badrabbit | hxxps://github[.]com/

Analysis

max time kernel
1428s
max time network
1431s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
22-08-2022 02:56

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

https://github.com/

Score

10^/10

badrabbit mimikatz wannacry evasion persistence ransomware spyware stealer worm

Malware Config

Extracted

Path

C:\Users\Admin\Downloads\!Please Read Me!.txt

Family

wannacry

Ransom Note

Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 15zGqZCTcys6eCjDkE3DypCjXi6QWRV6V1 Next, please find the decrypt software on your desktop, an executable file named "!WannaDecryptor!.exe". If it does not exsit, download the software from the address below. (You may need to disable your antivirus for a while.) rar password: wcry123 Run and follow the instructions! �

Wallets

15zGqZCTcys6eCjDkE3DypCjXi6QWRV6V1

Signatures

BadRabbit
Ransomware family discovered in late 2017, mainly targeting Russia and Ukraine.
ransomware badrabbit

Deletes NTFS Change Journal 2 TTPs 1 IoCs

The USN change journal is a persistent log of all changes made to local files used by Windows Server systems.

ransomware

Inhibit System Recovery

T1490

Data Destruction

T1485

pid	Process
3796	fsutil.exe

Mimikatz
mimikatz is an open source tool to dump credentials on Windows.
mimikatz
Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry

Clears Windows event logs 1 TTPs 4 IoCs

evasion ransomware

Indicator Removal on Host

T1070

pid	Process
3460	wevtutil.exe
2444	wevtutil.exe
3560	wevtutil.exe
4292	wevtutil.exe

Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

mimikatz is an open source tool to dump credentials on Windows 2 IoCs

resource	yara_rule
behavioral1/files/0x00080000000230ed-149.dat	mimikatz
behavioral1/files/0x00080000000230ed-150.dat	mimikatz

Blocklisted process makes network request 29 IoCs

flow	pid	Process
803	4960	rundll32.exe
832	4960	rundll32.exe
872	4960	rundll32.exe
902	4960	rundll32.exe
919	4960	rundll32.exe
948	4960	rundll32.exe
977	4960	rundll32.exe
1008	4960	rundll32.exe
1037	4960	rundll32.exe
1065	4960	rundll32.exe
1092	4960	rundll32.exe
1117	4960	rundll32.exe
1147	4960	rundll32.exe
1176	4960	rundll32.exe
1198	4960	rundll32.exe
1219	4960	rundll32.exe
1246	4960	rundll32.exe
1271	4960	rundll32.exe
1273	4960	rundll32.exe
1303	4960	rundll32.exe
1329	4960	rundll32.exe
1354	4960	rundll32.exe
1357	4960	rundll32.exe
1383	4960	rundll32.exe
1411	4960	rundll32.exe
1438	4960	rundll32.exe
1465	4960	rundll32.exe
1490	4960	rundll32.exe
1514	4960	rundll32.exe

Disables Task Manager via registry modification
evasion
Downloads MZ/PE file

Executes dropped EXE 10 IoCs

pid	Process
3304	BadRabbit.exe
4452	7954.tmp
1368	$uckyLocker.exe
3728	WannaCry.exe
4992	!WannaDecryptor!.exe
4512	!WannaDecryptor!.exe
3892	!WannaDecryptor!.exe
2068	!WannaDecryptor!.exe
4048	ChilledWindows.exe
1444	Hydra.exe

Modifies extensions of user files 12 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

description	ioc	Process
File created	C:\Users\Admin\Pictures\ConvertFromSync.raw.WCRYT	WannaCry.exe
File renamed	C:\Users\Admin\Pictures\ConvertFromSync.raw.WCRYT => C:\Users\Admin\Pictures\ConvertFromSync.raw.WCRY	WannaCry.exe
File created	C:\Users\Admin\Pictures\PopSubmit.png.WCRYT	WannaCry.exe
File created	C:\Users\Admin\Pictures\ResetStart.png.WCRYT	WannaCry.exe
File opened for modification	C:\Users\Admin\Pictures\SearchUndo.raw.WCRY	WannaCry.exe
File opened for modification	C:\Users\Admin\Pictures\ConvertFromSync.raw.WCRY	WannaCry.exe
File renamed	C:\Users\Admin\Pictures\PopSubmit.png.WCRYT => C:\Users\Admin\Pictures\PopSubmit.png.WCRY	WannaCry.exe
File opened for modification	C:\Users\Admin\Pictures\PopSubmit.png.WCRY	WannaCry.exe
File renamed	C:\Users\Admin\Pictures\ResetStart.png.WCRYT => C:\Users\Admin\Pictures\ResetStart.png.WCRY	WannaCry.exe
File opened for modification	C:\Users\Admin\Pictures\ResetStart.png.WCRY	WannaCry.exe
File created	C:\Users\Admin\Pictures\SearchUndo.raw.WCRYT	WannaCry.exe
File renamed	C:\Users\Admin\Pictures\SearchUndo.raw.WCRYT => C:\Users\Admin\Pictures\SearchUndo.raw.WCRY	WannaCry.exe

Drops startup file 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\~SD439A.tmp	WannaCry.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\~SD43B1.tmp	WannaCry.exe

Loads dropped DLL 1 IoCs

pid	Process
4960	rundll32.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Update Task Scheduler = "\"C:\\Users\\Admin\\Downloads\\WannaCry.exe\" /r"	WannaCry.exe

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\K:	ChilledWindows.exe
File opened (read-only)	\??\L:	ChilledWindows.exe
File opened (read-only)	\??\P:	ChilledWindows.exe
File opened (read-only)	\??\S:	ChilledWindows.exe
File opened (read-only)	\??\T:	ChilledWindows.exe
File opened (read-only)	\??\Z:	ChilledWindows.exe
File opened (read-only)	\??\A:	ChilledWindows.exe
File opened (read-only)	\??\I:	ChilledWindows.exe
File opened (read-only)	\??\N:	ChilledWindows.exe
File opened (read-only)	\??\U:	ChilledWindows.exe
File opened (read-only)	\??\E:	ChilledWindows.exe
File opened (read-only)	\??\F:	ChilledWindows.exe
File opened (read-only)	\??\G:	ChilledWindows.exe
File opened (read-only)	\??\H:	ChilledWindows.exe
File opened (read-only)	\??\J:	ChilledWindows.exe
File opened (read-only)	\??\M:	ChilledWindows.exe
File opened (read-only)	\??\V:	ChilledWindows.exe
File opened (read-only)	\??\X:	ChilledWindows.exe
File opened (read-only)	\??\Y:	ChilledWindows.exe
File opened (read-only)	\??\B:	ChilledWindows.exe
File opened (read-only)	\??\O:	ChilledWindows.exe
File opened (read-only)	\??\Q:	ChilledWindows.exe
File opened (read-only)	\??\R:	ChilledWindows.exe
File opened (read-only)	\??\W:	ChilledWindows.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Sets desktop wallpaper using registry 2 TTPs 2 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\!WannaCryptor!.bmp"	!WannaDecryptor!.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\Desktop\Wallpaper = "0"	$uckyLocker.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\infpub.dat	rundll32.exe
File created	C:\Windows\cscc.dat	rundll32.exe
File created	C:\Windows\dispci.exe	rundll32.exe
File opened for modification	C:\Windows\7954.tmp	rundll32.exe
File created	C:\Windows\infpub.dat	BadRabbit.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3960	4268	WerFault.exe	83

Checks processor information in registry 2 TTPs 10 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
4416	schtasks.exe
1880	schtasks.exe

Kills process with taskkill 4 IoCs

evasion

pid	Process
1984	taskkill.exe
932	taskkill.exe
1836	taskkill.exe
4016	taskkill.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "174"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2295526160-1155304984-640977766-1000\{F19B656F-8821-44BA-9D64-8C40A8142D87}	ChilledWindows.exe

