badrabbit | hxxp://yaatde[.]com/r2[.]php?e=HVy1fQlxedMIqIi9uocLtH49fjI1V2RsM0JCaTZuVS80WTFzaHBiaC9XYmdIeWpkMzlqQ2lhbm91eUYzVGthOEgrN1Z5VG5lZkxXR0dQS0JDTDJ3Y0R0MTY0dHVnSlhjTkthVVQ2Q3RQZXVIRUZSRmYrSW1qbmJGTnN2WERkZG5xN0lGVE5yNjFuZXpsVXpMZ2JQVzUyell2L3RlZFlCYmpxQklkV2o4T2w1MXk2cEloSGZ4TERQdUwzUHFOcjlURmE0QW96dHY1TEF2ZHI2YVpIOVo0UnIySWhpVlFNSjBFQlE5angrZWtieDI1dGZ4VHo4bHpqVkU3UGt4Wm52QWQzUndyVDB3WkhqQnY3VHRkeFRNZ2wza3dTMmZIRGJ4L1hJcGJXYzlTU0dhUzJManExQldFWDZtQWZVVHJUOHpkLzJUWWtWeHU0TU5sVks3eFhBYzFFZUpDa2JXNmd3bEVVY05QYmRMb0tXZmRtdG1ORFBmQ3FYclNrK0VaM1RMTmk5aFVaZjlHSk1mSUJCTHNEa1A4WXpjUWUrU0lsNTEwM3NMN2x3aGxRdjNROGhkaElOMGZzVVluQlBrcFZSOFl5N0Ixci9Zam9lb3d0Nk1PNnJNRExQaTNodUhzdkxKLzh2TTRmRFB2bU9JbnFDRUpyUC9iaVdicTUvVVdma1pQUWlZMFg1TUdhSWhHNDk3TFdya1REZjNTMkxFNUJuVUJMSjd2ZHhhMGpLblhsK1BLV0hpY0VINVF5UFEzb2x6MmFsL3ozRkJ4ODVtMk5ZeGZ0SWFYZDZ1OHhHUUFDdnQzbVZhdHZYOFU1bk84SkwvSUxHWDErZS9GMlNKdTVWUEJIZjNRTmZnQzV3c3p4ZHlJZWUreUVLbnZvb1hKYjJlWUg5VS92UkEyc0RYL3lWb0tQeGlUcWgrRWVNREJpbldmODNSNnpNV3BaRG0vOVVYSW05eVRCODV4eEkwN280UWNReVBxQllRUnFEMmQ3aGl5SGVWMGNmU0RmaVozZzFpWXRPbUdIdG5Odmx0Wm9sS0VFOWFPbzJML1E4bk9JMGlZV2s1YWZtYU1PNmR1SXYvQlRTYUxMMTFwdXkzaHBhTUJqUUNWNFhYak5uQlRtSkdpTWlQejZqa1Z2cUZGTDArVlpGbXpnVUd0WXRVNk9pcjVHOVpyT29SNXNJRHRjdkNoSDUzNUJBRnE0T3NmckUwd1pxUnIxcXh2dDdNcC9mcWhFQUNST1lJbWJtYjBTdHFlMSs5ZDlmYjh4blFLM21HSGFJT2NJV3FneDNiandkWjk4UA%3D%3D

Analysis

max time kernel
360s
max time network
364s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
01-02-2024 04:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://yaatde.com/r2.php?e=HVy1fQlxedMIqIi9uocLtH49fjI1V2RsM0JCaTZuVS80WTFzaHBiaC9XYmdIeWpkMzlqQ2lhbm91eUYzVGthOEgrN1Z5VG5lZkxXR0dQS0JDTDJ3Y0R0MTY0dHVnSlhjTkthVVQ2Q3RQZXVIRUZSRmYrSW1qbmJGTnN2WERkZG5xN0lGVE5yNjFuZXpsVXpMZ2JQVzUyell2L3RlZFlCYmpxQklkV2o4T2w1MXk2cEloSGZ4TERQdUwzUHFOcjlURmE0QW96dHY1TEF2ZHI2YVpIOVo0UnIySWhpVlFNSjBFQlE5angrZWtieDI1dGZ4VHo4bHpqVkU3UGt4Wm52QWQzUndyVDB3WkhqQnY3VHRkeFRNZ2wza3dTMmZIRGJ4L1hJcGJXYzlTU0dhUzJManExQldFWDZtQWZVVHJUOHpkLzJUWWtWeHU0TU5sVks3eFhBYzFFZUpDa2JXNmd3bEVVY05QYmRMb0tXZmRtdG1ORFBmQ3FYclNrK0VaM1RMTmk5aFVaZjlHSk1mSUJCTHNEa1A4WXpjUWUrU0lsNTEwM3NMN2x3aGxRdjNROGhkaElOMGZzVVluQlBrcFZSOFl5N0Ixci9Zam9lb3d0Nk1PNnJNRExQaTNodUhzdkxKLzh2TTRmRFB2bU9JbnFDRUpyUC9iaVdicTUvVVdma1pQUWlZMFg1TUdhSWhHNDk3TFdya1REZjNTMkxFNUJuVUJMSjd2ZHhhMGpLblhsK1BLV0hpY0VINVF5UFEzb2x6MmFsL3ozRkJ4ODVtMk5ZeGZ0SWFYZDZ1OHhHUUFDdnQzbVZhdHZYOFU1bk84SkwvSUxHWDErZS9GMlNKdTVWUEJIZjNRTmZnQzV3c3p4ZHlJZWUreUVLbnZvb1hKYjJlWUg5VS92UkEyc0RYL3lWb0tQeGlUcWgrRWVNREJpbldmODNSNnpNV3BaRG0vOVVYSW05eVRCODV4eEkwN280UWNReVBxQllRUnFEMmQ3aGl5SGVWMGNmU0RmaVozZzFpWXRPbUdIdG5Odmx0Wm9sS0VFOWFPbzJML1E4bk9JMGlZV2s1YWZtYU1PNmR1SXYvQlRTYUxMMTFwdXkzaHBhTUJqUUNWNFhYak5uQlRtSkdpTWlQejZqa1Z2cUZGTDArVlpGbXpnVUd0WXRVNk9pcjVHOVpyT29SNXNJRHRjdkNoSDUzNUJBRnE0T3NmckUwd1pxUnIxcXh2dDdNcC9mcWhFQUNST1lJbWJtYjBTdHFlMSs5ZDlmYjh4blFLM21HSGFJT2NJV3FneDNiandkWjk4UA%3D%3D

