badrabbit | hxxps://github[.]com/Da2dalus/The-MALWARE-Repo/blob/master/Virus/MadMan[.]exe

Analysis

max time kernel
265s
max time network
266s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
27-05-2024 15:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Virus/MadMan.exe

Score

10^/10

badrabbit mimikatz persistence ransomware upx

Malware Config

Signatures

BadRabbit
Ransomware family discovered in late 2017, mainly targeting Russia and Ukraine.
ransomware badrabbit
Mimikatz
mimikatz is an open source tool to dump credentials on Windows.
mimikatz

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Users\\Admin\\Downloads\\Birele.exe"	Birele.exe

mimikatz is an open source tool to dump credentials on Windows 1 IoCs

resource	yara_rule
behavioral1/files/0x000c0000000234c2-463.dat	mimikatz

Downloads MZ/PE file

Executes dropped EXE 8 IoCs

pid	Process
4712	Bezilom.exe
2684	Bumerang.exe
4572	ddraw32.dll
2368	ddraw32.dll
4088	BadRabbit.exe
2616	4992.tmp
3828	BadRabbit.exe
3300	Birele.exe

Loads dropped DLL 2 IoCs

pid	Process
3716	rundll32.exe
2684	rundll32.exe

UPX packed file 13 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x00050000000167d8-298.dat	upx
behavioral1/memory/2684-330-0x0000000000400000-0x0000000000410000-memory.dmp	upx
behavioral1/files/0x00090000000234c0-333.dat	upx
behavioral1/memory/2684-336-0x0000000000400000-0x0000000000410000-memory.dmp	upx
behavioral1/memory/4572-340-0x0000000000400000-0x0000000000410000-memory.dmp	upx
behavioral1/memory/2368-339-0x0000000000400000-0x0000000000410000-memory.dmp	upx
behavioral1/memory/4572-341-0x0000000000400000-0x0000000000410000-memory.dmp	upx
behavioral1/memory/2368-365-0x0000000000400000-0x0000000000410000-memory.dmp	upx
behavioral1/files/0x0006000000016986-573.dat	upx
behavioral1/memory/3300-606-0x0000000000400000-0x0000000000438000-memory.dmp	upx
behavioral1/memory/3300-607-0x0000000000400000-0x0000000000438000-memory.dmp	upx
behavioral1/memory/3300-631-0x0000000000400000-0x0000000000438000-memory.dmp	upx
behavioral1/memory/3300-642-0x0000000000400000-0x0000000000438000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\StartUp = "C:\\Windows\\Maria.doc .exe"	Bezilom.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\system = "C:\\Users\\Admin\\Downloads\\Birele.exe"	Birele.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
67	raw.githubusercontent.com
68	raw.githubusercontent.com

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\ddraw32.dll	Bumerang.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\Maria.doc .exe	Bezilom.exe
File created	C:\Windows\infpub.dat	BadRabbit.exe
File created	C:\Windows\dispci.exe	rundll32.exe
File created	C:\Windows\infpub.dat	BadRabbit.exe
File opened for modification	C:\Windows\infpub.dat	rundll32.exe
File opened for modification	C:\Windows\Maria.doc .exe	Bezilom.exe
File opened for modification	C:\Windows\infpub.dat	rundll32.exe
File created	C:\Windows\cscc.dat	rundll32.exe
File opened for modification	C:\Windows\4992.tmp	rundll32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4088	4572	WerFault.exe	122

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
4724	schtasks.exe
456	schtasks.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
4724	taskkill.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000_Classes\Local Settings	msedge.exe

