badrabbit | hxxps://AllorWerfkc2025[.]277519[.]com

Analysis

max time kernel
899s
max time network
897s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
20/01/2025, 20:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://AllorWerfkc2025.277519.com

Score

10^/10

badrabbit mimikatz defense_evasion discovery ransomware upx

Malware Config

Signatures

BadRabbit
Ransomware family discovered in late 2017, mainly targeting Russia and Ukraine.
ransomware badrabbit
Badrabbit family
badrabbit
Mimikatz
mimikatz is an open source tool to dump credentials on Windows.
mimikatz
Mimikatz family
mimikatz

mimikatz is an open source tool to dump credentials on Windows 1 IoCs

resource	yara_rule
behavioral1/files/0x000300000002a486-501.dat	mimikatz

Blocklisted process makes network request 24 IoCs

flow	pid	Process
339	460	rundll32.exe
351	460	rundll32.exe
362	460	rundll32.exe
374	460	rundll32.exe
386	460	rundll32.exe
397	460	rundll32.exe
409	460	rundll32.exe
420	460	rundll32.exe
432	460	rundll32.exe
443	460	rundll32.exe
456	460	rundll32.exe
467	460	rundll32.exe
479	460	rundll32.exe
490	460	rundll32.exe
502	460	rundll32.exe
513	460	rundll32.exe
526	460	rundll32.exe
537	460	rundll32.exe
549	460	rundll32.exe
560	460	rundll32.exe
573	460	rundll32.exe
585	460	rundll32.exe
597	460	rundll32.exe
608	460	rundll32.exe

Downloads MZ/PE file

Executes dropped EXE 3 IoCs

pid	Process
3888	BadRabbit.exe
908	E2D9.tmp
4740	BadRabbit.exe

Loads dropped DLL 2 IoCs

pid	Process
460	rundll32.exe
2684	rundll32.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
2	raw.githubusercontent.com
46	raw.githubusercontent.com

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x001a00000002ad77-674.dat	upx

Drops file in Windows directory 11 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	UserOOBEBroker.exe
File created	C:\Windows\infpub.dat	BadRabbit.exe
File opened for modification	C:\Windows\E2D9.tmp	rundll32.exe
File created	C:\Windows\infpub.dat	BadRabbit.exe
File opened for modification	C:\Windows\infpub.dat	rundll32.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	UserOOBEBroker.exe
File opened for modification	C:\Windows\infpub.dat	rundll32.exe
File created	C:\Windows\cscc.dat	rundll32.exe
File created	C:\Windows\dispci.exe	rundll32.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setupact.log	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	UserOOBEBroker.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\BadRabbit.exe:Zone.Identifier	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FileCoAuth.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BadRabbit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BadRabbit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	BackgroundTransferHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	BackgroundTransferHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	BackgroundTransferHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\MuiCache	BackgroundTransferHost.exe

NTFS ADS 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\BadRabbit.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 115929.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 960790.crdownload:SmartScreen	msedge.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2516	schtasks.exe
4172	schtasks.exe

Suspicious behavior: EnumeratesProcesses 27 IoCs

pid	Process
4948	msedge.exe
4948	msedge.exe
2756	msedge.exe
2756	msedge.exe
3844	msedge.exe
3844	msedge.exe
1004	identity_helper.exe
1004	identity_helper.exe
240	msedge.exe
240	msedge.exe
460	rundll32.exe
460	rundll32.exe
460	rundll32.exe
460	rundll32.exe
908	E2D9.tmp
908	E2D9.tmp
908	E2D9.tmp
908	E2D9.tmp
908	E2D9.tmp
908	E2D9.tmp
908	E2D9.tmp
2684	rundll32.exe
2684	rundll32.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs

pid	Process
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeShutdownPrivilege	460	rundll32.exe
Token: SeDebugPrivilege	460	rundll32.exe
Token: SeTcbPrivilege	460	rundll32.exe
Token: SeDebugPrivilege	908	E2D9.tmp
Token: SeShutdownPrivilege	2684	rundll32.exe
Token: SeDebugPrivilege	2684	rundll32.exe
Token: SeTcbPrivilege	2684	rundll32.exe

