badrabbit | 4cf25411f28f639f72156c24b0f66ea42f5aee5973f6c137d901da6ae42d5b7e

Analysis

user interaction
yes
max time kernel
783s
max time network
785s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
10/07/2026, 04:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
$PLUGINSDIR/LangDLL.dll
Size 5KB
Sample260710-fa8qqsev31
SHA256 4cf25411f28f639f72156c24b0f66ea42f5aee5973f6c137d901da6ae42d5b7e
MD5 4b8a750993567ac9a350ba9768fabfa0
SHA1 7ee7a8c313b292d62561b085c9d490c0f8065624
SHA512 c2a06e352815a2f5340e8244cf2c5a4a5cd7e7848ea67e454ab207262cb33130008491e83d053c778bea97720f7387de737bf15355db3cd5477b94f3571107bb
SSDEEP 48:S46+/TTKYKxbWsptIp5tCZ0iVEAWyMEv9v/ft2O2B8mkGofjLl:zxuPbO5tCZBVEAWyMEFv2CmqL
TLSH
T171C1A370B3D248B9D591413778AB33D36612AE746784500FDB6311AA3820AE7AD3EBC2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

bootkit discovery execution badrabbit mimikatz persistence ransomware

Malware Config

Signatures

Family: BadRabbit
Ransomware family discovered in late 2017, mainly targeting Russia and Ukraine.
ransomware badrabbit
Family: Mimikatz
mimikatz is an open source tool to dump credentials on Windows.
mimikatz

mimikatz is an open source tool to dump credentials on Windows 1 IoCs

resource	yara_rule
behavioral2/files/0x001900000002b5f1-996.dat	mimikatz

Executes dropped EXE 3 IoCs

pid	Process
4268	BD40.tmp
1944	cscc.dat
5672	sys3.exe

Loads dropped DLL 2 IoCs

pid	Process
5844	rundll32.exe
3192	rundll32.exe

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	raw.githubusercontent.com
75	raw.githubusercontent.com
76	raw.githubusercontent.com

Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PHYSICALDRIVE0	[email protected]
File opened for modification	\??\PHYSICALDRIVE0	sys3.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File created	C:\Windows\dispci.exe	rundll32.exe
File opened for modification	C:\Windows\BD40.tmp	rundll32.exe
File created	C:\Windows\infpub.dat	[email protected]
File opened for modification	C:\Windows\infpub.dat	rundll32.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File created	C:\Windows\infpub.dat	[email protected]
File opened for modification	C:\Windows\infpub.dat	rundll32.exe
File created	C:\Windows\cscc.dat	rundll32.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4488	1624	WerFault.exe	80

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sys3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1976	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 17 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4290799360"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292114432"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365268"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "37"	LogonUI.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292114432"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365268"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134281325146107332"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1636999435-3883760687-346127294-1000\{65E6B1F5-D812-480A-942E-D08E4DA4DFEF}	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings	chrome.exe

NTFS ADS 4 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Krotten.zip:Zone.Identifier	chrome.exe
File opened for modification	C:\Users\Admin\Downloads\BadRabbit.zip:Zone.Identifier	chrome.exe
File opened for modification	C:\Users\Admin\Downloads\PowerPoint.zip:Zone.Identifier	chrome.exe
File created	C:\Users\Admin\AppData\Local\Temp\sys3.exe\:Zone.Identifier:$DATA	[email protected]

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5936	schtasks.exe
1444	schtasks.exe

Suspicious behavior: EnumeratesProcesses 19 IoCs

pid	Process
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
5480	chrome.exe
5480	chrome.exe
5844	rundll32.exe
5844	rundll32.exe
5844	rundll32.exe
5844	rundll32.exe
4268	BD40.tmp
4268	BD40.tmp
4268	BD40.tmp
4268	BD40.tmp
4268	BD40.tmp
4268	BD40.tmp
4268	BD40.tmp
3192	rundll32.exe
3192	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3052	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1784	chrome.exe
Token: SeCreatePagefilePrivilege	1784	chrome.exe
Token: SeShutdownPrivilege	1784	chrome.exe
Token: SeCreatePagefilePrivilege	1784	chrome.exe
Token: SeShutdownPrivilege	1784	chrome.exe
Token: SeCreatePagefilePrivilege	1784	chrome.exe
Token: SeShutdownPrivilege	1784	chrome.exe
Token: SeCreatePagefilePrivilege	1784	chrome.exe
Token: SeShutdownPrivilege	1784	chrome.exe
Token: SeCreatePagefilePrivilege	1784	chrome.exe
Token: SeShutdownPrivilege	1784	chrome.exe
Token: SeCreatePagefilePrivilege	1784	chrome.exe
Token: SeShutdownPrivilege	1784	chrome.exe
Token: SeCreatePagefilePrivilege	1784	chrome.exe
Token: SeShutdownPrivilege	1784	chrome.exe
Token: SeCreatePagefilePrivilege	1784	chrome.exe
Token: SeShutdownPrivilege	1784	chrome.exe
Token: SeCreatePagefilePrivilege	1784	chrome.exe
Token: SeShutdownPrivilege	1784	chrome.exe
Token: SeCreatePagefilePrivilege	1784	chrome.exe
Token: SeShutdownPrivilege	1784	chrome.exe
Token: SeCreatePagefilePrivilege	1784	chrome.exe
Token: SeShutdownPrivilege	1784	chrome.exe
Token: SeCreatePagefilePrivilege	1784	chrome.exe
Token: SeShutdownPrivilege	1784	chrome.exe
Token: SeCreatePagefilePrivilege	1784	chrome.exe
Token: SeShutdownPrivilege	1784	chrome.exe
Token: SeCreatePagefilePrivilege	1784	chrome.exe
Token: SeShutdownPrivilege	1784	chrome.exe
Token: SeCreatePagefilePrivilege	1784	chrome.exe
Token: SeShutdownPrivilege	1784	chrome.exe
Token: SeCreatePagefilePrivilege	1784	chrome.exe
Token: SeShutdownPrivilege	1784	chrome.exe
Token: SeCreatePagefilePrivilege	1784	chrome.exe
Token: SeShutdownPrivilege	1784	chrome.exe
Token: SeCreatePagefilePrivilege	1784	chrome.exe
Token: SeShutdownPrivilege	1784	chrome.exe
Token: SeCreatePagefilePrivilege	1784	chrome.exe
Token: SeShutdownPrivilege	1784	chrome.exe
Token: SeCreatePagefilePrivilege	1784	chrome.exe
Token: SeShutdownPrivilege	1784	chrome.exe
Token: SeCreatePagefilePrivilege	1784	chrome.exe
Token: SeShutdownPrivilege	1784	chrome.exe
Token: SeCreatePagefilePrivilege	1784	chrome.exe
Token: SeShutdownPrivilege	1784	chrome.exe
Token: SeCreatePagefilePrivilege	1784	chrome.exe
Token: SeShutdownPrivilege	1784	chrome.exe
Token: SeCreatePagefilePrivilege	1784	chrome.exe
Token: SeShutdownPrivilege	1784	chrome.exe
Token: SeCreatePagefilePrivilege	1784	chrome.exe
Token: SeShutdownPrivilege	1784	chrome.exe
Token: SeCreatePagefilePrivilege	1784	chrome.exe
Token: SeShutdownPrivilege	1784	chrome.exe
Token: SeCreatePagefilePrivilege	1784	chrome.exe
Token: SeShutdownPrivilege	1784	chrome.exe
Token: SeCreatePagefilePrivilege	1784	chrome.exe
Token: SeShutdownPrivilege	1784	chrome.exe
Token: SeCreatePagefilePrivilege	1784	chrome.exe
Token: SeShutdownPrivilege	1784	chrome.exe
Token: SeCreatePagefilePrivilege	1784	chrome.exe
Token: SeShutdownPrivilege	1784	chrome.exe
Token: SeCreatePagefilePrivilege	1784	chrome.exe
Token: SeShutdownPrivilege	1784	chrome.exe
Token: SeCreatePagefilePrivilege	1784	chrome.exe

