badrabbit | hxxps://github[.]com/Endermanch/MalwareDatabase

Analysis

max time kernel
413s
max time network
415s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
08-05-2024 13:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/Endermanch/MalwareDatabase

Score

10^/10

badrabbit mimikatz ransomware

Malware Config

Signatures

BadRabbit
Ransomware family discovered in late 2017, mainly targeting Russia and Ukraine.
ransomware badrabbit
Mimikatz
mimikatz is an open source tool to dump credentials on Windows.
mimikatz

mimikatz is an open source tool to dump credentials on Windows 1 IoCs

resource	yara_rule
behavioral1/files/0x00070000000236a0-1064.dat	mimikatz

Executes dropped EXE 1 IoCs

pid	Process
2124	32C0.tmp

Loads dropped DLL 1 IoCs

pid	Process
2260	rundll32.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
36	camo.githubusercontent.com
42	camo.githubusercontent.com

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
143	whatismyipaddress.com
144	whatismyipaddress.com
145	whatismyipaddress.com

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\infpub.dat	[email protected]
File opened for modification	C:\Windows\infpub.dat	rundll32.exe
File created	C:\Windows\cscc.dat	rundll32.exe
File created	C:\Windows\dispci.exe	rundll32.exe
File opened for modification	C:\Windows\32C0.tmp	rundll32.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
5028	schtasks.exe
5696	schtasks.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3906287020-2915474608-1755617787-1000\{04A98473-70BD-425A-A8EB-92C4C06B939A}	msedge.exe

Suspicious behavior: AddClipboardFormatListener 5 IoCs

pid	Process
2668	WINWORD.EXE
2668	WINWORD.EXE
1472	vlc.exe
316	vlc.exe
3140	vlc.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
3628	msedge.exe
3628	msedge.exe
1280	msedge.exe
1280	msedge.exe
1692	identity_helper.exe
1692	identity_helper.exe
5780	msedge.exe
5780	msedge.exe
3048	msedge.exe
3048	msedge.exe
6008	msedge.exe
6008	msedge.exe
6008	msedge.exe
6008	msedge.exe
2260	rundll32.exe
2260	rundll32.exe
2260	rundll32.exe
2260	rundll32.exe
2124	32C0.tmp
2124	32C0.tmp
2124	32C0.tmp
2124	32C0.tmp
2124	32C0.tmp
2124	32C0.tmp

Suspicious behavior: GetForegroundWindowSpam 3 IoCs

pid	Process
1472	vlc.exe
316	vlc.exe
3140	vlc.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 38 IoCs

pid	Process
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeBackupPrivilege	5684	svchost.exe
Token: SeRestorePrivilege	5684	svchost.exe
Token: SeSecurityPrivilege	5684	svchost.exe
Token: SeTakeOwnershipPrivilege	5684	svchost.exe
Token: 35	5684	svchost.exe
Token: SeShutdownPrivilege	2260	rundll32.exe
Token: SeDebugPrivilege	2260	rundll32.exe
Token: SeTcbPrivilege	2260	rundll32.exe
Token: SeDebugPrivilege	2124	32C0.tmp

