Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    264s
  • max time network
    265s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/09/2024, 15:24

Errors

Reason
Machine shutdown

General

  • Target

    https://anonym.ninja/download/ADMDlW32LcA6P6M

Malware Config

Signatures

  • BadRabbit

    Ransomware family discovered in late 2017, mainly targeting Russia and Ukraine.

  • Mimikatz

    mimikatz is an open source tool to dump credentials on Windows.

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • UAC bypass 3 TTPs 1 IoCs
  • mimikatz is an open source tool to dump credentials on Windows 1 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 8 IoCs
  • Loads dropped DLL 4 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Drops file in Windows directory 11 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • System Location Discovery: System Language Discovery 1 TTPs 35 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 15 IoCs
  • Modifies registry class 3 IoCs
  • NTFS ADS 3 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs
  • Suspicious use of AdjustPrivilegeToken 19 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 40 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://anonym.ninja/download/ADMDlW32LcA6P6M
    1⤵
    • Enumerates system info in registry
    • Modifies registry class
    • NTFS ADS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4040
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffee2f446f8,0x7ffee2f44708,0x7ffee2f44718
      2⤵
        PID:696
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,11196442884227451169,5249077860912090054,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2080 /prefetch:2
        2⤵
          PID:1620
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,11196442884227451169,5249077860912090054,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:2144
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,11196442884227451169,5249077860912090054,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2900 /prefetch:8
          2⤵
            PID:5052
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,11196442884227451169,5249077860912090054,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
            2⤵
              PID:2484
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,11196442884227451169,5249077860912090054,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:1
              2⤵
                PID:4992
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,11196442884227451169,5249077860912090054,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4784 /prefetch:1
                2⤵
                  PID:4768
                • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,11196442884227451169,5249077860912090054,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4952 /prefetch:8
                  2⤵
                    PID:3020
                  • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,11196442884227451169,5249077860912090054,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4952 /prefetch:8
                    2⤵
                    • Suspicious behavior: EnumeratesProcesses
                    PID:5024
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2140,11196442884227451169,5249077860912090054,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5864 /prefetch:8
                    2⤵
                      PID:2196
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,11196442884227451169,5249077860912090054,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5856 /prefetch:1
                      2⤵
                        PID:4044
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2140,11196442884227451169,5249077860912090054,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5764 /prefetch:8
                        2⤵
                        • Suspicious behavior: EnumeratesProcesses
                        PID:2388
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,11196442884227451169,5249077860912090054,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5960 /prefetch:1
                        2⤵
                          PID:4840
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,11196442884227451169,5249077860912090054,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3808 /prefetch:1
                          2⤵
                            PID:1088
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,11196442884227451169,5249077860912090054,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4216 /prefetch:1
                            2⤵
                              PID:2976
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,11196442884227451169,5249077860912090054,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1740 /prefetch:1
                              2⤵
                                PID:4292
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,11196442884227451169,5249077860912090054,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5900 /prefetch:1
                                2⤵
                                  PID:4476
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,11196442884227451169,5249077860912090054,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5092 /prefetch:1
                                  2⤵
                                    PID:1088
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,11196442884227451169,5249077860912090054,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5964 /prefetch:1
                                    2⤵
                                      PID:5092
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,11196442884227451169,5249077860912090054,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5868 /prefetch:2
                                      2⤵
                                        PID:3436
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,11196442884227451169,5249077860912090054,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4852 /prefetch:1
                                        2⤵
                                          PID:3988
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,11196442884227451169,5249077860912090054,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6232 /prefetch:1
                                          2⤵
                                            PID:2288
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2140,11196442884227451169,5249077860912090054,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5868 /prefetch:8
                                            2⤵
                                              PID:4584
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2140,11196442884227451169,5249077860912090054,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=4848 /prefetch:8
                                              2⤵
                                              • Modifies registry class
                                              PID:1828
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,11196442884227451169,5249077860912090054,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6180 /prefetch:1
                                              2⤵
                                                PID:2860
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,11196442884227451169,5249077860912090054,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5784 /prefetch:1
                                                2⤵
                                                  PID:3884
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,11196442884227451169,5249077860912090054,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5440 /prefetch:1
                                                  2⤵
                                                    PID:2536
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,11196442884227451169,5249077860912090054,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5928 /prefetch:1
                                                    2⤵
                                                      PID:1828
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2140,11196442884227451169,5249077860912090054,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6476 /prefetch:8
                                                      2⤵
                                                        PID:1088
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2140,11196442884227451169,5249077860912090054,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6904 /prefetch:8
                                                        2⤵
                                                          PID:4356
                                                        • C:\Users\Admin\Downloads\BadRabbit.exe
                                                          "C:\Users\Admin\Downloads\BadRabbit.exe"
                                                          2⤵
                                                          • Executes dropped EXE
                                                          • Drops file in Windows directory
                                                          • System Location Discovery: System Language Discovery
                                                          PID:3772
                                                          • C:\Windows\SysWOW64\rundll32.exe
                                                            C:\Windows\system32\rundll32.exe C:\Windows\infpub.dat,#1 15
                                                            3⤵
                                                            • Loads dropped DLL
                                                            • Drops file in Windows directory
                                                            • System Location Discovery: System Language Discovery
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            PID:876
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              /c schtasks /Delete /F /TN rhaegal
                                                              4⤵
                                                              • System Location Discovery: System Language Discovery
                                                              PID:2288
                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                schtasks /Delete /F /TN rhaegal
                                                                5⤵
                                                                • System Location Discovery: System Language Discovery
                                                                PID:1464
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              /c schtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR "C:\Windows\system32\cmd.exe /C Start \"\" \"C:\Windows\dispci.exe\" -id 1854166917 && exit"
                                                              4⤵
                                                              • System Location Discovery: System Language Discovery
                                                              PID:4848
                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                schtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR "C:\Windows\system32\cmd.exe /C Start \"\" \"C:\Windows\dispci.exe\" -id 1854166917 && exit"
                                                                5⤵
                                                                • System Location Discovery: System Language Discovery