NTFS ADS 7 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\WannaCry.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\MadMan.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\$uckyLocker(1).exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\ChilledWindows.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\Hydra.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\BadRabbit.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\$uckyLocker.exe:Zone.Identifier	firefox.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4960	rundll32.exe
4960	rundll32.exe
4960	rundll32.exe
4960	rundll32.exe
4452	7954.tmp
4452	7954.tmp
4452	7954.tmp
4452	7954.tmp
4452	7954.tmp
4452	7954.tmp

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2068	!WannaDecryptor!.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3288	firefox.exe
Token: SeDebugPrivilege	3288	firefox.exe
Token: SeDebugPrivilege	3288	firefox.exe
Token: SeDebugPrivilege	3288	firefox.exe
Token: SeDebugPrivilege	3288	firefox.exe
Token: SeDebugPrivilege	3288	firefox.exe
Token: SeDebugPrivilege	3288	firefox.exe
Token: SeShutdownPrivilege	4960	rundll32.exe
Token: SeDebugPrivilege	4960	rundll32.exe
Token: SeTcbPrivilege	4960	rundll32.exe
Token: SeDebugPrivilege	4452	7954.tmp
Token: SeDebugPrivilege	1984	taskkill.exe
Token: SeDebugPrivilege	932	taskkill.exe
Token: SeDebugPrivilege	4016	taskkill.exe
Token: SeDebugPrivilege	1836	taskkill.exe
Token: SeIncreaseQuotaPrivilege	3536	WMIC.exe
Token: SeSecurityPrivilege	3536	WMIC.exe
Token: SeTakeOwnershipPrivilege	3536	WMIC.exe
Token: SeLoadDriverPrivilege	3536	WMIC.exe
Token: SeSystemProfilePrivilege	3536	WMIC.exe
Token: SeSystemtimePrivilege	3536	WMIC.exe
Token: SeProfSingleProcessPrivilege	3536	WMIC.exe
Token: SeIncBasePriorityPrivilege	3536	WMIC.exe
Token: SeCreatePagefilePrivilege	3536	WMIC.exe
Token: SeBackupPrivilege	3536	WMIC.exe
Token: SeRestorePrivilege	3536	WMIC.exe
Token: SeShutdownPrivilege	3536	WMIC.exe
Token: SeDebugPrivilege	3536	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3536	WMIC.exe
Token: SeRemoteShutdownPrivilege	3536	WMIC.exe
Token: SeUndockPrivilege	3536	WMIC.exe
Token: SeManageVolumePrivilege	3536	WMIC.exe
Token: 33	3536	WMIC.exe
Token: 34	3536	WMIC.exe
Token: 35	3536	WMIC.exe
Token: 36	3536	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3536	WMIC.exe
Token: SeSecurityPrivilege	3536	WMIC.exe
Token: SeTakeOwnershipPrivilege	3536	WMIC.exe
Token: SeLoadDriverPrivilege	3536	WMIC.exe
Token: SeSystemProfilePrivilege	3536	WMIC.exe
Token: SeSystemtimePrivilege	3536	WMIC.exe
Token: SeProfSingleProcessPrivilege	3536	WMIC.exe
Token: SeIncBasePriorityPrivilege	3536	WMIC.exe
Token: SeCreatePagefilePrivilege	3536	WMIC.exe
Token: SeBackupPrivilege	3536	WMIC.exe
Token: SeRestorePrivilege	3536	WMIC.exe
Token: SeShutdownPrivilege	3536	WMIC.exe
Token: SeDebugPrivilege	3536	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3536	WMIC.exe
Token: SeRemoteShutdownPrivilege	3536	WMIC.exe
Token: SeUndockPrivilege	3536	WMIC.exe
Token: SeManageVolumePrivilege	3536	WMIC.exe
Token: 33	3536	WMIC.exe
Token: 34	3536	WMIC.exe
Token: 35	3536	WMIC.exe
Token: 36	3536	WMIC.exe
Token: SeBackupPrivilege	1532	vssvc.exe
Token: SeRestorePrivilege	1532	vssvc.exe
Token: SeAuditPrivilege	1532	vssvc.exe
Token: SeDebugPrivilege	180	firefox.exe
Token: SeDebugPrivilege	180	firefox.exe
Token: SeShutdownPrivilege	4048	ChilledWindows.exe
Token: SeCreatePagefilePrivilege	4048	ChilledWindows.exe

Suspicious use of FindShellTrayWindow 19 IoCs

pid	Process
3288	firefox.exe
3288	firefox.exe
3288	firefox.exe
3288	firefox.exe
3288	firefox.exe
3288	firefox.exe
180	firefox.exe
180	firefox.exe
180	firefox.exe
180	firefox.exe
180	firefox.exe
4048	ChilledWindows.exe
180	firefox.exe
180	firefox.exe
1444	Hydra.exe
2068	!WannaDecryptor!.exe
180	firefox.exe
180	firefox.exe
1444	Hydra.exe