Suspicious use of FindShellTrayWindow 44 IoCs

pid	Process
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5316	OpenWith.exe
5428	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2756 wrote to memory of 2952	2756	msedge.exe	77
PID 2756 wrote to memory of 2952	2756	msedge.exe	77
PID 2756 wrote to memory of 2132	2756	msedge.exe	78
PID 2756 wrote to memory of 2132	2756	msedge.exe	78
PID 2756 wrote to memory of 2132	2756	msedge.exe	78
PID 2756 wrote to memory of 2132	2756	msedge.exe	78
PID 2756 wrote to memory of 2132	2756	msedge.exe	78
PID 2756 wrote to memory of 2132	2756	msedge.exe	78
PID 2756 wrote to memory of 2132	2756	msedge.exe	78
PID 2756 wrote to memory of 2132	2756	msedge.exe	78
PID 2756 wrote to memory of 2132	2756	msedge.exe	78
PID 2756 wrote to memory of 2132	2756	msedge.exe	78
PID 2756 wrote to memory of 2132	2756	msedge.exe	78
PID 2756 wrote to memory of 2132	2756	msedge.exe	78
PID 2756 wrote to memory of 2132	2756	msedge.exe	78
PID 2756 wrote to memory of 2132	2756	msedge.exe	78
PID 2756 wrote to memory of 2132	2756	msedge.exe	78
PID 2756 wrote to memory of 2132	2756	msedge.exe	78
PID 2756 wrote to memory of 2132	2756	msedge.exe	78
PID 2756 wrote to memory of 2132	2756	msedge.exe	78
PID 2756 wrote to memory of 2132	2756	msedge.exe	78
PID 2756 wrote to memory of 2132	2756	msedge.exe	78
PID 2756 wrote to memory of 2132	2756	msedge.exe	78
PID 2756 wrote to memory of 2132	2756	msedge.exe	78
PID 2756 wrote to memory of 2132	2756	msedge.exe	78
PID 2756 wrote to memory of 2132	2756	msedge.exe	78
PID 2756 wrote to memory of 2132	2756	msedge.exe	78
PID 2756 wrote to memory of 2132	2756	msedge.exe	78
PID 2756 wrote to memory of 2132	2756	msedge.exe	78
PID 2756 wrote to memory of 2132	2756	msedge.exe	78
PID 2756 wrote to memory of 2132	2756	msedge.exe	78
PID 2756 wrote to memory of 2132	2756	msedge.exe	78
PID 2756 wrote to memory of 2132	2756	msedge.exe	78
PID 2756 wrote to memory of 2132	2756	msedge.exe	78
PID 2756 wrote to memory of 2132	2756	msedge.exe	78
PID 2756 wrote to memory of 2132	2756	msedge.exe	78
PID 2756 wrote to memory of 2132	2756	msedge.exe	78
PID 2756 wrote to memory of 2132	2756	msedge.exe	78
PID 2756 wrote to memory of 2132	2756	msedge.exe	78
PID 2756 wrote to memory of 2132	2756	msedge.exe	78
PID 2756 wrote to memory of 2132	2756	msedge.exe	78
PID 2756 wrote to memory of 2132	2756	msedge.exe	78
PID 2756 wrote to memory of 4948	2756	msedge.exe	79
PID 2756 wrote to memory of 4948	2756	msedge.exe	79
PID 2756 wrote to memory of 1016	2756	msedge.exe	80
PID 2756 wrote to memory of 1016	2756	msedge.exe	80
PID 2756 wrote to memory of 1016	2756	msedge.exe	80
PID 2756 wrote to memory of 1016	2756	msedge.exe	80
PID 2756 wrote to memory of 1016	2756	msedge.exe	80
PID 2756 wrote to memory of 1016	2756	msedge.exe	80
PID 2756 wrote to memory of 1016	2756	msedge.exe	80
PID 2756 wrote to memory of 1016	2756	msedge.exe	80
PID 2756 wrote to memory of 1016	2756	msedge.exe	80
PID 2756 wrote to memory of 1016	2756	msedge.exe	80
PID 2756 wrote to memory of 1016	2756	msedge.exe	80
PID 2756 wrote to memory of 1016	2756	msedge.exe	80
PID 2756 wrote to memory of 1016	2756	msedge.exe	80
PID 2756 wrote to memory of 1016	2756	msedge.exe	80
PID 2756 wrote to memory of 1016	2756	msedge.exe	80
PID 2756 wrote to memory of 1016	2756	msedge.exe	80
PID 2756 wrote to memory of 1016	2756	msedge.exe	80
PID 2756 wrote to memory of 1016	2756	msedge.exe	80
PID 2756 wrote to memory of 1016	2756	msedge.exe	80
PID 2756 wrote to memory of 1016	2756	msedge.exe	80

