cerber | 301d2453a8ed8669c59a099b7feda36c4e00180bc101ea9c694d4e7ad57590b6

Analysis

user interaction
yes
max time kernel
420s
max time network
421s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
31/08/2026, 12:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
sample.html
Size 295KB
Sample260831-phpgha1fph
SHA256 301d2453a8ed8669c59a099b7feda36c4e00180bc101ea9c694d4e7ad57590b6
MD5 1ac3d69c628d84283778b3d9c9a704a6
SHA1 59576d9428842f7cd2866cecf33792ac22b8ab15
SHA512 843f43dc9ae2abd3744113ad39bb701507a7f5ba2184cb5519404fc8a98b91ac454a379bee24c81877e0f12e63564442e16a09b567089c38fda6e98a193083e2
SSDEEP 3072:it3A2zqx3AAI7mJSYrl3/7Fg3Vmb/Mr6TIbWXdhy52T7XA:it3A2zqdzI7mJn/7FKmbRTIm7T7w
TLSH
T17D546B72A200B13BA523DEA0A6BF7F4E3C35E12BDC1646F86591E530CFE2EB1051665D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution cerber persistence privilege_escalation ransomware

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Roaming\Microsoft\OneNote\16.0\_R_E_A_D___T_H_I_S___NWP0ND_.txt

cerber

Ransom Note

Hi, I'am CRBR ENCRYPTOR ;) ----- ALL YOUR DOCUMENTS, PH0T0S, DATABASES AND OTHER IMPORTANT FILES HAVE BEEN ENCRYPTED! ----- The only one way to decrypt your files is to receive the private key and decryption program. To receive the private key and decryption program go to any decrypted folder, inside there is the special file (*_R_E_A_D___T_H_I_S_*) with complete instructions how to decrypt your files. If you cannot find any (*_R_E_A_D___T_H_I_S_*) file at your PC, follow the instructions below: ----- 1. Download "Tor Browser" from https://www.torproject.org/ and install it. 2. In the "Tor Browser" open your personal page here: http://xpcx6erilkjced3j.onion/8BF0-C957-9E02-0098-B178 Note! This page is available via "Tor Browser" only. ----- Also you can use temporary addresses on your personal page without using "Tor Browser". ----- 1. http://xpcx6erilkjced3j.1n5mod.top/8BF0-C957-9E02-0098-B178 2. http://xpcx6erilkjced3j.19kdeh.top/8BF0-C957-9E02-0098-B178 3. http://xpcx6erilkjced3j.1mpsnr.top/8BF0-C957-9E02-0098-B178 4. http://xpcx6erilkjced3j.18ey8e.top/8BF0-C957-9E02-0098-B178 5. http://xpcx6erilkjced3j.17gcun.top/8BF0-C957-9E02-0098-B178 ----- Note! These are temporary addresses! They will be available for a limited amount of time! -----

URLs

http://xpcx6erilkjced3j.onion/8BF0-C957-9E02-0098-B178
http://xpcx6erilkjced3j.1n5mod.top/8BF0-C957-9E02-0098-B178
http://xpcx6erilkjced3j.19kdeh.top/8BF0-C957-9E02-0098-B178
http://xpcx6erilkjced3j.1mpsnr.top/8BF0-C957-9E02-0098-B178
http://xpcx6erilkjced3j.18ey8e.top/8BF0-C957-9E02-0098-B178
http://xpcx6erilkjced3j.17gcun.top/8BF0-C957-9E02-0098-B178

Signatures

Family: Cerber
Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.
ransomware cerber

Badlisted process makes network request 4 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2465	4496	mshta.exe
2468	4496	mshta.exe
2469	4496	mshta.exe
2471	4496	mshta.exe

Contacts a large (1149) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Modifies Windows Firewall 2 TTPs 2 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
920	netsh.exe
5008	netsh.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\International\Geo\Nation	Cerber5.exe

Creates a file in the Startup directory 1 TTPs 1 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File opened for modification	\??\c:\users\admin\appdata\roaming\microsoft\word\startup\	Cerber5.exe

Executes dropped EXE 5 IoCs

pid	Process
5956	WinNuke.98.exe
536	Mabezat.exe
6008	Cerber5.exe
3788	Cerber5.exe
5720	Cerber5.exe

Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
172	raw.githubusercontent.com
173	raw.githubusercontent.com
174	raw.githubusercontent.com
271	camo.githubusercontent.com

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\i:	Cerber5.exe
File opened (read-only)	\??\j:	Cerber5.exe
File opened (read-only)	\??\o:	Cerber5.exe
File opened (read-only)	\??\b:	Cerber5.exe
File opened (read-only)	\??\z:	Cerber5.exe
File opened (read-only)	\??\k:	Cerber5.exe
File opened (read-only)	\??\k:	Cerber5.exe
File opened (read-only)	\??\v:	Cerber5.exe
File opened (read-only)	\??\i:	Cerber5.exe
File opened (read-only)	\??\o:	Cerber5.exe
File opened (read-only)	\??\x:	Cerber5.exe
File opened (read-only)	\??\e:	Cerber5.exe
File opened (read-only)	\??\n:	Cerber5.exe
File opened (read-only)	\??\x:	Cerber5.exe
File opened (read-only)	\??\z:	Cerber5.exe
File opened (read-only)	\??\e:	Cerber5.exe
File opened (read-only)	\??\h:	Cerber5.exe
File opened (read-only)	\??\s:	Cerber5.exe
File opened (read-only)	\??\s:	Cerber5.exe
File opened (read-only)	\??\z:	Cerber5.exe
File opened (read-only)	\??\a:	Cerber5.exe
File opened (read-only)	\??\g:	Cerber5.exe
File opened (read-only)	\??\j:	Cerber5.exe
File opened (read-only)	\??\p:	Cerber5.exe
File opened (read-only)	\??\w:	Cerber5.exe
File opened (read-only)	\??\t:	Cerber5.exe
File opened (read-only)	\??\q:	Cerber5.exe
File opened (read-only)	\??\y:	Cerber5.exe
File opened (read-only)	\??\v:	Cerber5.exe
File opened (read-only)	\??\r:	Cerber5.exe
File opened (read-only)	\??\m:	Cerber5.exe
File opened (read-only)	\??\v:	Cerber5.exe
File opened (read-only)	\??\a:	Cerber5.exe
File opened (read-only)	\??\l:	Cerber5.exe
File opened (read-only)	\??\y:	Cerber5.exe
File opened (read-only)	\??\h:	Cerber5.exe
File opened (read-only)	\??\m:	Cerber5.exe
File opened (read-only)	\??\y:	Cerber5.exe
File opened (read-only)	\??\r:	Cerber5.exe
File opened (read-only)	\??\u:	Cerber5.exe
File opened (read-only)	\??\m:	Cerber5.exe
File opened (read-only)	\??\w:	Cerber5.exe
File opened (read-only)	\??\n:	Cerber5.exe
File opened (read-only)	\??\u:	Cerber5.exe
File opened (read-only)	\??\l:	Cerber5.exe
File opened (read-only)	\??\s:	Cerber5.exe
File opened (read-only)	\??\e:	Cerber5.exe
File opened (read-only)	\??\h:	Cerber5.exe
File opened (read-only)	\??\w:	Cerber5.exe
File opened (read-only)	\??\b:	Cerber5.exe
File opened (read-only)	\??\r:	Cerber5.exe
File opened (read-only)	\??\t:	Cerber5.exe
File opened (read-only)	\??\u:	Cerber5.exe
File opened (read-only)	\??\k:	Cerber5.exe
File opened (read-only)	\??\g:	Cerber5.exe
File opened (read-only)	\??\o:	Cerber5.exe
File opened (read-only)	\??\q:	Cerber5.exe
File opened (read-only)	\??\b:	Cerber5.exe
File opened (read-only)	\??\i:	Cerber5.exe
File opened (read-only)	\??\q:	Cerber5.exe
File opened (read-only)	\??\a:	Cerber5.exe
File opened (read-only)	\??\l:	Cerber5.exe
File opened (read-only)	\??\p:	Cerber5.exe
File opened (read-only)	\??\t:	Cerber5.exe

Drops file in System32 directory 38 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\word	Cerber5.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\excel	Cerber5.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\onenote	Cerber5.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\steam	Cerber5.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\word	Cerber5.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\excel	Cerber5.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\excel	Cerber5.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\onenote	Cerber5.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\outlook	Cerber5.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\onenote	Cerber5.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\steam	Cerber5.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\the bat!	Cerber5.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\desktop	Cerber5.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\bitcoin	Cerber5.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\excel	Cerber5.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\microsoft sql server	Cerber5.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\powerpoint	Cerber5.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\office	Cerber5.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\outlook	Cerber5.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\powerpoint	Cerber5.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\outlook	Cerber5.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\thunderbird	Cerber5.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\word	Cerber5.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\office	Cerber5.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\the bat!	Cerber5.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\microsoft sql server	Cerber5.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\office	Cerber5.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\onenote	Cerber5.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\word	Cerber5.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\documents	Cerber5.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft sql server	Cerber5.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\powerpoint	Cerber5.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\outlook	Cerber5.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\powerpoint	Cerber5.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\thunderbird	Cerber5.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\bitcoin	Cerber5.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft sql server	Cerber5.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\office	Cerber5.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tmpDCE.bmp"	Cerber5.exe

Drops file in Program Files directory 20 IoCs

description	ioc	Process
File opened for modification	\??\c:\program files (x86)\bitcoin	Cerber5.exe
File opened for modification	\??\c:\program files (x86)\microsoft\office	Cerber5.exe
File opened for modification	\??\c:\program files (x86)\microsoft\onenote	Cerber5.exe
File opened for modification	\??\c:\program files (x86)\microsoft\powerpoint	Cerber5.exe
File opened for modification	\??\c:\program files (x86)\powerpoint	Cerber5.exe
File opened for modification	\??\c:\program files (x86)\	Cerber5.exe
File opened for modification	\??\c:\program files (x86)\microsoft\outlook	Cerber5.exe
File opened for modification	\??\c:\program files (x86)\microsoft\word	Cerber5.exe
File opened for modification	\??\c:\program files (x86)\office	Cerber5.exe
File opened for modification	\??\c:\program files (x86)\onenote	Cerber5.exe
File opened for modification	\??\c:\program files (x86)\outlook	Cerber5.exe
File opened for modification	\??\c:\program files (x86)\steam	Cerber5.exe
File opened for modification	\??\c:\program files (x86)\thunderbird	Cerber5.exe
File opened for modification	\??\c:\program files (x86)\microsoft\excel	Cerber5.exe
File opened for modification	\??\c:\program files (x86)\microsoft\microsoft sql server	Cerber5.exe
File opened for modification	\??\c:\program files (x86)\the bat!	Cerber5.exe
File opened for modification	\??\c:\program files (x86)\word	Cerber5.exe
File opened for modification	\??\c:\program files\	Cerber5.exe
File opened for modification	\??\c:\program files (x86)\excel	Cerber5.exe
File opened for modification	\??\c:\program files (x86)\microsoft sql server	Cerber5.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\	Cerber5.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\word	Cerber5.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\steam	Cerber5.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\bitcoin	Cerber5.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\word	Cerber5.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\the bat!	Cerber5.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\documents	Cerber5.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\bitcoin	Cerber5.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\excel	Cerber5.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\powerpoint	Cerber5.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\onenote	Cerber5.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\outlook	Cerber5.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\steam	Cerber5.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\word	Cerber5.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\desktop	Cerber5.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\bitcoin	Cerber5.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\bitcoin	Cerber5.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\excel	Cerber5.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft sql server	Cerber5.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\outlook	Cerber5.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\powerpoint	Cerber5.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\word	Cerber5.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\office	Cerber5.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\excel	Cerber5.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\onenote	Cerber5.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\steam	Cerber5.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\thunderbird	Cerber5.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\thunderbird	Cerber5.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\excel	Cerber5.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\onenote	Cerber5.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\outlook	Cerber5.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\powerpoint	Cerber5.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\the bat!	Cerber5.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\excel	Cerber5.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\office	Cerber5.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\office	Cerber5.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\onenote	Cerber5.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\onenote	Cerber5.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\powerpoint	Cerber5.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\word	Cerber5.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft sql server	Cerber5.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\office	Cerber5.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\outlook	Cerber5.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\the bat!	Cerber5.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\thunderbird	Cerber5.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\desktop	Cerber5.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft sql server	Cerber5.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft sql server	Cerber5.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\office	Cerber5.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\powerpoint	Cerber5.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\office	Cerber5.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\onenote	Cerber5.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\powerpoint	Cerber5.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\word	Cerber5.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\excel	Cerber5.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\microsoft sql server	Cerber5.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\office	Cerber5.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\outlook	Cerber5.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\thunderbird	Cerber5.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\microsoft sql server	Cerber5.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\outlook	Cerber5.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\onenote	Cerber5.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\outlook	Cerber5.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\steam	Cerber5.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
6080	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cerber5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cerber5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cerber5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NOTEPAD.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WinNuke.98.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mabezat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
6080	cmd.exe
2120	PING.EXE