Suspicious use of SendNotifyMessage 13 IoCs

pid	Process
3288	firefox.exe
3288	firefox.exe
3288	firefox.exe
3288	firefox.exe
3288	firefox.exe
180	firefox.exe
180	firefox.exe
180	firefox.exe
180	firefox.exe
180	firefox.exe
180	firefox.exe
180	firefox.exe
180	firefox.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
3288	firefox.exe
3288	firefox.exe
3288	firefox.exe
3288	firefox.exe
3288	firefox.exe
3288	firefox.exe
3288	firefox.exe
3288	firefox.exe
3288	firefox.exe
3288	firefox.exe
3288	firefox.exe
3288	firefox.exe
3288	firefox.exe
3288	firefox.exe
3288	firefox.exe
3288	firefox.exe
3288	firefox.exe
3288	firefox.exe
3288	firefox.exe
3288	firefox.exe
3288	firefox.exe
3288	firefox.exe
3288	firefox.exe
3288	firefox.exe
3288	firefox.exe
3288	firefox.exe
3288	firefox.exe
3288	firefox.exe
3288	firefox.exe
3288	firefox.exe
3288	firefox.exe
3288	firefox.exe
3288	firefox.exe
3288	firefox.exe
4992	!WannaDecryptor!.exe
4992	!WannaDecryptor!.exe
4512	!WannaDecryptor!.exe
4512	!WannaDecryptor!.exe
3892	!WannaDecryptor!.exe
3892	!WannaDecryptor!.exe
2068	!WannaDecryptor!.exe
2068	!WannaDecryptor!.exe
180	firefox.exe
180	firefox.exe
180	firefox.exe
180	firefox.exe
180	firefox.exe
180	firefox.exe
180	firefox.exe
180	firefox.exe
180	firefox.exe
180	firefox.exe
180	firefox.exe
180	firefox.exe
180	firefox.exe
180	firefox.exe
180	firefox.exe
180	firefox.exe
180	firefox.exe
180	firefox.exe
180	firefox.exe
180	firefox.exe
180	firefox.exe
180	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2036 wrote to memory of 3288	2036	firefox.exe	84
PID 2036 wrote to memory of 3288	2036	firefox.exe	84
PID 2036 wrote to memory of 3288	2036	firefox.exe	84
PID 2036 wrote to memory of 3288	2036	firefox.exe	84
PID 2036 wrote to memory of 3288	2036	firefox.exe	84
PID 2036 wrote to memory of 3288	2036	firefox.exe	84
PID 2036 wrote to memory of 3288	2036	firefox.exe	84
PID 2036 wrote to memory of 3288	2036	firefox.exe	84
PID 2036 wrote to memory of 3288	2036	firefox.exe	84
PID 3288 wrote to memory of 3484	3288	firefox.exe	86
PID 3288 wrote to memory of 3484	3288	firefox.exe	86
PID 3288 wrote to memory of 2316	3288	firefox.exe	89
PID 3288 wrote to memory of 2316	3288	firefox.exe	89
PID 3288 wrote to memory of 2316	3288	firefox.exe	89
PID 3288 wrote to memory of 2316	3288	firefox.exe	89
PID 3288 wrote to memory of 2316	3288	firefox.exe	89
PID 3288 wrote to memory of 2316	3288	firefox.exe	89
PID 3288 wrote to memory of 2316	3288	firefox.exe	89
PID 3288 wrote to memory of 2316	3288	firefox.exe	89
PID 3288 wrote to memory of 2316	3288	firefox.exe	89
PID 3288 wrote to memory of 2316	3288	firefox.exe	89
PID 3288 wrote to memory of 2316	3288	firefox.exe	89
PID 3288 wrote to memory of 2316	3288	firefox.exe	89
PID 3288 wrote to memory of 2316	3288	firefox.exe	89
PID 3288 wrote to memory of 2316	3288	firefox.exe	89
PID 3288 wrote to memory of 2316	3288	firefox.exe	89
PID 3288 wrote to memory of 2316	3288	firefox.exe	89
PID 3288 wrote to memory of 2316	3288	firefox.exe	89
PID 3288 wrote to memory of 2316	3288	firefox.exe	89
PID 3288 wrote to memory of 2316	3288	firefox.exe	89
PID 3288 wrote to memory of 2316	3288	firefox.exe	89
PID 3288 wrote to memory of 2316	3288	firefox.exe	89
PID 3288 wrote to memory of 2316	3288	firefox.exe	89
PID 3288 wrote to memory of 2316	3288	firefox.exe	89
PID 3288 wrote to memory of 2316	3288	firefox.exe	89
PID 3288 wrote to memory of 2316	3288	firefox.exe	89
PID 3288 wrote to memory of 2316	3288	firefox.exe	89
PID 3288 wrote to memory of 2316	3288	firefox.exe	89
PID 3288 wrote to memory of 2316	3288	firefox.exe	89
PID 3288 wrote to memory of 2316	3288	firefox.exe	89
PID 3288 wrote to memory of 2316	3288	firefox.exe	89
PID 3288 wrote to memory of 2316	3288	firefox.exe	89
PID 3288 wrote to memory of 2316	3288	firefox.exe	89
PID 3288 wrote to memory of 2316	3288	firefox.exe	89
PID 3288 wrote to memory of 2316	3288	firefox.exe	89
PID 3288 wrote to memory of 2316	3288	firefox.exe	89
PID 3288 wrote to memory of 2316	3288	firefox.exe	89
PID 3288 wrote to memory of 2316	3288	firefox.exe	89
PID 3288 wrote to memory of 2316	3288	firefox.exe	89
PID 3288 wrote to memory of 2316	3288	firefox.exe	89
PID 3288 wrote to memory of 2316	3288	firefox.exe	89
PID 3288 wrote to memory of 2316	3288	firefox.exe	89
PID 3288 wrote to memory of 2316	3288	firefox.exe	89
PID 3288 wrote to memory of 2316	3288	firefox.exe	89
PID 3288 wrote to memory of 640	3288	firefox.exe	90
PID 3288 wrote to memory of 640	3288	firefox.exe	90
PID 3288 wrote to memory of 640	3288	firefox.exe	90
PID 3288 wrote to memory of 640	3288	firefox.exe	90
PID 3288 wrote to memory of 640	3288	firefox.exe	90
PID 3288 wrote to memory of 640	3288	firefox.exe	90
PID 3288 wrote to memory of 640	3288	firefox.exe	90
PID 3288 wrote to memory of 640	3288	firefox.exe	90
PID 3288 wrote to memory of 640	3288	firefox.exe	90
PID 3288 wrote to memory of 640	3288	firefox.exe	90

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" https://github.com/
1⤵
- Suspicious use of WriteProcessMemory
PID:2036
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" https://github.com/
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3288
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3288.0.1357492285\962761544" -parentBuildID 20200403170909 -prefsHandle 1700 -prefMapHandle 1692 -prefsLen 1 -prefMapSize 220117 -appdir "C:\Program Files\Mozilla Firefox\browser" - 3288 "\\.\pipe\gecko-crash-server-pipe.3288" 1780 gpu
    3⤵
    PID:3484
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3288.3.818958552\1960093183" -childID 1 -isForBrowser -prefsHandle 2264 -prefMapHandle 2496 -prefsLen 78 -prefMapSize 220117 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 3288 "\\.\pipe\gecko-crash-server-pipe.3288" 2268 tab
    3⤵
    PID:2316
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3288.13.1276490897\389916340" -childID 2 -isForBrowser -prefsHandle 3648 -prefMapHandle 3644 -prefsLen 6860 -prefMapSize 220117 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 3288 "\\.\pipe\gecko-crash-server-pipe.3288" 3664 tab
    3⤵
    PID:640

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 476 -p 4268 -ip 4268
1⤵
PID:4784

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 4268 -s 1760
1⤵
- Program crash
PID:3960

C:\Users\Admin\Downloads\BadRabbit.exe
"C:\Users\Admin\Downloads\BadRabbit.exe"
1⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3304
- C:\Windows\SysWOW64\rundll32.exe
  C:\Windows\system32\rundll32.exe C:\Windows\infpub.dat,#1 15
  2⤵
  - Blocklisted process makes network request
  - Loads dropped DLL
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4960
- - C:\Windows\SysWOW64\cmd.exe
    /c schtasks /Delete /F /TN rhaegal
    3⤵
    PID:2372
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /Delete /F /TN rhaegal
      4⤵
      PID:1548
- - C:\Windows\SysWOW64\cmd.exe
    /c schtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR "C:\Windows\system32\cmd.exe /C Start \"\" \"C:\Windows\dispci.exe\" -id 4268354038 && exit"
    3⤵
    PID:2740
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR "C:\Windows\system32\cmd.exe /C Start \"\" \"C:\Windows\dispci.exe\" -id 4268354038 && exit"
      4⤵
      Creates scheduled task(s)
      PID:1880
- - C:\Windows\SysWOW64\cmd.exe
    /c schtasks /Create /SC once /TN drogon /RU SYSTEM /TR "C:\Windows\system32\shutdown.exe /r /t 0 /f" /ST 05:23:00
    3⤵
    PID:1140
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /Create /SC once /TN drogon /RU SYSTEM /TR "C:\Windows\system32\shutdown.exe /r /t 0 /f" /ST 05:23:00
      4⤵
      Creates scheduled task(s)
      PID:4416
- - C:\Windows\7954.tmp
    "C:\Windows\7954.tmp" \\.\pipe\{FDBE051B-8CCB-47CC-B44C-6F01FEC190B4}
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4452
- - C:\Windows\SysWOW64\cmd.exe
    /c wevtutil cl Setup & wevtutil cl System & wevtutil cl Security & wevtutil cl Application & fsutil usn deletejournal /D C:
    3⤵
    PID:4632
  - - C:\Windows\SysWOW64\wevtutil.exe
      wevtutil cl Setup
      4⤵
      Clears Windows event logs
      PID:3460
  - - C:\Windows\SysWOW64\wevtutil.exe
      wevtutil cl System
      4⤵
      Clears Windows event logs
      PID:2444
  - - C:\Windows\SysWOW64\wevtutil.exe
      wevtutil cl Security
      4⤵
      Clears Windows event logs
      PID:3560
  - - C:\Windows\SysWOW64\wevtutil.exe
      wevtutil cl Application
      4⤵
      Clears Windows event logs
      PID:4292
  - - C:\Windows\SysWOW64\fsutil.exe
      fsutil usn deletejournal /D C:
      4⤵
      Deletes NTFS Change Journal
      PID:3796
- - C:\Windows\SysWOW64\cmd.exe
    /c schtasks /Delete /F /TN drogon
    3⤵
    PID:1244
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /Delete /F /TN drogon
      4⤵
      PID:3204

