927918830166875,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3412 /prefetch:1
  2⤵
  PID:4604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,16720250141818857807,1399927918830166875,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4636 /prefetch:1
  2⤵
  PID:3968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,16720250141818857807,1399927918830166875,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4560 /prefetch:1
  2⤵
  PID:5056
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,16720250141818857807,1399927918830166875,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5132 /prefetch:8
  2⤵
  PID:2712
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,16720250141818857807,1399927918830166875,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5132 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,16720250141818857807,1399927918830166875,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5280 /prefetch:1
  2⤵
  PID:4768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2124,16720250141818857807,1399927918830166875,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5568 /prefetch:8
  2⤵
  PID:232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,16720250141818857807,1399927918830166875,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5588 /prefetch:1
  2⤵
  PID:3828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2124,16720250141818857807,1399927918830166875,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5816 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,16720250141818857807,1399927918830166875,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6056 /prefetch:1
  2⤵
  PID:2296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,16720250141818857807,1399927918830166875,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5988 /prefetch:1
  2⤵
  PID:2488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,16720250141818857807,1399927918830166875,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6584 /prefetch:1
  2⤵
  PID:3536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,16720250141818857807,1399927918830166875,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6600 /prefetch:1
  2⤵
  PID:5012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,16720250141818857807,1399927918830166875,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6904 /prefetch:1
  2⤵
  PID:1516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,16720250141818857807,1399927918830166875,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6932 /prefetch:1
  2⤵
  PID:2272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,16720250141818857807,1399927918830166875,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5784 /prefetch:1
  2⤵
  PID:2488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,16720250141818857807,1399927918830166875,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1048 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2124,16720250141818857807,1399927918830166875,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6716 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,16720250141818857807,1399927918830166875,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6828 /prefetch:1
  2⤵
  PID:4860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,16720250141818857807,1399927918830166875,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6816 /prefetch:1
  2⤵
  PID:4068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2124,16720250141818857807,1399927918830166875,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4080 /prefetch:8
  2⤵
  PID:2900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2124,16720250141818857807,1399927918830166875,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=7020 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:4844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,16720250141818857807,1399927918830166875,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6776 /prefetch:1
  2⤵
  PID:2424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,16720250141818857807,1399927918830166875,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6236 /prefetch:1
  2⤵
  PID:1796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,16720250141818857807,1399927918830166875,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4400 /prefetch:1
  2⤵
  PID:2640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,16720250141818857807,1399927918830166875,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7032 /prefetch:1
  2⤵
  PID:4776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,16720250141818857807,1399927918830166875,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6444 /prefetch:1
  2⤵
  PID:4328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,16720250141818857807,1399927918830166875,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6560 /prefetch:1
  2⤵
  PID:2720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,16720250141818857807,1399927918830166875,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6416 /prefetch:1
  2⤵
  PID:4444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,16720250141818857807,1399927918830166875,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7144 /prefetch:1
  2⤵
  PID:3588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2124,16720250141818857807,1399927918830166875,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7060 /prefetch:8
  2⤵
  PID:2028

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:956

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2776

C:\Users\Admin\Downloads\Ransomware-Samples-main\Ransomware-Samples-main\Cerber\Ransomware.Cerber\cerber.exe
"C:\Users\Admin\Downloads\Ransomware-Samples-main\Ransomware-Samples-main\Cerber\Ransomware.Cerber\cerber.exe"
1⤵
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:3096
- C:\Windows\SysWOW64\netsh.exe
  C:\Windows\system32\netsh.exe advfirewall set allprofiles state on
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:1708
- C:\Windows\SysWOW64\netsh.exe
  C:\Windows\system32\netsh.exe advfirewall reset
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:4844
- C:\Windows\SysWOW64\mshta.exe
  "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\_R_E_A_D___T_H_I_S___7KWGV2I_.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2704
- C:\Windows\SysWOW64\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\_R_E_A_D___T_H_I_S___35PYYBJ2_.txt
  2⤵
  - System Location Discovery: System Language Discovery
  - Opens file in notepad (likely ransom note)
  PID:852
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4532
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im "cerber.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:3588
- - C:\Windows\SysWOW64\PING.EXE
    ping -n 1 127.0.0.1
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:532

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Network Service Discovery

T1046

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
2bec5662c8ee1e68061ae0480c3ce396

SHA1
7c9ba0821a16b7cd0b4a7eaf433a78fb4df750a9

SHA256
2121a4e22e4cb4cd1bbf223908d168e8374a729430596cc12079056d6120efb3

SHA512
15c037be773931250fc2b93e4084fea593b5646c286035dfe42700e5bbf481bcfa6384e1423d70a68a9e3f1c01b5ff9c526121b3ff8e3b8366aca29d20251ace

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000013

Filesize
212KB

MD5
08ec57068db9971e917b9046f90d0e49

SHA1
28b80d73a861f88735d89e301fa98f2ae502e94b

SHA256
7a68efe41e5d8408eed6e9d91a7b7b965a3062e4e28eeffeefb8cdba6391f4d1

SHA512
b154142173145122bc49ddd7f9530149100f6f3c5fd2f2e7503b13f7b160147b8b876344f6faae5e8616208c51311633df4c578802ac5d34c005bb154e9057cf

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
ce9b9e7b5e0632c124aeee0603601c0e

SHA1
15dab7b93c0f0fd5f7feb221970e61ca1593cc74

SHA256
b8bce5591d639f47a39ab3d9246975f6fb0451ca4f5be2eeba88a279845a62b4

SHA512
ae9811b266037e9be96850578c5d0afcaf676b49d2fc5505c7c41506f376c10697a19eb51c2b7908805473ec71a0a2ec12ae7d3a81e52543f23df1353fc2ce10

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
cd82a7010b91e4bd6235ad29412d08b6

