badrabbit | hxxps://github[.]com/Endermanch/MalwareDatabase

Analysis

max time kernel
300s
max time network
300s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
03-08-2024 16:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/Endermanch/MalwareDatabase

Score

10^/10

badrabbit mimikatz discovery ransomware

Malware Config

Signatures

BadRabbit
Ransomware family discovered in late 2017, mainly targeting Russia and Ukraine.
ransomware badrabbit
Mimikatz
mimikatz is an open source tool to dump credentials on Windows.
mimikatz

mimikatz is an open source tool to dump credentials on Windows 1 IoCs

resource	yara_rule
behavioral1/files/0x000a000000023560-484.dat	mimikatz

Downloads MZ/PE file

Executes dropped EXE 1 IoCs

pid	Process
4328	2F3F.tmp

Loads dropped DLL 2 IoCs

pid	Process
5084	rundll32.exe
2980	rundll32.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
58	raw.githubusercontent.com
59	raw.githubusercontent.com

Drops file in Windows directory 7 IoCs

description	ioc	Process
File created	C:\Windows\infpub.dat	[email protected]
File opened for modification	C:\Windows\infpub.dat	rundll32.exe
File created	C:\Windows\cscc.dat	rundll32.exe
File created	C:\Windows\dispci.exe	rundll32.exe
File created	C:\Windows\infpub.dat	[email protected]
File opened for modification	C:\Windows\infpub.dat	rundll32.exe
File opened for modification	C:\Windows\2F3F.tmp	rundll32.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3132	3596	WerFault.exe	119
2636	4460	WerFault.exe	124

System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	YouAreAnIdiot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	YouAreAnIdiot.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings	OpenWith.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 603730.crdownload:SmartScreen	msedge.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
452	schtasks.exe
3276	schtasks.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
2312	msedge.exe
2312	msedge.exe
4160	msedge.exe
4160	msedge.exe
4164	identity_helper.exe
4164	identity_helper.exe
3332	msedge.exe
3332	msedge.exe
3688	msedge.exe
3688	msedge.exe
216	msedge.exe
216	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
4356	msedge.exe
4356	msedge.exe
5024	msedge.exe
5024	msedge.exe
5084	rundll32.exe
5084	rundll32.exe
5084	rundll32.exe
5084	rundll32.exe
2980	rundll32.exe
2980	rundll32.exe
4328	2F3F.tmp
4328	2F3F.tmp
4328	2F3F.tmp
4328	2F3F.tmp
4328	2F3F.tmp
4328	2F3F.tmp
4328	2F3F.tmp
736	msedge.exe
736	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5084	rundll32.exe
Token: SeDebugPrivilege	5084	rundll32.exe
Token: SeTcbPrivilege	5084	rundll32.exe
Token: SeShutdownPrivilege	2980	rundll32.exe
Token: SeDebugPrivilege	2980	rundll32.exe
Token: SeTcbPrivilege	2980	rundll32.exe
Token: SeDebugPrivilege	4328	2F3F.tmp

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe

Suspicious use of SetWindowsHookEx 19 IoCs

pid	Process
688	OpenWith.exe
688	OpenWith.exe
688	OpenWith.exe
688	OpenWith.exe
688	OpenWith.exe
688	OpenWith.exe
688	OpenWith.exe
688	OpenWith.exe
688	OpenWith.exe
688	OpenWith.exe
688	OpenWith.exe
688	OpenWith.exe
688	OpenWith.exe
688	OpenWith.exe
688	OpenWith.exe
688	OpenWith.exe
688	OpenWith.exe
688	OpenWith.exe
688	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4160 wrote to memory of 4084	4160	msedge.exe	83
PID 4160 wrote to memory of 4084	4160	msedge.exe	83
PID 4160 wrote to memory of 1448	4160	msedge.exe	84
PID 4160 wrote to memory of 1448	4160	msedge.exe	84
PID 4160 wrote to memory of 1448	4160	msedge.exe	84
PID 4160 wrote to memory of 1448	4160	msedge.exe	84
PID 4160 wrote to memory of 1448	4160	msedge.exe	84
PID 4160 wrote to memory of 1448	4160	msedge.exe	84
PID 4160 wrote to memory of 1448	4160	msedge.exe	84
PID 4160 wrote to memory of 1448	4160	msedge.exe	84
PID 4160 wrote to memory of 1448	4160	msedge.exe	84
PID 4160 wrote to memory of 1448	4160	msedge.exe	84
PID 4160 wrote to memory of 1448	4160	msedge.exe	84
PID 4160 wrote to memory of 1448	4160	msedge.exe	84
PID 4160 wrote to memory of 1448	4160	msedge.exe	84
PID 4160 wrote to memory of 1448	4160	msedge.exe	84
PID 4160 wrote to memory of 1448	4160	msedge.exe	84
PID 4160 wrote to memory of 1448	4160	msedge.exe	84
PID 4160 wrote to memory of 1448	4160	msedge.exe	84
PID 4160 wrote to memory of 1448	4160	msedge.exe	84
PID 4160 wrote to memory of 1448	4160	msedge.exe	84
PID 4160 wrote to memory of 1448	4160	msedge.exe	84
PID 4160 wrote to memory of 1448	4160	msedge.exe	84
PID 4160 wrote to memory of 1448	4160	msedge.exe	84
PID 4160 wrote to memory of 1448	4160	msedge.exe	84
PID 4160 wrote to memory of 1448	4160	msedge.exe	84
PID 4160 wrote to memory of 1448	4160	msedge.exe	84
PID 4160 wrote to memory of 1448	4160	msedge.exe	84
PID 4160 wrote to memory of 1448	4160	msedge.exe	84
PID 4160 wrote to memory of 1448	4160	msedge.exe	84
PID 4160 wrote to memory of 1448	4160	msedge.exe	84
PID 4160 wrote to memory of 1448	4160	msedge.exe	84
PID 4160 wrote to memory of 1448	4160	msedge.exe	84
PID 4160 wrote to memory of 1448	4160	msedge.exe	84
PID 4160 wrote to memory of 1448	4160	msedge.exe	84
PID 4160 wrote to memory of 1448	4160	msedge.exe	84
PID 4160 wrote to memory of 1448	4160	msedge.exe	84
PID 4160 wrote to memory of 1448	4160	msedge.exe	84
PID 4160 wrote to memory of 1448	4160	msedge.exe	84
PID 4160 wrote to memory of 1448	4160	msedge.exe	84
PID 4160 wrote to memory of 1448	4160	msedge.exe	84
PID 4160 wrote to memory of 1448	4160	msedge.exe	84
PID 4160 wrote to memory of 2312	4160	msedge.exe	85
PID 4160 wrote to memory of 2312	4160	msedge.exe	85
PID 4160 wrote to memory of 4480	4160	msedge.exe	86
PID 4160 wrote to memory of 4480	4160	msedge.exe	86
PID 4160 wrote to memory of 4480	4160	msedge.exe	86
PID 4160 wrote to memory of 4480	4160	msedge.exe	86
PID 4160 wrote to memory of 4480	4160	msedge.exe	86
PID 4160 wrote to memory of 4480	4160	msedge.exe	86
PID 4160 wrote to memory of 4480	4160	msedge.exe	86
PID 4160 wrote to memory of 4480	4160	msedge.exe	86
PID 4160 wrote to memory of 4480	4160	msedge.exe	86
PID 4160 wrote to memory of 4480	4160	msedge.exe	86
PID 4160 wrote to memory of 4480	4160	msedge.exe	86
PID 4160 wrote to memory of 4480	4160	msedge.exe	86
PID 4160 wrote to memory of 4480	4160	msedge.exe	86
PID 4160 wrote to memory of 4480	4160	msedge.exe	86
PID 4160 wrote to memory of 4480	4160	msedge.exe	86
PID 4160 wrote to memory of 4480	4160	msedge.exe	86
PID 4160 wrote to memory of 4480	4160	msedge.exe	86
PID 4160 wrote to memory of 4480	4160	msedge.exe	86
PID 4160 wrote to memory of 4480	4160	msedge.exe	86
PID 4160 wrote to memory of 4480	4160	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/Endermanch/MalwareDatabase
1⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffbc5046f8,0x7fffbc504708,0x7fffbc504718
  2⤵
  PID:4084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,14396343194998463703,8184517362915641201,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
  2⤵
  PID:1448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,14396343194998463703,8184517362915641201,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,14396343194998463703,8184517362915641201,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2672 /prefetch:8
  2⤵
  PID:4480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,14396343194998463703,8184517362915641201,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:2824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,14396343194998463703,8184517362915641201,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
  2⤵
  PID:3808
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,14396343194998463703,8184517362915641201,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5560 /prefetch:8
  2⤵
  PID:3364
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,14396343194998463703,8184517362915641201,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5560 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2100,14396343194998463703,8184517362915641201,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5548 /prefetch:8
  2⤵
  PID:2924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,14396343194998463703,8184517362915641201,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5596 /prefetch:1
  2⤵
  PID:2792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2100,14396343194998463703,8184517362915641201,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5796 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,14396343194998463703,8184517362915641201,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2064 /prefetch:1
  2⤵
  PID:3956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2100,14396343194998463703,8184517362915641201,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3328 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,14396343194998463703,8184517362915641201,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6212 /prefetch:1
  2⤵
  PID:2204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2100,14396343194998463703,8184517362915641201,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5692 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,14396343194998463703,8184517362915641201,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5764 /prefetch:1
  2⤵
  PID:5092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,14396343194998463703,8184517362915641201,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5880 /prefetch:1
  2⤵
  PID:2080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,14396343194998463703,8184517362915641201,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6168 /prefetch:1
  2⤵
  PID:4412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,14396343194998463703,8184517362915641201,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:1840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,14396343194998463703,8184517362915641201,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5744 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,14396343194998463703,8184517362915641201,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6164 /prefetch:1
  2⤵
  PID:3332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2100,14396343194998463703,8184517362915641201,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5780 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,14396343194998463703,8184517362915641201,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5664 /prefetch:1
  2⤵
  PID:3836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2100,14396343194998463703,8184517362915641201,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4768 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,14396343194998463703,8184517362915641201,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4752 /prefetch:1
  2⤵
  PID:3444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2100,14396343194998463703,8184517362915641201,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6380 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,14396343194998463703,8184517362915641201,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6400 /prefetch:1
  2⤵
  PID:2980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2100,14396343194998463703,8184517362915641201,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6024 /prefetch:8
  2⤵
  PID:4376