C:\Users\Admin\Downloads\$uckyLocker.exe
"C:\Users\Admin\Downloads\$uckyLocker.exe"
1⤵
- Executes dropped EXE
- Sets desktop wallpaper using registry
PID:1368

C:\Users\Admin\Downloads\WannaCry.exe
"C:\Users\Admin\Downloads\WannaCry.exe"
1⤵
- Executes dropped EXE
- Modifies extensions of user files
- Drops startup file
- Adds Run key to start application
PID:3728
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c 120831661144761.bat
  2⤵
  PID:1528
- - C:\Windows\SysWOW64\cscript.exe
    cscript //nologo c.vbs
    3⤵
    PID:3400
- C:\Users\Admin\Downloads\!WannaDecryptor!.exe
  !WannaDecryptor!.exe f
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4992
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im MSExchange*
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1984
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im sqlserver.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:932
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im Microsoft.Exchange.*
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1836
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im sqlwriter.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4016
- C:\Users\Admin\Downloads\!WannaDecryptor!.exe
  !WannaDecryptor!.exe c
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4512
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c start /b !WannaDecryptor!.exe v
  2⤵
  PID:2948
- - C:\Users\Admin\Downloads\!WannaDecryptor!.exe
    !WannaDecryptor!.exe v
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3892
  - - C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
      4⤵
      PID:3384
    - - C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        wmic shadowcopy delete
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3536
- C:\Users\Admin\Downloads\!WannaDecryptor!.exe
  !WannaDecryptor!.exe
  2⤵
  - Executes dropped EXE
  - Sets desktop wallpaper using registry
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  PID:2068

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1532

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:4252
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:180
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="180.0.877712430\1781629116" -parentBuildID 20200403170909 -prefsHandle 1612 -prefMapHandle 1600 -prefsLen 1 -prefMapSize 222298 -appdir "C:\Program Files\Mozilla Firefox\browser" - 180 "\\.\pipe\gecko-crash-server-pipe.180" 1696 gpu
    3⤵
    PID:4584
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="180.3.366513062\243345612" -childID 1 -isForBrowser -prefsHandle 2448 -prefMapHandle 1416 -prefsLen 452 -prefMapSize 222298 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 180 "\\.\pipe\gecko-crash-server-pipe.180" 2552 tab
    3⤵
    PID:2552
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="180.13.179171235\5250191" -childID 2 -isForBrowser -prefsHandle 3716 -prefMapHandle 3712 -prefsLen 6608 -prefMapSize 222298 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 180 "\\.\pipe\gecko-crash-server-pipe.180" 3760 tab
    3⤵
    PID:4092

C:\Users\Admin\Downloads\ChilledWindows.exe
"C:\Users\Admin\Downloads\ChilledWindows.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4048

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4f4 0x304
1⤵
PID:1256

C:\Users\Admin\Downloads\Hydra.exe
"C:\Users\Admin\Downloads\Hydra.exe"
1⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
PID:1444

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /7
1⤵
PID:4276

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa38d4055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
PID:1436

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

File Deletion

T1107

Indicator Removal on Host

T1070

Modify Registry

T1112

Web Service

T1102

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Data Destruction

T1485

Defacement

T1491

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_48.db.WCRY

Filesize
312B

MD5
b39e88eda61c81ed04bac5d7cf9179de

SHA1
3ca32a85a7b0b9c22a988c2f5ba7fba43f3eade2

SHA256
4d9eb8fb291c8194b0b3570ebad5188452be451ac74f1e6b83ade7b415eea672

SHA512
866da14825036e5b1d8069c22f36d7ce194a8e1dc826e730ccb47a4976c652ba02ac165c95ac60da1e21db582cdb09bb7dca29777aff4daac3580aa79b682336

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\0fx48ci0.default-release\cache2\entries\84A5EAC46BD04E39D369CEFA91172BD9A892410B

Filesize
14KB

MD5
81649a822f4b36ebfa0988add01e5f2a

SHA1
441112ba556b2fcfc3e2a08c5d73c3ddbc9a76fd

SHA256
490df7666b32bd7147a1375755142c0d3c48a58076136879cdecc992a775efa0

SHA512
8899a8413774a4eb19b1c53d912c72394e5a0070f18184e1a0af03c8fe151afb4ba1017482673feded53ca33d25950894165db7a2532a60b7b0d821444b83f71

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\0fx48ci0.default-release\cache2\index

Filesize
20KB

MD5
07a921ee6b3592ed6973208a7f720c0a

SHA1
e118cce347924d1e36fca199799b2d8c078c1285

SHA256
5b3a6b3296ae28eb82bfc100db7aba86cbce7b7de37cc30d05853c31fdd93648

SHA512
afe5ecf86c1c94363676a6ecb4aef90600ea1d67d761533118af8761996143c70ea935dd992f22167c0b1eb01fdb63522be5b4e7f99e811474f29adbfd1bf78b

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\0fx48ci0.default-release\cache2\index.log

Filesize
7KB

MD5
6481899e6c31da87edb53e06ba9327de

SHA1
eb63e8e2c56907d14f522be2b00641239f875705

SHA256
ff46db6c7479f7b9f2b3f73e4cdaa973bb17a17761bc731f50608322ccb08aad

SHA512
4974e995fe586844e033210223a2f3e269b40d7a65731ba0940b0603dae8171b871df5f15e5d2827c71330521f991d7a1ce2eb1c1218ee0918dd6283cccc2b7b

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\0fx48ci0.default-release\startupCache\scriptCache-child.bin

Filesize
665KB

MD5
ff1cd0db5c196089298093f5432c4d41

SHA1
a07f46b5e31839f86adb8b6b27b8c8c99063393f

SHA256
87967b75e9e3e81065cbb9c275f3e41c8f2686279673d7ff4871cedf7c52d270

SHA512
d29a25acb78090d3887fb109e82c66548baef00f3f3d4eab697c18cafbdce2d05c1d9e45b6c54b29e7aeb5bd9919250eb842b3eebeca4fec49bd87c5c9b668c0

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\0fx48ci0.default-release\startupCache\scriptCache.bin

Filesize
6.7MB

MD5
f44163eac2dbd32078ec8aa42c543907

SHA1
f40385e1b25141a0ef3f23f2edd3c43b07bedb3d

SHA256
f5c661f4146b474d2940f645425cfccea47964a55b82302ffcfbbf10fdd63d0f

SHA512
becdb9db853e4a0e0f3bc8e96204f9c5846c010141ec450122fd31ff1c7115762cac25f750da98c81b3158ca7c1b363ea39f9b1a73531fdca223d7a74a309795

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\0fx48ci0.default-release\startupCache\startupCache.8.little

Filesize
2.2MB

MD5
ddcb8f7c663422dfd0efcef98fb39295

SHA1
3abc36c4502465eae35e3c8ef44fb0721d0eec09

SHA256
086aea5b5b171640650d9361def2c4b7811c6e2628011535f34e2694a7bcb432

SHA512
4d058ab266659b110e400526d034f3790a1afc2c3ac8847ece059514ec0bab3919252aa87e90e637762bfe29e4fbdc4dbc21bdf3183270966e31014fbd8c3b02

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\0fx48ci0.default-release\startupCache\urlCache.bin

Filesize
2KB

MD5
9224e6b2836feec159b8751f47db053d

SHA1
c2a8d7a37c81920a4de3be392971b462c22acb35

SHA256
0189ab39596388981a1c2d22cd0dc4201e23fe2b3b03b592eebf850c86a34d34

SHA512
f7203cda909a9bfe04176643c1bf5dfbf0e5ff68d72c2ab2b7ea9df8d2f0f06da8593d7c832f4d08b14c6f4e820603e647218ed20c7f4c6a32c4ae4025724732