SHA1
8ffa9c11e9724bc626bd5bdff0483349d8378b9b

SHA256
38295e03ff30a5ca02be8418ad6c8d62e7bffa1ac8d7ba0f7054bf18d4168018

SHA512
40c22b04ac49d07b7f8bfa44d5460d3ef3b8c6e39e0cfa3787f2cd1edbe7b8ab4519e6834fe594202f3db5c8a29ac337d054fe84b27057e804d8e63bc15275d3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
4KB

MD5
7ad71f243617fb73057a7a92d0cb676f

SHA1
3287b8ccc40532e28a8be2dbe88c73f5cefbf892

SHA256
72b80ff23c28c552d43815a3a207a271ca375d8b826e5e5cb8b3c4d3715219a7

SHA512
c41c304201dc11b98e555f2ffc89f5a3fac1dac3f56c11a7f942773dfd70c2d6b677b437d5642facb85162a62495b5092803d0422a07e81d3048ba2f9f292dd4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
ca5b11a520e45a8e142a3e7976c72936

SHA1
82fb6fc205bcb838bb46c07deaa4e6e4916a6f49

SHA256
1dfc4e786635b98d88c6eb57aed4bd58bcc23b8c7498063271852d4a2d5b00bd

SHA512
0bd1a88de45edaeb7481e6f7ac3670bbfd9509a70be78bd173ac448bc105bf7819f59cab905ce3c1e64bd296fca377a5c9f56e18b4d17d6b71d0648bfb38b931

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
ce5c37b0e1edd64237fcbdb1426a615d

SHA1
0315b6d5ca6e49b702444045fbba6231cd4b21e0

SHA256
22a2a99bfb9895f38cfd836582ddced1f7ebc5e85ae3c93f22120f6731eb3c90

SHA512
07ebfce9e3f8cd1cddea1d976d4d2dd380259f2aa696ae1378ef7af8190c8a3ce52d12c65db8cd81cfd995f121c40523488494994af4a0e90b3c969197a515f1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
dbea34cecd04ce2a02494b127a29df62

SHA1
7bde639b99f5c9504f5a2bb125ba8eb1f9e5e8c5

SHA256
044c6028d0203fc2d7145323575f027bc5ee0ce4c553ceefd5fdfa68198c41d8

SHA512
aa60e32122b052de2679fe47b3b8caf3d7e7134b363a48426f81821aae68e0018d00e28a73acfc8b62d18ba8722dd03e585a429739556c7b8f1098bf06f6906c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
df83d699ee23c94e2640e6f7dbec3df8

SHA1
433428918d4b5468bebee62045f77692122c3893

SHA256
0c59f923e784f711246b62a3444ab7dc85e94f23e5fdfb7eaafc87ea4c0bb209

SHA512
924822490bc7ebcd5f2a0e466b27266ead3e715aab0949e685d66da17f464ebf072c34caf83e339570b0b13dd403b1ec786cb1cef0d5647ecffe6239b0e7bf5f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
a45a431f38c5490a487a5bc6cba6401e

SHA1
f92c42f9b0df2784e4fba65346d313cd4a36142a

SHA256
b9a7318b75659c6d5a00d99896db080d99170449cefe863e54c38f700f8dc4ad

SHA512
0bd5d8ecee5f1c25f0f8e8b43a806a18b11758020be4327b95eed8f467eb411fac0d337e98b65af8b23f22fd46f5955bd5964fbaab00f2a5b61a7953843e7291

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
c592c0922a36d0d021dbeeb98b74164a

SHA1
7bfbc4e0ca351ccf1fda10a7fb8c1921fa89e164

SHA256
b662faf865be56aefbf64292cb58ebc98cdc23ce2c26448d40cd8adff447cd11

SHA512
1f42b4ba2bb0b469b37da99abef79054d960014ff37d3e4fcce1e0dadd9bd174a2484e90071e9eb59368305b03f4f3a18997adfde711106698ce24d1d12dc4c1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
a08a5dd2c91961ee6e20ddbc4aadb978

SHA1
52be03f0ac84e0fdadeb18b29cf0fe060860e597

SHA256
592dcb1cb1dbe3e0528cdbc756aa9fec4806ee38180b8eb477caa5690e319c47

SHA512
ba06ad14aadca6a5333ca25642130f1aa1dbfd5c374c5bf974a89120918a1936cec6b82fc823a59c9aa3528245f9c830f53941a84f3e6d0cc991c942c634f24f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
c50d1a345ac05f11649022ea5c1d995b

SHA1
13ebf977ecd516e11e30c9de07911a94e8185616

SHA256
f142ab2b1089a3d06cc9aae2f9190bd4f49676b03d4ab3e5374ac715a468c1e6

SHA512
aee4673a0aaf0a1fe5876ed73649521d692f5b64022db2d2dcd445345cf6e90e92c0dc492441dfb11d7d32d556506010610ddd6439bfcd1e36d188bac35aca78

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
9d908daec4681f541a9dc0d7dac93e69

SHA1
24cebad5d1c962e575260300bfb2364cf1d1d930

SHA256
cf2723494023b72ac83d3e444af2ebc3a958ff938606ced2d90cecc002764ac0

SHA512
974464428b93ecab3c3b8be47762390a3c8326d17fedfddf12cd02baad6b7424def848fa7cb6b0e471d29859cf2fdee76bf8d4fce54e46187a1feb788894c195

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
7908ccf915f42f275c2341bd49b251df

SHA1
73bda3f89a886ce82f826e68ab42cb68b536c87e

SHA256
955b9f604b6abc250103fff8e0c932ea2312b0ed39d50a05141182733ad868f1

SHA512
63a1ca14757b86c892dc4aeba09f1b73b3158a94f89500f7243bff9478d5211cc0a07481f1e7907900494ed5c0d9d2b9c018a546ad136db6ee3498243bd46353

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
99bff9f90534515024ff646d3412da7f