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://AllorWerfkc2025.277519.com
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffe5a9e3cb8,0x7ffe5a9e3cc8,0x7ffe5a9e3cd8
  2⤵
  PID:2952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1916,9717383341949287699,11283851048110363666,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1956 /prefetch:2
  2⤵
  PID:2132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1916,9717383341949287699,11283851048110363666,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2112 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1916,9717383341949287699,11283851048110363666,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2524 /prefetch:8
  2⤵
  PID:1016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,9717383341949287699,11283851048110363666,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:3988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,9717383341949287699,11283851048110363666,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
  2⤵
  PID:3804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,9717383341949287699,11283851048110363666,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4620 /prefetch:1
  2⤵
  PID:3604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1916,9717383341949287699,11283851048110363666,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4788 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,9717383341949287699,11283851048110363666,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5328 /prefetch:1
  2⤵
  PID:2292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,9717383341949287699,11283851048110363666,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3952 /prefetch:1
  2⤵
  PID:4932
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1916,9717383341949287699,11283851048110363666,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5768 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,9717383341949287699,11283851048110363666,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5296 /prefetch:1
  2⤵
  PID:1120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,9717383341949287699,11283851048110363666,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5500 /prefetch:1
  2⤵
  PID:3184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,9717383341949287699,11283851048110363666,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5800 /prefetch:1
  2⤵
  PID:1508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,9717383341949287699,11283851048110363666,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1120 /prefetch:1
  2⤵
  PID:4924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,9717383341949287699,11283851048110363666,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5336 /prefetch:1
  2⤵
  PID:4516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,9717383341949287699,11283851048110363666,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5420 /prefetch:1
  2⤵
  PID:1888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,9717383341949287699,11283851048110363666,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2856 /prefetch:1
  2⤵
  PID:3844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,9717383341949287699,11283851048110363666,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5300 /prefetch:1
  2⤵
  PID:2156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,9717383341949287699,11283851048110363666,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5440 /prefetch:1
  2⤵
  PID:4908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,9717383341949287699,11283851048110363666,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5552 /prefetch:1
  2⤵
  PID:4932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,9717383341949287699,11283851048110363666,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6404 /prefetch:1
  2⤵
  PID:388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1916,9717383341949287699,11283851048110363666,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6912 /prefetch:8
  2⤵
  PID:2620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1916,9717383341949287699,11283851048110363666,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6704 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:240
- C:\Users\Admin\Downloads\BadRabbit.exe
  "C:\Users\Admin\Downloads\BadRabbit.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  PID:3888
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\system32\rundll32.exe C:\Windows\infpub.dat,#1 15
    3⤵
    - Blocklisted process makes network request
    - Loads dropped DLL
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:460
  - - C:\Windows\SysWOW64\cmd.exe
      /c schtasks /Delete /F /TN rhaegal
      4⤵
      System Location Discovery: System Language Discovery
      PID:2432
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Delete /F /TN rhaegal
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2076
  - - C:\Windows\SysWOW64\cmd.exe
      /c schtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR "C:\Windows\system32\cmd.exe /C Start \"\" \"C:\Windows\dispci.exe\" -id 440557961 && exit"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2548
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR "C:\Windows\system32\cmd.exe /C Start \"\" \"C:\Windows\dispci.exe\" -id 440557961 && exit"
        5⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:2516
  - - C:\Windows\SysWOW64\cmd.exe
      /c schtasks /Create /SC once /TN drogon /RU SYSTEM /TR "C:\Windows\system32\shutdown.exe /r /t 0 /f" /ST 20:47:00
      4⤵
      System Location Discovery: System Language Discovery
      PID:1888
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Create /SC once /TN drogon /RU SYSTEM /TR "C:\Windows\system32\shutdown.exe /r /t 0 /f" /ST 20:47:00
        5⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:4172
  - - C:\Windows\E2D9.tmp
      "C:\Windows\E2D9.tmp" \\.\pipe\{193F105C-5268-43E6-9C1D-D648CE748587}
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1916,9717383341949287699,11283851048110363666,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5356 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=1916,9717383341949287699,11283851048110363666,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=4508 /prefetch:8
  2⤵
  PID:2072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,9717383341949287699,11283851048110363666,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2464 /prefetch:1
  2⤵
  PID:5556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1916,9717383341949287699,11283851048110363666,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3368 /prefetch:8
  2⤵
  PID:5660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1916,9717383341949287699,11283851048110363666,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6540 /prefetch:8
  2⤵
  PID:5800