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe

Suspicious use of SendNotifyMessage 45 IoCs

pid	Process
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1472	vlc.exe
1472	vlc.exe
1472	vlc.exe
316	vlc.exe
316	vlc.exe
316	vlc.exe
316	vlc.exe
316	vlc.exe
316	vlc.exe
316	vlc.exe
3140	vlc.exe
3140	vlc.exe
3140	vlc.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
2668	WINWORD.EXE
2668	WINWORD.EXE
2668	WINWORD.EXE
2668	WINWORD.EXE
2668	WINWORD.EXE
2668	WINWORD.EXE
2668	WINWORD.EXE
1472	vlc.exe
316	vlc.exe
3140	vlc.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1280 wrote to memory of 4840	1280	msedge.exe	82
PID 1280 wrote to memory of 4840	1280	msedge.exe	82
PID 1280 wrote to memory of 3232	1280	msedge.exe	84
PID 1280 wrote to memory of 3232	1280	msedge.exe	84
PID 1280 wrote to memory of 3232	1280	msedge.exe	84
PID 1280 wrote to memory of 3232	1280	msedge.exe	84
PID 1280 wrote to memory of 3232	1280	msedge.exe	84
PID 1280 wrote to memory of 3232	1280	msedge.exe	84
PID 1280 wrote to memory of 3232	1280	msedge.exe	84
PID 1280 wrote to memory of 3232	1280	msedge.exe	84
PID 1280 wrote to memory of 3232	1280	msedge.exe	84
PID 1280 wrote to memory of 3232	1280	msedge.exe	84
PID 1280 wrote to memory of 3232	1280	msedge.exe	84
PID 1280 wrote to memory of 3232	1280	msedge.exe	84
PID 1280 wrote to memory of 3232	1280	msedge.exe	84
PID 1280 wrote to memory of 3232	1280	msedge.exe	84
PID 1280 wrote to memory of 3232	1280	msedge.exe	84
PID 1280 wrote to memory of 3232	1280	msedge.exe	84
PID 1280 wrote to memory of 3232	1280	msedge.exe	84
PID 1280 wrote to memory of 3232	1280	msedge.exe	84
PID 1280 wrote to memory of 3232	1280	msedge.exe	84
PID 1280 wrote to memory of 3232	1280	msedge.exe	84
PID 1280 wrote to memory of 3232	1280	msedge.exe	84
PID 1280 wrote to memory of 3232	1280	msedge.exe	84
PID 1280 wrote to memory of 3232	1280	msedge.exe	84
PID 1280 wrote to memory of 3232	1280	msedge.exe	84
PID 1280 wrote to memory of 3232	1280	msedge.exe	84
PID 1280 wrote to memory of 3232	1280	msedge.exe	84
PID 1280 wrote to memory of 3232	1280	msedge.exe	84
PID 1280 wrote to memory of 3232	1280	msedge.exe	84
PID 1280 wrote to memory of 3232	1280	msedge.exe	84
PID 1280 wrote to memory of 3232	1280	msedge.exe	84
PID 1280 wrote to memory of 3232	1280	msedge.exe	84
PID 1280 wrote to memory of 3232	1280	msedge.exe	84
PID 1280 wrote to memory of 3232	1280	msedge.exe	84
PID 1280 wrote to memory of 3232	1280	msedge.exe	84
PID 1280 wrote to memory of 3232	1280	msedge.exe	84
PID 1280 wrote to memory of 3232	1280	msedge.exe	84
PID 1280 wrote to memory of 3232	1280	msedge.exe	84
PID 1280 wrote to memory of 3232	1280	msedge.exe	84
PID 1280 wrote to memory of 3232	1280	msedge.exe	84
PID 1280 wrote to memory of 3232	1280	msedge.exe	84
PID 1280 wrote to memory of 3628	1280	msedge.exe	85
PID 1280 wrote to memory of 3628	1280	msedge.exe	85
PID 1280 wrote to memory of 1136	1280	msedge.exe	86
PID 1280 wrote to memory of 1136	1280	msedge.exe	86
PID 1280 wrote to memory of 1136	1280	msedge.exe	86
PID 1280 wrote to memory of 1136	1280	msedge.exe	86
PID 1280 wrote to memory of 1136	1280	msedge.exe	86
PID 1280 wrote to memory of 1136	1280	msedge.exe	86
PID 1280 wrote to memory of 1136	1280	msedge.exe	86
PID 1280 wrote to memory of 1136	1280	msedge.exe	86
PID 1280 wrote to memory of 1136	1280	msedge.exe	86
PID 1280 wrote to memory of 1136	1280	msedge.exe	86
PID 1280 wrote to memory of 1136	1280	msedge.exe	86
PID 1280 wrote to memory of 1136	1280	msedge.exe	86
PID 1280 wrote to memory of 1136	1280	msedge.exe	86
PID 1280 wrote to memory of 1136	1280	msedge.exe	86
PID 1280 wrote to memory of 1136	1280	msedge.exe	86
PID 1280 wrote to memory of 1136	1280	msedge.exe	86
PID 1280 wrote to memory of 1136	1280	msedge.exe	86
PID 1280 wrote to memory of 1136	1280	msedge.exe	86
PID 1280 wrote to memory of 1136	1280	msedge.exe	86
PID 1280 wrote to memory of 1136	1280	msedge.exe	86

