Resubmissions

21-08-2024 12:05

240821-n9jjwsxekh 8

21-08-2024 11:55

240821-n3ra6axbpb 10

Analysis

  • max time kernel
    293s
  • max time network
    295s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21-08-2024 11:55

General

  • Target

    https://github.com/fabrimagic72/malware-samples

Malware Config

Signatures

  • BadRabbit

    Ransomware family discovered in late 2017, mainly targeting Russia and Ukraine.

  • Chimera 64 IoCs

    Ransomware which infects local and network files, often distributed via Dropbox links.

  • Chimera Ransomware Loader DLL 1 IoCs

    Drops/unpacks executable file which resembles Chimera's Loader.dll.

  • Mimikatz

    mimikatz is an open source tool to dump credentials on Windows.

  • Renames multiple (3256) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • mimikatz is an open source tool to dump credentials on Windows 1 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 6 IoCs
  • Loads dropped DLL 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Drops desktop.ini file(s) 27 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 11 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • System Location Discovery: System Language Discovery 1 TTPs 16 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 40 IoCs
  • Modifies registry class 1 IoCs
  • NTFS ADS 2 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 33 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs
  • Suspicious use of AdjustPrivilegeToken 14 IoCs
  • Suspicious use of FindShellTrayWindow 46 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/fabrimagic72/malware-samples
    1⤵
    • Enumerates system info in registry
    • NTFS ADS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2432
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcc66c46f8,0x7ffcc66c4708,0x7ffcc66c4718
      2⤵
        PID:2324
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1796,6766256359634919753,17051506359705428252,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:2
        2⤵
          PID:2064
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1796,6766256359634919753,17051506359705428252,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2288 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:4204
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1796,6766256359634919753,17051506359705428252,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2688 /prefetch:8
          2⤵
            PID:3144
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1796,6766256359634919753,17051506359705428252,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
            2⤵
              PID:5000
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1796,6766256359634919753,17051506359705428252,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
              2⤵
                PID:220
              • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1796,6766256359634919753,17051506359705428252,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5364 /prefetch:8
                2⤵
                  PID:4388
                • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1796,6766256359634919753,17051506359705428252,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5364 /prefetch:8
                  2⤵
                  • Suspicious behavior: EnumeratesProcesses
                  PID:2424
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1796,6766256359634919753,17051506359705428252,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5732 /prefetch:1
                  2⤵
                    PID:656
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1796,6766256359634919753,17051506359705428252,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5712 /prefetch:1
                    2⤵
                      PID:5032
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1796,6766256359634919753,17051506359705428252,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3396 /prefetch:8
                      2⤵
                        PID:1148
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1796,6766256359634919753,17051506359705428252,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=3484 /prefetch:8
                        2⤵
                        • Modifies registry class
                        • Suspicious behavior: EnumeratesProcesses
                        PID:1992
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1796,6766256359634919753,17051506359705428252,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5784 /prefetch:1
                        2⤵
                          PID:1640
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1796,6766256359634919753,17051506359705428252,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5444 /prefetch:1
                          2⤵
                            PID:2944
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1796,6766256359634919753,17051506359705428252,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5476 /prefetch:1
                            2⤵
                              PID:1380
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1796,6766256359634919753,17051506359705428252,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5432 /prefetch:1
                              2⤵
                                PID:6076
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1796,6766256359634919753,17051506359705428252,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5992 /prefetch:1
                                2⤵
                                  PID:4032
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=1796,6766256359634919753,17051506359705428252,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5748 /prefetch:8
                                  2⤵
                                    PID:5352
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1796,6766256359634919753,17051506359705428252,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5880 /prefetch:1
                                    2⤵
                                      PID:5348
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1796,6766256359634919753,17051506359705428252,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6716 /prefetch:8
                                      2⤵
                                        PID:1908
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1796,6766256359634919753,17051506359705428252,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7052 /prefetch:1
                                        2⤵
                                          PID:5784
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1796,6766256359634919753,17051506359705428252,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6868 /prefetch:8
                                          2⤵
                                          • Suspicious behavior: EnumeratesProcesses
                                          PID:4932
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1796,6766256359634919753,17051506359705428252,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7116 /prefetch:1
                                          2⤵
                                            PID:3952
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1796,6766256359634919753,17051506359705428252,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6896 /prefetch:8
                                            2⤵
                                              PID:3680
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1796,6766256359634919753,17051506359705428252,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5132 /prefetch:8
                                              2⤵
                                              • Suspicious behavior: EnumeratesProcesses
                                              PID:1108
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1796,6766256359634919753,17051506359705428252,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6544 /prefetch:2
                                              2⤵
                                              • Suspicious behavior: EnumeratesProcesses
                                              PID:1900
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1796,6766256359634919753,17051506359705428252,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6480 /prefetch:1
                                              2⤵
                                                PID:5792
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1796,6766256359634919753,17051506359705428252,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6204 /prefetch:1
                                                2⤵
                                                  PID:4064
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1796,6766256359634919753,17051506359705428252,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5096 /prefetch:1
                                                  2⤵
                                                    PID:5292
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1796,6766256359634919753,17051506359705428252,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5628 /prefetch:1
                                                    2⤵
                                                      PID:6048
                                                  • C:\Windows\System32\CompPkgSrv.exe
                                                    C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                    1⤵
                                                      PID:512
                                                    • C:\Windows\System32\CompPkgSrv.exe
                                                      C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                      1⤵
                                                        PID:3068
                                                      • C:\Windows\System32\rundll32.exe
                                                        C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                                        1⤵
                                                          PID:5700
                                                        • C:\Users\Admin\Desktop\HawkEye.exe
                                                          "C:\Users\Admin\Desktop\HawkEye.exe"
                                                          1⤵
                                                          • Chimera
                                                          • Executes dropped EXE
                                                          • Drops desktop.ini file(s)
                                                          • Drops file in Program Files directory
                                                          • System Location Discovery: System Language Discovery
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          PID:5832
                                                          • C:\Program Files\Internet Explorer\iexplore.exe
                                                            "C:\Program Files\Internet Explorer\iexplore.exe" -k "C:\Users\Admin\Downloads\YOUR_FILES_ARE_ENCRYPTED.HTML"
                                                            2⤵
                                                            • Modifies Internet Explorer settings
                                                            • Suspicious use of FindShellTrayWindow
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:5956
                                                            • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                                                              "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:5956 CREDAT:17410 /prefetch:2
                                                              3⤵
                                                              • System Location Discovery: System Language Discovery
                                                              • Modifies Internet Explorer settings
                                                              • Suspicious use of SetWindowsHookEx
                                                              PID:3152
                                                        • C:\Users\Admin\Desktop\BadRabbit.exe
                                                          "C:\Users\Admin\Desktop\BadRabbit.exe"
                                                          1⤵
                                                          • Executes dropped EXE
                                                          • Drops file in Windows directory
                                                          • System Location Discovery: System Language Discovery
                                                          PID:4864
                                                          • C:\Windows\SysWOW64\rundll32.exe
                                                            C:\Windows\system32\rundll32.exe C:\Windows\infpub.dat,#1 15
                                                            2⤵
                                                            • Loads dropped DLL
                                                            • Drops file in Windows directory
                                                            • System Location Discovery: System Language Discovery
                                                            • Suspicious behavior: EnumeratesProcesses
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            PID:3412
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              /c schtasks /Delete /F /TN rhaegal
                                                              3⤵
                                                              • System Location Discovery: System Language Discovery
                                                              PID:5268
                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                schtasks /Delete /F /TN rhaegal
                                                                4⤵
                                                                • System Location Discovery: System Language Discovery
                                                                PID:5320
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              /c schtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR "C:\Windows\system32\cmd.exe /C Start \"\" \"C:\Windows\dispci.exe\" -id 1627536120 && exit"
                                                              3⤵
                                                              • System Location Discovery: System Language Discovery
                                                              PID:1428
                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                schtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR "C:\Windows\system32\cmd.exe /C Start \"\" \"C:\Windows\dispci.exe\" -id 1627536120 && exit"
                                                                4⤵
                                                                • System Location Discovery: System Language Discovery
                                                                • Scheduled Task/Job: Scheduled Task
                                                                PID:2796
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              /c schtasks /Create /SC once /TN drogon /RU SYSTEM /TR "C:\Windows\system32\shutdown.exe /r /t 0 /f" /ST 12:15:00
                                                              3⤵
                                                              • System Location Discovery: System Language Discovery
                                                              PID:5180
                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                schtasks /Create /SC once /TN drogon /RU SYSTEM /TR "C:\Windows\system32\shutdown.exe /r /t 0 /f" /ST 12:15:00
                                                                4⤵
                                                                • System Location Discovery: System Language Discovery
                                                                • Scheduled Task/Job: Scheduled Task
                                                                PID:5756
                                                            • C:\Windows\8B9C.tmp
                                                              "C:\Windows\8B9C.tmp" \\.\pipe\{F07E963F-D87A-4318-9F07-1BC8C391A756}
                                                              3⤵
                                                              • Executes dropped EXE
                                                              • Suspicious behavior: EnumeratesProcesses
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              PID:5396
                                                        • C:\Users\Admin\Desktop\BadRabbit.exe
                                                          "C:\Users\Admin\Desktop\BadRabbit.exe"
                                                          1⤵
                                                          • Executes dropped EXE
                                                          • Drops file in Windows directory
                                                          • System Location Discovery: System Language Discovery
                                                          PID:2400
                                                          • C:\Windows\SysWOW64\rundll32.exe
                                                            C:\Windows\system32\rundll32.exe C:\Windows\infpub.dat,#1 15
                                                            2⤵
                                                            • Loads dropped DLL
                                                            • Drops file in Windows directory
                                                            • System Location Discovery: System Language Discovery
                                                            • Suspicious behavior: EnumeratesProcesses
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            PID:4864
                                                        • C:\Users\Admin\Desktop\BadRabbit.exe
                                                          "C:\Users\Admin\Desktop\BadRabbit.exe"
                                                          1⤵
                                                          • Executes dropped EXE
                                                          • Drops file in Windows directory
                                                          • System Location Discovery: System Language Discovery
                                                          PID:5644
                                                          • C:\Windows\SysWOW64\rundll32.exe
                                                            C:\Windows\system32\rundll32.exe C:\Windows\infpub.dat,#1 15
                                                            2⤵
                                                            • Loads dropped DLL
                                                            • Drops file in Windows directory
                                                            • System Location Discovery: System Language Discovery
                                                            • Suspicious behavior: EnumeratesProcesses
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            PID:2592
                                                        • C:\Users\Admin\Desktop\BadRabbit.exe
                                                          "C:\Users\Admin\Desktop\BadRabbit.exe"
                                                          1⤵
                                                          • Executes dropped EXE
                                                          • Drops file in Windows directory
                                                          • System Location Discovery: System Language Discovery
                                                          PID:4588
                                                          • C:\Windows\SysWOW64\rundll32.exe
                                                            C:\Windows\system32\rundll32.exe C:\Windows\infpub.dat,#1 15
                                                            2⤵
                                                            • Loads dropped DLL
                                                            • Drops file in Windows directory
                                                            • System Location Discovery: System Language Discovery
                                                            • Suspicious behavior: EnumeratesProcesses
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            PID:1924

                                                        Network

                                                        MITRE ATT&CK Enterprise v15

                                                        Replay Monitor

                                                        Loading Replay Monitor...

                                                        Downloads

                                                        • C:\Program Files\Java\jdk-1.8\jre\lib\YOUR_FILES_ARE_ENCRYPTED.HTML

                                                          Filesize

                                                          4KB

                                                          MD5

                                                          8458ff63be202714f73d9037c3d3b9a5

                                                          SHA1

                                                          cae55657b0e5e8ce0fc1a0761817903059683122

                                                          SHA256

                                                          6f7c60ad7c8387aba2877e8eefe94daa562012f9fc99e8d9c1ea06b7a91253dd

                                                          SHA512

                                                          8105a1c40ad11603095952957e1e263a25982c158b6f1db432b007993d55f055145fb42ef6e37283d68e296d2edc59c80eaa5fdf1c9127bc3f59b36bbd325773

                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                          Filesize

                                                          152B

                                                          MD5

                                                          e4f80e7950cbd3bb11257d2000cb885e

                                                          SHA1

                                                          10ac643904d539042d8f7aa4a312b13ec2106035

                                                          SHA256

                                                          1184ee8d32d0edecddd93403fb888fad6b3e2a710d37335c3989cc529bc08124

                                                          SHA512

                                                          2b92c9807fdcd937e514d4e7e1cc7c2d3e3aa162099b7289ceac2feea72d1a4afbadf1c09b3075d470efadf9a9edd63e07ea7e7a98d22243e45b3d53473fa4f0

                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                          Filesize

                                                          152B

                                                          MD5

                                                          2dc1a9f2f3f8c3cfe51bb29b078166c5

                                                          SHA1

                                                          eaf3c3dad3c8dc6f18dc3e055b415da78b704402

                                                          SHA256

                                                          dcb76fa365c2d9ee213b224a91cdd806d30b1e8652d72a22f2371124fa4479fa

                                                          SHA512

                                                          682061d9cc86a6e5d99d022da776fb554350fc95efbf29cd84c1db4e2b7161b76cd1de48335bcc3a25633079fb0bd412e4f4795ed6291c65e9bc28d95330bb25

                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

                                                          Filesize

                                                          37KB

                                                          MD5

                                                          25c164c17e9d2475837bd5b9d822aeeb

                                                          SHA1

                                                          0b5fc6247afc76aaef44cf13418754221a8bc70b

                                                          SHA256

                                                          51351d1af0a1f2c2249a0c958364f8637ce8c74bc9dd45990c55667423cfd6e2

                                                          SHA512

                                                          5d0d08caa9c715001b56cf40f800c9db0d39ec8d27357a68773666d93a929c6d46783b435af8476015de619af5c3d7e40a15c1c46a7f5ce8553944e0db115935

                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

                                                          Filesize

                                                          37KB

                                                          MD5

                                                          48f925eefce06701a10bb34743596ef6

                                                          SHA1

                                                          3271af5587fb44878f2355cb99cc2a5a915706fd

                                                          SHA256

                                                          85712a77e89fff00123155170da85c01b812e5b68de05a05f59c71fcba597a17

                                                          SHA512

                                                          76993db32748cf3f3295318b153ab6fd85d18a624f5b75d85d2e8c7b39f5d19003cb10c659173dee6a87aec02ce30f3f3219ca9bfae0996e37db64fd6b446d6e

                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

                                                          Filesize

                                                          21KB

                                                          MD5

                                                          7715176f600ed5d40eaa0ca90f7c5cd7

                                                          SHA1

                                                          00fdb1d5b1421ea03d2d33542a4eaf7ac543d3d0

                                                          SHA256

                                                          154632629a0698587e95c608e6ed5f232e2ba1a33d7c07fea862a25293a9926e

                                                          SHA512

                                                          799cfee1969b6137813c98b83b90052c04527b273156f577841b64828c07c4e6a3913a6ddd49ae5021ed54a367ddbc5ab2193226960b0ffe9a618c663c8d8a1c

                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

                                                          Filesize

                                                          20KB

                                                          MD5

                                                          2f0cb4a501c76993f5ab360291384aea

                                                          SHA1

                                                          cca34788d5ad38c56868e3cb046f79e0c38e3102

                                                          SHA256

                                                          0f765c5719d516d59250896d5aa283527ebc7e6779504c6562f4f2c04246af2a

                                                          SHA512

                                                          dbfab771c875d04b3db32574bad4429d58f16eb194034c201746f7cda29174dce73f6513dae0e45a919cda6dff1d6e79aebc1576ec231310d8d910c7354804cc

                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

                                                          Filesize

                                                          18KB

                                                          MD5

                                                          2e23d6e099f830cf0b14356b3c3443ce

                                                          SHA1

                                                          027db4ff48118566db039d6b5f574a8ac73002bc

                                                          SHA256

                                                          7238196a5bf79e1b83cacb9ed4a82bf40b32cd789c30ef790e4eac0bbf438885

                                                          SHA512

                                                          165b1de091bfe0dd9deff0f8a3968268113d95edc9fd7a8081b525e0910f4442cfb3b4f5ac58ecfa41991d9dcabe5aa8b69f7f1c77e202cd17dd774931662717

                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

                                                          Filesize

                                                          17KB

                                                          MD5

                                                          109a8cceba33695698297e575e56bfad

                                                          SHA1

                                                          2b8c6dce1ccd21a6eea2dd9aef2a8a6bde389053

                                                          SHA256

                                                          dd82d9ac034f0a06524fc1d5ef884c29a7e4d586a1e7db66e339dc54fac3636d

                                                          SHA512

                                                          6d51ed30c45560838df921212370a0044640a8e3c0433922106225cb6fec8cc115ac6191c753da13def21c4e0db4deb5782fb7a75ada822ced1db7c7d13beaf3

                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

                                                          Filesize

                                                          57KB

                                                          MD5

                                                          7e21b212cb697ee8dc11eb5d6318af30

                                                          SHA1

                                                          019139f1d160a7923d20dab67fb286a1e453285f

                                                          SHA256

                                                          c7bc66711c2ec323863307b2cb6d6b0175082f35d34c40c33befe11b86051baf

                                                          SHA512

                                                          9b8f1f8d9c5e1c39644b327b273850c5b2b403742b13222fcffa7ae074fe7040d0d0e05bc8f5986772f9106297dcf487c4f8367f249cf091300209b17459a697

                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009

                                                          Filesize

                                                          19KB

                                                          MD5

                                                          f5b631335f170065edf1b148e10b34d4

                                                          SHA1

                                                          ca34f82af577fec763ed38f0436d20f1cf766f62

                                                          SHA256

                                                          99be964ed51ca453ccfaa264a1ea9490da11e32b53765919172b6d3749a9f846

                                                          SHA512

                                                          c66791cbdc7c0d12e7295eb26eb583b26e03692c8986ab7d5dac0e6a561b8b68a8a9e33814121efc700ff6b472aa4f685162b0c75439b144f12286c9e28c7cc7

                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000a

                                                          Filesize

                                                          53KB

                                                          MD5

                                                          cfff8fc00d16fc868cf319409948c243

                                                          SHA1

                                                          b7e2e2a6656c77a19d9819a7d782a981d9e16d44

                                                          SHA256

                                                          51266cbe2741a46507d1bb758669d6de3c2246f650829774f7433bc734688a5a

                                                          SHA512

                                                          9d127abfdf3850998fd0d2fb6bd106b5a40506398eb9c5474933ff5309cdc18c07052592281dbe1f15ea9d6cb245d08ff09873b374777d71bbbc6e0594bde39b

                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b

                                                          Filesize

                                                          16KB

                                                          MD5

                                                          9395baaa17b0a20ab4cbb63fb8b5f9fe

                                                          SHA1

                                                          41f9ee65e2a8df82ca7d0efa76a067580b75380e

                                                          SHA256

                                                          8ad28f829724670c14ecf5b8e2a1eebfa603ddbd3b4281aeca9ae5376cda9bb8

                                                          SHA512

                                                          ddffd1b003ed46eb248e5a5eaa5b7c65a2f5988132562b4172e8d863ff739e2a5613062808811bcfb5695f869556d31e31ca6484e066a581b1a25486f0de11cb

                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000d

                                                          Filesize

                                                          137KB

                                                          MD5

                                                          a336ad7a2818eb9c1d9b7d0f4cc7d456

                                                          SHA1

                                                          d5280cb38af2010e0860b7884a23de0484d18f62

                                                          SHA256

                                                          83bdfb7d266fd8436312f6145c1707ddf0fb060825527acfe364c5db859887a3

                                                          SHA512

                                                          fa69455b3bfc162ab86a12332fe13322dfd8749be456779c93a6ab93e1d628e246a31a0a55cdba0c45adb3085acd62ba0a094b2115529d70cb9f693f3b1da327

                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000e

                                                          Filesize

                                                          23KB

                                                          MD5

                                                          bc715e42e60059c3ea36cd32bfb6ebc9

                                                          SHA1

                                                          b8961b23c29b9769100116ba0da44f13a24a3dd4

                                                          SHA256

                                                          110ccd760150c6ac29c987ee2b8f7c56772036f6fe74ff2fb56c094849912745

                                                          SHA512

                                                          5c0edd336a6d892f0163aa183e5482313dd86f9f5b2d624b3c4529692d70720f4823808f10ee7870fd9368b24de752b343570419fd244c33ad2d9cc86007bedc

                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000010

                                                          Filesize

                                                          67KB

                                                          MD5

                                                          12793b05702482f518b5fd3396bba123

                                                          SHA1

                                                          4b7bc1985171c29be72b8c6c5c25b80c97c1b36f

                                                          SHA256

                                                          f76288f0c22faf8374fd02bf2f6b54e6e3c2d5a7531bfa64983efb82ad9add70

                                                          SHA512

                                                          97fffbdbbaffc16c0ac98d4bc600acfbba9629747f3cc1905924a20d657630805ba323957c597ec06a908e2d0fee978a5d3326da6c5b6d4bcacfeb16f091206d

                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                          Filesize

                                                          4KB

                                                          MD5

                                                          2638ed29c5d4ada3d2b2ba6782c1df4d

                                                          SHA1

                                                          b12e41feb220cf862f39c2db7520cf75074e7a8d

                                                          SHA256

                                                          85e9dbc50dbf89c415a4d7885756ebddf42512b185f602831cc79fe1f3e6828b

                                                          SHA512

                                                          70c24ce2efe8b72384b1de100992f393732ca604d7ff598c085d42a44edc25f339ccedf0890191d93b20ca2434c01e186f6910a3bb2d7d7a577e01ae876bb968

                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                          Filesize

                                                          4KB

                                                          MD5

                                                          c5055944b56495225b85cce1e2d4852a

                                                          SHA1

                                                          7de78e9608ceafd9ac83e22c5d7353dde1d54209

                                                          SHA256

                                                          f13dd9ebcf9ae304ffe4445b3c82b6c8a58e84b77aef0391f4d77af224bfc609

                                                          SHA512

                                                          fb4092877b289f8cb6c2237b716d023ccbf63ce82f5b2b122750070a821ad408cb3c64041227417498974bc617c7da0dad818ff483e0040c7b76f449e2bd6be7

                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                          Filesize

                                                          782B

                                                          MD5

                                                          626ff66ddf27620f986cac7206079175

                                                          SHA1

                                                          3aff0082a9c04ecc070a057ee9bd5e9af9469607

                                                          SHA256

                                                          1652cf1e654dc4897c6f1d0a7a7bed7ee0f3aa89ddf3fc0c78989350e575891a

                                                          SHA512

                                                          f067c058f0c062c7e9b328ff80097c1468157893d0fab4855bb2dd682a4f57ad090ebdd25ea9f743759008371500dea969d21bede2cac51d4aa84dd2216d9f0b

                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                          Filesize

                                                          865B

                                                          MD5

                                                          f2fb0eeac9c9bdaf29c664501cc37280

                                                          SHA1

                                                          18858457071c0da62d1c511d1b8267e60afc90c7

                                                          SHA256

                                                          6ff2d811b481aeca1bc5e8bcc266be83ec5bad2aa051449d6190e5dbf6287a32

                                                          SHA512

                                                          cca291684a66c3daf093501b2d05a09599c6fbe276111cc4aba9b54cb41b22d2bb7431e045b8ba80f52a144f11c73336f6a22a0c0760033e1184bb422af6037a

                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                          Filesize

                                                          5KB

                                                          MD5

                                                          dd48f6d5c74df1cc7238416c3695c2d1

                                                          SHA1

                                                          cd920043a4e13cbcb88c7c27a02829eb90721804

                                                          SHA256

                                                          dd795a5ec08662cf314c23fa148746668b08e7aece45a2e7e8804c63324f6f62

                                                          SHA512

                                                          d5990512d606cdfc93df65194f9aff70997c2f3c18a83ea42c225bd0a989619803ba9370164115f34c00ecdb74d3700ff62296e6991c3950d5220e76bf56b8e7

                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                          Filesize

                                                          7KB

                                                          MD5

                                                          44ee659f07a88256134ea52555e0d0b7

                                                          SHA1

                                                          6f880ce974d47bb501028029feb7795684b936df

                                                          SHA256

                                                          282b96547e6e9b809630002329def3fc37939d17741e52371d3778f94305bf3b

                                                          SHA512

                                                          5f9e6a07f34c7c684872abac43aafcd6e9ef4db1d1259fbc9431d227a5577f2efb8b4135828f6b40ce0aad8c6db376ead050eba41d0abdecb759863ceb9ddab3

                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                          Filesize

                                                          7KB

                                                          MD5

                                                          6401f07c803cc634e75c09e715933f63

                                                          SHA1

                                                          5c96b55c0455879b7ac9a28665c6324255c531cc

                                                          SHA256

                                                          f896ed04814057bf14ac6be73d263975afec89d5f582f3e089e7de5c45e4e0ff

                                                          SHA512

                                                          2d43cca66589ae316d0188a165ecb3038ee27dd288b410f5a53c5392a517b3e2f048e51087f9060302e06858407f3948fce5df743c8b6b2663bf31f04c74cf3c

                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                          Filesize

                                                          7KB

                                                          MD5

                                                          95a13f558a8ace7cc1c2970d0790c93b

                                                          SHA1

                                                          0370b02ad3067b7c8ea22c872afe3746572ae0a5

                                                          SHA256

                                                          197f6bcb5732beb37b60431b9a082641c39404e25b50235d1b6c2e76dffc98ad

                                                          SHA512

                                                          98e1b0c82d4ba8a1c7e8fe51e412270b92d7709216d00f940d9edfc6a1cee55019cd4db537fb819e59a517ed023f557d5d00f8e91fdacdc7539e0dd203067a32

                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                          Filesize

                                                          6KB

                                                          MD5

                                                          7fa2944cd5f8088cdc0d7f0995891095

                                                          SHA1

                                                          03c9975d6eb3ef8c5635ea7788fe392cb5ad6014

                                                          SHA256

                                                          90d8f15e28d92f1bc3a0ba88948da52e1bc625f9aa11e1364ce6d6ab11f7e49e

                                                          SHA512

                                                          e05699c7bba89e45715e700b5f7b72234824db31a76cbde44b1f4fc50626adb563d11647bfc3329c02da0533f2522d75352cd00677e96bdb105d71d5b5cf6e68

                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                          Filesize

                                                          7KB

                                                          MD5

                                                          54291b3d53f89611d85354305caaeebb

                                                          SHA1

                                                          0f28153285833e9da4f0530c048d69f461be5450

                                                          SHA256

                                                          7401d30b86bb58c827c3d52ad45536cd7d7b0cdd0e75b5b2f7b0ea23158d610b

                                                          SHA512

                                                          16f43b7e9419363c7c4914ceb82cc3a14babf56f7ea34336e602afc83008d9fc89816de39befb0189f03116b1c4dba88968e39c18d0775bef7e23fd542560f5c

                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                          Filesize

                                                          1KB

                                                          MD5

                                                          d065562cd5cee9eb37af49a87bbbeb5b

                                                          SHA1

                                                          667d7d281dadaa2fc7b677ad7c09b47f712b90e3

                                                          SHA256

                                                          d256efb2139ea8d810b4417e2d169733f46fad7b77510a36b430efa0f9f19b6a

                                                          SHA512

                                                          cae1c697eff98bbcf4bafc51f7d5cc8e98f128266b370c43bb2803d03bbb241018bed8873ebc8ad09260101aae1f6bed8dca738184c55fcd05318f0d55ae8a5e

                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                          Filesize

                                                          1KB

                                                          MD5

                                                          3af680e1f465d61748ec56e2d53f2585

                                                          SHA1

                                                          eed89042e6479a1477ae2f86b1b5753d49eb1320

                                                          SHA256

                                                          f2acabe6c616fcbbd83694eefc4b78fafe9279630e8182312c0a6aab44b81f93

                                                          SHA512

                                                          50032e2e33048d768e32c1c23f002605d4e4d88e328db4acceb415d5e627ae24e729f15c7b6cf270552a6cd36a846ae024ee6c57928912e624e3a978e60d47ea

                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                          Filesize

                                                          1KB

                                                          MD5

                                                          644a2e38818bbf29e4fa96c8c493530f

                                                          SHA1

                                                          c313fef2d469884ac72def8fefc2008e7eddcc88

                                                          SHA256

                                                          77d6097565dd90756fc497cde69754dcf7ca9d06f201275a0e69131ef285f714

                                                          SHA512

                                                          60644271a627ece4943a1cf677628dafe30fb0dbed7d66f6d1f03a3e0e444db51c2457583a559a1bb4995cec1d2170a8108f7cff0afd88169913da9072ca2e7e

                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                          Filesize

                                                          1KB

                                                          MD5

                                                          4e33cad58635ed0d5c4e4bac607eabf2

                                                          SHA1

                                                          d48729ed8e2451f5a95eaa5483590026db74ebf6

                                                          SHA256

                                                          f8a51fbd6c2ecfe5549359ebb9e08f61139fd26df6949b6e33d6b5f56ff0944c

                                                          SHA512

                                                          c2ad3e293b7493393ac5efc5ba5b710a2f6f5620996a5ff8b83eb25cead7fcacfe1bec47835fee4207f80a5ac5c01eec9c43950442df5e5afb8d5efd79cd6038

                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                          Filesize

                                                          1KB

                                                          MD5

                                                          69a238c18de650208f201684c39fa727

                                                          SHA1

                                                          e9151e8cc8fbe6f33f7d2e83e153aefd98760f63

                                                          SHA256

                                                          88fd837591bade565e0ba880c5cc52691637d03b05575b3ff793dc5b6bf01424

                                                          SHA512

                                                          b3583f42e92724147da262ef6e2d79d2aba705c9496d004451e81011aea8eefcfc1acbe23cd0e8f9d3878aef6231a0059ecec00fa468352b185516bf5c5eb672

                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57e2de.TMP

                                                          Filesize

                                                          874B

                                                          MD5

                                                          6cc01b0bedd7eadcc0503ca9cbab3b4f

                                                          SHA1

                                                          9afbd75b871a49c4ddebc8602f53a1d2c53eb8f5

                                                          SHA256

                                                          91921b17bf8adae209e8000dd13884385af4740719ce77002a8949e3a1617d68

                                                          SHA512

                                                          5924e5439d7b261f837e5c63938906b7b48698b3ad8af8283253cb594732d67fe436d2846545347151e08288ded968748927a870d2bb5c37b539cdd42c4b82ee

                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                                          Filesize

                                                          16B

                                                          MD5

                                                          6752a1d65b201c13b62ea44016eb221f

                                                          SHA1

                                                          58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                                          SHA256

                                                          0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                                          SHA512

                                                          9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                          Filesize

                                                          11KB

                                                          MD5

                                                          3c2546d52196162a9ac6bd1c2a9a4c65

                                                          SHA1

                                                          571f157ddf0cd5972030a87931a238f1e51fd280

                                                          SHA256

                                                          57674c4205c0b2961efbafd38c2887aad75cb3ce3386c36d7099680e95db6655

                                                          SHA512

                                                          4fc1f04c20e79047d40e07c316b188a42bb8dfe9aa0fabfd696a363589cf8957dab23b952388cc743d2727bab9d8c35929dd7bd29945e59ac4d6817626e12ce5

                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                          Filesize

                                                          12KB

                                                          MD5

                                                          558bb024e855fe9523c96f0718b40d27

                                                          SHA1

                                                          5c22930c4b663cb2e6c8df6d444f0279f10eb314

                                                          SHA256

                                                          a4a483644e817ceb87b96ee32c3d451db576ce2c5511233bb8d23a325f7df9ae

                                                          SHA512

                                                          3314cd49c9a37754d893ae262ac11cf08906c919fa408104b9c0c8d9091f847316fef87344a6340d08a92105241015fa0afd2f1dc82708135a75aba033743a4f

                                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\IFM58U6K\suggestions[1].en-US

                                                          Filesize

                                                          17KB

                                                          MD5

                                                          5a34cb996293fde2cb7a4ac89587393a

                                                          SHA1

                                                          3c96c993500690d1a77873cd62bc639b3a10653f

                                                          SHA256

                                                          c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

                                                          SHA512

                                                          e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

                                                        • C:\Users\Admin\Downloads\Unconfirmed 135286.crdownload

                                                          Filesize

                                                          232KB

                                                          MD5

                                                          60fabd1a2509b59831876d5e2aa71a6b

                                                          SHA1

                                                          8b91f3c4f721cb04cc4974fc91056f397ae78faa

                                                          SHA256

                                                          1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838

                                                          SHA512

                                                          3e842a7d47b32942adb936cae13293eddf1a6b860abcfe7422d0fb73098264cc95656b5c6d9980fad1bf8b5c277cd846c26acaba1bef441582caf34eb1e5295a

                                                        • C:\Users\Admin\Downloads\Unconfirmed 640245.crdownload

                                                          Filesize

                                                          431KB

                                                          MD5

                                                          fbbdc39af1139aebba4da004475e8839

                                                          SHA1

                                                          de5c8d858e6e41da715dca1c019df0bfb92d32c0

                                                          SHA256

                                                          630325cac09ac3fab908f903e3b00d0dadd5fdaa0875ed8496fcbb97a558d0da

                                                          SHA512

                                                          74eca8c01de215b33d5ceea1fda3f3bef96b513f58a750dba04b0de36f7ef4f7846a6431d52879ca0d8641bfd504d4721a9a96fa2e18c6888fd67fa77686af87

                                                        • C:\Windows\8B9C.tmp

                                                          Filesize

                                                          60KB

                                                          MD5

                                                          347ac3b6b791054de3e5720a7144a977

                                                          SHA1

                                                          413eba3973a15c1a6429d9f170f3e8287f98c21c

                                                          SHA256

                                                          301b905eb98d8d6bb559c04bbda26628a942b2c4107c07a02e8f753bdcfe347c

                                                          SHA512

                                                          9a399916bc681964af1e1061bc0a8e2926307642557539ad587ce6f9b5ef93bdf1820fe5d7b5ffe5f0bb38e5b4dc6add213ba04048c0c7c264646375fcd01787

                                                        • C:\Windows\infpub.dat

                                                          Filesize

                                                          401KB

                                                          MD5

                                                          1d724f95c61f1055f0d02c2154bbccd3

                                                          SHA1

                                                          79116fe99f2b421c52ef64097f0f39b815b20907

                                                          SHA256

                                                          579fd8a0385482fb4c789561a30b09f25671e86422f40ef5cca2036b28f99648

                                                          SHA512

                                                          f2d7b018d1516df1c97cfff5507957c75c6d9bf8e2ce52ae0052706f4ec62f13eba6d7be17e6ad2b693fdd58e1fd091c37f17bd2b948cdcd9b95b4ad428c0113

                                                        • C:\Windows\infpub.dat

                                                          Filesize

                                                          401KB

                                                          MD5

                                                          c4f26ed277b51ef45fa180be597d96e8

                                                          SHA1

                                                          e9efc622924fb965d4a14bdb6223834d9a9007e7

                                                          SHA256

                                                          14d82a676b63ab046ae94fa5e41f9f69a65dc7946826cb3d74cea6c030c2f958

                                                          SHA512

                                                          afc2a8466f106e81d423065b07aed2529cbf690ab4c3e019334f1bedfb42dc0e0957be83d860a84b7285bd49285503bfe95a1cf571a678dbc9bdb07789da928e

                                                        • memory/1924-1845-0x0000000000B70000-0x0000000000BD8000-memory.dmp

                                                          Filesize

                                                          416KB

                                                        • memory/1924-1852-0x0000000000B70000-0x0000000000BD8000-memory.dmp

                                                          Filesize

                                                          416KB

                                                        • memory/2592-1831-0x0000000002810000-0x0000000002878000-memory.dmp

                                                          Filesize

                                                          416KB

                                                        • memory/2592-1839-0x0000000002810000-0x0000000002878000-memory.dmp

                                                          Filesize

                                                          416KB

                                                        • memory/3412-1758-0x0000000000A10000-0x0000000000A78000-memory.dmp

                                                          Filesize

                                                          416KB

                                                        • memory/3412-1695-0x0000000000A10000-0x0000000000A78000-memory.dmp

                                                          Filesize

                                                          416KB

                                                        • memory/3412-1688-0x0000000000A10000-0x0000000000A78000-memory.dmp

                                                          Filesize

                                                          416KB

                                                        • memory/4864-1814-0x0000000000A10000-0x0000000000A78000-memory.dmp

                                                          Filesize

                                                          416KB

                                                        • memory/4864-1822-0x0000000000A10000-0x0000000000A78000-memory.dmp

                                                          Filesize

                                                          416KB

                                                        • memory/5832-1040-0x00000000051C0000-0x00000000051DA000-memory.dmp

                                                          Filesize

                                                          104KB

                                                        • memory/5832-1035-0x0000000010000000-0x0000000010010000-memory.dmp

                                                          Filesize

                                                          64KB