badrabbit | 3cc951ba5d33757ea90766b47a7174ed5b1c7600f5f47d418e3b1fcfabe54f7e

max time kernel
468s
max time network
472s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
23-02-2024 16:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

MalwareDatabase
Size

285KB
MD5

8adbc73e595f87a63b1efe9dc51ce993
SHA1

942d0f1b51055b5f0ae1f319c4509da66f8295d8
SHA256

3cc951ba5d33757ea90766b47a7174ed5b1c7600f5f47d418e3b1fcfabe54f7e
SHA512

c70bd77e192dc1c5da185d37b021c0cc23649512e8c9b9b46959fe488438ba3e8c4538bddd076ad232fc02e87727175bd15387c098b695c2f1556445bb0ec8ed
SSDEEP

6144:iDuqJ5fBrVSgE29xxspm0n1vuz3U9ovZJT3CqbMrhryfQNRPaCieMjAkvCJv1Vi/:afBrVSgE29xxspm0n1vuz3U9ovZJT3CU

Score

10^/10

badrabbit mimikatz ransomware

Malware Config

Signatures

BadRabbit
Ransomware family discovered in late 2017, mainly targeting Russia and Ukraine.
ransomware badrabbit
Mimikatz
mimikatz is an open source tool to dump credentials on Windows.
mimikatz

mimikatz is an open source tool to dump credentials on Windows 1 IoCs

resource	yara_rule
behavioral1/files/0x000200000002a96f-914.dat	mimikatz

Executes dropped EXE 1 IoCs

pid	Process
2168	EBD3.tmp

Loads dropped DLL 1 IoCs

pid	Process
3572	rundll32.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
1	raw.githubusercontent.com
5	camo.githubusercontent.com
48	raw.githubusercontent.com

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\infpub.dat	[email protected]
File opened for modification	C:\Windows\infpub.dat	rundll32.exe
File created	C:\Windows\cscc.dat	rundll32.exe
File created	C:\Windows\dispci.exe	rundll32.exe
File opened for modification	C:\Windows\EBD3.tmp	rundll32.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Winword.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Winword.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	Winword.exe

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
4900	schtasks.exe
876	schtasks.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	Winword.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	Winword.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	Winword.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 40 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\NodeSlot = "2"	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Generic"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\MuiCache	MiniSearchHost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2930051783-2551506282-3430162621-1000\{B8B66396-FA60-41B3-9044-56DC58313DE1}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0100000000000000ffffffff	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\MRUListEx = 00000000ffffffff	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1 = 19002f433a5c000000000000000000000000000000000000000000	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0 = 8c003100000000005558466e110050524f4752417e310000740009000400efbec55259615558466e2e0000003f0000000000010000000000000000004a000000000095904800500072006f006700720061006d002000460069006c0065007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100370038003100000018000000	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\MRUListEx = ffffffff	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings	OpenWith.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\MalwareDatabase-master.zip:Zone.Identifier	msedge.exe

Suspicious behavior: AddClipboardFormatListener 3 IoCs

pid	Process
2356	Winword.exe
2356	Winword.exe
484	vlc.exe

Suspicious behavior: EnumeratesProcesses 30 IoCs

pid	Process
1000	msedge.exe
1000	msedge.exe
1432	msedge.exe
1432	msedge.exe
2124	identity_helper.exe
2124	identity_helper.exe
3712	msedge.exe
3712	msedge.exe
4100	msedge.exe
4100	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
956	msedge.exe
956	msedge.exe
3572	rundll32.exe
3572	rundll32.exe
3572	rundll32.exe
3572	rundll32.exe
2168	EBD3.tmp
2168	EBD3.tmp
2168	EBD3.tmp
2168	EBD3.tmp
2168	EBD3.tmp
2168	EBD3.tmp
4520	msedge.exe
4520	msedge.exe
860	msedge.exe
860	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 3 IoCs

pid	Process
1660	OpenWith.exe
4400	OpenWith.exe
484	vlc.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 19 IoCs

pid	Process
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
860	msedge.exe
860	msedge.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3572	rundll32.exe
Token: SeDebugPrivilege	3572	rundll32.exe
Token: SeTcbPrivilege	3572	rundll32.exe
Token: SeDebugPrivilege	2168	EBD3.tmp

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe

Suspicious use of SendNotifyMessage 31 IoCs

pid	Process
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
484	vlc.exe
484	vlc.exe
484	vlc.exe

