badrabbit | 086d35f26bd2fd886e99744960b394d94e74133c40145a3e2bc6b3877b91ec5d

Analysis

max time kernel
224s
max time network
233s
platform
windows11-21h2_x64
resource
win11-20231215-en
resource tags

arch:x64arch:x86image:win11-20231215-enlocale:en-usos:windows11-21h2-x64system
submitted
05-02-2024 06:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NetWire.exe
Size

1.2MB
MD5

7621f79a7f66c25ad6c636d5248abeb9
SHA1

98304e41f82c3aee82213a286abdee9abf79bcce
SHA256

086d35f26bd2fd886e99744960b394d94e74133c40145a3e2bc6b3877b91ec5d
SHA512

59ffcf6eeac00c089e9c77192663d0dc97b2e62cedb6d64fe7dc2e67499abc34e33977e05113c9d39ca6d3e37e8b5c3e6aa926c8526215808b147c0152f7dbfd
SSDEEP

24576:nBlDgE7EmXWAqSvg439vGSVNe1/hqIiHSvd7:n7DlC+GSjiBiyF

Score

10^/10

badrabbit mimikatz modiloader persistence ransomware trojan

Malware Config

Extracted

Family

modiloader

https://drive.google.com/u/0/uc?id=1TcSctGVBajYMA7CFDc158wpvqkpxmkhJ&export=download

Signatures

BadRabbit
Ransomware family discovered in late 2017, mainly targeting Russia and Ukraine.
ransomware badrabbit
Mimikatz
mimikatz is an open source tool to dump credentials on Windows.
mimikatz
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader First Stage 2 IoCs

resource	yara_rule
behavioral1/memory/4452-847-0x0000000010410000-0x000000001047E000-memory.dmp	modiloader_stage1
behavioral1/memory/4452-911-0x0000000010410000-0x000000001047E000-memory.dmp	modiloader_stage1

mimikatz is an open source tool to dump credentials on Windows 1 IoCs

resource	yara_rule
behavioral1/files/0x0004000000024fdf-1780.dat	mimikatz

Downloads MZ/PE file

Executes dropped EXE 5 IoCs

pid	Process
3852	BadRabbit.exe
4164	BadRabbit.exe
544	43C1.tmp
1032	BadRabbit.exe
4812	BadRabbit.exe

Loads dropped DLL 4 IoCs

pid	Process
2756	rundll32.exe
2100	rundll32.exe
3808	rundll32.exe
3208	rundll32.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-175642277-3213633112-3688900201-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Qspt = "C:\\Users\\Admin\\AppData\\Local\\Qspt\\Qspt.hta"	NetWire.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service

T1102

flow	ioc
1	drive.google.com
2	drive.google.com
12	raw.githubusercontent.com
46	raw.githubusercontent.com

Drops file in Windows directory 10 IoCs

description	ioc	Process
File created	C:\Windows\dispci.exe	rundll32.exe
File opened for modification	C:\Windows\infpub.dat	rundll32.exe
File opened for modification	C:\Windows\43C1.tmp	rundll32.exe
File created	C:\Windows\infpub.dat	BadRabbit.exe
File created	C:\Windows\infpub.dat	BadRabbit.exe
File opened for modification	C:\Windows\infpub.dat	rundll32.exe
File created	C:\Windows\cscc.dat	rundll32.exe
File opened for modification	C:\Windows\infpub.dat	rundll32.exe
File created	C:\Windows\infpub.dat	BadRabbit.exe
File created	C:\Windows\infpub.dat	BadRabbit.exe

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
4824	schtasks.exe
4616	schtasks.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-175642277-3213633112-3688900201-1000\{9C3DE4FB-BEFC-47DB-8BCC-AE5965C5045F}	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 721729.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 31 IoCs

pid	Process
2728	msedge.exe
2728	msedge.exe
1388	msedge.exe
1388	msedge.exe
3024	msedge.exe
3024	msedge.exe
4064	msedge.exe
4064	msedge.exe
3008	identity_helper.exe
3008	identity_helper.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
4092	msedge.exe
4092	msedge.exe
2756	rundll32.exe
2756	rundll32.exe
2756	rundll32.exe
2756	rundll32.exe
2100	rundll32.exe
2100	rundll32.exe
544	43C1.tmp
544	43C1.tmp
544	43C1.tmp
544	43C1.tmp
544	43C1.tmp
544	43C1.tmp
544	43C1.tmp
3208	rundll32.exe
3208	rundll32.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

pid	Process
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2756	rundll32.exe
Token: SeDebugPrivilege	2756	rundll32.exe
Token: SeTcbPrivilege	2756	rundll32.exe
Token: SeShutdownPrivilege	2100	rundll32.exe
Token: SeDebugPrivilege	2100	rundll32.exe
Token: SeTcbPrivilege	2100	rundll32.exe
Token: SeDebugPrivilege	544	43C1.tmp
Token: SeShutdownPrivilege	3208	rundll32.exe
Token: SeDebugPrivilege	3208	rundll32.exe
Token: SeTcbPrivilege	3208	rundll32.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2880 wrote to memory of 4452	2880	NetWire.exe	76
PID 2880 wrote to memory of 4452	2880	NetWire.exe	76
PID 2880 wrote to memory of 4452	2880	NetWire.exe	76
PID 2880 wrote to memory of 4452	2880	NetWire.exe	76
PID 2880 wrote to memory of 4452	2880	NetWire.exe	76
PID 2880 wrote to memory of 4452	2880	NetWire.exe	76
PID 2880 wrote to memory of 4452	2880	NetWire.exe	76
PID 2880 wrote to memory of 4452	2880	NetWire.exe	76
PID 2880 wrote to memory of 4452	2880	NetWire.exe	76
PID 2880 wrote to memory of 4452	2880	NetWire.exe	76
PID 2880 wrote to memory of 4452	2880	NetWire.exe	76
PID 2880 wrote to memory of 4452	2880	NetWire.exe	76
PID 2880 wrote to memory of 4452	2880	NetWire.exe	76
PID 2880 wrote to memory of 4452	2880	NetWire.exe	76
PID 2880 wrote to memory of 4452	2880	NetWire.exe	76
PID 2880 wrote to memory of 4452	2880	NetWire.exe	76
PID 2880 wrote to memory of 4452	2880	NetWire.exe	76
PID 2880 wrote to memory of 4452	2880	NetWire.exe	76
PID 2880 wrote to memory of 4452	2880	NetWire.exe	76
PID 2880 wrote to memory of 4452	2880	NetWire.exe	76
PID 2880 wrote to memory of 4452	2880	NetWire.exe	76
PID 2880 wrote to memory of 4452	2880	NetWire.exe	76
PID 2880 wrote to memory of 4452	2880	NetWire.exe	76
PID 2880 wrote to memory of 4452	2880	NetWire.exe	76
PID 2880 wrote to memory of 4452	2880	NetWire.exe	76
PID 2880 wrote to memory of 4452	2880	NetWire.exe	76
PID 2880 wrote to memory of 4452	2880	NetWire.exe	76
PID 2880 wrote to memory of 4452	2880	NetWire.exe	76
PID 2880 wrote to memory of 4452	2880	NetWire.exe	76
PID 2880 wrote to memory of 4452	2880	NetWire.exe	76
PID 2880 wrote to memory of 4452	2880	NetWire.exe	76
PID 2880 wrote to memory of 4452	2880	NetWire.exe	76
PID 2880 wrote to memory of 4452	2880	NetWire.exe	76
PID 2880 wrote to memory of 4452	2880	NetWire.exe	76
PID 2880 wrote to memory of 4452	2880	NetWire.exe	76
PID 2880 wrote to memory of 4452	2880	NetWire.exe	76
PID 2880 wrote to memory of 4452	2880	NetWire.exe	76
PID 2880 wrote to memory of 4452	2880	NetWire.exe	76
PID 2880 wrote to memory of 4452	2880	NetWire.exe	76
PID 2880 wrote to memory of 4452	2880	NetWire.exe	76
PID 2880 wrote to memory of 4452	2880	NetWire.exe	76
PID 2880 wrote to memory of 4452	2880	NetWire.exe	76
PID 2880 wrote to memory of 4452	2880	NetWire.exe	76
PID 2880 wrote to memory of 4452	2880	NetWire.exe	76
PID 2880 wrote to memory of 4452	2880	NetWire.exe	76
PID 2880 wrote to memory of 4452	2880	NetWire.exe	76
PID 2880 wrote to memory of 4452	2880	NetWire.exe	76
PID 2880 wrote to memory of 4452	2880	NetWire.exe	76
PID 2880 wrote to memory of 4452	2880	NetWire.exe	76
PID 2880 wrote to memory of 4452	2880	NetWire.exe	76
PID 2880 wrote to memory of 4452	2880	NetWire.exe	76
PID 2880 wrote to memory of 4452	2880	NetWire.exe	76
PID 2880 wrote to memory of 4452	2880	NetWire.exe	76
PID 2880 wrote to memory of 4452	2880	NetWire.exe	76
PID 2880 wrote to memory of 4452	2880	NetWire.exe	76
PID 2880 wrote to memory of 4452	2880	NetWire.exe	76
PID 2880 wrote to memory of 4452	2880	NetWire.exe	76
PID 2880 wrote to memory of 4452	2880	NetWire.exe	76
PID 2880 wrote to memory of 4452	2880	NetWire.exe	76
PID 2880 wrote to memory of 4452	2880	NetWire.exe	76
PID 2880 wrote to memory of 4452	2880	NetWire.exe	76
PID 2880 wrote to memory of 4452	2880	NetWire.exe	76
PID 2880 wrote to memory of 4452	2880	NetWire.exe	76
PID 2880 wrote to memory of 4452	2880	NetWire.exe	76

