badrabbit | hxxps://github[.]com/Endermanch/MalwareDatabase/tree/master/jokes

Analysis

max time kernel
394s
max time network
394s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
18-08-2024 03:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/Endermanch/MalwareDatabase/tree/master/jokes

Score

10^/10

badrabbit mimikatz defense_evasion discovery persistence ransomware upx

Malware Config

Signatures

BadRabbit
Ransomware family discovered in late 2017, mainly targeting Russia and Ukraine.
ransomware badrabbit
Mimikatz
mimikatz is an open source tool to dump credentials on Windows.
mimikatz

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Users\\Admin\\Downloads\\Birele\\[email protected]"	[email protected]

mimikatz is an open source tool to dump credentials on Windows 1 IoCs

resource	yara_rule
behavioral1/files/0x000800000001da72-450.dat	mimikatz

Executes dropped EXE 1 IoCs

pid	Process
388	8B88.tmp

Impair Defenses: Safe Mode Boot 1 TTPs 6 IoCs

defense_evasion

Safe Mode Boot

T1562.009

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\ProfSvc	[email protected]
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\Power	[email protected]
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\iai2c.sys	[email protected]
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\CBDHSvc	[email protected]
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\UserManager	[email protected]
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\SerCx2.sys	[email protected]

Loads dropped DLL 3 IoCs

pid	Process
5904	rundll32.exe
3232	rundll32.exe
5572	rundll32.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/5968-609-0x0000000000400000-0x0000000000438000-memory.dmp	upx
behavioral1/memory/5968-613-0x0000000000400000-0x0000000000438000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\system = "C:\\Users\\Admin\\Downloads\\Birele\\[email protected]"	[email protected]

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
77	raw.githubusercontent.com
76	raw.githubusercontent.com

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\System32\DriverStore\FileRepository\display.inf_amd64_71aa85b0e2292a7a\display.PNF	chrome.exe
File created	\??\c:\windows\system32\driverstore\filerepository\display.inf_amd64_71aa85b0e2292a7a\display.PNF	chrome.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\infpub.dat	[email protected]
File created	C:\Windows\dispci.exe	rundll32.exe
File opened for modification	C:\Windows\infpub.dat	rundll32.exe
File opened for modification	C:\Windows\infpub.dat	rundll32.exe
File created	C:\Windows\cscc.dat	rundll32.exe
File opened for modification	C:\Windows\8B88.tmp	rundll32.exe
File created	C:\Windows\infpub.dat	[email protected]
File created	C:\Windows\infpub.dat	[email protected]
File opened for modification	C:\Windows\infpub.dat	rundll32.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 14 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
6088	taskkill.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133684246564552697"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings	chrome.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5268	schtasks.exe
5240	schtasks.exe

Suspicious behavior: EnumeratesProcesses 33 IoCs

pid	Process
4308	chrome.exe
4308	chrome.exe
4972	chrome.exe
4972	chrome.exe
4972	chrome.exe
4972	chrome.exe
4972	chrome.exe
1036	taskmgr.exe
1036	taskmgr.exe
1036	taskmgr.exe
1036	taskmgr.exe
1036	taskmgr.exe
1036	taskmgr.exe
1036	taskmgr.exe
1036	taskmgr.exe
1036	taskmgr.exe
1036	taskmgr.exe
1036	taskmgr.exe
5904	rundll32.exe
5904	rundll32.exe
5904	rundll32.exe
5904	rundll32.exe
388	8B88.tmp
388	8B88.tmp
388	8B88.tmp
388	8B88.tmp
388	8B88.tmp
388	8B88.tmp
388	8B88.tmp
3232	rundll32.exe
3232	rundll32.exe
5572	rundll32.exe
5572	rundll32.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
4308	chrome.exe
4308	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4308	chrome.exe
Token: SeCreatePagefilePrivilege	4308	chrome.exe
Token: SeShutdownPrivilege	4308	chrome.exe
Token: SeCreatePagefilePrivilege	4308	chrome.exe
Token: SeShutdownPrivilege	4308	chrome.exe
Token: SeCreatePagefilePrivilege	4308	chrome.exe
Token: SeShutdownPrivilege	4308	chrome.exe
Token: SeCreatePagefilePrivilege	4308	chrome.exe
Token: SeShutdownPrivilege	4308	chrome.exe
Token: SeCreatePagefilePrivilege	4308	chrome.exe
Token: SeShutdownPrivilege	4308	chrome.exe
Token: SeCreatePagefilePrivilege	4308	chrome.exe
Token: SeShutdownPrivilege	4308	chrome.exe
Token: SeCreatePagefilePrivilege	4308	chrome.exe
Token: SeShutdownPrivilege	4308	chrome.exe
Token: SeCreatePagefilePrivilege	4308	chrome.exe
Token: SeShutdownPrivilege	4308	chrome.exe
Token: SeCreatePagefilePrivilege	4308	chrome.exe
Token: SeShutdownPrivilege	4308	chrome.exe
Token: SeCreatePagefilePrivilege	4308	chrome.exe
Token: SeShutdownPrivilege	4308	chrome.exe
Token: SeCreatePagefilePrivilege	4308	chrome.exe
Token: SeShutdownPrivilege	4308	chrome.exe
Token: SeCreatePagefilePrivilege	4308	chrome.exe
Token: SeShutdownPrivilege	4308	chrome.exe
Token: SeCreatePagefilePrivilege	4308	chrome.exe
Token: SeShutdownPrivilege	4308	chrome.exe
Token: SeCreatePagefilePrivilege	4308	chrome.exe
Token: SeShutdownPrivilege	4308	chrome.exe
Token: SeCreatePagefilePrivilege	4308	chrome.exe
Token: SeShutdownPrivilege	4308	chrome.exe
Token: SeCreatePagefilePrivilege	4308	chrome.exe
Token: SeShutdownPrivilege	4308	chrome.exe
Token: SeCreatePagefilePrivilege	4308	chrome.exe
Token: SeShutdownPrivilege	4308	chrome.exe
Token: SeCreatePagefilePrivilege	4308	chrome.exe
Token: SeShutdownPrivilege	4308	chrome.exe
Token: SeCreatePagefilePrivilege	4308	chrome.exe
Token: SeShutdownPrivilege	4308	chrome.exe
Token: SeCreatePagefilePrivilege	4308	chrome.exe
Token: SeShutdownPrivilege	4308	chrome.exe
Token: SeCreatePagefilePrivilege	4308	chrome.exe
Token: SeShutdownPrivilege	4308	chrome.exe
Token: SeCreatePagefilePrivilege	4308	chrome.exe
Token: SeShutdownPrivilege	4308	chrome.exe
Token: SeCreatePagefilePrivilege	4308	chrome.exe
Token: SeShutdownPrivilege	4308	chrome.exe
Token: SeCreatePagefilePrivilege	4308	chrome.exe
Token: SeShutdownPrivilege	4308	chrome.exe
Token: SeCreatePagefilePrivilege	4308	chrome.exe
Token: SeShutdownPrivilege	4308	chrome.exe
Token: SeCreatePagefilePrivilege	4308	chrome.exe
Token: SeShutdownPrivilege	4308	chrome.exe
Token: SeCreatePagefilePrivilege	4308	chrome.exe
Token: SeShutdownPrivilege	4308	chrome.exe
Token: SeCreatePagefilePrivilege	4308	chrome.exe
Token: SeShutdownPrivilege	4308	chrome.exe
Token: SeCreatePagefilePrivilege	4308	chrome.exe
Token: SeShutdownPrivilege	4308	chrome.exe
Token: SeCreatePagefilePrivilege	4308	chrome.exe
Token: SeShutdownPrivilege	4308	chrome.exe
Token: SeCreatePagefilePrivilege	4308	chrome.exe
Token: SeShutdownPrivilege	4308	chrome.exe
Token: SeCreatePagefilePrivilege	4308	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4308	chrome.exe
4308	chrome.exe
4308	chrome.exe
4308	chrome.exe
4308	chrome.exe
4308	chrome.exe
4308	chrome.exe
4308	chrome.exe
4308	chrome.exe
4308	chrome.exe
4308	chrome.exe
4308	chrome.exe
4308	chrome.exe
4308	chrome.exe
4308	chrome.exe
4308	chrome.exe
4308	chrome.exe
4308	chrome.exe
4308	chrome.exe
4308	chrome.exe
4308	chrome.exe
4308	chrome.exe
4308	chrome.exe
4308	chrome.exe
4308	chrome.exe
4308	chrome.exe
4308	chrome.exe
4308	chrome.exe
4308	chrome.exe
4308	chrome.exe
4308	chrome.exe
4308	chrome.exe
4308	chrome.exe
1036	taskmgr.exe
1036	taskmgr.exe
1036	taskmgr.exe
1036	taskmgr.exe
1036	taskmgr.exe
1036	taskmgr.exe
1036	taskmgr.exe
1036	taskmgr.exe
1036	taskmgr.exe
1036	taskmgr.exe
1036	taskmgr.exe
1036	taskmgr.exe
1036	taskmgr.exe
1036	taskmgr.exe
1036	taskmgr.exe
1036	taskmgr.exe
1036	taskmgr.exe
1036	taskmgr.exe
1036	taskmgr.exe
1036	taskmgr.exe
1036	taskmgr.exe
1036	taskmgr.exe
1036	taskmgr.exe
1036	taskmgr.exe
1036	taskmgr.exe
1036	taskmgr.exe
1036	taskmgr.exe
1036	taskmgr.exe
1036	taskmgr.exe
1036	taskmgr.exe
1036	taskmgr.exe

Suspicious use of SendNotifyMessage 60 IoCs

pid	Process
4308	chrome.exe
4308	chrome.exe
4308	chrome.exe
4308	chrome.exe
4308	chrome.exe
4308	chrome.exe
4308	chrome.exe
4308	chrome.exe
4308	chrome.exe
4308	chrome.exe
4308	chrome.exe
4308	chrome.exe
4308	chrome.exe
4308	chrome.exe
4308	chrome.exe
4308	chrome.exe
4308	chrome.exe
4308	chrome.exe
4308	chrome.exe
4308	chrome.exe
4308	chrome.exe
4308	chrome.exe
4308	chrome.exe
4308	chrome.exe
1036	taskmgr.exe
1036	taskmgr.exe
1036	taskmgr.exe
1036	taskmgr.exe
1036	taskmgr.exe
1036	taskmgr.exe
1036	taskmgr.exe
1036	taskmgr.exe
1036	taskmgr.exe
1036	taskmgr.exe
1036	taskmgr.exe
1036	taskmgr.exe
1036	taskmgr.exe
1036	taskmgr.exe
1036	taskmgr.exe
1036	taskmgr.exe
1036	taskmgr.exe
1036	taskmgr.exe
1036	taskmgr.exe
1036	taskmgr.exe
1036	taskmgr.exe
1036	taskmgr.exe
1036	taskmgr.exe
1036	taskmgr.exe
1036	taskmgr.exe
1036	taskmgr.exe
1036	taskmgr.exe
1036	taskmgr.exe
1036	taskmgr.exe
1036	taskmgr.exe
1036	taskmgr.exe
1036	taskmgr.exe
1036	taskmgr.exe
1036	taskmgr.exe
1036	taskmgr.exe
1036	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4308 wrote to memory of 1044	4308	chrome.exe	84
PID 4308 wrote to memory of 1044	4308	chrome.exe	84
PID 4308 wrote to memory of 404	4308	chrome.exe	85
PID 4308 wrote to memory of 404	4308	chrome.exe	85
PID 4308 wrote to memory of 404	4308	chrome.exe	85
PID 4308 wrote to memory of 404	4308	chrome.exe	85
PID 4308 wrote to memory of 404	4308	chrome.exe	85
PID 4308 wrote to memory of 404	4308	chrome.exe	85
PID 4308 wrote to memory of 404	4308	chrome.exe	85
PID 4308 wrote to memory of 404	4308	chrome.exe	85
PID 4308 wrote to memory of 404	4308	chrome.exe	85
PID 4308 wrote to memory of 404	4308	chrome.exe	85
PID 4308 wrote to memory of 404	4308	chrome.exe	85
PID 4308 wrote to memory of 404	4308	chrome.exe	85
PID 4308 wrote to memory of 404	4308	chrome.exe	85
PID 4308 wrote to memory of 404	4308	chrome.exe	85
PID 4308 wrote to memory of 404	4308	chrome.exe	85
PID 4308 wrote to memory of 404	4308	chrome.exe	85
PID 4308 wrote to memory of 404	4308	chrome.exe	85
PID 4308 wrote to memory of 404	4308	chrome.exe	85
PID 4308 wrote to memory of 404	4308	chrome.exe	85
PID 4308 wrote to memory of 404	4308	chrome.exe	85
PID 4308 wrote to memory of 404	4308	chrome.exe	85
PID 4308 wrote to memory of 404	4308	chrome.exe	85
PID 4308 wrote to memory of 404	4308	chrome.exe	85
PID 4308 wrote to memory of 404	4308	chrome.exe	85
PID 4308 wrote to memory of 404	4308	chrome.exe	85
PID 4308 wrote to memory of 404	4308	chrome.exe	85
PID 4308 wrote to memory of 404	4308	chrome.exe	85
PID 4308 wrote to memory of 404	4308	chrome.exe	85
PID 4308 wrote to memory of 404	4308	chrome.exe	85
PID 4308 wrote to memory of 404	4308	chrome.exe	85
PID 4308 wrote to memory of 2824	4308	chrome.exe	86
PID 4308 wrote to memory of 2824	4308	chrome.exe	86
PID 4308 wrote to memory of 2868	4308	chrome.exe	87
PID 4308 wrote to memory of 2868	4308	chrome.exe	87
PID 4308 wrote to memory of 2868	4308	chrome.exe	87
PID 4308 wrote to memory of 2868	4308	chrome.exe	87
PID 4308 wrote to memory of 2868	4308	chrome.exe	87
PID 4308 wrote to memory of 2868	4308	chrome.exe	87
PID 4308 wrote to memory of 2868	4308	chrome.exe	87
PID 4308 wrote to memory of 2868	4308	chrome.exe	87
PID 4308 wrote to memory of 2868	4308	chrome.exe	87
PID 4308 wrote to memory of 2868	4308	chrome.exe	87
PID 4308 wrote to memory of 2868	4308	chrome.exe	87
PID 4308 wrote to memory of 2868	4308	chrome.exe	87
PID 4308 wrote to memory of 2868	4308	chrome.exe	87
PID 4308 wrote to memory of 2868	4308	chrome.exe	87
PID 4308 wrote to memory of 2868	4308	chrome.exe	87
PID 4308 wrote to memory of 2868	4308	chrome.exe	87
PID 4308 wrote to memory of 2868	4308	chrome.exe	87
PID 4308 wrote to memory of 2868	4308	chrome.exe	87
PID 4308 wrote to memory of 2868	4308	chrome.exe	87
PID 4308 wrote to memory of 2868	4308	chrome.exe	87
PID 4308 wrote to memory of 2868	4308	chrome.exe	87
PID 4308 wrote to memory of 2868	4308	chrome.exe	87
PID 4308 wrote to memory of 2868	4308	chrome.exe	87
PID 4308 wrote to memory of 2868	4308	chrome.exe	87
PID 4308 wrote to memory of 2868	4308	chrome.exe	87
PID 4308 wrote to memory of 2868	4308	chrome.exe	87
PID 4308 wrote to memory of 2868	4308	chrome.exe	87
PID 4308 wrote to memory of 2868	4308	chrome.exe	87
PID 4308 wrote to memory of 2868	4308	chrome.exe	87
PID 4308 wrote to memory of 2868	4308	chrome.exe	87

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/Endermanch/MalwareDatabase/tree/master/jokes
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4308
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff9723ccc40,0x7ff9723ccc4c,0x7ff9723ccc58
  2⤵
  PID:1044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1868,i,18018359375980777213,14906780545572777645,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=1864 /prefetch:2
  2⤵
  PID:404
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1856,i,18018359375980777213,14906780545572777645,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=1724 /prefetch:3
  2⤵
  PID:2824
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2232,i,18018359375980777213,14906780545572777645,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2428 /prefetch:8
  2⤵
  PID:2868
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3108,i,18018359375980777213,14906780545572777645,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3152 /prefetch:1
  2⤵
  PID:1616
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3116,i,18018359375980777213,14906780545572777645,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3196 /prefetch:1
  2⤵
  PID:2036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4336,i,18018359375980777213,14906780545572777645,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4864 /prefetch:8
  2⤵
  PID:1168
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4340,i,18018359375980777213,14906780545572777645,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5000 /prefetch:8
  2⤵
  PID:2452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=5208,i,18018359375980777213,14906780545572777645,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5148 /prefetch:8
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  PID:4972
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4960,i,18018359375980777213,14906780545572777645,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=724 /prefetch:8
  2⤵
  PID:5576
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5132,i,18018359375980777213,14906780545572777645,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4552 /prefetch:8
  2⤵
  PID:5704

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:1600

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:824

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1384

C:\Users\Admin\Downloads\CookieClickerHack\[email protected]
"C:\Users\Admin\Downloads\CookieClickerHack\[email protected]"
1⤵
PID:2436

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /7
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1036