SHA1
83b74669d5b77fabf9dd6faa97086c56686ee7b9

SHA256
45d3518e6d34d33167ed078f19c9861d1c521ed93aff25351410c4106c86c277

SHA512
41058ea581b4dd36370ddabed203c165b56a78215358cc442b105dca48830083f88e867bb8b01c48134c1787f76fa1aa03c35f9a6bc777a4377a2e949921cd7a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
76cb7536c26a9d74740b1cf110162f38

SHA1
792ff419513618d9f10d58cd200735a382681f5a

SHA256
06ce32a161cdbdd8e2fd7837c2ae77f1d3a5d07f8149c5ff20ccf4b6cff81b29

SHA512
b17c895608f15b084b9455120f14c60865b691dc40e9532eaec318eb1b6ade6a6f3aeeb1165095d6cfa6427447b2193a210dcef20eef78a7ffd36b718c98f7db

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
0db683ab9cad07e65d56be1eb80416e7

SHA1
b974f151a062668f169a752f3e01c7aaddad233b

SHA256
4f320c0a0822b7399eb109751ba2df4795552de06e6d8f4870aaace10aeafe1b

SHA512
9d27e882966c3ed9fee9f0f5979555218f67253626957dd48de61ee826741a35d2a7f9571b49c70403727dcbbeaf6d0f7f142f51a9fc61c4e156ab8055fa233e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
3aad2b0dc4880b29ac221a4c7ecfda6e

SHA1
4b84e21ca9f8f4d28c98aae1b04c1d5b61056af3

SHA256
c0dd3e5d4931a219504f3645cbb4762e29b3b38feab2f3071aca0f5ec1ea60c9

SHA512
343ed4e80a832a55f0803450905bb7bbebeff5638b19cf64316812c7b1abafe945b511f05180c5ed7cf85cbf8f0b793c959c17c4937018502c9e344157f42288

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
7abeb3cf5c991ae42c013d921dfe01a4

SHA1
5702cd683a2f6e339fe69ae713e4cd1291173e4a

SHA256
b31b167079e326b880abcb5ffa7041562c15e987544a0e818d98b334947444d0

SHA512
76e3e3cfda67d9422f5614d6ad1581e7c446946190eaf95308eababf2ca755a2f4437c8c2178d104e87fb1cdb7ec8963343d33ace25ae0c3446fba3d758da33b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
983fde08800b4df6fdfd6017f99dfdac

SHA1
569ba2b6a373bbac70726de321fbd907637358f2

SHA256
e6813ed5ccc8646ed7fcac903f44442bdff40b5efba9717790cd2a4c77432351

SHA512
d01b6544f0052ca769191e0ff906417b92fbe8a84db832a2b67ab377768c07a41f684ddcf5be528ca1cb11bd34ccd3e6e6a8a436157ccedb84c507a5581a15df

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
22b55c72c9b0f246f49f5f8cd9c520e8

SHA1
4e4629cab53fbad7862826e738362d3dd15f99e9

SHA256
19e00d198b674e5c0890a070ca4cd827ab13446709476724f61ebb837b9d8af2

SHA512
72160508282680faacf3df2ebf56ca85574bb09e6016e83294d8ee1f5eb90eb784ae5a5f447bee2e7dc80a6f932d56329d7ad350fcdbfea194b49c989192e9d6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
bbbbbc4d03b3b6f447acb11783db9481

SHA1
a17feae3f7c69dd8cded43fe14d29c33601cbf45

SHA256
fa26e6f2ba0dfb155f5f9a27096880011930ce78421a5b5f597ba89807d6d607

SHA512
bedddd98d987d3c63708b7dc3e68389527c9922bf96e8dbe640657b5643e065d7b0b0396d0f1d738442e5fd066590c85d3ab9336e7b8a6da2dcb5404811b68e3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
99KB

MD5
7a0f5a66ae84baeb951bcc247f92a089

SHA1
56f30a22bdc9dab54cf9924697715c92e2e4a78c

SHA256
964ddd58c100e7d893b8cb8293b99fff589879228059c4da62ba009c27b7da80

SHA512
4a1cec6f2d8fd36bad783f293ad2e4e1a02b21c82541d11f81027d04c78ed731dc68c160fd6b94cf0e846b9d06289ad482808a9dc0ad4792cbe93ef2ba636b1f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
99KB

MD5
0cbbc020570addfcf319b94689355f68

SHA1
781862f1adb75fb32de8b4b30fe49dce7c9d725e

SHA256
61ade3d49c9d91eec10a2282e17873b81a5da80b5f1a5caafbdf0ee3d3397282

SHA512
d027e19edf0de808ec999438b54fa69ef5ee113be5956cd3e812efcdf96c425d1079335ebc1723bf774b8faa3c80f30b7b24634318cbaca25a4b15fc25edd658

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
99KB

MD5
4d0b6fdfa043a1c7020891f6fae3d546

SHA1
394ba449bb3e4a51a3200985706214c000cdbe89

SHA256
a6cf68038368faa4cc240ea3c0998ba68813a2b4df8434d5509e26d23954e7b1

SHA512
2b0bd546cf8423d3d6e6dd8b20cd8e016f40bbf80e0a4db3d2ff7bbede36582287496e9ad0aeb6d5d9f4016efaef1c342c405b91a3211534b01f6e5391e15553

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
99KB

MD5
ba9b177b63bf8b1937b6825f4e4c9756

SHA1
31889f1e9a62546e0a6392c840e9899b28ce9de7

SHA256
44af4940ce7adfeb8296745f6c6ff81af37288ec961bf0970b763b25f53ceac2

SHA512
5d4c8094d2de4127c164a541700b824cf5f5e08fd2ec434a86bd63344317c43d68506524a55f1f62625c93f290efb4df6859d7c1f8ba40109e5f516cd7933de1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1