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4348

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:940

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5088

C:\Users\Admin\Downloads\BadRabbit.exe
"C:\Users\Admin\Downloads\BadRabbit.exe"
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4740
- C:\Windows\SysWOW64\rundll32.exe
  C:\Windows\system32\rundll32.exe C:\Windows\infpub.dat,#1 15
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2684

C:\Windows\system32\BackgroundTransferHost.exe
"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.13
1⤵
- Modifies registry class
PID:1844

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
- System Location Discovery: System Language Discovery
PID:1800

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,Control_RunDLL C:\Windows\System32\srchadmin.dll ,
1⤵
PID:5088

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:1752

C:\Windows\System32\oobe\UserOOBEBroker.exe
C:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding
1⤵
- Drops file in Windows directory
PID:3972

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
1⤵
- System Location Discovery: System Language Discovery
PID:1236

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:5316

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:5428

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1B1401C7EC8E96BC79CBFD92F9DF762D_5398732881722BDE3E78D6CA6BB2B78B

Filesize
5B

MD5
5bfa51f3a417b98e7443eca90fc94703

SHA1
8c015d80b8a23f780bdd215dc842b0f5551f63bd

SHA256
bebe2853a3485d1c2e5c5be4249183e0ddaff9f87de71652371700a89d937128

SHA512
4cd03686254bb28754cbaa635ae1264723e2be80ce1dd0f78d1ab7aee72232f5b285f79e488e9c5c49ff343015bd07bb8433d6cee08ae3cea8c317303e3ac399

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\164726e9-81a4-40a4-9b34-2618c275f6bc.tmp

Filesize
11KB

MD5
e3a91a172ca218537bb9a022f6f9a10b

SHA1
b0a4f4834af129daa6ca6a02d740e089bc2e428b

SHA256
bd5b2a5396d667d6cba6bdccc4056a727f1b22a28ebc96a3596cafdfbf89cca3

SHA512
e4ddc7d364cef465c277ebf1dc39d1c345f589e1170f233b933abad2fad793736d94cd2557033697212c78382a771f7af405507d6878aa1fc7b5f8232d01cbdf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fdee96b970080ef7f5bfa5964075575e

SHA1
2c821998dc2674d291bfa83a4df46814f0c29ab4

SHA256
a241023f360b300e56b2b0e1205b651e1244b222e1f55245ca2d06d3162a62f0

SHA512
20875c3002323f5a9b1b71917d6bd4e4c718c9ca325c90335bd475ddcb25eac94cb3f29795fa6476d6d6e757622b8b0577f008eec2c739c2eec71d2e8b372cff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
46e6ad711a84b5dc7b30b75297d64875

SHA1
8ca343bfab1e2c04e67b9b16b8e06ba463b4f485

SHA256
77b51492a40a511e57e7a7ecf76715a2fd46533c0f0d0d5a758f0224e201c77f

SHA512
8472710b638b0aeee4678f41ed2dff72b39b929b2802716c0c9f96db24c63096b94c9969575e4698f16e412f82668b5c9b5cb747e8a2219429dbb476a31d297e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\046f229c-b9d4-4e39-bcd1-3e545f8678fd.tmp

Filesize
1KB

MD5
70ffc8707cccd54189acca9224a09777

SHA1
1cbc9d4ffe1d2658d330e3ac3b7d6616662e031a

SHA256
19f7f2507f510f1bbed52f90fc5c94269a4215204a67a2d08c5ecc0fd35f06ac

SHA512
8de53fc312d5d53773873e461b459bfcecbbaf0bd526d32137f59be5d096cfd87bf5318fab6235181be3d4939564962b3a919351ee55f03d151cd43461d57bd1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
5c2b56c7fe6fdfabd6724d624580c390