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1232	msedge.exe
988	chrome.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
2084	taskkill.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134326524112988793"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 12 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings	Cerber5.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1788976790-1541110888-1636651838-1000\{06B04548-1EC5-4A5A-AC9A-0BC9606F2F8B}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1788976790-1541110888-1636651838-1000\{E1D48A6B-1FD1-4AA7-B46B-B44ABC5901FF}	chrome.exe

Opens file in notepad (likely ransom note) 2 IoCs

ransomware

pid	Process
2124	NOTEPAD.EXE
5452	NOTEPAD.EXE

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2120	PING.EXE

Suspicious behavior: EnumeratesProcesses 31 IoCs

pid	Process
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
5328	chrome.exe
5328	chrome.exe
936	taskmgr.exe
936	taskmgr.exe
936	taskmgr.exe
936	taskmgr.exe
936	taskmgr.exe
936	taskmgr.exe
936	taskmgr.exe
936	taskmgr.exe
936	taskmgr.exe
936	taskmgr.exe
936	taskmgr.exe
936	taskmgr.exe
936	taskmgr.exe
936	taskmgr.exe
936	taskmgr.exe
936	taskmgr.exe
936	taskmgr.exe
936	taskmgr.exe
936	taskmgr.exe
936	taskmgr.exe
936	taskmgr.exe
936	taskmgr.exe
936	taskmgr.exe
936	taskmgr.exe
936	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4976	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 28 IoCs

pid	Process
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3364	chrome.exe
Token: SeCreatePagefilePrivilege	3364	chrome.exe
Token: SeShutdownPrivilege	3364	chrome.exe
Token: SeCreatePagefilePrivilege	3364	chrome.exe
Token: SeShutdownPrivilege	3364	chrome.exe
Token: SeCreatePagefilePrivilege	3364	chrome.exe
Token: SeShutdownPrivilege	3364	chrome.exe
Token: SeCreatePagefilePrivilege	3364	chrome.exe
Token: SeShutdownPrivilege	3364	chrome.exe
Token: SeCreatePagefilePrivilege	3364	chrome.exe
Token: SeShutdownPrivilege	3364	chrome.exe
Token: SeCreatePagefilePrivilege	3364	chrome.exe
Token: SeShutdownPrivilege	3364	chrome.exe
Token: SeCreatePagefilePrivilege	3364	chrome.exe
Token: SeShutdownPrivilege	3364	chrome.exe
Token: SeCreatePagefilePrivilege	3364	chrome.exe
Token: SeShutdownPrivilege	3364	chrome.exe
Token: SeCreatePagefilePrivilege	3364	chrome.exe
Token: SeShutdownPrivilege	3364	chrome.exe
Token: SeCreatePagefilePrivilege	3364	chrome.exe
Token: SeShutdownPrivilege	3364	chrome.exe
Token: SeCreatePagefilePrivilege	3364	chrome.exe
Token: SeShutdownPrivilege	3364	chrome.exe
Token: SeCreatePagefilePrivilege	3364	chrome.exe
Token: SeShutdownPrivilege	3364	chrome.exe
Token: SeCreatePagefilePrivilege	3364	chrome.exe
Token: SeShutdownPrivilege	3364	chrome.exe
Token: SeCreatePagefilePrivilege	3364	chrome.exe
Token: SeShutdownPrivilege	3364	chrome.exe
Token: SeCreatePagefilePrivilege	3364	chrome.exe
Token: SeShutdownPrivilege	3364	chrome.exe
Token: SeCreatePagefilePrivilege	3364	chrome.exe
Token: SeShutdownPrivilege	3364	chrome.exe
Token: SeCreatePagefilePrivilege	3364	chrome.exe
Token: SeShutdownPrivilege	3364	chrome.exe
Token: SeCreatePagefilePrivilege	3364	chrome.exe
Token: SeShutdownPrivilege	3364	chrome.exe
Token: SeCreatePagefilePrivilege	3364	chrome.exe
Token: SeShutdownPrivilege	3364	chrome.exe
Token: SeCreatePagefilePrivilege	3364	chrome.exe
Token: SeShutdownPrivilege	3364	chrome.exe
Token: SeCreatePagefilePrivilege	3364	chrome.exe
Token: SeShutdownPrivilege	3364	chrome.exe
Token: SeCreatePagefilePrivilege	3364	chrome.exe
Token: SeShutdownPrivilege	3364	chrome.exe
Token: SeCreatePagefilePrivilege	3364	chrome.exe
Token: SeShutdownPrivilege	3364	chrome.exe
Token: SeCreatePagefilePrivilege	3364	chrome.exe
Token: SeShutdownPrivilege	3364	chrome.exe
Token: SeCreatePagefilePrivilege	3364	chrome.exe
Token: SeShutdownPrivilege	3364	chrome.exe
Token: SeCreatePagefilePrivilege	3364	chrome.exe
Token: SeShutdownPrivilege	3364	chrome.exe
Token: SeCreatePagefilePrivilege	3364	chrome.exe
Token: SeShutdownPrivilege	3364	chrome.exe
Token: SeCreatePagefilePrivilege	3364	chrome.exe
Token: SeShutdownPrivilege	3364	chrome.exe
Token: SeCreatePagefilePrivilege	3364	chrome.exe
Token: SeShutdownPrivilege	3364	chrome.exe
Token: SeCreatePagefilePrivilege	3364	chrome.exe
Token: SeShutdownPrivilege	3364	chrome.exe
Token: SeCreatePagefilePrivilege	3364	chrome.exe
Token: SeShutdownPrivilege	3364	chrome.exe
Token: SeCreatePagefilePrivilege	3364	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
4976	OpenWith.exe
2212	AcroRd32.exe
2212	AcroRd32.exe
2212	AcroRd32.exe
2212	AcroRd32.exe
3848	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5116 wrote to memory of 4864	5116	msedge.exe	84
PID 5116 wrote to memory of 1232	5116	msedge.exe	86
PID 5116 wrote to memory of 4380	5116	msedge.exe	87
PID 5116 wrote to memory of 4380	5116	msedge.exe	87
PID 5116 wrote to memory of 2148	5116	msedge.exe	88
PID 5116 wrote to memory of 2148	5116	msedge.exe	88
PID 5116 wrote to memory of 2148	5116	msedge.exe	88
PID 5116 wrote to memory of 4616	5116	msedge.exe	89
PID 5116 wrote to memory of 4616	5116	msedge.exe	89
PID 5116 wrote to memory of 4616	5116	msedge.exe	89
PID 5116 wrote to memory of 4348	5116	msedge.exe	90
PID 5116 wrote to memory of 4348	5116	msedge.exe	90
PID 5116 wrote to memory of 4348	5116	msedge.exe	90
PID 5116 wrote to memory of 2472	5116	msedge.exe	92
PID 5116 wrote to memory of 2632	5116	msedge.exe	93
PID 5116 wrote to memory of 2472	5116	msedge.exe	92
PID 5116 wrote to memory of 2472	5116	msedge.exe	92
PID 5116 wrote to memory of 2632	5116	msedge.exe	93
PID 5116 wrote to memory of 2632	5116	msedge.exe	93
PID 5116 wrote to memory of 1304	5116	msedge.exe	98
PID 5116 wrote to memory of 1104	5116	msedge.exe	97
PID 5116 wrote to memory of 1304	5116	msedge.exe	98
PID 5116 wrote to memory of 1104	5116	msedge.exe	97
PID 5116 wrote to memory of 1696	5116	msedge.exe	100
PID 5116 wrote to memory of 4464	5116	msedge.exe	101
PID 5116 wrote to memory of 4464	5116	msedge.exe	101
PID 5116 wrote to memory of 4464	5116	msedge.exe	101
PID 3364 wrote to memory of 3960	3364	chrome.exe	104
PID 3364 wrote to memory of 3864	3364	chrome.exe	105
PID 3364 wrote to memory of 3864	3364	chrome.exe	105
PID 3364 wrote to memory of 988	3364	chrome.exe	106
PID 3364 wrote to memory of 1212	3364	chrome.exe	107
PID 3364 wrote to memory of 1212	3364	chrome.exe	107
PID 3364 wrote to memory of 1960	3364	chrome.exe	108
PID 3364 wrote to memory of 1960	3364	chrome.exe	108
PID 3364 wrote to memory of 4512	3364	chrome.exe	109
PID 3364 wrote to memory of 4512	3364	chrome.exe	109
PID 3364 wrote to memory of 820	3364	chrome.exe	111
PID 3364 wrote to memory of 820	3364	chrome.exe	111
PID 3364 wrote to memory of 540	3364	chrome.exe	113
PID 3364 wrote to memory of 540	3364	chrome.exe	113
PID 3364 wrote to memory of 1028	3364	chrome.exe	114
PID 3364 wrote to memory of 1028	3364	chrome.exe	114
PID 3364 wrote to memory of 536	3364	chrome.exe	115
PID 3364 wrote to memory of 536	3364	chrome.exe	115
PID 3364 wrote to memory of 3544	3364	chrome.exe	116
PID 3364 wrote to memory of 752	3364	chrome.exe	120
PID 3364 wrote to memory of 752	3364	chrome.exe	120
PID 3364 wrote to memory of 3988	3364	chrome.exe	126
PID 3364 wrote to memory of 3988	3364	chrome.exe	126
PID 3364 wrote to memory of 4852	3364	chrome.exe	127
PID 3364 wrote to memory of 4852	3364	chrome.exe	127
PID 3364 wrote to memory of 5176	3364	chrome.exe	133
PID 3364 wrote to memory of 5184	3364	chrome.exe	134
PID 3364 wrote to memory of 5192	3364	chrome.exe	135
PID 3364 wrote to memory of 5476	3364	chrome.exe	136
PID 3364 wrote to memory of 5592	3364	chrome.exe	137
PID 3364 wrote to memory of 5592	3364	chrome.exe	137
PID 3364 wrote to memory of 5636	3364	chrome.exe	138
PID 3364 wrote to memory of 5636	3364	chrome.exe	138
PID 3364 wrote to memory of 5644	3364	chrome.exe	139
PID 3364 wrote to memory of 5644	3364	chrome.exe	139
PID 3364 wrote to memory of 5724	3364	chrome.exe	140
PID 3364 wrote to memory of 5724	3364	chrome.exe	140