Filesize
264KB

MD5
6cb6715ee7de41ba8780bd91b096ff4e

SHA1
dfeb6502ffddd2f9b7bb7b3796791a5c60fa1ccc

SHA256
70c3495116407bb8f8a69aca92bf2e91840eb09a7da7e429b2f46697179937ba

SHA512
cbc50cc2b2abc1b8517611f2d254a4fb2cb83f930e9d2c0c677e4c8a7ffd06e728de1aa9c96efea27022ff4221a7426a8594b9bb5222f3ff27fb9f44da6d2a74

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2783c40400a8912a79cfd383da731086

SHA1
001a131fe399c30973089e18358818090ca81789

SHA256
331fa67da5f67bbb42794c3aeab8f7819f35347460ffb352ccc914e0373a22c5

SHA512
b7c7d3aa966ad39a86aae02479649d74dcbf29d9cb3a7ff8b9b2354ea60704da55f5c0df803fd0a7191170a8e72fdd5eacfa1a739d7a74e390a7b74bdced1685

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ff63763eedb406987ced076e36ec9acf

SHA1
16365aa97cd1a115412f8ae436d5d4e9be5f7b5d

SHA256
8f460e8b7a67f0c65b7248961a7c71146c9e7a19772b193972b486dbf05b8e4c

SHA512
ce90336169c8b2de249d4faea2519bf7c3df48ae9d77cdf471dd5dbd8e8542d47d9348080a098074aa63c255890850ee3b80ddb8eef8384919fdca3bb9371d9f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
77ca0b951eed204ac2d8966519888de2

SHA1
7e6cf092ba55bf8624d5618f33d4c88c7b752cfd

SHA256
391c4efbdf35ec0889648759e3e99360886b432882432b70db969dbbc6c63042

SHA512
7c6a6b02abf63121e8beffd631780ecd07759176649b55dd7a6ce0f44e5ff6003e64aad9ce5803acfdd4e325ecf5fc853cc94e099f5e79b43f9ac1b166d27071

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fe2590e23cd6af9e6580ec8ef2a41e26

SHA1
f08ee69275b249287f2cbd9cdc3207ed53ab8e52

SHA256
8b9f05ed8a209bab2b15e21a76171a28d0bb39271a211ffc2668cb9614f12b58

SHA512
624dbf1db3658834d398172d7d0c1915fb23718e88593cd22733c95476ab042260087e9d7ed8c13f0d7a7f738214640de1b0f547b172d3db8f6eb6be5ef045c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9579630d-0a7a-4786-b5c4-b5069fbca171.tmp

Filesize
1B

MD5
5058f1af8388633f609cadb75a75dc9d

SHA1
3a52ce780950d4d969792a2559cd519d7ee8c727

SHA256
cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

SHA512
0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_0

Filesize
44KB

MD5
ea454536b6bbe1d259fd4bd3c409a830

SHA1
44e35d5387903b7816f5c3995bf81af268127bf5

SHA256
4ca626f1f014de0ebbe455935b9ff076c29c662cb20f6a0e0c94763f801eb81e

SHA512
7fbc83e28e908dccd39d7d7564be65a6e73c93595b724cffd1f12c5b64f8fd0dcbfe004042ca7f3f2a02a3b399b79214ddb6e985b0d8590580b183bc275d44aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_1

Filesize
264KB

MD5
5afed82ec27a95740df717497dfdd262

SHA1
3d07ba89ce118fad326f896e2ef2f3d30a0b2d35

SHA256
a99431e26519e881b67a6936319b1e519feecea9bb2793b84c702008e2bd9b2a

SHA512
09c0581632b9acab83bce65f41d1f988c5bb527a445428f9e04b568c3d49ccbfd87f45719fcd242ba49cb83b1db64db9f055f54318c515b8c8eda9efd3099ad1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_2

Filesize
1.0MB

MD5
1b052ca18361bf870acda2c602a3985b

SHA1
6903f2933a34df946815277de7675872cdc688b5

SHA256
0b2c8e9d9aabda872d2ff0b019fe7afb546a2c40569fc92ffa3b4fc1634f1f5a

SHA512
bafc9fc9527a2ae23531bb49b97b0d8456cdda56bbca615ffe8f984e646fdf2f1829a9d2a8c6841fa314ff1bc60d6281bd89adc3bcdc6ddbb5f7e7f069f2eaa1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_3

Filesize
4.0MB

MD5
b0d59045eb78095b00fbf9a12433e1ec

SHA1
bac2ece4fa3e1880fe6b26277d51e6e86c533142

SHA256
e766b76a4cb4e2cf220ef4a49786648126c71c9f0102f68fc226ec720804e2a9

SHA512
d7f1227c96f7274fb501e51e876a1158563d1a012b159042319eae280c1c5f384fabc4114ca6ec6beb4b7684d1ec411f874ae0ab442ae0f3cab67ae7ffa6908b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
93ccd8bcf06a1489734e25c7b1ce4638

SHA1
87514cae8b6fcc2a3ea46acf2334790842ea3316

SHA256
5f162b885b66a1b63c1da80a4c07212c693f26f572f68c4745efff662fccb893

SHA512
7da4ab50dc538f60a08fc6d3e90e5e953d5d43247645b2ac9252e478d00f7babd7433aab7419cb2979bae3ea181018b8462e44b4d9b56c757097d4382094ca93

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
f7dfccc873ed1ec054d69fffc4b1109c

SHA1
fdee8279355451c0aac7f1be0049e8e70b43ce74

SHA256
f346242dcaa7773a26ddb0667465fe5b69abf41def6ab17c4cc91ca145aa377c

SHA512
452644240d22eea796fa512e4ae0b560014da11bdd28a80f3fafdaf2ab7ea6cec0a08c42614d3f6dc89672a7ced72c274e219f0b7d204335a737720b507a3a76

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
312B

MD5
aaec45124be7e8d3fec948f383f5bdc9

SHA1
7d3c5e5eff77a66cc05fc4561278baa0410549b5

SHA256
9daf54a2625fada1a4d057dc9e956b2ade3b1245d9c9367564cb36affc5bc76a

SHA512
6a485f1607bd32f3fb043cad74d5cc7fd71035fa3718aa253194dc1ca875a5ff5fdbccec3cf5832a1bde3070bf5b93c8b25f3d99c3479175b57917f850bdf228

