danabot | hxxps://arceusx[.]com/

Analysis

max time kernel
292s
max time network
299s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
15-10-2024 15:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://arceusx.com/

Score

10^/10

danabot banker botnet discovery macro trojan xlm

Malware Config

Extracted

Language

xlm4.0

Source

URLs

xlm40.dropper

https://erpoweredent.at/3/zte.dll

Extracted

Family

danabot

51.178.195.151

51.222.39.81

149.255.35.125

38.68.50.179

51.77.7.204

rsa_pubkey.plain

Signatures

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Danabot x86 payload 1 IoCs

Detection of Danabot x86 payload, mapped in memory during the execution of its loader.

botnet

resource	yara_rule
behavioral1/files/0x000a000000022b16-777.dat	family_danabot

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	5432	5356	rundll32.exe	137

Blocklisted process makes network request 9 IoCs

flow	pid	Process
249	5584	rundll32.exe
250	5584	rundll32.exe
253	5584	rundll32.exe
256	5584	rundll32.exe
257	5584	rundll32.exe
258	5584	rundll32.exe
260	5584	rundll32.exe
261	5584	rundll32.exe
262	5584	rundll32.exe

Downloads MZ/PE file

Suspicious Office macro 1 IoCs

Office document equipped with 4.0 macros.

macro xlm

resource	yara_rule
behavioral1/files/0x0007000000023dd0-545.dat	office_xlm_macros

Executes dropped EXE 11 IoCs

pid	Process
644	DanaBot.exe
3044	DanaBot.exe
548	YouAreAnIdiot.exe
1696	YouAreAnIdiot.exe
1996	YouAreAnIdiot.exe
6008	YouAreAnIdiot.exe
3648	YouAreAnIdiot.exe
1364	YouAreAnIdiot.exe
852	YouAreAnIdiot.exe
5524	YouAreAnIdiot.exe
4772	DanaBot.exe

Loads dropped DLL 18 IoCs

pid	Process
5320	regsvr32.exe
5584	rundll32.exe
548	YouAreAnIdiot.exe
548	YouAreAnIdiot.exe
1696	YouAreAnIdiot.exe
1696	YouAreAnIdiot.exe
1996	YouAreAnIdiot.exe
1996	YouAreAnIdiot.exe
6008	YouAreAnIdiot.exe
6008	YouAreAnIdiot.exe
3648	YouAreAnIdiot.exe
3648	YouAreAnIdiot.exe
1364	YouAreAnIdiot.exe
1364	YouAreAnIdiot.exe
852	YouAreAnIdiot.exe
852	YouAreAnIdiot.exe
5524	YouAreAnIdiot.exe
5524	YouAreAnIdiot.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\H:	EXCEL.EXE
File opened (read-only)	\??\M:	EXCEL.EXE
File opened (read-only)	\??\T:	EXCEL.EXE
File opened (read-only)	\??\U:	EXCEL.EXE
File opened (read-only)	\??\Y:	EXCEL.EXE
File opened (read-only)	\??\B:	EXCEL.EXE
File opened (read-only)	\??\G:	EXCEL.EXE
File opened (read-only)	\??\I:	EXCEL.EXE
File opened (read-only)	\??\O:	EXCEL.EXE
File opened (read-only)	\??\P:	EXCEL.EXE
File opened (read-only)	\??\Q:	EXCEL.EXE
File opened (read-only)	\??\X:	EXCEL.EXE
File opened (read-only)	\??\A:	EXCEL.EXE
File opened (read-only)	\??\E:	EXCEL.EXE
File opened (read-only)	\??\J:	EXCEL.EXE
File opened (read-only)	\??\R:	EXCEL.EXE
File opened (read-only)	\??\W:	EXCEL.EXE
File opened (read-only)	\??\K:	EXCEL.EXE
File opened (read-only)	\??\L:	EXCEL.EXE
File opened (read-only)	\??\N:	EXCEL.EXE
File opened (read-only)	\??\S:	EXCEL.EXE
File opened (read-only)	\??\V:	EXCEL.EXE
File opened (read-only)	\??\Z:	EXCEL.EXE

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
211	raw.githubusercontent.com
212	raw.githubusercontent.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Program crash 11 IoCs

pid	pid_target	Process	procid_target
5588	644	WerFault.exe	161
2284	3044	WerFault.exe	169
2012	548	WerFault.exe	185
3784	1696	WerFault.exe	188
3360	1996	WerFault.exe	191
3448	6008	WerFault.exe	194
5624	3648	WerFault.exe	197
4904	1364	WerFault.exe	201
4372	852	WerFault.exe	204
804	5524	WerFault.exe	207
5832	4772	WerFault.exe	210

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	YouAreAnIdiot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	YouAreAnIdiot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	YouAreAnIdiot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	YouAreAnIdiot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DanaBot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DanaBot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DanaBot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	YouAreAnIdiot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	YouAreAnIdiot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	YouAreAnIdiot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	YouAreAnIdiot.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	OpenWith.exe

