danabot | hxxps://github[.]com/Da2dalus/The-MALWARE-Repo

Resubmissions

20-10-2024 00:05

241020-adhe3aygrj 3

20-10-2024 00:04

19-10-2024 23:57

19-10-2024 23:54

19-10-2024 23:50

19-10-2024 23:42

Analysis

max time kernel
336s
max time network
338s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
19-10-2024 23:57

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

https://github.com/Da2dalus/The-MALWARE-Repo

Score

10^/10

danabot aspackv2 banker bootkit botnet discovery persistence trojan

Malware Config

Extracted

Family

danabot

51.178.195.151

51.222.39.81

149.255.35.125

38.68.50.179

51.77.7.204

rsa_pubkey.plain

Signatures

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Danabot x86 payload 1 IoCs

Detection of Danabot x86 payload, mapped in memory during the execution of its loader.

botnet

resource	yara_rule
behavioral1/files/0x0009000000023bfa-273.dat	family_danabot

Blocklisted process makes network request 10 IoCs

flow	pid	Process
72	5716	rundll32.exe
76	5716	rundll32.exe
88	5716	rundll32.exe
92	5716	rundll32.exe
105	5716	rundll32.exe
106	5716	rundll32.exe
110	5716	rundll32.exe
111	5716	rundll32.exe
114	5716	rundll32.exe
115	5716	rundll32.exe

Downloads MZ/PE file

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral1/files/0x0008000000023d40-405.dat	aspack_v212_v242

Executes dropped EXE 19 IoCs

pid	Process
5288	DanaBot.exe
4108	YouAreAnIdiot.exe
5752	YouAreAnIdiot.exe
3008	YouAreAnIdiot.exe
5816	YouAreAnIdiot.exe
376	YouAreAnIdiot.exe
5196	YouAreAnIdiot.exe
5440	Avoid.exe
5972	CookieClickerHack.exe
5124	CookieClickerHack.exe
1500	CookieClickerHack.exe
5928	Curfun.exe
1728	Time.exe
4108	rickroll.exe
5540	WindowsUpdate.exe
3808	WindowsUpdate.exe
1528	Time.exe
5544	PowerPoint.exe
2968	sys3.exe

Loads dropped DLL 3 IoCs

pid	Process
5592	regsvr32.exe
5592	regsvr32.exe
5716	rundll32.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
59	raw.githubusercontent.com
60	raw.githubusercontent.com

Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PHYSICALDRIVE0	PowerPoint.exe
File opened for modification	\??\PHYSICALDRIVE0	sys3.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Program crash 8 IoCs

pid	pid_target	Process	procid_target
5684	5288	WerFault.exe	116
5576	4108	WerFault.exe	131
2796	5752	WerFault.exe	134
4476	3008	WerFault.exe	137
6016	376	WerFault.exe	141
2680	5816	WerFault.exe	138
5244	5196	WerFault.exe	148
3364	5716	WerFault.exe	124

System Location Discovery: System Language Discovery 1 TTPs 17 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	YouAreAnIdiot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DanaBot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	YouAreAnIdiot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	YouAreAnIdiot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	YouAreAnIdiot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	YouAreAnIdiot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Curfun.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	YouAreAnIdiot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Time.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Time.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PowerPoint.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Avoid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sys3.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "5"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings	msedge.exe

NTFS ADS 11 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 248323.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 675980.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 742112.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 151157.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 205025.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 383024.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 139907.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 682206.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 976248.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 730181.crdownload:SmartScreen	msedge.exe
File created	C:\Users\Admin\AppData\Local\Temp\sys3.exe\:SmartScreen:$DATA	PowerPoint.exe

Suspicious behavior: EnumeratesProcesses 55 IoCs

pid	Process
2536	msedge.exe
2536	msedge.exe
4024	msedge.exe
4024	msedge.exe
4624	identity_helper.exe
4624	identity_helper.exe
5188	msedge.exe
5188	msedge.exe
5316	msedge.exe
5316	msedge.exe
2968	msedge.exe
2968	msedge.exe
4324	msedge.exe
4324	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5428	msedge.exe
5428	msedge.exe
1856	msedge.exe
1856	msedge.exe
5132	msedge.exe
5132	msedge.exe
3100	msedge.exe
3100	msedge.exe
5540	WindowsUpdate.exe
5540	WindowsUpdate.exe
5744	msedge.exe
5744	msedge.exe
4392	msedge.exe
4392	msedge.exe
3808	WindowsUpdate.exe
3808	WindowsUpdate.exe
5460	msedge.exe
5460	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4024	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs

pid	Process
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe

Suspicious use of AdjustPrivilegeToken 13 IoCs

description	pid	Process
Token: SeDebugPrivilege	5660	taskmgr.exe
Token: SeSystemProfilePrivilege	5660	taskmgr.exe
Token: SeCreateGlobalPrivilege	5660	taskmgr.exe
Token: 33	5660	taskmgr.exe
Token: SeIncBasePriorityPrivilege	5660	taskmgr.exe
Token: SeSystemtimePrivilege	1728	Time.exe
Token: SeSystemtimePrivilege	1728	Time.exe
Token: SeSystemtimePrivilege	1728	Time.exe
Token: SeSystemtimePrivilege	1528	Time.exe
Token: SeSystemtimePrivilege	1728	Time.exe
Token: SeSystemtimePrivilege	1528	Time.exe
Token: SeSystemtimePrivilege	1728	Time.exe
Token: SeShutdownPrivilege	2968	sys3.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
5440	Avoid.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4024	msedge.exe
3064	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4024 wrote to memory of 772	4024	msedge.exe	84
PID 4024 wrote to memory of 772	4024	msedge.exe	84
PID 4024 wrote to memory of 4536	4024	msedge.exe	85
PID 4024 wrote to memory of 4536	4024	msedge.exe	85
PID 4024 wrote to memory of 4536	4024	msedge.exe	85
PID 4024 wrote to memory of 4536	4024	msedge.exe	85
PID 4024 wrote to memory of 4536	4024	msedge.exe	85
PID 4024 wrote to memory of 4536	4024	msedge.exe	85
PID 4024 wrote to memory of 4536	4024	msedge.exe	85
PID 4024 wrote to memory of 4536	4024	msedge.exe	85
PID 4024 wrote to memory of 4536	4024	msedge.exe	85
PID 4024 wrote to memory of 4536	4024	msedge.exe	85
PID 4024 wrote to memory of 4536	4024	msedge.exe	85
PID 4024 wrote to memory of 4536	4024	msedge.exe	85
PID 4024 wrote to memory of 4536	4024	msedge.exe	85
PID 4024 wrote to memory of 4536	4024	msedge.exe	85
PID 4024 wrote to memory of 4536	4024	msedge.exe	85
PID 4024 wrote to memory of 4536	4024	msedge.exe	85
PID 4024 wrote to memory of 4536	4024	msedge.exe	85
PID 4024 wrote to memory of 4536	4024	msedge.exe	85
PID 4024 wrote to memory of 4536	4024	msedge.exe	85
PID 4024 wrote to memory of 4536	4024	msedge.exe	85
PID 4024 wrote to memory of 4536	4024	msedge.exe	85
PID 4024 wrote to memory of 4536	4024	msedge.exe	85
PID 4024 wrote to memory of 4536	4024	msedge.exe	85
PID 4024 wrote to memory of 4536	4024	msedge.exe	85
PID 4024 wrote to memory of 4536	4024	msedge.exe	85
PID 4024 wrote to memory of 4536	4024	msedge.exe	85
PID 4024 wrote to memory of 4536	4024	msedge.exe	85
PID 4024 wrote to memory of 4536	4024	msedge.exe	85
PID 4024 wrote to memory of 4536	4024	msedge.exe	85
PID 4024 wrote to memory of 4536	4024	msedge.exe	85
PID 4024 wrote to memory of 4536	4024	msedge.exe	85
PID 4024 wrote to memory of 4536	4024	msedge.exe	85
PID 4024 wrote to memory of 4536	4024	msedge.exe	85
PID 4024 wrote to memory of 4536	4024	msedge.exe	85
PID 4024 wrote to memory of 4536	4024	msedge.exe	85
PID 4024 wrote to memory of 4536	4024	msedge.exe	85
PID 4024 wrote to memory of 4536	4024	msedge.exe	85
PID 4024 wrote to memory of 4536	4024	msedge.exe	85
PID 4024 wrote to memory of 4536	4024	msedge.exe	85
PID 4024 wrote to memory of 4536	4024	msedge.exe	85
PID 4024 wrote to memory of 2536	4024	msedge.exe	86
PID 4024 wrote to memory of 2536	4024	msedge.exe	86
PID 4024 wrote to memory of 5068	4024	msedge.exe	87
PID 4024 wrote to memory of 5068	4024	msedge.exe	87
PID 4024 wrote to memory of 5068	4024	msedge.exe	87
PID 4024 wrote to memory of 5068	4024	msedge.exe	87
PID 4024 wrote to memory of 5068	4024	msedge.exe	87
PID 4024 wrote to memory of 5068	4024	msedge.exe	87
PID 4024 wrote to memory of 5068	4024	msedge.exe	87
PID 4024 wrote to memory of 5068	4024	msedge.exe	87
PID 4024 wrote to memory of 5068	4024	msedge.exe	87
PID 4024 wrote to memory of 5068	4024	msedge.exe	87
PID 4024 wrote to memory of 5068	4024	msedge.exe	87
PID 4024 wrote to memory of 5068	4024	msedge.exe	87
PID 4024 wrote to memory of 5068	4024	msedge.exe	87
PID 4024 wrote to memory of 5068	4024	msedge.exe	87
PID 4024 wrote to memory of 5068	4024	msedge.exe	87
PID 4024 wrote to memory of 5068	4024	msedge.exe	87
PID 4024 wrote to memory of 5068	4024	msedge.exe	87
PID 4024 wrote to memory of 5068	4024	msedge.exe	87
PID 4024 wrote to memory of 5068	4024	msedge.exe	87
PID 4024 wrote to memory of 5068	4024	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/Da2dalus/The-MALWARE-Repo
1⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe57b046f8,0x7ffe57b04708,0x7ffe57b04718
  2⤵
  PID:772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2000,8450288868772575080,3719192110952146441,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2212 /prefetch:2
  2⤵
  PID:4536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2000,8450288868772575080,3719192110952146441,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2248 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2000,8450288868772575080,3719192110952146441,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2924 /prefetch:8
  2⤵
  PID:5068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,8450288868772575080,3719192110952146441,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:2908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,8450288868772575080,3719192110952146441,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
  2⤵
  PID:4548
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2000,8450288868772575080,3719192110952146441,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5400 /prefetch:8
  2⤵
  PID:2240
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2000,8450288868772575080,3719192110952146441,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5400 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2000,8450288868772575080,3719192110952146441,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5396 /prefetch:8
  2⤵
  PID:3476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,8450288868772575080,3719192110952146441,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5656 /prefetch:1
  2⤵
  PID:3856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2000,8450288868772575080,3719192110952146441,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6096 /prefetch:8
  2⤵
  PID:1320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,8450288868772575080,3719192110952146441,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5876 /prefetch:1
  2⤵
  PID:532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,8450288868772575080,3719192110952146441,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6148 /prefetch:1
  2⤵
  PID:4304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,8450288868772575080,3719192110952146441,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5924 /prefetch:1
  2⤵
  PID:1728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,8450288868772575080,3719192110952146441,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5900 /prefetch:1
  2⤵
  PID:4440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2000,8450288868772575080,3719192110952146441,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5944 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5188
- C:\Users\Admin\Downloads\DanaBot.exe
  "C:\Users\Admin\Downloads\DanaBot.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5288
- - C:\Windows\SysWOW64\regsvr32.exe
    C:\Windows\system32\regsvr32.exe -s C:\Users\Admin\DOWNLO~1\DanaBot.dll f1 C:\Users\Admin\DOWNLO~1\DanaBot.exe@5288
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:5592
  - - C:\Windows\SysWOW64\rundll32.exe
      C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\DOWNLO~1\DanaBot.dll,f0
      4⤵
      Blocklisted process makes network request
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:5716
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5716 -s 932
        5⤵
        Program crash
        