Suspicious use of SetWindowsHookEx 53 IoCs

pid	Process
3108	OpenWith.exe
1660	OpenWith.exe
1660	OpenWith.exe
1660	OpenWith.exe
1660	OpenWith.exe
1660	OpenWith.exe
1660	OpenWith.exe
1660	OpenWith.exe
1660	OpenWith.exe
1660	OpenWith.exe
1660	OpenWith.exe
1660	OpenWith.exe
1660	OpenWith.exe
1660	OpenWith.exe
1660	OpenWith.exe
1660	OpenWith.exe
1660	OpenWith.exe
1660	OpenWith.exe
1660	OpenWith.exe
1660	OpenWith.exe
1660	OpenWith.exe
1660	OpenWith.exe
1660	OpenWith.exe
1660	OpenWith.exe
1660	OpenWith.exe
1660	OpenWith.exe
1660	OpenWith.exe
728	OpenWith.exe
4400	OpenWith.exe
4400	OpenWith.exe
4400	OpenWith.exe
4400	OpenWith.exe
4400	OpenWith.exe
4400	OpenWith.exe
4400	OpenWith.exe
4400	OpenWith.exe
4400	OpenWith.exe
4400	OpenWith.exe
4400	OpenWith.exe
4400	OpenWith.exe
4400	OpenWith.exe
4400	OpenWith.exe
4400	OpenWith.exe
2356	Winword.exe
2356	Winword.exe
2356	Winword.exe
2356	Winword.exe
2356	Winword.exe
2356	Winword.exe
2356	Winword.exe
2356	Winword.exe
3400	MiniSearchHost.exe
484	vlc.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1432 wrote to memory of 2996	1432	msedge.exe	83
PID 1432 wrote to memory of 2996	1432	msedge.exe	83
PID 1432 wrote to memory of 3968	1432	msedge.exe	84
PID 1432 wrote to memory of 3968	1432	msedge.exe	84
PID 1432 wrote to memory of 3968	1432	msedge.exe	84
PID 1432 wrote to memory of 3968	1432	msedge.exe	84
PID 1432 wrote to memory of 3968	1432	msedge.exe	84
PID 1432 wrote to memory of 3968	1432	msedge.exe	84
PID 1432 wrote to memory of 3968	1432	msedge.exe	84
PID 1432 wrote to memory of 3968	1432	msedge.exe	84
PID 1432 wrote to memory of 3968	1432	msedge.exe	84
PID 1432 wrote to memory of 3968	1432	msedge.exe	84
PID 1432 wrote to memory of 3968	1432	msedge.exe	84
PID 1432 wrote to memory of 3968	1432	msedge.exe	84
PID 1432 wrote to memory of 3968	1432	msedge.exe	84
PID 1432 wrote to memory of 3968	1432	msedge.exe	84
PID 1432 wrote to memory of 3968	1432	msedge.exe	84
PID 1432 wrote to memory of 3968	1432	msedge.exe	84
PID 1432 wrote to memory of 3968	1432	msedge.exe	84
PID 1432 wrote to memory of 3968	1432	msedge.exe	84
PID 1432 wrote to memory of 3968	1432	msedge.exe	84
PID 1432 wrote to memory of 3968	1432	msedge.exe	84
PID 1432 wrote to memory of 3968	1432	msedge.exe	84
PID 1432 wrote to memory of 3968	1432	msedge.exe	84
PID 1432 wrote to memory of 3968	1432	msedge.exe	84
PID 1432 wrote to memory of 3968	1432	msedge.exe	84
PID 1432 wrote to memory of 3968	1432	msedge.exe	84
PID 1432 wrote to memory of 3968	1432	msedge.exe	84
PID 1432 wrote to memory of 3968	1432	msedge.exe	84
PID 1432 wrote to memory of 3968	1432	msedge.exe	84
PID 1432 wrote to memory of 3968	1432	msedge.exe	84
PID 1432 wrote to memory of 3968	1432	msedge.exe	84
PID 1432 wrote to memory of 3968	1432	msedge.exe	84
PID 1432 wrote to memory of 3968	1432	msedge.exe	84
PID 1432 wrote to memory of 3968	1432	msedge.exe	84
PID 1432 wrote to memory of 3968	1432	msedge.exe	84
PID 1432 wrote to memory of 3968	1432	msedge.exe	84
PID 1432 wrote to memory of 3968	1432	msedge.exe	84
PID 1432 wrote to memory of 3968	1432	msedge.exe	84
PID 1432 wrote to memory of 3968	1432	msedge.exe	84
PID 1432 wrote to memory of 3968	1432	msedge.exe	84
PID 1432 wrote to memory of 3968	1432	msedge.exe	84
PID 1432 wrote to memory of 1000	1432	msedge.exe	86
PID 1432 wrote to memory of 1000	1432	msedge.exe	86
PID 1432 wrote to memory of 1616	1432	msedge.exe	85
PID 1432 wrote to memory of 1616	1432	msedge.exe	85
PID 1432 wrote to memory of 1616	1432	msedge.exe	85
PID 1432 wrote to memory of 1616	1432	msedge.exe	85
PID 1432 wrote to memory of 1616	1432	msedge.exe	85
PID 1432 wrote to memory of 1616	1432	msedge.exe	85
PID 1432 wrote to memory of 1616	1432	msedge.exe	85
PID 1432 wrote to memory of 1616	1432	msedge.exe	85
PID 1432 wrote to memory of 1616	1432	msedge.exe	85
PID 1432 wrote to memory of 1616	1432	msedge.exe	85
PID 1432 wrote to memory of 1616	1432	msedge.exe	85
PID 1432 wrote to memory of 1616	1432	msedge.exe	85
PID 1432 wrote to memory of 1616	1432	msedge.exe	85
PID 1432 wrote to memory of 1616	1432	msedge.exe	85
PID 1432 wrote to memory of 1616	1432	msedge.exe	85
PID 1432 wrote to memory of 1616	1432	msedge.exe	85
PID 1432 wrote to memory of 1616	1432	msedge.exe	85
PID 1432 wrote to memory of 1616	1432	msedge.exe	85
PID 1432 wrote to memory of 1616	1432	msedge.exe	85
PID 1432 wrote to memory of 1616	1432	msedge.exe	85

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\MalwareDatabase
1⤵
PID:1156

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffcd1383cb8,0x7ffcd1383cc8,0x7ffcd1383cd8
  2⤵
  PID:2996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1828,1946894703778547996,13614687638520733141,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1904 /prefetch:2
  2⤵
  PID:3968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1828,1946894703778547996,13614687638520733141,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2660 /prefetch:8
  2⤵
  PID:1616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1828,1946894703778547996,13614687638520733141,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2320 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1828,1946894703778547996,13614687638520733141,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:1696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1828,1946894703778547996,13614687638520733141,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3180 /prefetch:1
  2⤵
  PID:2104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1828,1946894703778547996,13614687638520733141,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4056 /prefetch:1
  2⤵
  PID:4756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1828,1946894703778547996,13614687638520733141,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4564 /prefetch:1
  2⤵
  PID:4672
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1828,1946894703778547996,13614687638520733141,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5424 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1828,1946894703778547996,13614687638520733141,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5512 /prefetch:1
  2⤵
  PID:1456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1828,1946894703778547996,13614687638520733141,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5032 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1828,1946894703778547996,13614687638520733141,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
  2⤵
  PID:2684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1828,1946894703778547996,13614687638520733141,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5516 /prefetch:1
  2⤵
  PID:3000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1828,1946894703778547996,13614687638520733141,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5812 /prefetch:1
  2⤵
  PID:3696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1828,1946894703778547996,13614687638520733141,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5804 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:4100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1828,1946894703778547996,13614687638520733141,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5888 /prefetch:8
  2⤵
  PID:4976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1828,1946894703778547996,13614687638520733141,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6024 /prefetch:8
  2⤵
  PID:4588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1828,1946894703778547996,13614687638520733141,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4016 /prefetch:1
  2⤵
  PID:1756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1828,1946894703778547996,13614687638520733141,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5084 /prefetch:1
  2⤵
  PID:4088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1828,1946894703778547996,13614687638520733141,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4656 /prefetch:1
  2⤵
  PID:3428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1828,1946894703778547996,13614687638520733141,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5856 /prefetch:1
  2⤵
  PID:4644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1828,1946894703778547996,13614687638520733141,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3952 /prefetch:1
  2⤵
  PID:2036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1828,1946894703778547996,13614687638520733141,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
  2⤵
  PID:676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1828,1946894703778547996,13614687638520733141,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6172 /prefetch:1
  2⤵
  PID:2216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1828,1946894703778547996,13614687638520733141,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6156 /prefetch:1
  2⤵
  PID:3560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1828,1946894703778547996,13614687638520733141,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=4648 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1828,1946894703778547996,13614687638520733141,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5808 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1828,1946894703778547996,13614687638520733141,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6436 /prefetch:1
  2⤵
  PID:1436

