cerber | hxxp://google[.]com

Analysis

max time kernel
953s
max time network
960s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
20-09-2024 14:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://google.com

Score

10^/10

cerber discovery evasion persistence privilege_escalation ransomware

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\_R_E_A_D___T_H_I_S___PXKJQB_.txt

Family

cerber

Ransom Note

Hi, I'am CRBR ENCRYPTOR ;) ----- ALL YOUR DOCUMENTS, PH0T0S, DATABASES AND OTHER IMPORTANT FILES HAVE BEEN ENCRYPTED! ----- The only one way to decrypt your files is to receive the private key and decryption program. To receive the private key and decryption program go to any decrypted folder, inside there is the special file (*_R_E_A_D___T_H_I_S_*) with complete instructions how to decrypt your files. If you cannot find any (*_R_E_A_D___T_H_I_S_*) file at your PC, follow the instructions below: ----- 1. Download "Tor Browser" from https://www.torproject.org/ and install it. 2. In the "Tor Browser" open your personal page here: http://xpcx6erilkjced3j.onion/BF54-1F6F-FEB0-0098-B024 Note! This page is available via "Tor Browser" only. ----- Also you can use temporary addresses on your personal page without using "Tor Browser". ----- 1. http://xpcx6erilkjced3j.1n5mod.top/BF54-1F6F-FEB0-0098-B024 2. http://xpcx6erilkjced3j.19kdeh.top/BF54-1F6F-FEB0-0098-B024 3. http://xpcx6erilkjced3j.1mpsnr.top/BF54-1F6F-FEB0-0098-B024 4. http://xpcx6erilkjced3j.18ey8e.top/BF54-1F6F-FEB0-0098-B024 5. http://xpcx6erilkjced3j.17gcun.top/BF54-1F6F-FEB0-0098-B024 ----- Note! These are temporary addresses! They will be available for a limited amount of time! -----

URLs

http://xpcx6erilkjced3j.onion/BF54-1F6F-FEB0-0098-B024

http://xpcx6erilkjced3j.1n5mod.top/BF54-1F6F-FEB0-0098-B024

http://xpcx6erilkjced3j.19kdeh.top/BF54-1F6F-FEB0-0098-B024

http://xpcx6erilkjced3j.1mpsnr.top/BF54-1F6F-FEB0-0098-B024

http://xpcx6erilkjced3j.18ey8e.top/BF54-1F6F-FEB0-0098-B024

http://xpcx6erilkjced3j.17gcun.top/BF54-1F6F-FEB0-0098-B024

Signatures

Cerber
Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.
ransomware cerber
Contacts a large (1134) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Modifies Windows Firewall 2 TTPs 2 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
1456	netsh.exe
4796	netsh.exe

Drops startup file 1 IoCs

description	ioc	Process
File opened for modification	\??\c:\users\admin\appdata\roaming\microsoft\word\startup\	[email protected]

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\v:	[email protected]
File opened (read-only)	\??\x:	[email protected]
File opened (read-only)	\??\p:	[email protected]
File opened (read-only)	\??\w:	[email protected]
File opened (read-only)	\??\n:	[email protected]
File opened (read-only)	\??\l:	[email protected]
File opened (read-only)	\??\n:	[email protected]
File opened (read-only)	\??\t:	[email protected]
File opened (read-only)	\??\w:	[email protected]
File opened (read-only)	\??\a:	[email protected]
File opened (read-only)	\??\j:	[email protected]
File opened (read-only)	\??\e:	[email protected]
File opened (read-only)	\??\h:	[email protected]
File opened (read-only)	\??\m:	[email protected]
File opened (read-only)	\??\o:	[email protected]
File opened (read-only)	\??\s:	[email protected]
File opened (read-only)	\??\l:	[email protected]
File opened (read-only)	\??\q:	[email protected]
File opened (read-only)	\??\u:	[email protected]
File opened (read-only)	\??\y:	[email protected]
File opened (read-only)	\??\s:	[email protected]
File opened (read-only)	\??\u:	[email protected]
File opened (read-only)	\??\e:	[email protected]
File opened (read-only)	\??\h:	[email protected]
File opened (read-only)	\??\b:	[email protected]
File opened (read-only)	\??\k:	[email protected]
File opened (read-only)	\??\p:	[email protected]
File opened (read-only)	\??\y:	[email protected]
File opened (read-only)	\??\z:	[email protected]
File opened (read-only)	\??\r:	[email protected]
File opened (read-only)	\??\a:	[email protected]
File opened (read-only)	\??\i:	[email protected]
File opened (read-only)	\??\z:	[email protected]
File opened (read-only)	\??\b:	[email protected]
File opened (read-only)	\??\g:	[email protected]
File opened (read-only)	\??\g:	[email protected]
File opened (read-only)	\??\o:	[email protected]
File opened (read-only)	\??\q:	[email protected]
File opened (read-only)	\??\k:	[email protected]
File opened (read-only)	\??\v:	[email protected]
File opened (read-only)	\??\x:	[email protected]
File opened (read-only)	\??\i:	[email protected]
File opened (read-only)	\??\j:	[email protected]
File opened (read-only)	\??\r:	[email protected]
File opened (read-only)	\??\m:	[email protected]
File opened (read-only)	\??\t:	[email protected]

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
200	raw.githubusercontent.com
201	raw.githubusercontent.com

Drops file in System32 directory 38 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\bitcoin	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\excel	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\excel	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\microsoft sql server	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\microsoft sql server	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\outlook	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\word	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\excel	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\word	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\word	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\word	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\excel	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\office	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\powerpoint	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\onenote	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\steam	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\desktop	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\outlook	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\outlook	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\the bat!	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\powerpoint	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\office	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\office	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\bitcoin	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\office	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\onenote	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\thunderbird	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft sql server	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\onenote	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\onenote	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\outlook	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\powerpoint	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\steam	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\thunderbird	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft sql server	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\powerpoint	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\the bat!	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\documents	[email protected]

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tmpC35B.bmp"	[email protected]