NTFS ADS 5 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 248080.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 31667.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 938917.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 63054.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 275318.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 33 IoCs

pid	Process
2444	msedge.exe
2444	msedge.exe
2564	msedge.exe
2564	msedge.exe
1920	identity_helper.exe
1920	identity_helper.exe
4424	msedge.exe
4424	msedge.exe
2808	msedge.exe
2808	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
4372	msedge.exe
4372	msedge.exe
3716	rundll32.exe
3716	rundll32.exe
3716	rundll32.exe
3716	rundll32.exe
2616	4992.tmp
2616	4992.tmp
2616	4992.tmp
2616	4992.tmp
2616	4992.tmp
2616	4992.tmp
2616	4992.tmp
2684	rundll32.exe
2684	rundll32.exe
208	msedge.exe
208	msedge.exe
4608	msedge.exe
4608	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3716	rundll32.exe
Token: SeDebugPrivilege	3716	rundll32.exe
Token: SeTcbPrivilege	3716	rundll32.exe
Token: SeDebugPrivilege	2616	4992.tmp
Token: SeShutdownPrivilege	2684	rundll32.exe
Token: SeDebugPrivilege	2684	rundll32.exe
Token: SeTcbPrivilege	2684	rundll32.exe
Token: SeDebugPrivilege	4724	taskkill.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4712	Bezilom.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2564 wrote to memory of 4128	2564	msedge.exe	83
PID 2564 wrote to memory of 4128	2564	msedge.exe	83
PID 2564 wrote to memory of 1880	2564	msedge.exe	84
PID 2564 wrote to memory of 1880	2564	msedge.exe	84
PID 2564 wrote to memory of 1880	2564	msedge.exe	84
PID 2564 wrote to memory of 1880	2564	msedge.exe	84
PID 2564 wrote to memory of 1880	2564	msedge.exe	84
PID 2564 wrote to memory of 1880	2564	msedge.exe	84
PID 2564 wrote to memory of 1880	2564	msedge.exe	84
PID 2564 wrote to memory of 1880	2564	msedge.exe	84
PID 2564 wrote to memory of 1880	2564	msedge.exe	84
PID 2564 wrote to memory of 1880	2564	msedge.exe	84
PID 2564 wrote to memory of 1880	2564	msedge.exe	84
PID 2564 wrote to memory of 1880	2564	msedge.exe	84
PID 2564 wrote to memory of 1880	2564	msedge.exe	84
PID 2564 wrote to memory of 1880	2564	msedge.exe	84
PID 2564 wrote to memory of 1880	2564	msedge.exe	84
PID 2564 wrote to memory of 1880	2564	msedge.exe	84
PID 2564 wrote to memory of 1880	2564	msedge.exe	84
PID 2564 wrote to memory of 1880	2564	msedge.exe	84
PID 2564 wrote to memory of 1880	2564	msedge.exe	84
PID 2564 wrote to memory of 1880	2564	msedge.exe	84
PID 2564 wrote to memory of 1880	2564	msedge.exe	84
PID 2564 wrote to memory of 1880	2564	msedge.exe	84
PID 2564 wrote to memory of 1880	2564	msedge.exe	84
PID 2564 wrote to memory of 1880	2564	msedge.exe	84
PID 2564 wrote to memory of 1880	2564	msedge.exe	84
PID 2564 wrote to memory of 1880	2564	msedge.exe	84
PID 2564 wrote to memory of 1880	2564	msedge.exe	84
PID 2564 wrote to memory of 1880	2564	msedge.exe	84
PID 2564 wrote to memory of 1880	2564	msedge.exe	84
PID 2564 wrote to memory of 1880	2564	msedge.exe	84
PID 2564 wrote to memory of 1880	2564	msedge.exe	84
PID 2564 wrote to memory of 1880	2564	msedge.exe	84
PID 2564 wrote to memory of 1880	2564	msedge.exe	84
PID 2564 wrote to memory of 1880	2564	msedge.exe	84
PID 2564 wrote to memory of 1880	2564	msedge.exe	84
PID 2564 wrote to memory of 1880	2564	msedge.exe	84
PID 2564 wrote to memory of 1880	2564	msedge.exe	84
PID 2564 wrote to memory of 1880	2564	msedge.exe	84
PID 2564 wrote to memory of 1880	2564	msedge.exe	84
PID 2564 wrote to memory of 1880	2564	msedge.exe	84
PID 2564 wrote to memory of 2444	2564	msedge.exe	85
PID 2564 wrote to memory of 2444	2564	msedge.exe	85
PID 2564 wrote to memory of 2784	2564	msedge.exe	86
PID 2564 wrote to memory of 2784	2564	msedge.exe	86
PID 2564 wrote to memory of 2784	2564	msedge.exe	86
PID 2564 wrote to memory of 2784	2564	msedge.exe	86
PID 2564 wrote to memory of 2784	2564	msedge.exe	86
PID 2564 wrote to memory of 2784	2564	msedge.exe	86
PID 2564 wrote to memory of 2784	2564	msedge.exe	86
PID 2564 wrote to memory of 2784	2564	msedge.exe	86
PID 2564 wrote to memory of 2784	2564	msedge.exe	86
PID 2564 wrote to memory of 2784	2564	msedge.exe	86
PID 2564 wrote to memory of 2784	2564	msedge.exe	86
PID 2564 wrote to memory of 2784	2564	msedge.exe	86
PID 2564 wrote to memory of 2784	2564	msedge.exe	86
PID 2564 wrote to memory of 2784	2564	msedge.exe	86
PID 2564 wrote to memory of 2784	2564	msedge.exe	86
PID 2564 wrote to memory of 2784	2564	msedge.exe	86
PID 2564 wrote to memory of 2784	2564	msedge.exe	86
PID 2564 wrote to memory of 2784	2564	msedge.exe	86
PID 2564 wrote to memory of 2784	2564	msedge.exe	86
PID 2564 wrote to memory of 2784	2564	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Virus/MadMan.exe
1⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa1e7f46f8,0x7ffa1e7f4708,0x7ffa1e7f4718
  2⤵
  PID:4128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,2098817613583476863,8447648861001477552,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:2
  2⤵
  PID:1880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2076,2098817613583476863,8447648861001477552,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2076,2098817613583476863,8447648861001477552,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2664 /prefetch:8
  2⤵
  PID:2784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,2098817613583476863,8447648861001477552,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:4900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,2098817613583476863,8447648861001477552,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:3312
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,2098817613583476863,8447648861001477552,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5212 /prefetch:8
  2⤵
  PID:4292
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,2098817613583476863,8447648861001477552,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5212 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,2098817613583476863,8447648861001477552,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2724 /prefetch:1
  2⤵
  PID:2516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,2098817613583476863,8447648861001477552,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1368 /prefetch:1
  2⤵
  PID:4292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,2098817613583476863,8447648861001477552,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2620 /prefetch:1
  2⤵
  PID:2256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,2098817613583476863,8447648861001477552,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1968 /prefetch:1
  2⤵
  PID:2928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2076,2098817613583476863,8447648861001477552,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=2960 /prefetch:8
  2⤵
  PID:2320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,2098817613583476863,8447648861001477552,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5896 /prefetch:1
  2⤵
  PID:412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2076,2098817613583476863,8447648861001477552,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6232 /prefetch:8
  2⤵
  PID:3728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2076,2098817613583476863,8447648861001477552,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5412 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,2098817613583476863,8447648861001477552,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
  2⤵
  PID:464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2076,2098817613583476863,8447648861001477552,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5884 /prefetch:8
  2⤵
  PID:5032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,2098817613583476863,8447648861001477552,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5492 /prefetch:1
  2⤵
  PID:380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2076,2098817613583476863,8447648861001477552,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1804 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,2098817613583476863,8447648861001477552,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6136 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,2098817613583476863,8447648861001477552,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4620 /prefetch:1
  2⤵
  PID:3468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2076,2098817613583476863,8447648861001477552,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3320 /prefetch:8
  2⤵
  PID:3936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2076,2098817613583476863,8447648861001477552,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6568 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,2098817613583476863,8447648861001477552,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5484 /prefetch:1
  2⤵
  PID:2148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2076,2098817613583476863,8447648861001477552,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6672 /prefetch:8
  2⤵
  PID:3300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2076,2098817613583476863,8447648861001477552,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5520 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,2098817613583476863,8447648861001477552,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:1932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2076,2098817613583476863,8447648861001477552,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6796 /prefetch:8
  2⤵
  PID:4852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2076,2098817613583476863,8447648861001477552,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6772 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4608