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4228

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4512

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4392

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3108

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1660

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:728

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4400
- C:\Program Files\Microsoft Office\root\Office16\Winword.exe
  "C:\Program Files\Microsoft Office\root\Office16\Winword.exe" /n "C:\Users\Admin\Downloads\MalwareDatabase-master\MalwareDatabase-master\README.md"
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of SetWindowsHookEx
  PID:2356

C:\Users\Admin\AppData\Local\Temp\Temp1_BadRabbit.zip\[email protected]
"C:\Users\Admin\AppData\Local\Temp\Temp1_BadRabbit.zip\[email protected]"
1⤵
- Drops file in Windows directory
PID:224
- C:\Windows\SysWOW64\rundll32.exe
  C:\Windows\system32\rundll32.exe C:\Windows\infpub.dat,#1 15
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3572
- - C:\Windows\SysWOW64\cmd.exe
    /c schtasks /Delete /F /TN rhaegal
    3⤵
    PID:4516
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /Delete /F /TN rhaegal
      4⤵
      PID:988
- - C:\Windows\SysWOW64\cmd.exe
    /c schtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR "C:\Windows\system32\cmd.exe /C Start \"\" \"C:\Windows\dispci.exe\" -id 4124246861 && exit"
    3⤵
    PID:2788
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR "C:\Windows\system32\cmd.exe /C Start \"\" \"C:\Windows\dispci.exe\" -id 4124246861 && exit"
      4⤵
      Creates scheduled task(s)
      PID:4900
- - C:\Windows\SysWOW64\cmd.exe
    /c schtasks /Create /SC once /TN drogon /RU SYSTEM /TR "C:\Windows\system32\shutdown.exe /r /t 0 /f" /ST 17:12:00
    3⤵
    PID:1036
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /Create /SC once /TN drogon /RU SYSTEM /TR "C:\Windows\system32\shutdown.exe /r /t 0 /f" /ST 17:12:00
      4⤵
      Creates scheduled task(s)
      PID:876
- - C:\Windows\EBD3.tmp
    "C:\Windows\EBD3.tmp" \\.\pipe\{87DEEBAF-1E4B-4392-AB5E-330D4B25A930}
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2168

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3400

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:1244

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Downloads\CompareHide.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of SendNotifyMessage
PID:860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xe0,0x10c,0x7ffcd1383cb8,0x7ffcd1383cc8,0x7ffcd1383cd8
  2⤵
  PID:324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1904,15467111450895445291,8449394451267178726,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2260 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1904,15467111450895445291,8449394451267178726,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1920 /prefetch:2
  2⤵
  PID:4472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1904,15467111450895445291,8449394451267178726,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2484 /prefetch:8
  2⤵
  PID:728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,15467111450895445291,8449394451267178726,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:1568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,15467111450895445291,8449394451267178726,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:3256

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1384

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2684

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\ReadCopy.TTS"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:484

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
96899614360333c9904499393c6e3d75

SHA1
bbfa17cf8df01c266323965735f00f0e9e04cd34

SHA256
486e4b4bb11f664c91c675e73cfeabe53b5009ae719459813be17814cd97e43c

SHA512
974735b40a9f92b40a37a698f7f333590f32ff45633c6e619500e74ec274bc20bf7dbc830b1685777b714d37a3ca103d741ee056f4ff45ef08c07b38a7895df7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
19a8bcb40a17253313345edd2a0da1e7

SHA1
86fac74b5bbc59e910248caebd1176a48a46d72e

SHA256
b8024fbed11683ef4b53f5afac0ff691025b7eecca0f6a95737da1585558227e

SHA512
9f8780f49d30aad01b28189804329aeca6ad2b7ffb6be505d40bb1af7802bb62622f518cb1c43a5815bbbb46638f6c52aead3d68f14fa957d18157edb42e95c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1423c1a528e7edc20b7f2c4b94e6bacd

SHA1
e7d7285afad7b07ed6805f31d4fc3bb3f7f0242e

SHA256
498a177a3e2edbfea97c14353865421c078f73d84e7619bebd36d77c5b1317da

SHA512
870217847a95fe38049f04734776fa604f84d830d5b5bf6b753620afde7d0800a26c96c77d66fa6c79d6b369853b27487f010c2e6661acecab858a3156bd3106

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2c5433e3aec0e7a9da9726637867fdc3

SHA1
7f93f26c987ce7218f46659ba777e23c5a68660b

SHA256
a3753cb5fe6ba511b56ecc69c08f93ee7bd6ccc6d7a89b5e6c68f5c2e0b9e8a9

SHA512
cf1c3e0c2b46433ecfbf98d0bc831a66a752a2bfa7df8ed336fdbf7220ab7cd6506c73535687271b9e261951f0d825e7335de36afb3967edd96f71161d744f62

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
6db23a6609db50f9a9e89758fc9f0e94