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x25c,0x7ffc5d49c188,0x7ffc5d49c194,0x7ffc5d49c1a0
  2⤵
  PID:4864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1900,i,7102694212581839271,7149775228846425053,524288 --field-trial-handle=2316,i,7307847076725744973,16743913563378815138,262144 --variations-seed-version --mojo-platform-channel-handle=2344 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2268,i,2002118317597478212,8671684852174115009,524288 --field-trial-handle=2316,i,7307847076725744973,16743913563378815138,262144 --variations-seed-version --mojo-platform-channel-handle=2356 /prefetch:8
  2⤵
  PID:4380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1636,i,3932025155572111358,15652109777139099997,262144 --field-trial-handle=2316,i,7307847076725744973,16743913563378815138,262144 --variations-seed-version --mojo-platform-channel-handle=2308 /prefetch:2
  2⤵
  PID:2148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3432,i,2703639733265873450,10626619773640177382,2097152 --field-trial-handle=2316,i,7307847076725744973,16743913563378815138,262144 --variations-seed-version --mojo-platform-channel-handle=3444 /prefetch:1
  2⤵
  PID:4616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3440,i,1809100970942571903,4563429932054145301,2097152 --field-trial-handle=2316,i,7307847076725744973,16743913563378815138,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:4348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4172,i,3881919026377736168,14344932031766396426,2097152 --field-trial-handle=2316,i,7307847076725744973,16743913563378815138,262144 --variations-seed-version --mojo-platform-channel-handle=4180 /prefetch:1
  2⤵
  PID:2472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4240,i,6839751343056893251,10248544091868014038,2097152 --field-trial-handle=2316,i,7307847076725744973,16743913563378815138,262144 --variations-seed-version --mojo-platform-channel-handle=4208 /prefetch:2
  2⤵
  PID:2632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5108,i,6003656083402313702,18193799121897327600,524288 --field-trial-handle=2316,i,7307847076725744973,16743913563378815138,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:8
  2⤵
  PID:1104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5124,i,12417462320481517738,14049613394010722371,524288 --field-trial-handle=2316,i,7307847076725744973,16743913563378815138,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:8
  2⤵
  PID:1304
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5900,i,5270044633835669069,8832763514930993335,524288 --field-trial-handle=2316,i,7307847076725744973,16743913563378815138,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:8
  2⤵
  PID:4148
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5900,i,5270044633835669069,8832763514930993335,524288 --field-trial-handle=2316,i,7307847076725744973,16743913563378815138,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:8
  2⤵
  PID:1696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=4268,i,3184469093045027066,5519944552630910387,2097152 --field-trial-handle=2316,i,7307847076725744973,16743913563378815138,262144 --variations-seed-version --mojo-platform-channel-handle=4380 /prefetch:1
  2⤵
  PID:4464

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2520

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffc5c1ec728,0x7ffc5c1ec734,0x7ffc5c1ec740
  2⤵
  PID:3960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1704,i,4564942432725370085,3826189846033285422,262144 --field-trial-handle=1964,i,13473967710262773555,9206755589557719019,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1960 /prefetch:2
  2⤵
  PID:3864
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2272,i,3709261706670769673,12419781314705180709,524288 --field-trial-handle=1964,i,13473967710262773555,9206755589557719019,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2280 /prefetch:3
  2⤵
  - System Time Discovery
  PID:988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2424,i,17560925908121432011,10107069043589687654,524288 --field-trial-handle=1964,i,13473967710262773555,9206755589557719019,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2432 /prefetch:8
  2⤵
  PID:1212
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3232,i,13673724561250223222,13299181902863405246,2097152 --field-trial-handle=1964,i,13473967710262773555,9206755589557719019,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:1960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3264,i,14130430215565784636,6605343431616956525,2097152 --field-trial-handle=1964,i,13473967710262773555,9206755589557719019,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:4512
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4440,i,12942135822946883856,2550696734083814362,2097152 --field-trial-handle=1964,i,13473967710262773555,9206755589557719019,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4432 /prefetch:2
  2⤵
  PID:820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4664,i,8337136665286419536,12620327135536895301,2097152 --field-trial-handle=1964,i,13473967710262773555,9206755589557719019,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4572 /prefetch:1
  2⤵
  PID:540
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4912,i,12322016050305203079,161565265498729814,524288 --field-trial-handle=1964,i,13473967710262773555,9206755589557719019,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4920 /prefetch:8
  2⤵
  PID:1028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5024,i,14040869492396067228,8740261676219282370,524288 --field-trial-handle=1964,i,13473967710262773555,9206755589557719019,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5064 /prefetch:8
  2⤵
  PID:536
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5536,i,16301690061786571072,10696217165027843848,524288 --field-trial-handle=1964,i,13473967710262773555,9206755589557719019,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5552 /prefetch:8
  2⤵
  PID:3544
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5776,i,6388067752874542922,16401614176875086102,2097152 --field-trial-handle=1964,i,13473967710262773555,9206755589557719019,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5592 /prefetch:1
  2⤵
  PID:752
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=3476,i,16784636847593516418,4617154674311647549,2097152 --field-trial-handle=1964,i,13473967710262773555,9206755589557719019,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:3988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5896,i,2764706336361985320,872858691439153549,2097152 --field-trial-handle=1964,i,13473967710262773555,9206755589557719019,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:4852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6048,i,17651000363878178720,4393062307517352521,524288 --field-trial-handle=1964,i,13473967710262773555,9206755589557719019,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5996 /prefetch:8
  2⤵
  PID:5176
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5980,i,15206086420726901915,2640690616904792470,524288 --field-trial-handle=1964,i,13473967710262773555,9206755589557719019,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6080 /prefetch:8
  2⤵
  PID:5184
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5976,i,3518209916324093971,17357281307943372006,524288 --field-trial-handle=1964,i,13473967710262773555,9206755589557719019,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6084 /prefetch:8
  2⤵
  PID:5192
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4428,i,12537479009255495176,240594484536419669,524288 --field-trial-handle=1964,i,13473967710262773555,9206755589557719019,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4536 /prefetch:8
  2⤵
  PID:5476
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=5952,i,5200293756489419429,5354962492281038840,2097152 --field-trial-handle=1964,i,13473967710262773555,9206755589557719019,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6296 /prefetch:1
  2⤵
  PID:5592
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6496,i,937953167151854082,13711004557819253564,524288 --field-trial-handle=1964,i,13473967710262773555,9206755589557719019,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6464 /prefetch:8
  2⤵
  PID:5636
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=6444,i,8156192128170078275,11629953918793821688,2097152 --field-trial-handle=1964,i,13473967710262773555,9206755589557719019,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6624 /prefetch:1
  2⤵
  PID:5644
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6788,i,8572197253350439416,12796709776033089957,524288 --field-trial-handle=1964,i,13473967710262773555,9206755589557719019,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6740 /prefetch:8
  2⤵
  PID:5724
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=6800,i,7418954048637595572,6073314117537802331,2097152 --field-trial-handle=1964,i,13473967710262773555,9206755589557719019,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6428 /prefetch:1
  2⤵
  PID:5884
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=3336,i,13946843853277150928,499947970896192805,2097152 --field-trial-handle=1964,i,13473967710262773555,9206755589557719019,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6984 /prefetch:1
  2⤵
  PID:1548
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=5952,i,8525947335500020155,17422090582652157521,2097152 --field-trial-handle=1964,i,13473967710262773555,9206755589557719019,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6328 /prefetch:1
  2⤵
  PID:4760
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=7156,i,14649918620235040921,7340748030082799622,2097152 --field-trial-handle=1964,i,13473967710262773555,9206755589557719019,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4500 /prefetch:1
  2⤵
  PID:5360
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=6724,i,16196494942387176515,16327726416442839746,2097152 --field-trial-handle=1964,i,13473967710262773555,9206755589557719019,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6700 /prefetch:1
  2⤵
  PID:820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=6432,i,511858189717873918,7272676348059747004,2097152 --field-trial-handle=1964,i,13473967710262773555,9206755589557719019,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6420 /prefetch:1
  2⤵
  PID:5444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=3236,i,5742614795180212234,4296827205066652540,2097152 --field-trial-handle=1964,i,13473967710262773555,9206755589557719019,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6968 /prefetch:1
  2⤵
  PID:5524
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --metrics-shmem-handle=6424,i,10958584594821221235,13362600706311344159,2097152 --field-trial-handle=1964,i,13473967710262773555,9206755589557719019,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6864 /prefetch:1
  2⤵
  PID:5588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6708,i,15876054875023170336,12839467418988236007,524288 --field-trial-handle=1964,i,13473967710262773555,9206755589557719019,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6800 /prefetch:8
  2⤵
  PID:5776
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --metrics-shmem-handle=7104,i,16808755692633887395,16842680158904867784,2097152 --field-trial-handle=1964,i,13473967710262773555,9206755589557719019,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6304 /prefetch:1
  2⤵
  PID:5688
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4520,i,14426576028025629314,4674552163915105616,524288 --field-trial-handle=1964,i,13473967710262773555,9206755589557719019,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7040 /prefetch:8
  2⤵
  PID:5864
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --metrics-shmem-handle=5832,i,12125337798612677829,14932565224470319247,2097152 --field-trial-handle=1964,i,13473967710262773555,9206755589557719019,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3456 /prefetch:1
  2⤵
  PID:6056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --metrics-shmem-handle=6732,i,6333927067714372330,4140157461039372497,2097152 --field-trial-handle=1964,i,13473967710262773555,9206755589557719019,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5400 /prefetch:1
  2⤵
  PID:4012
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=6968,i,13744662390926175719,11612250103545758677,524288 --field-trial-handle=1964,i,13473967710262773555,9206755589557719019,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3488 /prefetch:8
  2⤵
  PID:3572
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=3928,i,10209612682233900692,10231942307692532228,524288 --field-trial-handle=1964,i,13473967710262773555,9206755589557719019,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3524 /prefetch:8
  2⤵
  - Modifies registry class
  PID:3448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --metrics-shmem-handle=5940,i,17040787379495373567,2614686232465899056,2097152 --field-trial-handle=1964,i,13473967710262773555,9206755589557719019,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5756 /prefetch:1
  2⤵
  PID:3372
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=3392,i,181373346642462713,3845510390411509131,262144 --field-trial-handle=1964,i,13473967710262773555,9206755589557719019,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5848 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5328
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6132,i,16893812399383280659,4822518257521762121,524288 --field-trial-handle=1964,i,13473967710262773555,9206755589557719019,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6612 /prefetch:8
  2⤵
  PID:516
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=4668,i,1994136623990141405,5573006873616468793,524288 --field-trial-handle=1964,i,13473967710262773555,9206755589557719019,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6884 /prefetch:8
  2⤵
  PID:1360
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4644,i,13663525432996773156,14370432565783359970,524288 --field-trial-handle=1964,i,13473967710262773555,9206755589557719019,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5692 /prefetch:8
  2⤵
  PID:4000
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4720,i,3524942250562358209,558360027395609161,524288 --field-trial-handle=1964,i,13473967710262773555,9206755589557719019,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2576 /prefetch:8
  2⤵
  PID:2088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --metrics-shmem-handle=3404,i,6947965969334024006,4230853937721628605,2097152 --field-trial-handle=1964,i,13473967710262773555,9206755589557719019,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4628 /prefetch:1
  2⤵
  PID:5772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=1276,i,17242402829953831064,5873649124102832937,524288 --field-trial-handle=1964,i,13473967710262773555,9206755589557719019,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5812 /prefetch:8
  2⤵
  PID:4976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --metrics-shmem-handle=7016,i,17695814897232769764,637630223173184621,2097152 --field-trial-handle=1964,i,13473967710262773555,9206755589557719019,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5884 /prefetch:1
  2⤵
  PID:2772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4424,i,4411472584711970618,7689241303050980703,524288 --field-trial-handle=1964,i,13473967710262773555,9206755589557719019,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4576 /prefetch:8
  2⤵
  PID:3108

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3744

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3548

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4456

C:\Users\Admin\Downloads\WinNuke.98.exe
"C:\Users\Admin\Downloads\WinNuke.98.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5956

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4976

C:\Users\Admin\Downloads\Mabezat.exe
"C:\Users\Admin\Downloads\Mabezat.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:536

C:\Users\Admin\Downloads\Cerber5.exe
"C:\Users\Admin\Downloads\Cerber5.exe"
1⤵
- Checks computer location settings
- Creates a file in the Startup directory
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:6008
- C:\Windows\SysWOW64\netsh.exe
  C:\Windows\system32\netsh.exe advfirewall set allprofiles state on
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:920
- C:\Windows\SysWOW64\netsh.exe
  C:\Windows\system32\netsh.exe advfirewall reset
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:5008
- C:\Windows\SysWOW64\mshta.exe
  "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\_R_E_A_D___T_H_I_S___HOIYPF13_.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
  2⤵
  - Badlisted process makes network request
  - System Location Discovery: System Language Discovery
  PID:4496
- C:\Windows\SysWOW64\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\_R_E_A_D___T_H_I_S___H4I7D0N_.txt
  2⤵
  - System Location Discovery: System Language Discovery
  - Opens file in notepad (likely ransom note)
  PID:2124
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /d /c taskkill /f /im "C" > NUL & ping -n 1 127.0.0.1 > NUL & del "C" > NUL && exit
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:6080
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im "C"
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:2084
- - C:\Windows\SysWOW64\PING.EXE
    ping -n 1 127.0.0.1
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:2120

C:\Users\Admin\Downloads\Cerber5.exe
"C:\Users\Admin\Downloads\Cerber5.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- System Location Discovery: System Language Discovery
PID:3788

C:\Users\Admin\Downloads\Cerber5.exe
"C:\Users\Admin\Downloads\Cerber5.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- System Location Discovery: System Language Discovery
PID:5720

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\_R_E_A_D___T_H_I_S___H4I7D0N_.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:5452

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
PID:5416
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffc5c1ec728,0x7ffc5c1ec734,0x7ffc5c1ec740
  2⤵
  PID:5488

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"
1⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
PID:2212

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
PID:936

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3848

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Network Service Discovery

T1046

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 a9bc91a3244e7d72467b656c5486d15c0ed9f92add88f691c3853e2b856cbd81
MD5 b1e1deec2c4182d0013a230b355f4c7d
SHA1 126437183b8f548051a3f561eea1eb0ee68fc9cc
SHA512 e718639402727b342725497f1be1fb31c240520b2883d9791df2e05dd851d0e309e06e9942c2a24d6090668922ba1d9f9a1ebf9b87311e7d55ee2d605549ce06
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 25317ac66516dddd49dd14ddaa8d7b65927247e8328b79228e1af3c3044fa9dd
MD5 6489b920b03be62e3e2714b1120fa51b
SHA1 01db433993c83ca4a9b0e985a1ad91aef0d8c005
SHA512 a6483b52ba7c487e7ac31dcd2bca37261977eae32d47d3aa843b9118e4b612fe8b7e6d1cb6ff87d1fd5227be5cb2ce215bda76bee9adbe3b28c287d996765605
TLSH
T15CE02B65CE63AC3B18FC1718A4654706E65113572680984F373E800C4FB473A4596C5C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000006

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000006
Size 72KB
SHA256 3ca847c98e57cbac8e40711634967a7758b8e960064a3c76fc8fa76232b7a2fc
MD5 715bf19e847184c24024af361eb46b42
SHA1 9972a63f74cfc45c93be3fa4203b495c8cae7ee2
SHA512 0bbc27b5c5d5640c44ff2a2908bd4e744e1fdb4a5272c410f8177bee6eb3e32fc5352b5ae3d731f508a6343b9d880ffa4d904731dc48f066bae5e70af9e670ad
SSDEEP 1536:4ZE7sIlGJwlz/wGfsh2hjDWhTq+FYc/ACxkCytKapQIdIFH:WElDlDwAsh2h/DTwA62/2Idc
TLSH
T1BD730281DAD6A5243DCAB4B2621797B3A04F6E327D1CD93F8237112E83614358B79B3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000009

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000009
Size 38KB
SHA256 7165713d3e1a610399471a5e93d5677508f62ef072c1151e72273bf4bd54f916
MD5 9436affc97843765a966b3568fa7e5ec
SHA1 7bfda74bb30589c75d718fbc997f18c6d5cc4a0b
SHA512 473ec3a843c33e18d6d194651fe11353fcd03a7959225faeabf8c77484155ea6a7bccb72dbaf2093ed53c408faa3be9f6fc907f7a5ddf8223375f9d09b504456
SSDEEP 768:eUEh2+iKBVQbBhu8vjenqz2Ez6Y/AxHLEaP72sV9qKYbDblXqhP8qwFSE3uk:eUEEoBVQDjeQaLnP2pfZTqgSEB
TLSH
T11703F112148F7FA1C244F224A4EFE416ACC3F565ABA15E6980B8B7C7010E3C657A46FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000a

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000a
Size 86KB
SHA256 b7e0db7f989744b84919e2d093928ec1101f364a4f2fab212e3d6aceba97c602
MD5 95deedf11dfc4849fd1823403b414fed
SHA1 8177b76bac76493c8bc5b3e00e02df89f84d7805
SHA512 cb77d2b05667260c6d339cde6803e461bbec68c06e80aad9375e861c4cd9827619c0d50e56b03d58f23d8c36f3b86c0526629d5042e5e099e92add2194b16d8c
SSDEEP 1536:Rf4CTX6nYmApA/a7ijWyB4lLGxwZT9GJl3FXYvU3/fVx4MCy:RJXS2ijWyalCxw99Gn3FXXHViMCy
TLSH
T1A79312B35F1EB22CA45998390F395A11BCA3790E5468CE523033F7E56FA04E993D38E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000c

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000c
Size 437KB
SHA256 a451b8791f9183f16a2b30959f9f69e20f35117f8ca6e34e463916869328f3c8
MD5 15d9ce7fe8b446c91cc0598983dde50a
SHA1 b2ad1e9b11a41f5176e3cc495dac68aa26e0955f
SHA512 39e14f23bbde8278b586057eeb648777afc1e6d11b71f3e5529688341f7868b61d0d7ef43cc925189a70def4a6b53e863a06fc8d36e7551c9a50745be6607529
SSDEEP 12288:9SyJNj5Vy52pw6eyroMIW3/dJhlzOH7pVUa0Uiku:9vJzV1pw/yroMfCIUfu
TLSH
T10B9423CFDB2108E7FE76C411CDAD9FE8049BA554056D8CB35BB6066D825A0808636FEF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000d

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000d
Size 515KB
SHA256 a253e716e392a5948771e7440fe73f0b7b9c2a6fa0e121a9290e13229157b1a0
MD5 af8f5ec84170a24f3899477300335988
SHA1 a4e0514f1375da88fc04cef73d6ec6bd62342462
SHA512 9b5e9232d72104b00d896c44dbb3caecfbfadfcf3179e3cb77ed1b89f84a7cb21cc5d7e009b0674baedb9d682bd34e3db87908420a714d80f27e569d08c7e15d
SSDEEP 12288:G3pmAXkJXiwCtLrdKFfGtMzsjs/OBDQ3FyCPabZBNuQcEA:GdmXwVdWrYjs31OZBmp
TLSH
T1D1B423C233B6892F41C1B98B26949797CFCC291B5A423EF3EB182DDC5047285765ADF2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000048

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000048
Size 313KB
SHA256 b3e1e9d97d74c416c2a30dd11858789af5554cf2de62f577c13944a19623777d
MD5 fe1bc60a95b2c2d77cd5d232296a7fa4
SHA1 c07dfdea8da2da5bad036e7c2f5d37582e1cf684
SHA512 266c541a421878e1e175db5d94185c991cec5825a4bc50178f57264f3556080e6fe984ed0380acf022ce659aa1ca46c9a5e97efc25ff46cbfd67b9385fd75f89
SSDEEP 6144:nl578cxdGY87FohbnmM2i8ito7wTmCbL94KCT3OAmK:nl59zH8MiM2z+NLQBN
TLSH
T19F645BC3BAA883CBDD2D43BA12B41F3EBC499E24158F9449D1D4C8D4D98E73278766C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 2bfe5d0d2e4072c2a4957a9ed3e4443f1e7216604f0ecd9540126d563f5db6bb
MD5 b5cfb7831c7bb9a2ccb76e3661e8b2c5
SHA1 e8a914777d814565cc246ca74b1ac33a8a892bd7
SHA512 fc9b605bfec1cb49792a380293b7c943b7df470cfb40168821dab8784cb46cd4738d51d5422c3abde304f809d23ee5b8b382ba94d681d7745076a15f3d7ab9b2
TLSH
T1BF71095B15AF1F01DB811C38D4EB5D47F730CE9A4A930FA2F11020BC5DF23E5A99A999
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 e1dc70c9670a7072ea015faf69c66449b96ce1a788e88e44fb07e35a7481064f
MD5 321303b0c657b10e1cd9f768dd0ac1c1
SHA1 a05591d96c081796f17677da7db9b38d14d656b2
SHA512 cf324652918900b38304851a68ff7961121f739f20656bad517b9e90a82536d0e92c306a4fe41c897a306fb803fe2fbce0aee02d804881d2521a98a6cee34d02
SSDEEP 96:M9sub5KW9numrzMqyjyZ1jXNy9GukpeA8V:i9j970i7ZyWpL8V
TLSH
T18E81194E159F2F01CB810E38D4EB5C4BFB70CE8A4B530F52B12014BC9DF23E9A5AA559
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 fc9b1e2c611ddc9756cb40ab5fc1b1d24b1964f2fdda6d152ebb04ee8b9c480f
MD5 e49c5d658713885ffed60bf3583b5ab6
SHA1 0b6f572b7651f995498dda89c6af4262d57a5aac
SHA512 39bf64ccfd6bd54c181770a18b694c7f1e3f70608b88cfb97e7a5d86d351eff57b216d03a01ffe8d1f627fc6e1d9652d15a385c6f42e863b2751a44fee2212ee
SSDEEP 96:YqYsXMbE5269mQUjewjyvryjyZ1SImXnekD524D0N:/YYmhQU2vN7SjXjDtD0N
TLSH
T170A1DA4A418E1B10D7980DBC97A64D4FBAF0F9C54EDF6F11A8201A78FAF53D4646B1C8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_github.com_0.indexeddb.leveldb\000003.log
Size 59KB
SHA256 efb46e2503531bb0211361711d31d97abd3918a4380f406af9b4ffb13d022e9a
MD5 db6b7e25dbd07c0f274eb5a77155a7e3
SHA1 3a5694503accee643f0f60e0334122f9672f517a
SHA512 a808698d4fb7dd8243e8df5aeea1230f57c4623e8a2937482d933b6b14bb6440d551ad6550fdfb9808e2eee839b367e0f8a57b1fd6f64146a15562f69b51382b
SSDEEP 384:oPzNA3BmIbrm1YZi3Uf0pcAM3JAzaZW1Gn220pcegdXN4W9H4y7VjM7Z1U9bRk+1:SKmIE3UlMa0qjiXdvDD
TLSH
T1AD53658CF6F98817DFBF8B5B38F22D0C5A3AF212B480585420570B5C65B9F91A5DB1A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_github.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_github.com_0.indexeddb.leveldb\LOG
Size 379B
SHA256 e66cd74ae662163ccffe7a1193fb4c632356f391022803ad0b5d286a3f3f6235
MD5 5fa5d43fafbc0c5316d180b08b6c2a61
SHA1 abe7f243f4a41622f434a08bcf460f59b6a7cbc1
SHA512 c1c377b0e29f6deba5b8a3fc47d7db933983d308c2fc98982b2221c7fb8630f334d146db44710e69a5f12813bbd965d74a7521788bcd1c026c84592cefd6c55a
TLSH
T160E09BE995ED865F559480675178BB0ECAE2250DEBCC9CCE1F43D460B5C10489A9D690
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_github.com_0.indexeddb.leveldb\LOG.old
Size 339B
SHA256 66717dee4e8f1d19b9da65f290daa075fee5ad398e17f715d95e7e12e8526ce8
MD5 2f438d7b5768ae816a032d2ba3b41391
SHA1 de97784157cf200bfac2f7f1cbbb9ea32070d58f
SHA512 0f2e1e1657959fc86bb4fb1fbe4370d7d49bc413503da716805d1024e156c3ad2a70ec06677a622edcc8347d380a08099ac436a626f4fee26b5b428ce7e5fcb7
TLSH
T154E0DFAA94C986AF1554C0A765357B0FCEB61508E7CCAD8E0F62E420B1C5008A4AD261
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_github.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 10KB
SHA256 35011ec94c39fd3dd18e1b588f47b07433fbcede43152cfe71d4247485fe237a
MD5 f057b6e508c1f0d622d2fe6eb7a83ccc
SHA1 ea16dfa453fac4220ce1a1e22765de870b395d61
SHA512 17532f1298ae676444cbfa35362a7cf2f22c679f7b5e68ae2b1938448c121934802e219c8bda1fbe22c41b54f0a73913f1fe796bfb0abdc44e6872112d5a8c97
SSDEEP 192:DEQKEjUqJmeuqsiWJEaaWehVmcjjhnmDiBIrStbKodI7CF7UzClaP/vXfPwNP9mu:DEQKEjUqJmeuqsiWJEaaWefmcj5mDEIC
TLSH
T1B122BEF7C3D8C66DC91156F49B256F1FCE290A24432C3C66C8E4AE5B93E2872D25178E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 9a5de40720f75307c9a29ef2ca2aa614f2a15f6377bdd53e909dc913da47cd16
MD5 9a0c1a546a93a2a1d3029e8799723ef6
SHA1 00428fdaffb1756497dc192ca2220203aa1c5431
SHA512 5bb6c96acd32d37f38e332d8ce3eb57e1b0e57f0b63d44a99cfa2a704f0c2f750afd40f8e8f92d69e0778cbc0b1b40a20335fb450e1d7ff3aec664f13e7b3c81
SSDEEP 192:DEQKEjUqJmeGaaWcXe9WQyJNPVaP/vmfPvVmmmxjjhnmDm6mDiBmgmzD/m/eE:DEQKEjUqJmeGaaWcXe9WQyJNdaHuf1mG
TLSH
T19CF1CFF7C3E8856DCA1156F4AB156F2FCE290624431D3C66C8E4AE1B93F2871E25178E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 11KB
SHA256 620439a754ed5a5d0103e7eec9c3fcb8d4d2dac30ee46c9ebd99f67ce7d5dae2
MD5 4759e2fa5a3ae4d8044de2f8fad72b4f
SHA1 2bde2c7cd661362adae63ad86a016c9191fc8928
SHA512 947be46812c21bcab013a16791fe152722c2dd5b1e8e4bdb41bb39404211460266d3ded204a082c5d92beec22bf406e4f7eaa7ca3859afb99d7283ce3d31eb67
SSDEEP 192:DEQKEjUqJmeuqsiWJ4mVqnaaWe2jjhDIhTKodI7CF7UzClaP/vXfPwNP97llVmpM:DEQKEjUqJmeuqsiWJ4mVqnaaWe2j5IhB
TLSH
T12C32AEF7C3D8C66DC91156F49B256F1FCE290A24432D3C66C8D4AE4B93E2872E25178E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 10KB
SHA256 4f063197c49338e3fd8dd032062cdbc6768a145c8f178765b0314285ee1a68bb
MD5 012bbb3db0d61f91b1f3ffc0fd322f4f
SHA1 b64ccf2d205739af851f99ce7e2842fd9413d3a1
SHA512 272675e0579f2fece3841f7351c0f3de413016e85731375ca5d17c71d53d609b8e85115dfdcf74c60bdde4f8e5fb088538f9ad6bcd30f79b7b9c175a6a27d4d8
SSDEEP 192:D0uitxJJm9wA+Z5JkmVqTsuoaaWeUjjhDI/TKodIuZkqlaP/vqfPiNPirVm0ebm+:D0uitxJJm9wA+Z5JkmVqTsuoaaWeUj53
TLSH
T165229CF783E5C66DC91156F49B25AF2FCE290524032C3C76C9D4AE1B93E2872E25178E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 282208d55d6e20c10cf733e75e50471517188f70fdb339dde49af80f531650d1
MD5 4f6c940a07ed017186f970ab3d71cb96
SHA1 e33ebc4bd306e1c762fe73bcd4e304af7c655568
SHA512 b682d1b7057fbbf0c68dc2340f17e393cb3e1cc348066c87b0733586303e387f4d47e799f578a573b2dea533e75d264bd858af6728c19b558d756dc218b31619
TLSH
T19B41FCD7DABEB02B107D1DAB0D04B84529BAF8314241A8F1DB9785ACF0874F79B52027
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 b30736e71746ecd7392b07cb1387ce5a8755152d974ad01a9b108fac4c9d5ebf
MD5 bf1da93b0086b9d287a60e6062c3f779
SHA1 03c0526c7a0b2946b35df795eac698c66a98bb54
SHA512 43efea79d8d2d423e7989347b6d549176023057d6eb69c342a61480cddec33e251834e445506cc6bc1b18cafd010a14fd9f68b510dda6f47cca40a9c7ba43e23
SSDEEP 192:IRDcBzXVG9FFHYBNv7MF+pAPRp2zU99HHsb+WNnUmQZ47g2VDd8esGLVyIsnAUg8:IRDmzXaytgoUXZ1wEr2hdOk8
TLSH
T14C52D76EEE106A7B2CCAC229FD657B57D3F1102221D51E80EAFC892C25E76CC221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 8bb41de53d0107faf7f48c5697b7fb52837e2d7a27483209ef732fa3478b4575
MD5 67ec689be06a32cb30e0eda1c49656cd
SHA1 d989a27a266c1aad67274452ff8042097b34017a
SHA512 b90aa2c681b7f86c458f7353fe0e5e7e273a5588726cc43b8e9bcd8b036f8f0544f1a0514a1bddd0a9ff40f7361b8cf383249695c9ebd877efed4cc63bb795ea
SSDEEP 192:RRDcBzrsG9FFHY9Nv7MF+pVPRp5pEBzhx9HHsb+WNDkV8D++V+dDzu02gDd8esGl:RRDmzrbWtgoLXI1wD3hYh2OdOne
TLSH
T11D62E76BBE202A7B5CDAC629FD157B57D7F1202221C11E80EAFC9D2C25E76CC2217457
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 adcb474d6644f03899bd3c969c0283f6603e8151e8061fac12606f02c10cff38
MD5 46c48f3b4436c2000ee7e9a7b9d82c51
SHA1 91b764cd316ea2881a0bb3147e5e99a06c8574a2
SHA512 adfe8ab06dd5cd5ec344958575c264767b7da929fbe6e9f575ce52440b74110caae7f32b783f0eabde4cf1f66d52b2ca989af46729ec5541cca1b98a6da40278
SSDEEP 192:RRDcBzrsG9FFHYONv7MF+pVPRp5pEBzhQ9HHsb+WNDkV8D++V+dDWDDd8esGAVyr:RRDmzrbRtgoLXt1wD3hYWfdOne
TLSH
T17B62E86AAE102A7B5CDAC229FD557B57D7F1203220D11E80EAFC9D2C25E76CC221745B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 844d931c7e30d9da0b00b9cdbe21e50311a5cd3cc79ec89de85a53e02f485df1
MD5 afedd063d8497f4ab2fb34014c73951d
SHA1 251814e7203bfb2e6d65d04e072cfce47ec896b1
SHA512 86556d8b772bb51269a922643e70f756caf094465ed049f69e4d181c73afa71a580c86a178c80624a45499f5a78dc95189bb14f47536832e568de6e3cd7e68f8
SSDEEP 192:BRDcBzrsG9FFHY9Nv7MF+pVPRp5pEBzh79HHsb+WNDk61Cgv+V+dDzu024Dd8ese:BRDmzrbWtgoLXW1wD3EYh2WdOne
TLSH
T1BC62D86BAD202A7B5CDAC629FD157B57D7F1202220D11E80EAFC9D2C25E7ACC2217457
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 15KB
SHA256 6683acb993baa3ebe0c75f448160afc7f58b890425007f35aad101cba9cb7a0e
MD5 2e27167ffdac29d8e295ecd187741146
SHA1 778a6c0143e6ec5d3a05fc4d75795cf82d3a3a03
SHA512 7044f08dfba0c7e72a0bb2adbb42501edecc46758e081a55a0f1215dac6932bfc9875c11537cce1028f406fd78c254c229f622ed3f3b568d5de05bf6b0fbdede
SSDEEP 192:BRicBzisG9FFHYqNv7iF+pVPRp5pEi9t79HHsb+WNo7S1LBMynMCYtu02WvDd8ed:BRimzibFtuoLXT1wLNuL2W7dOne
TLSH
T1FE62D86BAD202A775CEBC229FD15B75BD3F1212221D11E80EAFC9D2C25E76CC2207457
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 15KB
SHA256 e35b0a631a442dda6397cb643b0edebb58fd7c64124e5c77d4fa279a9b084f6c
MD5 15f4b2296cd4f05def89afd03a148d8d
SHA1 6c5adf2f5fca8483ce18e258c94cfd1c5def1248
SHA512 27ef218302443824b762a1e7a403778abd57e0ad66b025aafcdca0d69e6432b193caee9e83400c5144106ac4e75a35b741c68de26a8c6bfef88a292a5d2a4935
SSDEEP 192:BRDcBzrsG9FFHYqNv7MF+pVPRp5pEBzh79HHsb+WNodk61LBM+V+dDzu02tDd8ed:BRDmzrbFtgoLXW1wYH3Yh2JdOne
TLSH
T1B362E96BED202A7B5CEAC629FD157B57D3F1212221C11E80EAFC9D2C25E76CC2217457
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 15KB
SHA256 a78723e895b37d1523d9eb1429a07a3a1b5d0f803cc7beaeee120b516a160f8b
MD5 3a223d4985d86bee69fa06a1f20e1bd8
SHA1 840973b43fbbae7a5e50fc0d2bd9ec16349fe1c4
SHA512 209ba85079f4db356e65ce69b444288b6279d148dcc49412028663c2c6b40d3b93600f722f28a971324f88db3c26738903ad28a854f853131eabcc9273f61dd9
SSDEEP 192:BRDcBzrsG9FFHYqNv7iF+pVPRp5pEi8t79HHsb+WNo7S1LBM+V+CYtu02UDd8ese:BRDmzrbFtuoLXq1wL34L2ydOne
TLSH
T11E62E86BAD202A775CEAC629FD157B5BD3F1202220C11E80EAFD9D2C25E7ACC2207457
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 15KB
SHA256 0182797e1603a72b09e1fbaf70f6544fc43b344a0c562be227d256ce547d6c6b
MD5 c60955b0506b7fdfe63c8cff07de81fe
SHA1 762d988a6b1ff053bd482c2addde930bd0e7fd99
SHA512 cbd5e640f007788384c470e31e111679ae74d3c36f382c00d3c31ab3b169995a0a47657f0d72eb928808ab5145b83f4fe04541bd698914179d32c5b7ecfc0040
SSDEEP 192:BRDcBzisG9FFHYqNv7iF+pVPRp5pEi9t79HHsb+WNo7S1LBMDfc/CYtu02pDd8ed:BRDmzibFtuoLXT1wLoKL2VdOne
TLSH
T16D62E96BAD202A779CEAC229FD15B75BD3F1202221D11E80EAFC9D2C25E76CC6207457
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 15KB
SHA256 5f22ce8611bc1a2bf390565f5249401b8a596d11e54641c5825cacc1f51a1145
MD5 2cc5ee537f7b84820cf2cd8dd5b62960
SHA1 e4c5075db3c85a9480620c5a09f39d078849987e
SHA512 b9a5c50ffa7294c3842cab56d8507588ab33b082466c12b9d4e7fa2b047c44bbb5ef27bba19170c7577f66b12291d870d17e5bfa4b5c0b0ed87d75eee771461c
SSDEEP 192:BRicBzBsG9FFHYq35v7iF+pVPRp5pEi9t79HHsb+WNo7S1LBMuieCYtu02EDd8ed:BRimzBbF3ZuoLXT1wL4YL2CdOne
TLSH
T12862E96BED202A7B5CEAC629FD15B75BD3F1202221D11E80EAFC9D2C25E76CC6207457
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 15KB
SHA256 0fc54507914e262425333e24db9e49cbc693c9bc1cf0bcc56d373d658897b09a
MD5 001cdbcf4409cf88527aa495826e7a28
SHA1 1e25cdd72b2cdd7eecea80d38426a24a60740bb2
SHA512 71b2f81906fe62d41fe1f9735a4b3e5440106fd8db4aa4f459ac787877cefe91caf4b2bc46fa721ba06bafd1fa8114c7b0f549d2dc70e2fc683de3116ffca61c
SSDEEP 192:BRicBzQsG9FFHYH35v7iF+pVPRp5pEi9t79HHsb+WNo7S1LBMwYoCYtu02iDd8ed:BRimzQbE3ZuoLXT1wLMiL2QdOne
TLSH
T1E562E96BED202A7B5CDAC629FD15B75BD3F1202221D11E80EAFC9D2C25E76CC6207457
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 15KB
SHA256 51ff4271f4e16f4da6c63a4bc69a01713db78dd58b1ebea6a4a19a7bd49d4922
MD5 ca0e8531e2e31044808be29bd758de36
SHA1 e667ecc58371a742d658615aeb41cac5a18447f2
SHA512 023e5a4afb80532186a118bf40d57a66359f5ed6ed0f0ee00476cd8de491d973d14ebe7d2041b58b9960b0c0c78b0dc0264e51ca7f63814fc9187b05d8a70d41
SSDEEP 192:VyRicBzQsG9FFHYH35v7iF+pVPRp5pEi9t79HHsb+WNo7S1ggSwYoCYtu02ODd8A:VyRimzQbE3ZuoLXT1wp+iL28dOni
TLSH
T15F62E86BAD202A7B5CDAC229FD15BB57D3F1202224D11E80EAFC9D2C25E7ACC6317457
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 15KB
SHA256 20b11fd696adddb2ac60b8e98fdc625d36d920064114574edb98f0ca7b391deb
MD5 871624d6fe027bedc49ea4ca6ff9d1b1
SHA1 6d794a4fec0557c74973c05718c5bade626a48d4
SHA512 1394d9b9983e6229af7703edbaa4037cf7634a769e728c8a7f6a6d508f20285f3b4c5cb7d07e8f728a03d752cfb97d6ea2848e70173666f3d508e9146dd7e196
SSDEEP 192:VyRDcBzQsG9FFHYHyv7iF+pVPRp5pEi9t79HHsb+WNOKS1ggSwYoCYtu02tDd8ey:VyRDmzQbEeuoLXT1w6+iL2JdOYi
TLSH
T14772D86BAD202A7B5CDBC229FD15BB57D3F1202224D11E80EAFC9D2C25E7ACC6217457
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 c5d5159fa85b7806f87cecff8faba8cf3d6d9b02f6fd645d11ebe03df945d543
MD5 6b542c784ef6fb74c2cfbc8730557832
SHA1 b5c4544407a42eace26e6bfb318ac394e0033896
SHA512 b52cb0268cf56eb71140ea015b2077ec2465a9945bcbe7e3fe6f06166a26bd603d906f433f0669eb32aeac4d810048bbf9f41b671af040b3630e5285d4d3e3b8
SSDEEP 192:IRDcBzrsG9FFHYBNv7MF+pAPRp2pEIz99HHsb+WNrlUmQZv+V+7g2TDd8esGOVyr:IRDmzrbytgoUX41wuEJ2PdOTe
TLSH
T1CC52E76AEE202A7B6CDAC229FD557B57D3F1202221C51E80EAFD8D2C25E76CC2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 15KB
SHA256 46ba84bfa34cf39dfc11cb2738622c997222434c3f52a9d648a878aae4cf8443
MD5 5ea631fda29a549bd6cd7f601a3718fb
SHA1 95365d7621f6b60d63a0303d167b0bb7e80a92bb
SHA512 1c673face2d9a51e1521dfc53f989286a1b4bbddf45d60a19c60da2350475af1aa8863c9495d51dd8c3b9153b9c10d35e1096668affc5b4192dfd0a9de0a5e25
SSDEEP 192:BRDcBzBsG9FFHYq35v7iF+pVPRp5pEi9t79HHsb+WNo7S1LBMwYoCYtu02iDd8ed:BRDmzBbF3ZuoLXT1wLMiL2QdOne
TLSH
T1CE62E96BAD202A775CDAC629FD15B757D3F1202221D11E80EAFC9D2C25E76CC6207457
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 15KB
SHA256 c9e8eedae9dd36fbbdcba9b6b64ce3339385ea7c79cd96f260af95ebf9944bd4
MD5 c30e1827d860d871c58b41a3ab759011
SHA1 8be4846cdea06f42038a42f5655b5c89d07b480c
SHA512 8d89e3d747a8d062cb763447d65353ef79113eba8f6d11317b4ad480d5d1a2c40affbab5338a656379ac31fe13020beb59b8ef1f3c544553a2490f2c757f209f
SSDEEP 192:VyRIcBzQsG9FFHYH35v7iF+pVPRp5pEi9t79HHsb+WNo7S1ggSwYoCYtu02ODd8A:VyRImzQbE3ZuoLXT1wp+iL28dOni
TLSH
T16962E86BAD202A7B5CDAC229FD15BB57D3F1202224D11E80EAFC9D2C25E7ACC6317457
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 34d3b150d9ebc3413240a436dcd8cc4d2da0e46d00a681d2118263aea9d32f3e
MD5 73285efb9f7ee0bd384426865ccccf8e
SHA1 51903f2b7a36fa90857257254c2bebdfe5da7eef
SHA512 e9bab3e8a04453bd7ca516137298f57170d38058ccd5df170108532fdb6eefb2d5ae94de47967a5242cb07be597050bef4f69d7f740877c626e131f01424e28d
SSDEEP 384:TRjPq7KxkXqKf/pUZNCgVLH2HfgslT37pLuLcSjFgXODPO+ErU3voHGjBm2oR0h9:TxPq7KxkXqKf/pUZNCgVLH2HfgsV37pM
TLSH
T1287219676C4C8E7B0F94CACCDC167F4F9DB5025B65EA886482FA582903D5ADF01061FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 4c586f7823db6fa9a3e0b1b0eeec5413adb6e0730fb420321d21e560dbb2859b
MD5 c3ad2212bf8dbb9fbec4b8d10f6a8d20
SHA1 825d6e6859971d20cb0efa9d953d50bda75db3b9
SHA512 4dc128f8e6ab27c0962598e6f5a1e62f44e391a37914cf9667af5e97796f9f37411ec0020ebe29257bee354c6e6eca36d5c61545c44a128781a5c3ed93411d36
TLSH
T1DAB0125184025A41C10703F41252188877549F209B0A2B0143E0B9668865161801C060
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58d6f2.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58d6f2.TMP
Size 96B
SHA256 d1aefb5a5ca786a4efc43022deb9f49d570610471daf49e01469c41405ed5d04
MD5 9b4904bd9fc6d352fc949f98b66c7296
SHA1 651e73bd5e04baecd4f9a91152ae6315a01be6f8
SHA512 04974f3042f5fb94467b3fad4d1f4927824d2da74606923cc4661d61186b39591439100095cf7f4f77af450844227c6c8bbd03206fff5e0b573459455a77e4ee
TLSH
T141B02202C0023302C00203F03A88CCC832A0CF22C203020AC2F02A3AEC282A0082A2A0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 96B
SHA256 f3f9a628fb00d75934efb2bded37648ff9251068bef9744fbe2480ba7a700a24
MD5 2e9cc791be5ab0e1d6fb38ab7c2afcb8
SHA1 0ba6b871062a1b67ad3187ec20beaaf1a2a9ba43
SHA512 50f8f0422232e5922813427d0a88ddc996bf451fcdf49fe085646856c1163629702f80c9633b1414d8626867b70dfdb6439bd1ef016aec0b932fc1df9fb85e0b
TLSH
T105B0228830822F02FF2003B0C2C300823322BE20033B0A328BF38008AC222828B30202
MD5 SHA1 SHA512 TLSH

Submit Download

c97a49b8-f63b-4a57-a83e-245c77d5c353.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\c97a49b8-f63b-4a57-a83e-245c77d5c353.tmp
Size 13KB
SHA256 7dce373d583e076e7d6549a0b25a81cb4d5fb3021ee2c09718b1aa845dcde210
MD5 9a79ad448e295a1f75eb670e51f4f516
SHA1 4f890b4e116c128c2caf2ea6cf49f460598faff1
SHA512 e6be588019aca17722d3147a4eedf31328896e32cc39407c18d4b48fa01a2d7bb50931324955124111012237135cddb4cf97357e53ffaf9a21acf5e2da7521c3
SSDEEP 192:IRDcBzXsG9FFHYBNv7MF+pAPRp2pEIz99HHsb+WNrlUmQZv/E+7g2eDd8esGOVyr:IRDmzXbytgoUX41wukJ2sdOTe
TLSH
T1FB52E76ABE206A7B6CDAC229FD557B57D3F1202221C51E80EAFD8D2C25E76CC2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cbfcdbad-39c1-40c8-a800-6b65e515dfbb.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\cbfcdbad-39c1-40c8-a800-6b65e515dfbb.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 241KB
SHA256 03f7fe26346b5fb5c0114ab5777c3a7c441380b41d7558c172762bab10ed9347
MD5 eb21a8913db268522f47ab9aacf7595f
SHA1 52c98e5077b485605cfa81c85198a373bf40d141
SHA512 6c18fb18e72350b3ec6e9b48f471204dc17adb8e0c7bb8add52e868b770b2a51d14e802cb412983bb01bdaa894559074bbae9326cbc5380029df56e78503f98c
SSDEEP 6144:J7a1HbGnc38ro8CcaFt3s7Flad/+gjem7Rkm1tYpBeh2BAoV:JibGno3cUAragQ9oBGcAoV
TLSH
T1523412337C60783E5DAAEF6EF40E263B2DF19F928515E85FCCC45B00968E7984E449A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 241KB
SHA256 be92a04118860a4c5dfbb1793f26ac2f7ee5ad54d9d5d3b039fccdc5af8549c6
MD5 ab370b8b9d21a3aa80eee775d2d49fae
SHA1 fa871fcc165927c8dd1d9e67dd83258fcdef85e9
SHA512 2efbc23f03b92595c930e6c8bc2764621278dd10a9b61fdac2e30eeba91ccf18dcf04ad76820713385118b761de3adc46ce881c72e617a6a39c7a8137089db8f
SSDEEP 6144:Jua1HbGnc38ro8CcaFt3s7Flad/+gjem7Rkm1tYpBeh2BAoV:JRbGno3cUAragQ9oBGcAoV
TLSH
T1663412337C60783E5DAAEF6EF40E263B2DF19F928515E85FCCC45B00968E7984E449A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 240KB
SHA256 2b383d2af4567ca1726a3d59666d533882e5ff44e8478bcc53c0be1dacac32f3
MD5 24ead65bb652d74d2b7c735ce5ea6929
SHA1 478b11b3f4f64c96aa5476b9dfc5814aaa7a9725
SHA512 a6fd77b40975312a61e4964b1be202f3de894da2d4d0a6244797db2f9cfb4b0d52f7055fccd348e39706eca896f6f88784462be941d11d570564046a188b9344
SSDEEP 6144:JV1HbGnc38ro8CcaFt3s7Flad/+gjem7Rkm1tYpBeh2BAoV:J3bGno3cUAragQ9oBGcAoV
TLSH
T1993413337D60787E59AEFF7AF40E173B2DF15E924415E89BCCC04B0496DEB884A44968
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 242KB
SHA256 83d076b84a3843792015198dfff873abaf10dcb182735a93f433bc875046a5c8
MD5 a119cd8c25cd782afc5d162f4a8d097c
SHA1 330cd5cc67486d16a1eca4cb3c73efd687a7967a
SHA512 877db66b55ae166f55c101067b2cb3136ec52836d6cce52a262fa7fbf7c79759ea238ef2622b2d4388d94545678b5daf5c0c132774174dcbf2c604d211429743
SSDEEP 6144:JRs1HbGnc38ro8CcaFt3s7Flad/+gjem7Rkm1tYpBeh2BAoV:JWbGno3cUAragQ9oBGcAoV
TLSH
T10D3412337C60783E5DAAEF7EB40E26372DF19F928405E89FCCC45B04968E7544E449A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 07fed951c0b8fafdc24cc6a10faf862301a8d3fe70980e11235047563fd08f3f
MD5 c12c3849d49d4dbf8c8f4d1cdfd712cb
SHA1 0c9b1b4d4c44321641f50757620e2925aa7b30b0
SHA512 0c81ecfd4953425c924a42f74bcab0b73650a87bbc3e96ab21caa86c658241a286ea802fd55a3f4d08cd1477a8d47e2a3780eb5f34e99413c5e72645524cb90c
SSDEEP 3072:/nGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMM:/Gm7Rkm1tYpBeh2BAoM
TLSH
T100C312275E75E9375878BB0EB08E0B1F1EF14AA6D830DA92C8D86B0467F97CC1A05D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 241KB
SHA256 a91e04b151c9bd7602ce1fd39d52878ebce7266423d860fcb081c6a54dc7d3d6
MD5 846b45c5753f441e81b3f9a60b7a5f72
SHA1 edb00d16580570cb996026127ea4d0f568523b2a
SHA512 884234e1e592024286f9e699c97a3ee01543695d34525929de86bae7109f1d7d6a9691b156a7b51a8ef7ba6ea0a90e4a4998a5f382d7a6e3024c28726907397c
SSDEEP 6144:N7a1HbGnc38ro8CcaFt3s7Flad/+gjem7Rkm1tYpBeh2BAoV:NibGno3cUAragQ9oBGcAoV
TLSH
T1123412337C60783E5DAAEF7EB40E263B2DF19F928415E85FCCC45B00968E7984E449A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 241KB
SHA256 27ccd1aadc805bafa4831e7582dfaf5c97dc25921242dfd79abe93b4edead4f7
MD5 626727d1c4a99d10776d5a1d4087b3c6
SHA1 58a76a575caf4df923fe53e629e9ade1b64905a2
SHA512 a62bcb92bb81141a306371c882b9bb07e99151e46ee9aea22d4f6a0726af3bf8025f7bd5c029d7718164d5e4ddedcd731538e08186838e0d49274a912c07d9ea
SSDEEP 6144:NJa1HbGnc38ro8CcaFt3s7Flad/+gjem7Rkm1tYpBeh2BAoV:NQbGno3cUAragQ9oBGcAoV
TLSH
T1C83412337C60783E5DAAEF7EB40E263B2DF19F928415E85FCCC45B00968E7984E449A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 241KB
SHA256 1b8dfebe50226646736b908906065993fa300785ab2817def548d7b6bdb43a73
MD5 96fb72ac1ff0d67feb5d7be6db08699b
SHA1 0bc1c76abc81217e63175ff0239d760f93751972
SHA512 afd2919feefcc0dd41f2c78f42ee05c5f055707e814af0b13a026b92d56c327e9d371677b57573aef76c8483acd9ddfa4400e7c33d5f01570a233cb9fa618f24
SSDEEP 6144:NN91HbGnc38ro8CcaFt3s7Flad/+gjem7Rkm1tYpBeh2BAoV:NJbGno3cUAragQ9oBGcAoV
TLSH
T1103412337D60783E59AAFF7EB40E263B2DF19F928515E85FCCC45B00968E7884E449A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5b701b240f688ccd0cbb893821bc75fe1862d60cc935acf15185f5354486114d
MD5 a6b96bc3fb82f67fe02c065306c79a1c
SHA1 ea83f0f8e62d29a7ba15fc739e6704dfc873ba27
SHA512 23d1a6166b9d175d76e619ebd08ffc2ee62d59f8778f9eb54db2c85d98f0544424fbe4f5d47d0df434e43bdecd039785347df7dcc039a40d571210c87fa7f782
TLSH
T17AD02330ED08BFEAF03B317C321002083D8C14D2440340D1E414097D8CAD48286E0EFA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 92b83a0e542b7bb3ed324c35b5f2a40c47a6351981065b804e4d9d80ddd6d7ee
MD5 9ea20a12d0c030ae7f84014f382662b7
SHA1 7912569189cf07c1ce092a268e67e9f391b7c8c7
SHA512 39ca414f13163c8479fe7650ae0dd1607b267fe3f319c09aec7bd5f68448e9ac604351069bf6b166b3f897d3afb5d7f35e609b9fc72b9debbcb05bad8fad7d81
TLSH
T132D02B20FF04E002D1072172540047100E0848902093C140E030441CDCEC804D395307
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7d64d2777f444a09968d6c155732e22d743fcf7c319c222bc06f6bb97808e489
MD5 89bc5edb6bd922f1cf8ec5536b066fa6
SHA1 c50aaf0fe1444780bb68ee7ab6e1c7468c2f303e
SHA512 77a1265c1484940562f1514202a0072e343efb323e1dcdb979fc9b7a2c69d85b814c076828b260c0b86a19e482ebb0a2df850f9b7c130a327861a7c56e26cde8
TLSH
T15CD02B20BF04E402D1072172540047100E0848902093C241E030441CCCED844D395307
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 ab2be136a002b0f5776fc5db3a40ae5301d931535d069fc1d5b352e74ffb183b
MD5 337dc72e9e5412ad340a1e4a56392147
SHA1 884e76c365cbd99fcd865e23023c045a6eccd09d
SHA512 53fff7563e8889b4f4df918004a0d09cc698095ad6137586e773b0b75da7642fb59eb96fa9ea1a5dcc977616474d9ff206d29ccc6e7ba07f6ebeb6399b6bdce5
TLSH
T14E714EB7034D14E3EB631C31ACC20AC678BA90ECF637BE961460DB35C52533105E9659
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe587942.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe587942.TMP
Size 3KB
SHA256 23192a03fc09d6297ba1f9b11646439ec9d89b16d41db09829c0c3563b0347ed
MD5 656400aff4a1c4c839114a07bafa9cbf
SHA1 138161faba41f9e6441cfc8c5c5733ec4e0b9df7
SHA512 5df9402b52b9054cca1c0547ee24d410cd1df53db12e49966ca6b2ef99ea2a401bf850e557c4aa350fa51fc09ee1d7c8133553d77c368f573de646cc2f174513
TLSH
T1B0714CB7034D18E3EB631C32ECC10AC678BA91ECF6377E9A1060CB35C62633145E9658
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 efddaea152af668566226bb6b3766922898af351d79ae9ce32e0c855241f30ca
MD5 baca02e7934d6e45886f8886fa224f83
SHA1 39572da94a334fe03da074dddf9adc26d79c2970
SHA512 548758a508a98d3f7d1164e9aebf016e858e41c2351a09859a7761c3cb22d5e4ac08fe18ca9af9b34d6e940e24a4c037136a92fff5d7bf5e3b249adaaeae0bc6
TLSH
T1B2417DF7C2D486BD891156F09B24AD2BCD2D0516422C3C56C9E4EF5B63F25B1D20159F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 2dfdb659dd382b8e48f00ada73cebe3e4afca959498c9b1600faef67e4d9e6fb
MD5 2303281bfc837c92d3cdfb816cf727ca
SHA1 4326190a560e998b1cf532973d5df84f260d01cd
SHA512 565e530d6192dec35cee0ac6f10b2c69863e1f7d88ff22bf4608445aa860d5d15cf686a0bb6da87e7f68637c1c6ef846d932253d0112fef283eafbc4ee41f6f6
SSDEEP 192:sxZpR2yM/jK1Ml8MkF/f6sYQ+8VHIdpd3HW6+WNGYvr0jojIgrJ:sxZpgMF/f6sv+3NHbGZ89
TLSH
T11742F911AA346977CCCBD30DFA45BF53D6F9456292900E44AAFCDA1C05E6AED2207C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 fd50d78d18f1831585cb0c8c2b52016d4f61aa413d6c19efdc629da64a67ffdc
MD5 7c7cec272b00b4d646e8c71b9da51f65
SHA1 8ed8cd457cbb8e5f530827c630f8da2d833e2677
SHA512 876650d93e0b64d8ef1ba1e098d6177b934862b6fe2b6434347b448f160f25449932e3293c121b0deb83dd28cee3c5671062e65ceb1932486e5fc8e5a527fef4
SSDEEP 192:sxZpR2yM/jK1Ml8AkF/f6sesWpVG+wVHIdpd9HW6+WNGYP3lj8hIgbRJ:sxZpQWF/f6sPWvG+LXHbGu23
TLSH
T17452E801AA349A7BCCCBD20DFA55BF53D6F9456292910E449AFCDA1C01E7AED2207C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 d32572272d3828961eda43e86d2d8c1ffc77e3cb6ea3a7ba9e5a541a3e7cb815
MD5 ef6fcdab9430ec3c390f7f1957543644
SHA1 9b2c47dc328c17dd7d2c83a1af3b8519bb4b78d1
SHA512 3f386e5738fc17c8d715291e0ed3767d383cb487c4b9370dbed2a11ea6f4fef995724cd6ca56ccc57681924ae1e3c246ccfa278ade298331ba4ae5700d39bf6f
SSDEEP 768:iUseJ3xWvhfyn8F1+UoAYDCx9Tuqh0VfUC9xbog/OVYcLly0ppjroSJ:iUseJ3xWvhfynu1jaVcL88pQo
TLSH
T10FD20B2B280CCB7E4F844E5DEC266F966EE801CB57984D5487FA984C02C77EB512B4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 5c6740d1e783c1bd7630d812ee9a5ca5c78e2b5600121daab5274c4fbded92d3
MD5 a899f079d1e3d8c3e2d8e5f2c46d3886
SHA1 2f633085d17db5a7ef97a8b4f45e3ff40f7a5210
SHA512 ef38073611969e8c55ddabc9cff2bcd1afdcc541fe9ae5f0b0b2d929c2b48e3be95b826acbc5e50c98d8ebc2cb57a44459abfa63fe5dc3e53e3a34408a162fc2
SSDEEP 24:KdxwLfxwyxwRxwIaxwNdxwBxwhxwx4xwlxwB+xwsIjxwdxwxKixwOhaxwzxwx1EQ:KYHIhKggkXyVDIdKYMAPyJiI/KXq0y
TLSH
T1C3912216B47A12023C3E2898B2E5D5360F4139A3745968EFBFB840558E67E214EFD8FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