        PID:3364
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5288 -s 464
    3⤵
    - Program crash
    PID:5684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,8450288868772575080,3719192110952146441,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6504 /prefetch:1
  2⤵
  PID:1688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2000,8450288868772575080,3719192110952146441,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=2752 /prefetch:8
  2⤵
  PID:5108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2000,8450288868772575080,3719192110952146441,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6468 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5316
- C:\Users\Admin\Downloads\YouAreAnIdiot.exe
  "C:\Users\Admin\Downloads\YouAreAnIdiot.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4108
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4108 -s 1200
    3⤵
    - Program crash
    PID:5576
- C:\Users\Admin\Downloads\YouAreAnIdiot.exe
  "C:\Users\Admin\Downloads\YouAreAnIdiot.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5752
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5752 -s 1176
    3⤵
    - Program crash
    PID:2796
- C:\Users\Admin\Downloads\YouAreAnIdiot.exe
  "C:\Users\Admin\Downloads\YouAreAnIdiot.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3008
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3008 -s 1172
    3⤵
    - Program crash
    PID:4476
- C:\Users\Admin\Downloads\YouAreAnIdiot.exe
  "C:\Users\Admin\Downloads\YouAreAnIdiot.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5816
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5816 -s 1232
    3⤵
    - Program crash
    PID:2680
- C:\Users\Admin\Downloads\YouAreAnIdiot.exe
  "C:\Users\Admin\Downloads\YouAreAnIdiot.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:376
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 376 -s 1104
    3⤵
    - Program crash
    PID:6016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,8450288868772575080,3719192110952146441,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6340 /prefetch:1
  2⤵
  PID:4800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2000,8450288868772575080,3719192110952146441,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6536 /prefetch:8
  2⤵
  PID:1328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2000,8450288868772575080,3719192110952146441,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5924 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2968
- C:\Users\Admin\Downloads\Avoid.exe
  "C:\Users\Admin\Downloads\Avoid.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of FindShellTrayWindow
  PID:5440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,8450288868772575080,3719192110952146441,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3444 /prefetch:1
  2⤵
  PID:1428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2000,8450288868772575080,3719192110952146441,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=2188 /prefetch:8
  2⤵
  PID:3972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2000,8450288868772575080,3719192110952146441,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6196 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4324
- C:\Users\Admin\Downloads\CookieClickerHack.exe
  "C:\Users\Admin\Downloads\CookieClickerHack.exe"
  2⤵
  - Executes dropped EXE
  PID:5972
- C:\Users\Admin\Downloads\CookieClickerHack.exe
  "C:\Users\Admin\Downloads\CookieClickerHack.exe"
  2⤵
  - Executes dropped EXE
  PID:5124
- C:\Users\Admin\Downloads\CookieClickerHack.exe
  "C:\Users\Admin\Downloads\CookieClickerHack.exe"
  2⤵
  - Executes dropped EXE
  PID:1500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2000,8450288868772575080,3719192110952146441,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1388 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,8450288868772575080,3719192110952146441,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4828 /prefetch:1
  2⤵
  PID:2004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2000,8450288868772575080,3719192110952146441,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6504 /prefetch:8
  2⤵
  PID:2960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2000,8450288868772575080,3719192110952146441,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5580 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5428
- C:\Users\Admin\Downloads\Curfun.exe
  "C:\Users\Admin\Downloads\Curfun.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,8450288868772575080,3719192110952146441,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6372 /prefetch:1
  2⤵
  PID:2208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2000,8450288868772575080,3719192110952146441,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5492 /prefetch:8
  2⤵
  PID:5212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2000,8450288868772575080,3719192110952146441,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5960 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1856
- C:\Users\Admin\Downloads\Time.exe
  "C:\Users\Admin\Downloads\Time.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:1728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,8450288868772575080,3719192110952146441,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5396 /prefetch:1
  2⤵
  PID:5996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2000,8450288868772575080,3719192110952146441,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6220 /prefetch:8
  2⤵
  PID:560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2000,8450288868772575080,3719192110952146441,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3748 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5132
- C:\Users\Admin\Downloads\rickroll.exe
  "C:\Users\Admin\Downloads\rickroll.exe"
  2⤵
  - Executes dropped EXE
  PID:4108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,8450288868772575080,3719192110952146441,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5544 /prefetch:1
  2⤵
  PID:2876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2000,8450288868772575080,3719192110952146441,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5764 /prefetch:8
  2⤵
  PID:1376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2000,8450288868772575080,3719192110952146441,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6364 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3100
- C:\Users\Admin\Downloads\WindowsUpdate.exe
  "C:\Users\Admin\Downloads\WindowsUpdate.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:5540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,8450288868772575080,3719192110952146441,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1924 /prefetch:1
  2⤵
  PID:3056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2000,8450288868772575080,3719192110952146441,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6812 /prefetch:8
  2⤵
  PID:2016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2000,8450288868772575080,3719192110952146441,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6920 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,8450288868772575080,3719192110952146441,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6708 /prefetch:1
  2⤵
  PID:5848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2000,8450288868772575080,3719192110952146441,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6112 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,8450288868772575080,3719192110952146441,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3680 /prefetch:1
  2⤵
  PID:5416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2000,8450288868772575080,3719192110952146441,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6776 /prefetch:8
  2⤵
  PID:2688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,8450288868772575080,3719192110952146441,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6816 /prefetch:1
  2⤵
  PID:2736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2000,8450288868772575080,3719192110952146441,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5088 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5460
- C:\Users\Admin\Downloads\PowerPoint.exe
  "C:\Users\Admin\Downloads\PowerPoint.exe"
  2⤵
  - Executes dropped EXE
  - Writes to the Master Boot Record (MBR)
  - System Location Discovery: System Language Discovery
  - NTFS ADS
  PID:5544
- - C:\Users\Admin\AppData\Local\Temp\sys3.exe
    C:\Users\Admin\AppData\Local\Temp\\sys3.exe
    3⤵
    - Executes dropped EXE
    - Writes to the Master Boot Record (MBR)
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2968

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2216

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:852

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 5288 -ip 5288
1⤵
PID:5640

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 4108 -ip 4108
1⤵
PID:5564

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 5752 -ip 5752
1⤵
PID:5488

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3008 -ip 3008
1⤵
PID:428

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 376 -ip 376
1⤵
PID:5888

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2348

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 5816 -ip 5816
1⤵
PID:2400

C:\Users\Admin\Downloads\YouAreAnIdiot.exe
"C:\Users\Admin\Downloads\YouAreAnIdiot.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5196
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5196 -s 1172
  2⤵
  - Program crash
  PID:5244

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 5196 -ip 5196
1⤵
PID:5248

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /7
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SendNotifyMessage
PID:5660

C:\Windows\system32\rundll32.exe
C:\Windows\system32\rundll32.exe C:\Windows\system32\PcaSvc.dll,PcaPatchSdbTask
1⤵
PID:4308

C:\Users\Admin\Downloads\WindowsUpdate.exe
"C:\Users\Admin\Downloads\WindowsUpdate.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3808

C:\Users\Admin\Downloads\Time.exe
"C:\Users\Admin\Downloads\Time.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1528

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa384b855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:3064

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 5716 -ip 5716
1⤵
PID:4764

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fab8d8d865e33fe195732aa7dcb91c30

SHA1
2637e832f38acc70af3e511f5eba80fbd7461f2c

SHA256
1b034ffe38e534e2b7a21be7c1f207ff84a1d5f3893207d0b4bb1a509b4185ea

SHA512
39a3d43ef7e28fea2cb247a5d09576a4904a43680db8c32139f22a03d80f6ede98708a2452f3f82232b868501340f79c0b3f810f597bcaf5267c3ccfb1704b43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
36988ca14952e1848e81a959880ea217

SHA1
a0482ef725657760502c2d1a5abe0bb37aebaadb

SHA256
d7e96088b37cec1bde202ae8ec2d2f3c3aafc368b6ebd91b3e2985846facf2e6

SHA512
d04b2f5afec92eb3d9f9cdc148a3eddd1b615e0dfb270566a7969576f50881d1f8572bccb8b9fd7993724bdfe36fc7633a33381d43e0b96c4e9bbd53fc010173

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
63cf229f6de95b4023e33c0fed3dcc51

SHA1
94cf03dfdc5a512750e6b243009b56e2ce94e905

SHA256
751aaff8917ef20cef4c75c67a0a69a97144d027d37febae4ce29befbebcfbbf

SHA512
5a95a8c52511d6d3b7ba5988a8a2d3c49bdec15514e800edce74221d039be32e9eb036c08e6448794cecf7f05fbca7656e2607c0e28099ac333dba1819d561cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
579B

MD5
ed5f4213c17629776cd75510648fc019

SHA1
ebfa685dca9b7c920cd5ad521c03e4ad0ce435b9

SHA256
e969795f0e63ec8a35cdf34d5bc43867ca0825bebfed9734943e69b34ed2ad87

SHA512
71bcc166ae5a48f7a79aa5de7ecc7e10dce22c39240ca9ffe9d0f9340f40fc2a2429529cfee8b2b5d7082efe94921fa7df3454852d5313ff4093bfdffc189627

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
7dd0162a5c392a26417c88d85d189d93

SHA1
a59d929f0bf52712d2c1dd8c2a0e12f9809cb041

SHA256
79c4985adf201b2653473ddb1f39059fff1787942a1e6748f57f14eeb6ae747c

SHA512
a69634b3787af6aaf05ef60d6711af29aa68fb2ededd5067cdbe28e3f9cfeb926e8ff40b1f57cd740b517cb20c8005bd9929e73d1e51d025c36f7236713ac7c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3a05ce5239f47d98d8a670c2bc9a0006

SHA1
2db0eb68954f0d8bc495f729fff1533c39e731d5

SHA256
e729d57adf3ec7ae2ad31498869e61b4df73037c223eda14f6cf0fd332878a35

SHA512
b751008e581d0436bb0796d452384adbfd9fd8a0de86302a04e7e7c88da5a421ac7ce59f1f998a36f0764d20905621268d93e9d9aefe7ed37c085434ea65c21a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1484052317462a2225b05d74b6fa67fb

SHA1
caebd403066e817e49a4994e82f39651f9f0d5b8

SHA256
162add791e56a3c93131ff0747a8290925ef71314a3518d8cae11ffb161f8bfb

SHA512
c735e1e047b232dcc64a6d15e08bb4facf6be8adf95b212b43faf9c0d508b39fec645143da1503959768cb69d13f71ec2b004fff434298704cb8a181f5ee2424

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e06e9671c83986b488cef93907df464a

SHA1
6d8abbd905e6b132186271b626adef2173190a53

SHA256
2baee4490a9bf916b6f72fbd9d6e2d1e764c424637898208fd4313b42688d8ea

SHA512
bf69f90dffb48a4d375ea5cf59d80d739945e14ecb58fabb2a8b89d046cc99e853db530e5ea4e1b0fb55dd2ff838234a2b097e7a4a66c501212bf28274b6effc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
67a6bfe03b56e93f95d4c10dfb3f6383

SHA1
11afb955909265391e3e050eee3dadfc0a6a216d

SHA256
0962615f1f76565dc7052d76bd09cbb5655bfb8d26b9321dc7e30209d894f7ff

SHA512
bfb9bd07cd695d0872a44274a63f811ea06f0d96440f35a98d8deadeea891ddc67beb8f5708684ef2cb1ec60c25c324ed76365ce0ad7e1aca59a767777366760

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
8d85c6fae024f936440eff479a1daeeb

SHA1
5150590d06b3eca110fdd9ed27d1b2a36b0f4a77

SHA256
4898f10a63c2f4eabe7ab4d05131573d6f77524ef35b6e46487b72aaa1cf6834

SHA512
8539820939b4df90a5ddb0ca160554861d9adbe7032edae950a0e6d11de85ebfe02bef18b4776244ec3f4ce0bbbbdcd6d48167d6c346bd62d261b61acf3d439a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
617ebb71c4781d3443bfd5b6e31440ae

SHA1
a73dbdc146c3cd60ebeba19326fd5e68514cc730

SHA256
893928ab5e7001fcb6edc405986bcbc09feba6b1c2889caaa4928c2e96e60366

SHA512
751b486143d6ad7b9d9e36a7a61d79798b5e8918efa3ba4b448b4474117d4471104a4cc89529bfb639c75fe3c5e24e9f84b50ec13360d06754aeeed99d3eb460

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
a8a0cbc41a6fe2ba3e239ca0580f4e26

SHA1
f7cda3298e24e2f89e0f021caa610182462b335b

SHA256
eba21e57ed3c03e984e0b64fe7582c3780d05e6acb46b491a69788457897d923

SHA512
c3a71d80f61a8a81c5dc6dd00b8f3a864083cd9c2c93d765e24ecb7d8c3884e3a5e3bf4b5f8b9a5c98cea487a0ed9d8447e8349f5de268cb335095015da156a5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
eb74c6d1391813e9cb8139211ad4c49b

SHA1
af492dd15cbcf8f58e9f7b33238cf1dbf7ec78e9

SHA256
724f8b927da988a44a0ff6d42f1741e1fb03f6006383f4b8b1257facb245ceb1

SHA512
869c92bbeadeceacafa97ab13a983460b6016cf1bb397526cf9e51254b1f9dfe9decc2e154c07fe3c6915905505ee450d0e8461eee51c2782b7a88692be35813

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
7867cdc9071ce0f2b2d6515344db6926

SHA1
33cb58b6c0e6fb20d8d56f9b4a808597835b2ec0

SHA256
7c771822a0e758fc0b6c3824f16817b0408f622f24fa6ba7abdbc47a800546ca

SHA512
260cc1bc6fcbeba203e0abe28250f34734d992677bbfb755cd9c15f6f037935795927559bce08af0ee01e9a99a0edd6a7b72f3d2086b2563b32895a5d93edc74

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
fa528dfb22c3fd3fc4231c0e77597e36

SHA1
28b4590f36f5b0e4ebf5656307a4f94eb65762af

SHA256
98c98b930e330000f65efceeb6205d0a392e791bdc8adbef6ae99d6186400ab4

SHA512
a7ceac7432b78f00ad6d38f28ddad77346521fb6c1dd3a3d9bdb850b1e2daa4bfae07eb903ad0c47b415a0409c6e568ca835f61f2e4b6f4efa92a4742447a37a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
0eaa6036d8e6e023d0549ccc50f72527

SHA1
859a18600718399f08ed5e43a847f27aaae32e8a

SHA256
3fcfe8012bcb023e959461bb8b2831f7900955170c956e6af5682f203ecdd132

SHA512
183a7529c05e44b9c1c13531e65bca1559620e94a2c352ce10d9489845a8491bb6163efe40b71139ef17eccf81b07fad97cd2e8ca1710ff8d7eb904b4fb9c3a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
644666ca809e48648d0940505bf7ef99

SHA1
559a28c8e624fe063db4c3e247c81bf959d2af31

SHA256
8c9594db9379a692664f0dc83ef18e9beb1478ed1cad60827e097a30d43513d2

SHA512
91d8255f820e3b862650af8a5b607a405837f4f4f96153acce2ab627e8a79dcb70814f149421a3fc5c15b6d09784fc4bdab214049ad44dfea1ac536d3ffe3331

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
8b8a2e8b90792d9a816ab5c5c5c24d62

SHA1
bf1c8f37f8b1cf639a58bbebce38db2be6793ffa

SHA256
b6933f856b8992c13c1e374e793043212758db70de71617be0550bee1fc0f3c9

SHA512
eccaf0c633516f8727b358d368966d1111b8f3d84e64c31c27ec68f2f2c804584b075294e2995d186120cb8a371b57b92d66822ca7c54b47663500b470614298

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
f4c6eb804d100c00c546da7ffc9659d7

SHA1
d593fa8bbf03d779219fba28664eb89e0ab12391

SHA256
3e752b6312b8faf66cd4f6c97494cf18de42fb7eea85e41686db6203bb59b5ed

SHA512
0145affc6ea9fc8437deae8a907db5b0d30e13dc563e9bd1f990f2b64463da6cb8d269605d7b9d03c2b2d4613d4676bd4b8f504d835dd5b26f84c9bc39f6de53

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
6278d20688176bea9533f1f485d5a244

SHA1
b0962ccb1d91c799b41ff42824309a6f2deabcc6

SHA256
3cfd4456327c360e643d7f85dd459bc525c5e791af711b4c571902d35918c40c

SHA512
bbb3777d4ee3fae2c149929fdce8ff384ba6ccdc1a459abea91ed8b52f914a5771db91af9977d0ba9a460ad9266ba364293b869f86fa50809439dfa73b6fa880

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
15176ae0cb501633e3753e70a79c7d7a

SHA1
e5801469e520ae19e67e26eb5c8c148bc93e0fc6

SHA256
b6ca02fdf5f22da3f21b9a100e31286678df4d8719c5d5e0ee6d2914b63d7d81

SHA512
8d80b4299923184f16ec2ee8ab4a45f1be21f57cb3c379a652cb963e672539437f2d246f7eddacc1a451601ba13a5a15f3bd441bfd8774501d23920f5c0a1e9b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
37d93091bbebb75835e5abea8d214894

SHA1
f3f8b78a0268edf2ec27783a8ba0b42b7910a92f

SHA256
c3f8e171efff9c29221813a67017bce9eb83f4dfa60e9426d4c8e7952cfd7c34

SHA512
b8019726519c9add7a624170f67ed921c7b954d5bee8c8d98290f9d40df4fcc3a07626bf81edbd97b44c357b5fd816a53cca9c3e856566b5507214dcea2df612

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
43248c59ab9c697a6f8f94ce2cda3c62

SHA1
9c7f46b28ea8cd5e9906263f21d5b5ac71a8ef95

SHA256
be110753cea6c8389c3bee2e4c8618e6ad2ee6e20358d5c3517248d60bcf4ee4

SHA512
2261e12cb141cbbdba809fbb01495c24bc8edc90b2b0e468802bfc36ab06c27cecd09d2f4717ce1572ef838a83196fad77340e6179a238b0b0b2d5a106f4e1d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57cd33.TMP

Filesize
874B

MD5
29bb6fc54cf0f3ea8c88ede8e224f289

SHA1
6f87b0ed731966bccad4310a5986030938fce821

SHA256
f357def4d051e284dc8a826b440b917afbdbe870912cf0c8be01f28d01e81326

SHA512
e82cc267ec55c0445300d2cf12428b1cd4e43aa1f94f5b6f57da138d1c9ecd7877343215d5a464a39da3ceb29dd84c13a6effcb81fd9652594914bb00ee4abaf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
86e9290da4ace44d03f769659e8bb1d8

SHA1
3cc8728f57bc4adbcf51a7d4e7417088d9042c07

SHA256
cfe9459b5ecf32c9f02e233e26e0f14d3432d82265b4558c9935dbf5cafadcfa

SHA512
428adf184c3c33ffee7e1f30c392462cbaaf14b18473e031a0bdc6e8226cd52519d529f21c2dd6dd5ccba8c8220bb319eed12a775f694309b52ff44fff8279ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
242090c2156c8eab6aa2a5818e3d62f9

SHA1
56c27fb314031e2ee1c77b78dc4596a0b4708c71

SHA256
b83e5daad9f51e3e119b3cf285927519756388a34f006b1fb1e0ffe9798b7a3d

SHA512
6bea2ba274d7382ec40a22024b32645fa0b21093561ebbb27ee1b327ac35d817f2ce7dfcbc889bb861df86b56cbb39f45723aee54144f6df62358734e42847c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
97becaa1d1fa7ec64f9bac6f6dd4d62c

SHA1
f4a162aeeaf35e5060ff0e208461d058bfd1a83a

SHA256
be708a5d5e33530252fe6564af08680fd86a0e8370e4fa9dc236ef4709862c85

SHA512
374e661c85238296aaade7da208ac19080497d8b85439bbfc31c963ebba2b2465573ccd4bac8b0462f7d4ce94830d784d479f9484d3013caa8d649ab783ff6e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
97e28c50d870d9871f1ad44ba139e3f0

SHA1
65bb65ae5b9ab298340dc486bd6abc2c96a1b2c1

SHA256
8f6622bb42beb2e3447c3d93df805df38b59b14dde305bddba0b6747e1258655

SHA512
ff81783319f060b9e234ee912b5e40006a89a05869e6804ed0981aa39334fd8c0996d26397e9645d3d6750adfe7ab64f08ac2a047ebc32bd26cde012c9035e61

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
bb515efb5f7461b5c1f18dfacdceea86

SHA1
4e27252f73f60e66f04999ef6f7f370fb33b89e7

SHA256
b0858107c10e914fc9a59d38ee4f2dd89326e1161425b30ed09292e6f634daf3

SHA512
aeff5210b8c000bc7afe7438e5c4b456ab4b3b99b396875b0442ecc730cbb9aac0b8ec959dd811b42312607771d5e85e53119385817f8f07de1a9890fbc4c50c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
060cc0fd2052dee8fc4d9443f22af71f

SHA1
8db4d8817afe27e7e344ebc4fd6d353a4ceae2bc

SHA256
864fd1cf63373301f07e85fe512e64958f98bc6e294b737916d2f800649137b3

SHA512
dc19693d6e9056d8050bda20f135912c3b1d37af15cce908aca08d2601342a999fb34a887121e124755e0d6da0f0251f1a93e2be9eb1d5f35dcbde9e8df978e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
6c73a582eb5f962ce3c52ceac9a848d3

SHA1
a9d301f9ee6a8ffbf02b925dfc1819e3a66f2568

SHA256
6d49f080a7f2576ef9b7a950f35efeead4da961fc86e65b417afe232f8222b8e

SHA512
d8821e2c5d27fd97c9a26286e2e5ecc1aa1150b5caf65e80b77e40d4b2b0ea4daf26c0d6a22c2eb5d9f75cd8060a6e85406c0047ee1254efe777991553fcf17d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
6ceb408d0c87c8398eff0af42a6bbf6a