SHA1
8cffe9fe37986b2e566ad25e06dc581e92fc37c8

SHA256
3d71b74401b0b8f590684224cada6d120656336c5e86dc3f35ee070ccc30f84c

SHA512
8a3d09b8879c50e8bcf176bef4803a12b77bf24d26a1768bf878843e2ddf76c62ff954c44a9277dcc7a4eb143362744092a46d370995e579fe0c13c0380dce59

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
f913f6603503b09aa33a156d330f0f4e

SHA1
b634a88b8430e3c40c02ba0bef435e453495bb73

SHA256
e55bb250fc9060948f477bc7c59e060bc565c1674a4b6e618c8cf5c26a66a49c

SHA512
be1eebf33196c25ced369faf2aaa9811b93e7d5d74b0be365358e5d6f98db9e5aa90ce7f90d1c3b11de4650329259aee0d919d709a4d8e4356ccd182e7793d69

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons

Filesize
28KB

MD5
ff338469aad8d1ddb12918733113baae

SHA1
53160c0aa93921de87613244129052a0ea1060f3

SHA256
05d6d2458a1254d28993e13c055bf35a331a5f7d93228e4e662d2d9f99ec3e7d

SHA512
d1853a354801d56517810fd5ca25d999dad0c64ce38392857b68bd1c851aefd2018ddba7295116b809bcecaa19214382691fdafa4583ac2af86cba89ff72a364

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
0f3fb30e56c501ce2655ecfaf36ad668

SHA1
f1ad109088c3443997168aec4b7b3c3134292179

SHA256
616c1e381058fef90ae259bc7957870691115d10863ae9544e28f5279be358c6

SHA512
e9d4d26b9d69000929e5f75b41492392577c6b5c16cb95d215ff26cee0b0383e647433049dabe824f98832376ff736707a496a687f2f916c7c4fced39ace8925

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History

Filesize
116KB

MD5
aa65ba3c00f7082a3197c4fcf2228708

SHA1
47695b4b068d561fac5eb1b1e471a2ba060e3f54

SHA256
9f636fef9c528b2ba556cc79208b94fde0bc6627b577edae6b7996618d19db28

SHA512
2a4f19dc750f8d012b56d2cc75c7f46c08ff6cd704bdaf6c25a04c9c459ef22d49e40418e814612565c7b58f00ea708563c7919399b5c439bf88cee8445fd988

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History Provider Cache

Filesize
5KB

MD5
f000813e46f597f20348b738c18cf7e3

SHA1
8c61c63f402d0a1becfb24e9c9fda579d075f57c

SHA256
69cab2387585350897fe02894252c019ddac58e2adfca8ede9c2aa537c802190

SHA512
be2f64935ff12c2d64bd2f8fcddcaa5528b0c10b11a96d4b8acfd44f5c356e387316f9544c9ed417acf13ac456dac116b43a9459c8e6a1ba165efd85acf9d2a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log

Filesize
23KB

MD5
30255d7fb39e2482a068fb264166721c

SHA1
ed5d5cb16162ae175410a0bb7f28cdbed81cebd0

SHA256
ecf82b7d753327d87cc7be201def1b84bda71b5851e3a340045dfc5afa45c617

SHA512
23b98cedf06b504d5434ff1b58eab1b615fe39c133f57eba0a734ddc768c8d3d5791db6d6ab8d9a791431e8e838149a2cf36a9c5924a7de055eac0655ffd9d14

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Filesize
331B

MD5
daa7de75b15cc8c030cbb239ad0c7317

SHA1
59001a3c6cf8a1fe2756d04e764172207020a843

SHA256
f4d628a21b36bfc82326b90f37a41d9f6dfe5ee6e5f064ec9cde589fa69d20d5

SHA512
93bed54e8b14ff62f13a5198bb94a8379cb06d57bb8931164385d382ea2a8d84fcc066da35176c4156ef341cb290de783c8fc9bcb4a8115b815601a8e5584fbb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
58850e3e79a79fb2bf5fc5c5e66ddcee

SHA1
6f9c90aabd2ad73ca071fa38d08f4587dce32c2b

SHA256
57d33ee3b16f1e7c8615d753737e8dd8f06007ff07937d7ab42ec9ed36b53d0c

SHA512
2aab3bad19d642a309bc9f9ced6ac20105fc2984c6e4b90c6327508c9dbc7d6f1516fd97ab4c2ddc3c918d2c9c8ed03e1ee8e1704ed7b29b1198bcc0fb5d14ab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
885b2c2be8c22a9066ad2a859c0ff96e

SHA1
3ae6242a17af56baa4b302c31348eb8c2e0a9b24

SHA256
b8b56f20bfe41e3488b44cded9cd6f16fe122de6b1b2c081d5ab2e7f50b29f87

SHA512
21373dc6c16df6c3ac85457ff7e6de73f9194cf7a68a5172ff09d8216669a281efc7f2a9b44ac85ef6526510ba18dd232b0f8053ec4a727fcf9268fbce99cb0e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
8400a8c3f08335ea8738d295430db0df

SHA1
4633a8ff4cebf21c77379795e0cf2d15575bab3c

SHA256
656fd2063b705baebe4ff12696151eb98bc816574868816ad249cdbbb2501c93

SHA512
2d2fa093eadbc620aa03b143684f378c18c1002413c0c7ea73da912c1b94d5ef14efefabccb581ad42b7c5ea41d3cb752a15527359a69f2a47cf1188472c8310

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ac5c9812e0fccd6929276cf5e0a45b6a

SHA1
7bce710b318551cb8de327b8715453bca21d2d96

SHA256
609a31311249ed856522b73c30c57a8baa02cb2eff4e01ff96f95f59d5c289c5

SHA512
9089a8f5b680b3f5ac716aa051b99e478e306106896116347fe3a67441fdf51be55b8bae4098217698350e17487b193a255d40140418bfcec851cc3bedb50012

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
ba754f5b3d960fc4f0b35abfb5f38091