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\0fx48ci0.default-release\thumbnails\513a2fe403a179cd13970f0e76bdc69e.png

Filesize
7KB

MD5
a21f6c30563aed7296fb3486f6c90e57

SHA1
5147c6cd4331e0fee2042a1e9db2c1ba0e0cf87d

SHA256
c384b9361a7cee0bc389d9a10243f500edf7ad8600a2ef2cc99d4a3a1c97f9ff

SHA512
364f9051a47f2b14ffc12b5c59dce7afd54257af98c7bf65ff2d2f9e1b0eea2da88915e22de5e32497e840ac1a0047392d82e0a50c0cd0e27780a1c607c37888

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\0fx48ci0.default-release\thumbnails\8c2490024829f09848d01b8bd4478e71.png

Filesize
75KB

MD5
37a415ca9e5ce2d6fe939bc9a714bfb6

SHA1
be428c6db88b6d904b081a9c290ea975bacea41c

SHA256
3e7a15e865a97f5aaa8be94407fc8eca4b5b9660856d5ba287554dc76141cdc4

SHA512
b894c5ed6abbfbc47fe1908e81e31dfc7209f99a8d8a987eb1196d1c2a5b676d237296459bf147b5acbff51673a5e8c9b0538e7f12af8288092e070dd4465911

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0fx48ci0.default-release\SiteSecurityServiceState.txt

Filesize
937B

MD5
bb7af8be2edca21b92dfbada1d8e1521

SHA1
4856975a21a89440246dab5a79f085cc1178ba07

SHA256
3b389ce133b9d51d1cfa99fadb607dca3f8ae3d9feeca91c6c2fdf71fbec51ab

SHA512
0947d978e116a3e56c133c36ff0263a3ff3acfe0b6ca85a82557dd50d6ef5b2ac86e8e515f0eab1ca01ec3e542421ac0a2a6510589f8e4142884b61522663629

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0fx48ci0.default-release\SiteSecurityServiceState.txt

Filesize
1KB

MD5
1dac0e9cc23f53ccbd0091a4a7f78b70

SHA1
bb12e0b099f567b5348e3cd68c498356177643fd

SHA256
b46976fdd52e0000a7e3e9fa601bc3807636c4d7fa7b87d6210430adf818a58c

SHA512
b95ea2fd836034f33bd135323a4a7d556ac6d7669cf634493a6a058c5b0edaf13e66b87e86155789f001200b9466a655e1ec59d9c445189ae1a8b3057f9d930f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0fx48ci0.default-release\addonStartup.json.lz4

Filesize
1KB

MD5
bc4bd0071af0574fe57b6756f0b26071

SHA1
dfc6af6b87b58391f67679a24c28495503f9e75d

SHA256
2f0cb964330decccb1375985d126d6cd2fec171e344cdd6e21026fa9459d8ad3

SHA512
9cd3f9140a3beca18114253556281c48e0a2401d8e7bb01b518a0615caf6a1f4a8cece627c00caaf9cb3f7cf3a57a224ec5233682b5b3f8e933619b85488551d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0fx48ci0.default-release\cert9.db

Filesize
224KB

MD5
375c69171909e2bd636e5f22a47db9f0

SHA1
abea2b74240ab2877841f471ebc181982cae4050

SHA256
dde23798bc9630ed81b1c43b8fd0f5be2f3ffea852e03c296343252ef8cacc46

SHA512
8d14a84d6c6ee31e2d9c0d268189dd9d1bd92f92a90f3e869a735b38ffd4fbc4a40a6bcae8de6bfddc70121f8c8a4be21ec9e7813db18114ee86dfc059d109fd

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0fx48ci0.default-release\cookies.sqlite

Filesize
512KB

MD5
9f231be914d0cc5bba5e53b1f9102445

SHA1
bd1ed0b55165de8bc5fbc6d5c67814bec4c6e227

SHA256
85c8e62302f78220ed1d72c78ee468432d7e75b8d4c22965c6f57702c56ea711

SHA512
9b8d93ca4a0fc80002b4e095c198db6b59164db97965286942929533b1415a5086dd1bc2f9846309511680cfff70267a717015a3d08981f6493617aefbdb7141

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0fx48ci0.default-release\extensions.json

Filesize
38KB

MD5
97e972617b4d87cfabe9f3fed76df9e3

SHA1
a4aaa1342d171ac48e4e93d3180733e2d691bcee

SHA256
64ac43480620c3f272e4ed9f5acca1c1cbae79b22f4ecde36e3d379605a93474

SHA512
972a31199f6aae96c9c208651843ad7c6b24f3fbcbb0e992126ec2e4d06a8881d374a2df1e4da9a4bab4706b14a9b25c56905ee496a7769e3a6d74808db22503

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0fx48ci0.default-release\favicons.sqlite

Filesize
5.0MB

MD5
9848cbcf1256af89eaf95605c8481534

SHA1
00d8c6440851b2a577a20de30f96eac865ae9a31

SHA256
6f3819e7bf16ad332a24c5907b5ece1bf66f49133e84c16557de576c17c6fb06

SHA512
f2f36aa55061994b5bb99b74f972f388f5d1854134442cda3e9a9869e46d3d6ec596a3ca3dc812082a6eee00769b63e944081c957b6b8b01c74996de965da424

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0fx48ci0.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info

Filesize
116B

MD5
3d33cdc0b3d281e67dd52e14435dd04f

SHA1
4db88689282fd4f9e9e6ab95fcbb23df6e6485db

SHA256
f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b

SHA512
a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0fx48ci0.default-release\gmp-widevinecdm\4.10.1582.2\LICENSE.txt

Filesize
479B

MD5
49ddb419d96dceb9069018535fb2e2fc

SHA1
62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

SHA256
2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

SHA512
48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0fx48ci0.default-release\gmp-widevinecdm\4.10.1582.2\manifest.json

Filesize
373B

MD5
69236425227c0bd3e5c21034285822e8

SHA1
2dd63dd2c47e00a536fade01d3a7cea26c2305ec

SHA256
e328dfab8c729a9398506cc3e29fcc0342f72298d54f476f33c9b352e84c10b7

SHA512
738b0bbbfa01b2fe8b987026860c22f3593d19d605a76683161cc5c18237440344dce0c16ba07b80953ab03885f06efa2d96a334461ee7acda76506df6a22ae9

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0fx48ci0.default-release\permissions.sqlite

Filesize
96KB

MD5
1af68b1937889054cf7c026150501272

SHA1
5269cd4cf24d8633609f1c430b3e433da7c12fe5

SHA256
0fcd294b25806718fe95aeee80e7ab46f6f3b438172fdbe5da5ec898c78ab386

SHA512
e2bcbdb68a1ff2dacf9b2656572976a9032f276b8199a65a9b45dd26b33b003d7ac1694ed1562baecbdb1c2a421aebc5a33ad987471fc814fc7b4f7f66825058

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0fx48ci0.default-release\places.sqlite

Filesize
5.0MB

MD5
583afdb48f550434d7a5de702152e8d5

SHA1
3e57951b0307596e1e4ccc4dee3c3a8ce6d00878

SHA256
8f62a3116c2d8b087419325cdcd960c3d3e96049b010704643d3a3d5c3e9d4a3

SHA512
2a654e3b49af5ef4e86f6bb858f0ffa1521013a32a1c301c969c59df64340b51aac31d30775789425ff6335f838a96c54374d0e2aed3d926661e47999d4a99a5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0fx48ci0.default-release\prefs.js