SHA1
7b07bbd07c4e56689c97530597752d05b00b70b7

SHA256
ae007e2b686d0f7dcbb5917b719294e683e9b8a43e603e378a513870fb028926

SHA512
23f6bb4fefc0d3337893d5068698d77574544b0ffef4d98d4b73afa113269d83af28a81261e37b36e110534df2859885e9a559fd5dcbbac43122d03b512ab59c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
61a8199b88bae056b5e3b6ddbb883bb8

SHA1
2726e06b394570bced8669e047cb925430599bc2

SHA256
a4addf3f4f7665f251a24b8512a9348f7550afe172c92002ac3838de21e21c82

SHA512
d83114285cee88e6a031b9688b84b068773852708de83428d7933fb93947d63604d248dbb4c22d28b763f8c547991373a0afd47e95018b6af5add873241e0edf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
f4e2349521147806aa7434cfec6b6b00

SHA1
9657289ba199d9fd8630239b1a855bbbbe87648d

SHA256
5bafc941d0a17e5aff70a9ef271dc95f9b523a4e8ad9eccc3554c8c2f09c2b23

SHA512
0191c9258af73a451a0f340004713ac8420eeb2b1da83808cce17b267af388efba7fb0a717d87b6e543171035accc8f28e80ee92e34940dc62b26ad311924aab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
a8067b99095cc0cf016d80e694acca83

SHA1
d41da1f811f90703187b9700eb37464904b58b6d

SHA256
c8611d29b6422ed669c08397671a36f53e0b6c61db051e65ea3be12d85144aad

SHA512
d1541263da4d95a7acdc8f0239d3bd1eb6a6640702ae143c7d1ef4809bcfed957da695fe1d552cf24e2380ee971f61d5ea85760259bcf53a07ba75b6f38195b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
625383fc47fe8effa71d3549de493d4e

SHA1
fa51135cc10ce5727a1039681b5e4745cfd84496

SHA256
76cb86a734c5cced22ee151053df3a2bd54877d2c892ed6e2aac46b692988bca

SHA512
a151f6dd5c1632cadd84e3ac9acf611bd6fdeee206ed61b882daf5dfa875ccebe022ec63ce2eb2a270b0eacb0225c6c6282616d1c40093de0042a2ab6afe5d46

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
54bdc9d7c4dfd8b9da5543d4f80358f4

SHA1
e4266771d36df38a0f04423febf74538f0ce6f35

SHA256
786d8ea797a743dd4a2af2f06bbbc7403c231e8a8ebfb305e5537d071f2f30f3

SHA512
1359ebcc3c6651a82cba22abffae4801056537d864b5943464a544034b0e6df7d9a689f38bb5b5ca469181ddd4d50fc2b7897db3e57f85910229c6bfc8ce6716

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
afac17c94a62856c8bfac22a7b5b72ae

SHA1
77c90202a6215237e544ec98ef1fc2b8998e34ee

SHA256
5502a1ce238bc87f47e71eb403be2f9e497a9ed29ddcb6dd3acc1a6f8aa65e56

SHA512
98612b10910bc42b1d2e0eadbdef1de0a4048239f83d43cfc8b08fd70ac32218b1261d398ee36fc2b3d4ae679449a8f9b191dcb22d6ede176899d4f86be42e69

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f23fc9420fbed8cbca38d4814dc1e8dd

SHA1
29642716e58e25662dffd0ef16c299e9817d9c49

SHA256
98c08f821dae3b7fe92a43a041aa81928d47cc7eca959c33674d9d5b78bf2bff

SHA512
60808c3f8a65fafb8b69de7ad2d88bf9d4a9c9661c4773d8681c0f202716af16b6c5bbc77ba5cfeb717d96c8820f71fd5f8d3f83f87aff5659b75fca4f61dd64

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
2f60942a2694ac5986ea08fdf9a2be4a

SHA1
93abc59e56c4aea48de5c44b9cbc3a02d2022285

SHA256
1fce221e310dbadbfa0069e3f7dcdd7d9c8488068b8111947144f490839943d5

SHA512
16e48ffa63d933549150404aa9b77d59e84113168d9b49d01cd7ce1a47ca0ce58e3436c9b73bc1fb7d74419485067340b96c82961fb5db9b5ea71a712a12f0b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
a1d5c181f03a9990e8bf78d5da7e7ecc

SHA1
a1e4e7ce74c525c87af0947fabd4c3e0397c9be8

SHA256
75dd528e4f4ae4953c56f6a940440318ab375bc9233a425f7a716a771762328d

SHA512
56fadf5e4b17aa1f1237f1ea2790c9c6d8b5881bf3f13cfcbf726157ec01d3548e883ba113c729efc151eed6d2b24fe513ed4d4818c8b8530432467f6e5d3045

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
486e5de77d3b9a67a81e2abe34d3a3b6

SHA1
e075e16809d5ebbf330a9058c1062b61b63fad01

SHA256
f0052f90e248c3bb2701c78176369c1c5a5c3f992742f2ed44e0aaa4a61629da

SHA512
278f0c420ea83aacd319b4dc561696aa8be8c71f7d0ea059879ce6ef94dafb7585b3aacd35bd07f42bfe4dbc8907d4bfb5dc23d6c16e615e8ad0476825818f1a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
31758f65428d139dcd50b17b2f44510a

SHA1
18830304e0aa581241bbd6417d4db5d584df1019

SHA256
394c2c214cb1b070f3a3d13a46f88d492fa99f10d1b6afd4fafc47e1398c291f

SHA512
9cb273fb1c6f5d5ebaadc6eeaa70fa7b10fa5a20b1b93b14eae22ccc69ee0da3aeb7885c3b525fda92d5fe25ed041699a02c6c2fb171f28113d025f70f2e85e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
6061e9dcde589d9a5b26a89297a0a875

SHA1
a65af6bcb41bd06e7bef0c196af28c4feb2c152a

SHA256
7abd227181f235fc4ffb5ccbdff06d4551a49a20040d5f3e7ad2c71f6eec10d9

SHA512
d6e43f772d1301e3baea0c6fd54ffefb4fe6986921497dcec141b0e3fa1103a563d23b7b32aff7ad63bf85c8a80757bda9806da326e54047aa66ba0cbfd80bca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
41c8ccdd44b850d190f556edd2e6e7eb

SHA1
d670078962ad29dc06cebecd21c4e0b2d5e4a99f

SHA256
6c019caa126e6764534387505d5a385fe9344a80da0ee83f6947db9d35a4568e

SHA512
86773d8dad7b84bf737f16a2a419e39b5cfb2e55e024cfde3f9f4d43601893b5f4561c19fdf52abaa0ff5c153ec71a16f0b27da8f774fb22a05f0622354ad712

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe588131.TMP

Filesize
1KB

MD5
89fd19c453916faeb1916afd375f9ce3

SHA1
ab10fb8f5626318f8dc5ddb8c278889fb1000dd1

SHA256
16787fe0f77d850840aa5b0bef3a8c691420d4b9c635933310d829317cfc6fe6

SHA512
82a47dc4333857cc6de937fb4933bf623fcaf2044a7d1b0c6356b658040a505d8876945cd615fc6de09147310b6405f2795f3711c801ea722a1a174b7d4e8fb9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
e12759a0cc01610ae3022fdb401bf85b

SHA1
609052e8ec05ec0bd15e5f27737a1dc836174208

SHA256
2ce4b34dde9b695c2d428505de2dc8d72a9cca0db99057a516ebbbfd275b436c

SHA512
1dedf12f29e4154e9ca1f9cd0cf6474122f20edd0ef44e7a80aaca03af21ffc1c0195890440e74a3b77cd2f7c4f192838d16af6c28a43c2323d04da228ad31fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
183f073939a0d885414a1e1e5d06c714

SHA1
d29c97fe1324662d49cb5672331e461bda78701d

SHA256
00cfbb367e0312419ba4277155bcfda6f69248a091f45da8f004ae9cd2a8b06f

SHA512
f1235731a5d3df2bc485a31f83809dbee0cd440ab50d3fec96589934a541f5019a0ff2cbd0e2ec96369251eb647250e92fca4efa4c74030edf964944d6c719dd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
42018aa5209437b5ab66351aa81e48ba

SHA1
60ef55a2138cfc93da94ddcf2ef00a4b0b1d7beb

SHA256
6043c62f4579124559694db7eedeaccf0724de1d2bb9749d1c6c77cc13e665e1

SHA512
78d966cedfdde413e6d72ea0d4e3b29bcd6b72592177f6e0adf513d931be54e7f13e3eed9eabcf467d65cc4bd2ea3acb89f97f1a092be46af5685f747e84e68f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
c8697b94ca40c7824d12f10d94bb0e82

