badrabbit | hxxps://github[.]com/Endermanch/MalwareDatabase

max time kernel
146s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
02-08-2024 22:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/Endermanch/MalwareDatabase

Score

10^/10

badrabbit mimikatz discovery ransomware

Malware Config

Signatures

BadRabbit
Ransomware family discovered in late 2017, mainly targeting Russia and Ukraine.
ransomware badrabbit
Mimikatz
mimikatz is an open source tool to dump credentials on Windows.
mimikatz

mimikatz is an open source tool to dump credentials on Windows 1 IoCs

resource	yara_rule
behavioral1/files/0x00070000000234c2-271.dat	mimikatz

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LOGON.exe	[email protected]

Executes dropped EXE 2 IoCs

pid	Process
4576	D97.tmp
2336	Fantom.exe

Loads dropped DLL 1 IoCs

pid	Process
536	rundll32.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
46	raw.githubusercontent.com
47	raw.githubusercontent.com
48	raw.githubusercontent.com

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\System32\DriverStore\FileRepository\display.inf_amd64_71aa85b0e2292a7a\display.PNF	chrome.exe
File created	\??\c:\windows\system32\driverstore\filerepository\display.inf_amd64_71aa85b0e2292a7a\display.PNF	chrome.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\cscc.dat	rundll32.exe
File created	C:\Windows\dispci.exe	rundll32.exe
File opened for modification	C:\Windows\D97.tmp	rundll32.exe
File created	C:\Windows\infpub.dat	[email protected]
File opened for modification	C:\Windows\infpub.dat	rundll32.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fantom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	[email protected]

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe

Modifies data under HKEY_USERS 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 34 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\WorkFolders	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{885A186E-A440-4ADA-812B-DB871B942259}	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{885A186E-A440-4ADA-812B-DB871B942259}\Rev = "0"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Downloads"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616209"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0000000001000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616193"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{885A186E-A440-4ADA-812B-DB871B942259}\Vid = "{137E7700-3573-11CF-AE69-08002B2E1262}"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0100000000000000ffffffff	explorer.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4476	schtasks.exe
4724	schtasks.exe

Suspicious behavior: AddClipboardFormatListener 3 IoCs

pid	Process
3984	explorer.exe
3984	explorer.exe
3984	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
544	chrome.exe
544	chrome.exe
536	rundll32.exe
536	rundll32.exe
536	rundll32.exe
536	rundll32.exe
4576	D97.tmp
4576	D97.tmp
4576	D97.tmp
4576	D97.tmp
4576	D97.tmp
4576	D97.tmp
4576	D97.tmp
2492	[email protected]
2492	[email protected]
2492	[email protected]
2492	[email protected]
2492	[email protected]
2492	[email protected]
2492	[email protected]
2492	[email protected]
2492	[email protected]
2492	[email protected]
2492	[email protected]
2492	[email protected]
2492	[email protected]
2492	[email protected]
2492	[email protected]
2492	[email protected]
2492	[email protected]
2492	[email protected]
2492	[email protected]
2492	[email protected]
2492	[email protected]
2492	[email protected]
2492	[email protected]
2492	[email protected]
2492	[email protected]
2492	[email protected]
2492	[email protected]
2492	[email protected]
2492	[email protected]
2492	[email protected]
2492	[email protected]
2492	[email protected]
2492	[email protected]
2492	[email protected]
2492	[email protected]
2492	[email protected]
2492	[email protected]
2492	[email protected]
2492	[email protected]
2492	[email protected]
2492	[email protected]
2492	[email protected]
2492	[email protected]
2492	[email protected]
2492	[email protected]
2492	[email protected]
2492	[email protected]
2492	[email protected]
2492	[email protected]
2492	[email protected]
2492	[email protected]