Drops file in Program Files directory 20 IoCs

description	ioc	Process
File opened for modification	\??\c:\program files (x86)\microsoft\excel	[email protected]
File opened for modification	\??\c:\program files (x86)\microsoft\microsoft sql server	[email protected]
File opened for modification	\??\c:\program files (x86)\the bat!	[email protected]
File opened for modification	\??\c:\program files (x86)\word	[email protected]
File opened for modification	\??\c:\program files (x86)\	[email protected]
File opened for modification	\??\c:\program files (x86)\excel	[email protected]
File opened for modification	\??\c:\program files (x86)\microsoft\outlook	[email protected]
File opened for modification	\??\c:\program files (x86)\office	[email protected]
File opened for modification	\??\c:\program files (x86)\outlook	[email protected]
File opened for modification	\??\c:\program files\	[email protected]
File opened for modification	\??\c:\program files (x86)\microsoft\onenote	[email protected]
File opened for modification	\??\c:\program files (x86)\microsoft\word	[email protected]
File opened for modification	\??\c:\program files (x86)\onenote	[email protected]
File opened for modification	\??\c:\program files (x86)\powerpoint	[email protected]
File opened for modification	\??\c:\program files (x86)\steam	[email protected]
File opened for modification	\??\c:\program files (x86)\thunderbird	[email protected]
File opened for modification	\??\c:\program files (x86)\bitcoin	[email protected]
File opened for modification	\??\c:\program files (x86)\microsoft sql server	[email protected]
File opened for modification	\??\c:\program files (x86)\microsoft\office	[email protected]
File opened for modification	\??\c:\program files (x86)\microsoft\powerpoint	[email protected]

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\bitcoin	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\steam	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\word	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\powerpoint	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\excel	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\onenote	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\outlook	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\office	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\onenote	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\the bat!	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft sql server	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\excel	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\powerpoint	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\thunderbird	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\desktop	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\powerpoint	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\word	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\outlook	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\onenote	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\localservice\desktop	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\microsoft sql server	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\outlook	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\outlook	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\steam	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\thunderbird	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\outlook	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\onenote	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\steam	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\office	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\onenote	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\powerpoint	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\powerpoint	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\localservice\documents	[email protected]
File opened for modification	\??\c:\windows\	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\office	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\office	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\word	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\office	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\outlook	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\powerpoint	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\thunderbird	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\bitcoin	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\excel	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\onenote	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\steam	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\powerpoint	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\onenote	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\outlook	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\office	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\the bat!	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\bitcoin	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft sql server	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\excel	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\thunderbird	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\excel	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\microsoft sql server	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\outlook	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\the bat!	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\excel	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\excel	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\the bat!	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\word	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft sql server	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\microsoft sql server	[email protected]

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NOTEPAD.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	[email protected]

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3132	cmd.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133713157225432750"	chrome.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-523280732-2327480845-3730041215-1000\{766DB47D-C268-4D54-8081-67CDA875BD5D}	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000_Classes\Local Settings	[email protected]

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
1820	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1208	msedge.exe
1208	msedge.exe
544	msedge.exe
544	msedge.exe
4532	identity_helper.exe
4532	identity_helper.exe
2496	chrome.exe
2496	chrome.exe
4968	chrome.exe
4968	chrome.exe
4968	chrome.exe
4968	chrome.exe
2676	[email protected]
2676	[email protected]
2676	[email protected]
2676	[email protected]
2676	[email protected]
2676	[email protected]
2676	[email protected]
2676	[email protected]
2676	[email protected]
2676	[email protected]
2676	[email protected]
2676	[email protected]
2676	[email protected]
2676	[email protected]
2676	[email protected]
2676	[email protected]
2676	[email protected]
2676	[email protected]
2676	[email protected]
2676	[email protected]
2676	[email protected]
2676	[email protected]
2676	[email protected]
2676	[email protected]
2676	[email protected]
2676	[email protected]
2676	[email protected]
2676	[email protected]
2676	[email protected]
2676	[email protected]
2676	[email protected]
2676	[email protected]
2676	[email protected]
2676	[email protected]
2676	[email protected]
2676	[email protected]
2676	[email protected]
2676	[email protected]
2676	[email protected]
2676	[email protected]
1856	[email protected]
1856	[email protected]
2676	[email protected]
2676	[email protected]
1856	[email protected]
1856	[email protected]
2676	[email protected]
2676	[email protected]
1856	[email protected]
1856	[email protected]
2676	[email protected]
2676	[email protected]

