hxxp://itch[.]io

max time kernel
2699s
max time network
2603s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
17/10/2024, 11:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

http://itch.io

Score

8^/10

defense_evasion discovery persistence

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 10 IoCs

pid	Process
2384	DanaBot.exe
1568	DanaBot.exe
408	DanaBot.exe
2468	Lentin.c.exe
5616	Lentin.c.exe
5680	DanaBot.exe
5688	Lentin.c.exe
5864	Lentin.c.exe
3616	DanaBot.exe
1148	Lentin.c.exe

Modifies system executable filetype association 2 TTPs 2 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	Lentin.c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"c:\\recycled\\txfol\" %1 %*"	Lentin.c.exe

Enumerates connected drives 3 TTPs 49 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\e:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\E:	Lentin.c.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
104	raw.githubusercontent.com
141	raw.githubusercontent.com
142	raw.githubusercontent.com

Drops file in Windows directory 7 IoCs

description	ioc	Process
File created	C:\Windows\.txt	Lentin.c.exe
File opened for modification	C:\Windows\txfoltxfol.dll	Lentin.c.exe
File created	C:\Windows\txfol.txt	Lentin.c.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setupact.log	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	UserOOBEBroker.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 2 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\DanaBot.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Lentin.c.exe:Zone.Identifier	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Program crash 5 IoCs

pid	pid_target	Process	procid_target
2468	2384	WerFault.exe	138
3880	1568	WerFault.exe	145
444	408	WerFault.exe	149
5788	5680	WerFault.exe	188
4332	3616	WerFault.exe	203

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DanaBot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lentin.c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lentin.c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lentin.c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lentin.c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lentin.c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FileCoAuth.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000\Software\Microsoft\Internet Explorer\Main	Lentin.c.exe
Key created	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000\Software\Microsoft\Internet Explorer\GPU	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000\Software\Microsoft\Internet Explorer\GPU	wwahost.exe

Modifies Internet Explorer start page 1 TTPs 1 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "www.asianetglobal.com"	Lentin.c.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jfif\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a5c9e8068e20db01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	wwahost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raw\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dib	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ico\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	wwahost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000333431068e20db01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b04f8a058e20db01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tiff	SearchProtocolHost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	wwahost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000545b38068e20db01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tiff\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cr2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	wwahost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003441c0068e20db01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\S-1-5-19	wwahost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	wwahost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raw	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\windows.cloudexperienceho	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\live.com\NumberOfSubdomains = "1"	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Settings	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\live.com\Total = "0"	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.com\Total = "40"	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.cloudexperiencehost\ = "1"	wwahost.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\live.com	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "124"	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1 = 8c003100000000004759b165110050524f4752417e310000740009000400efbec55259615159dc612e0000003f0000000000010000000000000000004a000000000097721000500072006f006700720061006d002000460069006c0065007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100370038003100000018000000	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CacheLimit = "51200"	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DomStorageState\EdpState = "0"	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.cloudexperiencehost\ = "0"	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\live.com\ = "0"	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\live.com\Total = "0"	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\fpt.live.com	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoft.com\ = "0"	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\fpt2.microsoft.com\ = "40"	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\live.com\ = "0"	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoft.com\NumberOfSub = "0"	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1\NodeSlot = "7"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202020202	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.com\ = "0"	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 000000000200000001000000ffffffff	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\windows.cloudexperienceho = "0"	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\MuiCache	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\account.live.com\ = "124"	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\live.com\NumberOfSubdomains = "0"	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\live.com\NumberOfSubdomains = "2"	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\fpt.live.com\ = "0"	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 0100000000000000ffffffff	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	OpenWith.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.cloudexperiencehost	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage	wwahost.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.cloudexperiencehost	wwahost.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\live.com	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "40"	wwahost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\Shell\SniffedFolderType = "Generic"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	BackgroundTransferHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoft.com\Total = "0"	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage	wwahost.exe

NTFS ADS 4 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 468271.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\DanaBot.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 545094.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Lentin.c.exe:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
980	msedge.exe
980	msedge.exe
4400	msedge.exe
4400	msedge.exe
2260	msedge.exe
2260	msedge.exe
3880	identity_helper.exe
3880	identity_helper.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
3012	msedge.exe
3012	msedge.exe
3920	msedge.exe
3920	msedge.exe
4876	msedge.exe
4876	msedge.exe
1064	msedge.exe
1064	msedge.exe
2588	identity_helper.exe
2588	identity_helper.exe
4340	msedge.exe
4340	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
5496	OpenWith.exe
1900	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 34 IoCs

pid	Process
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeManageVolumePrivilege	4444	svchost.exe
Token: SeSystemtimePrivilege	2468	Lentin.c.exe
Token: 33	6056	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	6056	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6056	SearchIndexer.exe
Token: SeDebugPrivilege	1412	wwahost.exe
Token: SeDebugPrivilege	1412	wwahost.exe
Token: SeDebugPrivilege	1412	wwahost.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe

Suspicious use of SendNotifyMessage 44 IoCs

pid	Process
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
4860	helppane.exe
4860	helppane.exe
4212	MiniSearchHost.exe
5496	OpenWith.exe
5496	OpenWith.exe
5496	OpenWith.exe
5496	OpenWith.exe
5496	OpenWith.exe
5496	OpenWith.exe
5496	OpenWith.exe
5496	OpenWith.exe
5496	OpenWith.exe
1900	OpenWith.exe
1900	OpenWith.exe
1900	OpenWith.exe
1900	OpenWith.exe
1900	OpenWith.exe
1900	OpenWith.exe
1900	OpenWith.exe
1900	OpenWith.exe
1900	OpenWith.exe
1900	OpenWith.exe
1900	OpenWith.exe
1900	OpenWith.exe
1900	OpenWith.exe
1900	OpenWith.exe
1900	OpenWith.exe
1900	OpenWith.exe
1900	OpenWith.exe
4136	OpenWith.exe
2496	OpenWith.exe
5080	OpenWith.exe
5704	OpenWith.exe
5812	OpenWith.exe
5732	OpenWith.exe
5732	OpenWith.exe
5732	OpenWith.exe
5732	OpenWith.exe
5732	OpenWith.exe
5732	OpenWith.exe
5732	OpenWith.exe
5732	OpenWith.exe
5732	OpenWith.exe
2120	OpenWith.exe
2120	OpenWith.exe
2120	OpenWith.exe
2120	OpenWith.exe
2120	OpenWith.exe
3316	OpenWith.exe
5876	OpenWith.exe
5960	OpenWith.exe
4812	OpenWith.exe
6116	OpenWith.exe
5132	OpenWith.exe
124	OpenWith.exe
5344	OpenWith.exe
5344	OpenWith.exe
5344	OpenWith.exe
5344	OpenWith.exe
5344	OpenWith.exe
5344	OpenWith.exe
5344	OpenWith.exe
5344	OpenWith.exe
5344	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4400 wrote to memory of 1916	4400	msedge.exe	78
PID 4400 wrote to memory of 1916	4400	msedge.exe	78
PID 4400 wrote to memory of 4332	4400	msedge.exe	79
PID 4400 wrote to memory of 4332	4400	msedge.exe	79
PID 4400 wrote to memory of 4332	4400	msedge.exe	79
PID 4400 wrote to memory of 4332	4400	msedge.exe	79
PID 4400 wrote to memory of 4332	4400	msedge.exe	79
PID 4400 wrote to memory of 4332	4400	msedge.exe	79
PID 4400 wrote to memory of 4332	4400	msedge.exe	79
PID 4400 wrote to memory of 4332	4400	msedge.exe	79
PID 4400 wrote to memory of 4332	4400	msedge.exe	79
PID 4400 wrote to memory of 4332	4400	msedge.exe	79
PID 4400 wrote to memory of 4332	4400	msedge.exe	79
PID 4400 wrote to memory of 4332	4400	msedge.exe	79
PID 4400 wrote to memory of 4332	4400	msedge.exe	79
PID 4400 wrote to memory of 4332	4400	msedge.exe	79
PID 4400 wrote to memory of 4332	4400	msedge.exe	79
PID 4400 wrote to memory of 4332	4400	msedge.exe	79
PID 4400 wrote to memory of 4332	4400	msedge.exe	79
PID 4400 wrote to memory of 4332	4400	msedge.exe	79
PID 4400 wrote to memory of 4332	4400	msedge.exe	79
PID 4400 wrote to memory of 4332	4400	msedge.exe	79
PID 4400 wrote to memory of 4332	4400	msedge.exe	79
PID 4400 wrote to memory of 4332	4400	msedge.exe	79
PID 4400 wrote to memory of 4332	4400	msedge.exe	79
PID 4400 wrote to memory of 4332	4400	msedge.exe	79
PID 4400 wrote to memory of 4332	4400	msedge.exe	79
PID 4400 wrote to memory of 4332	4400	msedge.exe	79
PID 4400 wrote to memory of 4332	4400	msedge.exe	79
PID 4400 wrote to memory of 4332	4400	msedge.exe	79
PID 4400 wrote to memory of 4332	4400	msedge.exe	79
PID 4400 wrote to memory of 4332	4400	msedge.exe	79
PID 4400 wrote to memory of 4332	4400	msedge.exe	79
PID 4400 wrote to memory of 4332	4400	msedge.exe	79
PID 4400 wrote to memory of 4332	4400	msedge.exe	79
PID 4400 wrote to memory of 4332	4400	msedge.exe	79
PID 4400 wrote to memory of 4332	4400	msedge.exe	79
PID 4400 wrote to memory of 4332	4400	msedge.exe	79
PID 4400 wrote to memory of 4332	4400	msedge.exe	79
PID 4400 wrote to memory of 4332	4400	msedge.exe	79
PID 4400 wrote to memory of 4332	4400	msedge.exe	79
PID 4400 wrote to memory of 4332	4400	msedge.exe	79
PID 4400 wrote to memory of 980	4400	msedge.exe	80
PID 4400 wrote to memory of 980	4400	msedge.exe	80
PID 4400 wrote to memory of 3348	4400	msedge.exe	81
PID 4400 wrote to memory of 3348	4400	msedge.exe	81
PID 4400 wrote to memory of 3348	4400	msedge.exe	81
PID 4400 wrote to memory of 3348	4400	msedge.exe	81
PID 4400 wrote to memory of 3348	4400	msedge.exe	81
PID 4400 wrote to memory of 3348	4400	msedge.exe	81
PID 4400 wrote to memory of 3348	4400	msedge.exe	81
PID 4400 wrote to memory of 3348	4400	msedge.exe	81
PID 4400 wrote to memory of 3348	4400	msedge.exe	81
PID 4400 wrote to memory of 3348	4400	msedge.exe	81
PID 4400 wrote to memory of 3348	4400	msedge.exe	81
PID 4400 wrote to memory of 3348	4400	msedge.exe	81
PID 4400 wrote to memory of 3348	4400	msedge.exe	81
PID 4400 wrote to memory of 3348	4400	msedge.exe	81
PID 4400 wrote to memory of 3348	4400	msedge.exe	81
PID 4400 wrote to memory of 3348	4400	msedge.exe	81
PID 4400 wrote to memory of 3348	4400	msedge.exe	81
PID 4400 wrote to memory of 3348	4400	msedge.exe	81
PID 4400 wrote to memory of 3348	4400	msedge.exe	81
PID 4400 wrote to memory of 3348	4400	msedge.exe	81

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://itch.io
1⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffa0a413cb8,0x7ffa0a413cc8,0x7ffa0a413cd8
  2⤵
  PID:1916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1888,6951797019888376006,9881520742096450648,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1932 /prefetch:2
  2⤵
  PID:4332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1888,6951797019888376006,9881520742096450648,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2352 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1888,6951797019888376006,9881520742096450648,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2640 /prefetch:8
  2⤵
  PID:3348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,6951797019888376006,9881520742096450648,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:1
  2⤵
  PID:1504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,6951797019888376006,9881520742096450648,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:3408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,6951797019888376006,9881520742096450648,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4824 /prefetch:1
  2⤵
  PID:4116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,6951797019888376006,9881520742096450648,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5324 /prefetch:1
  2⤵
  PID:3172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1888,6951797019888376006,9881520742096450648,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5328 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2260
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1888,6951797019888376006,9881520742096450648,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5788 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,6951797019888376006,9881520742096450648,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4744 /prefetch:1
  2⤵
  PID:2472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,6951797019888376006,9881520742096450648,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5724 /prefetch:1
  2⤵
  PID:4748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,6951797019888376006,9881520742096450648,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5456 /prefetch:1
  2⤵
  PID:4048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,6951797019888376006,9881520742096450648,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5772 /prefetch:1
  2⤵
  PID:3888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,6951797019888376006,9881520742096450648,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5576 /prefetch:1
  2⤵
  PID:5052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,6951797019888376006,9881520742096450648,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5460 /prefetch:1
  2⤵
  PID:4504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,6951797019888376006,9881520742096450648,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5584 /prefetch:1
  2⤵
  PID:956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=1888,6951797019888376006,9881520742096450648,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6012 /prefetch:8
  2⤵
  PID:1964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1888,6951797019888376006,9881520742096450648,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=4632 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,6951797019888376006,9881520742096450648,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5388 /prefetch:1
  2⤵
  PID:4392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,6951797019888376006,9881520742096450648,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1644 /prefetch:1
  2⤵
  PID:748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,6951797019888376006,9881520742096450648,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1688 /prefetch:1
  2⤵
  PID:4748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,6951797019888376006,9881520742096450648,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2952 /prefetch:1
  2⤵
  PID:4156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,6951797019888376006,9881520742096450648,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3924 /prefetch:1
  2⤵
  PID:2804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,6951797019888376006,9881520742096450648,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2072 /prefetch:1
  2⤵
  PID:2356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,6951797019888376006,9881520742096450648,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6388 /prefetch:1
  2⤵
  PID:3896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1888,6951797019888376006,9881520742096450648,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6604 /prefetch:8
  2⤵
  PID:736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1888,6951797019888376006,9881520742096450648,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6340 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:3012

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1700

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4368

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3892

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:4872

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4444

C:\Windows\System32\SystemSettingsBroker.exe
C:\Windows\System32\SystemSettingsBroker.exe -Embedding
1⤵
PID:5080

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2296

C:\Users\Admin\Desktop\DanaBot.exe
"C:\Users\Admin\Desktop\DanaBot.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2384
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2384 -s 300
  2⤵
  - Program crash
  PID:2468

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2384 -ip 2384
1⤵
PID:4816

C:\Users\Admin\Desktop\DanaBot.exe
"C:\Users\Admin\Desktop\DanaBot.exe"
1⤵
- Executes dropped EXE
PID:1568
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1568 -s 264
  2⤵
  - Program crash
  PID:3880

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 1568 -ip 1568
1⤵
PID:4604

C:\Users\Admin\Desktop\DanaBot.exe
"C:\Users\Admin\Desktop\DanaBot.exe"
1⤵
- Executes dropped EXE
PID:408
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 408 -s 268
  2⤵
  - Program crash
  PID:444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 408 -ip 408
1⤵
PID:2340

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffa0a413cb8,0x7ffa0a413cc8,0x7ffa0a413cd8
  2⤵
  PID:3492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1884,3207440979643257592,13168914955767728647,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1892 /prefetch:2
  2⤵
  PID:4332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1884,3207440979643257592,13168914955767728647,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2312 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1884,3207440979643257592,13168914955767728647,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2560 /prefetch:8
  2⤵
  PID:4088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,3207440979643257592,13168914955767728647,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:2344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,3207440979643257592,13168914955767728647,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:3532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,3207440979643257592,13168914955767728647,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4108 /prefetch:1
  2⤵
  PID:4172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,3207440979643257592,13168914955767728647,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4916 /prefetch:1
  2⤵
  PID:2400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,3207440979643257592,13168914955767728647,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4696 /prefetch:1
  2⤵
  PID:2036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,3207440979643257592,13168914955767728647,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3396 /prefetch:1
  2⤵
  PID:412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1884,3207440979643257592,13168914955767728647,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5284 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,3207440979643257592,13168914955767728647,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4716 /prefetch:1
  2⤵
  PID:408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,3207440979643257592,13168914955767728647,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5404 /prefetch:1
  2⤵
  PID:4336
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1884,3207440979643257592,13168914955767728647,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4140 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,3207440979643257592,13168914955767728647,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4884 /prefetch:1
  2⤵
  PID:4756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,3207440979643257592,13168914955767728647,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5896 /prefetch:1
  2⤵
  PID:2252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,3207440979643257592,13168914955767728647,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5416 /prefetch:1
  2⤵
  PID:4128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,3207440979643257592,13168914955767728647,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3848 /prefetch:1
  2⤵
  PID:3196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,3207440979643257592,13168914955767728647,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4732 /prefetch:1
  2⤵
  PID:2452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1884,3207440979643257592,13168914955767728647,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6168 /prefetch:8
  2⤵
  PID:3660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,3207440979643257592,13168914955767728647,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5712 /prefetch:1
  2⤵
  PID:1124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1884,3207440979643257592,13168914955767728647,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5668 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:4340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,3207440979643257592,13168914955767728647,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5436 /prefetch:1
  2⤵
  PID:836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,3207440979643257592,13168914955767728647,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6588 /prefetch:1
  2⤵
  PID:1704

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1624

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1500

C:\Users\Admin\Desktop\Lentin.c.exe
"C:\Users\Admin\Desktop\Lentin.c.exe"
1⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Suspicious use of AdjustPrivilegeToken
PID:2468

C:\Windows\helppane.exe
C:\Windows\helppane.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument microsoft-edge:https://go.microsoft.com/fwlink/?LinkId=528882
  2⤵
  PID:1520
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffa0a413cb8,0x7ffa0a413cc8,0x7ffa0a413cd8
    3⤵
    PID:2300

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Suspicious use of SetWindowsHookEx
PID:4212

C:\Users\Admin\Desktop\Lentin.c.exe
"C:\Users\Admin\Desktop\Lentin.c.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5616

C:\Users\Admin\Desktop\DanaBot.exe
"C:\Users\Admin\Desktop\DanaBot.exe"
1⤵
- Executes dropped EXE
PID:5680
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5680 -s 264
  2⤵
  - Program crash
  PID:5788

C:\Users\Admin\Desktop\Lentin.c.exe
"C:\Users\Admin\Desktop\Lentin.c.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5688

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 5680 -ip 5680
1⤵
PID:5760

C:\Users\Admin\Desktop\Lentin.c.exe
"C:\Users\Admin\Desktop\Lentin.c.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5864

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
PID:6056
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5180
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 828 2788 1132 812 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5204
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 828 2876 2852 812 {85EE815A-7738-4808-A14A-3AD87E32A3BF}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4640
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  PID:1980

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:5496

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1900

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4136

C:\Users\Admin\Desktop\DanaBot.exe
"C:\Users\Admin\Desktop\DanaBot.exe"
1⤵
- Executes dropped EXE
PID:3616
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3616 -s 256
  2⤵
  - Program crash
  PID:4332

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 3616 -ip 3616
1⤵
PID:3444

C:\Users\Admin\Desktop\Lentin.c.exe
"C:\Users\Admin\Desktop\Lentin.c.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1148

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:2496

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:5080

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5704

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:5812

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:5732

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:2120

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:3316

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5876

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:5960

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4812

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:6116

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:5132

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:124

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5344

C:\Windows\system32\BackgroundTransferHost.exe
"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.13
1⤵
- Modifies registry class
PID:916

C:\Windows\System32\oobe\UserOOBEBroker.exe
C:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding
1⤵
- Drops file in Windows directory
PID:1696

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
1⤵
- System Location Discovery: System Language Discovery
PID:5384

C:\Windows\system32\wwahost.exe
"C:\Windows\system32\wwahost.exe" -ServerName:App.wwa
1⤵
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:1412

C:\Windows\system32\wwahost.exe
"C:\Windows\system32\wwahost.exe" -ServerName:App.wwa
1⤵
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
PID:1608

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4c1a24fa898d2a98b540b20272c8e47b

SHA1
3218bff9ce95b52842fa1b8bd00be073177141ef

SHA256
bbcc378fcbf64580e7a48b4e7ca9be57fa0a1f2e747f488325685bdb18d73a95

SHA512
e61f196e7f1c9a5fe249abe9b11eea770fb2f4babc61f60b12c71f43e6fe9354cf14869daf46abc2c2655bce180252acd43c10562a2dcd31fa7d90d33253820e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f1d2c7fd2ca29bb77a5da2d1847fbb92

SHA1
840de2cf36c22ba10ac96f90890b6a12a56526c6

SHA256
58d0f80310f4a84f687c5ce0adaa982eb42fe4480510399fa2ae975d40bb8bc5

SHA512
ede1fafea2404f16948fe0b5ea5161ccee3ee6e40c55ff98c337eac981a6776b9c73dc030a5c59e4347aec91259f497539206e71949c33adcecbf2c846709e14

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a3e6f5076430377b5ed63759e4505dd8

SHA1
aca0723c432a006346b5f73f8ff4bd020e46b7e8

SHA256
f8e745e2c17d26417ab88afd9d8975697e2f438378e97f70ea9646968c906c4c

SHA512
11e2aa0db5adc59186f4077c40248279574ee2136e511a5a52a2e42ea8b429df16b2c79dc944298f53051f79ff04139919116597c7c959812c5dffcb8a82f13c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
908ef0f6b5a4afef4c6f9c525fa5a70b

SHA1
e74bf08fddb062dc95f855143a8fd0d1a531d3be

SHA256
5bb18fc267c55156ff5c08d196c920e3565212b6c1f7754443be8375763c0907

SHA512
f2ad8a8f2c5015c088287b6678bf53b4fce928e88b7a125b247b26d16d362e5a5775999aaa387780c4c860f591134ae3058d4a2c1df6d4c7bb2d7f8d4e3435cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
5cedd22b8c5f003fbb2a47259508e59b

SHA1
d300639bec919fcdbffc250f5a753b16ff1ae0d4

SHA256
bdadf133c40354046750863f1f5d0e08217b25542ead37cedaf56138ed10c65c

SHA512
a156349f12457b6af13a0200038a178dbc4f4ba9e144a5a2c3c2ac2a4387d73c78a409476172a5f2a1fe6ca19bbda93e7ca16a826424e42a83dc3664fe39e7d1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
384B

MD5
123362e484b7826ef802915b977e260b

SHA1
b7135ffee501e08823ea7051f2172a56a9a03e97

SHA256
51748abca1969364864217ccacf536dcfd179e5e3723f0cb7053c622316ac0f8

SHA512
65abcdf8848785f9999d6e2e5d9e441a470cbb87264d947d261947ad40e4aa41a433570344cce56806d6c3e4d0cacd1b80e5a4a352274e41c66bbbf9fbcbce65

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
b831b8e723dc36753d2a770aa416bfe0

SHA1
d0348f5af44e407b2c8c5ee154df90944f32eda0

SHA256
d46885cb406bceca6a2c406fe2ca35c9fa264d8c74942743acf45a28dc925522

SHA512
327def56b3ed9c5b621deefb871d108a5bc364ad183b959b164c9ab6f9582a5261ba91a54b8e8aa1784a40af5fe468d4dbccf20717cdd7c3725f92a069f2de8d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
649d386411bb00de5270ae9730ba6716

