badrabbit | hxxps://github[.]com/Da2dalus/The-MALWARE-Repo/blob/master/Ransomware

Analysis

max time kernel
600s
max time network
604s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
27-04-2024 12:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Ransomware

Score

10^/10

badrabbit mimikatz aspackv2 evasion ransomware

Malware Config

Signatures

BadRabbit
Ransomware family discovered in late 2017, mainly targeting Russia and Ukraine.
ransomware badrabbit
Mimikatz
mimikatz is an open source tool to dump credentials on Windows.
mimikatz

mimikatz is an open source tool to dump credentials on Windows 1 IoCs

resource	yara_rule
behavioral1/files/0x00070000000232ee-242.dat	mimikatz

Blocklisted process makes network request 12 IoCs

flow	pid	Process
440	4316	rundll32.exe
473	4316	rundll32.exe
515	4316	rundll32.exe
557	4316	rundll32.exe
592	4316	rundll32.exe
612	4316	rundll32.exe
656	4316	rundll32.exe
698	4316	rundll32.exe
737	4316	rundll32.exe
760	4316	rundll32.exe
794	4316	rundll32.exe
836	4316	rundll32.exe

Disables Task Manager via registry modification
evasion
Downloads MZ/PE file

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral1/files/0x0004000000016849-488.dat	aspack_v212_v242

Executes dropped EXE 5 IoCs

pid	Process
5088	BadRabbit.exe
2300	8CDA.tmp
5492	DesktopBoom.exe
1456	Launcher.exe
1476	Trololo.exe

Loads dropped DLL 1 IoCs

pid	Process
4316	rundll32.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
48	raw.githubusercontent.com
50	raw.githubusercontent.com

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\8CDA.tmp	rundll32.exe
File created	C:\Windows\infpub.dat	BadRabbit.exe
File opened for modification	C:\Windows\infpub.dat	rundll32.exe
File created	C:\Windows\cscc.dat	rundll32.exe
File created	C:\Windows\dispci.exe	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
404	schtasks.exe
2612	schtasks.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Kills process with taskkill 2 IoCs

evasion

pid	Process
752	taskkill.exe
1600	taskkill.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133586962177194072"	chrome.exe

Modifies registry class 31 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	Launcher.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	Launcher.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings	taskmgr.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\MRUListEx = ffffffff	Launcher.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1"	Launcher.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\NodeSlot = "2"	Launcher.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1 = 14002e8005398e082303024b98265d99428e115f0000	Launcher.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0100000000000000ffffffff	Launcher.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	Launcher.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	Launcher.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	Launcher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Downloads"	Launcher.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{885A186E-A440-4ADA-812B-DB871B942259}	Launcher.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings	Launcher.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295"	Launcher.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy	Launcher.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1"	Launcher.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616257"	Launcher.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	Launcher.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	Launcher.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	Launcher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\KnownFolderDerivedFolderType = "{885A186E-A440-4ADA-812B-DB871B942259}"	Launcher.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1	Launcher.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14"	Launcher.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	Launcher.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4"	Launcher.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	Launcher.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16"	Launcher.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295"	Launcher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	Launcher.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	Launcher.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4764	chrome.exe
4764	chrome.exe
4316	rundll32.exe
4316	rundll32.exe
4316	rundll32.exe
4316	rundll32.exe
2300	8CDA.tmp
2300	8CDA.tmp
2300	8CDA.tmp
2300	8CDA.tmp
2300	8CDA.tmp
2300	8CDA.tmp
2300	8CDA.tmp
872	taskmgr.exe
872	taskmgr.exe
872	taskmgr.exe
872	taskmgr.exe
872	taskmgr.exe
872	taskmgr.exe
872	taskmgr.exe
872	taskmgr.exe
872	taskmgr.exe
872	taskmgr.exe
872	taskmgr.exe
872	taskmgr.exe
872	taskmgr.exe
872	taskmgr.exe
872	taskmgr.exe
872	taskmgr.exe
872	taskmgr.exe
872	taskmgr.exe
872	taskmgr.exe
872	taskmgr.exe
872	taskmgr.exe
872	taskmgr.exe
872	taskmgr.exe
872	taskmgr.exe
872	taskmgr.exe
872	taskmgr.exe
872	taskmgr.exe
872	taskmgr.exe
872	taskmgr.exe
872	taskmgr.exe
872	taskmgr.exe
872	taskmgr.exe
872	taskmgr.exe
872	taskmgr.exe
872	taskmgr.exe
872	taskmgr.exe
872	taskmgr.exe
872	taskmgr.exe
872	taskmgr.exe
872	taskmgr.exe
872	taskmgr.exe
872	taskmgr.exe
872	taskmgr.exe
872	taskmgr.exe
872	taskmgr.exe
872	taskmgr.exe
872	taskmgr.exe
872	taskmgr.exe
872	taskmgr.exe
872	taskmgr.exe
872	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 3 IoCs