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2460

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3300

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3564

C:\Users\Admin\Downloads\Bezilom.exe
"C:\Users\Admin\Downloads\Bezilom.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:4712

C:\Users\Admin\Downloads\Bumerang.exe
"C:\Users\Admin\Downloads\Bumerang.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2684
- C:\Windows\SysWOW64\ddraw32.dll
  C:\Windows\system32\ddraw32.dll
  2⤵
  - Executes dropped EXE
  PID:4572
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4572 -s 324
    3⤵
    - Program crash
    PID:4088
- C:\Windows\SysWOW64\ddraw32.dll
  C:\Windows\system32\ddraw32.dll :C:\Users\Admin\Downloads\Bumerang.exe
  2⤵
  - Executes dropped EXE
  PID:2368

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4572 -ip 4572
1⤵
PID:2036

C:\Users\Admin\Downloads\BadRabbit.exe
"C:\Users\Admin\Downloads\BadRabbit.exe"
1⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4088
- C:\Windows\SysWOW64\rundll32.exe
  C:\Windows\system32\rundll32.exe C:\Windows\infpub.dat,#1 15
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3716
- - C:\Windows\SysWOW64\cmd.exe
    /c schtasks /Delete /F /TN rhaegal
    3⤵
    PID:2464
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /Delete /F /TN rhaegal
      4⤵
      PID:840
- - C:\Windows\SysWOW64\cmd.exe
    /c schtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR "C:\Windows\system32\cmd.exe /C Start \"\" \"C:\Windows\dispci.exe\" -id 1069087795 && exit"
    3⤵
    PID:3784
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR "C:\Windows\system32\cmd.exe /C Start \"\" \"C:\Windows\dispci.exe\" -id 1069087795 && exit"
      4⤵
      Creates scheduled task(s)
      PID:4724
- - C:\Windows\SysWOW64\cmd.exe
    /c schtasks /Create /SC once /TN drogon /RU SYSTEM /TR "C:\Windows\system32\shutdown.exe /r /t 0 /f" /ST 15:32:00
    3⤵
    PID:4544
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /Create /SC once /TN drogon /RU SYSTEM /TR "C:\Windows\system32\shutdown.exe /r /t 0 /f" /ST 15:32:00
      4⤵
      Creates scheduled task(s)
      PID:456
- - C:\Windows\4992.tmp
    "C:\Windows\4992.tmp" \\.\pipe\{ACBF0115-6E71-4FEA-921C-BD5B64D3BDBA}
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2616

C:\Users\Admin\Downloads\BadRabbit.exe
"C:\Users\Admin\Downloads\BadRabbit.exe"
1⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3828
- C:\Windows\SysWOW64\rundll32.exe
  C:\Windows\system32\rundll32.exe C:\Windows\infpub.dat,#1 15
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2684

C:\Users\Admin\Downloads\Birele.exe
"C:\Users\Admin\Downloads\Birele.exe"
1⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Adds Run key to start application
PID:3300
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM explorer.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4724

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2daa93382bba07cbc40af372d30ec576

SHA1
c5e709dc3e2e4df2ff841fbde3e30170e7428a94

SHA256
1826d2a57b1938c148bf212a47d947ed1bfb26cfc55868931f843ee438117f30

SHA512
65635cb59c81548a9ef8fdb0942331e7f3cd0c30ce1d4dba48aed72dbb27b06511a55d2aeaadfadbbb4b7cb4b2e2772bbabba9603b3f7d9c8b9e4a7fbf3d6b6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ecdc2754d7d2ae862272153aa9b9ca6e

SHA1
c19bed1c6e1c998b9fa93298639ad7961339147d

SHA256
a13d791473f836edcab0e93451ce7b7182efbbc54261b2b5644d319e047a00a7

SHA512
cd4fb81317d540f8b15f1495a381bb6f0f129b8923a7c06e4b5cf777d2625c30304aee6cc68aa20479e08d84e5030b43fbe93e479602400334dfdd7297f702f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
3dbdf6e678e6c45c1b413f2e82cbac36

