danabot | 10ae7bc76a6d12d1a278156b9e949850262c2fd516e54a55a1e5c2264f2bc835

Analysis

max time kernel
1146s
max time network
1176s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
18-11-2024 17:10

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

OIP.jpg
Size

10KB
MD5

b93d7afe4b92832b106532271746ee11
SHA1

98b7eb52a84a31338af5789acbaa2ec6aa103d37
SHA256

10ae7bc76a6d12d1a278156b9e949850262c2fd516e54a55a1e5c2264f2bc835
SHA512

f6477f5e45ca5d1738e719809f5edb65bf82e54e1d6aa6a0cebf1054875c5d6f1a13dbf4f29e34169f65fe6e132c28e44a74fbdaf4a05793f4f55e8e086b22bf
SSDEEP

192:NTy1njwHoxuxq+H+yXD7CE5r4h3laN+bTONzVKG4FO2i4GwHk9ww7c1iSGO4:NgmU+H+yXD7CS4h1aN+POeG4g2iHGc7X

Score

10^/10

danabot banker botnet defense_evasion discovery evasion execution impact persistence privilege_escalation ransomware trojan

Malware Config

Extracted

Family

danabot

51.178.195.151

51.222.39.81

149.255.35.125

38.68.50.179

51.77.7.204

rsa_pubkey.plain

Signatures

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot
Danabot family
danabot

Danabot x86 payload 1 IoCs

Detection of Danabot x86 payload, mapped in memory during the execution of its loader.

botnet

Processes:

resource	yara_rule
C:\Users\Admin\DOWNLO~1\THE-MA~1\THE-MA~1\BANKIN~1\DanaBot.dll	family_danabot

Modifies Windows Defender Real-time Protection settings 3 TTPs 2 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

RedEye.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	RedEye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	RedEye.exe

UAC bypass 3 TTPs 1 IoCs
evasion trojan

Bypass User Account Control
T1548.002

Disable or Modify Tools
T1562.001

Modify Registry
T1112

Processes:

RedEye.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" RedEye.exe
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RedEye.exe

Blocklisted process makes network request 9 IoCs

Processes:

rundll32.exe

flow	pid	process
143	5036	rundll32.exe
145	5036	rundll32.exe
146	5036	rundll32.exe
147	5036	rundll32.exe
163	5036	rundll32.exe
163	5036	rundll32.exe
170	5036	rundll32.exe
177	5036	rundll32.exe
178	5036	rundll32.exe

Disables RegEdit via registry modification 4 IoCs

evasion

Processes:

Krotten.exeRedEye.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	Krotten.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	Krotten.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	RedEye.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	RedEye.exe

Disables Task Manager via registry modification
evasion
Disables use of System Restore points 1 TTPs
evasion

Inhibit System Recovery
T1490

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 64 IoCs

persistence

Image File Execution Options Injection

T1546.012

Processes:

RedEye.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ComboFix.exe	RedEye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\microsoftedge.exe	RedEye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\logoff.exe\Debugger = "RIP"	RedEye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rkill-unsigned.exe	RedEye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rkill-unsigned.exe\Debugger = "RIP"	RedEye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ZAM.exe	RedEye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\microsoftedge.exe\Debugger = "RIP"	RedEye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UserAccountControlSettings.exe\Debugger = "RIP"	RedEye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HitmanPro_x64.exe	RedEye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe	RedEye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe\Debugger = "RIP"	RedEye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\chrome.exe\Debugger = "RIP"	RedEye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\firefox.exe\Debugger = "RIP"	RedEye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe	RedEye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rkill.scr\Debugger = "RIP"	RedEye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HitmanPro.exe\Debugger = "RIP"	RedEye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe	RedEye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\chrome.exe	RedEye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\opera.exe\Debugger = "RIP"	RedEye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\microsoftedgecp.exe	RedEye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RKill64.exe	RedEye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe	RedEye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad++.exe	RedEye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iExplore64.exe\Debugger = "RIP"	RedEye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HitmanPro.exe	RedEye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe\Debugger = "RIP"	RedEye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\recoverydrive.exe	RedEye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rkill64.com	RedEye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rkill64.scr	RedEye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mb3-setup-1878.1878-3.3.1.2183.exe	RedEye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RKill64.exe\Debugger = "RIP"	RedEye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rkill-unsigned64.exe	RedEye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe	RedEye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "RIP"	RedEye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad++.exe\Debugger = "RIP"	RedEye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powershell.exe	RedEye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\yandex.exe\Debugger = "RIP"	RedEye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RKill.exe	RedEye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe\Debugger = "RIP"	RedEye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mbam.exe	RedEye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\gpedit.msc	RedEye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bcdedit.exe	RedEye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\logoff.exe	RedEye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rkill64.scr\Debugger = "RIP"	RedEye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\control.exe	RedEye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Autoruns64.exe	RedEye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Autoruns.exe	RedEye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powershell.exe\Debugger = "RIP"	RedEye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\yandex.exe	RedEye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mspaint.exe	RedEye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rkill.com	RedEye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\microsoftedgecp.exe\Debugger = "RIP"	RedEye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iexplore.exe\Debugger = "RIP"	RedEye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSASCuiL.exe\Debugger = "RIP"	RedEye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mspaint.exe\Debugger = "RIP"	RedEye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\control.exe\Debugger = "RIP"	RedEye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Autoruns64.exe\Debugger = "RIP"	RedEye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RKill.exe\Debugger = "RIP"	RedEye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\a2start.exe	RedEye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mb3-setup-1878.1878-3.3.1.2183.exe\Debugger = "RIP"	RedEye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mbam.exe\Debugger = "RIP"	RedEye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HitmanPro_x64.exe\Debugger = "RIP"	RedEye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\opera.exe	RedEye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\gpedit.msc\Debugger = "RIP"	RedEye.exe

Modifies Windows Firewall 2 TTPs 1 IoCs
evasion

Windows Service
T1543.003

Disable or Modify System Firewall
T1562.004

Processes:

NetSh.exe

pid process

276 NetSh.exe
Executes dropped EXE 2 IoCs

Processes:

hiar.exehiar.exe

pid process

3360 hiar.exe
3288 hiar.exe
Loads dropped DLL 3 IoCs

Processes:

regsvr32.exerundll32.exe

pid process

3856 regsvr32.exe
5036 rundll32.exe
5036 rundll32.exe

pid	process
276	NetSh.exe

pid	process
3360	hiar.exe
3288	hiar.exe

pid	process
3856	regsvr32.exe
5036	rundll32.exe
5036	rundll32.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

RedEye.exeKrotten.exeExplorer.EXE

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Users\\Admin\\Downloads\\The-MALWARE-Repo-master\\The-MALWARE-Repo-master\\Ransomware\\RedEye.exe"	RedEye.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Users\\Admin\\Downloads\\The-MALWARE-Repo-master\\The-MALWARE-Repo-master\\Ransomware\\RedEye.exe"	RedEye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Users\\Admin\\Downloads\\The-MALWARE-Repo-master\\The-MALWARE-Repo-master\\Ransomware\\RedEye.exe"	RedEye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\WINDOWS\\Web\\rundll32.exe"	Krotten.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AVPCC = "C:\\WINDOWS\\Cursors\\avp.exe"	Krotten.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\{905566CF-23D3-741B-5056-89006DF8340B} = "C:\\Users\\Admin\\AppData\\Roaming\\Ysaq\\hiar.exe"	Explorer.EXE

Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media
T1091

Processes:

RedEye.exe

description ioc process

File created C:\autorun.inf RedEye.exe
File opened for modification C:\autorun.inf RedEye.exe

description	ioc	process
File created	C:\autorun.inf	RedEye.exe
File opened for modification	C:\autorun.inf	RedEye.exe

Sets desktop wallpaper using registry 2 TTPs 2 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

RedEye.exeRedEye.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\Desktop\WallPaper = "C:\\redeyebmp.bmp"	RedEye.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\Desktop\WallPaper = "C:\\redeyebmp.bmp"	RedEye.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 45 IoCs

Processes:

Explorer.EXEhiar.exeDllHost.exeDllHost.exeRedEye.exeRedEye.exeNetSh.exeConhost.exeDllHost.exeDllHost.exeDllHost.exe

pid	process
3452	Explorer.EXE
3452	Explorer.EXE
3452	Explorer.EXE
3452	Explorer.EXE
3288	hiar.exe
3288	hiar.exe
3288	hiar.exe
3288	hiar.exe
1072	DllHost.exe
1072	DllHost.exe
1072	DllHost.exe
1072	DllHost.exe
3288	hiar.exe
4440	DllHost.exe
4440	DllHost.exe
4440	DllHost.exe
4440	DllHost.exe
1372	RedEye.exe
1372	RedEye.exe
1372	RedEye.exe
1372	RedEye.exe
5024	RedEye.exe
5024	RedEye.exe
5024	RedEye.exe
5024	RedEye.exe
276	NetSh.exe
276	NetSh.exe
276	NetSh.exe
276	NetSh.exe
308	Conhost.exe
308	Conhost.exe
308	Conhost.exe
308	Conhost.exe
1952	DllHost.exe
1952	DllHost.exe
1952	DllHost.exe
1952	DllHost.exe
3924	DllHost.exe
3924	DllHost.exe
3924	DllHost.exe
3924	DllHost.exe
1004	DllHost.exe
1004	DllHost.exe
1004	DllHost.exe
1004	DllHost.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

satan.exehiar.exe

description pid process target process

PID 4876 set thread context of 1300 4876 satan.exe satan.exe
PID 3360 set thread context of 3288 3360 hiar.exe hiar.exe
Drops file in Windows directory 2 IoCs

Processes:

Krotten.exeRedEye.exe

description ioc process

File opened for modification C:\WINDOWS\Web Krotten.exe
File created C:\Windows\Nope.txt RedEye.exe
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

description	pid	process	target process
PID 4876 set thread context of 1300	4876	satan.exe	satan.exe
PID 3360 set thread context of 3288	3360	hiar.exe	hiar.exe

description	ioc	process
File opened for modification	C:\WINDOWS\Web	Krotten.exe
File created	C:\Windows\Nope.txt	RedEye.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

Processes:

NetSh.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	NetSh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	NetSh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	NetSh.exe

Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

736 1828 WerFault.exe DanaBot.exe
212 5036 WerFault.exe rundll32.exe

pid	pid_target	process	target process
736	1828	WerFault.exe	DanaBot.exe
212	5036	WerFault.exe	rundll32.exe

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

satan.execmd.exeDanaBot.exeregsvr32.exerundll32.exeKrotten.exesatan.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	satan.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DanaBot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Krotten.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	satan.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exemsedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Interacts with shadow copies 3 TTPs 4 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490

Direct Volume Access
T1006

Processes:

vssadmin.exevssadmin.exevssadmin.exevssadmin.exe

pid process

1848 vssadmin.exe
4488 vssadmin.exe
1920 vssadmin.exe
1816 vssadmin.exe

pid	process
1848	vssadmin.exe
4488	vssadmin.exe
1920	vssadmin.exe
1816	vssadmin.exe

Modifies Internet Explorer settings 1 TTPs 8 IoCs

adware spyware

Modify Registry

T1112

Processes:

Explorer.EXEKrotten.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	Explorer.EXE
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Main	Krotten.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Window title = ":::::::::::::::::: ÌÎÉ ÕÓÉ ÏÐÎÒÓÕ À ÏÈÇÄÀ ÃÍÈÅÒ ::::::::::::::::::"	Krotten.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Microsoft\Internet Explorer\Main	Krotten.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window title = ":::::::::::::::::: ÌÎÉ ÕÓÉ ÏÐÎÒÓÕ À ÏÈÇÄÀ ÃÍÈÅÒ ::::::::::::::::::"	Krotten.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Microsoft\Internet Explorer\Toolbar	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser	Explorer.EXE

Modifies Internet Explorer start page 1 TTPs 2 IoCs

stealer

Modify Registry

T1112

Processes:

Krotten.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Start Page = "http://poetry.rotten.com/lightning/"	Krotten.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://poetry.rotten.com/lightning/"	Krotten.exe

Modifies data under HKEY_USERS 2 IoCs

Processes:

chrome.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133764261989167235"	chrome.exe

Modifies registry class 56 IoCs

Processes:

Explorer.EXEKrotten.exesihost.exemsedge.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\GroupByKey:PID = "2"	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\ShowCmd = "1"	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Rev = "0"	Explorer.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\REGFILE\SHELL\OPEN\COMMAND	Krotten.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\GroupByKey:FMTID = "{30C8EEF4-A832-41E2-AB32-E3C3CA28FD29}"	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Vid = "{137E7700-3573-11CF-AE69-08002B2E1262}"	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\Mode = "6"	Explorer.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\IconSize = "48"	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\NodeSlot = "9"	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\FFlags = "1092616209"	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\Shell\SniffedFolderType = "Generic"	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202020202020202	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = ffffffff	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.Search_cw5n1h2txyewy\WasEverActivated = "1"	sihost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\GroupView = "4294967295"	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0000000001000000ffffffff	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\Shell	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 14001f80cb859f6720028040b29b5540cc05aab60000	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\LogicalViewMode = "2"	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\Rev = "0"	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\Vid = "{65F125E5-7BE1-4810-BA9D-D271C8432CE3}"	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1\0	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1\0\1	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\Sort = 0000000000000000000000000000000002000000f4eec83032a8e241ab32e3c3ca28fd29030000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\HotKey = "0"	Explorer.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\GroupByDirection = "1"	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\Shell	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\WFlags = "0"	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616193"	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202020202	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\FFlags = "1092616193"	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	Explorer.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	Explorer.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