Filesize
9KB

MD5
603051d8cc6ea86f61f12d678fba109e

SHA1
bbfb4a71ed528e66e4496ea2f4db6691afb3cc46

SHA256
fc47e983f31f32199e59e10c140ee858572360defa2fd215bb141126dc46b97d

SHA512
a598232c08ca653b1eeef4a86d702b9b8a849a435d890530f2c1559c9af8a6823a9c253153e82f8188718ab5aa4ac81a075ea187d5f5d3ab4dd18e38a51fdc32

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0fx48ci0.default-release\prefs.js

Filesize
9KB

MD5
c77e3448a99c6c58f374e2bb48c81277

SHA1
72fc9ae11e05bf0a916e899ae8ee30b2b952aa68

SHA256
4e54a2eea2145a9df16b6716aca7a99794393345cdd62966dc99d8418374be47

SHA512
23528e34da1acd0c624f2528e8531adebc528ece586c04b96300dee352ea259a7a1a4c353e2031ec079ff06f393964bc61141b02085af0cc8b65ac3f52d65dcb

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0fx48ci0.default-release\search.json.mozlz4

Filesize
2KB

MD5
050765a1861ca36e6962c6f940576426

SHA1
0e70c3bd064eed1cc0fd4f7db21a0b40749e093d

SHA256
b51f79d1401c356509a9d6fe9d212384292640466a492b45158577e0aec1f31d

SHA512
022b6e062eb1095abf1d5a288f6ee3c22ce2556f62524c9a977c8058c9e98e7713b16612f6d505cb52ebbaeee5f17b567965527403b3fa8491926ccec6cfb81d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0fx48ci0.default-release\security_state\data.safe.bin

Filesize
759KB

MD5
5b26f2458d98b150aed0f1b28c05c27f

SHA1
d777deeff592cae972151aee7f75c13b1982228f

SHA256
60f4fe67eb201ecbbdaf9d0200e61eb90b6dfc2321773b3757ad4b6a261f92db

SHA512
a4d8cc76ab9450ccaeebb0e3317c456f9b86bcfccd81ae4a5399fc2083285a76df235df3a0161d6bf6db251e9d6dcb312ec308ad832d60fae08e0d29b597e520

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0fx48ci0.default-release\sessionCheckpoints.json

Filesize
288B

MD5
948a7403e323297c6bb8a5c791b42866

SHA1
88a555717e8a4a33eccfb7d47a2a4aa31038f9c0

SHA256
2fca1f29b73dd5b4159fa1eb16e69276482f5224ba7d2219a547039129a51f0e

SHA512
17e2f65c33f47c8bb4beca31db2aff3d4bbb6c2d36924057f9f847e207bdcb85ffcbb32c80dd06862ffc9b7f0bd3f5e2e65b48bb1bc3363732751101d5596b1a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0fx48ci0.default-release\sessionstore.jsonlz4

Filesize
16KB

MD5
5f06fc647e0adfe3352a4bd07f8875ff

SHA1
498973146901e6c815fb0a77eaafbd04244e7a87

SHA256
99c83f212e4ac1f61cc3d9f0ff8d175d3847dbbd59b76bf174c1a6f915615915

SHA512
f2ff32328f5ed21f0bacf7509ee59f524f2e23ed1a860df69fc928b3139eb559d9020c47437cb9e9029f6df4c678b09701157f1a7538c667fd1baa3b085ab179

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0fx48ci0.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite

Filesize
72KB

MD5
ba13f2a9361ce577ed0bab8f07f04503

SHA1
30f25fe512dc46587563186c2b646c6972148927

SHA256
b33f399d3143b560f11133e468caafb46b3ddf6536cb40d32a86378d4f27542d

SHA512
b560f24b3ff35470502c70362f3d385dce5607e12b8ca02f5d9853673a43fdb6679a04c99c207b1108bda76f9391c10a256717320e0958097e7a96c36b1af732

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0fx48ci0.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
12.8MB

MD5
3a9df32e1a0b52ab00ad9a47cd82027f

SHA1
b855ba5d4c706e176c04346a98a519925d750407

SHA256
605db7c7910ee792df7e7b5c580624c43bd609f29b5c4550b0d970a754dac65d

SHA512
d15914476ad9b0ac4ff98858eea84d392903432f79c1248ea7ee20470be768c335b10d7094b16bfa2d6c1f17b80ef644120e4d2496bd13fcf6c4228da78f4537

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0fx48ci0.default-release\webappsstore.sqlite

Filesize
96KB

MD5
b4b4e80b101df3c612a5057b979a63ac

SHA1
381007162f3e69df8db9f43241b0075a75dc6abd

SHA256
3d18b25c3f50d3db012559218df182653eabbff88d25ada09b4dd72df7836b6d

SHA512
35dcd0d235aabc325dc45521d48084b9beab803cbba1cd821ac0e9bbd386e0ce965a1b0d33523f973946e90fa77a70c8484bc2b54b1c6b084e535d0c9c66bf34

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0fx48ci0.default-release\xulstore.json

Filesize
141B

MD5
1995825c748914809df775643764920f

SHA1
55c55d77bb712d2d831996344f0a1b3e0b7ff98a

SHA256
87835b1bd7d0934f997ef51c977349809551d47e32c3c9224899359ae0fce776

SHA512
c311970610d836550a07feb47bd0774fd728130d0660cbada2d2d68f2fcfbe84e85404d7f5b8ab0f71a6c947561dcffa95df2782a712f4dcb7230ea8ba01c34c

Download Submit
C:\Users\Admin\Desktop\READ_IT.txt

Filesize
108B

MD5
d845190db42d07b1f4a34292d8f335c7

SHA1
fa97f5c6d4aa832a0a1451730e8ba2a32b2f9339

SHA256
6bd70f8e5afcaf2bac76a5e40649be7ad4d59fb10d37e4f18ed3b1027b714b9a

SHA512
9d9310f6885084665a54cba5c33ce55d2de89978b82d59c70746f1e9ca2abdd094713e562f802f5e723654824ab872b9ab453cb32e279b5960edc196f683a08c

Download Submit
C:\Users\Admin\Downloads\!WannaDecryptor!.exe

Filesize
236KB

MD5
cf1416074cd7791ab80a18f9e7e219d9

SHA1
276d2ec82c518d887a8a3608e51c56fa28716ded

SHA256
78e3f87f31688355c0f398317b2d87d803bd87ee3656c5a7c80f0561ec8606df

SHA512
0bb0843a90edacaf1407e6a7273a9fbb896701635e4d9467392b7350ad25a1bec0c1ceef36737b4af5e5841936f4891436eded0533aa3d74c9a54efa42f024c5

Download Submit
C:\Users\Admin\Downloads\!WannaDecryptor!.exe

Filesize
236KB

MD5
cf1416074cd7791ab80a18f9e7e219d9

SHA1
276d2ec82c518d887a8a3608e51c56fa28716ded

SHA256
78e3f87f31688355c0f398317b2d87d803bd87ee3656c5a7c80f0561ec8606df

SHA512
0bb0843a90edacaf1407e6a7273a9fbb896701635e4d9467392b7350ad25a1bec0c1ceef36737b4af5e5841936f4891436eded0533aa3d74c9a54efa42f024c5

Download Submit
C:\Users\Admin\Downloads\!WannaDecryptor!.exe

Filesize
236KB

MD5
cf1416074cd7791ab80a18f9e7e219d9

SHA1
276d2ec82c518d887a8a3608e51c56fa28716ded

SHA256
78e3f87f31688355c0f398317b2d87d803bd87ee3656c5a7c80f0561ec8606df

SHA512
0bb0843a90edacaf1407e6a7273a9fbb896701635e4d9467392b7350ad25a1bec0c1ceef36737b4af5e5841936f4891436eded0533aa3d74c9a54efa42f024c5