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

Filesize
319B

MD5
72af5c0d9712fa7ee090d62cf5959f23

SHA1
381920edfcb6af9d1fcb0487794452df7a0bcdc6

SHA256
3705374e1cd313334f377d4c55bf136cb04bff9dfcbe15ee69f6344898246e2d

SHA512
6580574f891a3da5adf17cdeb66e15632d34a7f904f4c547a75481d9ddb03a3891e8f9f35bbfd84dcfac1beab2c3262f53da2e4ea7f98072ace6bb15a9249fd9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons

Filesize
24KB

MD5
eeb0fe7af6b4186816f473e464b8cca7

SHA1
7ab4889d11fe51055b15ece6858043d4f06301e0

SHA256
45fe1b2e3d9715372a4f8a0a229d20688c02cf16f215835baf4495ff76ca6ff0

SHA512
90225ae1bad62c24518702aa73c21f73f3cdc4b5ccfea4b8a2fddb81bfbee199b8278f760e9b07b492c63b558ce534f1c6f69b150004851c7900d3090ded530b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History

Filesize
124KB

MD5
c63a3e7362fcb9495b27240ae7549e30

SHA1
a2ef0b7c442fdd0ab6ca751716b0641bbb2f5067

SHA256
d940085cd1169a2becbcd1d373f39021bf9b10d165fd4b12d1360eabab5985c9

SHA512
3b8124cd1166a839885ba5c5791fd7a7335a0bb2b5be61b93bd423de077dcf803e7dc82fe4386238adbe17289ebcc0fcce26ff96f9c71ad22bda0fc13d0595f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History Provider Cache

Filesize
799B

MD5
13424fa6df971c5ceb2cbcf573ed14c5

SHA1
fa4494a2b0309572278f411be089ed523a2f0930

SHA256
04e3e94891bbbaf1d55061ee03066f9ae64b7fe3c88d6aad26d0cd59ffb54c7a

SHA512
31cd65c4b7ce395f8435ed4b75451f6ae241b155d48cb5c309e18bccbb14879bc0d6778e5cab8a9de4df2edc5100e61d8a183d64fb7ea355cb43aa38c3d399d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Filesize
331B

MD5
8398868fad3e705be6558a07338316ca

SHA1
093b6973ffd7a3011179b463d703337905157241

SHA256
3c8a04ae2aad0065e59bfe8c55d17b0f37ab48a50c2eed498e521b514dcd7e9a

SHA512
cc56fdc8507d360411a5873e54066aff3d3e917821b56c9a25b9a7fbcfb56edb48277b392d3a1106e75437f312f5eb901304cf3b23036206e2e639e16473613a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
6eb2d8c72cb8a61997753632d10fc91e

SHA1
e4740ddb88cf1c4c5b14d4ba0ff98fc15982194d

SHA256
7ac60af104a8471086ca79e82c18c1be1a4b2c85091ed9293f306ab04acb7440

SHA512
79ca4628a9b9fa54ad5eacba47b4ed4ce032fd92f4aa73f67c455761ab3d9fce526a6437405c6bf68a4e387bb224003d4ead2df19bb057e7c2d179d83e779f08

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
cd48f35628799fef71b09231cfbed926

SHA1
8f8a5e3e9f86c433741d2636b22876448608b4cf

SHA256
c32ca0ddca26db007b3f55d2f9c1e4075636fd9b5439859e439670f2f98a93e8

SHA512
5d261714763dba273272a1769db4bc1bb0dfe37bf2a4c8d87324371555981e4967b3e3296f075234d25384a0d858b0b1c2e4fa664bd8356593539a953cbcc459

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
42771225e19002c05d13be853ef574fb

SHA1
0f6ee8d8b244da51f486bb01d93753f1741c7f92

SHA256
55877b36612501069795cd4fa8cd94c58f709811d30653626c5ddf62378f742d

SHA512
47d17c7359de74e2563318ba3610d4fd9b08de954af6edb89a858499c33a50796c57279a3749c901b5a1cc9b0b29246abe759802a998b841f043d00517659050

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
fd17535ea8b695cc5992a1533d4b357a

SHA1
8c1e0c33b60c99a6ee69e9e90ffba91720143b5a

SHA256
449de32c1f242d1a04017c311497cd0a6e8a060aee63eec2a05d1da96883cc4c

SHA512
8cf91560e4dd00a27dbb047fc7f1e208b4ba7172eb7fea0ed055be5663d1b1cf52504fe016c8b8ce357be1e5fa370366aea01109d91a76df413f755743b8991c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
dccb9c4398430e8a35335956d4b21378

SHA1
ec0f16abceb03654717a5d54e19ba634d1b1d94f

SHA256
20151724683b8b4801b8f58c8ffffaa50d40a65cb53d3c48e3d726711d1b2eca

SHA512
7b16c5a749c540eae987b19bce2d187da7e82bff23a42449f5c620ef9997e515bf8d6f95080c801ad756440da04abef409f6bfcad490cd65f6bde4172be3c308

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
cf0ada210fb7207f8768766feaa9b30f

SHA1
bbd3fc53902000e57255eb9becbccf1ea33d11d5

SHA256
ab27c9d0618ec941183fcda0b9067a8251cab71748d0760c2826b5ba094d5a78

SHA512
2b0f95d56f8f3962eb2103187b7875f28b409606baba5e9ca67f130a41c44e1db887c2a101665e0369d249e318b265a9f223fdbed5ebbd869e55ff1a7c614cb5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
4a31f16b9d1095c8ca8c3dbfd2203fcc

SHA1
46f78764d645e2201a4afd2e22e7a24a2fcf604b

SHA256
cdc14eb3cffbd4402c2f419c531c272d0aed7b7daf1af87859b377f094aaf9fd

SHA512
c7026fb71b667ac956d1a4d2f2f1b87c51c54a8ecd6bfc13bb900e560bb2e448e8a50d56efb91b4a46c7a6f1864eff2e30c854eace1e7d120e6a11dc5ec11845