SHA1
d0519f0e834e91caf673f5a2f6cb11c6a31768c4

SHA256
3f5707025213184595a6258ad8aa5e5124caf5761f8426a1b0243bde6ffe9417

SHA512
d70f6bd206f7b53d0e6d2c78fefde2adfd5a493d3c2ea3f68816d98b1914ac934575bd9708538cfe2a56ec4a9a0c3f49b2ca70522c36d290697e6d775a45c0a4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5a914657d2d882697f9c7d1732640e23

SHA1
dbf75d2df1e505bbec32ecc9b49b321fe0133e87

SHA256
dbaebdd6a2b859e95914194f540a77b632a06179d4d85063adab81a1931a4f08

SHA512
2e14e1da551c4c9ed156cc80bee5f65c2f8b0d2c32f64badb61c8695c213a0e211773a1540d20f79cba568219e17d3d4aecffecdcd242e0df4ff5d0ba91e8540

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
e740e63cef3ea6ec9252f1ec4e4648cc

SHA1
068f794d1c7e39f0167d255e7d3144b75fa8cb26

SHA256
0b13c8096857b5d9218dc88722578dea9ba41a159e2511018e72295bff802074

SHA512
a86a5e5ebb9104133550685286f93ac6b6f7b7255741385bcd3edc59f5466aa03277c29a6f7970cef89f8387838a04c5e8f918af00d784091ecb3ff92d6251f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c554eb748d58b3ad646f4fce63412fa6

SHA1
fedb22a8e3fcb335bf74af235876b12b1cbf4425

SHA256
20073e130b7995ed4afa04f13ace5edac063a039775efdda6c29d0fb5b5585ed

SHA512
2e136e9eb1fbfe88859b65691633a3b4ca84bb764db1fac278fc506b68a82106b2f19662efcecc137625af88998b251248081349ec0eab5af233baac597040c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
739a353f0bbdd3554e954bdf5e15e479

SHA1
e880d01cf91f4672548cce3ee53b7c85028a2342

SHA256
a5e8a8a93cce4a7966ee18ad3538ea3750775028fc6ad763c97b9e48368c17d6

SHA512
d6244d0d1a735ab1709c4efc454832a261239229054c4b0265ab461ef3f9564070f3dc5b2e760de0870020ee0e32f4365cda7e0d6a09b8403fa5f8368272c61e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
5172fdc07c81fbe79a441081a58fce84

SHA1
138a2cb8a9e734b347ad596223bcc10442770f0e

SHA256
16bc74fdca77ef1a0bbcedbbcc19a266d98808d53a2251d96b7064511745a0eb

SHA512
f80ce41dd77f8c266b814c8b454cf8ef797a06aa95799b5b20c3569fd6395b29290e5e1f691c4cf3be85ec994b03a458489d95278c2e23dd78337cfe4b6c1b70

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Filesize
1KB

MD5
e743b3218370ce3514b2c795800acd6f

SHA1
5bef0066821e425de244f4451bef43f009500198

SHA256
dab1d4231597bab682369881af6ed31ec8ddf7ea2223d7bcf7718df673c3fee5

SHA512
c8277b88865896e3cad44c6d501717c111d6d3c50fd7e4406af214182304bb5b021bad6ca5d9809c590ae10a57488b97dadf64e09294b337ef3c538df5f32663

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

Filesize
322B

MD5
f9b70bfed906c357b09c06923c55691b

SHA1
8cead4ee4ae8292e9f701990f896660f24176763

SHA256
d2d006d9d8d8094ca576e05af5d59118751fe6c08c8f9b450403d32c0f8164ca

SHA512
440e55345d4bc12e72d33dbd4902578401d204bbe97f4e444f545c894b927e241d023c517b409de2f9c38947a0b339f310a6851f58e8b34233bb2de43954ad77

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Tabs_13353180614991135

Filesize
19KB

MD5
74e19a817afd717f7916d6b95ec2d485

SHA1
15f8c1c1ca77ca4eee34030001312331d80418a2

SHA256
aafd7b6b5dbd0499c8f8fb1b1870ddbad0ceb0525981e836ec595ac669a63ea3

SHA512
ce42c7e5073fe9810eb264eb280cdafc8cd1fcbcd77c1aa13b7a2a8b1cf0e487bf2a36ddf0bf797c80a0b50306f5f9d982516ccc4d0703dc66d65f287180ff6c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log

Filesize
187B

MD5
6dcd48b04c9fca2417eda3993076fdb8

SHA1
6aeb83383089d9976569eee9a46498707e5cbe2d

SHA256
27b94b35f4a468f1cfb1c78a8e95a3592e47f56d270e4d986f87f56ae0b61396

SHA512
2185d1685aef4a8d96438583e42950717ed77df36387730d5970aa9180c1014ce56edc0382d74b6f5ca419d07504f194ffd9db61715674251cfe4deabf2f02d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Filesize
347B

MD5
0521f8ff98caa24fed1db103e7b422b0

SHA1
0b31ea2ec178a23851c10ea6dd7b22f89fd64db6

SHA256
3caafc1bdd15662224da2bbcb781b49d15a3188479136c7f71f34dcc0eb6ab63

SHA512
ceb7539a1ef295934d5e7bf0179be173846e3e5bdcbdb307fb576e26ffa87183425740094de7f5ba56da215b2cb7f5d20b308e16dd2be8d793af9a3d64e6a37e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Filesize
323B

MD5
5baeb8fc81ed5d88a94ec3c9823753c3

SHA1
0c122a5ce48d44f9af25d17ad02898c9cc70dd89

SHA256
c7ab8073e45fbcd22a66da4c7f142d3915f1d75907595abb3e58505520630b2c

SHA512
54eb7f246dc482c066d632ca59b4c4dec5292c68d46007a431f1c54d53f0744ed53ed8f74c5a3e172af7be10abe10c2af1038da4a0c4e6d591bf8e9f91150740

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
8c270f70d725d9133310c1e20760e77e

SHA1
03b72a74390e318fd946d8d9c25211ae18f9d808

SHA256
768e140d37eb079ce6dc90d63888f662ece5ff20bb9ef5b73a8f005526659276

SHA512
6558317dffcb393eeeca9ab9aaabb001d800c710464a783389a062bb023102ea82d53df70be94922ff2f2958176b16c4f1946991e0c0b860b260554b896112b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
d1f1b386fa45c004c2c99dde4fd915b9

SHA1
7d42537122abcb7fec630d79bdbfb662c21c2173

SHA256
cde009317fafc48e3bf866d78e60ba5d4de32b24906907e20305cb15b810350c

SHA512
4cdcc9ed6e4ecac00ad803183779db19efdc2fa753e87b4d35b81e9b5fd116b032b708c05ee4f30392c7b96a6e3c0b3456f31d5d4470a88e057f5b7715393221

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
6180c9aaa0ca2232ef62f747baeae884

SHA1
036d8f19077cdaf964bb446589b1599b87b94a89

SHA256
1d6270c7423a64c2fcf2b54cabdda6596f7ebae0d135e38adcf5195405839750

SHA512
2f312eabe8174d41ed42789e58c1aed88e9832cf4ff6e9d7cfe4a4a7affb311409ae31eb3d41f138c83496f141820cb383caf4fdeba00689f42e5a318ddabc3f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
29ae73b1cca7a3b38b7e2af3655bbeab

SHA1
b7f0f330b1e9becbd0797c8789267a1f4feb4464

SHA256
7509d1d40ef2b79bc7d23993612a102a1e81a7602b7e1bc16ce9dbfd9a7203c0

SHA512
21069a5a99d560e89efb17d6d46060cfbb5c38c9e366df834239cdf2e532c76eeb64d246a6a8ea05c5c52c4451c02e58eb093e372c461e195c374ae05625e3dd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
948b92f625043bebc3827b12ea59bce1

SHA1
f9def4d5d1eec483eac1a6c5f8aa8f1e44c8f5f8

SHA256
1729a6c5aa4eb93b16a0ae30ecf766e0cec0af8687310bfb4f012402f433bde6

SHA512
d6b3a10c691aea1f8070bd4e8e721c4e32d95e1a6ff2ea29e7d53ce99eeffdcb4fffb540227e70461b2364f6ea6f88ce96a07f8506c1c973ca9de5ec94991c43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe580105.TMP

Filesize
1KB

MD5
0e758ee849b9aebb6ed459ccae032bd0

SHA1
9c7705804eadce5b71cd7d89bcd79a5817f6898c

SHA256
c9f7252231efbb85a49706d73f519ae8037b68be0ca801e39cdf648f6d2c27a1

SHA512
cfae4ee0120e29a8a1e463f34a241a123f8d0b3f334adc19b6ac22fdc41452b32d01323d333a3181103f969c521f3d3d3813be94e68a5d8402499874cef6bdad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Visited Links

Filesize
128KB

MD5
47d44df2fd9bd6669e1f54d3f171811d

SHA1
e55be61277f98289f1861e83046d53c61e82efa8

SHA256
47287506ced4c07dc26f021798ce57a5e6abce4ef2bc1e2bda8b0f5b5ac42480

SHA512
f700a5993b1691649ac9599eafc9a1b76533f6e9b7fcfee77be8b4e2e8b769e3a4e31e1f41bb0f4323e9f4661c53fec5ed1c5afe14879f234cec26adc85f8440

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Filesize
112KB

MD5
354780499b81b1c238eb4bae699e1a13

SHA1
dc911d84c275e899fbd1e7da87894335f40ea292

SHA256
b62bbe6ef6aa0438aabf207e51857d52cfe854c0e59f76e9fdd669d61e9bfe42

SHA512
edfd31497d5d27aeebe95bdaabcb9951430a47260e8d66c9ce87df068fdaf377c839e27f5831ba56d8bef86de3243afb11e179605aaa5c0b2572581cc71cd81c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db

Filesize
88KB

MD5
a5f748b9d8cd3018469f7c6bc22ef783

SHA1
d6d9510e306e37e7873afbd5752be731216f11fa

SHA256
d0805996c1f321b8212059aa36f2a1fe1625ce486dceff6e20f6bc752ba46cf7

SHA512
6beb07525081f102d01c2a925201614defbb4873be68f0eedafdee3104f8220cab6fa1f8defe6a13d73442a5312d931e652ec621ebe6253c8fd7d75fb6ec3165

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

Filesize
135KB

MD5
0b41ce1d456ad55e8b9bd9d71da69054

SHA1
94226789771433cddb3925859056f942b9534932

SHA256
53500e5765697b2fdeab74c885b84f120de7529799ecaf38678e530ab8106229

SHA512
d90df668ffd94621369fa591cd241f5ac1961aa32e7b533639c74c4f2603fac49b8d10088e0f1f7bf42ddf322859cf8c234606482674fc9ee593514d65b5b52f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Filesize
319B

MD5
0102cbc334453394fa7f16e04e61dad8

SHA1
254e2e05a11dd7189e8d3ed16ebbd618eebf3123

SHA256
cd1f92f274f46e61924f4d90b20c6ddeaa6244be26148cdd3cedbe2545419d9d

SHA512
995879d063bea0ecb4a73427f0fc7f7976b6d4a941aedade306a174e422f0c4611aa2244093af58df7e9c9b731edb7a8f2b57fd1769f14d9ff27a446de3efa56

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Filesize
337B

MD5
e36925d061760f5478a78d86dfe699d8

SHA1
0b545251558c3158b8bb8933d925947acf22e3f3

SHA256
cf91682a919e8ca0f17ca145006ebaba014b7814ee6d8f210f9ed8555f9abf0e

SHA512
3610e8711c51220646a1d19519c208ad47d3cc6f8b63f94e1547c92b4ce0dd68bc57c1aaa7fc4e0a1153514088e14eaee8f7cccf88ebe66e2203127a88d05ae3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version

Filesize
11B

MD5
b29bcf9cd0e55f93000b4bb265a9810b

SHA1
e662b8c98bd5eced29495dbe2a8f1930e3f714b8

SHA256
f53ab2877a33ef4dbde62f23f0cbfb572924a80a3921f47fc080d680107064b4

SHA512
e15f515e4177d38d6bb83a939a0a8f901ce64dffe45e635063161497d527fbddaf2b1261195fde90b72b4c3e64ac0a0500003faceffcc749471733c9e83eb011

