badrabbit | hxxps://github[.]com/Da2dalus/The-MALWARE-Repo

Analysis

max time kernel
343s
max time network
345s
platform
windows11-21h2_x64
resource
win11-20250217-en
resource tags

arch:x64arch:x86image:win11-20250217-enlocale:en-usos:windows11-21h2-x64system
submitted
27/02/2025, 05:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/Da2dalus/The-MALWARE-Repo

Score

10^/10

badrabbit mimikatz troldesh defense_evasion discovery persistence ransomware trojan upx

Malware Config

Signatures

BadRabbit
Ransomware family discovered in late 2017, mainly targeting Russia and Ukraine.
ransomware badrabbit
Badrabbit family
badrabbit
Mimikatz
mimikatz is an open source tool to dump credentials on Windows.
mimikatz
Mimikatz family
mimikatz

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3449935180-2903586757-2462874082-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Program Files (x86)\\Windows\\Error file remover\\fatalerror.exe"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Program Files (x86)\\Windows\\Error file remover\\fatalerror.exe"	msiexec.exe

Troldesh family
troldesh
Troldesh, Shade, Encoder.858
Troldesh is a ransomware spread by malspam.
ransomware trojan troldesh

mimikatz is an open source tool to dump credentials on Windows 1 IoCs

resource	yara_rule
behavioral1/files/0x001900000002af6b-295.dat	mimikatz

Downloads MZ/PE file 6 IoCs

flow	pid	Process
24	2244	msedge.exe
24	2244	msedge.exe
24	2244	msedge.exe
24	2244	msedge.exe
24	2244	msedge.exe
24	2244	msedge.exe

Executes dropped EXE 11 IoCs

pid	Process
2716	BadRabbit.exe
2364	367C.tmp
648	BadRabbit.exe
4236	NoMoreRansom.exe
224	NoMoreRansom.exe
4212	WinlockerVB6Blacksod.exe
3204	WinlockerVB6Blacksod.exe
4632	AdwereCleaner.exe
4996	6AdwCleaner.exe
496	Fantom.exe
4604	WinlockerVB6Blacksod.exe

Loads dropped DLL 50 IoCs

pid	Process
1136	rundll32.exe
2552	rundll32.exe
4212	WinlockerVB6Blacksod.exe
4212	WinlockerVB6Blacksod.exe
4052	MsiExec.exe
4052	MsiExec.exe
4052	MsiExec.exe
4052	MsiExec.exe
4052	MsiExec.exe
4052	MsiExec.exe
4052	MsiExec.exe
4052	MsiExec.exe
4052	MsiExec.exe
4052	MsiExec.exe
4684	MsiExec.exe
4052	MsiExec.exe
4212	WinlockerVB6Blacksod.exe
4052	MsiExec.exe
3204	WinlockerVB6Blacksod.exe
3204	WinlockerVB6Blacksod.exe
2772	MsiExec.exe
2772	MsiExec.exe
2772	MsiExec.exe
2772	MsiExec.exe
2772	MsiExec.exe
2772	MsiExec.exe
2772	MsiExec.exe
2772	MsiExec.exe
2772	MsiExec.exe
2772	MsiExec.exe
2324	MsiExec.exe
2772	MsiExec.exe
3204	WinlockerVB6Blacksod.exe
2772	MsiExec.exe
4604	WinlockerVB6Blacksod.exe
4604	WinlockerVB6Blacksod.exe
3104	MsiExec.exe
3104	MsiExec.exe
3104	MsiExec.exe
3104	MsiExec.exe
3104	MsiExec.exe
3104	MsiExec.exe
3104	MsiExec.exe
3104	MsiExec.exe
3104	MsiExec.exe
3104	MsiExec.exe
1432	MsiExec.exe
3104	MsiExec.exe
4604	WinlockerVB6Blacksod.exe
3104	MsiExec.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3449935180-2903586757-2462874082-1000\Software\Microsoft\Windows\CurrentVersion\Run\Client Server Runtime Subsystem = "\"C:\\ProgramData\\Windows\\csrss.exe\""	NoMoreRansom.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3449935180-2903586757-2462874082-1000\Software\Microsoft\Windows\CurrentVersion\Run\AdwCleaner = "\"C:\\Users\\Admin\\AppData\\Local\\6AdwCleaner.exe\" -auto"	6AdwCleaner.exe

Blocklisted process makes network request 3 IoCs

flow	pid	Process
234	4052	MsiExec.exe
241	2772	MsiExec.exe
351	3104	MsiExec.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\K:	WinlockerVB6Blacksod.exe
File opened (read-only)	\??\H:	WinlockerVB6Blacksod.exe
File opened (read-only)	\??\L:	WinlockerVB6Blacksod.exe
File opened (read-only)	\??\T:	WinlockerVB6Blacksod.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	WinlockerVB6Blacksod.exe
File opened (read-only)	\??\T:	WinlockerVB6Blacksod.exe
File opened (read-only)	\??\B:	WinlockerVB6Blacksod.exe
File opened (read-only)	\??\E:	WinlockerVB6Blacksod.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\M:	WinlockerVB6Blacksod.exe
File opened (read-only)	\??\V:	WinlockerVB6Blacksod.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\E:	WinlockerVB6Blacksod.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	WinlockerVB6Blacksod.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\B:	WinlockerVB6Blacksod.exe
File opened (read-only)	\??\J:	WinlockerVB6Blacksod.exe
File opened (read-only)	\??\O:	WinlockerVB6Blacksod.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Y:	WinlockerVB6Blacksod.exe
File opened (read-only)	\??\L:	WinlockerVB6Blacksod.exe
File opened (read-only)	\??\Z:	WinlockerVB6Blacksod.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\L:	WinlockerVB6Blacksod.exe
File opened (read-only)	\??\V:	WinlockerVB6Blacksod.exe
File opened (read-only)	\??\X:	WinlockerVB6Blacksod.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\H:	WinlockerVB6Blacksod.exe
File opened (read-only)	\??\T:	WinlockerVB6Blacksod.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\M:	WinlockerVB6Blacksod.exe
File opened (read-only)	\??\P:	WinlockerVB6Blacksod.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\S:	WinlockerVB6Blacksod.exe
File opened (read-only)	\??\W:	WinlockerVB6Blacksod.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\N:	WinlockerVB6Blacksod.exe
File opened (read-only)	\??\N:	WinlockerVB6Blacksod.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\K:	WinlockerVB6Blacksod.exe
File opened (read-only)	\??\Z:	WinlockerVB6Blacksod.exe
File opened (read-only)	\??\A:	msiexec.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
13	raw.githubusercontent.com
1	raw.githubusercontent.com

UPX packed file 12 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/4236-861-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral1/memory/4236-871-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral1/memory/4236-872-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral1/memory/4236-874-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral1/memory/4236-900-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral1/memory/4236-928-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral1/memory/224-931-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral1/memory/224-936-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral1/memory/4236-939-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral1/memory/4236-949-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral1/memory/4236-950-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral1/memory/4236-980-0x0000000000400000-0x00000000005DE000-memory.dmp	upx

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Windows\Error file remover\fatalerror.exe	msiexec.exe
File created	C:\Program Files (x86)\Windows\Error file remover\Windows Logoff Sound.wav	msiexec.exe
File opened for modification	C:\Program Files (x86)\Windows\Error file remover\Windows Logoff Sound.wav	msiexec.exe
File opened for modification	C:\Program Files (x86)\Windows\Error file remover\fatalerror.exe	msiexec.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\Installer\SourceHash{C452D4E2-DE24-48B6-B5C3-ACB240A01606}	msiexec.exe
File created	C:\Windows\SystemTemp\~DF8130D75E7BDD9816.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI205E.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF15CBD3FCF56FCE32.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC7C6.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DFB0FDEF169074F253.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1D3A.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF7DFD96D4E8F48067.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC605.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF06D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF23E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI200F.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DFB34A89716C1564D6.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF7C5BE28BE702545E.TMP	msiexec.exe
File created	C:\Windows\Installer\e5af003.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2159.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC687.tmp	msiexec.exe
File created	C:\Windows\Installer\e5aefff.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5aefff.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC6E5.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC6F7.tmp	msiexec.exe
File opened for modification	C:\Windows\367C.tmp	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIF04D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1F90.tmp	msiexec.exe
File created	C:\Windows\Installer\e5af008.msi	msiexec.exe
File created	C:\Windows\infpub.dat	BadRabbit.exe
File opened for modification	C:\Windows\infpub.dat	rundll32.exe
File created	C:\Windows\cscc.dat	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIF0DC.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF0FE.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1DD8.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2225.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DFC041B3AC0412738C.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF1B0.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF1EF.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1FC0.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2330.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC656.tmp	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Tasks\sys.job	MsiExec.exe
File opened for modification	C:\Windows\Installer\MSI1CBC.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC708.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF14E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF14F.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC625.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC5F4.tmp	msiexec.exe
File created	C:\Windows\infpub.dat	BadRabbit.exe
File created	C:\Windows\SystemTemp\~DFD61FF1669F06CE3B.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1B62.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1E95.tmp	msiexec.exe
File opened for modification	C:\Windows\Tasks\sys.job	MsiExec.exe
File created	C:\Windows\dispci.exe	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIF0BC.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF15F.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e5af003.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1D89.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF1EE35296621A6BF1.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\e5af008.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF0ED.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF86238FA81AF13A66.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC655.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF69D79E5175FCB548.TMP	msiexec.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 6 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\BadRabbit.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Cerber5.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\NoMoreRansom.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\WinlockerVB6Blacksod.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\AdwereCleaner.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Fantom.exe:Zone.Identifier	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 26 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BadRabbit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NoMoreRansom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fantom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BadRabbit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WinlockerVB6Blacksod.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WinlockerVB6Blacksod.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AdwereCleaner.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NoMoreRansom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WinlockerVB6Blacksod.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe

NSIS installer 2 IoCs

installer

resource	yara_rule
behavioral1/files/0x001e00000002b057-1653.dat	nsis_installer_1
behavioral1/files/0x001e00000002b057-1653.dat	nsis_installer_2

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 7 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\26\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe

NTFS ADS 7 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\BadRabbit.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Cerber5.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\NoMoreRansom.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\WinlockerVB6Blacksod.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 427044.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\AdwereCleaner.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Fantom.exe:Zone.Identifier	msedge.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4932	schtasks.exe
4672	schtasks.exe

Suspicious behavior: EnumeratesProcesses 51 IoCs

pid	Process
2244	msedge.exe
2244	msedge.exe
3976	msedge.exe
3976	msedge.exe
1496	identity_helper.exe
1496	identity_helper.exe
1524	msedge.exe
1524	msedge.exe
1064	msedge.exe
1064	msedge.exe
1136	rundll32.exe
1136	rundll32.exe
1136	rundll32.exe
1136	rundll32.exe
2364	367C.tmp
2364	367C.tmp
2364	367C.tmp
2364	367C.tmp
2364	367C.tmp
2364	367C.tmp
2364	367C.tmp
2552	rundll32.exe
2552	rundll32.exe
4556	msedge.exe
4556	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
3120	msedge.exe
3120	msedge.exe
4236	NoMoreRansom.exe
4236	NoMoreRansom.exe
4236	NoMoreRansom.exe
4236	NoMoreRansom.exe
224	NoMoreRansom.exe
224	NoMoreRansom.exe
224	NoMoreRansom.exe
224	NoMoreRansom.exe
864	msedge.exe
864	msedge.exe
1276	msiexec.exe
1276	msiexec.exe
1276	msiexec.exe
1276	msiexec.exe
2076	msedge.exe
2076	msedge.exe
4572	msedge.exe
4572	msedge.exe
1276	msiexec.exe
1276	msiexec.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3976	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 32 IoCs

pid	Process
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1136	rundll32.exe
Token: SeDebugPrivilege	1136	rundll32.exe
Token: SeTcbPrivilege	1136	rundll32.exe
Token: SeDebugPrivilege	2364	367C.tmp
Token: 33	2728	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2728	AUDIODG.EXE
Token: SeShutdownPrivilege	2552	rundll32.exe
Token: SeDebugPrivilege	2552	rundll32.exe
Token: SeTcbPrivilege	2552	rundll32.exe
Token: SeSecurityPrivilege	1276	msiexec.exe
Token: SeCreateTokenPrivilege	4212	WinlockerVB6Blacksod.exe
Token: SeAssignPrimaryTokenPrivilege	4212	WinlockerVB6Blacksod.exe
Token: SeLockMemoryPrivilege	4212	WinlockerVB6Blacksod.exe
Token: SeIncreaseQuotaPrivilege	4212	WinlockerVB6Blacksod.exe
Token: SeMachineAccountPrivilege	4212	WinlockerVB6Blacksod.exe
Token: SeTcbPrivilege	4212	WinlockerVB6Blacksod.exe
Token: SeSecurityPrivilege	4212	WinlockerVB6Blacksod.exe
Token: SeTakeOwnershipPrivilege	4212	WinlockerVB6Blacksod.exe
Token: SeLoadDriverPrivilege	4212	WinlockerVB6Blacksod.exe
Token: SeSystemProfilePrivilege	4212	WinlockerVB6Blacksod.exe
Token: SeSystemtimePrivilege	4212	WinlockerVB6Blacksod.exe
Token: SeProfSingleProcessPrivilege	4212	WinlockerVB6Blacksod.exe
Token: SeIncBasePriorityPrivilege	4212	WinlockerVB6Blacksod.exe
Token: SeCreatePagefilePrivilege	4212	WinlockerVB6Blacksod.exe
Token: SeCreatePermanentPrivilege	4212	WinlockerVB6Blacksod.exe
Token: SeBackupPrivilege	4212	WinlockerVB6Blacksod.exe
Token: SeRestorePrivilege	4212	WinlockerVB6Blacksod.exe
Token: SeShutdownPrivilege	4212	WinlockerVB6Blacksod.exe
Token: SeDebugPrivilege	4212	WinlockerVB6Blacksod.exe
Token: SeAuditPrivilege	4212	WinlockerVB6Blacksod.exe
Token: SeSystemEnvironmentPrivilege	4212	WinlockerVB6Blacksod.exe
Token: SeChangeNotifyPrivilege	4212	WinlockerVB6Blacksod.exe
Token: SeRemoteShutdownPrivilege	4212	WinlockerVB6Blacksod.exe
Token: SeUndockPrivilege	4212	WinlockerVB6Blacksod.exe
Token: SeSyncAgentPrivilege	4212	WinlockerVB6Blacksod.exe
Token: SeEnableDelegationPrivilege	4212	WinlockerVB6Blacksod.exe
Token: SeManageVolumePrivilege	4212	WinlockerVB6Blacksod.exe
Token: SeImpersonatePrivilege	4212	WinlockerVB6Blacksod.exe
Token: SeCreateGlobalPrivilege	4212	WinlockerVB6Blacksod.exe
Token: SeShutdownPrivilege	4916	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4916	msiexec.exe
Token: SeCreateTokenPrivilege	4916	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4916	msiexec.exe
Token: SeLockMemoryPrivilege	4916	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4916	msiexec.exe
Token: SeMachineAccountPrivilege	4916	msiexec.exe
Token: SeTcbPrivilege	4916	msiexec.exe
Token: SeSecurityPrivilege	4916	msiexec.exe
Token: SeTakeOwnershipPrivilege	4916	msiexec.exe
Token: SeLoadDriverPrivilege	4916	msiexec.exe
Token: SeSystemProfilePrivilege	4916	msiexec.exe
Token: SeSystemtimePrivilege	4916	msiexec.exe
Token: SeProfSingleProcessPrivilege	4916	msiexec.exe
Token: SeIncBasePriorityPrivilege	4916	msiexec.exe
Token: SeCreatePagefilePrivilege	4916	msiexec.exe
Token: SeCreatePermanentPrivilege	4916	msiexec.exe
Token: SeBackupPrivilege	4916	msiexec.exe
Token: SeRestorePrivilege	4916	msiexec.exe
Token: SeShutdownPrivilege	4916	msiexec.exe
Token: SeDebugPrivilege	4916	msiexec.exe
Token: SeAuditPrivilege	4916	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4916	msiexec.exe
Token: SeChangeNotifyPrivilege	4916	msiexec.exe
Token: SeRemoteShutdownPrivilege	4916	msiexec.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe

Suspicious use of SendNotifyMessage 36 IoCs

pid	Process
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4996	6AdwCleaner.exe
4996	6AdwCleaner.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3976 wrote to memory of 2320	3976	msedge.exe	81
PID 3976 wrote to memory of 2320	3976	msedge.exe	81
PID 3976 wrote to memory of 620	3976	msedge.exe	82
PID 3976 wrote to memory of 620	3976	msedge.exe	82
PID 3976 wrote to memory of 620	3976	msedge.exe	82
PID 3976 wrote to memory of 620	3976	msedge.exe	82
PID 3976 wrote to memory of 620	3976	msedge.exe	82
PID 3976 wrote to memory of 620	3976	msedge.exe	82
PID 3976 wrote to memory of 620	3976	msedge.exe	82
PID 3976 wrote to memory of 620	3976	msedge.exe	82
PID 3976 wrote to memory of 620	3976	msedge.exe	82
PID 3976 wrote to memory of 620	3976	msedge.exe	82
PID 3976 wrote to memory of 620	3976	msedge.exe	82
PID 3976 wrote to memory of 620	3976	msedge.exe	82
PID 3976 wrote to memory of 620	3976	msedge.exe	82
PID 3976 wrote to memory of 620	3976	msedge.exe	82
PID 3976 wrote to memory of 620	3976	msedge.exe	82
PID 3976 wrote to memory of 620	3976	msedge.exe	82
PID 3976 wrote to memory of 620	3976	msedge.exe	82
PID 3976 wrote to memory of 620	3976	msedge.exe	82
PID 3976 wrote to memory of 620	3976	msedge.exe	82
PID 3976 wrote to memory of 620	3976	msedge.exe	82
PID 3976 wrote to memory of 620	3976	msedge.exe	82
PID 3976 wrote to memory of 620	3976	msedge.exe	82
PID 3976 wrote to memory of 620	3976	msedge.exe	82
PID 3976 wrote to memory of 620	3976	msedge.exe	82
PID 3976 wrote to memory of 620	3976	msedge.exe	82
PID 3976 wrote to memory of 620	3976	msedge.exe	82
PID 3976 wrote to memory of 620	3976	msedge.exe	82
PID 3976 wrote to memory of 620	3976	msedge.exe	82
PID 3976 wrote to memory of 620	3976	msedge.exe	82
PID 3976 wrote to memory of 620	3976	msedge.exe	82
PID 3976 wrote to memory of 620	3976	msedge.exe	82
PID 3976 wrote to memory of 620	3976	msedge.exe	82
PID 3976 wrote to memory of 620	3976	msedge.exe	82
PID 3976 wrote to memory of 620	3976	msedge.exe	82
PID 3976 wrote to memory of 620	3976	msedge.exe	82
PID 3976 wrote to memory of 620	3976	msedge.exe	82
PID 3976 wrote to memory of 620	3976	msedge.exe	82
PID 3976 wrote to memory of 620	3976	msedge.exe	82
PID 3976 wrote to memory of 620	3976	msedge.exe	82
PID 3976 wrote to memory of 620	3976	msedge.exe	82
PID 3976 wrote to memory of 2244	3976	msedge.exe	83
PID 3976 wrote to memory of 2244	3976	msedge.exe	83
PID 3976 wrote to memory of 1532	3976	msedge.exe	84
PID 3976 wrote to memory of 1532	3976	msedge.exe	84
PID 3976 wrote to memory of 1532	3976	msedge.exe	84
PID 3976 wrote to memory of 1532	3976	msedge.exe	84
PID 3976 wrote to memory of 1532	3976	msedge.exe	84
PID 3976 wrote to memory of 1532	3976	msedge.exe	84
PID 3976 wrote to memory of 1532	3976	msedge.exe	84
PID 3976 wrote to memory of 1532	3976	msedge.exe	84
PID 3976 wrote to memory of 1532	3976	msedge.exe	84
PID 3976 wrote to memory of 1532	3976	msedge.exe	84
PID 3976 wrote to memory of 1532	3976	msedge.exe	84
PID 3976 wrote to memory of 1532	3976	msedge.exe	84
PID 3976 wrote to memory of 1532	3976	msedge.exe	84
PID 3976 wrote to memory of 1532	3976	msedge.exe	84
PID 3976 wrote to memory of 1532	3976	msedge.exe	84
PID 3976 wrote to memory of 1532	3976	msedge.exe	84
PID 3976 wrote to memory of 1532	3976	msedge.exe	84
PID 3976 wrote to memory of 1532	3976	msedge.exe	84
PID 3976 wrote to memory of 1532	3976	msedge.exe	84
PID 3976 wrote to memory of 1532	3976	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://github.com/Da2dalus/The-MALWARE-Repo
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff9ba673cb8,0x7ff9ba673cc8,0x7ff9ba673cd8
  2⤵
  PID:2320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1920,18321229158600192249,5183816334615520137,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1948 /prefetch:2
  2⤵
  PID:620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1920,18321229158600192249,5183816334615520137,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2380 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - Suspicious behavior: EnumeratesProcesses
  PID:2244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1920,18321229158600192249,5183816334615520137,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2812 /prefetch:8
  2⤵
  PID:1532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,18321229158600192249,5183816334615520137,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:2820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,18321229158600192249,5183816334615520137,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:2892
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1920,18321229158600192249,5183816334615520137,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5668 /prefetch:8
  2⤵
  PID:4092
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1920,18321229158600192249,5183816334615520137,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5668 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,18321229158600192249,5183816334615520137,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5280 /prefetch:1
  2⤵
  PID:3740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,18321229158600192249,5183816334615520137,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5308 /prefetch:1
  2⤵
  PID:3240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1920,18321229158600192249,5183816334615520137,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4700 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,18321229158600192249,5183816334615520137,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5656 /prefetch:1
  2⤵
  PID:1140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,18321229158600192249,5183816334615520137,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5832 /prefetch:1
  2⤵
  PID:2152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,18321229158600192249,5183816334615520137,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6036 /prefetch:1
  2⤵
  PID:3676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,18321229158600192249,5183816334615520137,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5992 /prefetch:1
  2⤵
  PID:4016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1920,18321229158600192249,5183816334615520137,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3836 /prefetch:8
  2⤵
  PID:1652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1920,18321229158600192249,5183816334615520137,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4904 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:1064
- C:\Users\Admin\Downloads\BadRabbit.exe
  "C:\Users\Admin\Downloads\BadRabbit.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  PID:2716
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\system32\rundll32.exe C:\Windows\infpub.dat,#1 15
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1136
  - - C:\Windows\SysWOW64\cmd.exe
      /c schtasks /Delete /F /TN rhaegal
      4⤵
      System Location Discovery: System Language Discovery
      PID:4260
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Delete /F /TN rhaegal
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2820
  - - C:\Windows\SysWOW64\cmd.exe
      /c schtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR "C:\Windows\system32\cmd.exe /C Start \"\" \"C:\Windows\dispci.exe\" -id 54854942 && exit"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2472
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR "C:\Windows\system32\cmd.exe /C Start \"\" \"C:\Windows\dispci.exe\" -id 54854942 && exit"
        5⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:4932
  - - C:\Windows\SysWOW64\cmd.exe
      /c schtasks /Create /SC once /TN drogon /RU SYSTEM /TR "C:\Windows\system32\shutdown.exe /r /t 0 /f" /ST 05:32:00
      4⤵
      System Location Discovery: System Language Discovery
      PID:5052
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Create /SC once /TN drogon /RU SYSTEM /TR "C:\Windows\system32\shutdown.exe /r /t 0 /f" /ST 05:32:00
        5⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:4672
  - - C:\Windows\367C.tmp
      "C:\Windows\367C.tmp" \\.\pipe\{E3A224ED-8BAE-4B4C-8D89-004B9B4977A2}
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,18321229158600192249,5183816334615520137,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4960 /prefetch:1
  2⤵
  PID:2512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,18321229158600192249,5183816334615520137,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4700 /prefetch:1
  2⤵
  PID:708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,18321229158600192249,5183816334615520137,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6672 /prefetch:1
  2⤵
  PID:332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,18321229158600192249,5183816334615520137,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6020 /prefetch:1
  2⤵
  PID:1580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,18321229158600192249,5183816334615520137,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6948 /prefetch:1
  2⤵
  PID:660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,18321229158600192249,5183816334615520137,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6972 /prefetch:1
  2⤵
  PID:3100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,18321229158600192249,5183816334615520137,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5276 /prefetch:1
  2⤵
  PID:2256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,18321229158600192249,5183816334615520137,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5748 /prefetch:1
  2⤵
  PID:4680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1920,18321229158600192249,5183816334615520137,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=7264 /prefetch:8
  2⤵
  PID:2936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,18321229158600192249,5183816334615520137,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6340 /prefetch:1
  2⤵
  PID:1144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,18321229158600192249,5183816334615520137,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7600 /prefetch:1
  2⤵
  PID:1848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1920,18321229158600192249,5183816334615520137,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7000 /prefetch:8
  2⤵
  PID:1464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,18321229158600192249,5183816334615520137,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6340 /prefetch:1
  2⤵
  PID:4192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,18321229158600192249,5183816334615520137,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7916 /prefetch:1
  2⤵
  PID:648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1920,18321229158600192249,5183816334615520137,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7896 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:4556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,18321229158600192249,5183816334615520137,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6976 /prefetch:1
  2⤵
  PID:4248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,18321229158600192249,5183816334615520137,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2592 /prefetch:1
  2⤵
  PID:2576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,18321229158600192249,5183816334615520137,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7856 /prefetch:1
  2⤵
  PID:3364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,18321229158600192249,5183816334615520137,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7328 /prefetch:1
  2⤵
  PID:2588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1920,18321229158600192249,5183816334615520137,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=6364 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,18321229158600192249,5183816334615520137,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7552 /prefetch:1
  2⤵
  PID:2368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,18321229158600192249,5183816334615520137,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6520 /prefetch:1
  2⤵
  PID:2408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1920,18321229158600192249,5183816334615520137,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6156 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:3120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1920,18321229158600192249,5183816334615520137,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5976 /prefetch:8
  2⤵
  PID:3836
- C:\Users\Admin\Downloads\NoMoreRansom.exe
  "C:\Users\Admin\Downloads\NoMoreRansom.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,18321229158600192249,5183816334615520137,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6476 /prefetch:1
  2⤵
  PID:4464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,18321229158600192249,5183816334615520137,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5960 /prefetch:1
  2⤵
  PID:5104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1920,18321229158600192249,5183816334615520137,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6112 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1920,18321229158600192249,5183816334615520137,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6376 /prefetch:8
  2⤵
  PID:4644
- C:\Users\Admin\Downloads\WinlockerVB6Blacksod.exe
  "C:\Users\Admin\Downloads\WinlockerVB6Blacksod.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:4212
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\Windows\Error file remover 1.0.0.0\install\0A01606\Error file remover.msi" AI_SETUPEXEPATH=C:\Users\Admin\Downloads\WinlockerVB6Blacksod.exe SETUPEXEDIR=C:\Users\Admin\Downloads\ EXE_CMD_LINE="/exenoupdates /exelang 0 /noprereqs "
    3⤵
    - Enumerates connected drives
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,18321229158600192249,5183816334615520137,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1732 /prefetch:1
  2⤵
  PID:4132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,18321229158600192249,5183816334615520137,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7572 /prefetch:1
  2⤵
  PID:2440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1920,18321229158600192249,5183816334615520137,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7852 /prefetch:8
  2⤵
  PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1920,18321229158600192249,5183816334615520137,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6660 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:2076
- C:\Users\Admin\Downloads\AdwereCleaner.exe
  "C:\Users\Admin\Downloads\AdwereCleaner.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4632
- - C:\Users\Admin\AppData\Local\6AdwCleaner.exe
    "C:\Users\Admin\AppData\Local\6AdwCleaner.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of SetWindowsHookEx
    PID:4996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,18321229158600192249,5183816334615520137,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7552 /prefetch:1
  2⤵
  PID:3248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,18321229158600192249,5183816334615520137,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6832 /prefetch:1
  2⤵
  PID:3364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1920,18321229158600192249,5183816334615520137,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7936 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:4572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1920,18321229158600192249,5183816334615520137,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7572 /prefetch:8
  2⤵
  PID:952
- C:\Users\Admin\Downloads\Fantom.exe
  "C:\Users\Admin\Downloads\Fantom.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:496
- C:\Users\Admin\Downloads\WinlockerVB6Blacksod.exe
  "C:\Users\Admin\Downloads\WinlockerVB6Blacksod.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  PID:4604
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\Windows\Error file remover 1.0.0.0\install\0A01606\Error file remover.msi" AI_SETUPEXEPATH=C:\Users\Admin\Downloads\WinlockerVB6Blacksod.exe SETUPEXEDIR=C:\Users\Admin\Downloads\ EXE_CMD_LINE="/exenoupdates /exelang 0 /noprereqs "
    3⤵
    - Enumerates connected drives
    - System Location Discovery: System Language Discovery
    PID:4592