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
db089e4312ecffa939e032a84c8da640

SHA1
3781a174dca2a126022c5e52a7d3473d214ee035

SHA256
b2b6c6584ddba6c614b1650966ce368b8313ab8af01e6ffb49b7b3bfefa2b3c9

SHA512
685dedd8b391d9a9fa4d57f6516dc3cd110baa48638ede15f60afd592a13f8eef8b542d3a9f1eb6c2eef5b53c85f66f19b0d4981343aea30dd91cfac659b8636

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
60cb18295139f1469e4198e28ce13f4a

SHA1
dddc27379823a3c6f27513ad452fa8f184152a7e

SHA256
509b3a8d8d827d07fc46108ac725fed83f0a4b05189c0ce6f7252ce2df77408b

SHA512
545bdf21b6a9bd56f0ad61697fd2c4fc7385abcfbfa9d2b957c9e9c4c729baf08365cb59300a4c284ca667d32778965ac351f1eeb0221c9b82c3eec316d45776

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
f25990393a731120f7725bb4bd048ec4

SHA1
5a452e6d8e0c58d7570e3cad7fd4a517cf3e96b2

SHA256
060645f563d32ab1ed1f985211877be11e745da12be1f2a650dbbecc146fd632

SHA512
f4cc4f1ee9dc6aba71b868eb59a6f1cf710b9f15d113fa502e2d66902e72647453c37ecbe726fd01233d32a1bb8130a4294048324bdaeaff3458f6a8e7aeb4b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
750992e489792c2284f94111accf25a8

SHA1
11ca6446241b72f3e8686f29a88c3a5db6141451

SHA256
2b7f568b7c17ddedf00b424a3d489a01d65270b8bdd7f21d55af7d914256f77f

SHA512
7e747b4a484eafa7cfeeecc0b0dbc70a0544449a25940fb62b1c10af40218f80e253d6e3772fb3217ab8c75be3d7976c076b0f2cdf4793aa318b6101ef7b1e51

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Filesize
156B

MD5
fa1af62bdaf3c63591454d2631d5dd6d

SHA1
14fc1fc51a9b7ccab8f04c45d84442ed02eb9466

SHA256
00dd3c8077c2cca17ea9b94804490326ae6f43e6070d06b1516dfd5c4736d94d

SHA512
2c3184f563b9a9bff088114f0547f204ee1e0b864115366c86506215f42d7dbf161bc2534ccaee783e62cc01105edffc5f5dabf229da5ebd839c96af1d45de77

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

Filesize
319B

MD5
596fd8822573a46188d79aa205317c0c

SHA1
706137ab771ba79a0d6c6e17249bba8f59a21f43

SHA256
341a8d36be62247e87734d485cda30e26618e0fc76cde8a1416035e4982ffdea

SHA512
1f28eaac03fd062695a591e241043683e05264859fb46ebeab1492ceceddcee23c435e5621bd9daf4baec190dc70d020225de01d204ef1415d0f6e6e6740b1f4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Tabs_13370434497034589

Filesize
3KB

MD5
524885d30aa6524129cc00dce88feea6

SHA1
e659ed097f36df7b8439b23a67a16c562a8a2e2e

SHA256
fd40fba8e7e34e544bfb304e611003d32b347608da2555f574713830bb2078ad

SHA512
8865535247d17230ab0f82401f5be75791d836d86e0cef7c5b0c0b2a1b996ce1cd8c4c6f30a12341c0a5eb2520b1f640cabc741c95f2c886597c75cad3603207

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log

Filesize
112B

MD5
3ed72d1cd8d26100f357c6eb7e510b8c

SHA1
7e020aeec49e66af7e63586472a1edaa96849e7f

SHA256
eca9178b06786bef69e26de79e78c13022796276aeba7f4478279b6b77320885

SHA512
b5c4d596564afd0c5939a370c4aba93e140d38f0527c026ff4888474f164d357a443335d579b025c118d7ee1f7687d450faba7ec5cd8256ed6fecdbd6b263a7d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Filesize
347B

MD5
e1abad4155d50ac8e99185452350ad61

SHA1
2f279898780651a5ac76dfe93b30e084fd456705

SHA256
7951d3cfc7817502b8080e91c3eaf5f707fbc98dd79d79535c90023887a8c51e

SHA512
7fcb04cac3f66a2596ceadef550f45c8e13394ede64061a1d8be363021f002272c0de6969b0c44dabf347a190cc26aacc16b755517f9c4e04dd094f860321cee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Filesize
323B

MD5
9dfa27fd40411501cf9e6fe02f51aab3

SHA1
3310a1c3a7a762a7c6b3379361853f9ea12eaebb

SHA256
ff193b111a43b217c9ffd4bc10f1eaae9be5a321beca9a93598bcc19c31ef246

SHA512
735bbd5a286ec01858fc5f250d1accd592998caeef1f74c86292b8a69c0028d91a56a5c6fb3358fee2f6404b21b7b7c9bab0a84e26329604ca3376d0a887c3ec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
f9935de49e02897aff4e88e7d2b15ec6

SHA1
9058e177215b340ecc9fcf01bb96b040c75f7d9e

SHA256
d51cabafde573054d19929d6524029195cb9d24563575b1f0547b3617a22e81c

SHA512
ff493a041b671b3c5a315d783bf901890b9af42dbab914fd92195c703a3a5abe8613341c1d9acd9e35e201d7a262513e0b711a68b0c0caf88e44462b7e696009

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
d618f433822a97b72f90e9ff89831e93

SHA1
4518eadb8bedea11df0d3f22bcaf1449ebef9969

SHA256
5ac5cc2fdfa0a6cebe07585d218381183e0370a8993aa21d2884272f119d1ec4

SHA512
565ea5ed4fdcb9079c8b5e8e8c08750f883c3c3107e903e2d3f4c8be46296fddf118dd4092ca6ba7ac886f3d96a8c7279ca47c21ad5770f7990e3a15ecba3ff7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
f78a80e301153b4669665a8aed187290

SHA1
df248d37dae28c30a3e8f9b72166cadc860c472d

SHA256
00f6c7be4622deea64605c91208057d3e50c097be2fe7b44bedfba6daadd0748

SHA512
8190beae32ef5e193a884591aeaea009c783461cd281ec166fa0fe0e57c3eba1cdddd26026233754076b3ca2ae229816dc51245180a912f8fc80020e92226b50

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
38c1435cc63c37f9d29ff544d1a0dcfe

SHA1
96229571c8ce94bb4d75d4ffadef2b355dda9eba

SHA256
611014fdf6bb264278aaa2cfa6b23797dbbc7473db26522e4e0466120b1d4117

SHA512
6a655569d892b1bd040f3e46502d421a65cfbc5295c60f9c9b3be6703043cfc64004a078db97281458f519c782a29b508eaecdb3698ba6cc40957ebf70696f69

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Visited Links

Filesize
128KB

MD5
6ac81980348430f5ad5f0b9be38870e3

SHA1
a92e79b24def5c56d8a3b36083dcdda77511efcf

SHA256
1aef0a938f958de528e375d2b34c1a02857ddd12f0808ccaf8604ddc74456330

SHA512
21c45de3d87051e9746ccf7ca88b0a53ee4546bca53ee0ba7e4f1ff82f2038c145be543277fd1caa006edfd815f206fa62c3cbd51b64080490fec4c0112d7678

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db

Filesize
44KB

MD5
0e83878cbb7cc0b0f43c26cf93d65dd4

SHA1
d2f60bfeedc8eae06a629cbf57939260ce84e05b

SHA256
0bba3c540240188c5799a9a9fdd86d96e2df0a81f57bc7517c8e8b2fb5c93c0f

SHA512
4cb090a742a6eb7b447f0bac835e3dd9ba58d3baab333413575ac62f0e350d88ce39bf0e90a8f23632f5616836c5e5ba3334437806914311e01682b4336da3d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

Filesize
2KB

MD5
ed7f035609220a2be2eef54c639ab250

SHA1
7227e2fe68473fdeb19a9bbb388d4072c9202e2a

SHA256
cad4698de6ea1d68ce597edd74a111d95a4b5ccb39414bad629aac9cfd47356a

SHA512
c91fbc574ffc5680ff8424567c284b6ea8587fc65d3ff8de343a1b2e3157a9b9d79acaa2c5d6f6e9a8b48af5e3b20f0eb5b61adb042d0d8698a4b36ab365d796

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Filesize
319B

MD5
d5a60230081dd318263b45f36bb219cb

SHA1
dff6a2ebe074bde389d8ac2e5cdcf4e32a345df4

SHA256
0b0093a95cdb94774cdc25977fa0c4b0b2b1ae5318913d71b3bd52112c135775

SHA512
fbe54ea388f4800f339020569c9f6ce6c8f22b9891fdf5a253818b374b588af1733f7a43d8974cccb63c02c80ceff0f15bec22203cc6085f4c69a6aa50fa46ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Filesize
565B

MD5
bd23c7371bc8db963acf3eaba792753c

SHA1
7978dc67d0ce7ac1a6bd0bc8d35b7a09dccbc630

SHA256
b34a2dd5b995e01a46488eb9f09094a852eb09b87e9a976d974ca09aeedb2985

SHA512
aa68b3bf191a43dcbe3037b74d7148ea1c85fb8f47a2e477f92f8f7fec2cfab13279a071c26d4c1f6a345c98fee50d49de05620b7803a8af6030f3c2cece1149

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Filesize
337B

MD5
01b981dadddd5dea94b7653791ae19a9

SHA1
4f96dee90398db1b0e9c23c906ec8c7075843966

SHA256
deec1852a791d87747e5727455c0e26bdb3598d2748e45cabfdba1aaad8bbf92

SHA512
792931b6318024693dd47411577d48bfb08888a558e4b78077ce032d707737aa0a74e3d28d063ac7018b56e1a314d6bd4368e77a668b45200db22fbb23e99d13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_0

Filesize
44KB

MD5
74452842ac3380e73edda3913482500a

SHA1
778afb140907df16b44488353965f38a878b7dca

SHA256
cd89ae3dd1ddedc1d076ffd4248e6dd0df4bdf6ade60f09161aa01a10d5c07df

SHA512
7cecc36828bc8289690481a0c3f93b967b12fb8bc6cfcf15c1140abb02d430da3a8b9dba803ccdda5b3b8ca5c2ee3d837eddb946d30153455b43c3cc0a1623a0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_1

Filesize
264KB

MD5
0a5268432a6c55aabd7a26a1cb6b5002

SHA1
21a934aad8d0b04da5baf6a9f3831d8342e60199

SHA256
5083c3875831056936fce9ff4cd9446986ba33d3281315cc3998596b1fafbfc7

SHA512
2e3c98ebdc9370a1b8601293b164c3196f8f042dcf3dd0dee7b7f088f5d12a970c8c410c5c12aaca14b447f1299adf30474e6d16e98d33e61a4884b584c76a2a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_3

Filesize
4.0MB

MD5
f3c0b88edc5f253b773e7b2f49ef5a7b

SHA1
e10a0f2e6616b92510ff390703d94b19734ffcf3

SHA256
bd7f74daeb758dbe904889e39800d764602f9955cfa1f7db0eafb0f06086cc6c

SHA512
315685305bbf4da30a3326c609dc837a963db5f3efbfd0b36472eebe21dbdd394d02ce33d7cadfafe8aa1ff95403955b21625aa30dc10526c17929c6e4df58eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\f_000001

Filesize
22KB

MD5
1ac9e744574f723e217fb139ef1e86a9

SHA1
4194dce485bd10f2a030d2499da5c796dd12630f

SHA256
4564be03e04002c5f6eaeaea0aff16c5d0bbdad45359aef64f4c199cda8b195e

SHA512
b8515fb4b9470a7ce678331bbd59f44da47b627f87ea5a30d92ec1c6d583f1607539cd9318a5bccf0a0c6c2bd2637992e0519bd37acdf876f7a11ed184fb5109

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\f_000002

Filesize
25KB

MD5
596c754665dc3ef9437ef542eb4b130a

SHA1
2fd7ba914e8df3314850a0f0085d5388e7d45811

SHA256
bc79b14f5edf047445a5ead84ac1c46d8bb2e8015fe8465f1ba90a8286375500

SHA512
d224eca48a06915370fd20858d6250df1f19a8990ec3bf2230fc5d72f1b5f356f609a4098fc5c22fcad8137734d4adfe9d69f0e91836fcfd6c1c4464559168eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version

Filesize
11B

MD5
838a7b32aefb618130392bc7d006aa2e

SHA1
5159e0f18c9e68f0e75e2239875aa994847b8290

SHA256
ac3dd2221d90b09b795f1f72e72e4860342a4508fe336c4b822476eb25a55eaa

SHA512
9e350f0565cc726f66146838f9cebaaa38dd01892ffab9a45fe4f72e5be5459c0442e99107293a7c6f2412c71f668242c5e5a502124bc57cbf3b6ad8940cb3e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
6980bf347d8de92fa47304052916c7bc

SHA1
95be550728ff484d3b9dba0d01ee7efe5bb1033d

SHA256
e170bad77f50d45d5028326ae514b2d9cf0c6a0e22b7c4b56020dcb5b12dc0bf

SHA512
ab3651da31e2494ca51531e7229b1b933961eacbe7f4a946dbbd13db3f07fe60f2c825969c672ab73d401b643ffb032320ad1d675c3e0d0536fb2cbf8782f148

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
46c89b2db4df20ff86285ccbbfe0b700

SHA1
2c26f3112f778c555984cbce428ca53ca126331a

SHA256
74ed7e2013f9f31d77d85cd063e61a71c66517850df9575f93e65b1ad7adddda

SHA512
b54d92c85d92eacd8c1c891a4b0776597dd0b3dc0461528275095193b985b54a382f529a0996df3bc17b305895a8bbbc5c0868501c541e506f03360b2604e7ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
0ea46bcef3e22f324b4e56a772a4c469

SHA1
254486a2af680612763512609a417cf36acc9ddd

SHA256
3b0344fa59744db3890f1f2559f182e3b3110c3e8004933a2efbfe4c6827152a

SHA512
530ded3679c9494ac5d85eebe81901112fbc2568752190a7ba07e46577033bdcd3276b2092016e275c21f79a087df98ca78c157bc51108003637f8626ce06285

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
18abf5d9857e3c22383652e80b2228ad

SHA1
609d350a8052d910dc67706247e2040b5a90a357

SHA256
e537117781c6fd1598f4777569fbcc860f7681ce89fed5e6c5945ff7ba18f0a7

SHA512
1b11c4b4bf565fece9a5b683e531ed4aa984812ff81bf640e9245ef2b74b91809a0289490b6b3fba6c48a4561df5c3087cb4aa1d189d975e9b1da65aaa42b826

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\_R_E_A_D___T_H_I_S___BB2Y_.txt

Filesize
1KB

MD5
83870aae6ccb1bb00ad6de6d0f802576

SHA1
e408915447c3708cc65c7b1e5646fe12c815bcdd

SHA256
8077cfb7eb660ab5ffb2a27e9b9413c0e4922436687958360280319858074339

SHA512
4d2e885b427cd9c04c664493bfa14ea43350545845b9de2c45af5d1c3df56e7fcabfa8c6a484385e003471f2d47cdfeae9457fa18dffc984cbc318cec68e41c8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\9cd93bc6dcf544bae69531052e64647ec02f2bb4.tbres

Filesize
4KB

MD5
f9423433ac41d802044dc61318f0f434

SHA1
3f49ae87023c80a89288a54392b69652a95cfee9

SHA256
4372b28ced94379d97b531df22564047934aee48192a2c1a7f5245c820aeca60

SHA512
2565ff6a31c217084bd48932cc30243c72c2764738f1bf5ad91eb54558bad983bad41e6a03d60a131c28e93d43feb2398ebfa155186533b51727de67ebf21678

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\OneNote\16.0\_R_E_A_D___T_H_I_S___M0R3RZ5D_.hta

Filesize
75KB

MD5
55ca2e97869045698b5ffad0ad164c94

SHA1
20cc1eae2e3529ed62358204f16626dc9e78825e

SHA256
84ad662c296281bd4b803108eca29118c3128ac1ea714ffc4c4fd8b6e1a9c07a

SHA512
b01e7bf49551a2b5fe17bd7b410df70d972dfbf3b71cf5b384de718cb51ec6c5ec8c3ab9c12dec301870c5e717c1b128a592b3e40445c1001d160f0a9f28cf57

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 732900.crdownload

Filesize
15.1MB

MD5
e88a0140466c45348c7b482bb3e103df

SHA1
c59741da45f77ed2350c72055c7b3d96afd4bfc1

SHA256
bab1853454ca6fdd3acd471254101db1b805b601e309a49ec7b4b1fbcfc47ad7

SHA512
2dc9682f4fb6ea520acc505bdbe7671ab7251bf9abd25a5275f0c543a6157d7fa5325b9dce6245e035641ab831d646f0e14f6649f9464f5e97431ab1bf7da431

Download Submit
memory/3096-1449-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3096-1472-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3096-1473-0x0000000000440000-0x0000000000451000-memory.dmp

Filesize
68KB

Download
memory/3096-1093-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3096-1068-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download