C:\Users\Admin\AppData\Local\Temp\NetWire.exe
"C:\Users\Admin\AppData\Local\Temp\NetWire.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2880
- C:\Users\Admin\AppData\Local\Temp\NetWire.exe
  "C:\Users\Admin\AppData\Local\Temp\NetWire.exe"
  2⤵
  - Adds Run key to start application
  PID:4452
- - C:\Program Files (x86)\internet explorer\ieinstal.exe
    "C:\Program Files (x86)\internet explorer\ieinstal.exe"
    3⤵
    PID:2488

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004C4 0x00000000000004D0
1⤵
PID:3712

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fff5abd3cb8,0x7fff5abd3cc8,0x7fff5abd3cd8
  2⤵
  PID:2140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1984,6522249227310465350,4163208920273990199,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2096 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1984,6522249227310465350,4163208920273990199,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2472 /prefetch:8
  2⤵
  PID:4992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1984,6522249227310465350,4163208920273990199,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2036 /prefetch:2
  2⤵
  PID:2512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,6522249227310465350,4163208920273990199,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:4292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,6522249227310465350,4163208920273990199,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,6522249227310465350,4163208920273990199,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4924 /prefetch:1
  2⤵
  PID:4216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,6522249227310465350,4163208920273990199,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4500 /prefetch:1
  2⤵
  PID:3464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1984,6522249227310465350,4163208920273990199,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5188 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,6522249227310465350,4163208920273990199,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4488 /prefetch:1
  2⤵
  PID:1296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,6522249227310465350,4163208920273990199,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3392 /prefetch:1
  2⤵
  PID:688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1984,6522249227310465350,4163208920273990199,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=4728 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:4064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1984,6522249227310465350,4163208920273990199,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4964 /prefetch:8
  2⤵
  PID:3272
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1984,6522249227310465350,4163208920273990199,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5380 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,6522249227310465350,4163208920273990199,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5580 /prefetch:1
  2⤵
  PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,6522249227310465350,4163208920273990199,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4692 /prefetch:1
  2⤵
  PID:4968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,6522249227310465350,4163208920273990199,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5140 /prefetch:1
  2⤵
  PID:4076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,6522249227310465350,4163208920273990199,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5804 /prefetch:1
  2⤵
  PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,6522249227310465350,4163208920273990199,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2348 /prefetch:1
  2⤵
  PID:4452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,6522249227310465350,4163208920273990199,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5528 /prefetch:1
  2⤵
  PID:772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,6522249227310465350,4163208920273990199,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5656 /prefetch:1
  2⤵
  PID:3988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,6522249227310465350,4163208920273990199,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5876 /prefetch:1
  2⤵
  PID:4592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,6522249227310465350,4163208920273990199,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6308 /prefetch:1
  2⤵
  PID:3280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1984,6522249227310465350,4163208920273990199,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6868 /prefetch:8
  2⤵
  PID:2764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,6522249227310465350,4163208920273990199,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6376 /prefetch:1
  2⤵
  PID:388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1984,6522249227310465350,4163208920273990199,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5884 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1984,6522249227310465350,4163208920273990199,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6072 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4092
- C:\Users\Admin\Downloads\BadRabbit.exe
  "C:\Users\Admin\Downloads\BadRabbit.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  PID:3852
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\system32\rundll32.exe C:\Windows\infpub.dat,#1 15
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2756
  - - C:\Windows\SysWOW64\cmd.exe
      /c schtasks /Delete /F /TN rhaegal
      4⤵
      PID:904
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Delete /F /TN rhaegal
        5⤵
        
        PID:3996
  - - C:\Windows\SysWOW64\cmd.exe
      /c schtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR "C:\Windows\system32\cmd.exe /C Start \"\" \"C:\Windows\dispci.exe\" -id 1311928481 && exit"
      4⤵
      PID:2200
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR "C:\Windows\system32\cmd.exe /C Start \"\" \"C:\Windows\dispci.exe\" -id 1311928481 && exit"
        5⤵
        Creates scheduled task(s)
        
        PID:4824
  - - C:\Windows\SysWOW64\cmd.exe
      /c schtasks /Create /SC once /TN drogon /RU SYSTEM /TR "C:\Windows\system32\shutdown.exe /r /t 0 /f" /ST 06:37:00
      4⤵
      PID:1968
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Create /SC once /TN drogon /RU SYSTEM /TR "C:\Windows\system32\shutdown.exe /r /t 0 /f" /ST 06:37:00
        5⤵
        Creates scheduled task(s)
        
        PID:4616
  - - C:\Windows\43C1.tmp
      "C:\Windows\43C1.tmp" \\.\pipe\{48460B47-CA49-4D75-A1BB-A27AEACB95CC}
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:544
- C:\Users\Admin\Downloads\BadRabbit.exe
  "C:\Users\Admin\Downloads\BadRabbit.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  PID:4164
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\system32\rundll32.exe C:\Windows\infpub.dat,#1 15
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2100

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:808

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2360

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1912

C:\Users\Admin\Downloads\BadRabbit.exe
"C:\Users\Admin\Downloads\BadRabbit.exe"
1⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1032
- C:\Windows\SysWOW64\rundll32.exe
  C:\Windows\system32\rundll32.exe C:\Windows\infpub.dat,#1 15
  2⤵
  - Loads dropped DLL
  PID:3808

C:\Users\Admin\Downloads\BadRabbit.exe
"C:\Users\Admin\Downloads\BadRabbit.exe"
1⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4812
- C:\Windows\SysWOW64\rundll32.exe
  C:\Windows\system32\rundll32.exe C:\Windows\infpub.dat,#1 15
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3208

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ab16bd4ff2a8053c32cae8e2c4d25a66

SHA1
c1e041f30745a24f337adae3f4561d0f94f9e7cf

SHA256
5bafe572e81800f2a0bcd73872edb58a34972bf6134fac1432bdda1b7c0ebb70

SHA512
e4d7ee26645efa73e97b3453de0a3cf4a2374f758f625fac76e074c90413ad22fe17183e1611d5262cd1012da41a8d80b9718912af6bd5d807f4e972f591e69d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

Filesize
27KB

MD5
e43ef41505f07dc2966670de50ccfcec

SHA1
c096d302ba575fb898f2f4ce6f2ad22745d93021

SHA256
dc8c7dc7d6c9fae3c0c6ac5b4d8718f6f09976968c8cd640cfc82e090ec29dd9

SHA512
dd8e90219f9b03204abdf12922a245d9354c3de7e2c444cbe54404b24a5a90acdae89fdb37cca26788af9d8eed7e8266d8c35d022055e3241368bf2aa6870e3e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
67KB

MD5
88a552e6be1ac3978c49143983276b3a

SHA1
dbf4f4dc62a3da564b1a87b5191dc9a72a9b9423

SHA256
927121d8118a41fa3460b9ad84daeae59ea60dc9607e462b7e1341bea60da8d5

SHA512
125b13be3d209ff5cc12d8f9f12d01d271cd50c2800059241ebb419167c21adfa9d979ff6b8d88052f5d302e98090b7c8ceff4894b397168d8ba6d8a6204fb9a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

Filesize
19KB

MD5
76a3f1e9a452564e0f8dce6c0ee111e8

SHA1
11c3d925cbc1a52d53584fd8606f8f713aa59114

SHA256
381396157ed5e8021dd8e660142b35eb71a63aecd33062a1103ce9c709c7632c

SHA512
a1156a907649d6f2c3f7256405d9d5c62a626b8d4cd717fa2f29d2fbe91092a2b3fdd0716f8f31e59708fe12274bc2dea6c9ae6a413ea290e70ddf921fe7f274

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

Filesize
64KB

MD5
d6b36c7d4b06f140f860ddc91a4c659c

SHA1
ccf16571637b8d3e4c9423688c5bd06167bfb9e9

SHA256
34013d7f3f0186a612bef84f2984e2767b32c9e1940df54b01d5bd6789f59e92

SHA512
2a9dd9352298ec7d1b439033b57ee9a390c373eeb8502f7f36d6826e6dd3e447b8ffd4be4f275d51481ef9a6ac2c2d97ef98f3f9d36a5a971275bf6cee48e487

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

Filesize
63KB

MD5
710d7637cc7e21b62fd3efe6aba1fd27

SHA1
8645d6b137064c7b38e10c736724e17787db6cf3

SHA256
c0997474b99524325dfedb5c020436e7ea9f9c9a1a759ed6daf7bdd4890bdc2b

SHA512
19aa77bed3c441228789cf8f931ca6194cc8d4bc7bb85d892faf5eaeda67d22c8c3b066f8ceda8169177da95a1fe111bd3436ceeaf4c784bd2bf96617f4d0c44

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

Filesize
88KB

MD5
b38fbbd0b5c8e8b4452b33d6f85df7dc

SHA1
386ba241790252df01a6a028b3238de2f995a559

SHA256
b18b9eb934a5b3b81b16c66ec3ec8e8fecdb3d43550ce050eb2523aabc08b9cd

SHA512
546ca9fb302bf28e3a178e798dd6b80c91cba71d0467257b8ed42e4f845aa6ecb858f718aac1e0865b791d4ecf41f1239081847c75c6fb3e9afd242d3704ad16

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

Filesize
1.1MB

MD5
c10533650ab2ce04634865c72de4c069

SHA1
36a8d127fb45ffe2707d97806d4e75b491aad8e6

SHA256
12c27ab7264cb8fe40062da6606b6b572d787e7282239d948e01e813439bb69a

SHA512
9fe25a1f0228bd5c1b8ad365e221edef202fbc8ba11dc008d40198a2b8223caf211e74d16bc4fc293a088dc6af6f9080f9f45f5d6696d42232d800390807a7d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009

Filesize
33KB

MD5
3cd0f2f60ab620c7be0c2c3dbf2cda97

SHA1
47fad82bfa9a32d578c0c84aed2840c55bd27bfb

SHA256
29a3b99e23b07099e1d2a3c0b4cff458a2eba2519f4654c26cf22d03f149e36b

SHA512
ef6e3bbd7e03be8e514936bcb0b5a59b4cf4e677ad24d6d2dfca8c1ec95f134ae37f2042d8bf9a0e343b68bff98a0fd748503f35d5e9d42cdaa1dc283dec89fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000a

Filesize
75KB

MD5
cf989be758e8dab43e0a5bc0798c71e0

SHA1
97537516ffd3621ffdd0219ede2a0771a9d1e01d

SHA256
beeca69af7bea038faf8f688bf2f10fda22dee6d9d9429306d379a7a4be0c615

SHA512
f8a88edb6bcd029ad02cba25cae57fdf9bbc7fa17c26e7d03f09040eb0559bc27bd4db11025706190ae548363a1d3b3f95519b9740e562bb9531c4d51e3ca2b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
dc953bc81991fb8565676bec1fa48821

SHA1
1a1962ccf4be755abfc80fe1f17da41a463c7cf4

SHA256
7ca4bd4a11de71f4fee385f90b9954a6e599b570b22f02e36e8a2050aaa58394

SHA512
8848c8ac144a41804b62d057276cc2c15ce499673e32842f3ba0c9c2b485c15a9db208baab9633261e2742b4851094322c278eb7784bc9cf4c0749fd533b40c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
9a67b2c78bcfa3dc1c10ad97eaf6aaa2

SHA1
10b8e17a6942724ca444bd4f60c159e98aca5b85

SHA256
a404a2671ce86727d501a1cfaf5bd89a846229ebc1510023902264887617c66a

SHA512
a8a7f812df9df10d0a53f28c4f180fec8be5ee835fbefb081c7c5b5c76d0e1f0ee2d21fdb128f51416ea5736db2780f63191cb87fa32a02cf844781c5265fbf7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
467B

MD5
54dd20af23dd54e67ca05518ee7731be

SHA1
372eb77e0d8d0f243353c54d114fb6fe336460ba

SHA256
764a80e703e029499fc0629a91029bdcc3875b066920c94374e62ebcbb0ce2a1

SHA512
0790415af6b784ad3a48babe4df1d94cc30c0e780f255ff45ebcedf010163c76cfdacef90c423ba3791e49379869b3ecd6d77b0ffe080ae0e42bafc769fa9b9d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
936B

MD5
f70284a6e22079d9cd3b1f553a263ec1

SHA1
ec3bda3eae447cbc83657491ae5c9457caa7ab90

SHA256
6e4d37bbbdd70f201c444c5f511e5fe7bb71f07aad572126b602a439d65fc4a6

SHA512
0f284293086a813a700595dd00276a6941584da9b05addfe487ed25020c7d94c723e34edca9d89dba37f3c33a9cba950af477599953676f4933d900b14a8350d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
0476627779c20116c9145ef4921f0067

SHA1
fec478d604b5aed9cc006b03571f59271fb4726e

SHA256
e7349c09483015a3d7ecbb9707ae84cf81f0bf11e2e2bc6cb2c84ca5c181123d

SHA512
5caaef85732c2bbdfbb64597348a94fc22aa9b5e0bdef73963970426b0243574ecd4e26b6707b38f8591522d197088bc90cf2083fe6596775291236ee0a7cecb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4aa801692692ab4004100998cb4eef8d

SHA1
baae797758391598e52031ef3823db2c7c6e4591

SHA256
a1bd933a701357cb97598913c6b1788be7dc0bf03e109ca486f6d5ea8c43c153

SHA512
964f74f00e35474238030ae52d15c1121e6bc3a7655b7db36690dbe672ceda562e042ed0135780a289ab2b15e2afec6494be4cbfd8c650972c3f3e85bc3b2a13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
4KB

MD5
b4ad73f7179eb5ec06075c3042b7ec17

SHA1
6747f3238bde7f2ce0ebd2fc030ef5012acec874

SHA256
b97436b26022cb668baf38dda100d0a896d7b942730162a6a42df4d00de91eb4

SHA512
4ef8f84f6441e2c37ff0c356b3e8a197b8ebdc87fcfde1a675497455d0c78d6740392b6531ce50bb98b40763112f15e636ffb960ab56d0b8e8380c669ae77e92

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9a6fa35ed1f4f0af614d20a9871ce5eb

SHA1
eb892887a233625361194d1cf39cdbbdf05400c4

SHA256
0e5ea83ab32b22b22c6bb1cedcbd0b87096d967ba6f78b41ee359079d638137e

SHA512
dad97b5b4a97114b06b6979ce6dfe04f1739a74c19d28b1221dcba94000d21423aad2f9284ea7eba987a4033fc28942d5a00f7b058476edaf82372edca45712a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
fc6803b1401f2b788a6a61cc79566892

SHA1
81a2feebec170747f37c71643335b1771013d51a

SHA256
bf6b793405c2a7083767416df56500dc80b9a3466f335391baabdffb61d5492c

SHA512
aab453b16e78b0434c29b953968af864db0442aa8639c43429274dd77aec5096903fbc3988a658fc10924c6b1e64c833abcf2205e472557c70ba00199ab8cf9f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0bd27613897a5697a514df977ba2130a

SHA1
a4b0fa5c7b10d74cc02fab0d3308572840f498c5

SHA256
02d3e246f701f7b1dc3f06773e0b4e50e07b4f273861ec859c0423ae4d7eac25

SHA512
63861de727a25d9751685819912025b297aefcfb4afdd82b3900262fc8f15dbbbb12213871689241245c40dc61096ad41906c3fd8741c74e24b20287c89eb870

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
25KB

MD5
ac2b1e1028003f95bdb29d2cc74186dc

SHA1
b3d75c41f59e96148e07ba1c10d27f67adfc5d79

SHA256
8b5480e0e913fbfd94380c8b791244d03a71a0d054950836441425e1727ba383

SHA512
2b43d48f809212b459e53284446f0dfb23de64cbd251dd76350115910b11e4605469ddb41f2bd31aa9a98e652790d6928adee38b39d4fc4e9107e6a4f7d20e68

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
d365d2c9459b1bdf34686d4644ad9905

SHA1
2af19f177d05ac700deacc98ca4962d7d50ef211

SHA256
45b357988d552dc1459c7b9fb27d6343a7ac6af5f842fd2fcd183ebd6dd9d282

SHA512
b69d524673084e370317042097d9b6b54c0523ca7672dd4b035cd3589a677b34ab8ab3ca7be3ce40c5d87dd73ed46776d211f6971fc1a05b7bf7ac114f03240a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
684bc5c184fb3b91d8539e5c39571c6f

SHA1
b55cd9a1a30b7a5c2613d2bda8b9995e90eb9af0

SHA256
2a1d7b5c7cfeac516e787a016008719316f0eae48d4bd4d64da439213089676e

SHA512
806a947644a38524e93ee14a46a7d67c4479716a296860eaf9a4626cfc59ccf584d8294be019a597eb26b89ab866442cf2aec3590b25df41c2d05fd701423bef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
76caf8da0e698231ab54bbdf102436f3

SHA1
dfb87f9f37486b577800c817c2e3dbc32ae5e76b

SHA256
c5dd7b9ad4d22c5c23bfeb34b505b39f9caa83f247993b1c74a5803c3af43a0a

SHA512
1455e0d567a8d33bcd26c1bb96b274482ddefb67f115aaebce1ed7c8143220d9a9425cf251ce68586333bbe0da6d60107baa6f77b285100f29fec085e9fac2eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
538B

MD5
7a2df4e6f8e6f267b3829a660946ad7f

SHA1
c5bd0419a09fefd7dcd2678b9cca74918a0aec26

SHA256
8f5f9a611ee003b1d7358a0e8c84afae1d310b90d2237367775f6677adaeec30

SHA512
1c9b20edb7d052a9eec063c0bad6d4f38733d6883281bc295f0fdebc8c0881890f1af00a933f0c25af3b3a3dcdc0a0a42ef53068825d836699ed6b495d66fe33

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
969f593ad09ba769439125820b5cae58

SHA1
f73d62190b5faf970e6b7a143b253ba7d1b303df

SHA256
ee63baa3912d9eced5887d7e2d9e3f33f17bc49126d567169a962f5e918ea3c9

SHA512
75266d2874851a79e5276f4c675a874e1dace26c6d02d4b1ca4253d101259bbbdcdd5cbdc6276f07647b7cf5be3601ec872e6953314945d907c33f6852bf6801

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
538B

MD5
f7957bb394e3b37e864051f4441d1c9f

SHA1
2d898c1cd0ebbc914363727761b3f1103eba050a

SHA256
bf5bbe84a85b82bc1a360dbbd14ec27e47ba5477be8c63cda841e92f71a8a14a

SHA512
e998dbd94de8349f90773ad163790fa664e75545db716d89fb963c039597ff2108967ecb6e1f7c52fbe2a7ff43212cf34d8325baed4fd4e0afca0de570230caa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe587fca.TMP

Filesize
368B

MD5
d2c7234a9e0e64a9a7fa362af7f20616

SHA1
cd050e34fd0657f28d1c1b191d431a2f1b009bb8

SHA256
70b07a96a7fff5a0de4f88c56a767966c1a5a0a8ededa88dd24bf536bf54dddd

SHA512
a8f4413299632a7cde7a23feb0b10dc2ef870b2abdc1910e16cc0d398a38de18a2eb4c309c68774fb3aed9413e2e9599f24fafb7768688f22f18d54d7ddc526d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d3433a6b-466a-4ed1-a4fc-8562d71911b0.tmp

Filesize
5KB

MD5
378db802a15bc5663aceff771546a7e0

SHA1
8cfddeff9169a6d6b917827f8bc10cb1fe28c1f7

SHA256
358ec4aa1156ed1c4c9eda122687cd1d54b3a33966c3f606a066039cddbf4086

SHA512
51dd8a10174a92f6b439f1372b5642f87750b12e2e6583f8dc7644fbbbe32208cc27da4e0970c2edff696aee006b1cd4f756289dc6925fe6e817c2ad67e0322d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
8b39f3bd39d9f67a861b17cbe1ab7a09

SHA1
5c56ca7383e5b17f540c77e573b03a94f7db85d3

SHA256
93d9e5b5853b9d6c04475c00791a3d6b80ffcf765729acf5e0cd5afc3b3f8993

SHA512
2f98aa1842bcb4b3f203936178b93c6a8f67a16efbd839c787dc7463886a1330e74f7377f3b73cf22cc08de1a9ad1b93a80fd7abe0d472af978acb17d654ce03

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
505e5850f06accc4c28835f24ae79e91

SHA1
f0b7467dea060ef9b85a0951d1a4731ed9aaa588

SHA256
a91855d0fd4c1186a10923461535903fb3a9aa019264494c23fe12c9a32aee47

SHA512
8abe863ec828cf01941b49dcc9c6fb471fbdcd621830b1d8efc603830b3084f3ee4d4a545bac389e4ede221e9ac7a24d174adc0b9289c6e224bae889f8a27f0c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
393a88100a17d0825d1bea4d001eb9da

SHA1
bb6605c2801726ac2e9ca213b553775c150a5d4c

SHA256
8e8f31d51404f9823e4f4f818179f441ab24fa4e4ee69cbc7dc58da4e26e3c9c

SHA512
0dee4c791e4fd9b35b95bb1f38984677c2e53edd7df9b5d4dd9911a6293c81da644e7156621fb966114acb33a19e097f1d54a03e29a02c4d3499666a95a886d0

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 721729.crdownload

Filesize
431KB

MD5
fbbdc39af1139aebba4da004475e8839

SHA1
de5c8d858e6e41da715dca1c019df0bfb92d32c0

SHA256
630325cac09ac3fab908f903e3b00d0dadd5fdaa0875ed8496fcbb97a558d0da

SHA512
74eca8c01de215b33d5ceea1fda3f3bef96b513f58a750dba04b0de36f7ef4f7846a6431d52879ca0d8641bfd504d4721a9a96fa2e18c6888fd67fa77686af87

Download Submit
C:\Windows\43C1.tmp

Filesize
60KB

MD5
347ac3b6b791054de3e5720a7144a977

SHA1
413eba3973a15c1a6429d9f170f3e8287f98c21c

SHA256
301b905eb98d8d6bb559c04bbda26628a942b2c4107c07a02e8f753bdcfe347c

SHA512
9a399916bc681964af1e1061bc0a8e2926307642557539ad587ce6f9b5ef93bdf1820fe5d7b5ffe5f0bb38e5b4dc6add213ba04048c0c7c264646375fcd01787

Download Submit
C:\Windows\infpub.dat

Filesize
401KB

MD5
1d724f95c61f1055f0d02c2154bbccd3

SHA1
79116fe99f2b421c52ef64097f0f39b815b20907

SHA256
579fd8a0385482fb4c789561a30b09f25671e86422f40ef5cca2036b28f99648

SHA512
f2d7b018d1516df1c97cfff5507957c75c6d9bf8e2ce52ae0052706f4ec62f13eba6d7be17e6ad2b693fdd58e1fd091c37f17bd2b948cdcd9b95b4ad428c0113

Download Submit
memory/2880-0-0x0000000002850000-0x0000000002851000-memory.dmp

Filesize
4KB

Download
memory/4452-3-0x0000000000700000-0x0000000000701000-memory.dmp

Filesize
4KB

Download
memory/4452-847-0x0000000010410000-0x000000001047E000-memory.dmp

Filesize
440KB

Download
memory/4452-2-0x00000000001F0000-0x00000000001F1000-memory.dmp

Filesize
4KB

Download
memory/4452-911-0x0000000010410000-0x000000001047E000-memory.dmp

Filesize
440KB

Download