badrabbit | hxxp://github[.]com

Analysis

max time kernel
510s
max time network
511s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
20-02-2024 19:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://github.com

Score

10^/10

badrabbit cerber mimikatz discovery evasion ransomware

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Roaming\Microsoft\OneNote\16.0\_R_E_A_D___T_H_I_S___BNLC8NQ9_.txt

Family

cerber

Ransom Note

Hi, I'am CRBR ENCRYPTOR ;) ----- ALL YOUR DOCUMENTS, PH0T0S, DATABASES AND OTHER IMPORTANT FILES HAVE BEEN ENCRYPTED! ----- The only one way to decrypt your files is to receive the private key and decryption program. To receive the private key and decryption program go to any decrypted folder, inside there is the special file (*_R_E_A_D___T_H_I_S_*) with complete instructions how to decrypt your files. If you cannot find any (*_R_E_A_D___T_H_I_S_*) file at your PC, follow the instructions below: ----- 1. Download "Tor Browser" from https://www.torproject.org/ and install it. 2. In the "Tor Browser" open your personal page here: http://xpcx6erilkjced3j.onion/1943-0929-9822-0098-B103 Note! This page is available via "Tor Browser" only. ----- Also you can use temporary addresses on your personal page without using "Tor Browser". ----- 1. http://xpcx6erilkjced3j.1n5mod.top/1943-0929-9822-0098-B103 2. http://xpcx6erilkjced3j.19kdeh.top/1943-0929-9822-0098-B103 3. http://xpcx6erilkjced3j.1mpsnr.top/1943-0929-9822-0098-B103 4. http://xpcx6erilkjced3j.18ey8e.top/1943-0929-9822-0098-B103 5. http://xpcx6erilkjced3j.17gcun.top/1943-0929-9822-0098-B103 ----- Note! These are temporary addresses! They will be available for a limited amount of time! -----

URLs

http://xpcx6erilkjced3j.onion/1943-0929-9822-0098-B103

http://xpcx6erilkjced3j.1n5mod.top/1943-0929-9822-0098-B103

http://xpcx6erilkjced3j.19kdeh.top/1943-0929-9822-0098-B103

http://xpcx6erilkjced3j.1mpsnr.top/1943-0929-9822-0098-B103

http://xpcx6erilkjced3j.18ey8e.top/1943-0929-9822-0098-B103

http://xpcx6erilkjced3j.17gcun.top/1943-0929-9822-0098-B103

Signatures

BadRabbit
Ransomware family discovered in late 2017, mainly targeting Russia and Ukraine.
ransomware badrabbit
Cerber
Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.
ransomware cerber
Mimikatz
mimikatz is an open source tool to dump credentials on Windows.
mimikatz

mimikatz is an open source tool to dump credentials on Windows 1 IoCs

resource	yara_rule
behavioral1/files/0x000b00000001da0f-526.dat	mimikatz

Blocklisted process makes network request 5 IoCs

flow	pid	Process
3286	184	rundll32.exe
3324	184	rundll32.exe
3365	184	rundll32.exe
3407	184	rundll32.exe
3438	184	rundll32.exe

Contacts a large (1109) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Modifies Windows Firewall 2 TTPs 2 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2260	netsh.exe
3584	netsh.exe

Drops startup file 2 IoCs

description	ioc	Process
File opened for modification	\??\c:\users\admin\appdata\roaming\microsoft\word\startup\	[email protected]
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LOGON.exe	[email protected]

Executes dropped EXE 1 IoCs

pid	Process
4880	9E9C.tmp

Loads dropped DLL 1 IoCs

pid	Process
184	rundll32.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\z:	[email protected]
File opened (read-only)	\??\g:	[email protected]
File opened (read-only)	\??\o:	[email protected]
File opened (read-only)	\??\q:	[email protected]
File opened (read-only)	\??\s:	[email protected]
File opened (read-only)	\??\j:	[email protected]
File opened (read-only)	\??\l:	[email protected]
File opened (read-only)	\??\x:	[email protected]
File opened (read-only)	\??\y:	[email protected]
File opened (read-only)	\??\b:	[email protected]
File opened (read-only)	\??\k:	[email protected]
File opened (read-only)	\??\n:	[email protected]
File opened (read-only)	\??\m:	[email protected]
File opened (read-only)	\??\p:	[email protected]
File opened (read-only)	\??\r:	[email protected]
File opened (read-only)	\??\t:	[email protected]
File opened (read-only)	\??\a:	[email protected]
File opened (read-only)	\??\e:	[email protected]
File opened (read-only)	\??\h:	[email protected]
File opened (read-only)	\??\i:	[email protected]
File opened (read-only)	\??\u:	[email protected]
File opened (read-only)	\??\v:	[email protected]
File opened (read-only)	\??\w:	[email protected]

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service

T1102

flow	ioc
65	raw.githubusercontent.com
66	raw.githubusercontent.com
79	camo.githubusercontent.com
87	raw.githubusercontent.com

Drops file in System32 directory 38 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\excel	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\outlook	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\the bat!	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\office	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\office	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\desktop	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\excel	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\outlook	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\office	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\powerpoint	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\onenote	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\powerpoint	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\the bat!	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\thunderbird	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\bitcoin	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft sql server	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\excel	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\outlook	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\bitcoin	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\word	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\word	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\documents	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft sql server	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\powerpoint	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\steam	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\onenote	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\outlook	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\powerpoint	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\thunderbird	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\word	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\excel	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\microsoft sql server	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\office	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\steam	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\word	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\microsoft sql server	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\onenote	[email protected]
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\onenote	[email protected]

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tmp213A.bmp"	[email protected]

Drops file in Program Files directory 20 IoCs

description	ioc	Process
File opened for modification	\??\c:\program files (x86)\microsoft\microsoft sql server	[email protected]
File opened for modification	\??\c:\program files (x86)\microsoft\outlook	[email protected]
File opened for modification	\??\c:\program files (x86)\	[email protected]
File opened for modification	\??\c:\program files (x86)\microsoft\word	[email protected]
File opened for modification	\??\c:\program files (x86)\outlook	[email protected]
File opened for modification	\??\c:\program files (x86)\word	[email protected]
File opened for modification	\??\c:\program files (x86)\excel	[email protected]
File opened for modification	\??\c:\program files (x86)\microsoft sql server	[email protected]
File opened for modification	\??\c:\program files (x86)\onenote	[email protected]
File opened for modification	\??\c:\program files (x86)\thunderbird	[email protected]
File opened for modification	\??\c:\program files (x86)\microsoft\powerpoint	[email protected]
File opened for modification	\??\c:\program files (x86)\office	[email protected]
File opened for modification	\??\c:\program files (x86)\powerpoint	[email protected]
File opened for modification	\??\c:\program files\	[email protected]
File opened for modification	\??\c:\program files (x86)\bitcoin	[email protected]
File opened for modification	\??\c:\program files (x86)\microsoft\excel	[email protected]
File opened for modification	\??\c:\program files (x86)\microsoft\office	[email protected]
File opened for modification	\??\c:\program files (x86)\microsoft\onenote	[email protected]
File opened for modification	\??\c:\program files (x86)\steam	[email protected]
File opened for modification	\??\c:\program files (x86)\the bat!	[email protected]