Suspicious use of FindShellTrayWindow 55 IoCs

pid	Process
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2140	MiniSearchHost.exe
3052	OpenWith.exe
5608	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1580 wrote to memory of 1624	1580	rundll32.exe	80
PID 1784 wrote to memory of 2548	1784	chrome.exe	85
PID 1784 wrote to memory of 3448	1784	chrome.exe	86
PID 1784 wrote to memory of 3448	1784	chrome.exe	86
PID 1784 wrote to memory of 1976	1784	chrome.exe	87
PID 1784 wrote to memory of 920	1784	chrome.exe	88
PID 1784 wrote to memory of 920	1784	chrome.exe	88
PID 1784 wrote to memory of 2300	1784	chrome.exe	90
PID 1784 wrote to memory of 2300	1784	chrome.exe	90
PID 1784 wrote to memory of 684	1784	chrome.exe	91
PID 1784 wrote to memory of 684	1784	chrome.exe	91
PID 1784 wrote to memory of 2800	1784	chrome.exe	92
PID 1784 wrote to memory of 2800	1784	chrome.exe	92
PID 1784 wrote to memory of 3720	1784	chrome.exe	94
PID 1784 wrote to memory of 3720	1784	chrome.exe	94
PID 1784 wrote to memory of 4980	1784	chrome.exe	95
PID 1784 wrote to memory of 4980	1784	chrome.exe	95
PID 1784 wrote to memory of 3336	1784	chrome.exe	96
PID 1784 wrote to memory of 3336	1784	chrome.exe	96
PID 1784 wrote to memory of 4468	1784	chrome.exe	97
PID 1784 wrote to memory of 1460	1784	chrome.exe	101
PID 1784 wrote to memory of 1460	1784	chrome.exe	101
PID 1784 wrote to memory of 2912	1784	chrome.exe	102
PID 1784 wrote to memory of 2912	1784	chrome.exe	102
PID 1784 wrote to memory of 2456	1784	chrome.exe	103
PID 1784 wrote to memory of 2920	1784	chrome.exe	104
PID 1784 wrote to memory of 3084	1784	chrome.exe	105
PID 1784 wrote to memory of 4020	1784	chrome.exe	106
PID 1784 wrote to memory of 4436	1784	chrome.exe	121
PID 1784 wrote to memory of 4436	1784	chrome.exe	121
PID 1784 wrote to memory of 4204	1784	chrome.exe	122
PID 1784 wrote to memory of 4204	1784	chrome.exe	122
PID 1784 wrote to memory of 732	1784	chrome.exe	123
PID 1784 wrote to memory of 732	1784	chrome.exe	123
PID 1784 wrote to memory of 4304	1784	chrome.exe	124
PID 1784 wrote to memory of 4304	1784	chrome.exe	124
PID 1784 wrote to memory of 3092	1784	chrome.exe	125
PID 1784 wrote to memory of 3092	1784	chrome.exe	125
PID 1784 wrote to memory of 1092	1784	chrome.exe	126
PID 1784 wrote to memory of 1092	1784	chrome.exe	126
PID 1784 wrote to memory of 4916	1784	chrome.exe	127
PID 1784 wrote to memory of 4916	1784	chrome.exe	127
PID 1784 wrote to memory of 2060	1784	chrome.exe	128
PID 1784 wrote to memory of 3752	1784	chrome.exe	129
PID 1784 wrote to memory of 3752	1784	chrome.exe	129
PID 1784 wrote to memory of 1500	1784	chrome.exe	130
PID 1784 wrote to memory of 1500	1784	chrome.exe	130
PID 1784 wrote to memory of 5140	1784	chrome.exe	131
PID 1784 wrote to memory of 5140	1784	chrome.exe	131
PID 1784 wrote to memory of 5480	1784	chrome.exe	133
PID 1784 wrote to memory of 5980	1784	chrome.exe	137
PID 1784 wrote to memory of 5980	1784	chrome.exe	137
PID 1784 wrote to memory of 5024	1784	chrome.exe	138
PID 5784 wrote to memory of 5844	5784	[email protected]	144
PID 5844 wrote to memory of 5760	5844	rundll32.exe	145
PID 5760 wrote to memory of 2712	5760	cmd.exe	147
PID 5844 wrote to memory of 5888	5844	rundll32.exe	148
PID 5888 wrote to memory of 5936	5888	cmd.exe	150
PID 5844 wrote to memory of 2384	5844	rundll32.exe	151
PID 5844 wrote to memory of 4268	5844	rundll32.exe	153
PID 2384 wrote to memory of 1444	2384	cmd.exe	155
PID 5412 wrote to memory of 3192	5412	[email protected]	165
PID 1784 wrote to memory of 5592	1784	chrome.exe	166
PID 5556 wrote to memory of 5672	5556	[email protected]	171

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\LangDLL.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1580
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\LangDLL.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1624
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1624 -s 456
    3⤵
    - Program crash
    PID:4488