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3984	explorer.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
544	chrome.exe
544	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	544	chrome.exe
Token: SeCreatePagefilePrivilege	544	chrome.exe
Token: SeShutdownPrivilege	544	chrome.exe
Token: SeCreatePagefilePrivilege	544	chrome.exe
Token: SeShutdownPrivilege	544	chrome.exe
Token: SeCreatePagefilePrivilege	544	chrome.exe
Token: SeShutdownPrivilege	544	chrome.exe
Token: SeCreatePagefilePrivilege	544	chrome.exe
Token: SeShutdownPrivilege	544	chrome.exe
Token: SeCreatePagefilePrivilege	544	chrome.exe
Token: SeShutdownPrivilege	544	chrome.exe
Token: SeCreatePagefilePrivilege	544	chrome.exe
Token: SeShutdownPrivilege	544	chrome.exe
Token: SeCreatePagefilePrivilege	544	chrome.exe
Token: SeShutdownPrivilege	544	chrome.exe
Token: SeCreatePagefilePrivilege	544	chrome.exe
Token: SeShutdownPrivilege	544	chrome.exe
Token: SeCreatePagefilePrivilege	544	chrome.exe
Token: SeShutdownPrivilege	544	chrome.exe
Token: SeCreatePagefilePrivilege	544	chrome.exe
Token: SeShutdownPrivilege	544	chrome.exe
Token: SeCreatePagefilePrivilege	544	chrome.exe
Token: SeShutdownPrivilege	544	chrome.exe
Token: SeCreatePagefilePrivilege	544	chrome.exe
Token: SeShutdownPrivilege	544	chrome.exe
Token: SeCreatePagefilePrivilege	544	chrome.exe
Token: SeShutdownPrivilege	544	chrome.exe
Token: SeCreatePagefilePrivilege	544	chrome.exe
Token: SeShutdownPrivilege	544	chrome.exe
Token: SeCreatePagefilePrivilege	544	chrome.exe
Token: SeShutdownPrivilege	544	chrome.exe
Token: SeCreatePagefilePrivilege	544	chrome.exe
Token: SeShutdownPrivilege	544	chrome.exe
Token: SeCreatePagefilePrivilege	544	chrome.exe
Token: SeShutdownPrivilege	544	chrome.exe
Token: SeCreatePagefilePrivilege	544	chrome.exe
Token: SeShutdownPrivilege	544	chrome.exe
Token: SeCreatePagefilePrivilege	544	chrome.exe
Token: SeShutdownPrivilege	544	chrome.exe
Token: SeCreatePagefilePrivilege	544	chrome.exe
Token: SeShutdownPrivilege	544	chrome.exe
Token: SeCreatePagefilePrivilege	544	chrome.exe
Token: SeShutdownPrivilege	544	chrome.exe
Token: SeCreatePagefilePrivilege	544	chrome.exe
Token: SeShutdownPrivilege	544	chrome.exe
Token: SeCreatePagefilePrivilege	544	chrome.exe
Token: SeShutdownPrivilege	544	chrome.exe
Token: SeCreatePagefilePrivilege	544	chrome.exe
Token: SeShutdownPrivilege	536	rundll32.exe
Token: SeDebugPrivilege	536	rundll32.exe
Token: SeTcbPrivilege	536	rundll32.exe
Token: SeShutdownPrivilege	544	chrome.exe
Token: SeCreatePagefilePrivilege	544	chrome.exe
Token: SeShutdownPrivilege	544	chrome.exe
Token: SeCreatePagefilePrivilege	544	chrome.exe
Token: SeDebugPrivilege	4576	D97.tmp
Token: SeShutdownPrivilege	544	chrome.exe
Token: SeCreatePagefilePrivilege	544	chrome.exe
Token: SeShutdownPrivilege	544	chrome.exe
Token: SeCreatePagefilePrivilege	544	chrome.exe
Token: SeShutdownPrivilege	544	chrome.exe
Token: SeCreatePagefilePrivilege	544	chrome.exe
Token: SeShutdownPrivilege	544	chrome.exe
Token: SeCreatePagefilePrivilege	544	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
2492	[email protected]
2492	[email protected]
2492	[email protected]
2492	[email protected]
2492	[email protected]
2492	[email protected]
2492	[email protected]
2492	[email protected]
2492	[email protected]
2492	[email protected]
2492	[email protected]
2492	[email protected]
2492	[email protected]
2492	[email protected]
2492	[email protected]
2492	[email protected]
2492	[email protected]
2492	[email protected]
2492	[email protected]
2492	[email protected]
2492	[email protected]
2492	[email protected]
2492	[email protected]
2492	[email protected]

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3984	explorer.exe
3984	explorer.exe
3984	explorer.exe
3984	explorer.exe
3984	explorer.exe
3984	explorer.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 544 wrote to memory of 5044	544	chrome.exe	82
PID 544 wrote to memory of 5044	544	chrome.exe	82
PID 544 wrote to memory of 2400	544	chrome.exe	85
PID 544 wrote to memory of 2400	544	chrome.exe	85
PID 544 wrote to memory of 2400	544	chrome.exe	85
PID 544 wrote to memory of 2400	544	chrome.exe	85
PID 544 wrote to memory of 2400	544	chrome.exe	85
PID 544 wrote to memory of 2400	544	chrome.exe	85
PID 544 wrote to memory of 2400	544	chrome.exe	85
PID 544 wrote to memory of 2400	544	chrome.exe	85
PID 544 wrote to memory of 2400	544	chrome.exe	85
PID 544 wrote to memory of 2400	544	chrome.exe	85
PID 544 wrote to memory of 2400	544	chrome.exe	85
PID 544 wrote to memory of 2400	544	chrome.exe	85
PID 544 wrote to memory of 2400	544	chrome.exe	85
PID 544 wrote to memory of 2400	544	chrome.exe	85
PID 544 wrote to memory of 2400	544	chrome.exe	85
PID 544 wrote to memory of 2400	544	chrome.exe	85
PID 544 wrote to memory of 2400	544	chrome.exe	85
PID 544 wrote to memory of 2400	544	chrome.exe	85
PID 544 wrote to memory of 2400	544	chrome.exe	85
PID 544 wrote to memory of 2400	544	chrome.exe	85
PID 544 wrote to memory of 2400	544	chrome.exe	85
PID 544 wrote to memory of 2400	544	chrome.exe	85
PID 544 wrote to memory of 2400	544	chrome.exe	85
PID 544 wrote to memory of 2400	544	chrome.exe	85
PID 544 wrote to memory of 2400	544	chrome.exe	85
PID 544 wrote to memory of 2400	544	chrome.exe	85
PID 544 wrote to memory of 2400	544	chrome.exe	85
PID 544 wrote to memory of 2400	544	chrome.exe	85
PID 544 wrote to memory of 2400	544	chrome.exe	85
PID 544 wrote to memory of 2400	544	chrome.exe	85
PID 544 wrote to memory of 4016	544	chrome.exe	86
PID 544 wrote to memory of 4016	544	chrome.exe	86
PID 544 wrote to memory of 2836	544	chrome.exe	87
PID 544 wrote to memory of 2836	544	chrome.exe	87
PID 544 wrote to memory of 2836	544	chrome.exe	87
PID 544 wrote to memory of 2836	544	chrome.exe	87
PID 544 wrote to memory of 2836	544	chrome.exe	87
PID 544 wrote to memory of 2836	544	chrome.exe	87
PID 544 wrote to memory of 2836	544	chrome.exe	87
PID 544 wrote to memory of 2836	544	chrome.exe	87
PID 544 wrote to memory of 2836	544	chrome.exe	87
PID 544 wrote to memory of 2836	544	chrome.exe	87
PID 544 wrote to memory of 2836	544	chrome.exe	87
PID 544 wrote to memory of 2836	544	chrome.exe	87
PID 544 wrote to memory of 2836	544	chrome.exe	87
PID 544 wrote to memory of 2836	544	chrome.exe	87
PID 544 wrote to memory of 2836	544	chrome.exe	87
PID 544 wrote to memory of 2836	544	chrome.exe	87
PID 544 wrote to memory of 2836	544	chrome.exe	87
PID 544 wrote to memory of 2836	544	chrome.exe	87
PID 544 wrote to memory of 2836	544	chrome.exe	87
PID 544 wrote to memory of 2836	544	chrome.exe	87
PID 544 wrote to memory of 2836	544	chrome.exe	87
PID 544 wrote to memory of 2836	544	chrome.exe	87
PID 544 wrote to memory of 2836	544	chrome.exe	87
PID 544 wrote to memory of 2836	544	chrome.exe	87
PID 544 wrote to memory of 2836	544	chrome.exe	87
PID 544 wrote to memory of 2836	544	chrome.exe	87
PID 544 wrote to memory of 2836	544	chrome.exe	87
PID 544 wrote to memory of 2836	544	chrome.exe	87
PID 544 wrote to memory of 2836	544	chrome.exe	87
PID 544 wrote to memory of 2836	544	chrome.exe	87

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/Endermanch/MalwareDatabase
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:544
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffa23a8cc40,0x7ffa23a8cc4c,0x7ffa23a8cc58
  2⤵
  PID:5044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2080,i,11669998245681530933,1307636825687989088,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2076 /prefetch:2
  2⤵
  PID:2400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2008,i,11669998245681530933,1307636825687989088,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2472 /prefetch:3
  2⤵
  PID:4016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2128,i,11669998245681530933,1307636825687989088,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2576 /prefetch:8
  2⤵
  PID:2836
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3124,i,11669998245681530933,1307636825687989088,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3152 /prefetch:1
  2⤵
  PID:4568
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3140,i,11669998245681530933,1307636825687989088,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:2992
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4704,i,11669998245681530933,1307636825687989088,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4876 /prefetch:8
  2⤵
  PID:452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4964,i,11669998245681530933,1307636825687989088,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4984 /prefetch:8
  2⤵
  PID:400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4972,i,11669998245681530933,1307636825687989088,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5056 /prefetch:8
  2⤵
  PID:2116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5392,i,11669998245681530933,1307636825687989088,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5440 /prefetch:8
  2⤵
  PID:3076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=5152,i,11669998245681530933,1307636825687989088,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5356 /prefetch:8
  2⤵
  - Drops file in System32 directory
  PID:3904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5472,i,11669998245681530933,1307636825687989088,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5420 /prefetch:8
  2⤵
  PID:3932

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:1320

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5024

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3664

C:\Users\Admin\AppData\Local\Temp\Temp1_BadRabbit.zip\[email protected]
"C:\Users\Admin\AppData\Local\Temp\Temp1_BadRabbit.zip\[email protected]"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2276
- C:\Windows\SysWOW64\rundll32.exe
  C:\Windows\system32\rundll32.exe C:\Windows\infpub.dat,#1 15
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:536
- - C:\Windows\SysWOW64\cmd.exe
    /c schtasks /Delete /F /TN rhaegal
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1676
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /Delete /F /TN rhaegal
      4⤵
      System Location Discovery: System Language Discovery
      PID:4876
- - C:\Windows\SysWOW64\cmd.exe
    /c schtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR "C:\Windows\system32\cmd.exe /C Start \"\" \"C:\Windows\dispci.exe\" -id 131092444 && exit"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:860
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR "C:\Windows\system32\cmd.exe /C Start \"\" \"C:\Windows\dispci.exe\" -id 131092444 && exit"
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:4476
- - C:\Windows\SysWOW64\cmd.exe
    /c schtasks /Create /SC once /TN drogon /RU SYSTEM /TR "C:\Windows\system32\shutdown.exe /r /t 0 /f" /ST 23:03:00
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2412
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /Create /SC once /TN drogon /RU SYSTEM /TR "C:\Windows\system32\shutdown.exe /r /t 0 /f" /ST 23:03:00
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:4724
- - C:\Windows\D97.tmp
    "C:\Windows\D97.tmp" \\.\pipe\{3AB6C2E6-CE8B-4C5B-932C-0E02A8B9B649}
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4576

C:\Users\Admin\AppData\Local\Temp\Temp1_DeriaLock.zip\[email protected]
"C:\Users\Admin\AppData\Local\Temp\Temp1_DeriaLock.zip\[email protected]"
1⤵
- Drops startup file
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
PID:2492

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:3952

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding
1⤵
PID:2456

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{682159d9-c321-47ca-b3f1-30e36b2ec8b9} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3984
- C:\Users\Admin\AppData\Local\Temp\Temp1_Fantom.zip\Fantom.exe
  "C:\Users\Admin\AppData\Local\Temp\Temp1_Fantom.zip\Fantom.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2336

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {3eef301f-b596-4c0b-bd92-013beafce793} -Embedding
1⤵
PID:5100

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
- Modifies registry class
PID:800

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000013

Filesize
198KB

MD5
3500896b86e96031cf27527cb2bbce40

SHA1
77ad023a9ea211fa01413ecd3033773698168a9c

SHA256
7b8e6ac4d63a4d8515200807fbd3a2bd46ac77df64300e5f19508af0d54d2be6

SHA512
3aaeeb40471a639619a6022d8cfc308ee5898e7ce0646b36dd21c3946feb3476b51ed8dfdf92e836d77c8e8f7214129c3283ad05c3d868e1027cb8ce8aa01884

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
e6e77111da0a6beb4a63c4894bfd482a

SHA1
77fbcd48ff2f132b14dbab08053a8a859c8e351e

SHA256
1b4965487f3ae27efa1362fbd0c0988c43a0a63935696a21ea76baa4195e9dcf

SHA512
737f13b1dbf7db5a032b05e6dab9418a542a4d364fdfa91b9b1e65bf7f317bf7c2b2931792a27eb9a1d2a673885da1c6b1f5b2b65d73b5cef10d202e19d76d73

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
25ed562722370707971cbff133fbf58b

SHA1
6485ea6a4120c6bcb892ba5288925e86833de83c

SHA256
f65a32a28b51929829303a0c42a046c509df36dc3cbb329eb7b494e9cca3d695

SHA512
449848dc1df6e2f9c8c0d7c6d5d7b241f473a4fcf157154f4d0c3d6266aa3f8665aeb314c46c1625bed89ca6c9a4b25ecb58567fb563dbfcbb436cf2f0b938de

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
da870398d3ad27188e0bc9f547eb6d31

SHA1
6a239c8bd20b32beb5b10ec95ca9f2c6f683297f

SHA256
ead3d1d38c27b55024652208943e06377b7e855184fd1795f8bc5bf6d1621c32

SHA512
66c920630c9c495320d437253a96e35e67dab5f2e6af1aec683d9661656245ae4a93e92ca88170384836a4ea9ba3f92fbf98fe751d5548e0cfa1719507451742

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
fb7657836541f272a5c72c99146d6960

SHA1
9c4d8114afb6255a916e0c4f677a45d47edf53d0

SHA256
da8aca767a40850f3b5bba127e628e90d42c1660463b51eefbcb8a8339bcd526

SHA512
dfe1a7354f6cfe5567ec6cfcb9407f6738c014880d5671089a3b076416dba5bf43e8b3b576e04d2a8c2d948e91a070d9e3c54a8ff008f312f1e50aee6f7abd4f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
8ae54bce1e10bf88021b84ea8f1e96b0

SHA1
6f73c1b9b950a1b1b7e74b62ac08bcb3207cfd80

SHA256
80af68a6c38ede26fcac728bfa0345eeae07dbd98d3809c080db60e5e9bb44e8

SHA512
4735388122c39ad82d20931ccd7d86ac093b35309d2c6dcfa454a11997a11602e77c211ded127e459ae583369540294cf3b74a9ade4b5d7c84c9574611be4a53

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
e4e72b2d80718d5a8fe57d86fa1076e9

SHA1
244766e067e6d854a1918607ce9aa8530d7b3fcd

SHA256
677847c11d12a14ca9a4be9a08788196e5a7c8c7dc214390641806d323bceeb3

SHA512
94b7d1bf74f535433d3f35e46f75db4675c8f369013618fdbba9b188cf1f51546b9acbb3b6127cf40136560583476fdc6a89d9ce6e2fe67c63aa7079d82d8e58

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
328e16342de5caace1f7557ed99171b2

SHA1
2d8482bd71f3ca3917c60458ff6f741c3c128128

SHA256
9e830bdc9769ad623d5f4109f0ad0caddcb87a8a9309d9a55eeba95d98befe4f

SHA512
283a35a9ef69909ca9491c809cc8a6ccfdb74a73d8ebaa86a9769de00cdc21e50ac6a248204519ec601859d8e516743f3f89d9c843a151d8b8bf97d2573e8878

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
38df5e9085bd624cf26f128a5a469fef

SHA1
2dd35d30f11ff1b6493e4370ab620bb90631d8bf

SHA256
262e1bfeab7c9a2e06d8edeeec49070c04cf247d2f02ef620a98d905946a6acd

SHA512
19c024f6606f3f5fda6172781d237b493a23c554be51935de96d8145887fb1b7233e760f88e46f02c29f9af5734ecf38538b9744b0c65a64e9ba41df5426832a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
a9084be284dd984c59f6ae0e15fd83c4

SHA1
78d99f4874e22cf13d0906cda840a68ad41c1949

SHA256
174360c94f16cfbf6a15c171a03d0b08740ca53e8cc75d624bc3e479f4f56b16

SHA512
bca6e0e441cfe3766087bed10374da9e815964c2800555e8724f5a74aa091a7199e4fc39497e7ca34215d215c4fa6796c90a89def18bf5e5604ef093b40f6dbb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
a3fd364e9fecb8117b18ac4cebea608d

SHA1
f9a6ae94dd1b6c69ef6b4d4e0ad937cad410ba6b

SHA256
38490101ec5666182a0deee48cce83b8c5742d38f16d5c3cd375935f38115d36

SHA512
06ef362f2cdbbd65c25acfb70fec739940ceef82507853bb34895776865378d22d633aed502b0f34eab9b247726a9b07efeed890a30468de15e36bf2f66e9650

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
e5cc3d48ab1c623006c641d638650983

SHA1
0bcf73e3e67e4da644a45ba12305870098571205

SHA256
ef6ea20691792071bf57acde36c4a451dfae4ff85599bab6f3e243136b0374bf

SHA512
0a5024553b8e8e3d529022a242ab46579a3d7dbfab1f8433dc178146f9e3316dc381809af31f73276043172a1b5d4036ff71b8a10122dfd1ab617892400d3410

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
42ce03a89af3963b82aace9ab7bb8354

SHA1
2248ce5847f060166631f8e1234da2443895c992

SHA256
1a736b0e6274b6864125708afa66704afa66cec19c292fa862125730506924ec

SHA512
9884427b4fa0fbd2658bf28ed520c8dc2a0424c65534812b04d48a0b2312f84febd8d934c82b932604364b9a2d00841f5e359d9fb8f5e95e3bc13e30ab88d82d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
8f4a22c3b7eb7dc8d1d56528c7d0864e

SHA1
08f254219f29a5c2aeb37cf0ecd5989559e788e1

SHA256
40d2d576be88cbf9548f4e81667f24f3048b4a9dd4ce53aca64be4ca638a21f9

SHA512
b84271a781052047ac98376a68f3977af029cde3a57bd2556f666ec282fa2207678ae6fcdd2487b893f92be6b70edbbea485ae31cdaa79a4f31019e6388c319e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
ac6314aef77e38aef4e73dc05f472356

SHA1
5fb495e52bd1f195f62e26de1ff5717333943b8b

SHA256
c3e08cfbcbf040b9025a4baddedde5fec18e69d0e195da965e3995f947a6f926

SHA512
1fbc28281c16161609f0fbe8b6d39605e9ca09f204dd1cad71f61092c8fcc3c0638cad9a0bd9246e8665296169cc988a1256de546e597d7d7a69300ad3138f75

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
221b67faa32b352f9b2c3f1e3c52511b

SHA1
b4c1dd9715be70aa08d0403199b619174e3b6844

SHA256
e14f2f4b88f0fccb55555b450b2e590e52987a96e037cf21962fd08c30e4d89b

SHA512
48829552cfd5a18b0465d570c3786c7b29ff983c9ad22e47ffa96c468f2ff9f9030d17f40b4fa555cda6ca780eff79faf6bbb0de374cb463c39c154788ba8769

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
a166cda66dec9dc1597a7df8a2981da3

SHA1
3478a500298f1bdc438791fbfbcde5f6812e63bf

SHA256
d8192e75ca03f5e243c2090879815682ca0c93eaf9eacd935525c2c1b1b30551

SHA512
7a05487d9c89c0a1688f2c044951a9835627bf78c6748b0a71d7d15ee5960a4d50cbab2c694805389a24d432fb33790e06b001f7cd6a25c7c79950ae64b9ab9e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
3621b51e3ced09ae8dae1c1a52ecd9b3

SHA1
f2321013c7b07f45ea22b66ddfec6cdf674fd97c

SHA256
4f6422019ebc3deb4f363e8bb48f5a9440f73728b812172f1e49559687f32560

SHA512
b60dc84cc854d852c42c8940e645676a57c6eed9fbfdd4897d0d34b3d7599be0188ad6544dcaec5e3391c07a22c155338f216f8deaba7c7a02e7e89b0992f550

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\cc84ee0b-0790-488a-b242-b797ef7a4034.tmp

Filesize
8KB

MD5
db153657a856875fa93ad2a34ae4159c

SHA1
d16b0285a948529ded5072137738108269d9ef26

SHA256
f5e86e8afb5e7a5714d3d897d3cb5b555e30958c0a55fcc5c903451802c6eb1b

SHA512
dbb915e8e24c9cbd0ba2b7a0e7b0d3e934ba0ac26a891aa0616f3d24f75e79eee50c123b78b11c9a56341fe6c36f23044f9fdb7329720c1155b1660832e39d3b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
99KB

MD5
bb1049a83a297194d6143507eaa7de8c

SHA1
6ee939c960b5a93bfef917c74a6657c3d3cbbee9

SHA256
f4db7fa145deb236b9ed709e4053b06b017add84e450f17d5c2882be1a694aae

SHA512
e81ebf294bed89a2d4e6eebbfdaea064e7f021b384fbaa13f664518911899bf031147b55c507ce0d0831426f09cd3e5655e30b72a28393912b66040abdb2f05e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
99KB

MD5
04c78e371f1269cd57fcefad7136b933

SHA1
6e4286794b56e537d2b5e3a74314e51cf9da3df4

SHA256
8255762930ec907413cffdb35dcdf8907553c24ffb74623b2f064d2b4c9f7b2e

SHA512
697b91c181a2e117a7161fee9e07a5add6e3110c8a614392c49101bd3d78465cb523df3562047fb298faea9562f3019d35ed8a4e7fb4f7b8ff57e8d2decfdc68

Download Submit
C:\Users\Admin\AppData\Local\Temp\Temp1_Fantom.zip\Fantom.exe

Filesize
261KB

MD5
7d80230df68ccba871815d68f016c282

SHA1
e10874c6108a26ceedfc84f50881824462b5b6b6

SHA256
f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b

SHA512
64d02b3e7ed82a64aaac1f74c34d6b6e6feaac665ca9c08911b93eddcec66595687024ec576e74ea09a1193ace3923969c75de8733859835fef45335cf265540

Download Submit
C:\Users\Admin\Downloads\BadRabbit.zip

Filesize
393KB

MD5
8472bddbee8581d484cb80ceb10a837a

SHA1
1eb020f7d580e893935eca3b53cb563003e66c83

SHA256
36a8790cf4c3f12daf7551e88c2d76cbca9d45746720104abad576d2d1d63cb6

SHA512
1a17bf14c73eb5ff614a904cfa7d51af2c5169a7b4382e8437f01aa5e3bbf32d7994e0fe7d8abdc975fb1df7550ac1d0d58433c75714bceece78bedc95842ecb

Download Submit
C:\Users\Admin\Downloads\BadRabbit.zip.crdownload

Filesize
393KB

MD5
61da9939db42e2c3007ece3f163e2d06

SHA1
4bd7e9098de61adecc1bdbd1a01490994d1905fb

SHA256
ea8ccb8b5ec36195af831001b3cc46caedfc61a6194e2568901e7685c57ceefa

SHA512
14d0bc14a10e5bd8022e7ab4a80f98600f84754c2c80e22a8e3d9f9555dde5bad056d925576b29fc1a37e73c6ebca693687b47317a469a7dfdc4ab0f3d97a63e

Download Submit
C:\Users\Admin\Downloads\DeriaLock.zip.crdownload

Filesize
210KB

MD5
016d1ca76d387ec75a64c6eb3dac9dd9

SHA1
b0a2b2d4d639c6bcc5b114b3fcbb56d7c7ddbcbe

SHA256
8037a333dfeca754a46e284b8c4b250127daef6d728834bf39497df03006e177

SHA512
f08653184d7caf48e971635699b17b9502addb33fb91cc6e0a563e6a000aeb57ac0a2edd5a9e21ef99a4770c0dbb65899150fa5842b0326976a299382f6be86e

Download Submit
C:\Users\Admin\Downloads\Krotten.zip

Filesize
25KB

MD5
1aea5ad85df3b14e216cc0200c708673

SHA1
e3ee16e93ba7c3d7286dc9ebbaf940f0bcb6cad3

SHA256
8dfa496c93680adc10e77c0946c7927d3e58d79900013c95dfca3411d766bd16

SHA512
06faa190350e4558c6d4f1f201dc0698587495897593aaeac16f3ea3d8c1c7f81d65beea6bc7e730ca1df9bdfdf3cd2bcc84bf50f64787e0b1dbd21492796f36

Download Submit
C:\Windows\D97.tmp

Filesize
60KB

MD5
347ac3b6b791054de3e5720a7144a977

SHA1
413eba3973a15c1a6429d9f170f3e8287f98c21c

SHA256
301b905eb98d8d6bb559c04bbda26628a942b2c4107c07a02e8f753bdcfe347c

SHA512
9a399916bc681964af1e1061bc0a8e2926307642557539ad587ce6f9b5ef93bdf1820fe5d7b5ffe5f0bb38e5b4dc6add213ba04048c0c7c264646375fcd01787

Download Submit
C:\Windows\infpub.dat

Filesize
401KB

MD5
1d724f95c61f1055f0d02c2154bbccd3

SHA1
79116fe99f2b421c52ef64097f0f39b815b20907

SHA256
579fd8a0385482fb4c789561a30b09f25671e86422f40ef5cca2036b28f99648

SHA512
f2d7b018d1516df1c97cfff5507957c75c6d9bf8e2ce52ae0052706f4ec62f13eba6d7be17e6ad2b693fdd58e1fd091c37f17bd2b948cdcd9b95b4ad428c0113

Download Submit
memory/536-265-0x00000000007C0000-0x0000000000828000-memory.dmp

Filesize
416KB

Download
memory/536-254-0x00000000007C0000-0x0000000000828000-memory.dmp

Filesize
416KB

Download
memory/536-262-0x00000000007C0000-0x0000000000828000-memory.dmp

Filesize
416KB

Download
memory/2336-652-0x0000000002620000-0x000000000264B000-memory.dmp

Filesize
172KB

Download
memory/2336-640-0x0000000002620000-0x000000000264B000-memory.dmp

Filesize
172KB

Download
memory/2336-627-0x00000000021A0000-0x00000000021D2000-memory.dmp

Filesize
200KB

Download
memory/2336-628-0x0000000002620000-0x0000000002652000-memory.dmp

Filesize
200KB

Download
memory/2336-654-0x0000000002620000-0x000000000264B000-memory.dmp

Filesize
172KB

Download
memory/2336-629-0x0000000002620000-0x000000000264B000-memory.dmp

Filesize
172KB

Download
memory/2336-650-0x0000000002620000-0x000000000264B000-memory.dmp

Filesize
172KB

Download
memory/2336-648-0x0000000002620000-0x000000000264B000-memory.dmp

Filesize
172KB

Download
memory/2336-646-0x0000000002620000-0x000000000264B000-memory.dmp

Filesize
172KB

Download
memory/2336-644-0x0000000002620000-0x000000000264B000-memory.dmp

Filesize
172KB

Download
memory/2336-642-0x0000000002620000-0x000000000264B000-memory.dmp

Filesize
172KB

Download
memory/2336-630-0x0000000002620000-0x000000000264B000-memory.dmp

Filesize
172KB

Download
memory/2336-638-0x0000000002620000-0x000000000264B000-memory.dmp

Filesize
172KB

Download
memory/2336-636-0x0000000002620000-0x000000000264B000-memory.dmp

Filesize
172KB

Download
memory/2336-635-0x0000000002620000-0x000000000264B000-memory.dmp

Filesize
172KB

Download
memory/2336-632-0x0000000002620000-0x000000000264B000-memory.dmp

Filesize
172KB

Download
memory/2492-341-0x00000000000F0000-0x0000000000172000-memory.dmp

Filesize
520KB

Download
memory/2492-353-0x0000000004BD0000-0x0000000004BDA000-memory.dmp

Filesize
40KB

Download
memory/2492-342-0x0000000004B30000-0x0000000004BCC000-memory.dmp

Filesize
624KB

Download
memory/2492-343-0x00000000051A0000-0x0000000005744000-memory.dmp

Filesize
5.6MB

Download
memory/2492-344-0x0000000004BF0000-0x0000000004C82000-memory.dmp

Filesize
584KB

Download
memory/2492-354-0x0000000004E30000-0x0000000004E86000-memory.dmp

Filesize
344KB

Download