Score

10^/10

badrabbit mimikatz ransomware

Malware Config

Signatures

BadRabbit
Ransomware family discovered in late 2017, mainly targeting Russia and Ukraine.
ransomware badrabbit
Mimikatz
mimikatz is an open source tool to dump credentials on Windows.
mimikatz

mimikatz is an open source tool to dump credentials on Windows 1 IoCs

resource	yara_rule
behavioral1/files/0x000200000001ea2f-1310.dat	mimikatz

Executes dropped EXE 1 IoCs

pid	Process
4388	684.tmp

Loads dropped DLL 1 IoCs

pid	Process
684	rundll32.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
334	raw.githubusercontent.com
335	raw.githubusercontent.com
316	camo.githubusercontent.com

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\cscc.dat	rundll32.exe
File created	C:\Windows\dispci.exe	rundll32.exe
File opened for modification	C:\Windows\684.tmp	rundll32.exe
File created	C:\Windows\infpub.dat	[email protected]
File opened for modification	C:\Windows\infpub.dat	rundll32.exe

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
1496	schtasks.exe
524	schtasks.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 29 IoCs

pid	Process
3560	msedge.exe
3560	msedge.exe
4824	msedge.exe
4824	msedge.exe
4004	identity_helper.exe
4004	identity_helper.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4388	msedge.exe
4388	msedge.exe
4044	msedge.exe
4044	msedge.exe
2572	msedge.exe
2572	msedge.exe
684	rundll32.exe
684	rundll32.exe
684	rundll32.exe
684	rundll32.exe
4388	684.tmp
4388	684.tmp
4388	684.tmp
4388	684.tmp
4388	684.tmp
4388	684.tmp
4388	684.tmp
2500	msedge.exe
2500	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 40 IoCs

pid	Process
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeShutdownPrivilege	684	rundll32.exe
Token: SeDebugPrivilege	684	rundll32.exe
Token: SeTcbPrivilege	684	rundll32.exe
Token: SeDebugPrivilege	4388	684.tmp
Token: SeRestorePrivilege	4168	7zG.exe
Token: 35	4168	7zG.exe
Token: SeSecurityPrivilege	4168	7zG.exe
Token: SeSecurityPrivilege	4168	7zG.exe

Suspicious use of FindShellTrayWindow 62 IoCs

pid	Process
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4168	7zG.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe

Suspicious use of SendNotifyMessage 28 IoCs

pid	Process
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2636	[email protected]

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4824 wrote to memory of 5036	4824	msedge.exe	84
PID 4824 wrote to memory of 5036	4824	msedge.exe	84
PID 4824 wrote to memory of 5048	4824	msedge.exe	86
PID 4824 wrote to memory of 5048	4824	msedge.exe	86
PID 4824 wrote to memory of 5048	4824	msedge.exe	86
PID 4824 wrote to memory of 5048	4824	msedge.exe	86
PID 4824 wrote to memory of 5048	4824	msedge.exe	86
PID 4824 wrote to memory of 5048	4824	msedge.exe	86
PID 4824 wrote to memory of 5048	4824	msedge.exe	86
PID 4824 wrote to memory of 5048	4824	msedge.exe	86
PID 4824 wrote to memory of 5048	4824	msedge.exe	86
PID 4824 wrote to memory of 5048	4824	msedge.exe	86
PID 4824 wrote to memory of 5048	4824	msedge.exe	86
PID 4824 wrote to memory of 5048	4824	msedge.exe	86
PID 4824 wrote to memory of 5048	4824	msedge.exe	86
PID 4824 wrote to memory of 5048	4824	msedge.exe	86
PID 4824 wrote to memory of 5048	4824	msedge.exe	86
PID 4824 wrote to memory of 5048	4824	msedge.exe	86
PID 4824 wrote to memory of 5048	4824	msedge.exe	86
PID 4824 wrote to memory of 5048	4824	msedge.exe	86
PID 4824 wrote to memory of 5048	4824	msedge.exe	86
PID 4824 wrote to memory of 5048	4824	msedge.exe	86
PID 4824 wrote to memory of 5048	4824	msedge.exe	86
PID 4824 wrote to memory of 5048	4824	msedge.exe	86
PID 4824 wrote to memory of 5048	4824	msedge.exe	86
PID 4824 wrote to memory of 5048	4824	msedge.exe	86
PID 4824 wrote to memory of 5048	4824	msedge.exe	86
PID 4824 wrote to memory of 5048	4824	msedge.exe	86
PID 4824 wrote to memory of 5048	4824	msedge.exe	86
PID 4824 wrote to memory of 5048	4824	msedge.exe	86
PID 4824 wrote to memory of 5048	4824	msedge.exe	86
PID 4824 wrote to memory of 5048	4824	msedge.exe	86
PID 4824 wrote to memory of 5048	4824	msedge.exe	86
PID 4824 wrote to memory of 5048	4824	msedge.exe	86
PID 4824 wrote to memory of 5048	4824	msedge.exe	86
PID 4824 wrote to memory of 5048	4824	msedge.exe	86
PID 4824 wrote to memory of 5048	4824	msedge.exe	86
PID 4824 wrote to memory of 5048	4824	msedge.exe	86
PID 4824 wrote to memory of 5048	4824	msedge.exe	86
PID 4824 wrote to memory of 5048	4824	msedge.exe	86
PID 4824 wrote to memory of 5048	4824	msedge.exe	86
PID 4824 wrote to memory of 5048	4824	msedge.exe	86
PID 4824 wrote to memory of 3560	4824	msedge.exe	85
PID 4824 wrote to memory of 3560	4824	msedge.exe	85
PID 4824 wrote to memory of 4912	4824	msedge.exe	87
PID 4824 wrote to memory of 4912	4824	msedge.exe	87
PID 4824 wrote to memory of 4912	4824	msedge.exe	87
PID 4824 wrote to memory of 4912	4824	msedge.exe	87
PID 4824 wrote to memory of 4912	4824	msedge.exe	87
PID 4824 wrote to memory of 4912	4824	msedge.exe	87
PID 4824 wrote to memory of 4912	4824	msedge.exe	87
PID 4824 wrote to memory of 4912	4824	msedge.exe	87
PID 4824 wrote to memory of 4912	4824	msedge.exe	87
PID 4824 wrote to memory of 4912	4824	msedge.exe	87
PID 4824 wrote to memory of 4912	4824	msedge.exe	87
PID 4824 wrote to memory of 4912	4824	msedge.exe	87
PID 4824 wrote to memory of 4912	4824	msedge.exe	87
PID 4824 wrote to memory of 4912	4824	msedge.exe	87
PID 4824 wrote to memory of 4912	4824	msedge.exe	87
PID 4824 wrote to memory of 4912	4824	msedge.exe	87
PID 4824 wrote to memory of 4912	4824	msedge.exe	87
PID 4824 wrote to memory of 4912	4824	msedge.exe	87
PID 4824 wrote to memory of 4912	4824	msedge.exe	87
PID 4824 wrote to memory of 4912	4824	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://yaatde.com/r2.php?e=HVy1fQlxedMIqIi9uocLtH49fjI1V2RsM0JCaTZuVS80WTFzaHBiaC9XYmdIeWpkMzlqQ2lhbm91eUYzVGthOEgrN1Z5VG5lZkxXR0dQS0JDTDJ3Y0R0MTY0dHVnSlhjTkthVVQ2Q3RQZXVIRUZSRmYrSW1qbmJGTnN2WERkZG5xN0lGVE5yNjFuZXpsVXpMZ2JQVzUyell2L3RlZFlCYmpxQklkV2o4T2w1MXk2cEloSGZ4TERQdUwzUHFOcjlURmE0QW96dHY1TEF2ZHI2YVpIOVo0UnIySWhpVlFNSjBFQlE5angrZWtieDI1dGZ4VHo4bHpqVkU3UGt4Wm52QWQzUndyVDB3WkhqQnY3VHRkeFRNZ2wza3dTMmZIRGJ4L1hJcGJXYzlTU0dhUzJManExQldFWDZtQWZVVHJUOHpkLzJUWWtWeHU0TU5sVks3eFhBYzFFZUpDa2JXNmd3bEVVY05QYmRMb0tXZmRtdG1ORFBmQ3FYclNrK0VaM1RMTmk5aFVaZjlHSk1mSUJCTHNEa1A4WXpjUWUrU0lsNTEwM3NMN2x3aGxRdjNROGhkaElOMGZzVVluQlBrcFZSOFl5N0Ixci9Zam9lb3d0Nk1PNnJNRExQaTNodUhzdkxKLzh2TTRmRFB2bU9JbnFDRUpyUC9iaVdicTUvVVdma1pQUWlZMFg1TUdhSWhHNDk3TFdya1REZjNTMkxFNUJuVUJMSjd2ZHhhMGpLblhsK1BLV0hpY0VINVF5UFEzb2x6MmFsL3ozRkJ4ODVtMk5ZeGZ0SWFYZDZ1OHhHUUFDdnQzbVZhdHZYOFU1bk84SkwvSUxHWDErZS9GMlNKdTVWUEJIZjNRTmZnQzV3c3p4ZHlJZWUreUVLbnZvb1hKYjJlWUg5VS92UkEyc0RYL3lWb0tQeGlUcWgrRWVNREJpbldmODNSNnpNV3BaRG0vOVVYSW05eVRCODV4eEkwN280UWNReVBxQllRUnFEMmQ3aGl5SGVWMGNmU0RmaVozZzFpWXRPbUdIdG5Odmx0Wm9sS0VFOWFPbzJML1E4bk9JMGlZV2s1YWZtYU1PNmR1SXYvQlRTYUxMMTFwdXkzaHBhTUJqUUNWNFhYak5uQlRtSkdpTWlQejZqa1Z2cUZGTDArVlpGbXpnVUd0WXRVNk9pcjVHOVpyT29SNXNJRHRjdkNoSDUzNUJBRnE0T3NmckUwd1pxUnIxcXh2dDdNcC9mcWhFQUNST1lJbWJtYjBTdHFlMSs5ZDlmYjh4blFLM21HSGFJT2NJV3FneDNiandkWjk4UA%3D%3D
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe07a846f8,0x7ffe07a84708,0x7ffe07a84718
  2⤵
  PID:5036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2160,11542504645171359411,5275503839244278065,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2252 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,11542504645171359411,5275503839244278065,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2208 /prefetch:2
  2⤵
  PID:5048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2160,11542504645171359411,5275503839244278065,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2796 /prefetch:8
  2⤵
  PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,11542504645171359411,5275503839244278065,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:1828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,11542504645171359411,5275503839244278065,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:4004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,11542504645171359411,5275503839244278065,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4668 /prefetch:1
  2⤵
  PID:5064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,11542504645171359411,5275503839244278065,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5340 /prefetch:1
  2⤵
  PID:4544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,11542504645171359411,5275503839244278065,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4728 /prefetch:1
  2⤵
  PID:2956
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,11542504645171359411,5275503839244278065,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5860 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4004
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,11542504645171359411,5275503839244278065,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5860 /prefetch:8
  2⤵
  PID:616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,11542504645171359411,5275503839244278065,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3444 /prefetch:1
  2⤵
  PID:4052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,11542504645171359411,5275503839244278065,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5468 /prefetch:1
  2⤵
  PID:3248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,11542504645171359411,5275503839244278065,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3452 /prefetch:1
  2⤵
  PID:1432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,11542504645171359411,5275503839244278065,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6108 /prefetch:1
  2⤵
  PID:4540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,11542504645171359411,5275503839244278065,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6124 /prefetch:1
  2⤵
  PID:4464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,11542504645171359411,5275503839244278065,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5576 /prefetch:1
  2⤵
  PID:2840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,11542504645171359411,5275503839244278065,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5612 /prefetch:1
  2⤵
  PID:3596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,11542504645171359411,5275503839244278065,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3584 /prefetch:1
  2⤵
  PID:4280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2160,11542504645171359411,5275503839244278065,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=2032 /prefetch:8
  2⤵
  PID:4696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,11542504645171359411,5275503839244278065,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5336 /prefetch:1
  2⤵
  PID:2244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,11542504645171359411,5275503839244278065,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6504 /prefetch:1
  2⤵
  PID:3064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,11542504645171359411,5275503839244278065,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6528 /prefetch:1
  2⤵
  PID:3820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,11542504645171359411,5275503839244278065,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6252 /prefetch:1
  2⤵
  PID:3184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,11542504645171359411,5275503839244278065,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6276 /prefetch:1
  2⤵
  PID:3844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,11542504645171359411,5275503839244278065,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5924 /prefetch:1
  2⤵
  PID:3044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,11542504645171359411,5275503839244278065,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6280 /prefetch:1
  2⤵
  PID:2248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,11542504645171359411,5275503839244278065,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3800 /prefetch:1
  2⤵
  PID:844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,11542504645171359411,5275503839244278065,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5696 /prefetch:1
  2⤵
  PID:4536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,11542504645171359411,5275503839244278065,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6728 /prefetch:1
  2⤵
  PID:3248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2160,11542504645171359411,5275503839244278065,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6220 /prefetch:8
  2⤵
  PID:2444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,11542504645171359411,5275503839244278065,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6560 /prefetch:1
  2⤵
  PID:3820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,11542504645171359411,5275503839244278065,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6604 /prefetch:1
  2⤵
  PID:2484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,11542504645171359411,5275503839244278065,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4820 /prefetch:1
  2⤵
  PID:4464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,11542504645171359411,5275503839244278065,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6528 /prefetch:1
  2⤵
  PID:1968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,11542504645171359411,5275503839244278065,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6872 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,11542504645171359411,5275503839244278065,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3572 /prefetch:1
  2⤵
  PID:2552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,11542504645171359411,5275503839244278065,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7128 /prefetch:1
  2⤵
  PID:552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,11542504645171359411,5275503839244278065,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5244 /prefetch:1
  2⤵
  PID:3248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,11542504645171359411,5275503839244278065,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6536 /prefetch:1
  2⤵
  PID:2472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,11542504645171359411,5275503839244278065,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5444 /prefetch:1
  2⤵
  PID:3844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,11542504645171359411,5275503839244278065,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6896 /prefetch:1
  2⤵
  PID:4536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,11542504645171359411,5275503839244278065,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7152 /prefetch:1
  2⤵
  PID:4800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,11542504645171359411,5275503839244278065,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6240 /prefetch:1
  2⤵
  PID:1856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,11542504645171359411,5275503839244278065,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5704 /prefetch:1
  2⤵
  PID:1880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2160,11542504645171359411,5275503839244278065,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=1764 /prefetch:8
  2⤵
  PID:372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,11542504645171359411,5275503839244278065,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5596 /prefetch:1
  2⤵
  PID:3388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2160,11542504645171359411,5275503839244278065,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5292 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2160,11542504645171359411,5275503839244278065,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3768 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,11542504645171359411,5275503839244278065,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6428 /prefetch:1
  2⤵
  PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2160,11542504645171359411,5275503839244278065,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5292 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,11542504645171359411,5275503839244278065,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3572 /prefetch:1
  2⤵
  PID:4744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2160,11542504645171359411,5275503839244278065,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4884 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,11542504645171359411,5275503839244278065,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1688 /prefetch:1
  2⤵
  PID:3492

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3248

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2932

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1644

C:\Users\Admin\AppData\Local\Temp\Temp1_BadRabbit.zip\[email protected]
"C:\Users\Admin\AppData\Local\Temp\Temp1_BadRabbit.zip\[email protected]"
1⤵
- Drops file in Windows directory
PID:492
- C:\Windows\SysWOW64\rundll32.exe
  C:\Windows\system32\rundll32.exe C:\Windows\infpub.dat,#1 15
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:684
- - C:\Windows\SysWOW64\cmd.exe
    /c schtasks /Delete /F /TN rhaegal
    3⤵
    PID:2732
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /Delete /F /TN rhaegal
      4⤵
      PID:5068
- - C:\Windows\SysWOW64\cmd.exe
    /c schtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR "C:\Windows\system32\cmd.exe /C Start \"\" \"C:\Windows\dispci.exe\" -id 434786614 && exit"
    3⤵
    PID:932
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR "C:\Windows\system32\cmd.exe /C Start \"\" \"C:\Windows\dispci.exe\" -id 434786614 && exit"
      4⤵
      Creates scheduled task(s)
      PID:1496
- - C:\Windows\SysWOW64\cmd.exe
    /c schtasks /Create /SC once /TN drogon /RU SYSTEM /TR "C:\Windows\system32\shutdown.exe /r /t 0 /f" /ST 05:09:00
    3⤵
    PID:1224
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /Create /SC once /TN drogon /RU SYSTEM /TR "C:\Windows\system32\shutdown.exe /r /t 0 /f" /ST 05:09:00
      4⤵
      Creates scheduled task(s)
      PID:524
- - C:\Windows\684.tmp
    "C:\Windows\684.tmp" \\.\pipe\{08986BE6-889F-4285-BB11-1DA07A0DD63B}
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4388

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\" -an -ai#7zMap29003:72:7zEvent9328
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4168

C:\Users\Admin\AppData\Local\Temp\Temp1_MEMZ.zip\[email protected]
"C:\Users\Admin\AppData\Local\Temp\Temp1_MEMZ.zip\[email protected]"
1⤵
- Suspicious use of SetWindowsHookEx
PID:2636
- C:\Users\Admin\AppData\Local\Temp\Temp1_MEMZ.zip\[email protected]
  "C:\Users\Admin\AppData\Local\Temp\Temp1_MEMZ.zip\[email protected]" /watchdog
  2⤵
  PID:3824
- C:\Users\Admin\AppData\Local\Temp\Temp1_MEMZ.zip\[email protected]
  "C:\Users\Admin\AppData\Local\Temp\Temp1_MEMZ.zip\[email protected]" /watchdog
  2⤵
  PID:3892
- C:\Users\Admin\AppData\Local\Temp\Temp1_MEMZ.zip\[email protected]
  "C:\Users\Admin\AppData\Local\Temp\Temp1_MEMZ.zip\[email protected]" /watchdog
  2⤵
  PID:1412
- C:\Users\Admin\AppData\Local\Temp\Temp1_MEMZ.zip\[email protected]
  "C:\Users\Admin\AppData\Local\Temp\Temp1_MEMZ.zip\[email protected]" /watchdog
  2⤵
  PID:688
- C:\Users\Admin\AppData\Local\Temp\Temp1_MEMZ.zip\[email protected]
  "C:\Users\Admin\AppData\Local\Temp\Temp1_MEMZ.zip\[email protected]" /watchdog
  2⤵
  PID:560

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
eb20b5930f48aa090358398afb25b683

SHA1
4892c8b72aa16c5b3f1b72811bf32b89f2d13392

SHA256
2695ab23c2b43aa257f44b6943b6a56b395ea77dc24e5a9bd16acc2578168a35

SHA512
d0c6012a0059bc1bb49b2f293e6c07019153e0faf833961f646a85b992b47896092f33fdccc893334c79f452218d1542e339ded3f1b69bd8e343d232e6c3d9e8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001c

Filesize
193KB

MD5
7fe2c36271aa8065b034ce9efdbd2a07

SHA1
e22ee654cb122d0d62393dd8d6753d2bcad148a3

SHA256
02cf672988303d8fbdbc7625f54596ece6d83c78152ca6e1aa332fc8c75d5c34

SHA512
45d53a09ced29138e2f99e0e8a293322050f8032e006df06315ac9af2f1ab64d1c767ea5db53289bb5881a4866061299e5a60cd83753fe6ba88e8de7562706ec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
fe1c9e2fd0f2ff4459b160c757ebf601

SHA1
0cf0fdb7ea6a4a40bb27165629020c08787a13c4

SHA256
3bfac23f92459066fb2bdb2bc98b3d7dd8e54b550dc694242eabea4c63e7edfd

SHA512
00faace62ffb68e9cf8ead22468635c61e90016143a8b39ca1f3a4cf7079fd728ee231914783a13161066e4d0e4e8cc4740beb01145e03f42ae2884c2b757e6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
1c4b9af1d9bc4b5781a5878a0e547923

SHA1
ebcda7cbf8c1e6908ce0b860aa5c37870a87d198

SHA256
c27ed29d5c4953cef1bf041499767edfca814a25d53dc9f16c0dc0bc86784d70

SHA512
4315380663e3631e3c7b70b7e790030e350f7d8fc85c7a8c90824d1bc5aaf95b51571af9adb5ba477279e2b93d48600370c12ab1ff9cee51c7fa9d304eab64d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
302e03f7501df8a93ad6e5ce916e9bee

SHA1
24443587a000b7454042f864f84ea365123dadc0

SHA256
d0ab6f4414a5b36052da03907239c097ab1056d5ed4c578b4bc348f3e8446e8e

SHA512
3c748a2ff18c5202c0052eea96fc27db6ce91adb67f2fe493710f91c483c32512b74df7676780dce2e320fd20ffba1b829ad4f48200c76b2c879a27b9360efde

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
937ae9e47c335036415db74bc99e9454

SHA1
954371cb78278daea9b15d152366fcfcd2a062a3

SHA256
d40e83977470673636d6b382a89405156ce729736658d6b3050fb56f7572a2e5

SHA512
247d853457a85a7794bc0b7a10ca7df975f9bc7495df93f4a09fdfa2f49dfbb5e82cb734bee6ee33cb4a3d3317381cbfeb7565d290d964015cc32fb94b51902a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1008B

MD5
d3fcc7acca449b10fe08ea02cbb7f5a7

SHA1
612bbbf5f2fa698bce64a05835884d38ec0aa404

SHA256
896108775a1ba5230bb2b086c87096c81741305db736f24dbbeb0fb963eab637

SHA512
cea5e99d140116cdd3c4ed5d9734aee6fa901bdf0fe41368609ad035ca0c0854d149efa48364fa2d9a2f4dc97f488eb3134bf0defd992b4da6f434a0b884e04c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
5KB

MD5
3f89cef261ceaea2fed632ddac213878

SHA1
303bea8e3ea2b7031390c8534886c81e7c2dded2

SHA256
d0d34cbd7e6d8cea5adcad1a247c9676da4116c8248383f45fcf7e8f01b8be0a

SHA512
087c48edd8b24a0c223efb8876fa29fcfdfd999d1bf57f65f8de1d65dd2faa7eb6d377c8598304606170cf251218ceff36be797e40a16d13a624defaeaab75fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
c3704f9bd54b183b032925e85d4db966

SHA1
a82ab58a4778a670a44f528d898954d0962385f9

SHA256
c0e219ee5a27dccce246bf0f5fa46996a66cf36550e2bf65851e68eb3e4ce87b

SHA512
08d5e55ba17268d58bf238a44a8d3c5a4188e3e4ccafb0ec7f71844e1215b1d9a71bd8a49d894fe8f3214e989679dbf7616e029e5605389a9cc546269784d0da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
9465385951dfcb921af5f5f379dcc498

SHA1
9c4d489e33b823308cb4f9fe38a9e675fd045109

SHA256
30c2277fbf96b6dbd462c0429645659496eeecce26befd521ae14e0a379eea6b

SHA512
e63c62237592896ff5c094ea753424e4b6d800887246e1e5c0735bd2427f653ca6b49ad9d040e29343d69b4d818e2badaf146f116ab7054e9bf30f7134a4dedb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
815cb6073be7247d7f56abdd05291bf6

SHA1
b50fe282c0d12ff64e97bafbc876589df4fca861

SHA256
b0324c9e66a2d6b7376e4c65332f90b115f1351b10406d2a0d541b662f661dbb

SHA512
9ea3b93d039c3f1083508a2e1f3e4c303326864762d3dce55f277f15432a2fc24c666401f2811f522954b9f663d8b7213d0ea464d2c36ef532d75489b4b1f441

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
8b7175d0b51cee987fb42e29e295e28b

SHA1
14e6934ffcf03523ac960b167a5da74d5f8d3824

SHA256
fed4ce2a825b8cae81707c7aecc1ff92fe04a72bc06de98d2b39623d23c14d1b

SHA512
2ded6b9fcdb76f0581d7da8f59c5c6583a2c848e7f4a76a64c9fb0ced928e468b1570f60238d7e2f5b19b38eb809165aeb003d62a2a7997526c819488769233a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
3b4c877108bc879e0ddd074e9fc5faf9

SHA1
1bcbb021f15057071ad8a969465d71666e0c2416

SHA256
809adaf14abc5636c0c3513f1148a73bbf695e932de759d509f62371cc4996b4

SHA512
b74eb65ca118b2f4771ba46fc3d5429d047f6b741fbb963ebd33ef235e0ea61bf63f8acd97d7fe462d3119238c4aa8499dd9b32bb73bf317914f48fbe4a1e87f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
500f4b32af9afc6ce44dafdccd50c183

SHA1
5e8ef8b859d87698f68086b6bb1d2142e6eb6c23

SHA256
fe2b8e85b7c7c033e77a681fff9c47803d65e1ea0f5360a80eae3b8ce271c4c9

SHA512
9364baa9aa860a68cfe6553d72e87ba15ac24151eea3bc7f1460da5f36e6e384cfab086fa6bdab174f54fdeadb299763b60afaf8253ed1bd1aa7f224849d8745

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
93a959f45d86124e9ab36583065fcd0d

SHA1
7c3e0aa9e0e5ba6bf04616aced8c28e01f1b4b80

SHA256
aebd2c7ccda96cb368896f63a006eba9f77f4ef218e52b25a05fdbfefa5b5d08

SHA512
ba3359e242c9e29fbdb33799d2b9ef47ee7b68f5776f39276c5a6ac90421a5d8dfac70e8836091dbeee21cf804b3040096d83593b7df2c3c89d4a8e4b49a5379

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
d8bcdadd0c3c4e2bc2bdf6013ee0d7a5

SHA1
87c8068bbcfc9d3274e60e330b83c9bf526b21a3

SHA256
e2a3347586039beefebd3e3efe4bbea3a99496e3108cc88c9213deb7f7633fe4

SHA512
72c3cf9c7dd59d8d0444b99e68781a5b9eaa9d43077a6eba7972eb2765056f00d9b7977e90093e986f1081d0d74f400210a12fa7e9842ddb7a9363c2a57f05bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
10d8f8ecc92a7e4e4dc7fd1a027e309f

SHA1
5924d634b0072287b6b4e44371ea526c92df837d

SHA256
152168fe3b8f14184bc6cd8cbc5b1ad921971498e4ccc6f7bc024d169f3605c1

SHA512
27a513429401599bb7e0557e197cfbbbb2798b30f24d11baf18faaa262ce0d0327fdb5dd6dcab91299f43c86599b92dc50fe3607852825af0f3556ae42b85428

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
75609fbc7ca4298aff0e2b7a23e91864

SHA1
ff3a514a8d0ee2937ef045b6958f8a8e4c051242

SHA256
cb92cdbe8a5d48a843006b9b0e540893e2b6c1633f3f2abbd446caf464d336b5

SHA512
c95e15dc67775c22973b6ef7d1415b7f7827fe38c643f60c7f5ff5bc627d08ab0d510c5898651a2ac3f39600eea8782c75a9af53712c8eed5ad3b3867ac45685

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
10KB

MD5
5258e460e74efb82dc47d5a7b9abc43a

SHA1
151bafacb876151d4e496fbda9654bcc38b969aa

SHA256
684ee00d4e7979e1b9433b6f8f4f5412164a330334afe6b22ac690834a8a2ed5

SHA512
0fa36371c1f1165b2d0a734d28cfc4805ec2a4f35975f50b050ed2a070fbfa2b663db130ff255c2b8b483b286db5bc435aff23ccb880732ee445d2d98204c1da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
2bbbdb35220e81614659f8e50e6b8a44

SHA1
7729a18e075646fb77eb7319e30d346552a6c9de

SHA256
73f853ad74a9ac44bc4edf5a6499d237c940c905d3d62ea617fbb58d5e92a8dd

SHA512
59c5c7c0fbe53fa34299395db6e671acfc224dee54c7e1e00b1ce3c8e4dfb308bf2d170dfdbdda9ca32b4ad0281cde7bd6ae08ea87544ea5324bcb94a631f899

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
28fd2e0280076da8fe86204a13973176

SHA1
e6dbf0acd44673b979bb144170fead3c9b14e0c5

SHA256
414344199fbae6511ca0ae038ef914fd4e017d5fe79cfc45019c33c96b4afee0

SHA512
bf03d7d949f90ad6c19046303d8076bea6a5be198a72eeef0c3c9fbda531f0250965815914535bde0e8071ff4ca4c4df133476cffefb3b28b764c92daec1a58a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
afccc1a78cca6bf11369a60a4bd45d07

SHA1
2b1e301274e03b175b9eff18f066916cb3e2cd58

SHA256
cda585b42a6b03ac70bbc27db100ac6d88ebafede728bb93639379ce152540d0

SHA512
33aa7ecbec6cfe1dd8ed323012191c40d57692f11e75b776afce72ed2da20108715ed9c91c5c4b72f801e44ef0bbd7c5b1d685d857e528de000acedbbb84760a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
34f2d0d2b88a84ad40c22d9a975f9e23

SHA1
5111e197f67e7af00c258743500b6f098cb1864c

SHA256
604d6a3b852a8df81bdda5b90fc33e1b4eeb1bd826f9e9e32adb0aee62abd256

SHA512
0efbf238e3bff03d9f51fb53e04b39079eb6bcee1611687e21beacb1e2526517ce66147bbf2c0b276938fb753430855bf5d84fcfe897e979a8f10a089831feee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
ac00a5835293b4811589a9af024296c2

SHA1
49bbdd055e136a443fa4e83254d77d53dbf7fae1

SHA256
e068600f542687666b9c41209927929d22dd6e704978a120dc34ad8797f6a9b6

SHA512
c3e6e4bb6d28a3aceac2d1185cc19c6b7d4fd063db783b7de6c246723b61b5a89954aa1bace4751008594ca3d6153fa962fb2a73855a35134f11f9bded54dd88

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
511cb16e3b3d5d5e31da27bc087ba819

SHA1
5b77d6b443a6dd771cea574eb538b9f5162bbe46

SHA256
92d3a647a5b9b2e3c31046e9da334f85968440167707dd5b4bbf55532b741f08

SHA512
5b95f86a63931c5bc929d18dd935baa27e568209de67ae61749c952829703c18f90fb86ee5c94506f10a119dcdad7af227bd6ebb850c34181e1d2bc407c852df

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
71adfdd4f0b91a2fbca565bb81527e5f

SHA1
b846b0336509ce32dcdc14155373091460d448f7

SHA256
2894c0e70c207c9a25a5945c45020cff88e98cae7d9d2785643a76935c6b9644

SHA512
9af92f44da2bbe5a9f7d580d34f2521afc59e66d90de79b54989f90122bfd185ff69eac38a293b3f465446588dcce328fe7bd179ea70d3ec783fc2309c1fa887

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
b0036060bde91b9442348887b56e9cfe

SHA1
7f471b4dda6b743dc8132b9de8d20dd95437604b

SHA256
2dcb7c7b6d663daf0366a633b4524173ccf51385bcc96b0ae133d24a7c8e692c

SHA512
86eae94acffe9df27e81f552d206283140002b4103729b5670934b75b5f633fdfe4bee90efdce0b9ce138d0ada772f6ec5f072ea0ec806209f42048251cdf166

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
515a533d1a261a0fcd446d830c8e6b48

SHA1
7ff35bda5f2b69bf3f686ccde6c511e4c4023a52

SHA256
3403ccdc28bba16e692b9f80c26853adc2faf4d7781daba9f1ff376338f6d804

SHA512
4a1a4ac1773a9868e6c55f56b20451c63403f3d677e5fd7856b1f0333e7645a62dab83cb0afdec857d497b54cafccd2a3b457e6dc5d60732ff07720d369f35c7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
44ddf338188324a27ee66c2fd281e61f

SHA1
7a798ef01f5039a7d346676427108529711328e3

SHA256
206077ac8ca2f53827b5aefeb4a0e0617c8c8baa9f0f596796c4bccdcbd9ed8c

SHA512
089e585367d4c81a8e9916f5a51e3b04466e0ee721c09c7f955f45d4803b1ee51b066bf46247137dfc6c38dcbec705cf14a0b8de3201ca71751b6d55b49a67bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
40c6f3cabde6539f52672b384e47b244

SHA1
4a4cf76d47a875881653258224ec87488bbc5297

SHA256
8b196e536984ea8ace60c9eb2199d612ba1d1149b63d1211f4c8f83473255460

SHA512
4715c7504ca49b926d200ee41b8596417fe0d91ca4f39e0713c23d322d952123cf97328004f43cc6ef9821c55e5c7916082c590d6b36b4eebc212470bc43cd40

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
101d1006a5018b2bda7787b6a266a26d

SHA1
f0dd030c23e4bbe032b58dc5068557bae0b1ab1f

SHA256
64574a316cd3d9b56adc4cc1a10f8597e1e2b18f476d42f3ae3bf309a00610a2

SHA512
33e88049894b63d728f35d8892df362d5c6460edd44a08230eea315b9f1e0dfaf648c0fd4f1c488dc3b88b12086a7e4762069b7dc2845835b85bb5efa244335f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
5437918dd6cd534aff8d5957d514b459

SHA1
39cf83d5978e660b2c15a8ca04bebb4c10e8369f

SHA256
eb5ae7a995bd2cdb5a90050a14417f1f86d877bd34266ea946f839f5d9ffe0e1

SHA512
5917d0ec0b85fadc5aaee77198f793c214cedacb667ca99534409ff1a1803e33451a42b9f9577eb28f546718ae353702b7c33107b3a0db77ec32f40a0f718c12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe580385.TMP

Filesize
1KB

MD5
2d035357b3503bbec0d95b96cd5abb83

SHA1
dde226400d5415987e136eb500a8ba66cc721b01

SHA256
60fffa98ae4e28f66059675a74fa63c92de19a2a8d833311578e3747666328f3

SHA512
a70dd686e31c2187b2f55d3bd0d68db8b05f9045b23101605fbd895c2aa8abcffcb0008ec49a8cf6ec65adb6be91f034ec75635d49fd406bb85ad2ee71c23e3b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
9b27c7bc48385aca0b9fe7a321addee9

SHA1
e1da51073db3f66823665db7330d1bfa196e1885

SHA256
99428ff18a36dbf6128f436a01d445736d282d6342ef43603e3efe3535436d5b

SHA512
66f37c2d1d7431b4b284549efbaa119be8e9a4886d7d06868473b937ac181b5ff21f5e6756d902c57fc02e2b9e2c87547f308d4e99819cad92299b3b9cfb8b62

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
a850eb3a1edff513ad64b2ef0b4ca5a7

SHA1
051298b13dd72bff925be0396ab8f0eb0de4d2a2

SHA256
8e8065e1061f19e536f56bc75ae6a7a676a07f023def9c6299ce7e3436e86596

SHA512
546c892a2876149c4c6fa1381ad4ac65215a731fca5ecbae387b978ea717ea8465a22be706fd9d20002bf88d229c5a4c1b6794acf72e8f32cb1b3248063a65b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
ed88d24b5ad162587925918506a3922e

SHA1
0fdd9a1bdedac321cf8ff571a90c03c72933f5c2

SHA256
165ccf91b957759da75b2e34dfca68d2d17df191e3d288317073efe3fefcb0a5

SHA512
4ce972b261d47be207cd8368c68fd4afea57adb90e5b74f95f3ce2056f9f4d8ebe9227e967cbefe6891d6d71e0fdf8c3584b76992a2d1b163f709e75acfb027e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
21KB

MD5
4f5d3524b218936e89d5df6065bf11fa

SHA1
0415a09aeeb32722376126b578331a93a45a7259

SHA256
d1a2eae4703aa76414d457129cdaffb2a606eef68a5f0d5caafb615ef875ea48

SHA512
4b08d63f52ece95558e858a163b0edf0861ece9d3ee92b515efdc96b28e9abe58944ce818dd606d270468e3d88387a0114bb26bc9c385bf58b607619c3bd5901

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
24KB

MD5
ccc168c8556b9aa55bd7db1e207c3595

SHA1
9b2fcb2b47287ba64c6f2e0b5cc21ed23bfdcbe0

SHA256
be76aa4cc313d3a231e69cf72641e61f3b44b2abe8b0ddf01de5cc15bb8c64d7

SHA512
53a0cf8898b9d4db6f8c8ee4d6dc57ae891d38303a0cd3b9a74254d3c553adf0edac99102ff29401ec2d5ba1c06acb64b2aabc0b18420b0e2e2f8bcad2b186af

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
26KB

MD5
c8b94c94d64427a3fc23b6ca725a0288

SHA1
04a64d2c9d178607744fc4ca2a11bbaed4c4862e

SHA256
32630de7f0b69deab40c442a0ae97ef52b5c74844db1b60bc83c43fb68bebd46

SHA512
aad2005058f1308fb443ec848e3986ac859bfecc75efa9302625890518a9d95ccb714bfbc469f7c730af5deaa29ba9aa206e82634a85625a4149bbd31453aee8

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
23KB

MD5
79ed18af6457e26387e25e6b2c81aaa2

SHA1
b591410bc31b69807cdbb46dc2169a17c538afab

SHA256
e1c5c0ed7048e8e7e934503dfb3f6f4b0575240fe00ab6a5f997d0b479455653

SHA512
c0e084a3f102d8940d14d150a63db8c446d638e56e04d3ea05fb7cbef39933549954c1b010823af88f69c02acb9afd6b9be785e420ddeb1a29a561691c20f5b6

Download Submit
C:\Users\Admin\Downloads\7ev3n.zip

Filesize
64KB

MD5
0bab88d4102ed6a6a368488a0c6d111a

SHA1
924e0f920694049d4731304dbaa874c91538200a

SHA256
1a5d32dc3658791366cdcdc120bd4451851b7f94df318a235084fe55adef5524

SHA512
afa37f659cef1991415782ea7f123362159685d2b87a59c7548c945c4d68d37d345247ea88115e0f9f2917bb9a132315aa5ca2b3ad7effab103d7d1269c0adff

Download Submit
C:\Users\Admin\Downloads\7ev3n.zip

Filesize
139KB

MD5
8633d1a832e82750d4788dc2df6ee03f

SHA1
646754dfd0907da4e1c7e7e931defe6101bc9155

SHA256
5e32ebb1dd734aa7bcaf079325180e0ec88933bff4a239774578b8c1548810d8

SHA512
e05f8cb4ff0aff0f64c79acb214473d73bdcafae18e03084cd41c83ec967f911c6ec626d34ad4eeb438a55df015ed16554726fd27dfee7524521c801a63ab48a

Download Submit
C:\Users\Admin\Downloads\BadRabbit.zip

Filesize
393KB

MD5
61da9939db42e2c3007ece3f163e2d06

SHA1
4bd7e9098de61adecc1bdbd1a01490994d1905fb

SHA256
ea8ccb8b5ec36195af831001b3cc46caedfc61a6194e2568901e7685c57ceefa

SHA512
14d0bc14a10e5bd8022e7ab4a80f98600f84754c2c80e22a8e3d9f9555dde5bad056d925576b29fc1a37e73c6ebca693687b47317a469a7dfdc4ab0f3d97a63e

Download Submit
C:\Users\Admin\Downloads\BadRabbit.zip

Filesize
393KB

MD5
e8406222edfd6a77055d79bf7a985041

SHA1
b60ce38779ebf7272183063fd0f825ede2c6d46d

SHA256
4dc57fcb01acde99b881e49127354a0aabd5fdcd92261909cd841fbdf5ce2053

SHA512
ef71058b2b73cccada4639e74a2fc536b8de79ada73baed11b230e1f075e8b3d099cb8f1d91d4f2a4d871b62d723d4720926a08ced8b6088cac3ea1496a84c76

Download Submit
C:\Users\Admin\Downloads\Birele.zip

Filesize
113KB

MD5
6ca327b67f1a2b2a4fbb7f342e15e7bf

SHA1
aab4a7d8199e8416ad8649fede35b846fc96f082

SHA256
460a3e3a039c2d0bb2c76017b41403bf3e92727269f49b08778d33108278b58f

SHA512
b7a7574ca52885e531aca71ebe52f7832f8a2436cda047e7686936fe0337eae7c4ebcc57df27c26316871d4167ea4e6794beb933f7c13efb0addac0d400e4d9a

Download Submit
C:\Users\Admin\Downloads\Birele.zip

Filesize
113KB

MD5
c002b5ff876d45ab39ec36da0a8927d2

SHA1
7900ba89a0a1e3da5cd9f7a04ce13d4314db6718

SHA256
98ee14380b3691231c7a96a9d167eb45829022c69e4b5f8db39e613a7b955cad

SHA512
a972f730d8bb5d6427291cdfee888f86f48078ea6cc2f513a1e0439f05b014dedf93f4d8cf596022d8f1bfd638c29ab431816524ae5d8d6c65a1667cfed8bfd7

Download Submit
C:\Users\Admin\Downloads\MEMZ.zip

Filesize
8KB

MD5
69977a5d1c648976d47b69ea3aa8fcaa

SHA1
4630cc15000c0d3149350b9ecda6cfc8f402938a

SHA256
61ca4d8dd992c763b47bebb9b5facb68a59ff0a594c2ff215aa4143b593ae9dc

SHA512
ba0671c72cd4209fabe0ee241b71e95bd9d8e78d77a893c94f87de5735fd10ea8b389cf4c48462910042c312ddff2f527999cd2f845d0c19a8673dbceda369fd

Download Submit
C:\Windows\684.tmp

Filesize
60KB

MD5
347ac3b6b791054de3e5720a7144a977

SHA1
413eba3973a15c1a6429d9f170f3e8287f98c21c

SHA256
301b905eb98d8d6bb559c04bbda26628a942b2c4107c07a02e8f753bdcfe347c

SHA512
9a399916bc681964af1e1061bc0a8e2926307642557539ad587ce6f9b5ef93bdf1820fe5d7b5ffe5f0bb38e5b4dc6add213ba04048c0c7c264646375fcd01787

Download Submit
C:\Windows\infpub.dat

Filesize
401KB

MD5
1d724f95c61f1055f0d02c2154bbccd3

SHA1
79116fe99f2b421c52ef64097f0f39b815b20907

SHA256
579fd8a0385482fb4c789561a30b09f25671e86422f40ef5cca2036b28f99648

SHA512
f2d7b018d1516df1c97cfff5507957c75c6d9bf8e2ce52ae0052706f4ec62f13eba6d7be17e6ad2b693fdd58e1fd091c37f17bd2b948cdcd9b95b4ad428c0113

Download Submit
memory/684-1304-0x0000000002780000-0x00000000027E8000-memory.dmp

Filesize
416KB

Download
memory/684-1299-0x0000000002780000-0x00000000027E8000-memory.dmp

Filesize
416KB

Download
memory/684-1291-0x0000000002780000-0x00000000027E8000-memory.dmp

Filesize
416KB

Download