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/Endermanch/MalwareDatabase
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff92b3a46f8,0x7ff92b3a4708,0x7ff92b3a4718
  2⤵
  PID:4840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,4479281468293701189,2046553982374558853,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2176 /prefetch:2
  2⤵
  PID:3232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,4479281468293701189,2046553982374558853,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2284 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2088,4479281468293701189,2046553982374558853,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2700 /prefetch:8
  2⤵
  PID:1136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4479281468293701189,2046553982374558853,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
  2⤵
  PID:5080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4479281468293701189,2046553982374558853,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
  2⤵
  PID:2132
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,4479281468293701189,2046553982374558853,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5432 /prefetch:8
  2⤵
  PID:4908
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,4479281468293701189,2046553982374558853,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5432 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2088,4479281468293701189,2046553982374558853,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5532 /prefetch:8
  2⤵
  PID:3480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4479281468293701189,2046553982374558853,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5664 /prefetch:1
  2⤵
  PID:4020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4479281468293701189,2046553982374558853,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6080 /prefetch:1
  2⤵
  PID:760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4479281468293701189,2046553982374558853,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6096 /prefetch:1
  2⤵
  PID:1284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4479281468293701189,2046553982374558853,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5708 /prefetch:1
  2⤵
  PID:4364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4479281468293701189,2046553982374558853,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6384 /prefetch:1
  2⤵
  PID:4036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4479281468293701189,2046553982374558853,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1696 /prefetch:1
  2⤵
  PID:5996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4479281468293701189,2046553982374558853,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2232 /prefetch:1
  2⤵
  PID:5512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4479281468293701189,2046553982374558853,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1696 /prefetch:1
  2⤵
  PID:804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4479281468293701189,2046553982374558853,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5788 /prefetch:1
  2⤵
  PID:5024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4479281468293701189,2046553982374558853,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=212 /prefetch:1
  2⤵
  PID:4504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2088,4479281468293701189,2046553982374558853,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5720 /prefetch:8
  2⤵
  PID:5388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2088,4479281468293701189,2046553982374558853,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=3764 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:5780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4479281468293701189,2046553982374558853,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6304 /prefetch:1
  2⤵
  PID:6136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4479281468293701189,2046553982374558853,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5664 /prefetch:1
  2⤵
  PID:5536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4479281468293701189,2046553982374558853,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:3332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4479281468293701189,2046553982374558853,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
  2⤵
  PID:1060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4479281468293701189,2046553982374558853,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6228 /prefetch:1
  2⤵
  PID:2168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2088,4479281468293701189,2046553982374558853,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3512 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4479281468293701189,2046553982374558853,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2052 /prefetch:1
  2⤵
  PID:4448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4479281468293701189,2046553982374558853,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6376 /prefetch:1
  2⤵
  PID:3536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,4479281468293701189,2046553982374558853,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1352 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4479281468293701189,2046553982374558853,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6724 /prefetch:1
  2⤵
  PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4479281468293701189,2046553982374558853,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6808 /prefetch:1
  2⤵
  PID:5896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4479281468293701189,2046553982374558853,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6936 /prefetch:1
  2⤵
  PID:5564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4479281468293701189,2046553982374558853,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5008 /prefetch:1
  2⤵
  PID:5028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4479281468293701189,2046553982374558853,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7192 /prefetch:1
  2⤵
  PID:4752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4479281468293701189,2046553982374558853,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7468 /prefetch:1
  2⤵
  PID:852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4479281468293701189,2046553982374558853,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7700 /prefetch:1
  2⤵
  PID:3660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4479281468293701189,2046553982374558853,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7848 /prefetch:1
  2⤵
  PID:3852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4479281468293701189,2046553982374558853,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8060 /prefetch:1
  2⤵
  PID:4164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4479281468293701189,2046553982374558853,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8164 /prefetch:1
  2⤵
  PID:1932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4479281468293701189,2046553982374558853,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8280 /prefetch:1
  2⤵
  PID:2456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4479281468293701189,2046553982374558853,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8436 /prefetch:1
  2⤵
  PID:3972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4479281468293701189,2046553982374558853,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8576 /prefetch:1
  2⤵
  PID:5040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4479281468293701189,2046553982374558853,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8708 /prefetch:1
  2⤵
  PID:5688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4479281468293701189,2046553982374558853,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7620 /prefetch:1
  2⤵
  PID:540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4479281468293701189,2046553982374558853,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8020 /prefetch:1
  2⤵
  PID:5316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4479281468293701189,2046553982374558853,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9228 /prefetch:1
  2⤵
  PID:828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4479281468293701189,2046553982374558853,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9200 /prefetch:1
  2⤵
  PID:2056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4479281468293701189,2046553982374558853,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7976 /prefetch:1
  2⤵
  PID:3080

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3396

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4296

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1312

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k SDRSVC
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5684

C:\Users\Admin\Downloads\MalwareDatabase-master\MalwareDatabase-master\ransomwares\BadRabbit\[email protected]
"C:\Users\Admin\Downloads\MalwareDatabase-master\MalwareDatabase-master\ransomwares\BadRabbit\[email protected]"
1⤵
- Drops file in Windows directory
PID:3260
- C:\Windows\SysWOW64\rundll32.exe
  C:\Windows\system32\rundll32.exe C:\Windows\infpub.dat,#1 15
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2260
- - C:\Windows\SysWOW64\cmd.exe
    /c schtasks /Delete /F /TN rhaegal
    3⤵
    PID:5760
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /Delete /F /TN rhaegal
      4⤵
      PID:3700
- - C:\Windows\SysWOW64\cmd.exe
    /c schtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR "C:\Windows\system32\cmd.exe /C Start \"\" \"C:\Windows\dispci.exe\" -id 1629130759 && exit"
    3⤵
    PID:3144
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR "C:\Windows\system32\cmd.exe /C Start \"\" \"C:\Windows\dispci.exe\" -id 1629130759 && exit"
      4⤵
      Creates scheduled task(s)
      PID:5028
- - C:\Windows\SysWOW64\cmd.exe
    /c schtasks /Create /SC once /TN drogon /RU SYSTEM /TR "C:\Windows\system32\shutdown.exe /r /t 0 /f" /ST 14:00:00
    3⤵
    PID:2408
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /Create /SC once /TN drogon /RU SYSTEM /TR "C:\Windows\system32\shutdown.exe /r /t 0 /f" /ST 14:00:00
      4⤵
      Creates scheduled task(s)
      PID:5696
- - C:\Windows\32C0.tmp
    "C:\Windows\32C0.tmp" \\.\pipe\{17DE97BD-6C32-4223-9B31-840EBD8A1919}
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2124

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Downloads\RegisterSuspend.docx" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2668

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1472

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\HideUnblock.ram"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:316

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\InstallPop.DVR-MS"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:3140

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ae54e9db2e89f2c54da8cc0bfcbd26bd

SHA1
a88af6c673609ecbc51a1a60dfbc8577830d2b5d

SHA256
5009d3c953de63cfd14a7d911156c514e179ff07d2b94382d9caac6040cb72af

SHA512
e3b70e5eb7321b9deca6f6a17424a15b9fd5c4008bd3789bd01099fd13cb2f4a2f37fe4b920fb51c50517745b576c1f94df83efd1a7e75949551163985599998

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f53207a5ca2ef5c7e976cbb3cb26d870

SHA1
49a8cc44f53da77bb3dfb36fc7676ed54675db43

SHA256
19ab4e3c9da6d9cedda7461efdba9a2085e743513ab89f1dd0fd5a8f9486ad23

SHA512
be734c7e8afda19f445912aef0d78f9941add29baebd4a812bff27f10a1d78b52aeb11c551468c8644443c86e1a2a6b2e4aead3d7f81d39925e3c20406ac1499

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\24688e3b-79c9-4e65-8165-06eeac53a72c.tmp

Filesize
6KB

MD5
4422bf0d837faed615b89ce6cc1b75ed

SHA1
95e3b27889d5e5b0c11c70ad2eb1b57d94248aa8

SHA256
8c337f16ddfe0f37f6385f683919c8f199c325b90ff5746cc2c5f6cf78afe0b5

SHA512
81cc3790071d1358e088dfbe09b1e4ddb8e80bb9c104b245a04c026708defc095565fe3dd60745257be36feec9b38844de988cde4da8519e49c05f346029961f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000055

Filesize
64KB

MD5
af2854ba8c3c90a6559ec9240f07014a

SHA1
35855956cce13396918a41f3ff85e27864cbb8bc

SHA256
0ad9bca7284f78b93368df4f82f9cf7bfba333f49f2ee4f1d1098c6f4d8eb043

SHA512
8d54a9eb379fb4b4f44f8d71c7498d0ab788578f6b49d8dd0f797efe171877bdc54f1ab2faed6ce931629b673b332667416586c6707ca019da57b3f6576ed3ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000060

Filesize
250KB

MD5
29b1adf527657e404731bcb7271b79f8

SHA1
50aae42abf35013822edd2004b109c1dca12e96b

SHA256
4fbab2df29d82f1d5d1ab88a4cd42dfbfd777934ed5b177324542239df37bcc8

SHA512
17d123f7b9e62a158ab2589750da30e0d8290f910052d0d464a7f5a40d4e5011c8c33ee4804000fbc52f1c4e27b8d04cf7fd1bf13a9a9b07ac2376fad1e6ed56

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index

Filesize
6KB

MD5
fe86bf60e3cbf847d40f9d78001d7ad7

SHA1
7be51043fbd0909e64cc81ffda0e7d0cd42c6036

SHA256
7f16c5e6b3ffcb55881cb9e6530eaa1243f6b73adf725c66528cbcf63914544b

SHA512
913f2e82eefbe80402e183ba6610f1a58589bf6cf3d6b489b8595da8711ca72b6842bde72b8e10141ca25e019668ad6fa73a4e87e9f7a968193cb254de0de1e0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index

Filesize
2KB

MD5
c6ff1ea0abc9476a85c711593df68633

SHA1
693c2e8278aed2cafa547d78af9654965220d306

SHA256
86e6fee9c33080fae9f5d89ca7fff543fffcc5393898375fa336603c0e8273d1

SHA512
392a4996c2688efddfbeeeea280310208c3cc039b42f52caa63d556f0fd071cedd2bfbae195cddd59659feaacf22cd6c89a4017b657dbd8bec8497a14074e4fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
898b6c495d9bf03170dd0b2bc26320da

SHA1
3534a9fed154574c228630bbabcf50953af29f1e

SHA256
c1672b01c3e6e3d927d203b51af7569fd9f6e82211c795c4a45cf72c7dc7dc28

SHA512
f9ec5af3c3aa3deb41393b0db94a32609f64b0f256d93fbd5fdc839bea8cfa6f91b4607443c71b491b0a9c869145de6fdfd1867f97a60d79de208f120241d2e8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
14KB

MD5
6aaf0047129d8d6670b9b722a8c13ee3

SHA1
bac9e136be7229182111b0c8e3ed08df5f8cdd43

SHA256
086f89635433415fcea3e2312802a5419356226e585d1219377206e731bf74c2

SHA512
75a07e66c581599e83021292213f00880be1fb1d5b828f20eea4bda4ad26f1a535c625bbca0b9e0f106c2e62070070688d957c3e7d47cb9e3fe1261404db9f9c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
604c56dfb47b05c694f59c2f4f9aa06b

SHA1
68ca00786f284ec91061cf4a93dd672d860e2e2c

SHA256
8cd95507f0724791a57f5713ca43d99ff0a6baccefb67dee2401ef8de6b90802

SHA512
05846e586215f2ea71a9e0f4f7ceb8b0c3ab31b569317c77e329af2a328d75dab63d4f7c39a7c8e900300aca3f36de20e16042e601cf356b1a32d9c34ba304e4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
18KB

MD5
5db294475c71607dc75d795defa8bdec

SHA1
2e44e19350fbe31edd7e6e87856b977d5014aa5b

SHA256
db296c5c694cd2503b03930e39b4b4ab057dd4c31c70d088d3f82607656f8e63

SHA512
8162c52e0e1c53b0a07bd444152c64b77b834bbb34785dfa72bc9794b8bdb3d575685f3082c76d13230e03cd3a7b03a9dae051ea592ca2690401c14e7dcd2c88

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
94c33af8d4e2ed84ec49610a1583f3fa

SHA1
aa03acc7de6306b888ec8a7cba356a52ead27854

SHA256
fe84b0369be87ee0f9d45e0951ad4676300fecb2096c7ebe89649eb5b7fd9c35

SHA512
60eefd0ed10787d9905d3e1d0f29647d69dac9e70feb2f0e0cad320b15e05aa051345096c19de6b309c71a18b3109c0045431aa72d4fd725aefa4b3fe78d835a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
b9ecb8683c6ab49a32e78abfcaabb16f

SHA1
2b54c58e41993086c3aa589551b3d957a1564186

SHA256
aee47a81327e929c97a7719dd467617b9b88fc5956ef80e750a6f2478420b19c

SHA512
9dc1385280b956e6739d4056e3fd2ca6394f4f71207825b34ff097f61a8f109db80f8367641d031982a523f2f75fd0ce5bb29bd0111553f42fd45cd5a96404ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
17KB

MD5
2611cbfd0590fbe445bf29351f20c2cf

SHA1
dedfc77e5abb0fe348efb99bf2024f93a54e6eed

SHA256
49626c2d43fbe18f6faaac96760d7fbac001193edcd3e7cb749cc1fc56d9d502

SHA512
b13173983f6425c0e9a03e72b53b5587d504afc0dd30fa540bd894ac3d46c2529cd8b004c987a4441bee58e29bce081e1c40746a0502a8676cdc580629cbf7e6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
316405c78c44f5d71ab56c89db5f78ec

SHA1
5d17e4b59b93235d62c74cf21121bd1949317d91

SHA256
2c7538953be0c0a0e2acdc169479da9a9f4cc61c3a32279be1edc48510f37724

SHA512
a7c90c3faa6768da57e5084c84239086ce594a595c3bf33924be70e4c8db664470a0f161106a9ee9f49e34e91a6febd9e1e67bdc2ca1871d32865f9bb0f2d0e6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
c5aeb14dc5925418a6207041f1e56cd9

SHA1
11cf491bb5c599e9de86f3367dcbe3a7cf4827b1

SHA256
12668754654eda7536f931a851235bc66e10108c0db4a13b68713510a7c3f3a6

SHA512
292b63bdc23596ce7fc6f038f800c6baec955848554c2048c0bfe9534e992a942cc31a57ed5e0cf9a48d0b0d1cc4fbe41d35e405b31be14899e9228aec76ba77

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
35887240c395660667bc66a7bed1ffda

SHA1
09c2ab6cda17a0ad323281cf5a2d19cfc101c2ba

SHA256
dbc361497fff67bd2e8baa350c6aeb0f0f05e7fb138ddbc401aecbe7afe562e0

SHA512
abcece9fc6289e02c6e947e3ce743ea8a2fcbf761057e1c2ff2cabe1d0f6ca7b6249a2974e0a6225863246a21f55ac5e1ee678e2f4efe2849ede6c78d8b9258e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
13393d2da43f2e81006c9fed4ebf7089

SHA1
cc2e0b84188fa99a08eaa1dc1b661d6d85be37db

SHA256
70f3e2800e70becded19adea2f5570653907b9a53e7e19384b29b416ee3eb466

SHA512
23dac9aca539ccf6502318ed7be3294672b973954a3b8ff31339c08b7cf6224be43094fbfb6d7c3f5500755db8db2e90f91ffe5cb377fb2934c4af1dccbc1767

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57a623.TMP

Filesize
1KB

MD5
3cfc6af3bb25e0eae46086b30c1c2cde

SHA1
5480754204f9e83cdc616d98b9cb83f5cfa35718

SHA256
2e45604eb4bc47df476652b469797fadded923a2bc10c6418977de9084ada94a

SHA512
3910501858ed09d1e38ab3a0373de428d2ddf2cd2bd82cd1d02c22321b9e570ac5073a60aa90d93c355b50763369670d902ab9554cbcddfa1bf749f9cec5e6c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\fb88d61c-f7d7-45e7-86a6-64d6cc2d000c.tmp

Filesize
657B

MD5
0d2f0363771c24c54d1bc759a73a8711

SHA1
cd40230a0a64ac40e3548046cc444fb4d2028c1e

SHA256
77358f45fb03268ffc012b98394bf4671ca259985bbbf353ec36a14a891bc977

SHA512
ff05d8c1877523636da8c142ca870935434b432c569cde157b459e1f99773e079d22e3c41715552c6265a03831cf89dfceca63e3436ed08fb546f6235cb0399b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
13bdf3b2d6f93c8454c656668f803d36

SHA1
3762885f443efbc804648608c10fa7e58016adb9

SHA256
77cbe411e126c22d024520474736cb59494cbd3ad8d8f7bab19209e990df78c2

SHA512
5cabb4e53365cbc1be5dc786c63ea3d7e7b060df4ffff258a5f49a79f72cbfcae9220b1fdfe6de652b84c004957538e29b2eb9eb45c88a09ad4faf1b50a9b06d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
63c1eaf0a03d8603e01a1fa21063baf5

SHA1
add77048e022cde97cc49cd48784fa0008f97940

SHA256
ffd4f144ca5fc82a4344404044ccc8dc4134d3b579ba46f5ad5864b2dedc2ddf

SHA512
5897f372bf0d4daea32000fe7a0d3b93bfaed1e31e19feb647b265b2420e37a334aa03511d42c253198bd08bfcd9b1d519d15901dc2e29d9041667640c96edf4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
ee8220c81b316d903c9e814b89d7e30d

SHA1
4ae4c3dd1890e9a1de0c639519a3910dec9679ec

SHA256
0721455aac9d25ee07958d3ff6905091708f2b8f261cb78613e576ca77a7b906

SHA512
a877d433d47ff4f319ef5acbc480e2f27b17ccff7a82b4606bf17156ec1ea2bed9d5c1c15a97a6d5e6d91c2ec35781867de9c43e813d760a9e6d080a06fbd2d1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\9cd93bc6dcf544bae69531052e64647ec02f2bb4.tbres

Filesize
4KB

MD5
98fd4550d3743e40e9d07ac05115d528

SHA1
0db12dfaf05bdc587391486465a75fee49ff3df2

SHA256
c9d2698ab43acfb18e1c8be261d9b5b6befacf1d74e40b07984aecbff94cfe1a

SHA512
40d99a59096b42e93e06eef0c543a76e1cee740113954c0ba8c807ee55206fb32db354ad439cb32f228458a2c0080df0cdb72871031b60ebd16b22af821814ee

Download Submit
C:\Users\Admin\AppData\Roaming\vlc\ml.xspf

Filesize
304B

MD5
781602441469750c3219c8c38b515ed4

SHA1
e885acd1cbd0b897ebcedbb145bef1c330f80595

SHA256
81970dbe581373d14fbd451ac4b3f96e5f69b79645f1ee1ca715cff3af0bf20d

SHA512
2b0a1717d96edb47bdf0ffeb250a5ec11f7d0638d3e0a62fbe48c064379b473ca88ffbececb32a72129d06c040b107834f1004ccda5f0f35b8c3588034786461

Download Submit
C:\Users\Admin\AppData\Roaming\vlc\vlc-qt-interface.ini

Filesize
532B

MD5
1d8b72889eb4fee6ab174c9c80dd8d0d

SHA1
0adfb766fb6596100eb6853b1f3d9701e3f4418b

SHA256
8a9a5cfba3e8f47e546536a829bf9dff0bba579344318515d02b3622d54094e1

SHA512
a38c69dd324bf880a086ae47cafd1e848aa0ba44964fed90088a52f796da288e02b761872382f3a658b1a1795c09b62a9a6c92f1566d2929b5b60a43dda5a68c

Download Submit
C:\Users\Admin\AppData\Roaming\vlc\vlc-qt-interface.ini

Filesize
504B

MD5
6a320314e722ced036114daf8e077201

SHA1
3d3a6a37f3c6836c65aa93ab2e1abcfcf4405ef6

SHA256
a155fd48274646664f573990392b666dd4dbb3ae89f9208e10ca5a0bfdf542fa

SHA512
97220c3b7fb21385f6f852e7950e103f4706f6d0d67ed08622edd83f14eeee8b6e7145650036545618fba4ea0be9cca723963dff3a39cb9f36c115d4808d8ec1

Download Submit
C:\Windows\32C0.tmp

Filesize
60KB

MD5
347ac3b6b791054de3e5720a7144a977

SHA1
413eba3973a15c1a6429d9f170f3e8287f98c21c

SHA256
301b905eb98d8d6bb559c04bbda26628a942b2c4107c07a02e8f753bdcfe347c

SHA512
9a399916bc681964af1e1061bc0a8e2926307642557539ad587ce6f9b5ef93bdf1820fe5d7b5ffe5f0bb38e5b4dc6add213ba04048c0c7c264646375fcd01787

Download Submit
C:\Windows\infpub.dat

Filesize
401KB

MD5
1d724f95c61f1055f0d02c2154bbccd3

SHA1
79116fe99f2b421c52ef64097f0f39b815b20907

SHA256
579fd8a0385482fb4c789561a30b09f25671e86422f40ef5cca2036b28f99648

SHA512
f2d7b018d1516df1c97cfff5507957c75c6d9bf8e2ce52ae0052706f4ec62f13eba6d7be17e6ad2b693fdd58e1fd091c37f17bd2b948cdcd9b95b4ad428c0113

Download Submit
memory/316-1160-0x00007FF92A0E0000-0x00007FF92A0F8000-memory.dmp

Filesize
96KB

Download
memory/316-1158-0x00007FF92AC40000-0x00007FF92AC5B000-memory.dmp

Filesize
108KB

Download
memory/316-1146-0x00007FF92BBA0000-0x00007FF92BBD4000-memory.dmp

Filesize
208KB

Download
memory/316-1145-0x00007FF6254C0000-0x00007FF6255B8000-memory.dmp

Filesize
992KB

Download
memory/316-1152-0x00007FF921870000-0x00007FF9218B1000-memory.dmp

Filesize
260KB

Download
memory/316-1153-0x00007FF92B240000-0x00007FF92B261000-memory.dmp

Filesize
132KB

Download
memory/316-1154-0x00007FF92B520000-0x00007FF92B538000-memory.dmp

Filesize
96KB

Download
memory/316-1155-0x00007FF92B120000-0x00007FF92B131000-memory.dmp

Filesize
68KB

Download
memory/316-1156-0x00007FF92B010000-0x00007FF92B021000-memory.dmp

Filesize
68KB

Download
memory/316-1157-0x00007FF92AFF0000-0x00007FF92B001000-memory.dmp

Filesize
68KB

Download
memory/316-1159-0x00007FF92A2B0000-0x00007FF92A2C1000-memory.dmp

Filesize
68KB

Download
memory/316-1161-0x00007FF91C4B0000-0x00007FF91C4E0000-memory.dmp

Filesize
192KB

Download
memory/316-1162-0x00007FF91C440000-0x00007FF91C4A7000-memory.dmp

Filesize
412KB

Download
memory/316-1147-0x00007FF91B640000-0x00007FF91B8F6000-memory.dmp

Filesize
2.7MB

Download
memory/316-1163-0x00007FF91C3C0000-0x00007FF91C43C000-memory.dmp

Filesize
496KB

Download
memory/316-1164-0x00007FF921850000-0x00007FF921861000-memory.dmp

Filesize
68KB

Download
memory/316-1165-0x00007FF91C740000-0x00007FF91C751000-memory.dmp

Filesize
68KB

Download
memory/316-1150-0x00007FF92B650000-0x00007FF92B661000-memory.dmp

Filesize
68KB

Download
memory/316-1149-0x00007FF930E70000-0x00007FF930E87000-memory.dmp

Filesize
92KB

Download
memory/316-1148-0x00007FF932B40000-0x00007FF932B58000-memory.dmp

Filesize
96KB

Download
memory/1472-1137-0x00007FF916C50000-0x00007FF917D00000-memory.dmp

Filesize
16.7MB

Download
memory/1472-1136-0x00007FF91B640000-0x00007FF91B8F6000-memory.dmp

Filesize
2.7MB

Download
memory/1472-1134-0x00007FF6254C0000-0x00007FF6255B8000-memory.dmp

Filesize
992KB

Download
memory/1472-1135-0x00007FF92BBA0000-0x00007FF92BBD4000-memory.dmp

Filesize
208KB

Download
memory/2260-1055-0x0000000002EF0000-0x0000000002F58000-memory.dmp

Filesize
416KB

Download
memory/2260-1058-0x0000000002EF0000-0x0000000002F58000-memory.dmp

Filesize
416KB

Download
memory/2260-1048-0x0000000002EF0000-0x0000000002F58000-memory.dmp

Filesize
416KB

Download
memory/2668-1085-0x00007FF8F9A30000-0x00007FF8F9A40000-memory.dmp

Filesize
64KB

Download
memory/2668-1121-0x00007FF8F9A30000-0x00007FF8F9A40000-memory.dmp

Filesize
64KB

Download
memory/2668-1122-0x00007FF8F9A30000-0x00007FF8F9A40000-memory.dmp

Filesize
64KB

Download
memory/2668-1123-0x00007FF8F9A30000-0x00007FF8F9A40000-memory.dmp

Filesize
64KB

Download
memory/2668-1120-0x00007FF8F9A30000-0x00007FF8F9A40000-memory.dmp

Filesize
64KB

Download
memory/2668-1084-0x00007FF8F9A30000-0x00007FF8F9A40000-memory.dmp

Filesize
64KB

Download
memory/2668-1088-0x00007FF8F77F0000-0x00007FF8F7800000-memory.dmp

Filesize
64KB

Download
memory/2668-1087-0x00007FF8F77F0000-0x00007FF8F7800000-memory.dmp

Filesize
64KB

Download
memory/2668-1086-0x00007FF8F9A30000-0x00007FF8F9A40000-memory.dmp

Filesize
64KB

Download
memory/2668-1082-0x00007FF8F9A30000-0x00007FF8F9A40000-memory.dmp

Filesize
64KB

Download
memory/2668-1083-0x00007FF8F9A30000-0x00007FF8F9A40000-memory.dmp

Filesize
64KB

Download