danabot | 66b077c58bca07756617e3469e3a6238dae76d411a14bc9b7d4986a7cecf6e16

Analysis

max time kernel
287s
max time network
290s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
04-08-2024 01:21

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

Gabriel's Message to Bike Thief (320 kbps).mp3
Size

1.2MB
MD5

31d707645793d1a2bec01c0aea70544d
SHA1

75cebdbbd30eef5e342ec5405a953b7d3f65cc0b
SHA256

66b077c58bca07756617e3469e3a6238dae76d411a14bc9b7d4986a7cecf6e16
SHA512

1ea3d5fcecb660ff9edcccc654c42472b86eb3971b0d864f7a82c509c046a544185c9d103450c618eaf66e3abc5a65cf846ee480a5e3e5a0325c3961b07a0571
SSDEEP

24576:B2lSxkffvOVT7lnR12C4KzvAs7bTMOYZ1byhlBjVnL5r:UAiv675ikTfMOCyZVV

Score

10^/10

danabot floxif backdoor banker botnet defense_evasion discovery macro persistence trojan upx xlm

Malware Config

Extracted

Language

xlm4.0

Source

URLs

xlm40.dropper

https://erpoweredent.at/3/zte.dll

Extracted

Family

danabot

51.178.195.151

51.222.39.81

149.255.35.125

38.68.50.179

51.77.7.204

rsa_pubkey.plain

Signatures

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Danabot x86 payload 1 IoCs

Detection of Danabot x86 payload, mapped in memory during the execution of its loader.

botnet

Processes:

resource	yara_rule
C:\Users\Admin\DOWNLO~1\THE-MA~1\THE-MA~1\BANKIN~1\DanaBot.dll	family_danabot

Floxif, Floodfix
Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
backdoor trojan floxif

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

rundll32.exe

description	pid	pid_target	process	target process
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	5596	2548	rundll32.exe	EXCEL.EXE

Detects Floxif payload 1 IoCs

backdoor

Processes:

resource	yara_rule
C:\Program Files\Common Files\System\symsrv.dll	floxif

Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow pid process

155 4452 rundll32.exe
Downloads MZ/PE file

flow	pid	process
155	4452	rundll32.exe

Suspicious Office macro 1 IoCs

Office document equipped with 4.0 macros.

macro xlm

Processes:

resource	yara_rule
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Banking-Malware\Zloader.xlsm	office_xlm_macros

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

Processes:

resource	yara_rule
C:\Program Files\Common Files\System\symsrv.dll	acprotect

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

FreeYoutubeDownloader.exeFreeYoutubeDownloader.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation	FreeYoutubeDownloader.exe
Key value queried	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation	FreeYoutubeDownloader.exe

Executes dropped EXE 11 IoCs

Processes:

BlueScreen.exeBlueScreen.exeFreeYoutubeDownloader.exeFree YouTube Downloader.exeFreeYoutubeDownloader.exeFreeYoutubeDownloader.exeFree YouTube Downloader.exe6AdwCleaner.exeAV.EXEAV2.EXEDB.EXE

pid	process
5256	BlueScreen.exe
5700	BlueScreen.exe
4444	FreeYoutubeDownloader.exe
1096	Free YouTube Downloader.exe
5952	FreeYoutubeDownloader.exe
5836	FreeYoutubeDownloader.exe
2608	Free YouTube Downloader.exe
2544	6AdwCleaner.exe
1640	AV.EXE
3888	AV2.EXE
1056	DB.EXE

Loads dropped DLL 4 IoCs

Processes:

regsvr32.exerundll32.exeFloxif.exe

pid process

3652 regsvr32.exe
3652 regsvr32.exe
4452 rundll32.exe
5992 Floxif.exe

pid	process
3652	regsvr32.exe
3652	regsvr32.exe
4452	rundll32.exe
5992	Floxif.exe

UPX packed file 14 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Users\Admin\Downloads\BlueScreen.exe	upx
behavioral2/memory/5256-561-0x0000000000400000-0x0000000000409000-memory.dmp	upx
behavioral2/memory/5256-563-0x0000000000400000-0x0000000000409000-memory.dmp	upx
behavioral2/memory/5700-586-0x0000000000400000-0x0000000000409000-memory.dmp	upx
C:\Program Files\Common Files\System\symsrv.dll	upx
behavioral2/memory/5992-946-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/5992-949-0x0000000010000000-0x0000000010030000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\DB.EXE	upx
behavioral2/memory/3976-1002-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/memory/1056-995-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral2/memory/1056-990-0x0000000000660000-0x00000000006F3000-memory.dmp	upx
behavioral2/memory/1056-989-0x0000000000660000-0x00000000006F3000-memory.dmp	upx
behavioral2/memory/1056-985-0x0000000000660000-0x00000000006F3000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\EN.EXE	upx

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

FreeYoutubeDownloader.exeFreeYoutubeDownloader.exe6AdwCleaner.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Free Youtube Downloader = "C:\\Windows\\Free Youtube Downloader\\Free Youtube Downloader\\Free YouTube Downloader.exe"	FreeYoutubeDownloader.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Free Youtube Downloader = "C:\\Windows\\Free Youtube Downloader\\Free Youtube Downloader\\Free YouTube Downloader.exe"	FreeYoutubeDownloader.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AdwCleaner = "\"C:\\Users\\Admin\\AppData\\Local\\6AdwCleaner.exe\" -auto"	6AdwCleaner.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops desktop.ini file(s) 7 IoCs

Processes:

wmplayer.exe

description	ioc	process
File opened for modification	C:\Users\Public\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	wmplayer.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

unregmp2.exeEXCEL.EXEwmplayer.exe

description	ioc	process
File opened (read-only)	\??\Z:	unregmp2.exe
File opened (read-only)	\??\K:	unregmp2.exe
File opened (read-only)	\??\G:	EXCEL.EXE
File opened (read-only)	\??\T:	unregmp2.exe
File opened (read-only)	\??\Y:	unregmp2.exe
File opened (read-only)	\??\H:	EXCEL.EXE
File opened (read-only)	\??\R:	wmplayer.exe
File opened (read-only)	\??\Y:	wmplayer.exe
File opened (read-only)	\??\E:	EXCEL.EXE
File opened (read-only)	\??\P:	unregmp2.exe
File opened (read-only)	\??\E:	wmplayer.exe
File opened (read-only)	\??\P:	wmplayer.exe
File opened (read-only)	\??\S:	wmplayer.exe
File opened (read-only)	\??\I:	EXCEL.EXE
File opened (read-only)	\??\M:	EXCEL.EXE
File opened (read-only)	\??\U:	EXCEL.EXE
File opened (read-only)	\??\H:	wmplayer.exe
File opened (read-only)	\??\N:	wmplayer.exe
File opened (read-only)	\??\S:	EXCEL.EXE
File opened (read-only)	\??\T:	EXCEL.EXE
File opened (read-only)	\??\U:	unregmp2.exe
File opened (read-only)	\??\V:	unregmp2.exe
File opened (read-only)	\??\M:	wmplayer.exe
File opened (read-only)	\??\A:	unregmp2.exe
File opened (read-only)	\??\B:	unregmp2.exe
File opened (read-only)	\??\O:	unregmp2.exe
File opened (read-only)	\??\J:	wmplayer.exe
File opened (read-only)	\??\K:	wmplayer.exe
File opened (read-only)	\??\L:	wmplayer.exe
File opened (read-only)	\??\K:	EXCEL.EXE
File opened (read-only)	\??\L:	EXCEL.EXE
File opened (read-only)	\??\V:	EXCEL.EXE
File opened (read-only)	\??\J:	unregmp2.exe
File opened (read-only)	\??\W:	unregmp2.exe
File opened (read-only)	\??\B:	wmplayer.exe
File opened (read-only)	\??\N:	EXCEL.EXE
File opened (read-only)	\??\I:	unregmp2.exe
File opened (read-only)	\??\X:	wmplayer.exe
File opened (read-only)	\??\B:	EXCEL.EXE
File opened (read-only)	\??\X:	EXCEL.EXE
File opened (read-only)	\??\G:	unregmp2.exe
File opened (read-only)	\??\H:	unregmp2.exe
File opened (read-only)	\??\M:	unregmp2.exe
File opened (read-only)	\??\A:	wmplayer.exe
File opened (read-only)	\??\Q:	wmplayer.exe
File opened (read-only)	\??\Z:	wmplayer.exe
File opened (read-only)	\??\R:	EXCEL.EXE
File opened (read-only)	\??\L:	unregmp2.exe
File opened (read-only)	\??\A:	EXCEL.EXE
File opened (read-only)	\??\Q:	EXCEL.EXE
File opened (read-only)	\??\W:	EXCEL.EXE
File opened (read-only)	\??\E:	unregmp2.exe
File opened (read-only)	\??\S:	unregmp2.exe
File opened (read-only)	\??\G:	wmplayer.exe
File opened (read-only)	\??\O:	wmplayer.exe
File opened (read-only)	\??\T:	wmplayer.exe
File opened (read-only)	\??\U:	wmplayer.exe
File opened (read-only)	\??\Y:	EXCEL.EXE
File opened (read-only)	\??\Z:	EXCEL.EXE
File opened (read-only)	\??\N:	unregmp2.exe
File opened (read-only)	\??\J:	EXCEL.EXE
File opened (read-only)	\??\Q:	unregmp2.exe
File opened (read-only)	\??\R:	unregmp2.exe
File opened (read-only)	\??\X:	unregmp2.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