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 1624 -ip 1624
1⤵
PID:3192

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x10c,0x110,0x114,0xe8,0x118,0x7ff929ccc728,0x7ff929ccc734,0x7ff929ccc740
  2⤵
  PID:2548
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1600,i,3145517073766180868,14733364919476331059,262144 --field-trial-handle=2052,i,11571409457620969388,18049160031395776502,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=1784 /prefetch:2
  2⤵
  PID:3448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2240,i,8994031596168593443,5073695386623910891,524288 --field-trial-handle=2052,i,11571409457620969388,18049160031395776502,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=2244 /prefetch:11
  2⤵
  - System Time Discovery
  PID:1976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2376,i,2165044944217968512,1119540130680122199,524288 --field-trial-handle=2052,i,11571409457620969388,18049160031395776502,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=2400 /prefetch:13
  2⤵
  PID:920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3236,i,2494942076146876288,5711123652247432235,2097152 --field-trial-handle=2052,i,11571409457620969388,18049160031395776502,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=3428 /prefetch:1
  2⤵
  PID:2300
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3256,i,1920924010546085536,14107211926221661597,2097152 --field-trial-handle=2052,i,11571409457620969388,18049160031395776502,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4332,i,140120599889090344,12447013237409870908,2097152 --field-trial-handle=2052,i,11571409457620969388,18049160031395776502,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=4348 /prefetch:9
  2⤵
  PID:2800
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4592,i,6858920831611161900,14499974367039147715,2097152 --field-trial-handle=2052,i,11571409457620969388,18049160031395776502,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=4744 /prefetch:1
  2⤵
  PID:3720
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4856,i,12551308482442303518,11259710639948805201,524288 --field-trial-handle=2052,i,11571409457620969388,18049160031395776502,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=4912 /prefetch:14
  2⤵
  PID:4980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5044,i,17012157888741522837,4672956151507688498,524288 --field-trial-handle=2052,i,11571409457620969388,18049160031395776502,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=5056 /prefetch:14
  2⤵
  PID:3336
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5548,i,8332774492058853422,9173892387360845799,524288 --field-trial-handle=2052,i,11571409457620969388,18049160031395776502,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=5552 /prefetch:14
  2⤵
  PID:4468
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5796,i,12734802868058802831,3576949070615747387,2097152 --field-trial-handle=2052,i,11571409457620969388,18049160031395776502,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=5792 /prefetch:1
  2⤵
  PID:1460
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=3644,i,6007333394136826449,16879332875762703074,2097152 --field-trial-handle=2052,i,11571409457620969388,18049160031395776502,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=3696 /prefetch:1
  2⤵
  PID:2912
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3480,i,2471858382134322838,2944901899195321805,524288 --field-trial-handle=2052,i,11571409457620969388,18049160031395776502,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=5564 /prefetch:14
  2⤵
  PID:2456
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5948,i,10480891151362006630,4853282361858411603,524288 --field-trial-handle=2052,i,11571409457620969388,18049160031395776502,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=5840 /prefetch:14
  2⤵
  PID:2920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5924,i,15341726098052968524,3787709774931249744,524288 --field-trial-handle=2052,i,11571409457620969388,18049160031395776502,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=6032 /prefetch:14
  2⤵
  PID:3084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=3572,i,6868075261928414064,8306768929461661623,524288 --field-trial-handle=2052,i,11571409457620969388,18049160031395776502,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=4360 /prefetch:14
  2⤵
  - NTFS ADS
  PID:4020
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5632,i,3575940173218419061,16273320478060207726,2097152 --field-trial-handle=2052,i,11571409457620969388,18049160031395776502,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=5948 /prefetch:1
  2⤵
  PID:4436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4412,i,9104554502995040234,12741111545142279394,524288 --field-trial-handle=2052,i,11571409457620969388,18049160031395776502,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=3552 /prefetch:14
  2⤵
  PID:4204
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6152,i,17110549577660092627,8392967803574726020,2097152 --field-trial-handle=2052,i,11571409457620969388,18049160031395776502,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=6156 /prefetch:1
  2⤵
  PID:732
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6184,i,1521717763693440146,6079165258310783626,524288 --field-trial-handle=2052,i,11571409457620969388,18049160031395776502,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=6304 /prefetch:14
  2⤵
  PID:4304
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=6340,i,7247716898971609087,4708975086038354331,2097152 --field-trial-handle=2052,i,11571409457620969388,18049160031395776502,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=6020 /prefetch:1
  2⤵
  PID:3092
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=3648,i,16739702093816601193,3678144610862118729,2097152 --field-trial-handle=2052,i,11571409457620969388,18049160031395776502,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=4360 /prefetch:1
  2⤵
  PID:1092
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=6372,i,5572226662338808775,12715623173507942466,2097152 --field-trial-handle=2052,i,11571409457620969388,18049160031395776502,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=6344 /prefetch:1
  2⤵
  PID:4916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5632,i,1743569128471363894,10175232406436100992,524288 --field-trial-handle=2052,i,11571409457620969388,18049160031395776502,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=4372 /prefetch:14
  2⤵
  - Modifies registry class
  PID:2060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=3628,i,5360060611259500791,3553520621459899800,524288 --field-trial-handle=2052,i,11571409457620969388,18049160031395776502,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=6424 /prefetch:12
  2⤵
  PID:3752
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=6044,i,18007132491680660911,15264530571768219789,2097152 --field-trial-handle=2052,i,11571409457620969388,18049160031395776502,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=5748 /prefetch:1
  2⤵
  PID:1500
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=6136,i,3936268178974811165,9860065065688963435,2097152 --field-trial-handle=2052,i,11571409457620969388,18049160031395776502,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=6400 /prefetch:1
  2⤵
  PID:5140
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6576,i,8010617353782157859,3748796522972959587,262144 --field-trial-handle=2052,i,11571409457620969388,18049160031395776502,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=6292 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5480
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=6096,i,18389334243831294789,12177110398244378713,524288 --field-trial-handle=2052,i,11571409457620969388,18049160031395776502,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=6420 /prefetch:14
  2⤵
  PID:5980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1532,i,16274323528568716088,6963521240740209340,524288 --field-trial-handle=2052,i,11571409457620969388,18049160031395776502,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=6736 /prefetch:14
  2⤵
  - NTFS ADS
  PID:5024
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6816,i,6625241025000667021,10465556452863497421,524288 --field-trial-handle=2052,i,11571409457620969388,18049160031395776502,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=5672 /prefetch:14
  2⤵
  - NTFS ADS
  PID:5592

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2076

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3432

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:3756

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3340

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Suspicious use of SetWindowsHookEx
PID:2140

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:1864

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3052

C:\Users\Admin\Downloads\BadRabbit\[email protected]
"C:\Users\Admin\Downloads\BadRabbit\[email protected]"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5784
- C:\Windows\SysWOW64\rundll32.exe
  C:\Windows\system32\rundll32.exe C:\Windows\infpub.dat,#1 15
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5844
- - C:\Windows\SysWOW64\cmd.exe
    /c schtasks /Delete /F /TN rhaegal
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5760
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /Delete /F /TN rhaegal
      4⤵
      System Location Discovery: System Language Discovery
      PID:2712
- - C:\Windows\SysWOW64\cmd.exe
    /c schtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR "C:\Windows\system32\cmd.exe /C Start \"\" \"C:\Windows\dispci.exe\" -id 3785606035 && exit"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5888
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR "C:\Windows\system32\cmd.exe /C Start \"\" \"C:\Windows\dispci.exe\" -id 3785606035 && exit"
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:5936
- - C:\Windows\SysWOW64\cmd.exe
    /c schtasks /Create /SC once /TN drogon /RU SYSTEM /TR "C:\Windows\system32\shutdown.exe /r /t 0 /f" /ST 06:11:00
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2384
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /Create /SC once /TN drogon /RU SYSTEM /TR "C:\Windows\system32\shutdown.exe /r /t 0 /f" /ST 06:11:00
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:1444
- - C:\Windows\BD40.tmp
    "C:\Windows\BD40.tmp" \\.\pipe\{B0A7386A-1887-4400-ABB2-B1B961181703}
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:4268
- - C:\Windows\SysWOW64\cmd.exe
    /c wevtutil cl Setup & wevtutil cl System & wevtutil cl Security & wevtutil cl Application & fsutil usn deletejournal /D C:
    3⤵
    PID:5696
- - C:\Windows\SysWOW64\cmd.exe
    /c schtasks /Delete /F /TN drogon
    3⤵
    PID:3972

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe
1⤵
PID:4932

C:\Windows\cscc.dat
cscc.dat
1⤵
- Executes dropped EXE
PID:1944

C:\Windows\system32\shutdown.exe
C:\Windows\system32\shutdown.exe
1⤵
PID:1788

C:\Users\Admin\Downloads\BadRabbit\[email protected]
"C:\Users\Admin\Downloads\BadRabbit\[email protected]"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5412
- C:\Windows\SysWOW64\rundll32.exe
  C:\Windows\system32\rundll32.exe C:\Windows\infpub.dat,#1 15
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:3192