NTFS ADS 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 985117.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 718214.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 983397.crdownload:SmartScreen	msedge.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
1876	NOTEPAD.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
5356	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
2028	msedge.exe
2028	msedge.exe
428	msedge.exe
428	msedge.exe
3320	identity_helper.exe
3320	identity_helper.exe
4692	msedge.exe
4692	msedge.exe
5520	msedge.exe
5520	msedge.exe
5520	msedge.exe
5520	msedge.exe
116	msedge.exe
116	msedge.exe
4896	msedge.exe
4896	msedge.exe
5516	msedge.exe
5516	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3652	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 26 IoCs

pid	Process
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe

Suspicious use of SetWindowsHookEx 39 IoCs

pid	Process
5356	EXCEL.EXE
5356	EXCEL.EXE
5356	EXCEL.EXE
5356	EXCEL.EXE
5356	EXCEL.EXE
5356	EXCEL.EXE
5356	EXCEL.EXE
5356	EXCEL.EXE
5356	EXCEL.EXE
5356	EXCEL.EXE
5356	EXCEL.EXE
5356	EXCEL.EXE
5356	EXCEL.EXE
5356	EXCEL.EXE
3652	OpenWith.exe
3652	OpenWith.exe
3652	OpenWith.exe
3652	OpenWith.exe
3652	OpenWith.exe
3652	OpenWith.exe
3652	OpenWith.exe
3652	OpenWith.exe
3652	OpenWith.exe
3652	OpenWith.exe
3652	OpenWith.exe
3652	OpenWith.exe
3652	OpenWith.exe
3652	OpenWith.exe
3652	OpenWith.exe
3652	OpenWith.exe
3652	OpenWith.exe
3652	OpenWith.exe
3652	OpenWith.exe
3652	OpenWith.exe
3652	OpenWith.exe
3652	OpenWith.exe
3652	OpenWith.exe
3652	OpenWith.exe
3652	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 428 wrote to memory of 2784	428	msedge.exe	84
PID 428 wrote to memory of 2784	428	msedge.exe	84
PID 428 wrote to memory of 2860	428	msedge.exe	85
PID 428 wrote to memory of 2860	428	msedge.exe	85
PID 428 wrote to memory of 2860	428	msedge.exe	85
PID 428 wrote to memory of 2860	428	msedge.exe	85
PID 428 wrote to memory of 2860	428	msedge.exe	85
PID 428 wrote to memory of 2860	428	msedge.exe	85
PID 428 wrote to memory of 2860	428	msedge.exe	85
PID 428 wrote to memory of 2860	428	msedge.exe	85
PID 428 wrote to memory of 2860	428	msedge.exe	85
PID 428 wrote to memory of 2860	428	msedge.exe	85
PID 428 wrote to memory of 2860	428	msedge.exe	85
PID 428 wrote to memory of 2860	428	msedge.exe	85
PID 428 wrote to memory of 2860	428	msedge.exe	85
PID 428 wrote to memory of 2860	428	msedge.exe	85
PID 428 wrote to memory of 2860	428	msedge.exe	85
PID 428 wrote to memory of 2860	428	msedge.exe	85
PID 428 wrote to memory of 2860	428	msedge.exe	85
PID 428 wrote to memory of 2860	428	msedge.exe	85
PID 428 wrote to memory of 2860	428	msedge.exe	85
PID 428 wrote to memory of 2860	428	msedge.exe	85
PID 428 wrote to memory of 2860	428	msedge.exe	85
PID 428 wrote to memory of 2860	428	msedge.exe	85
PID 428 wrote to memory of 2860	428	msedge.exe	85
PID 428 wrote to memory of 2860	428	msedge.exe	85
PID 428 wrote to memory of 2860	428	msedge.exe	85
PID 428 wrote to memory of 2860	428	msedge.exe	85
PID 428 wrote to memory of 2860	428	msedge.exe	85
PID 428 wrote to memory of 2860	428	msedge.exe	85
PID 428 wrote to memory of 2860	428	msedge.exe	85
PID 428 wrote to memory of 2860	428	msedge.exe	85
PID 428 wrote to memory of 2860	428	msedge.exe	85
PID 428 wrote to memory of 2860	428	msedge.exe	85
PID 428 wrote to memory of 2860	428	msedge.exe	85
PID 428 wrote to memory of 2860	428	msedge.exe	85
PID 428 wrote to memory of 2860	428	msedge.exe	85
PID 428 wrote to memory of 2860	428	msedge.exe	85
PID 428 wrote to memory of 2860	428	msedge.exe	85
PID 428 wrote to memory of 2860	428	msedge.exe	85
PID 428 wrote to memory of 2860	428	msedge.exe	85
PID 428 wrote to memory of 2860	428	msedge.exe	85
PID 428 wrote to memory of 2028	428	msedge.exe	86
PID 428 wrote to memory of 2028	428	msedge.exe	86
PID 428 wrote to memory of 1220	428	msedge.exe	87
PID 428 wrote to memory of 1220	428	msedge.exe	87
PID 428 wrote to memory of 1220	428	msedge.exe	87
PID 428 wrote to memory of 1220	428	msedge.exe	87
PID 428 wrote to memory of 1220	428	msedge.exe	87
PID 428 wrote to memory of 1220	428	msedge.exe	87
PID 428 wrote to memory of 1220	428	msedge.exe	87
PID 428 wrote to memory of 1220	428	msedge.exe	87
PID 428 wrote to memory of 1220	428	msedge.exe	87
PID 428 wrote to memory of 1220	428	msedge.exe	87
PID 428 wrote to memory of 1220	428	msedge.exe	87
PID 428 wrote to memory of 1220	428	msedge.exe	87
PID 428 wrote to memory of 1220	428	msedge.exe	87
PID 428 wrote to memory of 1220	428	msedge.exe	87
PID 428 wrote to memory of 1220	428	msedge.exe	87
PID 428 wrote to memory of 1220	428	msedge.exe	87
PID 428 wrote to memory of 1220	428	msedge.exe	87
PID 428 wrote to memory of 1220	428	msedge.exe	87
PID 428 wrote to memory of 1220	428	msedge.exe	87
PID 428 wrote to memory of 1220	428	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://arceusx.com/
1⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd22fd46f8,0x7ffd22fd4708,0x7ffd22fd4718
  2⤵
  PID:2784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2020,17032557428594798189,15414632106279127874,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2040 /prefetch:2
  2⤵
  PID:2860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2020,17032557428594798189,15414632106279127874,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2244 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2020,17032557428594798189,15414632106279127874,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2784 /prefetch:8
  2⤵
  PID:1220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,17032557428594798189,15414632106279127874,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:1004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,17032557428594798189,15414632106279127874,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:2096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,17032557428594798189,15414632106279127874,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4924 /prefetch:1
  2⤵
  PID:116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,17032557428594798189,15414632106279127874,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5340 /prefetch:1
  2⤵
  PID:648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,17032557428594798189,15414632106279127874,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5480 /prefetch:1
  2⤵
  PID:1476
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2020,17032557428594798189,15414632106279127874,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5984 /prefetch:8
  2⤵
  PID:3008
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2020,17032557428594798189,15414632106279127874,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5984 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,17032557428594798189,15414632106279127874,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6068 /prefetch:1
  2⤵
  PID:5512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,17032557428594798189,15414632106279127874,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5932 /prefetch:1
  2⤵
  PID:5520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,17032557428594798189,15414632106279127874,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5576 /prefetch:1
  2⤵
  PID:5732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,17032557428594798189,15414632106279127874,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6116 /prefetch:1
  2⤵
  PID:5740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,17032557428594798189,15414632106279127874,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5952 /prefetch:1
  2⤵
  PID:6032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2020,17032557428594798189,15414632106279127874,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6528 /prefetch:8
  2⤵
  PID:2036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,17032557428594798189,15414632106279127874,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4584 /prefetch:1
  2⤵
  PID:4416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,17032557428594798189,15414632106279127874,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3060 /prefetch:1
  2⤵
  PID:1552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,17032557428594798189,15414632106279127874,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3076 /prefetch:1
  2⤵
  PID:3492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,17032557428594798189,15414632106279127874,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6416 /prefetch:1
  2⤵
  PID:2436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,17032557428594798189,15414632106279127874,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7088 /prefetch:1
  2⤵
  PID:5856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,17032557428594798189,15414632106279127874,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6828 /prefetch:1
  2⤵
  PID:3868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,17032557428594798189,15414632106279127874,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7096 /prefetch:1
  2⤵
  PID:4304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,17032557428594798189,15414632106279127874,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6092 /prefetch:1
  2⤵
  PID:5284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,17032557428594798189,15414632106279127874,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7004 /prefetch:1
  2⤵
  PID:5288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,17032557428594798189,15414632106279127874,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6636 /prefetch:1
  2⤵
  PID:1940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2020,17032557428594798189,15414632106279127874,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5848 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4692
- C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
  "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\Downloads\Zloader.xlsm"
  2⤵
  - Enumerates connected drives
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of SetWindowsHookEx
  PID:5356
- - C:\Windows\System32\rundll32.exe
    "C:\Windows\System32\rundll32.exe" C:\nxTgTGh\ECeMdPT\EnVYsVZ.dll,DllRegisterServer
    3⤵
    - Process spawned unexpected child process
    PID:5432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,17032557428594798189,15414632106279127874,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=180 /prefetch:1
  2⤵
  PID:3832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2020,17032557428594798189,15414632106279127874,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6720 /prefetch:8
  2⤵
  PID:5672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2020,17032557428594798189,15414632106279127874,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5912 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2020,17032557428594798189,15414632106279127874,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5024 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:116
- C:\Users\Admin\Downloads\DanaBot.exe
  "C:\Users\Admin\Downloads\DanaBot.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:644
- - C:\Windows\SysWOW64\regsvr32.exe
    C:\Windows\system32\regsvr32.exe -s C:\Users\Admin\DOWNLO~1\DanaBot.dll f1 C:\Users\Admin\DOWNLO~1\DanaBot.exe@644
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:5320
  - - C:\Windows\SysWOW64\rundll32.exe
      C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\DOWNLO~1\DanaBot.dll,f0
      4⤵
      Blocklisted process makes network request
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:5584
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 644 -s 460
    3⤵
    - Program crash
    PID:5588
- C:\Users\Admin\Downloads\DanaBot.exe
  "C:\Users\Admin\Downloads\DanaBot.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3044
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3044 -s 156
    3⤵
    - Program crash
    PID:2284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,17032557428594798189,15414632106279127874,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5804 /prefetch:1
  2⤵
  PID:4408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,17032557428594798189,15414632106279127874,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7176 /prefetch:1
  2⤵
  PID:2580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,17032557428594798189,15414632106279127874,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4604 /prefetch:1
  2⤵
  PID:1828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,17032557428594798189,15414632106279127874,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1352 /prefetch:1
  2⤵
  PID:3904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2020,17032557428594798189,15414632106279127874,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7120 /prefetch:8
  2⤵
  PID:1552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2020,17032557428594798189,15414632106279127874,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7176 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,17032557428594798189,15414632106279127874,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6176 /prefetch:1
  2⤵
  PID:4868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2020,17032557428594798189,15414632106279127874,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6204 /prefetch:8
  2⤵
  PID:5264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2020,17032557428594798189,15414632106279127874,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7376 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5516
- C:\Users\Admin\Downloads\YouAreAnIdiot.exe
  "C:\Users\Admin\Downloads\YouAreAnIdiot.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:548
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 548 -s 1560
    3⤵
    - Program crash
    PID:2012
- C:\Users\Admin\Downloads\YouAreAnIdiot.exe
  "C:\Users\Admin\Downloads\YouAreAnIdiot.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1696
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1696 -s 1532
    3⤵
    - Program crash
    PID:3784
- C:\Users\Admin\Downloads\YouAreAnIdiot.exe
  "C:\Users\Admin\Downloads\YouAreAnIdiot.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1996
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1996 -s 1528
    3⤵
    - Program crash
    PID:3360
- C:\Users\Admin\Downloads\YouAreAnIdiot.exe
  "C:\Users\Admin\Downloads\YouAreAnIdiot.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:6008
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 6008 -s 1528
    3⤵
    - Program crash
    PID:3448
- C:\Users\Admin\Downloads\YouAreAnIdiot.exe
  "C:\Users\Admin\Downloads\YouAreAnIdiot.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:3648
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3648 -s 1528
    3⤵
    - Program crash
    PID:5624

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4416

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3260

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 644 -ip 644
1⤵
PID:5084

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 3044 -ip 3044
1⤵
PID:1204

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 548 -ip 548
1⤵
PID:5456

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 1696 -ip 1696
1⤵
PID:6096

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 1996 -ip 1996
1⤵
PID:5872

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 6008 -ip 6008
1⤵
PID:5512

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 3648 -ip 3648
1⤵
PID:1568

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1920

C:\Users\Admin\Downloads\YouAreAnIdiot.exe
"C:\Users\Admin\Downloads\YouAreAnIdiot.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1364
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1364 -s 1540
  2⤵
  - Program crash
  PID:4904

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 1364 -ip 1364
1⤵
PID:3424

C:\Users\Admin\Downloads\YouAreAnIdiot.exe
"C:\Users\Admin\Downloads\YouAreAnIdiot.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:852
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 852 -s 1528
  2⤵
  - Program crash
  PID:4372

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 852 -ip 852
1⤵
PID:2696

C:\Users\Admin\Downloads\YouAreAnIdiot.exe
"C:\Users\Admin\Downloads\YouAreAnIdiot.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:5524
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5524 -s 1532
  2⤵
  - Program crash
  PID:804

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 5524 -ip 5524
1⤵
PID:1828

C:\Users\Admin\Downloads\DanaBot.exe
"C:\Users\Admin\Downloads\DanaBot.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4772
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4772 -s 148
  2⤵
  - Program crash
  PID:5832

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4772 -ip 4772
1⤵
PID:4104

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3652
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\DanaBot.dll
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:1876

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0a9dc42e4013fc47438e96d24beb8eff

SHA1
806ab26d7eae031a58484188a7eb1adab06457fc

SHA256
58d66151799526b3fa372552cd99b385415d9e9a119302b99aadc34dd51dd151

SHA512
868d6b421ae2501a519595d0c34ddef25b2a98b082c5203da8349035f1f6764ddf183197f1054e7e86a752c71eccbc0649e515b63c55bc18cf5f0592397e258f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
61cef8e38cd95bf003f5fdd1dc37dae1

SHA1
11f2f79ecb349344c143eea9a0fed41891a3467f

SHA256
ae671613623b4477fbd5daf1fd2d148ae2a09ddcc3804b2b6d4ffcb60b317e3e

SHA512
6fb9b333fe0e8fde19fdd0bd01a1990a4e60a87c0a02bc8297da1206e42f8690d06b030308e58c862e9e77714a585eed7cc1627590d99a10aeb77fc0dd3d864d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1db5f2e8-55df-4c09-a9b1-b525a2b1ee53.tmp

Filesize
3KB

MD5
8cdb8b40c953f76c1abc99c3931f3927

SHA1
994b1d5d57b05309a872dd8d907c7308608b3a3b

SHA256
0caddd7acab2c9f2c075a1b4cc27663a60ab3a58c6c19213a3d81c3812a7a4d7

SHA512
10740f5a5d5b8b5baf6582b2221ef42949bff68d6cc5024793187cb840f64635943fd4413c44640774cf931c97d46e4ff6d3896e93301f244302e5153765f981

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
b882899e469fbffe20bc5804d86665a3

SHA1
350a1be00e7e8c53a17081afff8843801d7a5d8a

SHA256
b21b66bf8466a478593211f2ab5c054a66987df38749fc517953b3ba16c1a33c

SHA512
e6ab7f20782ee682a23b604908dfc9a67370dd5c8d6ad5e1d0e0a3435dade8bcd20f910827db86603fbc11e0c2a76654c2c6477c35b2510bd74ab448034dc27d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
0317e26cea9c4cbcc38a6129f5554ae4

SHA1
4083bf7449c5c51aa96ac515abbdc02a92e981d3

SHA256
4f5f2aa32e905bee625ed390c8bd9c83f713afa3b08e135c7eca06d23fce13bc

SHA512
c112587847a5803e40a6898cf14b20e9bd97eff85d6177d30eb96f82b4267899859d4c13a5659a7c648aa41792e8d954cea0f6444d4142e80fe8c702450eb328

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
5becc3b1e5a07570fe6453537d3d4321

SHA1
41c8d513d17b16a559386c33a2ee339b1943e1bb

SHA256
b12ba535a27a37eaadada107b62494993cffcd162ccb89f22a1e346d573b4a1a

SHA512
eff101ea9a35adf2a67334d0017e60d5e569d4f101edc945a2ba5d632600a40bea4e4314a6013793aed9744996cf40cf0c3326cc9561d70a645e7291816cb9d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
79b2de609dee0ddc4b8af496c70017f8

SHA1
1e8cdc801ccf4515c3b553a0a0bc15041def8f89

SHA256
b1cede394841c88f378de99af3be85904ba96b67a04e092e61893cd81e43195c

SHA512
1b18038890cdb5ecadda9d820ec5e7a42d1737fe086b95d9f792295d01dbf6a9a4a40af7e36aeab3d73f279a48e00359bfce4210d88840199a0a9eeeb6f5b496

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f3544bed20e379abe9b3f6241b0f8d45

SHA1
824f0b9673709baf4f029641da6421f9c1feb8e7

SHA256
0e97059bcc000d249baf7ecdd034e98b3de6710acaa48c5bb82770d27790b6ea

SHA512
2c82218c0d871506f534eb9ed2a0ccf59ed84e0a1cf7b6f59c6c4304ea4877457972d204f901604d1c93e5ad02ca5d2593fc492679bb823366606c7dcee95fb4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
1bf9e1e492900faaf635a29deb324a7f

SHA1
1cb1f1e91f37947b4bcab3d229271bd675eb791e

SHA256
8551a7f8e5782add9208876dc4b772dfb2f9ce06039f066365a7c1f49710b802

SHA512
d48e888d7d4d8d462e6ceae7f06216e957e627658e8736a4d500b4a4c54b584dcbde2025a87c3c970a91a08faee9fcc2ceef83045eeafa77119afb3252611d85

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
2f50a761f2884084ce812fbc42756ad1

SHA1
342bfdf47a4027d14a9136ad4d1d2dfd1cfb289b

SHA256
56b9f8662a1b4a434b8b5a2c2616b349b9ef18f172468a4aa97875a21845100b

SHA512
1c41c174d6cec25b31803b80a9c18e0f5587c1b0305d392eea210f33e8c681b26a16197b7ccef51b4f8c8b808ad845b5e43bbb591eb99f1945ba1e9bca043aaf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
4b03d552c2d4f731d8f25e4875ddbf22

SHA1
7d278e9ac02377678adcb3640303347d90cb29b8

SHA256
7331b4ea7429d4c298d5cacd6dea5b9ec96bd7696e6939eb2073220ad512ab45

SHA512
d05936d5e49ef26624adc5c0d2b50f4a2e79ff356b94e716816b34eeb5c6293c7a174a952d54431b20ebaa10f4b39f46f5dff3046de996cdfbbc9bc47399a70f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
40ee24a1394b195dcaa3bd1dd8989eaa

SHA1
4cf3fb6d7c61a2065b8fd78a6bf48d8d89dfd179

SHA256
c35f3aabbb48edf8636d112567a41685fe9508da819977310f8735bc33ff2f53

SHA512
163684a4715d0c7584bcb07cd6c1c066b4f98e4840371eebf754d79143b43b849551ef65ba4a7f4d89fa49039caf43b53188aa1e312679cf1e8cd849609994f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
9c5b09d6935d802bf2de26d0b9be5a7c

SHA1
3d2d1e547579c2d56f481488f2977ee0452f161f

SHA256
ae89d3d4b6e62aeef5a4d617aab49cab635e7713e09a84d94ffa77ea5ad6d603

SHA512
d1a94dd4b6939625f334a0e4f128b7cf6e18abcdac0139c3ce47c138dac2ccbfce39b3c4b183bf8b97eb56ec5e395d5123191778c64e6657d8b7d9d316e6367a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
705B

MD5
a570d01f3dd394ceaaa99e0930961cca

SHA1
370d372f22eb62fa545f6a8c7df304a7db9dc740

SHA256
d37fdddd83f728cbe34d7036dd54c6d27ee997cc4ab4dfd44c55cf98cb8003c5

SHA512
e00919a7f70c6302c85ae395dddf0aa40fe22f4363f2b2fd3beceaeb91de6ce89eed663007083db20a31b8536da4425d8cf2c4dd405f1d45fe7c8fc1015105fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
bf92d0c1bb5292732c50de0e92a51983

SHA1
e58f2773050e0c5f3450bdf8553b50399a49f0b8

SHA256
7baeda0ffa9d41011916f13c2a876fb9f7fcf765688e12950ecdcdae2f16d772

SHA512
c0ae5d24fcf2f2b24cf0c38f5cdbb43053f58bd6137eb01eccbe88502ce2cf0d0907245a5e8334ca7d7bd0e2bf03542f5ba171c079bf0cc2201c1c2560113c3c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
51344c134c0067dee4e8342dd91a6b05

SHA1
c081c728984d81bcfa9321ffb259f2a5194be98f

SHA256
fc35e68e16ec419ff1316722365640f080dcc94a3311e9177038ff178184bb1e

SHA512
f84750817c4569417dafb95457174eb9c3e5f6b7677a31307eae2ee8e4a624b8570782b3761bc6523b7e255dad2773439b2c080ee821f55f8a1e93c87e05231a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
5b22f244a83a4516f64a2b47bd25aed1

SHA1
bbf33a988aee3edc7f6ed06a9626c086daaa47e9

SHA256
2618ceab769bf582f17f19abdc413bbf84db95541526b0e7297c1e3053bba55a

SHA512
4ed48753492a89d0c1e1e7990d9ea259356a58022002a06c99698b3165c802f42974f9fbf40c97b0648e6d56e84403fb5ec14fd37b891802f4327f7b58ae7777

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
e9c1ca23b2030bf1e2167641265890fe

SHA1
190160b770be38d5a443a23e8e0ad2f6f5fb094b

SHA256
ae561d116eee61022a538f55ff1e3d8acdb9f72cb97db78a171c753f3f609894

SHA512
1eead1b852e6722b95076d66d83ea7dfda324cb3eb0a7d6e4ccab8387cb4596c24ed00ffae2bc55d21f6aadf3894ae37f013f81324a1754f6ac76582b1f4208c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
7f654bc0e4c8faa400390670b4e972a2

SHA1
5b61e34a94c7cb0fdfc9a1901a16c799d6a961ed

SHA256
e5c1f8b96473d463dbd0f09f6d37a98d82f768f130aaef595663ea69cbe2f7ff

SHA512
c5b7ff1f9e13aef4ebf44c803a0b37b4c90f272abf94e680b1ab8e69248f1be8e0cfd14a8c51ed5f82bfed335e3c7e6751d573e5315c3f387f8f7798f2a11cda

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
2def43eb2213f239d6ef8f33d85e2d21

SHA1
8cccc5fabbd6b5eb5df32d1ac589e73e89e201f0

SHA256
8e6c166f36422a5f13d021c2e1823d5b47c15c02c96be294d13ee6daba1773fa

SHA512
a9a178877e0796a36244a97aabf027e377699b30ad3c0813b613e26058217418907e01e86ead93c3fc69585748c7696ab2ca0271094c21d5d4885e601f0fdab9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
30277e8ad0f6cc18a55b61759b4bde2f

SHA1
5c9916a476a5ef043afc7d40728344172666c9f3

SHA256
cfc80ec8f5a640ea9d2a85f514e3ebd752d6f7a3e0599c637099167c4a6f2cbc

SHA512
3fb6a98f4ff3b97c8c069d2622976413afcb2aa3c41468040af93f301d1254affba26970c914b0eb32b1f1757986d0c475527b2260701ee48854d21a2edeb4fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
707917cae2e9810b295cc5b03d1b87b8

SHA1
01d77d776227c74857455a9e766c75f6dbb52ab7

SHA256
dcf6841c70754cab1b89489f0b847eb0ae12e6325d0bd819be1484edb943dbaf

SHA512
cd52dabf001383fb84cc9ce53e4fb94b7f59818eb1eb5426868d044fc0285ad3cad3d4336e1719706044a5ae7ac59bb37d67a1d1b39ac81d5476050647586caf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
1690acfb1917122af41db0c014b4c488

SHA1
e7a8619c423e7cb349c28d83d0401387fe096153

SHA256
8052265b920b0c12d171c9d4ff7684c67b6a346b774f23ebece50a2426603c61

SHA512
843b79490b611a076d4b98f3bc23145fe39785fdda1eb1dc0196d2fb0e7da7df8d51e71bd7f3a058b607663c7618906774017e482e3afe0f093badc8c3bb9be6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
f45acbcbf6625329d4315878b845e1a7

SHA1
a663504c6d22f7fc08cdcc2d4c0a1bef55541ae8

SHA256
5d1ea6b93dbd68bd1f414f8d74e9d7cc7f6e06b25792a17c547f9219eca6d2f8

SHA512
8ad8282a8bb2dfd51e2dd047cd4b6a5e2c3cbe6034d4584fc4cc0607d70ebee1f4b29bf0df82b817e5da632d61b141b9f988a969cfd0e8a5ce256fe9c250e83c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5804cd.TMP

Filesize
538B

MD5
d9e889c7b4b2059eb84ef4ced315e9d7

SHA1
b7bf33e7ed1fed835e5b5c20bb882e32d9af0292

SHA256
369bc463d05be4c6e71eb428fcfef01e3b50d016d1c96d8627e9ba3e44bf0449

SHA512
1c0ee95b1b5652510ff79751711d7522b812385aca04076f44c63943322a74fe1e1dc020c0756a1a12c6a34c3c9131630d80f11f413fc9f5f14b1efbc44e93bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
3016727e4a50ab515efa09b66e996e78

SHA1
ac34112ba5cb89ced20a4747d4fe1f715a9b4d9d

SHA256
cf550a924e94304beb5651f5bfaf24ffcb68c12e46b94048a93474be3a257f40

SHA512
f8015378e98658cb3be98edba704a6eb1ab971653cf4509ee19770ffa09de16088f277b78dc58629a3c0e82f70cb48ee049a8c524549ddbf54e82d476c186c1c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
26d15e66913a513f40f286b77bd14ef9

SHA1
83a7962e6dd7021523ed2fd8bdadc10a4bc260eb

SHA256
3d72e4aae48052a3c8785ee9f850223df16bc55c4f77f585f0ddc1dbdb9587bc

SHA512
6164c40a495738212447675863f83ab9b89b6ce46ae34d7a8fcde47b342675028af5a81e6838f89de49a06f2c74ea68dd5ba0c7f4123c397e722668730abf180

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
0a2fc2c727af09d1bd4bfc8c5e8e9001

SHA1
8c1c0a973220b93cc75606c5298059fc82e3604e

SHA256
cbbce63fef7cc61e956433b461ecb45e70bbbdc29b032a3eda1a40049b713a3c

SHA512
f50bc5a759b31b2cbc5e713e1c6f9b1c410df6e1a608159109255660a6510f11056c407971551a979823bfae8b2c0ae004ef37651260bf5a0885a00423737af4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
28563c190a7445d0313a8077aa1ac2ce

SHA1
6338b9e34c8b420f7fbb0fb31ffa58125c2a2438

SHA256
ae1053fba4dac0b7f64a3b1fa72ad9f4c4ec9b87232ce7388255470bd9b6fcf1

SHA512
556771c8ed39080101c94382ac17e24ff0a848fa96d340d2c2ac2c777988642f1385cfa2c2820f41e0cbb9341c1f58f3dadccfbabd388e8529dd331b3f891c0e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\9cd93bc6dcf544bae69531052e64647ec02f2bb4.tbres

Filesize
4KB

MD5
a955b6edd94d8b0bd42e50669ff7fc8b

SHA1
c7f733401013b8007bd903d9337182ff4b1fc58b

SHA256
5ebc383374a736d95ee1d7e8943ae22db9a4af59603994b8a5d7c0ada811c5d8

SHA512
b8ef0ec9e7b1a0ee70414fab19c4484c579bf175aae6d611b7dc710c6dda352724bdad9230cfb4b8202a5c4cd28cc182ec4aa68bb4f6b2d820508a6c2354a474

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat

Filesize
300B

MD5
51b0a28c62afd7991fab7ccf533f69f4

SHA1
bd375dd5fb29450efcc1816eaef4f0f0e10cc25f

SHA256
c95e1b6a9cf2deeae22e6bf61040a402e37b9f4336fabef27f2905b831d331ff

SHA512
9e13978ab2db6afa7dbfe7def2165edb53784a360408fd23e534187d09667283756c7ac1238b7073a8053d3a41b3f7beac6ff1f756e364bd838842e1e791ddf0

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms

Filesize
685B

MD5
2b8dced37840367012c4fb8408e68eb1

SHA1
377200c0832824cbbdaa06bb2354d035d1b800f4

SHA256
c4503441da3bab5ec30291ecc8d7e2d305ded105cd3c894458df37e79434ddd1

SHA512
2592fb8c7182a45caab87d44fac6fca1807ad9458c9cda34cb59c11ca0050ceadf04a38d2da24330d200c697892a045c7146cddf0b13fb9c60977c4244181438

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms

Filesize
24B

MD5
4fcb2a3ee025e4a10d21e1b154873fe2

SHA1
57658e2fa594b7d0b99d02e041d0f3418e58856b

SHA256
90bf6baa6f968a285f88620fbf91e1f5aa3e66e2bad50fd16f37913280ad8228

SHA512
4e85d48db8c0ee5c4dd4149ab01d33e4224456c3f3e3b0101544a5ca87a0d74b3ccd8c0509650008e2abed65efd1e140b1e65ae5215ab32de6f6a49c9d3ec3ff

Download Submit
C:\Users\Admin\DOWNLO~1\DanaBot.dll

Filesize
2.4MB

MD5
7e76f7a5c55a5bc5f5e2d7a9e886782b

SHA1
fc500153dba682e53776bef53123086f00c0e041

SHA256
abd75572f897cdda88cec22922d15b509ee8c840fa5894b0aecbef6de23908a3

SHA512
0318e0040f4dbf954f27fb10a69bce2248e785a31d855615a1eaf303a772ad51d47906a113605d7bfd3c2b2265bf83c61538f78b071f85ee3c4948f5cde3fb24

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 585430.crdownload

Filesize
11.7MB

MD5
f287374102f39de90d0b0e36ec8fe6c9

SHA1
2aa254f171164d139fc3ab73cd2066d21da77be7

SHA256
f2d1c1bcf85812f04cd2b33d175b23746ce1cdd877002ef3e0a9b8d722a461d6

SHA512
ba9fe1949d1c4e7843f76d8a942b702d10e5ce65de43bb06e053491fb565945030f4cddadfca44de1284f621177ce2c18a3f10d53c5b86f897816ec6bf34956c

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 718214.crdownload

Filesize
17KB

MD5
451112d955af4fe3c0d00f303d811d20

SHA1
1619c35078ba891091de6444099a69ef364e0c10

SHA256
0d57a706d4e10cca3aed49b341a651f29046f5ef1328878d616be93c3b4cbce9

SHA512
35357d2c4b8229ef9927fa37d85e22f3ae26606f577c4c4655b2126f0ecea4c69dae03043927207ca426cc3cd54fc3e72124369418932e04733a368c9316cf87

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 983397.crdownload

Filesize
424KB

MD5
e263c5b306480143855655233f76dc5a

SHA1
e7dcd6c23c72209ee5aa0890372de1ce52045815

SHA256
1f69810b8fe71e30a8738278adf09dd982f7de0ab9891d296ce7ea61b3fa4f69

SHA512
e95981eae02d0a8bf44493c64cca8b7e50023332e91d75164735a1d0e38138f358100c93633ff3a0652e1c12a5155cba77d81e01027422d7d5f71000eafb4113

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 985117.crdownload

Filesize
2.7MB

MD5
48d8f7bbb500af66baa765279ce58045

SHA1
2cdb5fdeee4e9c7bd2e5f744150521963487eb71

SHA256
db0d72bc7d10209f7fa354ec100d57abbb9fe2e57ce72789f5f88257c5d3ebd1

SHA512
aef8aa8e0d16aab35b5cc19487e53583691e4471064bc556a2ee13e94a0546b54a33995739f0fa3c4de6ff4c6abf02014aef3efb0d93ca6847bad2220c3302bd

Download Submit
C:\Users\Admin\Downloads\Zloader.xlsm

Filesize
93KB

MD5
b36a0543b28f4ad61d0f64b729b2511b

SHA1
bf62dc338b1dd50a3f7410371bc3f2206350ebea

SHA256
90c03a8ca35c33aad5e77488625598da6deeb08794e6efc9f1ddbe486df33e0c

SHA512
cf691e088f9852a3850ee458ef56406ead4aea539a46f8f90eb8e300bc06612a66dfa6c9dee8dcb801e7edf7fb4ed35226a5684f4164eaad073b9511189af037

Download Submit
memory/548-988-0x0000000000C20000-0x0000000000C92000-memory.dmp

Filesize
456KB

Download
memory/548-997-0x0000000005740000-0x000000000574A000-memory.dmp

Filesize
40KB

Download
memory/548-993-0x00000000058C0000-0x0000000005916000-memory.dmp

Filesize
344KB

Download
memory/548-992-0x0000000005540000-0x000000000554A000-memory.dmp

Filesize
40KB

Download
memory/548-991-0x0000000005620000-0x00000000056B2000-memory.dmp

Filesize
584KB

Download
memory/548-990-0x0000000005BD0000-0x0000000006174000-memory.dmp

Filesize
5.6MB

Download
memory/548-989-0x0000000005580000-0x000000000561C000-memory.dmp

Filesize
624KB

Download
memory/644-780-0x0000000000400000-0x0000000000AAD000-memory.dmp

Filesize
6.7MB

Download
memory/3044-813-0x0000000000400000-0x0000000000AAD000-memory.dmp

Filesize
6.7MB

Download
memory/4772-1043-0x0000000000400000-0x0000000000AAD000-memory.dmp

Filesize
6.7MB

Download
memory/5356-662-0x00007FFCF27D0000-0x00007FFCF27E0000-memory.dmp

Filesize
64KB

Download
memory/5356-553-0x00007FFCF27D0000-0x00007FFCF27E0000-memory.dmp

Filesize
64KB

Download
memory/5356-555-0x00007FFCF27D0000-0x00007FFCF27E0000-memory.dmp

Filesize
64KB

Download
memory/5356-556-0x00007FFCEFE70000-0x00007FFCEFE80000-memory.dmp

Filesize
64KB

Download
memory/5356-557-0x00007FFCEFE70000-0x00007FFCEFE80000-memory.dmp

Filesize
64KB

Download
memory/5356-554-0x00007FFCF27D0000-0x00007FFCF27E0000-memory.dmp

Filesize
64KB

Download
memory/5356-663-0x00007FFCF27D0000-0x00007FFCF27E0000-memory.dmp

Filesize
64KB

Download
memory/5356-664-0x00007FFCF27D0000-0x00007FFCF27E0000-memory.dmp

Filesize
64KB

Download
memory/5356-551-0x00007FFCF27D0000-0x00007FFCF27E0000-memory.dmp

Filesize
64KB

Download
memory/5356-665-0x00007FFCF27D0000-0x00007FFCF27E0000-memory.dmp

Filesize
64KB

Download
memory/5356-552-0x00007FFCF27D0000-0x00007FFCF27E0000-memory.dmp

Filesize
64KB

Download
memory/5584-802-0x0000000000400000-0x000000000066B000-memory.dmp

Filesize
2.4MB

Download