107 raw.githubusercontent.com
108 raw.githubusercontent.com
Drops file in Program Files directory 1 IoCs

Processes:

Floxif.exe

description ioc process

File created C:\Program Files\Common Files\System\symsrv.dll Floxif.exe

flow	ioc
107	raw.githubusercontent.com
108	raw.githubusercontent.com

description	ioc	process
File created	C:\Program Files\Common Files\System\symsrv.dll	Floxif.exe

Drops file in Windows directory 11 IoCs

Processes:

svchost.exeFreeYoutubeDownloader.exeFreeYoutubeDownloader.exeFreeYoutubeDownloader.exe

description	ioc	process
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll	svchost.exe
File opened for modification	C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Free YouTube Downloader.exe	FreeYoutubeDownloader.exe
File opened for modification	C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe	FreeYoutubeDownloader.exe
File opened for modification	C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Uninstall.ini	FreeYoutubeDownloader.exe
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll	svchost.exe
File opened for modification	C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Free YouTube Downloader.exe	FreeYoutubeDownloader.exe
File opened for modification	C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe	FreeYoutubeDownloader.exe
File opened for modification	C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Uninstall.exe	FreeYoutubeDownloader.exe
File created	C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Uninstall.ini	FreeYoutubeDownloader.exe
File opened for modification	C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Free YouTube Downloader.exe	FreeYoutubeDownloader.exe
File opened for modification	C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Uninstall.exe	FreeYoutubeDownloader.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 3 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exe

pid pid_target process target process

5260 5432 WerFault.exe YouAreAnIdiot.exe
928 5420 WerFault.exe DanaBot.exe
4332 5992 WerFault.exe Floxif.exe

pid	pid_target	process	target process
5260	5432	WerFault.exe	YouAreAnIdiot.exe
928	5420	WerFault.exe	DanaBot.exe
4332	5992	WerFault.exe	Floxif.exe

System Location Discovery: System Language Discovery 1 TTPs 19 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

AV2.EXEDB.EXEFreeYoutubeDownloader.exeCurfun.exeFloxif.exeAV.EXETime.exeDanaBot.exeregsvr32.exewmplayer.exeunregmp2.exeFreeYoutubeDownloader.exeFreeYoutubeDownloader.exeBlueScreen.exeYouAreAnIdiot.exeBlueScreen.exeAdwereCleaner.exerundll32.exeAna.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AV2.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DB.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FreeYoutubeDownloader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Curfun.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Floxif.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AV.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Time.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DanaBot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmplayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	unregmp2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FreeYoutubeDownloader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FreeYoutubeDownloader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BlueScreen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	YouAreAnIdiot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BlueScreen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AdwereCleaner.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ana.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

taskmgr.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXEmsedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE

Modifies registry class 24 IoCs

Processes:

OpenWith.exemsedge.exewmplayer.exeOpenWith.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\md_auto_file\shell\edit	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\￐￐￐ￛ䁖뵓᪾ᐅ\ = "md_auto_file"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\\ = "md_auto_file"	OpenWith.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-656926755-4116854191-210765258-1000\{1AA5FA84-DDF5-475D-8581-0AE600DA820E}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\md_auto_file	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\.md\ = "md_auto_file"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\md_auto_file\shell\open	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\md_auto_file\shell\open\command\ = "%SystemRoot%\\system32\\NOTEPAD.EXE %1"	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\md_auto_file\shell\edit\command\ = "%SystemRoot%\\system32\\NOTEPAD.EXE %1"	OpenWith.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-656926755-4116854191-210765258-1000\{45F4B5D4-271E-4A08-962A-3B5978AB2F5E}	wmplayer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-wmplayer\CLSID = "{cd3afa96-b84f-48f0-9393-7edc34128127}"	wmplayer.exe
Key created	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\md_auto_file\shell	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\\ = "md_auto_file"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\md_auto_file\shell\edit\command	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\md_auto_file\shell\open\command	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-wmplayer	wmplayer.exe
Key created	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\.md	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\￐￐￐ￛ䁖뵓᪾ᐅ	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\\ = "md_auto_file"	OpenWith.exe

Modifies system certificate store 2 TTPs 5 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

Processes:

6AdwCleaner.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\8AD5C9987E6F190BD6F5416E2DE44CCD641D8CDA	6AdwCleaner.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\8AD5C9987E6F190BD6F5416E2DE44CCD641D8CDA\Blob = 0300000001000000140000008ad5c9987e6f190bd6f5416e2de44ccd641d8cda140000000100000014000000daed6474149c143cabdd99a9bd5b284d8b3cc9d8040000000100000010000000ff5fbc4290fa389e798467ebd7ae940b0f0000000100000014000000c45627b5584bf62327df60d6185744a2d2f2bcbf190000000100000010000000e843ac3b52ec8c297fa948c9b1fb28195c00000001000000040000000008000018000000010000001000000045ed9bbc5e43d3b9ecd63c060db78e5c4b0000000100000044000000350034003500370041003800430045003400420032004100370034003900390046003800320039003900410030003100330042003600450031004300370043005f000000200000000100000088040000308204843082036ca0030201020210421af2940984191f520a4bc62426a74b300d06092a864886f70d0101050500306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74301e170d3035303630373038303931305a170d3230303533303130343833385a308195310b3009060355040613025553310b3009060355040813025554311730150603550407130e53616c74204c616b652043697479311e301c060355040a131554686520555345525452555354204e6574776f726b3121301f060355040b1318687474703a2f2f7777772e7573657274727573742e636f6d311d301b0603550403131455544e2d5553455246697273742d4f626a65637430820122300d06092a864886f70d01010105000382010f003082010a0282010100ceaa813fa3a36178aa31005595119e270f1f1cdf3a9b826830c04a611df12f0efabe79f7a523ef55519684cddbe3b96e3e31d80a2067c7f4d9bf94eb47043e02ce2aa25d870409f6309d188a97b2aa1cfc41d2a136cbfb3d91bae7d97035fae4e790c39ba39bd33cf5129977b1b709e068e61cb8f39463886a6afe0b76c9bef422e467b9ab1a5e77c18507dd0d6cbfee06c7776a419ea70fd7fbee9417b7fc85bea4abc41c31ddd7b6d1e4f0efdf168fb25293d7a1d489a1072ebfe10112421e1ae1d89534db647928ffba2e11c2e5e85b9248fb470bc26cdaad328341f3a5e54170fd65906dfafa51c4f9bd962b19042cd36da7dcf07f6f8365e26aab8786750203010001a381f43081f1301f0603551d23041830168014adbd987a34b426f7fac42654ef03bde024cb541a301d0603551d0e04160414daed6474149c143cabdd99a9bd5b284d8b3cc9d8300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff30110603551d20040a300830060604551d200030440603551d1f043d303b3039a037a0358633687474703a2f2f63726c2e7573657274727573742e636f6d2f416464547275737445787465726e616c4341526f6f742e63726c303506082b0601050507010104293027302506082b060105050730018619687474703a2f2f6f6373702e7573657274727573742e636f6d300d06092a864886f70d010105050003820101004d422fa6c18aeb07809058468cf81939662a3c5a2c6dcfd4d987558d790b12887b408fd5c7f84b8d551663adb757dc3b2bbdd3c14f1e03874b449be3e2404526f326492b6a84f1547ad442dafcd36abb667eca9eeae9bbdc07c7c3924e833c81499f92d53209ea492ea111719a36d2c54e68b6cb0e1b2516af6cde5d76d81f72b193268617db18deaf45e9dffb98af1418eda45ef6899445f055044addff27dd064a40f6b4bcf1e40f9902bbfd5d0e2e28c1be3b5f1a3f971084bc163ed8a39c631d66cb5c5fda3ef30f0a093522dbdbc03f00f9e60d5d67d1fda01e032bd940f7becc87665480a6a3b8f51962d5d226b19826ee9acb44a7455a8195151af551	6AdwCleaner.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\02FAF3E291435468607857694DF5E45B68851868	6AdwCleaner.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\02FAF3E291435468607857694DF5E45B68851868\Blob = 0f000000010000001400000009b9105c5bba24343ca7f341c624e183f6ee7c1b090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b00000001000000260000005300650063007400690067006f00200028004100640064005400720075007300740029000000620000000100000020000000687fa451382278fff0c8b11f8d43d576671c6eb2bceab413fb83d965d06d2ff2140000000100000014000000adbd987a34b426f7fac42654ef03bde024cb541a1d000000010000001000000006f9583c00a763c23fb9e065a3366d557e0000000100000008000000000063f58926d70168000000010000000800000000409120d035d90103000000010000001400000002faf3e291435468607857694df5e45b6885186820000000010000003a040000308204363082031ea003020102020101300d06092a864886f70d0101050500306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74301e170d3030303533303130343833385a170d3230303533303130343833385a306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100b7f71a33e6f200042d39e04e5bed1fbc6c0fcdb5fa23b6cede9b113397a4294c7d939fbd4abc93ed031ae38fcfe56d505ad69729945a80b0497adb2e95fdb8cabf37382d1e3e9141ad7056c7f04f3fe8329e74cac89054e9c65f0f789d9a403c0eac61aa5e148f9e87a16a50dcd79a4eaf05b3a671949c71b350600ac7139d38078602a8e9a869261890ab4cb04f23ab3a4f84d8dfce9fe1696fbbd742d76b44e4c7adee6d415f725a710837b37965a459a09437f7002f0dc29272dad03872db14a845c45d2a7db7b4d6c4eeaccd1344b7c92bdd430025fa61b9696a582311b7a7338f567559f5cd29d746b70a2b65b6d3426f15b2b87bfbefe95d53d5345a270203010001a381dc3081d9301d0603551d0e04160414adbd987a34b426f7fac42654ef03bde024cb541a300b0603551d0f040403020106300f0603551d130101ff040530030101ff3081990603551d2304819130818e8014adbd987a34b426f7fac42654ef03bde024cb541aa173a471306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74820101300d06092a864886f70d01010505000382010100b09be08525c2d623e20f9606929d41989cd9847981d91e5b14072336658fb0d877bbac416c47608351b0f9323de7fcf62613c78016a5bf5afc87cf787989219ae24c070a8635bcf2de51c4d296b7dc7e4eee70fd1c39eb0c0251142d8ebd16e0c1df4675e724adecf442b48593701067ba9d06354a18d32b7acc5142a17a63d1e6bba1c52bc236be130de6bd637e797ba7090d40ab6add8f8ac3f6f68c1a420551d445f59fa76221681520433c99e77cbd24d8a9911773883f561b313818b4710f9acdc80e9e8e2e1be18c9883cb1f31f1444cc604734976600fc7f8bd17806b2ee9cc4c0e5a9a790f200a2ed59e63261e559294d882175a7bd0bcc78f4e8604	6AdwCleaner.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\02FAF3E291435468607857694DF5E45B68851868\Blob = 19000000010000001000000045ed9bbc5e43d3b9ecd63c060db78e5c03000000010000001400000002faf3e291435468607857694df5e45b6885186868000000010000000800000000409120d035d9017e0000000100000008000000000063f58926d7011d000000010000001000000006f9583c00a763c23fb9e065a3366d55140000000100000014000000adbd987a34b426f7fac42654ef03bde024cb541a620000000100000020000000687fa451382278fff0c8b11f8d43d576671c6eb2bceab413fb83d965d06d2ff20b00000001000000260000005300650063007400690067006f0020002800410064006400540072007500730074002900000053000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f000000010000001400000009b9105c5bba24343ca7f341c624e183f6ee7c1b20000000010000003a040000308204363082031ea003020102020101300d06092a864886f70d0101050500306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74301e170d3030303533303130343833385a170d3230303533303130343833385a306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100b7f71a33e6f200042d39e04e5bed1fbc6c0fcdb5fa23b6cede9b113397a4294c7d939fbd4abc93ed031ae38fcfe56d505ad69729945a80b0497adb2e95fdb8cabf37382d1e3e9141ad7056c7f04f3fe8329e74cac89054e9c65f0f789d9a403c0eac61aa5e148f9e87a16a50dcd79a4eaf05b3a671949c71b350600ac7139d38078602a8e9a869261890ab4cb04f23ab3a4f84d8dfce9fe1696fbbd742d76b44e4c7adee6d415f725a710837b37965a459a09437f7002f0dc29272dad03872db14a845c45d2a7db7b4d6c4eeaccd1344b7c92bdd430025fa61b9696a582311b7a7338f567559f5cd29d746b70a2b65b6d3426f15b2b87bfbefe95d53d5345a270203010001a381dc3081d9301d0603551d0e04160414adbd987a34b426f7fac42654ef03bde024cb541a300b0603551d0f040403020106300f0603551d130101ff040530030101ff3081990603551d2304819130818e8014adbd987a34b426f7fac42654ef03bde024cb541aa173a471306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74820101300d06092a864886f70d01010505000382010100b09be08525c2d623e20f9606929d41989cd9847981d91e5b14072336658fb0d877bbac416c47608351b0f9323de7fcf62613c78016a5bf5afc87cf787989219ae24c070a8635bcf2de51c4d296b7dc7e4eee70fd1c39eb0c0251142d8ebd16e0c1df4675e724adecf442b48593701067ba9d06354a18d32b7acc5142a17a63d1e6bba1c52bc236be130de6bd637e797ba7090d40ab6add8f8ac3f6f68c1a420551d445f59fa76221681520433c99e77cbd24d8a9911773883f561b313818b4710f9acdc80e9e8e2e1be18c9883cb1f31f1444cc604734976600fc7f8bd17806b2ee9cc4c0e5a9a790f200a2ed59e63261e559294d882175a7bd0bcc78f4e8604	6AdwCleaner.exe