C:\Users\Admin\Downloads\PowerPoint\[email protected]
"C:\Users\Admin\Downloads\PowerPoint\[email protected]"
1⤵
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of WriteProcessMemory
PID:5556
- C:\Users\Admin\AppData\Local\Temp\sys3.exe
  C:\Users\Admin\AppData\Local\Temp\\sys3.exe
  2⤵
  - Executes dropped EXE
  - Writes to the Master Boot Record (MBR)
  - System Location Discovery: System Language Discovery
  PID:5672

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa39e6055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:5608

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 2f335c4547bd5bb103e01ad9536c899a5c2aba9f7f41ad22d5e17dacdbe53be8
MD5 e9314f85254aa99df6e191610bce5f1a
SHA1 ea466a9a6dfdef4cb2f77abc57b4d33fc2a8de23
SHA512 71f398cd377f665ec1d604ca8f1a3ebbfa01889d92cfd30bdd25e3270962127d508391b99cc8875c49cd1316ae19cac9f280b4592f2cb84cb4ff2121bde4f90e
TLSH
T155E0EDAACC20AC2B58FD1718B4910A8AF600131B2B80596B3A3C82098FB477B41868AC
MD5 SHA1 SHA512 TLSH

Submit Download

f_000038

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000038
Size 21KB
SHA256 ef5987a65de60c15084f58eb14943fe3d9ff412f5f67134dad7b0903ad02503a
MD5 9dea6b8eb7a950b8b7eef7641c57aaf6
SHA1 f4516a7c5d8949bcf28ecf0ee62f21fff8459250
SHA512 de02a7f9b741d537ca90eb821a0b8ea3a3fbcc3cf96715af22d976e081c5f567f5a16bda5982e38f87e53296b73f89e46a4ce98d8ed410f8d19f2d3d18fe3d54
SSDEEP 384:UKX4kfO2bDUBcBP9/tZIGSQq4qWn/r/5RRqlrfFM7zdnoVboWQ8FjavIx:Ug4o0BSptZfS74BzRRRqlfF4zdoVMWQe
TLSH
T147A2E159F0A4EBDA9C10827BFE7D87224154677E848E040A0D0153AC9BE6D46DD3C6FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 1c021cd2015ce3e19fb23631de994808ea327514e1f8d796072d48e8de57f96b
MD5 bea9cd4680fd29bb371f0b5f470afc48
SHA1 1fc42f9c3d87d70c8733ecf9cc0f89a898ddc46c
SHA512 5ebdf9a938321b880acc2bd85793c5a0c6d2323527db47bc107690616f384fc0c0f643b7f82106aa60a5d3cc46017e48f67191709cda7f0c75db41c5cb82bd53
SSDEEP 96:MMa8SIo7SBLnU98grkne4vaAHW/gTgRXgLy+W9T9:6Io7Cg0n0AHiSwQLy+Ap
TLSH
T120B108D9E25ACEF3DF2C5BB835BA39582E32EC9647820FEC612B90F659037E4415C058
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 63528e13793ac32ab5d9e0ccd829420817c92ef56db1d123671a626e9e728564
MD5 468cc678fe0cf3cb9a6903498dad549e
SHA1 51e16894f60baf8f549ebb8d84c8fca6b7777f93
SHA512 3896bd4e506238fdeeeb2a2af27ee5d59955c84adab67825fc562adea68d60a3a91e606328007320f408fd86d953205786953d0a5a52dc743e2b298c060eeede
SSDEEP 48:Ipp4ddebJ/S1xxu9MB3qMNeoRCkUKm8a79QdjAnTkTt98ImdRhcqXaKV6zoRL0Za:fO4v9o7AqnU98F0YBA3Wl33XMqyjksoV
TLSH
T14681C4D6C21ADEF3DF2C877875B639643E32CC0247821FED511380FA59827E8969C4A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_github.com_0.indexeddb.leveldb\000003.log
Size 89KB
SHA256 ceac5fbfbbe3d60319052cbc414ca6f2df30e69232b6470a001c82e02d05f42d
MD5 fdd0a4fb20144161d08cee02e5eea3b9
SHA1 a32c96f15d178006d2e02054222d515d625839f8
SHA512 448158c8eda3f6e5cf9b8b18cf4ada462f8e8151a0e1a98b5df66c2d3eb5b6eb57ce9899883607fcbf85c86efce918aeb9c2e17ba1eba842bf02868412d7c972
SSDEEP 768:qRaLmSdjmSYp+TmSWcQ91jTgzMDTg33AvotPVQ91jTgzMDTg33AikQ91jTgzM8Ty:9mSdjmSYp+TmSWlu5gk
TLSH
T142932298FAF84C179F7B975774F23C2C8876F11260C89C5574A24FAD52A6AC0B28F643
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_github.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_github.com_0.indexeddb.leveldb\LOG
Size 339B
SHA256 b8b5ed22f6cf9c68b6ea949a2f05b825061b6c83c50c5ffafe00e5865e26b3e3
MD5 6427063c83f6dc65d86007e0de0de84e
SHA1 754e6b77596852d724b581be435bd44d84c7c8af
SHA512 1353a5664396bdbf680219d9502514c7a9f61995a3da29c89b757dcd9e59a656994a5e8ecc394196d6407663298a8b5bff6bb6b68f076efb4b4b24c98bf3209f
TLSH
T1CDE0D86995C98A6F515480A655357B0FDFA2550CD7CC6D8A0F83DC2470CA00899FE265
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_github.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 13KB
SHA256 e5cd01671aa71cab5233e6e2bf341a1be318b57a599b752f0d055f2551206f48
MD5 14301a28030b16de171800017cfc38d5
SHA1 7e8a3d67a6468c8c349b94beb0475cb0d3544ce1
SHA512 d1a9ba92af1ae53fe5990000b52148b1b02109e4ca90a90fa68ecf80c5ab31b7bee9e5dcbe8d8c61ca986d849aa03b05006da346648da9691de0033d87e0c63d
SSDEEP 384:DRYKYhRmVmv7whtEoJ4KYezJdaIpGRUm/mXmmmImDmtEybmPBUmQUCIKIeI6aeHt:7k2p6+WXxi+s+VhJeW49Ree
TLSH
T191529BF7C3E8852D890156F89B15AF1FCE591A28432C3D6689D8BE5B93E3831D21164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 edefb8e321424269ce2f7d04ae0415eba1e5e905a9a079b03b66a920267f7b5e
MD5 b734835709ae62c845d52bc075e6fc25
SHA1 76da7c8c495f8d877bacf61c41048433f5a0fc54
SHA512 a48878d8885da25f252b7d7bfc6982b208f68319dbc350dcd1198c9e91202a6e37a5757348f8433c8d23dbd16be00a6d1cac2acc14e6505d6a56e379921dac30
SSDEEP 192:DRYKYhRmVmvfaIp9LL4dpMPJiKRtIMNPgAaPim3HmXmmmImDmtiBmzmH:DRYKYhRmVmvfaIp9LL2pMPJiKRtIMNYx
TLSH
T120F1C0F7C3E5852D891155F4AB15AF1FCE291624831C3C66C8D8BE5BA3E3872E21174E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 13KB
SHA256 ba5882bd0cd46c22a6647b1eb8dca3524901a215823b0959698fec8512d27c5c
MD5 d032ac423037f0a4b588752db67b5275
SHA1 1c627d114d4129b8e7da867f17882fb3bdbfa6f0
SHA512 d46eb43cb5af260cd7c47f4a5b1ade69e2972924edf1441f72e1cf1add537ba00e08ed72fe920dd26d4f5232e01c2835a7f97f214a558326f60b9ae365f08a60
SSDEEP 384:DRYKYhRmVmv7whtEoJ4KYezJFAWaIpGRUm/mXmRBUmQUCIKIeI6aeH29Drc11fhv:7k2pm+Wm+VhJeWY9Re7x18H
TLSH
T12C529BF7C3D9852D890156F89B25AF1FCE591A28432C3C7688D8BE5B93E2831D21175E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 14KB
SHA256 b8527c13328118d58e77723cfdafe3d19de74e0230f0a62d605844b98e044d42
MD5 c694dd63d550d5dae232abe8a21e4733
SHA1 ef40963b8e91413e7d4eb091081ef26f014f1362
SHA512 bf6ee2369de4f1e37b8dfc0f8fe28d61e757205055dbcb51b66be57d1a3e6adac619cf3a4f321b67307bfdedc0b4ccdd915e20ff94e68094edc958d598970e08
SSDEEP 384:D0utqmVmjwwhtEoJ4KYezJFA+t6XdaIpGRUm/mrmREdmQUCIII6aeH29Drc11fhr:dkPp1+qo+7JeWq9vii3SgvF
TLSH
T186629CF7C3E9852D891156F89B15AF1FCE291628432C3C7688D8BE1BD3E2831E21575E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 13KB
SHA256 020b692cac83bf9251f6e2521ebc4cd7ff3b00cde81243247076e997652281fe
MD5 4de814671d021d42f636780178f5774b
SHA1 02dd888424cd0e6f220c21cb59988441ad709531
SHA512 6c2521206cd1e1c8950b3af8c20a6dd04740c1ea3e9f73618f21133296fe93e825c52d16bab3d0a40938f6b88abb517cff2a028e520addf54dd6ffee859c6dc5
SSDEEP 384:D0umitqmVmv7whtEoJ4KYezJFA+1aIpGRUm/mXmREdmQUCIKIeI6aeH29Drc11fr:Vk2pA+Wo+VhJeWLcSIxi3SV
TLSH
T12252ABF7C3E9862D890156F89B15AF1FCE291628432C3C7688D8BE1BD3E2831D21175E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 2KB
SHA256 9eb29f376c84ed9f478f76508d0fbc106fa49cd9da2ce206641184db7178e7fa
MD5 cbe1a6ec6a0efa6377fb96c5b00be197
SHA1 c6294f9c0debf703b1a6c3ad2e47cd8c4d808188
SHA512 d575d0408963999c378ace2eecaa6c4824838a3b914fe1f87e9fa06aedf01f250d4bc38f941164f7224d93532a5d21a4608155fa68166f2622bf5b077c1ec6ae
TLSH
T11F4181D7A7FE745B10BE486F1D04B8052DBAB833416278F5EB92826CF0894F70B26417
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 e8778b8cb8dd5fc7786344a1e37347d8cd072013c426d65f8e4884ad46056f3d
MD5 987a68105f4c2460de08e3e9e0c7dd09
SHA1 4174a1e1f32e9d0453e52eb5a1cf93fe2240ba5a
SHA512 cf63b28bf9acbcdda398bce9c61d5e69ae9428757f405d27cbd13edd76e060ade7ae479e5adb874ad9f3f1efc16c938cb42265a30e41d66d4cc01aef532abfa3
SSDEEP 192:eRAcBh0QITQnWMLnv7AnpIPRpOgLz6D9uHsb+WN4F/d+u0MWMEpR2Q/DWVyIsnAq:eRAmh0BTev8ngXEUwuQmEj2Qye
TLSH
T12A62C72BB910697BACDBD219F8627B5BD7F1202226D41E84EBFC8A1C15E76CD3217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 0df4450414a69ef7df2ea395ad9df6d4f9053341db7047d4edb8c1195f1a8335
MD5 1f8140c94b26db9e082233822f74634e
SHA1 e3053c4d84bb88c4a9c563bb417ddd863f88b2eb
SHA512 7f8f47515ffc4de30d94c17ee4ab1a81adcd65d88765b91d09ef5a8cf612393b9b7e699cb3e7c09ea56fb4bc1255e6a5cdeff32b6f3f071fcabc61931c221063
SSDEEP 192:lRo5QITQnWM2+v7+pAPRp279uHsb+WNnzp01R2Q/LWVyIsnAUgtaJ:lRo5BTf66UXkUw90X2Qa8
TLSH
T1D142E82EAA10797B6CDFD229F8223B57D7F5102222952E84EBFC892C15E75CD311701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 a6673a537958934e496fb57e9cbb1dd577e09c78021c8ce317f4182e01eff62c
MD5 bad60d7ebf9739df75f73c0e10eb1b6e
SHA1 90c54746f12588740bce91f9f29502f15fc002c4
SHA512 baeb986a3aed19c10898841b95b221468d802ba5ee8c656616b2b237c6bedad061a73a40716717878906c8e58d6b74cf3ce7ebc2ada4479c193c7e801533f4e5
SSDEEP 192:eRAcBh3PITQnWMenv7AnpIPRpOgLz6D9uHsb+WN4F/d+CI9c/2cuyR2Q/DWVyIsN:eRAmh3wTXv8ngXEUwuBeuuu2Qy6
TLSH
T11162D86BA910697BACDBD219F8627B5BD7F5202227C41E84EBFC8A1C14E76CD3217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 59ad29b76f5b2602d2e6aaf43899ada713a1f888b2c950704b1548ebbe35ce15
MD5 8e2ce8cba9aa03d3d4aed7c7bd325b47
SHA1 1e605627e4ec35b9e0702a2b54b180c27f198edf
SHA512 9f90f2a9b17f38550433b645b31e51f8b50458e1dd0c8afbbe566b48e454906b0e38056bb2dce4df78144589715366dab4bd0af88be4825a6cb0c6884dc7bc3c
SSDEEP 192:lRAcBz5QITQnWM2sv7+pAPRp24Tx9uHsb+WNnzp4jhelR2Q/LWVyIsnAUgtaJ:lRAmz5BTf46UXLUw9qeH2Qa8
TLSH
T17852E72EBA10697B6CDFD229F8227B57D7F5102222952E84EBFC892C14E76CD311701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 7088d1b8d4f538876120e466d3e957b172dc080c2a21edc872d57f434dd6886e
MD5 1b6455d56f12bd69bfea2735fb263327
SHA1 d70059364836901d30ae15190007118e0a7b6fff
SHA512 685ed5003a81c85fcad041386dfc62636b1932dbe22847fa8ababeb52f852ddf2e284ee95d9ff49237750361b774ff6b47f9a24a573dc6e6e0feeaf464f07e6b
SSDEEP 192:lRAcBz5QITQnWM2Sv7+pAPRp2gLL6x9uHsb+WN4Fzp4jheKR2Q/1WVyIsnAUgraJ:lRAmz5BTf+6UXOUwGqeG2QMe
TLSH
T17852C72EB910697B6CDFD229F8627B5BD7F1202226851E84EBFC8A1C15E76CD3217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 74e3637074236c59b216ee94d5eb867de0a04c1224862643028f9848b180282e
MD5 28e51b2f89e30c878d20e8de9f69dee7
SHA1 91bf8d7fe260d5b350f0d455b095d3d766eba006
SHA512 70e0f01323d5d2713a08bba0d1db06c6d1cea9054173a5524cc2a1411a759b0ccb488802bb570e2674234097a27e310991fa152b5013286ad32d08d0e348241f
SSDEEP 192:lRAcBztQITQnWM2Sv7+pAPRp2gLL6x9uHsb+WN4FzpvcId+jhec9R2Q/1WVyIsnB:lRAmztBTf+6UXOUwGlQeC2QMe
TLSH
T1A552C62EB910697B6CDFD229F8627B5BD7F1212226851E84EBFC8A1C14E76CD3217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 6252d57095c33ee191192af616e2a8cdad121dc03853ba79d0330fa96d68a24a
MD5 c6a4ba8d7edb48e064956e1c6df9bd26
SHA1 95e506f8d390e6fb5b6892d41340dc27a24d785c
SHA512 59352c3593fe452e8f255264fc09378a077a86644198152f82de2d086b6a4a42e71401d179377101511287dc9c3f4b9728062f7fcfbbd9aeae8d353cb20ebd5e
SSDEEP 192:eRAcBhtQITQnWMLSv7AnpIPRpOgLu6Y9uHsb+WN4F/d+cId+WMERR2Q/DWVyIsnB:eRAmhtBTe+8ngXYUwuw4Er2Qye
TLSH
T12562C76BB910697B6CDFD229F8627B5BD7F1202226941E84EBFC8A1C14E76CD3217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 e277bc59ed91affb8dd5791e3534bf6bbeae2f0a50963326824f7fa4cf80e4c3
MD5 665c23efc4423114370f27a30de3c400
SHA1 8f4a544f8bbcfd43bd670d99fa747eb94dce47a1
SHA512 69583f0f0b68c0ce02565756c29e576944ed6d1032bfa523e698db51e27b2318af06575f4f884d177350f175581250ef5d9403b700cfda972e72a870cf398d67
SSDEEP 192:eRAcBh0QITQnWMenv7AnpIPRpOgLz6D9uHsb+WN4F/d+CI9c/2cuyR2Q/DWVyIsN:eRAmh0BTXv8ngXEUwuBeuuu2Qy6
TLSH
T14862D86BA910697B9CDBD229F8627B5BD7F1202227C41E84EBFC8A1C14E76CD3217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 87abfd6483e055ddeb2f8fc2f483f91af443de3130ad7f6cceeeecc94a6c2511
MD5 04c2655e775a571e3b09dcdcd782d924
SHA1 84dda5dbd4088a2a3591384e8279d568339c383c
SHA512 38ea57f7244c49bbd8e846e3f0d5342b6c186f24c011ef661cc6a4f6836da0e0f816f76146075af79a69abcd50476432db60bf14c0daf6c81fe144ac588ce833