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
2496	chrome.exe
2496	chrome.exe
2496	chrome.exe
2496	chrome.exe
2496	chrome.exe
2496	chrome.exe
2496	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2496	chrome.exe
Token: SeCreatePagefilePrivilege	2496	chrome.exe
Token: SeShutdownPrivilege	2496	chrome.exe
Token: SeCreatePagefilePrivilege	2496	chrome.exe
Token: SeShutdownPrivilege	2496	chrome.exe
Token: SeCreatePagefilePrivilege	2496	chrome.exe
Token: SeShutdownPrivilege	2496	chrome.exe
Token: SeCreatePagefilePrivilege	2496	chrome.exe
Token: SeShutdownPrivilege	2496	chrome.exe
Token: SeCreatePagefilePrivilege	2496	chrome.exe
Token: SeShutdownPrivilege	2496	chrome.exe
Token: SeCreatePagefilePrivilege	2496	chrome.exe
Token: SeShutdownPrivilege	2496	chrome.exe
Token: SeCreatePagefilePrivilege	2496	chrome.exe
Token: SeShutdownPrivilege	2496	chrome.exe
Token: SeCreatePagefilePrivilege	2496	chrome.exe
Token: SeShutdownPrivilege	2496	chrome.exe
Token: SeCreatePagefilePrivilege	2496	chrome.exe
Token: SeShutdownPrivilege	2496	chrome.exe
Token: SeCreatePagefilePrivilege	2496	chrome.exe
Token: SeShutdownPrivilege	2496	chrome.exe
Token: SeCreatePagefilePrivilege	2496	chrome.exe
Token: SeShutdownPrivilege	2496	chrome.exe
Token: SeCreatePagefilePrivilege	2496	chrome.exe
Token: SeShutdownPrivilege	2496	chrome.exe
Token: SeCreatePagefilePrivilege	2496	chrome.exe
Token: SeShutdownPrivilege	2496	chrome.exe
Token: SeCreatePagefilePrivilege	2496	chrome.exe
Token: SeShutdownPrivilege	2496	chrome.exe
Token: SeCreatePagefilePrivilege	2496	chrome.exe
Token: SeShutdownPrivilege	2496	chrome.exe
Token: SeCreatePagefilePrivilege	2496	chrome.exe
Token: SeShutdownPrivilege	2496	chrome.exe
Token: SeCreatePagefilePrivilege	2496	chrome.exe
Token: SeShutdownPrivilege	2496	chrome.exe
Token: SeCreatePagefilePrivilege	2496	chrome.exe
Token: SeShutdownPrivilege	2496	chrome.exe
Token: SeCreatePagefilePrivilege	2496	chrome.exe
Token: SeShutdownPrivilege	2496	chrome.exe
Token: SeCreatePagefilePrivilege	2496	chrome.exe
Token: SeShutdownPrivilege	2496	chrome.exe
Token: SeCreatePagefilePrivilege	2496	chrome.exe
Token: SeShutdownPrivilege	2496	chrome.exe
Token: SeCreatePagefilePrivilege	2496	chrome.exe
Token: SeShutdownPrivilege	2496	chrome.exe
Token: SeCreatePagefilePrivilege	2496	chrome.exe
Token: SeShutdownPrivilege	2496	chrome.exe
Token: SeCreatePagefilePrivilege	2496	chrome.exe
Token: SeShutdownPrivilege	2496	chrome.exe
Token: SeCreatePagefilePrivilege	2496	chrome.exe
Token: SeShutdownPrivilege	2496	chrome.exe
Token: SeCreatePagefilePrivilege	2496	chrome.exe
Token: SeShutdownPrivilege	2496	chrome.exe
Token: SeCreatePagefilePrivilege	2496	chrome.exe
Token: SeShutdownPrivilege	2496	chrome.exe
Token: SeCreatePagefilePrivilege	2496	chrome.exe
Token: SeShutdownPrivilege	2496	chrome.exe
Token: SeCreatePagefilePrivilege	2496	chrome.exe
Token: SeShutdownPrivilege	2496	chrome.exe
Token: SeCreatePagefilePrivilege	2496	chrome.exe
Token: SeShutdownPrivilege	2496	chrome.exe
Token: SeCreatePagefilePrivilege	2496	chrome.exe
Token: SeShutdownPrivilege	2496	chrome.exe
Token: SeCreatePagefilePrivilege	2496	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
2496	chrome.exe
2496	chrome.exe
2496	chrome.exe
2496	chrome.exe
2496	chrome.exe
2496	chrome.exe
2496	chrome.exe
2496	chrome.exe
2496	chrome.exe
2496	chrome.exe
2496	chrome.exe
2496	chrome.exe
2496	chrome.exe
2496	chrome.exe
2496	chrome.exe
2496	chrome.exe
2496	chrome.exe
2496	chrome.exe
2496	chrome.exe
2496	chrome.exe
2496	chrome.exe
2496	chrome.exe
2496	chrome.exe
2496	chrome.exe
2496	chrome.exe
2496	chrome.exe
2496	chrome.exe
2496	chrome.exe
2496	chrome.exe
2496	chrome.exe
2496	chrome.exe
2496	chrome.exe
2496	chrome.exe
2496	chrome.exe
2496	chrome.exe
2496	chrome.exe
2496	chrome.exe
2496	chrome.exe

Suspicious use of SendNotifyMessage 52 IoCs

pid	Process
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
2496	chrome.exe
2496	chrome.exe
2496	chrome.exe
2496	chrome.exe
2496	chrome.exe
2496	chrome.exe
2496	chrome.exe
2496	chrome.exe
2496	chrome.exe
2496	chrome.exe
2496	chrome.exe
2496	chrome.exe
2496	chrome.exe
2496	chrome.exe
2496	chrome.exe
2496	chrome.exe
2496	chrome.exe
2496	chrome.exe
2496	chrome.exe
2496	chrome.exe
2496	chrome.exe
2496	chrome.exe
2496	chrome.exe
2496	chrome.exe
3232	[email protected]
3232	[email protected]
3232	[email protected]
3232	[email protected]

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 544 wrote to memory of 2488	544	msedge.exe	82
PID 544 wrote to memory of 2488	544	msedge.exe	82
PID 544 wrote to memory of 2404	544	msedge.exe	83
PID 544 wrote to memory of 2404	544	msedge.exe	83
PID 544 wrote to memory of 2404	544	msedge.exe	83
PID 544 wrote to memory of 2404	544	msedge.exe	83
PID 544 wrote to memory of 2404	544	msedge.exe	83
PID 544 wrote to memory of 2404	544	msedge.exe	83
PID 544 wrote to memory of 2404	544	msedge.exe	83
PID 544 wrote to memory of 2404	544	msedge.exe	83
PID 544 wrote to memory of 2404	544	msedge.exe	83
PID 544 wrote to memory of 2404	544	msedge.exe	83
PID 544 wrote to memory of 2404	544	msedge.exe	83
PID 544 wrote to memory of 2404	544	msedge.exe	83
PID 544 wrote to memory of 2404	544	msedge.exe	83
PID 544 wrote to memory of 2404	544	msedge.exe	83
PID 544 wrote to memory of 2404	544	msedge.exe	83
PID 544 wrote to memory of 2404	544	msedge.exe	83
PID 544 wrote to memory of 2404	544	msedge.exe	83
PID 544 wrote to memory of 2404	544	msedge.exe	83
PID 544 wrote to memory of 2404	544	msedge.exe	83
PID 544 wrote to memory of 2404	544	msedge.exe	83
PID 544 wrote to memory of 2404	544	msedge.exe	83
PID 544 wrote to memory of 2404	544	msedge.exe	83
PID 544 wrote to memory of 2404	544	msedge.exe	83
PID 544 wrote to memory of 2404	544	msedge.exe	83
PID 544 wrote to memory of 2404	544	msedge.exe	83
PID 544 wrote to memory of 2404	544	msedge.exe	83
PID 544 wrote to memory of 2404	544	msedge.exe	83
PID 544 wrote to memory of 2404	544	msedge.exe	83
PID 544 wrote to memory of 2404	544	msedge.exe	83
PID 544 wrote to memory of 2404	544	msedge.exe	83
PID 544 wrote to memory of 2404	544	msedge.exe	83
PID 544 wrote to memory of 2404	544	msedge.exe	83
PID 544 wrote to memory of 2404	544	msedge.exe	83
PID 544 wrote to memory of 2404	544	msedge.exe	83
PID 544 wrote to memory of 2404	544	msedge.exe	83
PID 544 wrote to memory of 2404	544	msedge.exe	83
PID 544 wrote to memory of 2404	544	msedge.exe	83
PID 544 wrote to memory of 2404	544	msedge.exe	83
PID 544 wrote to memory of 2404	544	msedge.exe	83
PID 544 wrote to memory of 2404	544	msedge.exe	83
PID 544 wrote to memory of 1208	544	msedge.exe	84
PID 544 wrote to memory of 1208	544	msedge.exe	84
PID 544 wrote to memory of 1608	544	msedge.exe	85
PID 544 wrote to memory of 1608	544	msedge.exe	85
PID 544 wrote to memory of 1608	544	msedge.exe	85
PID 544 wrote to memory of 1608	544	msedge.exe	85
PID 544 wrote to memory of 1608	544	msedge.exe	85
PID 544 wrote to memory of 1608	544	msedge.exe	85
PID 544 wrote to memory of 1608	544	msedge.exe	85
PID 544 wrote to memory of 1608	544	msedge.exe	85
PID 544 wrote to memory of 1608	544	msedge.exe	85
PID 544 wrote to memory of 1608	544	msedge.exe	85
PID 544 wrote to memory of 1608	544	msedge.exe	85
PID 544 wrote to memory of 1608	544	msedge.exe	85
PID 544 wrote to memory of 1608	544	msedge.exe	85
PID 544 wrote to memory of 1608	544	msedge.exe	85
PID 544 wrote to memory of 1608	544	msedge.exe	85
PID 544 wrote to memory of 1608	544	msedge.exe	85
PID 544 wrote to memory of 1608	544	msedge.exe	85
PID 544 wrote to memory of 1608	544	msedge.exe	85
PID 544 wrote to memory of 1608	544	msedge.exe	85
PID 544 wrote to memory of 1608	544	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.com
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa9b7b46f8,0x7ffa9b7b4708,0x7ffa9b7b4718
  2⤵
  PID:2488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2012,14898306559246982913,8016596726282033590,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2268 /prefetch:2
  2⤵
  PID:2404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2012,14898306559246982913,8016596726282033590,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2320 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2012,14898306559246982913,8016596726282033590,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2936 /prefetch:8
  2⤵
  PID:1608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,14898306559246982913,8016596726282033590,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
  2⤵
  PID:220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,14898306559246982913,8016596726282033590,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3536 /prefetch:1
  2⤵
  PID:3548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,14898306559246982913,8016596726282033590,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5004 /prefetch:1
  2⤵
  PID:4724
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2012,14898306559246982913,8016596726282033590,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5336 /prefetch:8
  2⤵
  PID:3544
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2012,14898306559246982913,8016596726282033590,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5336 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,14898306559246982913,8016596726282033590,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5356 /prefetch:1
  2⤵
  PID:1944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,14898306559246982913,8016596726282033590,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5408 /prefetch:1
  2⤵
  PID:4524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,14898306559246982913,8016596726282033590,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4048 /prefetch:1
  2⤵
  PID:1584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,14898306559246982913,8016596726282033590,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5084 /prefetch:1
  2⤵
  PID:5028