NTFS ADS 2 IoCs

Processes:

msedge.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 839690.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 517791.crdownload:SmartScreen	msedge.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid process

2548 EXCEL.EXE

pid	process
2548	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exetaskmgr.exe

pid	process
4304	msedge.exe
4304	msedge.exe
4364	msedge.exe
4364	msedge.exe
5044	identity_helper.exe
5044	identity_helper.exe
5916	msedge.exe
5916	msedge.exe
3516	msedge.exe
3516	msedge.exe
1528	msedge.exe
1528	msedge.exe
5712	msedge.exe
5712	msedge.exe
5712	msedge.exe
5712	msedge.exe
3668	msedge.exe
3668	msedge.exe
3316	taskmgr.exe
3316	taskmgr.exe
3316	taskmgr.exe
3316	taskmgr.exe
3316	taskmgr.exe
3316	taskmgr.exe
3316	taskmgr.exe
3316	taskmgr.exe
3316	taskmgr.exe
3316	taskmgr.exe
3316	taskmgr.exe
3316	taskmgr.exe
3316	taskmgr.exe
3316	taskmgr.exe
3316	taskmgr.exe
3316	taskmgr.exe
3316	taskmgr.exe
3316	taskmgr.exe
3316	taskmgr.exe
3316	taskmgr.exe
3316	taskmgr.exe
3316	taskmgr.exe
3316	taskmgr.exe
3316	taskmgr.exe
3316	taskmgr.exe
3316	taskmgr.exe
3316	taskmgr.exe
3316	taskmgr.exe
3316	taskmgr.exe
3316	taskmgr.exe
3316	taskmgr.exe
3316	taskmgr.exe
3316	taskmgr.exe
3316	taskmgr.exe
3316	taskmgr.exe
3316	taskmgr.exe
3316	taskmgr.exe
3316	taskmgr.exe
3316	taskmgr.exe
3316	taskmgr.exe
3316	taskmgr.exe
3316	taskmgr.exe
3316	taskmgr.exe
3316	taskmgr.exe
3316	taskmgr.exe
3316	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

Processes:

OpenWith.exetaskmgr.exe

pid process

3260 OpenWith.exe
3316 taskmgr.exe

pid	process
3260	OpenWith.exe
3316	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs

Processes:

msedge.exe

pid	process
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe

Suspicious use of AdjustPrivilegeToken 18 IoCs

Processes:

unregmp2.exewmplayer.exeAUDIODG.EXEtaskmgr.exeTime.exe6AdwCleaner.exeFloxif.exe

description	pid	process
Token: SeShutdownPrivilege	860	unregmp2.exe
Token: SeCreatePagefilePrivilege	860	unregmp2.exe
Token: SeShutdownPrivilege	3436	wmplayer.exe
Token: SeCreatePagefilePrivilege	3436	wmplayer.exe
Token: 33	1840	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1840	AUDIODG.EXE
Token: SeShutdownPrivilege	3436	wmplayer.exe
Token: SeCreatePagefilePrivilege	3436	wmplayer.exe
Token: SeDebugPrivilege	3316	taskmgr.exe
Token: SeSystemProfilePrivilege	3316	taskmgr.exe
Token: SeCreateGlobalPrivilege	3316	taskmgr.exe
Token: SeShutdownPrivilege	3436	wmplayer.exe
Token: SeCreatePagefilePrivilege	3436	wmplayer.exe
Token: SeSystemtimePrivilege	3608	Time.exe
Token: SeDebugPrivilege	2544	6AdwCleaner.exe
Token: SeSystemtimePrivilege	3608	Time.exe
Token: SeDebugPrivilege	5992	Floxif.exe
Token: SeSystemtimePrivilege	3608	Time.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

wmplayer.exemsedge.exe

pid	process
3436	wmplayer.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe

Suspicious use of SendNotifyMessage 64 IoCs

Processes:

msedge.exeFree YouTube Downloader.exeFree YouTube Downloader.exetaskmgr.exe

pid	process
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
1096	Free YouTube Downloader.exe
2608	Free YouTube Downloader.exe
3316	taskmgr.exe
3316	taskmgr.exe
3316	taskmgr.exe
3316	taskmgr.exe
3316	taskmgr.exe
3316	taskmgr.exe
3316	taskmgr.exe
3316	taskmgr.exe
3316	taskmgr.exe
3316	taskmgr.exe
3316	taskmgr.exe
3316	taskmgr.exe
3316	taskmgr.exe
3316	taskmgr.exe
3316	taskmgr.exe
3316	taskmgr.exe
3316	taskmgr.exe
3316	taskmgr.exe
3316	taskmgr.exe
3316	taskmgr.exe
3316	taskmgr.exe
3316	taskmgr.exe
3316	taskmgr.exe
3316	taskmgr.exe
3316	taskmgr.exe
3316	taskmgr.exe
3316	taskmgr.exe
3316	taskmgr.exe
3316	taskmgr.exe
3316	taskmgr.exe
3316	taskmgr.exe
3316	taskmgr.exe

Suspicious use of SetWindowsHookEx 43 IoCs

Processes:

FreeYoutubeDownloader.exeOpenWith.exeOpenWith.exe6AdwCleaner.exeEXCEL.EXE

pid	process
5836	FreeYoutubeDownloader.exe
3260	OpenWith.exe
3260	OpenWith.exe
3260	OpenWith.exe
3260	OpenWith.exe
3260	OpenWith.exe
3260	OpenWith.exe
3260	OpenWith.exe
3260	OpenWith.exe
3260	OpenWith.exe
3260	OpenWith.exe
3260	OpenWith.exe
3260	OpenWith.exe
3260	OpenWith.exe
3260	OpenWith.exe
3260	OpenWith.exe
3260	OpenWith.exe
3260	OpenWith.exe
3260	OpenWith.exe
3260	OpenWith.exe
3260	OpenWith.exe
3260	OpenWith.exe
2300	OpenWith.exe
2300	OpenWith.exe
2300	OpenWith.exe
2300	OpenWith.exe
2300	OpenWith.exe
2544	6AdwCleaner.exe
2544	6AdwCleaner.exe
2548	EXCEL.EXE
2548	EXCEL.EXE
2548	EXCEL.EXE
2548	EXCEL.EXE
2548	EXCEL.EXE
2548	EXCEL.EXE
2548	EXCEL.EXE
2548	EXCEL.EXE
2548	EXCEL.EXE
2548	EXCEL.EXE
2548	EXCEL.EXE
2548	EXCEL.EXE
2548	EXCEL.EXE
2548	EXCEL.EXE

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

wmplayer.exeunregmp2.exemsedge.exe

description	pid	process	target process
PID 3436 wrote to memory of 2472	3436	wmplayer.exe	unregmp2.exe
PID 3436 wrote to memory of 2472	3436	wmplayer.exe	unregmp2.exe
PID 3436 wrote to memory of 2472	3436	wmplayer.exe	unregmp2.exe
PID 2472 wrote to memory of 860	2472	unregmp2.exe	unregmp2.exe
PID 2472 wrote to memory of 860	2472	unregmp2.exe	unregmp2.exe
PID 4364 wrote to memory of 2684	4364	msedge.exe	msedge.exe
PID 4364 wrote to memory of 2684	4364	msedge.exe	msedge.exe
PID 4364 wrote to memory of 5056	4364	msedge.exe	msedge.exe
PID 4364 wrote to memory of 5056	4364	msedge.exe	msedge.exe
PID 4364 wrote to memory of 5056	4364	msedge.exe	msedge.exe
PID 4364 wrote to memory of 5056	4364	msedge.exe	msedge.exe
PID 4364 wrote to memory of 5056	4364	msedge.exe	msedge.exe
PID 4364 wrote to memory of 5056	4364	msedge.exe	msedge.exe
PID 4364 wrote to memory of 5056	4364	msedge.exe	msedge.exe
PID 4364 wrote to memory of 5056	4364	msedge.exe	msedge.exe
PID 4364 wrote to memory of 5056	4364	msedge.exe	msedge.exe
PID 4364 wrote to memory of 5056	4364	msedge.exe	msedge.exe
PID 4364 wrote to memory of 5056	4364	msedge.exe	msedge.exe
PID 4364 wrote to memory of 5056	4364	msedge.exe	msedge.exe
PID 4364 wrote to memory of 5056	4364	msedge.exe	msedge.exe
PID 4364 wrote to memory of 5056	4364	msedge.exe	msedge.exe
PID 4364 wrote to memory of 5056	4364	msedge.exe	msedge.exe
PID 4364 wrote to memory of 5056	4364	msedge.exe	msedge.exe
PID 4364 wrote to memory of 5056	4364	msedge.exe	msedge.exe
PID 4364 wrote to memory of 5056	4364	msedge.exe	msedge.exe
PID 4364 wrote to memory of 5056	4364	msedge.exe	msedge.exe
PID 4364 wrote to memory of 5056	4364	msedge.exe	msedge.exe
PID 4364 wrote to memory of 5056	4364	msedge.exe	msedge.exe
PID 4364 wrote to memory of 5056	4364	msedge.exe	msedge.exe
PID 4364 wrote to memory of 5056	4364	msedge.exe	msedge.exe
PID 4364 wrote to memory of 5056	4364	msedge.exe	msedge.exe
PID 4364 wrote to memory of 5056	4364	msedge.exe	msedge.exe
PID 4364 wrote to memory of 5056	4364	msedge.exe	msedge.exe
PID 4364 wrote to memory of 5056	4364	msedge.exe	msedge.exe
PID 4364 wrote to memory of 5056	4364	msedge.exe	msedge.exe
PID 4364 wrote to memory of 5056	4364	msedge.exe	msedge.exe
PID 4364 wrote to memory of 5056	4364	msedge.exe	msedge.exe
PID 4364 wrote to memory of 5056	4364	msedge.exe	msedge.exe
PID 4364 wrote to memory of 5056	4364	msedge.exe	msedge.exe
PID 4364 wrote to memory of 5056	4364	msedge.exe	msedge.exe
PID 4364 wrote to memory of 5056	4364	msedge.exe	msedge.exe
PID 4364 wrote to memory of 5056	4364	msedge.exe	msedge.exe
PID 4364 wrote to memory of 5056	4364	msedge.exe	msedge.exe
PID 4364 wrote to memory of 5056	4364	msedge.exe	msedge.exe
PID 4364 wrote to memory of 5056	4364	msedge.exe	msedge.exe
PID 4364 wrote to memory of 5056	4364	msedge.exe	msedge.exe
PID 4364 wrote to memory of 5056	4364	msedge.exe	msedge.exe
PID 4364 wrote to memory of 4304	4364	msedge.exe	msedge.exe
PID 4364 wrote to memory of 4304	4364	msedge.exe	msedge.exe
PID 4364 wrote to memory of 632	4364	msedge.exe	msedge.exe
PID 4364 wrote to memory of 632	4364	msedge.exe	msedge.exe
PID 4364 wrote to memory of 632	4364	msedge.exe	msedge.exe
PID 4364 wrote to memory of 632	4364	msedge.exe	msedge.exe
PID 4364 wrote to memory of 632	4364	msedge.exe	msedge.exe
PID 4364 wrote to memory of 632	4364	msedge.exe	msedge.exe
PID 4364 wrote to memory of 632	4364	msedge.exe	msedge.exe
PID 4364 wrote to memory of 632	4364	msedge.exe	msedge.exe
PID 4364 wrote to memory of 632	4364	msedge.exe	msedge.exe
PID 4364 wrote to memory of 632	4364	msedge.exe	msedge.exe
PID 4364 wrote to memory of 632	4364	msedge.exe	msedge.exe
PID 4364 wrote to memory of 632	4364	msedge.exe	msedge.exe
PID 4364 wrote to memory of 632	4364	msedge.exe	msedge.exe
PID 4364 wrote to memory of 632	4364	msedge.exe	msedge.exe
PID 4364 wrote to memory of 632	4364	msedge.exe	msedge.exe

C:\Program Files (x86)\Windows Media Player\wmplayer.exe
"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\Gabriel's Message to Bike Thief (320 kbps).mp3"
1⤵
- Drops desktop.ini file(s)
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3436
- C:\Windows\SysWOW64\unregmp2.exe
  "C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2472
- - C:\Windows\system32\unregmp2.exe
    "C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT
    3⤵
    - Enumerates connected drives
    - Suspicious use of AdjustPrivilegeToken
    PID:860

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s upnphost
1⤵
- Drops file in Windows directory
PID:3220

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffbb90246f8,0x7ffbb9024708,0x7ffbb9024718
  2⤵
  PID:2684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2024,6621142121872914397,5366068278452767148,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2028 /prefetch:2
  2⤵
  PID:5056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2024,6621142121872914397,5366068278452767148,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2024,6621142121872914397,5366068278452767148,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2796 /prefetch:8
  2⤵
  PID:632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,6621142121872914397,5366068278452767148,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3428 /prefetch:1
  2⤵
  PID:4808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,6621142121872914397,5366068278452767148,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3436 /prefetch:1
  2⤵
  PID:4192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,6621142121872914397,5366068278452767148,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4192 /prefetch:1
  2⤵
  PID:2096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,6621142121872914397,5366068278452767148,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5072 /prefetch:1
  2⤵
  PID:4728
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2024,6621142121872914397,5366068278452767148,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5492 /prefetch:8
  2⤵
  PID:1256
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2024,6621142121872914397,5366068278452767148,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5492 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2024,6621142121872914397,5366068278452767148,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=4052 /prefetch:8
  2⤵
  PID:5116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,6621142121872914397,5366068278452767148,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5644 /prefetch:1
  2⤵
  PID:1232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,6621142121872914397,5366068278452767148,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5648 /prefetch:1
  2⤵
  PID:1628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,6621142121872914397,5366068278452767148,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5892 /prefetch:1
  2⤵
  PID:1076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,6621142121872914397,5366068278452767148,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6108 /prefetch:1
  2⤵
  PID:2092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2024,6621142121872914397,5366068278452767148,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5984 /prefetch:8
  2⤵
  PID:5908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2024,6621142121872914397,5366068278452767148,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=6040 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:5916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,6621142121872914397,5366068278452767148,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5580 /prefetch:1
  2⤵
  PID:5216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,6621142121872914397,5366068278452767148,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6136 /prefetch:1
  2⤵
  PID:5620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,6621142121872914397,5366068278452767148,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4044 /prefetch:1
  2⤵
  PID:1616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,6621142121872914397,5366068278452767148,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:1812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,6621142121872914397,5366068278452767148,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5860 /prefetch:1
  2⤵
  PID:5864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,6621142121872914397,5366068278452767148,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6424 /prefetch:1
  2⤵
  PID:4124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,6621142121872914397,5366068278452767148,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1352 /prefetch:1
  2⤵
  PID:768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2024,6621142121872914397,5366068278452767148,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6204 /prefetch:8
  2⤵
  PID:5488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2024,6621142121872914397,5366068278452767148,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1832 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3516
- C:\Users\Admin\Downloads\BlueScreen.exe
  "C:\Users\Admin\Downloads\BlueScreen.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,6621142121872914397,5366068278452767148,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5724 /prefetch:1
  2⤵
  PID:412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2024,6621142121872914397,5366068278452767148,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5700 /prefetch:8
  2⤵
  PID:3264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2024,6621142121872914397,5366068278452767148,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6872 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1528
- C:\Users\Admin\Downloads\FreeYoutubeDownloader.exe
  "C:\Users\Admin\Downloads\FreeYoutubeDownloader.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  PID:4444
- - C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Free YouTube Downloader.exe
    "C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Free YouTube Downloader.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SendNotifyMessage
    PID:1096
- C:\Users\Admin\Downloads\FreeYoutubeDownloader.exe
  "C:\Users\Admin\Downloads\FreeYoutubeDownloader.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  PID:5952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2024,6621142121872914397,5366068278452767148,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3428 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2024,6621142121872914397,5366068278452767148,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1980 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,6621142121872914397,5366068278452767148,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5992 /prefetch:1
  2⤵
  PID:5804