SSDEEP 384:fFjLm7KxkXqKf/pUZNCgVLH2Hfgsl+27pLuLcSjBsXODLi+ErU3ZSHG7Ep83wCv:fVLm7KxkXqKf/pUZNCgVLH2Hfgs427p+
TLSH
T18C7208676C4C9E370F94D6C8D8267B4FADB5024B65DD886493FA982903D4BCF110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 a4b7dc32be5f5b533b4b94460d493af8d64b1af080b70a91f63f64d0655ba7e9
MD5 53b09aa50d556ac1aeceaf318e52ad25
SHA1 cef9e72e9baf0e75595f47eac5fe6ab59a099c28
SHA512 5d20d7eccbd02d60f0e50aef9a8a117621cc7c8233a7831e5f88213fdbab59a60b200772fc2470233af56ec92f9cd9ba5a676c193f40a32c9b1d0d6c53494e3e
TLSH
T1E1B01250C0415541C85602F411C6149875545F11960E270963F06922C8291B1C058050
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5ec83f.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5ec83f.TMP
Size 96B
SHA256 83c2a4a33de3025cba870e24d4a08d56a592036161a68b9ec151bd788a3c8735
MD5 a73c0715e1f11007cae12050154e2ffa
SHA1 c1b46cf58ca982fca54c6294d4ae7c2c9b61cefd
SHA512 3220c7e8eed694bbe035e6ca120e3a49e80564ffbd5f8c6355d83d056170ab545282a30045599778bb4b73e97e0849e92ba790393c6bcfae79e4e8f361865c56
TLSH
T1CDB002A6C92AB213C84603B479969BDCB160DF26CA071217D6E01F76DC29AB1453616C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 bd03800cbda2fb4ba20fd58f35386751a0941d218914161b1d574b800b1b80c7
MD5 2dda40410a9d0935c16aa80dfe8cabb6
SHA1 2da641b0dd3dc149fb4cf5930fdfe26cbadcca8c
SHA512 46bea5d55ca20f1d27493e9c2a79a5979b85132a5440d701b501abcd06c9c2c676550b01ea38df1523cd4e82d520eec72cc93abb6f0fd5b612e6b05f2215c5fa
TLSH
T187A0022521C5CC52CD54677962960DC1B7516C510B5682036CB164C89862146550D614
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\4\CacheStorage\index.txt
Size 150B
SHA256 5ff2762099d8a40c52a2546324f59fa06ecf2b64478281f674eb823c2bc911cb
MD5 6458b5152be6cc08301f171930faace7
SHA1 ed8fe9afa9cbbd56b4a6a53ffc41d15fd41d4433
SHA512 68d54567932291ac159e2d99808c0cffdabe438c34d6fd7fc7cfeba4db3bf05118490aa5a16f6b20325606fd1daada7b4ef221cdfca1a903e41bf8777d98e2fe
TLSH
T105C02BD31941C48B4634EDCC1018392FD14FD14C8CD0CDFCB80C04572034E374802938
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe604bc3.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\4\CacheStorage\index.txt~RFe604bc3.TMP
Size 157B
SHA256 84a84a1027d195439f5d6444d32d2abbb1bae40cf9d3b6b1e370799ed341a967
MD5 d691666533376054516e319928c58924
SHA1 8955b227682b1ca06b65d03c0e537e44e04e7740
SHA512 c0fe72a932c85b0f4d2f97ad858990cdd912f356c0bc2180beaa3134e0ac83513b52ea849c690dbb5415a4778977234a43e279c8268546644abb398405f2ceea
TLSH
T13FC08CD3151184874730A8C91028395ED15F9C488CD0CDECB80974572035A278841928
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 232KB
SHA256 7c0077a0c3de09f755ebf4faec1b13ea6d0513b7b5107137a27b9852c801ec2f
MD5 6823a8554c1bc9f97a4c997952d07e85
SHA1 0fbad4a637049fddc84febdea84b2f77fee524b9
SHA512 ba11bee2807012ca011bf5ec5e4636e20dcb55f369180464f0e250075025bcbd5294c6934cd05cfa4615e196521faa01a960f664b13accb9bb01195463729c4a
SSDEEP 6144:kQmSo0khmRgB36T8Ljk8wCcmXKegIh6jh9JvexhK:kdICHwCHHgVUxg
TLSH
T1D234224A2D37BC9204BC2BFBB5573BD74E2143921C9670AC64DDEF4742EAD74062B4A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 233KB
SHA256 d0dca7a43851259e4d328a36405e3a360aff3a7e9d95455e20f192be41bd2013
MD5 ad7ff4ba744fe8ef3c2e06f683c43f25
SHA1 2188ba95416944e0bafdceb795a529f7cb1e118b
SHA512 6913e396df5a852bd287917e45c6cdd89473c7ac4a593b86ffcd467743d21d783b0c67560cc08e29bf11a462b2c43e1992c26ed3d286c1fc374cc97b4fdf222d
SSDEEP 6144:mQmSo0khmRgB36T8Ljk8wCcmXKegIh6jh9JvexhK:mdICHwCHHgVUxg
TLSH
T1193423656C37BCD208BC2FBA71573B824E6043D31C9574AC64DDEF4742DADB8162B4A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 38aff70c321844b0060962881bd16dda61a5f2c757458552900a6350234f80dd
MD5 28879575c13cfde08ff62082f3425051
SHA1 9c28849d18e7321fd747c69c246748327c7cb81e
SHA512 9a260f3bbecb14170ce1967317f93986d89cbe56f59c73bc2cd12a9f18aafb9bb753716cdbaed26139f9ba175ded5543c90a85fcdd91021938af99f83ad1d94d
SSDEEP 3072:98uwLcXcgVXruSixWgL0rF6jh9JDvexqw/w5nP:bwCcmXKegIh6jh9JvexhQ
TLSH
T1C8B3125A28273DA68CBC6EB37453338286A353A26C05F14E94CCDF0B49DDDB515EB8B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 232KB
SHA256 e1e5dd4421707fa7c0b9bae35e141c4fa304850c4ba523afbda609985d3672ab
MD5 c80e17a2fe9133c565e20d987af4ed2b
SHA1 21bb77a228fe6a5b5223c5feb53d941048ac85c2
SHA512 49522fb0d34e63bebefcf6b3343a65ebebf55961437120b826c643a0dff8bcb94e18247b6f4474c3950d23d251be9020eb1806b9c89aa3e6c12fd5a857cf319a
SSDEEP 6144:zQmSo0khmRgB36T8Ljk8wCcmXKegIh6jh9JvexhK:zdICHwCHHgVUxg
TLSH
T13C34224A2D37BC9204BC2BFBB5573BD74E2143921C9670AC64DDEF4742EAD74062B4A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 233KB
SHA256 4c8d836e8589cd77cd4fdf1060bca8b30ebd1b5001f97770ac1ab75708d7d571
MD5 be602f367f04af695a91e7e2f2b5ab4e
SHA1 496a5b4616c3ffeab6e195e1ce2f939115a11667
SHA512 fe8dc9ca6c307f9d4b5af41a76e7b347cbd29472c7655db0a561a184c2c3393d959d07568fbc56e7e8f033cacd3685834e5bee6ed1a6edac9488e0ab4182ea6b
SSDEEP 6144:+QmSo0khmRgB36T8Ljk8wCcmXKegIh6jh9JvexhK:+dICHwCHHgVUxg
TLSH
T1FA3423656C37BCD208BC2FB671573B824E6043D31C9674AC64DDEF4742DADB8162B4A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 233KB
SHA256 41975c0feb903c804eb183bc8c2a1f8df8fa2ed79fdf9b38c8a83520738c8201
MD5 32dbfe868b18626290db265bce9027b4
SHA1 3efd05709fef73fd63df13860c8c53aea1d59690
SHA512 0bcb0e2a92ebe7786e2b408d54c11b9a5b28efadd9e3058316dc8bb47d057418bd3bd014194b6885f9b5ee30094b40c7f03e97f31aedd61a559f75f4f08059be
SSDEEP 6144:iQmSo0khmRgB36T8Ljk8wCcmXKegIh6jh9JvexhK:idICHwCHHgVUxg
TLSH
T1DA3423656C37BCD208BC2FB671573B824E6043D31C9674AC64DDEF4742DADB8162B4A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sys3.exe

Path C:\Users\Admin\AppData\Local\Temp\sys3.exe
Size 136KB
SHA256 9c3f8df80193c085912c9950c58051ae77c321975784cc069ceacd4f57d5861d
MD5 70108103a53123201ceb2e921fcfe83c
SHA1 c71799a6a6d09ee758b04cdf90a4ab76fbd2a7e3
SHA512 996701c65eee7f781c2d22dce63f4a95900f36b97a99dcf833045bce239a08b3c2f6326b3a808431cdab92d59161dd80763e44126578e160d79b7095175d276b
SSDEEP 1536:3VrdxBvcGdDHHtWv8udA1JYREgJ/qEOpsChnU4V1lyqHv4vAmOG9HSDKRppppp5B:1H5D0dSgo7ppTV1lyqPOAmOG9HSOD
TLSH
T128D339B3AC82C8D5FB2D38FB957FA97C816FAD083918B4129905310A187EED3657345B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

systm.txt

Path C:\Users\Admin\AppData\Local\Temp\systm.txt
Size 61B
SHA256 5a6e65b4c7d8e3a2510c99f6c643754d142ae70fde156d426f3f351ad2e2c008
MD5 afb85e4e6a706157ac27d5eb3388b3f6
SHA1 fcf17fac57b0dc2aac2e73d33250e09e816c0f81
SHA512 3d22ffe28f890bcc97c7c2544688e7d6f4bf5216394cd50ad9a1f0d760e2f6463f8f74f34f2eeffad7592aa4c765e6610dd5db84c3453590912738dcf522ccd4
TLSH
T157A002D7449995020114541B016A17DE6059140559C13789BDE0CC49B3244296C8E78B
MD5 SHA1 SHA512 TLSH

Submit Download

BadRabbit.zip

Path C:\Users\Admin\Downloads\BadRabbit.zip
Size 393KB
SHA256 a547daf519db3a70aed2c3a8b734a5706b372728a0feb632065b615b41a34eda
MD5 9cd8e6f8b8567a45665f3cc56a4aa7ec
SHA1 ae06357aaab9a3545f67555d88275ea7eb663e4e
SHA512 e2b296dd0e8625751d1742a5f8686d5ce56eb6404a6363de7f53acec93143f82bf1bd18ed061e5d42b1f4c4ff7d6910f1f40fca2387636fad39df8e7183672ed
SSDEEP 12288:G9fV1JDjRNzesMag7OsIlnI9A+TenYDVK7IgKKeLC:0fV1FdNzIOsIV2AdeVK7IrC
TLSH
T1D48423B1DE70847D9C6D65E981E20EC6A621C64EDB0527C20AE0BDD6E4D0AC3CE77BD4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BadRabbit.zip:Zone.Identifier

Path C:\Users\Admin\Downloads\BadRabbit.zip:Zone.Identifier
Size 237B
SHA256 ff322b9dd275b402f20196d87ea236d3d4673edcfa89c6415a3b971043bafbd0
MD5 c4efc3efd43c32d8f6ad8a3e58a009a3
SHA1 af23e1ddb803742baf92efe08b7970353a0ab392
SHA512 7230b524f14f30eeffa88de088ccbb70c47badbc6489322ef13fbf79e55f1ffd4bf0fc58a729863f5ffe554d284f2a9c1ab5e41f09c0c7cc0688c6c636c49fdd
TLSH
T1E0D0A7E2F850151C0F47B1CD36E8A99CD03770D484F84212FEB0C54F746029961DBA21
MD5 SHA1 SHA512 TLSH

Submit Download

Krotten.zip

Path C:\Users\Admin\Downloads\Krotten.zip
Size 25KB
SHA256 b8a6e1c0505e005b8e2cf1c99c4099f360357a246e2c6e8d16046f0e93b662e2
MD5 13037f36d6dc3dbd6b0c120974a113da
SHA1 2bdff32fa7acabcbd55fb36297cc9268744fe7fb
SHA512 eb56308ccde68b9d46beb1e60c9148ec07fb9599ac43571ab3cc5ed7d6ceec2a9444c49b384551235e9cd5016169a57d28b26a18e93d504a8ba6d6f9e864f124
SSDEEP 384:4UQfohugFUg7+HEQ4+egeOFWg2JY22j3ynayhLbaDUBRwd15Kjm5wSK/uN5/8:4UgAckVwWnc3ia83RkYEwSKWn/8
TLSH
T1E1C2E1016466EC74AFF16CDAC502981196F95F30A37367B46AEB41A7F759F80EC0C107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Krotten.zip.crdownload

Path C:\Users\Admin\Downloads\Krotten.zip.crdownload
Size 25KB
SHA256 8dfa496c93680adc10e77c0946c7927d3e58d79900013c95dfca3411d766bd16
MD5 1aea5ad85df3b14e216cc0200c708673
SHA1 e3ee16e93ba7c3d7286dc9ebbaf940f0bcb6cad3
SHA512 06faa190350e4558c6d4f1f201dc0698587495897593aaeac16f3ea3d8c1c7f81d65beea6bc7e730ca1df9bdfdf3cd2bcc84bf50f64787e0b1dbd21492796f36
SSDEEP 768:gGkaFGuW/1rmxspfsYEOgDGjvZIxvTAd7i6BoBTYpk1:xhQBoSgDGDZQ0dhyj1
TLSH
T1E4C2E1615E6E09099E011AC8D5DEB1B731C462E36B3E5252B1C112422DF3B85EEBC7F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Krotten.zip:Zone.Identifier

Path C:\Users\Admin\Downloads\Krotten.zip:Zone.Identifier
Size 26B
SHA256 eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913
MD5 fbccf14d504b7b2dbcb5a5bda75bd93b
SHA1 d59fc84cdd5217c6cf74785703655f78da6b582b
SHA512 aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98
MD5 SHA1 SHA512

Submit Download

PowerPoint.zip:Zone.Identifier

Path C:\Users\Admin\Downloads\PowerPoint.zip:Zone.Identifier
Size 239B
SHA256 2c35612c990594c175fc04c96a4af9fedd4881477294de2de3bee9dea1ce42e7
MD5 60f9d78be0974adcd306751fa164ef90
SHA1 307318a392db6cfca6d3b96629df78f825e89ff6
SHA512 be4991b69a4eec668d3eeea97f4b92ddd7c14374236a670711f025da01325de92df7a8bee8d45fbfd647d88944a909137b70de3460e6616d419d1ea318a9ded1
TLSH
T12CD0A7C3F44015180F0771CD36E8A8ADA037305484F46716FEE0C90F755028A71DFB16
MD5 SHA1 SHA512 TLSH

Submit Download

BD40.tmp

Path C:\Windows\BD40.tmp
Size 60KB
SHA256 301b905eb98d8d6bb559c04bbda26628a942b2c4107c07a02e8f753bdcfe347c
MD5 347ac3b6b791054de3e5720a7144a977
SHA1 413eba3973a15c1a6429d9f170f3e8287f98c21c
SHA512 9a399916bc681964af1e1061bc0a8e2926307642557539ad587ce6f9b5ef93bdf1820fe5d7b5ffe5f0bb38e5b4dc6add213ba04048c0c7c264646375fcd01787
SSDEEP 1536:QeRCKjey4TTGLeBYEUW1SIUDoCB449rHUV:KKjey4TTmeBZUGSIUDoCq49oV
TLSH
T1E6536C5A23A441F8E5679231C8B1ED16E7B2B8461370834F02A8C6AB5FB37D19D3C772
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cscc.dat

Path C:\Windows\cscc.dat
Size 205KB
SHA256 0b2f863f4119dc88a22cc97c0a136c88a0127cb026751303b045f7322a8972f6
MD5 edb72f4a46c39452d1a5414f7d26454a
SHA1 08f94684e83a27f2414f439975b7f8a6d61fc056
SHA512 d62a19436aba8b2d181c065076b4ab54d7d8159d71237f83f1aff8c3d132a80290af39a8142708acb468d78958c64f338ba6ad0cab9fbac001a6a0bddc0e4faa
SSDEEP 3072:zCBsPmcx7BTn/irEsrDUxo2vYsWwYEJOXKVviEWuwlVBgzUMqqDLW+z3AHW5:8sPnBT/irETNWiJOXKVvKBgz3qqDL1zt
TLSH
T19D244D8D91B90494ECA3D0B5DFE98BD1F2273108C399F9E732A695F0A7235D4263DE06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

infpub.dat

Path C:\Windows\infpub.dat
Size 401KB
SHA256 579fd8a0385482fb4c789561a30b09f25671e86422f40ef5cca2036b28f99648
MD5 1d724f95c61f1055f0d02c2154bbccd3
SHA1 79116fe99f2b421c52ef64097f0f39b815b20907
SHA512 f2d7b018d1516df1c97cfff5507957c75c6d9bf8e2ce52ae0052706f4ec62f13eba6d7be17e6ad2b693fdd58e1fd091c37f17bd2b948cdcd9b95b4ad428c0113
SSDEEP 12288:GtDjvhNTc/cq4RKZZKfArRuSA80m+/6sXRnfPGp:IjTc/cq4RUZaArbInfPGp
TLSH
T11094129332A00072D1B3893025A57B274FBEF5125CA45DEFA9BB19A51DB07C2BE2534F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

infpub.dat

Path C:\Windows\infpub.dat
Size 401KB
SHA256 a96e54ac864ab635e4b05b29404555c56ec5bcd50183384de3a724c4c80334dd
MD5 2b2479fe80dde99dd497a1ca41d5aa23
SHA1 19116ce6ff6d859a91d5a9c7828b6b793c431479
SHA512 d6ad7e7216073181d36002c704a1ffbe9823ebf8fac85a21f8d98fe21d6d28f0de338fbf7d7e7f857056c04a14729b8406db77a47b3dbd26bc873dd2ff9f4b37
SSDEEP 6144:GWSND4t+jmehNTBi//cq4RCrZZKfA4gbdl:GtDjvhNTc/cq4RKZZKfArR
TLSH
T16994E25672E101A3D172977024D12F670FEFFC2248759DEB9EAB1D6E1830582FE2874A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1944-1031-0x0000000000010000-0x0000000000047000-memory.dmp

Download

memory/3192-1042-0x0000000001520000-0x0000000001588000-memory.dmp

Download

memory/3192-1035-0x0000000001520000-0x0000000001588000-memory.dmp

Download

memory/5556-1221-0x000000002AA00000-0x000000002AA24000-memory.dmp

Download

memory/5556-1222-0x000000002AA00000-0x000000002AA24000-memory.dmp

Download

memory/5844-990-0x00000000014D0000-0x0000000001538000-memory.dmp

Download

memory/5844-987-0x00000000014D0000-0x0000000001538000-memory.dmp

Download

memory/5844-980-0x00000000014D0000-0x0000000001538000-memory.dmp

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads