mimikatz | hxxps://github[.]com/enginestein/Virus-Collection/tree/main/Windows/Binaries

Analysis

max time kernel
1799s
max time network
1800s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
10-09-2024 06:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/enginestein/Virus-Collection/tree/main/Windows/Binaries

Score

10^/10

mimikatz bootkit defense_evasion discovery persistence spyware stealer

Malware Config

Signatures

Mimikatz
mimikatz is an open source tool to dump credentials on Windows.
mimikatz

mimikatz is an open source tool to dump credentials on Windows 1 IoCs

resource	yara_rule
behavioral1/files/0x000400000000f3dc-476.dat	mimikatz

Blocklisted process makes network request 9 IoCs

flow	pid	Process
1458	4848	rundll32.exe
1483	4848	rundll32.exe
1492	4848	rundll32.exe
1521	4848	rundll32.exe
1529	4848	rundll32.exe
1556	4848	rundll32.exe
1563	4848	rundll32.exe
1590	4848	rundll32.exe
1599	4848	rundll32.exe

Downloads MZ/PE file

Executes dropped EXE 8 IoCs

pid	Process
1316	rickroll.exe
4248	rickroll.exe
4392	rickroll.exe
4324	rickroll.exe
1348	rickroll.exe
2428	NotPetya.exe
3220	48E1.tmp
4640	NotPetya.exe

Loads dropped DLL 2 IoCs

pid	Process
4848	rundll32.exe
3688	rundll32.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
1	raw.githubusercontent.com
2	raw.githubusercontent.com
27	raw.githubusercontent.com

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	rundll32.exe

Drops file in Program Files directory 54 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\HomeBanner_Light.pdf	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Welcome.pdf	rundll32.exe
File opened for modification	C:\Program Files\ExpandShow.zip	rundll32.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC	rundll32.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.PPT	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\MobileScanCard_Light.pdf	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\Complex Machine.pdf	rundll32.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrome.7z	rundll32.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\include\win32\bridge\AccessBridgeCalls.c	rundll32.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\include\classfile_constants.h	rundll32.exe
File opened for modification	C:\Program Files\Microsoft Office\Office16\OSPP.VBS	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\Dynamic.pdf	rundll32.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\include\jvmti.h	rundll32.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\include\jvmticmlr.h	rundll32.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\deploy\ffjcext.zip	rundll32.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\1494870C-9912-C184-4CC9-B401-A53F4D8DE290.pdf	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\MobileAcrobatCard_Light.pdf	rundll32.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\amd64\jvm.cfg	rundll32.exe
File opened for modification	C:\Program Files\NewRemove.rar	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\DefaultID.pdf	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\Adobe Sign White Paper.pdf	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\Bus Schedule.pdf	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\Adobe Cloud Services.pdf	rundll32.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\java.settings.cfg	rundll32.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\include\jawt.h	rundll32.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\include\win32\bridge\AccessBridgePackages.h	rundll32.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\include\win32\jni_md.h	rundll32.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\javafx-src.zip	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\AdobeID.pdf	rundll32.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.PPT	rundll32.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.XLS	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\MobileScanCard_Dark.pdf	rundll32.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\include\win32\jawt_md.h	rundll32.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.cfg	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\MobileAcrobatCard_Dark.pdf	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\ENUtxt.pdf	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\Words.pdf	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\Adobe Acrobat Pro DC.pdf	rundll32.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\include\jni.h	rundll32.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\include\win32\bridge\AccessBridgeCallbacks.h	rundll32.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\include\win32\bridge\AccessBridgeCalls.h	rundll32.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\amd64\jvm.cfg	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\PDFSigQFormalRep.pdf	rundll32.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.XLS	rundll32.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Web Server Extensions\16\BIN\1033\FPEXT.MSG	rundll32.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\SHELLNEW\EXCEL12.XLSX	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\StandardBusiness.pdf	rundll32.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\include\jdwpTransport.h	rundll32.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SAMPLES\SOLVSAMP.XLS	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\SignHere.pdf	rundll32.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\ffjcext.zip	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Click on 'Change' to select default PDF handler.pdf	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\HomeBanner_Dark.pdf	rundll32.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File created	C:\Windows\perfc.dat	NotPetya.exe
File opened for modification	C:\Windows\perfc.dat	rundll32.exe
File created	C:\Windows\perfc	rundll32.exe
File created	C:\Windows\dllhost.dat	rundll32.exe
File created	C:\Windows\perfc.dat	NotPetya.exe
File opened for modification	C:\Windows\perfc.dat	rundll32.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 2 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\rickroll.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\NotPetya.exe:Zone.Identifier	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NotPetya.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NotPetya.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-6179872-1886041298-1573312864-1000_Classes\Local Settings	msedge.exe

NTFS ADS 4 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 193834.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\NotPetya.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 759873.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\rickroll.exe:Zone.Identifier	msedge.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1752	schtasks.exe

Suspicious behavior: EnumeratesProcesses 27 IoCs

pid	Process
3840	msedge.exe
3840	msedge.exe
4296	msedge.exe
4296	msedge.exe
2364	msedge.exe
2364	msedge.exe
3168	identity_helper.exe
3168	identity_helper.exe
1368	msedge.exe
1368	msedge.exe
1820	msedge.exe
1820	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
4848	rundll32.exe
4848	rundll32.exe
3220	48E1.tmp
3220	48E1.tmp
3220	48E1.tmp
3220	48E1.tmp
3220	48E1.tmp
3220	48E1.tmp
3220	48E1.tmp
3688	rundll32.exe
3688	rundll32.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4848	rundll32.exe
Token: SeDebugPrivilege	4848	rundll32.exe
Token: SeTcbPrivilege	4848	rundll32.exe
Token: SeDebugPrivilege	3220	48E1.tmp
Token: SeShutdownPrivilege	3688	rundll32.exe
Token: SeDebugPrivilege	3688	rundll32.exe
Token: SeTcbPrivilege	3688	rundll32.exe

Suspicious use of FindShellTrayWindow 45 IoCs

pid	Process
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2428	NotPetya.exe
4640	NotPetya.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4296 wrote to memory of 4820	4296	msedge.exe	81
PID 4296 wrote to memory of 4820	4296	msedge.exe	81
PID 4296 wrote to memory of 1924	4296	msedge.exe	82
PID 4296 wrote to memory of 1924	4296	msedge.exe	82
PID 4296 wrote to memory of 1924	4296	msedge.exe	82
PID 4296 wrote to memory of 1924	4296	msedge.exe	82
PID 4296 wrote to memory of 1924	4296	msedge.exe	82
PID 4296 wrote to memory of 1924	4296	msedge.exe	82
PID 4296 wrote to memory of 1924	4296	msedge.exe	82
PID 4296 wrote to memory of 1924	4296	msedge.exe	82
PID 4296 wrote to memory of 1924	4296	msedge.exe	82
PID 4296 wrote to memory of 1924	4296	msedge.exe	82
PID 4296 wrote to memory of 1924	4296	msedge.exe	82
PID 4296 wrote to memory of 1924	4296	msedge.exe	82
PID 4296 wrote to memory of 1924	4296	msedge.exe	82
PID 4296 wrote to memory of 1924	4296	msedge.exe	82
PID 4296 wrote to memory of 1924	4296	msedge.exe	82
PID 4296 wrote to memory of 1924	4296	msedge.exe	82
PID 4296 wrote to memory of 1924	4296	msedge.exe	82
PID 4296 wrote to memory of 1924	4296	msedge.exe	82
PID 4296 wrote to memory of 1924	4296	msedge.exe	82
PID 4296 wrote to memory of 1924	4296	msedge.exe	82
PID 4296 wrote to memory of 1924	4296	msedge.exe	82
PID 4296 wrote to memory of 1924	4296	msedge.exe	82
PID 4296 wrote to memory of 1924	4296	msedge.exe	82
PID 4296 wrote to memory of 1924	4296	msedge.exe	82
PID 4296 wrote to memory of 1924	4296	msedge.exe	82
PID 4296 wrote to memory of 1924	4296	msedge.exe	82
PID 4296 wrote to memory of 1924	4296	msedge.exe	82
PID 4296 wrote to memory of 1924	4296	msedge.exe	82
PID 4296 wrote to memory of 1924	4296	msedge.exe	82
PID 4296 wrote to memory of 1924	4296	msedge.exe	82
PID 4296 wrote to memory of 1924	4296	msedge.exe	82
PID 4296 wrote to memory of 1924	4296	msedge.exe	82
PID 4296 wrote to memory of 1924	4296	msedge.exe	82
PID 4296 wrote to memory of 1924	4296	msedge.exe	82
PID 4296 wrote to memory of 1924	4296	msedge.exe	82
PID 4296 wrote to memory of 1924	4296	msedge.exe	82
PID 4296 wrote to memory of 1924	4296	msedge.exe	82
PID 4296 wrote to memory of 1924	4296	msedge.exe	82
PID 4296 wrote to memory of 1924	4296	msedge.exe	82
PID 4296 wrote to memory of 1924	4296	msedge.exe	82
PID 4296 wrote to memory of 3840	4296	msedge.exe	83
PID 4296 wrote to memory of 3840	4296	msedge.exe	83
PID 4296 wrote to memory of 2924	4296	msedge.exe	84
PID 4296 wrote to memory of 2924	4296	msedge.exe	84
PID 4296 wrote to memory of 2924	4296	msedge.exe	84
PID 4296 wrote to memory of 2924	4296	msedge.exe	84
PID 4296 wrote to memory of 2924	4296	msedge.exe	84
PID 4296 wrote to memory of 2924	4296	msedge.exe	84
PID 4296 wrote to memory of 2924	4296	msedge.exe	84
PID 4296 wrote to memory of 2924	4296	msedge.exe	84
PID 4296 wrote to memory of 2924	4296	msedge.exe	84
PID 4296 wrote to memory of 2924	4296	msedge.exe	84
PID 4296 wrote to memory of 2924	4296	msedge.exe	84
PID 4296 wrote to memory of 2924	4296	msedge.exe	84
PID 4296 wrote to memory of 2924	4296	msedge.exe	84
PID 4296 wrote to memory of 2924	4296	msedge.exe	84
PID 4296 wrote to memory of 2924	4296	msedge.exe	84
PID 4296 wrote to memory of 2924	4296	msedge.exe	84
PID 4296 wrote to memory of 2924	4296	msedge.exe	84
PID 4296 wrote to memory of 2924	4296	msedge.exe	84
PID 4296 wrote to memory of 2924	4296	msedge.exe	84
PID 4296 wrote to memory of 2924	4296	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/enginestein/Virus-Collection/tree/main/Windows/Binaries
1⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fffa09e3cb8,0x7fffa09e3cc8,0x7fffa09e3cd8
  2⤵
  PID:4820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1880,9456653869267822231,12417803641630466769,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1892 /prefetch:2
  2⤵
  PID:1924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1880,9456653869267822231,12417803641630466769,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2272 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1880,9456653869267822231,12417803641630466769,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2532 /prefetch:8
  2⤵
  PID:2924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,9456653869267822231,12417803641630466769,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:4352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,9456653869267822231,12417803641630466769,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:3204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1880,9456653869267822231,12417803641630466769,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4876 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2364
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1880,9456653869267822231,12417803641630466769,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5624 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,9456653869267822231,12417803641630466769,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5264 /prefetch:1
  2⤵
  PID:4736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,9456653869267822231,12417803641630466769,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5660 /prefetch:1
  2⤵
  PID:2408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,9456653869267822231,12417803641630466769,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5340 /prefetch:1
  2⤵
  PID:4224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1880,9456653869267822231,12417803641630466769,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6168 /prefetch:8
  2⤵
  PID:3984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,9456653869267822231,12417803641630466769,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6200 /prefetch:1
  2⤵
  PID:2268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,9456653869267822231,12417803641630466769,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6272 /prefetch:1
  2⤵
  PID:4256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1880,9456653869267822231,12417803641630466769,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5280 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:1368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,9456653869267822231,12417803641630466769,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4672 /prefetch:1
  2⤵
  PID:5000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1880,9456653869267822231,12417803641630466769,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6648 /prefetch:8
  2⤵
  PID:3480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1880,9456653869267822231,12417803641630466769,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6548 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:1820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1880,9456653869267822231,12417803641630466769,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=6608 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:784

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2700

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3520

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3420

C:\Users\Admin\Downloads\rickroll.exe
"C:\Users\Admin\Downloads\rickroll.exe"
1⤵
- Executes dropped EXE
PID:1316

C:\Users\Admin\Downloads\rickroll.exe
"C:\Users\Admin\Downloads\rickroll.exe"
1⤵
- Executes dropped EXE
PID:4248

C:\Users\Admin\Downloads\rickroll.exe
"C:\Users\Admin\Downloads\rickroll.exe"
1⤵
- Executes dropped EXE
PID:4392

C:\Users\Admin\Downloads\rickroll.exe
"C:\Users\Admin\Downloads\rickroll.exe"
1⤵
- Executes dropped EXE
PID:4324

C:\Users\Admin\Downloads\rickroll.exe
"C:\Users\Admin\Downloads\rickroll.exe"
1⤵
- Executes dropped EXE
PID:1348

C:\Users\Admin\Downloads\NotPetya.exe
"C:\Users\Admin\Downloads\NotPetya.exe"
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2428
- C:\Windows\SysWOW64\rundll32.exe
  "C:\Windows\System32\rundll32.exe" C:\Windows\perfc.dat #1
  2⤵
  - Blocklisted process makes network request
  - Loads dropped DLL
  - Writes to the Master Boot Record (MBR)
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4848
- - C:\Windows\SysWOW64\cmd.exe
    /c schtasks /Create /SC once /TN "" /TR "C:\Windows\system32\shutdown.exe /r /f" /ST 07:31
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4616
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /Create /SC once /TN "" /TR "C:\Windows\system32\shutdown.exe /r /f" /ST 07:31
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:1752
- - C:\Users\Admin\AppData\Local\Temp\48E1.tmp
    "C:\Users\Admin\AppData\Local\Temp\48E1.tmp" \\.\pipe\{8ED2DE2E-1C30-435D-9E5D-0A7686FA0701}
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3220

C:\Users\Admin\Downloads\NotPetya.exe
"C:\Users\Admin\Downloads\NotPetya.exe"
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4640
- C:\Windows\SysWOW64\rundll32.exe
  "C:\Windows\System32\rundll32.exe" C:\Windows\perfc.dat #1
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3688

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
302c3de891ef3a75b81a269db4e1cf22

SHA1
5401eb5166da78256771e8e0281ca2d1f471c76f

SHA256
1d1640e5755779c90676290853d2e3ca948f57cf5fb1df4b786e277a97757f58

SHA512
da18e7d40376fd13255f3f67a004c3a7f408466bd7ce92e36a4d0c20441279fe4b1b6e0874ab74c494663fb97bd7992b5e7c264b3fc434c1e981326595263d33

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c9efc5ba989271670c86d3d3dd581b39

SHA1
3ad714bcf6bac85e368b8ba379540698d038084f

SHA256
c2e16990b0f6f23efdcecd99044993a4c2b8ba87bd542dd8f6256d69e24b93b3

SHA512
c1bc0dc70ab827b54feb64ad069d21e1c3c28d57d126b08314a9670437881d77dba02b5cca57ef0f2aa7f8e7d4d163fbd2c6f246ea2d51ce201d61a89015e8b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6043fb21-de07-4e9e-9451-c6bd90d1cb23.tmp

Filesize
579B

MD5
a7d1701142cca705f833d70023ef4e1e

SHA1
1b76853132abfcddb4fefac42bf9df5d013c9815

SHA256
6c92f51e7f056e73c407228fc280cb7ca4d00ab02674d1dda4eafd7dc9f070f7

SHA512
806b7ccb375cc6116e64a9fa15229d783615d13b54cf40251561d9b664f0925915c5375ad88f5ca8d061e01367de239c29da79adf693559af53eeb7d9b1ba1a0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
c019814d0d63a9f8cf45150159a9605a

SHA1
87edc0a35129832f0f3d6cf1eaa231128982cd1a

SHA256
914e87864fbcd7b68bd7829a405d5f24bd0e9701e778d56c25c462182eef948e

SHA512
3105edc4a275f86da6113614dd53f5a316b54f777b10575b0f6dfaa7c97be37c2ec51ad18923e414e6001101a2a99006c924b645d1ae1cb9ba1c238af11fef54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
fe0912cca482d59555f2aee4e8eb2e42

SHA1
c38656a244decb3681267d65118c1723ff51707b

SHA256
1fa5c0bbca0ef30f1afaf38360e24b4abdf546cfae3a21432dfe1ca8142d4187

SHA512
d17fc5f26c7a6ff988cad4655451a05c15d5068f8f5111d8010c5eecf1dccc0eff537e11e47bdf7ad373f4e6752fafd0da15148d002a74e18a7a50ca96fc155a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f2aa1ce81e09aad5e2c42a3c4651239e

SHA1
da4a4555c514e3fd73390d1b734d98cfbcc2f663

SHA256
6bc4178859d71b8a57fdc0fa04d9631c401295506a01eb7f147af550ac3e3068

SHA512
f1c6a398a6304f94e084076bc13c2527ad8d3c25372fa100f2e3a7596adff983c86569d49c4ab9b17e65732587548887ae944ad08a679bd5db57aa83760e32df

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
f2a90d30c8e5f33acbc7b775a0bf8833

SHA1
f12448c6f053dc5359939eb9a5320cdc2a273753

SHA256
4db3dcfb40c28ceb969cac1dc2728fc9068fbc40f54b0cb5cef1252382d6a449

SHA512
b412991e5ae3c1cae385b95c15736235252e3f523306b2a06065c53707ddc2a09ff0c794ad261118f19b4433b546082bd1311b103ceab60414adf1c1d720ec7a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
528b0095c6b41101d28eb17796d6311a

SHA1
b564f3fbf8157b58fb40e107a2829a363a1fb508

SHA256
f2afa377e216e05cd44879103c4d0a716b86462a7f396e4071d50d161f5e3aa3

SHA512
d35098af162e5df2e6a5414727b44a6d29f3534a46a0b8a76c15ca14c18bff6944cefe1fa30f970c5a71a74d869ecc38c50825a286c7b1dab46619200b0dae68

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
d16a9e31a88b0d71017e758a9cca7fd0

SHA1
4ba601c34f703d9be61ea521e8c059d3298b725c

SHA256
1b137996e4f19df201c7d8510b4daf78cbe55b849c483f4e97ad7c6734310b62

SHA512
dd4800991530242e054f0c4837236ac253ab83cfad22ff2beb926eca10d8747887b560801f6fb167c114fe8d2c4e95915d5f74ca67b22f8db6936e682df6c8de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
a413a92f042106d52aca961bef823590

SHA1
92c61225ad8e8db6dab830a5a728d927a5106bea

SHA256
ad21c160231b7ca41ec6d0c44421c90efa588dc5c71540001a9e84d2d2b67497

SHA512
3268dae85572674040085162f5787cbbc70377e133d27e761d2cde2bcc23215d058e8a807cd436afeefcf4e599e952d9d299797fafdec01f105cfec51aa6e4c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
4fe29aa733aef7dc9d1dc31eee6a5cfa

SHA1
f583a8f45e1f8fbff33f35ef266f08a61b24ac95

SHA256
48146c07ad43f41b08fa4694483d89420dd66ae2537ed2d035276e542d68bdd6

SHA512
2de5ee8cb446093c9853f93658bd975a07133ebca60485e973270bfe5de7f9126c82103a996e51e10746f4818bcfd1a9c02c5a3512f4eb050a5f142c4c7159ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
361e397184113a7eac9eb9846abff2b9

SHA1
1f18017d92231f96f1fc42cb0f81a2c147a72123

SHA256
9b1881f0eb3bb23118f4ec5b9e6974bb02f31b4f9ae893a151c0f5a9fcbe2083

SHA512
5046eb83b8e3d00c975b40d17a279992b6053e8744355e4220a7eee7e85a0ff970451c02b27c636030c74b0760dc64e8de9d312d25eb5bc4a57163de44db825f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5888e2.TMP

Filesize
874B

MD5
bb814464132fc33b4c2996fcdc640045

SHA1
61ca69b73a5f7f4377f4c3d149d91918f121bd68

SHA256
17b84b8962c1bf2e294e1dedd258763f70a465b89d26d9e49c3e17c7d6b34e8a

SHA512
2ed33cb81c9bdb6eec55f8f3fdf5ea12975a8bdef3f7ba3490ba81a3e2295463220284ed2ba2bbdbb9b21e23d383be523742f002b17e973752b80db7a37912e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
c96cb25f9d26f0f567f30a45fe41af44

SHA1
965974cdc35bb6eb63f7282aa211e96086f36cc4

SHA256
e5daf9fc7efc0a49beb1633f538206165387fa7bb740f4d717ea6847c3d16d22

SHA512
a045c1288dffa3d72759413068e0087f5e625d753e2ec1fdbaf17a4d07bba9d505252f0d184cf8a2563abe02ce7c6d9654e04d88610ed3ec3aeab084163f7c2b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
28cc9d20870d5cb28a9a5c2107072be2

SHA1
8177a11479466105618eeae1bf3b76cfbda8126d

SHA256
5756e9ee02a254e941180616f94dc997b45da0761538984a923288f8cc6817e8

SHA512
d4b18a788b449f277d1fc1b7cb80395fa4f200af7d3e516f84f34a4c67e4eb9c44879797ffd77164b8aaab676f320f8699a970dff7606e227f3fe63678961e87

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
2f984fe321a2c96fb4830cb872d30ff2

SHA1
5d37090b0c6094af83167c27f26124ba34de156c

SHA256
a622f0afda3732507566621e8e71a94069a09462668d30abae4819182fd9c030

SHA512
c9fcb88fa8fb248d08573dc6486a6e6b20f8bb86727fe00c10974ee6ada6c606fcd0aecb19725b8d9a96aa5a5a38c1c1a963e8a7e5dab62322b49d3a21b23b51

Download Submit
C:\Users\Admin\AppData\Local\Temp\48E1.tmp

Filesize
55KB

MD5
7e37ab34ecdcc3e77e24522ddfd4852d

SHA1
38e2855e11e353cedf9a8a4f2f2747f1c5c07fcf

SHA256
02ef73bd2458627ed7b397ec26ee2de2e92c71a0e7588f78734761d8edbdcd9f

SHA512
1b037a2aa8bf951d2ffe2f724aa0b2fbb39c2173215806ba0327bda7b096301d887f9bb7db46f9e04584b16aa6b1aaeaf67f0ecf5f20eb02ceac27c8753ca587

Download Submit
C:\Users\Admin\Downloads\NotPetya.exe:Zone.Identifier

Filesize
256B

MD5
482a9c1c8ecdd132cede2d4e54309a33

SHA1
2ebe1d70b8ce19238c8e6c808273c0039facc88c

SHA256
c454c2f0c66efd88cb8ec21fa07aace37b20238a05e1e1f4b889a36045bea530

SHA512
9437af044367168f0799c05e36d27fdd0e4c981cc89b286a1196915e7c2be64ea46590c9e20364bfff81f48b0480742349dd7b058e6f338e7354e37e6bd0c7ee

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 193834.crdownload

Filesize
390KB

MD5
5b7e6e352bacc93f7b80bc968b6ea493

SHA1
e686139d5ed8528117ba6ca68fe415e4fb02f2be

SHA256
63545fa195488ff51955f09833332b9660d18f8afb16bdf579134661962e548a

SHA512
9d24af0cb00fb8a5e61e9d19cd603b5541a22ae6229c2acf498447e0e7d4145fee25c8ab9d5d5f18f554e6cbf8ca56b7ca3144e726d7dfd64076a42a25b3dfb6

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 759873.crdownload

Filesize
129KB

MD5
0ec108e32c12ca7648254cf9718ad8d5

SHA1
78e07f54eeb6af5191c744ebb8da83dad895eca1

SHA256
48b08ea78124ca010784d9f0faae751fc4a0c72c0e7149ded81fc03819f5d723

SHA512
1129e685f5dd0cb2fa22ef4fe5da3f1e2632e890333ce17d3d06d04a4097b4d9f4ca7d242611ffc9e26079900945cf04ab6565a1c322e88e161f1929d18a2072

Download Submit
C:\Users\Admin\Downloads\rickroll.exe:Zone.Identifier

Filesize
244B

MD5
5a3563750b8f970326f34556ae527af8

SHA1
3edc0d5c988331771471e021b69b70f84267d0ca

SHA256
8fa780f2076b62bd0299d1f756722fc2caf7dd0f7f9b3a76223a95772f3f134e

SHA512
4783d96cce5940b0887a642a20cd319cda8cec634e06de54ab3d62e7a5be7db70a5b7e92896f6f31fc2f754be27f4bd782c72bd1607b38a1e2df43a5d583e00a

Download Submit
C:\Windows\perfc.dat

Filesize
353KB

MD5
71b6a493388e7d0b40c83ce903bc6b04

SHA1
34f917aaba5684fbe56d3c57d48ef2a1aa7cf06d

SHA256
027cc450ef5f8c5f653329641ec1fed91f694e0d229928963b30f6b0d7d3a745

SHA512
072205eca5099d9269f358fe534b370ff21a4f12d7938d6d2e2713f69310f0698e53b8aff062849f0b2a521f68bee097c1840993825d2a5a3aa8cf4145911c6f

Download Submit
memory/1316-265-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/1348-318-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/4248-283-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/4324-290-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/4392-287-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/4848-452-0x0000000000D20000-0x0000000000D7E000-memory.dmp

Filesize
376KB

Download
memory/4848-460-0x0000000000D20000-0x0000000000D7E000-memory.dmp

Filesize
376KB

Download
memory/4848-463-0x0000000000D20000-0x0000000000D7E000-memory.dmp

Filesize
376KB

Download
memory/4848-461-0x0000000000D20000-0x0000000000D7E000-memory.dmp

Filesize
376KB

Download
memory/4848-486-0x0000000000D20000-0x0000000000D7E000-memory.dmp

Filesize
376KB

Download