SHA1
157e23dd8d335d6ba40b5fb78d87a22b03d05230

SHA256
81d6a534869c2fd532f4a51ad0398c9970d15ee925c928c46d2729d397abd7db

SHA512
3eb91f60110ec838e40cfd4cb6cea8fb923de1af16a5d5a46a65aff67f4f1ae003568f65b94d9a1980070c74fc778ebcb13836a7ed15319aac11b3f147edd066

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
7a67f8dd1415b04be1ee6ee4d941c33c

SHA1
e1010c99f3f16e366a858f98d582c64e836d1b52

SHA256
5ea610dd98a76986b4fbc3d89fccad617de75b10b7df8a95c651896f1d06c679

SHA512
672e7adaedd2b4d35dc10d7c7f8b5709a47bcdf3eb0831b62628f35b487ea093cf5da7bf813563e785c2c7fd1d0b6f28b7f85f40cca05b249e143669972046c2

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\BackgroundTransferApi\53941567-8c72-4bbe-85a9-d5e2f6847228.down_data

Filesize
555KB

MD5
5683c0028832cae4ef93ca39c8ac5029

SHA1
248755e4e1db552e0b6f8651b04ca6d1b31a86fb

SHA256
855abd360d8a8d6974eba92b70cbd09ce519bc8773439993f9ab37cb6847309e

SHA512
aba434bd29be191c823b02ea9b639beb10647bbe7759bbffdaa790dfb1ec2c58d74c525ef11aacda209e4effe322d1d3a07b115446c8914b07a3bce4d8a0e2c3

Download Submit
C:\Users\Admin\Downloads\BadRabbit.exe:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 115929.crdownload

Filesize
116KB

MD5
41789c704a0eecfdd0048b4b4193e752

SHA1
fb1e8385691fa3293b7cbfb9b2656cf09f20e722

SHA256
b2dcfdf9e7b09f2aa5004668370e77982963ace820e7285b2e264a294441da23

SHA512
76391ac85fdc3be75441fcd6e19bed08b807d3946c7281c647f16a3be5388f7be307e6323fac8502430a4a6d800d52a88709592a49011ecc89de4f19102435ea

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 960790.crdownload

Filesize
431KB

MD5
fbbdc39af1139aebba4da004475e8839

SHA1
de5c8d858e6e41da715dca1c019df0bfb92d32c0

SHA256
630325cac09ac3fab908f903e3b00d0dadd5fdaa0875ed8496fcbb97a558d0da

SHA512
74eca8c01de215b33d5ceea1fda3f3bef96b513f58a750dba04b0de36f7ef4f7846a6431d52879ca0d8641bfd504d4721a9a96fa2e18c6888fd67fa77686af87

Download Submit
C:\Windows\E2D9.tmp

Filesize
60KB

MD5
347ac3b6b791054de3e5720a7144a977

SHA1
413eba3973a15c1a6429d9f170f3e8287f98c21c

SHA256
301b905eb98d8d6bb559c04bbda26628a942b2c4107c07a02e8f753bdcfe347c

SHA512
9a399916bc681964af1e1061bc0a8e2926307642557539ad587ce6f9b5ef93bdf1820fe5d7b5ffe5f0bb38e5b4dc6add213ba04048c0c7c264646375fcd01787

Download Submit
C:\Windows\infpub.dat

Filesize
401KB

MD5
1d724f95c61f1055f0d02c2154bbccd3

SHA1
79116fe99f2b421c52ef64097f0f39b815b20907

SHA256
579fd8a0385482fb4c789561a30b09f25671e86422f40ef5cca2036b28f99648

SHA512
f2d7b018d1516df1c97cfff5507957c75c6d9bf8e2ce52ae0052706f4ec62f13eba6d7be17e6ad2b693fdd58e1fd091c37f17bd2b948cdcd9b95b4ad428c0113

Download Submit
memory/460-495-0x0000000002920000-0x0000000002988000-memory.dmp

Filesize
416KB

Download
memory/460-492-0x0000000002920000-0x0000000002988000-memory.dmp

Filesize
416KB

Download
memory/460-484-0x0000000002920000-0x0000000002988000-memory.dmp

Filesize
416KB

Download
memory/2684-550-0x00000000023A0000-0x0000000002408000-memory.dmp

Filesize
416KB

Download
memory/2684-542-0x00000000023A0000-0x0000000002408000-memory.dmp

Filesize
416KB

Download