badrabbit | hxxps://github[.]com/Da2dalus/The-MALWARE-Repo

Resubmissions

30-01-2025 16:48

250130-vbellsxja1 10

30-01-2025 02:38

30-01-2025 02:32

30-01-2025 02:25

30-01-2025 02:21

30-01-2025 02:17

30-01-2025 02:13

Analysis

max time kernel
390s
max time network
389s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
30-01-2025 02:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/Da2dalus/The-MALWARE-Repo

Score

10^/10

badrabbit cryptolocker dharma mimikatz credential_access defense_evasion discovery execution impact persistence ransomware spyware stealer upx

Malware Config

Signatures

BadRabbit
Ransomware family discovered in late 2017, mainly targeting Russia and Ukraine.
ransomware badrabbit
Badrabbit family
badrabbit
CryptoLocker
Ransomware family with multiple variants.
ransomware cryptolocker
Cryptolocker family
cryptolocker
Dharma
Dharma is a ransomware that uses security software installation to hide malicious activities.
ransomware dharma
Dharma family
dharma
Mimikatz
mimikatz is an open source tool to dump credentials on Windows.
mimikatz
Mimikatz family
mimikatz
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047
Renames multiple (552) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

mimikatz is an open source tool to dump credentials on Windows 1 IoCs

resource	yara_rule
behavioral1/files/0x001e00000002ace9-768.dat	mimikatz

Downloads MZ/PE file 6 IoCs

flow	pid	Process
32	3824	msedge.exe
32	3824	msedge.exe
32	3824	msedge.exe
32	3824	msedge.exe
32	3824	msedge.exe
98	3824	msedge.exe

Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
credential_access stealer

Windows Credential Manager
T1555.004

Drops startup file 5 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta	CoronaVirus.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CoronaVirus.exe	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	CoronaVirus.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-44A42474.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-44A42474.[[email protected]].ncov	CoronaVirus.exe

Executes dropped EXE 15 IoCs

pid	Process
4080	NPE.exe
3380	NPE.exe
2032	NPE.exe
3672	BadRabbit.exe
3296	DF10.tmp
2704	BadRabbit.exe
3600	Birele.exe
1756	BadRabbit.exe
3384	CoronaVirus.exe
14712	msedge.exe
14276	msedge.exe
14132	msedge.exe
13620	CryptoLocker.exe
13580	{34184A33-0407-212E-3320-09040709E2C2}.exe
32052	{34184A33-0407-212E-3320-09040709E2C2}.exe

Loads dropped DLL 6 IoCs

pid	Process
4044	rundll32.exe
2808	rundll32.exe
5040	rundll32.exe
14712	msedge.exe
14276	msedge.exe
14132	msedge.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\CoronaVirus.exe = "C:\\Windows\\System32\\CoronaVirus.exe"	CoronaVirus.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Windows\System32\Info.hta = "mshta.exe \"C:\\Windows\\System32\\Info.hta\""	CoronaVirus.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Users\Admin\AppData\Roaming\Info.hta = "mshta.exe \"C:\\Users\\Admin\\AppData\\Roaming\\Info.hta\""	CoronaVirus.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000\Software\Microsoft\Windows\CurrentVersion\Run\CryptoLocker = "C:\\Users\\Admin\\AppData\\Roaming\\{34184A33-0407-212E-3320-09040709E2C2}.exe"	{34184A33-0407-212E-3320-09040709E2C2}.exe

Drops desktop.ini file(s) 64 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	CoronaVirus.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini	CoronaVirus.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini	CoronaVirus.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\Favorites\Links\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\Searches\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Public\AccountPictures\desktop.ini	CoronaVirus.exe
File opened for modification	F:\$RECYCLE.BIN\S-1-5-21-1537126222-899333903-2037027349-1000\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\Links\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	CoronaVirus.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\Contacts\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini	CoronaVirus.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility\Desktop.ini	CoronaVirus.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini	CoronaVirus.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\Pictures\Saved Pictures\desktop.ini	CoronaVirus.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini	CoronaVirus.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\OneDrive\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	CoronaVirus.exe
File opened for modification	C:\Program Files\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Program Files (x86)\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Public\Libraries\desktop.ini	CoronaVirus.exe
File opened for modification	C:\$Recycle.Bin\S-1-5-21-1537126222-899333903-2037027349-1000\desktop.ini	CoronaVirus.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Application Shortcuts\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\Pictures\Camera Roll\desktop.ini	CoronaVirus.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
4	raw.githubusercontent.com
32	raw.githubusercontent.com

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\System32\CoronaVirus.exe	CoronaVirus.exe
File created	C:\Windows\System32\Info.hta	CoronaVirus.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0006000000025ad2-920.dat	upx
behavioral1/memory/3600-942-0x0000000000400000-0x0000000000438000-memory.dmp	upx
behavioral1/memory/3600-946-0x0000000000400000-0x0000000000438000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\codec\libscte27_plugin.dll.id-44A42474.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\widevinecdmadapter.dll	CoronaVirus.exe
File opened for modification	C:\Program Files\7-Zip\Lang\gl.txt.id-44A42474.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.DirectoryServices.dll.id-44A42474.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\System.Windows.Forms.resources.dll.id-44A42474.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\email\themes\dark\adobe_logo.png.id-44A42474.[[email protected]].ncov	CoronaVirus.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_MoveNoDrop32x32.gif.id-44A42474.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	CoronaVirus.exe
File opened for modification	C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\theme\node_modules\@uifabric\merge-styles\lib\mergeStyles.js	CoronaVirus.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.Process.dll.id-44A42474.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\share.svg.id-44A42474.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Help\msitss55.dll	CoronaVirus.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\GRAPH_K_COL.HXK.id-44A42474.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\RICEPAPR\RICEPAPR.ELM.id-44A42474.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_1.0.38.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.targetsize-72_altform-unplated_contrast-black.png	CoronaVirus.exe
File opened for modification	C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Assets\Square44x44Logo.targetsize-24_altform-unplated.png	CoronaVirus.exe
File opened for modification	C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\theme\node_modules\@uifabric\utilities\lib-commonjs\DelayedRender.js	CoronaVirus.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\root\ui-strings.js	CoronaVirus.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ipsrus.xml	CoronaVirus.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Configuration\config.xml.id-44A42474.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.2104.12721.0_x64__8wekyb3d8bbwe\Images\FilePdf32x32.png	CoronaVirus.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\rhp_world_icon_hover.png.id-44A42474.[[email protected]].ncov	CoronaVirus.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\prism_d3d.dll.id-44A42474.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\sk-sk\ui-strings.js.id-44A42474.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\MSOUC.HXS	CoronaVirus.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsNotepad_10.2102.13.0_x64__8wekyb3d8bbwe\Assets\NotepadSmallTile.scale-200.png	CoronaVirus.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\en-ae\ui-strings.js.id-44A42474.[[email protected]].ncov	CoronaVirus.exe
File created	C:\Program Files\Microsoft Office\root\Office16\FPA_f14\FA000000014.id-44A42474.[[email protected]].ncov	CoronaVirus.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\JOURNAL\JOURNAL.INF.id-44A42474.[[email protected]].ncov	CoronaVirus.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\LyncVDI_Eula.txt.id-44A42474.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\UIAutomationTypes.resources.dll	CoronaVirus.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingNews_1.0.6.0_x64__8wekyb3d8bbwe\Assets\AppTiles\NewsAppList.targetsize-30_altform-unplated.png	CoronaVirus.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.41182.0_x64__8wekyb3d8bbwe\Assets\contrast-black\SmallTile.scale-200_contrast-black.png	CoronaVirus.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\msedgeupdateres_tr.dll.id-44A42474.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\theme\node_modules\@uifabric\utilities\lib\test\index.js	CoronaVirus.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\cs-cz\ui-strings.js	CoronaVirus.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\demux\libnsc_plugin.dll.id-44A42474.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\cardview-addtotable-dark.png	CoronaVirus.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\ReachFramework.resources.dll.id-44A42474.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\System.Windows.Forms.Design.resources.dll	CoronaVirus.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\images\Other-48.png.id-44A42474.[[email protected]].ncov	CoronaVirus.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\libs\require\2.1.15\require.min.js.id-44A42474.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Trial-ul-oob.xrm-ms.id-44A42474.[[email protected]].ncov	CoronaVirus.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\root\ui-strings.js.id-44A42474.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\WindowsBase.dll.id-44A42474.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\it.pak	CoronaVirus.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\contrast-black\OutlookMailWideTile.scale-125.png	CoronaVirus.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\contrast-white\HxCalendarLargeTile.scale-125.png	CoronaVirus.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\Locales\en-GB.pak.id-44A42474.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\Locales\nn.pak.id-44A42474.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft\OFFICE\Heartbeat\HeartbeatCache.xml.id-44A42474.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\theme\node_modules\@uifabric\merge-styles\lib-commonjs\IStyleFunction.js	CoronaVirus.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\my\LC_MESSAGES\vlc.mo.id-44A42474.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\MyriadPro-BoldIt.otf	CoronaVirus.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.Serialization.dll.id-44A42474.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\System.Windows.Forms.resources.dll	CoronaVirus.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.GamingApp_2105.900.24.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\Xbox_SplashScreen.scale-125.png	CoronaVirus.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.2103.1172.0_x64__8wekyb3d8bbwe\Assets\Tented\TentMobile_24x20.png	CoronaVirus.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\de-de\ui-strings.js.id-44A42474.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\JOURNAL\JOURNAL.ELM.id-44A42474.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Principal.dll.id-44A42474.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription5-ppd.xrm-ms	CoronaVirus.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\PresentationFramework.resources.dll	CoronaVirus.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\invalid32x32.gif.id-44A42474.[[email protected]].ncov	CoronaVirus.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\infpub.dat	BadRabbit.exe
File opened for modification	C:\Windows\DF10.tmp	rundll32.exe
File opened for modification	C:\Windows\infpub.dat	rundll32.exe
File created	C:\Windows\infpub.dat	BadRabbit.exe
File opened for modification	C:\Windows\infpub.dat	rundll32.exe
File opened for modification	C:\Windows\infpub.dat	rundll32.exe
File created	C:\Windows\cscc.dat	rundll32.exe
File created	C:\Windows\dispci.exe	rundll32.exe
File created	C:\Windows\infpub.dat	BadRabbit.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 6 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\CoronaVirus.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\CryptoLocker.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\BadRabbit.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\NPE.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Birele.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Cerber5.exe:Zone.Identifier	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 7 IoCs