Download Submit
C:\Users\Admin\Downloads\!WannaDecryptor!.exe

Filesize
236KB

MD5
cf1416074cd7791ab80a18f9e7e219d9

SHA1
276d2ec82c518d887a8a3608e51c56fa28716ded

SHA256
78e3f87f31688355c0f398317b2d87d803bd87ee3656c5a7c80f0561ec8606df

SHA512
0bb0843a90edacaf1407e6a7273a9fbb896701635e4d9467392b7350ad25a1bec0c1ceef36737b4af5e5841936f4891436eded0533aa3d74c9a54efa42f024c5

Download Submit
C:\Users\Admin\Downloads\!WannaDecryptor!.exe

Filesize
236KB

MD5
cf1416074cd7791ab80a18f9e7e219d9

SHA1
276d2ec82c518d887a8a3608e51c56fa28716ded

SHA256
78e3f87f31688355c0f398317b2d87d803bd87ee3656c5a7c80f0561ec8606df

SHA512
0bb0843a90edacaf1407e6a7273a9fbb896701635e4d9467392b7350ad25a1bec0c1ceef36737b4af5e5841936f4891436eded0533aa3d74c9a54efa42f024c5

Download Submit
C:\Users\Admin\Downloads\!WannaDecryptor!.exe.lnk

Filesize
590B

MD5
2621ed06a063a3079c4feca79d485cfe

SHA1
e37fee5f625804e00a8c7202f81556edffcbf3cb

SHA256
b0b8e7f0b8e2d5e6840847a8bfe067a6bc5ab9f265a38cb048322944fb38451c

SHA512
85372f492f0b5d7f542bc2a33a643da680295f977af04f00a2a0bca89eae8d3b4129cb73ed682ede933a5beb6627a1b1e0ec6c6dc8bb2433efa6cab51a2e7d3d

Download Submit
C:\Users\Admin\Downloads\$uckyLocker.exe

Filesize
414KB

MD5
c850f942ccf6e45230169cc4bd9eb5c8

SHA1
51c647e2b150e781bd1910cac4061a2cee1daf89

SHA256
86e0eac8c5ce70c4b839ef18af5231b5f92e292b81e440193cdbdc7ed108049f

SHA512
2b3890241b8c8690aab0aed347daa778aba20f29f76e8b79b02953b6252324317520b91ea60d3ef73e42ad403f7a6e0e3f2a057799f21ed447dae7096b2f47d9

Download Submit
C:\Users\Admin\Downloads\$uckyLocker.exe

Filesize
414KB

MD5
c850f942ccf6e45230169cc4bd9eb5c8

SHA1
51c647e2b150e781bd1910cac4061a2cee1daf89

SHA256
86e0eac8c5ce70c4b839ef18af5231b5f92e292b81e440193cdbdc7ed108049f

SHA512
2b3890241b8c8690aab0aed347daa778aba20f29f76e8b79b02953b6252324317520b91ea60d3ef73e42ad403f7a6e0e3f2a057799f21ed447dae7096b2f47d9

Download Submit
C:\Users\Admin\Downloads\00000000.res

Filesize
136B

MD5
64ef2d895527c91a8db2e12d0f1e10be

SHA1
8a6ac98ba6ed2cb4e68d590a38b651fa410ef13d

SHA256
d75fa3fc37a888d47ea35fb8071e0598960a5594e025903b1bb18085697ad2f3

SHA512
2134c349924465edbba53be8fb35096579493fee87b84f6abcac891e9a49c79e19c5d17eac5298578d6a1741177d8e6a47204017a7e2ff0b452ca4fc3ce977df

Download Submit
C:\Users\Admin\Downloads\00000000.res

Filesize
136B

MD5
becaa58f406c3024af284c37dfc121df

SHA1
e2aaa6aa93c9d51b3b08ef4443736e2092407c11

SHA256
99e442cea7a82953b86b418665dac1f483b6deb93964a43189346f9ffcb21cd1

SHA512
9a3a783ae5c834a199d7d09e11319379acd30da96928ac865b48be36202b82815a22c48433653e64d4da88c1f547d4de0c1cb712efb4f035293c680f0feb00b8

Download Submit
C:\Users\Admin\Downloads\00000000.res

Filesize
136B

MD5
50f975833d9a5bd1caaf390b61596f78

SHA1
b4c9fe441b813870a382cc0ec842b39c150e29c5

SHA256
3226508d903bbab3f08855ba4440333171b3de469242e0b27eefa43342e2a967

SHA512
120019e9f3f07c7f6ec9c42760fda0e89401c5084f850e8d27b8599df13fb1bac12279349e7435e96c4b8b0f5e5599f8e7498f5be107401b6c2c8a785af971a4

Download Submit
C:\Users\Admin\Downloads\00000000.res

Filesize
136B

MD5
9b7e1a6ed0aa42d0ca1443a702740bd1

SHA1
6a3e258740258a1d203418d259224b096722f480

SHA256
4234bf959481af2680540367bf466f997438c23d352d40418f00b60d4a4e95e8

SHA512
528d64d48710ffed912d124f890d337e87a4a51b789180f5183b970ec5b11a0d616a297e4fa4821876ea3537a124d4b35c8c66a7822a7cc48d95c8b08b84d797

Download Submit
C:\Users\Admin\Downloads\00000000.res

Filesize
136B

MD5
078dabd8e51365474bb9d56e33fd92e6

SHA1
65aeaaa81bdf062e6c28cfc1031d48b180cde41d

SHA256
989fa9e3cdc4689a1bab2ea25a84944bdbd124cb6ab10f69612e19acd3a08655

SHA512
07db5b0767de37f4e5016d154e31e5c3be9d8c0353f159c895b3bf5535646b0dff1c5f420f753021c8a6e2980833de8aa67e3d7eeaa3db3c5faf9d8b945eb0ca

Download Submit
C:\Users\Admin\Downloads\00000000.res

Filesize
136B

MD5
c0dcbe5b1261ea4797cfd69bb73feeb5

SHA1
90d19f2862415aab8504c52b99ef3acbc2a55e71

SHA256
d370f05d29823d236937771af3452990e7736ddfbea8e0523be7b5b9fd848806

SHA512
3857033fbf6163a788944a3f88cde1440204b6a68e1e511d5b319f74e7e463680493e64f4819fdcccfb2c8637ef45e118383d503816f03db77a31c0e71924a58

Download Submit
C:\Users\Admin\Downloads\120831661144761.bat

Filesize
318B

MD5
a261428b490a45438c0d55781a9c6e75

SHA1
e9eefce11cefcbb7e5168bfb8de8a3c3ac45c41e

SHA256
4288d655b7de7537d7ea13fdeb1ba19760bcaf04384cd68619d9e5edb5e31f44

SHA512
304887938520ffcc6966da83596ccc8688b7eace9572982c224f3fb9c59e6fb2dcaa021a19d2aae47346e954c0d0d8145c723b7143dece11ac7261dc41ba3d40

Download Submit
C:\Users\Admin\Downloads\BadRabbit.exe

Filesize
431KB

MD5
fbbdc39af1139aebba4da004475e8839

SHA1
de5c8d858e6e41da715dca1c019df0bfb92d32c0

SHA256
630325cac09ac3fab908f903e3b00d0dadd5fdaa0875ed8496fcbb97a558d0da

SHA512
74eca8c01de215b33d5ceea1fda3f3bef96b513f58a750dba04b0de36f7ef4f7846a6431d52879ca0d8641bfd504d4721a9a96fa2e18c6888fd67fa77686af87

Download Submit
C:\Users\Admin\Downloads\BadRabbit.exe

Filesize
431KB

MD5
fbbdc39af1139aebba4da004475e8839

SHA1
de5c8d858e6e41da715dca1c019df0bfb92d32c0

SHA256
630325cac09ac3fab908f903e3b00d0dadd5fdaa0875ed8496fcbb97a558d0da

SHA512
74eca8c01de215b33d5ceea1fda3f3bef96b513f58a750dba04b0de36f7ef4f7846a6431d52879ca0d8641bfd504d4721a9a96fa2e18c6888fd67fa77686af87

Download Submit
C:\Users\Admin\Downloads\WannaCry.exe

Filesize
224KB

MD5
5c7fb0927db37372da25f270708103a2

SHA1
120ed9279d85cbfa56e5b7779ffa7162074f7a29

SHA256
be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844

SHA512
a15f97fad744ccf5f620e5aabb81f48507327b898a9aa4287051464019e0f89224c484e9691812e166471af9beaddcfc3deb2ba878658761f4800663beef7206

Download Submit
C:\Users\Admin\Downloads\WannaCry.exe

Filesize
224KB

MD5
5c7fb0927db37372da25f270708103a2

SHA1
120ed9279d85cbfa56e5b7779ffa7162074f7a29

SHA256
be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844

SHA512
a15f97fad744ccf5f620e5aabb81f48507327b898a9aa4287051464019e0f89224c484e9691812e166471af9beaddcfc3deb2ba878658761f4800663beef7206

Download Submit
C:\Users\Admin\Downloads\c.vbs

Filesize
201B

MD5
02b937ceef5da308c5689fcdb3fb12e9

SHA1
fa5490ea513c1b0ee01038c18cb641a51f459507

SHA256
5d57b86aeb52be824875008a6444daf919717408ec45aff4640b5e64610666f1

SHA512
843eeae13ac5fdc216b14e40534543c283ecb2b6c31503aba2d25ddd215df19105892e43cf618848742de9c13687d21e8c834eff3f2b69a26df2509a6f992653

Download Submit
C:\Users\Admin\Downloads\c.wry

Filesize
628B

MD5
ac0e4ff6830e756d6bc71463a25cce90

SHA1
12fbee23fceace45080bedc89756561bd15d3dff

SHA256
c2d4692a7b1cdab8206eddd486f0cbf1474af413c88e4f365ae6c7d5cff02311

SHA512
958e476f03d1e7ae67b7121017411ea14e476172ed57eb00a4e2686be0eb9900433ee5dfd44e36c0f74e47fa5601c984448be7d13b7e979d542308371a2d3b89

Download Submit
C:\Users\Admin\Downloads\c.wry

Filesize
628B

MD5
ac0e4ff6830e756d6bc71463a25cce90

SHA1
12fbee23fceace45080bedc89756561bd15d3dff

SHA256
c2d4692a7b1cdab8206eddd486f0cbf1474af413c88e4f365ae6c7d5cff02311

SHA512
958e476f03d1e7ae67b7121017411ea14e476172ed57eb00a4e2686be0eb9900433ee5dfd44e36c0f74e47fa5601c984448be7d13b7e979d542308371a2d3b89

Download Submit
C:\Users\Admin\Downloads\f.wry

Filesize
79B

MD5
d209e8e2fc42bc210f691b49ce1c6fca

SHA1
4e6eb4a8b414ab128be047b78e913d230609412a

SHA256
6bd8f3d28253da4e72b3a7525f6af5b667799493685bd7bc1eb4712437219bcb

SHA512
8f6fbecece7cbf2ffc5dfe589b25f415ede4a7ed6f12ba8a166259b9e5051f15000b63b383a6b223ad942e9ac08ad0022f33756470adb2cafcd06e01bcb72af5

Download Submit
C:\Users\Admin\Downloads\m.wry

Filesize
42KB

MD5
980b08bac152aff3f9b0136b616affa5

SHA1
2a9c9601ea038f790cc29379c79407356a3d25a3

SHA256
402046ada270528c9ac38bbfa0152836fe30fb8e12192354e53b8397421430d9

SHA512
100cda1f795781042b012498afd783fd6ff03b0068dbd07b2c2e163cd95e6c6e00755ce16b02b017693c9febc149ed02df9df9b607e2b9cca4b07e5bd420f496

Download Submit
C:\Windows\7954.tmp

Filesize
60KB

MD5
347ac3b6b791054de3e5720a7144a977

SHA1
413eba3973a15c1a6429d9f170f3e8287f98c21c

SHA256
301b905eb98d8d6bb559c04bbda26628a942b2c4107c07a02e8f753bdcfe347c

SHA512
9a399916bc681964af1e1061bc0a8e2926307642557539ad587ce6f9b5ef93bdf1820fe5d7b5ffe5f0bb38e5b4dc6add213ba04048c0c7c264646375fcd01787

Download Submit
C:\Windows\7954.tmp

Filesize
60KB

MD5
347ac3b6b791054de3e5720a7144a977

SHA1
413eba3973a15c1a6429d9f170f3e8287f98c21c

SHA256
301b905eb98d8d6bb559c04bbda26628a942b2c4107c07a02e8f753bdcfe347c

SHA512
9a399916bc681964af1e1061bc0a8e2926307642557539ad587ce6f9b5ef93bdf1820fe5d7b5ffe5f0bb38e5b4dc6add213ba04048c0c7c264646375fcd01787

Download Submit
C:\Windows\infpub.dat

Filesize
401KB

MD5
1d724f95c61f1055f0d02c2154bbccd3

SHA1
79116fe99f2b421c52ef64097f0f39b815b20907

SHA256
579fd8a0385482fb4c789561a30b09f25671e86422f40ef5cca2036b28f99648

SHA512
f2d7b018d1516df1c97cfff5507957c75c6d9bf8e2ce52ae0052706f4ec62f13eba6d7be17e6ad2b693fdd58e1fd091c37f17bd2b948cdcd9b95b4ad428c0113

Download Submit
C:\Windows\infpub.dat

Filesize
401KB

MD5
1d724f95c61f1055f0d02c2154bbccd3

SHA1
79116fe99f2b421c52ef64097f0f39b815b20907

SHA256
579fd8a0385482fb4c789561a30b09f25671e86422f40ef5cca2036b28f99648

SHA512
f2d7b018d1516df1c97cfff5507957c75c6d9bf8e2ce52ae0052706f4ec62f13eba6d7be17e6ad2b693fdd58e1fd091c37f17bd2b948cdcd9b95b4ad428c0113

Download Submit
memory/1368-155-0x0000000000E00000-0x0000000000E6E000-memory.dmp

Filesize
440KB

Download
memory/1368-156-0x0000000005D70000-0x0000000006314000-memory.dmp

Filesize
5.6MB

Download
memory/1368-157-0x00000000056C0000-0x0000000005752000-memory.dmp

Filesize
584KB

Download
memory/1368-158-0x0000000005770000-0x000000000577A000-memory.dmp

Filesize
40KB

Download
memory/1444-236-0x0000000000BE0000-0x0000000000BF0000-memory.dmp

Filesize
64KB

Download
memory/3728-161-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download
memory/4048-231-0x000000001C090000-0x000000001C098000-memory.dmp

Filesize
32KB

Download
memory/4048-232-0x000000001C8F0000-0x000000001C928000-memory.dmp

Filesize
224KB

Download
memory/4048-233-0x000000001C8C0000-0x000000001C8CE000-memory.dmp

Filesize
56KB

Download
memory/4048-234-0x00007FFE99090000-0x00007FFE99B51000-memory.dmp

Filesize
10.8MB

Download
memory/4048-235-0x00007FFE99090000-0x00007FFE99B51000-memory.dmp

Filesize
10.8MB

Download
memory/4048-230-0x00007FFE99090000-0x00007FFE99B51000-memory.dmp

Filesize
10.8MB

Download
memory/4048-229-0x0000000000F10000-0x0000000001374000-memory.dmp

Filesize
4.4MB

Download
memory/4960-137-0x00000000015C0000-0x0000000001628000-memory.dmp

Filesize
416KB

Download
memory/4960-143-0x00000000015C0000-0x0000000001628000-memory.dmp

Filesize
416KB

Download

Analysis

Sharing

Errors

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads