cerber | 416774bf62d9612d11d561d7e13203a3cbc352382a8e382ade3332e3077e096c

Analysis

max time kernel
110s
max time network
111s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20250314-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20250314-enlocale:en-usos:windows10-ltsc_2021-x64system
submitted
15/03/2025, 17:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cerber.exe
Size

604KB
MD5

8b6bc16fd137c09a08b02bbe1bb7d670
SHA1

c69a0f6c6f809c01db92ca658fcf1b643391a2b7
SHA256

e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678
SHA512

b53d2cc0fe5fa52262ace9f6e6ea3f5ce84935009822a3394bfe49c4d15dfeaa96bfe10ce77ffa93dbf81e5428122aa739a94bc709f203bc346597004fd75a24
SSDEEP

6144:yYghlI5/u8f1mr+4RJ99MpDa52RX5wRDhOOU0qsR:yYKlYmDXEpDHRXP01

Score

10^/10

cerber defense_evasion discovery persistence privilege_escalation ransomware

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Microsoft\Office\OTele\_R_E_A_D___T_H_I_S___8OBG_.hta

Family

cerber

Ransom Note

<!DOCTYPE html> <html lang="en"> <head> <meta charset="utf-8"> <title>CERBER RANSOMWARE: Instructions</title> <HTA:APPLICATION APPLICATIONNAME="h" SCROLL="yes" SINGLEINSTANCE="yes" WINDOWSTATE="maximize"> <style type="text/css"> a { color: #04a; text-decoration: none; } a:hover { text-decoration: underline; } body { background-color: #e7e7e7; color: #222; font-family: "Lucida Sans Unicode", "Lucida Grande", sans-serif; font-size: 13pt; line-height: 19pt; } body, h1 { margin: 0; padding: 0; } hr { color: #bda; height: 2pt; margin: 1.5%; } h1 { color: #555; font-size: 14pt; } ol { padding-left: 2.5%; } ol li { padding-bottom: 13pt; } small { color: #555; font-size: 11pt; } ul { list-style-type: none; margin: 0; padding: 0; } .button { color: #04a; cursor: pointer; } .button:hover { text-decoration: underline; } .container { background-color: #fff; border: 2pt solid #c7c7c7; margin: 5%; min-width: 850px; padding: 2.5%; } .header { border-bottom: 2pt solid #c7c7c7; margin-bottom: 2.5%; padding-bottom: 2.5%; } .h { display: none; } .hr { background: #bda; display: block; height: 2pt; margin-top: 1.5%; margin-bottom: 1.5%; overflow: hidden; width: 100%; } .info { background-color: #efe; border: 2pt solid #bda; display: inline-block; padding: 1.5%; text-align: center; } .updating { color: red; display: none; padding-left: 35px; background: url("data:image/gif;base64,R0lGODlhGQAZAKIEAMzMzJmZmTMzM2ZmZgAAAAAAAAAAAAAAACH/C05FVFNDQVBFMi4wAwEAAAAh+QQFAAAEACwAAAAAGQAZAAADVki63P4wSEiZvLXemRf4yhYoQ0l9aMiVLISCDms+L/DIwwnfc+c3qZ9g6Hn5hkhF7YgUKI2dpvNpExJ/WKquSoMCvd9geDeuBpcuGFrcQWep5Df7jU0AACH5BAUAAAQALAoAAQAOABQAAAMwSLDU/iu+Gdl0FbTAqeXg5YCdSJCBuZVqKw5wC8/qHJv2IN+uKvytn9AnFBCHx0cCACH5BAUAAAQALAoABAAOABQAAAMzSLoEzrC5F9Wk9YK6Jv8gEYzgaH4myaVBqYbfIINyHdcDI+wKniu7YG+2CPI4RgFI+EkAACH5BAUAAAQALAQACgAUAA4AAAMzSLrcBNDJBeuUNd6WwXbWtwnkFZwMqUpnu6il06IKLChDrsxBGufAHW0C1IlwxeMieEkAACH5BAUAAAQALAEACgAUAA4AAAM0SLLU/lAtFquctk6aIe5gGA1kBpwPqVZn66hl1KINPDRB3sxAGufAHc0C1IkIxcARZ4QkAAAh+QQFAAAEACwBAAQADgAUAAADMUhK0vurSfiko8oKHC//yyCCYvmVI4cOZAq+UCCDcv3VM4cHCuDHOZ/wI/xxigDQMAEAIfkEBQAABAAsAQABAA4AFAAAAzNIuizOkLgZ13xraHVF1puEKWBYlUP1pWrLBLALz+0cq3Yg324PAUAXcNgaBlVGgPAISQAAIfkEBQAABAAsAQABABQADgAAAzRIujzOMBJHpaXPksAVHoogMlzpZWK6lF2UjgobSK9AtjSs7QTg8xCfELgQ/og9I1IxXCYAADs=") left no-repeat; } #change_language { float: right; } #change_language, #texts div { display: none; } </style> </head> <body> <div class="container"> <div class="header"> <a id="change_language" href="#" onclick="return changeLanguage1();" title="English">☑ English</a> <h1>CERBER RANSOMWARE</h1> Instructions </div> <div id="languages"> ☑ Select your language <ul> <li><a href="#" title="English" onclick="return sh_bl('en');">English</a></li> <li><a href="#" title="Arabic" onclick="return sh_bl('ar');">العربية</a></li> <li><a href="#" title="Chinese" onclick="return sh_bl('zh');">中文</a></li> <li><a href="#" title="Dutch" onclick="return sh_bl('nl');">Nederlands</a></li> <li><a href="#" title="French" onclick="return sh_bl('fr');">Français</a></li> <li><a href="#" title="German" onclick="return sh_bl('de');">Deutsch</a></li> <li><a href="#" title="Italian" onclick="return sh_bl('it');">Italiano</a></li> <li><a href="#" title="Japanese" onclick="return sh_bl('ja');">日本語</a></li> <li><a href="#" title="Korean" onclick="return sh_bl('ko');">한국어</a></li> <li><a href="#" title="Polish" onclick="return sh_bl('pl');">Polski</a></li> <li><a href="#" title="Portuguese" onclick="return sh_bl('pt');">Português</a></li> <li><a href="#" title="Spanish" onclick="return sh_bl('es');">Español</a></li> <li><a href="#" title="Turkish" onclick="return sh_bl('tr');">Türkçe</a></li> </ul> </div> <div id="texts"> <div id="en"> Can't yoCu find the necessary files? Is the cpQy982wontent of your files not readable? It is normal bezhAq98cause the files' names and the data in your files have been encryp7Rted by "CeUrber Ransomware". It me3g6HviNxans your files are NOT damagexHd! Your files are modified only. This modification is reversible. FzDCUYiwmrom now it is not possUt0xvrible to use your files until they will be decrypted. The only way to dech1Mrypt your files safely is to buy the special decryption software "CCyxerber Decryptor". Any attempts to restpa4gyore your files with the thirJodd-party software will be fatal for your files! <hr> You can procI0mOReed with purchasing of the decryption softwD3Xare at your personal page: Ple8nquQ3hhhNase wait...<a class="url" href="http://p27dokhpz2n7nvgr.12hygy.top/820E-3B12-07E1-0446-9535" target="_blank">http://p27dokhpz2n7nvgr.12hygy.top/820E-3B12-07E1-0446-9535</a><hr><a href="http://p27dokhpz2n7nvgr.14ewqv.top/820E-3B12-07E1-0446-9535" target="_blank">http://p27dokhpz2n7nvgr.14ewqv.top/820E-3B12-07E1-0446-9535</a><hr><a href="http://p27dokhpz2n7nvgr.14vvrc.top/820E-3B12-07E1-0446-9535" target="_blank">http://p27dokhpz2n7nvgr.14vvrc.top/820E-3B12-07E1-0446-9535</a><hr><a href="http://p27dokhpz2n7nvgr.129p1t.top/820E-3B12-07E1-0446-9535" target="_blank">http://p27dokhpz2n7nvgr.129p1t.top/820E-3B12-07E1-0446-9535</a><hr><a href="http://p27dokhpz2n7nvgr.1apgrn.top/820E-3B12-07E1-0446-9535" target="_blank">http://p27dokhpz2n7nvgr.1apgrn.top/820E-3B12-07E1-0446-9535</a> If t0mhis page cannot be opened  cliQhpVOWcR9lck here  to get a new addrXkd7v3ess of your personal page. If the addrewYvlcss of your personal page is the same as befoxQCiDqoxpMre after you tried to get a new one, you c3ovflan try to get a new address in one hour. At thrwfxDis page you will receive the complete instrjuctions how to buy the decrypti1ksNV0b69on software for restoring all your files. Also at this page you will be able to resc2IInmMextore any one file for free to be sure "CerbeMH6C4DZX1r Decryptor" will help you. <hr> If your perxsonal page is not availaC1YdGE6Jigble for a long period there is another way to open your personal page - instaqbfp9pllation and use of Tor Browser: <ol> <li>run your Intex97qkDFv2rnet browser (if you do not know what it is run the Internet Explorer);</li> <li>enti6uszPHcMUer or copy the address <a href="https://www.torproject.org/download/download-easy.html.en" target="_blank">https://www.torproject.org/download/download-easy.html.en</a> into the address bar of your browser and press ENTER;</li> <li>wait for the site loadjUH1nsbing;</li> <li>on the site you will be offered to doswPzkTpwnload Tor Browser; download and run it, follow the installation instructions, wait until the installation is completed;</li> <li>rueQ2RGn Tor Browser;</li> <li>connect with the butt2on "Connect" (if you use the English version);</li> <li>a normal Internet broaXSkfIaixwser window will be opened after the initialization;</li> <li>type or copy the addCress http://p27dokhpz2n7nvgr.onion/820E-3B12-07E1-0446-9535 in this browser address bar;</li> <li>preAfTEejRHaTss ENTER;</li> <li>the site sholyn2uld be loaded; if for some reason the site is not lodading wait for a moment and try again.</li> </ol> If you have any prRMoblems during installation or use of Tor Browser, please, visit <a href="https://www.youtube.com/results?search_query=Install+Tor+Browser+Windows" target="_blank">https://www.youtube.com</a> and type request in the searcZDUfb21Zth bar "Install Tor Browser Windows" and you will find a lot of training videos about Tor Browser installation and use. <hr> Additf1ional information: You will fiWvUibGnd the instruCeTv6Dctions ("*_READ_THIS_FILE_*.hta") for rehj8ksSstoring your files in any fZdWOYHqAjolder with your encqzCrypted files. The instrd2diV2xuctions "*_READ_THIS_FILE_*.hta" in the f4fyEZ0QolderJWYCws with your encryD9Qd2WNpted files are not virO4Huses! The instruch70Ttions "*_READ_THIS_FILE_*.hta" will heCoahElp you to decGTrypt your files. Remembe0le7kXQDr! The worst silMMpWHTHtuation already happq9KUxGened and now the future of your files deNpends on your determxF3ZRgtwtyination and speed of your actions. </div> <div id="ar" style="direction: rtl;"> لا يمكنك العثور على الملفات الضرورية؟ هل محتوى الملفات غير قابل للقراءة؟ هذا أمر طبيعي لأن أسماء الملفات والبيانات في الملفات قد تم تشفيرها بواسطة "Cerber Ransomware". وهذا يعني أن الملفات الخاصة بك ليست تالفة! فقد تم تعديل ملفاتك فقط. ويمكن التراجع عن هذا. ومن الآن فإنه لا يكن استخدام الملفات الخاصة بك حتى يتم فك تشفيرها. الطريقة الوحيدة لفك تشفير ملفاتك بأمان هو أن تشتري برنامج فك التشفير المتخصص "Cerber Decryptor". إن أية محاولات لاستعادة الملفات الخاصة بك بواسطة برامج من طرف ثالث سوف تكون مدمرة لملفاتك! <hr> يمكنك الشروع في شراء برنامج فك التشفير من صفحتك الشخصية: أرجو الإنتظار...<a class="url" href="http://p27dokhpz2n7nvgr.12hygy.top/820E-3B12-07E1-0446-9535" target="_blank">http://p27dokhpz2n7nvgr.12hygy.top/820E-3B12-07E1-0446-9535</a><hr><a href="http://p27dokhpz2n7nvgr.14ewqv.top/820E-3B12-07E1-0446-9535" target="_blank">http://p27dokhpz2n7nvgr.14ewqv.top/820E-3B12-07E1-0446-9535</a><hr><a href="http://p27dokhpz2n7nvgr.14vvrc.top/820E-3B12-07E1-0446-9535" target="_blank">http://p27dokhpz2n7nvgr.14vvrc.top/820E-3B12-07E1-0446-9535</a><hr><a href="http://p27dokhpz2n7nvgr.129p1t.top/820E-3B12-07E1-0446-9535" target="_blank">http://p27dokhpz2n7nvgr.129p1t.top/820E-3B12-07E1-0446-9535</a><hr><a href="http://p27dokhpz2n7nvgr.1apgrn.top/820E-3B12-07E1-0446-9535" target="_blank">http://p27dokhpz2n7nvgr.1apgrn.top/820E-3B12-07E1-0446-9535</a> في حالة تعذر فتح هذه الصفحة  انقر هنا  لإنشاء عنوان جديد لصفحتك الشخصية. في هذه الصفحة سوف تتلقى تعليمات كاملة حول كيفية شراء برنامج فك التشفير لاستعادة جميع الملفات الخاصة بك. في هذه الصفحة أيضًا سوف تتمكن من استعادة ملف واحد بشكل مجاني للتأكد من أن "Cerber Decryptor" سوف يساعدك. <hr> إذا كانت صفحتك الشخصية غير متاحة لفترة طويلة فإن ثمّة طريقة أخرى لفتح صفحتك الشخصية - تحميل واستخدام متصفح Tor: <ol> <li>قم بتشغيل متصفح الإنترنت الخاص بك (إذا كنت لا تعرف ما هو قم بتشغيل إنترنت إكسبلورر);</li> <li>قم بكتابة أو نسخ العنوان <a href="https://www.torproject.org/download/download-easy.html.en" target="_blank">https://www.torproject.org/download/download-easy.html.en</a> إلى شريط العنوان في المستعرض الخاص بك ثم اضغط ENTER;</li> <li>انتظر لتحميل الموقع;</li> <li>سوف يعرض عليك الموقع تحميل متصفح Tor. قم بتحميله وتشغيله، واتبع تعليمات التثبيت، وانتظر حتى اكتمال التثبيت;</li> <li>قم بتشغيل متصفح Tor;</li> <li>اضغط على الزر "Connect" (إذا كنت تستخدم النسخة الإنجليزية);</li> <li>سوف تُفتح نافذة متصفح الإنترنت العادي بعد البدء;</li> <li>قم بكتابة أو نسخ العنوان http://p27dokhpz2n7nvgr.onion/820E-3B12-07E1-0446-9535 في شريط العنوان في المتصفح;</li> <li>اضغط ENTER;</li> <li>يجب أن يتم تحميل الموقع؛ إذا لم يتم تحميل الموقع لأي سبب، انتظر للحظة وحاول مرة أخرى.</li> </ol> إذا كان لديك أية مشكلات أثناء عملية التثبيت أو استخدام متصفح Tor، يُرجى زيارة <a href="https://www.youtube.com/results?search_query=Install+Tor+Browser+Windows" target="_blank">https://www.youtube.com</a> واكتب الطلب "install tor browser windows" أو "تثبيت نوافذ متصفح Tor" في شريط البحث، وسوف تجد الكثير من أشرطة الفيديو للتدريب حول تثبيت متصفح Tor واستخدامه. <hr> معلومات إضFMuKb9Tdافية: سXوف تجد إرشادات استعادة الملفات الخاصة بك ("*_READ_THIS_FILE_*") في أي مجلد مع ملفاتك المشفرة. الإرش9f0Kادات ("*_READ_THIS_FILE_*") الموجودة في المجلدات مع ملفاتك المشفرة ليست فيروسات والإرشادات ("*_READ_THIS_FILE_*") سوف تساعدك على فك تشفير الملفات الخاصة بك. تذكر أن أسوأ موBanKdp5Tvقف قد حدث بالفعل، والآن مستقبل ملفاتك يعتمد على عزيمتك وسرعة الإجراءات الخاصة بك. </div> <div id="zh"> 您找不到所需的文件？ 您文件的内容无法阅读？ 这是正常的，因为您文件的文件名和数据已经被“Cerber Ransomware”加密了。 这意味着您的文件并没有损坏！您的文件只是被修改了，这��

Extracted

Path

C:\Users\Admin\AppData\Local\Microsoft\Office\OTele\_R_E_A_D___T_H_I_S___FUYTUG1O_.txt

Family

cerber

Ransom Note

CERBER RANSOMWARE ----- YOUR DOCUMENTS, PH0TOS, DATABASES AND OTHER IMPORTANT FILES HAVE BEEN ENCRYPTED! ----- The only way to decrypt y0ur files is to receive the private key and decryption program. To receive the private key and decryption program go to any decrypted folder, inside there is the special file (*_READ_THIS_FILE_*) with complete instructions how to decrypt your files. If you cannot find any (*_READ_THIS_FILE_*) file at your PC, follow the instructions below: ----- 1. Download "Tor Browser" from https://www.torproject.org/ and install it. 2. In the "Tor Browser" open your personal page here: http://p27dokhpz2n7nvgr.onion/820E-3B12-07E1-0446-9535 Note! This page is available via "Tor Browser" only. ----- Also you can use temporary addresses on your personal page without using "Tor Browser". ----- 1. http://p27dokhpz2n7nvgr.12hygy.top/820E-3B12-07E1-0446-9535 2. http://p27dokhpz2n7nvgr.14ewqv.top/820E-3B12-07E1-0446-9535 3. http://p27dokhpz2n7nvgr.14vvrc.top/820E-3B12-07E1-0446-9535 4. http://p27dokhpz2n7nvgr.129p1t.top/820E-3B12-07E1-0446-9535 5. http://p27dokhpz2n7nvgr.1apgrn.top/820E-3B12-07E1-0446-9535 ----- Note! These are temporary addresses! They will be available for a limited amount of time! -----

