badrabbit | hxxps://github[.]com/Endermanch/MalwareDatabase/blob/master/ransomwares/BadRabbit[.]zip

Resubmissions

04-08-2024 09:02

240804-kzf48s1glm 8

04-08-2024 08:57

240804-kw28aswbpc 10

03-08-2024 19:52

240803-ylf4zatcrq 3

Analysis

max time kernel
150s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
04-08-2024 08:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/Endermanch/MalwareDatabase/blob/master/ransomwares/BadRabbit.zip

Score

10^/10

badrabbit discovery ransomware

Malware Config

Signatures

BadRabbit
Ransomware family discovered in late 2017, mainly targeting Russia and Ukraine.
ransomware badrabbit

Loads dropped DLL 1 IoCs

pid	Process
4660	rundll32.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
52	raw.githubusercontent.com
53	raw.githubusercontent.com

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\infpub.dat	[email protected]
File opened for modification	C:\Windows\infpub.dat	rundll32.exe
File created	C:\Windows\cscc.dat	rundll32.exe
File created	C:\Windows\dispci.exe	rundll32.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
2412	msedge.exe
2412	msedge.exe
4132	msedge.exe
4132	msedge.exe
4828	identity_helper.exe
4828	identity_helper.exe
4448	msedge.exe
4448	msedge.exe
1304	msedge.exe
1304	msedge.exe
1304	msedge.exe
1304	msedge.exe
4660	rundll32.exe
4660	rundll32.exe
4660	rundll32.exe
4660	rundll32.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4660	rundll32.exe
Token: SeDebugPrivilege	4660	rundll32.exe
Token: SeTcbPrivilege	4660	rundll32.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4132 wrote to memory of 3304	4132	msedge.exe	84
PID 4132 wrote to memory of 3304	4132	msedge.exe	84
PID 4132 wrote to memory of 892	4132	msedge.exe	85
PID 4132 wrote to memory of 892	4132	msedge.exe	85
PID 4132 wrote to memory of 892	4132	msedge.exe	85
PID 4132 wrote to memory of 892	4132	msedge.exe	85
PID 4132 wrote to memory of 892	4132	msedge.exe	85
PID 4132 wrote to memory of 892	4132	msedge.exe	85
PID 4132 wrote to memory of 892	4132	msedge.exe	85
PID 4132 wrote to memory of 892	4132	msedge.exe	85
PID 4132 wrote to memory of 892	4132	msedge.exe	85
PID 4132 wrote to memory of 892	4132	msedge.exe	85
PID 4132 wrote to memory of 892	4132	msedge.exe	85
PID 4132 wrote to memory of 892	4132	msedge.exe	85
PID 4132 wrote to memory of 892	4132	msedge.exe	85
PID 4132 wrote to memory of 892	4132	msedge.exe	85
PID 4132 wrote to memory of 892	4132	msedge.exe	85
PID 4132 wrote to memory of 892	4132	msedge.exe	85
PID 4132 wrote to memory of 892	4132	msedge.exe	85
PID 4132 wrote to memory of 892	4132	msedge.exe	85
PID 4132 wrote to memory of 892	4132	msedge.exe	85
PID 4132 wrote to memory of 892	4132	msedge.exe	85
PID 4132 wrote to memory of 892	4132	msedge.exe	85
PID 4132 wrote to memory of 892	4132	msedge.exe	85
PID 4132 wrote to memory of 892	4132	msedge.exe	85
PID 4132 wrote to memory of 892	4132	msedge.exe	85
PID 4132 wrote to memory of 892	4132	msedge.exe	85
PID 4132 wrote to memory of 892	4132	msedge.exe	85
PID 4132 wrote to memory of 892	4132	msedge.exe	85
PID 4132 wrote to memory of 892	4132	msedge.exe	85
PID 4132 wrote to memory of 892	4132	msedge.exe	85
PID 4132 wrote to memory of 892	4132	msedge.exe	85
PID 4132 wrote to memory of 892	4132	msedge.exe	85
PID 4132 wrote to memory of 892	4132	msedge.exe	85
PID 4132 wrote to memory of 892	4132	msedge.exe	85
PID 4132 wrote to memory of 892	4132	msedge.exe	85
PID 4132 wrote to memory of 892	4132	msedge.exe	85
PID 4132 wrote to memory of 892	4132	msedge.exe	85
PID 4132 wrote to memory of 892	4132	msedge.exe	85
PID 4132 wrote to memory of 892	4132	msedge.exe	85
PID 4132 wrote to memory of 892	4132	msedge.exe	85
PID 4132 wrote to memory of 892	4132	msedge.exe	85
PID 4132 wrote to memory of 2412	4132	msedge.exe	86
PID 4132 wrote to memory of 2412	4132	msedge.exe	86
PID 4132 wrote to memory of 1140	4132	msedge.exe	87
PID 4132 wrote to memory of 1140	4132	msedge.exe	87
PID 4132 wrote to memory of 1140	4132	msedge.exe	87
PID 4132 wrote to memory of 1140	4132	msedge.exe	87
PID 4132 wrote to memory of 1140	4132	msedge.exe	87
PID 4132 wrote to memory of 1140	4132	msedge.exe	87
PID 4132 wrote to memory of 1140	4132	msedge.exe	87
PID 4132 wrote to memory of 1140	4132	msedge.exe	87
PID 4132 wrote to memory of 1140	4132	msedge.exe	87
PID 4132 wrote to memory of 1140	4132	msedge.exe	87
PID 4132 wrote to memory of 1140	4132	msedge.exe	87
PID 4132 wrote to memory of 1140	4132	msedge.exe	87
PID 4132 wrote to memory of 1140	4132	msedge.exe	87
PID 4132 wrote to memory of 1140	4132	msedge.exe	87
PID 4132 wrote to memory of 1140	4132	msedge.exe	87
PID 4132 wrote to memory of 1140	4132	msedge.exe	87
PID 4132 wrote to memory of 1140	4132	msedge.exe	87
PID 4132 wrote to memory of 1140	4132	msedge.exe	87
PID 4132 wrote to memory of 1140	4132	msedge.exe	87
PID 4132 wrote to memory of 1140	4132	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/Endermanch/MalwareDatabase/blob/master/ransomwares/BadRabbit.zip
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd09e646f8,0x7ffd09e64708,0x7ffd09e64718
  2⤵
  PID:3304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,13789440774020992986,7509160450798745872,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
  2⤵
  PID:892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,13789440774020992986,7509160450798745872,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,13789440774020992986,7509160450798745872,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2836 /prefetch:8
  2⤵
  PID:1140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,13789440774020992986,7509160450798745872,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:2936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,13789440774020992986,7509160450798745872,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:4704
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,13789440774020992986,7509160450798745872,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5200 /prefetch:8
  2⤵
  PID:4844
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,13789440774020992986,7509160450798745872,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5200 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,13789440774020992986,7509160450798745872,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5424 /prefetch:1
  2⤵
  PID:3692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,13789440774020992986,7509160450798745872,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5452 /prefetch:1
  2⤵
  PID:4984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2092,13789440774020992986,7509160450798745872,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5840 /prefetch:8
  2⤵
  PID:1516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,13789440774020992986,7509160450798745872,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5876 /prefetch:1
  2⤵
  PID:4688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2092,13789440774020992986,7509160450798745872,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6032 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,13789440774020992986,7509160450798745872,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5880 /prefetch:1
  2⤵
  PID:4844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,13789440774020992986,7509160450798745872,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6248 /prefetch:1
  2⤵
  PID:2656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,13789440774020992986,7509160450798745872,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3160 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1304

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1664

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3124

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4244

C:\Users\Admin\AppData\Local\Temp\Temp1_BadRabbit.zip\[email protected]
"C:\Users\Admin\AppData\Local\Temp\Temp1_BadRabbit.zip\[email protected]"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3516
- C:\Windows\SysWOW64\rundll32.exe
  C:\Windows\system32\rundll32.exe C:\Windows\infpub.dat,#1 15
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4660
- - C:\Windows\SysWOW64\cmd.exe
    /c schtasks /Delete /F /TN rhaegal
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3056
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /Delete /F /TN rhaegal
      4⤵
      System Location Discovery: System Language Discovery
      PID:4712

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f9664c896e19205022c094d725f820b6

SHA1
f8f1baf648df755ba64b412d512446baf88c0184

SHA256
7121d84202a850791c2320385eb59eda4d697310dc51b1fcd4d51264aba2434e

SHA512
3fa5d2c68a9e70e4a25eaac2095171d87c741eec2624c314c6a56f4fa390d6319633bf4c48b1a4af7e9a0451f346beced9693da88cfc7bcba8dfe209cbd1b3ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
847d47008dbea51cb1732d54861ba9c9

SHA1
f2099242027dccb88d6f05760b57f7c89d926c0d

SHA256
10292fa05d896a2952c1d602a72d761d34bc776b44d6a7df87e49b5b613a8ac1

SHA512
bd1526aa1cc1c016d95dfcc53a78b45b09dde4ce67357fc275ab835dbe1bb5b053ca386239f50cde95ad243a9c1bbb12f7505818577589beecc6084f7b94e83f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
f7b4d665359804f84f64ae7ba9a84c94

SHA1
19d12407f00b1bbe00d42bb77fa4f358cac35e2c

SHA256
8f87c54f17b1c5bbb6849ed6890f96e9d60263bf759cff0e04bdac2fca11380c

SHA512
d7b6a304a4c16bdbf92de082b5e7da93023cbe5f413baf4f811f7d0db68d8d3ea44a34b4a1206413b972a599d602cb78fff9496144e0f3ca1cc50ad125d65efe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
492B

MD5
d39090d712dae41674a6c4c2e281144d

SHA1
eb315a93b7867b7ce822e763ff950210a920c87e

SHA256
fe431dcd29d088cebeb4398d26fdf8c1edc6d6fa762c183dff3afa16ffec386d

SHA512
cba8945d1e71f4e213a6ebffbb1a1e202428b423ba94d33b3881b0ddb6e1ace8032bb0b09e54d98b86302e77a35347685f401ab164bd91ae003ab6a9c29bb0fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5cf393808009eafe8e97f0020ac7d59b

SHA1
f4be49e778c0720ffb1974572078154ed2dcef56

SHA256
dd6404eef8bccd6d77a313df8336581e15456475eb60d82a22b8ce69ba0326c4

SHA512
06e1886db98a055f5493dde1043f34105447ff15475d27ce2c57dc8054aa619fe7b3e25e17d742dcb767da006670e9fe5d0f503a565d9bb798ceaaedf7e25354

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
49da8b672b5b4c173fc0715c67f5d1fd

SHA1
91aaaa9f5228a630ed571df769ea70919822efe1

SHA256
499b9cda795d28a9c0af7acda04a80246bb114fb1a860fce894dbb2f82d06711

SHA512
b73d4feb6027febbe689f38a4819a2068d04d829f0e28173be672e604ceb7cd474f9b92ec61ac83f2d7e9d95e3bd5548526f7968bf42c932d851aefe7e64e089

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a071e48640baab02feb76a0b9f57e0b0

SHA1
5ad4117b7021ca2dd3069eb107a73f361a92bafd

SHA256
c1d00a8ee13b6cdaf53f28d7c62bb1bace7c13075c7bd6c2f5a95399dc03d3a5

SHA512
42a9a03852a64497a54ddfc143edb965394b9f30f6d408c0d9072d63c1190571563838bed6be866a0fe4f6f0c81323b984f41b85dce779131fe27bab31f5bf45

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
874B

MD5
b715efd482c86868a5dc3b87aadabb7d

SHA1
02aace289bb83ea59ad5af1450ff3e7a3fcac792

SHA256
1708ab7269cc4217b71dd2ca6f1390ef9ac1b11b2574ff0c14c405a7f504e08d

SHA512
f14c4154950b9bb5b8199ead0128831b8b42756ff1b21872661f3e82d205ef0164a5acbbf9d6dd1091003a5e1da9619481a65ab5a602d9ff864c36981250a723

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58072f.TMP

Filesize
874B

MD5
df243dcf3f9c1aec6bcc99fe5206db44

SHA1
2019c4f4ec4c0f601e27e8ec88b57f6c4cf862b9

SHA256
78ece41ef3f7c08f056d10fb8d5f2e5eca6f9390a3e31c1224a633c379c56b6a

SHA512
e930a5f4b468c406456413de577dd25d3d08e2d02497fb5dc4d9046386e93fd9243752329b94c13d5061974ef27db6f04cb783b324995001c008424a6d1039e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
20fc31581be0fba8033641a90d60cb5e

SHA1
6a543e79fbb2091cb6bca47dfa993acbe830f5b1

SHA256
d42418672c4c1c2b51039530cefdf68924460a6d815995562cc414f92e023658

SHA512
86db41d5c574e9f4f5676efca8d3321dcb0c300d4e4e48fd557a5e838de9166f6fd2db9937a19335f15a47febb1b83abcf6b0a0ec2936c5df8bb63b6e577a2d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
24d067819ddd6dbea8396a5a5f8a5b2a

SHA1
105b4084f832b846043af469b97ecc12771a19b4

SHA256
dcbc99fb6d8461d95f919a1c10527c8a66116e6a72c4ede2193bf0546a65f8fb

SHA512
1ad2b852e27cda84374bdccb137501accdffd4d00055128f0335edf9e4ab341a5d0adeb06dc899de300d73747dae8463d968233f7647d0d9bf0c19d9ea7a0123

Download Submit
C:\Users\Admin\Downloads\BadRabbit.zip

Filesize
393KB

MD5
61da9939db42e2c3007ece3f163e2d06

SHA1
4bd7e9098de61adecc1bdbd1a01490994d1905fb

SHA256
ea8ccb8b5ec36195af831001b3cc46caedfc61a6194e2568901e7685c57ceefa

SHA512
14d0bc14a10e5bd8022e7ab4a80f98600f84754c2c80e22a8e3d9f9555dde5bad056d925576b29fc1a37e73c6ebca693687b47317a469a7dfdc4ab0f3d97a63e

Download Submit
C:\Windows\infpub.dat

Filesize
401KB

MD5
1d724f95c61f1055f0d02c2154bbccd3

SHA1
79116fe99f2b421c52ef64097f0f39b815b20907

SHA256
579fd8a0385482fb4c789561a30b09f25671e86422f40ef5cca2036b28f99648

SHA512
f2d7b018d1516df1c97cfff5507957c75c6d9bf8e2ce52ae0052706f4ec62f13eba6d7be17e6ad2b693fdd58e1fd091c37f17bd2b948cdcd9b95b4ad428c0113

Download Submit
memory/4660-276-0x0000000002DB0000-0x0000000002E18000-memory.dmp

Filesize
416KB

Download
memory/4660-284-0x0000000002DB0000-0x0000000002E18000-memory.dmp

Filesize
416KB

Download