badrabbit | hxxps://github[.]com/Endermanch/MalwareDatabase

Analysis

max time kernel
1051s
max time network
1059s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
01/04/2024, 19:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://github.com/Endermanch/MalwareDatabase
Sample240401-xpp1lsdb39

Score

10^/10

badrabbit mimikatz ransomware

Malware Config

Signatures

BadRabbit
Ransomware family discovered in late 2017, mainly targeting Russia and Ukraine.
ransomware badrabbit
Mimikatz
mimikatz is an open source tool to dump credentials on Windows.
mimikatz

mimikatz is an open source tool to dump credentials on Windows 1 IoCs

resource	yara_rule
behavioral3/files/0x000400000001da73-340.dat	mimikatz

Blocklisted process makes network request 12 IoCs

flow	pid	Process
403	2564	rundll32.exe
427	2564	rundll32.exe
469	2564	rundll32.exe
510	2564	rundll32.exe
552	2564	rundll32.exe
605	2564	rundll32.exe
647	2564	rundll32.exe
689	2564	rundll32.exe
724	2564	rundll32.exe
742	2564	rundll32.exe
783	2564	rundll32.exe
824	2564	rundll32.exe

Executes dropped EXE 1 IoCs

pid	Process
788	ECF6.tmp

Loads dropped DLL 1 IoCs

pid	Process
2564	rundll32.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
95	raw.githubusercontent.com
96	raw.githubusercontent.com
27	camo.githubusercontent.com

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\infpub.dat	[email protected]
File opened for modification	C:\Windows\infpub.dat	rundll32.exe
File created	C:\Windows\cscc.dat	rundll32.exe
File created	C:\Windows\dispci.exe	rundll32.exe
File opened for modification	C:\Windows\ECF6.tmp	rundll32.exe

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
880	schtasks.exe
216	schtasks.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 23 IoCs

pid	Process
4272	msedge.exe
4272	msedge.exe
2244	msedge.exe
2244	msedge.exe
2540	identity_helper.exe
2540	identity_helper.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
1240	msedge.exe
1240	msedge.exe
2564	rundll32.exe
2564	rundll32.exe
2564	rundll32.exe
2564	rundll32.exe
788	ECF6.tmp
788	ECF6.tmp
788	ECF6.tmp
788	ECF6.tmp
788	ECF6.tmp
788	ECF6.tmp
788	ECF6.tmp

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2564	rundll32.exe
Token: SeDebugPrivilege	2564	rundll32.exe
Token: SeTcbPrivilege	2564	rundll32.exe
Token: SeDebugPrivilege	788	ECF6.tmp

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2244 wrote to memory of 1708	2244	msedge.exe	85
PID 2244 wrote to memory of 1708	2244	msedge.exe	85
PID 2244 wrote to memory of 1212	2244	msedge.exe	86
PID 2244 wrote to memory of 1212	2244	msedge.exe	86
PID 2244 wrote to memory of 1212	2244	msedge.exe	86
PID 2244 wrote to memory of 1212	2244	msedge.exe	86
PID 2244 wrote to memory of 1212	2244	msedge.exe	86
PID 2244 wrote to memory of 1212	2244	msedge.exe	86
PID 2244 wrote to memory of 1212	2244	msedge.exe	86
PID 2244 wrote to memory of 1212	2244	msedge.exe	86
PID 2244 wrote to memory of 1212	2244	msedge.exe	86
PID 2244 wrote to memory of 1212	2244	msedge.exe	86
PID 2244 wrote to memory of 1212	2244	msedge.exe	86
PID 2244 wrote to memory of 1212	2244	msedge.exe	86
PID 2244 wrote to memory of 1212	2244	msedge.exe	86
PID 2244 wrote to memory of 1212	2244	msedge.exe	86
PID 2244 wrote to memory of 1212	2244	msedge.exe	86
PID 2244 wrote to memory of 1212	2244	msedge.exe	86
PID 2244 wrote to memory of 1212	2244	msedge.exe	86
PID 2244 wrote to memory of 1212	2244	msedge.exe	86
PID 2244 wrote to memory of 1212	2244	msedge.exe	86
PID 2244 wrote to memory of 1212	2244	msedge.exe	86
PID 2244 wrote to memory of 1212	2244	msedge.exe	86
PID 2244 wrote to memory of 1212	2244	msedge.exe	86
PID 2244 wrote to memory of 1212	2244	msedge.exe	86
PID 2244 wrote to memory of 1212	2244	msedge.exe	86
PID 2244 wrote to memory of 1212	2244	msedge.exe	86
PID 2244 wrote to memory of 1212	2244	msedge.exe	86
PID 2244 wrote to memory of 1212	2244	msedge.exe	86
PID 2244 wrote to memory of 1212	2244	msedge.exe	86
PID 2244 wrote to memory of 1212	2244	msedge.exe	86
PID 2244 wrote to memory of 1212	2244	msedge.exe	86
PID 2244 wrote to memory of 1212	2244	msedge.exe	86
PID 2244 wrote to memory of 1212	2244	msedge.exe	86
PID 2244 wrote to memory of 1212	2244	msedge.exe	86
PID 2244 wrote to memory of 1212	2244	msedge.exe	86
PID 2244 wrote to memory of 1212	2244	msedge.exe	86
PID 2244 wrote to memory of 1212	2244	msedge.exe	86
PID 2244 wrote to memory of 1212	2244	msedge.exe	86
PID 2244 wrote to memory of 1212	2244	msedge.exe	86
PID 2244 wrote to memory of 1212	2244	msedge.exe	86
PID 2244 wrote to memory of 1212	2244	msedge.exe	86
PID 2244 wrote to memory of 4272	2244	msedge.exe	87
PID 2244 wrote to memory of 4272	2244	msedge.exe	87
PID 2244 wrote to memory of 1404	2244	msedge.exe	88
PID 2244 wrote to memory of 1404	2244	msedge.exe	88
PID 2244 wrote to memory of 1404	2244	msedge.exe	88
PID 2244 wrote to memory of 1404	2244	msedge.exe	88
PID 2244 wrote to memory of 1404	2244	msedge.exe	88
PID 2244 wrote to memory of 1404	2244	msedge.exe	88
PID 2244 wrote to memory of 1404	2244	msedge.exe	88
PID 2244 wrote to memory of 1404	2244	msedge.exe	88
PID 2244 wrote to memory of 1404	2244	msedge.exe	88
PID 2244 wrote to memory of 1404	2244	msedge.exe	88
PID 2244 wrote to memory of 1404	2244	msedge.exe	88
PID 2244 wrote to memory of 1404	2244	msedge.exe	88
PID 2244 wrote to memory of 1404	2244	msedge.exe	88
PID 2244 wrote to memory of 1404	2244	msedge.exe	88
PID 2244 wrote to memory of 1404	2244	msedge.exe	88
PID 2244 wrote to memory of 1404	2244	msedge.exe	88
PID 2244 wrote to memory of 1404	2244	msedge.exe	88
PID 2244 wrote to memory of 1404	2244	msedge.exe	88
PID 2244 wrote to memory of 1404	2244	msedge.exe	88
PID 2244 wrote to memory of 1404	2244	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/Endermanch/MalwareDatabase
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbe83346f8,0x7ffbe8334708,0x7ffbe8334718
  2⤵
  PID:1708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2240,15227382376425472484,5694689178996689159,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2248 /prefetch:2
  2⤵
  PID:1212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2240,15227382376425472484,5694689178996689159,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2304 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2240,15227382376425472484,5694689178996689159,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2904 /prefetch:8
  2⤵
  PID:1404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,15227382376425472484,5694689178996689159,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:3612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,15227382376425472484,5694689178996689159,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
  2⤵
  PID:908
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2240,15227382376425472484,5694689178996689159,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5524 /prefetch:8
  2⤵
  PID:3276
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2240,15227382376425472484,5694689178996689159,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5524 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,15227382376425472484,5694689178996689159,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4952 /prefetch:1
  2⤵
  PID:3296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,15227382376425472484,5694689178996689159,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5220 /prefetch:1
  2⤵
  PID:8
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,15227382376425472484,5694689178996689159,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:5036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,15227382376425472484,5694689178996689159,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2240,15227382376425472484,5694689178996689159,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2240,15227382376425472484,5694689178996689159,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5552 /prefetch:8
  2⤵
  PID:2884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,15227382376425472484,5694689178996689159,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3120 /prefetch:1
  2⤵
  PID:1280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2240,15227382376425472484,5694689178996689159,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5220 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1240

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2992

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3276

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4872

C:\Users\Admin\AppData\Local\Temp\Temp1_BadRabbit.zip\[email protected]
"C:\Users\Admin\AppData\Local\Temp\Temp1_BadRabbit.zip\[email protected]"
1⤵
- Drops file in Windows directory
PID:4812
- C:\Windows\SysWOW64\rundll32.exe
  C:\Windows\system32\rundll32.exe C:\Windows\infpub.dat,#1 15
  2⤵
  - Blocklisted process makes network request
  - Loads dropped DLL
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2564
- - C:\Windows\SysWOW64\cmd.exe
    /c schtasks /Delete /F /TN rhaegal
    3⤵
    PID:1908
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /Delete /F /TN rhaegal
      4⤵
      PID:4772
- - C:\Windows\SysWOW64\cmd.exe
    /c schtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR "C:\Windows\system32\cmd.exe /C Start \"\" \"C:\Windows\dispci.exe\" -id 4279030965 && exit"
    3⤵
    PID:2492
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR "C:\Windows\system32\cmd.exe /C Start \"\" \"C:\Windows\dispci.exe\" -id 4279030965 && exit"
      4⤵
      Creates scheduled task(s)
      PID:880
- - C:\Windows\SysWOW64\cmd.exe
    /c schtasks /Create /SC once /TN drogon /RU SYSTEM /TR "C:\Windows\system32\shutdown.exe /r /t 0 /f" /ST 19:22:00
    3⤵
    PID:1272
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /Create /SC once /TN drogon /RU SYSTEM /TR "C:\Windows\system32\shutdown.exe /r /t 0 /f" /ST 19:22:00
      4⤵
      Creates scheduled task(s)
      PID:216
- - C:\Windows\ECF6.tmp
    "C:\Windows\ECF6.tmp" \\.\pipe\{F0731285-133A-47CB-AC42-31E8081042DC}
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:788

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 7c6b0de6f9b4c3ca1f5d6af23c3380f849825af00b58420b76c72b62cfae44ae
MD5 36bb45cb1262fcfcab1e3e7960784eaa
SHA1 ab0e15841b027632c9e1b0a47d3dec42162fc637
SHA512 02c54c919f8cf3fc28f5f965fe1755955636d7d89b5f0504a02fcd9d94de8c50e046c7c2d6cf349fabde03b0fbbcc61df6e9968f2af237106bf7edd697e07456
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 a56135007f4dadf6606bc237cb75ff5ff77326ba093dff30d6881ce9a04a114c
MD5 1e3dc6a82a2cb341f7c9feeaf53f466f
SHA1 915decb72e1f86e14114f14ac9bfd9ba198fdfce
SHA512 0a5223e8cecce77613b1c02535c79b3795e5ad89fc0a934e9795e488712e02b527413109ad1f94bbd4eb35dd07b86dd6e9f4b57d4d7c8a0a57ec3f7f76c7890a
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 2KB
SHA256 fcfe3885e6bc7405fc9f512e753dc03589c1375b2e8773e67f5dfa31d8e2db53
MD5 c103be4c0add3409fe6b524c018fb0ef
SHA1 42cd6d7e30d8c5ff43e6e858241692bc310d1c2d
SHA512 21a625dff056f359b74c28331cd056823c1c1731c0208d93d479935882fb33076845cc8d7520a1343083ec242d741b14257ea257866b17f47c57adc6e4338fb3
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 f90e395dd7e325db63452bc6079df0a7e61ae6faf38d6d7488353325bcf8739e
MD5 89a37314c05d9a8ef76693a24b52e46d
SHA1 095899a890ecee9da493f4e465aa322726bb4207
SHA512 60a257083325af6b40f90db6db9711a98f8848e6e3d51a04c75aa67d77705a24f84ffba79f42947552d9a493f6865baacc17af73c856b3bcb1b1c22e46f45e09
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 496B
SHA256 b15378cc8b4d0281de5749998605f5285dd1b752e9987fdf70ba724c1ce04bcd
MD5 15f718aa95bd4a624e1d34d0bdaa756d
SHA1 38652ab858207aecbd7548eac5b7fc075590b5a9
SHA512 1ccf3d5ce9aed0cdc97fc468aeb039f5aab3c377124e2c8f938810bfc0aaeba0b3a03eba1c856c157306e3165a5dcdc6d7e093f5bada41d833192ab228d8f8d7
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 579B
SHA256 223280d95a13f1af6af06459bbf230874500c212a2e16f63914eff3f22e8b57a
MD5 46fa4f5f7344089589d117bd7599b3a9
SHA1 b6cc1fe19e527d4a372c97e4d195ed94eee40030
SHA512 6b680aedde7e806802652aab9ab31cb21438bc8756b063955e6f03bbbdf1273f7d47c40ec1a19fe27537afeb8d6cc219a246d31f7c6822b481649fe296e2a45c
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 eee7f9eb503e01e5064c3d0008fe662ecce8557d69b4831443f99cbd01795bf3
MD5 e45defb91d4e1ce2726a662ff9de6836
SHA1 bbd0df1f4c03f4c93e4d27ded517127acda131cf
SHA512 e630cb0c3b659cab8ce7f0712604e631b55aef8db746f743154b55ecb7825dd6ead1c4399035e5d501cdeee3dea14bfd83b12d25ec16c9341d91accddee5896c
SSDEEP 96:n3k8sQO0t1JpsV8wpvWMoiVmde9wjSjNCoonUWQyV+VD7AiEwb:n3kQtXpsV8GWMNwmpOrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 f8dc85d6810aef5d78fb2c21c86f44a2fb346ede3568daca0186965ad6d9e84b
MD5 b9bffcbbfcf5cb349f085756694595a9
SHA1 ba83b7cb9a2bb29f602da36e2c840cd8fc8490dd
SHA512 4b77b6a471639a66db0f2b22e0c8accecd0162316fe94c4ce6cd4847f634a6ad7567282f5ae857b91eaedac12ba273c30bccac121256e627ae5e5425e5f2dfb9
SSDEEP 96:n3krsQO0t1JpsV8wpvWMoiVmde9wjSjNCoKnUWQyV+VD7AiEwb:n3k1tXpsV8GWMNwmpMrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 19039641849925948b7f260366e23f2bc6d42b905a299fef590fdc9fe4b8e5f5
MD5 b65ee7bff9078a8d60fd78d24e9c3fab
SHA1 bad9cddb91a1c3ca522756dc6e4e8c1abe40a3a6
SHA512 3bef0cdc2c6d86dd9331fecf133dd36173b200f49795e803376799333658677b69ad90147d9ea321f2d6b4206497ffb1ecb4e6687fb9a918692715280dc9c724
SSDEEP 96:n3kv0t1Z5sV8wpvWMoiVmdeHCuonUWQyV+VD7ziEwb:n3kstr5sV8GWMXmrt
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 a9444eba57943a4f033ba87e4944af2743e631ecc73217041054dbe364bd9f94
MD5 3d30f022577bd9b6e1a09be777b5983b
SHA1 9859f9065d554831397a285d79588c83d976bc2b
SHA512 22bddf5c7a0f1a3805ea330b66488429c963194d9b668ab726288ec1880951a93d4ff28bf73a42592c3d9393b6af726ecb28b9c3ceefafe779dd7b068d895cec
SSDEEP 96:n3k40t1ZpsV8wpvWMoiVmdeeue1jCZFonUWQyV+VD7AiEwb:n3kFtrpsV8GWMuuehPrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 5e0f0dde7f48e633b3d98dcd03e68ab64fb0f4846a3a32edca2eb21a826e71d9
MD5 ca633e8505f8dfaaca8c6e7a35d2223e
SHA1 1b82a25716e6d8fe25196c55509b4d3f08bc4053
SHA512 b9d91bd3127cce6404210213b8fa79a3363e4264af67f18aaab20e8c5c01d0090cc937fa0bd56164fc0d9c435e1568ff783a2fdd0938228cd8673ab77ff6d670
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 6ff0b331447e54e0559d99ea44034086d549b034c581562b78bcf5f8487b8002
MD5 4bf5421254cbfc0f6926c8db8f84d85f
SHA1 75a2ad0a8ec545fa4a3a8f883bf97de2fd0a2e4a
SHA512 507a522dce71fc7694111d400c8e73e866ea3c4a27c2264483989a0d306b799e9039f84766ead2301e76ee5ae993ab97f6708e5158a8f88cea3d31ef4d057fc5
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe59aa40.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe59aa40.TMP
Size 1KB
SHA256 c687a1caf7d950e13009dcd94b13073f5d7a96f37cc8b64cf9d36cb119443068
MD5 ffe48f7dfc4eac8702c875142dfcd4f6
SHA1 05c09577144ee76f3ca54e5b006c05016cfe7793
SHA512 847c45a4eb3cc96898e831a985b48c97e8dd820f8b76feb030675b9856a9145b06d0bb5a1cdaab95fa790dd3fb80a8e2613699fcc962f046250ca33ff7dab935
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 aa2d916a2a133a4695d2404ff8f224198b619fe2f19480dd08db7b6ee32aa6b8
MD5 9aad4a581e3e74fc30204c46a82ab0c3
SHA1 fc2a01f9ff14c8183ede73eefc1649dbcd483a59
SHA512 93b9de32456561abf6fa2c7590ec9bcfd97669e6ce241b44aa52b5303c3cb08a82feac3dee7fe65ab9e2d3b3f336f42090f9f6c4ebde77fddd05a2648d57ea4a
SSDEEP 192:0oCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupLe2RUPNnU1dvbq3znIYWL6:U9iIxuERzA83h09RZxYbgnq+3zIDG8U
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 51aba46bfb5523050ea981ef75074b6eaf026aa7d71ce302299e1e6c54df4e1c
MD5 144b7ecea451bce6c941cebeabf76d3a
SHA1 591fa2afb9b61eab08eadb440e990f0c07ef6d64
SHA512 9de83af1b049bd26cfed5ba21c9f8a5e718a50cf2f17d0270b5445f524e236ab6bdec3d7d9cd8631c998a6c6f9467c2b84c1d8d2b330477c060931d48e6ecd70
SSDEEP 192:1oCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupLe2RUPNnU1dvbq3znIYWL6:59iIxuERzA83h09RZxYbgnq+3zIDG8U
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 78b626818f48f7fb9857b289bc23bef8284390b39a6862a95ec268965efe2069
MD5 3d725ea9346b276bc7d8266dc31d9106
SHA1 5f9055d5d06aef56329a016e1e2ad478cb8b92b4
SHA512 c8ae65f9927e4354123071e2242718734830fb564be6d6201b7de4b5d49e6f54185b0b557c7818ac883659f50b2ecc9b80c20b2859671aced958419ca742f689
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupae2RUPtRUvbqVznIYWLSDH:A9iIxuERzA83h09RZxY0+U+VzIDG8U
MD5 SHA1 SHA512 SSDEEP

Submit Download

BadRabbit.zip

Path C:\Users\Admin\Downloads\BadRabbit.zip
Size 393KB
SHA256 ea8ccb8b5ec36195af831001b3cc46caedfc61a6194e2568901e7685c57ceefa
MD5 61da9939db42e2c3007ece3f163e2d06
SHA1 4bd7e9098de61adecc1bdbd1a01490994d1905fb
SHA512 14d0bc14a10e5bd8022e7ab4a80f98600f84754c2c80e22a8e3d9f9555dde5bad056d925576b29fc1a37e73c6ebca693687b47317a469a7dfdc4ab0f3d97a63e
SSDEEP 12288:KPd6ZnyRPZJhKymLkH+yDXZEyfMrvDca6:Koy5ZJ7BeeXmb8a6
MD5 SHA1 SHA512 SSDEEP

Submit Download

BadRabbit.zip

Path C:\Users\Admin\Downloads\BadRabbit.zip
Size 393KB
SHA256 0b0abdd196af3f819d61c5914bd26c4989e088f987f2c9af42bcbab81db80cb4
MD5 45ea6c9f7387ba507bb8fb50f8083f7e
SHA1 bf63aa5a5005a7e1b4138e4856455ba7e91ef100
SHA512 2900c80923d384d380e2101f1183ad84145bebf95f1c7b0428c3bdea2e76d6e6e02ec96c5f677823eb3e8b35d4a30d9f95a26138576cd2d8331150ebeb76fc23
SSDEEP 12288:7Ndr2BBdGvJfuIQYw7uQHfkzSJ9vyKJ4V:7NFYBa9w7ZHMa96y0
MD5 SHA1 SHA512 SSDEEP

Submit Download

ECF6.tmp

Path C:\Windows\ECF6.tmp
Size 60KB
SHA256 301b905eb98d8d6bb559c04bbda26628a942b2c4107c07a02e8f753bdcfe347c
MD5 347ac3b6b791054de3e5720a7144a977
SHA1 413eba3973a15c1a6429d9f170f3e8287f98c21c
SHA512 9a399916bc681964af1e1061bc0a8e2926307642557539ad587ce6f9b5ef93bdf1820fe5d7b5ffe5f0bb38e5b4dc6add213ba04048c0c7c264646375fcd01787
SSDEEP 1536:QeRCKjey4TTGLeBYEUW1SIUDoCB449rHUV:KKjey4TTmeBZUGSIUDoCq49oV
MD5 SHA1 SHA512 SSDEEP

Submit Download

infpub.dat

Path C:\Windows\infpub.dat
Size 401KB
SHA256 579fd8a0385482fb4c789561a30b09f25671e86422f40ef5cca2036b28f99648
MD5 1d724f95c61f1055f0d02c2154bbccd3
SHA1 79116fe99f2b421c52ef64097f0f39b815b20907
SHA512 f2d7b018d1516df1c97cfff5507957c75c6d9bf8e2ce52ae0052706f4ec62f13eba6d7be17e6ad2b693fdd58e1fd091c37f17bd2b948cdcd9b95b4ad428c0113
SSDEEP 12288:GtDjvhNTc/cq4RKZZKfArRuSA80m+/6sXRnfPGp:IjTc/cq4RUZaArbInfPGp
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2564-334-0x00000000024F0000-0x0000000002558000-memory.dmp

Download

memory/2564-331-0x00000000024F0000-0x0000000002558000-memory.dmp

Download

memory/2564-323-0x00000000024F0000-0x0000000002558000-memory.dmp

Download