pid	Process
5492	DesktopBoom.exe
872	taskmgr.exe
1456	Launcher.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
4764	chrome.exe
4764	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4764	chrome.exe
Token: SeCreatePagefilePrivilege	4764	chrome.exe
Token: SeShutdownPrivilege	4764	chrome.exe
Token: SeCreatePagefilePrivilege	4764	chrome.exe
Token: SeShutdownPrivilege	4764	chrome.exe
Token: SeCreatePagefilePrivilege	4764	chrome.exe
Token: SeShutdownPrivilege	4764	chrome.exe
Token: SeCreatePagefilePrivilege	4764	chrome.exe
Token: SeShutdownPrivilege	4764	chrome.exe
Token: SeCreatePagefilePrivilege	4764	chrome.exe
Token: SeShutdownPrivilege	4764	chrome.exe
Token: SeCreatePagefilePrivilege	4764	chrome.exe
Token: SeShutdownPrivilege	4764	chrome.exe
Token: SeCreatePagefilePrivilege	4764	chrome.exe
Token: SeShutdownPrivilege	4764	chrome.exe
Token: SeCreatePagefilePrivilege	4764	chrome.exe
Token: SeShutdownPrivilege	4764	chrome.exe
Token: SeCreatePagefilePrivilege	4764	chrome.exe
Token: SeShutdownPrivilege	4764	chrome.exe
Token: SeCreatePagefilePrivilege	4764	chrome.exe
Token: SeShutdownPrivilege	4764	chrome.exe
Token: SeCreatePagefilePrivilege	4764	chrome.exe
Token: SeShutdownPrivilege	4764	chrome.exe
Token: SeCreatePagefilePrivilege	4764	chrome.exe
Token: SeShutdownPrivilege	4764	chrome.exe
Token: SeCreatePagefilePrivilege	4764	chrome.exe
Token: SeShutdownPrivilege	4764	chrome.exe
Token: SeCreatePagefilePrivilege	4764	chrome.exe
Token: SeShutdownPrivilege	4764	chrome.exe
Token: SeCreatePagefilePrivilege	4764	chrome.exe
Token: SeShutdownPrivilege	4764	chrome.exe
Token: SeCreatePagefilePrivilege	4764	chrome.exe
Token: SeShutdownPrivilege	4764	chrome.exe
Token: SeCreatePagefilePrivilege	4764	chrome.exe
Token: SeShutdownPrivilege	4764	chrome.exe
Token: SeCreatePagefilePrivilege	4764	chrome.exe
Token: SeShutdownPrivilege	4764	chrome.exe
Token: SeCreatePagefilePrivilege	4764	chrome.exe
Token: SeShutdownPrivilege	4764	chrome.exe
Token: SeCreatePagefilePrivilege	4764	chrome.exe
Token: SeShutdownPrivilege	4764	chrome.exe
Token: SeCreatePagefilePrivilege	4764	chrome.exe
Token: SeShutdownPrivilege	4764	chrome.exe
Token: SeCreatePagefilePrivilege	4764	chrome.exe
Token: SeShutdownPrivilege	4764	chrome.exe
Token: SeCreatePagefilePrivilege	4764	chrome.exe
Token: SeShutdownPrivilege	4764	chrome.exe
Token: SeCreatePagefilePrivilege	4764	chrome.exe
Token: SeShutdownPrivilege	4764	chrome.exe
Token: SeCreatePagefilePrivilege	4764	chrome.exe
Token: SeShutdownPrivilege	4764	chrome.exe
Token: SeCreatePagefilePrivilege	4764	chrome.exe
Token: SeShutdownPrivilege	4764	chrome.exe
Token: SeCreatePagefilePrivilege	4764	chrome.exe
Token: SeShutdownPrivilege	4764	chrome.exe
Token: SeCreatePagefilePrivilege	4764	chrome.exe
Token: SeShutdownPrivilege	4764	chrome.exe
Token: SeCreatePagefilePrivilege	4764	chrome.exe
Token: SeShutdownPrivilege	4316	rundll32.exe
Token: SeDebugPrivilege	4316	rundll32.exe
Token: SeTcbPrivilege	4316	rundll32.exe
Token: SeShutdownPrivilege	4764	chrome.exe
Token: SeCreatePagefilePrivilege	4764	chrome.exe
Token: SeShutdownPrivilege	4764	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
872	taskmgr.exe
872	taskmgr.exe
872	taskmgr.exe
872	taskmgr.exe
872	taskmgr.exe
872	taskmgr.exe
872	taskmgr.exe
872	taskmgr.exe
872	taskmgr.exe
872	taskmgr.exe
872	taskmgr.exe
872	taskmgr.exe
872	taskmgr.exe
872	taskmgr.exe
872	taskmgr.exe
872	taskmgr.exe
872	taskmgr.exe
872	taskmgr.exe
872	taskmgr.exe
872	taskmgr.exe
872	taskmgr.exe
872	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
872	taskmgr.exe
872	taskmgr.exe
872	taskmgr.exe
872	taskmgr.exe
872	taskmgr.exe
872	taskmgr.exe
872	taskmgr.exe
872	taskmgr.exe
872	taskmgr.exe
872	taskmgr.exe
872	taskmgr.exe
872	taskmgr.exe
872	taskmgr.exe
872	taskmgr.exe
872	taskmgr.exe
872	taskmgr.exe
872	taskmgr.exe
872	taskmgr.exe
872	taskmgr.exe
872	taskmgr.exe
872	taskmgr.exe
872	taskmgr.exe
872	taskmgr.exe
872	taskmgr.exe
872	taskmgr.exe
872	taskmgr.exe
872	taskmgr.exe
872	taskmgr.exe
872	taskmgr.exe
872	taskmgr.exe
872	taskmgr.exe
872	taskmgr.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1456	Launcher.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4764 wrote to memory of 4884	4764	chrome.exe	91
PID 4764 wrote to memory of 4884	4764	chrome.exe	91
PID 4764 wrote to memory of 4580	4764	chrome.exe	93
PID 4764 wrote to memory of 4580	4764	chrome.exe	93
PID 4764 wrote to memory of 4580	4764	chrome.exe	93
PID 4764 wrote to memory of 4580	4764	chrome.exe	93
PID 4764 wrote to memory of 4580	4764	chrome.exe	93
PID 4764 wrote to memory of 4580	4764	chrome.exe	93
PID 4764 wrote to memory of 4580	4764	chrome.exe	93
PID 4764 wrote to memory of 4580	4764	chrome.exe	93
PID 4764 wrote to memory of 4580	4764	chrome.exe	93
PID 4764 wrote to memory of 4580	4764	chrome.exe	93
PID 4764 wrote to memory of 4580	4764	chrome.exe	93
PID 4764 wrote to memory of 4580	4764	chrome.exe	93
PID 4764 wrote to memory of 4580	4764	chrome.exe	93
PID 4764 wrote to memory of 4580	4764	chrome.exe	93
PID 4764 wrote to memory of 4580	4764	chrome.exe	93
PID 4764 wrote to memory of 4580	4764	chrome.exe	93
PID 4764 wrote to memory of 4580	4764	chrome.exe	93
PID 4764 wrote to memory of 4580	4764	chrome.exe	93
PID 4764 wrote to memory of 4580	4764	chrome.exe	93
PID 4764 wrote to memory of 4580	4764	chrome.exe	93
PID 4764 wrote to memory of 4580	4764	chrome.exe	93
PID 4764 wrote to memory of 4580	4764	chrome.exe	93
PID 4764 wrote to memory of 4580	4764	chrome.exe	93
PID 4764 wrote to memory of 4580	4764	chrome.exe	93
PID 4764 wrote to memory of 4580	4764	chrome.exe	93
PID 4764 wrote to memory of 4580	4764	chrome.exe	93
PID 4764 wrote to memory of 4580	4764	chrome.exe	93
PID 4764 wrote to memory of 4580	4764	chrome.exe	93
PID 4764 wrote to memory of 4580	4764	chrome.exe	93
PID 4764 wrote to memory of 4580	4764	chrome.exe	93
PID 4764 wrote to memory of 4580	4764	chrome.exe	93
PID 4764 wrote to memory of 4580	4764	chrome.exe	93
PID 4764 wrote to memory of 4580	4764	chrome.exe	93
PID 4764 wrote to memory of 4580	4764	chrome.exe	93
PID 4764 wrote to memory of 4580	4764	chrome.exe	93
PID 4764 wrote to memory of 4580	4764	chrome.exe	93
PID 4764 wrote to memory of 4580	4764	chrome.exe	93
PID 4764 wrote to memory of 4580	4764	chrome.exe	93
PID 4764 wrote to memory of 5096	4764	chrome.exe	94
PID 4764 wrote to memory of 5096	4764	chrome.exe	94
PID 4764 wrote to memory of 3420	4764	chrome.exe	95
PID 4764 wrote to memory of 3420	4764	chrome.exe	95
PID 4764 wrote to memory of 3420	4764	chrome.exe	95
PID 4764 wrote to memory of 3420	4764	chrome.exe	95
PID 4764 wrote to memory of 3420	4764	chrome.exe	95
PID 4764 wrote to memory of 3420	4764	chrome.exe	95
PID 4764 wrote to memory of 3420	4764	chrome.exe	95
PID 4764 wrote to memory of 3420	4764	chrome.exe	95
PID 4764 wrote to memory of 3420	4764	chrome.exe	95
PID 4764 wrote to memory of 3420	4764	chrome.exe	95
PID 4764 wrote to memory of 3420	4764	chrome.exe	95
PID 4764 wrote to memory of 3420	4764	chrome.exe	95
PID 4764 wrote to memory of 3420	4764	chrome.exe	95
PID 4764 wrote to memory of 3420	4764	chrome.exe	95
PID 4764 wrote to memory of 3420	4764	chrome.exe	95
PID 4764 wrote to memory of 3420	4764	chrome.exe	95
PID 4764 wrote to memory of 3420	4764	chrome.exe	95
PID 4764 wrote to memory of 3420	4764	chrome.exe	95
PID 4764 wrote to memory of 3420	4764	chrome.exe	95
PID 4764 wrote to memory of 3420	4764	chrome.exe	95
PID 4764 wrote to memory of 3420	4764	chrome.exe	95
PID 4764 wrote to memory of 3420	4764	chrome.exe	95

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Ransomware
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4764
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff894c99758,0x7ff894c99768,0x7ff894c99778
  2⤵
  PID:4884
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1672 --field-trial-handle=1896,i,4227056829416079124,3173062498484995036,131072 /prefetch:2
  2⤵
  PID:4580
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 --field-trial-handle=1896,i,4227056829416079124,3173062498484995036,131072 /prefetch:8
  2⤵
  PID:5096
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2236 --field-trial-handle=1896,i,4227056829416079124,3173062498484995036,131072 /prefetch:8
  2⤵
  PID:3420
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3204 --field-trial-handle=1896,i,4227056829416079124,3173062498484995036,131072 /prefetch:1
  2⤵
  PID:3276
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3116 --field-trial-handle=1896,i,4227056829416079124,3173062498484995036,131072 /prefetch:1
  2⤵
  PID:840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5148 --field-trial-handle=1896,i,4227056829416079124,3173062498484995036,131072 /prefetch:8
  2⤵
  PID:884
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5048 --field-trial-handle=1896,i,4227056829416079124,3173062498484995036,131072 /prefetch:8
  2⤵
  PID:936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4932 --field-trial-handle=1896,i,4227056829416079124,3173062498484995036,131072 /prefetch:8
  2⤵
  PID:4292
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5468 --field-trial-handle=1896,i,4227056829416079124,3173062498484995036,131072 /prefetch:8
  2⤵
  PID:4432
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5032 --field-trial-handle=1896,i,4227056829416079124,3173062498484995036,131072 /prefetch:8
  2⤵
  PID:4344
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5836 --field-trial-handle=1896,i,4227056829416079124,3173062498484995036,131072 /prefetch:8
  2⤵
  PID:2908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5660 --field-trial-handle=1896,i,4227056829416079124,3173062498484995036,131072 /prefetch:8
  2⤵
  PID:896
- C:\Users\Admin\Downloads\BadRabbit.exe
  "C:\Users\Admin\Downloads\BadRabbit.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  PID:5088
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\system32\rundll32.exe C:\Windows\infpub.dat,#1 15
    3⤵
    - Blocklisted process makes network request
    - Loads dropped DLL
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4316
  - - C:\Windows\SysWOW64\cmd.exe
      /c schtasks /Delete /F /TN rhaegal
      4⤵
      PID:5008
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Delete /F /TN rhaegal
        5⤵
        
        PID:2348
  - - C:\Windows\SysWOW64\cmd.exe
      /c schtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR "C:\Windows\system32\cmd.exe /C Start \"\" \"C:\Windows\dispci.exe\" -id 3316171602 && exit"
      4⤵
      PID:4136
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR "C:\Windows\system32\cmd.exe /C Start \"\" \"C:\Windows\dispci.exe\" -id 3316171602 && exit"
        5⤵
        Creates scheduled task(s)
        
        PID:404
  - - C:\Windows\SysWOW64\cmd.exe
      /c schtasks /Create /SC once /TN drogon /RU SYSTEM /TR "C:\Windows\system32\shutdown.exe /r /t 0 /f" /ST 13:15:00
      4⤵
      PID:1668
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Create /SC once /TN drogon /RU SYSTEM /TR "C:\Windows\system32\shutdown.exe /r /t 0 /f" /ST 13:15:00
        5⤵
        Creates scheduled task(s)
        
        PID:2612
  - - C:\Windows\8CDA.tmp
      "C:\Windows\8CDA.tmp" \\.\pipe\{9D0FEF91-FB38-4379-A5E0-E44C2097DE4F}
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:2300
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2312 --field-trial-handle=1896,i,4227056829416079124,3173062498484995036,131072 /prefetch:2
  2⤵
  PID:6132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5056 --field-trial-handle=1896,i,4227056829416079124,3173062498484995036,131072 /prefetch:8
  2⤵
  PID:5176
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5028 --field-trial-handle=1896,i,4227056829416079124,3173062498484995036,131072 /prefetch:8
  2⤵
  PID:936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1644 --field-trial-handle=1896,i,4227056829416079124,3173062498484995036,131072 /prefetch:8
  2⤵
  PID:4024
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=2360 --field-trial-handle=1896,i,4227056829416079124,3173062498484995036,131072 /prefetch:8
  2⤵
  PID:3968
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5012 --field-trial-handle=1896,i,4227056829416079124,3173062498484995036,131072 /prefetch:8
  2⤵
  PID:5500
- C:\Users\Admin\Downloads\DesktopBoom.exe
  "C:\Users\Admin\Downloads\DesktopBoom.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: GetForegroundWindowSpam
  PID:5492
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=2300 --field-trial-handle=1896,i,4227056829416079124,3173062498484995036,131072 /prefetch:8
  2⤵
  PID:5696
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4688 --field-trial-handle=1896,i,4227056829416079124,3173062498484995036,131072 /prefetch:8
  2⤵
  PID:5712
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2648 --field-trial-handle=1896,i,4227056829416079124,3173062498484995036,131072 /prefetch:8
  2⤵
  PID:3104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4664 --field-trial-handle=1896,i,4227056829416079124,3173062498484995036,131072 /prefetch:8
  2⤵
  PID:5852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=1888 --field-trial-handle=1896,i,4227056829416079124,3173062498484995036,131072 /prefetch:8
  2⤵
  PID:5864
- C:\Users\Admin\Downloads\Launcher.exe
  "C:\Users\Admin\Downloads\Launcher.exe"
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:1456
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4884 --field-trial-handle=1896,i,4227056829416079124,3173062498484995036,131072 /prefetch:8
  2⤵
  PID:5224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=1604 --field-trial-handle=1896,i,4227056829416079124,3173062498484995036,131072 /prefetch:8
  2⤵
  PID:2060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5752 --field-trial-handle=1896,i,4227056829416079124,3173062498484995036,131072 /prefetch:8
  2⤵
  PID:6068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6104 --field-trial-handle=1896,i,4227056829416079124,3173062498484995036,131072 /prefetch:8
  2⤵
  PID:6112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5556 --field-trial-handle=1896,i,4227056829416079124,3173062498484995036,131072 /prefetch:8
  2⤵
  PID:6120
- C:\Users\Admin\Downloads\Trololo.exe
  "C:\Users\Admin\Downloads\Trololo.exe"
  2⤵
  - Executes dropped EXE
  PID:1476
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill.exe /f /im explorer.exe
    3⤵
    - Kills process with taskkill
    PID:752
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill.exe /f /im taskmgr.exe
    3⤵
    - Kills process with taskkill
    PID:1600

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:876

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:872

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4136 --field-trial-handle=3084,i,4016110471176367543,14287608422419064331,262144 --variations-seed-version /prefetch:8
1⤵
PID:4596

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5492

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x504 0x4e8
1⤵
PID:3772

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3628 --field-trial-handle=3084,i,4016110471176367543,14287608422419064331,262144 --variations-seed-version /prefetch:8
1⤵
PID:4904

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
4fb2bf9f5be17453383ad3845a7ebe1f

SHA1
1f74c3efcb6fb344fe208a15f28f40fd01155e82

SHA256
92debebdac206d6264b2e490021f3ca45462134d2d39034b4b15bbaa66157dd5

SHA512
b091d87f6061a09333294cf0248c82bcdd1d49a90b5b17077d1f2ddb097e29663ffb4752ed82fb1446f591642e0dfb2b9e7c9ae3758bf92845082c39d859f24c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
b70e76ab56774e08db5f55d34ece6424

SHA1
a2808804f85abf901f431233d16352108cd255a1

SHA256
8b0c591f5779413bcd1c6101d6b8fb8fbd8e8ee12b4e783c8139c9649dbc5b0a

SHA512
28f3363c1e0c0bf65773554c184aa3fd9440425efe58299166362bbe070ca86cafef2cda0bccdc7527f20cf90838f9a205c806ee0c75440cc274ae6deabbd0d1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
1f8366cf8c62c0b6581396a5eb614bb7

SHA1
2ae082a5fadb4a97aad1a24f452bd242d32cc43e

SHA256
01530901b101c7be73b2dcc668299a3446282fb9a2ce19aaca705a40f5e391ec

SHA512
8aeedba75409666c220c14931d66af45b8b43f908e79ca61566190c930a8964e53d9184f93ce50ccce1e18ccae002f2b4909947f8026db7c4939ed590536b581

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
e1951ee89ef19f5be31e9a9947b6ceb2

SHA1
88cd861fb93633d8839498c72c5bb6e1e366b3ae

SHA256
6b8f4f85c1d4835caf86729f53889db8ee9db373c5df606e46f3451c185da388

SHA512
5f9969a4bd37cb320278181f5d3204993d8c577a2877f2c6e84d80a24f4e195318aa4b0397cbe892826f421334247bb03bdc8a7ccf0e9b7b91b9e4c707c64e20

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
44f7fb2e9f2e5b8a919b4a9116d8edde

SHA1
c1b32d3b627c4c1f003d586befa16d91c388d82f

SHA256
cbb509b6dd748c82205d81b9e608931f69355c122fac5943e0b53207edbb6b7d

SHA512
cb7e15a474f9bed43aaa42e6d9c12f25fca67461b8ca913e14f661e172cc2711663ce4080105f2bf0be79d13c4d399a8f6e3a83030db950f70deb1aa745e7a40

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
986B

MD5
e3746e8244ec2fcf7f8299056498530e

SHA1
d797c97d5be16424f99eb395793ba1f3e1dbe0d9

SHA256
cfd54b03e5f39148e20c3b30c6c1d821c48ec03f7fa82191c919da2aa37c2e00

SHA512
8254a6c6071b92295eb060c713f58b46e615c619f3fea1ce913d4c44bee46ca429a6abd9c249134551b83918ad2abc7adaeee1a065b18b9892ddbed7a019fcdb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
679c553c3c20a6006704b5bb6bc5408d

SHA1
c40c85c16e90dc318102c5ae208970370822c5e8

SHA256
2d83cf43791b7d2a114e0a4cf3520c1b5733658c4853c5b7f7cc0e73a14de60c

SHA512
0ee82a60742b377fdbe0c32e45d4b355c2cbfa2170a132a1d988c30e3671098a3512d0e413a33249e5d17337a5bdf4baf6e7468371cefdee76f254eddcc0472a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
6334d5b3a74a35ca4f444c7adb1ee935

SHA1
0c16b0cd71074a065ab95088bd29f986af67a805

SHA256
3a782b5d8044017641864f6c244867be20b79773044d0657f979513d1ef38eca

SHA512
1f21eb0e9bd61a3f509c5b6b451cdfe01a7d086ecd7a29d6dc06dfd80b2871324bf8dde6e926faa42a3084e240109a50aba7108824365f4582cd2cbac04909dc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
9142c30172387c34f18854791608b54a

SHA1
423f9d1f80bf3677bd0892b4ceec841ee891df2e

SHA256
f8f248477ef712ee9ad5c91ac7d97681f1f507f798f23085df229e65f2a8c659

SHA512
92f808f240a51505eadd4abf6147d9a8ae4d3abd087fa99c15a66598637b870815426d6fa75449b3e397e3d09d509452a5e173357cb8014520619ed779210d42

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
ba9cc8649b72795c0674e957fb4b55d5

SHA1
e342f0e79270f2ccecd6ce02a3c277671785405c

SHA256
862b0f6a334275cc5cb645d2bc2d03528738539b78bc19d9e5329e3447ca9ece

SHA512
6f64a30d9d835e05e47bb4dbe470c8f2ca2ff8befce1b1f04ce7f0ca6ad5d217f33eae86bb8fdb73f7da0421f0018dc3dbf6198bc951a322fae2ee03809e51d6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
d8e7b147464e4668896ccb53450e113b

SHA1
841747605277b6ebb1fc84896959c98a50b652a6

SHA256
ca78f73561387d9705e4a375524559af1bab69bf25ce15bef6064f6cc5a48a49

SHA512
df64631542e683355914440b69f74305367bd77dee4b77c8f6580dc50666d637812950f6376c80e845c0bfba2d8b359ef9a7bc4ed0c67a9b4dbc5f86cf4f0d2e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
9d70be1db9af0bf8073abb12b04ed73b

SHA1
1643e706537b7ea0e938943d7bff5ffdb0408f91

SHA256
d4daab5496f3db326727909487b03739f6580e16e2ba90324dc64f5cbfab6a76

SHA512
31b577f2a4605d88f4d54890e6320fbf3d339e558dab341d3434be8626a0e64684bcd2b7fc7a772b479c85ce4ba094764053f2c77edef4a6c70c6ad5a98d3f92

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
e02c72a820cbbd8969012edf34785643

SHA1
6302c23a44508848b54e541b49cfb6569a733530

SHA256
87fecd12a0a3f6740e5af3c2bc6536cbf047c5a3d6028365a9fc88bf895b58b5

SHA512
46911de6c23155f3884aa6d7cfe43fbf5683d9014a7cb3b215c859199854d5ea48d6e204a40a0b587dae3eaf33244411f93690b8e462a028ca8f6d02364a6b7d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
e41a878e8022873a2e55bcfd75b8b62c

SHA1
d44967b46355b35d3fbe65aa7b221d6d2f82e9e5

SHA256
b0f3510b9b15e31acddbb8200e976d7e1611721d849e3019b790f96c35343d16

SHA512
576e02c345dde23377000d84765d0f64ff43147fbd19d2369ab0c3dbb99c76b14f56f4175fa4f903a59ba72ccfac5701fa2574083877b2f90e777a0ba73b003e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
9927168463b401bc5d2f692265e60109

SHA1
c4cbcf30ba8a292449a14ccd43790d7f23b91c16

SHA256
b568b6ad6dae417981aac963fda0d39dbb8ccfd148756aa10735abcde559f1b9

SHA512
ac09fff9c79d9fe10140b782de043731969b375a87382bf323dd28046cdb66148cddea6e450ead5423e7d0ed4a6ccfe5f2458b31c409f2ea72f80ea22609bfd5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
e7fc740818e778510f3ea2835cd8d649

SHA1
28868c2c6c1d797ee644d1f4c7fd7649b22e804e

SHA256
8c7dbd1114e9cc17e919bfb8eb90ab472271c14224f82548ed5f0e0bae744c4f

SHA512
c0c2c31d3441e89ca6e6a61dd8c8dd1bad6fc11b2686d83410e8f71b4651a6ed6d45d097f7e1e71482467d678d0811eb00644097c54d4ce6f8a0defe31083070

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
1ce82b863c9f19f1b6de45713fb49d18

SHA1
72cf4ba5bd855ed47bc1589880c7588202debca2

SHA256
533486b0ce2192c7617ad6cdbae430977a088a57d9425cce788b8fd19d5c03c8

SHA512
27141574d22072e659d7204d2e8e23d5fd61062ac79e38a5134fea1dddf6c929d52a3bed5d55bbf5abaaf452f6c489acc6ad95d4d0fbbbb65a4fef3e154f281e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
e2d5d4ba386d79c4df9926f7db912e55

SHA1
e788ea649c7ea8318386a42f3ca4c0262a42b896

SHA256
4778817b1d8a6305d017f25168f0f1bbc0e4b3dd75f234b192ff94f69246e100

SHA512
af8ddedaf79b80cf345e4149727d166b827905d02424c2c0e961bb67aaf9b7833c97cd55bc6ca120ec94380adbc23615b7802bfbd67bde9a1ef1d16e01366ec3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
6fd81b7c482a2a7f836a2a2d5f743e99

SHA1
b292d28ae76da9eaa80d8b5a1c7c65e78410af65

SHA256
faeac16779d531047a4eae2479619a9386691770e5bd6290e0c6fdb303b4a76a

SHA512
58d5ea346966b5689adcb21ca506f20a6a09ae08df0a00845c04e9ef527655fb799d999dbc2588030750d29c9ba509fa641050cf24ff65b888f8b1cd28ba8c5b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
fece99481cf1edcad2be67d36199b39a

SHA1
5291d2fb3f5aba2aa126c74a4452d9404e3474fd

SHA256
ffc9b9006da56daa997f9080573343b1d70832013f98e1c628fe99054a620df7

SHA512
7062f8d78d5c99f13e1acc703e78c7ad3e8ae3e517c2c7a4ac5ce91d2181a94548430d01f62c6dd23b93a5642ac95c3caf56cbb9fc6c10a2dc876fbdd61f0b24

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
da30a8e151803c6e3262b899b4c294bf

SHA1
051d0841632c769eae530aee5c6bc6d14b842aac

SHA256
365488f5274b4fd1ff9b46afa991e71c87fca691d4044de380dba9266cf662dd

SHA512
4f3ec484e5ce041b999556f7f2a1585ab6859bae6f90a0dfb1b706f23d1162d1940b15aed5387dc4341983258f7109f7da8902fb2d7a57662b8fe289c903daf4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
47539a4f46f2fbd09ec6ed5bc4cc4e55

SHA1
5dea0a5f12358dbf4fbee4d0304b7436ccb32550

SHA256
147fac8cf2a6fd37a7c0d2ba23200dbac1c3f54f9183e2d1dfbbf9b60b31214e

SHA512
4904a2154e1887c8cd52008c85bc1035c52f57ecbe0f82e39d80cc1824e9fa727e8b5e604a51e7179de517aa6f458ebd0a5a909b62cc4adc0c2331dcaac469fe

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
095ca4de564b3739c3e680ade8c6416b

SHA1
e1c7f7b849ceaf4c604e971b668be52793c67e0a

SHA256
c96ecbc4b79e57a1752949642b941f23ce3553850aaaaa946934f091245237da

SHA512
c693159488bc6d1a28b0c7ef77789ceafa08c26bea8f5b5b5ac97f7fb7574e8e8b62c1a644faed6bfe8b8b8dc12952638cd700b212064f8b4372037a4660edda

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
2e46e88f5277a3e07249a80037ea86a1

SHA1
eee8db910defeed779d6787d461fbab40d1b75af

SHA256
503526b8ebe66b926bb413d80e01dc6e6c642babef10eb9b436c5446ede1cec6

SHA512
92a4d943a5136a7e76af4fdf3e702689b2bab3355ed1a2b34219b99a1891d9668fcf526bca8c648524931072a716e83aa219933a6e59d021ffdd995773f29b9e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
d65368a349e535ae4aeff05f2042d53e

SHA1
f0240a48a8b9ee2f3b311f529b343cb06e0182b4

SHA256
435048721bda9a1f95b3a58d9d6a35b90f6a669951794d739ab7adf194da7b8e

SHA512
fac1b62fd0ae039f36d0a55775e301704ff3365f8dea1fb0b0964067f297e0a08f2c513acd9791af3ef11f85af350e364f0b280b921732c3730551984fc0a718

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
15bbd450d24223e89b50cb88e3c3a976

SHA1
dc6d159458f83c985eb223ad987acef33ab1c41a

SHA256
e273e9f1c675494f3f795cdbf77cea82e3faf0b4d24798b42aee68f15d49e732

SHA512
e008eb1cf0f9375ab08b230ec5a48b52dbc4deec2d67c9c883858a10475d1d019e2fda9d93085013dfae2f86143c5b2f6504f5690f7b37495a8971d839645c34

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
c9940b18e807c1c2ff5e96b4d7ae5481

SHA1
ceefc1bd47cbc75390c6a50a8b0c410797412e22

SHA256
a721851aaa8b0deb5f37ddd20d9821bf6d8858059d3437100c8b9dc8aaa1364a

SHA512
42184694f1d12afc29d38c13fb83999f926193596a0c6022ea00e3f75d51a5a141bd307ffd1d3d5d89c5b45afcde3692d969a161e0a82393d9473c1284340ff4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
ead4dd5743ef992f7938321aa865bd1b

SHA1
16a76f8b288778dd574d5d180854bd19b1e8d4b2

SHA256
6e0f662ea8e0f9e7202162f9b22c464be5cf6436a869ab08b03094ed7b238eb5

SHA512
c695d191440fea4dd426e8898a0766e98807026ba438f6b67fde1ebe597a00f17ed72f4d723d79ddcf05c66ba783e36c17fa56f55733786c630528a699047ed7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
128KB

MD5
686eb8c1751e0f68edf926e484e303da

SHA1
c6ef8bef1c73bb150d8e84dd55bd3b15de1f34a2

SHA256
789e62cac6f930d9f6df769d0b6a11a844729cf0b527f7498f5c50d61fb26821

SHA512
66588b7c40ab03a0eaf429d7abbabf6df7c1ace1c920e1dc2bf5b0ae1544b73f65849f5e0cfbf264c5801c29cd2a227f654075cf19141867453b57e9eb87a339

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
128KB

MD5
a473eb0a0752e59e562e20729673d583

SHA1
7efac2f7dfc7c785309f3e16d13c6773d00e2a53

SHA256
9a8a8df00088c58df9d1433d1ac80f1c7f1132a7b99290522fcd2df1e30d2dc5

SHA512
f6d1dc9297612ac06da0cb3e55590a8dcf34057b952ba2c43dc501ce4db1a082bc276a675d7bdf97130a88aee1b13c7fd5aa59b943f7717fd917da4d64f9b9f3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\Downloads\1fb82aeb-63d6-481e-af19-7b7505c2c0be.tmp

Filesize
1.1MB

MD5
f0a661d33aac3a3ce0c38c89bec52f89

SHA1
709d6465793675208f22f779f9e070ed31d81e61

SHA256
c20e78ce9028299d566684d35b1230d055e5ea0e9b94d0aff58f650e0468778a

SHA512
57cdb3c38f2e90d03e6dc1f9d8d1131d40d3919f390bb1783343c82465461319e70483dc3cd3efdbd9a62dfc88d74fc706f05d760ffd8506b16fd7686e414443

Download Submit
C:\Users\Admin\Downloads\BadRabbit.exe

Filesize
431KB

MD5
fbbdc39af1139aebba4da004475e8839

SHA1
de5c8d858e6e41da715dca1c019df0bfb92d32c0

SHA256
630325cac09ac3fab908f903e3b00d0dadd5fdaa0875ed8496fcbb97a558d0da

SHA512
74eca8c01de215b33d5ceea1fda3f3bef96b513f58a750dba04b0de36f7ef4f7846a6431d52879ca0d8641bfd504d4721a9a96fa2e18c6888fd67fa77686af87

Download Submit
C:\Users\Admin\Downloads\Launcher.exe

Filesize
197KB

MD5
7506eb94c661522aff09a5c96d6f182b

SHA1
329bbdb1f877942d55b53b1d48db56a458eb2310

SHA256
d5b962dfe37671b5134f0b741a662610b568c2b5374010ee92b5b7857d87872c

SHA512
d815a9391ef3d508b89fc221506b95f4c92d586ec38f26aec0f239750f34cf398eed3d818fa439f6aa6ed3b30f555a1903d93eeeec133b80849a4aa6685ec070

Download Submit
C:\Users\Admin\Downloads\Trololo.exe

Filesize
3.0MB

MD5
b6d61b516d41e209b207b41d91e3b90d

SHA1
e50d4b7bf005075cb63d6bd9ad48c92a00ee9444

SHA256
3d0efd55bde5fb7a73817940bac2a901d934b496738b7c5cab7ea0f6228e28fe

SHA512
3217fc904e4c71b399dd273786634a6a6c19064a9bf96960df9b3357001c12b9547813412173149f6185eb5d300492d290342ec955a8347c6f9dcac338c136da

Download Submit
C:\Windows\8CDA.tmp

Filesize
60KB

MD5
347ac3b6b791054de3e5720a7144a977

SHA1
413eba3973a15c1a6429d9f170f3e8287f98c21c

SHA256
301b905eb98d8d6bb559c04bbda26628a942b2c4107c07a02e8f753bdcfe347c

SHA512
9a399916bc681964af1e1061bc0a8e2926307642557539ad587ce6f9b5ef93bdf1820fe5d7b5ffe5f0bb38e5b4dc6add213ba04048c0c7c264646375fcd01787

Download Submit
C:\Windows\infpub.dat

Filesize
401KB

MD5
1d724f95c61f1055f0d02c2154bbccd3

SHA1
79116fe99f2b421c52ef64097f0f39b815b20907

SHA256
579fd8a0385482fb4c789561a30b09f25671e86422f40ef5cca2036b28f99648

SHA512
f2d7b018d1516df1c97cfff5507957c75c6d9bf8e2ce52ae0052706f4ec62f13eba6d7be17e6ad2b693fdd58e1fd091c37f17bd2b948cdcd9b95b4ad428c0113

Download Submit
memory/872-281-0x000001A7D64D0000-0x000001A7D64D1000-memory.dmp

Filesize
4KB

Download
memory/872-282-0x000001A7D64D0000-0x000001A7D64D1000-memory.dmp

Filesize
4KB

Download
memory/872-283-0x000001A7D64D0000-0x000001A7D64D1000-memory.dmp

Filesize
4KB

Download
memory/872-278-0x000001A7D64D0000-0x000001A7D64D1000-memory.dmp

Filesize
4KB

Download
memory/872-272-0x000001A7D64D0000-0x000001A7D64D1000-memory.dmp

Filesize
4KB

Download
memory/872-284-0x000001A7D64D0000-0x000001A7D64D1000-memory.dmp

Filesize
4KB

Download
memory/872-280-0x000001A7D64D0000-0x000001A7D64D1000-memory.dmp

Filesize
4KB

Download
memory/872-279-0x000001A7D64D0000-0x000001A7D64D1000-memory.dmp

Filesize
4KB

Download
memory/872-273-0x000001A7D64D0000-0x000001A7D64D1000-memory.dmp

Filesize
4KB

Download
memory/872-274-0x000001A7D64D0000-0x000001A7D64D1000-memory.dmp

Filesize
4KB

Download
memory/1456-532-0x0000000000400000-0x0000000000489000-memory.dmp

Filesize
548KB

Download
memory/1456-710-0x0000000000400000-0x0000000000489000-memory.dmp

Filesize
548KB

Download
memory/1456-711-0x0000000000400000-0x0000000000489000-memory.dmp

Filesize
548KB

Download
memory/1476-576-0x000000001CCD0000-0x000000001CD1C000-memory.dmp

Filesize
304KB

Download
memory/1476-575-0x0000000001700000-0x0000000001708000-memory.dmp

Filesize
32KB

Download
memory/1476-573-0x000000001CAB0000-0x000000001CB4C000-memory.dmp

Filesize
624KB

Download
memory/1476-572-0x000000001C540000-0x000000001CA0E000-memory.dmp

Filesize
4.8MB

Download
memory/1476-571-0x000000001BFC0000-0x000000001C066000-memory.dmp

Filesize
664KB

Download
memory/4316-236-0x0000000001260000-0x00000000012C8000-memory.dmp

Filesize
416KB

Download
memory/4316-228-0x0000000001260000-0x00000000012C8000-memory.dmp

Filesize
416KB

Download
memory/4316-211-0x0000000001260000-0x00000000012C8000-memory.dmp

Filesize
416KB

Download