URLs

http://p27dokhpz2n7nvgr.onion/820E-3B12-07E1-0446-9535

http://p27dokhpz2n7nvgr.12hygy.top/820E-3B12-07E1-0446-9535

http://p27dokhpz2n7nvgr.14ewqv.top/820E-3B12-07E1-0446-9535

http://p27dokhpz2n7nvgr.14vvrc.top/820E-3B12-07E1-0446-9535

http://p27dokhpz2n7nvgr.129p1t.top/820E-3B12-07E1-0446-9535

http://p27dokhpz2n7nvgr.1apgrn.top/820E-3B12-07E1-0446-9535

Signatures

Cerber
Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.
ransomware cerber
Cerber family
cerber
Contacts a large (1109) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Modifies Windows Firewall 2 TTPs 2 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
5816	netsh.exe
3660	netsh.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-780313508-644878201-565826771-1000\Control Panel\International\Geo\Nation	cerber.exe

Drops startup file 1 IoCs

description	ioc	Process
File opened for modification	\??\c:\users\admin\appdata\roaming\microsoft\word\startup\	cerber.exe

Drops file in System32 directory 38 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\excel	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft sql server	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\excel	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\excel	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\outlook	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\onenote	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\thunderbird	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\thunderbird	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\bitcoin	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft sql server	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\documents	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\office	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\powerpoint	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\steam	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\word	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\word	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\excel	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\office	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\word	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\powerpoint	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\office	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\steam	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\the bat!	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\desktop	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\microsoft sql server	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\powerpoint	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\powerpoint	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\outlook	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\bitcoin	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\onenote	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\outlook	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\onenote	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\outlook	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\microsoft sql server	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\office	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\onenote	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\word	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\the bat!	cerber.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-780313508-644878201-565826771-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tmpE520.bmp"	cerber.exe

Drops file in Program Files directory 20 IoCs

description	ioc	Process
File opened for modification	\??\c:\program files (x86)\outlook	cerber.exe
File opened for modification	\??\c:\program files (x86)\thunderbird	cerber.exe
File opened for modification	\??\c:\program files (x86)\word	cerber.exe
File opened for modification	\??\c:\program files\	cerber.exe
File opened for modification	\??\c:\program files (x86)\microsoft\excel	cerber.exe
File opened for modification	\??\c:\program files (x86)\microsoft\microsoft sql server	cerber.exe
File opened for modification	\??\c:\program files (x86)\microsoft\powerpoint	cerber.exe
File opened for modification	\??\c:\program files (x86)\microsoft\word	cerber.exe
File opened for modification	\??\c:\program files (x86)\onenote	cerber.exe
File opened for modification	\??\c:\program files (x86)\microsoft\office	cerber.exe
File opened for modification	\??\c:\program files (x86)\office	cerber.exe
File opened for modification	\??\c:\program files (x86)\the bat!	cerber.exe
File opened for modification	\??\c:\program files (x86)\	cerber.exe
File opened for modification	\??\c:\program files (x86)\bitcoin	cerber.exe
File opened for modification	\??\c:\program files (x86)\microsoft\outlook	cerber.exe
File opened for modification	\??\c:\program files (x86)\powerpoint	cerber.exe
File opened for modification	\??\c:\program files (x86)\steam	cerber.exe
File opened for modification	\??\c:\program files (x86)\excel	cerber.exe
File opened for modification	\??\c:\program files (x86)\microsoft sql server	cerber.exe
File opened for modification	\??\c:\program files (x86)\microsoft\onenote	cerber.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft sql server	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\word	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\steam	cerber.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\office	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\outlook	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\powerpoint	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\office	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\steam	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\thunderbird	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\thunderbird	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\outlook	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\powerpoint	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\microsoft sql server	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\onenote	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\powerpoint	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\powerpoint	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\microsoft sql server	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\office	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\onenote	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\outlook	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\word	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\word	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\documents	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\desktop	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\excel	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\onenote	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\powerpoint	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\powerpoint	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\bitcoin	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\excel	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\excel	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\outlook	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\word	cerber.exe
File opened for modification	\??\c:\windows\	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft sql server	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\word	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\office	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\onenote	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\thunderbird	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\word	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\excel	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\excel	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\excel	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\microsoft sql server	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\microsoft sql server	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\word	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\powerpoint	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\steam	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\onenote	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\office	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\the bat!	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\the bat!	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\documents	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\onenote	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\word	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\onenote	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\the bat!	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\thunderbird	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\desktop	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\excel	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\office	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\outlook	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\steam	cerber.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NOTEPAD.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cerber.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
5524	PING.EXE

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 28 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
4912	taskkill.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-780313508-644878201-565826771-1000_Classes\Local Settings	cerber.exe
Key created	\REGISTRY\USER\S-1-5-21-780313508-644878201-565826771-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-780313508-644878201-565826771-1000\{3C964862-32B8-40ED-A5BD-FCA0CEBC26F2}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-780313508-644878201-565826771-1000\{4DDB2E84-62E3-4267-9D53-FC0C244A42F8}	msedge.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
3300	NOTEPAD.EXE

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
5524	PING.EXE

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
1992	taskmgr.exe
1992	taskmgr.exe
1992	taskmgr.exe
1992	taskmgr.exe
1992	taskmgr.exe
1992	taskmgr.exe
1992	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2884	cerber.exe
Token: SeCreatePagefilePrivilege	2884	cerber.exe
Token: SeDebugPrivilege	1992	taskmgr.exe
Token: SeSystemProfilePrivilege	1992	taskmgr.exe
Token: SeCreateGlobalPrivilege	1992	taskmgr.exe
Token: 33	1992	taskmgr.exe
Token: SeIncBasePriorityPrivilege	1992	taskmgr.exe
Token: SeDebugPrivilege	4912	taskkill.exe
Token: SeDebugPrivilege	4896	firefox.exe
Token: SeDebugPrivilege	4896	firefox.exe

Suspicious use of FindShellTrayWindow 52 IoCs

pid	Process
1992	taskmgr.exe
1992	taskmgr.exe
1992	taskmgr.exe
1992	taskmgr.exe
1992	taskmgr.exe
1992	taskmgr.exe
1992	taskmgr.exe
1992	taskmgr.exe
1992	taskmgr.exe
1992	taskmgr.exe
1992	taskmgr.exe
1992	taskmgr.exe
1992	taskmgr.exe
1992	taskmgr.exe
1992	taskmgr.exe
1992	taskmgr.exe
1992	taskmgr.exe
1992	taskmgr.exe
1992	taskmgr.exe
1992	taskmgr.exe
1992	taskmgr.exe
1992	taskmgr.exe
1992	taskmgr.exe
1992	taskmgr.exe
1992	taskmgr.exe
1992	taskmgr.exe
1992	taskmgr.exe
1992	taskmgr.exe
1992	taskmgr.exe
1992	taskmgr.exe
1992	taskmgr.exe
1992	taskmgr.exe
4896	firefox.exe
4896	firefox.exe
4896	firefox.exe
4896	firefox.exe
4896	firefox.exe
4896	firefox.exe
4896	firefox.exe
4896	firefox.exe
4896	firefox.exe
4896	firefox.exe
4896	firefox.exe
4896	firefox.exe
4896	firefox.exe
4896	firefox.exe
4896	firefox.exe
4896	firefox.exe
4896	firefox.exe
4896	firefox.exe
5788	msedge.exe
5788	msedge.exe

Suspicious use of SendNotifyMessage 44 IoCs

pid	Process
1992	taskmgr.exe
1992	taskmgr.exe
1992	taskmgr.exe
1992	taskmgr.exe
1992	taskmgr.exe
1992	taskmgr.exe
1992	taskmgr.exe
1992	taskmgr.exe
1992	taskmgr.exe
1992	taskmgr.exe
1992	taskmgr.exe
1992	taskmgr.exe
1992	taskmgr.exe
1992	taskmgr.exe
1992	taskmgr.exe
1992	taskmgr.exe
1992	taskmgr.exe
1992	taskmgr.exe
1992	taskmgr.exe
1992	taskmgr.exe
1992	taskmgr.exe
1992	taskmgr.exe
1992	taskmgr.exe
1992	taskmgr.exe
1992	taskmgr.exe
1992	taskmgr.exe
1992	taskmgr.exe
1992	taskmgr.exe
1992	taskmgr.exe
1992	taskmgr.exe
1992	taskmgr.exe
1992	taskmgr.exe
4896	firefox.exe
4896	firefox.exe
4896	firefox.exe
4896	firefox.exe
4896	firefox.exe
4896	firefox.exe
4896	firefox.exe
4896	firefox.exe
4896	firefox.exe
4896	firefox.exe
4896	firefox.exe
4896	firefox.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4896	firefox.exe
4896	firefox.exe
4896	firefox.exe
4896	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2884 wrote to memory of 5816	2884	cerber.exe	81
PID 2884 wrote to memory of 5816	2884	cerber.exe	81
PID 2884 wrote to memory of 5816	2884	cerber.exe	81
PID 2884 wrote to memory of 3660	2884	cerber.exe	83
PID 2884 wrote to memory of 3660	2884	cerber.exe	83
PID 2884 wrote to memory of 3660	2884	cerber.exe	83
PID 2884 wrote to memory of 5908	2884	cerber.exe	88
PID 2884 wrote to memory of 5908	2884	cerber.exe	88
PID 2884 wrote to memory of 5908	2884	cerber.exe	88
PID 2884 wrote to memory of 3300	2884	cerber.exe	89
PID 2884 wrote to memory of 3300	2884	cerber.exe	89
PID 2884 wrote to memory of 3300	2884	cerber.exe	89
PID 2884 wrote to memory of 3936	2884	cerber.exe	92
PID 2884 wrote to memory of 3936	2884	cerber.exe	92
PID 2884 wrote to memory of 3936	2884	cerber.exe	92
PID 3936 wrote to memory of 4912	3936	cmd.exe	94
PID 3936 wrote to memory of 4912	3936	cmd.exe	94
PID 3936 wrote to memory of 4912	3936	cmd.exe	94
PID 3936 wrote to memory of 5524	3936	cmd.exe	95
PID 3936 wrote to memory of 5524	3936	cmd.exe	95
PID 3936 wrote to memory of 5524	3936	cmd.exe	95
PID 4916 wrote to memory of 4896	4916	firefox.exe	98
PID 4916 wrote to memory of 4896	4916	firefox.exe	98
PID 4916 wrote to memory of 4896	4916	firefox.exe	98
PID 4916 wrote to memory of 4896	4916	firefox.exe	98
PID 4916 wrote to memory of 4896	4916	firefox.exe	98
PID 4916 wrote to memory of 4896	4916	firefox.exe	98
PID 4916 wrote to memory of 4896	4916	firefox.exe	98
PID 4916 wrote to memory of 4896	4916	firefox.exe	98
PID 4916 wrote to memory of 4896	4916	firefox.exe	98
PID 4916 wrote to memory of 4896	4916	firefox.exe	98
PID 4916 wrote to memory of 4896	4916	firefox.exe	98
PID 4896 wrote to memory of 5028	4896	firefox.exe	99
PID 4896 wrote to memory of 5028	4896	firefox.exe	99
PID 4896 wrote to memory of 5028	4896	firefox.exe	99
PID 4896 wrote to memory of 5028	4896	firefox.exe	99
PID 4896 wrote to memory of 5028	4896	firefox.exe	99
PID 4896 wrote to memory of 5028	4896	firefox.exe	99
PID 4896 wrote to memory of 5028	4896	firefox.exe	99
PID 4896 wrote to memory of 5028	4896	firefox.exe	99
PID 4896 wrote to memory of 5028	4896	firefox.exe	99
PID 4896 wrote to memory of 5028	4896	firefox.exe	99
PID 4896 wrote to memory of 5028	4896	firefox.exe	99
PID 4896 wrote to memory of 5028	4896	firefox.exe	99
PID 4896 wrote to memory of 5028	4896	firefox.exe	99
PID 4896 wrote to memory of 5028	4896	firefox.exe	99
PID 4896 wrote to memory of 5028	4896	firefox.exe	99
PID 4896 wrote to memory of 5028	4896	firefox.exe	99
PID 4896 wrote to memory of 5028	4896	firefox.exe	99
PID 4896 wrote to memory of 5028	4896	firefox.exe	99
PID 4896 wrote to memory of 5028	4896	firefox.exe	99
PID 4896 wrote to memory of 5028	4896	firefox.exe	99
PID 4896 wrote to memory of 5028	4896	firefox.exe	99
PID 4896 wrote to memory of 5028	4896	firefox.exe	99
PID 4896 wrote to memory of 5028	4896	firefox.exe	99
PID 4896 wrote to memory of 5028	4896	firefox.exe	99
PID 4896 wrote to memory of 5028	4896	firefox.exe	99
PID 4896 wrote to memory of 5028	4896	firefox.exe	99
PID 4896 wrote to memory of 5028	4896	firefox.exe	99
PID 4896 wrote to memory of 5028	4896	firefox.exe	99
PID 4896 wrote to memory of 5028	4896	firefox.exe	99
PID 4896 wrote to memory of 5028	4896	firefox.exe	99
PID 4896 wrote to memory of 5028	4896	firefox.exe	99
PID 4896 wrote to memory of 5028	4896	firefox.exe	99

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\cerber.exe
"C:\Users\Admin\AppData\Local\Temp\cerber.exe"
1⤵
- Checks computer location settings
- Drops startup file
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2884
- C:\Windows\SysWOW64\netsh.exe
  C:\Windows\system32\netsh.exe advfirewall set allprofiles state on
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:5816
- C:\Windows\SysWOW64\netsh.exe
  C:\Windows\system32\netsh.exe advfirewall reset
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:3660
- C:\Windows\SysWOW64\mshta.exe
  "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\_R_E_A_D___T_H_I_S___P94AZ_.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5908
- C:\Windows\SysWOW64\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\_R_E_A_D___T_H_I_S___8B2U_.txt
  2⤵
  - System Location Discovery: System Language Discovery
  - Opens file in notepad (likely ransom note)
  PID:3300
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3936
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im "cerber.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4912
- - C:\Windows\SysWOW64\PING.EXE
    ping -n 1 127.0.0.1
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:5524

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1992

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4916
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4896
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1992 -prefsLen 27100 -prefMapHandle 1996 -prefMapSize 270279 -ipcHandle 2072 -initialChannelId {c0c4e39e-776b-46eb-b759-095ff4f82311} -parentPid 4896 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4896" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:5028
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2424 -prefsLen 27136 -prefMapHandle 2428 -prefMapSize 270279 -ipcHandle 2436 -initialChannelId {df7d3342-c854-4041-8638-f37d06c6c46b} -parentPid 4896 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4896" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    - Checks processor information in registry
    PID:764
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3856 -prefsLen 27277 -prefMapHandle 3860 -prefMapSize 270279 -jsInitHandle 3864 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3872 -initialChannelId {fae1e188-5e73-4671-8589-008775f1948f} -parentPid 4896 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4896" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:4860
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3856 -prefsLen 27277 -prefMapHandle 3908 -prefMapSize 270279 -ipcHandle 4132 -initialChannelId {fd01c171-c04c-417a-bb56-cc92f16e4b37} -parentPid 4896 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4896" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:472
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3428 -prefsLen 25213 -prefMapHandle 2776 -prefMapSize 270279 -jsInitHandle 3284 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3324 -initialChannelId {6ff506a7-a458-41ad-a171-28d1a652d337} -parentPid 4896 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4896" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:2544
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4596 -prefsLen 25213 -prefMapHandle 4600 -prefMapSize 270279 -jsInitHandle 4604 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4612 -initialChannelId {84b5b2bc-b3aa-47f1-b431-11fd380b08b5} -parentPid 4896 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4896" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 tab
    3⤵
    - Checks processor information in registry
    PID:2224
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4780 -prefsLen 25213 -prefMapHandle 4784 -prefMapSize 270279 -jsInitHandle 4788 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3220 -initialChannelId {56e9c150-66bd-4388-b9cd-9087148e1413} -parentPid 4896 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4896" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:3968
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4988 -prefsLen 34825 -prefMapHandle 4992 -prefMapSize 270279 -jsInitHandle 4996 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4960 -initialChannelId {b4879aef-2ac5-4bc1-a32b-c36bae373310} -parentPid 4896 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4896" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:1756
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5520 -prefsLen 35013 -prefMapHandle 5524 -prefMapSize 270279 -ipcHandle 5468 -initialChannelId {0743053e-923d-4cdc-9239-1337bab599ae} -parentPid 4896 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4896" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 utility
    3⤵
    - Checks processor information in registry
    PID:2468
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4836 -prefsLen 33031 -prefMapHandle 2920 -prefMapSize 270279 -jsInitHandle 2924 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6004 -initialChannelId {6b7350ee-984b-42ce-8fcf-1c785e29e244} -parentPid 4896 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4896" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:5736

C:\Windows\SysWOW64\werfault.exe
werfault.exe /h /shared Global\1236df558a0c43ca823d25b2cfeb1896 /t 6124 /p 5908
1⤵
PID:3784

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\_R_E_A_D___T_H_I_S___P94AZ_.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
1⤵
- System Location Discovery: System Language Discovery
PID:2436

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\RequestCopy.mhtml
1⤵
PID:5752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument C:\Users\Admin\Desktop\RequestCopy.mhtml
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  PID:5788
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x260,0x264,0x268,0x25c,0x28c,0x7ff922def208,0x7ff922def214,0x7ff922def220
    3⤵
    PID:708
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1792,i,10666722894719347513,164847567649312130,262144 --variations-seed-version --mojo-platform-channel-handle=2912 /prefetch:3
    3⤵
    PID:3184
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2276,i,10666722894719347513,164847567649312130,262144 --variations-seed-version --mojo-platform-channel-handle=2260 /prefetch:2
    3⤵
    PID:5480
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2480,i,10666722894719347513,164847567649312130,262144 --variations-seed-version --mojo-platform-channel-handle=2924 /prefetch:8
    3⤵
    PID:2196
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3456,i,10666722894719347513,164847567649312130,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
    3⤵
    PID:4128
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3464,i,10666722894719347513,164847567649312130,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:1
    3⤵
    PID:3948
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=4884,i,10666722894719347513,164847567649312130,262144 --variations-seed-version --mojo-platform-channel-handle=4896 /prefetch:1
    3⤵
    PID:4624
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4288,i,10666722894719347513,164847567649312130,262144 --variations-seed-version --mojo-platform-channel-handle=3696 /prefetch:8
    3⤵
    PID:1204
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5108,i,10666722894719347513,164847567649312130,262144 --variations-seed-version --mojo-platform-channel-handle=3740 /prefetch:8
    3⤵
    PID:4584
- - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5648,i,10666722894719347513,164847567649312130,262144 --variations-seed-version --mojo-platform-channel-handle=5664 /prefetch:8
    3⤵
    PID:416
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5716,i,10666722894719347513,164847567649312130,262144 --variations-seed-version --mojo-platform-channel-handle=5728 /prefetch:8
    3⤵
    PID:2900
- - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5648,i,10666722894719347513,164847567649312130,262144 --variations-seed-version --mojo-platform-channel-handle=5664 /prefetch:8
    3⤵
    PID:4308
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
    3⤵
    - Drops file in Windows directory
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    PID:3584
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x268,0x26c,0x270,0x264,0x310,0x7ff922def208,0x7ff922def214,0x7ff922def220
      4⤵
      PID:5676
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1768,i,13193021974481326554,4114250108691805969,262144 --variations-seed-version --mojo-platform-channel-handle=2328 /prefetch:3
      4⤵
      PID:4752
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2228,i,13193021974481326554,4114250108691805969,262144 --variations-seed-version --mojo-platform-channel-handle=2224 /prefetch:2
      4⤵
      PID:5372
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2344,i,13193021974481326554,4114250108691805969,262144 --variations-seed-version --mojo-platform-channel-handle=2356 /prefetch:8
      4⤵
      PID:464
  - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4144,i,13193021974481326554,4114250108691805969,262144 --variations-seed-version --mojo-platform-channel-handle=4212 /prefetch:8
      4⤵
      PID:4420
  - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4144,i,13193021974481326554,4114250108691805969,262144 --variations-seed-version --mojo-platform-channel-handle=4212 /prefetch:8
      4⤵
      PID:4892
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4500,i,13193021974481326554,4114250108691805969,262144 --variations-seed-version --mojo-platform-channel-handle=4568 /prefetch:8
      4⤵
      PID:4680

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:1084

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:5128

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Network Service Discovery

T1046

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma

Filesize
16KB

MD5
cfab81b800edabacbf6cb61aa78d5258

SHA1
2730d4da1be7238d701dc84eb708a064b8d1cf27

SHA256
452a5479b9a2e03612576c30d30e6f51f51274cd30ef576ea1e71d20c657376f

SHA512
ec188b0ee4d3daabc26799b34ee471bee988bdd7ceb011ed7df3d4cf26f98932bbbb4b70dc2b7fd4df9a3981b3ce22f4b5be4a0db97514d526e521575efb2ec6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
13213fb1155ca1d6bf2d079b0d9fedc8

SHA1
6238f569ada3a5390d23a803176d3e9143fa5550

SHA256
ee0c406dfa2abb9b434e5af0afb95c86131d690e5a0d83347c34873843623f55

SHA512
c5aadd24357f4f8613902e9cb191c1ab9e5868077f37ac4a8a8853265457644e718ee7339214c4049ba034bd56ea72a36b8e4714704427c91cc7e2c0920e9c5c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
aa9afd16e8041e8c80250b50ea6899e4

SHA1
a3a698d431952253255c343f2b35f74e73e63088

SHA256
2bd7f856d73f78bc3a4de32b447b21babad42c009b19fcebe2f8cdeca2380926

SHA512
344de0888df8851d957ca6fab055eb9e2f1aa6d958022c2c30442cd6aad4d158d0a99f8908184abc60fb1e0ccdd3d9395d8c0d37fc317d3700974c3348d4a5ff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0

Filesize
44KB

MD5
f0421d86a1e68b0eb266e110b9a75108

SHA1
98702e20fd4299a7877727021ed9380604550eef

SHA256
e45739dff0b15c2a1cc92322c9808a5c483f9b22237a01c1e1751cb92fb37196

SHA512
b006339953fe097956198c0a14544ed9d65bba288ade8d57d19824340ebecdc58633f49d192cb84b5ffd959a2af7bb289b4a639baff990cfc9f1bae1b1f567a0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1

Filesize
264KB

MD5
18ab1729bb75e80c8f216ce6f5bbf5b6

SHA1
9742f958c11332105e1d51081ca743b14810a03d

SHA256
cfae8a3d32416920b1798e0633630e3c8e9b728dc916ee5e76d8cbcab101a19f

SHA512
31ea7e2c14ec2c6196c25b6ba27708dd920cb938dae700f6e3c5e951daa1b7abea6edcc926e21a2a7289b759765ff1d4261554ba9629532f087fbc37b7d11bb9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3

Filesize
8.0MB

MD5
7655f3d84328b3c275c441fa94a676ee

SHA1
eca24a128593b168d0a594b1b40ee217b0941cfd

SHA256
bd09b743e423d67dc28886f68f58e866000481b361f2a43440f05566c9666859

SHA512
030e8919a4baff78eea778fea3d7781999524569540a3cd26ada51c16d5e8bb01521451ef864a7e4e11031d50883dba8913f5d9ffe7a7afe3269296cb8c2f49c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000070

Filesize
19KB

MD5
5e5ae2374ea57ea153558afd1c2c1372

SHA1
c1bef73c5b67c8866a607e3b8912ffa532d85ccc

SHA256
1ef458d087e95119808d5e5fecbc9604d7805ea4da98170e2c995e967da308f3

SHA512
46059e4a334e0a5295ebcef8401eb94b8fa0971b200f0f9e788ed61edae5018c917efd30b01631cbd6bdadc5240c9fcad2966ea0aa9c94b538bcc369e10bbbaf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
8901a5e06793d1ab3ac144767d53b013

SHA1
1f2a96ea3713e081f7a32e11434b4d2bd568a9e5

SHA256
fffa2ed50e328fd43d2544ce6436fba166659dd1fc4c429b554c1acfcd2f2c92

SHA512
af13f1b06ca7eaee5c5b81ee88f8de6050ca96a7f6843b5ae897e98c5600244e99913fdaf52bb67b78385a0fd3764a4278c56b5ab23979795edfe240434ccdf4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\e57478ea-67fd-4a07-9168-dc6a0033cae4.tmp

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG

Filesize
343B

MD5
cb021ecfbafeb12032d984cc07cf9c8f

SHA1
e4bc53ffdf8f8530f00e2a8cece14952dae943a0

SHA256
ab1ee27844cacff26a12eac70f50e34ec8b461cf60536607d8fab69e1b80e70c

SHA512
a5ab50a4d9df68e54eb464b4e22c884a5e7403f75fa15b8147eebc4240870f54febec2f9434ab2a4ac0e34bea803abf0b93fb5a0c886014bb5820d5ed283a17e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db

Filesize
32KB

MD5
592dd583a14efbfc015f673fe8f8bb60

SHA1
134b1a98f5a2cec15132702ecec751ad314c17bd

SHA256
df553610c19ebeb344d042bb75c11051eca6cef3359f7d6e9dade9b48a085060

SHA512
15bbac922a093b78b795a5c8cfa984603d0adadab1c5da72c81a4e18c98c8dfbafcc9b7351868873804e11be9c0fb8ad49a8cac147712a0d983bbadeb249c780

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

Filesize
322B

MD5
cb3e586a8f1490bb7f2f97fe92ab7e75

SHA1
c44c83631d8d4b5e50760265b52777ad1c3ebc3e

SHA256
595f7e9ed393c43c17223a2c3dfe3c7cc125b2cf79109565576c15c1e4b729c5

SHA512
cc279c7db3f55a0becb37c8de5587f9c1539829b3293ad4f8ab58f6d0d00eeff90f4591d27cd17f7a7c2ec66e937edb633a99719bd02fe5a7219a31887deb393

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History

Filesize
192KB

MD5
3ca4cbb5a14cd25bf31cb50494058073

SHA1
9ac13fbbe0878d36f86242f67839da18dc456a4d

SHA256
e0517ac2dca3ddc39ef8867539227659e96654ceefb1aa73fde89d9cd750b527

SHA512
1c09d56b5215d6d2ae6d8608f211ded7b71d30b4376310e9ec382fa693bfcaee6ad0c61c6210e51eb263ed62166af4390c98dc2a96f72ed0f695515b7bd48597

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps

Filesize
107KB

MD5
40e2018187b61af5be8caf035fb72882

SHA1
72a0b7bcb454b6b727bf90da35879b3e9a70621e

SHA256
b3efd9d75856016510dd0bdb5e22359925cee7f2056b3cde6411c55ae8ae8ee5

SHA512
a21b8f3f7d646909d6aed605ad5823269f52fda1255aa9bb4d4643e165a7b11935572bf9e0a6a324874f99c20a6f3b6d1e457c7ccd30adcac83c15febc063d12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Filesize
334B

MD5
4c0ef0d4e58a5cd5b5eb9959290d4266

SHA1
bd9108383200321faa34a138f6a4d65649a9d70b

SHA256
020f37ef3d22723bfdbaff47f78030d5db4f887be41960a5fc94d48d5296d244

SHA512
6dcd01682d260a60735dd75ca73f3dd617cfb13e7fcce81aa5544d0edd9211527da973e0e4e91cd309e1f6fed02feb945e34cdba13c68c352bbb1ace5b0232fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
5a9be99799c662eaeffafbca5de42f08

SHA1
35bfee78937ebcf1dc61907f7b91e5e326ab2e3d

SHA256
eb71a07db6d1adb359505f7ba7b36f9fd9edf1ec726b7d06b727c828135f85c6

SHA512
b19b79a3d12e6e88ebf8d455c4329e62588dfa5b3d63e32773f97f314ff38a2db878dbc5337f11c0bafd8bb6545a686acb309342baca5aa4cc70da25a0d84fa3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
40B

MD5
20d4b8fa017a12a108c87f540836e250

SHA1
1ac617fac131262b6d3ce1f52f5907e31d5f6f00

SHA256
6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

SHA512
507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
16KB

MD5
0eb906ad788f0b7423435d41588a424e

SHA1
2415ae664c57a09e1fd5bffd1d862a83dc4b3deb

SHA256
312d01acdf941f4b000dadddc6d4b3b10719e2c55e401cc9f4ff43921cb25ddd

SHA512
3470163c0099dec42945c3a37b3430d54902c8ef8094b4c94bcd7b4c4cb3b242ecf4593fa4d8a296aaa0ac33c79ae2dd47f57f1716f2d64c706a5da59745291c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
36KB

MD5
5ea348687e931385e3f2a42225a7b323

SHA1
00d8c6de5bea9fee2419d9aa7fdf96edb9b833e8

SHA256
2217a7b7e9a8377d49a8cb6165b61f250f5a19468a27fcddcb0910de89888cb5

SHA512
41303f9fa653b6141c74d440b4b5d5de6db5c91dca0e9bb2cff2449a298ecd74e7607aa3dd2e96b5ad807ff36b67ea9bb38695397c2a011d5ed855749b8454a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG

Filesize
335B

MD5
d2fdce55cb7455ecc4414aa0cb87a66d

SHA1
7e852aea70477132fed5314b8658060388924a62

SHA256
640a26e5aa81e95f9e6ce1f94a96c95ce98db0627bf2655d573c83e0726cf73f

SHA512
f5f874b1df225418e8e0558cddf42fdfb312ee7605a4f186b6050b1ccd9bbd23a33da90debd579896d0d0840ae516e18177c84d52ef16be3b6c0f5e1c8754df7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Filesize
350B

MD5
91bb4e97d2980446180adf04299a9070

SHA1
50a0115d9bce9645c21a8ffe94f8f80ac52f30da

SHA256
251b175da88ffddd06f086745b0b0796a2705eab1f93d1d720aa90c610b5a65f

SHA512
f224606cf9f78fd22667e43a3878f53c0adf0d49ad88513e8818e3561288df5eca2efba283f4b9f8e36a5a3a113bbaa0aa77b7d3d7e641a2b6f71e2947b1a161

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Filesize
326B

MD5
4c2b54afb8caa56cf0029e91ec6a7f8b

SHA1
a818a45a27a592b1f421b204ac017cdae7c76d97

SHA256
9177ff133a03a4cf02bbcf07fa1e495ec37e309a0a216bcec1d4592ee3656778

SHA512
3ce3836cd109793e17d8dbdd7bdb03e6f829d5ed6b03ffa112adf6e25ba2f3d6550c5e56b05cc42e741f25f75fef4bd6c11380e70322748348affa33abe55eeb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

Filesize
25KB

MD5
f448f2a88d0f5c1224c73ff21e9cba59

SHA1
1e488711e5221a2184d01786d0c2e582839ec7e5

SHA256
8d34d4de7ea00a7611e416f42f59c1b7eff38666b03de817cbded5c582f25bbb

SHA512
d25c293ea77ca9452ac9582e12c9abc92e49655929ff6ba89c49af5321aa567d3591c155cbed54a7cf3459d5942cefeee99b699b0df97e605ff3a29f0296bf06

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

Filesize
22KB

MD5
c3b4372004245797237007616f2a0656

SHA1
36e42ed7b514c332e2a16d641aea1336385b9164

SHA256
f45e1180127b088e9458bf999177932b1e0c4610a105c1a19d25eff2418e7e90

SHA512
b845af03d9362af3b3798e7eaf01feeda177943ac0c36ea1fd75b76dc639f3361913ce894cf20fad95f1ff0c2d2a9bce4154091afdfd59832af50ffc86cced73

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Visited Links

Filesize
128KB

MD5
a145cc614bf5ee0119393fda4db5ce5a

SHA1
18cc592ec6112045a9bcfbca394e6995f982ec1a

SHA256
02c85a16ff1b5ebec4f4c6cde0017b72f40a3c4244a88001c882b891dd079067

SHA512
16424795d5e094cc36de1329ad42a8155523fe1c748925cbce75c2cfaaab2b9e8628456e372c96f32eacc194c213a8280c40f8a481a9143c2d64342b973f4d2d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Filesize
228KB

MD5
da36c846726e41f2df805ac468f8907e

SHA1
3baf2c2ed3a6624b06a6c998936bf0314aad81d7

SHA256
59d4d11754edb4412b5b42c014f4f0c61ca60e1534b5eca75f56824590924ed5

SHA512
83f68b881a08c99584811f705e6d03a02650525f9b1cf6d83ccbcb15317816f9204f7696221af2451a7781fb5dec2808f556ff9314bc126871a8bce7e9449710

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\default_cloud_config.json

Filesize
12KB

MD5
18261eb12378081f939fb9415ca0c9e1

SHA1
20d4ff782e17fe45e71c3f9fc60a94655f72ec7c

SHA256
12bbeec9a0af9e3ed945b28b9b8ef89b2f897768d1ba3ffd6f3fbb42fa5bc556

SHA512
fef634b4ce77c2f36ce1bdd63e8ac28e76cd089f0bff33f4425c757ddf37fe9fab30dea7b5bb51c91eb27012cf78800e03643e13d51a25bf624ce58ab3488a80

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\favorites_diagnostic.log

Filesize
2KB

MD5
111d3e6eb8c98a1df28f1452df99ac73

SHA1
d29d1540cc86111430dfaf83b93d19e27385be0f

SHA256
f68f7d1ea62517fa467c62ca4dc32b51cdb55abe5e44f0cb21631a2caf8efa61

SHA512
e9fa369c851082c1f23696c82a3fc2b368afd08436aa7754729c36931d0b3cbd126e29779104ae6bff859ebf2087952f0bf6fe1c19ab18e4c38caeba86322641

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

Filesize
10KB

MD5
458517a647d8ad4cd047dd2b22e829c3

SHA1
9072a9d8571f351e82ca18b61b72320565159aa8

SHA256
f318bf056884cab011461126b762350fd6801f815863d00c3f0b4d03ea4c320f

SHA512
b1630c512c55fd78317e961884d9fd6689f7403aee693cd973edda6a49010ecf37d870767c2fed05b6e86e58a8660e165b595bfb1accfd1b9d64f4fedf4f0a0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Filesize
322B

MD5
085d8e1a3feedd685bf07b07e67412c7

SHA1
02336c1063b2d9f0eabd3c4f5395c75aeafe4529

SHA256
4e3bdfc4df0ae20de12c04cbc0d6108cdd4236ab602031c3d48b297de25a3f67

SHA512
85761a88d200af447a6ec43b20dea34348505e6899a041a1e90ee4e35b93eff3a8a81505dfe255b68d3eb58b6cb735c0878a722a222181156164c1a28154256c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Filesize
1KB

MD5
9749f27415de5db9e1ec315639fc5f4e

SHA1
724d85aed564dece1b9ab1973163cf8866b6787b

SHA256
9deaa492aa4bedc1d563e9d77f45271998d6f76cad1df30d71f2eec08fd7a119

SHA512
c239b1308d97be62ce4a68e3faabe805ce7d88b3f6f8a85ec6a35c99e43008867e4aa160af22731178d5dc04a9ff7317f533d825ca27d72353b53ead89228624

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Filesize
340B

MD5
a4e38f6dfc929413cdd24ee9ac3e30e0

SHA1
2d2b5dbbc6e0a4067781ddcef38b2541f8bb26e4

SHA256
c8f1c99b8b9d520374a6c29454365589d22f98a84a58d10ac2b41fb23b6aafd6

SHA512
32eb17b128c4ba7eed2cb70bdeac88820f901560cf2d803df15bc56a2c2cc4f9e73a4dc9550af47f3c1ba1fbd0e2109e0eb92ca9565f2039c5ff435d1f91613c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_0

Filesize
44KB

MD5
d05606dbdf4394cf88abef9f145e1bc0

SHA1
e123588ee9e264bfa9c4ae320dee32f96adc82b7

SHA256
9cd68cc50aee416968814072f25c0307e9d483cf78ab16a4cd194fe5e9b6a0cd

SHA512
ee7e5f6b9c3357c0a95db4a150af4e625e37a323b3b5f4a42ed85441b208c5471dc6a2e21ee2ad0d476afd907a76ec99847abda30834a47d5d06f9127d345191

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_1

Filesize
264KB

MD5
b678e07b6dac23febfe9dc51d56d23e7

SHA1
6904eaf4a80208013553c7ccc3ea8076b4815693

SHA256
12573e6e52b937185532432493fb8701d79eb1218a6f2a806e7eae1e8484554a

SHA512
ce98d31b52a0fec7e9f0d73864dd1c9b893265dc3be04536769d497ef80b05788c77c6288e4e6c37bc2ab66e17e71d54985be8e98a65d5177ff848febd3349ab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_3

Filesize
4.0MB

MD5
78aa885643d09ca584a4562ec34806ca

SHA1
a8ab042b3bd4b1830ea4ab39f0f1e96bd25e1221

SHA256
0a24b0e6fe035c47d83b3c96574683d5a4080cf4fef205bacd05ba882dd10f70

SHA512
1d34ecab62acc92532b7c092f897b516a7e1da45ed014e1ed38ad7e48ee1e6a3962697416678c3250842f3917bf077522e55a03790b44220f1a83accf185f97a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1

Filesize
264KB

MD5
00b5fe5f296a2834ca4e34e2d114dbcf

SHA1
2f4c9a439a6c7e71f12f24c1d7b723241489cf29

SHA256
5ac49f60cff1fb2a7219e36d355754144d263bf586a9fdf77ceea5d3dfc4979b

SHA512
f534874e95d3a27223c5e31978a827a66a2c07bf94b77488033d9dfcc249d85aff0799e8cb170584202b1071663434ebbacd4c2625f041c18419d9e893503793

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Browser

Filesize
120B

MD5
a397e5983d4a1619e36143b4d804b870

SHA1
aa135a8cc2469cfd1ef2d7955f027d95be5dfbd4

SHA256
9c70f766d3b84fc2bb298efa37cc9191f28bec336329cc11468cfadbc3b137f4

SHA512
4159ea654152d2810c95648694dd71957c84ea825fcca87b36f7e3282a72b30ef741805c610c5fa847ca186e34bde9c289aaa7b6931c5b257f1d11255cd2a816

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version

Filesize
13B

MD5
3e45022839c8def44fd96e24f29a9f4b

SHA1
c798352b5a0860f8edfd5c1589cf6e5842c5c226

SHA256
01a3e5d854762d8fdd01b235ce536fde31bf9a6be0596c295e3cea9aaf40f3dd

SHA512
2888982860091421f89f3d7444cacccb1938ef70fc084d3028d8a29021e6e1d83eaef62108eace2f0d590ed41ece0e443d8b564e9c9a860fc48d766edb1dc3d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
55KB

MD5
0a6a5679136721589ad487b792dcffa6

SHA1
eed4fd6408788591ccf78d637f7a1f99481bceb7

SHA256
47284ca49e3d927c629d1e4e3c3048b4d5b322220719ae2c8e627b79181a1c0b

SHA512
0e0352d44178f7737bb132c235c94bae1120898c7de912ef0a0cb78fab9309f23874041539c9324279b8932593e40b8118fb3c9689074fc615ba3c4af642cd8f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
41KB

MD5
6bf5abfc293e80a9b7911f1be886de83

SHA1
f30caec749aeb2e0f2c264b9fe1a930735380769

SHA256
c54a395a5820b1294a31099a29487d28ed7ae7423b1cac01500fb779b141d05f

SHA512
8164182f831d21d37f3eb5f02ff9cad7a60ea1032720ad83af213483d28968f7454111341a1e35f1b717bf171956723724dcda15da8884a4e432de9aac752280

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
55KB

MD5
a90aa7972c0822d325eac1f219d36173

SHA1
7e618270e3a635b7b86da914e8f5a88125e1d7d8

SHA256
6e4067945fe626e2b7cdfa6b0f4ac50489660e13ef979577eb8b0b0ff49ad613

SHA512
06ad7da45268646a6b539c0a4beac13ff8913e4a4ae1af8901ad0e71e6775cda08eb4b54197c56bdebfcfb10dcc18c32f0fe7e2bdf8f68aec7c1055f3e5a5f6c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1

Filesize
264KB

MD5
2c19aefd63557aa023694507a9e76a0f

SHA1
32a76f75aab7d278147830ccf668d24decbde7bb

SHA256
db0818dcba374f87af3e3f744bdd40eea48947971110a336fdba3d48ebc9404e

SHA512
9e9fef9e38fffa45b87a27ffaa474648a007e839f33f2e72f98c314d59418cd0cc97ae1f47fba49542c29ae9f12e0f588fac5805ab4f16ddc7750d0267832e8e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations

Filesize
86B

MD5
961e3604f228b0d10541ebf921500c86

SHA1
6e00570d9f78d9cfebe67d4da5efe546543949a7

SHA256
f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed

SHA512
535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\first_party_sets.db

Filesize
68KB

MD5
c485b2f56d3cd9104905a14de0e6f3ed

SHA1
011c8a86414ef18a36d5501534fd2cad5ae63011

SHA256
7f456393457a1aa02eddc37069d74a0a9e19062086a66333763c8127177c5c9c

SHA512
7347e4ccf623cc2f3bc05cfe15906e212bd2a1631dbef1cad20dcd8179b7d0184b1f6332116ee9b42f75ebfcdc36aa2dcfcb210c1a31bbcd5bd50a2c1db55498

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\first_party_sets.db-journal

Filesize
512B

MD5
91eaeff669a6b049874959f9f3b8e8a9

SHA1
f04bffa386681d9049a28f593defaa428d1379cc

SHA256
701f6555e1f2d215e51c90878d1d9f796f63414e5884ca612e889caf47bc94d7

SHA512
c2376525465061538b6348c1f500fd60cae9dac9d8a4ea1aa08bfe8d36b17e0bc77fe2b1d65247992a4d6835c6445c9a2c30c445159a90ba02c0222b89ae8861

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\OTele\_R_E_A_D___T_H_I_S___8OBG_.hta

Filesize
75KB

MD5
e8d0e4f78d6f1680dcb1e1dab2d1ad3e

SHA1
a77a341be9c7ee6124e8ce1a93f9b5dea151e6ac

SHA256
cb16a7c2404557a09badf2944fb1e1d0a74caf4d1ecc8950aa1d27a9fbd7a038

SHA512
522f7c7fce7ddbdd7719fc9867b8c4ab531c975dabb549ff59321463ef862c2380a1dc628794b5b0ee7ec93b6132abbe9595a6cf8e5ff6b4a0436bb4c2574382

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\OTele\_R_E_A_D___T_H_I_S___FUYTUG1O_.txt

Filesize
1KB

MD5
0cb60cacafa4963fb18e543774f6a0ca

SHA1
6a6b7a1155bb167947471be809d252edd2d4b2dc

SHA256
5099d0f25cc9a2ebfa7f1fea300adc96e7a7a2cb98ee129e6f30055b96b22d89

SHA512
696e0b73831fe0a3f9c3483dd10c44685167477c5843d5d38a42541971bb5b2e5c7192186db1f349f9accb2f49bb93d80963923838530fd317ef8d0e5d24bf47

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Filesize
2KB

MD5
c8c3c819eb0b6af140454d20dd3019ea

SHA1
f8b19cdb07d39155c3678594480e32678eb7f861

SHA256
3d24614d1418545d79e1b0ed077f6fc56de65d915536d8938351d17d51bc4608

SHA512
645195d54f0d0ef4be72e4e56e09d92da863094575bc654edb877e376addb45fc48f134996261e30afe3e457cbe89bfe598a61ed24c321752ad0cb24409f3f00

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\8b0d4544beb97a69dbb9583fca5575a9aba6e37d.tbres

Filesize
2KB

MD5
136a7b8a5b82a916ff17c983d7fb3fe1

SHA1
a06d4cbfaf9b907f4d866155227b87bc1b33219e

SHA256
a20e569e2bb69759877cdfdd5bf442b8c49857b03a6a8641f19337794df63f6c

SHA512
899812bbd58a1e340ea8ac704c89698309e2a95f632144619bcac59eb22589ceac7a873cb85fe1205aea3c086418e85306ac30480336f4db1abbda6ac99e5f7c

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\50jftte4.default-release\activity-stream.discovery_stream.json

Filesize
22KB

MD5
2ad0670418c7befcfe46845842586462

SHA1
0e36315ef0eb50853bbf80edc6f2fbe565a91a59

SHA256
133f65a0a4a083a5e8f46cda7dd8911d1f803ca36cc027fbf828a4a738eb4e07

SHA512
d0e7afa7a694910cc06580ae6013331e2d1a8851baceb5e8c333dcf6fad5a6fc215ac3b3d9f5a3ce993337d9b33eb3fcd392b315801a6943c881c4884c0a5320

Download Submit
C:\Users\Admin\AppData\Local\Temp\cv_debug.log

Filesize
2KB

MD5
daab9b210cebf4bd70213149808800fd

SHA1
2b2d7ec7bf224e325ca2a837a1d8f55980c88491

SHA256
7f34ed091cdd97c6eb2d69d547eefb490e9ab2e76c01ffb3a8536fd29b862ea5

SHA512
72226b6489bcdd2aca9006275d5e145b6d17e7bac9cb39559d0cf41992ecba474ed6c81cbd3f45fb95f78da7c2e8b47761beeb1b7a25ae834b8519ec4a1f152a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\50jftte4.default-release\compatibility.ini

Filesize
198B

MD5
ce9ef13caa8a74c25157b184aa038475

SHA1
db03a9935d8bb3ce6b120aca98feade536805160

SHA256
252b7fff962848c61092e82a3d87adca163849767713a93ab533bb397f1f53bb

SHA512
0f6f5053e78167ef5cc5fa70ed3a87dd116df0671a590299277a197341bed983e3d77e37ad2c33cd4afe880fab9ed1c7f7502210040617a01f97a81c1e1d4f29

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\50jftte4.default-release\datareporting\glean\db\data.safe.tmp

Filesize
6KB

MD5
2a6e68d79dc5d2b134931280539466c1

SHA1
7882e8d978dcc7e6d636a23eb1411ae912919c34

SHA256
8bbadedfd0e7e9120bf01c36b90348af306a343181660ff8d4e810c4347287d1

SHA512
6a44b3f58a702ddd3f46b80cc7000114f53173349567606e16f0820b5701e6f2c8254016d5eb319b8dd6bb877b79f622416c341aee39ce08c142b8827c882160

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\50jftte4.default-release\datareporting\glean\db\data.safe.tmp

Filesize
6KB

MD5
fd949d401bf09fd0feec0d999b1b1729

SHA1
20452129f9fc8e3119eac1041c200f1bdb1ac87a

SHA256
340d198a2891d1d354958c65a5589a866b7ab5b46aa6c7e5e1e5a80983312871

SHA512
de3cea59eae30770353e45ef3f692215a35b18d8e6e0870060389519a0708f4a065000e7c510aba555a09e00d3d1c63e52e9b65f905fa33da3b4e346efa758e0

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\50jftte4.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
a8346b78ad06927eb9b3f0389b4bb69a

SHA1
2a4183db54c1e1ad8e9621fac5dc30459827e74c

SHA256
84623c29b8fe11cc84377c08f7bff3b8aba89cca67db233579409a23f0363302

SHA512
f94ed735d5700e2dc0081a0494202ebfc12384b90a2457af980101da466d0f1821f1ef3acd62fd580ce91dea67b2e39ae46b779aadb3468683e62aa95306fd51

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\50jftte4.default-release\datareporting\glean\db\data.safe.tmp

Filesize
31KB

MD5
6642094bd87a6840d1510c0c0d5962b3

SHA1
4686126b7e0e64e9cedd5627c4bf0435502bf268

SHA256
e7efbb6771540b75408f15c825a8c0b7892d2885ea1df3046d141a81f56cc7e0

SHA512
7363d0f7a6ddb1b894722d2e1e7270741e03bae22297c608a935ce634eb19945d5ab9e5d9910a058bf4fe38225016c1863953edd3809ad57a0fdca77324efdec

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\50jftte4.default-release\datareporting\glean\events\events

Filesize
1KB

MD5
d19c754c015628b672453d19f84bb601

SHA1
726b276da387390531417ac408525e92accca91d

SHA256
231b8755f2af4fa938dd1a64a2db144edfd3570a254afa7453bcc8dcb99525cd

SHA512
63ca590199d9e77d2319a46390f88c8a023e04cac4794b69e7be0758c34423a86c03fb218831d939ef54352a2fe5ec05c7feba35f802a848f75140311d39a345

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\50jftte4.default-release\datareporting\glean\pending_pings\129564cf-669f-4692-8ba0-57fe98c4ad16

Filesize
883B

MD5
a5099c06b8cae891163ef711ed2cb45d

SHA1
5478a35804accc642a7df1db0ebcf8e0fc7c1f7b

SHA256
cb0712660834169f61f05d0da0c376b16dc98b64974f0970650ec2fade9038aa

SHA512
8cffc4d8c5f613e95729044ef10313375bc3adb63e0aac4ec252bcde76c8c18a56904ae4338cd8769dea8c1b6c5b93f863ae0e557c5042ddacf119008f57479e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\50jftte4.default-release\datareporting\glean\pending_pings\279b431e-ded5-4fec-b758-44ecea90e10e

Filesize
2KB

MD5
4801f329834e87048a31e30fb124f9b8

SHA1
25c6409fca1bb1ee7aabc85515e2817c59118f14

SHA256
940e8ce2fd5fac88f93595094f1e27e65af4f5966eaf7f2799b87d42f41ad3c6

SHA512
fb60ac5acf391f988094a6272d25dd70083a0476ed4cc189d7c706c07cc82f9876a60d410fb6fb94bc495066b189efc17109fa69cf9a0c444d1b489dd0db4f0b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\50jftte4.default-release\datareporting\glean\pending_pings\58762106-f3a7-4178-adff-e7b06ac51567

Filesize
235B

MD5
24ef2c2f73ffceaf767812f978cd9b6f

SHA1
6099883d252cd2a04517f10e539c1825ec1302a1

SHA256
7068ef2fff1dfcf14d2b6280d114f301b6efe9397d65db2b3bf7cf8d0e2b402f

SHA512
919542072049b2b4f4c9f7f1cc78c0affa5b6995221697d5ca03262aafc3472c76bb9ef7aeaef4592427114d3ba8c451e1829cbfc4f96accd86ffa667a424920

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\50jftte4.default-release\datareporting\glean\pending_pings\65ec4fae-227a-437f-a839-572761722cc5

Filesize
235B

MD5
acd42e38bee8cd77b932a1f984872407

SHA1
a4fe76b3522ccdcc12b75bb55bf049e7d51b6df1

SHA256
85ad0d8311ec02b32d34d011f6561af3fa6aeda5256d6c702632c6829275091c

SHA512
bb7c38a5d011188877a0552e4b86f290e2160d6ead384ac9434c5832e02f462ac0567084c38b4be547f028a8c592d3b3f475dd453a94565c7f00edc4d4372791

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\50jftte4.default-release\datareporting\glean\pending_pings\859b886c-52dc-4949-8706-3df7b1dfda65

Filesize
886B

MD5
6f8c9ad43084f2cf658e5d635d53da6e

SHA1
cd12fec3966168685af60f1d36d88b67b602e634

SHA256
f3fb13decb87251cc720e7b03ce0f3287077d632199af6e1b85239734cb26d12

SHA512
db05e2f98951912b0cfeb046922da9bd15786959ac1c21cbfd6ce08491c80386296944797133f566d3df201488f8223c10ea3042c9f64e7b53a1d1dbe729f171

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\50jftte4.default-release\datareporting\glean\pending_pings\aa39e3c4-5c9d-433b-b98b-56ac42aa2f3a

Filesize
16KB

MD5
2ecbacda2d017a1ee6c0b14d39730599

SHA1
ab8144b2e33146be9ea118be38d9c8aef12f9d83

SHA256
79882a21ed9d7775b39c26f439f5c4a3ae14f48c980fc3a295854635995d37c4

SHA512
9bdcdc8bb33462bc88b5ba9ee1a987bb46f573bd3b6c0c430fe58417aa83de6433f3ba256fe41b155cc0887a3e07ca03ca40d4bc02143bb96756924c383f4713

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\50jftte4.default-release\prefs-1.js

Filesize
6KB

MD5
767b64f780003ff9b40f68a85cea8959

SHA1
3ef83b00b3ee147c8fbc580f19ff8ef05808e3c8

SHA256
2f66b15f027b391e6a68b4497ce0927c13750e90684b0fc5b688d13174064e8a

SHA512
ad0746716422ea3a9fd71ffcafdd59eb8070175d5959d63811bbbcf21b4fd127987a55dbd1505e691d04dbf2da08a53af983a72bbff8e8d734093bd06b6c967e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\50jftte4.default-release\prefs.js

Filesize
6KB

MD5
bc8203d85b84af80b60ee5fc05eb28aa

SHA1
6e2b2da9ae30a8c2e5ca5e8eab629f4109bf0944

SHA256
5901aa102b1ea9c6a84cf2def2b8a4cb60fb12635172a2d3151fe37f29d5ace2

SHA512
5285e798b92259b64025b0943a1fa0a50e7f162a7dde8ff8cbb1ab65d4a927017d79a403df277179c69b2ac9fe00ed275a7666875ae613db907a2a68cbe1a589

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\50jftte4.default-release\prefs.js

Filesize
6KB

MD5
b9de4bf302acaf6affc1e6537d69b262

SHA1
e87b9f2b5b87d4b51dc34a06b73e47a017a7921b

SHA256
03ae3c3428f5f62de23b5b90fa17aa21c217e43ea8cb2118fcd6020f104c51ac

SHA512
6c3f01b850c2dd64d58024e5b445b091ea3e028c25839183afa998673f60f71c2a4db1f5309d3e34d2a6e52e2daebbbf134ffaa887783065558cd71c24dd2f87

Download Submit
memory/1992-417-0x000001FBCD6A0000-0x000001FBCD6A1000-memory.dmp

Filesize
4KB

Download
memory/1992-424-0x000001FBCD6A0000-0x000001FBCD6A1000-memory.dmp

Filesize
4KB

Download
memory/1992-422-0x000001FBCD6A0000-0x000001FBCD6A1000-memory.dmp

Filesize
4KB

Download
memory/1992-416-0x000001FBCD6A0000-0x000001FBCD6A1000-memory.dmp

Filesize
4KB

Download
memory/1992-418-0x000001FBCD6A0000-0x000001FBCD6A1000-memory.dmp

Filesize
4KB

Download
memory/1992-426-0x000001FBCD6A0000-0x000001FBCD6A1000-memory.dmp

Filesize
4KB

Download
memory/1992-428-0x000001FBCD6A0000-0x000001FBCD6A1000-memory.dmp

Filesize
4KB

Download
memory/1992-425-0x000001FBCD6A0000-0x000001FBCD6A1000-memory.dmp

Filesize
4KB

Download
memory/1992-423-0x000001FBCD6A0000-0x000001FBCD6A1000-memory.dmp

Filesize
4KB

Download
memory/1992-427-0x000001FBCD6A0000-0x000001FBCD6A1000-memory.dmp

Filesize
4KB

Download
memory/2884-400-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2884-442-0x0000000000440000-0x0000000000451000-memory.dmp

Filesize
68KB

Download
memory/2884-441-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2884-2-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2884-1-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2884-4-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2884-7-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2884-0-0x0000000002260000-0x0000000002291000-memory.dmp

Filesize
196KB

Download
memory/2884-407-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download