C:\Users\Admin\Downloads\BadRabbit\[email protected]
"C:\Users\Admin\Downloads\BadRabbit\[email protected]"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5844
- C:\Windows\SysWOW64\rundll32.exe
  C:\Windows\system32\rundll32.exe C:\Windows\infpub.dat,#1 15
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:5904
- - C:\Windows\SysWOW64\cmd.exe
    /c schtasks /Delete /F /TN rhaegal
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6032
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /Delete /F /TN rhaegal
      4⤵
      System Location Discovery: System Language Discovery
      PID:6092
- - C:\Windows\SysWOW64\cmd.exe
    /c schtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR "C:\Windows\system32\cmd.exe /C Start \"\" \"C:\Windows\dispci.exe\" -id 1726973893 && exit"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5152
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR "C:\Windows\system32\cmd.exe /C Start \"\" \"C:\Windows\dispci.exe\" -id 1726973893 && exit"
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:5240
- - C:\Windows\SysWOW64\cmd.exe
    /c schtasks /Create /SC once /TN drogon /RU SYSTEM /TR "C:\Windows\system32\shutdown.exe /r /t 0 /f" /ST 03:38:00
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5148
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /Create /SC once /TN drogon /RU SYSTEM /TR "C:\Windows\system32\shutdown.exe /r /t 0 /f" /ST 03:38:00
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:5268
- - C:\Windows\8B88.tmp
    "C:\Windows\8B88.tmp" \\.\pipe\{1BB6BFAC-32EF-4410-BA72-90A4450B1B6A}
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:388

C:\Users\Admin\Downloads\BadRabbit\[email protected]
"C:\Users\Admin\Downloads\BadRabbit\[email protected]"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2788
- C:\Windows\SysWOW64\rundll32.exe
  C:\Windows\system32\rundll32.exe C:\Windows\infpub.dat,#1 15
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:3232

C:\Users\Admin\Downloads\BadRabbit\[email protected]
"C:\Users\Admin\Downloads\BadRabbit\[email protected]"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3996
- C:\Windows\SysWOW64\rundll32.exe
  C:\Windows\system32\rundll32.exe C:\Windows\infpub.dat,#1 15
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:5572

C:\Users\Admin\Downloads\Birele\[email protected]
"C:\Users\Admin\Downloads\Birele\[email protected]"
1⤵
- Modifies WinLogon for persistence
- Impair Defenses: Safe Mode Boot
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:5968
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM explorer.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  PID:6088

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Safe Mode Boot

T1562.009

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\9ccde215-4cc7-453b-9e09-4f249d376ec2.tmp

Filesize
10KB

MD5
321356cfc50cb5462fc1f34e0a984883

SHA1
0e1869e9b1ad1359cd8d333cf569cf4debd83cb0

SHA256
d5ce21665e460ec025b4ea5d603da4450a826e5382c304e5c041126a5528f62a

SHA512
522d6a9bf4c1f27ca9e66b63dc0bec29de30ab99c4721849f4305c71be4f0479ff0d3f7fb223ccbeeda484a53ae2691ec99d27a395bf513325f3dd1f22b84d62

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
7b22a9bb07dec24e64a16b53217cc568

SHA1
2b55916e19a89310bac3235154617d09fc5ee46b

SHA256
0f69c9f1bb059384ce05c23d229e0830d74fe52125f9bc573cf275be68f17489

SHA512
72d291af9cb5b647f85213607b2e23c803ff897d66b5b25953668302f24a17ec57c279822615ccf748b040b42413477650eadebfa95ccef618c9cfbf2b4839ab

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
372abef61d595ce86ddf6c4abd68ea56

SHA1
e25f74e36b5ef3707db6056c3dfbd6ca0500a93a

SHA256
41796fafb52fb77137c060f09732d4faa3bf7e1138c65c93c5dda61523c289e6

SHA512
978dc52dc2b379a2504deb4a5bbd34db5521f75844f37198060705a3d49636153b7cec8ffc5431cec87f12a2ac22de5995b9aa5d3ded91cbcc2718e2f8903f5e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
6329380509a486a78135b8f7103e5be7

SHA1
b6058bf15c2c8baa379e9d9bc6eddcacb5d1ae78

SHA256
0db4f676f21f0192b39fa347f4cac2c90b793d0079225ae7856bddf97c6d5265

SHA512
87c36aff20fe2fc933206a356facc3db0174b77be66373bb73da5e0920be58a70a9f62a559bd6f6ddb82bb4067a82d9e53ddf78ac906177e30596483889c7e67

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
94a6668f4aac404f6ee34e4a530d058b

SHA1
a07a9203aff4098ebeb6104af29f499137b988b8

SHA256
8fe5572bbdb4444ee4b669df839b3315c10de02a72580942a46152b5be80d0ff

SHA512
46135262a771eb9d5c00673c51a22a134b7be2a21e93611730baa5e1272b4b29525151913b4ab956fd768bf244d4997ac1e37cf02e228860452ca109fa00f021

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
4416d2a4b6648d4a3a367a4fab93c72c

SHA1
e530121a9bca36b4cd7e721f16bd314783fb9bae

SHA256
5150c0ccbfe623a008690e0218805adb71ba83b94ea7dd6b4b2793ee3f2e26c4

SHA512
e979ef8de901477b9b7647b3457f123d8da70a2c2b2bb525852ca544f32b2aab1559087b34c9aaf38efb4e536ea7bb52df425c7c05200b4cd6b4a798d24d35c0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
b478ce93ac7026b79879d627838dd6c8

SHA1
a4a5bfd65bc7fbc53cc498bb8c36f4805aca4295

SHA256
d7451e966585826f72e930a64863588afdbc29ce4bc992e63f6f6e9d06b9b517

SHA512
737690e05f5cc5ed38407e42cc747bbc2fb1743548d671fc773aefd3e5522ebf3522ed58be48621c07f693f0aa00f1393718d3becb2f1832c2010c92acc5b336

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
8f5a426376f6a911527ce080fd1d665c

SHA1
a4fdfedda18a584d01cd1a11d20767e3ff417b58

SHA256
daa1d1a68131bc4db2bf390e36bb984ecd9d555944b3046d4dbc697626af222a

SHA512
5f66285a39df670921dc5ebb456df7205d46a6e8b4883333e0140d37d5bb8ee74771842f4391aee65743b6187445ddaada64f97d8a0da92fbda9d451ff754901

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
2788e62db0f40275ff9a09284aab1485

SHA1
99a951a966c7b15f1071b055466a3b0f20b897c9

SHA256
be6af77434dfc8f3ffbe5380022066110de7df1180497ec7b71a3110e5169933

SHA512
573d6789ad05dd377a289487958c8fad03c557496ba98db0551cce00286757dc5d6fb2c17c12fbf5cc31215232d60a27e24b6d50d10edfa92840d6e73f118fe0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
845e4d34150a22db6557ab79947504fa

SHA1
78d04e54cb7657ecb062a7c8f6c1a10d8b80a562

SHA256
ce9c715917d29805f2f1bed05a2879de9f4724edf84df83ed4594e290d5d4ecf

SHA512
2b508b099d648406d448171b20ed1023b349e20f8329a3fa993b7f2fa49dae7fae77f6f2c62aedd3036722e6555b424611e67adce711b764464474d5eb77051c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
fcf3e4d6eb53ed76674944fb0974efb6

SHA1
79e844c5e4e7fdf5c2ec759277e8c596bf75a98d

SHA256
eb3c21748d39ee733d6e187b32b55fdbf4d146b56f17fca45b8bf6530bd628fd

SHA512
19417ac086e45b597e31c12f60c119301ba061cdc21119308ae4d48a3b4d880a786054c6fe86ddfd441f83a3221239fdedc9a2f430ba4e91959b65cba19766b6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
73746e76c577210f3a492d1d84effedf

SHA1
9a8c9b954826a352f5fb0d9c8728abc95ef12053

SHA256
d45cbfb21e1eb4e2352ea90bbaa90b09827ec364126ba068ca7c6c494806d735

SHA512
6cb2ece8353f778e6b1828819d129509e78cf628c76d51a4580043e2b1b6301fd093b08a4b53d01223068ee607a1a1f5252423db1b496f7df85194c72c2d0f0d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
b1d9249d413dd9cd522eeef8c065d28f

SHA1
02859e08e72e347fcbec95705d86e81c24dc0199

SHA256
c32eeffb44738f2d199f1a9bb35dd21e01ca974b127109bfb7859b1ed4650ff1

SHA512
7ae3d606ca4f2788952bc2552b0f5a4e7bff96bfca67cec5f4cfa323ef15d78bda177a0905236c33674a3b88e36bf2c98a136aecec72624444777b872d584ae2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
27538c5599ab1d15729e8a286aae9a99

SHA1
14328940c2d4d5c6f157ca9ab0c31fed65446d58

SHA256
e31611bc615defbefe863d35084e68c4aa012f5a507fedba89161481c9ba86fc

SHA512
19bf224ce08d59ce715db073637bce843a39185f84ba888f82abfe51f8eb4436d47d44c8bbccdb6a6484a87e24e540a11a8b79a629e578eb6aedf05a32983a30

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
90bba46053486677ce41438f3009f1ed

SHA1
1dbbe81601b360f70f3886fcd0a459528cff3be1

SHA256
b41aafd9f5c36f6939ec00f6af820c6e9ed523962d4499e8b12a66471c109898

SHA512
2773896ecbb070bd31be8f2196e21f25ba87c62a628b9c1045cb196fc8cbfe0a4417160941da9e40ac7299730e19ee9360fbfb8df72a30bf4a498106f3a4f37d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
7df7aa258179eddc2c13e904acad22e6

SHA1
1916b697e66a40121e60ae801845d43751e960b9

SHA256
1c08323e33df0b8488f166ea2a807174444c47b1ecc3e75dfc9a252fa9bb742a

SHA512
0836156d70ddf571bde20093cd31621ffea1fcdfb8fa98e352878909284506f19ec1dd258989eec59dedb079b8eb4457c55df7c472a34d66bb5381848424c80e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
a7af812300311f5aa6a76ea73ed4ed98

SHA1
815f41334ac0a7a59e68aa1d747c46740443b953

SHA256
8c32b4c5a98d7eee1f99be0b69fcad9dd0c91aa9646a5bf10deff23212e36804

SHA512
d75f97681cf6995067176f83d7aae0110e967fa2549197310ddafb8c72113a6754b95c8e84732e158223cd745242dd15d9bdbc52d08d78814842891897c8013a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
22585828620bc7e0af60df3c111b03af

SHA1
3338642571f98c6efa090ee0263de6ccebb6185b

SHA256
405758c619fb5b4b7b0feb80717fc19f31a20e147ca2cd8f1e4b0993eddcf098

SHA512
7693f5d352e34a48cde6edabb711022523eb021e323308062bf83a2ee5194b987a2fe374fc5cc58738151ab7a85963a7099aa5e3ec1f0c346f0fd77af7a4386e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
f4313a1d7e333b7e5219488e9c2f7a20

SHA1
43e0cc58b296b9724361d3f3b91f2a56a82cd6a2

SHA256
f0201ed0e42812f18aedc4e2e985e89d74a046e722770e716cc25b04c0a2d828

SHA512
1b92e8b7c6582870e5c5907fbc66fad0ff916f8a037ac37695f71f5ec2b66e5d0729fe7f2079726d4cebe8e6374bbad8f93c5053d095e0500c032492a0a0f705

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
1a7277347dce9c9c114dca5ab47ec31f

SHA1
33a6cb11b9a7651e1c869eac881bd41e42b24ada

SHA256
2d0cd3edc40ff8ffd638e72d41afb61ab676fcceefd9037df8e37c3b702b5d0e

SHA512
b93155852e953c4f8f26a41e11387507eee1d9b7341d558edb8be1ed0245bb39899a99135d6f9df6e0bcf8dd95973427190413b6144b2d59d015005a397eb1c8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
36b86d98c0eac4f11141a5d552da3095

SHA1
4027349a7286e465f4571e7645dcb6e6a499a1bc

SHA256
089dd3d14c92105708ecf0135100d8ec3d673495e65f7e4bb7b5147da1e4ddf0

SHA512
300cfcc7ef4e663d71d9caa040aedc32c6c9b8b76081c180daa9407e90b75edec857373a971f5e3e5067e8373c1330ae0500d55d84aba8f48d5912cdb3253f90

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
637816aca04d703879db04251811f2c9

SHA1
4b033bab3d960d06c3640aedb55d1f027e290e10

SHA256
b20f23a1b34db26add1ecd793285645512e9cbe65882fe46e18a554e3e8484e7

SHA512
698a6d14130331cc8458cebc5cc5de7c3fd17221ddc3d075d44e64f9737165868de78bc06beb3c8efc2f5481f3c34c3d4ddc4522adca8912aac154a0d8488d57

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
0aee47cb1fbd32b434302e8d8894636b

SHA1
a8fa311d545b31a4d049f8dedaad66fa3ccd2d25

SHA256
aa4bf3537c456a5a1ac0b4dbad0d90d76214a8301e66d6fca5ea60fe31e784fd

SHA512
a56f1b2111f8decaab0319c5b690f49b4c816cd404f8ebece3bbae606f849e3008621b6a522d59d36c719421394af65365519634d3073dac94220b32a34d8dda

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
2bfdf83430fbf8604ebaa718dc19cfc2

SHA1
52a24087d2ac4f001ca4457deeb0c60f27cc2018

SHA256
1fa7d7db313046ae18e7ebaa0fec6dfbeef95f40fa79a8755eaa7ffa4ea04496

SHA512
0fd6c24aabef6f258f30d8695a60abb3a8f360a43d50b6d167a9c128d569661efd4fb7cf9d7d80db91b9446bcfcb57c0b1e838afd45041a972134f2111ede979

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
54dd536fdd8716cc19b5b6817505b2cc

SHA1
dc0b17dd5bebf289417d1f2a45e1a80387f1e3f8

SHA256
cf456cf36cb7efa5effc72f62ee23207feb75bb1181c4bd6d359a65000c1d298

SHA512
a74f8cade9d09531dc670f4ab5002d15ae48fe7a622f28ef3660a43298bf66e5b2c48ad78ff5ff42056c7a37fc7655cca81a0ffc7119cf6d4b49a160bd488e49

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
97ed094d6fb6e7cfd598f1fc8761b096

SHA1
0bfe2784bb2a070a116d30a163126a1bad075701

SHA256
b57a758da9c4f0137ceacc75d8b7904b41d3c11a40c874f09ebdda6e327471e2

SHA512
64bd60ce623931cb95345bd93a7c91131dd31d5ff7d2a4c6274f5f5ebf21e88e4a30f7f7c009520068ff0936d9106cdf5a7b38755aa3403a621505f22b889169

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
1f145c8e542949ceebed3c6fe3fcd90c

SHA1
18344535002d642e2d73269bf508408679bb0ddb

SHA256
604d62ec0e861ad369b7bd4ced387c2ac11b5cf3dc3d5870ad11f63a70061fa7

SHA512
a83495f5cb50bc1328e5cdaa2056a74b79459c9825640a3e30d2eb7eaca574961786950421b7d95197c811e177f65e4f6ee3b2feb7bcee8a506ec9f9430430ee

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
5b2b177601fa3452d247f0e2749fbfc9

SHA1
f70d7abfbc4a2f35f4c307cc63e016fa7a83877f

SHA256
9fc48d65b31905a1e1a6bfebcbb67f9f7a20faecffb0bf0fa9cc030d3e0ef63f

SHA512
60c963348b210228d607204befe50969086530d03380f1e1277b3461ea190cbfe638fedf94682f6e935d4f0178024fa6e739eb6363d33d0dc11b8600ccdb076d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
67020bbd4869c6c68ca58a6418e3d390

SHA1
187a37dadde3d6114cd5872af29405e5f9a51d35

SHA256
0f3bd1d8f60b81799814ecb07510d7948deaa032fdb262f44befd88d5ea872d0

SHA512
8882afa36f7ca2572a62e95baa7135912e7130f4ef545a00d72ef99c6b8522c4b7e25f7d5b75434be4fe5cfd3ad9b0eff5d0841c573d7ffc99009b406cec9edc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
7aa75c17734739eca443f2908d26240c

SHA1
e98fb1e64341566d163950c71645d469c55174c7

SHA256
02e9b5919263b42231646e7ecdd42a21e2eee345341b1e654a64506a92ea35e6

SHA512
4c1e1b29097a9fba6bc6574ea718698cad7bb57ffd8c63ea70ea7fd198de2fb3c876d0eeb4ee21c6826d8fdda182aeeaa68b8175da5051f2acd65e6ee4cc6eee

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
b8b0ea1b09069272b0b2c75d9b40535f

SHA1
30e0b551e07023a78e5f29b1240516398ae73859

SHA256
6eac0a393fa55c523b53ddaebd8918dcb100cc4364302d391dea85d27af63653

SHA512
f20b3e68cb42865a1431f3fffab7b371011e96d65a0d8403af751396107046bf3e3939e73667e2216e1c7df3d1846652910d276200f07ed0e18a87006e0837ca

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
ce2bd03b6e5ba0042da1f33df10e1336

SHA1
071e59ec66ba4a15a7ef09f9e0b165d134200a90

SHA256
398577057fc9e33531fddeb6527a6e54087862be0d2f9d20b0d302328239c167

SHA512
6f7c5d94ba076e67bd31c76a480f6b49231284fa37c0adf713bb99645d02e4f072329ca92dc0916f56a47cc694aa08eea68d1d9880ffe558df21d800220b87a6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
d6b9d8343e0d57f46705fb98bc853f91

SHA1
5566f15f30915b45283f1fa23d45710dcf4ec1dd

SHA256
3f9a063b41a2d2b7b3bfff31a37e4f4b7634a5857a30ccd6de6789d8622b7ba2

SHA512
af0b1ed017af5315e82a5d1b0af40a705fb4569e5fe63bc7e91063418d91409c58244637f4db49528d447a5b3ed61340d93867627269df6be5060ffcc9a315fa

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
2f6ff4dd7abe3abcee4b8f7ca4593fee

SHA1
726d70f164e6cf8bb92cef7e48fc61f6d37eb82d

SHA256
7a5172e7041fe8b5870d532aabc63dd2512572f548f9041180386eac3b9ab4fb

SHA512
ec97e661abe0a1d7d2b14692001d0b31ad797dd959948feb5279b7214e8a9bade40a24f7ae6f218e4805ca6fb1dd5339688e9dbde244e0c262a36683b65983a9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
1665d54a4143c3e6d1aa775219a42497

SHA1
9d4f448ca7285ac655da5ac6b2eff3b2f44d623b

SHA256
c28a41e79977f6628cac00ff9f2393a19e80f2fe99976bebd2515d99cc439a59

SHA512
f09f46eb59f47a84f8c7a412abd0c4adecd621bd03c1a0a50bc77036af079025804c7f5e994cd2f925303e125f252e36e7ccb3fb33d8e2c8d624e8eba9e28556

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
a7e93ca17a908f8105b32f8a65839fb9

SHA1
a86db08c33897b0d8379734f5b88b365856024c7

SHA256
583d4d34a601b6cf9f9cd2da73bf0b4b48b8a982c126c167b085ed48314a3d0c

SHA512
ec64a1e36fc06cc911f79bcad45fa0850bcd64b05746560db4077e027c611c2111fc188109387b2ea356c084ebbaf672a0aa6af93a80cba986267d0427a1cbd9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
fe0dcf29b93d198d6a68ff493bd63210

SHA1
845e600f6de0604958b7560a7fcda75bfb47c30f

SHA256
1739b8420add388d604c8877f9354c8cbde891c5d8f70eb981de0022003d9a56

SHA512
14c55bb88ecf8183c9d44c42b17bd3247e232d719da146811ebe279c08e06afda93698a6cf10e6edf83dc218c85a8793c539066b9a46517231f07ed8571c4176

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
51874ea6ddd97949ddefb897ba5fda6a

SHA1
31dce8f1802de4bbc5ba76aa33a3ad9c2e148b82

SHA256
ce96b16cfb377ca489e6086da244f2edc6af213dae98370da620144a366828c0

SHA512
fe397c34c568ca1f8afcba820027ef4491eca78975074dfed6ed11a30f6c023298bcade658f95e81d353a3eb7e3c20b69c60fc983f9ba4c558c843a634bcebf0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
99KB

MD5
9245271601313b1936f5a28149aca736

SHA1
e0eb66e9aad9083b921ca488d0ed78d5397633e4

SHA256
690aa24db9635abe7d6d4bad6baa77ad8a5ccb2620f8269fdd6686a65df8800a

SHA512
be46e4183415162819334de820386d4e7ab60ea2a693823e2b7710a5e9501a0849d170a7986e6bb7f3006b841538098963e15b80359bd8896f103dfe38b6d7b4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
99KB

MD5
18321c430761e7ceb4a881422640c993

SHA1
c821e1e892ae8a7caa5727c7760ba6da085a2cd4

SHA256
8cbd87c40482ff2b4f10d47af52d67d357a02a9a598d1e9dac6d35522841c43a

SHA512
873ffecf39c5b266cf469ba93c9fe654b05485a3052dc4ceef637ba443b188fce7ae2e139fdcd5d12f7da24199beb18450533ab567a2f407afa111a01eac5904

Download Submit
C:\Users\Admin\Downloads\BadRabbit.zip

Filesize
393KB

MD5
61da9939db42e2c3007ece3f163e2d06

SHA1
4bd7e9098de61adecc1bdbd1a01490994d1905fb

SHA256
ea8ccb8b5ec36195af831001b3cc46caedfc61a6194e2568901e7685c57ceefa

SHA512
14d0bc14a10e5bd8022e7ab4a80f98600f84754c2c80e22a8e3d9f9555dde5bad056d925576b29fc1a37e73c6ebca693687b47317a469a7dfdc4ab0f3d97a63e

Download Submit
C:\Users\Admin\Downloads\BadRabbit.zip

Filesize
393KB

MD5
592a7a2991d4ee6f6c3f5903a33e2c03

SHA1
1404b46d0aafe6cff3884c69bec3e1d881fbae83

SHA256
5e802359795953f45ebf81ee7a377db48cd16c5b2124b4168d781f4e572ed440

SHA512
756a0f6b0c60dc5e6ce4c2d9ffdb92755c70bf37c3dfb5e62adfecace9d293717575472a4c7d0c7099c3e55518791bef2da9fa2dd1e2a81ab003832cbc469b68

Download Submit
C:\Users\Admin\Downloads\Birele.zip

Filesize
113KB

MD5
6ca327b67f1a2b2a4fbb7f342e15e7bf

SHA1
aab4a7d8199e8416ad8649fede35b846fc96f082

SHA256
460a3e3a039c2d0bb2c76017b41403bf3e92727269f49b08778d33108278b58f

SHA512
b7a7574ca52885e531aca71ebe52f7832f8a2436cda047e7686936fe0337eae7c4ebcc57df27c26316871d4167ea4e6794beb933f7c13efb0addac0d400e4d9a

Download Submit
C:\Users\Admin\Downloads\CookieClickerHack.zip

Filesize
20KB

MD5
a7bcca47b5413eb92250a45f86d1ab75

SHA1
915ad4c18ae188da9ab338ced6862c4efb670091

SHA256
b7f82523253c3a1f18de5c649a96132820d89274cdf7a8c5cd3f47a79e76ed39

SHA512
4a666fe25bbaf41ff217a07bdd19fd9e2f57dba228511d9ae92d3ee75adaeb952fd91d4d4472e0c73babfb86806d54ddbe3d603ae124545b89ebdf570db19d87

Download Submit
C:\Users\Admin\Downloads\CookieClickerHack.zip

Filesize
20KB

MD5
bec6d3be51b6f0ad6aaf01fd7a92bfca

SHA1
4362ac8078dc1b8d806b12ade3607e98655d604a

SHA256
a7228ffa908896d80215877474f6797c05594e6848050f353b84af129c81974c

SHA512
f09320379c735594654ed99c4d52209a61087bdf055601bfbdf789df42b5e0a1c315a6651fc88f2951cea38bafb8a384726faa5a331f0d1d7a9a99637f1119b3

Download Submit
C:\Windows\8B88.tmp

Filesize
60KB

MD5
347ac3b6b791054de3e5720a7144a977

SHA1
413eba3973a15c1a6429d9f170f3e8287f98c21c

SHA256
301b905eb98d8d6bb559c04bbda26628a942b2c4107c07a02e8f753bdcfe347c

SHA512
9a399916bc681964af1e1061bc0a8e2926307642557539ad587ce6f9b5ef93bdf1820fe5d7b5ffe5f0bb38e5b4dc6add213ba04048c0c7c264646375fcd01787

Download Submit
C:\Windows\infpub.dat

Filesize
401KB

MD5
1d724f95c61f1055f0d02c2154bbccd3

SHA1
79116fe99f2b421c52ef64097f0f39b815b20907

SHA256
579fd8a0385482fb4c789561a30b09f25671e86422f40ef5cca2036b28f99648

SHA512
f2d7b018d1516df1c97cfff5507957c75c6d9bf8e2ce52ae0052706f4ec62f13eba6d7be17e6ad2b693fdd58e1fd091c37f17bd2b948cdcd9b95b4ad428c0113

Download Submit
memory/1036-345-0x000001AFBC460000-0x000001AFBC461000-memory.dmp

Filesize
4KB

Download
memory/1036-348-0x000001AFBC460000-0x000001AFBC461000-memory.dmp

Filesize
4KB

Download
memory/1036-342-0x000001AFBC460000-0x000001AFBC461000-memory.dmp

Filesize
4KB

Download
memory/1036-343-0x000001AFBC460000-0x000001AFBC461000-memory.dmp

Filesize
4KB

Download
memory/1036-344-0x000001AFBC460000-0x000001AFBC461000-memory.dmp

Filesize
4KB

Download
memory/1036-346-0x000001AFBC460000-0x000001AFBC461000-memory.dmp

Filesize
4KB

Download
memory/1036-347-0x000001AFBC460000-0x000001AFBC461000-memory.dmp

Filesize
4KB

Download
memory/1036-338-0x000001AFBC460000-0x000001AFBC461000-memory.dmp

Filesize
4KB

Download
memory/1036-337-0x000001AFBC460000-0x000001AFBC461000-memory.dmp

Filesize
4KB

Download
memory/1036-336-0x000001AFBC460000-0x000001AFBC461000-memory.dmp

Filesize
4KB

Download
memory/2436-293-0x00007FF95DAE5000-0x00007FF95DAE6000-memory.dmp

Filesize
4KB

Download
memory/2436-358-0x00007FF95D830000-0x00007FF95E1D1000-memory.dmp

Filesize
9.6MB

Download
memory/2436-294-0x000000001B8C0000-0x000000001B966000-memory.dmp

Filesize
664KB

Download
memory/2436-299-0x00000000011A0000-0x00000000011A8000-memory.dmp

Filesize
32KB

Download
memory/2436-335-0x00007FF95D830000-0x00007FF95E1D1000-memory.dmp

Filesize
9.6MB

Download
memory/2436-315-0x00007FF95D830000-0x00007FF95E1D1000-memory.dmp

Filesize
9.6MB

Download
memory/2436-296-0x00007FF95D830000-0x00007FF95E1D1000-memory.dmp

Filesize
9.6MB

Download
memory/2436-295-0x00007FF95D830000-0x00007FF95E1D1000-memory.dmp

Filesize
9.6MB

Download
memory/2436-314-0x00007FF95D830000-0x00007FF95E1D1000-memory.dmp

Filesize
9.6MB

Download
memory/2436-297-0x000000001BE40000-0x000000001C30E000-memory.dmp

Filesize
4.8MB

Download
memory/2436-298-0x000000001C3F0000-0x000000001C48C000-memory.dmp

Filesize
624KB

Download
memory/2436-313-0x00007FF95D830000-0x00007FF95E1D1000-memory.dmp

Filesize
9.6MB

Download
memory/2436-312-0x00007FF95D830000-0x00007FF95E1D1000-memory.dmp

Filesize
9.6MB

Download
memory/2436-311-0x00007FF95DAE5000-0x00007FF95DAE6000-memory.dmp

Filesize
4KB

Download
memory/2436-301-0x00007FF95D830000-0x00007FF95E1D1000-memory.dmp

Filesize
9.6MB

Download
memory/2436-300-0x000000001C6A0000-0x000000001C6EC000-memory.dmp

Filesize
304KB

Download
memory/3232-519-0x0000000002730000-0x0000000002798000-memory.dmp

Filesize
416KB

Download
memory/3232-511-0x0000000002730000-0x0000000002798000-memory.dmp

Filesize
416KB

Download
memory/5572-540-0x0000000001600000-0x0000000001668000-memory.dmp

Filesize
416KB

Download
memory/5572-532-0x0000000001600000-0x0000000001668000-memory.dmp

Filesize
416KB

Download
memory/5904-444-0x0000000002B60000-0x0000000002BC8000-memory.dmp

Filesize
416KB

Download
memory/5904-441-0x0000000002B60000-0x0000000002BC8000-memory.dmp

Filesize
416KB

Download
memory/5904-433-0x0000000002B60000-0x0000000002BC8000-memory.dmp

Filesize
416KB

Download
memory/5968-609-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/5968-613-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download