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2064

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1680

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5044

C:\Users\Admin\AppData\Local\Temp\Temp1_YouAreAnIdiot (1).zip\YouAreAnIdiot.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_YouAreAnIdiot (1).zip\YouAreAnIdiot.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3596
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3596 -s 1200
  2⤵
  - Program crash
  PID:3132

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3596 -ip 3596
1⤵
PID:912

C:\Users\Admin\AppData\Local\Temp\Temp1_YouAreAnIdiot (1).zip\YouAreAnIdiot.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_YouAreAnIdiot (1).zip\YouAreAnIdiot.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4460
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4460 -s 1172
  2⤵
  - Program crash
  PID:2636

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 4460 -ip 4460
1⤵
PID:1188

C:\Users\Admin\AppData\Local\Temp\Temp1_BadRabbit.zip\[email protected]
"C:\Users\Admin\AppData\Local\Temp\Temp1_BadRabbit.zip\[email protected]"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3852
- C:\Windows\SysWOW64\rundll32.exe
  C:\Windows\system32\rundll32.exe C:\Windows\infpub.dat,#1 15
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5084
- - C:\Windows\SysWOW64\cmd.exe
    /c schtasks /Delete /F /TN rhaegal
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3236
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /Delete /F /TN rhaegal
      4⤵
      System Location Discovery: System Language Discovery
      PID:4584
- - C:\Windows\SysWOW64\cmd.exe
    /c schtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR "C:\Windows\system32\cmd.exe /C Start \"\" \"C:\Windows\dispci.exe\" -id 3957467447 && exit"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1608
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR "C:\Windows\system32\cmd.exe /C Start \"\" \"C:\Windows\dispci.exe\" -id 3957467447 && exit"
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:3276
- - C:\Windows\SysWOW64\cmd.exe
    /c schtasks /Create /SC once /TN drogon /RU SYSTEM /TR "C:\Windows\system32\shutdown.exe /r /t 0 /f" /ST 17:10:00
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2276
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /Create /SC once /TN drogon /RU SYSTEM /TR "C:\Windows\system32\shutdown.exe /r /t 0 /f" /ST 17:10:00
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:452
- - C:\Windows\2F3F.tmp
    "C:\Windows\2F3F.tmp" \\.\pipe\{67663713-C126-415F-883F-6A2ABA8EB3FB}
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4328

C:\Users\Admin\AppData\Local\Temp\Temp1_BadRabbit.zip\[email protected]
"C:\Users\Admin\AppData\Local\Temp\Temp1_BadRabbit.zip\[email protected]"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2132
- C:\Windows\SysWOW64\rundll32.exe
  C:\Windows\system32\rundll32.exe C:\Windows\infpub.dat,#1 15
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2980

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:688
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\PetrWrap
  2⤵
  PID:5012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ab8ce148cb7d44f709fb1c460d03e1b0

SHA1
44d15744015155f3e74580c93317e12d2cc0f859

SHA256
014006a90e43ea9a1903b08b843a5aab8ad3823d22e26e5b113fad5f9fa620ff

SHA512
f685423b1eaee18a2a06030b4b2977335f62499c0041c142a92f6e6f846c2b9ce54324b6ae94efbbb303282dcda70e2b1597c748fddc251c0b3122a412c2d7c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
38f59a47b777f2fc52088e96ffb2baaf

SHA1
267224482588b41a96d813f6d9e9d924867062db

SHA256
13569c5681c71dc42ab57d34879f5a567d7b94afe0e8f6d7c6f6c1314fb0087b

SHA512
4657d13e1bb7cdd7e83f5f2562f5598cca12edf839626ae96da43e943b5550fab46a14b9018f1bec90de88cc714f637605531ccda99deb9e537908ddb826113b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
fd2de7a265fb28bc0f5df5d233938346

SHA1
d90fb5454a93fe300dc938eebeaf560ee1837b06

SHA256
89c7ae0d5e5bae0c86b40629c3fe82fba78222bd04a6bba7a920b1bda0227e54

SHA512
9125e1b28aaa04585f32fd6ea39a46e3e673ca94638e6c4a3982f3b7f7a46d59d32a00d62e4e4ff3de1b181a1d7b0eac9b246199a7e25a01499aaf16a1d1ce81

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
03b7e93fa85354285eb5ba10c727f5b4

SHA1
95fd68d6c73c7dd748ce5e547511a3ac3b2b9eb1

SHA256
daca06b9fbe44d04c68a82e6c35cd056802f6198ca2f348a41f9e7e9f66e2ee7

SHA512
4c4adac7bc0508556562806a907155d990f02e4ee93e41f89cd42e862ee7ffc513b40ee53adae0860a1fd1bcacd8cd20fd7e06ace9c2383780d6ac1d0e7ab234

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
fe1ce6c06e706e736162eba7d8ce901d

SHA1
2aca43716f12b84bf6c9e4bb08a669c17fb16637

SHA256
77cd1023af3bb2c152080d02e19b1d561f1374f30e4fbb7aeec736cb96d1e4a9

SHA512
93781304af8dbe17d959fa9ff35ecb99f026175a3b1ec649ede503d71d242d832871335af8221aa1098a6d37e6d2e28d95138a1056b7f3cc9971e94e5e207874

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2f3f1d4c95b0ab801a3e87406f43aaa8

SHA1
f59a757f2214ee98f77a34c0a9fe47c4be80a466

SHA256
9a6c3eeabd76675bdf4837b2e8b5e8775e875fc28c5d1a25d2b9df56b331e6a2

SHA512
42d69ead78a82b754c23de049e74cc5851c9b604296e94d9a4a5dba911715aa5f2c2dfbb0189566d09552b74e72d9de678a3202931fd83221e317d61f0e35608

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a71c1d8be30fca92eee1b50b64536456

SHA1
f2f71b295b99d9b93c3359debcbc5c953cf85a0d

SHA256
f8da706dc7cdc7739a5e4bff85d587ccf583f2ca43abe7f8b7515bdafee9929b

SHA512
f94eabd003b8fda014e3d55e6d057695df322fa5891e794a7a9730fcbdb0cacf26dd37b056fd7f607045928426a40191b191c6116f7bf351b0370d1409bccba2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
fc84175aab644898910e5d57c8aa6b4d

SHA1
1df792a47e5fb053c0f6a83202c0f8d75e721fe2

SHA256
36aa46ddc475ce70da67db9345445a43b6a48d0b600d94bb9c8d6fc186bf6a0c

SHA512
b3d19ae875751132e58ab72c4b155264e5ecc687c36bfc9473102c9dae2fceeb40c7dde554824ba5a933bbbde09a6362ecc088b2fd343b2e6bd10ac7c2edcfc4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
933d55950a44c4e6770b6abde546a8f5

SHA1
90dd9c19fedf15f2cac6646cdd46c0939a401290

SHA256
5cda54abdb12af5a4eef29b00ab48c5fca49d884543da354465a0563a0851325

SHA512
237faa702dfbe816700aaf04f4a6e0b018e3a541c2e90b29dd206f569e61e113f21eda27b893189a7c528146ca6b510583cde31eb9c1bb9a134a62517630412c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
c9876d94120424985758e3e221101c58

SHA1
182976529368a55f8ec5f4baf1f134cb92f23485

SHA256
43e72d7c4ce7f5a8cea983999cc8c36745b37e03016dfe187636ef2ef31c1f11

SHA512
982c60d493b72adf8af7e965d5464471bd55a121f19ff1d166c2fa3b4df42738fc1011949e2089b63225ef5a2de062ce0af43d2805f408c7310f6500c6f0efa6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
d3753a08b8f1d93ad90f532b1218d7d3

SHA1
956c63cb9d6a2e04c2df3d7a633d0ffe750bac15

SHA256
b9773eb51819930b49b593d4b43fa102d61cae58afefff62cd0b4775eac0f07d

SHA512
4d4a9ac18a385e9f24867453b4bc8463eebed0d7c4c9a4d44db6087364e87c2fce86ce6c89f0696b894878d49730c2d03c17421a00e20c06793aef3904c8709c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
483164560002e8253a22aeb412db2dd8

SHA1
628e4e3e92cb24306f0063e5c9b521859c0cd0af

SHA256
c2a58a7f0d632af7c6d58853cdb048d4f74918b29876f95293c173eddf19c1c0

SHA512
e9d3a81bdc079bd5aed18732d7059aedef59a24628c64bd28bf1a6346e75d5064b1c8d04948cdb6dad5504a78855f728f7e6e7750a8f2f362deae49281707923

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
7b9e7e9d0b4833d913691b12933073dc

SHA1
680594cd71a5692e26054429dfcac985a390af6f

SHA256
363cf2adff763e1f6a3a0fbb6d6499ba067f51f9b4aee03578a67420adc2f3d9

SHA512
86180ac48056d8ad2890a4b10ab9eb4e2d5cb991d4ef3f290545cce5a8079c7cd8752d0e1619d6319bbe2c49079aa2a85365361b9887b9e0af615e2f103473db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
b14f2e183e46757bbf5422b189c0b3ed

SHA1
5205f8258f603bcf65170b173b7950754c22ccd5

SHA256
561a4868e0f1db1a87f7473effbc66a944bd6d4797d67ca63adc29ac17bc5299

SHA512
130ce225887138f9eeba9636eb14a20a65e4d1dee6ae69aae05ffc968be7cb6ef130c2f139ddfa49e67736553e4d7ccb01b8e5e0d0415631f7eb305d74cc9d44

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
1a491869b3aa31d433a994aab9bd0bd7

SHA1
294e3512566f00ad2e76f572543d6014f541b64b

SHA256
635e5b352124d0c6e06404ea1017f1c81434e24cca31b4d58e8d2daa99caab6c

SHA512
24a3114828879f74e787999a088bab9738a743a89416e09f0c25082006ce15dec0501062305a5665ed955786beb6eb75fe28b277ef7ca34b5a269a195ab08b1c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
f1f44c1451ce299a7cd26a8574da69f2

SHA1
0bb1ebac26ea4d90949871087894097a43a55afa

SHA256
fb852d11adef17e334d9130fa1970654c79a25f8d3f49ed0ffb2fd94682116ef

SHA512
8d81d026c4e0592e6500686fc5a88c88140c85d4b2e6fa742b46cb8322e7bb731c478a82cccb37845a823cbc6c018e2bc9de19996a5ee073d67abf3683c7c92b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57e271.TMP

Filesize
1KB

MD5
5f8a3d00aa00b99c206576a45d32e10d

SHA1
e2d25ce58445b6c551277cbbd890663ceb52abc9

SHA256
12fe85c54c54dd9f3056b63ce92ac49ee4b43782966709d0517a7affcd6b0d2b

SHA512
76f89c9751941de10c48e3399ac3216f8353d05f34f0eed87fe2ddd7a61eaf0b9e263c3ebe54f8344c661b92470e2ba1b2a6d7f84132b7d8d6ff1dfcdfd981d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f42bbfc2-2cb0-4dbc-aa96-29d04a44ee4a.tmp

Filesize
678B

MD5
b518a3421569335bd9029bdcdc002437

SHA1
17753daf447bb68af0a27a8b01dd15c9cf91052c

SHA256
48dbfd20edbbccf9b3c2e85c427819f67dbaf74e658b4a86fcd937fee6f1caf8

SHA512
92b564896a371880653da62524d8543bdd744a091acd6cf0ba40240021ac19f71dd68ee736ddc743e530e9789506f58a3d98c92bdfd0f4156ba182ca9c0a91f9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
d124407c7359bf57f77ca3ee300a1c55

SHA1
86cf4263f03095519ada11bd4394ccacdb1dac4f

SHA256
2b4eff43c3bda711b382f5fcc31e4401e8b41ed849fae4cae8cadf753b0dd640

SHA512
3336b40189fa229604adcef3bfb899795e3002071aba172888a332be683ec0a74a94a073ec4e94a153b18f85fd6cb17c9948a20c360de1dbd6740840555d3c69

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
6ce55035824b5136971c6dc38aada957

SHA1
1deb4212062b328b74aa4f4e86f1bd70be01ca1f

SHA256
bdc5ef6c7d998118fd233e8ee737ee4634ecc2164b34f0701392037b8234b292

SHA512
be8482ae81f78329a8c0cfd4bb2d3da0d796b450cd19a05cc4046510c9953b3c158500b7b5b4d396eeaad076fb6776a331cd9eb2b5ba68c47de8d2f49bb7f78e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
07f5580c23333a7329781a212387b2ea

SHA1
a58dc12e8bc70ea13e7f4ed14aad37471fff1ae8

SHA256
a598a6da846845b731cebc9434b8875a62afd96b74622aed33758fd91086f227

SHA512
0bdf2721c6dc1edc692b1316e2b02a3e2bc0d334be3d5d8143d2931b87d0e4ed7a2efe6688258301912f7e9ef21a9deb894581038727bf1ec70b5e53c961b52c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
4fec1db9990d046d7dc228dea9b0b927

SHA1
6042665d5079f37746c5c0587a09aa40cf3b55b5

SHA256
48893b80ee1a7cd02e1d9dbc00fb04e11b1d71c8e4d68566e9f08f5e37698483

SHA512
cc90ca493d8b287910e1e0c521c41d5bd80ee1dcfeba68f81f5183adc0970320e24d359f785e75a23f75a895cdb501b68694aa4d568c2762da7f1c6061b924a4

Download Submit
C:\Users\Admin\Downloads\BadRabbit.zip

Filesize
393KB

MD5
61da9939db42e2c3007ece3f163e2d06

SHA1
4bd7e9098de61adecc1bdbd1a01490994d1905fb

SHA256
ea8ccb8b5ec36195af831001b3cc46caedfc61a6194e2568901e7685c57ceefa

SHA512
14d0bc14a10e5bd8022e7ab4a80f98600f84754c2c80e22a8e3d9f9555dde5bad056d925576b29fc1a37e73c6ebca693687b47317a469a7dfdc4ab0f3d97a63e

Download Submit
C:\Users\Admin\Downloads\BadRabbit.zip

Filesize
393KB

MD5
54ecab5ed054b8ad2eb6166c5c2c9abd

SHA1
01f9a94a65f3bcf3f61a822dc0686c07d07350d4

SHA256
75993223e8371275da0f46396696ff0106da9dfe3e781dd7ac3722f031143ed1

SHA512
daae2f95c2f1655c1c1ce2ed86b053fec4756c4196d6fd4ac830361a3c4f05308508caf6f1c9d463eb4460badfc3bfeca05d4cdd636dd72c9042767c2123ac6e

Download Submit
C:\Users\Admin\Downloads\FakeActivation.zip

Filesize
275KB

MD5
6db8a7da4e8dc527d445b7a37d02d5d6

SHA1
4fcc7cff8b49a834858d8c6016c3c6f109c9c794

SHA256
7cc43d4259f9dbe6806e1c067ebd1784eaaf56a026047d9380be944b71e5b984

SHA512
b1b4269da8a0648747c4eee7a26619b29d8d1182fe12446c780091fef205a7b5e6fb93c9b74c710cca5d2e69600579b9d470e31a32689ecc570d0c4bbe4fe718

Download Submit
C:\Users\Admin\Downloads\FakeActivation.zip

Filesize
275KB

MD5
b706b48dc9c32c427c8b3dc72b39ab5e

SHA1
8628620acde809b9856a1f8c1a0c3636cb7a36e2

SHA256
fffcd94a3074e68e515fc0b977ab370ca4dcc6134c04a3e2428f0f245feec761

SHA512
82762e6429572a110565ad43aa9c3ecc715e101dbd616b6bc756f6cbee197df2a69b5e4aeb3fcea5955fdb2e5bae4d14013a18787ba7d49b6eb49b1216bd8b3b

Download Submit
C:\Users\Admin\Downloads\MEMZ.zip

Filesize
8KB

MD5
69977a5d1c648976d47b69ea3aa8fcaa

SHA1
4630cc15000c0d3149350b9ecda6cfc8f402938a

SHA256
61ca4d8dd992c763b47bebb9b5facb68a59ff0a594c2ff215aa4143b593ae9dc

SHA512
ba0671c72cd4209fabe0ee241b71e95bd9d8e78d77a893c94f87de5735fd10ea8b389cf4c48462910042c312ddff2f527999cd2f845d0c19a8673dbceda369fd

Download Submit
C:\Users\Admin\Downloads\MEMZ.zip

Filesize
8KB

MD5
a511c271c21dc1410193307d7c764667

SHA1
b871222de1ab772fa0a78a88f7bce5d584d27f02

SHA256
be5526a2d78aa458e26079d42c95d84ded5033e69a1f6e8b82c75580bfce2993

SHA512
4f1e371a31df15e1ea5ff350ff59ba90e3154755f11f73a1452037c01817ced1018d3bfb48f6b437d92ad280046fed19b550e607d06a97283540218d5fd2b4d5

Download Submit
C:\Users\Admin\Downloads\PetrWrap

Filesize
473KB

MD5
17c25c8a7c141195ee887de905f33d7b

SHA1
7fa8079e8dca773574d01839efc623d3cd8e6a47

SHA256
e079fa28ea51fa98644164caf585ae3231d25372fccca1245902fb57488d4660

SHA512
de95f18101b99d159fe459c5e5651e0db2b1c76e02c9c2741bfd920decc970abc6dc0b41651be0471b4c7c3deb8b5e9a6e956c6515f268f9dfee7b76087a1e2b

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 603730.crdownload

Filesize
225KB

MD5
af2379cc4d607a45ac44d62135fb7015

SHA1
39b6d40906c7f7f080e6befa93324dddadcbd9fa

SHA256
26b4699a7b9eeb16e76305d843d4ab05e94d43f3201436927e13b3ebafa90739

SHA512
69899c47d0b15f92980f79517384e83373242e045ca696c6e8f930ff6454219bf609e0d84c2f91d25dfd5ef3c28c9e099c4a3a918206e957be806a1c2e0d3e99

Download Submit
C:\Users\Admin\Downloads\YouAreAnIdiot (1).zip

Filesize
223KB

MD5
e068f3e79429dc59d229742637c6fc9b

SHA1
e3e319b6034c148939a8c787dbe1df3da14809a6

SHA256
80dfec041dc3fe2a418536f68a2e931d3630c3565aac856003809f7a6e12441b

SHA512
5965c177df0e4baec79655146318acf0d8dfdb03e618724723b4f101e4808beb2a5318a27dd98ddc4f663104789b893f92ce51e4fdf64f9e5a9f807b6c3f2d93

Download Submit
C:\Users\Admin\Downloads\YouAreAnIdiot.zip

Filesize
223KB

MD5
a7a51358ab9cdf1773b76bc2e25812d9

SHA1
9f3befe37f5fbe58bbb9476a811869c5410ee919

SHA256
817ae49d7329ea507f0a01bb8009b9698bbd2fbe5055c942536f73f4d1d2b612

SHA512
3adc88eec7f646e50be24d2322b146438350aad358b3939d6ec0cd700fa3e3c07f2b75c5cd5e0018721af8e2391b0f32138ab66369869aaaa055d9188b4aa38d

Download Submit
C:\Windows\2F3F.tmp

Filesize
60KB

MD5
347ac3b6b791054de3e5720a7144a977

SHA1
413eba3973a15c1a6429d9f170f3e8287f98c21c

SHA256
301b905eb98d8d6bb559c04bbda26628a942b2c4107c07a02e8f753bdcfe347c

SHA512
9a399916bc681964af1e1061bc0a8e2926307642557539ad587ce6f9b5ef93bdf1820fe5d7b5ffe5f0bb38e5b4dc6add213ba04048c0c7c264646375fcd01787

Download Submit
C:\Windows\infpub.dat

Filesize
401KB

MD5
1d724f95c61f1055f0d02c2154bbccd3

SHA1
79116fe99f2b421c52ef64097f0f39b815b20907

SHA256
579fd8a0385482fb4c789561a30b09f25671e86422f40ef5cca2036b28f99648

SHA512
f2d7b018d1516df1c97cfff5507957c75c6d9bf8e2ce52ae0052706f4ec62f13eba6d7be17e6ad2b693fdd58e1fd091c37f17bd2b948cdcd9b95b4ad428c0113

Download Submit
memory/2980-477-0x00000000027F0000-0x0000000002858000-memory.dmp

Filesize
416KB

Download
memory/2980-469-0x00000000027F0000-0x0000000002858000-memory.dmp

Filesize
416KB

Download
memory/3596-449-0x00000000055A0000-0x00000000055F6000-memory.dmp

Filesize
344KB

Download
memory/3596-448-0x0000000005280000-0x000000000528A000-memory.dmp

Filesize
40KB

Download
memory/3596-447-0x0000000005370000-0x0000000005402000-memory.dmp

Filesize
584KB

Download
memory/3596-446-0x0000000005920000-0x0000000005EC4000-memory.dmp

Filesize
5.6MB

Download
memory/3596-445-0x00000000052D0000-0x000000000536C000-memory.dmp

Filesize
624KB

Download
memory/3596-444-0x0000000000820000-0x0000000000892000-memory.dmp

Filesize
456KB

Download
memory/5084-478-0x00000000025B0000-0x0000000002618000-memory.dmp

Filesize
416KB

Download
memory/5084-463-0x00000000025B0000-0x0000000002618000-memory.dmp

Filesize
416KB

Download
memory/5084-455-0x00000000025B0000-0x0000000002618000-memory.dmp

Filesize
416KB

Download