cryptolocker | 6514b345465786d232a61f8aca8e3b60e2bf8a3e45f237086e55caac0c19cb4d

max time kernel
1141s
max time network
1801s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20250113-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20250113-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
13-01-2025 17:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_1d93e8597dd860cf81cd913c4b997818.html
Size

25KB
MD5

1d93e8597dd860cf81cd913c4b997818
SHA1

a7dacf6a32b194720a87130a16f2222c44f036eb
SHA256

6514b345465786d232a61f8aca8e3b60e2bf8a3e45f237086e55caac0c19cb4d
SHA512

c35592acafe20b18914ba7ee31201faa7534136df292d7c14436fb3bcbdd5f07b96b3b63897509068b8263ec4e12f55e192de027996dac8e63e08712fb891e98
SSDEEP

384:PqlIcCtF4JVGTHyk9v1o99t5W9ISFaTGHx6QckT/gbpLOXguLZ:sZtSF5zg9ExLZ

Score

10^/10

cryptolocker dharma aspackv2 credential_access defense_evasion discovery evasion execution impact macro persistence privilege_escalation ransomware spyware stealer upx

Malware Config

Signatures

CryptoLocker
Ransomware family with multiple variants.
ransomware cryptolocker
Cryptolocker family
cryptolocker
Dharma
Dharma is a ransomware that uses security software installation to hide malicious activities.
ransomware dharma
Dharma family
dharma

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2449540194-3226363261-2578591490-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Users\\Admin\\Downloads\\The-MALWARE-Repo-master\\The-MALWARE-Repo-master\\Ransomware\\Birele.exe"	Birele.exe

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047
Renames multiple (566) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware
Contacts a large (1138) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Modifies Windows Firewall 2 TTPs 2 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2148	netsh.exe
2832	netsh.exe

Suspicious Office macro 1 IoCs

Office document equipped with macros.

macro

resource
behavioral1/files/0x0028000000046420-1279.dat

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral1/files/0x002800000004637a-1906.dat	aspack_v212_v242

Checks computer location settings 2 TTPs 8 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2449540194-3226363261-2578591490-1000\Control Panel\International\Geo\Nation	CoronaVirus.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2449540194-3226363261-2578591490-1000\Control Panel\International\Geo\Nation	msedge.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2449540194-3226363261-2578591490-1000\Control Panel\International\Geo\Nation	msedge.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2449540194-3226363261-2578591490-1000\Control Panel\International\Geo\Nation	msedge.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2449540194-3226363261-2578591490-1000\Control Panel\International\Geo\Nation	msedge.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2449540194-3226363261-2578591490-1000\Control Panel\International\Geo\Nation	Cerber5.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2449540194-3226363261-2578591490-1000\Control Panel\International\Geo\Nation	msedge.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2449540194-3226363261-2578591490-1000\Control Panel\International\Geo\Nation	msedge.exe

Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
credential_access stealer

Windows Credential Manager
T1555.004

Deletes itself 1 IoCs

pid	Process
2896	CoronaVirus.exe

Drops startup file 6 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-52BD0798.[[email protected]].ncov	CoronaVirus.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta	CoronaVirus.exe
File opened for modification	\??\c:\users\admin\appdata\roaming\microsoft\word\startup\	Cerber5.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CoronaVirus.exe	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	CoronaVirus.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-52BD0798.[[email protected]].ncov	CoronaVirus.exe

Executes dropped EXE 20 IoCs

pid	Process
4288	rickroll.exe
2128	rickroll.exe
2012	rickroll.exe
2336	Hydra.exe
4480	ScreenScrew.exe
3780	ScreenScrew.exe
732	ScreenScrew.exe
2344	CryptoLocker.exe
3412	{34184A33-0407-212E-3320-09040709E2C2}.exe
2956	{34184A33-0407-212E-3320-09040709E2C2}.exe
2896	CoronaVirus.exe
4436	Cerber5.exe
3276	Birele.exe
8044	msedge.exe
8156	msedge.exe
7984	msedge.exe
7844	msedge.exe
7800	msedge.exe
7732	msedge.exe
6816	msedge.exe

Impair Defenses: Safe Mode Boot 1 TTPs 7 IoCs

defense_evasion

Safe Mode Boot

T1562.009

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\Power	Birele.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\iai2c.sys	Birele.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\CBDHSvc	Birele.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\WinDefend	Birele.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\UserManager	Birele.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\SerCx2.sys	Birele.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\ProfSvc	Birele.exe

Loads dropped DLL 7 IoCs

pid	Process
8044	msedge.exe
7984	msedge.exe
7844	msedge.exe
7800	msedge.exe
8156	msedge.exe
7732	msedge.exe
6816	msedge.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\CoronaVirus.exe = "C:\\Windows\\System32\\CoronaVirus.exe"	CoronaVirus.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Windows\System32\Info.hta = "mshta.exe \"C:\\Windows\\System32\\Info.hta\""	CoronaVirus.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Users\Admin\AppData\Roaming\Info.hta = "mshta.exe \"C:\\Users\\Admin\\AppData\\Roaming\\Info.hta\""	CoronaVirus.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2449540194-3226363261-2578591490-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\CryptoLocker = "C:\\Users\\Admin\\AppData\\Roaming\\{34184A33-0407-212E-3320-09040709E2C2}.exe"	{34184A33-0407-212E-3320-09040709E2C2}.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2449540194-3226363261-2578591490-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\system = "C:\\Users\\Admin\\Downloads\\The-MALWARE-Repo-master\\The-MALWARE-Repo-master\\Ransomware\\Birele.exe"	Birele.exe

Drops desktop.ini file(s) 64 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Program Files (x86)\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini	CoronaVirus.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Public\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	CoronaVirus.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\OneDrive\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI	CoronaVirus.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\Contacts\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\Links\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Public\AccountPictures\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini	CoronaVirus.exe
File opened for modification	F:\$RECYCLE.BIN\S-1-5-21-2449540194-3226363261-2578591490-1000\desktop.ini	CoronaVirus.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn1\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Public\Downloads\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\Favorites\Links\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	CoronaVirus.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini	CoronaVirus.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn2\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\3D Objects\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini	CoronaVirus.exe
File opened for modification	C:\$Recycle.Bin\S-1-5-21-2449540194-3226363261-2578591490-1000\desktop.ini	CoronaVirus.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Public\Libraries\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Program Files\desktop.ini	CoronaVirus.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\Saved Games\desktop.ini	CoronaVirus.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	CoronaVirus.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\m:	Cerber5.exe
File opened (read-only)	\??\s:	Cerber5.exe
File opened (read-only)	\??\t:	Cerber5.exe
File opened (read-only)	\??\a:	Cerber5.exe
File opened (read-only)	\??\h:	Cerber5.exe
File opened (read-only)	\??\n:	Cerber5.exe
File opened (read-only)	\??\o:	Cerber5.exe
File opened (read-only)	\??\p:	Cerber5.exe
File opened (read-only)	\??\r:	Cerber5.exe
File opened (read-only)	\??\y:	Cerber5.exe
File opened (read-only)	\??\e:	Cerber5.exe
File opened (read-only)	\??\g:	Cerber5.exe
File opened (read-only)	\??\i:	Cerber5.exe
File opened (read-only)	\??\j:	Cerber5.exe
File opened (read-only)	\??\w:	Cerber5.exe
File opened (read-only)	\??\x:	Cerber5.exe
File opened (read-only)	\??\b:	Cerber5.exe
File opened (read-only)	\??\k:	Cerber5.exe
File opened (read-only)	\??\l:	Cerber5.exe
File opened (read-only)	\??\q:	Cerber5.exe
File opened (read-only)	\??\u:	Cerber5.exe
File opened (read-only)	\??\v:	Cerber5.exe
File opened (read-only)	\??\z:	Cerber5.exe