SHA1
83c2572eca81fdd773f9169a32ef44c61aa9aa2d

SHA256
5acd7281df4e335c35a30850fe1070ae4f835aba5d950ade1bf04a7ce27b4e4d

SHA512
7a71e4ad6a2545e0063fe219968bbfb810cfa9a315ebed4e0d205d5a9b66ead9e71410069a8f0c078e77811b672129970fd07a1d94c60f3410b9609db789e54e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
73da44d78aaf88962ea615650a8f4af6

SHA1
53c373d248d6bb3041e0e7c2dac80a189eafabe8

SHA256
4d1163d5954602547b9a6a4f63bd92ef888d8fbb8f110447d81511f9ad12737e

SHA512
24cc4a87af7a644e136bc489ebb2b0415065f8573950b43c36eddd1a2e3c27d18fee1b68cabd39e553e9266d28402db4c77598dd142b043d057f46584ec7851f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
4f53dd874db6e93c60fffa9f45b78514

SHA1
0e92345e4e25e53760700e3f01d09bdef0e8b3a7

SHA256
4af253065ef7d00248f95771c2fac0bb0e32e989d9d6eb71ab754e3dfe0e7e60

SHA512
99e6823bcfffa81eaea7ee2df6f2d861ce3ad466a0f962d2c9e688ca3b0b5e10eb3dcaa614c11193e97aae24f5fb4e574c05ae17cc23210bb32aa9a35e20a59c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
318743ca926975b19108f9083856dbc4

SHA1
3908eb50de456ed8d6a110ffb9d0328ecc470926

SHA256
3869b6207e47733e5c89cf87d788cd72534ec8b1a5aeec9d39d02319fa88da3d

SHA512
4836c3a3d059b9d1a5fbda598780ab58dc6d325e324d7e9dd513832940c77fd26b009345baa262fb1423aae9d30271742f001dc219902656a89e5f5423eb030b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
359085483d3145670575c3b7fcd3a95c

SHA1
144dcb3b8381637e0d901fea20fca6f598af8143

SHA256
d0774bf6beebce3a2ecb90d30bed53c83e42e0cb65c082222350b1b4f736de19

SHA512
61865c2a29f0a38ddb964ea5513e08a1db1db1f5eaa436c3333a78d97dbe28181ee58ff5f248612a2b991d03fef088eae85a8af4572c77dec5140ce882bfe217

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
4ef8183fc2094cd519670aa506918684

SHA1
89e48e1f521b02fd63eb201724b3e722c0233737

SHA256
3546389a7af56bc0bda13eba9d5293cfa5888ca6d4a4697fecce37967dd9ccba

SHA512
3627f7e79370b14e29cb66ad7c38e236b19c93ced81252d041b856ccac1dd8e5ab61420e301cca572fa47c163689ee6ee667ec4bc556603a9acbded3833626ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
af10ddfea75dd20b518d0e6ca1c3fbef

SHA1
024bba6fb42e1819a941861bae199b691fd83825

SHA256
d8f5b6b7e79df21480e84493093e28f81ab670d4a0c490ce420c6fba6cc36e84

SHA512
631fdc9dfb0fe42020eeabd689d3746455f2225003fa99f13f05a5951a164ca5f482a5be4daf9c46b3998d94c92d41e3f01e6ee32a936ab4a462930cce892277

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
ce6709b5b78427687870eb90602a422f

SHA1
07d36b216d342f555d973b942d936e688905ac0e

SHA256
efcf702333b4e785d75e3e8c193ecb29aeefb3ecdab7d508b7b2d4ddddfcbedb

SHA512
19a202a1186a34c87ad60b935d73971168df0512a5c760b5658b0f013368cc05345edfbc7c67f6e031ad7f83435220afaf32d554cb8f08d10a4753f418e34fc2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
485d68b1809f388a5c1c4bf870ac7fe6

SHA1
459a3fd841e8cb83c6fe56f492116661740a20e6

SHA256
991cf2a04e7be58e981ec782eed73373d508a5d991ac9df91b175a49b237d68e

SHA512
2c804a2cb2f3ad988041c23875725832a7a52468d4a785412b975d9b644003b79a5d48b12baafd8d194d68289dc5bf76c3dec6bb8b8b18dbc14a79f94833bfd0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
6fed02a5910ddc7876ab1037d3951f06

SHA1
518a111bcb93196c3166a37658e6573384602eb9

SHA256
e41b4ec04c1734072b98e689fa71884d5f19028a8da28b0b5764d7606493efea

SHA512
83bce876bd34988f5273d9b22abfe91bc477fbb1d088fbd483f4acd600f0ed47dfb9eb763ea7c7a27f1d79dd4bdd7e716e63cb61ce79a99138b3a5cb17d78e9b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
3ce0c561d3735c269e085f93b5cfaa8a

SHA1
dc4116766aa900b65f7c22bb74921f9035cbc781

SHA256
a5cd67eca82f6db898fbd5358cb2e0d60a55c59f35d91b17505371d7a4a21d57

SHA512
85966de3eee139984f267c5a3fbf390e25c50fa4fbe5e08365d0db13327aa407c4159e99111f7d1e81ee74fe01268b487f96ca483f0b0f7b3df90c23e6badbfd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
3c5d441e5cd0de28f9e0fcce35083a9f

SHA1
13b63cf0a96f5a38f1b92a0db181e247103aabdf

SHA256
c1171aaa46fd73941592c52f78d5b5d501d0254d8ed3f8abd55d8ead1a872e9f

SHA512
82a3252a247fba7ecce93144f040946a82d65e1853cd8f9c8b1294c27858eb25cb7a6996435261dd527cac6b580dd896f1fdd79d6a51d69f16323fd1c15dd6de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
9721127121a1f8b193541c080418308b

SHA1
22d455e152645348b19af63bb180323ed496e334

SHA256
b69890602d8a95755fae33ed416aac4249b7518e90b7765e4dd63f42be7558f0

SHA512
17fcbfc928a84ddecc4c8c585cdfc6f51c8947267f238256cfb4764cb5a3a0adf34a4d8e3c3499d7be539c7e3afdf36626b7f8c758c14d3455d5a885fe25e852

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
2eaa8be9fa311cb8b77bc28fb2ef2a79

SHA1
0b30af4f5887ba4cc8a81ae42dd5c68d1adbc335

SHA256
6fe51fd25b51940f8c2f25b3efe57e9dcb9726ebda61a5021fdbc832631efb32

SHA512
777ce797625c7dbe9b04985f715c29abc3f2cf4341a76f53954018cd536830e9de5667b13a1eee759b5941080d449b4656f6fb737d17691ed5ac9df84dc0f65c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
2505c1edeb567ebfd37263771d9e9d54

SHA1
a35c4433b9d706e832452e95c9b2d62b0ab00507

SHA256
0b1e45bdec167deae905c7bb201a8af8fe235c943925f91eadba0ecb6fa176ee

SHA512
d429f8c20235d9af81142c693e7523b84821fc5afe2300e4dce9bcc59ad662a97091aace27e00aec0bb6960d27ad2c438ad35574b0e40224964ba56ca98522e0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
6b39a400f531026a7a189566f4092caa

SHA1
29334e0d913874afe59da42a9d1804f7c2cc40ae

SHA256
caf2c4ec25cd3c975d7605a370ec2995f54b45e82b6efece836b087c4209b749

SHA512
337840924ddfbd54160cc90713a9ae4f3c0a3026b276e15c718398166aa26484d6288fc4fff9a02769b66da5eef2b66d079163eae5093fa447dbd4f883011dc5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
a59c3a6c502fcfbb7a0519e72bf884ae

SHA1
dce7171a54763c2ba9264657502f196acf2a551d

SHA256
6818415bddef16124b75cf1150a33217f29f5282b45f7491efb1cf239044f588

SHA512
5cc9b311583c27571bca58e665e14faae8dafe959d556fe9089c83bd57ec1d274307132d39db20cc02e171ba559b025986141f866746ebd8b91b433397a7f128