SHA1
83d10d76b842ac3596d1cfaecfe25b3f87e9d2c7

SHA256
00e3a9c67f9ae24e8d7e0631ab775fb94ffe3b3d46c3f4d795e6597927ba71c5

SHA512
800b571b4985ca6403379e45ec35e9999dbfd25bb159b6a6c3085b2f340be1a8a6256e5c75c3895e11d9394057aff7845655762aae0a9a49028b4a500fdde508

Download Submit
C:\Users\Admin\DOWNLO~1\DanaBot.dll

Filesize
2.4MB

MD5
7e76f7a5c55a5bc5f5e2d7a9e886782b

SHA1
fc500153dba682e53776bef53123086f00c0e041

SHA256
abd75572f897cdda88cec22922d15b509ee8c840fa5894b0aecbef6de23908a3

SHA512
0318e0040f4dbf954f27fb10a69bce2248e785a31d855615a1eaf303a772ad51d47906a113605d7bfd3c2b2265bf83c61538f78b071f85ee3c4948f5cde3fb24

Download Submit
C:\Users\Admin\Downloads\PetrWrap

Filesize
473KB

MD5
17c25c8a7c141195ee887de905f33d7b

SHA1
7fa8079e8dca773574d01839efc623d3cd8e6a47

SHA256
e079fa28ea51fa98644164caf585ae3231d25372fccca1245902fb57488d4660

SHA512
de95f18101b99d159fe459c5e5651e0db2b1c76e02c9c2741bfd920decc970abc6dc0b41651be0471b4c7c3deb8b5e9a6e956c6515f268f9dfee7b76087a1e2b

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 139907.crdownload

Filesize
424KB

MD5
e263c5b306480143855655233f76dc5a

SHA1
e7dcd6c23c72209ee5aa0890372de1ce52045815

SHA256
1f69810b8fe71e30a8738278adf09dd982f7de0ab9891d296ce7ea61b3fa4f69

SHA512
e95981eae02d0a8bf44493c64cca8b7e50023332e91d75164735a1d0e38138f358100c93633ff3a0652e1c12a5155cba77d81e01027422d7d5f71000eafb4113

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 151157.crdownload

Filesize
760KB

MD5
515198a8dfa7825f746d5921a4bc4db9

SHA1
e1da0b7f046886c1c4ff6993f7f98ee9a1bc90ae

SHA256
0fda176b199295f72fafc3bc25cefa27fa44ed7712c3a24ca2409217e430436d

SHA512
9e47037fe40b79ebf056a9c6279e318d85da9cd7e633230129d77a1b8637ecbafc60be38dd21ca9077ebfcb9260d87ff7fcc85b8699b3135148fe956972de3e8

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 205025.crdownload

Filesize
3KB

MD5
6f5767ec5a9cc6f7d195dde3c3939120

SHA1
4605a2d0aae8fa5ec0b72973bea928762cc6d002

SHA256
59fe169797953f2046b283235fe80158ebf02ba586eabfea306402fba8473dae

SHA512
c0fbba6ecaef82d04157c5fcf458817bf11ce29cdaf3af6cac56724efcf4305565c6e665cdcf2106c675ba0574c60606be81d9baafe804fc7d2d3a50fed0baf6

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 248323.crdownload

Filesize
248KB

MD5
20d2c71d6d9daf4499ffc4a5d164f1c3

SHA1
38e5dcd93f25386d05a34a5b26d3fba1bf02f7c8

SHA256
3ac8cc58dcbceaec3dab046aea050357e0e2248d30b0804c738c9a5b037c220d

SHA512
8ffd56fb3538eb60da2dde9e3d6eee0dac8419c61532e9127f47c4351b6e53e01143af92b2e26b521e23cdbbf15d7a358d3757431e572e37a1eede57c7d39704

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 383024.crdownload

Filesize
2.7MB

MD5
48d8f7bbb500af66baa765279ce58045

SHA1
2cdb5fdeee4e9c7bd2e5f744150521963487eb71

SHA256
db0d72bc7d10209f7fa354ec100d57abbb9fe2e57ce72789f5f88257c5d3ebd1

SHA512
aef8aa8e0d16aab35b5cc19487e53583691e4471064bc556a2ee13e94a0546b54a33995739f0fa3c4de6ff4c6abf02014aef3efb0d93ca6847bad2220c3302bd

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 675980.crdownload

Filesize
138KB

MD5
0b3b2dff5503cb032acd11d232a3af55

SHA1
6efc31c1d67f70cf77c319199ac39f70d5a7fa95

SHA256
ef878461a149024f3065121ff4e165731ecabef1b94b0b3ed2eda010ad39202b

SHA512
484014d65875e706f7e5e5f54c2045d620e5cce5979bf7f37b45c613e6d948719c0b8e466df5d8908706133ce4c4b71a11b804417831c9dbaf72b6854231ea17

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 675980.crdownload:SmartScreen

Filesize
7B

MD5
4047530ecbc0170039e76fe1657bdb01

SHA1
32db7d5e662ebccdd1d71de285f907e3a1c68ac5

SHA256
82254025d1b98d60044d3aeb7c56eed7c61c07c3e30534d6e05dab9d6c326750

SHA512
8f002af3f4ed2b3dfb4ed8273318d160152da50ee4842c9f5d9915f50a3e643952494699c4258e6af993dc6e1695d0dc3db6d23f4d93c26b0bc6a20f4b4f336e

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 682206.crdownload

Filesize
68KB

MD5
bc1e7d033a999c4fd006109c24599f4d

SHA1
b927f0fc4a4232a023312198b33272e1a6d79cec

SHA256
13adae722719839af8102f98730f3af1c5a56b58069bfce8995acd2123628401

SHA512
f5d9b8c1fd9239894ec9c075542bff0bcef79871f31038e627ae257b8c1db9070f4d124448a78e60ccc8bc12f138102a54825e9d7647cd34832984c7c24a6276

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 730181.crdownload

Filesize
136KB

MD5
70108103a53123201ceb2e921fcfe83c

SHA1
c71799a6a6d09ee758b04cdf90a4ab76fbd2a7e3

SHA256
9c3f8df80193c085912c9950c58051ae77c321975784cc069ceacd4f57d5861d

SHA512
996701c65eee7f781c2d22dce63f4a95900f36b97a99dcf833045bce239a08b3c2f6326b3a808431cdab92d59161dd80763e44126578e160d79b7095175d276b

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 742112.crdownload

Filesize
111KB

MD5
9d0d2fcb45b1ff9555711b47e0cd65e5

SHA1
958f29a99cbb135c92c5d1cdffb9462be35ee9fd

SHA256
dc476ae39effdd80399b6e36f1fde92c216a5bbdb6b8b2a7ecbe753e91e4c993

SHA512
8fd4ce4674cd52a3c925149945a7a50a139302be17f6ee3f30271ebe1aa6d92bcb15a017dca989cd837a5d23cd56eaacc6344dc7730234a4629186976c857ca9

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 976248.crdownload

Filesize
129KB

MD5
0ec108e32c12ca7648254cf9718ad8d5

SHA1
78e07f54eeb6af5191c744ebb8da83dad895eca1

SHA256
48b08ea78124ca010784d9f0faae751fc4a0c72c0e7149ded81fc03819f5d723

SHA512
1129e685f5dd0cb2fa22ef4fe5da3f1e2632e890333ce17d3d06d04a4097b4d9f4ca7d242611ffc9e26079900945cf04ab6565a1c322e88e161f1929d18a2072

Download Submit
memory/1728-757-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/1728-849-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/2968-1112-0x000000002AA00000-0x000000002AA24000-memory.dmp

Filesize
144KB

Download
memory/3808-1136-0x0000000000400000-0x00000000006BC000-memory.dmp

Filesize
2.7MB

Download
memory/3808-1027-0x0000000000400000-0x00000000006BC000-memory.dmp

Filesize
2.7MB

Download
memory/3808-998-0x0000000000400000-0x00000000006BC000-memory.dmp

Filesize
2.7MB

Download
memory/4108-355-0x0000000004D90000-0x0000000004E2C000-memory.dmp

Filesize
624KB

Download
memory/4108-359-0x0000000004FD0000-0x0000000005026000-memory.dmp

Filesize
344KB

Download
memory/4108-812-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/4108-358-0x0000000004E50000-0x0000000004E5A000-memory.dmp

Filesize
40KB

Download
memory/4108-357-0x0000000004F30000-0x0000000004FC2000-memory.dmp

Filesize
584KB

Download
memory/4108-356-0x0000000005440000-0x00000000059E4000-memory.dmp

Filesize
5.6MB

Download
memory/4108-354-0x0000000000360000-0x00000000003D2000-memory.dmp

Filesize
456KB

Download
memory/5124-503-0x000000001CBD0000-0x000000001CC1C000-memory.dmp

Filesize
304KB

Download
memory/5288-278-0x0000000000400000-0x0000000000AAD000-memory.dmp

Filesize
6.7MB

Download
memory/5440-472-0x0000000000400000-0x00000000004A6000-memory.dmp

Filesize
664KB

Download
memory/5540-1139-0x0000000000400000-0x00000000006BC000-memory.dmp

Filesize
2.7MB

Download
memory/5540-864-0x0000000000400000-0x00000000006BC000-memory.dmp

Filesize
2.7MB

Download
memory/5540-845-0x0000000000400000-0x00000000006BC000-memory.dmp

Filesize
2.7MB

Download
memory/5544-1107-0x000000002AA00000-0x000000002AA24000-memory.dmp

Filesize
144KB

Download
memory/5592-276-0x0000000002420000-0x000000000268B000-memory.dmp

Filesize
2.4MB

Download
memory/5660-598-0x00000299778C0000-0x00000299778C1000-memory.dmp

Filesize
4KB

Download
memory/5660-587-0x00000299778C0000-0x00000299778C1000-memory.dmp

Filesize
4KB

Download
memory/5660-593-0x00000299778C0000-0x00000299778C1000-memory.dmp

Filesize
4KB

Download
memory/5660-594-0x00000299778C0000-0x00000299778C1000-memory.dmp

Filesize
4KB

Download
memory/5660-595-0x00000299778C0000-0x00000299778C1000-memory.dmp

Filesize
4KB

Download
memory/5660-588-0x00000299778C0000-0x00000299778C1000-memory.dmp

Filesize
4KB

Download
memory/5660-596-0x00000299778C0000-0x00000299778C1000-memory.dmp

Filesize
4KB

Download
memory/5660-597-0x00000299778C0000-0x00000299778C1000-memory.dmp

Filesize
4KB

Download
memory/5660-592-0x00000299778C0000-0x00000299778C1000-memory.dmp

Filesize
4KB

Download
memory/5660-586-0x00000299778C0000-0x00000299778C1000-memory.dmp

Filesize
4KB

Download
memory/5716-368-0x0000000000400000-0x000000000066B000-memory.dmp

Filesize
2.4MB

Download
memory/5716-282-0x0000000000400000-0x000000000066B000-memory.dmp

Filesize
2.4MB

Download
memory/5928-749-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/5928-717-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/5928-875-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/5928-687-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/5928-846-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/5928-790-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/5972-490-0x000000001B660000-0x000000001B706000-memory.dmp

Filesize
664KB

Download
memory/5972-491-0x000000001BC80000-0x000000001C14E000-memory.dmp

Filesize
4.8MB

Download
memory/5972-492-0x000000001C1F0000-0x000000001C28C000-memory.dmp

Filesize
624KB

Download
memory/5972-502-0x0000000000F10000-0x0000000000F18000-memory.dmp

Filesize
32KB

Download

Resubmissions

Analysis

Sharing

Errors

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads