Overview

overview

10

Static

static

1

URLScan

urlscan

https://github.com/E...

windows7-x64

6

https://github.com/E...

windows10-1703-x64

6

https://github.com/E...

windows10-2004-x64

10

https://github.com/E...

windows11-21h2-x64

Analysis

  • max time kernel
    1051s
  • max time network
    1059s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01-04-2024 19:01

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    https://github.com/Endermanch/MalwareDatabase

Score
10/10
badrabbitmimikatzransomware

Malware Config

Signatures

  • BadRabbit

    Ransomware family discovered in late 2017, mainly targeting Russia and Ukraine.

    ransomwarebadrabbit
  • Mimikatz

    mimikatz is an open source tool to dump credentials on Windows.

    mimikatz
  • mimikatz is an open source tool to dump credentials on Windows 1 IoCs
  • Blocklisted process makes network request 12 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
  • Drops file in Windows directory 5 IoCs
  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 23 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 33 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/Endermanch/MalwareDatabase
    1⤵
    • Enumerates system info in registry
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2244
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbe83346f8,0x7ffbe8334708,0x7ffbe8334718
      2⤵
        PID:1708
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2240,15227382376425472484,5694689178996689159,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2248 /prefetch:2
        2⤵
          PID:1212
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2240,15227382376425472484,5694689178996689159,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2304 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:4272
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2240,15227382376425472484,5694689178996689159,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2904 /prefetch:8
          2⤵
            PID:1404
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,15227382376425472484,5694689178996689159,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
            2⤵
              PID:3612
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,15227382376425472484,5694689178996689159,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
              2⤵
                PID:908
              • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2240,15227382376425472484,5694689178996689159,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5524 /prefetch:8
                2⤵
                  PID:3276
                • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2240,15227382376425472484,5694689178996689159,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5524 /prefetch:8
                  2⤵
                  • Suspicious behavior: EnumeratesProcesses
                  PID:2540
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,15227382376425472484,5694689178996689159,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4952 /prefetch:1
                  2⤵
                    PID:3296
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,15227382376425472484,5694689178996689159,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5220 /prefetch:1
                    2⤵
                      PID:8
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,15227382376425472484,5694689178996689159,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
                      2⤵
                        PID:5036
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,15227382376425472484,5694689178996689159,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3496 /prefetch:1
                        2⤵
                          PID:644
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2240,15227382376425472484,5694689178996689159,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
                          2⤵
                          • Suspicious behavior: EnumeratesProcesses
                          PID:4684
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2240,15227382376425472484,5694689178996689159,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5552 /prefetch:8
                          2⤵
                            PID:2884
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,15227382376425472484,5694689178996689159,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3120 /prefetch:1
                            2⤵
                              PID:1280
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2240,15227382376425472484,5694689178996689159,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5220 /prefetch:8
                              2⤵
                              • Suspicious behavior: EnumeratesProcesses
                              PID:1240
                          • C:\Windows\System32\CompPkgSrv.exe
                            C:\Windows\System32\CompPkgSrv.exe -Embedding
                            1⤵
                              PID:2992
                            • C:\Windows\System32\CompPkgSrv.exe
                              C:\Windows\System32\CompPkgSrv.exe -Embedding
                              1⤵
                                PID:3276
                              • C:\Windows\System32\rundll32.exe
                                C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                1⤵
                                  PID:4872
                                • C:\Users\Admin\AppData\Local\Temp\Temp1_BadRabbit.zip\[email protected]
                                  "C:\Users\Admin\AppData\Local\Temp\Temp1_BadRabbit.zip\[email protected]"
                                  1⤵
                                  • Drops file in Windows directory
                                  PID:4812
                                  • C:\Windows\SysWOW64\rundll32.exe
                                    C:\Windows\system32\rundll32.exe C:\Windows\infpub.dat,#1 15
                                    2⤵
                                    • Blocklisted process makes network request
                                    • Loads dropped DLL
                                    • Drops file in Windows directory
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:2564
                                    • C:\Windows\SysWOW64\cmd.exe
                                      /c schtasks /Delete /F /TN rhaegal
                                      3⤵
                                        PID:1908
                                        • C:\Windows\SysWOW64\schtasks.exe
                                          schtasks /Delete /F /TN rhaegal
                                          4⤵
                                            PID:4772
                                        • C:\Windows\SysWOW64\cmd.exe
                                          /c schtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR "C:\Windows\system32\cmd.exe /C Start \"\" \"C:\Windows\dispci.exe\" -id 4279030965 && exit"
                                          3⤵
                                            PID:2492
                                            • C:\Windows\SysWOW64\schtasks.exe
                                              schtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR "C:\Windows\system32\cmd.exe /C Start \"\" \"C:\Windows\dispci.exe\" -id 4279030965 && exit"
                                              4⤵
                                              • Creates scheduled task(s)
                                              PID:880
                                          • C:\Windows\SysWOW64\cmd.exe
                                            /c schtasks /Create /SC once /TN drogon /RU SYSTEM /TR "C:\Windows\system32\shutdown.exe /r /t 0 /f" /ST 19:22:00
                                            3⤵
                                              PID:1272
                                              • C:\Windows\SysWOW64\schtasks.exe
                                                schtasks /Create /SC once /TN drogon /RU SYSTEM /TR "C:\Windows\system32\shutdown.exe /r /t 0 /f" /ST 19:22:00
                                                4⤵
                                                • Creates scheduled task(s)
                                                PID:216
                                            • C:\Windows\ECF6.tmp
                                              "C:\Windows\ECF6.tmp" \\.\pipe\{F0731285-133A-47CB-AC42-31E8081042DC}
                                              3⤵
                                              • Executes dropped EXE
                                              • Suspicious behavior: EnumeratesProcesses
                                              • Suspicious use of AdjustPrivilegeToken
                                              PID:788

                                        Network

                                        MITRE ATT&CK Enterprise v15

                                        Replay Monitor

                                        Loading Replay Monitor...

                                        Downloads

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                          Filesize

                                          152B

                                          MD5

                                          36bb45cb1262fcfcab1e3e7960784eaa

                                          SHA1

                                          ab0e15841b027632c9e1b0a47d3dec42162fc637

                                          SHA256

                                          7c6b0de6f9b4c3ca1f5d6af23c3380f849825af00b58420b76c72b62cfae44ae

                                          SHA512

                                          02c54c919f8cf3fc28f5f965fe1755955636d7d89b5f0504a02fcd9d94de8c50e046c7c2d6cf349fabde03b0fbbcc61df6e9968f2af237106bf7edd697e07456

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                          Filesize

                                          152B

                                          MD5

                                          1e3dc6a82a2cb341f7c9feeaf53f466f

                                          SHA1

                                          915decb72e1f86e14114f14ac9bfd9ba198fdfce

                                          SHA256

                                          a56135007f4dadf6606bc237cb75ff5ff77326ba093dff30d6881ce9a04a114c

                                          SHA512

                                          0a5223e8cecce77613b1c02535c79b3795e5ad89fc0a934e9795e488712e02b527413109ad1f94bbd4eb35dd07b86dd6e9f4b57d4d7c8a0a57ec3f7f76c7890a

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
                                          Filesize

                                          2KB

                                          MD5

                                          c103be4c0add3409fe6b524c018fb0ef

                                          SHA1

                                          42cd6d7e30d8c5ff43e6e858241692bc310d1c2d

                                          SHA256

                                          fcfe3885e6bc7405fc9f512e753dc03589c1375b2e8773e67f5dfa31d8e2db53

                                          SHA512

                                          21a625dff056f359b74c28331cd056823c1c1731c0208d93d479935882fb33076845cc8d7520a1343083ec242d741b14257ea257866b17f47c57adc6e4338fb3

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                          Filesize

                                          1KB

                                          MD5

                                          89a37314c05d9a8ef76693a24b52e46d

                                          SHA1

                                          095899a890ecee9da493f4e465aa322726bb4207

                                          SHA256

                                          f90e395dd7e325db63452bc6079df0a7e61ae6faf38d6d7488353325bcf8739e

                                          SHA512

                                          60a257083325af6b40f90db6db9711a98f8848e6e3d51a04c75aa67d77705a24f84ffba79f42947552d9a493f6865baacc17af73c856b3bcb1b1c22e46f45e09

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
                                          Filesize

                                          496B

                                          MD5

                                          15f718aa95bd4a624e1d34d0bdaa756d

                                          SHA1

                                          38652ab858207aecbd7548eac5b7fc075590b5a9

                                          SHA256

                                          b15378cc8b4d0281de5749998605f5285dd1b752e9987fdf70ba724c1ce04bcd

                                          SHA512

                                          1ccf3d5ce9aed0cdc97fc468aeb039f5aab3c377124e2c8f938810bfc0aaeba0b3a03eba1c856c157306e3165a5dcdc6d7e093f5bada41d833192ab228d8f8d7

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
                                          Filesize

                                          579B

                                          MD5

                                          46fa4f5f7344089589d117bd7599b3a9

                                          SHA1

                                          b6cc1fe19e527d4a372c97e4d195ed94eee40030

                                          SHA256

                                          223280d95a13f1af6af06459bbf230874500c212a2e16f63914eff3f22e8b57a

                                          SHA512

                                          6b680aedde7e806802652aab9ab31cb21438bc8756b063955e6f03bbbdf1273f7d47c40ec1a19fe27537afeb8d6cc219a246d31f7c6822b481649fe296e2a45c

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                          Filesize

                                          6KB

                                          MD5

                                          e45defb91d4e1ce2726a662ff9de6836

                                          SHA1

                                          bbd0df1f4c03f4c93e4d27ded517127acda131cf

                                          SHA256

                                          eee7f9eb503e01e5064c3d0008fe662ecce8557d69b4831443f99cbd01795bf3

                                          SHA512

                                          e630cb0c3b659cab8ce7f0712604e631b55aef8db746f743154b55ecb7825dd6ead1c4399035e5d501cdeee3dea14bfd83b12d25ec16c9341d91accddee5896c

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                          Filesize

                                          6KB

                                          MD5

                                          b9bffcbbfcf5cb349f085756694595a9

                                          SHA1

                                          ba83b7cb9a2bb29f602da36e2c840cd8fc8490dd

                                          SHA256

                                          f8dc85d6810aef5d78fb2c21c86f44a2fb346ede3568daca0186965ad6d9e84b

                                          SHA512

                                          4b77b6a471639a66db0f2b22e0c8accecd0162316fe94c4ce6cd4847f634a6ad7567282f5ae857b91eaedac12ba273c30bccac121256e627ae5e5425e5f2dfb9

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                          Filesize

                                          6KB

                                          MD5

                                          b65ee7bff9078a8d60fd78d24e9c3fab

                                          SHA1

                                          bad9cddb91a1c3ca522756dc6e4e8c1abe40a3a6

                                          SHA256

                                          19039641849925948b7f260366e23f2bc6d42b905a299fef590fdc9fe4b8e5f5

                                          SHA512

                                          3bef0cdc2c6d86dd9331fecf133dd36173b200f49795e803376799333658677b69ad90147d9ea321f2d6b4206497ffb1ecb4e6687fb9a918692715280dc9c724

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                          Filesize

                                          6KB

                                          MD5

                                          3d30f022577bd9b6e1a09be777b5983b

                                          SHA1

                                          9859f9065d554831397a285d79588c83d976bc2b

                                          SHA256

                                          a9444eba57943a4f033ba87e4944af2743e631ecc73217041054dbe364bd9f94

                                          SHA512

                                          22bddf5c7a0f1a3805ea330b66488429c963194d9b668ab726288ec1880951a93d4ff28bf73a42592c3d9393b6af726ecb28b9c3ceefafe779dd7b068d895cec

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                          Filesize

                                          1KB

                                          MD5

                                          ca633e8505f8dfaaca8c6e7a35d2223e

                                          SHA1

                                          1b82a25716e6d8fe25196c55509b4d3f08bc4053

                                          SHA256

                                          5e0f0dde7f48e633b3d98dcd03e68ab64fb0f4846a3a32edca2eb21a826e71d9

                                          SHA512

                                          b9d91bd3127cce6404210213b8fa79a3363e4264af67f18aaab20e8c5c01d0090cc937fa0bd56164fc0d9c435e1568ff783a2fdd0938228cd8673ab77ff6d670

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                          Filesize

                                          1KB

                                          MD5

                                          4bf5421254cbfc0f6926c8db8f84d85f

                                          SHA1

                                          75a2ad0a8ec545fa4a3a8f883bf97de2fd0a2e4a

                                          SHA256

                                          6ff0b331447e54e0559d99ea44034086d549b034c581562b78bcf5f8487b8002

                                          SHA512

                                          507a522dce71fc7694111d400c8e73e866ea3c4a27c2264483989a0d306b799e9039f84766ead2301e76ee5ae993ab97f6708e5158a8f88cea3d31ef4d057fc5

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe59aa40.TMP
                                          Filesize

                                          1KB

                                          MD5

                                          ffe48f7dfc4eac8702c875142dfcd4f6

                                          SHA1

                                          05c09577144ee76f3ca54e5b006c05016cfe7793

                                          SHA256

                                          c687a1caf7d950e13009dcd94b13073f5d7a96f37cc8b64cf9d36cb119443068

                                          SHA512

                                          847c45a4eb3cc96898e831a985b48c97e8dd820f8b76feb030675b9856a9145b06d0bb5a1cdaab95fa790dd3fb80a8e2613699fcc962f046250ca33ff7dab935

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
                                          Filesize

                                          16B

                                          MD5

                                          6752a1d65b201c13b62ea44016eb221f

                                          SHA1

                                          58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                          SHA256

                                          0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                          SHA512

                                          9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                          Filesize

                                          12KB

                                          MD5

                                          9aad4a581e3e74fc30204c46a82ab0c3

                                          SHA1

                                          fc2a01f9ff14c8183ede73eefc1649dbcd483a59

                                          SHA256

                                          aa2d916a2a133a4695d2404ff8f224198b619fe2f19480dd08db7b6ee32aa6b8

                                          SHA512

                                          93b9de32456561abf6fa2c7590ec9bcfd97669e6ce241b44aa52b5303c3cb08a82feac3dee7fe65ab9e2d3b3f336f42090f9f6c4ebde77fddd05a2648d57ea4a

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                          Filesize

                                          12KB

                                          MD5

                                          144b7ecea451bce6c941cebeabf76d3a

                                          SHA1

                                          591fa2afb9b61eab08eadb440e990f0c07ef6d64

                                          SHA256

                                          51aba46bfb5523050ea981ef75074b6eaf026aa7d71ce302299e1e6c54df4e1c

                                          SHA512

                                          9de83af1b049bd26cfed5ba21c9f8a5e718a50cf2f17d0270b5445f524e236ab6bdec3d7d9cd8631c998a6c6f9467c2b84c1d8d2b330477c060931d48e6ecd70

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                          Filesize

                                          11KB

                                          MD5

                                          3d725ea9346b276bc7d8266dc31d9106

                                          SHA1

                                          5f9055d5d06aef56329a016e1e2ad478cb8b92b4

                                          SHA256

                                          78b626818f48f7fb9857b289bc23bef8284390b39a6862a95ec268965efe2069

                                          SHA512

                                          c8ae65f9927e4354123071e2242718734830fb564be6d6201b7de4b5d49e6f54185b0b557c7818ac883659f50b2ecc9b80c20b2859671aced958419ca742f689

                                          Download Submit

                                        • C:\Users\Admin\Downloads\BadRabbit.zip
                                          Filesize

                                          393KB

                                          MD5

                                          61da9939db42e2c3007ece3f163e2d06

                                          SHA1

                                          4bd7e9098de61adecc1bdbd1a01490994d1905fb

                                          SHA256

                                          ea8ccb8b5ec36195af831001b3cc46caedfc61a6194e2568901e7685c57ceefa

                                          SHA512

                                          14d0bc14a10e5bd8022e7ab4a80f98600f84754c2c80e22a8e3d9f9555dde5bad056d925576b29fc1a37e73c6ebca693687b47317a469a7dfdc4ab0f3d97a63e

                                          Download Submit

                                        • C:\Users\Admin\Downloads\BadRabbit.zip
                                          Filesize

                                          393KB

                                          MD5

                                          45ea6c9f7387ba507bb8fb50f8083f7e

                                          SHA1

                                          bf63aa5a5005a7e1b4138e4856455ba7e91ef100

                                          SHA256

                                          0b0abdd196af3f819d61c5914bd26c4989e088f987f2c9af42bcbab81db80cb4

                                          SHA512

                                          2900c80923d384d380e2101f1183ad84145bebf95f1c7b0428c3bdea2e76d6e6e02ec96c5f677823eb3e8b35d4a30d9f95a26138576cd2d8331150ebeb76fc23

                                          Download Submit

                                        • C:\Windows\ECF6.tmp
                                          Filesize

                                          60KB

                                          MD5

                                          347ac3b6b791054de3e5720a7144a977

                                          SHA1

                                          413eba3973a15c1a6429d9f170f3e8287f98c21c

                                          SHA256

                                          301b905eb98d8d6bb559c04bbda26628a942b2c4107c07a02e8f753bdcfe347c

                                          SHA512

                                          9a399916bc681964af1e1061bc0a8e2926307642557539ad587ce6f9b5ef93bdf1820fe5d7b5ffe5f0bb38e5b4dc6add213ba04048c0c7c264646375fcd01787

                                          Download Submit

                                        • C:\Windows\infpub.dat
                                          Filesize

                                          401KB

                                          MD5

                                          1d724f95c61f1055f0d02c2154bbccd3

                                          SHA1

                                          79116fe99f2b421c52ef64097f0f39b815b20907

                                          SHA256

                                          579fd8a0385482fb4c789561a30b09f25671e86422f40ef5cca2036b28f99648

                                          SHA512

                                          f2d7b018d1516df1c97cfff5507957c75c6d9bf8e2ce52ae0052706f4ec62f13eba6d7be17e6ad2b693fdd58e1fd091c37f17bd2b948cdcd9b95b4ad428c0113

                                          Download Submit

                                        • memory/2564-334-0x00000000024F0000-0x0000000002558000-memory.dmp

                                          Filesize

                                          416KB

                                          Download

                                        • memory/2564-331-0x00000000024F0000-0x0000000002558000-memory.dmp

                                          Filesize

                                          416KB

                                          Download

                                        • memory/2564-323-0x00000000024F0000-0x0000000002558000-memory.dmp

                                          Filesize

                                          416KB

                                          Download