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x498 0x340
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1840

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5000

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:768

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5596

C:\Users\Admin\Downloads\BlueScreen.exe
"C:\Users\Admin\Downloads\BlueScreen.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5700

C:\Users\Admin\Downloads\FreeYoutubeDownloader.exe
"C:\Users\Admin\Downloads\FreeYoutubeDownloader.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5836
- C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Free YouTube Downloader.exe
  "C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Free YouTube Downloader.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SendNotifyMessage
  PID:2608

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /7
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SendNotifyMessage
PID:3316

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Joke\YouAreAnIdiot\WebsiteSourceCode\lol.html
1⤵
PID:5360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbb90246f8,0x7ffbb9024708,0x7ffbb9024718
  2⤵
  PID:5396

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3260
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Joke\YouAreAnIdiot\WebsiteSourceCode\README.md
  2⤵
  PID:1164

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2300
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Joke\YouAreAnIdiot\EXEVersion\README.md
  2⤵
  PID:4588

C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Joke\YouAreAnIdiot\EXEVersion\YouAreAnIdiot.exe
"C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Joke\YouAreAnIdiot\EXEVersion\YouAreAnIdiot.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:5432
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5432 -s 1556
  2⤵
  - Program crash
  PID:5260

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5432 -ip 5432
1⤵
PID:3028

C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Joke\Time.exe
"C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Joke\Time.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3608

C:\Windows\system32\rundll32.exe
C:\Windows\system32\rundll32.exe C:\Windows\system32\PcaSvc.dll,PcaPatchSdbTask
1⤵
PID:4356

C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Joke\Curfun.exe
"C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Joke\Curfun.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2852

C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\rogues\AdwereCleaner.exe
"C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\rogues\AdwereCleaner.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:6044
- C:\Users\Admin\AppData\Local\6AdwCleaner.exe
  "C:\Users\Admin\AppData\Local\6AdwCleaner.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Modifies system certificate store
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2544

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Banking-Malware\Zloader.xlsm"
1⤵
- Enumerates connected drives
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2548
- C:\Windows\System32\rundll32.exe
  "C:\Windows\System32\rundll32.exe" C:\nxTgTGh\ECeMdPT\EnVYsVZ.dll,DllRegisterServer
  2⤵
  - Process spawned unexpected child process
  PID:5596

C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Banking-Malware\DanaBot.exe
"C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Banking-Malware\DanaBot.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:5420
- C:\Windows\SysWOW64\regsvr32.exe
  C:\Windows\system32\regsvr32.exe -s C:\Users\Admin\DOWNLO~1\THE-MA~1\THE-MA~1\BANKIN~1\DanaBot.dll f1 C:\Users\Admin\DOWNLO~1\THE-MA~1\THE-MA~1\BANKIN~1\DanaBot.exe@5420
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:3652
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\DOWNLO~1\THE-MA~1\THE-MA~1\BANKIN~1\DanaBot.dll,f0
    3⤵
    - Blocklisted process makes network request
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:4452
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5420 -s 448
  2⤵
  - Program crash
  PID:928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 5420 -ip 5420
1⤵
PID:3488

C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Virus\Floxif\Floxif.exe
"C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Virus\Floxif\Floxif.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:5992
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5992 -s 432
  2⤵
  - Program crash
  PID:4332

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 5992 -ip 5992
1⤵
PID:6056

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Trojan\BonziKill.txt
1⤵
PID:1980

C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Trojan\Ana.exe
"C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Trojan\Ana.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3676
- C:\Users\Admin\AppData\Local\Temp\AV.EXE
  "C:\Users\Admin\AppData\Local\Temp\AV.EXE"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1640
- C:\Users\Admin\AppData\Local\Temp\AV2.EXE
  "C:\Users\Admin\AppData\Local\Temp\AV2.EXE"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3888
- C:\Users\Admin\AppData\Local\Temp\DB.EXE
  "C:\Users\Admin\AppData\Local\Temp\DB.EXE"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1056
- - C:\Windows\SysWOW64\cmd.exe
    /c C:\Users\Admin\AppData\Local\Temp\~unins5093.bat "C:\Users\Admin\AppData\Local\Temp\DB.EXE"
    3⤵
    PID:5968
- C:\Users\Admin\AppData\Local\Temp\EN.EXE
  "C:\Users\Admin\AppData\Local\Temp\EN.EXE"
  2⤵
  PID:3976
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\EN.EXE > nul
    3⤵
    PID:636
- C:\Users\Admin\AppData\Local\Temp\SB.EXE
  "C:\Users\Admin\AppData\Local\Temp\SB.EXE"
  2⤵
  PID:3516

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Common Files\System\symsrv.dll

Filesize
72KB

MD5
ccf7e487353602c57e2e743d047aca36

SHA1
99f66919152d67a882685a41b7130af5f7703888

SHA256
eaf76e5f1a438478ecf7b678744da34e9d9e5038b128f0c595672ee1dbbfd914

SHA512
dde0366658082b142faa6487245bfc8b8942605f0ede65d12f8c368ff3673ca18e416a4bf132c4bee5be43e94aef0531be2008746c24f1e6b2f294a63ab1486c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\26C212D9399727259664BDFCA073966E_D84AA834FA79E192D6B55D4ECAAD497F

Filesize
313B

MD5
25cc10d3ee6c506d2409cabfaa0b1c73

SHA1
30d5bffe578afee8c5cb2528c6d00385aaaa3712

SHA256
507e21d3b643a1a44dd636994cd455b3cb78e2f90b16537b258172511a53de20

SHA512
3205b908a4ec7f09cdd957ef99d3c4070f17a0ad1d23aa36e50310d99ff7d90ac9af1822a351babf604886778fa274c20e2cc79a45cf6e51278cf84e011cd661

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\26C212D9399727259664BDFCA073966E_D84AA834FA79E192D6B55D4ECAAD497F

Filesize
400B

MD5
b45239c254c1b79d6b272c48c8b1db85

SHA1
fd10723edd2730a93a74ac47a860067b9def74ae

SHA256
bf8415c2f330ba44fa4afbc137d9fc9483d11dba58fa919b09bc60714a12476e

SHA512
6fcc763659aefb9780faaa0a99f5234c149a8067a8032b94f19193133bcbd7bc95f1606d5b6938c0c659990738e78212b17a9e7c829d991371c5807a36dc2f13

Download Submit
C:\Users\Admin\AppData\Local\6AdwCleaner.exe

Filesize
168KB

MD5
87e4959fefec297ebbf42de79b5c88f6

SHA1
eba50d6b266b527025cd624003799bdda9a6bc86

SHA256
4f0033e811fe2497b38f0d45df958829d01933ebe7d331079eefc8e38fbeaa61

SHA512
232fedec0180e85560a226870a244a22f54ca130ed6d6dc95dc02a1ff85f17da396925c9ff27d522067a30ee3e74a38adff375d8752161ee629df14f39cf6ba9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
27304926d60324abe74d7a4b571c35ea

SHA1
78b8f92fcaf4a09eaa786bbe33fd1b0222ef29c1

SHA256
7039ad5c2b40f4d97c8c2269f4942be13436d739b2e1f8feb7a0c9f9fdb931de

SHA512
f5b6181d3f432238c7365f64fc8a373299e23ba8178bcc419471916ef8b23e909787c7c0617ab22e4eb90909c02bd7b84f1386fbc61e2bdb5a0eb474175da4bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9e3fc58a8fb86c93d19e1500b873ef6f

SHA1
c6aae5f4e26f5570db5e14bba8d5061867a33b56

SHA256
828f4eacac1c40b790fd70dbb6fa6ba03dcc681171d9b2a6579626d27837b1c4

SHA512
e5e245b56fa82075e060f468a3224cf2ef43f1b6d87f0351a2102d85c7c897e559be4caeaecfdc4059af29fdc674681b61229319dda95cb2ee649b2eb98d313e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
bba287ae5c359c180b5e904f257f34e8

SHA1
2dac74e13999d1beb6092d863fe68e81eee644f2

SHA256
b87cc4d8a7fa062f4d7a91763636ce97e986259aabf61c1183cac5af89fb4ee2

SHA512
0cd7a22b933cf6aa4534fe8956f42871e61e6ff270ce7294f32b5adceac0c165d6037ac13259542d36e5a07799b8e7d77b1c19d14b1156565e282521175a28bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
92b0d59c627a08094993c215ca17e8ae