Explorer.EXE

pid process

3452 Explorer.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

chrome.exemsedge.exemsedge.exeidentity_helper.exemsedge.exemsedge.exesatan.exe

pid	process
2892	chrome.exe
2892	chrome.exe
2892	chrome.exe
2816	msedge.exe
2816	msedge.exe
1456	msedge.exe
1456	msedge.exe
2168	identity_helper.exe
2168	identity_helper.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
3140	msedge.exe
3140	msedge.exe
4876	satan.exe
4876	satan.exe
4876	satan.exe
4876	satan.exe
4876	satan.exe
4876	satan.exe
4876	satan.exe
4876	satan.exe
4876	satan.exe
4876	satan.exe
4876	satan.exe
4876	satan.exe
4876	satan.exe
4876	satan.exe
4876	satan.exe
4876	satan.exe
4876	satan.exe
4876	satan.exe
4876	satan.exe
4876	satan.exe
4876	satan.exe
4876	satan.exe
4876	satan.exe
4876	satan.exe
4876	satan.exe
4876	satan.exe
4876	satan.exe
4876	satan.exe
4876	satan.exe
4876	satan.exe
4876	satan.exe
4876	satan.exe
4876	satan.exe
4876	satan.exe
4876	satan.exe
4876	satan.exe
4876	satan.exe
4876	satan.exe
4876	satan.exe
4876	satan.exe
4876	satan.exe
4876	satan.exe
4876	satan.exe
4876	satan.exe
4876	satan.exe
4876	satan.exe
4876	satan.exe
4876	satan.exe
4876	satan.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

3452 Explorer.EXE

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs

Processes:

chrome.exemsedge.exe

pid	process
2892	chrome.exe
2892	chrome.exe
2892	chrome.exe
2892	chrome.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

chrome.exeKrotten.exeExplorer.EXEvssvc.exeRedEye.exeRedEye.exe

description	pid	process
Token: SeShutdownPrivilege	2892	chrome.exe
Token: SeCreatePagefilePrivilege	2892	chrome.exe
Token: SeShutdownPrivilege	2892	chrome.exe
Token: SeCreatePagefilePrivilege	2892	chrome.exe
Token: SeShutdownPrivilege	2892	chrome.exe
Token: SeCreatePagefilePrivilege	2892	chrome.exe
Token: SeShutdownPrivilege	2892	chrome.exe
Token: SeCreatePagefilePrivilege	2892	chrome.exe
Token: SeShutdownPrivilege	2892	chrome.exe
Token: SeCreatePagefilePrivilege	2892	chrome.exe
Token: SeShutdownPrivilege	2892	chrome.exe
Token: SeCreatePagefilePrivilege	2892	chrome.exe
Token: SeShutdownPrivilege	2892	chrome.exe
Token: SeCreatePagefilePrivilege	2892	chrome.exe
Token: SeShutdownPrivilege	2892	chrome.exe
Token: SeCreatePagefilePrivilege	2892	chrome.exe
Token: SeShutdownPrivilege	2892	chrome.exe
Token: SeCreatePagefilePrivilege	2892	chrome.exe
Token: SeShutdownPrivilege	2892	chrome.exe
Token: SeCreatePagefilePrivilege	2892	chrome.exe
Token: SeShutdownPrivilege	2892	chrome.exe
Token: SeCreatePagefilePrivilege	2892	chrome.exe
Token: SeShutdownPrivilege	2892	chrome.exe
Token: SeCreatePagefilePrivilege	2892	chrome.exe
Token: SeSystemtimePrivilege	2232	Krotten.exe
Token: SeSystemtimePrivilege	2232	Krotten.exe
Token: SeSystemtimePrivilege	2232	Krotten.exe
Token: SeShutdownPrivilege	3452	Explorer.EXE
Token: SeCreatePagefilePrivilege	3452	Explorer.EXE
Token: SeBackupPrivilege	3716	vssvc.exe
Token: SeRestorePrivilege	3716	vssvc.exe
Token: SeAuditPrivilege	3716	vssvc.exe
Token: SeShutdownPrivilege	3452	Explorer.EXE
Token: SeCreatePagefilePrivilege	3452	Explorer.EXE
Token: SeShutdownPrivilege	3452	Explorer.EXE
Token: SeCreatePagefilePrivilege	3452	Explorer.EXE
Token: SeShutdownPrivilege	3452	Explorer.EXE
Token: SeCreatePagefilePrivilege	3452	Explorer.EXE
Token: SeShutdownPrivilege	3452	Explorer.EXE
Token: SeCreatePagefilePrivilege	3452	Explorer.EXE
Token: SeDebugPrivilege	1372	RedEye.exe
Token: SeShutdownPrivilege	3452	Explorer.EXE
Token: SeCreatePagefilePrivilege	3452	Explorer.EXE
Token: SeShutdownPrivilege	3452	Explorer.EXE
Token: SeCreatePagefilePrivilege	3452	Explorer.EXE
Token: SeShutdownPrivilege	3452	Explorer.EXE
Token: SeCreatePagefilePrivilege	3452	Explorer.EXE
Token: SeShutdownPrivilege	3452	Explorer.EXE
Token: SeCreatePagefilePrivilege	3452	Explorer.EXE
Token: SeShutdownPrivilege	3452	Explorer.EXE
Token: SeCreatePagefilePrivilege	3452	Explorer.EXE
Token: SeShutdownPrivilege	3452	Explorer.EXE
Token: SeCreatePagefilePrivilege	3452	Explorer.EXE
Token: SeDebugPrivilege	5024	RedEye.exe
Token: SeShutdownPrivilege	3452	Explorer.EXE
Token: SeCreatePagefilePrivilege	3452	Explorer.EXE
Token: SeShutdownPrivilege	3452	Explorer.EXE
Token: SeCreatePagefilePrivilege	3452	Explorer.EXE
Token: SeShutdownPrivilege	3452	Explorer.EXE
Token: SeCreatePagefilePrivilege	3452	Explorer.EXE
Token: SeShutdownPrivilege	3452	Explorer.EXE
Token: SeCreatePagefilePrivilege	3452	Explorer.EXE
Token: SeShutdownPrivilege	3452	Explorer.EXE
Token: SeCreatePagefilePrivilege	3452	Explorer.EXE

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

chrome.exemsedge.exe

pid	process
2892	chrome.exe
2892	chrome.exe
2892	chrome.exe
2892	chrome.exe
2892	chrome.exe
2892	chrome.exe
2892	chrome.exe
2892	chrome.exe
2892	chrome.exe
2892	chrome.exe
2892	chrome.exe
2892	chrome.exe
2892	chrome.exe
2892	chrome.exe
2892	chrome.exe
2892	chrome.exe
2892	chrome.exe
2892	chrome.exe
2892	chrome.exe
2892	chrome.exe
2892	chrome.exe
2892	chrome.exe
2892	chrome.exe
2892	chrome.exe
2892	chrome.exe
2892	chrome.exe
2892	chrome.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe

Suspicious use of SendNotifyMessage 64 IoCs

Processes:

chrome.exemsedge.exeExplorer.EXE

pid	process
2892	chrome.exe
2892	chrome.exe
2892	chrome.exe
2892	chrome.exe
2892	chrome.exe
2892	chrome.exe
2892	chrome.exe
2892	chrome.exe
2892	chrome.exe
2892	chrome.exe
2892	chrome.exe
2892	chrome.exe
2892	chrome.exe
2892	chrome.exe
2892	chrome.exe
2892	chrome.exe
2892	chrome.exe
2892	chrome.exe
2892	chrome.exe
2892	chrome.exe
2892	chrome.exe
2892	chrome.exe
2892	chrome.exe
2892	chrome.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
3452	Explorer.EXE
3452	Explorer.EXE
3452	Explorer.EXE
3452	Explorer.EXE
3452	Explorer.EXE
3452	Explorer.EXE
3452	Explorer.EXE
3452	Explorer.EXE

Suspicious use of SetWindowsHookEx 11 IoCs

Processes:

Conhost.exeExplorer.EXE

pid	process
1204	Conhost.exe
3452	Explorer.EXE
3452	Explorer.EXE
3452	Explorer.EXE
3452	Explorer.EXE
3452	Explorer.EXE
3452	Explorer.EXE
3452	Explorer.EXE
3452	Explorer.EXE
3452	Explorer.EXE
3452	Explorer.EXE

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

chrome.exe

description	pid	process	target process
PID 2892 wrote to memory of 1452	2892	chrome.exe	chrome.exe
PID 2892 wrote to memory of 1452	2892	chrome.exe	chrome.exe
PID 2892 wrote to memory of 3368	2892	chrome.exe	chrome.exe
PID 2892 wrote to memory of 3368	2892	chrome.exe	chrome.exe
PID 2892 wrote to memory of 3368	2892	chrome.exe	chrome.exe
PID 2892 wrote to memory of 3368	2892	chrome.exe	chrome.exe
PID 2892 wrote to memory of 3368	2892	chrome.exe	chrome.exe
PID 2892 wrote to memory of 3368	2892	chrome.exe	chrome.exe
PID 2892 wrote to memory of 3368	2892	chrome.exe	chrome.exe
PID 2892 wrote to memory of 3368	2892	chrome.exe	chrome.exe
PID 2892 wrote to memory of 3368	2892	chrome.exe	chrome.exe
PID 2892 wrote to memory of 3368	2892	chrome.exe	chrome.exe
PID 2892 wrote to memory of 3368	2892	chrome.exe	chrome.exe
PID 2892 wrote to memory of 3368	2892	chrome.exe	chrome.exe
PID 2892 wrote to memory of 3368	2892	chrome.exe	chrome.exe
PID 2892 wrote to memory of 3368	2892	chrome.exe	chrome.exe
PID 2892 wrote to memory of 3368	2892	chrome.exe	chrome.exe
PID 2892 wrote to memory of 3368	2892	chrome.exe	chrome.exe
PID 2892 wrote to memory of 3368	2892	chrome.exe	chrome.exe
PID 2892 wrote to memory of 3368	2892	chrome.exe	chrome.exe
PID 2892 wrote to memory of 3368	2892	chrome.exe	chrome.exe
PID 2892 wrote to memory of 3368	2892	chrome.exe	chrome.exe
PID 2892 wrote to memory of 3368	2892	chrome.exe	chrome.exe
PID 2892 wrote to memory of 3368	2892	chrome.exe	chrome.exe
PID 2892 wrote to memory of 3368	2892	chrome.exe	chrome.exe
PID 2892 wrote to memory of 3368	2892	chrome.exe	chrome.exe
PID 2892 wrote to memory of 3368	2892	chrome.exe	chrome.exe
PID 2892 wrote to memory of 3368	2892	chrome.exe	chrome.exe
PID 2892 wrote to memory of 3368	2892	chrome.exe	chrome.exe
PID 2892 wrote to memory of 3368	2892	chrome.exe	chrome.exe
PID 2892 wrote to memory of 3368	2892	chrome.exe	chrome.exe
PID 2892 wrote to memory of 3368	2892	chrome.exe	chrome.exe
PID 2892 wrote to memory of 2740	2892	chrome.exe	chrome.exe
PID 2892 wrote to memory of 2740	2892	chrome.exe	chrome.exe
PID 2892 wrote to memory of 456	2892	chrome.exe	chrome.exe
PID 2892 wrote to memory of 456	2892	chrome.exe	chrome.exe
PID 2892 wrote to memory of 456	2892	chrome.exe	chrome.exe
PID 2892 wrote to memory of 456	2892	chrome.exe	chrome.exe
PID 2892 wrote to memory of 456	2892	chrome.exe	chrome.exe
PID 2892 wrote to memory of 456	2892	chrome.exe	chrome.exe
PID 2892 wrote to memory of 456	2892	chrome.exe	chrome.exe
PID 2892 wrote to memory of 456	2892	chrome.exe	chrome.exe
PID 2892 wrote to memory of 456	2892	chrome.exe	chrome.exe
PID 2892 wrote to memory of 456	2892	chrome.exe	chrome.exe
PID 2892 wrote to memory of 456	2892	chrome.exe	chrome.exe
PID 2892 wrote to memory of 456	2892	chrome.exe	chrome.exe
PID 2892 wrote to memory of 456	2892	chrome.exe	chrome.exe
PID 2892 wrote to memory of 456	2892	chrome.exe	chrome.exe
PID 2892 wrote to memory of 456	2892	chrome.exe	chrome.exe
PID 2892 wrote to memory of 456	2892	chrome.exe	chrome.exe
PID 2892 wrote to memory of 456	2892	chrome.exe	chrome.exe
PID 2892 wrote to memory of 456	2892	chrome.exe	chrome.exe
PID 2892 wrote to memory of 456	2892	chrome.exe	chrome.exe
PID 2892 wrote to memory of 456	2892	chrome.exe	chrome.exe
PID 2892 wrote to memory of 456	2892	chrome.exe	chrome.exe
PID 2892 wrote to memory of 456	2892	chrome.exe	chrome.exe
PID 2892 wrote to memory of 456	2892	chrome.exe	chrome.exe
PID 2892 wrote to memory of 456	2892	chrome.exe	chrome.exe
PID 2892 wrote to memory of 456	2892	chrome.exe	chrome.exe
PID 2892 wrote to memory of 456	2892	chrome.exe	chrome.exe
PID 2892 wrote to memory of 456	2892	chrome.exe	chrome.exe
PID 2892 wrote to memory of 456	2892	chrome.exe	chrome.exe
PID 2892 wrote to memory of 456	2892	chrome.exe	chrome.exe
PID 2892 wrote to memory of 456	2892	chrome.exe	chrome.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Modifies registry class
PID:3040

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2528

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:3124

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:3452
- C:\Windows\system32\cmd.exe
  cmd /c C:\Users\Admin\AppData\Local\Temp\OIP.jpg
  2⤵
  PID:3928
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2892
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ffede36cc40,0x7ffede36cc4c,0x7ffede36cc58
    3⤵
    PID:1452
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1880,i,16325847912115341347,16281973464219764751,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1876 /prefetch:2
    3⤵
    PID:3368
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2032,i,16325847912115341347,16281973464219764751,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2100 /prefetch:3
    3⤵
    PID:2740
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=1760,i,16325847912115341347,16281973464219764751,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2452 /prefetch:8
    3⤵
    PID:456
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3140,i,16325847912115341347,16281973464219764751,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3164 /prefetch:1
    3⤵
    PID:2304
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3156,i,16325847912115341347,16281973464219764751,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3420 /prefetch:1
    3⤵
    PID:3020
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3144,i,16325847912115341347,16281973464219764751,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3748 /prefetch:1
    3⤵
    PID:4152
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4812,i,16325847912115341347,16281973464219764751,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4848 /prefetch:8
    3⤵
    PID:5020
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4788,i,16325847912115341347,16281973464219764751,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4928 /prefetch:8
    3⤵
    PID:4524
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=4856,i,16325847912115341347,16281973464219764751,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4848 /prefetch:1
    3⤵
    PID:1748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
  2⤵
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:1456
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffedd6d46f8,0x7ffedd6d4708,0x7ffedd6d4718
    3⤵
    PID:4436
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,16204035541914040641,8765482380040795048,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
    3⤵
    PID:3292
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2076,16204035541914040641,8765482380040795048,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2816
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2076,16204035541914040641,8765482380040795048,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2728 /prefetch:8
    3⤵
    PID:1464
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,16204035541914040641,8765482380040795048,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3404 /prefetch:1
    3⤵
    PID:4156
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,16204035541914040641,8765482380040795048,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3420 /prefetch:1
    3⤵
    PID:2120
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,16204035541914040641,8765482380040795048,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4104 /prefetch:1
    3⤵
    PID:2308
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,16204035541914040641,8765482380040795048,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5152 /prefetch:1
    3⤵
    PID:712
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,16204035541914040641,8765482380040795048,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5540 /prefetch:8
    3⤵
    PID:4900
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,16204035541914040641,8765482380040795048,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5540 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2168
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,16204035541914040641,8765482380040795048,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5580 /prefetch:1
    3⤵
    PID:3508
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,16204035541914040641,8765482380040795048,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6072 /prefetch:1
    3⤵
    PID:4924
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,16204035541914040641,8765482380040795048,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5968 /prefetch:1
    3⤵
    PID:4316
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,16204035541914040641,8765482380040795048,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5936 /prefetch:1
    3⤵
    PID:220
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,16204035541914040641,8765482380040795048,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6084 /prefetch:1
    3⤵
    PID:4160
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,16204035541914040641,8765482380040795048,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5176 /prefetch:1
    3⤵
    PID:2120
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,16204035541914040641,8765482380040795048,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1888 /prefetch:1
    3⤵
    PID:3108
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,16204035541914040641,8765482380040795048,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4848 /prefetch:1
    3⤵
    PID:3708
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,16204035541914040641,8765482380040795048,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1776 /prefetch:1
    3⤵
    PID:1936
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,16204035541914040641,8765482380040795048,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2620 /prefetch:1
    3⤵
    PID:3032
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2076,16204035541914040641,8765482380040795048,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6044 /prefetch:8
    3⤵
    PID:4508
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,16204035541914040641,8765482380040795048,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5724 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1100
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2076,16204035541914040641,8765482380040795048,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5888 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3140
- C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Banking-Malware\DanaBot.exe
  "C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Banking-Malware\DanaBot.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1828
- - C:\Windows\SysWOW64\regsvr32.exe
    C:\Windows\system32\regsvr32.exe -s C:\Users\Admin\DOWNLO~1\THE-MA~1\THE-MA~1\BANKIN~1\DanaBot.dll f1 C:\Users\Admin\DOWNLO~1\THE-MA~1\THE-MA~1\BANKIN~1\DanaBot.exe@1828
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:3856
  - - C:\Windows\SysWOW64\rundll32.exe
      C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\DOWNLO~1\THE-MA~1\THE-MA~1\BANKIN~1\DanaBot.dll,f0
      4⤵
      Blocklisted process makes network request
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:5036
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5036 -s 1016
        5⤵
        Program crash
        
        PID:212
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1828 -s 468
    3⤵
    - Program crash
    PID:736
- C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\Krotten.exe
  "C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\Krotten.exe"
  2⤵
  - Disables RegEdit via registry modification
  - Adds Run key to start application
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Modifies Internet Explorer start page
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  PID:2232
- C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\satan.exe
  "C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\satan.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4876
- - C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\satan.exe
    "C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\satan.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1300
  - - C:\Users\Admin\AppData\Roaming\Ysaq\hiar.exe
      "C:\Users\Admin\AppData\Roaming\Ysaq\hiar.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      PID:3360
    - - C:\Users\Admin\AppData\Roaming\Ysaq\hiar.exe
        
        "C:\Users\Admin\AppData\Roaming\Ysaq\hiar.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:3288
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp_30b27822.bat"
      4⤵
      System Location Discovery: System Language Discovery
      PID:396
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        Suspicious use of SetWindowsHookEx
        
        PID:1204
- C:\Windows\System32\vssadmin.exe
  "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
  2⤵
  - Interacts with shadow copies
  PID:1848
- C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\RedEye.exe
  "C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\RedEye.exe"
  2⤵
  - Sets desktop wallpaper using registry
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of AdjustPrivilegeToken
  PID:1372
- C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\RedEye.exe
  "C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\RedEye.exe"
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  - UAC bypass
  - Disables RegEdit via registry modification
  - Event Triggered Execution: Image File Execution Options Injection
  - Adds Run key to start application
  - Drops autorun.inf file
  - Sets desktop wallpaper using registry
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  PID:5024
- - C:\Windows\SYSTEM32\vssadmin.exe
    vssadmin delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:1816
- - C:\Windows\SYSTEM32\vssadmin.exe
    vssadmin delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:1920
- - C:\Windows\SYSTEM32\vssadmin.exe
    vssadmin delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:4488
- - C:\Windows\SYSTEM32\NetSh.exe
    NetSh Advfirewall set allprofiles state off
    3⤵
    - Modifies Windows Firewall
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Event Triggered Execution: Netsh Helper DLL
    PID:276
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      Suspicious use of NtSetInformationThreadHideFromDebugger
      PID:308
- - C:\Windows\System32\shutdown.exe
    "C:\Windows\System32\shutdown.exe" -r -t 00 -f
    3⤵
    PID:5072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
  2⤵
  PID:628
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffedd6d46f8,0x7ffedd6d4708,0x7ffedd6d4718
    3⤵
    PID:920
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2200,12585468367281405308,4512906320995371221,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2268 /prefetch:2
    3⤵
    PID:4336
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2200,12585468367281405308,4512906320995371221,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2320 /prefetch:3
    3⤵
    PID:3052
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2200,12585468367281405308,4512906320995371221,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2872 /prefetch:8
    3⤵
    PID:2832
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,12585468367281405308,4512906320995371221,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3428 /prefetch:1
    3⤵
    PID:3196
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,12585468367281405308,4512906320995371221,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3440 /prefetch:1
    3⤵
    PID:3540

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3584

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3788

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3872

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3936

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:4020

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3612

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca
1⤵
PID:1460

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3628

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:1500

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3664

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:2828

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1268

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1208

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1584

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1828 -ip 1828
1⤵
PID:1768

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}
1⤵
PID:2684

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1072

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3716

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4440

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1952

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:3924

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1004

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:1228

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:736

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3784

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3866855 /state1:0x41c64e6d
1⤵
PID:2348

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 5036 -ip 5036
1⤵
PID:5064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Netsh Helper DLL

T1546.007

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Netsh Helper DLL

T1546.007

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Direct Volume Access

T1006

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
a7d0cf37cf84d15b24d2341a35297ade

SHA1
efaa48639d282afcad9ae9f0f3ee93a081d5233d

SHA256
8a76b04dd822c1bada8f37003caa28a570614fe91de5fab54ee13e8f5d955e01

SHA512
600e6570f7086e0cf34b83195b09d3328ab898fc295030a750731ce4349b459d9e5a9cc01316496115fdefd6188eb9f5a12600f6449df5f301d69322387a4b55

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
3ef30855b6defb8d6a11d39bd5c41b39

SHA1
50cf633fd7799bad3ece48c7077d8d6aedeec1a4

SHA256
06034c94c917c22001e9b7f2fda56076aefefa506d28cd6d00611ec30d775b5f

SHA512
c88efa1dd8f1929c824592d5c6077872fe585b02247f0a3a21361dc02b6eb777f832be256c098db2839d36fdf0f8e7e97e80e57d3a618001a8a8fd8d55b96917

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
c8ff6f2613027319aba70cc09817575c

SHA1
9334e7c76fddacdd185951cd535621fa618b4120

SHA256
d831ed98ae298b21d887b3563c4176173792280e0e6d74517e005b3d968e6a3e

SHA512
ac61f563d1a7b7c596b31f52e4fdac813c86c66147635f382eca285714d1e1b24ac5fc9f0993af6e10b0cf55c26fa6ef28c305ac21ffd5a47b8b398e45708d81

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
356B

MD5
0cb6105f8b8df4d0b9437872025b4448

SHA1
1c9b7605bcca07f715c1a2b5791eb1d635474250

SHA256
0369c50fb191d9ea537f91bded998bd94b2615af70c414491ffb0bcf010e9b84

SHA512
8b112f220af9e949e31a34e7dc0c0a5a4fb2037beda1becb9226eb9692e7384fe4de4fe296488e1e27bc935e7e7971e3b3d40a867b62c7402e61cfb94357f31b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
81e259dffe746632dd2fe2902ec19463

SHA1
7feedbd8f0632bf0ba3a73b4fb94d031a42f16ae

SHA256
0a88a8fab8901c9eb85d57ec160b68e9b0e5d0b8faede0fce201ce908c0a93ab

SHA512
d23022c2f933088162ed1ce113e79b5ff8f53464b8344e84d17f4b77f2e54a068770f1889555609938dcb335366ed571f0cdf6148cf8a2e8aa216cee751fde1b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
6096b3212634ebe48702b5bedacc9c40

SHA1
846e3efdd1b8d1518ffeba42c86950012156003e

SHA256
98661bb7c31cc8b118f7c996ea0129c305b0e13b6180965a1047c48b56dad056

SHA512
0e77de873d4b1f6566577cf959e259887c6bc890983085c0e00f4e11d019226248d627fe127679f97182ac1d5c008febb8a3f4bf5623694534fe06eafa5ffb4c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
15KB

MD5
d2bf6f640eb4f2ad4411167de7d6e18b

SHA1
32f138763994dd0ca32e887494ecf9bdb26ca9f2

SHA256
2da7d3e1f657cf6687b59dbb1fc5708a107733cd70471119cddd5aaebeb268d0

SHA512
4a371780619a3fdee2b62bba20970376c32bea663b7a2b470eed1e1f0210cd230d043c8d18a64bd337c0006a1aaf0cf9c2af584085000b6562b210396e97c99a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
231KB

MD5
0ec2db476f068d98a4fe37acc1e7ecc1

SHA1
3d559634ab5960d4befa03571825c6dd9a817fff

SHA256
96559da526828038910c6a4817e1cc1bf749a1d9a746bfdbb0041ba6d6f34c39

SHA512
2406fe19de010296f5ca948ee645c5185400eeaf75aae8da71e15f3311088c6a339222aa812321cfe5a70f81cb8cfd9c7771c7387e397e15f42667791911a951

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
231KB

MD5
e5a0f6c90544673949b93e922fb47f62

SHA1
38aa4e2c6e531eaf555057321e4d93427a3605a6

SHA256
5a51238df6a72a2b373c8e808bed805cf4a4077ab7b0b0f2b77396328e1313e2

SHA512
7322e974a021357ee45dedeedf03ef2eddd992ebe1f3eee188f1d1a23ee08f24d6ae8affa430be5e4f0893a6815d08a798fa33000c15cb04dd160d250c88f09d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c2d9eeb3fdd75834f0ac3f9767de8d6f

SHA1
4d16a7e82190f8490a00008bd53d85fb92e379b0

SHA256
1e5efb5f1d78a4cc269cb116307e9d767fc5ad8a18e6cf95c81c61d7b1da5c66

SHA512
d92f995f9e096ecc0a7b8b4aca336aeef0e7b919fe7fe008169f0b87da84d018971ba5728141557d42a0fc562a25191bd85e0d7354c401b09e8b62cdc44b6dcd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fec6f16f171f3ba55568802a7592f7fc

SHA1
d679be0b4270bfd7d811bc8d028052a267160eab

SHA256
770fad00532e966f5f2e2a77afb0a177187a92b72c5b55890b3907300f91a652

SHA512
c7e88c90b615c353bef4f425d84c8e128d53d12f9a07cc1261b38bcbc3187f47ae63e38a614f2287f22b3ab08dcfa48b317c6f53d8cf391f3502df3966a2381e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
37128b4e4883085adb70212099d33acf

SHA1
9c716ed5401e9dc2c6879b03f0a34d824d2ede99

SHA256
91c7f07e7aa52f1e4d6751b4ba31d098072197bf3ba6a4549d213f9fe1de1ab7

SHA512
3e3851dbdec3560fc5eb18be51de362acb4bdb889c66d1794b97f29a8a3a86aca900406360778819ace767653d083be45a21673e232be205e81ff36ddd9f63ec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e55832d7cd7e868a2c087c4c73678018

SHA1
ed7a2f6d6437e907218ffba9128802eaf414a0eb

SHA256
a4d7777b980ec53de3a70aca8fb25b77e9b53187e7d2f0fa1a729ee9a35da574

SHA512
897fdebf1a9269a1bf1e3a791f6ee9ab7c24c9d75eeff65ac9599764e1c8585784e1837ba5321d90af0b004af121b2206081a6fb1b1ad571a0051ee33d3f5c5f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
1785664e9ee000f01ff7ce7953ce5465

SHA1
8ff458b5829cb9d8cb992efcf4f13c3856b94152

SHA256
9d9f0678f26283b4b118601bbebcdbae8e317483c037d88528731954089911a8

SHA512
b6a77beed1142f4269a57985b51c3a54a993d97c85edd419a82cc06ccce82f78dc40c174daa15d4e9c0f04870fc93b8f2eed2e8551d6b6acbf43077c3b737d74

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons

Filesize
28KB

MD5
3c10cae8a9d7b9ebc7cbc89be72395a1

SHA1
db43de8d5d045bb2faef77f6151b6bc53c6f5b4c

SHA256
d1239d0fab783e68d6e985d20360a8a1c96fd2bef11048bf3dd0bd554ad105d2

SHA512
10fe43f043fdd1693197327ba2866b05f9a5d8ec0f915567bef5eaad8f97bd9b27dc1c16227df42987393370aa75676850c24c951a9da2f6c213f814f4d51b2c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
102c2da2fd511ecdda86162bfb1e1bb2

SHA1
cd2169fd440a12a22b6101b72acec7da87e44b46

SHA256
4a7c2624d1dab3166024ed0b8805d00d737cc7c006fa68a40e56f12edd83c5c8

SHA512
26471a65f96d27f96adb19260fb1499fd65e5d1587c70b2ba87d306cd19e3721bf5c632257963afe8901d8131d9836dd3c56d2d144ac3c9b81973113a0fc919e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History

Filesize
124KB

MD5
7019feb2ac0942ca907103373c3bd3a1

SHA1
223e4c09da8acee28dcc055e279525d93708150c

SHA256
a6675171ee6e09bb626f3ab7e52cff8767d6adb66dd24d55ad24f3d18ba5fd1e

SHA512
17fd4219ad80ec958d1e5096bd385f85e4b3e6360131eb011e451c596e5b58f7207e464dcaff468f67e3abd9dce8770de0c78a47f2f397f3b464eeca1f274843

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History Provider Cache

Filesize
2KB

MD5
769e0da74c75e130eae79d051c5daba0

SHA1
5c45063e952e2d824222b8c5f2698e28710cf7a3

SHA256
625592c16fd509d0d7c12bcc2cac08b9bfdc4e25b8cdd3379e6be47f6a22c31b

SHA512
3befd58e89e634275456f3f299409d33409d23f7e3d39b8c2d7909ecfb6e5120c76ea2f5cf94371fbe08b620b8de1238fedfbbad2705062089d94285c173f431

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log

Filesize
13KB

MD5
50ae5b8476c061e26bb6a875ee85cfc0

SHA1
044796801e986be46cda17e9f86a80df6ea87d68

SHA256
a31a1bb78f38b4abf8a79c42efb881b4d005d2a066f1c2b9ad4fd3bb5e468bfd

SHA512
28c7f495735054a6404cadddb587fdaa4b12601970d5f2052cafb322ac282158205dc062f4bcf9e1d56d7a07db1b6ebd75e173cdd9a491d70e31806258aaad08

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Filesize
334B

MD5
81c8190ca2378b6ed7e5dfad01b8fb54

SHA1
9693b0ae0cd2be905994842582d86b170552f2a8

SHA256
0d44be0093fa779138baf058a6a3c34db0536f90024d6cad1c89b37c41d01f41

SHA512
9bbebf0caebab19c2d0fe007fab5f1de1acd9f992674338013f3bff46ef80ba95b1a48d09c38838096c13433fc77dae695d251d6769a06a3dc0640897b429af7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
857B

MD5
1287141d7ae79e6ce9b20101dc458ed2

SHA1
acc07b17e7ef25a694fe4fa9388ffa2ecf647924

SHA256
e9664ce2704664aed946b776ac981f80642d2f835a815940ab913b4067711481

SHA512
3c5c30847aa84a4360207872c67529102f520f6c372783154caed313f25b569ba982f8bbf33c31a6cbd7a8ea1af647d257afc484bc2b03f801a30e6f61b538e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
934B

MD5
76fa18f5f9c53f6dac4f61821393ed8f

SHA1
ac2c49e115b255bb8bab7941230cec8db625dabf

SHA256
f6e547b2218556e4ad06a938e78c0e217f26287de3679fa3e896840090f2cac4

SHA512
4bce997c3c28cb4a7c90f939c76556563e250125bfb978f402408791e5f8ead944d53544d93fde5aa12f4ceb4740de85799dcb750c637af68a2a04f5d36f398c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
934B

MD5
fd5cd64e29ab319399b029c9f9e12d73

SHA1
7e93c6052403f4c4135af6661215dd6e6227d67b

SHA256
f40a12a8937c7b8d8480cdc2d0cffbe5f6c68e0e007b50b845682554f84a8a73

SHA512
4a8b1ea6e8be0d4857cfb03c0a31c4a5807bff4f58703b269ff57f1324b0b8a164c4658ba05a1de4d94be456f5b6310cb0b8d6bf947934f4a9b80bba7a93286b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
0aa9834ab628f3b42102c75136c8bcd7

SHA1
7a2650ac1f831854021619777f3f274259b49e40

SHA256
b03d9ad0ea1a8c7b520e06e6fd6f72c0fa8ed9d5eda34d3ce73bb1a2319bcf99

SHA512
12342dd07c130aa24dcd3bf636f4e22b3ee5d397d7de2f7225e72136259b205e7438f03a6e57fd5860fae341bd53a4a04c99392a9e0011b30ef506d9910719be

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
e5e8baa9515952641f829d3c6b70efa9

SHA1
71c378839f4bbc2c45b5f395d40f7a8f101457c2

SHA256
c6aa95e7d61f34cc399b3b4720ef0eeb68928a2333693dd5e444e2af362e5e06

SHA512
561da9c71a37b5eddebd5d1d41ba29977468ff6150e7f0a5e7287a1e16778b68d327981595ce5f7905df7a59193ee56352aec842dd46e6ad9f9f897137089034

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
ea9f7b9690d296c5c0ff7255197d5086

SHA1
26edfc395da91f97e18eedff7e42fff38c0a8d26

SHA256
a3319b47b17fde90c222260399f7657ad7a6738ad4446015c120c1d035ea5ebe

SHA512
8e47f508bf5080c28405539da5d0e5eeadf70c1865d3dd60432248514c1f5704bddc30fe7b5d07b728f82c82b46f920f12ef4997b86e0f1ddaf33243f2eb1900

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2126ec7c1c4ab4e334ff42c128f6afdc

SHA1
9e29c8c2bfe2d31dfc8030551df707cb905fb70f

SHA256
32693744c65133f7be542d0a88410701f5876ccb34d7586fa58321defe174e1b

SHA512
3b4b79622bdbbeea904464e1a61f92ff26d25d389865d43ebca0329d9490af1161219b15e6a961e5dca9709102e256c7bdc6ff54ea76d76c49ae6735e6f4840d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
f4635d197747e16ec7da4090fa7eccd7

SHA1
1ec793d9adc8b020fe8fe2b9bade1c72e8ece26a

SHA256
80ba6fbcbc38de99017e44f2f852bf8dd0aeada640ea106410575781fb4c378b

SHA512
9b8ff09505062e0de1798e4031859b5cdd3ef66570a115c00c60920bb53f4117942200b0c5c4c25445946af197421fc788e2cc60834c981d20bd4ff4f619dd7b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
dfbd7824a1fc05281f8e8d3cd900062c

SHA1
881b4ec4b5a52fa281437628c887571b0d3a614a

SHA256
2d1d1021cecf712c0941b79141a0cee30f8a16e0954ac2189e408e27eeec71d5

SHA512
ab376d8a735c901d447e3c28820e2b91b1e39850c39734dde5f038dd778309bec161df2c3aa9d736a961be1bbeacaa1870546a80fc2ebed8bf5e4885d6037cc7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
bf4ee96132b4ce4a9fcbb65fdbf77655

SHA1
721d623829fe2cc610eef636393f0927feeb5042

SHA256
826a278f8aa5262af76f11d4750a1e4605693c155879c4f4b2b9fff89311665b

SHA512
9a74b02943de4546ddaa68dd717bcff20ba04f150873605cfe06effb3abf43c1720e52c3bea10fa8fb9b3a6b9570a47429f53d5903d6f9a3a4a338b9958da55f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Tabs_13376426212561386