favorites_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\favorites_diagnostic.log
Size 1KB
SHA256 c9c40af99bc9c9084ad7ee8575ef3b54ab53928b118761438ebd73a5683a695d
MD5 d782c1aa6803215511fd2375ef21abe0
SHA1 c4d7a9f703e8c5e90aed934c15ffecc3983c0a93
SHA512 f04c36c220d2d71248b0a2f5e7f6ac5caeea01c33545d3562d2e231e36720024e5d879839476a08c37dde10a7e911faee201a5ac78ef472523dcea5055da87ff
TLSH
T10B2110C2D2E910D56E8BAD95C22D5403A8B67EE6160E5CB37B2E44F54FC8C150E3EA35
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 1cd732cc3e1dcbb2239cce09106e33af242c7092ac310ae446f5d6fde806b8a4
MD5 758043d5946852f69105b1b6b218cda5
SHA1 e87e5b544b5ee5b123ff5f8fa88fd808ad56b36e
SHA512 113e11189b1e5dfec34c3e9fc0102ba9086ed125b690d5361b038da575f07c3ab9e54f9a0748be6f35102b429764cf1e51b596698c693b8c1cb58a0f9e903af3
SSDEEP 192:uUm+xasuheOwQxMGsNsyQaM7ZVSLQmiU1gD9d4MTH7+FdLJxtQ+2v8z1tqfSu:eZcIhsNsy27TS9qy9d9xW+20GSu
TLSH
T172626C319C389C37A9B3F246F48A36134EF89227D6C46B54F1ED7B1D05DA6A8030EC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 2e6d246dea6eb17788a2a5c2959567320eb446d3a475678a277ee24047c73e8f
MD5 4a175da8587bc43f81ad43a460393366
SHA1 0ed2a3605c55dce77e22ab57461d368d7e7d3c30
SHA512 4af8ab00c1d10552ffe424ebdfba6342f54cb221b9aea293c7869227fed89fd4217e635d153ff15a8ec30f3284fa9a75771cfe7a029f5e4de391108c2ffec0e0
SSDEEP 384:EZcI3sNsn27TS9ey9d9xW+20GTMA8tGn/oG5mkcimSu:i3K1AEl0Gf8VG5ULSu
TLSH
T120A24AB1D8649DE790A2F5C6A486F5132DB49237C68C5A5CF2F8BB3D309F9B80316C15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 9589d445f077b1841b54a51f55da9f030e98765c9cec63f24eecf21bfab53999
MD5 5508f2fc269b65f9addac77e9e625ace
SHA1 92dacfdcdb2fde1c5deeb2e5afec99080c0e52dc
SHA512 723fe120a772970f6f9c748daa47c97bfcac139c2521a06db3a8174a6196ed08551950f89d005625bc14532cc243c225993d2f092747ea9f78cefdb1392f1f45
SSDEEP 192:lONP6vMtPQmiUyDYThTH7+FdLJxf847GLU/u:lONP6UtRzTmd9xHsU/u
TLSH
T157021835AC786C7BEAB3BD4AF48A37171FE4516BA9905B54EAE82F1C00D764C1307826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 413c054cba33b1c8bfebb3b78a6d3c3de0255b38dc4d0020e499e5c9ab8c54f1
MD5 6e7546dc55ec2c989dcbd565e07014aa
SHA1 e40ac6de235e0389ed02f45fe6b51218dabaae32
SHA512 7cb7dd3e1949fd4052ebccb377275dca404cbb08e4dd2a157f8747ca7b274e803c858ae64b07e37b3599ef17f76ef899976d52b48852d1ee43410e17e68d6370
SSDEEP 192:SONV6vMbPQmiUy3YuhTH7+FdLJxtQ+2780ItqfU/u:SONV6UbRZumd9xW+2MGU/u
TLSH
T117120A32AC749C2BAE63B546F08B32174EE4926BDAC56B50F6DD3F1C05DE69C130AC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 1f4e6475f8d90071edfae3db14a24b69182e14ba8a2701e1c2f7c11a00265b5f
MD5 0571f63eb5f21a8c507655416ee03566
SHA1 ebeefe81c22dc3948f77239ef60762452b26ff7a
SHA512 aa1733dbbc0b3afb861350999599e603a79a443de0292221f74d9621ab92cda37b24fd9cacecfb0b574444956075ca7e25e7aca05825bc3b5d548fb5ffb690b5
TLSH
T17A412458B6F81118B3B37F5AABF6A86D587FB8772F06C09D10010E8F0662A40C871737
MD5 SHA1 SHA512 TLSH

Submit Download

_R_E_A_D___T_H_I_S___55QZ8U_.hta

Path C:\Users\Admin\AppData\Roaming\Microsoft\OneNote\16.0\_R_E_A_D___T_H_I_S___55QZ8U_.hta
Size 76KB
SHA256 0a946e7314a806116c9acf0809dc6cdcdfec8d3b7e076d4e88797285a6b22fab
MD5 eb03cf11adda322466633f7ee721c57d
SHA1 a337621362ccb05325389709ba80f8671f960efc
SHA512 581ac9d86151fe59dd11e06635ff444e31a6d89e088b80cb76bb4bf3339c69cb61a9b804fb03e30b2719ef6f88d011956e686df265b8c0873e1c8e3c469bbccc
SSDEEP 1536:YpdPlgPSEHdyJoaASVYTtqMojm90nygbnjgAuzMg:mjBoZSbMoy9QjzkpP
TLSH
T1EC7309C6F5CDB0270A42868352BDB320E49ED8B5C6126126E1BF44B3746A903B79F5FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_R_E_A_D___T_H_I_S___NWP0ND_.txt

Path C:\Users\Admin\AppData\Roaming\Microsoft\OneNote\16.0\_R_E_A_D___T_H_I_S___NWP0ND_.txt
Size 1KB
SHA256 fb7d7b2ee0c17593518bd60156ff84c3927ba9148ecc00248d71ce29848a4a39
MD5 b4811f4dad987d43f49c081bc59af063
SHA1 472a65e7e780f6286ff2e13ff08cf10157a6446f
SHA512 79c9814264e47b9acf8d4c41028ca0c9edc35afa43b214f44046dba6d1532c0c0d72851ea011b44f77dbd72711ea80af28546a1f257e59102949a76722935854
TLSH
T18E210F8BFD80A0912B82D673337E9560DA96224DF77A0181B44748E77B32E2373BF655
MD5 SHA1 SHA512 TLSH

Submit Download

Mabezat.exe

Path C:\Users\Admin\Downloads\Mabezat.exe
Size 141KB
SHA256 2ae0c4a5f1fedf964e2f8a486bf0ee5d1816aac30c889458a9ac113d13b50ceb
MD5 de8d08a3018dfe8fd04ed525d30bb612
SHA1 a65d97c20e777d04fb4f3c465b82e8c456edba24
SHA512 cc4bbf71024732addda3a30a511ce33ce41cbed2d507dfc7391e8367ddf9a5c4906a57bf8310e3f6535646f6d365835c7e49b95584d1114faf2738dcb1eb451a
SSDEEP 3072:k8sjSpy0bShLy8gXvzJ9k8a/o3z4aBy5chynHa3Ifn9xJY:Fsjl0bu+NxjJBRhyHJfO
TLSH
T102E3291272D0E176D8E513B041EE267317B9FCA10B2453DB13415AEAAD72FC1AE3935B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Petya.7z.crdownload

Path C:\Users\Admin\Downloads\Petya.7z.crdownload
Size 110KB
SHA256 0b451e2773e99bd1c3792817d3b6e61c37f28d935cf19d7f450172bcedf2ec77
MD5 ce77d13fe5496cb8879fc9ad1c6b2d67
SHA1 9c7ca5ee9e1fbc21c2b122634d080f24ee86c2d8
SHA512 6ef5661bce00ed2c591c21cd7992b58d18cab379667cffba773f456759ef78c53fc177dc0bbd7a7fa725fe9635ddc010771b76c13cd1c175d89d63184cfc764b
SSDEEP 3072:f1hhcP8KBtWvVdfmHqjWL5dxfD7OpIDFRKOfs9W5RF8Fw0ueJ:fZQ84tW95mHqjWL3B70QFB09W58FjJ
TLSH
T14DB31242B6A488F75FCA077928767047E00851AE27DC05BA7F236E3F055F36C14EA724
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WinNuke.98.exe

Path C:\Users\Admin\Downloads\WinNuke.98.exe
Size 32KB
SHA256 2f1f93ede80502d153e301baf9b7f68e7c7a9344cfa90cfae396aac17e81ce5a
MD5 eb9324121994e5e41f1738b5af8944b1
SHA1 aa63c521b64602fa9c3a73dadd412fdaf181b690
SHA512 7f7a702ddec8d94cb2177b4736d94ec53e575be3dd2d610410cb3154ba9ad2936c98e0e72ed7ab5ebbcbe0329be0d9b20a3bcd84670a6d1c8d7e0a9a3056edd2
SSDEEP 384:4cr14oKDP9KDviKDeTngwz9zmDAQE4KDJKDv5KDPP4vWe:92FgwBzMAbb3
TLSH
T12EE25232DF1A9884E9F4C5B685DB89B52131FC23C0403F6722D0AE3F6D73E96E914299
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/536-1350-0x0000000001000000-0x0000000001026000-memory.dmp

Download

memory/536-1348-0x0000000001000000-0x0000000001026000-memory.dmp

Download

memory/936-1888-0x000002A8BE4A0000-0x000002A8BE4A1000-memory.dmp

Download

memory/936-1891-0x000002A8BE4A0000-0x000002A8BE4A1000-memory.dmp

Download

memory/936-1883-0x000002A8BE4A0000-0x000002A8BE4A1000-memory.dmp

Download

memory/936-1882-0x000002A8BE4A0000-0x000002A8BE4A1000-memory.dmp

Download

memory/936-1894-0x000002A8BE4A0000-0x000002A8BE4A1000-memory.dmp

Download

memory/936-1893-0x000002A8BE4A0000-0x000002A8BE4A1000-memory.dmp

Download

memory/936-1892-0x000002A8BE4A0000-0x000002A8BE4A1000-memory.dmp

Download

memory/936-1884-0x000002A8BE4A0000-0x000002A8BE4A1000-memory.dmp

Download

memory/936-1890-0x000002A8BE4A0000-0x000002A8BE4A1000-memory.dmp

Download

memory/936-1889-0x000002A8BE4A0000-0x000002A8BE4A1000-memory.dmp

Download

memory/3788-1382-0x0000000000440000-0x000000000044E000-memory.dmp

Download

memory/6008-1387-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/6008-1380-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/6008-1844-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/6008-1791-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/6008-1798-0x0000000000400000-0x0000000000433000-memory.dmp

Download