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2200

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3728

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4192

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4916

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x000000000000048C 0x0000000000000484
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2728

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:3988

C:\Users\Admin\Downloads\BadRabbit.exe
"C:\Users\Admin\Downloads\BadRabbit.exe"
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:648
- C:\Windows\SysWOW64\rundll32.exe
  C:\Windows\system32\rundll32.exe C:\Windows\infpub.dat,#1 15
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2552

C:\Users\Admin\Desktop\NoMoreRansom.exe
"C:\Users\Admin\Desktop\NoMoreRansom.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:224

C:\Windows\System32\DataExchangeHost.exe
C:\Windows\System32\DataExchangeHost.exe -Embedding
1⤵
PID:736

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Modifies WinLogon for persistence
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1276
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding D4FB83EC7909D01C0123134B27B39075
  2⤵
  - Loads dropped DLL
  - Blocklisted process makes network request
  - System Location Discovery: System Language Discovery
  PID:4052
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 075BF98BC87FC76C6246384C0659BABF E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  PID:4684
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 3B74480BF2CB0D024C87475FC1E4EAB8
  2⤵
  - Loads dropped DLL
  - Blocklisted process makes network request
  - System Location Discovery: System Language Discovery
  PID:2772
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding C32946868EB897E749DBB39B8320D981 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  PID:2324
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 5E3A453B249D532B3B50E260C276B4EF
  2⤵
  - Loads dropped DLL
  - Blocklisted process makes network request
  - System Location Discovery: System Language Discovery
  PID:3104
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 2C2D6CB268A6FC112D48DB05A16B38E2 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1432

C:\Users\Admin\Downloads\WinlockerVB6Blacksod.exe
"C:\Users\Admin\Downloads\WinlockerVB6Blacksod.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- System Location Discovery: System Language Discovery
PID:3204
- C:\Windows\SysWOW64\msiexec.exe
  "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\Windows\Error file remover 1.0.0.0\install\0A01606\Error file remover.msi" AI_SETUPEXEPATH=C:\Users\Admin\Downloads\WinlockerVB6Blacksod.exe SETUPEXEDIR=C:\Users\Admin\Downloads\ EXE_CMD_LINE="/exenoupdates /exelang 0 /noprereqs "
  2⤵
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  PID:3492

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e5af002.rbs

Filesize
99KB

MD5
a4254440910167817e900e64e0e48d9b

SHA1
900051bd78c03ae72ca315d16d22a3ef3eb3ee0f

SHA256
840b06d58e6ce6e9b53da62d11cdcdf063b6c1c48403733e6fc328e31228f66e

SHA512
7db62f54675aefe0407bfbff6883f8cd87ba86082970c8893949aa67ba7af3ab383453d505507ca2c7b86875e2d0ddebd2de3dd3b99e20e25a4f6c2934e20c5d

Download Submit
C:\Config.Msi\e5af006.rbs

Filesize
101KB

MD5
6bd0814db06be938f8ed5ad20595d254

SHA1
3f55691b88b253a4cd7dd036080f31faf8c5264b

SHA256
2622adfe6ff49f2d44ea3f124fce853a4e7e8a6db05dec4a4c09ddc9397a98ec

SHA512
c7fe3f05948e2d6e985501b7e168d342b630ac93f1226b80cedfba457be2d7446a07b8eb53025d16224a190cf0640d1a2896a20b1ef9dc844c7e742aea0ec21c

Download Submit
C:\Config.Msi\e5af00b.rbs

Filesize
101KB

MD5
f0ffe59fcafa89363c0dde51d7f5736f

SHA1
b2bb3e2b88d6b165e241b60c28e86a6a0def2053

SHA256
d0bc70baba2c75ebfcb74bf81a7ff9e63905d61593f117ad0e3ce30b53cff2f5

SHA512
dd312a63ddda36e0762df66c18f7b200fd4476cdacb78db3e881c2d4bf8f666cc066632a07746e3f9257193bb651e0ef941578c8b4e41a830ba763f109202844

Download Submit
C:\Program Files (x86)\Windows\Error file remover\Windows Logoff Sound.wav

Filesize
724KB

MD5
bab1293f4cf987216af8051acddaf97f

SHA1
00abe5cfb050b4276c3dd2426e883cd9e1cde683

SHA256
bc26b1b97eeb45995bbd5f854db19f994cce1bb9ac9fb625eb207302dccdf344

SHA512
3b44371756f069be4f70113a09761a855d80e96c23c8cd76d0c19a43e93d1a159af079ba5189b88b5ee2c093099a02b00ea4dc20a498c9c0c2df7dc95e5ddd49

Download Submit
C:\Program Files (x86)\Windows\Error file remover\fatalerror.exe

Filesize
24KB

MD5
e579c5b3c386262e3dd4150eb2b13898

SHA1
5ab7b37956511ea618bf8552abc88f8e652827d3

SHA256
e9573a3041e5a45ed8133576d199eb8d12f8922bbe47d194fef9ac166a96b9e2

SHA512
9cf947bad87a701f0e0ad970681767e64b7588089cd9064c72bf24ba6ca0a922988f95b141b29a68ae0e0097f03a66d9b25b9d52197ff71f6e369cde0438e0bb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CDE89F9DCB25D8AC547E3CEFDA4FB6C2_EFB75332C2EEE29C462FC21A350076B8

Filesize
5B

MD5
5bfa51f3a417b98e7443eca90fc94703

SHA1
8c015d80b8a23f780bdd215dc842b0f5551f63bd

SHA256
bebe2853a3485d1c2e5c5be4249183e0ddaff9f87de71652371700a89d937128

SHA512
4cd03686254bb28754cbaa635ae1264723e2be80ce1dd0f78d1ab7aee72232f5b285f79e488e9c5c49ff343015bd07bb8433d6cee08ae3cea8c317303e3ac399

Download Submit
C:\Users\Admin\AppData\Local\6AdwCleaner.exe

Filesize
168KB

MD5
87e4959fefec297ebbf42de79b5c88f6

SHA1
eba50d6b266b527025cd624003799bdda9a6bc86

SHA256
4f0033e811fe2497b38f0d45df958829d01933ebe7d331079eefc8e38fbeaa61

SHA512
232fedec0180e85560a226870a244a22f54ca130ed6d6dc95dc02a1ff85f17da396925c9ff27d522067a30ee3e74a38adff375d8752161ee629df14f39cf6ba9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\9bd8bf0d-b077-4593-a5f5-0979efa86b21.tmp

Filesize
11KB

MD5
f1492126b11e8dc32302fad4a7d96d6e

SHA1
8d4070bcc2f0a6bbc3749f42449648c9069b0240

SHA256
ce0c826f256c4fdf25ef496ba5527fed18862b0daf04f816c0c3ff01bcd5035a

SHA512
7918eba309a7668162140f41dfa934cd79c1a3a4ab30cd5a5e90058f4991f31a040070fb874d86f0cdd942f61002b98ac9b840db407540dd8bb710445edb8200

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
25d7facb86265ce3e89835dd7b566491

SHA1
4db1197fadadd7742986efdc2ca76f89cef96942

SHA256
3d225a00da389fde7674a7eeb98e8572be2879252290ac00faa3a80ea671073f

SHA512
cbfc02ffc441edc20c72b35d20b15178a2173e2a1c54e3736f7ba6d058e1ac7a5c1b15798bf5b91ed3a8197430f0fe84aa3d75a8aba61b4f4dd85c1b3fe68bbb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1ab6627d6da0724908361604b2b351b7

SHA1
d6e7960616dd38cd05633face9bb0bdd061e3211

SHA256
88a373cea6d7ad2daaee9168a0519f8a23ab9ec9cbceab97df4c8d39fe1544d0

SHA512
59903d7dd6da68cb4378eceb6e356d5861514b8365da747da4cd05615ec7c7a51c810cbac6a7a00256db1aeedad80ef71b6ff06bae61e1884e620cc4a45a2d33

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000017

Filesize
62KB

MD5
c813a1b87f1651d642cdcad5fca7a7d8

SHA1
0e6628997674a7dfbeb321b59a6e829d0c2f4478

SHA256
df670e09f278fea1d0684afdcd0392a83d7041585ba5996f7b527974d7d98ec3

SHA512
af0d024ba1faafbd6f950c67977ed126827180a47cea9758ee51a95d13436f753eb5a7aa12a9090048a70328f6e779634c612aebde89b06740ffd770751e1c5b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000018