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Filesize
323B

MD5
a34e6c08ac8858f3f0ed7e2f4b58f841

SHA1
665a054b0abf1679c3bdab793327fb05d420d87a

SHA256
ffd4b1e0f0e39f6b6c042063e66edc74a78ee847c86c438f8bde41d85fba7411

SHA512
cbf6d3daf1a920ed557e41cae876160899fd5d58da741940bfb1ff57babc618194407117518ca2a281735a2eb28afb215a1e32a22ab15d512ff797600821d00e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
656b41f815abde4bee54e83a00e7efad

SHA1
af1cf7f3a374a25f37bb1fb17645346b088ab3df

SHA256
489e5b6ce8290eda3d7a0202f977b66ea99f170c03f7470b7af65d75d4e40ddd

SHA512
0563235babb7250303809ec649a9510f1f3be6123670069b355dcaced7e083e7afe4f446f873c5429ec532a909db8a61d245ec1f229fb2bae1c32a036d38d4dc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
6f6990b163077a8a93746cc37d5a613f

SHA1
fbdd4a201bee0aee59d49f149ffde941e446734a

SHA256
d77e570fc33d8403ba1e3234b807b65825193c1d3052d69ec78a44e77a5edb39

SHA512
8dae358d6da5deea97805664514fffa2ced850fca561671bc198e82b4f78dd40d24977b8589f0884a502f8e16230f81a3d0ffc679370b73ceffcb957686ca2c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
641ef73e1d5d15fc8da9697bf47beccd

SHA1
0b9f65e89e8d5b2b4feb24c7db9f9cc341298e84

SHA256
90194eeb1e847c1b2e1d14b342c3861de700131b75b098cac2f0fafdb025e394

SHA512
78c4a9ea748eef182ffaf64a4c5d4c00a02043a0b8db12007b0f06ab3ed567e2d0366123fd5bfe461564e21f441addb2aba1ccbb086a5b22ad8f2d8a026077ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
7c90f783f453e09b127036ca7e914112

SHA1
4966b01150f14caa1cc61040481d77b6e5ee7f1e

SHA256
c9b5cd07e1dcd095258b50df827dd731032b08ea0f43f0dffa144fc443dd2a2f

SHA512
cb6b89592f04870f50d6a338961a2484ff0fe9523243433b935d04cf90fa70847438fd936efa968939833a1f53e5b75178592290485cfdbca158ef5a481833cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
64d507c2145487c80db37c7d845e2a54

SHA1
3d73dd219a534e45099be879620a5ef01c8e7d03

SHA256
1c292f453df0e2b1963790378d10f993f9c11bd37761e63915f6d189f395f7b4

SHA512
5a1bbb8226edce9b34b6aaf2d81548f878b46f63bf6ed2bddc6f5e90418870155efa162ac788a86477e063f48f59c80ab1e8318540a770b76053dc53d8386b6c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
79619ade0e0f62058a90ba8923d04050

SHA1
be50180e342e7697fee0c6682f5689078294ee96

SHA256
c5826869b55393d14540101b9ad79cc3cfb86c0b23ac48a2ca10f4efb28f0175

SHA512
f00eef74c3ae39bb905b46e024ec33c8173ea12ff19cc2ebcf36ec045ac718aad38265c3934f57449e2a51f40a2cc1baf5b9b9a5423ecd305f3e13bd6c06be14

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
53ccba616f3111d495fb68be83f335c8

SHA1
b2c4febba7fe6b116c177bbd0adf39cec75c4b35

SHA256
54e3f1e1e2f9a6e28a2f54c8cf41361dac8e7268202c5fecc0720284591ef967

SHA512
a327c27125652f3085320d12a6244ed189a2c377aebc7a15dd28e4fcb0f6a1532fff4f2d3aceb7b4adffbcb907cd37452d2aa27f40dc34b44a6577f0d9b74f85

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
f20cb2b216f534452cd6e28677e7e299

SHA1
722474c64c00ad6b5a34a863f670a9a4676c0ab5

SHA256
c3a2b3ad9aacb24e939761607f6c37ea45c146e97939f28e53d22e86b923ac8c

SHA512
fc900efb1f5a2f2cddc1945d96439449f29129e422e05976067604dd8acbc884ee532ec7effafe771fea8304cf4c9ea5837e1a4f9b3a71b4246abf6df2b61b62

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
ca9854cdd8c2576ba7f63c783712dca6

SHA1
e3f040e97ab1da99ab53e0de133642b432ddc754

SHA256
b48f864f5e8b3c141ca3f376474525b44bc1cce47f5f3c3141af4735e40b55e2

SHA512
976d26c405b629f486f044ebdfe4aa6d8c912bbe67f519691437a6c7746aafaa9efeccef4839f73b2a014e127b164b64416f8567146e0999038769b77c020bd8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
f523369f7cd70e9bdcde76f75df12b24

SHA1
e10920a68d0e86da7aa6b67f70bd2f5fd2bc4f4e

SHA256
49d549a3ab37a9fae5f13a51a2bb423c9638beebaab1de3007af17857bc011de

SHA512
0b03aff62fff44352f59de93930ea496301133a26b6a91fe8b873caf760e3d044fce03ef2b2f8fe3fd1e8585bf410c47980a7c355fb330633c1e97082073eb8b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5a3b93.TMP

Filesize
371B

MD5
a87660678cd146e58628663ad10001c9

SHA1
66d2af22c4cdf2eafa3be439335a813b9e88c1c9

SHA256
a95fb9825bf1fd26ac35c1e45f041eb3a22d9df9ae8303439db86761772d776d

SHA512
94edd928cf614a5976101a0dcb351bee9dba2438932945c7165f0d2ec3ad3105c86e8b72ed0a28d712f05f637dde4aea5649f7c17629c90c406e889d4b23760d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version

Filesize
11B

MD5
b29bcf9cd0e55f93000b4bb265a9810b

SHA1
e662b8c98bd5eced29495dbe2a8f1930e3f714b8

SHA256
f53ab2877a33ef4dbde62f23f0cbfb572924a80a3921f47fc080d680107064b4

SHA512
e15f515e4177d38d6bb83a939a0a8f901ce64dffe45e635063161497d527fbddaf2b1261195fde90b72b4c3e64ac0a0500003faceffcc749471733c9e83eb011

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
919fe007398a9e7f0c7938b18f874a66

SHA1
55310dfcc7e4fe1a6c52d79a9652d06179cc98d5

SHA256
9f964d465b16d3585e79aad1db27a917218a67ab535cf8565235ad29574eed53

SHA512
59480c23597b0455cdce9a4cebe1f2ae86f97fcdea1d194757ed2baba288e4f4d89fb04ecba1046163ef20d7556b3bdf66fff7d29ba1cdde14434663297ef1b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
344eeac241ca9ee1907d6d0ba9c31392

SHA1
7b20d70a5f1743bbcddb76a42334d9e20473633f

SHA256
8d9f3b559786539661769e3fd2702e41331022ffb2f0003579d3d155cfc19498

SHA512
e128b111c430245410d59090177cdcdc1d2fbe4877daac57f0aa6f39c2d056d3571459cb28e4736060532a664aa752d008a70d4a0fde1b5c5393a2c530f65481

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
903014e4f7d730413fb45c0c4eec1173

SHA1
2b0131530132d0ea88990988daeaee5ebb1a9a1e

SHA256
f855a760f9c20241ba60ccecc2cddfb0d80f9543ec8dc729e1cdf45dfa4a7959

SHA512
dc7ad5113f6986f2822891990ca959bd54549a0a703a5305243233f4893b61397fca68df980ba1e495cd45609d220f9f90f5dd0cf155f8069cbe10f1ee1a6659

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
6e388c51ddd0fbe129237f531a410c44

SHA1
f015bff36bfa141ee34fc1418ce9df5380684b84

SHA256
54e64a0374f17e03cae4d68c00f77a1223d4df7380b7548c1720e3d6771fc2b1

SHA512
c5fbb79a3631cf98f2b60c573a17a2d6eadbd1f7befeec0d6c119e12ea93fd39e587cd1856bfa699b24c28f6a5f9fd601d8ef1f2762c35dd4893563da5a34236