SHA1
f2d1a31139629904b19b5444c34f7437dc4c616f

SHA256
c77143e9376960b48e617987dfcaed37d89f744abb5ab4e35dfa2b7c3735ffaa

SHA512
f73e2870b9f3dd6a037b140dbee7aa3f482f8539d2e3d8e9115b0e6d831105a89327e2645ae0970a53e5082eb9709ce647de4fe41b9aff339740b3971de2670a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
579B

MD5
ca3dac1178d10a645e836551a65b0332

SHA1
7fb32ae3ca77810f51265946218125ec1d7e49c6

SHA256
0fa377dfa78c020268face14a750666536e8ba935ac2275ca4c78bacb4d98c16

SHA512
bb5e66de5fe780b39a2521fd628e30fc9a227476bf15c80279cd03240f825e27fce96cd4c9b1ad9f5d72be49b867f9b2b319c45f4822cf01679aedf5c136efbe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
8c5164d91f68f99464577143c39c5a52

SHA1
ad9512a89f35b14b6f382d81b3dd69726f5e68e3

SHA256
9e3b9527b9d54fd6a14d7baa37f58da05a29f78195248f97c54b77ab31cb7911

SHA512
a53481c46484dd05c168f96759b185aa0a2577280eb4589bfa4acc8aff6b5848b47a3fd6334f16799eae55fe8f7c30bc640eb24e4b6434cb80746a2ce9185141

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3a1e1b4f151ac65a74c951cccabccc5e

SHA1
d72e2b1815342f63e64b1502f15bf9f381bec2a6

SHA256
32e199d4fdf77ea0757250a6451304369973aae5f2749d848b1d00b6bfd5ca95

SHA512
5d515af18fe9cea258706de2257715cb66f1212dd013d7604413bb65073fe485db259567bae66a50ed9b22b42a86db82c3725f6c8084dbe501b961d7952a46a3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e6e53111859c39615d31ee1b2d6746e7

SHA1
2d59f5da5af9be3709e51389198e0f22b33279a9

SHA256
751613e5bc74a1cd84e9f8c5c992f972fae6170d93bfbb479f9393a28ffa9a90

SHA512
32063fae524bd45f0b59c483aa0cdeb3e81e3a5198b4bc86406a68da540b6d75e70e04eff0343d779001425ef591615a6939c7aa28fde5e958ae478e84dc25c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
5bad03073845c71b43a7e185efec5e61

SHA1
6ee3da45a07f2465468fb3817400a9f9f1035450

SHA256
f86b31eda1381cf6550fbfe5c9660783cf93bc44a558c94d5ce95f0ff4a8e314

SHA512
2b4d76ccf0fb6a6eccaacdd7f121a978b8f5a92779c2939c931128b256373178303514e04e81092957350658bdb6199a0c7ee8650af78e60af7d37aeb4ff6b1d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
8c219f843ca9efb253ae01f126fdfd71

SHA1
bb58a35810919c2c872804df0f011007b8cfabb0

SHA256
b0d6752f8bb53d00c95e8740ead155caab0517a36fca1bfc742fff7867929df8

SHA512
8a30daa36faae7068afbbc33d7059d41405be4533b423863765ccb272060df26cda34b71c88dbef0447d1b821bb9bd776a55bc860f7cc9bd542992b404bd394b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
aebf048527ce98f90c38e806bd41da5b

SHA1
5e47513659a6df483064f001a9314a66539f31bb

SHA256
6fd78d7010ba0a7c7810ff0dd49a7717acaafb818bec8e8792bf661e4d96e73a

SHA512
bc451b9c35f87e28b556aade8426a98a49b107730850f66d54148ef6bd7bebb5c168bd8b57c85d0c72082ed8a30487324b5c34db2e6278ee7377c748ad1bd50d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
57371ded29fa5f63b6b3e459de25da7e

SHA1
027761ffe5c2fa67eb5c20e8c0a5fae19e1b1fc2

SHA256
dc31210063364d0ab47b802cca09d6f32024f6e637ec2f285575e2c1b00212bc

SHA512
a0dfa9432086a309c14a3066a00a2afc0d8dd62c44394887ffdcd8ddd6ca3abf21da9f5c07d43084df364ee015925ba584d06314b02bb0968614ff3e2778aa92

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
874B

MD5
0754d4cf367cf4f0e8519f11112d3c98

SHA1
c8208d1613696dc89749de34f11f2c5e60f633c8

SHA256
8335749e98768c6462d40323568ae964312dfaa168c977ef33e91ac64e5182e5

SHA512
8bf71167f02dd7fa36e5fbb01571c0ded7badaddf431ea6aa888951faebe47663c7ba4a5b1c016a6c439ba4f9b752cff543e09871af8c1e8882414547b2ad521

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
0180a0a0c1aba08c48951fdcdbd0cf8e

SHA1
b21be06f3b86bb34dbcf8eda738b21d22c19fa90

SHA256
c9f35b6ceb30ffb343cbc0d8c65e8adc593e7c8af1064357a54d8958ee07504f

SHA512
d727f55be6dd9955edfb6f8b44e50c2eb04f5c542972fc590995660c1c29fb82a480d0232b456d42b71967207a727b91b595edf27131806532663ca6ab1417de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
b51461a7ecb92fa87278e698d21e0301

SHA1
2fd4b56836f15dbea7b0c15b1adb60334104408d

SHA256
83e7ece906cb6a9d0e4cce4e8bbdab4f8862e024113e7cc382c53e645a870c8a

SHA512
83dafa195e5dbf36dcdacf7b7144dba9ff4d24fcfc7e3014f5fccd0c16ecde63a2a9b011161bfa27d95406869985b75d812e6504ff2e3c178d719df807516592

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
874B

MD5
a708cc4d86059bc365860138c5f0ea7e

SHA1
c8cdfadfe33fdbda572acd9ededfc6c48ec72df7

SHA256
334dbd21843c70006c38d53191750db796fb1708d9d5303e5f621f272ea83610

SHA512
0e54566a5076853b55b59d14d5c4045cda799ca73176e197408feb44c3da8b098b7f9bd91488d4af227c526955420ac67e5b8a838aad1113087eddb2e180f91c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe578760.TMP

Filesize
874B

MD5
fe6f6d5586ee01f871e21a8862da8cea

SHA1
8d1d6c750b8721547cc86e4a7058dce9737726ec

SHA256
808ae3aee09afb692e1c7453f2b9d94e221166a37c4476958a666c13f821c6a2

SHA512
e579c9a0d3619f478059816a4b7718f25e4fcd8eaed051e69df9bf0388a1856dde3941f13b609afd153a995f25fcee253958be08000a3870d3acfe69c2cf715b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
21637005153a7df239639e2af3865e40

SHA1
d42644bd9a59ea474e59592bf67a048c5417e21b

SHA256
400f969cb9dc3f9e0c3d6136e4527cc139252bf0496535003ff16db6b44cbfa0

SHA512
c15a2edcf9c49ca49e0aa980f8798a96945a24eebae97dbb30bc0b7b9b31b8a093ed422ab342f2ad1c040109dae23ccf63826aa4c3afc44bdb00fdfef7feec67

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
bb05f9dc86ab1967b44aee7e6e656025

SHA1
fe2562ceb9441b3a4e89dcf6e033468525239677

SHA256
8d576f0a3d875ba5879810dc56fdec4cfd7a04ca709374528ef59bdb0fe8b6f2

SHA512
626ad53b178926e617f97c9747a060677cc632c2f33f3dc001feaf2048855ddbc891c0f58022bb1bab36446964c7990738daeac69d412570bc1af57ecb101981

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
639be8c3a9aa9b5b379794fe5d1a96df

SHA1
db7de7bab7302f0bdee3d59cd61dae477d23a588

SHA256
5924beefdcd8b76b9f7a82f1f2c00e5cd16f31ce736490bd09a2d6bc3891a8e4

SHA512
c8dfc8c8acf82c7df2af20fd8f8fffa1888b4f5258f1888b22d0b70643b6569e96cb553d99479eaf18f5f12d29fa5822f6f8c50a8d66aa801d9b33225f11c54e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
6219cd010a389aa99f7e466d49864a88

SHA1
54948e6f00919d82ca748bd3cd7f912ddb1dd9d3

SHA256
dd0a43f032da80dc8f015c6385fc1bbac7e594ce434e4f890b38623e357b54e0

SHA512
9c783cc22b1516f1176e1d0731843283228851ae457d47b814ae42ed2b82fc30eaa7c972581cc20eaa81b7742de1bd6d626c8ffaf019064f82d5bd035f4c433f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
d7f291e43a6ad356e10bcc2bf1a48c56

SHA1
c64ce90545af6d9ff88b22d3b8409668f92473bf

SHA256
204d476d4ade4a52985ed3de2c31796bceae402dbc4d367b403e7b89c9bc242d

SHA512
16fdf9c6b4dc0ebe6eb693886181e5c89ba7b2d9c2bcd2c33c7456127545fa27d4efa5a329807759d7c8cb71f96812bf2aa4f53fef3b1c49ee90885b01166b85

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
423b4736ccf758c8459b450fc7c27fd9

SHA1
facc66fd35eb4ea8c753628b182d6b50272408b9

SHA256
ce16233ee97945064a1d1ec9200e35810916a621f884af6a6672535aa2f8fc53

SHA512
b86ceeab25b5078446a2a273298399179ab27eb5bb3ab791e0bf5930903434eda60f82680cf1709f1bc9e6e9ec3ec62b60f7f898d3c3716a2cdb1b687e58c577

Download Submit
C:\Users\Admin\Downloads\Bumerang.exe

Filesize
4KB

MD5
0447366545adfa485ad3014da2ef9ad5

SHA1
70bd1a6f4fa30394295f70305c712a332745f52a

SHA256
45a0f14ccc04d8edd3d3a03ec63585b7b9d5571c51d601242dd88b84f7d92daa

SHA512
285330df8f190c4d25b59f5c8ff38d25f66f85e89be0e74059288669790d516223734e4582d3ee2e8c410cb86058f79ccbc6d9df607ccfe4951ef473e2651aac

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 248080.crdownload

Filesize
28KB

MD5
8e9d7feb3b955e6def8365fd83007080

SHA1
df7522e270506b1a2c874700a9beeb9d3d233e23

SHA256
94d2b1da2c4ce7db94ee9603bc2f81386032687e7c664aff6460ba0f5dac0022

SHA512
4157a5628dc7f47489be2c30dbf2b14458a813eb66e942bba881615c101df25001c09afb9a54f88831fa4c1858f42d897f8f55fbf6b4c1a82d2509bd52ba1536

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 275318.crdownload

Filesize
116KB

MD5
41789c704a0eecfdd0048b4b4193e752

SHA1
fb1e8385691fa3293b7cbfb9b2656cf09f20e722

SHA256
b2dcfdf9e7b09f2aa5004668370e77982963ace820e7285b2e264a294441da23

SHA512
76391ac85fdc3be75441fcd6e19bed08b807d3946c7281c647f16a3be5388f7be307e6323fac8502430a4a6d800d52a88709592a49011ecc89de4f19102435ea

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 275318.crdownload:SmartScreen

Filesize
7B

MD5
4047530ecbc0170039e76fe1657bdb01

SHA1
32db7d5e662ebccdd1d71de285f907e3a1c68ac5

SHA256
82254025d1b98d60044d3aeb7c56eed7c61c07c3e30534d6e05dab9d6c326750

SHA512
8f002af3f4ed2b3dfb4ed8273318d160152da50ee4842c9f5d9915f50a3e643952494699c4258e6af993dc6e1695d0dc3db6d23f4d93c26b0bc6a20f4b4f336e

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 31667.crdownload

Filesize
26KB

MD5
b6c78677b83c0a5b02f48648a9b8e86d

SHA1
0d90c40d2e9e8c58c1dafb528d6eab45e15fda81

SHA256
706fce69fea67622b03fafb51ece076c1fdd38892318f8cce9f2ec80aabca822

SHA512
302acca8c5dd310f86b65104f7accd290014e38d354e97e4ffafe1702b0a13b90e4823c274b51bcc9285419e69ff7111343ac0a64fd3c8b67c48d7bbd382337b

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 63054.crdownload

Filesize
315KB

MD5
9f8bc96c96d43ecb69f883388d228754

SHA1
61ed25a706afa2f6684bb4d64f69c5fb29d20953

SHA256
7d373ccb96d1dbb1856ef31afa87c2112a0c1795a796ab01cb154700288afec5

SHA512
550a891c1059f58aa983138caf65a7ea9c326cb1b94c15f3e7594128f6e9f1295b9c2dbc0925637dba7c94e938083fffc6a63dc7c2e5b1e247679931cce505c6

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 938917.crdownload

Filesize
431KB

MD5
fbbdc39af1139aebba4da004475e8839

SHA1
de5c8d858e6e41da715dca1c019df0bfb92d32c0

SHA256
630325cac09ac3fab908f903e3b00d0dadd5fdaa0875ed8496fcbb97a558d0da

SHA512
74eca8c01de215b33d5ceea1fda3f3bef96b513f58a750dba04b0de36f7ef4f7846a6431d52879ca0d8641bfd504d4721a9a96fa2e18c6888fd67fa77686af87

Download Submit
C:\Windows\4992.tmp

Filesize
60KB

MD5
347ac3b6b791054de3e5720a7144a977

SHA1
413eba3973a15c1a6429d9f170f3e8287f98c21c

SHA256
301b905eb98d8d6bb559c04bbda26628a942b2c4107c07a02e8f753bdcfe347c

SHA512
9a399916bc681964af1e1061bc0a8e2926307642557539ad587ce6f9b5ef93bdf1820fe5d7b5ffe5f0bb38e5b4dc6add213ba04048c0c7c264646375fcd01787

Download Submit
C:\Windows\SysWOW64\ddraw32.dll

Filesize
22KB

MD5
f1ac5c806ed1e188c54e0861cbf1f358

SHA1
b2a2895a0eae5e2ef8d10ed0f079d0fcfea9585a

SHA256
87b7d23ab8720f1087d50a902244cbbdc25245b29da9bfa54698a4545b82afc4

SHA512
ddb61b46a71db7401984e1917f0ef1498883cff76f0a98ff8d65acb08b6d7181511ca57a1e23c7482fc9d26afcf48b662896375b80eff4b2e0d08b7b55d9b98f

Download Submit
C:\Windows\infpub.dat

Filesize
401KB

MD5
1d724f95c61f1055f0d02c2154bbccd3

SHA1
79116fe99f2b421c52ef64097f0f39b815b20907

SHA256
579fd8a0385482fb4c789561a30b09f25671e86422f40ef5cca2036b28f99648

SHA512
f2d7b018d1516df1c97cfff5507957c75c6d9bf8e2ce52ae0052706f4ec62f13eba6d7be17e6ad2b693fdd58e1fd091c37f17bd2b948cdcd9b95b4ad428c0113

Download Submit
memory/2368-365-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/2368-339-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/2684-336-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/2684-494-0x0000000002210000-0x0000000002278000-memory.dmp

Filesize
416KB

Download
memory/2684-486-0x0000000002210000-0x0000000002278000-memory.dmp

Filesize
416KB

Download
memory/2684-330-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/3300-606-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/3300-607-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/3300-631-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/3300-642-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/3716-457-0x0000000001520000-0x0000000001588000-memory.dmp

Filesize
416KB

Download
memory/3716-445-0x0000000001520000-0x0000000001588000-memory.dmp

Filesize
416KB

Download
memory/3716-437-0x0000000001520000-0x0000000001588000-memory.dmp

Filesize
416KB

Download
memory/4572-340-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/4572-341-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download