pid	pid_target	Process	procid_target
3660	4080	WerFault.exe	112
4772	4080	WerFault.exe	112
1592	3380	WerFault.exe	120
4968	3380	WerFault.exe	120
3296	2032	WerFault.exe	125
2380	2032	WerFault.exe	125
4920	3600	WerFault.exe	152

System Location Discovery: System Language Discovery 1 TTPs 20 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NPE.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Birele.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CryptoLocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BadRabbit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CoronaVirus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{34184A33-0407-212E-3320-09040709E2C2}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NPE.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BadRabbit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{34184A33-0407-212E-3320-09040709E2C2}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NPE.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BadRabbit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Interacts with shadow copies 3 TTPs 2 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
24416	vssadmin.exe
31184	vssadmin.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings	msedge.exe

NTFS ADS 14 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 290997.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\CryptoLocker.exe:Zone.Identifier	msedge.exe
File created	C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe\:SmartScreen:$DATA	CryptoLocker.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 252652.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 651822.crdownload:SmartScreen	msedge.exe
File created	C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe\:Zone.Identifier:$DATA	CryptoLocker.exe
File opened for modification	C:\Users\Admin\Downloads\BadRabbit.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 710843.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\NPE.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\CoronaVirus.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 323357.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Birele.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Cerber5.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 762969.crdownload:SmartScreen	msedge.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4832	schtasks.exe
2980	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3824	msedge.exe
3824	msedge.exe
2008	msedge.exe
2008	msedge.exe
5088	msedge.exe
5088	msedge.exe
1080	identity_helper.exe
1080	identity_helper.exe
3164	msedge.exe
3164	msedge.exe
3972	msedge.exe
3972	msedge.exe
4080	NPE.exe
4080	NPE.exe
3380	NPE.exe
3380	NPE.exe
2032	NPE.exe
2032	NPE.exe
4044	rundll32.exe
4044	rundll32.exe
4044	rundll32.exe
4044	rundll32.exe
3296	DF10.tmp
3296	DF10.tmp
3296	DF10.tmp
3296	DF10.tmp
3296	DF10.tmp
3296	DF10.tmp
3296	DF10.tmp
2808	rundll32.exe
2808	rundll32.exe
2896	msedge.exe
2896	msedge.exe
2896	msedge.exe
2896	msedge.exe
3528	msedge.exe
3528	msedge.exe
696	msedge.exe
696	msedge.exe
5040	rundll32.exe
5040	rundll32.exe
5088	msedge.exe
5088	msedge.exe
3384	CoronaVirus.exe
3384	CoronaVirus.exe
3384	CoronaVirus.exe
3384	CoronaVirus.exe
3384	CoronaVirus.exe
3384	CoronaVirus.exe
3384	CoronaVirus.exe
3384	CoronaVirus.exe
3384	CoronaVirus.exe
3384	CoronaVirus.exe
3384	CoronaVirus.exe
3384	CoronaVirus.exe
3384	CoronaVirus.exe
3384	CoronaVirus.exe
3384	CoronaVirus.exe
3384	CoronaVirus.exe
3384	CoronaVirus.exe
3384	CoronaVirus.exe
3384	CoronaVirus.exe
3384	CoronaVirus.exe
3384	CoronaVirus.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 27 IoCs