                                                                • Scheduled Task/Job: Scheduled Task
                                                                PID:3464
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              /c schtasks /Create /SC once /TN drogon /RU SYSTEM /TR "C:\Windows\system32\shutdown.exe /r /t 0 /f" /ST 15:45:00
                                                              4⤵
                                                              • System Location Discovery: System Language Discovery
                                                              PID:536
                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                schtasks /Create /SC once /TN drogon /RU SYSTEM /TR "C:\Windows\system32\shutdown.exe /r /t 0 /f" /ST 15:45:00
                                                                5⤵
                                                                • System Location Discovery: System Language Discovery
                                                                • Scheduled Task/Job: Scheduled Task
                                                                PID:4920
                                                            • C:\Windows\69A8.tmp
                                                              "C:\Windows\69A8.tmp" \\.\pipe\{A3E64255-3D78-4AFF-81A1-0E8303D5E5C2}
                                                              4⤵
                                                              • Executes dropped EXE
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              PID:5012
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              /c wevtutil cl Setup & wevtutil cl System & wevtutil cl Security & wevtutil cl Application & fsutil usn deletejournal /D C:
                                                              4⤵
                                                                PID:3932
                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                /c schtasks /Delete /F /TN drogon
                                                                4⤵
                                                                  PID:2924
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,11196442884227451169,5249077860912090054,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6768 /prefetch:1
                                                              2⤵
                                                                PID:3336
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2140,11196442884227451169,5249077860912090054,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6656 /prefetch:8
                                                                2⤵
                                                                  PID:2540
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2140,11196442884227451169,5249077860912090054,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5756 /prefetch:8
                                                                  2⤵
                                                                    PID:1196
                                                                • C:\Windows\System32\CompPkgSrv.exe
                                                                  C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                  1⤵
                                                                    PID:3588
                                                                  • C:\Windows\System32\CompPkgSrv.exe
                                                                    C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                    1⤵
                                                                      PID:1168
                                                                    • C:\Windows\System32\rundll32.exe
                                                                      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                                                      1⤵
                                                                        PID:4240
                                                                      • C:\Program Files\7-Zip\7zG.exe
                                                                        "C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\13-09-2024_ADMDlW32LcA6P6M\" -ad -an -ai#7zMap3886:114:7zEvent7422
                                                                        1⤵
                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                        • Suspicious use of FindShellTrayWindow
                                                                        PID:2628
                                                                      • C:\Users\Admin\Downloads\13-09-2024_ADMDlW32LcA6P6M\CSGhost-v4.3.1.exe
                                                                        "C:\Users\Admin\Downloads\13-09-2024_ADMDlW32LcA6P6M\CSGhost-v4.3.1.exe"
                                                                        1⤵
                                                                        • Executes dropped EXE
                                                                        • System Location Discovery: System Language Discovery
                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                        • Suspicious use of SetWindowsHookEx
                                                                        PID:3132
                                                                      • C:\Windows\system32\AUDIODG.EXE
                                                                        C:\Windows\system32\AUDIODG.EXE 0x4f8 0x2cc
                                                                        1⤵
                                                                          PID:4240
                                                                        • C:\Users\Admin\Downloads\BadRabbit.exe
                                                                          "C:\Users\Admin\Downloads\BadRabbit.exe"
                                                                          1⤵
                                                                          • Executes dropped EXE
                                                                          • Drops file in Windows directory
                                                                          • System Location Discovery: System Language Discovery
                                                                          PID:3400
                                                                          • C:\Windows\SysWOW64\rundll32.exe
                                                                            C:\Windows\system32\rundll32.exe C:\Windows\infpub.dat,#1 15
                                                                            2⤵
                                                                            • Loads dropped DLL
                                                                            • Drops file in Windows directory
                                                                            • System Location Discovery: System Language Discovery
                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                            PID:1464
                                                                        • C:\Users\Admin\Downloads\BadRabbit.exe
                                                                          "C:\Users\Admin\Downloads\BadRabbit.exe"
                                                                          1⤵
                                                                          • Executes dropped EXE
                                                                          • Drops file in Windows directory
                                                                          • System Location Discovery: System Language Discovery
                                                                          PID:3408
                                                                          • C:\Windows\SysWOW64\rundll32.exe
                                                                            C:\Windows\system32\rundll32.exe C:\Windows\infpub.dat,#1 15
                                                                            2⤵
                                                                            • Loads dropped DLL
                                                                            • Drops file in Windows directory
                                                                            • System Location Discovery: System Language Discovery
                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                            PID:2116
                                                                        • C:\Users\Admin\Downloads\BadRabbit.exe
                                                                          "C:\Users\Admin\Downloads\BadRabbit.exe"
                                                                          1⤵
                                                                          • Executes dropped EXE
                                                                          • Drops file in Windows directory
                                                                          • System Location Discovery: System Language Discovery
                                                                          PID:4588
                                                                          • C:\Windows\SysWOW64\rundll32.exe
                                                                            C:\Windows\system32\rundll32.exe C:\Windows\infpub.dat,#1 15
                                                                            2⤵
                                                                            • Loads dropped DLL
                                                                            • Drops file in Windows directory
                                                                            • System Location Discovery: System Language Discovery
                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                            PID:3604
                                                                        • C:\Users\Admin\Downloads\7ev3n.exe
                                                                          "C:\Users\Admin\Downloads\7ev3n.exe"
                                                                          1⤵
                                                                          • Executes dropped EXE
                                                                          • System Location Discovery: System Language Discovery
                                                                          • NTFS ADS
                                                                          PID:4812
                                                                          • C:\Users\Admin\AppData\Local\system.exe
                                                                            "C:\Users\Admin\AppData\Local\system.exe"
                                                                            2⤵
                                                                            • Executes dropped EXE
                                                                            • System Location Discovery: System Language Discovery
                                                                            PID:4796
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\del.bat
                                                                              3⤵
                                                                              • System Location Discovery: System Language Discovery
                                                                              PID:3576
                                                                            • C:\Windows\SysWOW64\SCHTASKS.exe
                                                                              C:\Windows\System32\SCHTASKS.exe /create /SC ONLOGON /TN uac /TR "C:\Users\Admin\AppData\Local\bcd.bat" /RL HIGHEST /f
                                                                              3⤵
                                                                              • System Location Discovery: System Language Discovery
                                                                              • Scheduled Task/Job: Scheduled Task
                                                                              PID:3944
                                                                            • C:\windows\SysWOW64\cmd.exe
                                                                              C:\windows\system32\cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v "Shell" /t REG_SZ /d "C:\Users\Admin\AppData\Local\system.exe" /f /reg:64
                                                                              3⤵
                                                                              • System Location Discovery: System Language Discovery
                                                                              PID:4340
                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v "Shell" /t REG_SZ /d "C:\Users\Admin\AppData\Local\system.exe" /f /reg:64
                                                                                4⤵
                                                                                • Modifies WinLogon for persistence
                                                                                • System Location Discovery: System Language Discovery
                                                                                PID:3528
                                                                            • C:\windows\SysWOW64\cmd.exe
                                                                              C:\windows\system32\cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "System" /t REG_SZ /d "C:\Users\Admin\AppData\Local\system.exe" /f /reg:64
                                                                              3⤵
                                                                              • System Location Discovery: System Language Discovery
                                                                              PID:5048
                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "System" /t REG_SZ /d "C:\Users\Admin\AppData\Local\system.exe" /f /reg:64
                                                                                4⤵
                                                                                • Adds Run key to start application
                                                                                • System Location Discovery: System Language Discovery
                                                                                PID:4540
                                                                            • C:\windows\SysWOW64\cmd.exe
                                                                              C:\windows\system32\cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard Layout" /v "Scancode Map" /t REG_BINARY /d "00000000000000001700000000003800000038e000005be000005ce00000360000001d0000001de000000f000000010000001c0000003e0000003b00000044000000450000003d0000005de000000000" /f /reg:64
                                                                              3⤵
                                                                              • System Location Discovery: System Language Discovery
                                                                              PID:3704
                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                REG ADD "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard Layout" /v "Scancode Map" /t REG_BINARY /d "00000000000000001700000000003800000038e000005be000005ce00000360000001d0000001de000000f000000010000001c0000003e0000003b00000044000000450000003d0000005de000000000" /f /reg:64
                                                                                4⤵
                                                                                • System Location Discovery: System Language Discovery
                                                                                PID:3104
                                                                            • C:\windows\SysWOW64\cmd.exe
                                                                              C:\windows\system32\cmd.exe /c REG ADD "HKEY_CURRENT_USER\Control Panel\Accessibility\StickyKeys" /v "Flags" /t REG_SZ /d 506 /f /reg:64
                                                                              3⤵
                                                                              • System Location Discovery: System Language Discovery
                                                                              PID:3552
                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                REG ADD "HKEY_CURRENT_USER\Control Panel\Accessibility\StickyKeys" /v "Flags" /t REG_SZ /d 506 /f /reg:64
                                                                                4⤵
                                                                                • System Location Discovery: System Language Discovery
                                                                                PID:5036
                                                                            • C:\windows\SysWOW64\cmd.exe
                                                                              C:\windows\system32\cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion" /v "rgd_bcd_condition" /t REG_SZ /d 1 /f /reg:64
                                                                              3⤵
                                                                              • System Location Discovery: System Language Discovery
                                                                              PID:3464
                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion" /v "rgd_bcd_condition" /t REG_SZ /d 1 /f /reg:64
                                                                                4⤵
                                                                                • System Location Discovery: System Language Discovery
                                                                                PID:1724
                                                                            • C:\windows\SysWOW64\cmd.exe
                                                                              C:\windows\system32\cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableLUA" /t REG_DWORD /d 0 /f /reg:64
                                                                              3⤵
                                                                              • System Location Discovery: System Language Discovery
                                                                              PID:5084
                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableLUA" /t REG_DWORD /d 0 /f /reg:64
                                                                                4⤵
                                                                                • UAC bypass
                                                                                • System Location Discovery: System Language Discovery
                                                                                PID:3052
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion" /v "crypted" /t REG_SZ /d 1 /f /reg:64
                                                                              3⤵
                                                                              • System Location Discovery: System Language Discovery
                                                                              PID:4728
                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion" /v "crypted" /t REG_SZ /d 1 /f /reg:64
                                                                                4⤵
                                                                                • System Location Discovery: System Language Discovery
                                                                                PID:5024
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c shutdown -r -t 10 -f
                                                                              3⤵
                                                                              • System Location Discovery: System Language Discovery
                                                                              PID:692
                                                                              • C:\Windows\SysWOW64\shutdown.exe
                                                                                shutdown -r -t 10 -f
                                                                                4⤵
                                                                                • System Location Discovery: System Language Discovery
                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                PID:4400
                                                                        • C:\Windows\system32\OpenWith.exe
                                                                          C:\Windows\system32\OpenWith.exe -Embedding
                                                                          1⤵
                                                                          • Modifies registry class
                                                                          • Suspicious use of SetWindowsHookEx
                                                                          PID:1320
                                                                        • C:\Windows\system32\LogonUI.exe
                                                                          "LogonUI.exe" /flags:0x4 /state0:0xa3909855 /state1:0x41c64e6d
                                                                          1⤵
                                                                          • Modifies data under HKEY_USERS
                                                                          • Suspicious use of SetWindowsHookEx
                                                                          PID:4288
                                                                        • C:\Windows\System32\rundll32.exe
                                                                          C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding
                                                                          1⤵
                                                                            PID:2812

                                                                          Network

                                                                          MITRE ATT&CK Enterprise v15

                                                                          Replay Monitor

                                                                          Loading Replay Monitor...

                                                                          Downloads

                                                                          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CDE89F9DCB25D8AC547E3CEFDA4FB6C2_EFB75332C2EEE29C462FC21A350076B8

                                                                            Filesize

                                                                            5B

                                                                            MD5

                                                                            5bfa51f3a417b98e7443eca90fc94703

                                                                            SHA1

                                                                            8c015d80b8a23f780bdd215dc842b0f5551f63bd

                                                                            SHA256

                                                                            bebe2853a3485d1c2e5c5be4249183e0ddaff9f87de71652371700a89d937128

                                                                            SHA512

                                                                            4cd03686254bb28754cbaa635ae1264723e2be80ce1dd0f78d1ab7aee72232f5b285f79e488e9c5c49ff343015bd07bb8433d6cee08ae3cea8c317303e3ac399

                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                            Filesize

                                                                            152B

                                                                            MD5

                                                                            ecf7ca53c80b5245e35839009d12f866

                                                                            SHA1

                                                                            a7af77cf31d410708ebd35a232a80bddfb0615bb

                                                                            SHA256

                                                                            882a513b71b26210ff251769b82b2c5d59a932f96d9ce606ca2fab6530a13687

                                                                            SHA512

                                                                            706722bd22ce27d854036b1b16e6a3cdb36284b66edc76238a79c2e11cee7d1307b121c898ad832eb1af73e4f08d991d64dc0bff529896ffb4ebe9b3dc381696

                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                            Filesize

                                                                            152B

                                                                            MD5

                                                                            4dd2754d1bea40445984d65abee82b21

                                                                            SHA1

                                                                            4b6a5658bae9a784a370a115fbb4a12e92bd3390

                                                                            SHA256

                                                                            183b8e82a0deaa83d04736553671cedb738adc909f483b3c5f822a0e6be7477d

                                                                            SHA512

                                                                            92d44ee372ad33f892b921efa6cabc78e91025e89f05a22830763217826fa98d51d55711f85c8970ac58abf9adc6c85cc40878032cd6d2589ab226cd099f99e1

                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000c

                                                                            Filesize

                                                                            64KB

                                                                            MD5

                                                                            d6b36c7d4b06f140f860ddc91a4c659c

                                                                            SHA1

                                                                            ccf16571637b8d3e4c9423688c5bd06167bfb9e9

                                                                            SHA256

                                                                            34013d7f3f0186a612bef84f2984e2767b32c9e1940df54b01d5bd6789f59e92

                                                                            SHA512

                                                                            2a9dd9352298ec7d1b439033b57ee9a390c373eeb8502f7f36d6826e6dd3e447b8ffd4be4f275d51481ef9a6ac2c2d97ef98f3f9d36a5a971275bf6cee48e487

                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000d

                                                                            Filesize

                                                                            67KB

                                                                            MD5

                                                                            929b1f88aa0b766609e4ca5b9770dc24

                                                                            SHA1

                                                                            c1f16f77e4f4aecc80dadd25ea15ed10936cc901

                                                                            SHA256

                                                                            965eaf004d31e79f7849b404d0b8827323f9fe75b05fe73b1226ccc4deea4074

                                                                            SHA512

                                                                            fe8d6b94d537ee9cae30de946886bf7893d3755c37dd1662baf1f61e04f47fa66e070210c990c4a956bde70380b7ce11c05ad39f9cbd3ea55b129bb1f573fa07

                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000e

                                                                            Filesize

                                                                            41KB

                                                                            MD5

                                                                            58756d99d2376dcfbede6057dd25a745

                                                                            SHA1

                                                                            76f81b96664cd8863210bb03cc75012eaae96320

                                                                            SHA256

                                                                            f5d0da7b010b28a7fe2c314724a966c44068a8c8fa7e9a495e1284aa501067fa

                                                                            SHA512

                                                                            476e35c3da0cf223e773c2d26403c12f8c8d034273cca9e3c4cba9359f8506159c2a5267793c8bd9982b636191ddda62e9119593f5599053894c7027a58acc10

                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000f

                                                                            Filesize

                                                                            19KB

                                                                            MD5

                                                                            2e86a72f4e82614cd4842950d2e0a716

                                                                            SHA1

                                                                            d7b4ee0c9af735d098bff474632fc2c0113e0b9c

                                                                            SHA256

                                                                            c1334e604dbbffdf38e9e2f359938569afe25f7150d1c39c293469c1ee4f7b6f

                                                                            SHA512

                                                                            7a5fd3e3e89c5f8afca33b2d02e5440934e5186b9fa6367436e8d20ad42b211579225e73e3a685e5e763fa3f907fc4632b9425e8bd6d6f07c5c986b6556d47b1

                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000010

                                                                            Filesize

                                                                            65KB

                                                                            MD5

                                                                            56d57bc655526551f217536f19195495

                                                                            SHA1

                                                                            28b430886d1220855a805d78dc5d6414aeee6995

                                                                            SHA256

                                                                            f12de7e272171cda36389813df4ba68eb2b8b23c58e515391614284e7b03c4d4

                                                                            SHA512

                                                                            7814c60dc377e400bbbcc2000e48b617e577a21045a0f5c79af163faa0087c6203d9f667e531bbb049c9bd8fb296678e6a5cdcad149498d7f22ffa11236b51cb

                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000011

                                                                            Filesize

                                                                            88KB

                                                                            MD5

                                                                            b38fbbd0b5c8e8b4452b33d6f85df7dc

                                                                            SHA1

                                                                            386ba241790252df01a6a028b3238de2f995a559

                                                                            SHA256

                                                                            b18b9eb934a5b3b81b16c66ec3ec8e8fecdb3d43550ce050eb2523aabc08b9cd

                                                                            SHA512

                                                                            546ca9fb302bf28e3a178e798dd6b80c91cba71d0467257b8ed42e4f845aa6ecb858f718aac1e0865b791d4ecf41f1239081847c75c6fb3e9afd242d3704ad16

                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000012

                                                                            Filesize

                                                                            1.2MB

                                                                            MD5

                                                                            3bab2651eb0e5c503c207d912da8b901

                                                                            SHA1

                                                                            16e69b1aa350548dd0398e40ff0d7dbefeb998d4

                                                                            SHA256

                                                                            1236a39237e0f535fb0029f8dcd89ec3f3142b17589a56a614fdee13708ac30c

                                                                            SHA512

                                                                            8dec3a0f0a882cbcfe69a48aa02b6695c22cc7270395d06eea1c441dce953407a5e1c26171750938c8d6f79292160342352c59cf5c6afb3bc3f55c1ea5d253ca

                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                                            Filesize

                                                                            4KB

                                                                            MD5

                                                                            92853595abf3f133b7b674c8097546c3

                                                                            SHA1

                                                                            7b1572dc0c752c66ea410deabe89f3159c300379

                                                                            SHA256

                                                                            5f41e0e8a4fdd7c4e9db5ee26a504f1716eedd093cfcee7b11d31de84ae407d6

                                                                            SHA512

                                                                            262720b28303c3fd97c9454e10a07f4cb440166d92a7bb5cae636d9f7348b96bca48653d9b08f93bc198ac8f5ced0e0ee6209bd48de725f3dea4a1025d78935a

                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                                            Filesize

                                                                            264B

                                                                            MD5

                                                                            077e0702a02d9e3e7404411a7e268740

                                                                            SHA1

                                                                            58d7fc994105880ecb7ac391b003db2ac5a71419

                                                                            SHA256

                                                                            cceef6d164f86885f2dde8ebfc2b70ecbccbc53837ac43fd454c7c7d35f66d7b

                                                                            SHA512

                                                                            e9503f12132d4fe19d499cf009bfcf10fb59e2a3b03afbeea5d7f7901e130a64084dbf3c3d0d112ba5bc01077b71978c0531f749134287f1b4568fefea84be05

                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                                            Filesize

                                                                            1KB

                                                                            MD5

                                                                            a2c4d38c57fbfa3f3b4f212ca37e0b36

                                                                            SHA1

                                                                            bc4b3bb4472080d2ce596d1ab6a75225f621d556

                                                                            SHA256

                                                                            9b79a36d23a51be9d45130bff8a8f98a4484aebadfa75bd713597de7f024d679

                                                                            SHA512

                                                                            3b4daaa998d10b5e826d5176180241c7e5b783c83254ff3e69ad5583937f88772487c56d537ecf1afb00a49b0672e3c508121dabd782c008489b21b0d0c770bf

                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                                            Filesize

                                                                            2KB

                                                                            MD5

                                                                            de56f2a92980e565168eef40ee572f06

                                                                            SHA1

                                                                            0c64f0cf7904edc169103f6235f20d3eb76d6b1f

                                                                            SHA256

                                                                            1a0a6ab4b84a1e2f76fb879a970f4d9d5ae248883ccf56e1a5f3b6de921c0005

                                                                            SHA512

                                                                            f536acd0564c3287f1708e1b9066924861da022dc6c057081342232ef7fccbc10c2529e0cd9f199076f130d1f29dd21545ec61e935b5c07f28fed2238251084f

                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                                            Filesize

                                                                            2KB

                                                                            MD5

                                                                            8bbb7f3f0bce6f9bbb4687b00e7f4c38

                                                                            SHA1

                                                                            f99891f15ad31c8d4c2d5ff334adeebb8a7f1a4e

                                                                            SHA256

                                                                            b1290b94e1389bb92563fa32c0f930fc206cde6659394df9ac14554d93d6fafa

                                                                            SHA512

                                                                            47f42f9d8b741f6c33c4781df648fc666104792b48c428a7a0bd4b86ee877e8b63960c47ca6787f01124ff8ed6008b86c6b50ff18a76ff031613c6e78f4c768b

                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                            Filesize

                                                                            6KB

                                                                            MD5

                                                                            c03bd34e083edd38ca500ef0e6631f6f

                                                                            SHA1

                                                                            398aae453812ccf38cf2c3c201ae3b8a4e3da6ef

                                                                            SHA256

                                                                            e75b902f624f41a5bb835b96167b368b1e72823deff95169ba65bcb0a710bbe0

                                                                            SHA512

                                                                            d3b1069d0864d62c7e4a7bc7c5eeb31314b15391beb86d10c5a9f2e68a7441b11101d39b78f8da0950a1a8c2fe8e7277a4d51d43f6b71d86b70fc0b5028e6d14

                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                            Filesize

                                                                            7KB

                                                                            MD5

                                                                            078a7452d9e19d05fa49537403d3abcb

                                                                            SHA1

                                                                            200c22c49db90d1277d74ae198abc1a7c3a8e06b

                                                                            SHA256

                                                                            fd6b5efaece8562dee5c3eb8fa836b7570f8cc19e40010958685e35bf4e4a187

                                                                            SHA512

                                                                            059d2524e3dcdaa2841583e1851142a760bd709d7bf08c06381f522b154cf9a9e1d20f3e3cf33cff2228206b8417ae4a4558eec3a4e7709fa6f09ecc6b6c4812

                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                            Filesize

                                                                            7KB

                                                                            MD5

                                                                            1a4f9a126226f71c1806fe41e0dce278

                                                                            SHA1

                                                                            0fa9ca7d9d7f9f7d44b45be090711f202e682ef5

                                                                            SHA256

                                                                            d719e2d6ef970d2353721077b0fc39b4201a0f6cc5ba282dbbec5921bc881ba2

                                                                            SHA512

                                                                            519379808c220ebf2e4e091d2a849425fdd39f9eb573aab1ab121991e91e00531bcf7d06becc304c2294246443712f35bd63ecb48a01226f53adad72fc2e680c

                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                            Filesize

                                                                            5KB

                                                                            MD5

                                                                            a336e2a82652081daecad5f5b5f63c76

                                                                            SHA1

                                                                            3b8c770d7fefcf91a7250dbfa07b8442dd75c57c

                                                                            SHA256

                                                                            7629ff054b590deea774a679bdf25d0955c19e77de0074656ce8f6c6dece8c76

                                                                            SHA512

                                                                            dc780161e2ff1f08c31a219cdfa41a1dd86522465b9a55cc4fcf4be0e48ab68bd85053333cc6657cd981d7863847836ab187005085574bfc7d48b75f3f147fb1

                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                            Filesize

                                                                            6KB

                                                                            MD5

                                                                            b5ca865123f6206b4f266e7c7333ca58

                                                                            SHA1

                                                                            1a66ddcd4e202e4249a1e57edce738dd0bdc8300

                                                                            SHA256

                                                                            adf18d885027dddb0588a8577de15c5b7fc5bc81596a440b5338ff3065fc38f2

                                                                            SHA512

                                                                            c4604c581b8f552ba84b8b8a6298ea73d266c696badb599c921a7d9f1ea3877e45a2bcde9af1aa9685b3770777f39a0dc64463a12356085c820b8f8f4ec002ce

                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                            Filesize

                                                                            6KB

                                                                            MD5

                                                                            dcd0f72c9a7ca0b8fcf949695d417174

                                                                            SHA1

                                                                            d9871397b74d329e6b2d559336b16c4ee9a54ebc

                                                                            SHA256

                                                                            fb06091bb968a4e6602324e85b892826c8e4ac2bc6aa48294031aef3bb3a9e0e

                                                                            SHA512

                                                                            e1fe4b7593269b4c0400c1a2744ce7d8545ef2a625d6870d11e7dca7acf3217adb64940f0193d5a9af96d3c4def7ecffa407d2564a94c83f2ae048f5645eff0b

                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                            Filesize

                                                                            7KB

                                                                            MD5

                                                                            82a70766878d587c0e6180a3c911f7e0

                                                                            SHA1

                                                                            6238b3f79e2929577591a73b4b215adeb5b531f3

                                                                            SHA256

                                                                            37211dd52f8f5149cdcf45be71abb98de121fb509b987d9c9658138d4a6f7b5e

                                                                            SHA512

                                                                            7f21a51ab48341630c73b3660fb1ef3e7e12bcdfc543a109fdbe986a932866e78d1115b5df0e52f1c4dcce08df0613fac4d10029a449c65e6b5e109ef1281261

                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                            Filesize

                                                                            869B

                                                                            MD5

                                                                            c0ee762f5ccb39db3caa204c499f0b67

                                                                            SHA1

                                                                            16fa80882a868ef5e85085b5f012de206467c2c3

                                                                            SHA256

                                                                            0d4a42b354e594043ec0b22a4fd52447ea12e86303d8ba94433ce247bec0a7e3

                                                                            SHA512

                                                                            7fcd65cc2e02239a3dd39a4d0966eec366c6a71a20b09b7dc90ce3f19dcafbb921e4a00076599f920c7fdafe32faf5bfac511995cacdf897461b105a17be2c80

                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                            Filesize

                                                                            1KB

                                                                            MD5

                                                                            3c2acf293ec2acbfdaba151366d66283

                                                                            SHA1

                                                                            73e258872ac8b784b387cdf3c23c6f842161b7e4

                                                                            SHA256

                                                                            be84eb289ef5fade9dcf27efd39c041d2ddf2d563c53fa8d9014669fa69bc1dc

                                                                            SHA512

                                                                            78b2b6b096f925f851ea5da30e0972eff3d5cab559602c22a0e3999cd25f9659581935f9a282d35e9b26fc59492a1201a5bc767ca73f95a77cc7e6e50a907160

                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                            Filesize

                                                                            1KB

                                                                            MD5

                                                                            cb463be47fe9e4efb928925f307deb08

                                                                            SHA1

                                                                            1307aa4edd574e4fc2cbc4a5a62b38ebe3d03bf7

                                                                            SHA256

                                                                            a2dcf48b7a705bbb93eee4d00a5222ec843ae14c80bd6cf4abcf7decef1855a1

                                                                            SHA512

                                                                            9ef5bac7f5216e7b42b20ba0dffcfac4dfd68236922d7dc4f6b603336aed821ae858cc614a02775cbb41573f97c21749abaf6ed1e7ac883c2632969aba87b496

                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                            Filesize

                                                                            1KB

                                                                            MD5

                                                                            8c6790688d73994703fa75a289956427

                                                                            SHA1

                                                                            be65d95e68d169902dcea78daf4997c727c58e50

                                                                            SHA256

                                                                            b10fb3eae95375f8d82ab3a1583f1ff1c163036a24e6e4c1fc52fa2e14b77235

                                                                            SHA512

                                                                            80f4060540580e2c1695b5c30f8edb4b3d5f562138ef788a1c9585e110466d6191a72d8e7c819826bef125c4d676c834589eb0b7d1dfaaf9d7f2a6ea4f9c7212

                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                            Filesize

                                                                            1KB

                                                                            MD5

                                                                            37cb8c2ea2bcb8bf62de286c13067aa6

                                                                            SHA1

                                                                            7fbda7cdd383130654088b30420406390566cc25

                                                                            SHA256

                                                                            7fad7be2d76be06606e4390c5e1df438613ce3492f15ef1e3473869e815544b9

                                                                            SHA512

                                                                            2324ed97c51c2cef4692eea6193b9dc15133ff56d99307a460ddbdcc59aef2d99938b7c44f50e8702a4652fc3670c39b8e82368b6e5b40b77369e7f82ee74e65

                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                            Filesize

                                                                            1KB

                                                                            MD5

                                                                            113cac6e418a61de329df78f952f05ab

                                                                            SHA1

                                                                            03c1a90ffdd26a1182f83b8b4bfb0625363155c2

                                                                            SHA256

                                                                            1a85a02bcf66e2037da7df7e825b85c2513c5edd04f7df6fda62d1d65d699971

                                                                            SHA512

                                                                            55dd2654a63412b1dbc78118b6aaf0a5e7feaa8e9541c273fd491613d51a22c381c1dfada113f39a1016d747ce653206415f21608db468f01df8fa96896ba9a4

                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                            Filesize

                                                                            1KB

                                                                            MD5

                                                                            a19ff5d2be38713fba5dd83aefde639e

                                                                            SHA1

                                                                            7f0f7238dbd48454d07013f81b469f4cbb0459bb

                                                                            SHA256

                                                                            d116694db65918cef1a6ee9741ac34bbb373525549ea549b7e7938608684e9c0

                                                                            SHA512

                                                                            d68c42fb2d7f1106c91552e44e827bfdbcc81a2e5565d3fceb8a4186a39e031e639e1ec188899ad8075167d45bbfac1774f828da4f8b28a5dac5f39d57c01a70

                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe598a06.TMP

                                                                            Filesize

                                                                            371B

                                                                            MD5

                                                                            59b461e2f4ed698250e404bf27eab52e

                                                                            SHA1

                                                                            6fff865163b2e23bc784fbeec3607a65e402a728

                                                                            SHA256

                                                                            132aaa8d3b56c79eeb7e8da105b8096c308aedf5ee007a25dc1162ab1d6e5fa7

                                                                            SHA512

                                                                            ab112b69439e63f9f376f39df408c1b236258ab1370b6653ba7ab6bcdab4b069d58392b948f1e84f8e4d643a0e95d59552c976464f4e2046c0cb1f4fef504ebf

                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                                                            Filesize

                                                                            16B

                                                                            MD5

                                                                            6752a1d65b201c13b62ea44016eb221f

                                                                            SHA1

                                                                            58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                                                            SHA256

                                                                            0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                                                            SHA512

                                                                            9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                            Filesize

                                                                            10KB

                                                                            MD5

                                                                            0ee3a305aa71a6344fe64f35f77692f6

                                                                            SHA1

                                                                            a9dadec03966c7c23fd5830b994cf7f5f5c2a405

                                                                            SHA256

                                                                            6a565c6acea9c1624b93604b0c467af2f5bd2791a9c82206057b1bc2cc058ed2

                                                                            SHA512

                                                                            6376b58b57d58deddfcecd046fd933f0dd2cbd7d086eaa5b54730e6fc01fefda526b2b2e89e099a82729c31b4fd83fb883882a672960bfd4f0d45fe1931209c4

                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                            Filesize

                                                                            10KB

                                                                            MD5

                                                                            9a1635219c101914911f3bbaa88d0d73

                                                                            SHA1

                                                                            9e4d3ccc7323863240118af6d0272460fa74f260

                                                                            SHA256

                                                                            859ac30e97834853354ccac18e70cdaebdc4cf87a55a2c2f6471a871d9ab09ba

                                                                            SHA512

                                                                            ccfb82e47ec3e69f174965ea3e580690916066b0d3fc800ca601ef345ff15216a8cdb89e78871ed08e9a8f6341c2b5434918d51d318d6f3a0e831b16c922676f

                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                            Filesize

                                                                            11KB

                                                                            MD5

                                                                            d097a7a3843f2472fceb17bf71689169

                                                                            SHA1

                                                                            c94733cd24cfd0a3405307c8dd94108266fef060

                                                                            SHA256

                                                                            06b062c14739c443a0f682c0643cb0a0302ede0c62058dffd2e1eb0e532da936

                                                                            SHA512

                                                                            731b6deab01be0562137570c2de8a1b509defc777fe6e4741f6fbf53fa043033ded96b8025259fac25c0c6717bb890717f1525253d026f8e13fbd3ab0a1f122b

                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                            Filesize

                                                                            11KB

                                                                            MD5

                                                                            efbf4d71c331fe9182fb1ada6597ccf4

                                                                            SHA1

                                                                            fbbb3d6e6d58648d940462d12ee66d98df5e80df

                                                                            SHA256

                                                                            68150d00e82594aec268d5e9215561c45e6422383bbe80013b93c649e136000a

                                                                            SHA512

                                                                            e793bcc5eaed22858137c5861d11c0491f43f4954471f284a9c44f0c81b15c4134762bce3f164d0d53631f327b0d38a9feea4fc1033099c99e08b4d0200fefe5

                                                                          • C:\Users\Admin\AppData\Local\del.bat

                                                                            Filesize

                                                                            56B

                                                                            MD5

                                                                            f62904abb27a3574e2e6121349ab4955

                                                                            SHA1

                                                                            35b3504f1d6bc88638a0721cf3d898eb0f95092a

                                                                            SHA256

                                                                            d31225722321313554e736bcd9debc4cb4c5ed6dce3921fa7839162fede832b6

                                                                            SHA512

                                                                            e8d1cf4c6a745790b2eaf4b3618703337313e3f561ba88982bc1a139aa4b5b29fd5f78f925e5bd12669eed74ca78510f6d6b1ce091bc55299057d2b2e867fb4e

                                                                          • C:\Users\Admin\AppData\Local\system.exe

                                                                            Filesize

                                                                            315KB

                                                                            MD5

                                                                            95db66b4cf190550785c9f9f3fdd7274

                                                                            SHA1

                                                                            b9d81ff4cf3068d144f3c8ac98e7682eeaea9ee8

                                                                            SHA256

                                                                            18301a46ced0b00d751d38d3aff0470428654415e85f04e1f63110e440cd7562

                                                                            SHA512

                                                                            176aa778f20c438928589a95dc1aaad3a14064d2687f1d1902460eeac151c5ac1a3189be1eed50e98992cb77959363d11f0abc379627bb2a402095c08b397f0a

                                                                          • C:\Users\Admin\Downloads\13-09-2024_ADMDlW32LcA6P6M\CSGhost-v4.3.1.exe

                                                                            Filesize

                                                                            110KB

                                                                            MD5

                                                                            5b7c939e660af3a678af8c48d416f3fd

                                                                            SHA1

                                                                            b751c3ed92f2b33693c63610a27f57616c59b6c6

                                                                            SHA256

                                                                            4d512dec8b02a8779f892ed6a07d6464625fd0ebce4ff1a0c1cb356784dd2d9c

                                                                            SHA512

                                                                            3f56222100b2decef5cb1022d446ce2ab9b282473ef51b8044b377e02b7907116c2790f08a154d4859d52827ceeed8b2adef519b0f9d193f4a488a4c7ee5ef55

                                                                          • C:\Users\Admin\Downloads\Unconfirmed 210355.crdownload

                                                                            Filesize

                                                                            315KB

                                                                            MD5

                                                                            9f8bc96c96d43ecb69f883388d228754

                                                                            SHA1

                                                                            61ed25a706afa2f6684bb4d64f69c5fb29d20953

                                                                            SHA256

                                                                            7d373ccb96d1dbb1856ef31afa87c2112a0c1795a796ab01cb154700288afec5

                                                                            SHA512

                                                                            550a891c1059f58aa983138caf65a7ea9c326cb1b94c15f3e7594128f6e9f1295b9c2dbc0925637dba7c94e938083fffc6a63dc7c2e5b1e247679931cce505c6

                                                                          • C:\Users\Admin\Downloads\Unconfirmed 370549.crdownload

                                                                            Filesize

                                                                            431KB

                                                                            MD5

                                                                            fbbdc39af1139aebba4da004475e8839

                                                                            SHA1

                                                                            de5c8d858e6e41da715dca1c019df0bfb92d32c0

                                                                            SHA256

                                                                            630325cac09ac3fab908f903e3b00d0dadd5fdaa0875ed8496fcbb97a558d0da

                                                                            SHA512

                                                                            74eca8c01de215b33d5ceea1fda3f3bef96b513f58a750dba04b0de36f7ef4f7846a6431d52879ca0d8641bfd504d4721a9a96fa2e18c6888fd67fa77686af87

                                                                          • C:\Users\Admin\Downloads\Unconfirmed 566534.crdownload

                                                                            Filesize

                                                                            51KB

                                                                            MD5

                                                                            43fb6444809e84db7c2f4ddf904aa9d3

                                                                            SHA1

                                                                            e9d5e258fbe7add705248360ec7ad6bab892b185

                                                                            SHA256

                                                                            8b3fcb0fe72dc394d77bd2aa46994888167862cffd7e58d018450717a61a20ab

                                                                            SHA512

                                                                            6a97840321beb8dc3800402a67a6208afda5ca71ce2bd6f29d706e919e6168602f07b370b5cadf3948c1e06ca53700133c46d88df61716c4d58475efa9c43286

                                                                          • C:\Windows\69A8.tmp

                                                                            Filesize

                                                                            60KB

                                                                            MD5

                                                                            347ac3b6b791054de3e5720a7144a977

                                                                            SHA1

                                                                            413eba3973a15c1a6429d9f170f3e8287f98c21c

                                                                            SHA256

                                                                            301b905eb98d8d6bb559c04bbda26628a942b2c4107c07a02e8f753bdcfe347c

                                                                            SHA512

                                                                            9a399916bc681964af1e1061bc0a8e2926307642557539ad587ce6f9b5ef93bdf1820fe5d7b5ffe5f0bb38e5b4dc6add213ba04048c0c7c264646375fcd01787

                                                                          • C:\Windows\infpub.dat

                                                                            Filesize

                                                                            401KB

                                                                            MD5

                                                                            1d724f95c61f1055f0d02c2154bbccd3

                                                                            SHA1

                                                                            79116fe99f2b421c52ef64097f0f39b815b20907

                                                                            SHA256

                                                                            579fd8a0385482fb4c789561a30b09f25671e86422f40ef5cca2036b28f99648

                                                                            SHA512

                                                                            f2d7b018d1516df1c97cfff5507957c75c6d9bf8e2ce52ae0052706f4ec62f13eba6d7be17e6ad2b693fdd58e1fd091c37f17bd2b948cdcd9b95b4ad428c0113

                                                                          • C:\Windows\infpub.dat

                                                                            Filesize

                                                                            401KB

                                                                            MD5

                                                                            c4f26ed277b51ef45fa180be597d96e8

                                                                            SHA1

                                                                            e9efc622924fb965d4a14bdb6223834d9a9007e7

                                                                            SHA256

                                                                            14d82a676b63ab046ae94fa5e41f9f69a65dc7946826cb3d74cea6c030c2f958

                                                                            SHA512

                                                                            afc2a8466f106e81d423065b07aed2529cbf690ab4c3e019334f1bedfb42dc0e0957be83d860a84b7285bd49285503bfe95a1cf571a678dbc9bdb07789da928e

                                                                          • memory/876-814-0x00000000025A0000-0x0000000002608000-memory.dmp

                                                                            Filesize

                                                                            416KB

                                                                          • memory/876-822-0x00000000025A0000-0x0000000002608000-memory.dmp

                                                                            Filesize

                                                                            416KB

                                                                          • memory/876-828-0x00000000025A0000-0x0000000002608000-memory.dmp

                                                                            Filesize

                                                                            416KB

                                                                          • memory/1464-867-0x0000000002450000-0x00000000024B8000-memory.dmp

                                                                            Filesize

                                                                            416KB

                                                                          • memory/1464-874-0x0000000002450000-0x00000000024B8000-memory.dmp

                                                                            Filesize

                                                                            416KB

                                                                          • memory/2116-879-0x0000000001040000-0x00000000010A8000-memory.dmp

                                                                            Filesize

                                                                            416KB

                                                                          • memory/2116-887-0x0000000001040000-0x00000000010A8000-memory.dmp

                                                                            Filesize

                                                                            416KB

                                                                          • memory/3604-910-0x00000000006B0000-0x0000000000718000-memory.dmp

                                                                            Filesize

                                                                            416KB

                                                                          • memory/3604-918-0x00000000006B0000-0x0000000000718000-memory.dmp

                                                                            Filesize

                                                                            416KB