Drops file in System32 directory 40 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\microsoft sql server	Cerber5.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\word	Cerber5.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\onenote	Cerber5.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\outlook	Cerber5.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\powerpoint	Cerber5.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\bitcoin	Cerber5.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\onenote	Cerber5.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\onenote	Cerber5.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\outlook	Cerber5.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\steam	Cerber5.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\office	Cerber5.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\word	Cerber5.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\bitcoin	Cerber5.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\microsoft sql server	Cerber5.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\powerpoint	Cerber5.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\steam	Cerber5.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\the bat!	Cerber5.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\documents	Cerber5.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft sql server	Cerber5.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\outlook	Cerber5.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\office	Cerber5.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\powerpoint	Cerber5.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\office	Cerber5.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\outlook	Cerber5.exe
File created	C:\Windows\System32\CoronaVirus.exe	CoronaVirus.exe
File created	C:\Windows\System32\Info.hta	CoronaVirus.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\excel	Cerber5.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft sql server	Cerber5.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\excel	Cerber5.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\excel	Cerber5.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\desktop	Cerber5.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\excel	Cerber5.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\office	Cerber5.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\onenote	Cerber5.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\thunderbird	Cerber5.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\word	Cerber5.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\powerpoint	Cerber5.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\word	Cerber5.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\the bat!	Cerber5.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\thunderbird	Cerber5.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x00280000000463b4-2013.dat	upx
behavioral1/memory/3276-2015-0x0000000000400000-0x0000000000438000-memory.dmp	upx
behavioral1/memory/3276-19758-0x0000000000400000-0x0000000000438000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\System.Windows.Forms.Primitives.resources.dll.id-52BD0798.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe.id-52BD0798.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_O17EnterpriseVL_Bypass30-ppd.xrm-ms	CoronaVirus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail-ul-phn.xrm-ms.id-52BD0798.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\Mozilla Firefox\vcruntime140_1.dll	CoronaVirus.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Microsoft.VCLibs.x86.14.00.appx	CoronaVirus.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\tpcps.dll	CoronaVirus.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app-api\dev\app-api.js.id-52BD0798.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcDemoR_BypassTrial365-ul-oob.xrm-ms.id-52BD0798.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial1-ppd.xrm-ms	CoronaVirus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019DemoR_BypassTrial180-ppd.xrm-ms.id-52BD0798.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Data.Services.Client.resources.dll	CoronaVirus.exe
File opened for modification	C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11cryptotoken.md	CoronaVirus.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\System.Windows.Forms.Primitives.resources.dll.id-52BD0798.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\dt_socket.dll	CoronaVirus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Grace-ppd.xrm-ms.id-52BD0798.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Retail-ul-oob.xrm-ms	CoronaVirus.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\ru-ru\ui-strings.js	CoronaVirus.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\PresentationUI.resources.dll.id-52BD0798.[[email protected]].ncov	CoronaVirus.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\duplicate.svg.id-52BD0798.[[email protected]].ncov	CoronaVirus.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\themes\dark\check.cur.id-52BD0798.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Locales\sr.pak	CoronaVirus.exe
File created	C:\Program Files\7-Zip\Lang\uk.txt.id-52BD0798.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\Windows Media Player\Media Renderer\DMR_120.png	CoronaVirus.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-file-l2-1-0.dll.id-52BD0798.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\Mozilla Firefox\freebl3.dll.id-52BD0798.[[email protected]].ncov	CoronaVirus.exe
File created	C:\Program Files\Mozilla Firefox\defaultagent.ini.id-52BD0798.[[email protected]].ncov	CoronaVirus.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\ReachFramework.resources.dll.id-52BD0798.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\playlist\soundcloud.luac.id-52BD0798.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\Mso98win32client.dll.id-52BD0798.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\WindowsBase.resources.dll	CoronaVirus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSIPC\he\msipc.dll.mui	CoronaVirus.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_delete_18.svg	CoronaVirus.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\themes\dark\arrow-right.gif.id-52BD0798.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\PresentationUI.resources.dll.id-52BD0798.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	CoronaVirus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Templates\1033\AdjacencyLetter.dotx	CoronaVirus.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ko-kr\ui-strings.js	CoronaVirus.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\it-it\PlayStore_icon.svg	CoronaVirus.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\sv\LC_MESSAGES\vlc.mo	CoronaVirus.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libgrey_yuv_plugin.dll.id-52BD0798.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.WebClient.dll.id-52BD0798.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\move.svg.id-52BD0798.[[email protected]].ncov	CoronaVirus.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\ReachFramework.resources.dll.id-52BD0798.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\UIAutomationClientSideProviders.dll	CoronaVirus.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\zh-tw\ui-strings.js.id-52BD0798.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\demux\libxa_plugin.dll.id-52BD0798.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\Microsoft.VisualBasic.Forms.resources.dll	CoronaVirus.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\en-il\ui-strings.js.id-52BD0798.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\bci.dll	CoronaVirus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Milk Glass.eftx	CoronaVirus.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Snippets\ShouldBeNullOrEmpty.snippets.ps1xml	CoronaVirus.exe
File opened for modification	C:\Program Files\StartCopy.csv.id-52BD0798.[[email protected]].ncov	CoronaVirus.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\WindowsFormsIntegration.resources.dll.id-52BD0798.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-rtlsupport-l1-1-0.dll.id-52BD0798.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\images\cursors\invalid32x32.gif.id-52BD0798.[[email protected]].ncov	CoronaVirus.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.dll.id-52BD0798.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files (x86)\Common Files\System\ado\ja-JP\msader15.dll.mui	CoronaVirus.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Xml.Linq.dll.id-52BD0798.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessVL_KMS_Client-ul.xrm-ms.id-52BD0798.[[email protected]].ncov	CoronaVirus.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\index.html.id-52BD0798.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\ro-ro\ui-strings.js.id-52BD0798.[[email protected]].ncov	CoronaVirus.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\ACEERR.DLL.id-52BD0798.[[email protected]].ncov	CoronaVirus.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Primitives.dll.id-52BD0798.[[email protected]].ncov	CoronaVirus.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\outlook	Cerber5.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\word	Cerber5.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\the bat!	Cerber5.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\the bat!	Cerber5.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\the bat!	Cerber5.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\thunderbird	Cerber5.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\excel	Cerber5.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\powerpoint	Cerber5.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\onenote	Cerber5.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\powerpoint	Cerber5.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\onenote	Cerber5.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\outlook	Cerber5.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\word	Cerber5.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft sql server	Cerber5.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\excel	Cerber5.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\office	Cerber5.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\powerpoint	Cerber5.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\steam	Cerber5.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\thunderbird	Cerber5.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\word	Cerber5.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\bitcoin	Cerber5.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft sql server	Cerber5.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\microsoft sql server	Cerber5.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\excel	Cerber5.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\the bat!	Cerber5.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\desktop	Cerber5.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\steam	Cerber5.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\office	Cerber5.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\office	Cerber5.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\outlook	Cerber5.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\powerpoint	Cerber5.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\powerpoint	Cerber5.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\bitcoin	Cerber5.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\bitcoin	Cerber5.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\excel	Cerber5.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\thunderbird	Cerber5.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\word	Cerber5.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\outlook	Cerber5.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\steam	Cerber5.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\documents	Cerber5.exe
File opened for modification	\??\c:\windows\	Cerber5.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\bitcoin	Cerber5.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\onenote	Cerber5.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\onenote	Cerber5.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\onenote	Cerber5.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\office	Cerber5.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft sql server	Cerber5.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\excel	Cerber5.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\onenote	Cerber5.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\excel	Cerber5.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\onenote	Cerber5.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\word	Cerber5.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\onenote	Cerber5.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\microsoft sql server	Cerber5.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\outlook	Cerber5.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\powerpoint	Cerber5.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\steam	Cerber5.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\desktop	Cerber5.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\office	Cerber5.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\office	Cerber5.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\office	Cerber5.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\outlook	Cerber5.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\powerpoint	Cerber5.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\powerpoint	Cerber5.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 16 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CoronaVirus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hydra.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CryptoLocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ScreenScrew.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{34184A33-0407-212E-3320-09040709E2C2}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ScreenScrew.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ScreenScrew.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Birele.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{34184A33-0407-212E-3320-09040709E2C2}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cerber5.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
6824	cmd.exe
9168	PING.EXE

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Interacts with shadow copies 3 TTPs 2 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
6068	vssadmin.exe
3052	vssadmin.exe

Kills process with taskkill 2 IoCs

evasion

pid	Process
2072	taskkill.exe
1496	taskkill.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2449540194-3226363261-2578591490-1000_Classes\Local Settings	msedge.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
9168	PING.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
4564	WINWORD.EXE
4564	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4988	msedge.exe
4988	msedge.exe
2492	msedge.exe
2492	msedge.exe
1768	identity_helper.exe
1768	identity_helper.exe
1900	msedge.exe
1900	msedge.exe
1900	msedge.exe
1900	msedge.exe
1724	msedge.exe
1724	msedge.exe
2896	CoronaVirus.exe
2896	CoronaVirus.exe
2896	CoronaVirus.exe
2896	CoronaVirus.exe
2896	CoronaVirus.exe
2896	CoronaVirus.exe
2896	CoronaVirus.exe
2896	CoronaVirus.exe
2896	CoronaVirus.exe
2896	CoronaVirus.exe
2896	CoronaVirus.exe
2896	CoronaVirus.exe
2896	CoronaVirus.exe
2896	CoronaVirus.exe
2896	CoronaVirus.exe
2896	CoronaVirus.exe
2896	CoronaVirus.exe
2896	CoronaVirus.exe
2896	CoronaVirus.exe
2896	CoronaVirus.exe
2896	CoronaVirus.exe
2896	CoronaVirus.exe
2896	CoronaVirus.exe
2896	CoronaVirus.exe
2896	CoronaVirus.exe
2896	CoronaVirus.exe
2896	CoronaVirus.exe
2896	CoronaVirus.exe
2896	CoronaVirus.exe
2896	CoronaVirus.exe
2896	CoronaVirus.exe
2896	CoronaVirus.exe
2896	CoronaVirus.exe
2896	CoronaVirus.exe
2896	CoronaVirus.exe
2896	CoronaVirus.exe
2896	CoronaVirus.exe
2896	CoronaVirus.exe
2896	CoronaVirus.exe
2896	CoronaVirus.exe
2896	CoronaVirus.exe
2896	CoronaVirus.exe
2896	CoronaVirus.exe
2896	CoronaVirus.exe
2896	CoronaVirus.exe
2896	CoronaVirus.exe
2896	CoronaVirus.exe
2896	CoronaVirus.exe
2896	CoronaVirus.exe
2896	CoronaVirus.exe
2896	CoronaVirus.exe
2896	CoronaVirus.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 24 IoCs

pid	Process
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe

Suspicious use of AdjustPrivilegeToken 13 IoCs

description	pid	Process
Token: SeRestorePrivilege	4144	7zG.exe
Token: 35	4144	7zG.exe
Token: SeSecurityPrivilege	4144	7zG.exe
Token: SeSecurityPrivilege	4144	7zG.exe
Token: SeDebugPrivilege	2072	taskkill.exe
Token: SeBackupPrivilege	6032	vssvc.exe
Token: SeRestorePrivilege	6032	vssvc.exe
Token: SeAuditPrivilege	6032	vssvc.exe
Token: SeShutdownPrivilege	4436	Cerber5.exe
Token: SeCreatePagefilePrivilege	4436	Cerber5.exe
Token: SeDebugPrivilege	1496	taskkill.exe
Token: 33	6316	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	6316	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe

Suspicious use of SendNotifyMessage 28 IoCs

pid	Process
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe

Suspicious use of SetWindowsHookEx 14 IoCs

pid	Process
4564	WINWORD.EXE
4564	WINWORD.EXE
4564	WINWORD.EXE
4564	WINWORD.EXE
4564	WINWORD.EXE
4564	WINWORD.EXE
4564	WINWORD.EXE
4564	WINWORD.EXE
4564	WINWORD.EXE
4564	WINWORD.EXE
4564	WINWORD.EXE
4564	WINWORD.EXE
4564	WINWORD.EXE
4564	WINWORD.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2492 wrote to memory of 704	2492	msedge.exe	80
PID 2492 wrote to memory of 704	2492	msedge.exe	80
PID 2492 wrote to memory of 788	2492	msedge.exe	81
PID 2492 wrote to memory of 788	2492	msedge.exe	81
PID 2492 wrote to memory of 788	2492	msedge.exe	81
PID 2492 wrote to memory of 788	2492	msedge.exe	81
PID 2492 wrote to memory of 788	2492	msedge.exe	81
PID 2492 wrote to memory of 788	2492	msedge.exe	81
PID 2492 wrote to memory of 788	2492	msedge.exe	81
PID 2492 wrote to memory of 788	2492	msedge.exe	81
PID 2492 wrote to memory of 788	2492	msedge.exe	81
PID 2492 wrote to memory of 788	2492	msedge.exe	81
PID 2492 wrote to memory of 788	2492	msedge.exe	81
PID 2492 wrote to memory of 788	2492	msedge.exe	81
PID 2492 wrote to memory of 788	2492	msedge.exe	81
PID 2492 wrote to memory of 788	2492	msedge.exe	81
PID 2492 wrote to memory of 788	2492	msedge.exe	81
PID 2492 wrote to memory of 788	2492	msedge.exe	81
PID 2492 wrote to memory of 788	2492	msedge.exe	81
PID 2492 wrote to memory of 788	2492	msedge.exe	81
PID 2492 wrote to memory of 788	2492	msedge.exe	81
PID 2492 wrote to memory of 788	2492	msedge.exe	81
PID 2492 wrote to memory of 788	2492	msedge.exe	81
PID 2492 wrote to memory of 788	2492	msedge.exe	81
PID 2492 wrote to memory of 788	2492	msedge.exe	81
PID 2492 wrote to memory of 788	2492	msedge.exe	81
PID 2492 wrote to memory of 788	2492	msedge.exe	81
PID 2492 wrote to memory of 788	2492	msedge.exe	81
PID 2492 wrote to memory of 788	2492	msedge.exe	81
PID 2492 wrote to memory of 788	2492	msedge.exe	81
PID 2492 wrote to memory of 788	2492	msedge.exe	81
PID 2492 wrote to memory of 788	2492	msedge.exe	81
PID 2492 wrote to memory of 788	2492	msedge.exe	81
PID 2492 wrote to memory of 788	2492	msedge.exe	81
PID 2492 wrote to memory of 788	2492	msedge.exe	81
PID 2492 wrote to memory of 788	2492	msedge.exe	81
PID 2492 wrote to memory of 788	2492	msedge.exe	81
PID 2492 wrote to memory of 788	2492	msedge.exe	81
PID 2492 wrote to memory of 788	2492	msedge.exe	81
PID 2492 wrote to memory of 788	2492	msedge.exe	81
PID 2492 wrote to memory of 788	2492	msedge.exe	81
PID 2492 wrote to memory of 788	2492	msedge.exe	81
PID 2492 wrote to memory of 4988	2492	msedge.exe	82
PID 2492 wrote to memory of 4988	2492	msedge.exe	82
PID 2492 wrote to memory of 4804	2492	msedge.exe	83
PID 2492 wrote to memory of 4804	2492	msedge.exe	83
PID 2492 wrote to memory of 4804	2492	msedge.exe	83
PID 2492 wrote to memory of 4804	2492	msedge.exe	83
PID 2492 wrote to memory of 4804	2492	msedge.exe	83
PID 2492 wrote to memory of 4804	2492	msedge.exe	83
PID 2492 wrote to memory of 4804	2492	msedge.exe	83
PID 2492 wrote to memory of 4804	2492	msedge.exe	83
PID 2492 wrote to memory of 4804	2492	msedge.exe	83
PID 2492 wrote to memory of 4804	2492	msedge.exe	83
PID 2492 wrote to memory of 4804	2492	msedge.exe	83
PID 2492 wrote to memory of 4804	2492	msedge.exe	83
PID 2492 wrote to memory of 4804	2492	msedge.exe	83
PID 2492 wrote to memory of 4804	2492	msedge.exe	83
PID 2492 wrote to memory of 4804	2492	msedge.exe	83
PID 2492 wrote to memory of 4804	2492	msedge.exe	83
PID 2492 wrote to memory of 4804	2492	msedge.exe	83
PID 2492 wrote to memory of 4804	2492	msedge.exe	83
PID 2492 wrote to memory of 4804	2492	msedge.exe	83
PID 2492 wrote to memory of 4804	2492	msedge.exe	83

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1d93e8597dd860cf81cd913c4b997818.html
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x124,0x128,0x12c,0xdc,0x130,0x7ffc867546f8,0x7ffc86754708,0x7ffc86754718
  2⤵
  PID:704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,10376724899989751768,3406145361268048964,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
  2⤵
  PID:788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,10376724899989751768,3406145361268048964,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2396 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,10376724899989751768,3406145361268048964,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2876 /prefetch:8
  2⤵
  PID:4804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,10376724899989751768,3406145361268048964,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3716 /prefetch:1
  2⤵
  PID:2744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,10376724899989751768,3406145361268048964,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3740 /prefetch:1
  2⤵
  PID:1876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,10376724899989751768,3406145361268048964,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5356 /prefetch:1
  2⤵
  PID:3908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,10376724899989751768,3406145361268048964,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5684 /prefetch:1
  2⤵
  PID:4428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,10376724899989751768,3406145361268048964,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4692 /prefetch:1
  2⤵
  PID:3736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,10376724899989751768,3406145361268048964,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6296 /prefetch:1
  2⤵
  PID:2588
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,10376724899989751768,3406145361268048964,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6788 /prefetch:8
  2⤵
  PID:1004
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
  2⤵
  PID:872
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x248,0x24c,0x250,0x224,0x254,0x7ff7a84c5460,0x7ff7a84c5470,0x7ff7a84c5480
    3⤵
    PID:1684
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,10376724899989751768,3406145361268048964,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6788 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,10376724899989751768,3406145361268048964,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4464 /prefetch:1
  2⤵
  PID:652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,10376724899989751768,3406145361268048964,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5812 /prefetch:1
  2⤵
  PID:760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,10376724899989751768,3406145361268048964,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5928 /prefetch:1
  2⤵
  PID:3148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,10376724899989751768,3406145361268048964,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7132 /prefetch:1
  2⤵
  PID:1272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,10376724899989751768,3406145361268048964,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7156 /prefetch:1
  2⤵
  PID:3276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,10376724899989751768,3406145361268048964,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6960 /prefetch:1
  2⤵
  PID:3912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2092,10376724899989751768,3406145361268048964,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=1220 /prefetch:8
  2⤵
  PID:3204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,10376724899989751768,3406145361268048964,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4504 /prefetch:1
  2⤵
  PID:1516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,10376724899989751768,3406145361268048964,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6856 /prefetch:1
  2⤵
  PID:4348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,10376724899989751768,3406145361268048964,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5748 /prefetch:1
  2⤵
  PID:2336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2092,10376724899989751768,3406145361268048964,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5824 /prefetch:8
  2⤵
  PID:3484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,10376724899989751768,3406145361268048964,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1832 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2092,10376724899989751768,3406145361268048964,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=7148 /prefetch:8
  2⤵
  PID:1192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,10376724899989751768,3406145361268048964,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4800 /prefetch:1
  2⤵
  PID:820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2092,10376724899989751768,3406145361268048964,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7060 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,10376724899989751768,3406145361268048964,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7060 /prefetch:1
  2⤵
  PID:1228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,10376724899989751768,3406145361268048964,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7280 /prefetch:1
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:8156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,10376724899989751768,3406145361268048964,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7312 /prefetch:1
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  PID:8044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,10376724899989751768,3406145361268048964,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5412 /prefetch:1
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  PID:7984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,10376724899989751768,3406145361268048964,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7572 /prefetch:1
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  PID:7844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,10376724899989751768,3406145361268048964,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1168 /prefetch:1
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  PID:7800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,10376724899989751768,3406145361268048964,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  PID:7732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,10376724899989751768,3406145361268048964,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  PID:6816

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3912

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2224

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4e0 0x320
1⤵
PID:1004

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4964

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\The-MALWARE-Repo-master\" -ad -an -ai#7zMap6379:108:7zEvent17987
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4144

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Virus\Melissa.doc" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4564

C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Joke\rickroll.exe
"C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Joke\rickroll.exe"
1⤵
- Executes dropped EXE
PID:4288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/watch?v=dQw4w9WgXcQ
  2⤵
  PID:30664
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x140,0x144,0x148,0x11c,0x14c,0x7ffc867546f8,0x7ffc86754708,0x7ffc86754718
    3⤵
    PID:48392

C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Joke\rickroll.exe
"C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Joke\rickroll.exe"
1⤵
- Executes dropped EXE
PID:2128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/watch?v=dQw4w9WgXcQ
  2⤵
  PID:21516
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffc867546f8,0x7ffc86754708,0x7ffc86754718
    3⤵
    PID:40668

C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Joke\rickroll.exe
"C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Joke\rickroll.exe"
1⤵
- Executes dropped EXE
PID:2012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/watch?v=dQw4w9WgXcQ
  2⤵
  PID:29272
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ffc867546f8,0x7ffc86754708,0x7ffc86754718
    3⤵
    PID:48220

C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Joke\Hydra.exe
"C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Joke\Hydra.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2336

C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Joke\ScreenScrew.exe
"C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Joke\ScreenScrew.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4480

C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Joke\ScreenScrew.exe
"C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Joke\ScreenScrew.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3780

C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Joke\ScreenScrew.exe
"C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Joke\ScreenScrew.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:732

C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\CryptoLocker.exe
"C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\CryptoLocker.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2344
- C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe
  "C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe" "/rC:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\CryptoLocker.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:3412
- - C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe
    "C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe" /w00000244
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2956

C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\CoronaVirus.exe
"C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\CoronaVirus.exe"
1⤵
- Checks computer location settings
- Deletes itself
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2896
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe"
  2⤵
  PID:4308
- - C:\Windows\system32\mode.com
    mode con cp select=1251
    3⤵
    PID:6156
- - C:\Windows\system32\vssadmin.exe
    vssadmin delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:6068
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe"
  2⤵
  PID:8228
- - C:\Windows\system32\mode.com
    mode con cp select=1251
    3⤵
    PID:7412
- - C:\Windows\system32\vssadmin.exe
    vssadmin delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:3052
- C:\Windows\System32\mshta.exe
  "C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"
  2⤵
  PID:7996
- C:\Windows\System32\mshta.exe
  "C:\Windows\System32\mshta.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"
  2⤵
  PID:7964

C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\Cerber5.exe
"C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\Cerber5.exe"
1⤵
- Checks computer location settings
- Drops startup file
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4436
- C:\Windows\SysWOW64\netsh.exe
  C:\Windows\system32\netsh.exe advfirewall set allprofiles state on
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:2148
- C:\Windows\SysWOW64\netsh.exe
  C:\Windows\system32\netsh.exe advfirewall reset
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:2832
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /d /c taskkill /f /im "C" > NUL & ping -n 1 127.0.0.1 > NUL & del "C" > NUL && exit
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:6824
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im "C"
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1496
- - C:\Windows\SysWOW64\PING.EXE
    ping -n 1 127.0.0.1
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:9168

C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\Birele.exe
"C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\Birele.exe"
1⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Impair Defenses: Safe Mode Boot
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:3276
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM explorer.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2072

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:6032

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:6936

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4e0 0x320
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:6316

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Direct Volume Access

T1006

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Safe Mode Boot

T1562.009

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Windows Credential Manager

T1555.004

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Network Service Discovery

T1046

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe.id-52BD0798.[[email protected]].ncov

Filesize
2.9MB

MD5
f761b238a4b093d9b62fb156b302f101

SHA1
df3e2bd0c7406ae0e9900dd50e041f412955ae39

SHA256
02784cd13d62695532f34c61878983d62b1af7d7edaae1e17050f69b23dc407c

SHA512
1749ad2fa55ca70f7a7212238dc6736330c52715ae4c5992fe793bfbfd074c2144c89e67869aef04ce7dad1fa2c956e99a5670973739b524c84b7da93b15f486

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ed90a660c04943bc07a5a29de51d4690

SHA1
4c1aabb06ed20c50300c6fddc492f4c1d491a09c

SHA256
70a4394643ed5adc0b953feb18f2318ea59a6aa6daab3161c5ffbe476891af02

SHA512
d78542e322265eca647cd0d41ff33383b0aebadcaf6cfe021433dd0581d9605d5a1924524529607564a8eaa0bed940a8cce73d2450182aa67856385f435aea95

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7aea85a5d58b45db7a4d9dd361b1eb5d

SHA1
c6844a476f9b8396b0db499d50303a0f34b8ddc6

SHA256
1b33dfb5c90ef3794804742054d7fb9fcaf94b99dfabd14054df4cd81794c46e

SHA512
f83d365e93c894d00c926c09d383b5805551a7c96595278131c3f5d44259713e5bb47a1d4259e452743a5c5040e8502c4e979a8ca076a4ea53d32722fb2b9057

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000018

Filesize
62KB

MD5
c813a1b87f1651d642cdcad5fca7a7d8

SHA1
0e6628997674a7dfbeb321b59a6e829d0c2f4478

SHA256
df670e09f278fea1d0684afdcd0392a83d7041585ba5996f7b527974d7d98ec3

SHA512
af0d024ba1faafbd6f950c67977ed126827180a47cea9758ee51a95d13436f753eb5a7aa12a9090048a70328f6e779634c612aebde89b06740ffd770751e1c5b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000019

Filesize
67KB

MD5
69df804d05f8b29a88278b7d582dd279

SHA1
d9560905612cf656d5dd0e741172fb4cd9c60688

SHA256
b885987a52236f56ce7a5ca18b18533e64f62ab64eb14050ede93c93b5bd5608

SHA512
0ef49eeeeb463da832f7d5b11f6418baa65963de62c00e71d847183e0035be03e63c097103d30329582fe806d246e3c0e3ecab8b2498799abbb21d8b7febdc0e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001a

Filesize
19KB

MD5
1bd4ae71ef8e69ad4b5ffd8dc7d2dcb5

SHA1
6dd8803e59949c985d6a9df2f26c833041a5178c

SHA256
af18b3681e8e2a1e8dc34c2aa60530dc8d8a9258c4d562cbe20c898d5de98725

SHA512
b3ff083b669aca75549396250e05344ba2f1c021468589f2bd6f1b977b7f11df00f958bbbd22f07708b5d30d0260f39d8de57e75382b3ab8e78a2c41ef428863

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001b

Filesize
63KB

MD5
226541550a51911c375216f718493f65

SHA1
f6e608468401f9384cabdef45ca19e2afacc84bd

SHA256
caecff4179910ce0ff470f9fa9eb4349e8fb717fa1432cf19987450a4e1ef4a5

SHA512
2947b309f15e0e321beb9506861883fde8391c6f6140178c7e6ee7750d6418266360c335477cae0b067a6a6d86935ec5f7acdfdacc9edffa8b04ec71be210516

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000033

Filesize
22KB

MD5
778ca3ed38e51e5d4967cd21efbdd007

SHA1
06e62821512a5b73931e237e35501f7722f0dbf4

SHA256
b7e1bfadb8d9c061f17a7234df012df7842ab1aa8fb6f9579fa3f0a3b4a75bc0

SHA512
5f6f02099ca8079305fb7e7f43ae4344d522271fe30379c0854d6a81b7d8adf408a50a4b799b5f52e6ed162ba6ce7fe97e24a2b9719df780e75683d3aa103d09

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000034

Filesize
49KB

MD5
65da8d6932ad74d3b51694b5a28dd0bb

SHA1
aa6e37cdacda153f499c299299a4dacf50c93765

SHA256
309ec80a404d5ba8c9816e0932bff343c8e205fe36819908682289ed7c7ae482

SHA512
bfce7ba0e18dde7d6f833709e565f704701d7a51b14d7c11b06cdce0b057290a334219c9aa4f7ea098c097eb779a2ceca397a9ad1ede0784348f78c81fd55015

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000037

Filesize
17KB

MD5
074e969bb4b56acd26091b19784df7e2

SHA1
0b8f66fd70f29859ea25ee481ff33f93bb84d512

SHA256
405893b0bf0b3e87141e7048e1cb6665ca5593fea1b159ca0ce90e77d049c51a

SHA512
0e7286126446b64efb16d8891ae2a649e4ccce337510eba812294e78b78d3d2680f4504bfcac7a8347e809c2e3fd905215ed711f60894b25a5beeff252372c8f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000039

Filesize
34KB

MD5
4ef030bc816262e8c61774e41de416dd

SHA1
bc0ed6a1a56092a01c2c811024bd9cbd5fb1fd11

SHA256
ccf18efca1c5f65c7511fe08ed9ac93322fc34ef9dadf2800e32c683e4c09c63

SHA512
382cce635d0eee2bf6278ff11a42307bd3c5d2c409e63b91c997a6c4478167d46eed8849a52b2121ed7bb789619f87ea53cd6c6041e1e05ccdc412e040775193

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00003a

Filesize
34KB

MD5
06e7f7a97846eb194dfda746226d0960

SHA1
6f07d517553c4205ed29a650116737743a1f3ac9

SHA256
848fb61fc851cf2056bfc1989074bf887568b70b67c9e777023135deb8eea913

SHA512
f9fbdbf6b0e9f9e2f448ec4eb0a452919487ccc545f06d928488cea018faefb771e769bf7d496b312fb3fbaedbc41082b64f94d44177a9df9af639be5fcba1c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00003e

Filesize
31KB

MD5
2d0cbcd956062756b83ea9217d94f686

SHA1
aedc241a33897a78f90830ee9293a7c0fd274e0e

SHA256
4670bfac0aeaec7193ce6e3f3de25773077a438da5f7098844bf91f8184c65b2

SHA512
92edce017aaf90e51811d8d3522cc278110e35fed457ea982a3d3e560a42970d6692a1a8963d11f3ba90253a1a0e222d8818b984e3ff31f46d0cdd6e0d013124

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00003f

Filesize
18KB

MD5
115c2d84727b41da5e9b4394887a8c40

SHA1
44f495a7f32620e51acca2e78f7e0615cb305781

SHA256
ae0e442895406e9922237108496c2cd60f4947649a826463e2da9860b5c25dd6

SHA512
00402945111722b041f317b082b7103bcc470c2112d86847eac44674053fc0642c5df72015dcb57c65c4ffabb7b03ece7e5f889190f09a45cef1f3e35f830f45

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000040

Filesize
18KB

MD5
c83e4437a53d7f849f9d32df3d6b68f3

SHA1
fabea5ad92ed3e2431659b02e7624df30d0c6bbc

SHA256
d9bada3a44bb2ffa66dec5cc781cafc9ef17ed876cd9b0c5f7ef18228b63cebb

SHA512
c2ca1630f7229dd2dec37e0722f769dd94fd115eefa8eeba40f9bb09e4fdab7cc7d15f3deea23f50911feae22bae96341a5baca20b59c7982caf7a91a51e152f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000041

Filesize
19KB

MD5
41ec4e9a135436783701748dbef52230

SHA1
ad9e472947dc486035c993e789f9ec08aa36ab45

SHA256
f7a58c4bdf063acb560bd697340313f6fcfeaa0a586365d36b803aaba19aca41

SHA512
f466d5fed7a18483c89e22f550ab36ccf4f873a8839755f762141aab08ded970218e06e6d5d48ba46aaba813ecbea20e51a713959c78f93f6c6c84bc7d6da8ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
48B

MD5
5b7243d852589954c074cca02e7c002c

SHA1
b05fe77871aa8060333d75fb6f7ea0ca724b8b13

SHA256
77b46050f96c9f1547562c1b70273709fae2671e5d979b2d4706f1d9bd7c2a44

SHA512
5b075d2a7e2872f6582cb525fddd294404231fb76f9d06c0da0e15ad841b64daed562e3e0c48f59a32391901b329c45fc2e36c3395b4df572af6a538f3873223

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
40f4b3e14462cb82fba9f1377826a60a

SHA1
8353f5eaeb068daa747a90c4c5ebf3226fb908c5

SHA256
36b743cff8338e0c4c2f7bdae4304be87c93f644c3bf4e8ff4f00cd47b9926e2

SHA512
5bf089a05a0146abfd2355e9d62cc9d11f9a76e44eabd1896705d9e25f825085f7a7a0609298983db94b5f71fb1c99f3be45e704b9b256f674cb5db3134ddde8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
423e93df44d206c0dea3801a68b67469

SHA1
bdfda16b97fadb48b2a78002a6636eb38d1b7175

SHA256
a8769bbdcb869f1f9453b11e02c81afb77ed88dbf92424c981f70003256ab260

SHA512
18215cb626a53acf79f9d4b01474aa0c35a48e71a100e642bfab6c0a6627b70062e455daf31d91d94aa31589f06d58a5f72b94b8668bb9d8dbf96a5311568443

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
436dc802bf78bbce2c40c28d290973d4

SHA1
479060ec43000f705c97b1f673fbd436b57489ad

SHA256
6082f84987d5fc38278261482e7b0b44905dddc8c08fd413d7ef8607f822921c

SHA512
5f4e96109159702c43fa94e0dc16a1cd555dd87ce0bf41233e45ee39c5a2b9d98b3c2ad90fd54e6899dae1a24edbfe3847abe2469885cc7b70e174c803791c51

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
7ae286038f38147fc3408663d283ba67

SHA1
a69e563cc46e6703016f88587d3c4e2d92c44b30

SHA256
b135d6f369f926e90f3398b143d8456530c1d7c0b80c7b3bec5e68980934048f

SHA512
9da28aa24dd6bd8a58f8db44815ecffdd719707e1a3033b5fb038a34c39aba1481dd0aa089c8439fed6e14458811d4da0d2ce9f9c25e9f57f942c3f5a83b0f1a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
0c7b5e176ccf122aad1821221cbcbdd1

SHA1
414a642c17885a050bca3861f693968d935fd10a

SHA256
fbe1bbd510c78f44f23c24219db273c11d22c75e4d05c0f8278445757e780f09

SHA512
549db11f4a030740cb315666e67db97b8560b0786e7c8a77a60b512cd79b01c0da33f7a77b01584f25d62cd40475759952a6d8ca577c92fdcd8a55fb95d6ae00

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
d5a898b0781428d90f9fa25cc40ea88b

SHA1
53602934f6d2d002d35ab67a10e00f557de44f25

SHA256
1b9b0df36aee076f271d03e5c42d270a35d4a4ae2117655e3e4dd966e1bd1b08

SHA512
a807a432a1a8d4a9ae897e2cf883e292397f9ffda4c551762f756e2965ebd742ff4a30e64062aa40fa0c7d27d288cc061a99ba6d017e8343583c3bdeefaaea3b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
6edcb592c511285ee7d51956fe758c45

SHA1
f1c2f0effd3615cf4c019a99cd60c47b57c999c3

SHA256
085e326084f211bd86f332209e0a651484917721d9bb506e2706ee2493440828

SHA512
3f77224667f85aaf15f83cad2745e4b10bee767d47446984f62b94872546fdacc67e8e3bf5a92905070b955f2fd80de6b0fe491c265ada2d74840b51f6730a4d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
5db245ae44a04885a892333cfcefb135

SHA1
b3a15d4b06dac65324bb7d60acdb4c44176d692a

SHA256
fc5e65becbe3c2bc5e9f25527bd6a62f07f2262eab6c964769965d40d262a4ff

SHA512
c8239964865079ff4b8a9164924c8660d3792783e2d55deb213e73cf1f2c9bfc1009a5fd70b7badb9762aef62b13ef43f18d5364221ddf78d49f64c4f4c4c72e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
2d6fe38633f2a8f70db6114757cae29f

SHA1
9990371c81a4282ef1451c348461b70d7eae10e6

SHA256
5067bcefe3f168fb9c471b03b42066d9e969f65fbd21793172abfe0894ed9885

SHA512
ba8a13a683a812fb59dfb8183c5e74cb7dbcfaeb83cfd807dfa1237bc7c8555e3cb365c185f03d80a34ebd336909ea7de889bd4862bee35cd19ff8a98d1a2fea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
cdcadbeaa51b9d55f34d87248871c68b

SHA1
89af3e930a814cb52ac32b9a84596a8b93f08415

SHA256
7adfe8837740c9d5f44fa271521d0a58dd8e998b3daf28a1dbbee1976d8da2c3

SHA512
3fe05a70d33e14fcb8cdcddc88af927d52e0efd68dfc396426836efdeee29dffcf28c0f1ba9808f9c1d7e24b9d3c16199049bf9754cc9259784d9e9dce9fa74e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
6d956586929b9cd29eed17e61176524a

SHA1
6bb04a30ee205b6a6eb3fc2e1a51cfd498eadc4d

SHA256
54a60e51b6e03c16d4a4f7e482819c732291c0c36a3121b436a9e36f2f9f988f

SHA512
f6c4933c6f8cdc686eff537d1c72df1762bd5b3dc480cc78548ae57112fa91141dfcc503bd3d9931939b4c547a013ae2bc0428c0dc321ff8a2543840a2ac20e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
54c384c71d73f5e7528965828ace890d

SHA1
946b8697b6c05cc3697badfd9c23ab1a301647ea

SHA256
dae9b900bfa79b0f8110d219166321d8e9374988ed91436b29e354f87c1b2023

SHA512
9163c249d9209b8dc32a4ee2883a751971d0d015af145b708ab352f9b0aba9666f4638f9e350f8c64d3fbd3b2a7873bd31320bd17d965039217d09e89cb4e1db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
6e9931e0d5cc3dcbc3f89ef1d33dcd60

SHA1
08bc83e5c59ee50c78d8a6eb403629f38272d404

SHA256
170e3a59a4dc2597ab7a35422debf2061449be3fd9e77b79a9fb45c0dc6f8884

SHA512
510d3728bd2881a58fd88c98c066349e1e1a607a3017084683268beb9f31fccc4811e1691ddbb063c9bfc611f6011795bb1328755da19880cca6a62341620ab0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
a233a792c8653f1a184a8c96eaf02dbe

SHA1
cfd41713c436e1d643ceeabfe8c6d49b7b6e42df

SHA256
fb8fb8daa4014f9fa1f10c08b784dc6d5d8d528538602ab43eca43c9f5407c0d

SHA512
25e3921a22ca2deaf95650cfcfc2528222417abebb2cbe2f3043162b7aa3abd28b2a514aa90239a896940088c6e137b4f8bb68bda19d35c4c797618081b30147

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
678B

MD5
b72a3cbd2d6c182f1199f47e594560a9

SHA1
c58dd6e0db8c489905d90fad4de49aaec2b82f39

SHA256
6e8d339d14262152be5bc3cf04eecef15eb19a88196a3729c390da39af74be32

SHA512
e2cff6f99972b646d366d4a17fe9d5288b792351afb642f611ae590b315e0fd9e96c2aae1b5b0223fadc7c65891d71ee2307e9f82277c226e371bfd681302f8c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State~RFe58b13a.TMP

Filesize
59B

MD5
2800881c775077e1c4b6e06bf4676de4

SHA1
2873631068c8b3b9495638c865915be822442c8b

SHA256
226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974

SHA512
e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State~RFe60fcb3.TMP

Filesize
4KB

MD5
649ae66599f83a5be26266df6a272f66

SHA1
81171bcbd612bcbb3b793ebbec7a964c09344a15

SHA256
6b09b7cf379cf2f403534780837640e8247032500cb31d1c85f8c1daa31c8943

SHA512
3c9b0ba6ee393c49071b2d3834b7f4a260d38a67ef6231de39720eb3a00955387c79276ddd286929b22cb8b458a9c5fc2b35e966bdfae0cf6a35723f5cbac871

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
f05ca7c67c614bc270ae420205f49ca7

SHA1
4e496a5b8076fa3b57473ef48cf98775a4c2de30

SHA256
5eb0d67e47ab9fcedc0d9e40447870c1b03419be8a11457e9347dfba13c36ab3

SHA512
8c183246878b376814fbce14becd8cf6c6a9a0dcb3ce184719d5838663c9ec29f929902052674dd80273086733513df54b446601502772949b87a81dba060fd7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
769670fdb277a5c78a532b3da87b2938

SHA1
bb83dcb064a328fdcc556dd582d71f07795f2575

SHA256
a7c2845acd6a48f122c71d7d09da7db37928264aaf2fb25dbddfa1a59dd5a19a

SHA512
0c2f949cd1586543373e199a543d3c5559d53522a1bb01fb3a8face8220d12237c1a63dff977432a979c6efdc76b8c83873471b19724834be92e2d7009d1a4e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
11f6ba6394fdd5ce5b831c11c6a906f3

SHA1
324ad8dfc440395d318940a20ad24f543e13e4d2

SHA256
df168fa46d5a879202d145fa2c11ca184778e4444ddab4e925b87174d24a5dc1

SHA512
302e0e82685e638d9614af195e2247cb7e031bf4f9bf88cc872eadda8ce94e1135016e60ffedbee592a914168b4d0e78b37cc19b18ed670eb7df9fb0300374dd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
105a9ae9728d311636a0a5f4eb115284

SHA1
7af07e1b00889239cfea5ffd26c6bd2e42e092c3

SHA256
8973140b994ce51a1159559f0a33ebc70be0acc3d882124b488cf16174220afd

SHA512
ccc6d2ee3fe0722d3451432618ba120829b13513295fe4eadda0aab2ae151be7dc019d531e39d6335d92d3408e55570bb79a2247f71e5db3ab9e3fa9ff08c30e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1f6d96f2fea5a1bb067047968a49dcfb

SHA1
19ac69c36aad255ce49a39809f6bb0ff36a12f02

SHA256
16df7ca6f133068f11587d87ff27ac13f0499c517c75cbe10f43e5941e97bb3f

SHA512
4787099a61ba09d2b9699b244b27e86af0e0240914aab9c286d4136fcc807f83bef9ae5a0ea80f15c32408fb9d70d04b1f0487b7b07669374a48d0a50b0580ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
44c77f4fa94755c69d71757d0a6ef957

SHA1
07efa07a41b7eb186abe8c167fe6e96abfd7f1d4

SHA256
e2dd7688db200e38f4c99ec9649ce4432064e3d61603dfdd0295efefb6abe840

SHA512
10d7ca7f1e0d212878c93795d2fdf079a2e9d2308be1d47abada7d748bd5390e901a84dc498488a3ce3acdf01937c1fc39a1d111ef08fb1148b7d7ebe949b750

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
33b1c302b685f75d4c42432b7b0bf5ea

SHA1
0e6b13ab6f88b322391edfed7ee09f7cef4e9548

SHA256
3314e2d2533b58165ddb1e4c8701cd55e05fe11ac38ab3a0dc4a90df05266c5b

SHA512
8678e4fa7c82aca2cc9d610d773ae4b13dddd78d5e61e6e437c642df6e07abcee959ef4b6c9e8adfa4180103a772b327a12d3577067b532897368dbfcc41205e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f67eb74c688078d6ba7f53a79f0a1799

SHA1
d22e6337b854129ae1f1d088036cc17b107aa28c

SHA256
6de4f95981e8611f808d2de89eaef88a8c123db1e1f7da7c2f97969b741e0360

SHA512
0a375d5cef73f39b1c89f44ee75899b0490cbe74979508ee2d1494d6e4626b6fb2aa4037c909796f46b3b8b0f2957975fedffa47b7323f841ad358adac2f4ca3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
48254982e70528f5ccc36f801dd7d5c9

SHA1
7eef45ae9d7cee0f3161e27f1f86e4d89881060f

SHA256
02953bb57d815b6b3a7ff5f6cfde5cc7f7a6e206af8001af7b3704b1dda928e2

SHA512
2d319e2875fafb70146c151eda681fc04d8c80155019ff43d1f82e057bf228570d1f1bfdba526688d45488c004a9da19c38c5ae25ce25272d426d1ea0b16ff0a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
55ac5035daa44e5169d4454fa40900cb

SHA1
a78cc59c2726ea59b71980fe2b80f4293af088e4

SHA256
7f8b0f40d1a6a8010e8d365f6d92c1dbdafcaeabf1ee492d745864ce78f4f3ac

SHA512
cfd5bac258a40a11f38346e74c8a43f18617c3742a83c51be6fd2caeec71c43c56a0684454b22b4adbb7caf7b3dc93cd7e0aaa5d4d7e7c528eda840374626c6d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
3197bce0fd2473291af7f959cb82b58f

SHA1
5747e270e0cb151ade7d29a1510ede74fc1e1a46

SHA256
b05c79dd0ad7e33bdb5e71f2fea8aee06d415a97ce2e9da76cbfed9f7b6f2c4f

SHA512
43e22facecb57e8a61671f4c6f76baf28f574291e46fda2d00fa00e6fc46800693947c2bb700976f983272f3c0f35f5ecce3f45ad4385ac9161a09460b2aa8ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\12d80892-b6bb-4e73-a755-7839858ba456\index-dir\the-real-index

Filesize
2KB

MD5
85e2e0e0bad92f0029bde169e64ff495

SHA1
ce87c8b6d666a9ca73287edf7f7166d9038771ba

SHA256
3f8f164a465e9b2bd27b8c509f17a47699e50f69e84c11dfc24467b14ebd6d1c

SHA512
98b448745423cff56d73a5dda761e4c6b14edfee888817487c685863fe796f522d5126eadf51d9189399e12f1a968ebbeeb5e2a09427d2add14171e8c22c7929

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\12d80892-b6bb-4e73-a755-7839858ba456\index-dir\the-real-index~RFe602a9e.TMP

Filesize
48B

MD5
8830dc2d6503e3cb6aded44baf56f7a6

SHA1
81041fbfd1a2d6102ecdea4fe485f10505f6876e

SHA256
18d2c319e3aa57c98d793f4496f97979ca641e759d1e2381cb69afa8e2d17590

SHA512
347d967b2e2f7d966b8d1a7fe00a81293fdfe960d660df38626aab388b72cca952c6cc58010cdf779cecfd6b99fb34cdc4aef6aaa631dcfc784897f5c651877e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\89d775a8-b4a8-467e-bd58-a83bd0f69326\index

Filesize
24B

MD5
54cb446f628b2ea4a5bce5769910512e

SHA1
c27ca848427fe87f5cf4d0e0e3cd57151b0d820d

SHA256
fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d

SHA512
8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\89d775a8-b4a8-467e-bd58-a83bd0f69326\index-dir\the-real-index

Filesize
2KB

MD5
2a05539ed412a4709d4e412d5630f44a

SHA1
52324067a32fe8a783d512170bf879bfb12068f9

SHA256
1b339767b7ec749ef6745c28b16a5dabfa2cc6985b6a47ee64d69ab0f00556b8

SHA512
b7e5d92ec6cadc0910b6d02cb8f01b3ee42b5e2c79d93d6db66ae38bfc1ef2c1c3eaa54532dbf3c2f29e8de1bb76a4847b2675d542f2cd208a9384a6481da31c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\89d775a8-b4a8-467e-bd58-a83bd0f69326\index-dir\the-real-index

Filesize
600B

MD5
7a17fa94775fead49df32991ea3e49c1

SHA1
0a69534d7c3ca579b608f939eeaf788c67bcd850

SHA256
e6cc44b2d44b782ba428acce7973f0cb403eab3fa413e0280521ad066bad0d5a

SHA512
63c8a0fb8f5b27c7177b3b23c45a9e5e17ff23fb7643dd736d9ef68fc415f1188ba3498aceacf2d2f5d0fa66c1a775f19f697ebe175bc49a73e58a5cc23c7ff8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\89d775a8-b4a8-467e-bd58-a83bd0f69326\index-dir\the-real-index

Filesize
216B

MD5
e928a0dc0fa86136073531e637eb41e8

SHA1
2bc826a53956d02ab88468ce61a90a11683ec384

SHA256
403fbc9b30f016858fdaf2f6cceed10886b52600c5fd8a31a158f8166a4fd47d

SHA512
745ded92846cf8d4980346bb2f4ffba0c24bc287c6dae17d66639116f87fdf4acb92af0f0fb3eccb7f58514f0624ffced46e5fc1033cb2cc349ad973a8e2b987

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\89d775a8-b4a8-467e-bd58-a83bd0f69326\index-dir\the-real-index~RFe6c6e25.TMP

Filesize
48B

MD5
42a8b57ce66ab46ab379853508911007

SHA1
47ba3f8b9eac8645d4534515129cb3d572945860

SHA256
3c8fe59b103f9d344926f1b19fb2c871b5557a559d834424768a249d37882355

SHA512
ef34d060f82dbe06c37e585e60c853882db28e71ac3c2f9cb79951c05ff11a109b6f6be7dfd003cb50fe7c50e13fccf08659709eb0ed5266907055740f3ffbdd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\a2524a26-6b9f-4d98-8cfe-50d34cfb9bbd\index-dir\the-real-index

Filesize
1KB

MD5
83094f96acba6abc8478453c3b76bc78

SHA1
3ba1c5d32e8e699d30cb95cf27d685d876f4a787

SHA256
418fba1e49c7a0c35307ef46dbb1a24e2572e1722006d607983814017472f68b

SHA512
96519a4dced4a81d9762321a01eb208846ab8b2ff29011f9c931ff23de995444d71888cd257583ac7d5cb4e73d30effc53ad19f7e4c1314314af37c66a359765

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\a2524a26-6b9f-4d98-8cfe-50d34cfb9bbd\index-dir\the-real-index

Filesize
2KB

MD5
caad40fc0cf9939bc5996fb61693d0cc

SHA1
43353e54f4a743f4e30a32c73f3ff5f7348f303c

SHA256
86a21b4d86825cf7efc149b3ceae163186ec42786be59a387d1c1f532a457fc4

SHA512
51dfc518eae83edb1d2a55f11e319e34c2617b619d6869a18a1459f100b2f8fd701cbad3101fc352be1a275368182461249916d1c23b9b73fa16be3d88c3ec7b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\a2524a26-6b9f-4d98-8cfe-50d34cfb9bbd\index-dir\the-real-index

Filesize
216B

MD5
7f7d35d69eefa1f88a0ecec8ec8a13a1

SHA1
8e0b700ade24a8ee17fddcee146d300278f09f9d

SHA256
94d53eed1a661fd884c25288e215f409a06d69342e5afb5c271a82c102720eee

SHA512
11e01aaf7ad5b3e7d74891fe74e4cb39e9f948ef5387ab558e3d65c9d96b95c6452971ecd68911ba58a03f113dfcb1b50272c71bd3ace311c35b258acab2116e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\a2524a26-6b9f-4d98-8cfe-50d34cfb9bbd\index-dir\the-real-index

Filesize
552B

MD5
06a9175c40e59b369dfba190a0cdeae2

SHA1
9a74793bb2cac3dbda81ee403a3412da45977313

SHA256
61afa5abd10f4eaa5402cef78a893d66b75034788815e1f7e0f95b74b91c346f

SHA512
c1ffb05982e91709457befe05bb0e59b4c18b9595e36904100e162a0645edac9b2e84f95cbcf0d82c3b469fb2a1a6d31a444cafc45cf334751430e44628e535b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\a2524a26-6b9f-4d98-8cfe-50d34cfb9bbd\index-dir\the-real-index

Filesize
2KB

MD5
c856a0b300a0d00af28a8d033145b535

SHA1
18917a2d588e47cd5ef554b7bc5f27d2c392d373

SHA256
e1aca3466197f7a9e20de9ad0acb1932ad19ef2eeafcc40273bdb7e7ea02f6f5

SHA512
5b2037c4dbcc74129239fd9146306fe772861b837241e476a750bf899791adeddb8b06ff69841ad0c3c21b262a7ce973d415c819fb6cc26d8e8a4344b7e4f2d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\a2524a26-6b9f-4d98-8cfe-50d34cfb9bbd\index-dir\the-real-index

Filesize
312B

MD5
630e99eb7860df20c449a10f735c70f7

SHA1
dfe0cdf1511827cd9f73bb256f6c3ae5c0719370

SHA256
bb386e7d3621c435dbc78a0a4f0902cb6ba8e2851472125b32af47749a241c5a

SHA512
6e109ebc95bd81602426825f57ff0f9531660fc56c5340e95ed270666265cb6e04c972dd22f36b666a36ef633556cbe19890c18258006aaf74ee3b6bd038db96

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\a2524a26-6b9f-4d98-8cfe-50d34cfb9bbd\index-dir\the-real-index~RFe671d1f.TMP

Filesize
48B

MD5
e1062090e45877868b32664d1555a8ea

SHA1
d232a7bc8f72fc93d7370bb677eaa69f26f0ccb3

SHA256
ea1355157f29661b822fed9697539456c5924b8e7bb7670b72ccaca87a8ca44d

SHA512
1aad39c9d4b6df394dcef8d18ed679ddde738f5de833cf724d00e2561833080acdda98e9dcbe81fd28cfc35165ff050b1508843e01541fa30349641747664407

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
89B

MD5
3e82db065370066f36bb3cb762cdc020

SHA1
473176825c845bbe1ec683adc945ae43b24f3565

SHA256
213f2185eb915b02e47e7f1e58456e6eefdd10ba2747e720158154e85849f277

SHA512
1b342ade6ec808609863adc18e7dc65bae694a9329e0ed4a15b5a93182ce644736bf412ab5d17e1cb1c43bc63d3be7d1bb99bd7f8912f78e5b1de4e758ad6463

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
89B

MD5
38249b42bb0b5f3696bf2005c059837f

SHA1
e03062579cef0ed9c62b2a7ad58a355ce8ab63df

SHA256
bed254059134dd49faf2a5fa74aea6a1cf607852f541d9fa3e6cd1586973d73c

SHA512
7d2f863e35e86b8939b69ffce8d7caa71d5ebd4eff5dcba8a34f269d774e9df7cbea2f6560ba068c51dceddff661701b669f7de40d0238ed028adb8a965f9c02

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
84B

MD5
2a41c4ef593dfffedbb8865c657184e1

SHA1
1f3c6589dbbfb8564bc8c36dc74805aec5065bb2

SHA256
f07b6432ae09e72a804ecdf506c131963f5cb6fd1b9acbe824d1c57a11adf765

SHA512
72e1d24bb8116d0d18812607d67cdd6a903b07720eaef36f0590005089f7206f04a935ed18f380160c23a927c068fd6df3e8d398a9e2e0b10e87d33f3ec4151c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
84B

MD5
f62a2a0611d939dd3e97ca5ba6d93a1a

SHA1
d2feb8b3e0cec575e2964e363a3a72451b12936e

SHA256
dbdb6ea45a1486e72f091fd1d1876c7e16dbded08a238ed10cbf0e12c5e5a81d

SHA512
b528ae01d869573e0ae13f0b564a66c8cc51437efaaba54165d6316ee6d8744213ad23d4a6040c8a757035236516fad719c0bbbd8dc193c9d43658a63f125384

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
83B

MD5
0acf6715eb0a717a6ca392280a3e7931

SHA1
ef3e27491e8bf75f2d43eee2e2a3f1c0afdd6a4a

SHA256
65e049396717456525f657be7f56a7fa09e90b23f70575827df799ee48952985

SHA512
1dc740a162c8e32d8c116c9aa2f255ea12b968a54ce184eee9203156055cf9807db41a6bc084c85118b7d8a9b0563d2d6faa80812efeee065c8da82402d1ff7b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
90B

MD5
ac3b279bfe7d9e51091277861385ea11

SHA1
9350566a83aed57dac02d6f2355f642ddc035f2a

SHA256
e12107a685c307bfd81f8160cb999fb16185e7b58bfeeba7609e089a5de361f1

SHA512
8823fab5fa68b91df11a7cb8c0106d524f89787406df6b2f7212f56517812feb92ad3e127ec45e314c6e1bd5abc91997369ac2986da5facb07e369d59e13be81

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
146B

MD5
60dc15ae5323738ef1683908025a9721

SHA1
15339cdc2c3c14c6c9ba9ccbe87a9b7703540cff

SHA256
3c51f36e357aa52189e16eff5c8adf7f877cdedb6fd8bf9b4185aa798673e308

SHA512
7fe3c1c453b48bb7ff7eca35cdf8c5b898bad652ffe6d3b66aa4b9e4717051ca4dda19f931da6cb52e1bf146d6f79e2f9ce757d91cfa3717d7abdb3cbb599241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
26B

MD5
2892eee3e20e19a9ba77be6913508a54

SHA1
7c4ef82faa28393c739c517d706ac6919a8ffc49

SHA256
4f110831bb434c728a6895190323d159df6d531be8c4bb7109864eeb7c989ff2

SHA512
b13a336db33299ab3405e13811e3ed9e5a18542e5d835f2b7130a6ff4c22f74272002fc43e7d9f94ac3aa6a4d53518f87f25d90c29e0d286b6470667ea9336ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
90B

MD5
e7cee7786247b0b4d8ad811b63f6c92a

SHA1
510e97c5acc0a8137ce16551684f3e5fa5054622

SHA256
138ce215f95dad54488ed3b61030c11b216ae6ff4187a31e85fb3be08d08eb5f

SHA512
32f70d7f15fcd36e9473ce1e5d109a55d01de5a54a46edc8f7d509da2c9feec657b35f043efa413fbe903337d34224973fe4cae16043f764df743dcda264081b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
82B

MD5
f1c56bf3862219b329cef0a1a20a4699

SHA1
130d796b2bf57b37e28ace5abcc6ec4604b04f66

SHA256
8d29e1d3d989c9cfb6cff7cf5939be874e95a5a71fa66d6530b788407f879a74

SHA512
b931e2565fa539e6cd7b3306325bd620c55f751aed053a163ad0db9b0d3ee2ca744ca8199aa53ea27da5af3eddbb3bfea5d9b39ad0ea2c1a95a21cd90214ea1c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt~RFe5f85c3.TMP

Filesize
89B

MD5
beddae830e56b28b6d90986b568dbb56

SHA1
5650ee3dab1d848c59c91b564908cd8e48b32485

SHA256
b9d0eae1464c311108f37713137ad3c197219db3949120b9e3544dff879706cd

SHA512
b8b3bdd03df67d55203f1b6230172229275c911e613c8579aab42e47669141e7c791f2d3e3e9a71ff4bc00f8a4036cd7b301a0a0a053a7785b470d2ba653d52e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
e72f699c16c296d2c38ff0218b4f9cab

SHA1
f9df00c9ee3bb402fb3cb12711773cc3179e4e36

SHA256
f8a124f14e8c5d53f5b45d42e54d297454a3a345deb89a59ef0306278523143a

SHA512
fd53b605c847ebb4e748c5d2ca4d332235164f7850d49758943fc6a591ce9aae0222fb6fbfaf6861e1e9172c1580fc978687f08a47e8f903e556d4d6ef9576b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5fef7a.TMP

Filesize
48B

MD5
87c4ab4ab25ea949b04f6ae5f11f32f6

SHA1
808a98adc3929a16938a738f76ca9ca36fa3746b

SHA256
38f80037371944030f229f18a3fd2fa1045cb875cec4b49d9c1fbcba35faeb64

SHA512
700c1d2ddd1c2b9b80abc2da45bf356c5acf629fb363218fd55b762070627b385baff13b05483dccf4427480ecd167bfa6620c3ccd8c88e7afd8162b44b00f23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
093aefa0f9740dde7b4e86968ccab914

SHA1
3afd7556d6b3891d04353f5218d67e5940cf0961

SHA256
d61b1c535df8be1a93a9d7057b34709c2c8fcafadb7a444a1129fbda7ec3e375

SHA512
5383ed3eaf300d5befed52c4d763c58ab50ca1a4b7c7d927929e7a70bad1c90877ab9a15d7e94ca396cb0538cabb1c40687c6c87123be1a1170c9bff1744ecfc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
fd62e91a5392a5588186312fa0f3b459

SHA1
113fb49154fde4eb21ff061f1bdb1dbd837e4b43

SHA256
c8e8e32dff3389865c8d5b32e0d0f321345869ab918f86383c1422d6518117eb

SHA512
3074153b21556f94ff7e84b21f23b78ca5de61b6b7ce0e03dfb21034b3217822133621c42c17a04144e605488745af5d899286c214c93dc0ff0e4c5624535494

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
ce847faf0e9b84800440f510946b0ac3

SHA1
a825d1d43368208aa4a667d6fafe207d39af1734

SHA256
f06dfbc5e1c2863f04513159e6bd0396d96854176143fc248f96347d6909b3b1

SHA512
c7c1d91bea59866f55577eec136dc78057b0d9e03be3bcfa0083d1610091fa33dd15c3400155cd0013f03c1dea903231cd0fb0448f04d73540394bdf0f18c526

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
e9425a421a8fab3e5ee156996180818c

SHA1
0a997a8eddf69b80a3bd756ffe0efe0a16e2faaf

SHA256
fa0987001022df5f7b2ff5f39a53d0282426b2101946d41952b6fdc8644c713a

SHA512
61e082cebf0f989b89cae69080c76ffd42c9177ad22912c39661d4d93299811df707ab91f696adcfcdbb8f749938cb30ec82487f695ba44ad82730e6f139277c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
3034497a744d15810312bb5b2a8b27c9

SHA1
57be4ebe51707af3b756251684341d1faa596d62

SHA256
d66e360f583d979a514afffab30aa2f24cddddbf49fd8eea998c2daab095484e

SHA512
159c09103718b6fe681de742beb1ee079e17cd0f0970ebfefaf74763c828c095e393989051c066b1d5e39d2c3ca5ad506233310779d195a1660b76e72d3ce53f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
3cfc29348128bf57e901ba3e169b53fc

SHA1
450668632e29340e8b297f69efc16f2ca053e987

SHA256
565afb74d8f17d455fca3cf36d583b14e24dd8db9e70d6bc405c57725e38485f

SHA512
b4da861046dc939a7ad88b9b3928150abbd7486c466fd805bdb66c7a77823e1363587853a012e1bb8470b63217eba3504c8d9c5fcb35adb196cfe25b7b3218ea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
a9043816f20fbf5925e715d749ee1267

SHA1
b1167931488c943560317122dadc3139e50b3dcc

SHA256
b8eba64b709bec19803c68b565c609d24485781c8fe6fb5777e29b5a9890becc

SHA512
7d636c7c54b0580f774fb963c2c4588ef2bf1bb18f27ad9de6a585385dac44ef928cd210037a09fb1fc3a4794b21e3afd4c541e9a4f31247383bc1f9ff969466

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
e2ddee8f5637c9646ee548f5d77530f6

SHA1
69c9e37530ab2d1dd9b4a25223f4814a4f94b4fe

SHA256
c25593ba526071d2e00b42ff3c97237cbde271b410317450000a5c17beafe328

SHA512
4599e092667604686a0b40663c9397624110739905b6b9189cc17710a84d42f4e4e69904eed5bd3a1b45821844024ed79be568d9cf30148cf1b4eb4ca3c2c706

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe59119a.TMP

Filesize
536B

MD5
1745fe9b46556402feec20b5e49bffa7

SHA1
2af81718022bc2987f0a9b2f698112b5b45f8d7b

SHA256
49dbd3c65724d299c50fb4751297c33907c0e9cf3daa851ee1025b92efbb95d8

SHA512
e59b17d5be4f8441bf68bbe7fc23b3e8a30b179fc5837e337e9e5e0e7f72766375cc246b68e5809fc783131a2c86b55fe0cbdec0d9ce6421fafe6cf925601dd1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5fadec.TMP

Filesize
1KB

MD5
90787ec286e99ece8dbe05aa38c0255f

SHA1
01fe2253264709e413ded61b426c771311e0d6b4

SHA256
e8987400d3e9899781b22907877ca92fe9a897b0f14340b013a8adee119be98c

SHA512
64d3818a686bea4b4814496e606d88c379238748643f46fcef0489f4c30ef2aadd620f0e6a6642fd094fdce37f9e3b8e658a38ff4de499ab13dd2b6fe5ad242a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\heavy_ad_intervention_opt_out.db

Filesize
16KB

MD5
9e02552124890dc7e040ce55841d75a4

SHA1
f4179e9e3c00378fa4ad61c94527602c70aa0ad9

SHA256
7b6e4ce73ddd8b5e7a7c4a94374ac2815d0048a5296879d7659a92ee0b425c77

SHA512
3e10237b1bff73f3bb031f108b8de18f1b3c3396d63dfee8eb2401ce650392b9417143a9ef5234831d8386fc12e232b583dd45eada3f2828b3a0a818123dd5cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
dc53a0363a2267d48a2ba95881f8a97a

SHA1
1a5f2bf2b07cdeb58f31b7dde7005cc81348a9dc

SHA256
9065dcce35732f636ad2d3510903a48cfa6257afacbb678e80bbb45d606c6de4

SHA512
0e3880ed4dfb2ee0911ffa90033c4d4bc51b95fcea766f0caa2021bd8341ecf2ce0217989b1c5836583986fb93cb601b915c8f2db841c826f4893038fb049dd8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
893d94ca5e638bfae36dbc629155297f

SHA1
1666a726baacc0b24a97cb521b40971a0efa65c4

SHA256
167da1f85af20b8cd50a7b9957021c1277cfc523ca916e7656ba7ea97b60ee17

SHA512
4c73fd4b8699d247fc622d833a515e59d5d1fb5c190125bef7173b5c89c03af196e82fd556583a454b7e79efae016762dc2bcae43688913dc582a0144b1e1285

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
508f6d52d7654dbbb63a1f9ec31832c9

SHA1
56457685152b29b499f0d16e82c71a3599b9ab6e

SHA256
33eb20f41aa34739046a143ea50db4da4f906f4eab829ac9cc49cb830e6bb300

SHA512
b1a61d5553a9e725a6e44e48e49a94eb26e7f0c3fd58591aca1a79a90d3ff79f998f43e5b475b384b7e44daf3a03ee3086d818f1a63f7b6de8e409396f13b96b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
24209ec6b202aa3e5bbdeff7e24bbd71

SHA1
22bd8659091cd778d5ec9addebc369e0d5cff2e2

SHA256
0ce9fc970e89cdca78f30cf65faf4abe05413818ebeb88f99eec75b0f57393cc

SHA512
2b8357ac978329eb1ccabb0e24d8f952d229bf45d2c32c1a62c54a9763b6ca85a71f5c8022a7ef51da854693274eb7cffe750ec96615aaf0806e7d005e456555

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\9cd93bc6dcf544bae69531052e64647ec02f2bb4.tbres

Filesize
4KB

MD5
cb3058b0834c82f40dabd4e4cc66efb2

SHA1
4733665b66399f1a158075c665f67e7654c89da1

SHA256
acf06eb9e7607472a53e8f98b4b80344e47f0f5c2d9d82deeb5a3c650b6b9ddf

SHA512
0b80497f348f84188cf4dbecb11cceb500ae2075298b21a9aa6ab174800e30f3166d6b7029076d988013453fd4c81a81a4f6dc7ef7e6244d1497aef9042aceb5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408.tbres

Filesize
2KB

MD5
c1022fd0fef6002b364e7efa258276ec

SHA1
df5c57635a640155406ac94e68ab4ea164de1480

SHA256
9589591792f944c35d3e3cb2e045a11dc121f6dae3071543690c0870e42f6ade

SHA512
228266ce929e7316cc155ae35bd9a7b1d9ab787bb729b2eac85eb3d9c91c391d9af26c13958959ba47b4ba8da71994c3150de22c67f3e3b1ce5479deaedb9857

Download Submit
C:\Users\Admin\AppData\Local\Temp\TCD4BB1.tmp\sist02.xsl

Filesize
245KB

MD5
f883b260a8d67082ea895c14bf56dd56

SHA1
7954565c1f243d46ad3b1e2f1baf3281451fc14b

SHA256
ef4835db41a485b56c2ef0ff7094bc2350460573a686182bc45fd6613480e353

SHA512
d95924a499f32d9b4d9a7d298502181f9e9048c21dbe0496fa3c3279b263d6f7d594b859111a99b1a53bd248ee69b867d7b1768c42e1e40934e0b990f0ce051e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat

Filesize
307B

MD5
633600cd5c866501bb3e196a836d0583

SHA1
249a8fcb9e5f19f6530bf71c6d1e778e053f7940

SHA256
b6b369fd7f4afc7540f7a84860523617fa4287c39f2b668cc11eda13fe39cc45

SHA512
de790571f2704bcf6bd60a85699cadea43ab643e5234e470e3aa0055373fa733c9e2ac672365a06cf1be061bbb8c3964ed5fe4e79d45f67a940541422caa2061

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Templates\~WRD0000.tmp

Filesize
31KB

MD5
46e430b8d12fac56956aa46ca1da91dd

SHA1
35ed5cc0cc85a61eea4abeccfbc549bf38765dc5

SHA256
5a0a77cd83055a42d97d35571c3b58ba1199db1b949c378a35e979415b31e4cf

SHA512
d8210a7cf28a36219bbf7add4a19c1b3cea1a2f9a5ec8edf96d24bbcf1d41613e46f2f2d854bb7a6b93ddc786e7565b597addf2749a3eaaaebf2d927d61258d0

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC

Filesize
16B

MD5
d29962abc88624befc0135579ae485ec

SHA1
e40a6458296ec6a2427bcb280572d023a9862b31

SHA256
a91a702aab9b8dd722843d3d208a21bcfa6556dfc64e2ded63975de4511eb866

SHA512
4311e87d8d5559248d4174908817a4ddc917bf7378114435cf12da8ccb7a1542c851812afbaf7dc106771bdb2e2d05f52e7d0c50d110fc7fffe4395592492c2f

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
f0d97a689f7fee8a9b74fdf3b1560894

SHA1
898daa83f807db2f27e09eff505805a4d87a78ee

SHA256
1823ab2d24afa9fedadd8f318bff9fc5e5e8482a1975ef380531f9f0b36c863d

SHA512
05e40d883c20829f7cdc3be66ac795dc60f5ef9970e11dc27b11776dcde19248a2760bb2423a996a030580c1d8cab0f314482a18094a2a8c8cbe679f813dbfa9

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
b03c1587ff56990112821bc5e282a894

SHA1
76224e7568e9e38662c03defc82388aca3e55fe0

SHA256
bdc3d9be39fac866ddab4d877cfbae825c009523d89ad6890d753dddb00dd2d6

SHA512
bb80e5e42617a39b4445ce7bb8fbb8acfde00676d88f9b1345c050340d4412128681727c9d1fb319c6afcb46936164a80659e6f559ea0d65d967b777cbb7f0bc

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

Filesize
2KB

MD5
960f5df7bd4a4f8ba8bcca6bb71a112c

SHA1
aff5da499ad5cf2b7c7fc4692b1209cbb767c7e4

SHA256
984ffd2c867a6b681da0d3ea988cb929bb709bdfd0f4c18856865384db0ce5c5

SHA512
c59894b9f64665cc219c8d658b9c1dec467655a238b52676925c503f1a23420e9758d65011b32a8d06f4af63caf164bfdea4763069b675dbcd6f46ffc0a5bb99

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

Filesize
1KB

MD5
be51a799be7f28fa79d0fc9ced6f9f38

SHA1
eedfa48c7dc07a47dfdb38771c2d79a2ac1b06dc

SHA256
47db9567f874f39a998ec141cdd4e259e484ac481001f6c4e580d092b9b34e04

SHA512
79f82e4f1d721db03910f9b7aeb4a984c25bfed8d67a7f93a883521dc2f0b0a915ffa09e87745aa4925cfa4e4da6a7a13c45421d370cd3b021381366f636d358

Download Submit
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Joke\Hydra.exe

Filesize
43KB

MD5
b2eca909a91e1946457a0b36eaf90930

SHA1
3200c4e4d0d4ece2b2aadb6939be59b91954bcfa

SHA256
0b6c0af51cde971b3e5f8aa204f8205418ab8c180b79a5ac1c11a6e0676f0f7c

SHA512
607d20e4a46932c7f4d9609ef9451e2303cd79e7c4778fe03f444e7dc800d6de7537fd2648c7c476b9f098588dc447e8c39d8b21cd528d002dfa513a19c6ebbf

Download Submit
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Joke\ScreenScrew.exe

Filesize
111KB

MD5
e87a04c270f98bb6b5677cc789d1ad1d

SHA1
8c14cb338e23d4a82f6310d13b36729e543ff0ca

SHA256
e03520794f00fb39ef3cfff012f72a5d03c60f89de28dbe69016f6ed151b5338

SHA512
8784f4d42908e54ecedfb06b254992c63920f43a27903ccedd336daaeed346db44e1f40e7db971735da707b5b32206be1b1571bc0d6a2d6eb90bbf9d1f69de13

Download Submit
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Joke\rickroll.exe

Filesize
129KB

MD5
0ec108e32c12ca7648254cf9718ad8d5

SHA1
78e07f54eeb6af5191c744ebb8da83dad895eca1

SHA256
48b08ea78124ca010784d9f0faae751fc4a0c72c0e7149ded81fc03819f5d723

SHA512
1129e685f5dd0cb2fa22ef4fe5da3f1e2632e890333ce17d3d06d04a4097b4d9f4ca7d242611ffc9e26079900945cf04ab6565a1c322e88e161f1929d18a2072

Download Submit
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\Birele.exe

Filesize
116KB

MD5
41789c704a0eecfdd0048b4b4193e752

SHA1
fb1e8385691fa3293b7cbfb9b2656cf09f20e722

SHA256
b2dcfdf9e7b09f2aa5004668370e77982963ace820e7285b2e264a294441da23

SHA512
76391ac85fdc3be75441fcd6e19bed08b807d3946c7281c647f16a3be5388f7be307e6323fac8502430a4a6d800d52a88709592a49011ecc89de4f19102435ea

Download Submit
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\Cerber5.exe

Filesize
313KB

MD5
fe1bc60a95b2c2d77cd5d232296a7fa4

SHA1
c07dfdea8da2da5bad036e7c2f5d37582e1cf684

SHA256
b3e1e9d97d74c416c2a30dd11858789af5554cf2de62f577c13944a19623777d

SHA512
266c541a421878e1e175db5d94185c991cec5825a4bc50178f57264f3556080e6fe984ed0380acf022ce659aa1ca46c9a5e97efc25ff46cbfd67b9385fd75f89

Download Submit
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\CoronaVirus.exe

Filesize
1.0MB

MD5
055d1462f66a350d9886542d4d79bc2b

SHA1
f1086d2f667d807dbb1aa362a7a809ea119f2565

SHA256
dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0

SHA512
2c5e570226252bdb2104c90d5b75f11493af8ed1be8cb0fd14e3f324311a82138753064731b80ce8e8b120b3fe7009b21a50e9f4583d534080e28ab84b83fee1

Download Submit
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\CryptoLocker.exe

Filesize
338KB

MD5
04fb36199787f2e3e2135611a38321eb

SHA1
65559245709fe98052eb284577f1fd61c01ad20d

SHA256
d765e722e295969c0a5c2d90f549db8b89ab617900bf4698db41c7cdad993bb9

SHA512
533d6603f6e2a77bd1b2c6591a135c4717753d53317c1be06e43774e896d9543bcd0ea6904a0688aa84b2d8424641d68994b1e7dc4aa46d66c36feecb6145444

Download Submit
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Virus\Melissa.doc

Filesize
40KB

MD5
4b68fdec8e89b3983ceb5190a2924003

SHA1
45588547dc335d87ea5768512b9f3fc72ffd84a3

SHA256
554701bc874da646285689df79e5002b3b1a1f76daf705bea9586640026697ca

SHA512
b2205ad850301f179a078219c6ce29da82f8259f4ec05d980c210718551de916df52c314cb3963f3dd99dcfb9de188bd1c7c9ee310662ece426706493500036f

Download Submit
memory/732-1923-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/2012-1894-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/2128-1888-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/2336-1892-0x00000000058E0000-0x0000000005E86000-memory.dmp

Filesize
5.6MB

Download
memory/2336-1891-0x0000000000B30000-0x0000000000B40000-memory.dmp

Filesize
64KB

Download
memory/2336-1893-0x0000000005410000-0x00000000054A2000-memory.dmp

Filesize
584KB

Download
memory/2336-1895-0x00000000053F0000-0x00000000053FA000-memory.dmp

Filesize
40KB

Download
memory/2896-27901-0x0000000000400000-0x000000000056F000-memory.dmp

Filesize
1.4MB

Download
memory/2896-2008-0x0000000000400000-0x000000000056F000-memory.dmp

Filesize
1.4MB

Download
memory/3276-2015-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/3276-19758-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/3780-1922-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/4288-1887-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/4480-1920-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/4564-1871-0x00007FFC560F0000-0x00007FFC56100000-memory.dmp

Filesize
64KB

Download
memory/4564-1870-0x00007FFC560F0000-0x00007FFC56100000-memory.dmp

Filesize
64KB

Download
memory/4564-1274-0x00007FFC560F0000-0x00007FFC56100000-memory.dmp

Filesize
64KB

Download
memory/4564-1873-0x00007FFC560F0000-0x00007FFC56100000-memory.dmp

Filesize
64KB

Download
memory/4564-1872-0x00007FFC560F0000-0x00007FFC56100000-memory.dmp

Filesize
64KB

Download
memory/4564-1275-0x00007FFC560F0000-0x00007FFC56100000-memory.dmp

Filesize
64KB

Download
memory/4564-1276-0x00007FFC53730000-0x00007FFC53740000-memory.dmp

Filesize
64KB

Download
memory/4564-1277-0x00007FFC53730000-0x00007FFC53740000-memory.dmp

Filesize
64KB

Download
memory/4564-1271-0x00007FFC560F0000-0x00007FFC56100000-memory.dmp

Filesize
64KB

Download
memory/4564-1272-0x00007FFC560F0000-0x00007FFC56100000-memory.dmp

Filesize
64KB

Download
memory/4564-1273-0x00007FFC560F0000-0x00007FFC56100000-memory.dmp

Filesize
64KB

Download