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
f92f98c293e065b2d92cc696fd8fcbf1

SHA1
17b9c736ea7aee5e50286792366e8d72eca1d28d

SHA256
2bea8959194a7a83c85d265f54a53f9f7cd3a461d08c52b79fe02d52887ab54c

SHA512
820906fa81343c506b2eb3554dc41a7cb7f20dbb52542bbe409c8a5829cdd4615dad00302b3a503350c371ea064d6ca712dd328595a838acf12f3197b361ef36

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
811b8a558823ff0609c240809e083953

SHA1
dce70876b61dfed4fdbaee33aae37605e54ab58b

SHA256
fbdfc9f17d778dcd4501d484ecb0967935563d22630c050e745761eab2a39b26

SHA512
9c5ad6efc6f4ebb3fd5b9846766f1f22579cef49dd88e75265b2145b24aa5c9f04d40468089518c4c73da9b62cfe9e9920cf45f407b3a3e0689fa1ba939daf6e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
67acec440f0c71d9e2fd4cdd8fb7f633

SHA1
ea60cda22c09428d972638b8b25caabec1890de4

SHA256
e3e7f4c072fc98ad0123a1e2fbd4c9f1fb2a2ce35948212dbd99bd1fa1a12aac

SHA512
1f55a2571efc240408c3e31ad2097c9e021784828c2167dd79b48a7b1c2339392e5c2d3f97a21d46a2c85a02e0503fa166885633ca5ef11f570f243bc9370363

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
fda2729fd1a9535d1dffb7931733f696

SHA1
4eadd556236283d568d92eabfaf7060bc6dd77d4

SHA256
4bc7b423a767f2a67fd99d3d583ea3404ad2b2127fd27d9369419b521a53fd92

SHA512
7bd6404fc8c3a256c7ba11dff7a40bf05b23376ca4ef85f9eaea81b73fe19abd534b29aa8e376ed286f0a77eec9e06be0ff67197044da7247a759a636915cf46

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1

Filesize
264KB

MD5
9bb610c5e2ce573b706fd0c8324b3c1c

SHA1
8de20b459deced623413960d9ea332763e884fb1

SHA256
ae7fa00fbc9de161f17b9bcd558ff8c6f8b8cb94c2b30932b29a95dda12d71c6

SHA512
d9bfe763c9ee676dcc1411dfa48a1428a5684dfcbc618c4ed06ada454e989da6ac2575b1923d8a26a4ece4e275fca6ab338939264991b169bd02e06dc062a4ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\cfe8bfe6-960d-42a4-86d7-80ad525267d1.tmp

Filesize
12KB

MD5
774682f588889ce94dc496b95f4530e0

SHA1
6ea008b8904f6d2f24f083aa484cc61d8f30f4fd

SHA256
63004f7a63ac0416d42d08b85254ab3e357d37e513145458e570944c530f8178

SHA512
e39ace090823f0550475c52cfdc860d7842a582d9e1d57a06d7d8c16fb3f0aec3ace90d44f9870bda1fcc52a8d7e6eb4af0c1db6ac7f12328568c9bb9e8b3eee

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat

Filesize
10KB

MD5
405fc71d90ddaa1a11a46a82f45ec8a3

SHA1
145d5254a4838d1a93869d23586b9d13362d0895

SHA256
0ea7613fb69bc81d4d2f515d22ac9b132e0a82c227785d225bb2eee0f147fc9d

SHA512
39803466888e1a00257a17dd9651c3c3b8035dda76f3c86d59a83045be87a210f88538c815d2a0076444eaac6140f9e5d5bd133a6a1150abee9907320e78e8fa

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat

Filesize
10KB

MD5
eebfb84605e05222e3ad98f4b9f62db2

SHA1
36ddd440df5b2776281ad245a6a57e7a183c09a0

SHA256
4a9b70f7113d5c252937ad9bbfa110031124ffe3643648db3f944111b61bd559

SHA512
90e6f46d36c30783af4032f72beb58eb157849a8197e39945542da8a0c1313cb87e91f18a732f5718ec6a676fcd790458419bcc22c608824416fa6df14bf5ba6

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat

Filesize
243B

MD5
0b13b335adfd3c2e8bc18b5492d0d229

SHA1
92e785434cceb51e231e463ff174760f0e819fdd

SHA256
2e5d271546d0d7a41d7450d900f299bba642f75233347f654164af150a25735e

SHA512
7b2242fec4f67d581fefd7f2f35d5ea4177554d8a366d73e7bfdec148a3bf5b580e4add2b7da392e154317922b085a7ddc2ac2b7dcf8a7f20c07896621a98dc1

Download Submit
C:\Users\Admin\Downloads\MalwareDatabase-master.zip

Filesize
23.1MB

MD5
7adf86df8229fce0b1a5754bbeb765af

SHA1
f7af84ad1c28a13d043f4886dbb168553ebd540d

SHA256
2aabdae461a5807b251628ca9a360d153fbe010fa0c633e7240f2bde9f091348

SHA512
b177d6da8b8b27b89677e27d51f5c4b7a6b3a0f46e6ff4e0e17988e6c7c006ff5287552a1d447dfce3fb6f7f37085b4dd77c683121890e868280acc32d4b7f1e

Download Submit
C:\Users\Admin\Downloads\MalwareDatabase-master.zip:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
C:\Windows\EBD3.tmp

Filesize
60KB

MD5
347ac3b6b791054de3e5720a7144a977

SHA1
413eba3973a15c1a6429d9f170f3e8287f98c21c

SHA256
301b905eb98d8d6bb559c04bbda26628a942b2c4107c07a02e8f753bdcfe347c

SHA512
9a399916bc681964af1e1061bc0a8e2926307642557539ad587ce6f9b5ef93bdf1820fe5d7b5ffe5f0bb38e5b4dc6add213ba04048c0c7c264646375fcd01787

Download Submit
C:\Windows\infpub.dat

Filesize
401KB

MD5
1d724f95c61f1055f0d02c2154bbccd3

SHA1
79116fe99f2b421c52ef64097f0f39b815b20907

SHA256
579fd8a0385482fb4c789561a30b09f25671e86422f40ef5cca2036b28f99648

SHA512
f2d7b018d1516df1c97cfff5507957c75c6d9bf8e2ce52ae0052706f4ec62f13eba6d7be17e6ad2b693fdd58e1fd091c37f17bd2b948cdcd9b95b4ad428c0113

Download Submit
memory/484-1083-0x00007FFCD89A0000-0x00007FFCD89D4000-memory.dmp

Filesize
208KB

Download
memory/484-1082-0x00007FF6552F0000-0x00007FF6553E8000-memory.dmp

Filesize
992KB

Download
memory/484-1084-0x00007FFCCF930000-0x00007FFCCFBE4000-memory.dmp

Filesize
2.7MB

Download
memory/484-1085-0x00007FFCCD9F0000-0x00007FFCCEA9B000-memory.dmp

Filesize
16.7MB

Download
memory/484-1086-0x00007FFCCD290000-0x00007FFCCD3A2000-memory.dmp

Filesize
1.1MB

Download
memory/2356-704-0x00007FFCB1F70000-0x00007FFCB1F80000-memory.dmp

Filesize
64KB

Download
memory/2356-720-0x00007FFCF1EE0000-0x00007FFCF20E9000-memory.dmp

Filesize
2.0MB

Download
memory/2356-701-0x00007FFCB1F70000-0x00007FFCB1F80000-memory.dmp

Filesize
64KB

Download
memory/2356-702-0x00007FFCB1F70000-0x00007FFCB1F80000-memory.dmp

Filesize
64KB

Download
memory/2356-764-0x00007FFCF1680000-0x00007FFCF173D000-memory.dmp

Filesize
756KB

Download
memory/2356-763-0x00007FFCF1EE0000-0x00007FFCF20E9000-memory.dmp

Filesize
2.0MB

Download
memory/2356-762-0x00007FFCB1F70000-0x00007FFCB1F80000-memory.dmp

Filesize
64KB

Download
memory/2356-761-0x00007FFCB1F70000-0x00007FFCB1F80000-memory.dmp

Filesize
64KB

Download
memory/2356-760-0x00007FFCB1F70000-0x00007FFCB1F80000-memory.dmp

Filesize
64KB

Download
memory/2356-759-0x00007FFCB1F70000-0x00007FFCB1F80000-memory.dmp

Filesize
64KB

Download
memory/2356-741-0x00007FFCF1EE0000-0x00007FFCF20E9000-memory.dmp

Filesize
2.0MB

Download
memory/2356-740-0x00007FFCF1EE0000-0x00007FFCF20E9000-memory.dmp

Filesize
2.0MB

Download
memory/2356-739-0x00007FFCF1EE0000-0x00007FFCF20E9000-memory.dmp

Filesize
2.0MB

Download
memory/2356-724-0x00007FFCF1EE0000-0x00007FFCF20E9000-memory.dmp

Filesize
2.0MB

Download
memory/2356-723-0x00007FFCF1680000-0x00007FFCF173D000-memory.dmp

Filesize
756KB

Download
memory/2356-722-0x00007FFCF1EE0000-0x00007FFCF20E9000-memory.dmp

Filesize
2.0MB

Download
memory/2356-721-0x00007FFCF1EE0000-0x00007FFCF20E9000-memory.dmp

Filesize
2.0MB

Download
memory/2356-705-0x00007FFCF1EE0000-0x00007FFCF20E9000-memory.dmp

Filesize
2.0MB

Download
memory/2356-719-0x00007FFCF1EE0000-0x00007FFCF20E9000-memory.dmp

Filesize
2.0MB

Download
memory/2356-718-0x00007FFCF1EE0000-0x00007FFCF20E9000-memory.dmp

Filesize
2.0MB

Download
memory/2356-717-0x00007FFCF1EE0000-0x00007FFCF20E9000-memory.dmp

Filesize
2.0MB

Download
memory/2356-716-0x00007FFCAF600000-0x00007FFCAF610000-memory.dmp

Filesize
64KB

Download
memory/2356-715-0x00007FFCF1EE0000-0x00007FFCF20E9000-memory.dmp

Filesize
2.0MB

Download
memory/2356-714-0x00007FFCF1EE0000-0x00007FFCF20E9000-memory.dmp

Filesize
2.0MB

Download
memory/2356-713-0x00007FFCAF600000-0x00007FFCAF610000-memory.dmp

Filesize
64KB

Download
memory/2356-712-0x00007FFCF1EE0000-0x00007FFCF20E9000-memory.dmp

Filesize
2.0MB

Download
memory/2356-711-0x00007FFCF1EE0000-0x00007FFCF20E9000-memory.dmp

Filesize
2.0MB

Download
memory/2356-708-0x00007FFCB1F70000-0x00007FFCB1F80000-memory.dmp

Filesize
64KB

Download
memory/2356-710-0x00007FFCF1EE0000-0x00007FFCF20E9000-memory.dmp

Filesize
2.0MB

Download
memory/2356-709-0x00007FFCF1EE0000-0x00007FFCF20E9000-memory.dmp

Filesize
2.0MB

Download
memory/2356-706-0x00007FFCB1F70000-0x00007FFCB1F80000-memory.dmp

Filesize
64KB

Download
memory/2356-707-0x00007FFCF1EE0000-0x00007FFCF20E9000-memory.dmp

Filesize
2.0MB

Download
memory/2356-703-0x00007FFCF1EE0000-0x00007FFCF20E9000-memory.dmp

Filesize
2.0MB

Download
memory/3572-908-0x0000000003010000-0x0000000003078000-memory.dmp

Filesize
416KB

Download
memory/3572-897-0x0000000003010000-0x0000000003078000-memory.dmp

Filesize
416KB

Download
memory/3572-905-0x0000000003010000-0x0000000003078000-memory.dmp

Filesize
416KB

Download