Filesize
67KB

MD5
73c52c814a005a48e77c6b95037bf608

SHA1
678bb8f0b67d4cfd3eb394f2aeb449269e02941b

SHA256
a1cecf47e5894ee9eb6b90503b2502706cc9f7c2b5e0d60ad11938839c0a090f

SHA512
681f08bf143cf15cc7c3ce6ab8f2e336bbfacc14ffe3a194c7ebdfca0dcc06c4ccc349497a95274f860f0673fd9e00f7d131edb5612c05d35ae38dffb96ec37d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
99e47da7cd9e945e1cc00ccfd4407fad

SHA1
1fc62c090cb3e94c584d4aedc65d3e8585f09279

SHA256
fd98d5aeb0d9f325ef8802bc5288e60c2c77dc8107a01f9319e3c29646a79315

SHA512
8a025feb239fff25f200c7a05725a4aea2f58df03858cccf05b3dfb7caf7b56aca99d8fe4e8f141f2a0a3f303e775320d7d8d13c429c970a04e77fe521a0a7e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
5af34c7e576cf6c89a30b5f3b900785b

SHA1
7ccc54baa02d85aac913292bfd4a31e53d6e2e6c

SHA256
fb7df2c03e87bec445d43fca7c2c9e59f53ef275dccdc92e4d89958debaedda4

SHA512
d0c8263204ba6999225511f9631054bc58fd61f3b444998ccd33fed4021e015bd93fb13a6f3badf8c7e47d0992971bd20525c4303361d52fbb533291133665d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
8af08cb83f0e62cabeb428934857050e

SHA1
d1f2b6a61806a8267add1d0182518c945f7b8bb0

SHA256
b5aaf53275c57bbf057accfcbb95ec94f2bab88eee992b920a4f6e1fe851e7e5

SHA512
d4ecfe31825a89a7948c7cc63a066232f9009c19a1c17338b2f0d3073671f25f69cc5291058db26ae24aac6452a0d1c00e8518375fad188b39ddfd6d78878c9c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
d354b32e96a0a6b70e508141b8a13888

SHA1
501c00a035f67861460afa8f7b1c5b7e99b3597b

SHA256
3f896b2732434d34023af625cacbf594609415481bedbf0f2c44fb9f9a9529fd

SHA512
73f60570e4f136e98c2f4df546e821918bb52c50c5ad004da1c0b6a9b9ceceb72525d790a3821b4a8b7194f397cc07814b37d512e9f8ec4825e3ca6891d49b4e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
30a8af1064300aa4e835d53e3ccaa347

SHA1
2d7a30a8bcf270513b08de05a72773acf29631c3

SHA256
d04f5e1904e0f242297795c407ee4ef243fbaaa5bfaea1a04d415f0e918730f4

SHA512
5e1237e94815664b67d22a13cb70d06bec678735487a080fcaab1811f9055631e91e943d0e5efd093b9bc3823a8286f0975fb91f353b11a23b057dd4af4fcb04

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
539a33fe515eaa8d557eb47682855a39

SHA1
01892d9c79d674c43eeb987008025dbcb8864201

SHA256
a0b7f43bdcc0923d1df6498a30f6b1cc69bf4d775dad735789e8bddda9c0b563

SHA512
0861d894c242573b4844f4c2696bbcf33a66b26044bf68bac48d4187a70c1af94a4a216f209f80bd80243ce75616db0ab9002342ee3e3b4909ac239e37a7aac1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
dffaa4ad6824f8788460184b788c237e

SHA1
ffb8d53a509ef365395d95df44d7e97cf29aabc5

SHA256
13f593e2c27f9af277515d0edcbf9e78478b306365ea77b766997983800f4d9b

SHA512
2172b2e85049fd358d009da0236017548df17b819ebf20659bfe1b657bc285bfbebbe9b1f724cbb51b0e6ab1386f5fb64a5b9afd5ac0e2a42e03eef28c44d0fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
64a41549a95ab3d28def9d1dd7239dc4

SHA1
548c9a3ac53ce31b2fb9220d5803e2a9f1c7c9bd

SHA256
831c56dbb0a70187ac950ad5aedd7605ff6450ab27869071180a2ba7142a5def

SHA512
d3bc96840a5ca1c835f3554e2b37e4ddaa1eedbdc146243b1f61a359e446976433010042996c11666265c7ffda7fa143a3d5ef190fce24b5796813bbcd717d01

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
03d4e8a33b5c2c93b82d6de4b648f20b

SHA1
b713f2723a675d2fbed95b22092910107a3f8e20

SHA256
693af40b5acdca8910217f039e99b2f412ea8eb1a3167f779b9becc5c21502cd

SHA512
927f5a4c200cda34ac4fcdc95ed4f1b38acc0700412500aa31d8003da073ab133485e3a386110b32b7c83f8935586cbc54b12f54aabce511d32f4b9dec2a2312

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d2f23005e2cf7cf12eae90a397accf8b

SHA1
5365ed2f9f3d54c7aff68e186d75a6be386b0b6a

SHA256
13ede77b133b7a9904955821b8674e4c0308590f2c59e81896d6e68c0b4a9c03

SHA512
471387085c232a3ae54bdd4c3b2db2d2a53ecc212394e75926a2842a85d7b4d76c7e2fe3b6002bfd74d0f03a2970d8ea38212b9882239e6123d03dfd1bb11a6f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
2a31214f4d4be3876f65f51b936d9cd8

SHA1
5708660709d79651573cc930dedf243c6efc4cc6

SHA256
38e3bb89fe37a2c8b8f3f6a3d814d6c86eabecdb5d46b0ac12048104f2f333ec

SHA512
7291cec0a060c26c2b1b0b4d4b9ddd2e8555a999bd849098e82e8efcd45f5f9788b290282653a44f25360ac08f7a633c6e6157f0f9cc6e00cad6bd083f0b82dc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
78a3782d265b17355cbc6f6866acdf55

SHA1
be401a1f57eee7a77aaf52d4f51abda9fade1495

SHA256
0d41d3c5efd2dbcdb42e22483580931733f2a79d11ef652002deeba574c508d1

SHA512
26deb2f3ff9d020f13ac03dc553cb50b3fb110427f3dade914c6f128602f5cfb94ce209877cdadb4a0de81e453c64b1e5234893b04e686694451f3373beca571

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
35cd647f4b15d4692e59852a3832788a

SHA1
918dc425ae8684707aaa1fdb6d031f659e144813

SHA256
e3f6d9e43018f8161694d858346844be315e0b0c91e0787f26e69c1d6fd28908

SHA512
3b580fe058dc1a6ae3a4933e6b2bb66e7b02cc8ac5e7035f6b8d9494fb96211a2c7537493f316403cddaa1ffe167e7a09f47c3d863e32bed956fc009bbf6f251

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
e33f61a4b4268bcca8d55faad563e07c

SHA1
b7771b58b22ca58cfafb408b334e5cc46ff7a0eb

SHA256
5ad3cccdd5036e379888da00ea819017a4bfcc0ee536aa36b6b323769056ae4a

SHA512
c30f957fbeaacd35bdb6525d5a997dc3f8707bf7c23d82cefb3c1a6b842f43f13d98ebbc34cff351780c0b09c76b6d45f2365e9b0e2eafd96e5eaa3bb3321fe6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c664496e98cf8296fad404e14c4fcdb1

SHA1
99b7db5cd083461cdf9a2f5aba49199ddb27900a

SHA256
3946be2f561b1ff86aa70bddab4d6f8a2ab1ed15cd665464bacdb6ffaf469281

SHA512
cc9a97d74e7e51713d44c3d134ecab237b99189162c11aecbdb1a931f856b320827b03c518abdc79dc25c97e215e155a009eede8f829624b9c902641085d5263

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
06d76922cde5fc1e6f5c18b72031ae9b

SHA1
ec31948b23bc2eab96047718884af5e7bd9a1e5e

SHA256
08feafb504901525088b3ad3075d607ea16ea317ed51dbe494aadf4d6c1ce5b5

SHA512
7c6dc5106994105953a512119b9698925301fad4914cfc30418fd1cdc02572b63e7ea98616733f501e98950076fe3882748814701f897157e89408005ff79348

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
6e1f2e1860a4b325f48e90ec0966f746

SHA1
757d9de213e52c9a26399c6919ce31417314f50d

SHA256
e706db38635e1bd1b104bfb1f2f5560e8ee9125fe48d9ea8907cf0828d78ef4f

SHA512
5e638da27979cc1401ed6de5fcb29868aa206cf031d985196810456a26e017f4207a79c313c9cfcaaa400b9dc7655e0815befbf9886c64196a8afa31120847b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
f8e2527c1db3a1f908de38624a687edb

SHA1
05957fca8be76411791d5cb5b2654b4fb916f5db

SHA256
28f30f628b99c354d88cfff7bd3ff84e298de12482a42a39d0c20257ce98b3ff

SHA512
8ad17843ebd0ceda04e9e27b955702a818f7f823fb14f4704ddeb349b4c96d8529422c1469e63abd9771bc99c3fe38225caec2c46a44e786f12d783920cc2409

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
a14f3f7285c304ae14d307aa53cc873a

SHA1
337d12aa52001fdff4b4d37081783317771084ad

SHA256
5c68eac53130073d9cfa89da06430dee66b449af4cf94b0c78539133df73f3f2

SHA512
e8792609295e781f407fa97723b5d8bc7ee3f4f3a370c12ab40f786c319caf5742b1b5d986c93674d2f14d14ddc51ce6b4162c53cf3a3f0fe858bb07d3c9786f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
a2801cb9979d06c0ba2c1161858aac09

