badrabbit | 49998dd0366a3d7dff3ec1b6c2add1c0f7283b42198273980025a41942bd8178

max time kernel
149s
max time network
151s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
28-08-2024 19:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Screenshot 2024-08-28 at 14.57.55.png
Size

419KB
MD5

00345903f4db4bb2c44099a766cbadb0
SHA1

9fba40eb3a9ffb65b24c98e47d36d99b56fe588c
SHA256

49998dd0366a3d7dff3ec1b6c2add1c0f7283b42198273980025a41942bd8178
SHA512

efb23c5a838b2407d9b5544dd864734dbb8c892c445cca6f3e41ad8a77ce73e9f85fc6be960981de840aed20b4190f322742d40dbc4ddaa1de8e2b4d6876984f
SSDEEP

12288:m0EHCJmoNmRxMquJhItGXNBd/GyUtlsUVhVg:mviJ3OM3nH4yUt19g

Score

10^/10

badrabbit mimikatz discovery ransomware

Malware Config

Signatures

BadRabbit
Ransomware family discovered in late 2017, mainly targeting Russia and Ukraine.
ransomware badrabbit
Mimikatz
mimikatz is an open source tool to dump credentials on Windows.
mimikatz

mimikatz is an open source tool to dump credentials on Windows 1 IoCs

resource	yara_rule
behavioral1/files/0x000900000001ab74-1216.dat	mimikatz

Executes dropped EXE 7 IoCs

pid	Process
5064	[email protected]
5236	B5CE.tmp
5544	[email protected]
5784	[email protected]
5968	[email protected]
4628	[email protected]
4704	[email protected]

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service

T1102

flow	ioc
211	raw.githubusercontent.com
212	raw.githubusercontent.com
213	raw.githubusercontent.com
210	raw.githubusercontent.com

Drops file in Windows directory 15 IoCs

description	ioc	Process
File opened for modification	C:\Windows\infpub.dat	rundll32.exe
File opened for modification	C:\Windows\infpub.dat	rundll32.exe
File opened for modification	C:\Windows\infpub.dat	rundll32.exe
File created	C:\Windows\infpub.dat	[email protected]
File opened for modification	C:\Windows\infpub.dat	rundll32.exe
File opened for modification	C:\Windows\infpub.dat	rundll32.exe
File created	C:\Windows\infpub.dat	[email protected]
File created	C:\Windows\cscc.dat	rundll32.exe
File created	C:\Windows\dispci.exe	rundll32.exe
File opened for modification	C:\Windows\B5CE.tmp	rundll32.exe
File created	C:\Windows\infpub.dat	[email protected]
File created	C:\Windows\infpub.dat	[email protected]
File created	C:\Windows\infpub.dat	[email protected]
File opened for modification	C:\Windows\infpub.dat	rundll32.exe
File created	C:\Windows\infpub.dat	[email protected]

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 18 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings	firefox.exe

NTFS ADS 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\BadRabbit.zip:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\InfinityCrypt.zip:Zone.Identifier	firefox.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5316	schtasks.exe
5184	schtasks.exe

Suspicious behavior: EnumeratesProcesses 21 IoCs

pid	Process
5128	rundll32.exe
5128	rundll32.exe
5128	rundll32.exe
5128	rundll32.exe
5236	B5CE.tmp
5236	B5CE.tmp
5236	B5CE.tmp
5236	B5CE.tmp
5236	B5CE.tmp
5236	B5CE.tmp
5236	B5CE.tmp
5596	rundll32.exe
5596	rundll32.exe
5908	rundll32.exe
5908	rundll32.exe
6000	rundll32.exe
6000	rundll32.exe
4820	rundll32.exe
4820	rundll32.exe
2800	rundll32.exe
2800	rundll32.exe

Suspicious use of AdjustPrivilegeToken 30 IoCs

description	pid	Process
Token: SeDebugPrivilege	4720	firefox.exe
Token: SeDebugPrivilege	4720	firefox.exe
Token: SeDebugPrivilege	4720	firefox.exe
Token: SeRestorePrivilege	6064	7zG.exe
Token: 35	6064	7zG.exe
Token: SeSecurityPrivilege	6064	7zG.exe
Token: SeSecurityPrivilege	6064	7zG.exe
Token: SeShutdownPrivilege	5128	rundll32.exe
Token: SeDebugPrivilege	5128	rundll32.exe
Token: SeTcbPrivilege	5128	rundll32.exe
Token: SeDebugPrivilege	5236	B5CE.tmp
Token: SeShutdownPrivilege	5596	rundll32.exe
Token: SeDebugPrivilege	5596	rundll32.exe
Token: SeTcbPrivilege	5596	rundll32.exe
Token: SeShutdownPrivilege	5908	rundll32.exe
Token: SeDebugPrivilege	5908	rundll32.exe
Token: SeTcbPrivilege	5908	rundll32.exe
Token: SeShutdownPrivilege	6000	rundll32.exe
Token: SeDebugPrivilege	6000	rundll32.exe
Token: SeTcbPrivilege	6000	rundll32.exe
Token: SeShutdownPrivilege	4820	rundll32.exe
Token: SeDebugPrivilege	4820	rundll32.exe
Token: SeTcbPrivilege	4820	rundll32.exe
Token: SeShutdownPrivilege	2800	rundll32.exe
Token: SeDebugPrivilege	2800	rundll32.exe
Token: SeTcbPrivilege	2800	rundll32.exe
Token: SeDebugPrivilege	4720	firefox.exe
Token: SeDebugPrivilege	4720	firefox.exe
Token: SeDebugPrivilege	4720	firefox.exe
Token: SeDebugPrivilege	4720	firefox.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
4720	firefox.exe
4720	firefox.exe
4720	firefox.exe
4720	firefox.exe
6064	7zG.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
4720	firefox.exe
4720	firefox.exe
4720	firefox.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
4720	firefox.exe
4720	firefox.exe
4720	firefox.exe
4720	firefox.exe
4720	firefox.exe
4720	firefox.exe
4720	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 520 wrote to memory of 4720	520	firefox.exe	77
PID 520 wrote to memory of 4720	520	firefox.exe	77
PID 520 wrote to memory of 4720	520	firefox.exe	77
PID 520 wrote to memory of 4720	520	firefox.exe	77
PID 520 wrote to memory of 4720	520	firefox.exe	77
PID 520 wrote to memory of 4720	520	firefox.exe	77
PID 520 wrote to memory of 4720	520	firefox.exe	77
PID 520 wrote to memory of 4720	520	firefox.exe	77
PID 520 wrote to memory of 4720	520	firefox.exe	77
PID 520 wrote to memory of 4720	520	firefox.exe	77
PID 520 wrote to memory of 4720	520	firefox.exe	77
PID 4720 wrote to memory of 4984	4720	firefox.exe	78
PID 4720 wrote to memory of 4984	4720	firefox.exe	78
PID 4720 wrote to memory of 200	4720	firefox.exe	79
PID 4720 wrote to memory of 200	4720	firefox.exe	79
PID 4720 wrote to memory of 200	4720	firefox.exe	79
PID 4720 wrote to memory of 200	4720	firefox.exe	79
PID 4720 wrote to memory of 200	4720	firefox.exe	79
PID 4720 wrote to memory of 200	4720	firefox.exe	79
PID 4720 wrote to memory of 200	4720	firefox.exe	79
PID 4720 wrote to memory of 200	4720	firefox.exe	79
PID 4720 wrote to memory of 200	4720	firefox.exe	79
PID 4720 wrote to memory of 200	4720	firefox.exe	79
PID 4720 wrote to memory of 200	4720	firefox.exe	79
PID 4720 wrote to memory of 200	4720	firefox.exe	79
PID 4720 wrote to memory of 200	4720	firefox.exe	79
PID 4720 wrote to memory of 200	4720	firefox.exe	79
PID 4720 wrote to memory of 200	4720	firefox.exe	79
PID 4720 wrote to memory of 200	4720	firefox.exe	79
PID 4720 wrote to memory of 200	4720	firefox.exe	79
PID 4720 wrote to memory of 200	4720	firefox.exe	79
PID 4720 wrote to memory of 200	4720	firefox.exe	79
PID 4720 wrote to memory of 200	4720	firefox.exe	79
PID 4720 wrote to memory of 200	4720	firefox.exe	79
PID 4720 wrote to memory of 200	4720	firefox.exe	79
PID 4720 wrote to memory of 200	4720	firefox.exe	79
PID 4720 wrote to memory of 200	4720	firefox.exe	79
PID 4720 wrote to memory of 200	4720	firefox.exe	79
PID 4720 wrote to memory of 200	4720	firefox.exe	79
PID 4720 wrote to memory of 200	4720	firefox.exe	79
PID 4720 wrote to memory of 200	4720	firefox.exe	79
PID 4720 wrote to memory of 200	4720	firefox.exe	79
PID 4720 wrote to memory of 200	4720	firefox.exe	79
PID 4720 wrote to memory of 200	4720	firefox.exe	79
PID 4720 wrote to memory of 200	4720	firefox.exe	79
PID 4720 wrote to memory of 200	4720	firefox.exe	79
PID 4720 wrote to memory of 200	4720	firefox.exe	79
PID 4720 wrote to memory of 200	4720	firefox.exe	79
PID 4720 wrote to memory of 200	4720	firefox.exe	79
PID 4720 wrote to memory of 200	4720	firefox.exe	79
PID 4720 wrote to memory of 200	4720	firefox.exe	79
PID 4720 wrote to memory of 200	4720	firefox.exe	79
PID 4720 wrote to memory of 200	4720	firefox.exe	79
PID 4720 wrote to memory of 200	4720	firefox.exe	79
PID 4720 wrote to memory of 200	4720	firefox.exe	79
PID 4720 wrote to memory of 200	4720	firefox.exe	79
PID 4720 wrote to memory of 200	4720	firefox.exe	79
PID 4720 wrote to memory of 200	4720	firefox.exe	79
PID 4720 wrote to memory of 200	4720	firefox.exe	79
PID 4720 wrote to memory of 200	4720	firefox.exe	79
PID 4720 wrote to memory of 200	4720	firefox.exe	79
PID 4720 wrote to memory of 1452	4720	firefox.exe	80
PID 4720 wrote to memory of 1452	4720	firefox.exe	80
PID 4720 wrote to memory of 1452	4720	firefox.exe	80

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Screenshot 2024-08-28 at 14.57.55.png"
1⤵
PID:5068

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:520
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4720
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4720.0.317275176\397169277" -parentBuildID 20221007134813 -prefsHandle 1716 -prefMapHandle 1708 -prefsLen 20747 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d59197ce-8846-4f4b-b6e5-fcbc779b1205} 4720 "\\.\pipe\gecko-crash-server-pipe.4720" 1796 26b925ce858 gpu
    3⤵
    PID:4984
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4720.1.2117483993\831349000" -parentBuildID 20221007134813 -prefsHandle 2140 -prefMapHandle 2136 -prefsLen 20828 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a2749651-a50c-47a2-ab6e-f08d526d8b0a} 4720 "\\.\pipe\gecko-crash-server-pipe.4720" 2152 26b80171f58 socket
    3⤵
    PID:200
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4720.2.339452628\793747824" -childID 1 -isForBrowser -prefsHandle 2736 -prefMapHandle 2944 -prefsLen 20931 -prefMapSize 233444 -jsInitHandle 1332 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ba04eff3-045f-4f28-bac7-12c5ca995fd0} 4720 "\\.\pipe\gecko-crash-server-pipe.4720" 2932 26b96799758 tab
    3⤵
    PID:1452
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4720.3.237999540\1818001363" -childID 2 -isForBrowser -prefsHandle 3432 -prefMapHandle 3428 -prefsLen 26109 -prefMapSize 233444 -jsInitHandle 1332 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {01a3788a-6ea0-404d-a613-57f4445abddd} 4720 "\\.\pipe\gecko-crash-server-pipe.4720" 3444 26b80162b58 tab
    3⤵
    PID:616
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4720.4.1900442924\749299723" -childID 3 -isForBrowser -prefsHandle 4276 -prefMapHandle 4272 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1332 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {02132475-beac-4962-8221-5da3dca3b64d} 4720 "\\.\pipe\gecko-crash-server-pipe.4720" 4288 26b985c0258 tab
    3⤵
    PID:4548
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4720.5.430396302\1851402598" -childID 4 -isForBrowser -prefsHandle 5012 -prefMapHandle 5004 -prefsLen 26328 -prefMapSize 233444 -jsInitHandle 1332 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8c3a595d-b234-4846-9d1f-407d15dbccf8} 4720 "\\.\pipe\gecko-crash-server-pipe.4720" 5020 26b8016d658 tab
    3⤵
    PID:620
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4720.6.1024475232\725226514" -childID 5 -isForBrowser -prefsHandle 5152 -prefMapHandle 5156 -prefsLen 26328 -prefMapSize 233444 -jsInitHandle 1332 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {adf7a5f2-e455-40ba-965d-982ae0469cc2} 4720 "\\.\pipe\gecko-crash-server-pipe.4720" 5144 26b99fc2158 tab
    3⤵
    PID:2668
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4720.7.1316418099\741006172" -childID 6 -isForBrowser -prefsHandle 5220 -prefMapHandle 5224 -prefsLen 26328 -prefMapSize 233444 -jsInitHandle 1332 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0752add6-e114-4726-9d65-c275290a1a32} 4720 "\\.\pipe\gecko-crash-server-pipe.4720" 5212 26b99fc2758 tab
    3⤵
    PID:3336
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4720.8.1017319847\1477711564" -childID 7 -isForBrowser -prefsHandle 5652 -prefMapHandle 5624 -prefsLen 26328 -prefMapSize 233444 -jsInitHandle 1332 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8b09095a-8739-4914-b0cb-3839bbe4984e} 4720 "\\.\pipe\gecko-crash-server-pipe.4720" 5664 26b9b050958 tab
    3⤵
    PID:3856
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4720.9.1081182045\394446145" -childID 8 -isForBrowser -prefsHandle 5792 -prefMapHandle 5892 -prefsLen 26503 -prefMapSize 233444 -jsInitHandle 1332 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {29adce2a-b1c4-4da1-8e39-24d1c8e87a4a} 4720 "\\.\pipe\gecko-crash-server-pipe.4720" 4404 26b9762b658 tab
    3⤵
    PID:1864
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4720.10.2075647513\872970815" -childID 9 -isForBrowser -prefsHandle 4260 -prefMapHandle 2588 -prefsLen 26503 -prefMapSize 233444 -jsInitHandle 1332 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a3acf670-0ec7-40bf-ba9f-5f2685acd734} 4720 "\\.\pipe\gecko-crash-server-pipe.4720" 3040 26b98df2358 tab
    3⤵
    PID:3836
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4720.11.679386878\828422839" -childID 10 -isForBrowser -prefsHandle 3196 -prefMapHandle 3180 -prefsLen 26503 -prefMapSize 233444 -jsInitHandle 1332 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {de01db04-a54c-4aeb-a495-c7b7d77be912} 4720 "\\.\pipe\gecko-crash-server-pipe.4720" 3096 26b99fc3958 tab
    3⤵
    PID:5104
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4720.12.718783681\2131821154" -childID 11 -isForBrowser -prefsHandle 5052 -prefMapHandle 9784 -prefsLen 26503 -prefMapSize 233444 -jsInitHandle 1332 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {6576d063-61fd-4447-87fa-2b365f4d6265} 4720 "\\.\pipe\gecko-crash-server-pipe.4720" 9648 26b9abed558 tab
    3⤵
    PID:3196
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4720.13.2125498283\837821204" -childID 12 -isForBrowser -prefsHandle 5668 -prefMapHandle 5752 -prefsLen 26503 -prefMapSize 233444 -jsInitHandle 1332 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {103061c1-0e68-4d86-b4ed-33156915afa7} 4720 "\\.\pipe\gecko-crash-server-pipe.4720" 9536 26b9b1e2658 tab
    3⤵
    PID:2152