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
0021c3a36aefdbd8c2498a9d8bdc1b3f

SHA1
a77e8ad0eb6477a5d46c967f868c180627081b37

SHA256
cd59ff14bde8ba1c3f307b1ece428e6d90e5bd95874b759a84384da2599bb302

SHA512
675e0f79702e02d5364306ef38ba87b6248bb0b7b9790551a7196869e261c051c4fa7eed9b4fa8e84588c9bf0a3a97913806a69cf51244b934f1ee76751d5657

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
7d28fbb2d7d00f831db4d14a5ef7b6cb

SHA1
aa921cabacfb46ad5ff7e77e0bf99be283123e8d

SHA256
c9472f822f0ba10467abca8f2fcd86c4fc1bda4c177fa19851011875f3646982

SHA512
3dafe61e25a45ae0c95be243f1fb9ffc6c90b3219831e5bfccb6cb60898830ee45544e782d4318298d5aa7b686698a6d5e1802582c4dff6f6d2c04eace3029a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
b38ee5a3b8d738057fb6758ad3b17bf9

SHA1
3d040f7c423a20f27c2ec14985af6336d826e81f

SHA256
2e0a2cc3c296e2a1ce2be152c592e62a661866a3759244077bdb5c23f91461c9

SHA512
50a358f4b785e92a2496e1fa011a96c5de869aa287c068792c3d64084b21032be6c9044448220d02e668e5c6d7f84788064e3b5906cd454b8e4d9402730a1f9d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
1eb0ed2520ba4a18fe7fdb5e0524511f

SHA1
30b099d7953b50d79fd722ab0648f2dfb7e6fab2

SHA256
ece1d17979a0b3395ade6a93f89f56f4a4c50ec9b744d2cc52517d77386cf276

SHA512
600f398ed8c79f9b7fb11d29e8ef1c3220c817d3c206eb25c0416d21e704309ab87fc1f880ded21dde954126397eebfc5ab641134216b47d145b4326fe882bab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1

Filesize
264KB

MD5
f25b8dfba7dc5fd7b17611edc7f51c7b

SHA1
ddc3dff9dc4d39b35d0bd9b137241089d6749511

SHA256
ac13180535838b9149f3816c6f3c348182757c02c3062001420fd60f1c14912f

SHA512
16a514f17b60b8f5fca750cef9ac5982840f3f24b63e54aebe7063b5576407939f4283d6cd66587f71e10169f9f6db0b0b983ed351c61c2c78911dfa95ee6ced

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1

Filesize
264KB

MD5
e75a282543e37fd89cb1e8293f4a4254

SHA1
2f070781596ebd4656307e3110e5aea1386af270

SHA256
363e8d1ac155dab9625c94f100d8e573843b82294c2cb82892ac7a86a24367a6

SHA512
867f8f71aee864c6fb5477d5dd61cfcc4fb29dd8f5b9ab43be1064cd3055952f1b3fb9338902183247f37f9f0ddd126d643ac7f72c1479f374752a405cd67c64

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\JCQGQUK0\microsoft.windows[1].xml

Filesize
13B

MD5
c1ddea3ef6bbef3e7060a1a9ad89e4c5

SHA1
35e3224fcbd3e1af306f2b6a2c6bbea9b0867966

SHA256
b71e4d17274636b97179ba2d97c742735b6510eb54f22893d3a2daff2ceb28db

SHA512
6be8cec7c862afae5b37aa32dc5bb45912881a3276606da41bf808a4ef92c318b355e616bf45a257b995520d72b7c08752c0be445dceade5cf79f73480910fed

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\LocalState\_sessionState.json

Filesize
119B

MD5
b5f7503592869da629440b518a9188df

SHA1
a228d91baaf6d06fd4049d3908492c58a9b7eee2

SHA256
5a8a278f47ab6112f94b75af5402ff43112bd70897df99b0bc554d77edac2ed3

SHA512
ea33bb35cd9373a0037180c01704d66d7a758b4a5ce8480d1302076e8c31f97516ec466635a48f4a77a01cc8ca27ac2045e9391582f93fd9b7ec23e28eeeda07

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\BackgroundTransferApi\bd15ab84-4f5f-4103-8974-f58f195647f4.down_data

Filesize
555KB

MD5
5683c0028832cae4ef93ca39c8ac5029

SHA1
248755e4e1db552e0b6f8651b04ca6d1b31a86fb

SHA256
855abd360d8a8d6974eba92b70cbd09ce519bc8773439993f9ab37cb6847309e

SHA512
aba434bd29be191c823b02ea9b639beb10647bbe7759bbffdaa790dfb1ec2c58d74c525ef11aacda209e4effe322d1d3a07b115446c8914b07a3bce4d8a0e2c3

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat

Filesize
10KB

MD5
327975ba2c226434c0009085b3702a06

SHA1
b7b8b25656b3caefad9c5a657f101f06e2024bbd

SHA256
6fa9064f304b70d6dcebee643ca017c2417ff325106917058f6e11341678583c

SHA512
150a57c143fc5ff2462f496f5a9451310b8d99e32c4d570641204c8062a78590f14bed438ac981e8b0609a0c87b859a1f8502a78687bc36c3a9529d633a58e51

Download Submit
C:\Users\Admin\Desktop\ClearConvertFrom.pptm

Filesize
316KB

MD5
377e526fd9b5a440c689e293c2e8e95a

SHA1
739d43b5aa0fde76ea2ab04bbd079b790cdcaf4c

SHA256
f851aadbfe3b5a00571c24a768e13142fc92a3be58de4103579f9b06558a2cd3

SHA512
b274ce07abafbd5d014fdbbadca9f03d08168be4f63d6c2360051ebe726ae7ea6c6162ea37bb13e1edf36f6c28e4555e278f87f050d3063826ebac9baad01fe2

Download Submit
C:\Users\Admin\Desktop\ConvertToPop.php

Filesize
769KB

MD5
fb9acc85ec7a9f5f12f0dec7d1b6fa3b

SHA1
dc1791da1baf1641551a66dc450cc967d6a09a5f

SHA256
bad1f40378b481dd3b8ce50d28622fd0210bd5dc6572bb5805f3e179c1422d29

SHA512
4654db7ee8bd6b7979e8abfb02b4070b93ca3ebf935f9e9829f7082f921723c1938a25974fa358eb5c98cde3714475345c62fce0cd48db2e2a2e7eab407f3909

Download Submit
C:\Users\Admin\Desktop\DenyTest.xht

Filesize
377KB

MD5
d2cf1c5b2178db4d6eed613b1134c381

SHA1
4696f1a773e72f2f4a1bf4f64b7feef9ead0cf04

SHA256
fa60bd963db246caf194602da5442ea2446cc5fac634a3e02b63c8babeb992dd

SHA512
4d1c09c953a8d76e73b3c97f5900f832217c7aec00da2c94bb351ac663599a26c00b063022ef6420fad4c4211d1fa9afa5e1364b33b4ba78dfb23b1d6729fed6

Download Submit
C:\Users\Admin\Desktop\DismountInitialize.mid

Filesize
830KB

MD5
9f7e7e793907212f3e7fd4c467269efd

SHA1
81bedb1492d5ae33e6fecbe04f2e20b0d523d6c5

SHA256
e7728772225ff2da6c0c4ba83ec7b702bbd64de5d118a8d41febd23d22c5936b

SHA512
3d1fbdc226a21756fee63e54baeaf7c3fc29de709dcbbe43b610672e6f335b240b3db87f348d66ce4a0f8c8ff9828185dab6c411fb0d3931b0ae7da18a643266

Download Submit
C:\Users\Admin\Desktop\EditConvertFrom.xlsx

Filesize
11KB

MD5
14edaae9b470ddaf6b291a0d3ef6fb1a

SHA1
bbb6497a9553033a19a68a37a7fb79dcaabb2efa

SHA256
3814e4848f14586d61d5dad5e13b0ccd47e25a70ad777e525283acb9bcb5da2a

SHA512
5e4df63a90848a04afdc4dda9bcf06f380c826146bc80f7e5f287152a4e9d439053e43b35cb591757bb0e7fd51b0c6f528f7c6273b9bec2c932cfd141b354aae

Download Submit
C:\Users\Admin\Desktop\ExpandUnpublish.crw

Filesize
407KB

MD5
ca49a65a692d91cbf829f15505ac4698

SHA1
641d86a44d78c7aa34b6a2ace007dd09c4609566

SHA256
f281d2ff1d2e6bc1a33540040af6f8ba26e8aed2ae4d4b685195882498613329

SHA512
5c9d9b0a6ae32cca30807690eac9be023162dfd3c69438ecb5bc4d00c668f682849b419d1682c246205d873a03eac40107a336d99612ff33348e598028b1b7e7

Download Submit
C:\Users\Admin\Desktop\GetReset.sql

Filesize
498KB

MD5
47470dde7e1e1a96324cdcbed2eecc34

SHA1
e049687e6028e7f54cb820687266794329098fb8

SHA256
d49328c6cc667e91d37b43e1b287a3d04d92173e48db8733bc6bd6cb9c7ed7eb

SHA512
7022060983b08d1077d6a62be7e636176aa13c8a06a553930a673970e96b11f6c90a60f3a5baf997dc91647223c42f10ca387ae083104fc39f96f30202205348

Download Submit
C:\Users\Admin\Desktop\LockConnect.potx

Filesize
558KB

MD5
6e2c9758aa5a0b3c3146673318edbeeb

SHA1
616c7f013e9fdd15ed42878a65b25ba04bfc656d

SHA256
e8982fddec9fa84edb89732c5bbeb949a31b20e2b79ea94df646742035556dae

SHA512
db5531619d75f09240cfd00a46931bc1ddf14740c150534fdf99fe557f1b8b8dd10aea0fcbfcf7d7a821a8a65811384bbf4368fdb7cd31f518facb1998155c8d

Download Submit
C:\Users\Admin\Desktop\MountAssert.vb

Filesize
1.2MB

MD5
618ea4c7297fe05a88f5ab9d87968782

SHA1
75a3d926c88b061f76fc0a27aa2eff21bf564621

SHA256
3ba69862d7351bbbcb699bfc2bb161db75fa7ad8ee0a924de0f7aa6be4ed335d

SHA512
3a121bf076ea966221b19fc713e22f798bb6aa6505da982be0ebb3e2ef5d76eb303e7a80540a747a6e8e97447ef70dcac17adad5ce558fd85c8c31ff271501af

Download Submit
C:\Users\Admin\Desktop\OptimizeConvertTo.vsd

Filesize
618KB

MD5
d69a36e5442af6010c7834f112d47150

SHA1
6fd3f028e33c913ebcda2effbb870fa723f815b4

SHA256
317228496dddeae46063cd171f35aa38423a8b68879fb275662a358e3aa358e0

SHA512
dc52e0afbdfc3a8acf5ff08415563374d564d5c3a41253afe60a01682fb1d2aa90b20bb29803e61813926639410b8daaade0efff3381c33cd04f1b0c46d5ff71

Download Submit
C:\Users\Admin\Desktop\OptimizeDisconnect.ico

Filesize
799KB

MD5
649ec60d330f1b2efe84832117b1ed36

SHA1
deb2fb4af57adb5f1b4a435cee789b9d5ca0ec93

SHA256
4dcd9aa0385a492b1fefddc846441225914d8fbb95455cf3dadab7226afbc800

SHA512
c72112dd49f7ac9bb7daf1da57414e2cef0057af0cdbf58781c10217eb39d0c6785bdd0e1a66c99aebb39909e9ba07f505fe59f04c80d35d48ed77d2d37157da

Download Submit
C:\Users\Admin\Desktop\OutClear.aifc

Filesize
648KB

MD5
ed9e44d8d525730de22187bc2daaf407

SHA1
8c6e0322dae47394ea1332685bb9b173c1b021db

SHA256
67047362f3b17eaf65f7f8ec0b7d7ee5796481547eda23434ac9aad896e4eef9

SHA512
963094584b11f5ff4fee1befb7a7453d4e0d21e22aedcddbd24f1bcfe255addf0e05d0111da7a46a1d5831163d9a262956e19f94846dd9195c0a7f98647cd337

Download Submit
C:\Users\Admin\Desktop\PingTrace.otf

Filesize
437KB

MD5
1ac24ae8d41892188cc13f779a963c58

SHA1
3eeda8abb59d3650cae888895428b2f01763c070

SHA256
40ddcf45c7f490cad5316ced754f2ab1547682ebf8c33c72becf83a5c58ea233

SHA512
e9fc31a23e4c14502518949951a8622ec4b2e10f840d92c4fd239c39bfea5aa7f423b875fcf129f60c2c1955d226d27473795566044cd2851aa5b874597920b2

Download Submit
C:\Users\Admin\Desktop\RenameCompare.ps1xml

Filesize
588KB

MD5
57e9abe1cf1499e2eaaae04fdd6e8f44

SHA1
feb7733a9af1b67f9b99ccae69124458b7a25b75

SHA256
e9420e78c14447c5fda60fe97115259a33c1aee97f88723066b5eeabb0d9d431

SHA512
47ab8df31a76acd0fe7c059fdb399a90aea3c3f71def37abb6e83468fb4b944e70d26c4265324fc7dcfd1798a1e2b87a10a54ef413119954d549e8231ca72621

Download Submit
C:\Users\Admin\Desktop\ResizeDismount.mpeg3

Filesize
739KB

MD5
45f87d1f0d85491e9f5969e38299f4a5

SHA1
0a13070dd9ed7c2549f14148f76bc0f08ad50183

SHA256
e618c052e93de0b9ec629c49cb71ce2690b3374edadb4ecfaebf2e247998de0d

SHA512
3f38e0fe1612e30e7ac34906943a4fd428ae6686b59bb9b86767f09170147cfa97598f595364a4b28fbee8db26058468b1f80c467f5ab1b703f98fff1a86a606

Download Submit
C:\Users\Admin\Desktop\ResizeUnlock.exe

Filesize
347KB

MD5
502dcebfafaff2ab5ac19357b2a77e44

SHA1
1cf6dbd9777ab43fbffcc1f6cf29f15589fc7401

SHA256
6879ae48365c5b9b2f22ada2dded1896f3110f9edd38e563a3a418f6895a3667

SHA512
2cff7bf0111181fc2c2b1705dea9f3dd2ea1d4f9faa2e4179bf57feb8c6056b9a5fd2f8ea64c8d3a2dbb2375a1e0706c3fdc25a1b29a5d564cc553657146533f

Download Submit
C:\Users\Admin\Desktop\ResolvePop.wmv

Filesize
528KB

MD5
c4afc44a094530c1e5ca34cea6f0c37c

SHA1
9c491b833b6ff6becece58d218a57afeb559f3a4

SHA256
21cc229b32b82ce91ac55766f78fc494424d2e8a80c064e157d5f50ac7c2eb18

SHA512
2acb8805926fa7a96cc0e0a1b2b188aca3b3f07da44563295ffad5276e7d7c54018fc4f95aa27c61149fba35eefa696969ff284dfba1a6452b06d307cb86b1bd

Download Submit
C:\Users\Admin\Desktop\SaveBlock.mp3

Filesize
467KB

MD5
1e7e98f4e8861b4ab88bbf7693235d3c

SHA1
7b84e05e7ce2f8820775b6badefbe7ae9f2e1608

SHA256
2badd0affc0a164fab41e0ca60d00bccb4b27ba366b15f5b232e373baee00328

SHA512
52ab78ace2394b935d0aa5519aa521e1caa79900d86049bf7743f5e162cb9fbd449f132ab8f7bc249dc2e5fe25d1624b1b564a92993af8010c01094d1f6e41a9

Download Submit
C:\Users\Admin\Desktop\SelectReset.docx

Filesize
18KB

MD5
e616fb35eb00a0c3f8d0a3c72dc5c442

SHA1
cc17472178dc6140c387438e393db308fcdb8354

SHA256
321be44119256bf3ac7bf4d9ed023d47b2c8be8403e073e6d5c54ba3036d6983

SHA512
ab7d88fd3c505b1fec6992887ac95e0c2b6a68f5318c90395c5f2f5c3a9ab690f385d0fe8e82129cd466b9d26256c267d8eec00ddf605db03bfe42f1c20ddfc0

Download Submit
C:\Users\Admin\Desktop\SetEnable.mpv2

Filesize
890KB

MD5
981caa5c0c36b6caa8882b6aada526db

SHA1
6d2ce1e979240957970290744d4048ad2a47fc90

SHA256
0cdea18cd76bdd8e3a78b1e7f57b4d73b4d27aa23d155875acc53a40d9ae776c

SHA512
17f72edb6d194d1df1b7726f97e427729193b809c2b45b7cae1a196b3d03f86b10404b0ec13893e172119d55b6da6844fb469a7c242e47e8db68257ef4a5f1bb

Download Submit
C:\Users\Admin\Desktop\SwitchResolve.ttc

Filesize
709KB

MD5
cea0127c600bbb15b4470ce72abc6387

SHA1
25910d728899d08ad4f4de2a1e8b7ceedef137a3

SHA256
873fffd9bb8d0c73d378a2b49e640df04068126ca31a14530b0e0c48fbad4826

SHA512
9ad069bf9ac57cccf94cfac5c089974b1246158fcb7d90b13b57e372f7f9f0b214cbb0e217513b8e9e04c91f775e965d654f819054b0e34714fefc79ef371f09

Download Submit
C:\Users\Admin\Desktop\TraceSkip.xht

Filesize
679KB

MD5
e5522ce98ee1797e48a236f84ec459c9

SHA1
b7313e6f749b126b5b90a4eed92198ac55bca4ef

SHA256
e8476002bdea7815c46b9eca37a1190a99fc24c655526d650e7457d39934e062

SHA512
125f303be7dbd150499bc99e71fdb97ed9e7e1cfd1adc900eebee1f05fc8c4f1214beffc62cd65f6acdf96680d94023ba3e6a61a046cb1875d4ed1abd7bc4ff1

Download Submit
C:\Users\Admin\Desktop\UnblockResize.ogg

Filesize
860KB

MD5
9d7d70656c8128970ae5431b3a2bb85d

SHA1
9fc61c190ca6d6ea7953bfa176d18b84a1c01f4f

SHA256
d59c9115c795e5d33d7a1f1eda90dd976a97147a3c661a33d99b47e65d6d2f6a

SHA512
1177457300aa7ef98d759b5ebba5f00bd392d5b651198a3902d05806925be476c4e5e19f76f69b1720f118b512d6820b1fcb8bdaee1c569499a8bd8cbfaa5141

Download Submit
C:\Users\Admin\Downloads\DanaBot.exe:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 468271.crdownload

Filesize
2.7MB

MD5
48d8f7bbb500af66baa765279ce58045

SHA1
2cdb5fdeee4e9c7bd2e5f744150521963487eb71

SHA256
db0d72bc7d10209f7fa354ec100d57abbb9fe2e57ce72789f5f88257c5d3ebd1

SHA512
aef8aa8e0d16aab35b5cc19487e53583691e4471064bc556a2ee13e94a0546b54a33995739f0fa3c4de6ff4c6abf02014aef3efb0d93ca6847bad2220c3302bd

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 545094.crdownload

Filesize
1.2MB

MD5
04ee0eff07a7e545f7052031ca0d8133

SHA1
56676f042cca5170a82f1fdc38648923297e8147

SHA256
50d60cd841a18b05e00ab4691fc1e30f6a099a65a58ba51080304205fbb0d666

SHA512
f4edcf31e36c94c1c568ec066edb961e7be6bdd25121cc118d5f19379cc57ab1db16ed14487c56d3838543b7668ce2b79f8ff510a646ae1216de811a23330551

Download Submit
C:\Users\Public\Desktop\Acrobat Reader DC.lnk

Filesize
2KB

MD5
4fb6ef3a138bd39455b8033ccc2eea2b

SHA1
9210ac235bbbe22f41f760c41c965913beed0420

SHA256
8e65fa11d5148006ea3c32b9135f74a9e79402bd5021fb653cb6c588c2b77679

SHA512
45eea0a851ad79909b7abf3dc631e09e86ef3ec568f93a3fe5131b5d66996422fe4902a4496ac7d7df1b1692b08f3cc27f9525be3843328c2ffdf8b5302e8c9d

Download Submit
C:\Users\Public\Desktop\VLC media player.lnk

Filesize
923B

MD5
20d1dca23e2b296a459c9c60324202b2

SHA1
4f132d2004ca68f05f45cc903632bb04a930222c

SHA256
9d9e19f924a0ed10d17a7e9098ba44ec7c77b7d8bd63fb7b99508ccc6c98d54f

SHA512
4344a3c8e7a31e373c8cda16cf11f9ab7a7a792280e6bca113c0d54d2ee1377c735a312f4934e754b40635d001f511e8b3081b6ec78823f8a7571f01e6a35c50

Download Submit
memory/1148-1598-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1148-1600-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2468-1494-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2468-1251-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/4444-355-0x000001C833D30000-0x000001C833D31000-memory.dmp

Filesize
4KB

Download
memory/4444-348-0x000001C835110000-0x000001C835111000-memory.dmp

Filesize
4KB

Download
memory/4444-341-0x000001C835110000-0x000001C835111000-memory.dmp

Filesize
4KB

Download
memory/4444-339-0x000001C835110000-0x000001C835111000-memory.dmp

Filesize
4KB

Download
memory/4444-338-0x000001C833FF0000-0x000001C833FF1000-memory.dmp

Filesize
4KB

Download
memory/4444-306-0x000001C82BA40000-0x000001C82BA50000-memory.dmp

Filesize
64KB

Download
memory/4444-322-0x000001C82BB40000-0x000001C82BB50000-memory.dmp

Filesize
64KB

Download
memory/4444-342-0x000001C835110000-0x000001C835111000-memory.dmp

Filesize
4KB

Download
memory/4444-343-0x000001C835110000-0x000001C835111000-memory.dmp

Filesize
4KB

Download
memory/4444-344-0x000001C835110000-0x000001C835111000-memory.dmp

Filesize
4KB

Download
memory/4444-345-0x000001C835110000-0x000001C835111000-memory.dmp

Filesize
4KB

Download
memory/4444-346-0x000001C835110000-0x000001C835111000-memory.dmp

Filesize
4KB

Download
memory/4444-347-0x000001C835110000-0x000001C835111000-memory.dmp

Filesize
4KB

Download
memory/4444-340-0x000001C835110000-0x000001C835111000-memory.dmp

Filesize
4KB

Download
memory/4444-349-0x000001C833D40000-0x000001C833D41000-memory.dmp

Filesize
4KB

Download
memory/4444-350-0x000001C833D30000-0x000001C833D31000-memory.dmp

Filesize
4KB

Download
memory/4444-352-0x000001C833D40000-0x000001C833D41000-memory.dmp

Filesize
4KB

Download
memory/4444-370-0x000001C833F90000-0x000001C833F91000-memory.dmp

Filesize
4KB

Download
memory/4444-369-0x000001C833E80000-0x000001C833E81000-memory.dmp

Filesize
4KB

Download
memory/4444-368-0x000001C833E80000-0x000001C833E81000-memory.dmp

Filesize
4KB

Download
memory/4444-358-0x000001C833C70000-0x000001C833C71000-memory.dmp

Filesize
4KB

Download
memory/4444-366-0x000001C833E70000-0x000001C833E71000-memory.dmp

Filesize
4KB

Download
memory/5616-1496-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/5688-1499-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/5864-1503-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download