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:212

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1988

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2496
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffa99dbcc40,0x7ffa99dbcc4c,0x7ffa99dbcc58
  2⤵
  PID:3252
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1948,i,1504539097846589420,14526819523224010660,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=1884 /prefetch:2
  2⤵
  PID:960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1784,i,1504539097846589420,14526819523224010660,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2176 /prefetch:3
  2⤵
  PID:3616
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2300,i,1504539097846589420,14526819523224010660,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2476 /prefetch:8
  2⤵
  PID:4464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3164,i,1504539097846589420,14526819523224010660,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3172 /prefetch:1
  2⤵
  PID:4252
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3200,i,1504539097846589420,14526819523224010660,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:1732
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4556,i,1504539097846589420,14526819523224010660,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4604 /prefetch:1
  2⤵
  PID:4844
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4864,i,1504539097846589420,14526819523224010660,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4912 /prefetch:8
  2⤵
  PID:2236
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4872,i,1504539097846589420,14526819523224010660,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4908 /prefetch:8
  2⤵
  PID:3940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=4916,i,1504539097846589420,14526819523224010660,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4936 /prefetch:1
  2⤵
  PID:3956
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=4904,i,1504539097846589420,14526819523224010660,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3412 /prefetch:1
  2⤵
  PID:3992
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=3400,i,1504539097846589420,14526819523224010660,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3152 /prefetch:1
  2⤵
  PID:976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --no-appcompat-clear --field-trial-handle=5288,i,1504539097846589420,14526819523224010660,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5300 /prefetch:8
  2⤵
  PID:2916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5340,i,1504539097846589420,14526819523224010660,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5316 /prefetch:8
  2⤵
  - Modifies registry class
  PID:5056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=5592,i,1504539097846589420,14526819523224010660,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5504 /prefetch:1
  2⤵
  PID:2180
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5100,i,1504539097846589420,14526819523224010660,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4968 /prefetch:8
  2⤵
  PID:2244
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5516,i,1504539097846589420,14526819523224010660,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5804 /prefetch:8
  2⤵
  PID:3776
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5492,i,1504539097846589420,14526819523224010660,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=864 /prefetch:8
  2⤵
  PID:876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5500,i,1504539097846589420,14526819523224010660,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5768 /prefetch:8
  2⤵
  PID:2724
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1136,i,1504539097846589420,14526819523224010660,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5064 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4968

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:1076

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1388

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:1668

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1540

C:\Users\Admin\Downloads\viruses\[email protected]
"C:\Users\Admin\Downloads\viruses\[email protected]"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:2676
- C:\Windows\SYSTEM32\mountvol.exe
  mountvol c:\ /d
  2⤵
  PID:2360

C:\Users\Admin\Downloads\viruses\[email protected]
"C:\Users\Admin\Downloads\viruses\[email protected]"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1856

C:\Users\Admin\Downloads\viruses\[email protected]
"C:\Users\Admin\Downloads\viruses\[email protected]"
1⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
PID:1564

C:\Users\Admin\Downloads\viruses\[email protected]
"C:\Users\Admin\Downloads\viruses\[email protected]"
1⤵
- Drops startup file
- Enumerates connected drives
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:3440
- C:\Windows\SysWOW64\netsh.exe
  C:\Windows\system32\netsh.exe advfirewall set allprofiles state on
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:1456
- C:\Windows\SysWOW64\netsh.exe
  C:\Windows\system32\netsh.exe advfirewall reset
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:4796
- C:\Windows\SysWOW64\mshta.exe
  "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\_R_E_A_D___T_H_I_S___UU7COJH_.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3584
- C:\Windows\SysWOW64\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\_R_E_A_D___T_H_I_S___QW8L9F8F_.txt
  2⤵
  - System Location Discovery: System Language Discovery
  - Opens file in notepad (likely ransom note)
  PID:1820
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /d /c taskkill /f /im "E" > NUL & ping -n 1 127.0.0.1 > NUL & del "C" > NUL && exit
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:3132

C:\Users\Admin\Downloads\viruses\[email protected]
"C:\Users\Admin\Downloads\viruses\[email protected]"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SendNotifyMessage
PID:3232

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Network Service Discovery

T1046

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\101612c8-5b4b-4e5c-86a2-1c4ca149a27c.tmp

Filesize
211KB

MD5
a20774f151ad07f9e3ac5310d0fb66b0

SHA1
600614684e3061ddebc3efcf13eaff5441d4e5ab

SHA256
a9d743eeb740dfa34f2dcb192251ad6fd8e2ed3b3c7e32aa5053b4d8daa7d101

SHA512
1baf5513d326aff1f4237c20503edfd497662292485fa9ca004f83d1c2d94308cacc67d3ab20cba1bd91efd7ad786a354b92432187217dbb15618d1e83c9f31f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\963bb425-5b24-4484-967e-d6fa322c1825.tmp

Filesize
9KB

MD5
8ab5e9eafc34e5bda0afbf9917281a6a

SHA1
f688847cf9a9b581fa406adee2fcbfca6125b986

SHA256
7181bd7cc3a54d74e7b21bc7d23d5d0f27441f9b21b7ea057bab872ff88f8398

SHA512
9a641274f9f8a8ed60af230115b9255e2cb53d8923965b313ac83477860a9183578aca25de1c99322f4a8a60a5bdfd22a6d85be047a046d1d6fcf15bc3a46c8b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
7c49ee5e14aede6e19bd779370e45db3

SHA1
85970826ff48f7b04926c72a18e29d7b7fc2d9ad

SHA256
fb112397c53025f6702b6c80fb5b750b41b48c478278dc8295f70b653833f88c

SHA512
d4417d0d5b14dd0f548dc1826dc5aa073bdbf3c6ef8217cc65406f0ef0fe41d04f7694ff28e800a667bee5de4cd0f0d8b2fa8ed9abd6735dbaa6b94c047d5d9a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
408B

MD5
818bba22d71840853229f1c0b4b65c33

SHA1
d0796a921142ba67131739fe582db21c9a80a6ee

SHA256
eef9d8f0e503e3cbf582c9e72bca2aec2f2407d7c7f524f3ab10310270fbe02a

SHA512
77cb4aec6bbfadad0171d52734c7fd7308c50484f15a4a1832943cc1a317c83b811e20076ef1f3952d03254539e3513fe741596829681b28321e844b93d2052a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
3f9f752bd5c4d00f27d87725bfeafe0f

SHA1
abf12c8c9868ad410b0cff00269a74da80da3425

SHA256
b65c1813f3842f5eb1586cf1d7bc1c60abf762bdcf237ec24cb480b6951c0262

SHA512
554a1d395eb83405a02375cbb9a2b0d8b69675febca6612e09883d3b209fba4dd7547c630e29c98843cd693ab4bd83ebe7cb0de1bb7cf3fbf13d04a71ef1f4e7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
6KB

MD5
6cb82df80a97f80cac950451e5a52980

SHA1
d04df0e6a2367c2c5786b579c53464bfea7389b2

SHA256
4dfcb469fa7329f57035db5027af0e157178d1feb8b51880867a9567090a3543

SHA512
287e57dfc09caced1ec9423623d814f4dcd72ba31a7c6fab0e080287716704068de9b465ed6fd88e168aba2aa542acd4fcc48ef46d2c93017122233882d2a886

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
8KB

MD5
b4be809ca045ce48208210dbab9f5374

SHA1
5d26d1168b0c3aa03db472301eb197c9d9bb9e52

SHA256
9a77f7459f5fe87ffe7feb7901ae80cb9fe064beafe5f56f266bfe9eb4d2c1b7

SHA512
f1f733e1f9dc60680e9e87a76bf843e24f4e74d9eb1cd56ae1dd5162e7369d61a918a585b8d5f24052dfcb946fffa3a3d254e3f614e54a0a347aea1186e9b735

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
356B

MD5
d07396d8c19327f2d7298f180d875d1b

SHA1
07f8f17128349963242a72387be47092a7bd591c

SHA256
2f2b60a17c0b85d7bfc5ecf69bf6b23832cdc191558dd672dc83aa0ec7f5d1ea

SHA512
c99c0eaeea94805ad26506b21a0ebb70920ef9cbf892363d4654e01dae91dd2ffca1b8caed18fe705ad741a0f52b7830e8aa4449f6f5f75fb5f1108361a6823a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
3f95bef5d66d9524c2a204b699ab3c63

SHA1
90734148728bc833800ece8081eb966ec3dafe03

SHA256
a733779764fa67c99e4e64f63d2ae7ace0806a75df5fa54ae90ea3e8e061e24e

SHA512
882a70aac0fed1a88e961d7451a7393570a360825140caac4cf92cb90544565e5fe179d3f2e445d75f1e45ae88f397699bfed8090c5a22107c0283f61e25e4cd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
3ad142dcb52574e752a00079a8afa7c2

SHA1
5e587e5f9bd524ad33c78f22f108a01a145a5bcc

SHA256
20b565db266b49347051ffd709aa06af50efc6b71abe1255b990a9a060e334b7

SHA512
6954b23ac010efb634198417e021d150d07390f97f82c52a664fd2c1b6079fdf34daf8ab6ec45b959f3896fe432a4fe41a71d6f58f303b43c524eec085f083c5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
5d3cc0c784535e7eb542bd5799da6c34

SHA1
4a1883a6dd35b5de2cd38c5a72e3477d5bdb9bef

SHA256
c46187eca0b1e25be9ee479e5b255032888fa3436926b123220f53f558aee5b4

SHA512
ac819993eca45d9c941e05c0da6764838b4a15e2567efa1b367a26198460c21cf1a6dcabf4a0d6d5ae893cc8757e76d0ef67be4f8a208a2fc41876587d5a3ce6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
f9b54d42c80b8b89b7e382995466002e

SHA1
f8d61abc9133ffb789cde46e59502d93dcb5e72f

SHA256
6579e6452d3a02075d350f208713dc30cd456a5fec8b6596a227d0b991c48fb2

SHA512
08540ec47eab166208152e254e26bbcd1b8c1492b924ad8c4a06d31d1744274382b3b258460a176ff9db789ba33703e343a1b4c852bb0a07b1c0757d5083c18e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
a51ec789ba97222153e1eef4d7eb0776

SHA1
49d12eefc7e9eb3520afb068974a5ec36dc7b18d

SHA256
0ef3f28b44e2590cf8eed439242282605b2900417d15ab49a60155ba988a39dd

SHA512
677e78d1c5492f1e68d2933b0dd083365a04e47b3683a8d4f20795fad1d75dcc462d6e35ac55527fc3ad172a3629f1aa35283457e471aa90d04f3f6562168107

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
d9701f1bf6a628d28ab9477cd0b1a71d

SHA1
0489758bdcc4394270a34ef970143933ff71cba6

SHA256
e32c5af88d4af4e3d879e36d1e398ccc287431e638e26c809ca1d07502947fe6

SHA512
c14006aee4cdfc4a19b507b7d1f33d920358a756cf0c6d8fbf8cfcd3a3b839ce38fa9ca0b5a95011cb97e500c490b647b6c149df4cee22eaf6a9e1d2fe56ed59

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
9734b1c4ab42f3be7ea21b8b501a454e

SHA1
e8a1d3bb08283da27aad7717723179b9532f3a7a

SHA256
314b01abf5357ea077936b4075f114809ca143b97375fc0480ad11c5e3499a40

SHA512
ca399c004521fe0cd6e20469502a8b2ff85c67c1488d8ea0b8f544d587e174133533f0dd6328f0b3b28ac92e798eb0aeb2a7bb8014167d17cb1b399d67eb8e10

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
bd1a09de04e0552a11b069fb2b6add34

SHA1
4daac8fc914d0a3512ed58000d921e34a145c405

SHA256
f371be71f24eac1cdc6915033bd4c1db452b5679e144385d62e0c1e960f907ac

SHA512
b9cbe10123ee828f099fbee9deb8c6fb17886035cb41803f6beb56dd8b24670b9741e44b0e02de3b1844b8a614206a4f8866bcca50f7d4f8d4f81a1435c08011

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
0e360fd14d500bf4de53a61d0dcba903

SHA1
282c3ac147eddd90aa53486c4e7df3da9007ee11

SHA256
c150274159ab3f375300c111f15dcd793fbf2c4fa6510f7f92d7827fd06227a5

SHA512
0823a53d8f0c34fc08a88441f11f85d446c8d9e7cef52323aa630a6e8bc28317b0765ce5abfa3731ee99c96116950e015da5d025dea577d5e0b5c69577f9177a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
e3c779983755583f86f6e860602baf70

SHA1
6155a233be9dc6e65724aaa902cc5f1fc8dea0af

SHA256
1ee89d890bdcb0b7090c47fd81a1a624b85b729f4e9ebf62c5ea7084ebad6739

SHA512
4a863c559b9d40aab299faecbf95ba174d212b05bfdddbc42137851fd8b33339bc336216f45c17f24c4f02390846eb517c2f8e380a36123f24ec974bdd40e170

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
15e16799f10b227fef1b95935acdbb5f

SHA1
7259ce1f46692efdfd0fbaa047eadcb4f423bf1a

SHA256
9f334141dbf897652f0b213cd8fae8ce3274c440e0c8125a534205d5629400c7

SHA512
5b1f63c614a15796b335feb4c71391cf0bac8180c96a0e1db0af815a0df411dc36002368aac662520321a8f0c6bea20de6a5636cd56a90b6648390635135f46c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
42ac08be5908e5601080548f81c216b1

SHA1
4af58763bd7c72f82189bdddf7cf9d287895fb10

SHA256
18c42a51c200ef3dfe2df8e9031e91bee048a965e67e8a378040935673e04afd

SHA512
451352432e2b2bc7fd2705d2bf2366a2bb457fddfcec6f3131cee311c591b4ab36e2c5a98f5566d9fdbb449f1c3a8059b6f557fb431f5749f34135b8d482ebde

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
bf35ac5940c2c08fed5185b9dc38a77e

SHA1
b4545936345d6859979184e50573d81b01928d4d

SHA256
1d1d31ed90b350545e144f385dc0c5ec382f5d815f8b35c4369efde6a2bbe03b

SHA512
309dd300e797756d1eef1f6fe734761255998587fb60aee67a8c8c90dd308d40312a40135b906651207dd1e88832eb4f1e814698d3458c0f7e2eece5e75c7738

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
fde90917e45683a0a4702cf08098cbf7

SHA1
1afe516ce36f3a4716c6fecd1bf9db3dc114ba4c

SHA256
43e59179a1d7a0352637913e3689c33da6d06d1ebc7717a59314136ababc7723

SHA512
3c638f7bb31b9d4847a134eac5e6b5bc04253e3bbdeb4df41f630af608fb2e3156a0e5c8e40bb711a51752844632a7c38d864e55bb4d54bf64be6d793f55c781

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
8b623b38bd1ff5307c697a4fae480ccb

SHA1
d5583a6dc755a34f38e508fd03a4cc0373d4a3e2

SHA256
9e79219f0e465aeabc6925d1784763121178e5828c1425bf0313a09a2be6fb81

SHA512
67e143a967d6b48ea1fb4a9ed1ef53e8ab5b014e862753b509442a11c3a8d632065b25751713112aa55f8a44ce588d951585682ac47bcf01bb0f124ca39f1c62

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
25ee431bdd8551f5bbae73330bc2b9d4

SHA1
860602ec31def0eeb123ec961f6ed09886bca51e

SHA256
679dd29cc18a5feb2f25d45238b8c2334326f07d8d74e1d064f4e82857d97677

SHA512
61c721fb27f8cf317cc27f32cde99e78740386204eede2efd7a88d6ef97306e52c5782e3c91190b0b0e1f3b13d37673a6bb49bb71a7a7fc11765a8ec417f3ea9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
f420d9ac18d4ee75ea6cdebc26a7c046

SHA1
a3939698a374609cb4d4fb26bbcbec2f5cc4ea8b

SHA256
28717f24e96f52f6024316c160e9586e4ffb97d86467d882681bdd325f90e08f

SHA512
c075f711386467b40ed60a4f5fc028de2af256a51ade67653d9d08b3b1119765775a0461d7529eec22637e99d1faa5b08065cca62656bbed658bd0ef58dc5f45

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
73bf4c8001a1ecbd1332b0e6a15e6486

SHA1
c4a83aad4b959031880023144c912dc5ebc7ace3

SHA256
0048301eb7e9b63a251f9810c0e89b8138ee8ff70c7c8700bec5c7571fbdc195

SHA512
d03b2fcbdc9bdb422edf103e03155fe7f8e29931c0a53d374957dd815b259ad8ec597f254831a17580a5c4e3524c2226f8d78fdf08b7f5a932e2d3e294fe0fe2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
4035d80d06c32e138818a0db8d3096b7

SHA1
a4c1d52d90b0ffc59e50f7c34f802838a6cff20b

SHA256
eea39baa038423c8e261d46e26b09251276fd0d5e04c64a2ffaf44e46a9dd899

SHA512
2595603120ee7f8a6c6a65262013d925a9b90029dc380f1e1e49b633f7031adbbd679485841757ff7bd969bbd1149ec012502128a25fab500c3380651712b216

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
96d05989e18ec591c11adeaad633fa48

SHA1
548c8db1dbfeef7bc71c0a5b99ac6470f71114a4

SHA256
025c5415fd6719536450c30b8b07aadeeaae75367b3c311e747ffec9ad409ad6

SHA512
d0fd1fc2248e1939d3a22990b161d2198b2758059527e8d3b37109f20982597dcf5c2ebfbb7899893b313dd63b07994348863eeb24308b33229a827e271ea7d6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
cb0d2652c26ec80755683cc9c68b6f6e

SHA1
fb2d0876ad243253166f3ce8b87d8da5810f4695

SHA256
f9982d24bcd52bced5815784ff95c75019743d6b1badd4fc61cc95a04cdc64f0

SHA512
8f7117ee15ea6a1d72a055b8648d7e8a61425b8aa391ee3697d1ec98e151aea3905c88be617e9872fed02a0f41994ef2aeb0228c0883ec2961d2d691731140fb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
15KB

MD5
28f8783f74515df65354756565cc5371

SHA1
7e09fb0245b02ee60939729ac6de7457521c65a8

SHA256
1da5180b307667fb438ac55a4765bb83a7e888319990b0ba47a083927680867e

SHA512
568197801a7158b6a09e98c6827de3554f1abdb6a37da27be57ffa897653945a502748116855318750ae2b16be3785ddcbdf3c87cdf14dd6f5cf4c1353456550

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\2\CacheStorage\index.txt

Filesize
82B

MD5
9c12ec41b948e46a5108b7dbfaf1d16c

SHA1
860c5126809bae1950aa06800c5c1bcdf05f6c53

SHA256
34291f16a0ca09f3129132c388fbf0d909778432ae92059c6d85f77a622dc004

SHA512
a93099ce7e7896b91fe111c44df3beece4828d40705f08f403c63502cf778822f276a3d40f01bee3433b8b1de32cfeef9c8b445bfcfaf56befae6b3ec43f463c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\2\CacheStorage\index.txt~RFe6345f8.TMP

Filesize
146B

MD5
7d9c6f81b6047ac170f87e7bfa79416d

SHA1
41120923c12e9c5e472b4743c5a370966d547067

SHA256
668a57be8b3da421931b5d5a73ffda33093ee4a44e74db8bd2acd5bdff923a76

SHA512
658a132aa5187eff8aa638d0217f894d94a3732eaa98ca3fe1a08f897fe5281561f436d579966f17bed53f2e99f7362b27cf674681835daf1f19207c7bc772a9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
211KB

MD5
ff9261facdbb835bb4f6a475726b1276

SHA1
fa49cc49a40a55ce7502671802e6c0936875aa81

SHA256
13fc515d0f5205879a98ed740dabb29ec234d43c28cb8304691b2e366920cdae

SHA512
50c48e7ce842d26963cefeb05926621d4c4021f5466b0b832764c072042ab24be435ec9a0e8dd212eb34b84e5ef77f0ad992835e18f7d1b4f1cbe5e021967da5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6837505dae817f02bbb549d3910f76ec

SHA1
4bead1243a3ed4ba876f30031d11b7fcd4052b84

SHA256
997f7c6bb1805cb785d5c0ce131c8cb2362e6dc77efb38c3980f69b7a789a649

SHA512
4382a76e27e70b6ecc05c14e9a1b915e36ca661cb868042b28d59a7d807ae1ba069aa0e734648225dee2b6dc33626f58ee24df1cc451217fa093f46d5df616d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e15f9acde9d56006be268b4025f94b5b

SHA1
5d36b646b34f0a1d08b6020f12e548db96865906

SHA256
045480199f3befc5d2eee18f84e92cc5bf8881b76ac168085a987878da798e0c

SHA512
22d43f812391c9fafde0a4e247212e491765e8f049eb56d692f248623b7a52044ceab8e6977675c343d502b460666bd72a4ea970f9aaa7a6b8a6c3a880bcc255

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\62457a6a-96f8-417c-a480-158c6935a919.tmp

Filesize
5KB

MD5
372c547972c02143ea8bd8a1c9a81bba

SHA1
8c759e4f7bf5cb0b0f2a3a920cfd1530c3c84a17

SHA256
a5cb58b9e06db2282b51f214b63f0088ad0b0b09721e6a5db833cbacb0ced97a

SHA512
f339a282173785fe72dd3749c25210f60dd904061999e853540975b1e54173d335577f5585446184ddba2e6bb8af0f19c0013ab84b7f8c8ca489d249b5b4f89e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
212KB

MD5
08ec57068db9971e917b9046f90d0e49

SHA1
28b80d73a861f88735d89e301fa98f2ae502e94b

SHA256
7a68efe41e5d8408eed6e9d91a7b7b965a3062e4e28eeffeefb8cdba6391f4d1

SHA512
b154142173145122bc49ddd7f9530149100f6f3c5fd2f2e7503b13f7b160147b8b876344f6faae5e8616208c51311633df4c578802ac5d34c005bb154e9057cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
f28d04c7531ce250c565742586481fa8

SHA1
20e15cd48ec4c7b22c646519562efbacd92e1b67

SHA256
dc5090d3856b0fc08c3695906de627c07b48004369bb8af2a76da426e3ee81fd

SHA512
b2fd98c720923053eded7aee57eb603d0ac056a5224f73b3cfdb5ba22a7c3020834d0751486aac29595590066e713cb8c4864dfd0b25a37b8a0581ec53fe9328

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
814B

MD5
116159f0d36d27b06358637a68a253ac

SHA1
92d15579f9916647f6900ae6819968889c55d9d3

SHA256
552e45ebc424f478288ca0e355b81fb5b801477bc983059c266721c93f7ffc09

SHA512
23fdcbb24f601eebcde34f2c97630b16e1077bcce22210505e8532668f350a9900ec98fddd26be43d42fb1a9085ea090c6c2dd2e8d57d24c797f7005afeaea7f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
af14ecf563f5567e9f8f3f07dbf9cf3d

SHA1
a3c17c714592fdb96c84ac5ee7c7b17d40597111

SHA256
a5995a169df1c706348e44eaa10582d3c706b6a0e4ac2f4e8100828effa0a1c2

SHA512
8a4b280c33f502596aa89a7867ff9703fb847738f513acdea08cc50e3943cfcf0523259d51ac5365ae34b439399dc1eb2f55188426afbe4702890b3f72740407

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ff7aa5b0447c33e6036ec8f85422aca5

SHA1
11d11158c8f483c7adbf09b3a9ed8c0d3cc8557a

SHA256
99dbf59e26b3e30578990dfaf4f7c0737d9a8070de0283330a539ec8b7b37f06

SHA512
ff01aac4a5874e0ec63cb7fea0567f1e34feee1315982ff0874e4042d5c0a7e9c55e6e5a5c4488374ab8d6e9f3aa83d7657a3940c67c1138a26288acaac2a8fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0a72cc0f9381e97a052d0ca01da367dc

SHA1
c8f69a27cae33792c67be8f6517bdde95d4b0ffe

SHA256
c7fbf85f2ea51c6185b2b57d614a032d9339f3d155d46cc1fcfadf7064b42282

SHA512
5fe184535216e887910eaa78ffbd3a20c15216bb1f1cbb7ae7d5bd3ee940aebebfdb262612ef89093be2b1cf844c4ec56267cb347816baf71a97a37dd1293d37

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
e311e8070a5db17b6cab425cdb01bd27

SHA1
ac533db7fa0902f34d02662fd029facbf4b8e8c6

SHA256
b9aaa4c71488c3a8769cee7cf502ab93813fd6df60ff2172ba8cb7e1dec86532

SHA512
87accdca84a2b2042e2c12381cd1bc0fb2d74bbb0c6a4d18f444212803ebc0b7184317df7f5fb3eac722d5d43d942dd62ee1d760f0b3fd18911df5bd04fa31c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
0748afe9810fb54a7bc59b0ee806a9b2

SHA1
52c1fb6b39933b91c1d45910717683d9eddef8b6

SHA256
6df392494d7b1c0b2b6f57abd5f4946eaf27781501133f8de5665270fbf5c325

SHA512
12690e4e4733a793357017909f60d6b50c300956df9e2a2e13fe98968e051c3636dacd8271ea62005a965260130c8d35e664002a5b95e81e08be59e880f2b7e6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
05e0478cd0ea3117540055040bbbae7b

SHA1
ae9ec2543675629060befacd82e3ab683c0e5108

SHA256
d1b1d957a843bdd7f09fd352f5011dcb1a483c9f0fbca1dbbc066e3ec4dbd314

SHA512
db9e31008fafa49c93821da1c16cd7175247d78d3088cb4f4f9aae25bdcece85767eb4d32dca45491447a0012115c3276f0a2c5d7b40000fbb1bac2650130e5f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\_R_E_A_D___T_H_I_S___9F29_.hta

Filesize
76KB

MD5
603fac187e57146ecf302662a49caa25

SHA1
39787be6b60617c6bba0b44384f965518120ab48

SHA256
0b5ccf83b3893caee48073d4e1e8bde99363eb3472d7ba88efc8b85e7520b76a

SHA512
c22bfad5f7eff179eb5d7d29495336bf7fa079c4d2f734e71b0dc8591f295110728736f1bd220c176e59299393616af0d171390d591f5b4de9be5e72c257e8c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\_R_E_A_D___T_H_I_S___PXKJQB_.txt

Filesize
1KB

MD5
2247db65ae8fce6c4310280d5a3df5f1

SHA1
1d73f82ccc33e870fa1b8b4db57892d938ad8531

SHA256
ef74c0573fb3482dbe14893b5dbdb59c85af0cf09b151fd0b2473a5ecc49c67f

SHA512
a082003c65aafe97ddffb6c8037590035718d4caa04c286787a66c748ccfacef489118b84fde1ed32d5515f3bcff0df3dbe1b42f0d7f14ce0840e46253368877

Download Submit
C:\Users\Admin\Downloads\Cerber 5.zip

Filesize
181KB

MD5
10d74de972a374bb9b35944901556f5f

SHA1
593f11e2aa70a1508d5e58ea65bec0ae04b68d64

SHA256
ab9f6ac4a669e6cbd9cfb7f7a53f8d2393cd9753cc1b1f0953f8655d80a4a1df

SHA512
1755be2bd1e2c9894865492903f9bf03a460fb4c952f84b748268bf050c3ece4185b612c855804c7600549170742359f694750a46e5148e00b5604aca5020218

Download Submit
C:\Users\Admin\Downloads\Koteyka2.zip

Filesize
721KB

MD5
0b6957df7b5112415195636db7c6b69f

SHA1
1d539b1533b5e5f56723a1e3f256325f095e3ab3

SHA256
b5d89cd72f3ded5ee31a61775738c3881eb8984f37a265056055755847817785

SHA512
aa6378c8a76df76a8a0bfa90fc5bc7b3d00762af720f85016119b11cca9882c4c9e7eb2e9af2210fc8129c18e16b34ba65b8e0718b17d928dbcbec698ad6434e

Download Submit
memory/1564-820-0x0000000000440000-0x000000000044E000-memory.dmp

Filesize
56KB

Download
memory/2676-819-0x00000000001C0000-0x00000000001CE000-memory.dmp

Filesize
56KB

Download
memory/3232-823-0x0000000000400000-0x00000000006B8000-memory.dmp

Filesize
2.7MB

Download
memory/3232-1259-0x0000000000400000-0x00000000006B8000-memory.dmp

Filesize
2.7MB

Download
memory/3232-1265-0x0000000000400000-0x00000000006B8000-memory.dmp

Filesize
2.7MB

Download
memory/3232-835-0x0000000000400000-0x00000000006B8000-memory.dmp

Filesize
2.7MB

Download
memory/3232-834-0x0000000000400000-0x00000000006B8000-memory.dmp

Filesize
2.7MB

Download
memory/3440-1275-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3440-838-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3440-822-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3440-1235-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3440-1241-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download