pid	Process
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe

Suspicious use of AdjustPrivilegeToken 16 IoCs

description	pid	Process
Token: SeDebugPrivilege	4080	NPE.exe
Token: SeDebugPrivilege	3380	NPE.exe
Token: SeDebugPrivilege	2032	NPE.exe
Token: SeShutdownPrivilege	4044	rundll32.exe
Token: SeDebugPrivilege	4044	rundll32.exe
Token: SeTcbPrivilege	4044	rundll32.exe
Token: SeDebugPrivilege	3296	DF10.tmp
Token: SeShutdownPrivilege	2808	rundll32.exe
Token: SeDebugPrivilege	2808	rundll32.exe
Token: SeTcbPrivilege	2808	rundll32.exe
Token: SeShutdownPrivilege	5040	rundll32.exe
Token: SeDebugPrivilege	5040	rundll32.exe
Token: SeTcbPrivilege	5040	rundll32.exe
Token: SeBackupPrivilege	31032	vssvc.exe
Token: SeRestorePrivilege	31032	vssvc.exe
Token: SeAuditPrivilege	31032	vssvc.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
4080	NPE.exe
4080	NPE.exe
3380	NPE.exe
3380	NPE.exe
2032	NPE.exe
2032	NPE.exe
2476	helppane.exe
2476	helppane.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2008 wrote to memory of 2668	2008	msedge.exe	78
PID 2008 wrote to memory of 2668	2008	msedge.exe	78
PID 2008 wrote to memory of 2880	2008	msedge.exe	79
PID 2008 wrote to memory of 2880	2008	msedge.exe	79
PID 2008 wrote to memory of 2880	2008	msedge.exe	79
PID 2008 wrote to memory of 2880	2008	msedge.exe	79
PID 2008 wrote to memory of 2880	2008	msedge.exe	79
PID 2008 wrote to memory of 2880	2008	msedge.exe	79
PID 2008 wrote to memory of 2880	2008	msedge.exe	79
PID 2008 wrote to memory of 2880	2008	msedge.exe	79
PID 2008 wrote to memory of 2880	2008	msedge.exe	79
PID 2008 wrote to memory of 2880	2008	msedge.exe	79
PID 2008 wrote to memory of 2880	2008	msedge.exe	79
PID 2008 wrote to memory of 2880	2008	msedge.exe	79
PID 2008 wrote to memory of 2880	2008	msedge.exe	79
PID 2008 wrote to memory of 2880	2008	msedge.exe	79
PID 2008 wrote to memory of 2880	2008	msedge.exe	79
PID 2008 wrote to memory of 2880	2008	msedge.exe	79
PID 2008 wrote to memory of 2880	2008	msedge.exe	79
PID 2008 wrote to memory of 2880	2008	msedge.exe	79
PID 2008 wrote to memory of 2880	2008	msedge.exe	79
PID 2008 wrote to memory of 2880	2008	msedge.exe	79
PID 2008 wrote to memory of 2880	2008	msedge.exe	79
PID 2008 wrote to memory of 2880	2008	msedge.exe	79
PID 2008 wrote to memory of 2880	2008	msedge.exe	79
PID 2008 wrote to memory of 2880	2008	msedge.exe	79
PID 2008 wrote to memory of 2880	2008	msedge.exe	79
PID 2008 wrote to memory of 2880	2008	msedge.exe	79
PID 2008 wrote to memory of 2880	2008	msedge.exe	79
PID 2008 wrote to memory of 2880	2008	msedge.exe	79
PID 2008 wrote to memory of 2880	2008	msedge.exe	79
PID 2008 wrote to memory of 2880	2008	msedge.exe	79
PID 2008 wrote to memory of 2880	2008	msedge.exe	79
PID 2008 wrote to memory of 2880	2008	msedge.exe	79
PID 2008 wrote to memory of 2880	2008	msedge.exe	79
PID 2008 wrote to memory of 2880	2008	msedge.exe	79
PID 2008 wrote to memory of 2880	2008	msedge.exe	79
PID 2008 wrote to memory of 2880	2008	msedge.exe	79
PID 2008 wrote to memory of 2880	2008	msedge.exe	79
PID 2008 wrote to memory of 2880	2008	msedge.exe	79
PID 2008 wrote to memory of 2880	2008	msedge.exe	79
PID 2008 wrote to memory of 2880	2008	msedge.exe	79
PID 2008 wrote to memory of 3824	2008	msedge.exe	80
PID 2008 wrote to memory of 3824	2008	msedge.exe	80
PID 2008 wrote to memory of 3344	2008	msedge.exe	81
PID 2008 wrote to memory of 3344	2008	msedge.exe	81
PID 2008 wrote to memory of 3344	2008	msedge.exe	81
PID 2008 wrote to memory of 3344	2008	msedge.exe	81
PID 2008 wrote to memory of 3344	2008	msedge.exe	81
PID 2008 wrote to memory of 3344	2008	msedge.exe	81
PID 2008 wrote to memory of 3344	2008	msedge.exe	81
PID 2008 wrote to memory of 3344	2008	msedge.exe	81
PID 2008 wrote to memory of 3344	2008	msedge.exe	81
PID 2008 wrote to memory of 3344	2008	msedge.exe	81
PID 2008 wrote to memory of 3344	2008	msedge.exe	81
PID 2008 wrote to memory of 3344	2008	msedge.exe	81
PID 2008 wrote to memory of 3344	2008	msedge.exe	81
PID 2008 wrote to memory of 3344	2008	msedge.exe	81
PID 2008 wrote to memory of 3344	2008	msedge.exe	81
PID 2008 wrote to memory of 3344	2008	msedge.exe	81
PID 2008 wrote to memory of 3344	2008	msedge.exe	81
PID 2008 wrote to memory of 3344	2008	msedge.exe	81
PID 2008 wrote to memory of 3344	2008	msedge.exe	81
PID 2008 wrote to memory of 3344	2008	msedge.exe	81

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://github.com/Da2dalus/The-MALWARE-Repo
1⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff9fc763cb8,0x7ff9fc763cc8,0x7ff9fc763cd8
  2⤵
  PID:2668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,11398805890459023225,10716907212147024920,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2092 /prefetch:2
  2⤵
  PID:2880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,11398805890459023225,10716907212147024920,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - Suspicious behavior: EnumeratesProcesses
  PID:3824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,11398805890459023225,10716907212147024920,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2780 /prefetch:8
  2⤵
  PID:3344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,11398805890459023225,10716907212147024920,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:4116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,11398805890459023225,10716907212147024920,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3392 /prefetch:1
  2⤵
  PID:3116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,11398805890459023225,10716907212147024920,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4080 /prefetch:1
  2⤵
  PID:1580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,11398805890459023225,10716907212147024920,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4720 /prefetch:1
  2⤵
  PID:4276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,11398805890459023225,10716907212147024920,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4836 /prefetch:1
  2⤵
  PID:2380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,11398805890459023225,10716907212147024920,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4968 /prefetch:1
  2⤵
  PID:2424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=2080,11398805890459023225,10716907212147024920,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5144 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5088
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,11398805890459023225,10716907212147024920,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5456 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,11398805890459023225,10716907212147024920,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5292 /prefetch:1
  2⤵
  PID:4468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2080,11398805890459023225,10716907212147024920,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6148 /prefetch:8
  2⤵
  PID:1692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2080,11398805890459023225,10716907212147024920,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2460 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:3164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,11398805890459023225,10716907212147024920,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1864 /prefetch:1
  2⤵
  PID:1888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,11398805890459023225,10716907212147024920,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1912 /prefetch:1
  2⤵
  PID:1152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,11398805890459023225,10716907212147024920,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6180 /prefetch:1
  2⤵
  PID:3592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,11398805890459023225,10716907212147024920,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4976 /prefetch:1
  2⤵
  PID:3184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,11398805890459023225,10716907212147024920,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6336 /prefetch:1
  2⤵
  PID:3128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,11398805890459023225,10716907212147024920,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6344 /prefetch:1
  2⤵
  PID:956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,11398805890459023225,10716907212147024920,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1864 /prefetch:1
  2⤵
  PID:3300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,11398805890459023225,10716907212147024920,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6336 /prefetch:1
  2⤵
  PID:5080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,11398805890459023225,10716907212147024920,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6852 /prefetch:1
  2⤵
  PID:8
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,11398805890459023225,10716907212147024920,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6716 /prefetch:1
  2⤵
  PID:3384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,11398805890459023225,10716907212147024920,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6392 /prefetch:1
  2⤵
  PID:3704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,11398805890459023225,10716907212147024920,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5356 /prefetch:1
  2⤵
  PID:4468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2080,11398805890459023225,10716907212147024920,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6668 /prefetch:8
  2⤵
  PID:2876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2080,11398805890459023225,10716907212147024920,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6620 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:3972
- C:\Users\Admin\Downloads\NPE.exe
  "C:\Users\Admin\Downloads\NPE.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:4080
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4080 -s 1200
    3⤵
    - Program crash
    PID:3660
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4080 -s 1200
    3⤵
    - Program crash
    PID:4772
- C:\Users\Admin\Downloads\NPE.exe
  "C:\Users\Admin\Downloads\NPE.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:3380
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3380 -s 1476
    3⤵
    - Program crash
    PID:1592
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3380 -s 1460
    3⤵
    - Program crash
    PID:4968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,11398805890459023225,10716907212147024920,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=7208 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,11398805890459023225,10716907212147024920,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6728 /prefetch:1
  2⤵
  PID:2380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2080,11398805890459023225,10716907212147024920,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7812 /prefetch:8
  2⤵
  PID:2804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2080,11398805890459023225,10716907212147024920,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7704 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:3528
- C:\Users\Admin\Downloads\Birele.exe
  "C:\Users\Admin\Downloads\Birele.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3600
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3600 -s 280
    3⤵
    - Program crash
    PID:4920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,11398805890459023225,10716907212147024920,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6744 /prefetch:1
  2⤵
  PID:4652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2080,11398805890459023225,10716907212147024920,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4756 /prefetch:8
  2⤵
  PID:3968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2080,11398805890459023225,10716907212147024920,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5264 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,11398805890459023225,10716907212147024920,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6612 /prefetch:1
  2⤵
  PID:1556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,11398805890459023225,10716907212147024920,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4820 /prefetch:1
  2⤵
  PID:276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,11398805890459023225,10716907212147024920,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7808 /prefetch:1
  2⤵
  PID:1836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,11398805890459023225,10716907212147024920,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6732 /prefetch:1
  2⤵
  PID:244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,11398805890459023225,10716907212147024920,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5456 /prefetch:1
  2⤵
  PID:1064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2080,11398805890459023225,10716907212147024920,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7632 /prefetch:8
  2⤵
  PID:1416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2080,11398805890459023225,10716907212147024920,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7996 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:5088
- C:\Users\Admin\Downloads\CoronaVirus.exe
  "C:\Users\Admin\Downloads\CoronaVirus.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops desktop.ini file(s)
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:3384
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe"
    3⤵
    PID:4232
  - - C:\Windows\system32\mode.com
      mode con cp select=1251
      4⤵
      PID:20156
  - - C:\Windows\system32\vssadmin.exe
      vssadmin delete shadows /all /quiet
      4⤵
      Interacts with shadow copies
      PID:24416
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe"
    3⤵
    PID:30908
  - - C:\Windows\system32\mode.com
      mode con cp select=1251
      4⤵
      PID:31104
  - - C:\Windows\system32\vssadmin.exe
      vssadmin delete shadows /all /quiet
      4⤵
      Interacts with shadow copies
      PID:31184
- - C:\Windows\System32\mshta.exe
    "C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"
    3⤵
    PID:31020
- - C:\Windows\System32\mshta.exe
    "C:\Windows\System32\mshta.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"
    3⤵
    PID:31092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,11398805890459023225,10716907212147024920,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5508 /prefetch:1
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:14712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2080,11398805890459023225,10716907212147024920,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7892 /prefetch:8
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:14276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2080,11398805890459023225,10716907212147024920,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3308 /prefetch:8
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:14132
- C:\Users\Admin\Downloads\CryptoLocker.exe
  "C:\Users\Admin\Downloads\CryptoLocker.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - NTFS ADS
  PID:13620
- - C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe
    "C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe" "/rC:\Users\Admin\Downloads\CryptoLocker.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    PID:13580
  - - C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe
      "C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe" /w00000234
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:32052

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2020

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4084

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1940

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4248

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4080 -ip 4080
1⤵
PID:3764

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4080 -ip 4080
1⤵
PID:760

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 3380 -ip 3380
1⤵
PID:1876

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 3380 -ip 3380
1⤵
PID:3320

C:\Users\Admin\Downloads\NPE.exe
"C:\Users\Admin\Downloads\NPE.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2032
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2032 -s 1468
  2⤵
  - Program crash
  PID:3296
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2032 -s 1468
  2⤵
  - Program crash
  PID:2380

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 2032 -ip 2032
1⤵
PID:3320

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 2032 -ip 2032
1⤵
PID:728

C:\Users\Admin\Downloads\BadRabbit.exe
"C:\Users\Admin\Downloads\BadRabbit.exe"
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3672
- C:\Windows\SysWOW64\rundll32.exe
  C:\Windows\system32\rundll32.exe C:\Windows\infpub.dat,#1 15
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4044
- - C:\Windows\SysWOW64\cmd.exe
    /c schtasks /Delete /F /TN rhaegal
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4772
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /Delete /F /TN rhaegal
      4⤵
      System Location Discovery: System Language Discovery
      PID:480
- - C:\Windows\SysWOW64\cmd.exe
    /c schtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR "C:\Windows\system32\cmd.exe /C Start \"\" \"C:\Windows\dispci.exe\" -id 313599615 && exit"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3088
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR "C:\Windows\system32\cmd.exe /C Start \"\" \"C:\Windows\dispci.exe\" -id 313599615 && exit"
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:4832
- - C:\Windows\SysWOW64\cmd.exe
    /c schtasks /Create /SC once /TN drogon /RU SYSTEM /TR "C:\Windows\system32\shutdown.exe /r /t 0 /f" /ST 02:57:00
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1880
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /Create /SC once /TN drogon /RU SYSTEM /TR "C:\Windows\system32\shutdown.exe /r /t 0 /f" /ST 02:57:00
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:2980
- - C:\Windows\DF10.tmp
    "C:\Windows\DF10.tmp" \\.\pipe\{C01BA2DA-E939-408C-A8F4-BE0FE78F62A8}
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3296

C:\Users\Admin\Downloads\BadRabbit.exe
"C:\Users\Admin\Downloads\BadRabbit.exe"
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2704
- C:\Windows\SysWOW64\rundll32.exe
  C:\Windows\system32\rundll32.exe C:\Windows\infpub.dat,#1 15
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2808

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 3600 -ip 3600
1⤵
PID:996

C:\Users\Admin\Downloads\BadRabbit.exe
"C:\Users\Admin\Downloads\BadRabbit.exe"
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1756
- C:\Windows\SysWOW64\rundll32.exe
  C:\Windows\system32\rundll32.exe C:\Windows\infpub.dat,#1 15
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5040

C:\Windows\helppane.exe
C:\Windows\helppane.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:2476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument microsoft-edge:https://go.microsoft.com/fwlink/?LinkId=517009
  2⤵
  PID:3796
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff9fc763cb8,0x7ff9fc763cc8,0x7ff9fc763cd8
    3⤵
    PID:932

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:31032

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\FILES ENCRYPTED.txt
1⤵
PID:31684

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Public\Desktop\FILES ENCRYPTED.txt
1⤵
PID:31736

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Direct Volume Access

T1006

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Windows Credential Manager

T1555.004

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe.id-44A42474.[[email protected]].ncov

Filesize
2.9MB

MD5
de0558c4e0e830f9be2ebb3fcac8dbe0

SHA1
5ef2219374d3783c3a85c3c6722ab4795687bb12

SHA256
a9263551a296dfe07d2932b9222ec5d308ebb4122706662b860c4fbaebb7fca0

SHA512
beaeefbf6449710065dfb241d41ad6b7d59e2ca60843c3686fa1a6c1622c8bbcc557a31520551316d7afbbbadb48b4c0e35af5b6d3b52b3685d88b08aea9ca2e

Download Submit
C:\ProgramData\Norton\NPE\NPEsettings.dat

Filesize
2KB

MD5
6250d92e25272a71f822ed3183d6120d

SHA1
53bf382712eca9ea08c4623a0d84788e4b5f7b3e

SHA256
28985f8befaa3f426840a9f09fe627ee17b16e2731c484c9fe295ec65816a76e

SHA512
197d57fbeb0b0e0427b4d6e06e761bba2b721b7ad7838bbc563a030d47e6355df8f301ca40b153005c4cee69a67e5518b54fa073f01d70dd3da38b80de0d723f

Download Submit
C:\ProgramData\Norton\{086A63F0-6B13-4F29-9695-134E7A01E963}\LC.INI

Filesize
157B

MD5
757ad01f498e653574e29dc4814b29db

SHA1
3973633a1ae7cbea9f7dd0c41b708174b8f9c61d

SHA256
d04b7786665c7b61007c2960ea95ae4f9d41276358c09840e941c5153a354b00

SHA512
a7f6a78d7731250563fea449fc4fd0a3ec2d1816c5675d09e1e280ead1b4a1ac18893ab45bc7ff2e9679255ae651ddfd490eb4e3331530ac38ec96f8512c2f08

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1B1401C7EC8E96BC79CBFD92F9DF762D_5398732881722BDE3E78D6CA6BB2B78B

Filesize
5B

MD5
5bfa51f3a417b98e7443eca90fc94703

SHA1
8c015d80b8a23f780bdd215dc842b0f5551f63bd

SHA256
bebe2853a3485d1c2e5c5be4249183e0ddaff9f87de71652371700a89d937128

SHA512
4cd03686254bb28754cbaa635ae1264723e2be80ce1dd0f78d1ab7aee72232f5b285f79e488e9c5c49ff343015bd07bb8433d6cee08ae3cea8c317303e3ac399

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4c1a24fa898d2a98b540b20272c8e47b

SHA1
3218bff9ce95b52842fa1b8bd00be073177141ef

SHA256
bbcc378fcbf64580e7a48b4e7ca9be57fa0a1f2e747f488325685bdb18d73a95

SHA512
e61f196e7f1c9a5fe249abe9b11eea770fb2f4babc61f60b12c71f43e6fe9354cf14869daf46abc2c2655bce180252acd43c10562a2dcd31fa7d90d33253820e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f1d2c7fd2ca29bb77a5da2d1847fbb92

SHA1
840de2cf36c22ba10ac96f90890b6a12a56526c6

SHA256
58d0f80310f4a84f687c5ce0adaa982eb42fe4480510399fa2ae975d40bb8bc5

SHA512
ede1fafea2404f16948fe0b5ea5161ccee3ee6e40c55ff98c337eac981a6776b9c73dc030a5c59e4347aec91259f497539206e71949c33adcecbf2c846709e14

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
1d9656e9abbee8e455ee69266be52929

SHA1
c8b64c96591bf750eabd68b8ce8eb355d9479e81

SHA256
1ffa4316f31e359294cb1c4978848f194713ae1bfca4318709dbfd439bd7191e

SHA512
9566d8a4c6c1a44300987623d5292f8ddbf8f642b4763f4547c6306711b17c373779c818ad611ccd0fcf04c53817a009cd83b273dbd320bab51b29758b2bf079

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
9aaf87b375bf78449e8f027f868e6e9b

SHA1
4201b36e8b2b2c2160b1670a605c7d4549b3d3bf

SHA256
9a48e6c53bcb2f704012d9272b9ae4c29e5106a044f50c0e69ce8c76852b12c0

SHA512
77e77ddd6b890715392e529646834bf3e5b42e5d1462d87ecaa982c224daee3073dd55984f6704b2c17fe54e4da9aea6c66aabefba67a23cc97ae58bb381444e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
4ea135efe6c33f3d72acacbd8dacd240

SHA1
7737cd4890ad9964b4ad602969741b7c3fb5be95

SHA256
dcb12bfe645bee7c7ea536c8cd0c174d327c9c5c27c438ee3b3369c3d3991302

SHA512
f91a1ef721fe2bedb5d54e900ff4873448cd23f6e0d454bef6ed75d3da0b564330b75de9a2185f7a422ce8763dac5990126289fd8c159415f781fd1c90dfadbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
0b341f2d164ed51d3bc95171014934cd

SHA1
547e262680cc7691c9bb78ac9d614a77397ce6be

SHA256
213ef4bccd2f0169623122eff20c6dbdb643239da3804c8fd299d8c4d72550fe

SHA512
b5056ed0ae3bebd7cd1d7e6e61b5873a436ecbd85c9a1c850be41eb2c81f8b655449cd7aee4a1ac92792b39ca494194dea160ccdb04e47d927454faedfa1d2ec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
c420c13f3a490a0d98fb7da85a7f4bf0

SHA1
13b040e003535422ff88685f7445a6694e51cd82

SHA256
7e8fc5f137d4f3135d221a272d57271635e6e718cac84f368f3998b1387e291b

SHA512
ae991c09657d3bd33b9e6b80dd1f63e07f3afacf5655f532da8a80fdd73b778b6e469c5b1804e5ca23b6a86f8eb9dc53345f65865941b8524c5eb6f0ebcd4762

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
b0ce618eadfeeeaa2e79a7f191657153

SHA1
cb1dbdf7a32ccb265284a58187bb33537d92a4e0

SHA256
eafdd67cdfa6436cdea1ec32c73d75fc94ab90b62d0b63ca10a57f6ae83f08fd

SHA512
836d3bfd820ef97b93c8ea739dbea75cec48296aed9be7db3b16fbe4d9d711d252fcd92c5340b8d3e312bd5784cd023ab6cd5c8424a2ec7f77d8ddccc1f001d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
5cc59b0ec65ca7d2fbcb5c8ccecbc7d1

SHA1
b0f081e64fd5122b5b7a5eaf6c2fb934d9708d3d

SHA256
d5e246c558c03aa9e0bc7cc1cf65b6a63b5b7ed20c9f08f7e45502bbbe279477

SHA512
e2fd6bea8ffaef22dae01302bf9d2af459454be0844ec7a9e03c6100f4985e331d1217a0041626959f0b32dc036b432ea7e939a3c2bf672f96ec9c464f68db97

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
22fc604d1d9046989a3511a309819635

SHA1
5f0cf073bcf1120891a4b12b087fd9f52f3ba6ce

SHA256
793896ef57f19fa45d52286ad1ab21943a283def3a9e6a6591ef65eaa7fe1d1a

SHA512
2c31fc3a9f1c30bb2af77d8d0cc344eac72d999d353460f73521de33023c41727efc8a0624b32e5504d136b55846c1c764f244724995ff26fc36c8c8843255b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
187516d444636ed9607e21d7e1fffe94

SHA1
78051adfb4ea6bbdab69f46e713f4e235fe45e63

SHA256
73a1485af9ca6524dcc35fa4864e7b3622e2e8dcd85ec4a49645364fb032ae87

SHA512
997dc4c6fecf74fbcd4ca7710e7f77f83c2e3c45d585a20c7a2cb320a55efff49857d4a0368c57eea722d32ab037892727fa36848720b4b9f3cbc3010e67054b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
016873213a07229e33592a78310390a4

SHA1
4ae23478b9689df3e99dfabc5a3929a9ae54d2d3

SHA256
fcb8069ff6d45d8ec9e6619a3f9ffcb3c9ca5e2208d766196c534bfbbce07957

SHA512
e1de499a3893491b698cfba7582b32de894cdd51d4195da48d83d8f2b640ae0be57f206c214b28d94b2e111340be3cc887cc2ecd8d14c5c4e1c2c1c38fedac34

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
bbb2a1ea60b668192201b805302c7ee3

SHA1
0d8cbb842205c79fe2f51e109e777b09c50966ec

SHA256
a108694f622d9e035215992a87b40026239849619d8fc3afd3b946615406f9c0

SHA512
be648e5799a64d1c0cad38af9a172d518a6d446547f504626fea7bb60655e5fc99c06db28fd6ad9e3eb2a910a9140f2e885c30846a374fc6a1cf8b749d27357d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
023b526466eefe00d0db7746bf88b400

SHA1
e1976b04d0d169af65b2594520f3b329867146c2

SHA256
351c0eef7abc5a4d65f72bdbf7c0b65a2c376f1102ff9403c3723d181af780f0

SHA512
b463c9f98034ab3954e577c4d9201678a9728ee10f4621c5dee6ef82314d55f1e268e6b47cf539cbc8ff187883673c7cf1136d2f3b8d6c91984ba0a58ef0ff4d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
1ef935c52e123a3a5435a7c592d8f9f5

SHA1
7624d2611ca9a182a193b5d611969442ce33f63c

SHA256
09015c44d2af0884e0764f34249d1bde39eeb4d66c969c44463274fe6ecb13bf

SHA512
8097b2a7a9dbec807f7d80f520d3a668f4e4b0475383904382b4078174baba40577be5fb6c3a0bd77bc3547999160b81afd48a64240a52b1352bffb9e38e7ba4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
99446b02f7945b8f8b8ac5e6b6590646

SHA1
7c229b644abbcbb08f607f71ae63c371b1205bb4

SHA256
bd42c752b57fe6b4af992d8b40c2b54c2b27823453673bb5a34a8fbd77861048

SHA512
9857d67529fa019ccd8eaa1c7fe4e40763129ca3b0e1dba833986508d6cb454b916f229138859376110adbb4db68ec618219edcaa90b7d6317137482340c1a71

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
41c65acad4bb7d07b243aadd45f92373

SHA1
ca6737c0212deff3664ff9604957f0ea99467c61

SHA256
722986436acbbd1d7c7dd6e7514e45c7925c60de89bf5b034712571b36915c8f

SHA512
bbf778ad8288b6351ba5452d2063b585db03eb5cb3a5194c68f0bc6e9b30f977a6c51f1c388cf264851273b4d792618294981648baf7c343d83f8cf99848ab11

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
9a563f3ae911ca252139b28f1c3f6cf4

SHA1
07cba78efbb08b032f59e38bc38ac23edd657b7a

SHA256
5a19aa0b83e3a870435a2cb68b8e9a68ec5cc5bc769a359249c2f245444343fb

SHA512
5fc62d999f42e33cee8d4a202c88b5e3bd927a101b9964cf8638402775b0a154e4e04893fe1eeef2820dc36a6c8b1777d4d22db38627ca26f341ed18804ae36f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
fa34ac62454e5f466b089cc751c7bd4a

SHA1
8bafe48463f01554316906fb94fa33b5fccea784

SHA256
c467bb079c7786c35b11949a4fbaf71a7f41740c18089866a8fd464b3aab7df1

SHA512
db73a8dce0c04556b04d4b7acadccd32bbdef6ed8f9055c365fbe79eefc83e7c947678379b332582e6f972069accfe777caf929d49b4ce11ae65aa8e6c18f33e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d8a79b9d3a44637bfd8a6cedd925bb76

SHA1
91049cb75d7fce029c44d84ae7b242263d54eafb

SHA256
55814cf016a11b4f1d4372d332518f77bba761b84039ffc98ad8678affbdf72d

SHA512
111a5a3f8409165480e0b67aac9ff3aac4be2ca7bde822d2f960d71089896b5a9fc968b39e9d22a58d96a28197d359590ded7862393fe45890b065ef60ac9ccc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0ed46849efc8f8b143ff1a65a28f69fa

SHA1
e14194c1ee2efbaad75e348d8101ee55f96793ba

SHA256
51a101455b608fef02925037eaa1095e77753ac907d99cc821b82d2bbbfcbb99

SHA512
1252e6ae65e88d07b6b5902df54dedc90a80e2364f1632cf4145ff02e3a82ff4869cdc0eb0ee502badcd9b19e9bfbdcdf3db4578ee24bae83216d32bd3ad7fc6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
d6efafd4359fe3f7d0dbe7f2c77895ae

SHA1
1cf00df7b7298a82f2374ef549e74dbec060653d

SHA256
15d16675751afe9d0e8a22b50bee626fb7039222849bace4e80c94cb46e678bb

SHA512
84dd3f1986e1de9273b139e661d72be2a34057ce4260b74da0f69dca15ae3220842906705f8c15156840ead2afbd04a831376a68282e8faf030e240a5221bd05

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
f626d485acab326a5e6c5b481f53d694

SHA1
2005b9b3eb254c4285fb32c8eb7d91c86844a821

SHA256
cede15eb66b15f0929567623a381971932acd4f73713c678a7c1c47efe085af7

SHA512
14a8a0d9c176e7cf32b06963ec9e3f1956b1317f7b150eda8f3ca8ebfb59c6daf9ffd0eabed8c7387caf1ad365036d909c68ccb70fae3cd0a8a4796fae56d29d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RFe5ca909.TMP

Filesize
8KB

MD5
eee8c4512603e54273c66b8b671c72b5

SHA1
9b59a449599eab870c4d7d951317496e66b458f3

SHA256
508b3cb14bdcf1e4fe3bc8690d6522e191979120eed1390736c38f9ea91d148b

SHA512
93b1bb6e45462bfd45850e0d217b8398627a4aa7590baef1e806f62aa9a9bfee794b81bba67652a8ffa8ed65204c4dfe20445c4af4b3da3c1d2beee7ce4647c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
05b1a8917d1ad4e4fc3f48d6ca528105

SHA1
1d04df5b51f989501a1c5812df7ca2998c0cd180

SHA256
850a3406f7793ce91e1f6cb5f1fc25054d9b2cfcdc5a9da00c5a42d6bd574242

SHA512
2bc018833b970be8dd821e89b6b9464bdee6a26d4be01d58f61a55a5a6d346b9bf36885b6533c11b0e29ef942916b94197c03cce86e40a43068a261c39edae09

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
d32be315a003e1bcd55989e4455f843a

SHA1
5e8a577fe8ab44391e616fdbbb6f7979fdd73488

SHA256
6e34cc66f55f9b7a6ac10bdc0c719b24f4c3c2920f835d8395644da39019426c

SHA512
3f887df6f517262670d488d319433e91a9a4b85461d07b06ed26d1b481607d32c0b411b251a07f08a75533875c846b6e268b3465bcf61279a259dc2faf6501c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
0a13e1365890a6c5d9409ba1fda9bf8c

SHA1
b474c4f0a8bde0e3a9b542cfae1c445e20d406fb

SHA256
f11934d367d56da7d2b55e7bca15d3934da9e5a77a9d5f1fccb62a41247eee1a

SHA512
a040b326c3c3b92c16e52e4fdefaeba29e0b9966afcf1bb6a0d0094e539a2f0dc14a7515f3078d5105233d76d198b1738de94690595aeda25ddd4aa0e29279a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
4ed901e7371463ede54d8b37f23017db

SHA1
11a766db64bc06f288e68bb17a26c92262cd06d4

SHA256
ccae0c0baa7bbbc620824ed63aa0fbbfd7a53b4b8d310900f5599093b2bab9aa

SHA512
b9c7d52bcb7458bd6423790559f56fde6c5397f75eccb624f18ba920c364039ef5d830cc3f3695252b7b877fa1aaa32902d64fb8d51b53d9c2570f3af4c7c2ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
7c655a1cade4be2bde6b3841c929c4dd

SHA1
cf2dc0400f8f385d5b4c93a295fe94edf1fb38ce

SHA256
ce7efcc8e2ed391012f07b14b28b50adc3706dd94a8d2af0d3af02f9b048d1cd

SHA512
418291431a2e905a6b5fcececbde828c64f6b35619d9e8a9a0292589b9f19436a5a1cff0230f1521005349d99760146a9f8a964c5c35fc42644d029e3630a2b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
493c4545da0d902b6ad70668bed13afa

SHA1
f282002eb4bd45540c3818642cc0d684bc36fd93

SHA256
15152cfd407a2d1ebd2e11422a1ff0d404f20a9bf60194cd3964a0d5017fb459

SHA512
196c8e0d0a8cedee137700e2946863741204a3d83fa270d7dd0aa586a388f6c4fab4d2b6c9baad19201345d0202953d5470fc4b88fc8a0c8e3227bfebb971005

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
dbdbb464d56ed422779e417455437490

SHA1
af8b10987f49586613a09418576d61373545355c

SHA256
f2d66943b2be22c41135e242b32752b223d3722712bbb99eabccc6aa2fa8101c

SHA512
c66823f9cb445e45eb8e7365f59c06a240480fc11380dc4d6fbf6b677793836004702f7a6a355cc464c8c8316366049649caa8a9401d046170de8184651691e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
68ad615af41e8d27e491c094eb720323

SHA1
9a9588f2f2b449717fb00ded8b0fbd8ff9eed397

SHA256
064bea23b3ac552a1036ac84777fa18683afd75e4c7ff9134b1693acd23018d2

SHA512
f5dd55948b2344ef7005ee686d43e2c9860b58cfca5c117fd3155c7baffb1e4f994d439a6f5fffe5be9b1b8d0add1a73e00dff6861545447ca9056ddf000be1e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
e29a8a1703cb3c79e2374ebc3caec60a

SHA1
70d87aa342758e8d24f0ea8c1d3b750af5cf9d0e

SHA256
5607eead6b239d6f3e36ece6c94585f77ce8159bddaed471815971f5f1de981e

SHA512
6a56744bb7cd12be34441f7ad4153ac7f171aab40fc46909ca9d38320418d4bcbef29e7ddcf016b6255237d6274651a1169866b66824331bdbc6ffdd80a631d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
cb3e9c15ab4fe9ab542a996bc4b8049d

SHA1
6b7b3c1a59c44e4de6c86ced77f1b08edb842e3d

SHA256
8b241c2be81c448b5e2f537789d22bbe1fe62531174b2bc465ac52e3e6110c4b

SHA512
f7721009908881cc4ee79205317ced5525416cc56c1a7ac76b9778fd442cce992dd25e5952f6216d087b824d68b223264bd3ca504f897e7137a55bb19a89b5f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
52edc0e32cb910769eae28cfea10a245

SHA1
af1a1e2bfe172fa89c74e4d873fb5b3f990a9623

SHA256
4f55f7c4e78c387ae508040e6c80ce5f81303d654d428765f828e8b8fb98438a

SHA512
76358b4c902060e366c4d3acdfe90f6ee9b771e5a92737314becd3ceb743edacbcc9d3b533b953313745e0d22b80b094a451e2027d425fd3e18d940605b7d4e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57f973.TMP

Filesize
874B

MD5
d1bd3a1a19068d24e2321720e1e55697

SHA1
e79d475a2041d036ca328e2cea0f79107b242973

SHA256
678a9144d13e07e3d57c599496db64c1fd2a25fd227ffa8f0e1fbb2ec5a7d083

SHA512
a91529d4b2ba356e9273922369f8b2f5446eb9a9eb764f719b6cf5c055fc7bfc48d936648fc7215237bdd101ce8e95376a6868c9fd123013deb70aadb379fe4d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5d0a72.TMP

Filesize
4KB

MD5
0aeacdc400eb876b2c69a7000f6e8e39

SHA1
434222c3644e39cdd57f793e75783ce372621aea

SHA256
5173f57a863c55c457d9df95853aa29968f8a373dbbfa9fa706bb7abc15c2605

SHA512
bb266206adb8f340c9db27b8133b3d6107d4eea4145df6621cb8354d0cc79d01638ef2eb6cb1e3b491695133e4a1760ad437418211246a89e95dfecb07b89d84

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
8bf6cad5c127839c6af698d392532c27

SHA1
ef0ab069f571bdb4464d6389ad28c9966275e9fa

SHA256
ea0d8bcb739577487db9e24f1f1dfff85658a48eac8185618298eb00a235a9dd

SHA512
480ae9ffc3cac6c65453851f7d1783dc6ce2407301441e17e21bb01bc1c7dc79d93c95e756fd83e01c78ba859838d6c8906a769b0e4d399a09f74884568afa72

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
bdd5fdedc8af534b98688c2d8dffc75f

SHA1
cad476099011f14e9d35ededd5f766c3c45febef

SHA256
4d61c63793e0c4c013687aeb12a5fd672dcdbdb87429e375f023ba7874b389c4

SHA512
edd02436df66d5d850c8ae759e865bfd4fdf766282546c7c19af519b8b4bd699a363cca3af503a2c2c440cbb92d935f145e254716c4b6adfc7a27f387ab20a7f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
caea5be9553b5cdefe02ac3b1943a658

SHA1
fc423fde80f2da51fe7ccc289f9dbe3e5e86c13c

SHA256
892d7fbcdb39c0b7e303e27eddf3999540b84341ee4bf8aa0faee41f099b72b7

SHA512
623dd3172c1056b0ceee6f4c77ded3b340457d5648f4b8f0b78d5d467ad0e7365b04732c94f35bfbf79c0ed30bbb3776a12f879f91ab084bab256fb774c05778

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
bd13b4c5ef15aca1804d08ea986d42ee

SHA1
1c48110213b58b86339fa5eedaef3e2db4af6086

SHA256
3c2d110e252ec1e74d7f391ebf9029fcd3845890a0f10abe2825697432b6d025

SHA512
9f91f61e332a6c171836c5f71b8dc1e8e9fe01f4e3c3fb36d16c23470d99b735e3ca58be310d62c60e1ea207929de6ad2526e6c593f1029b5bd0b57f2f583b2a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
b065904e396181f82a273dde9b6cee23

SHA1
93ed6456ce6a2d3755ad872317e9bb109b9e386c

SHA256
f7f45ec7a5d3eef4d3fc38b4e917be23f4ab9417c864a8c1dba8a01b7891e66f

SHA512
06e822fe5a8dc98f808862748b8de3db3f82e8c6e20855206b08e79e5701de76c7531f1ca01b2c8099ae115c300a69f3b4d1f755bfc7184adebe3982f89767c8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
4d39a78050afe0a0b7e5b4e5b21e2d21

SHA1
723856dc481a25691eccd316abc71b13eacfd7b1

SHA256
8e0ec4dbc819cbfa0259b1914da84853db48826a21cbd80d07749adb815744ac

SHA512
4ea4d953ccaa336a9503d44111f5d87fe9c60793d32dfe34f46ab4c03c0b0ada34bf2b81edddc3a2ff10cf33b80ddeee94cfb8b33578f7b0f360ac4503baf575

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
11a3da537d8168d2098386f43a23dab1

SHA1
792a2f446fcce96e772ec194d5362c79e0a706f4

SHA256
ded5f896f37127444d179f3843b2d5405cba8a58168407c06bedd96e33f9ee21

SHA512
f5aef32c168998cfb41d7c296dbfcf164832cba7cb3d7719d83fd4394ba74d24b55437b4c5316146fb45d0201b2e4bbc62ca2cfbc5b0532f8df764b00ea1f7a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
e57b70607b3f7efed6c755ae915604fa

SHA1
3556af21956f6754e32cbcabc4546df7915f8567

SHA256
cf2b1452c08e7e2862ae241999cb7ddb8a00b93a89d7915e7c040bdc5cf13f60

SHA512
e73ffdb3f8ac2133167c5a0084ecd9533b70596b7b9b14b5285100b75ceb1e3e34f3c517f2ec4b98d47b381f8d100ba15631424089334014dc44d2d70039b7bf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State~RFe5c7fb7.TMP

Filesize
11KB

MD5
b707a2c5321a1c05b41ff495af97fec8

SHA1
181b84afe67f9ffff6c56b3aa97112958e3d8307

SHA256
096caac73d752b7b82d224086799bd68d9e7c4d710e8c78ffdc452a509ff618e

SHA512
f068b95f102b4350c0c6e1270fd22fcac744110e73f40cd346cf196f988c447308eed8f026bc2e7713bab38eff3c8ed05f71a1963ff0288d4dce86d371638763

Download Submit
C:\Users\Admin\AppData\Local\NPE\ErrMgmt\Queue\Incoming\SQ_{3258E969-697D-41BF-81DF-A606FD8E208D}\SQ_{B96AD15A-50D2-4863-AE6F-896DB87DD64C}.etl

Filesize
256KB

MD5
ab9ae1924aa4a8520839bab9ff68b477

SHA1
8b57e2f2468d15fbb0ffc39a83d9603d998ce125

SHA256
4a38907679abf277e2061be97eea7a0ef6887140912caacbdca90ba846aa85b3

SHA512
d851634f391d32ae97ccd80a42b6d22d317b0c5c9125777fda251625fcae3abf7751823830a6957aebe9ccb20586e68ca2c9331b71e43f3675e02ce43e12b824

Download Submit
C:\Users\Admin\AppData\Local\NPE\ErrMgmt\SQCLIENT.dat

Filesize
2KB

MD5
e9ab6313bf4c2ab40249015f04eadb7d

SHA1
5f70d77b4db67a3b83f2bc424491f5fbc60bfd42

SHA256
0b04262457b5ee8269aaf6a993e4a1da5677c434e9c4dcc3d1db8e892bd077ad

SHA512
f6615aa1a3eca612205bc381dd8076dbc18552ba9cf3d3e61d6703afc0c0465684099eae32c334e3ce4a29f96fc5cfbb9c75cb7a66ca44fbfa9a1c1b16686953

Download Submit
C:\Users\Admin\AppData\Local\NPE\ErrMgmt\SQCLIENT.dat

Filesize
5KB

MD5
118e337064e921ee06224508a43aff9e

SHA1
ced7dc2e7b17bbfe7d61ad3e52e5ab693699ad44

SHA256
832a4e8a4fdf7d4b0ab6c8ffbc2e585e1f520c2eac8a1c4d5ec386d50223769b

SHA512
dcb73598778fbdd516c838afbdbd597b3a069f246ac88d26c92e0fad930d3d9258750c09ce3cfe03164533ab41d57a64c8a777b8ce71fe3b77ca496b210ce239

Download Submit
C:\Users\Admin\AppData\Local\NPE\ErrMgmt\SQCLIENT.dat

Filesize
6KB

MD5
ebe85498710f1534b20d2434df6c7a1e

SHA1
44ac35cac486a98467eaed4060e0836ce8e57a39

SHA256
426b7ef62c9448a0299242c271d7731b7e9db64db8206183c791f752a31814b3

SHA512
2f8547e2047a19626d690c959a1215add96e809b3c7e1cb635c6458b103e8251caec0c43444d184c27a9a2ce65e01a77e3146659d8622cdb1f5bce56af4ac4f7

Download Submit
C:\Users\Admin\Downloads\BadRabbit.exe:Zone.Identifier

Filesize
55B

MD5
0f98a5550abe0fb880568b1480c96a1c

SHA1
d2ce9f7057b201d31f79f3aee2225d89f36be07d

SHA256
2dfb5f4b33e4cf8237b732c02b1f2b1192ffe4b83114bcf821f489bbf48c6aa1

SHA512
dbc1150d831950684ab37407defac0177b7583da0fe13ee8f8eeb65e8b05d23b357722246888189b4681b97507a4262ece96a1c458c4427a9a41d8ea8d11a2f6

Download Submit
C:\Users\Admin\Downloads\NPE.exe:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 252652.crdownload

Filesize
116KB

MD5
41789c704a0eecfdd0048b4b4193e752

SHA1
fb1e8385691fa3293b7cbfb9b2656cf09f20e722

SHA256
b2dcfdf9e7b09f2aa5004668370e77982963ace820e7285b2e264a294441da23

SHA512
76391ac85fdc3be75441fcd6e19bed08b807d3946c7281c647f16a3be5388f7be307e6323fac8502430a4a6d800d52a88709592a49011ecc89de4f19102435ea

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 290997.crdownload

Filesize
431KB

MD5
fbbdc39af1139aebba4da004475e8839

SHA1
de5c8d858e6e41da715dca1c019df0bfb92d32c0

SHA256
630325cac09ac3fab908f903e3b00d0dadd5fdaa0875ed8496fcbb97a558d0da

SHA512
74eca8c01de215b33d5ceea1fda3f3bef96b513f58a750dba04b0de36f7ef4f7846a6431d52879ca0d8641bfd504d4721a9a96fa2e18c6888fd67fa77686af87

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 323357.crdownload

Filesize
338KB

MD5
04fb36199787f2e3e2135611a38321eb

SHA1
65559245709fe98052eb284577f1fd61c01ad20d

SHA256
d765e722e295969c0a5c2d90f549db8b89ab617900bf4698db41c7cdad993bb9

SHA512
533d6603f6e2a77bd1b2c6591a135c4717753d53317c1be06e43774e896d9543bcd0ea6904a0688aa84b2d8424641d68994b1e7dc4aa46d66c36feecb6145444

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 651822.crdownload

Filesize
313KB

MD5
fe1bc60a95b2c2d77cd5d232296a7fa4

SHA1
c07dfdea8da2da5bad036e7c2f5d37582e1cf684

SHA256
b3e1e9d97d74c416c2a30dd11858789af5554cf2de62f577c13944a19623777d

SHA512
266c541a421878e1e175db5d94185c991cec5825a4bc50178f57264f3556080e6fe984ed0380acf022ce659aa1ca46c9a5e97efc25ff46cbfd67b9385fd75f89

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 710843.crdownload

Filesize
12.8MB

MD5
e736652d1fdb84ee3d11870e6422457d

SHA1
4542923765d79d5dcc50d1ba7df0123fe586ff19

SHA256
81936f96faceecb40c6fbf91e00e1a60cab112571944157b00726d586d422d64

SHA512
540ddcf75ec92719b437d6df5563aefe16bad095318786417b7c8bc48f31085dc1d20fc1ad35ca9f59ab3591b67870fed4b90a69bef072df0375120e9279bdf6

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 762969.crdownload

Filesize
1.0MB

MD5
055d1462f66a350d9886542d4d79bc2b

SHA1
f1086d2f667d807dbb1aa362a7a809ea119f2565

SHA256
dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0

SHA512
2c5e570226252bdb2104c90d5b75f11493af8ed1be8cb0fd14e3f324311a82138753064731b80ce8e8b120b3fe7009b21a50e9f4583d534080e28ab84b83fee1

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 762969.crdownload:SmartScreen

Filesize
7B

MD5
4047530ecbc0170039e76fe1657bdb01

SHA1
32db7d5e662ebccdd1d71de285f907e3a1c68ac5

SHA256
82254025d1b98d60044d3aeb7c56eed7c61c07c3e30534d6e05dab9d6c326750

SHA512
8f002af3f4ed2b3dfb4ed8273318d160152da50ee4842c9f5d9915f50a3e643952494699c4258e6af993dc6e1695d0dc3db6d23f4d93c26b0bc6a20f4b4f336e

Download Submit
C:\Windows\DF10.tmp

Filesize
60KB

MD5
347ac3b6b791054de3e5720a7144a977

SHA1
413eba3973a15c1a6429d9f170f3e8287f98c21c

SHA256
301b905eb98d8d6bb559c04bbda26628a942b2c4107c07a02e8f753bdcfe347c

SHA512
9a399916bc681964af1e1061bc0a8e2926307642557539ad587ce6f9b5ef93bdf1820fe5d7b5ffe5f0bb38e5b4dc6add213ba04048c0c7c264646375fcd01787

Download Submit
C:\Windows\infpub.dat

Filesize
401KB

MD5
4e46d3825c01ec53e22d2fe7c4a7a582

SHA1
6cce78e16ccc0178d3b9b3fce26b249103bd1e1e

SHA256
f662641eab0abd8750a6c629357bc8b67597f6858273cc2e114d03da44a29493

SHA512
8287d2feeb1be2df830c0973180d8752ea7d159a4ec42d900198e0a1c41c9fd1b2676a6e682cd8781d90d23bbd49e3c410ccff174133daa535301a0bed4a9d97

Download Submit
C:\Windows\infpub.dat

Filesize
401KB

MD5
449546d6d9a953b1364147ed0755c3b3

SHA1
8306721ab3735df6a5e743b289011b04fdb763bc

SHA256
50bbb61b89a635adcbef23b498cc5c83bc94d161f816131433eeff9143d830b5

SHA512
ed986c6d12deca8d3357d16c976bb1535455c668520f9229f08096c9108a26aa5cc45cfba967e326b3cb1ceb25c97174161800311bdb1a652baf4f0a7c2114c0

Download Submit
C:\Windows\infpub.dat

Filesize
401KB

MD5
1d724f95c61f1055f0d02c2154bbccd3

SHA1
79116fe99f2b421c52ef64097f0f39b815b20907

SHA256
579fd8a0385482fb4c789561a30b09f25671e86422f40ef5cca2036b28f99648

SHA512
f2d7b018d1516df1c97cfff5507957c75c6d9bf8e2ce52ae0052706f4ec62f13eba6d7be17e6ad2b693fdd58e1fd091c37f17bd2b948cdcd9b95b4ad428c0113

Download Submit
memory/2808-832-0x0000000002C70000-0x0000000002CD8000-memory.dmp

Filesize
416KB

Download
memory/2808-824-0x0000000002C70000-0x0000000002CD8000-memory.dmp

Filesize
416KB

Download
memory/3384-1247-0x0000000000400000-0x000000000056F000-memory.dmp

Filesize
1.4MB

Download
memory/3384-26448-0x0000000000400000-0x000000000056F000-memory.dmp

Filesize
1.4MB

Download
memory/3600-946-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/3600-942-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/4044-762-0x0000000002DE0000-0x0000000002E48000-memory.dmp

Filesize
416KB

Download
memory/4044-752-0x0000000002DE0000-0x0000000002E48000-memory.dmp

Filesize
416KB

Download
memory/4044-759-0x0000000002DE0000-0x0000000002E48000-memory.dmp

Filesize
416KB

Download