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\dispci.exe	rundll32.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\excel	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft sql server	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\powerpoint	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\word	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\office	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\onenote	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\powerpoint	[email protected]
File opened for modification	\??\c:\windows\	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft sql server	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\office	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\onenote	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\powerpoint	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\word	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\word	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\bitcoin	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\outlook	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\powerpoint	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\onenote	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\steam	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\localservice\desktop	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\excel	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\onenote	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\outlook	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\outlook	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\word	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\outlook	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\onenote	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\the bat!	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\thunderbird	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\localservice\documents	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\word	[email protected]
File created	C:\Windows\cscc.dat	rundll32.exe
File opened for modification	C:\WINDOWS\SysWOW64	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\microsoft sql server	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\outlook	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\powerpoint	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\outlook	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\office	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\bitcoin	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft sql server	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\excel	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\office	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\onenote	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\steam	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\excel	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\office	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\onenote	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\steam	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\thunderbird	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\word	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\powerpoint	[email protected]
File opened for modification	C:\Windows\9E9C.tmp	rundll32.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\bitcoin	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\bitcoin	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\excel	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft sql server	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\powerpoint	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\powerpoint	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\the bat!	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\desktop	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\excel	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\office	[email protected]
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\office	[email protected]

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
4936	schtasks.exe
3552	schtasks.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
4848	taskkill.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000_Classes\Local Settings	[email protected]

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
1708	NOTEPAD.EXE

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4996	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2884	msedge.exe
2884	msedge.exe
3108	msedge.exe
3108	msedge.exe
1360	identity_helper.exe
1360	identity_helper.exe
2960	msedge.exe
2960	msedge.exe
184	rundll32.exe
184	rundll32.exe
184	rundll32.exe
184	rundll32.exe
4880	9E9C.tmp
4880	9E9C.tmp
4880	9E9C.tmp
4880	9E9C.tmp
4880	9E9C.tmp
4880	9E9C.tmp
4880	9E9C.tmp
4064	msedge.exe
4064	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
5084	msedge.exe
5084	msedge.exe
1940	[email protected]
1940	[email protected]
1940	[email protected]
1940	[email protected]
1940	[email protected]
1940	[email protected]
1940	[email protected]
1940	[email protected]
1940	[email protected]
1940	[email protected]
1940	[email protected]
1940	[email protected]
1940	[email protected]
1940	[email protected]
1940	[email protected]
1940	[email protected]
1940	[email protected]
1940	[email protected]
1940	[email protected]
1940	[email protected]
1940	[email protected]
1940	[email protected]
1940	[email protected]
1940	[email protected]
1940	[email protected]
1940	[email protected]
1940	[email protected]
1940	[email protected]
1940	[email protected]
1940	[email protected]
1940	[email protected]
1940	[email protected]
1940	[email protected]
1940	[email protected]
1940	[email protected]
1940	[email protected]
1940	[email protected]

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeShutdownPrivilege	184	rundll32.exe
Token: SeDebugPrivilege	184	rundll32.exe
Token: SeTcbPrivilege	184	rundll32.exe
Token: SeDebugPrivilege	4880	9E9C.tmp
Token: SeShutdownPrivilege	2712	[email protected]
Token: SeCreatePagefilePrivilege	2712	[email protected]
Token: SeDebugPrivilege	1940	[email protected]
Token: SeDebugPrivilege	4848	taskkill.exe

Suspicious use of FindShellTrayWindow 49 IoCs

pid	Process
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3108 wrote to memory of 2092	3108	msedge.exe	74
PID 3108 wrote to memory of 2092	3108	msedge.exe	74
PID 3108 wrote to memory of 3728	3108	msedge.exe	88
PID 3108 wrote to memory of 3728	3108	msedge.exe	88
PID 3108 wrote to memory of 3728	3108	msedge.exe	88
PID 3108 wrote to memory of 3728	3108	msedge.exe	88
PID 3108 wrote to memory of 3728	3108	msedge.exe	88
PID 3108 wrote to memory of 3728	3108	msedge.exe	88
PID 3108 wrote to memory of 3728	3108	msedge.exe	88
PID 3108 wrote to memory of 3728	3108	msedge.exe	88
PID 3108 wrote to memory of 3728	3108	msedge.exe	88
PID 3108 wrote to memory of 3728	3108	msedge.exe	88
PID 3108 wrote to memory of 3728	3108	msedge.exe	88
PID 3108 wrote to memory of 3728	3108	msedge.exe	88
PID 3108 wrote to memory of 3728	3108	msedge.exe	88
PID 3108 wrote to memory of 3728	3108	msedge.exe	88
PID 3108 wrote to memory of 3728	3108	msedge.exe	88
PID 3108 wrote to memory of 3728	3108	msedge.exe	88
PID 3108 wrote to memory of 3728	3108	msedge.exe	88
PID 3108 wrote to memory of 3728	3108	msedge.exe	88
PID 3108 wrote to memory of 3728	3108	msedge.exe	88
PID 3108 wrote to memory of 3728	3108	msedge.exe	88
PID 3108 wrote to memory of 3728	3108	msedge.exe	88
PID 3108 wrote to memory of 3728	3108	msedge.exe	88
PID 3108 wrote to memory of 3728	3108	msedge.exe	88
PID 3108 wrote to memory of 3728	3108	msedge.exe	88
PID 3108 wrote to memory of 3728	3108	msedge.exe	88
PID 3108 wrote to memory of 3728	3108	msedge.exe	88
PID 3108 wrote to memory of 3728	3108	msedge.exe	88
PID 3108 wrote to memory of 3728	3108	msedge.exe	88
PID 3108 wrote to memory of 3728	3108	msedge.exe	88
PID 3108 wrote to memory of 3728	3108	msedge.exe	88
PID 3108 wrote to memory of 3728	3108	msedge.exe	88
PID 3108 wrote to memory of 3728	3108	msedge.exe	88
PID 3108 wrote to memory of 3728	3108	msedge.exe	88
PID 3108 wrote to memory of 3728	3108	msedge.exe	88
PID 3108 wrote to memory of 3728	3108	msedge.exe	88
PID 3108 wrote to memory of 3728	3108	msedge.exe	88
PID 3108 wrote to memory of 3728	3108	msedge.exe	88
PID 3108 wrote to memory of 3728	3108	msedge.exe	88
PID 3108 wrote to memory of 3728	3108	msedge.exe	88
PID 3108 wrote to memory of 3728	3108	msedge.exe	88
PID 3108 wrote to memory of 2884	3108	msedge.exe	89
PID 3108 wrote to memory of 2884	3108	msedge.exe	89
PID 3108 wrote to memory of 4536	3108	msedge.exe	90
PID 3108 wrote to memory of 4536	3108	msedge.exe	90
PID 3108 wrote to memory of 4536	3108	msedge.exe	90
PID 3108 wrote to memory of 4536	3108	msedge.exe	90
PID 3108 wrote to memory of 4536	3108	msedge.exe	90
PID 3108 wrote to memory of 4536	3108	msedge.exe	90
PID 3108 wrote to memory of 4536	3108	msedge.exe	90
PID 3108 wrote to memory of 4536	3108	msedge.exe	90
PID 3108 wrote to memory of 4536	3108	msedge.exe	90
PID 3108 wrote to memory of 4536	3108	msedge.exe	90
PID 3108 wrote to memory of 4536	3108	msedge.exe	90
PID 3108 wrote to memory of 4536	3108	msedge.exe	90
PID 3108 wrote to memory of 4536	3108	msedge.exe	90
PID 3108 wrote to memory of 4536	3108	msedge.exe	90
PID 3108 wrote to memory of 4536	3108	msedge.exe	90
PID 3108 wrote to memory of 4536	3108	msedge.exe	90
PID 3108 wrote to memory of 4536	3108	msedge.exe	90
PID 3108 wrote to memory of 4536	3108	msedge.exe	90
PID 3108 wrote to memory of 4536	3108	msedge.exe	90
PID 3108 wrote to memory of 4536	3108	msedge.exe	90

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://github.com
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe27b146f8,0x7ffe27b14708,0x7ffe27b14718
  2⤵
  PID:2092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2036,15890407227401652265,4582611054520458751,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2060 /prefetch:2
  2⤵
  PID:3728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2036,15890407227401652265,4582611054520458751,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2036,15890407227401652265,4582611054520458751,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2776 /prefetch:8
  2⤵
  PID:4536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,15890407227401652265,4582611054520458751,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:1612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,15890407227401652265,4582611054520458751,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:3648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,15890407227401652265,4582611054520458751,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4664 /prefetch:1
  2⤵
  PID:184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2036,15890407227401652265,4582611054520458751,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3556 /prefetch:8
  2⤵
  PID:752
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2036,15890407227401652265,4582611054520458751,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5488 /prefetch:8
  2⤵
  PID:3900
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2036,15890407227401652265,4582611054520458751,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5488 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,15890407227401652265,4582611054520458751,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3544 /prefetch:1
  2⤵
  PID:5064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,15890407227401652265,4582611054520458751,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5264 /prefetch:1
  2⤵
  PID:1560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,15890407227401652265,4582611054520458751,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4900 /prefetch:1
  2⤵
  PID:1916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,15890407227401652265,4582611054520458751,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5792 /prefetch:1
  2⤵
  PID:4696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2036,15890407227401652265,4582611054520458751,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6004 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,15890407227401652265,4582611054520458751,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4912 /prefetch:1
  2⤵
  PID:2736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2036,15890407227401652265,4582611054520458751,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5660 /prefetch:8
  2⤵
  PID:1804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2036,15890407227401652265,4582611054520458751,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6332 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,15890407227401652265,4582611054520458751,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1824 /prefetch:1
  2⤵
  PID:2572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2036,15890407227401652265,4582611054520458751,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1048 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2036,15890407227401652265,4582611054520458751,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6080 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,15890407227401652265,4582611054520458751,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4912 /prefetch:1
  2⤵
  PID:3448

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1916

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3784

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3740

C:\Users\Admin\AppData\Local\Temp\Temp1_BadRabbit.zip\[email protected]
"C:\Users\Admin\AppData\Local\Temp\Temp1_BadRabbit.zip\[email protected]"
1⤵
PID:1692
- C:\Windows\SysWOW64\rundll32.exe
  C:\Windows\system32\rundll32.exe C:\Windows\infpub.dat,#1 15
  2⤵
  - Blocklisted process makes network request
  - Loads dropped DLL
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:184
- - C:\Windows\SysWOW64\cmd.exe
    /c schtasks /Delete /F /TN rhaegal
    3⤵
    PID:1388
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /Delete /F /TN rhaegal
      4⤵
      PID:4796
- - C:\Windows\SysWOW64\cmd.exe
    /c schtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR "C:\Windows\system32\cmd.exe /C Start \"\" \"C:\Windows\dispci.exe\" -id 356262646 && exit"
    3⤵
    PID:3452
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR "C:\Windows\system32\cmd.exe /C Start \"\" \"C:\Windows\dispci.exe\" -id 356262646 && exit"
      4⤵
      Creates scheduled task(s)
      PID:3552
- - C:\Windows\SysWOW64\cmd.exe
    /c schtasks /Create /SC once /TN drogon /RU SYSTEM /TR "C:\Windows\system32\shutdown.exe /r /t 0 /f" /ST 19:51:00
    3⤵
    PID:4444
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /Create /SC once /TN drogon /RU SYSTEM /TR "C:\Windows\system32\shutdown.exe /r /t 0 /f" /ST 19:51:00
      4⤵
      Creates scheduled task(s)
      PID:4936
- - C:\Windows\9E9C.tmp
    "C:\Windows\9E9C.tmp" \\.\pipe\{C5181481-02BA-4FC2-882E-B6C8DBC367DE}
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4880

C:\Users\Admin\AppData\Local\Temp\Temp1_Cerber 5.zip\[email protected]
"C:\Users\Admin\AppData\Local\Temp\Temp1_Cerber 5.zip\[email protected]"
1⤵
- Drops startup file
- Enumerates connected drives
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:2712
- C:\Windows\SysWOW64\netsh.exe
  C:\Windows\system32\netsh.exe advfirewall set allprofiles state on
  2⤵
  - Modifies Windows Firewall
  PID:2260
- C:\Windows\SysWOW64\netsh.exe
  C:\Windows\system32\netsh.exe advfirewall reset
  2⤵
  - Modifies Windows Firewall
  PID:3584
- C:\Windows\SysWOW64\mshta.exe
  "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\_R_E_A_D___T_H_I_S___ZNRZ18UV_.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
  2⤵
  PID:4424
- C:\Windows\SysWOW64\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\_R_E_A_D___T_H_I_S___PX5C34PL_.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:1708
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /d /c taskkill /f /im "E" > NUL & ping -n 1 127.0.0.1 > NUL & del "C" > NUL && exit
  2⤵
  PID:4532
- - C:\WINDOWS\SysWOW64\taskkill.exe
    taskkill /f /im "E"
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4848
- - C:\WINDOWS\SysWOW64\PING.EXE
    ping -n 1 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:4996

C:\Users\Admin\AppData\Local\Temp\Temp1_DeriaLock.zip\[email protected]
"C:\Users\Admin\AppData\Local\Temp\Temp1_DeriaLock.zip\[email protected]"
1⤵
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1940

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:3780

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Network Service Discovery

T1046

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
5e77545b7e1c504b2f5ce7c5cc2ce1fe

SHA1
d81a6af13cf31fa410b85471e4509124ebeaff7e

SHA256
cbb617cd6cde793f367df016b200d35ce3c521ab901bbcb52928576bb180bc11

SHA512
cbc65c61334a8b18ece79acdb30a4af80aa9448c3edc3902b00eb48fd5038bf6013d1f3f6436c1bcb637e78c485ae8e352839ca3c9ddf7e45b3b82d23b0e6e37

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
32667b4e5f290ce05ae910bfef4f4a25

SHA1
a19b7afd0507ea4348b52de77d41d636719273f8

SHA256
82b2df14569211a03574a9211f1f11b0f96835173627e2e636f78eb45a2b8469

SHA512
faa592e23a8ad401698b9841692bfbc18aceb62c1b512e0ae98ee0e36ce892b7d7c149f264a1891619283de98031dc943de24411e8d8d18cf4b1d9da61c4ad30

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
25418d669b110abe86bccc6d0b327ddd

SHA1
72a100c2a23c60e96e213f6117e618bddab28614

SHA256
e40326fa58235224c1020b9bf12454c4da9ed3fa5622bcf593a668308a19e21e

SHA512
d41bf33cabd37aa91aded25c5e6630074cc448b40ab891747f757fb10775e301c8fdb6ed53d9ccceb55e3b522716c6d854de4e36763b6f815ca060eb8c20d7ce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
f62d206087a4b8b2364e96f5aae29921

SHA1
51fe302b01f82bc8c269712818e321cf357666c3

SHA256
ec0a0cc81aec13a1d16d635760126845afa17d6ac208e4408078e8ca59bbfd82

SHA512
b69459691cb88739f83f44651548e98fa533f807705f2911b3ab489de672ad5dd17ee915c67730f9e90c6fd06725834ad00ad0d157a76ade300e6dc165ff3051

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
579B

MD5
b172a1f943f523da5eb756b3d8929415

SHA1
24074040f2a89fb5cf502d876313bc3cc2f47d34

SHA256
6ddaae37e8d36c7b1e1d5f025bd00d80736522a179504fd3c5d93f9ea2638ad6

SHA512
42f285938664b7f87c495f5d9b123282fb2208b5c00f4d7f066d8019f1a1a993cc9a3ade9250c3ee5077cc5619c87b459608538ae87d4ca67ebcceb6821fbf9e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
cc13d637bca24eed918d1a552534dab2

SHA1
fb8c343248e7488f4743af9a4ccba33e78f6b0db

SHA256
628f14fd9e3e66812d588fed534e0bb395af66f1197cf108875d0bd16f3e41ec

SHA512
8241c4d72aeccfb1172112224ce60be8091825e71c1963552d8e663c91a1a06a589f5047a94842ce72b412f364075a59cc5dc8fe29e986446a37ac40df33424e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f1b42a77ff5911b23df1c428a513557c

SHA1
692ba23dbb2501dc31b706c7fef62e315f8a8963

SHA256
e381c5afab9e1ce4dcf7077cf940c48bb113c64fe794e6e934445f89c7a0604d

SHA512
939761725c4d835cf23926edba2f5243aa1248bece181a0fa56e370476bdccf47c3e9fb0e0e1998388b8cf21922359a4ea1e38bf95c47ca6d0c78b6b2a29f149

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
52620ed42574f37a98e0ae4557efc226

SHA1
1242f7b4b945c36bd7e4cfecbf97a97401c7772c

SHA256
6aaa8f95b7a55ebae86d38c914f369b8ed1bfabdb844c6f4aeb0fa2fe807ab9f

SHA512
0068bbee24e82d22176df07d79a92f1bad239c97b7fb39afac4d597da97cfee45a32199397f4d07519e786885135847d2000149857501a7567a867a0fbe34f0a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
19288dd902c94bb6878b67f976f20b30

SHA1
6395def4349349b4450af7b95cc430fd82696966

SHA256
704dd2ff16f72fa8aa191a248f87f9809aa138265c6b344a9a3f877f7d01c518

SHA512
50c4a6f1f3b8973ffb0b2bf98ffbcf5e33adbb797fc5a08868aea53376328d49bba905e764dc4c2f70c69fc419db185ce77d3e07e71a24096ebe8bf56bc95adb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b0c53652588acf7de9d3ea5b683d172e

SHA1
6b566b0e7850ed1dd57acb60e92d9a81de1c1130

SHA256
6e8e62ee41c99241924e12adef6f11cfb2778b00c54f95dfae2d465315bfe3dd

SHA512
d8c27032b4e5b32bb5c3b32e21afa42309105dd5be3b425a7f4ec72a23c9b72ba350ba434115cf37c9c5277649a113e34aed30c30cee2102e92e9706e6a81d8e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
eb9bfe1285056e6c87029292d7203cd6

SHA1
a78eccc188fca1eed6ad27ebcc0eb040efebed1e

SHA256
4eee3471930e2201f797e81d4eb3973c98e092b2b992ddf529a4bf2a56e7e56a

SHA512
c75ff848d975cb898aa9b1aaa5b43c91d4646f4c4119db487d3f6a95f266d25fd82301bf4f2f5e6e56c52f47660c62acb0fa58dd8f95c775dc70dadb41a142c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
af3c2c05c5b385f65955c8b338c32851

SHA1
9e897b3485c3f633fae61c49280e8e5854d2cbe7

SHA256
0443bcd7229de3e5c4273eb95f753042d8795cafd1bcf58929d6bd1ce4104f41

SHA512
7c4ba641ab023bebe0db7999c306adfa66784e24da9e00539e572a335e3a89f9276a17737593aa05a10c90b26b6b1aba3820d2eec418ec7133e44120aeb3f7f1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
7f34525ff37d78edb38f8349baef6d4f

SHA1
9703840d5a1c32289ce874bacf5ce120e62d2753

SHA256
946d52b4b23d55525a9ac44592bf8b4541987a91df32959d20946b17727f8da0

SHA512
89e8b4b93e1c38e6b86a8603c5321d2f206b8b6fdb0b9be51b2835d73f7e4eaeb97a3bc6a0bca83b1f383484e06c66dc0ddd0a0da9b67b4962599ed48ea28fdc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
6db2d2ceb22a030bd1caa72b32cfbf98

SHA1
fe50f35e60f88624a28b93b8a76be1377957618b

SHA256
7b22b0b16088ab7f7d6f938d7cfe9ae807856662ce3a63e7de6c8107186853e4

SHA512
d5a67a394003f559c98e1a1e9e31c2d473d04cc075b08bb0aab115ce42744da536895df2cec73fa54fc36f38d38e4906680cfacfbf4698ee925f1609fbb07912

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
706B

MD5
7edbb8650e485c9eb72738f7ea9296df

SHA1
c07f113e0524e2036aaf5523c5b9c2dc19b6ed68

SHA256
4402462767572924004811b4e1574ca7aeadc48e432297789b35222b6df9d76d

SHA512
cff8d19807e8f5934dc80deab7b5d2e2e747669947d91cd5bd147e2624e3106abb4997167c8c151b2c826ab35db4ffac7e77c005bd27997fc9004df72038e179

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
8c32232e93cc3a248d9720a8941fa271

SHA1
2357bc5491ab2a9bdc47add4847b5a7be9ea3811

SHA256
49564a48a675133946c693dd60183782becb1e8974c54c6fd97b874d87b7905b

SHA512
b7e81a60e1a9527bf4c6250843f547110e0e6b34841be202dc04c6fcf1d693332c2d3f7b04d3095efb094c0cfddead742452d57f9110ceeb68e82f05c0c5c3cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
86a36950c30ba00ab434d234aa700bd0

SHA1
6d3eddda7912362eae495fd6fab3adab996cd023

SHA256
000aa0a47b9f50a724480584b9ae9a24896a054eb5183a61c83b1d369d1d266b

SHA512
fc2ffd36482ebb798bf88fa9b18c5cd22a57a8280931991d4c8ac46617f4d223c098fb98323fc3c00b51bd17b2f320eaedd52cd41b1e1142e0b3c42ca9b5015a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
712000cecc1161ecf16aa676e7f3a7c0

SHA1
d11393a3b13860ad1d09591870f360afb4122798

SHA256
725f03cf5ce0a0bba61a56ee852a78ef39233eba7e3f06894eee3abe671a189e

SHA512
ab539a669697ea3ca9bc4a4bb17793e80ab0ba0fd50cd579cd9ac8c103d171221597e4616d065c4f8e43809b1f3b9dfdfa8ed1506959a86c692d854f9b09a44e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
ebe4b96c88234f5713394f282e4ead87

SHA1
66fd552e8803747e44d23df92fbb99a9d6d5fce0

SHA256
a82fc5441b0b18e6476eee2c11a4cff2741f9143b489d6e989751c4cd0d18dac

SHA512
b50cf266a878917c8c102802ee1251a45a23c6df8c7516ce074bfa03bfcd7b9fcbfd6f0f1967160ae87033da12245102d07b392b923535059b253d7ccf29369d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
f3fdee8a79e240cc834599abe27839f6

SHA1
9fc8ab11c3c8725af56d362b9fcab8d39181c003

SHA256
badbe8d62fc80954f2f8454f7073ae7c18fefc93ef493fb5615e57f2028e9788

SHA512
b3d03b4c33962fda36bdc04a5ba51c993b8245d0a77d6a96ceb9149eef7930b4ef51e9a70ca6c2ee111b14307ccf18e9280dc626ba3cc42e2cb8af28fd1e54ea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
d6362552c02b880a5be8a5338881dba6

SHA1
bffc73029223e3ad288fc6d7cebe5d517e4c0549

SHA256
a4e484d5e03da4f3f5a6e07b63c7928bc008770404914ba589b024e1b0855381

SHA512
37ce3249d3525d2c372d49fffab9d6a8445797e0739b394acda7f27fae73cf89ed3da191ca3fcadeed983b663f5bfd76041f42acfd4f26c02888b6536e5a2511

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
803a52ce657916a6c0fc12a5f6ad74bc

SHA1
63a15bd7cc977d3a38a15105a1955c69f052ac07

SHA256
468152164f5249d17b13e9293847ff36f3f41608faa180fa83237aaeab86601a

SHA512
0cc45e0d487b2090652bb6dfdfe16d62fbc4bd81a7df5a2571112e984c9aeeafbd07a4d85214f7540c81d37bfd777e06625957ea246383503115b5c5bd6139b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
5b08a6cb8704312ed49d8717be54328a

SHA1
44808d02852e3015a5b00a122dc2405ae4c2265c

SHA256
7cf4670cecca609ab94a4023947777fd84765406cdd561a4a7f1564ebfa19a0c

SHA512
ea1f99c16bb65bf2925e67452f5a08f1b7129275c636c6e6689a34036f678f3f5a506cd575cdb204132549a61b64ea921d8d0ee490070604cfc71b126de2f784

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
2016d92ae53cdabac4fd995a815ae3de

SHA1
103ffede508bfd36427a320e3194cca814d0229e

SHA256
849a8b2a94719d326bce83f57778473a9ab9140a605852c1ccc0d519e35c7ae9

SHA512
cd7ca8834fdada3a91ae5a82e3d31d1323ec2cda440b0e7cf239769b3354a54f40266d1a435aa778512557faeef68206b54aef0ba0376689b6f6b91734b94137

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
b4c5a1e0f71d4da72dddddf1f8e27b6e

SHA1
7344aaeafe13fb988d286b87dd1dae5645284dcf

SHA256
7abff6d05eefe1053943d0a21f754455485232da326e40ce197f415aa604499e

SHA512
8a5a6ca87561672a7da886088673512be511be5595de5aeee8d8e19db623619a47b2dbb1a9f0cff80130aa88a3fbd0166b9f38a31a2a50dbf525207b599b7520

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\OneNote\16.0\_R_E_A_D___T_H_I_S___4Q7Q0FHW_.hta

Filesize
75KB

MD5
3606a0aabe632da89ddeb1ad00df57e1

SHA1
2073b22bcae815b89a652dd695aad4f138d4b9ce

SHA256
93e290567cd2cf8bef99d01109215ac22b949e643910dd90ba6e39d0249d40ec

SHA512
8239ffa01fbfca5afa6e87bba1f9ec0584668542534c77cb74897afc5518d22f0663ea22b5906cf8322f59cbb345d9a98d5e80161d84eb8a677b39c610b9fcd4

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\OneNote\16.0\_R_E_A_D___T_H_I_S___BNLC8NQ9_.txt

Filesize
1KB

MD5
76b95cfc17b4aea3c96eec84158580e5

SHA1
fd28f764eceb976417b193ffa6d36223c8b13fd7

SHA256
0870100d0a570ed42927fc9132e9e9d8dc8ec4dd45c28813b17913b77e33d5be

SHA512
3d77d3c8c6653c7df5bdcc0fa6ce3d5c20154073c461604e82b93a8fe6f9819ae9cb55f3ce1037c495141349f79cea5e8ed971b39d57c60c171a6d465f345019

Download Submit
C:\Users\Admin\Desktop\-fiJN6ZmlU.a513

Filesize
274KB

MD5
d546268ef07d9ff58b149b29101fd64a

SHA1
e8460c409b6e604dbc534b6eb89b6e516a51507a

SHA256
760f4e988fa4f0a354eb43b9489c4e07dae472070fd03f02ac5670ddb4996cfd

SHA512
88f6466bdcb6f8dd60e56d98c63fa5cc90613f4433b270ccfd7c0408266c7cd5c902f223de24016ddc48bd5da98d39b0903f7962b53ee35be0d82298a613ed99

Download Submit
C:\Users\Admin\Desktop\36dZhUPHok.a513

Filesize
265KB

MD5
4dbe6a134f86e16117a69d789fc43777

SHA1
0aa8f5519f3396215a6b7c90737d2307215a8efd

SHA256
bf939a43587ffc821c9f4fb3924d707843ea25a205fe48e9ba5ee7a4edb2aaa0

SHA512
bdd4336807d3ae487363ff9bed8adeb6597cbc6c7f28490496db1e26fbad3159b98a8a4d16047523358f25bde13c6c29e1b2a2ce944bf2e65fe8aa8def46f1cb

Download Submit
C:\Users\Admin\Desktop\5IHKV1gi2X.a513

Filesize
282KB

MD5
070ae47c689547a6e08fd36c85ac604e

SHA1
7a59d35f71b09781036de6d175821c289319abc0

SHA256
04056f256126f593880b0858589678b80a31791561dd351833ba5a0487094c64

SHA512
83138cfcbabf677dc2fc8e804c6c4aa57221887da09065338f492627fc147cd60e5e2f01228e735988c467a49a0dc2d4f6afa47badf9fb987b843beece2ba0c8

Download Submit
C:\Users\Admin\Desktop\Dm4IvJpViG.a513

Filesize
164KB

MD5
ae4867ba3cd29ec9466f9450534a8dad

SHA1
30f281b21605ee12c88c18653123198af8407d19

SHA256
1ee36c589940da3e4337bc8e39a611e6e7253011dc947504639bb34ce58dbad6

SHA512
e924918f8d7ac24f02f51497f5a92cf8917fd64263572be7c2f230197cebacb5075b0ec4d259e56c583522d4e2da4a4cfda7fa941072f84e4dfee7f4bb413889

Download Submit
C:\Users\Admin\Desktop\ENhAKkuFfQ.a513

Filesize
181KB

MD5
c91998bf0f7b3d00b6917a9ed42b01f6

SHA1
22beda2e6f6f3c8155a7b256d53ff04de05852ac

SHA256
4df1cf6da2542bef80141988cbe802b9ef0552de594499f1272ac18e546ddd77

SHA512
b8897037d1028d54ca027031e4886b44f84b9d226eebdb7ccb28db5b6aaee72b10f00978b7e40435750ecba07317bf16d33398fe34373c1ea3efe95cddd28062

Download Submit
C:\Users\Admin\Desktop\KxiCqURGM5.a513

Filesize
190KB

MD5
5639674eca8bdf9319019adee94f200f

SHA1
0a8edb305bcb129ebd8b6a67bdb15c573f289220

SHA256
7b16b3adf82116259a621c590b9849775ce8d4b54f95671f15e1ef0d900dbe30

SHA512
6ccf2e2d7667422be2fdd99e3a7f3b3886358d0f347166237ea720da81e339b02fd39ae227368d556bb50dd23b7c3638485cc91f8d6620a3e56c69ee4a9af5d1

Download Submit
C:\Users\Admin\Desktop\NrxIJgoPGk.a513

Filesize
173KB

MD5
ecb018c079405d2b4af1f8cfff828a4e

SHA1
b6b1b423b9d75443ee4422449cae962898f2c2f6

SHA256
f854338b2bc67b7f6d4ed24e72f650e3ecb449b1b57155fc4b0db8da22d35d45

SHA512
ebbc78ba0bda997949d11273f2f772819a19f6aea0c89b41917233996839da843a82c354d6d9204b672a81fb5648bb9e8daa11fe2c002cfea6764bb2a31cbae3

Download Submit
C:\Users\Admin\Desktop\OxVh-KO2FJ.a513

Filesize
223KB

MD5
1c70196d88cbb97feb7b167f266ffe80

SHA1
8f3425c0fc624e2d8854ecaa2a77ec95a2715a9e

SHA256
daa705bfecc4a8b00c9930adc99a892d3378f0807847d442da94d14685e19d28

SHA512
3fbe4409e6460ce3f1a0ec5889a35d2ad2f8e707a9a5064365811b4fdcd0678a90962072610017dcc28529ff54eb728f68a4507d54455df4500f909cab2c9d8b

Download Submit
C:\Users\Admin\Desktop\bNd9pArtxu.a513

Filesize
249KB

MD5
7aefa02e4b6610eac9547c6e8a2671bb

SHA1
9df5520066c767012718809893729f7468e96773

SHA256
7d6a533b3d57f24d14cdbf8c597d1ea25af50eb7a07aeb1bfb31d8c0ab76c2e1

SHA512
ccf170dab41703991788de3d94945a086e3899dbbfcb86038b5efcc3f1b373a642d84338790c1b6fbaf4ab34bac65333342ba0eb3942c03a837ce780255f7d8b

Download Submit
C:\Users\Admin\Desktop\haQDZfjAwK.a513

Filesize
299KB

MD5
311bb6c85199b7d2cba92aede61c6e35

SHA1
6b9d7ff0a8ee1a55cb72f200d7a48901bce3e37e

SHA256
61358ae4cf8201f507ff6e48fc8ad4f7b8949b3824c51fee16efa601b1e64650

SHA512
2f75ea7a6dd6efc41ab44b8bcd64a6c8962b62a5fbcaa5ab2a095071649919bd09b02eb4e28958f771392d4de9c72496f455c2f7df996d2d0a8fdae9bb0d270a

Download Submit
C:\Users\Admin\Desktop\rCU8djgXXe.a513

Filesize
139KB

MD5
c19e3c774268045bccf6db5d17cc6add

SHA1
90b708c7b9faa6f0f55b67b985f347dfdcaeeb41

SHA256
d43fc55312faa1fbd39cfb9ecd12a3a81fdac5cfe67efc41fac5f3abe23fd336

SHA512
4c762fe61b2b47bc2c48a5f8a31475854dde95245c265d3998f9bbb55c79270da03983344dfefc359880e26e070da2f879690bed9bdb48a89b5a6299f842c0a8

Download Submit
C:\Users\Admin\Documents\1UhpxqNiht.a513

Filesize
591KB

MD5
37ca67a83280d238a5b22f1132080a20

SHA1
0a36b22e7605a653be1eaab7a804616696a5e70d

SHA256
ec860a385edba775852ceb7052622c8e1a4abb303662d4998ea05d3cc9e54f87

SHA512
438a69fb22eda976c2267fc4a483f46c15cc0e5073ee0e92d97f741887d8492d633454f6c3f69dfeb9006328abf72d65dc1717811a6a19751d64f4c61776a6b8

Download Submit
C:\Users\Admin\Documents\5b6K01kDrE.a513

Filesize
613KB

MD5
aae65d4e22d2dbafe6ba697a8956c34a

SHA1
ab832f2c1cb9e273ef610c343e7b03225681b0f9

SHA256
7438324aa7cbc96c59ce8e3d7462d0bf4c5db2c4f704d55d167aecf8a2694402

SHA512
61f90154051da8bbb9083d2ad181e83722c706e8d47715e8ba11508e3f07f7bbf3570abf1f93aeb62315ce7a20b07cc56e8900b24611f09bdbbed52d35dbc785

Download Submit
C:\Users\Admin\Documents\8or0cRyzsb.a513

Filesize
11KB

MD5
7392e548486ea87d2425f728e00145ca

SHA1
db7162a8894592fda9bd2dfc20f08fd664157110

SHA256
e16dd2fd7a0c47d137dce5ada6145edd2f3dba7f5fc001bf72119363600e0549

SHA512
4d817a3588ba9eeb62c237d51fabe2f8b43df0a3160dccd020af3ff60d6a86cf440c2fa9b0656305ada763dd1bbd4bb739384c28c774d7293fb7a8578ddd19a9

Download Submit
C:\Users\Admin\Documents\BYjK0jLx2V.a513

Filesize
11KB

MD5
7e1e15bb7ef6c02ab3df6fc19d35b82a

SHA1
d155372c8910e40f4cae7294033b7cbc94e469be

SHA256
6932cc655d7798908684305f720c71a89738320f662e28f9eada13990df45c6d

SHA512
2963a51fa0cc4fd0ed5c6079b9fb7c8d1bdb86ab2c9c87125be5bccfde1001da21779da5964eae78edbc38cca7d7ad1b27e8ee0718cd85d27645fce19580e044

Download Submit
C:\Users\Admin\Documents\CZokpsYI-5.a513

Filesize
477KB

MD5
b0dbb31f5c6fda0b45c55a868ea9c1c4

SHA1
70e96a8130d247a6439d08a95e4130cfc3c780d5

SHA256
c9a7c3e3f0cbc24a42389283ecfafcf761fc77f84a7b78e220dc0ebd3b37ee32

SHA512
f179b8b71f51a3726ab12ddbfb7b5fab4db0c4acd4505f7a98ed758a28fead8b6d5440821c0dcf8a0c37aaa9dd3ea1c5f37f3d72dc9c4544585f89e16f774b9b

Download Submit
C:\Users\Admin\Documents\FwGTbrkfZq.a513

Filesize
682KB

MD5
4d8b99e5f1b96d0251c2e2960a4a12fd

SHA1
8339ddbd6ecb9b9b5b61e8f06c20485798fdf4dc

SHA256
bb06190f10ccbe4a4beab9dd2b6fae24d38639ae1e8a13dc747c728eb4eda3a2

SHA512
b6e99a012c5d6b6518d95e9d064b945f5fedc04763db0d589bf93aac0906e8ffced1fa39350ea16ed6af02df17dc837422ca48d69f34cd6abed4a788faac13a3

Download Submit
C:\Users\Admin\Documents\H4u2u-lf5J.a513

Filesize
386KB

MD5
a1c3b06b9c8ac9bd13e0b018643f2614

SHA1
9f7e404b1f28722468384899dcdf61a13701cd95

SHA256
5059b94f02447ce118bad62dd7680016ad6965665d0c19edb77f0dcb10cdf94c

SHA512
38755ea96a5a4946f410b3de7d87c997f33e31ab545534ba605ac94b7373b32245bbd06479e61cebd1fb3a73aed298e95d82041af7d555fd438a2810d14791a0

Download Submit
C:\Users\Admin\Documents\N0Abbc-bOk.a513

Filesize
318KB

MD5
89cc9dad4a87b876b8279ee817216362

SHA1
a922416e8ebadbfa39dbcd7b65f81abc54fdd82a

SHA256
d5e516faf7919a80e95885ac0c24476011dcb43e88ceacae64fae77b80005d79

SHA512
fcf775f8f891b9b4d30912432c9792b1d5866f0e810587f391df09ee4ba9147c03edc74b5c0c40a2bb932afe7f95d0df635ccf696874ef7e31ecf4952013c377

Download Submit
C:\Users\Admin\Documents\O9x4dLg4Dt.a513

Filesize
818KB

MD5
062597dbed238abaccc70b3e8f2e6ec6

SHA1
12b4b86926aa53e3901fc6a71d067ede71334141

SHA256
ecb50895a27108bd645241038ecb5ff72239d7b5c3b17b74cf01030c170df007

SHA512
a1e23a77af48bae655a26369c9ed416cf3219b906539a1d0f1b95c89e671b8f82a3b623325e5d8f0c0802a719b9277d62d369ef4fc634701f3f180842e805663

Download Submit
C:\Users\Admin\Documents\TnfIvkBVa6.a513

Filesize
523KB

MD5
6aad60e32c9f32131ffbc0f156bf1f8d

SHA1
0b75cc570c436f0a7a059625de743b5f36775448

SHA256
6ef3c0fff07d4a60177998a71bdf3f60013c1f37500fe108d3b5040a4ab8f979

SHA512
a022629522e4020a17dc84854cf90bd9e4602f179007c1cdc2e7e3eb159df782cceb3a0f632847abc717fba786d58e19ae7ac6b82a3e6c7e9f4cad9a734c7647

Download Submit
C:\Users\Admin\Documents\V4KX722Hgj.a513

Filesize
432KB

MD5
1bb49aab6fb6150e1456d6a84793c548

SHA1
fd87153d4e7fbdbec8ad0a86a00cd5745f5dea14

SHA256
f0faa7ca86c671c7ce975c0ab5000d97cc97f3df0197411024f72f29efdda0d4

SHA512
e36a7e1da00309ad043cb9aadf3d343fa8f74895778a914124680c8460cd518cbb01dc4cd74a37c8af0204edb6ba99307c43723de7bc9d919ba98515f52aec52

Download Submit
C:\Users\Admin\Documents\WgKXv4t9Vn.a513

Filesize
11KB

MD5
26fb7186bbba4c88c4999c3f88c8ccb1

SHA1
bb3b3e99e6bb6700670f64716be409189a513854

SHA256
6c9fd0b0136b9322f8d2718aeeedb7a9f333320732eba769a8574114c527b722

SHA512
685f6f08827dca11ded81969d43adff74f9efa4a4d5dda375865d4fae300dd6f2c52b88b963ce089801abae11a3bdb80bd193aeae6e7896eeb32a28a6696e3e5

Download Submit
C:\Users\Admin\Documents\Y-5PAk0AB9.a513

Filesize
11KB

MD5
f9d8963dae87a8c8465f7153d6a8ed9b

SHA1
121cd045d22affd5d1356de5b26c3aa01866ef3f

SHA256
73b3bc59ed1569708efecd873abee1ad459449b9c8f25d2d54230c42065ff533

SHA512
39fe785370d312a53adeebf7a5f1d97570e82854c1e564a0d2348e71f5473bec7ee4dea18662473c71b38c3deee61949514f4caabae43f44700198c9ccf4d8a4

Download Submit
C:\Users\Admin\Documents\YCddcA0W-a.a513

Filesize
1.1MB

MD5
17144ca497db502754c858fbdde72871

SHA1
0b5b2c7eb954097780a184796024d48e7e8ec878

SHA256
63622ea5fff9a2bf57de98f490663885addecc3b53db30f1c9444c2375d4ebc7

SHA512
9e6760454d5f34208e4de05202bf828a2cd8bd197e69daa0043761cac9379c7d262d43040032ef2366282f709ba4612d64073b2568e8fd3ab83809d1e9cff090

Download Submit
C:\Users\Admin\Documents\ZUgRVs6NBt.a513

Filesize
727KB

MD5
2a3b57d60e0f662efb70cd6e442b45e6

SHA1
808051099805b8e1668cfecc885838d46f166dd9

SHA256
b6165583016c36ad089b38c3dc4f4f71141e2f103e7913f9d6c2ad79401b5c9a

SHA512
ec1e5a396ad44e18e2a89efc49f6c6a7263a9e5dfcbbfda631994860c8cb4a0ecdb40cee107b450b6d179fcd7a385aa54d122955e9adc7d55f95c95667cb02a5

Download Submit
C:\Users\Admin\Documents\ZmERdMZF01.a513

Filesize
659KB

MD5
0ad0a99d776fcd336e82544c1da3ddb1

SHA1
6c31426281ef9b2969a25ac9e9b61b9360341123

SHA256
c88a761b2db254ec93dbb5eabb2b9c777f1df9760955daf646951e52cf7f136a

SHA512
1ccdbc89faf9fc0787c367d2d1355b8755934d3fb0f701755f6abf6e98f463202155b1e1c2fde4676041bc25226305ef06c8d51f38e5fce40490d2346159e291

Download Submit
C:\Users\Admin\Documents\aVRCXAnHVb.a513

Filesize
295KB

MD5
6505492b468bd3bc599953047a423809

SHA1
a9af59887b15dffd14533de2084c404b8bbfd8e3

SHA256
fe5239d793f7b5801611905bbfd1d6534f5c66442d48d9b5e7212345dfd7a24a

SHA512
4560f8eed62342f704188bbe533cba22eadc7998946317451b9925b20ab671c896c45162815a41e42ad4c073abb703adf163bac121240acbfeea0d479c7f192c

Download Submit
C:\Users\Admin\Documents\bJeZLR8l7U.a513

Filesize
11KB

MD5
c87c8d82fd323a916ff40632ddf95fde

SHA1
dbcb6d41fd046128096efe72d9a66a52dcf697b4

SHA256
0d386fba4292cbc2f11f0bfb0edb4e91df944f374fceb2f722cd1f276e7adb7b

SHA512
836d1d2b93f10a77221975405f9f521c5ab056aabc48e3c51be70923de073bfa26645c52a43ae8ae95fb554c802468c7b1cca636d8ccdf0c804c3d68b48531f9

Download Submit
C:\Users\Admin\Documents\dDAyE7lm9U.a513

Filesize
341KB

MD5
15cbb2849c266b09a9540521e45d8ff6

SHA1
27a138e9132239047c82925896659b48dfa185c7

SHA256
2cb9165a3d02576173e4d0179a7bcb64751c2912fb4c3ee671a6d66b658b17f0

SHA512
8e989efd59307890d87c09abf91ed8b010b9874f5d8849bbad13b25c5ca84890502989b59de5370e57504406b68bf2524e1ce2900f996eec08cd476cbc784ca0

Download Submit
C:\Users\Admin\Documents\nMTciQrAJF.a513

Filesize
545KB

MD5
854da1233743c6f1110a27a5d65840f6

SHA1
5f99ee8e3a69118badec7c3e01374253e3d692d7

SHA256
c03daf8f05d0a2040d95970abf6a67354333a900613e25bcd7f1e064e542ae85

SHA512
b0888f02307a9194c6870889028f5024640ab54809015aee9bfb1d9cdf48e466067f87feb02dbb2691ff7f230392a11d2aa84c87c2a7134d227488bd49636049

Download Submit
C:\Users\Admin\Documents\sYduvJJKxY.a513

Filesize
409KB

MD5
995736aa39a1c4a031bfb859bf824de0

SHA1
61c6adf830b83d7e88b6af0734f8cd9c4272dbd4

SHA256
7cb8028f102a34975d6c3739b00ab7b281883c58c8af5f1aab224c625895bc66

SHA512
325b865681292fe69adb4076b53c9ae670e5c4237c05061d8b5316c047282d8313534cbf5353f7f5a6c25144e70728639a05c766b177429e14699e3caa0c01e4

Download Submit
C:\Users\Admin\Documents\vMJv-dzfac.a513

Filesize
363KB

MD5
42f3003992e54e10d09bd33ef4b54cba

SHA1
9fa10e75b535f8c655d0a68db242f496856cad3a

SHA256
b9f44e895e0c363cff779815ece096c4d7b46caf1a0059ab73a51e9adf96170e

SHA512
ffa34a77af1be5b65d46bcbe29b6f0747653c8c98e09f1669d8596094b6278f7fbc1b2734adf30a1e1f903824f503d9471f0e2841b7b3f07e34d6a55a99c2d08

Download Submit
C:\Users\Admin\Downloads\BadRabbit.zip

Filesize
393KB

MD5
61da9939db42e2c3007ece3f163e2d06

SHA1
4bd7e9098de61adecc1bdbd1a01490994d1905fb

SHA256
ea8ccb8b5ec36195af831001b3cc46caedfc61a6194e2568901e7685c57ceefa

SHA512
14d0bc14a10e5bd8022e7ab4a80f98600f84754c2c80e22a8e3d9f9555dde5bad056d925576b29fc1a37e73c6ebca693687b47317a469a7dfdc4ab0f3d97a63e

Download Submit
C:\Users\Admin\Downloads\BadRabbit.zip

Filesize
393KB

MD5
ae81e973aa4b77255c0b931d0af20162

SHA1
b65d977770a5b680d3b08c1a89b13d13969ab8a0

SHA256
f094964382b43d000d5fef8dda40672ea122f2254094f7e107d658ffa3d4546f

SHA512
c45c49b7927a311057f55fdef83517f608b93f4a91ea10c161eb1fadc2523e35fb6093ce92fc8e420fca0b7e374f1eae4501ba8f549fb0d66b819617488140e8

Download Submit
C:\Users\Admin\Downloads\Cerber 5.zip

Filesize
181KB

MD5
10d74de972a374bb9b35944901556f5f

SHA1
593f11e2aa70a1508d5e58ea65bec0ae04b68d64

SHA256
ab9f6ac4a669e6cbd9cfb7f7a53f8d2393cd9753cc1b1f0953f8655d80a4a1df

SHA512
1755be2bd1e2c9894865492903f9bf03a460fb4c952f84b748268bf050c3ece4185b612c855804c7600549170742359f694750a46e5148e00b5604aca5020218

Download Submit
C:\Users\Admin\Downloads\DeriaLock.zip

Filesize
210KB

MD5
016d1ca76d387ec75a64c6eb3dac9dd9

SHA1
b0a2b2d4d639c6bcc5b114b3fcbb56d7c7ddbcbe

SHA256
8037a333dfeca754a46e284b8c4b250127daef6d728834bf39497df03006e177

SHA512
f08653184d7caf48e971635699b17b9502addb33fb91cc6e0a563e6a000aeb57ac0a2edd5a9e21ef99a4770c0dbb65899150fa5842b0326976a299382f6be86e

Download Submit
C:\Windows\9E9C.tmp

Filesize
60KB

MD5
347ac3b6b791054de3e5720a7144a977

SHA1
413eba3973a15c1a6429d9f170f3e8287f98c21c

SHA256
301b905eb98d8d6bb559c04bbda26628a942b2c4107c07a02e8f753bdcfe347c

SHA512
9a399916bc681964af1e1061bc0a8e2926307642557539ad587ce6f9b5ef93bdf1820fe5d7b5ffe5f0bb38e5b4dc6add213ba04048c0c7c264646375fcd01787

Download Submit
C:\Windows\infpub.dat

Filesize
401KB

MD5
1d724f95c61f1055f0d02c2154bbccd3

SHA1
79116fe99f2b421c52ef64097f0f39b815b20907

SHA256
579fd8a0385482fb4c789561a30b09f25671e86422f40ef5cca2036b28f99648

SHA512
f2d7b018d1516df1c97cfff5507957c75c6d9bf8e2ce52ae0052706f4ec62f13eba6d7be17e6ad2b693fdd58e1fd091c37f17bd2b948cdcd9b95b4ad428c0113

Download Submit
memory/184-520-0x0000000002CB0000-0x0000000002D18000-memory.dmp

Filesize
416KB

Download
memory/184-509-0x0000000002CB0000-0x0000000002D18000-memory.dmp

Filesize
416KB

Download
memory/184-517-0x0000000002CB0000-0x0000000002D18000-memory.dmp

Filesize
416KB

Download
memory/1940-1059-0x0000000005AC0000-0x0000000006064000-memory.dmp

Filesize
5.6MB

Download
memory/1940-1056-0x0000000000A60000-0x0000000000AE2000-memory.dmp

Filesize
520KB

Download
memory/1940-1060-0x00000000055B0000-0x0000000005642000-memory.dmp

Filesize
584KB

Download
memory/1940-1061-0x0000000005830000-0x0000000005840000-memory.dmp

Filesize
64KB

Download
memory/1940-1326-0x0000000005830000-0x0000000005840000-memory.dmp

Filesize
64KB

Download
memory/1940-1325-0x0000000005830000-0x0000000005840000-memory.dmp

Filesize
64KB

Download
memory/1940-1324-0x000000006FF40000-0x00000000706F0000-memory.dmp

Filesize
7.7MB

Download
memory/1940-1062-0x0000000005540000-0x000000000554A000-memory.dmp

Filesize
40KB

Download
memory/1940-1063-0x0000000005650000-0x00000000056A6000-memory.dmp

Filesize
344KB

Download
memory/1940-1067-0x0000000005830000-0x0000000005840000-memory.dmp

Filesize
64KB

Download
memory/1940-1057-0x0000000005470000-0x000000000550C000-memory.dmp

Filesize
624KB

Download
memory/1940-1058-0x000000006FF40000-0x00000000706F0000-memory.dmp

Filesize
7.7MB

Download
memory/2712-1065-0x0000000000440000-0x000000000044E000-memory.dmp

Filesize
56KB

Download
memory/2712-613-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2712-999-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2712-1055-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2712-587-0x00000000014D0000-0x0000000001501000-memory.dmp

Filesize
196KB

Download
memory/2712-588-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2712-599-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download