SHA1
b89cc490eb903b25c9494c23071e44f5e69f4f57

SHA256
0a19f114a2593175c6989e55e267de08c7bce202b54a0f9399047962f39f7a8b

SHA512
f2c5295c159d1c861e942f2e4ad186ac3109c01c9b501c3df147dc171b2a6011ec5f53f2ce5d2d1394b8b24e3dc6fecd5239a1e4d4c3840dc425955a7a7a1956

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
75d387e14228c49dafb92ca5110f38dc

SHA1
e9c13a68bdfbf0e67c115ab68d6eff120ebdd025

SHA256
e6fd786dd1b86f3e9f8ef1fca96df1fa4e98192db59185249e7bb634faf00da0

SHA512
4443bcdbe95c471667029f86f1eb4732bc59ed0c0191d904aaf2afc3244035d9d33269e5c37e8a7bd1568905b566268170c6379949b7b1c5e087c453eeff7b7b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
1bd8f9cba97b5c6c54f1390aad1d9739

SHA1
0cf39132751308701df7602e9575af78dc848f53

SHA256
a6159213fe98bbfc8e695398df9ca8440e4bc9ac51a783c827b9dcdca13c13ff

SHA512
91a14522d9d949ecdccd9c1775f47fdda051a38d4083944ce3da6025dc7650bcd8afd40000a330b9a15d4c77c922260b0ece00a14ee4d719700ab45eca78421d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
387b5f4e4e166af15e57c2202cb09971

SHA1
1967e93cf57461c0767557b39b5ab1bf9402f8e1

SHA256
c2d25745359728acb8161cd1fcf3c33509b39e770e1e2e4993fef25da5e79a68

SHA512
f65bf5e1052c8df2c36b15db54bc50666d7008119ae4190ea8164094ac3eee3730babe264fe59d6f59368caf9dd02e7c2b7bc218a5e024afac9eaa2fcfe90d65

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
9bc08f366e6acd1f35f088481da3d481

SHA1
82940be3300b74f2881e970d2434ac3f2193fb18

SHA256
44cbb8f414e67b2116a5a5d25cd2fc77254a90545741bb437fb1aa396dd2c94e

SHA512
1901ea64d2167461b63455ac3862d76a46ab0120a87e4baab2cdc0f7cf6b1e55494657d64e3acbb45f5da1d0c0fe421f919198ce3717767571f2e51eeae80feb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
4f8178a2fe12a85b0b61ed6571d4d732

SHA1
f9f0d650920c119454fd9613a1555f0706f3c883

SHA256
588ea81d136fe869161a35e347b3a91ff517869b634d9666304342a7ff22092a

SHA512
cddfffd97ea1042c97df646327365dc0f0133fe624add3a59092e845afffef9e5f2222511c23ce086bba39f4274a720de6c2c64667f65cb75a8b8b4868dc10c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
75bb830bc7dfea2f6182a3695453e3f9

SHA1
dd1ebca4d92714c9aebb71eb276dc8e797157b3a

SHA256
49d1203d367fb37e0f92ac879b7476e3725336c0e61486a4c469a08d867e25b0

SHA512
66cb4a7dd7422657f7e5a2cc503dad4e903dc126a921808b0db3e1e7830c199c5448c34b15400db1baabca8c61ffec2b50ddfcc33d138293370de4cef4b02d76

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
83bc8e356cbb490f641bab389adba856

SHA1
f2cd8145cea0d0d8c4c905ee393795940d770cb0

SHA256
54c8f8cd84b72079bdfd09bc269b0ee63ff9f7242605272e9ba758bf169d656f

SHA512
6f071d3460c007ad292fe54b1fd3ce086a8c1cdb27db0e675137514a3df564f100795c92e1ca3bbfff6259c6091f5cca3fd1fd4a177443e5bfafa60f16e5fd0f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
66e420093313146fd5ca38fc041226f0

SHA1
992fc2102732a2307a1d96c8d194b8c1cdbf2d9f

SHA256
47797a2daba8840c32076e28cced14ca855caadf5c6c3d208bf6c0b9ba180f81

SHA512
50216bef3a65ab5dad78b8aec76481862ba997422237e39e7785e9ee565ab6c1da9fd0e24e7fbe33fdfccebc9d6281b0dcbb918f5fb5075bf9be256f0f0ba6f9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
30314db9bee3899076e7a0a971754889

SHA1
10f4a0f83b95a6c30a031a1765cc3d3de17f5ee1

SHA256
87499f5e3357ee8c489f7a44bbcb23847dee81d7de79bee8808b6a4c3d4bddce

SHA512
3fe9de0aa73e638082c34260dc917bdebdeb66d545295e9e9ad49b0c35bd77ebf0167a551003c0fbe9c762fa49c1ff92e3c14ba2f94aca7c4b17153e9759a1c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
431f1c617e5f03d605e42306407ee795

SHA1
50c40c416266d1826bd84fe710e3b30fb7f90484

SHA256
4c9c7ccfd7d928a3583c990ade39ba7a01fbed502f8470057cb412fe6f61f8f8

SHA512
c575b102171eadd950d5f7d0505899a5bafc912c32a0c2ce30521f823e189738057708d03757a6e587ee936e0271ac7657580e9e724dc3569869448fecefe3fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
d5420f30b51cb4a652d2fd9646383e4b

SHA1
c0edbc6fc0b75267584ce7609cefcae167969b06

SHA256
bd25ab50aadd1f94dff137ac8a686c17ba7f1eb8813db1f4fe21e07e13242391

SHA512
e2747ab4622d7426fabb8b2890d061558e7d48832182da95cd53c136fc6201ef36219c8c24bcd135df5902039139c5fc3c830b9ed490dc59b24118e023694b6d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
7730c0f538e8fcd2ce5a9de1cb228406

SHA1
2464104df9998867251de26a6cbab066308cbc74

SHA256
c62b8f9e322b9fe71703f15b07712407b0324efca06d2d3844974ca8aedba481

SHA512
a1f65d23e101930f73c145b2e0f42410a170818f8e606f9486ffa9a7db9b24cdd88f5e8e885249b212844673644fe42d3a93f7c610fed80fff9c234fe1a4f28e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
5ef1ee35aec3fd2b8e086d26fd4b46f1

SHA1
085f18dcec90ad38b01b6639cbd0526e3c823add

SHA256
f41c788f6d2cc9fc0be8c5cc20d156b4dd970d8a9490419b94036f96bbeb2299

SHA512
79ea2bda27bd47c569c2d5c8043006214871f1b7927960a5fa49c310d50268fef484ba0cb522ef8ca40c25012e9b779ab4e761de0d8c730764aea705cf654633

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
4a7c47eb9e37e3eff2a4fd499fc85eba

SHA1
692dffaf419956c1eb7ea110580797a2909358ed

SHA256
279ea9e0569746a68ebb1fde85e2dbc54e32b07ccc1c3235093fc9f92502fd1c

SHA512
2398300513d9c6f6cc2e5f7e1b27affc7fc39b1216526036a07aae64a16a0e211d7d0073fc8394a5ed4eee9b89da52b65194f2c25e1b4f0f3a960ac8a7b413a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5810b4.TMP

Filesize
874B

MD5
b1a33fa9858e640a151cc6daf3c4eec4

SHA1
91f2f39ab45a9bd8123b81a78a09781dee55735f

SHA256
b2ceff02bd9a9caef4c23a5c9cc8fd6a3cb2da064ec36385e89879d2afba9a5e

SHA512
b5dce08139206bc2bd8ad2c4ca1ce99bcef4c1a4324821d27abda814a5102554e2a5ecc7a14e4417bd08cf27fe52891790327bbd5e2578267b191b06301d6dca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
89e1b5af90561202d6c85b7f680e405c

SHA1
5e8208799df8ca3891b5d6c863331f21c3480bde

SHA256
513f57e9c2b28ff0412b31fb9a9a80e2a031aadbbda1c298ce88f9af5b1f07ce

SHA512
569dff77e0281420b5d049fa4e75fb5c3f5010469cf9cf2c006e1c0c93b992ea869cc8126354e901e5f657c69a3aca54c9bf9c1462133f14ae68617fb386616d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
1ecdd917c21249ef7b244cc653001dbc

SHA1
86221dcda75ddada7537ec6a6aecd3ad73cb3515

SHA256
dee8255844cd0b237db3c94a2042a91473cc37f6db7c03b8e4bc2f828083f123

SHA512
5966edd61380b6207a91512a3b2bf0840e28840fc50273ac0fabc5f3a009a5e9dc335b22f5bb0ad309597f8a4690d07c0c84a2699b1aedd2d87621bb93788902

Download Submit
C:\Users\Admin\AppData\Local\Temp\AdvinstAnalytics\Error file remover\1.0.0.0\tracking.ini

Filesize
84B

MD5
297649b9034847b7df32cd39c36b4b83

SHA1
6e76630d7efbaf19a639f16c9c3b1db349b5b477

SHA256
d29d70a8e81c01297fbe0f6a0016252deb14005fe77f339a5bc6e116d924c6b2

SHA512
4f494423c2751d2898f6d4ed184bb6e12a14a0135fe21c1833df6b09cc064f75cc090f2f329f040d51769b2af49e223656a2a2d4c269c4c7e9f18400f7467f06

Download Submit
C:\Users\Admin\AppData\Local\Temp\AdvinstAnalytics\Error file remover\1.0.0.0\tracking.ini

Filesize
84B

MD5
8044b3d95bdd6387cc26668e3d6fdeb0

SHA1
e829c79c20ac0bd828874a3bfbdd4ebf402324f9

SHA256
007bf517384db02dfe6b1c13e81655799d3b4903808405577865cecf58bdb4a3

SHA512
200c8fdacc777fa97187c3f8a26c263d9ef686634210ddb88b533de3e37a7574bcb19a1e40548cc90a575faba40b2959de84953615df83669575747f121aaea3

Download Submit
C:\Users\Admin\AppData\Local\Temp\AdvinstAnalytics\Error file remover\1.0.0.0\tracking.ini

Filesize
84B

MD5
9136c0a5b57468d4820242de109ef3b2

SHA1
ed0642e46a367e2c729b2db7bc474f45ee204182

SHA256
ed1182e633f4341b629c43791e7a124f23d13fb75d47576e446a04bb3fad6079

SHA512
ac3a17a0d5e3807744f9cbdee787e7b28d4e9e5bed5aa714d26459be2cfe76c57697fa4006054850b073939c09f06c16c60133510e0702b9acf4b357f3eed670

Download Submit
C:\Users\Admin\AppData\Local\Temp\AdvinstAnalytics\Error file remover\1.0.0.0\tracking.ini

Filesize
84B

MD5
cd31f0081a286639fd7675f667ba9369

SHA1
11bbd8a18e5f382242e5085b4ad5577311fb4eca

SHA256
5b4a817cf463ff98c7598b30c589cf80c8d662530c35f628696325a240b957f8

SHA512
00d002566e08af6045fcc57ccf142adfe53efba99e3624d693c04af4f6f9bd899799c58b99f991a3fd00dc8bfc5eea52bde369e30454d8e41031c761210dd2f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\AdvinstAnalytics\Error file remover\1.0.0.0\tracking.ini

Filesize
84B

MD5
61110fe0b375998eaf65d47a212d95ba

SHA1
a643b4938b665ed516d728c99987d70bd783b36a

SHA256
4ce94d070d9d862dbb05882b6d143e51aa0e6037aece6467cc75419e1ff58b8e

SHA512
2a24397ef9597949bd572ce3dbae03d27ee89cee5c77619ca53cfc8c06ff835ed6bda711ab2cec6bdfe8e539e29660a48bbe58c55a8b72a0f6d2adb94d820c16

Download Submit
C:\Users\Admin\AppData\Local\Temp\AdvinstAnalytics\Error file remover\1.0.0.0\tracking.ini

Filesize
26B

MD5
6bc190dd42a169dfa14515484427fc8e

SHA1
b53bd614a834416e4a20292aa291a6d2fc221a5e

SHA256
b3395b660eb1edb00ff91ece4596e3abe99fa558b149200f50aabf2cb77f5087

SHA512
5b7011ed628b673217695809a38a800e9c8a42ceb0c54ab6f8bc39dba0745297a4fbd66d6b09188fcc952c08217152844dfc3ada7cf468c3aafcec379c0b16b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\AdvinstAnalytics\Error file remover\1.0.0.0\{40456794-55C2-4258-863D-5FABEB09172B}.session

Filesize
3KB

MD5
cfbe3133bd0f81617ab7e0fa481110fb

SHA1
d5fffb4671d237288b9b071879492b12ab84e3d7

SHA256
e4ec8cc1e640405dad4d332fe19beb1532dbacf4f10c59f99ed35f87192724c0

SHA512
f12643180e8ae9f3c59ff912b3fd3266be2f373f411c2f2405f94df0fabe7dd50f597a73d3d1981f148f55518f6358a0aed2d24f5ad5879768796f964f151097

Download Submit
C:\Users\Admin\AppData\Local\Temp\AdvinstAnalytics\Error file remover\1.0.0.0\{40456794-55C2-4258-863D-5FABEB09172B}.session

Filesize
4KB

MD5
5b60c935a5018dc1701ea53f12bcbf28

SHA1
159ad13b8a19f4510d763aa6b996a2d22322945e

SHA256
df22fd8ca37390fe07630b879dc36eac48200e58f28e34a14de5a0550004654a

SHA512
2a04c0f934dc43dc33343879d7f42a032c1b0690a740654f1ac9759f665a28ee89df6139602c7d74b267e2d3042e7a218f34ce2b6864d14f50737c86fddae0c9

Download Submit
C:\Users\Admin\AppData\Local\Temp\AdvinstAnalytics\Error file remover\1.0.0.0\{AA3E7B60-5B1C-42F3-A39F-686A0474F633}.session

Filesize
3KB

MD5
48cc31128c190202baf90dfa452132ea

SHA1
3411b9f2e759cb7087c57529ebe556cb5c169c47

SHA256
44658b1ab6d88e39c361039758e489af2cd9f7796e9991f483aac6287ec1ff5e

SHA512
f8b16a35102da24b459f027479dfa98efa10efebc9bb4fb1d0958698d173aa7e0b9edf3b2202ac3d478e9f407ef91a844fc674b8608c3b88afe460dbbf4f26dc

Download Submit
C:\Users\Admin\AppData\Local\Temp\AdvinstAnalytics\Error file remover\1.0.0.0\{AA3E7B60-5B1C-42F3-A39F-686A0474F633}.session

Filesize
4KB

MD5
d75a783d0d034ca9fc17d2d1c79185fa

SHA1
52cca57bfe6074a423a80eb5f23332b9d1ae370a

SHA256
e86ef96834af0c7d8d0203ebba53c8cfc107f6979d8cf229c949f2acfc51dc7a

SHA512
e445353ed6fceb2fb0f6871fbd73ad82db2164f1beb4f956446bb16ef0879df21b20ddb4f596625975f9439eb6c29a2cb14ad936374704cb8cdcc51c83953ed8

Download Submit
C:\Users\Admin\AppData\Local\Temp\AdvinstAnalytics\Error file remover\1.0.0.0\{FF14FE2A-54ED-4006-AD1B-1A1010E4DE60}.session

Filesize
4KB

MD5
0a63da55f89481be022b1e9fc36e9a98

SHA1
03008671232400fa746712daa83b00c18a21f287

SHA256
3b85cb5c1353f4d9228a9ddc75879b1552d4d23de2f8b8fb50d900da598423fd

SHA512
6ef1ad2ad6df1deeba53127894c4cabac86c0ed3393bb9caf1d2f5aa9e52051fadc6b7dca70d3ab04ad6742a1a5feddb0b34c73b4df6575f9ec2d3fa6f74e198

Download Submit
C:\Users\Admin\AppData\Local\Temp\shi16A1.tmp

Filesize
3.4MB

MD5
b5b6aec8ad531f3d05a3db60f6a6ef6d

SHA1
894b0afe1435a314332e139ac34e0484e83b15ff

SHA256
3ad943fdc99b66365bd323fd59a3db6477a0b2692347e0ce26b4f0578ae99502

SHA512
07d2a90b21214e5d6d3dcb269beab5f9cabf181a54c76b0d9bcff4e7608d92a17b9e297da968848a506ff896a337b934c2e308b0a41675726780513838b44715

Download Submit
C:\Users\Admin\AppData\Roaming\Windows\Error file remover 1.0.0.0\install\0A01606\Error file remover.msi

Filesize
1010KB

MD5
27bc9540828c59e1ca1997cf04f6c467

SHA1
bfa6d1ce9d4df8beba2bedf59f86a698de0215f3

SHA256
05c18698c3dc3b2709afd3355ad5b91a60b2121a52e5fcc474e4e47fb8e95e2a

SHA512
a3ae822116cddb52d859de7ffc958541bb47c355a835c5129aade9cc0e5fba3ff25387061deb5b55b5694a535f09fe8669485282eb6e7c818cc7092eb3392848

Download Submit
C:\Users\Admin\AppData\Roaming\Windows\Error file remover 1.0.0.0\install\decoder.dll

Filesize
126KB

MD5
3531cf7755b16d38d5e9e3c43280e7d2

SHA1
19981b17ae35b6e9a0007551e69d3e50aa1afffe

SHA256
76133e832c15aa5cbc49fb3ba09e0b8dd467c307688be2c9e85e79d3bf62c089

SHA512
7b053ba2cf92ef2431b98b2a06bd56340dad94de36d11e326a80cd61b9acb378ac644ac407cf970f4ef8333b8d3fb4ff40b18bb41ec5aee49d79a6a2adcf28fd

Download Submit
C:\Users\Admin\Downloads\BadRabbit.exe:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
C:\Users\Admin\Downloads\Cerber5.exe:Zone.Identifier

Filesize
229B

MD5
ce1b8e61e797dae6935c606497dbfa50

SHA1
b85ff4f9b9a6edae9d28b334ed8dacf89fbb137c

SHA256
8fbfe72b2686f21268b02aad1fa4614f43ef5ad043a697064ccc7868f42418a2

SHA512
ea0becf12157723bd30a4a41fdc38c1fce35a87a959e589110f1d4636c563ca6ca2316d5a0053db03c13c912750983004c705ef3054029df695d8211dc85ea42

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 414807.crdownload

Filesize
313KB

MD5
fe1bc60a95b2c2d77cd5d232296a7fa4

SHA1
c07dfdea8da2da5bad036e7c2f5d37582e1cf684

SHA256
b3e1e9d97d74c416c2a30dd11858789af5554cf2de62f577c13944a19623777d

SHA512
266c541a421878e1e175db5d94185c991cec5825a4bc50178f57264f3556080e6fe984ed0380acf022ce659aa1ca46c9a5e97efc25ff46cbfd67b9385fd75f89

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 427044.crdownload

Filesize
190KB

MD5
248aadd395ffa7ffb1670392a9398454

SHA1
c53c140bbdeb556fca33bc7f9b2e44e9061ea3e5

SHA256
51290129cccca38c6e3b4444d0dfb8d848c8f3fc2e5291fc0d219fd642530adc

SHA512
582b917864903252731c3d0dff536d7b1e44541ee866dc20e0341cbee5450f2f0ff4d82e1eee75f770e4dad9d8b9270ab5664ffedfe21d1ad2bd7fe6bc42cf0e

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 602805.crdownload

Filesize
431KB

MD5
fbbdc39af1139aebba4da004475e8839

SHA1
de5c8d858e6e41da715dca1c019df0bfb92d32c0

SHA256
630325cac09ac3fab908f903e3b00d0dadd5fdaa0875ed8496fcbb97a558d0da

SHA512
74eca8c01de215b33d5ceea1fda3f3bef96b513f58a750dba04b0de36f7ef4f7846a6431d52879ca0d8641bfd504d4721a9a96fa2e18c6888fd67fa77686af87

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 616386.crdownload

Filesize
261KB

MD5
7d80230df68ccba871815d68f016c282

SHA1
e10874c6108a26ceedfc84f50881824462b5b6b6

SHA256
f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b

SHA512
64d02b3e7ed82a64aaac1f74c34d6b6e6feaac665ca9c08911b93eddcec66595687024ec576e74ea09a1193ace3923969c75de8733859835fef45335cf265540

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 677638.crdownload

Filesize
1.4MB

MD5
63210f8f1dde6c40a7f3643ccf0ff313

SHA1
57edd72391d710d71bead504d44389d0462ccec9

SHA256
2aab13d49b60001de3aa47fb8f7251a973faa7f3c53a3840cdf5fd0b26e9a09f

SHA512
87a89e8ab85be150a783a9f8d41797cfa12f86fdccb48f2180c0498bfd2b1040b730dee4665fe2c83b98d436453680226051b7f1532e1c0e0cda0cf702e80a11

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 974161.crdownload

Filesize
2.4MB

MD5
dbfbf254cfb84d991ac3860105d66fc6

SHA1
893110d8c8451565caa591ddfccf92869f96c242

SHA256
68b0e1932f3b4439865be848c2d592d5174dbdbaab8f66104a0e5b28c928ee0c

SHA512
5e9ccdf52ebdb548c3fa22f22dd584e9a603ca1163a622db5707dbcc5d01e4835879dcfd28cb1589cbb25aed00f352f7a0a0962b1f38b68fc7d6693375e7666d

Download Submit
C:\Windows\367C.tmp

Filesize
60KB

MD5
347ac3b6b791054de3e5720a7144a977

SHA1
413eba3973a15c1a6429d9f170f3e8287f98c21c

SHA256
301b905eb98d8d6bb559c04bbda26628a942b2c4107c07a02e8f753bdcfe347c

SHA512
9a399916bc681964af1e1061bc0a8e2926307642557539ad587ce6f9b5ef93bdf1820fe5d7b5ffe5f0bb38e5b4dc6add213ba04048c0c7c264646375fcd01787

Download Submit
C:\Windows\Installer\MSI1FC0.tmp

Filesize
96KB

MD5
3cab78d0dc84883be2335788d387601e

SHA1
14745df9595f190008c7e5c190660361f998d824

SHA256
604e79fe970c5ed044517a9a35e4690ea6f7d959d21173ebef45cdd3d3a22bdd

SHA512
df6b49f2b5cddebd7e23e81b0f89e4883fc12d95735a9b3f84d2f402f4996c54b5fdea8adb9eaa98e8c973b089656d18d6b322bd71cb42d7807f7fa8a7348820

Download Submit
C:\Windows\Installer\MSI205E.tmp

Filesize
312KB

MD5
aa82345a8f360804ea1d8d935f0377aa

SHA1
c09cf3b1666d9192fa524c801bb2e3542c0840e2

SHA256
9c155d4214cebda186647c035ada552963dcac8f88a6b38a23ea34f9ecd1d437

SHA512
c051a381d87ba933ea7929c899fb01af2207cb2462dcb2b55c28cff65596b27bdb05a48207624eeea40fddb85003133ad7af09ca93cfb2426c155daea5a9a6db

Download Submit
C:\Windows\Installer\MSIC6F7.tmp

Filesize
128KB

MD5
7e6b88f7bb59ec4573711255f60656b5

SHA1
5e7a159825a2d2cb263a161e247e9db93454d4f6

SHA256
59ff5bc12b155cc2e666bd8bc34195c3750eb742542374fc5e53fb22d11e862f

SHA512
294a379c99403f928d476e04668717cdabc7dc3e33bcf6bcad5c3d93d4268971811ff7303aa5b4b2ed2b59d59c8eba350a9a30888d4b5b3064708521ac21439c

Download Submit
C:\Windows\Installer\MSIF0ED.tmp

Filesize
180KB

MD5
d552dd4108b5665d306b4a8bd6083dde

SHA1
dae55ccba7adb6690b27fa9623eeeed7a57f8da1

SHA256
a0367875b68b1699d2647a748278ebce64d5be633598580977aa126a81cf57c5

SHA512
e5545a97014b5952e15bb321135f65c0e24414f8dd606fe454fd2d048d3f769b9318df7cfb2a6bf932eb2bf6d79811b93cb2008115deb0f0fa9db07f32a70969

Download Submit
C:\Windows\Installer\MSIF0FE.tmp

Filesize
88KB

MD5
4083cb0f45a747d8e8ab0d3e060616f2

SHA1
dcec8efa7a15fa432af2ea0445c4b346fef2a4d6

SHA256
252b7423b01ff81aea6fe7b40de91abf49f515e9c0c7b95aa982756889f8ac1a

SHA512
26f8949cad02334f9942fda8509579303b81b11bc052a962c5c31a7c6c54a1c96957f30ee241c2206d496d2c519d750d7f6a12b52afdb282fa706f9fee385133

Download Submit
C:\Windows\infpub.dat

Filesize
401KB

MD5
7f13c57aed1c74fb2273d3e30ecdb5ef

SHA1
b2a3054cdd6f5636e9d6386d3abdf9f6fbeb8333

SHA256
0812d9df3caf0071c8753c3d4abcb7b5650b21d4de23ad77fba406fcceae2348

SHA512
a55af49432e2730dbea7d54f6fe12993de3037a5d6b70c889407df672ed8ddf5d68309d2ad2a2a46fc3f5cf15a7812595aa57b588ec0a96459ec5001b1b9e263

Download Submit
C:\Windows\infpub.dat

Filesize
401KB

MD5
449546d6d9a953b1364147ed0755c3b3

SHA1
8306721ab3735df6a5e743b289011b04fdb763bc

SHA256
50bbb61b89a635adcbef23b498cc5c83bc94d161f816131433eeff9143d830b5

SHA512
ed986c6d12deca8d3357d16c976bb1535455c668520f9229f08096c9108a26aa5cc45cfba967e326b3cb1ceb25c97174161800311bdb1a652baf4f0a7c2114c0

Download Submit
C:\Windows\infpub.dat

Filesize
401KB

MD5
1d724f95c61f1055f0d02c2154bbccd3

SHA1
79116fe99f2b421c52ef64097f0f39b815b20907

SHA256
579fd8a0385482fb4c789561a30b09f25671e86422f40ef5cca2036b28f99648

SHA512
f2d7b018d1516df1c97cfff5507957c75c6d9bf8e2ce52ae0052706f4ec62f13eba6d7be17e6ad2b693fdd58e1fd091c37f17bd2b948cdcd9b95b4ad428c0113

Download Submit
memory/224-936-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download
memory/224-931-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download
memory/496-1918-0x0000000004C10000-0x00000000051B6000-memory.dmp

Filesize
5.6MB

Download
memory/496-1792-0x0000000002700000-0x0000000002732000-memory.dmp

Filesize
200KB

Download
memory/496-1920-0x0000000005420000-0x000000000542A000-memory.dmp

Filesize
40KB

Download
memory/496-1919-0x00000000051F0000-0x0000000005282000-memory.dmp

Filesize
584KB

Download
memory/496-1793-0x0000000004B90000-0x0000000004BC2000-memory.dmp

Filesize
200KB

Download
memory/1136-278-0x0000000002E10000-0x0000000002E78000-memory.dmp

Filesize
416KB

Download
memory/1136-289-0x0000000002E10000-0x0000000002E78000-memory.dmp

Filesize
416KB

Download
memory/1136-286-0x0000000002E10000-0x0000000002E78000-memory.dmp

Filesize
416KB

Download
memory/2552-659-0x0000000002DF0000-0x0000000002E58000-memory.dmp

Filesize
416KB

Download
memory/2552-667-0x0000000002DF0000-0x0000000002E58000-memory.dmp

Filesize
416KB

Download
memory/4236-874-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download
memory/4236-928-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download
memory/4236-900-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download
memory/4236-872-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download
memory/4236-939-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download
memory/4236-949-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download
memory/4236-871-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download
memory/4236-950-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download
memory/4236-861-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download
memory/4236-980-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download
memory/4996-1691-0x0000000000440000-0x000000000046E000-memory.dmp

Filesize
184KB

Download