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5908

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Virus\" -an -ai#7zMap7624:92:7zEvent11647
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:6064

C:\Users\Admin\Downloads\Virus\[email protected]
"C:\Users\Admin\Downloads\Virus\[email protected]"
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5064
- C:\Windows\SysWOW64\rundll32.exe
  C:\Windows\system32\rundll32.exe C:\Windows\infpub.dat,#1 15
  2⤵
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5128
- - C:\Windows\SysWOW64\cmd.exe
    /c schtasks /Delete /F /TN rhaegal
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3268
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /Delete /F /TN rhaegal
      4⤵
      System Location Discovery: System Language Discovery
      PID:2248
- - C:\Windows\SysWOW64\cmd.exe
    /c schtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR "C:\Windows\system32\cmd.exe /C Start \"\" \"C:\Windows\dispci.exe\" -id 101288387 && exit"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1860
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR "C:\Windows\system32\cmd.exe /C Start \"\" \"C:\Windows\dispci.exe\" -id 101288387 && exit"
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:5184
- - C:\Windows\SysWOW64\cmd.exe
    /c schtasks /Create /SC once /TN drogon /RU SYSTEM /TR "C:\Windows\system32\shutdown.exe /r /t 0 /f" /ST 20:12:00
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5196
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /Create /SC once /TN drogon /RU SYSTEM /TR "C:\Windows\system32\shutdown.exe /r /t 0 /f" /ST 20:12:00
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:5316
- - C:\Windows\B5CE.tmp
    "C:\Windows\B5CE.tmp" \\.\pipe\{407F27E3-F58B-44F5-9E59-53034BEA0BC3}
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5236

C:\Users\Admin\Downloads\Virus\[email protected]
"C:\Users\Admin\Downloads\Virus\[email protected]"
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5544
- C:\Windows\SysWOW64\rundll32.exe
  C:\Windows\system32\rundll32.exe C:\Windows\infpub.dat,#1 15
  2⤵
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5596

C:\Users\Admin\Downloads\Virus\[email protected]
"C:\Users\Admin\Downloads\Virus\[email protected]"
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5784
- C:\Windows\SysWOW64\rundll32.exe
  C:\Windows\system32\rundll32.exe C:\Windows\infpub.dat,#1 15
  2⤵
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5908

C:\Users\Admin\Downloads\Virus\[email protected]
"C:\Users\Admin\Downloads\Virus\[email protected]"
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5968
- C:\Windows\SysWOW64\rundll32.exe
  C:\Windows\system32\rundll32.exe C:\Windows\infpub.dat,#1 15
  2⤵
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:6000

C:\Users\Admin\Downloads\Virus\[email protected]
"C:\Users\Admin\Downloads\Virus\[email protected]"
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4628
- C:\Windows\SysWOW64\rundll32.exe
  C:\Windows\system32\rundll32.exe C:\Windows\infpub.dat,#1 15
  2⤵
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4820

C:\Users\Admin\Downloads\Virus\[email protected]
"C:\Users\Admin\Downloads\Virus\[email protected]"
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4704
- C:\Windows\SysWOW64\rundll32.exe
  C:\Windows\system32\rundll32.exe C:\Windows\infpub.dat,#1 15
  2⤵
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2800

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\cache2\doomed\10508

Filesize
46KB

MD5
56a7318026e4c8228f592cd250d961f6

SHA1
0589a0ab72b7db7043fcd3d282959d59e3ad97c1

SHA256
c7998cbbbfb1821f4057657b4436b02ec4185cd998119458c361e63835de800b

SHA512
d54ac72ef2a9ebfe9ae186b54c0b203f701ab110364c9d70a519cc2492eb4458b3c333aa539c866c158ed12ab6ce44104fb2075e4f1600dbf7ec6621f8e06f52

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\cache2\doomed\504

Filesize
14KB

MD5
ed41739f10065b5952b9b710ee16372b

SHA1
be4fdaa348929bc617aa599ec712e639a49a66ae

SHA256
08a57eb92abe82e8ffe43601ccbf109fa1328ec06c239b32a7fa2b02b850d2f1

SHA512
4af72eb3ce62c221eb14a7265d512f7cd9aedeaf9767836b52f33c8209118d291009ae2917533fd6877615d4a1edf51f18f91224f3b1e6a976fee8e4c21b8f4e

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\cache2\entries\0A73C6E23F02820E5C7F05AD9890531BF91D87DB

Filesize
111KB

MD5
6a1adff43d8d4e99d776f2ac983c8647

SHA1
418f8dc8af7bfffd45fc77f180912bc183795fe0

SHA256
2f0ed8eb9fc04bf9951dc41a028c3324fe208da47def4bfe258371f8c57bdcb8

SHA512
e25096318a95ca9e5f281116adbf0bdd91de2de70cfd753a507de782a19f392f6449090d15f0a27715dc7d513a4a563e6101a80204cdd5a27220af4114c6e463

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\cache2\entries\46C625DB4964C00323A8EF4C60828B52A454EBB4

Filesize
1.1MB

MD5
eb2a7510791a9be6b7b17d44b4d42ac7

SHA1
a0fb9a2d76cf9e86fb78740c40cde058d6ca9e3f

SHA256
86abcc349333885a495e98519a2fd5343c3dea7ecb091a9200136a9f66e552ae

SHA512
f84ef66fdd39bbbc6802a41b6e4e80da942d92fb9d410ef78d110f5b73779a761fa0f04951aeb75f0734db0a7e58ba3e0437a7fe9a4b572e7d18a0fbb332e8d9

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\cache2\entries\4BCF7D608B2663D7D1515223C0F13E5D72484770

Filesize
14KB

MD5
961ca971c6a2e995c5923bd1acd59906

SHA1
c6f395c0739e1803e9f300461f291c85588c1d15

SHA256
1167db4b2a45924e512bd6b12f1b64493c7b124e5269aca53dcb8275de298cad

SHA512
9fcad631bf14335e61518772b3935ec965054619902d5a8feb9099e5ab4bb4ebee9e66d1b0a950f2d3fcf180b55c4e75caae131408ba4d8e0dc4e8740914852a

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\cache2\entries\53C8C46F04350B64D691DB4860BD34DEDDBDBB16

Filesize
15KB

MD5
c923ccff9d4fa0bd174c243c948210f4

SHA1
c413103de4f9d6264df926afc4b0f45a5166f91d

SHA256
fcb0484bfed241e0526b0209ff201b3fe32af34d7de2fca8535629f8dee0f4c7

SHA512
533599d554cb7bdcc625c6d50f10694b20379dac75670a67fc075353cd652775d83c6070ec38241220796e944f575ee562df25bf65f62f2168ec3ea74bc10ce4

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\cache2\entries\7F30F53457983F11F2D61636C9FB5706ED9AB60D

Filesize
16KB

MD5
7bf0328b4d9cb3c8534bdfc0399df621

SHA1
21c4962ef0062391e01a9615ae18b0095a1a9829

SHA256
d4e6202d98704ac4c95794faf7aaee7203317f725695303e125dd041e1c3d150

SHA512
77671196afbedfcbab3346694a5f8a65ca20f249b64016a670a2de85fd449f1ef71c5c2420fe6866223c1cc9b529339d3070b04b42841f26a7b9ac19d43f277d

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\cache2\entries\971254C7341460E85C93D0821B91E9985A0B32D6

Filesize
2.0MB

MD5
5ce345425f83ff45b9c4487124e39652

SHA1
550c16f4a606dc9982852f8b6f4d2f6341169d8f

SHA256
8a97ce50b228ff0436c8f6845e5e147d7ec835460011bb2f9aa25b311fda7de9

SHA512
4c9e7ebf3a056e561d0db4a5464a43bc4e7ba66ac9438d987d436e6cc369d3711da73ccb8b9f1cb464a118b60ef7f19b0c304a75005b91e34d14061e9eb14967

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\cache2\entries\98AF737DD946CA3B37F8CD63EC1E1756F57F2E19

Filesize
68KB

MD5
9a51bf01e2cc6347816d71faa9a4bb73

SHA1
cf6daf0902c1929a32eef9ba279eb2c99cc17bd7

SHA256
00dbb198c073ccd365ff8b1b6e578576679609d09fffc1e9683e0cbefa295ce4

SHA512
cc910def2b5239df51a901a4dd3c0a8a7fb6f235f67165d49c81ecaa6381b2ed35c7679bada00d23ef26c968faee0ccad7a3231692e58efe6dd9aa6726a34ac0

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\cache2\entries\AC6959268E349C7B5497A3867D6DCDC4D543431E

Filesize
13KB

MD5
b1ea73def5864301d216bb5af10fe084

SHA1
cdc66ae5855eb76fc292fa9e127d367bb224b604

SHA256
baeef19159a7a315f3cd5d6b37cd0c91f482b4852b094f9c820481539cc5135a

SHA512
0ee07f9fd18324abe481447ff93c360e17c1d104cfe2a8b7dd93a5541c1fb3215351036b5843e73f288e1836735b33e49667db077fccabe66f2a2197e6ede49d

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\cache2\entries\AF6E7B7DB9908D7B867517AC33D094ABD56E38F7

Filesize
14KB

MD5
638d0448ebedefc4789febeaacfd1888

SHA1
b716c09967dbf2bae237d3eb685db39b47a06fb3

SHA256
9ea5414dcd71ba358b080aae609385a823b9788031c65f04c523f6d498ba9e1b

SHA512
c0e1f28c4f2b67f83429f62d900f83ee27994ddc771ac659ada086c2017b66a4636162364faee5fa9d3e7b6eabdac5330995213826085648ef066c1308bc511f

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\cache2\entries\FF405EA908A0CDBF948198368567C7EC073C7A02

Filesize
18KB

MD5
9db5284e00a527ded2a9df9a26d03b55

SHA1
41dbdf4a4b11451fea6758e076a1e5ce61da0bad

SHA256
acb15edbe35cbe8078f11aec95e90bffa5590f426f1b162af92e488dd259e1f4

SHA512
15cd1f7a30837f0aeb41fc94ccdb515003be597ccc6c8af8166b6491de17889dd55d134a6955701f2bc5cecf2ebf4e89fe669a965f26a3dad512780029c23729

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\datareporting\glean\db\data.safe.bin

Filesize
2KB

MD5
cec4a5c04c4324cc4c90faacd36a0c6a

SHA1
0b36bafdda6254c27f72696f6288334f48f97e7a

SHA256
23dd55fe055084ad2274b769d3d96539067158565639b15781322154f7700152

SHA512
af8afd03d9464a1698f170e03ef924356f782f5189a5d5b469adb243d1de6a73fde09240486594d88e4b3dddf4b8cb5c81564b948ea671466048fd737480b406

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\datareporting\glean\pending_pings\741a6023-9291-4ed6-a5fd-a30da62f3f10

Filesize
10KB

MD5
9d21b0eab5f2c8120e6023e89087bc5c

SHA1
17b7a7662f7ccfff8454600c8c4796a5e3d61b97

SHA256
3b3a76928166611c4e71d13d622fab02895aa9e34ade5359399952c079068043

SHA512
75d58415f27e817994fa7e1123f354d8ad7fc7878181316328e3a4720813bd1c423a88c9f538006c98df07f60009e495e22bf2243c26f0a4bb02af1def76ad2d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\datareporting\glean\pending_pings\dae5d53d-be04-49c5-a533-581aea963a54

Filesize
746B

MD5
888fb3a8627bdb59124342fef1858aa7

SHA1
c63afb73b5f5e25c6042f380f46bf6576e982ab6

SHA256
5d92eccff4a3b1d77ce768369384478032e2e76650bf09f7348ab4ca38bacec1

SHA512
3f1b367c94b298aba73678551b389d2d344c958ee9457e1bced42cb8e9061a4a8c8753aad7cd225e0ecd5c5a5ae3a79791bc28e01510ba2455fbd5d8e14f6c80

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\prefs-1.js

Filesize
6KB

MD5
7052f947b41d5dbeeeb4a1b6ee630f2d

SHA1
43c0bc0b7d6b00f5cbe388e7af16af8d3226c7e5

SHA256
62d3f9f623ef6817f7e2b600bb67d93bbd84cbcbd872b465a63bcd1d93fd82af

SHA512
7fab09e3dab5b7a09b35f130f341bbaca8febf7fcdb83a2ece835807d502727f6ec05061ddfc2b67454ed099f19537e812401682e8a1769b15c3796232c6103e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\prefs-1.js

Filesize
6KB

MD5
a0bbd58ac9c48fc31525d87dd0daa8d9

SHA1
fe4cabf1a11a361c61d64aba4c340f2bd5a99bcb

SHA256
5083eae5d00b232fa34effd8b59fd97f7903fbc31c62f0081796ef23b4b91500

SHA512
2466f9c54c2dc002679d9a5ac570c8d002ece9c1289268069ef9373101f7b45f2bb1e5a3a72f90372c00bbcfe258b2de0dd34ebccb08f00e02a3651a5150d041

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\prefs-1.js

Filesize
6KB

MD5
56025e1598fa346f8693d8a664baa050

SHA1
ed4801b18a42124702f4e428802c509cbd517b0b

SHA256
a8831d8e044a86791f2b1b574979997c474e08e9bf81a3191a195f4bfc48f77e

SHA512
61736e63c1dcccc37ffd489f9e1d8a7fe1941c54efb279ad4d03d2bd9a67be177046ef015f295ed5042067c5aba0e1b7e9d8ccb4ac2dc59d2462a46e6f8bed59

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
8KB

MD5
11d78473737955033686e8a780aca52d

SHA1
16f0d01bb3175e94ced78281da946b471d28a58d

SHA256
08a67eeb83fbaf4f7f64104bb1daae869a5d1433d05ab2158951b08f632d73da

SHA512
f8d2b4bf8277c991b5402c4fce0734fd525efbce54f67fa961420976e6b7dd5d4b602f64c2d975945b0d431e4de7de3e1b22a9d7e94f3f9d974034b99367dda6

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
3KB

MD5
57150a79080e1c5a3434cbc3535d2193

SHA1
22a3bba51a48d5636bb114a6a16347a4e79ffd17

SHA256
999c16bec04f5b0d15a00b6ffab3f2f469b42c551aba952509fb1f0f1b5dd6d1

SHA512
d515e633e5f94eaa62663dc82167cf882224268a7d8f54441b446647e1f7f1b6ae6bc536f4acee6b06f29e9842566c6547450e86d8b72212498c105439c9e620

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
8KB

MD5
0e19c76c4088bef59fac7ea27168c657

SHA1
bd3c7930363c60d58bc01221de692ade6cd53705

SHA256
4160bfdb03e47480c9ab7ed61b6e71e77b60e34e103842fc4e973b4623e4d193

SHA512
cac5f85a6fc1567a9874e5fe64c6f16a7b6a356d9b21f86e103a3d8978e82406d4d7327527c99fe2555efcce53a88a4a31c2f55c06182fc0ed15b2fcb5cb82ba

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
9KB

MD5
8bbc0820303d751c652a247542f0a2d4

SHA1
474767479e31aff715559ca524d9fb2dbd0d42f0

SHA256
5065b783ac5a8d9cde6ce95f31fce21f9a112ceecfc3489ce35774a029423246

SHA512
a22dafbe05be195ae7a1b765a80c65985dc8921d8ed60d0f7ce4048a26c367c51e57af5171aa2285b239f8827c2fe01fc755675f0dacaec6d0a987a43913d76c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
7KB

MD5
760ee3f35c16f5c3fc2955cc28b06459

SHA1
edbbfecf958a39e676669a2041ec7458eced1264

SHA256
0f92fca53bf054d0f19eba0e7f9dbf0e2b343907228deb8a7d36b022f0de0b3d

SHA512
4b4d792daec0a9f7fa10d03e20e09d11631903231a6ff1c3f776bc516baccae6ec8c353e9e47620ffe7eab37003b425a8f623bf17873b7ce78d17b0d6a79bf98

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
184KB

MD5
a4627d94b477e3f653435fcf27e2663d

SHA1
d5dc31c0165277e469d92453c556786995e2800d

SHA256
7c1ea6cee0386d6af3cb7523167c2b880592657ceacc4e56edbc2394575c5c69

SHA512
7619d8f8f790c6b47faa75eb3f834640fe6ab684209f2eeb6eff26017c7ebb44972018463bb15d0e7955bed5bde4ebff809754b3c2057d7749bafe82dbe48455

Download Submit
C:\Users\Admin\Downloads\-Gj_peYX.zip.part

Filesize
393KB

MD5
61da9939db42e2c3007ece3f163e2d06

SHA1
4bd7e9098de61adecc1bdbd1a01490994d1905fb

SHA256
ea8ccb8b5ec36195af831001b3cc46caedfc61a6194e2568901e7685c57ceefa

SHA512
14d0bc14a10e5bd8022e7ab4a80f98600f84754c2c80e22a8e3d9f9555dde5bad056d925576b29fc1a37e73c6ebca693687b47317a469a7dfdc4ab0f3d97a63e

Download Submit
C:\Users\Admin\Downloads\Ns5ogwtV.zip.part

Filesize
33KB

MD5
5569bfe4f06724dd750c2a4690b79ba0

SHA1
05414c7d5dacf43370ab451d28d4ac27bdcabf22

SHA256
cfa4daab47e6eb546323d4c976261aefba3947b4cce1a655dde9d9d6d725b527

SHA512
775bd600625dc5d293cfebb208d7dc9b506b08dd0da22124a7a69fb435756c2a309cbd3d813fc78543fd9bae7e9b286a5bd83a956859c05f5656daa96fcc2165

Download Submit
C:\Users\Admin\Downloads\Virus\BadRabbit.zip

Filesize
393KB

MD5
875cc3ba79d20c0ec87e7eb503753e81

SHA1
b84febde8e5f71099ea9df98da5c7d681d24fdaf

SHA256
6ffde0ebce633202fef142170d8c1952ac9a4bc6b074dda77f3971029a9c0f8e

SHA512
cf6e26e7ea7d638997c938c182dc9da1731b50e49d27f2519e024c831c9c55c626bac9d66771ecab36738a2508d093af6d97a3b18494bf5204dad900791c0423

Download Submit
C:\Users\Admin\Downloads\Virus\[email protected]

Filesize
431KB

MD5
fbbdc39af1139aebba4da004475e8839

SHA1
de5c8d858e6e41da715dca1c019df0bfb92d32c0

SHA256
630325cac09ac3fab908f903e3b00d0dadd5fdaa0875ed8496fcbb97a558d0da

SHA512
74eca8c01de215b33d5ceea1fda3f3bef96b513f58a750dba04b0de36f7ef4f7846a6431d52879ca0d8641bfd504d4721a9a96fa2e18c6888fd67fa77686af87

Download Submit
C:\Windows\B5CE.tmp

Filesize
60KB

MD5
347ac3b6b791054de3e5720a7144a977

SHA1
413eba3973a15c1a6429d9f170f3e8287f98c21c

SHA256
301b905eb98d8d6bb559c04bbda26628a942b2c4107c07a02e8f753bdcfe347c

SHA512
9a399916bc681964af1e1061bc0a8e2926307642557539ad587ce6f9b5ef93bdf1820fe5d7b5ffe5f0bb38e5b4dc6add213ba04048c0c7c264646375fcd01787

Download Submit
C:\Windows\infpub.dat

Filesize
401KB

MD5
1d724f95c61f1055f0d02c2154bbccd3

SHA1
79116fe99f2b421c52ef64097f0f39b815b20907

SHA256
579fd8a0385482fb4c789561a30b09f25671e86422f40ef5cca2036b28f99648

SHA512
f2d7b018d1516df1c97cfff5507957c75c6d9bf8e2ce52ae0052706f4ec62f13eba6d7be17e6ad2b693fdd58e1fd091c37f17bd2b948cdcd9b95b4ad428c0113

Download Submit
C:\Windows\infpub.dat

Filesize
401KB

MD5
c29d6253d89ee9c0c872dd377a7a8454

SHA1
46be3800684f6b208e0a8c7b120ef8614c22c4b0

SHA256
03f4198a279ea4c36a62cd271d3b2d796547013548666006fbef45e20bb920cb

SHA512
50141de5e0a827688251161353932b677c85e0d6e6831293c9a0044543e541fe8bd4e62fa403abc06df9d220fd843aa58ff9cc37abf46be3e06ae14905c24a5e

Download Submit
C:\Windows\infpub.dat

Filesize
401KB

MD5
c4f26ed277b51ef45fa180be597d96e8

SHA1
e9efc622924fb965d4a14bdb6223834d9a9007e7

SHA256
14d82a676b63ab046ae94fa5e41f9f69a65dc7946826cb3d74cea6c030c2f958

SHA512
afc2a8466f106e81d423065b07aed2529cbf690ab4c3e019334f1bedfb42dc0e0957be83d860a84b7285bd49285503bfe95a1cf571a678dbc9bdb07789da928e

Download Submit
memory/4820-1290-0x00000000047D0000-0x0000000004838000-memory.dmp

Filesize
416KB

Download
memory/5128-1210-0x00000000042B0000-0x0000000004318000-memory.dmp

Filesize
416KB

Download
memory/5128-1204-0x00000000042B0000-0x0000000004318000-memory.dmp

Filesize
416KB

Download
memory/5128-1196-0x00000000042B0000-0x0000000004318000-memory.dmp

Filesize
416KB

Download
memory/5596-1248-0x00000000030C0000-0x0000000003128000-memory.dmp

Filesize
416KB

Download
memory/5596-1240-0x00000000030C0000-0x0000000003128000-memory.dmp

Filesize
416KB

Download
memory/5908-1274-0x0000000004870000-0x00000000048D8000-memory.dmp

Filesize
416KB

Download
memory/5908-1266-0x0000000004870000-0x00000000048D8000-memory.dmp

Filesize
416KB

Download
memory/6000-1286-0x00000000041B0000-0x0000000004218000-memory.dmp

Filesize
416KB

Download
memory/6000-1278-0x00000000041B0000-0x0000000004218000-memory.dmp

Filesize
416KB

Download