SHA1
117ccef45007734257a69464cb60926bfa93db63

SHA256
773bdabf6448c22cf606572a9a9a6ab1a012fe586b6fd632e291eb226700b172

SHA512
b909a4080f6b03d62495deaa92f8283230d31a9e9c895cab5edb6f7227cb4e6179ae19e940e41346c18cbae8c24605f1d0fe1f72edde5efad8b544bbaf9ae8ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
689b8a732229e0530f5553e907d9fc22

SHA1
ee1102f1713a2329dc3fb7a70e19c8b21a79b821

SHA256
bca732d6e8cf6642632e4d23a8a0fb6c7af3bc6ae2fa48539f8234987d1aac9c

SHA512
e20b0b4a2d80f5544e614eb7f38555f10c1f5c5979541466661a1e24208c3d61093b821e7c88cfdaa9aa1347393944693a50c58a1ecc8253898d6404105452d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
fd7495bd5c6ea7083cb2d55ab54a7f0f

SHA1
4637c6101f4634b9e0c57606d8e5dae4bef36c33

SHA256
af35962cedadf9a7b9aeb0a7addfe30d5b7654bb7228a6e79effd3e72d2afcda

SHA512
2624efe6bed40abbf100a79c0d1b1d6119edd5b1eba804d8d7bf46d5a69e059e99f75428b49b051c184d74b795438f952d7fb7a1828d1eaeae73fb75ca618ee7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
81e291688a1a92bce459ec82fe71816b

SHA1
d8699f3a7c99247378e87f16daa840b0026f3f18

SHA256
502c02a250749f821170a1a2408f41f3685cf97d507299f4cd488237da452a2f

SHA512
a4133dc496c1a79766f9c1be3c09b22d3a0830afceb24bea49d2abbc3a56d256c92dc50bd5324a5f47e7f8e045981e804df0290c72bf294a30ddcbe82095bc08

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8ad775222ef8c58ed1332554bafbc63b

SHA1
df7302848d9a2136f50261ba7ccf77343208e2a1

SHA256
aa6a425d7e1d64be0d2f441cb4ebf70410a605b80032add6701aa0b9d15b4166

SHA512
ca07a2986c0b7dfa652db02d9e465585740bfac1c382080e4e78ee2b8f16cc0ea93e1800855718651797391fc8639dc4f5f9294848f073c0028083732b383555

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c015376b8c237edd713658554ee867de

SHA1
2ff2fe9de6f9629e8d7cbbd4eba7b425ee6b2364

SHA256
9d082a3384560b1dd3c3f14f5675e7958c87a0d6c2d878e7f7d475e2a4aa1ff0

SHA512
1361fe0ad9c40f0163f8edd407051ec556814f75a936e0f71c17ee9609e9283c44196924df9312b5c86b54208620caa137f71bdf2ff79ee8bd81233335b7dd7f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
e5f2e4affb245f49bb6f398c5b93ca6d

SHA1
5051e5e0bc9806e63c82efaa552d901c6eb811a7

SHA256
c5eab6c49a434d1aa852fb37ee1ceb368b3e125ad95b8003f66ae5796ef21a2c

SHA512
b3777be0596ea5c133a24d3604ee213e0e74f2b04f1df6299642a90d48b5fa6d831e359d127fdabaae67065ccbd25ef142786ff938d59e396e1dd8058b46eee3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
90775e1ace541e8b14a9cb231ab4a7f6

SHA1
451a3524c5a0c70411f39d4d1a1a49eb9480ec6f

SHA256
1dce8019703f65383c8f783350d9c0669900040fe4fd19b12aedd4a2be1f6ac7

SHA512
2142137796e358a831806a0be47fa53b24d1c1da0b9b8414aedb34ff35d72535ad71c5af44080a2ec7eefb0ddf5d29f881cee16e509eaaf46f8030b3265af5b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
5f97e5aaefdf39a7beabd15069f04848

SHA1
dac414e0f51e137cdbac8c841c903cb4e78aa4ea

SHA256
454234576bb1acca9505002d3bad161806b0afb49bfc8bdc0eae32901bf22abb

SHA512
3cebca8ffe6c8a4c8764e2b5e456a980b9c6d954e48b81a44d681031e8a35dee887e809faac30c813527d1b126c560026d7a7515c13e37cbc6e81ed23a914f6d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
b648dbb4f72d6a76a6e593fc9291e456

SHA1
c6c635b2d6c9ea2d93a6f4fbc356a5d597d59e6d

SHA256
7f4c75e9db7867140144096fc0066bd8613ce92ebec6f4a95d056482a1fb7f94

SHA512
a86264dab0ef92cdf971a26b7b7ce4db8c1b5a3f764e8e4083aed6949eff973d209f1541d7f14cf22a05d7118b206bbbc67ce273c3488a88bf75c6415f358fe3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58d51e.TMP

Filesize
1KB

MD5
0062d18bf0cd44de45d823d594c93740

SHA1
a0357a155ade24a7dc4cdbba965ea02888f0991b

SHA256
99ffb810317bdd54ca931f6798202929a6c70ecdf304e1d43f067aee87efb6ac

SHA512
ab79c3e7ce7b1573228a78fe9173888bcb89233b351f37df0a3a144de7c651eb19f0051cfb4e565863298930b19c215b91232f4a75dadb7240e439545fee8e89

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
35d7f4f3c13bf6b9279d9912ea37fc2f

SHA1
1e23043f448fe4593d453447c743c7e92fff7b62

SHA256
2482f8c14a491f629e6e1a581458f705d75fe873355302139f560de78f6c2953

SHA512
48960790ca2af0215d64d01925d28469b7d6623b84fce7c06f325502e42ba6347ded26f2aae7e8a59a7610a45e5b3a09aeb56276eb90144569d0607200dd23c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
3b5bb3d2baf703a19a58df3a197b664b

SHA1
79d25960e52d9e73ffca94f0c960d9b47e01e9e5

SHA256
b11e636d0f31b71298a2d65fe0fb612c775c5de6b88161413ca90ae59c953043

SHA512
14af407deae64e01c88abf17340dea686728c7c33eafb5bbec5905a41695decf49ed7337cdd4667c8519f19d32843f6eb99b4b5dbac4717f39bea55481223909

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
c3c200a79630e5529b352acae88376bc

SHA1
c30db3fff71236ed8312293d233f00e0d096ba73

SHA256
8756e6ec285b8a43f8866dfdd2131f17876cb703c180c486e768f0584f3419d9

SHA512
b85aeda9cee0411cc83a93575910a2b5baa7e13c508e56ae33f4b85e1e7dfcc85acffcb4ecde4e394b6afbdea075f62b42338de6f8dd47d319d3d156aa8163bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
0069a701367b440a7ea960ddc16dd840

SHA1
f51c108a272c348844d865c36fc7b528cdc30ead

SHA256
cefa20c7b26a53fe96643a161025c8150fc34a41a3981221ed9e0b6f326d9050

SHA512
a10f10166c9bb186380c8f1a73fbd1fdd2bc8e10c56ed3d7d240b9a27793f6bb7e4dbd4bea8c67e0e1821b1c989d08a27cd6314616ad677094107ccd9f9a1559

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
29adb0ccf513f3c47c02704735d6677d

SHA1
9b0cd2a4ca029c24002a7b9bbcaf3ccc70ba0666

SHA256
7b6fd3e5a8fb4118d0a129346d15c2aff8a1e58dea80364704e568bd91c01bcf

SHA512
e1bb939bc08254fe7cd26ab9fca8f978aaf8be417febd778d314de61bab03c1c6cac6a6198f93b99714c7791318a7fa0851286361ce7a225cd69bf64031905fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
f2c2588045bc82624a6577fc114497a3

SHA1
f189e572d1b5f0adbd46120cb42f903b7bbba9bb

SHA256
69dfc639ce9e0d9bc30f564d89dbf874dec5382480d1cd602663ff2a5dae841e

SHA512
ed41402b33b67219b2f993dcc105f1019b90640010bc44b22ee3d3123e1cd52f0be5fd92d19a090c5effa70f023e8963ebda97195784737cb91a344f75376c52

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb

Filesize
256KB

MD5
adbd8353954edbe5e0620c5bdcad4363

SHA1
aeb5c03e8c1b8bc5d55683ea113e6ce1be7ac6e6

SHA256
64eff10c4e866930d32d4d82cc88ec0e6f851ac49164122cae1b27eb3c9d9d55

SHA512
87bf4a2dc4dd5c833d96f3f5cb0b607796414ffee36d5c167a75644bcbb02ab5159aa4aa093ed43abe290481abc01944885c68b1755d9b2c4c583fcccd041fd2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb

Filesize
1024KB

MD5
c7fd8729b2b3ab97c14835d2652d09b5

SHA1
a8c9a64772b7e691bcda98e61b204bf1982bd8fa

SHA256
a0d896cb639fff34b0c05085fc233f5169c8fd7b8da718927ffeaa940dc9e6e7

SHA512
813848be5386a082087cffd0398291e386e5fa37e564adab1727c460772ff338c6b5478782a1d37accda7523489374ff8a1bfc7b6f24143c9c237d23872589bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Media Player\LocalMLS_3.wmdb

Filesize
68KB

MD5
354832167375ee246a66bf0ea6a07277

SHA1
284d7efeca458241765ff2b5cef16ccf1d0c3b0c

SHA256
fe6f6fdbb1b19ca656b4783156b3638462d0a12bfa3a996f7a6d1e69e14035e3

SHA512
557e08123ef6de5ac6ff97979a1aff94a42c4978131bba749036dda18c852b6453d2469008d9929728e654e67bcf703495f6342f711da65edd05835dae4ac6fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\9cd93bc6dcf544bae69531052e64647ec02f2bb4.tbres

Filesize
4KB

MD5
f8e0102ab197633e73848b262822f468

SHA1
8121ef4640b8b1736aed6f3736afa2e1eb863ddd

SHA256
c0d39342218e73d20b6bda1d85de26572c61ab155a325f8c584e5b177a3af0f9

SHA512
ca25f854f552c75466646702301d71f20d3aae5f2f0a74227bfe8f2fee8388fad32b6af51e2ce5e1e9b9ed36035e336333df801e065205aaae1acd94146f3f4b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.DTD

Filesize
498B

MD5
90be2701c8112bebc6bd58a7de19846e

SHA1
a95be407036982392e2e684fb9ff6602ecad6f1e

SHA256
644fbcdc20086e16d57f31c5bad98be68d02b1c061938d2f5f91cbe88c871fbf

SHA512
d618b473b68b48d746c912ac5fc06c73b047bd35a44a6efc7a859fe1162d68015cf69da41a5db504dcbc4928e360c095b32a3b7792fcc6a38072e1ebd12e7cbe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML

Filesize
9KB

MD5
5433eab10c6b5c6d55b7cbd302426a39

SHA1
c5b1604b3350dab290d081eecd5389a895c58de5

SHA256
23dbf7014e99e93af5f2760f18ee1370274f06a453145c8d539b66d798dad131

SHA512
207b40d6bec65ab147f963a5f42263ae5bf39857987b439a4fa1647bf9b40e99cdc43ff68b7e2463aa9a948284126ac3c9c7af8350c91134b36d8b1a9c61fd34

Download Submit
C:\Users\Admin\AppData\Local\Temp\$inst\2.tmp

Filesize
36B

MD5
8708699d2c73bed30a0a08d80f96d6d7

SHA1
684cb9d317146553e8c5269c8afb1539565f4f78

SHA256
a32e0a83001d2c5d41649063217923dac167809cab50ec5784078e41c9ec0f0f

SHA512
38ece3e441cc5d8e97781801d5b19bdede6065a0a50f7f87337039edeeb4a22ad0348e9f5b5542b26236037dd35d0563f62d7f4c4f991c51020552cfae03b264

Download Submit
C:\Users\Admin\AppData\Local\Temp\$inst\temp_0.tmp

Filesize
176KB

MD5
bc82784f4aa47bcfed93e81a3b9950f2

SHA1
f5f2238d45733a6dde53c7b7dfe3645ee8ae3830

SHA256
dd47684334f0a2b716e96f142e8915266d5bc1725853fd0bdc6d06148db6167f

SHA512
d2378f324d430f16ce7dcf1f656b504009b005cdb6df9d5215fe0786c112e8eba8c1650a83192b6a9afad5892a1a456714665233f6767765619ccb5ff28e2b8a

Download Submit
C:\Users\Admin\AppData\Local\Temp\AV.EXE

Filesize
1.1MB

MD5
f284568010505119f479617a2e7dc189

SHA1
e23707625cce0035e3c1d2255af1ed326583a1ea

SHA256
26c8f13ea8dc17443a9fa005610537cb6700aebaf748e747e9278d504e416eb1

SHA512
ebe96e667dfde547c5a450b97cd7534b977f4073c7f4cbc123a0e00baaefeb3be725c1cafbfb5bb040b3359267954cd1b4e2094ef71fc273732016ee822064bf

Download Submit
C:\Users\Admin\AppData\Local\Temp\AV2.EXE

Filesize
368KB

MD5
014578edb7da99e5ba8dd84f5d26dfd5

SHA1
df56d701165a480e925a153856cbc3ab799c5a04

SHA256
4ce5e8b510895abb204f97e883d8cbaacc29ccef0844d9ae81f8666f234b0529

SHA512
bd5159af96d83fc7528956c5b1bd6f93847db18faa0680c6041f87bbebef5e3ba2de1f185d77ff28b8d7d78ec4f7bd54f48b37a16da39f43314ef022b4a36068

Download Submit
C:\Users\Admin\AppData\Local\Temp\DB.EXE

Filesize
243KB

MD5
c6746a62feafcb4fca301f606f7101fa

SHA1
e09cd1382f9ceec027083b40e35f5f3d184e485f

SHA256
b5a255d0454853c8afc0b321e1d86dca22c3dbefb88e5d385d2d72f9bc0109e6

SHA512
ee5dfa08c86bf1524666f0851c729970dbf0b397db9595a2bae01516299344edb68123e976592a83e492f2982fafe8d350ba2d41368eb4ecf4e6fe12af8f5642

Download Submit
C:\Users\Admin\AppData\Local\Temp\EN.EXE

Filesize
6KB

MD5
621f2279f69686e8547e476b642b6c46

SHA1
66f486cd566f86ab16015fe74f50d4515decce88

SHA256
c17a18cf2c243303b8a6688aad83b3e6e9b727fcd89f69065785ef7f1a2a3e38

SHA512
068402b02f1056b722f21b0a354b038f094d02e4a066b332553cd6b36e3640e8f35aa0499a2b057c566718c3593d3cea6bbabd961e04f0a001fd45d8be8e1c4e

Download Submit
C:\Users\Admin\AppData\Local\Temp\GB.EXE

Filesize
149KB

MD5
fe731b4c6684d643eb5b55613ef9ed31

SHA1
cfafe2a14f5413278304920154eb467f7c103c80

SHA256
e7953daad7a68f8634ded31a21a31f0c2aa394ca9232e2f980321f7b69176496

SHA512
f7756d69138df6d3b0ffa47bdf274e5fd8aab4fff9d68abe403728c8497ac58e0f3d28d41710de715f57b7a2b5daa2dd7e04450f19c6d013a08f543bd6fc9c2e

Download Submit
C:\Users\Admin\AppData\Local\Temp\SB.EXE

Filesize
224KB

MD5
9252e1be9776af202d6ad5c093637022

SHA1
6cc686d837cd633d9c2e8bc1eaba5fc364bf71d8

SHA256
ce822ff86e584f15b6abd14c61453bd3b481d4ec3fdeb961787fceb52acd8bd6

SHA512
98b1b3ce4d16d36f738478c6cf41e8f4a57d3a5ecfa8999d45592f79a469d8af8554bf4d5db34cb79cec71ce103f4fde1b41bd3cce30714f803e432e53da71ea

Download Submit
C:\Users\Admin\AppData\Local\Temp\wmsetup.log

Filesize
1KB

MD5
d05d1cb2cd81f21512a5986f9498561b

SHA1
b42e42a2135d5eeec4d233f425408888b47c3f9a

SHA256
3aefc7ad6617e494bb4d47d36e30278d280ae6ecac196f5efeb7b9d8fbddf958

SHA512
de01da8d0674aa18d1603313f1f8796f2916c6910c4aaf373ffa9b72c60c69c6de1ce7d317b377dcb73417de1afd7b9f4779e99fed4f4dbc5b56163a04797dfe

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat

Filesize
374B

MD5
a884ba39b8a2a8b18304943fef8008ba

SHA1
333a84b32f9b6059798e6bfd3cd1033614ca3456

SHA256
f108f6ee9ff7170066723bafbb8e9a484bdf76e6c7f876edbca808d8f1dc9173

SHA512
a1f80a54089c1e0887cbc35f7aa6df5f62574bc6935d03c22a2702f32db38763f0da5ff926a4f2c873dd675698bc95f853d604ebb5e50207023db3abe2b86977

Download Submit
C:\Users\Admin\DOWNLO~1\THE-MA~1\THE-MA~1\BANKIN~1\DanaBot.dll

Filesize
2.4MB

MD5
7e76f7a5c55a5bc5f5e2d7a9e886782b

SHA1
fc500153dba682e53776bef53123086f00c0e041

SHA256
abd75572f897cdda88cec22922d15b509ee8c840fa5894b0aecbef6de23908a3

SHA512
0318e0040f4dbf954f27fb10a69bce2248e785a31d855615a1eaf303a772ad51d47906a113605d7bfd3c2b2265bf83c61538f78b071f85ee3c4948f5cde3fb24

Download Submit
C:\Users\Admin\Desktop\Free Youtube Downloader.lnk

Filesize
2KB

MD5
b7a9ebcb5fcb69af354d0002df8df02c

SHA1
1a618c5ec34f6f33182de19988a7539ca3ab58b4

SHA256
c36cadeed39013dd887f3655d1c0d71a915d691f6420fbfe6a2c7b53700d62b7

SHA512
003baa6ecacd710394a48df2acf4403b06491c9dc43c5f1cca5985888b7b836e2c33451b7a8fb01958685ba8ca83f6224dd3ed840a127a76cc29b8e4bf102f23

Download Submit
C:\Users\Admin\Downloads\BlueScreen.exe

Filesize
9KB

MD5
b01ee228c4a61a5c06b01160790f9f7c

SHA1
e7cc238b6767401f6e3018d3f0acfe6d207450f8

SHA256
14e6ac84d824c0cf6ea8ebb5b3be10f8893449474096e59ff0fd878d49d0c160

SHA512
c849231c19590e61fbf15847af5062f817247f2bcd476700f1e1fa52dcafa5f0417cc01906b44c890be8cef9347e3c8f6b1594d750b1cebdd6a71256fed79140

Download Submit
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Banking-Malware\Zloader.xlsm

Filesize
94KB

MD5
29d048e5aac404f0e4243b809edc146b

SHA1
c5c15e9a2b036032bd5d3e2de920727fd5b7b5f9

SHA256
431a188a5d508da947a5c9e5f8c12da16aa745a4c12fd808372a58e53ac9fd8a

SHA512
c2f34860563ec7574d04842a43a960ef5eeec93243e66cd44ace3c2484ba7c3514a77858a88086a709a737b8031441a8dff686654b247058b6fee5eef5617c20

Download Submit
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Trojan\tsa.crt

Filesize
1010B

MD5
6e630504be525e953debd0ce831b9aa0

SHA1
edfa47b3edf98af94954b5b0850286a324608503

SHA256
2563fe2f793f119a1bae5cca6eab9d8c20409aa1f1e0db341c623e1251244ef5

SHA512
bbcf285309a4d5605e19513c77ef077a4c451cbef04e3cbdfec6d15cc157a9800a7ff6f70964b0452ddb939ff50766e887904eda06a9999fdedf5b2e8776ebd2

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 839690.crdownload

Filesize
396KB

MD5
13f4b868603cf0dd6c32702d1bd858c9

SHA1
a595ab75e134f5616679be5f11deefdfaae1de15

SHA256
cae57a60c4d269cd1ca43ef143aedb8bfc4c09a7e4a689544883d05ce89406e7

SHA512
e0d7a81c9cdd15a4ef7c8a9492fffb2c520b28cebc54a139e1bffa5c523cf17dfb9ffe57188cf8843d74479df402306f4f0ce9fc09d87c7cca92aea287e5ff24

Download Submit
C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe

Filesize
438KB

MD5
1bb4dd43a8aebc8f3b53acd05e31d5b5

SHA1
54cd1a4a505b301df636903b2293d995d560887e

SHA256
a2380a5f503bc6f5fcfd4c72e5b807df0740a60a298e8686bf6454f92e5d3c02

SHA512
94c70d592e806bb426760f61122b8321e8dc5cff7f793d51f9d5650821c502c43096f41d3e61207ca6989df5bfdbff57bc23328de16e99dd56e85efc90affdce

Download Submit
C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Free YouTube Downloader.exe

Filesize
153KB

MD5
f33a4e991a11baf336a2324f700d874d

SHA1
9da1891a164f2fc0a88d0de1ba397585b455b0f4

SHA256
a87524035509ff7aa277788e1a9485618665b7da35044d70c41ec0f118f3dfd7

SHA512
edf066968f31451e21c7c21d3f54b03fd5827a8526940c1e449aad7f99624577cbc6432deba49bb86e96ac275f5900dcef8d7623855eb3c808e084601ee1df20

Download Submit
C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Uninstall.exe

Filesize
110KB

MD5
ab648a0df4fe7a47fe9d980c545b065d

SHA1
ce28ea7dd117289daf467467a592bc304c72d4e6

SHA256
905a849721ec95ab08754aeee9a60b3ed435d36962466fcbe5cfca63dfc455cd

SHA512
7ae99da55fbf1c31c5281e5f4e10ab2bc33b89effeee82b574eb4b60541c5ea2913d5d99836608873da372c78e75436ae7e535568f48d81cb9dd26d2cc1b3a8c

Download Submit
C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Uninstall.ini

Filesize
3KB

MD5
c92a1d4d0755c886dd137c6cab43c35e

SHA1
fc16175e58ad1f67c57e7fdf55333fdd0e01d936

SHA256
6ab1ee65e6c9c5e31fe3680fc92a2a0ae73f216e966f5582a2d9c265357238d4

SHA512
0525880a1f4cc7dd912ca4006fe4bd02bf1218931fcb56489a0ec728a682fdf1ecd35e8797c665c63dc19d8236942d9b832a6a8c46e00df02afa2c65327dd9de

Download Submit
\??\pipe\LOCAL\crashpad_4364_HBTSMZCMFQWRKYGB

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/1056-995-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/1056-985-0x0000000000660000-0x00000000006F3000-memory.dmp

Filesize
588KB

Download
memory/1056-989-0x0000000000660000-0x00000000006F3000-memory.dmp

Filesize
588KB

Download
memory/1056-990-0x0000000000660000-0x00000000006F3000-memory.dmp

Filesize
588KB

Download
memory/1096-662-0x0000013ABCCA0000-0x0000013ABCCCE000-memory.dmp

Filesize
184KB

Download
memory/2544-849-0x0000000000660000-0x000000000068E000-memory.dmp

Filesize
184KB

Download
memory/2548-925-0x00007FFB88450000-0x00007FFB88460000-memory.dmp

Filesize
64KB

Download
memory/2548-878-0x00007FFB863F0000-0x00007FFB86400000-memory.dmp

Filesize
64KB

Download
memory/2548-872-0x00007FFB88450000-0x00007FFB88460000-memory.dmp

Filesize
64KB

Download
memory/2548-873-0x00007FFB88450000-0x00007FFB88460000-memory.dmp

Filesize
64KB

Download
memory/2548-874-0x00007FFB88450000-0x00007FFB88460000-memory.dmp

Filesize
64KB

Download
memory/2548-924-0x00007FFB88450000-0x00007FFB88460000-memory.dmp

Filesize
64KB

Download
memory/2548-926-0x00007FFB88450000-0x00007FFB88460000-memory.dmp

Filesize
64KB

Download
memory/2548-927-0x00007FFB88450000-0x00007FFB88460000-memory.dmp

Filesize
64KB

Download
memory/2548-875-0x00007FFB88450000-0x00007FFB88460000-memory.dmp

Filesize
64KB

Download
memory/2548-876-0x00007FFB88450000-0x00007FFB88460000-memory.dmp

Filesize
64KB

Download
memory/2548-877-0x00007FFB863F0000-0x00007FFB86400000-memory.dmp

Filesize
64KB

Download
memory/2852-858-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/2852-897-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/2852-937-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/2852-837-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/2852-944-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/2852-994-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/3316-744-0x000001B261D20000-0x000001B261D21000-memory.dmp

Filesize
4KB

Download
memory/3316-751-0x000001B261D20000-0x000001B261D21000-memory.dmp

Filesize
4KB

Download
memory/3316-756-0x000001B261D20000-0x000001B261D21000-memory.dmp

Filesize
4KB

Download
memory/3316-753-0x000001B261D20000-0x000001B261D21000-memory.dmp

Filesize
4KB

Download
memory/3316-754-0x000001B261D20000-0x000001B261D21000-memory.dmp

Filesize
4KB

Download
memory/3316-752-0x000001B261D20000-0x000001B261D21000-memory.dmp

Filesize
4KB

Download
memory/3316-755-0x000001B261D20000-0x000001B261D21000-memory.dmp

Filesize
4KB

Download
memory/3316-750-0x000001B261D20000-0x000001B261D21000-memory.dmp

Filesize
4KB

Download
memory/3316-745-0x000001B261D20000-0x000001B261D21000-memory.dmp

Filesize
4KB

Download
memory/3316-746-0x000001B261D20000-0x000001B261D21000-memory.dmp

Filesize
4KB

Download
memory/3436-34-0x0000000004570000-0x0000000004580000-memory.dmp

Filesize
64KB

Download
memory/3436-33-0x0000000004570000-0x0000000004580000-memory.dmp

Filesize
64KB

Download
memory/3436-36-0x0000000004570000-0x0000000004580000-memory.dmp

Filesize
64KB

Download
memory/3436-103-0x0000000004630000-0x0000000004640000-memory.dmp

Filesize
64KB

Download
memory/3436-54-0x0000000004570000-0x0000000004580000-memory.dmp

Filesize
64KB

Download
memory/3436-53-0x0000000004570000-0x0000000004580000-memory.dmp

Filesize
64KB

Download
memory/3436-35-0x0000000004570000-0x0000000004580000-memory.dmp

Filesize
64KB

Download
memory/3608-836-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/3608-950-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/3608-896-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/3652-934-0x00000000021C0000-0x000000000242B000-memory.dmp

Filesize
2.4MB

Download
memory/3888-1020-0x0000000000400000-0x00000000004C3000-memory.dmp

Filesize
780KB

Download
memory/3976-1002-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/4444-661-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4452-945-0x0000000000400000-0x000000000066B000-memory.dmp

Filesize
2.4MB

Download
memory/5256-561-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/5256-563-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/5420-936-0x0000000000400000-0x0000000000AAD000-memory.dmp

Filesize
6.7MB

Download
memory/5432-831-0x0000000005EA0000-0x0000000006444000-memory.dmp

Filesize
5.6MB

Download
memory/5432-832-0x00000000058F0000-0x0000000005982000-memory.dmp

Filesize
584KB

Download
memory/5432-835-0x00000000059F0000-0x00000000059FA000-memory.dmp

Filesize
40KB

Download
memory/5432-834-0x0000000005A50000-0x0000000005AA6000-memory.dmp

Filesize
344KB

Download
memory/5432-833-0x0000000005890000-0x000000000589A000-memory.dmp

Filesize
40KB

Download
memory/5432-830-0x0000000005780000-0x000000000581C000-memory.dmp

Filesize
624KB

Download
memory/5432-829-0x0000000000ED0000-0x0000000000F42000-memory.dmp

Filesize
456KB

Download
memory/5700-586-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/5836-722-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/5952-697-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/5952-695-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/5992-946-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/5992-947-0x0000000000C10000-0x0000000000C85000-memory.dmp

Filesize
468KB

Download
memory/5992-949-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download

Analysis

Sharing

Errors

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads