Resubmissions

10-04-2024 19:40

240410-ydkgescg9z 1

10-04-2024 19:27

240410-x6ewzace5s 10

10-04-2024 19:16

240410-xzannshb36 6

10-04-2024 19:04

240410-xq4kdsca2y 10

10-04-2024 18:56

240410-xlmq3sbg4y 10

10-04-2024 18:54

240410-xka1wsbf9s 7

10-04-2024 18:49

240410-xga7gsgd82 6

10-04-2024 18:41

240410-xbrmaabd2x 8

Analysis

  • max time kernel
    371s
  • max time network
    376s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240221-en
  • resource tags

    arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    10-04-2024 18:56

Errors

Reason
Machine shutdown

General

  • Target

    sample.html

  • Size

    467KB

  • MD5

    12b9d6652e7d1689ed510c50c53bd38c

  • SHA1

    013a1cc01a97a97d9b18dfbafcfec91a57e6232a

  • SHA256

    4b1aa26e12d9f06ba494ad2e2223466c8ddc5bc61b5f189630dffea54f3d93ce

  • SHA512

    0ce40b9a4d137d99330f7bc2776734d121d485d3f1e3af23ede4bbebead330c30de2c4568029303259812d591ef7bbc52bd1f16d8912dd5ea006523008346e7c

  • SSDEEP

    6144:DFoiM/iMTiMkiMriM2iMSiMliMziMViMuMt:D2iciiiViQibiRimiIiOiXMt

Malware Config

Signatures

  • BadRabbit

    Ransomware family discovered in late 2017, mainly targeting Russia and Ukraine.

  • Mimikatz

    mimikatz is an open source tool to dump credentials on Windows.

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 2 IoCs
  • UAC bypass 3 TTPs 1 IoCs
  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

  • mimikatz is an open source tool to dump credentials on Windows 1 IoCs
  • Disables RegEdit via registry modification 2 IoCs
  • Disables Task Manager via registry modification
  • Disables use of System Restore points 1 TTPs
  • Modifies Windows Firewall 2 TTPs 1 IoCs
  • Sets file execution options in registry 2 TTPs 64 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 1 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 4 IoCs
  • Drops file in Windows directory 5 IoCs
  • Program crash 1 IoCs
  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Interacts with shadow copies 2 TTPs 3 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

  • Modifies data under HKEY_USERS 15 IoCs
  • Modifies registry class 2 IoCs
  • Modifies system certificate store 2 TTPs 5 IoCs
  • NTFS ADS 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 27 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 21 IoCs
  • Suspicious use of AdjustPrivilegeToken 10 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 12 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html
    1⤵
    • Enumerates system info in registry
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2104
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff866cf3cb8,0x7ff866cf3cc8,0x7ff866cf3cd8
      2⤵
        PID:4592
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1892,9394161259415427038,3183633797654052231,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1904 /prefetch:2
        2⤵
          PID:2864
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1892,9394161259415427038,3183633797654052231,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2284 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:904
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1892,9394161259415427038,3183633797654052231,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2720 /prefetch:8
          2⤵
            PID:4240
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,9394161259415427038,3183633797654052231,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3156 /prefetch:1
            2⤵
              PID:4360
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,9394161259415427038,3183633797654052231,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3164 /prefetch:1
              2⤵
                PID:3352
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,9394161259415427038,3183633797654052231,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4636 /prefetch:1
                2⤵
                  PID:408
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,9394161259415427038,3183633797654052231,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
                  2⤵
                    PID:2788
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,9394161259415427038,3183633797654052231,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3560 /prefetch:1
                    2⤵
                      PID:3436
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1892,9394161259415427038,3183633797654052231,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3892 /prefetch:8
                      2⤵
                      • Suspicious behavior: EnumeratesProcesses
                      PID:3572
                    • C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1892,9394161259415427038,3183633797654052231,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3304 /prefetch:8
                      2⤵
                      • Suspicious behavior: EnumeratesProcesses
                      PID:2644
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,9394161259415427038,3183633797654052231,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5324 /prefetch:1
                      2⤵
                        PID:4724
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,9394161259415427038,3183633797654052231,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5112 /prefetch:1
                        2⤵
                          PID:4156
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,9394161259415427038,3183633797654052231,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5128 /prefetch:1
                          2⤵
                            PID:2956
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,9394161259415427038,3183633797654052231,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5856 /prefetch:1
                            2⤵
                              PID:3596
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,9394161259415427038,3183633797654052231,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5156 /prefetch:1
                              2⤵
                                PID:4860
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,9394161259415427038,3183633797654052231,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4904 /prefetch:1
                                2⤵
                                  PID:4600
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1892,9394161259415427038,3183633797654052231,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4948 /prefetch:8
                                  2⤵
                                    PID:4544
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1892,9394161259415427038,3183633797654052231,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5784 /prefetch:8
                                    2⤵
                                    • Modifies registry class
                                    • Suspicious behavior: EnumeratesProcesses
                                    PID:3084
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,9394161259415427038,3183633797654052231,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5020 /prefetch:1
                                    2⤵
                                      PID:1744
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,9394161259415427038,3183633797654052231,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1664 /prefetch:1
                                      2⤵
                                        PID:4812
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,9394161259415427038,3183633797654052231,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3868 /prefetch:1
                                        2⤵
                                          PID:1012
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,9394161259415427038,3183633797654052231,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6412 /prefetch:1
                                          2⤵
                                            PID:4104
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,9394161259415427038,3183633797654052231,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5744 /prefetch:1
                                            2⤵
                                              PID:2592
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,9394161259415427038,3183633797654052231,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5040 /prefetch:1
                                              2⤵
                                                PID:1544
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,9394161259415427038,3183633797654052231,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6552 /prefetch:1
                                                2⤵
                                                  PID:3280
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1892,9394161259415427038,3183633797654052231,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2936 /prefetch:8
                                                  2⤵
                                                  • NTFS ADS
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  PID:1496
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,9394161259415427038,3183633797654052231,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7100 /prefetch:1
                                                  2⤵
                                                    PID:2372
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1892,9394161259415427038,3183633797654052231,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5876 /prefetch:2
                                                    2⤵
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    PID:896
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,9394161259415427038,3183633797654052231,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5008 /prefetch:1
                                                    2⤵
                                                      PID:2696
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,9394161259415427038,3183633797654052231,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5388 /prefetch:1
                                                      2⤵
                                                        PID:4036
                                                    • C:\Windows\System32\CompPkgSrv.exe
                                                      C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                      1⤵
                                                        PID:4900
                                                      • C:\Windows\System32\CompPkgSrv.exe
                                                        C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                        1⤵
                                                          PID:4972
                                                        • C:\Windows\System32\rundll32.exe
                                                          C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                                          1⤵
                                                            PID:1376
                                                          • C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\rogues\AdwereCleaner.exe
                                                            "C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\rogues\AdwereCleaner.exe"
                                                            1⤵
                                                              PID:2712
                                                              • C:\Users\Admin\AppData\Local\6AdwCleaner.exe
                                                                "C:\Users\Admin\AppData\Local\6AdwCleaner.exe"
                                                                2⤵
                                                                • Executes dropped EXE
                                                                • Adds Run key to start application
                                                                • Modifies system certificate store
                                                                • Suspicious use of AdjustPrivilegeToken
                                                                • Suspicious use of SetWindowsHookEx
                                                                PID:2288
                                                            • C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\rogues\SpySheriff.exe
                                                              "C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\rogues\SpySheriff.exe"
                                                              1⤵
                                                                PID:5060
                                                              • C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\Birele.exe
                                                                "C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\Birele.exe"
                                                                1⤵
                                                                  PID:2636
                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 2636 -s 280
                                                                    2⤵
                                                                    • Program crash
                                                                    PID:1848
                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2636 -ip 2636
                                                                  1⤵
                                                                    PID:1784
                                                                  • C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\BadRabbit.exe
                                                                    "C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\BadRabbit.exe"
                                                                    1⤵
                                                                    • Drops file in Windows directory
                                                                    PID:2268
                                                                    • C:\Windows\SysWOW64\rundll32.exe
                                                                      C:\Windows\system32\rundll32.exe C:\Windows\infpub.dat,#1 15
                                                                      2⤵
                                                                      • Loads dropped DLL
                                                                      • Drops file in Windows directory
                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                      PID:200
                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                        /c schtasks /Delete /F /TN rhaegal
                                                                        3⤵
                                                                          PID:4708
                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                            schtasks /Delete /F /TN rhaegal
                                                                            4⤵
                                                                              PID:4640
                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                            /c schtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR "C:\Windows\system32\cmd.exe /C Start \"\" \"C:\Windows\dispci.exe\" -id 1550950631 && exit"
                                                                            3⤵
                                                                              PID:3132
                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                schtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR "C:\Windows\system32\cmd.exe /C Start \"\" \"C:\Windows\dispci.exe\" -id 1550950631 && exit"
                                                                                4⤵
                                                                                • Creates scheduled task(s)
                                                                                PID:5036
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              /c schtasks /Create /SC once /TN drogon /RU SYSTEM /TR "C:\Windows\system32\shutdown.exe /r /t 0 /f" /ST 19:20:00
                                                                              3⤵
                                                                                PID:2112
                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                  schtasks /Create /SC once /TN drogon /RU SYSTEM /TR "C:\Windows\system32\shutdown.exe /r /t 0 /f" /ST 19:20:00
                                                                                  4⤵
                                                                                  • Creates scheduled task(s)
                                                                                  PID:2900
                                                                              • C:\Windows\7FB7.tmp
                                                                                "C:\Windows\7FB7.tmp" \\.\pipe\{C57B3006-3F8A-4CDB-9A78-3B4E384832C3}
                                                                                3⤵
                                                                                • Executes dropped EXE
                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                PID:2704
                                                                          • C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\Annabelle.exe
                                                                            "C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\Annabelle.exe"
                                                                            1⤵
                                                                            • Modifies WinLogon for persistence
                                                                            • Modifies Windows Defender Real-time Protection settings
                                                                            • UAC bypass
                                                                            • Disables RegEdit via registry modification
                                                                            • Sets file execution options in registry
                                                                            • Adds Run key to start application
                                                                            PID:1348
                                                                            • C:\Windows\SYSTEM32\vssadmin.exe
                                                                              vssadmin delete shadows /all /quiet
                                                                              2⤵
                                                                              • Interacts with shadow copies
                                                                              PID:988
                                                                            • C:\Windows\SYSTEM32\vssadmin.exe
                                                                              vssadmin delete shadows /all /quiet
                                                                              2⤵
                                                                              • Interacts with shadow copies
                                                                              PID:1200
                                                                            • C:\Windows\SYSTEM32\vssadmin.exe
                                                                              vssadmin delete shadows /all /quiet
                                                                              2⤵
                                                                              • Interacts with shadow copies
                                                                              PID:3048
                                                                            • C:\Windows\SYSTEM32\NetSh.exe
                                                                              NetSh Advfirewall set allprofiles state off
                                                                              2⤵
                                                                              • Modifies Windows Firewall
                                                                              PID:2084
                                                                            • C:\Windows\System32\shutdown.exe
                                                                              "C:\Windows\System32\shutdown.exe" -r -t 00 -f
                                                                              2⤵
                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                              PID:2092
                                                                          • C:\Windows\system32\vssvc.exe
                                                                            C:\Windows\system32\vssvc.exe
                                                                            1⤵
                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                            PID:4612
                                                                          • C:\Windows\system32\werfault.exe
                                                                            werfault.exe /h /shared Global\2fadb80a171040909fd7132e3ea682bf /t 3380 /p 2288
                                                                            1⤵
                                                                              PID:1860
                                                                            • C:\Windows\system32\LogonUI.exe
                                                                              "LogonUI.exe" /flags:0x4 /state0:0xa39c9855 /state1:0x41c64e6d
                                                                              1⤵
                                                                              • Modifies data under HKEY_USERS
                                                                              • Suspicious use of SetWindowsHookEx
                                                                              PID:1504

                                                                            Network

                                                                            MITRE ATT&CK Enterprise v15

                                                                            Replay Monitor

                                                                            Loading Replay Monitor...

                                                                            Downloads

                                                                            • C:\Users\Admin\AppData\Local\6AdwCleaner.exe

                                                                              Filesize

                                                                              168KB

                                                                              MD5

                                                                              87e4959fefec297ebbf42de79b5c88f6

                                                                              SHA1

                                                                              eba50d6b266b527025cd624003799bdda9a6bc86

                                                                              SHA256

                                                                              4f0033e811fe2497b38f0d45df958829d01933ebe7d331079eefc8e38fbeaa61

                                                                              SHA512

                                                                              232fedec0180e85560a226870a244a22f54ca130ed6d6dc95dc02a1ff85f17da396925c9ff27d522067a30ee3e74a38adff375d8752161ee629df14f39cf6ba9

                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                              Filesize

                                                                              152B

                                                                              MD5

                                                                              d4604cbec2768d84c36d8ab35dfed413

                                                                              SHA1

                                                                              a5b3db6d2a1fa5a8de9999966172239a9b1340c2

                                                                              SHA256

                                                                              4ea5e5f1ba02111bc2bc9320ae9a1ca7294d6b3afedc128717b4c6c9df70bde2

                                                                              SHA512

                                                                              c8004e23dc8a51948a2a582a8ce6ebe1d2546e4c1c60e40c6583f5de1e29c0df20650d5cb36e5d2db3fa6b29b958acc3afd307c66f48c168e68cbb6bcfc52855

                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                              Filesize

                                                                              152B

                                                                              MD5

                                                                              577e1c0c1d7ab0053d280fcc67377478

                                                                              SHA1

                                                                              60032085bb950466bba9185ba965e228ec8915e5

                                                                              SHA256

                                                                              1d2022a0870c1a97ae10e8df444b8ba182536ed838a749ad1e972c0ded85e158

                                                                              SHA512

                                                                              39d3fd2d96aee014068f3fda389a40e3173c6ce5b200724c433c48ddffe864edfc6207bb0612b8a811ce41746b7771b81bce1b9cb71a28f07a251a607ce51ef5

                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

                                                                              Filesize

                                                                              64KB

                                                                              MD5

                                                                              d6b36c7d4b06f140f860ddc91a4c659c

                                                                              SHA1

                                                                              ccf16571637b8d3e4c9423688c5bd06167bfb9e9

                                                                              SHA256

                                                                              34013d7f3f0186a612bef84f2984e2767b32c9e1940df54b01d5bd6789f59e92

                                                                              SHA512

                                                                              2a9dd9352298ec7d1b439033b57ee9a390c373eeb8502f7f36d6826e6dd3e447b8ffd4be4f275d51481ef9a6ac2c2d97ef98f3f9d36a5a971275bf6cee48e487

                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

                                                                              Filesize

                                                                              19KB

                                                                              MD5

                                                                              2e86a72f4e82614cd4842950d2e0a716

                                                                              SHA1

                                                                              d7b4ee0c9af735d098bff474632fc2c0113e0b9c

                                                                              SHA256

                                                                              c1334e604dbbffdf38e9e2f359938569afe25f7150d1c39c293469c1ee4f7b6f

                                                                              SHA512

                                                                              7a5fd3e3e89c5f8afca33b2d02e5440934e5186b9fa6367436e8d20ad42b211579225e73e3a685e5e763fa3f907fc4632b9425e8bd6d6f07c5c986b6556d47b1

                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

                                                                              Filesize

                                                                              35KB

                                                                              MD5

                                                                              a053b626552864ee4e93f684617be84c

                                                                              SHA1

                                                                              977f090d070e793072bfb7dce69812dc41883d4e

                                                                              SHA256

                                                                              25b3ad881a0a88c6228e12688078638fe0b96210d0f0e20721e3c911a5b37dd4

                                                                              SHA512

                                                                              f7b444b1a1c465a4614cd1b9bd678875251f44e227abaaaf1fa6b35bb67bb25932b9b11cc8fabd19d2d5d6e80c6ad0b15149869e6e41f6345db3d49f08683e36

                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009

                                                                              Filesize

                                                                              67KB

                                                                              MD5

                                                                              d2d55f8057f8b03c94a81f3839b348b9

                                                                              SHA1

                                                                              37c399584539734ff679e3c66309498c8b2dd4d9

                                                                              SHA256

                                                                              6e273f3491917d37f4dbb6c3f4d3f862cada25c20a36b245ea7c6bd860fb400c

                                                                              SHA512

                                                                              7bcdbb9e8d005a532ec12485a9c4b777ddec4aee66333757cdae3f84811099a574e719d45eb4487072d0162fa4654349dd73705a8d1913834535b1a3e2247dc6

                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000a

                                                                              Filesize

                                                                              65KB

                                                                              MD5

                                                                              56d57bc655526551f217536f19195495

                                                                              SHA1

                                                                              28b430886d1220855a805d78dc5d6414aeee6995

                                                                              SHA256

                                                                              f12de7e272171cda36389813df4ba68eb2b8b23c58e515391614284e7b03c4d4

                                                                              SHA512

                                                                              7814c60dc377e400bbbcc2000e48b617e577a21045a0f5c79af163faa0087c6203d9f667e531bbb049c9bd8fb296678e6a5cdcad149498d7f22ffa11236b51cb

                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b

                                                                              Filesize

                                                                              88KB

                                                                              MD5

                                                                              b38fbbd0b5c8e8b4452b33d6f85df7dc

                                                                              SHA1

                                                                              386ba241790252df01a6a028b3238de2f995a559

                                                                              SHA256

                                                                              b18b9eb934a5b3b81b16c66ec3ec8e8fecdb3d43550ce050eb2523aabc08b9cd

                                                                              SHA512

                                                                              546ca9fb302bf28e3a178e798dd6b80c91cba71d0467257b8ed42e4f845aa6ecb858f718aac1e0865b791d4ecf41f1239081847c75c6fb3e9afd242d3704ad16

                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000c

                                                                              Filesize

                                                                              1.1MB

                                                                              MD5

                                                                              72fc993cb89d53f0773201a09506fb96

                                                                              SHA1

                                                                              293998db5b96adcb4dd9a53e178e54d4a3ec3c6a

                                                                              SHA256

                                                                              bfb58245c620ccd9842cb6cbac334244f26281a902bcd1373b738fe7ab6cb677

                                                                              SHA512

                                                                              4112ad705ce0000662309b6a3d88fbf0c8779adb88e1bc30e8f56ff892fb3a25e9e225eeaa963dc16299b414c64ef2a8b67ef250f82bdd5e458bd893ad8d69ac

                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                                              Filesize

                                                                              3KB

                                                                              MD5

                                                                              ded721263802494de399d962e155103d

                                                                              SHA1

                                                                              19e65c7ac9516e45699d418afbbd3928290450ed

                                                                              SHA256

                                                                              a10a0fc9ba1d67dd0a7d7df85270f872f7700ce6034d163db588383a717df28f

                                                                              SHA512

                                                                              32f9a6b8e0b1abc2993a2b91a3efd14baadfc88a308112e343ecdddf2a041e6854fcea6495bc0e5804fd9ca6bb338ed27857067202a4a308e6c07a1ce3440d80

                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                                              Filesize

                                                                              111B

                                                                              MD5

                                                                              285252a2f6327d41eab203dc2f402c67

                                                                              SHA1

                                                                              acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

                                                                              SHA256

                                                                              5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

                                                                              SHA512

                                                                              11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                                              Filesize

                                                                              1KB

                                                                              MD5

                                                                              50115577797facb3e7b1351e5abe2c9f

                                                                              SHA1

                                                                              b112f00da0cdbf06ee287fd1085bd4f36955f55b

                                                                              SHA256

                                                                              0395ef2a50242e65320f7d867ba902decd5c866b40c5002fde59f0f796bbf629

                                                                              SHA512

                                                                              15d53017a763508a806fb2e1d6f80a9c7b54f35c47b64dcad842e61b327b5dd3cb274ab9fa05d053e3a5375517b877ddfc1480d7dcb9797c75e441844afcad52

                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                                              Filesize

                                                                              1KB

                                                                              MD5

                                                                              e386925af5e5c58363c35775d08702a7

                                                                              SHA1

                                                                              3767d860cc19e32f1123e4e22dcbff5e1a4caa76

                                                                              SHA256

                                                                              7fd63cc00c57d535fc9603b1f36f325e8d421c1807106419e9e906fd69a1b92f

                                                                              SHA512

                                                                              2477af813a45e2d7d13e58102d36a5b3e4e23cc41597a9de394b9a1519f616e2dabb215ed7bc0a07d1b40d66980efc0464d075a98212d9e8283fe1063ed5685e

                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                              Filesize

                                                                              6KB

                                                                              MD5

                                                                              20c000fd17a453b080aa8bf3d151b5f2

                                                                              SHA1

                                                                              d924eb5519149cb24f895474ea4bc8417351b2ba

                                                                              SHA256

                                                                              1d729b0011943dd339fa9816fc4f8febb323149335e292d9034824f369068eb0

                                                                              SHA512

                                                                              8389612249ed34548f6c3c9189da49f55f473887192b212ba5cfbd1cd0af271c945887aac297b84ff09cf5cdc8a997027a12616b4c675b7bb1091424514e2c3d

                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                              Filesize

                                                                              6KB

                                                                              MD5

                                                                              9cffb5ae725cf719ec0e9fc8cc195a55

                                                                              SHA1

                                                                              054cb6227de7f1ce11adc4376c044320351de340

                                                                              SHA256

                                                                              a10735e4c3cd5a0f8eb934c2ace1be0390d398d79300903d230d6537de2ca1eb

                                                                              SHA512

                                                                              e21ae5416734e35bebf81d7b72762d8f8dbf18c87af2565b2be2d9a7d2b4a4fcefff9ce04af4c331d428a2d06f38650b1b59d8ba56f29bbdc56d84b03ba21838

                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                              Filesize

                                                                              6KB

                                                                              MD5

                                                                              9827a367db8927584e1ed41c3147aaaf

                                                                              SHA1

                                                                              ed08bbcb06a8e868974ed1612530911b8713073a

                                                                              SHA256

                                                                              c212fa41af4b3bffd9d26f82ed72480e6ba9e4146c107ca45be7f4f67ecec407

                                                                              SHA512

                                                                              1f870e1a6a774004c1f7152c4990f4462af4a25652e5164bccaea59bcc26c2456e7251dace4afa6e0d7322aaced8dcfbd6a114a6aad22f83d4cd76b214ec1194

                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                              Filesize

                                                                              6KB

                                                                              MD5

                                                                              d7eefb0c7a24454856c74812dcde9e8d

                                                                              SHA1

                                                                              3495b0858f554556de2278eb98d129ed3d23ca1d

                                                                              SHA256

                                                                              7140739a0ea44f085e4dcbd7346001a15c1543c3fc2006f40b64a4ba72e347dd

                                                                              SHA512

                                                                              a6207731f218a18f077a4c8fa96df590222819eb5b217ca14a0ec88c142ab127c76244797ac21849338aa7c7cead931e1eca228b6fc24cb5add089139e538969

                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                              Filesize

                                                                              5KB

                                                                              MD5

                                                                              2bf9fcd8a27dbe4c3fd77527a2ca0862

                                                                              SHA1

                                                                              5889925c0ad57ba246ac8575bd9c572766c6a5b1

                                                                              SHA256

                                                                              a4639f0366fbf8e8a2386c66b33b0c70a865b288537203af2302cb6978e4f99d

                                                                              SHA512

                                                                              783c0cbb74bd68cd3269ad32ebae59bb6ea8865012c0862252e955d4a24ed77df5aabae72339e6d7b41984051c26adbc923d0ac69d47aaa2c2213bbaa4e41425

                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                              Filesize

                                                                              1KB

                                                                              MD5

                                                                              fc22878777fef5c0757ec5dd7196a4d5

                                                                              SHA1

                                                                              62c8070dbab451bb0068560128973765a341b586

                                                                              SHA256

                                                                              e4c17c8aa33ccb74b666b33044e4ba6f1d37d5f12848ca41d724b475067c9210

                                                                              SHA512

                                                                              3c53c2fcb47c433e1312cb4b97ba52e44fd59988953a35fefcef8b9dc7fbd8837ad3b92b041fc9de1d3d7395077df12346e6c203a11744bbc01720162f060599

                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                              Filesize

                                                                              1KB

                                                                              MD5

                                                                              a13eedd73fd03debb84bf5af72123399

                                                                              SHA1

                                                                              99e9275c1296b2c09b513fb841d9b720995df6f6

                                                                              SHA256

                                                                              bc344dc868ec40ee9eda042b881c4184f90bfc579a040947699cf83aedd8e194

                                                                              SHA512

                                                                              a3076889f08e14271d371acd6afb68837a49169f3152b0712d392a60287418b0bcdcccb8fdd46ef6ba73ab71ee199088eb2d6e204932b23d9db51a116389e637

                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                              Filesize

                                                                              1KB

                                                                              MD5

                                                                              adc1617eb68a319db719a1e5fc803373

                                                                              SHA1

                                                                              1a4c8426d0401e0772af0fd0f3cbd5d598777f72

                                                                              SHA256

                                                                              664c5f44ae254bc60ade73bc80dfef8d689fabe9067098360496150aae8a4260

                                                                              SHA512

                                                                              d40a3ee038d7a9a2d49c9b202dcd2db1db28f67f8de536fbdf4e7e222e0534d9aa64fac542694724f7165b2320825ddf3b948f5c6dad879edb8d8f24f7494751

                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe584699.TMP

                                                                              Filesize

                                                                              536B

                                                                              MD5

                                                                              8047204451a167feccda5321dfa0424f

                                                                              SHA1

                                                                              18e1d83ddaafb0c59f89011e7ccd5067998a27cb

                                                                              SHA256

                                                                              0da506b0e5cc2084bc632912eb78ea999af662a7fc1aa108aa2f477e66c044ae

                                                                              SHA512

                                                                              525d42a88996c99c54f8df4f00825b42f6dcc1f319fa321e43046e0f89707a8e8898c07e523c22c45339001313f15f938725ad4cef28a9add2929a25b584f28d

                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                                                              Filesize

                                                                              16B

                                                                              MD5

                                                                              206702161f94c5cd39fadd03f4014d98

                                                                              SHA1

                                                                              bd8bfc144fb5326d21bd1531523d9fb50e1b600a

                                                                              SHA256

                                                                              1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

                                                                              SHA512

                                                                              0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                                                              Filesize

                                                                              16B

                                                                              MD5

                                                                              46295cac801e5d4857d09837238a6394

                                                                              SHA1

                                                                              44e0fa1b517dbf802b18faf0785eeea6ac51594b

                                                                              SHA256

                                                                              0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                                                                              SHA512

                                                                              8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\eff94763-f232-4bb7-b54d-470633ca30ee.tmp

                                                                              Filesize

                                                                              5KB

                                                                              MD5

                                                                              2f238d1c8c30bdaffd76e5f6ff406aed

                                                                              SHA1

                                                                              7a2091b2e406f87e8bd72d845d184ba63cefbc38

                                                                              SHA256

                                                                              eb4351119aa8b37c9a44e2926e29df6a1eba912aebdab0fd9830de14b91f3c97

                                                                              SHA512

                                                                              940767c406acba1a68c9c47676138aa1402df40d151a9d69f635d7f9025e388d331c80f256b0ae81e996bbe02f1764c1a6059c10674c2b87d6109f712ebc7587

                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                              Filesize

                                                                              11KB

                                                                              MD5

                                                                              594d3b4032635157b65c58b207ba7e99

                                                                              SHA1

                                                                              68909851a9f4baaa0436a9a48a0064d9c36f1aee

                                                                              SHA256

                                                                              98991f8fbe4bd043cc2a40ab33b0ef230cbb6ee8ac89eebc6b0616d259796cac

                                                                              SHA512

                                                                              dd0ce3dc527b70ffdc782fe4c8f06f6e76890ff66a9e1cf3b528e9a8f5cc411960c46a77f2d76948a6587d5b6196c36921dba5fb050e774dc36d154dc7592c00

                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                              Filesize

                                                                              11KB

                                                                              MD5

                                                                              b6b4b5206daf882392a4116f04d68b4c

                                                                              SHA1

                                                                              2487b73fb998d2b63c697b29890af118fa4fb810

                                                                              SHA256

                                                                              72f8794ffde6b943ab5d6b684f348f185d452a9c714bb13056e84635a945caff

                                                                              SHA512

                                                                              72260cf65f58b4ef653feb7d37b1024a45097ebfe95bb33ca03b0fbc9c7182d6ec5f43287dda902766d600c7918babdbdfea1481ea38c3ebf4fc85e44ef6dfa1

                                                                            • C:\Users\Admin\Downloads\The-MALWARE-Repo-master.zip

                                                                              Filesize

                                                                              198.8MB

                                                                              MD5

                                                                              af60ad5b6cafd14d7ebce530813e68a0

                                                                              SHA1

                                                                              ad81b87e7e9bbc21eb93aca7638d827498e78076

                                                                              SHA256

                                                                              b7dd3bce3ebfbc2d5e3a9f00d47f27cb6a5895c4618c878e314e573a7c216df1

                                                                              SHA512

                                                                              81314363d5d461264ed5fdf8a7976f97bceb5081c374b4ee6bbea5d8ce3386822d089d031234ddd67c5077a1cc1ed3f6b16139253fbb1b3d34d3985f9b97aba3

                                                                            • C:\Users\Admin\Downloads\The-MALWARE-Repo-master.zip:Zone.Identifier

                                                                              Filesize

                                                                              26B

                                                                              MD5

                                                                              fbccf14d504b7b2dbcb5a5bda75bd93b

                                                                              SHA1

                                                                              d59fc84cdd5217c6cf74785703655f78da6b582b

                                                                              SHA256

                                                                              eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

                                                                              SHA512

                                                                              aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

                                                                            • C:\Windows\7FB7.tmp

                                                                              Filesize

                                                                              60KB

                                                                              MD5

                                                                              347ac3b6b791054de3e5720a7144a977

                                                                              SHA1

                                                                              413eba3973a15c1a6429d9f170f3e8287f98c21c

                                                                              SHA256

                                                                              301b905eb98d8d6bb559c04bbda26628a942b2c4107c07a02e8f753bdcfe347c

                                                                              SHA512

                                                                              9a399916bc681964af1e1061bc0a8e2926307642557539ad587ce6f9b5ef93bdf1820fe5d7b5ffe5f0bb38e5b4dc6add213ba04048c0c7c264646375fcd01787

                                                                            • C:\Windows\infpub.dat

                                                                              Filesize

                                                                              401KB

                                                                              MD5

                                                                              1d724f95c61f1055f0d02c2154bbccd3

                                                                              SHA1

                                                                              79116fe99f2b421c52ef64097f0f39b815b20907

                                                                              SHA256

                                                                              579fd8a0385482fb4c789561a30b09f25671e86422f40ef5cca2036b28f99648

                                                                              SHA512

                                                                              f2d7b018d1516df1c97cfff5507957c75c6d9bf8e2ce52ae0052706f4ec62f13eba6d7be17e6ad2b693fdd58e1fd091c37f17bd2b948cdcd9b95b4ad428c0113

                                                                            • memory/200-739-0x0000000002E70000-0x0000000002ED8000-memory.dmp

                                                                              Filesize

                                                                              416KB

                                                                            • memory/200-747-0x0000000002E70000-0x0000000002ED8000-memory.dmp

                                                                              Filesize

                                                                              416KB

                                                                            • memory/200-750-0x0000000002E70000-0x0000000002ED8000-memory.dmp

                                                                              Filesize

                                                                              416KB

                                                                            • memory/1348-990-0x00007FF851DB0000-0x00007FF852872000-memory.dmp

                                                                              Filesize

                                                                              10.8MB

                                                                            • memory/1348-928-0x00007FF851DB0000-0x00007FF852872000-memory.dmp

                                                                              Filesize

                                                                              10.8MB

                                                                            • memory/1348-792-0x00000248A9A00000-0x00000248A9A10000-memory.dmp

                                                                              Filesize

                                                                              64KB

                                                                            • memory/1348-791-0x00000248A9A20000-0x00000248AAFAE000-memory.dmp

                                                                              Filesize

                                                                              21.6MB

                                                                            • memory/1348-756-0x000002488E3E0000-0x000002488F3D4000-memory.dmp

                                                                              Filesize

                                                                              16.0MB

                                                                            • memory/1348-752-0x00007FF851DB0000-0x00007FF852872000-memory.dmp

                                                                              Filesize

                                                                              10.8MB

                                                                            • memory/2288-726-0x000000001BB80000-0x000000001BB90000-memory.dmp

                                                                              Filesize

                                                                              64KB

                                                                            • memory/2288-697-0x0000000000CF0000-0x0000000000D1E000-memory.dmp

                                                                              Filesize

                                                                              184KB

                                                                            • memory/2288-701-0x000000001BB80000-0x000000001BB90000-memory.dmp

                                                                              Filesize

                                                                              64KB

                                                                            • memory/2288-714-0x00007FF851DB0000-0x00007FF852872000-memory.dmp

                                                                              Filesize

                                                                              10.8MB

                                                                            • memory/2288-921-0x00007FF851DB0000-0x00007FF852872000-memory.dmp

                                                                              Filesize

                                                                              10.8MB

                                                                            • memory/2288-723-0x000000001BB80000-0x000000001BB90000-memory.dmp

                                                                              Filesize

                                                                              64KB

                                                                            • memory/2288-699-0x000000001BB80000-0x000000001BB90000-memory.dmp

                                                                              Filesize

                                                                              64KB

                                                                            • memory/2288-698-0x00007FF851DB0000-0x00007FF852872000-memory.dmp

                                                                              Filesize

                                                                              10.8MB

                                                                            • memory/2288-724-0x000000001BB80000-0x000000001BB90000-memory.dmp

                                                                              Filesize

                                                                              64KB

                                                                            • memory/2288-782-0x0000000021B60000-0x0000000022306000-memory.dmp

                                                                              Filesize

                                                                              7.6MB

                                                                            • memory/2288-700-0x000000001BB80000-0x000000001BB90000-memory.dmp

                                                                              Filesize

                                                                              64KB

                                                                            • memory/2288-725-0x000000001BB80000-0x000000001BB90000-memory.dmp

                                                                              Filesize

                                                                              64KB

                                                                            • memory/2636-734-0x0000000000400000-0x0000000000438000-memory.dmp

                                                                              Filesize

                                                                              224KB

                                                                            • memory/2636-732-0x0000000000400000-0x0000000000438000-memory.dmp

                                                                              Filesize

                                                                              224KB

                                                                            • memory/2636-731-0x0000000000660000-0x0000000000666000-memory.dmp

                                                                              Filesize

                                                                              24KB

                                                                            • memory/2636-730-0x0000000000400000-0x0000000000438000-memory.dmp

                                                                              Filesize

                                                                              224KB

                                                                            • memory/5060-727-0x0000000000400000-0x000000000040E000-memory.dmp

                                                                              Filesize

                                                                              56KB

                                                                            • memory/5060-728-0x0000000000400000-0x000000000040E000-memory.dmp

                                                                              Filesize

                                                                              56KB

                                                                            • memory/5060-729-0x0000000000400000-0x000000000040E000-memory.dmp

                                                                              Filesize

                                                                              56KB