Filesize
12KB

MD5
7c890a0808c53119d48ee542b75b97f8

SHA1
9d542bc8608bfac0c5582f9eb99205ced6f7d105

SHA256
010aeb92aca018241fce5d676f06fcdc1589bac5f2f3ed5082a7199fd7b4cd15

SHA512
3b7d5bbd1b23b3406f5cc068ef8d878c09da8f3003622383cd55157dc4866893ba46d53b0e78cb16e93e5a42c66ebbbfc244abeb8bc2c18bc417dec17534bd55

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log

Filesize
187B

MD5
178f6ea22044b86dae74ce6a6007c697

SHA1
61b84557106793d257137b81c19178d5c9b6eff0

SHA256
5126b90fd6d69efbb8839457c24caac2351deae60ddc2132b6c89a07b69df8ee

SHA512
1f3e098bedec9f38639758f9f933f252ec4f40eed5ee74c69c9ca0f739e088626bb8f83c05ee9d98ed83cb7059ac50856bab713136f2f15ae13dabc4e6bae0cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Filesize
347B

MD5
249954a6f1d1a06730eea39e86d2ac58

SHA1
193e53cdc9e5e1be5fd562fe2d79b49966b99992

SHA256
6efc4f791efc3301516b378b5922be4b5f69d8e146afab2d035e009a401c3d4e

SHA512
1a27f67a16b0d1da44a0f7c8a819c89814241cc4d16e29961229475bfb1c52d6321e85046509a40c2a217f12f12d3aa0bd052b51e3c2c097ed8f2a4d2c05c28d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Filesize
326B

MD5
090fa3e1c869d3b622b2b7ca0d62cad2

SHA1
ec8a9888b4c55cc2b43b3f821e4fb6c25d0b5acf

SHA256
9934c2c53ca37f1d650bd3ad013533e8c0cf0802d3b29cedbd6d70db171390ef

SHA512
d5516ee1f35b9b72e286d26ded7819c6d05a9019df3758ff291e83af1a1a767361ce2d3276c412cb074537d387bac4935443c7f3f6038858697b697431cb19f1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
07a71086c9dfa632a1859ff08b7ff061

SHA1
00833dbc68d99581c5735ef5c642935d9968e151

SHA256
4a913463431f02d448dce9783b9f338efe4d2ce2cb476e10213fb43ac01cf3bb

SHA512
0d97ea62828bd34c8e969e08b63826ee8cf37cd6c3d0ac33b2592756fbb279f68142287cefd43e26ab0f62bfa327316fcbad721c6a799d1a795941aa7ce08a58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
84462c9d8f9dd4cbb9c48847a0760b59

SHA1
d46b22e51d1b1d7e87044a2ed77d7185eb320a38

SHA256
c9d629b4fbe4571d4d8c4b07098c4075f42c142199b4bc1019db663a047b26d3

SHA512
3b9ca253c7d243feb4ed9c63ebd0587d8979a68362572331f507253d6479924f2355a0e22ac7c7b1f15c9b8f3925585c6f58014e8a214101a2dbba1f195de44f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
a4850a53f6875c9e0e487ef5d07d1aeb

SHA1
3416e10261b33d2fcd14fcc759673eef56784a26

SHA256
590b402d2b62fded1419d0185cc062ab979138837f65c9c1104636676be4d444

SHA512
54715f925923b51cb45151a97201ae01bbd19e1553f4cbae42d130e229f1abec297690ad6ed8db5de6fa44b4262d3bb46ae0abc2739ee65571ca4c335b867df4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe6448b2.TMP

Filesize
199B

MD5
fab8c62ee8e6de14c0a15678786b6738

SHA1
31f26241bfa5b17b7de8de773cb59093d53a1514

SHA256
f09cd2aae0560242df73687443515e517e61f23016569ed86317d136f27445b0

SHA512
53c8fc656cffb29617027854e979a79351496f7936b116da156a6a5b6855cd918e60199a472ae473f94c98eef7dc94ae9c117e7fce1e8fcadf1be16054a8b633

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Visited Links

Filesize
128KB

MD5
19b6bbec9180c6d463e159402f554cb2

SHA1
dc3112f74e814b08e0ff88d84f866bba00d95940

SHA256
79aeb351e923e1c09f115222248e1d4c2a22e7b514f92a9f8ff7ae053e161377

SHA512
4876d9f7193a31162a52f1d39f085a8838450080e8fc9e065e083a747c06bf9f414ede7f6d2c87a4a89ed9682a3d194188909455fef62172c7b0196dea2db53b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Filesize
116KB

MD5
bf0e72d93e2374df87f34a62641a1601

SHA1
d3724ba4a13b822420cc02a5dcf75644820c31ce

SHA256
e4b291507272ef6a9465eab9d31526c2fbf0e8121b599ab0fe430b27f69cd955

SHA512
bac88e170953e3fc08ab3ffa95e6d2519288f1b49bf8cb5787b701bfdebc2065a5ce0c8599b2effc7b3fa547203a141e05750a3d4a57f3290731efac298118a2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\fb28a748-5b6f-48af-981d-351995612fdb.tmp

Filesize
1B

MD5
5058f1af8388633f609cadb75a75dc9d

SHA1
3a52ce780950d4d969792a2559cd519d7ee8c727

SHA256
cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

SHA512
0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db

Filesize
72KB

MD5
be115032158a1b1a612ff01e7c9ce5cb

SHA1
827192ce09465ff48b8546f8d0097e2413be4e02

SHA256
20a6b51016b0c1fd32c731b69523e7e67462c97f5e4ae753900c55680a68acd2

SHA512
eac13c342f1fa3ff3d7b3450ac06003f59093bd92e37de2f956fe4138e151a1da7882089b414f8ac00acfc935128527871da771f7abbb0b13b001f06cfa9fc48

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Filesize
337B

MD5
e5b91e22e5a713164483c49f81f7dbcd

SHA1
c6010a6523d737470b589ae611c1f8eca4c5b9c7

SHA256
5f58cfd4f7d6df59ae8615181793bd21d96f5b8548b93777962ca29e1c6f0396

SHA512
6e0f36b5d89873eb96ece6637cbcb5cb5b55102c5559e929952653d5f8e4cab6f5ab1296d42475bd434199cae8bd6dfce151a3ad6f360ded215528ef6e2794c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version

Filesize
11B

MD5
838a7b32aefb618130392bc7d006aa2e

SHA1
5159e0f18c9e68f0e75e2239875aa994847b8290

SHA256
ac3dd2221d90b09b795f1f72e72e4860342a4508fe336c4b822476eb25a55eaa

SHA512
9e350f0565cc726f66146838f9cebaaa38dd01892ffab9a45fe4f72e5be5459c0442e99107293a7c6f2412c71f668242c5e5a502124bc57cbf3b6ad8940cb3e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
fad2fb85d61c25b16bd472708049bfb7

SHA1
811c93f135e590b9ef6292213523bca97e45599c

SHA256
269d8b8bf6d01fe8bde528966aa03e8073290dc68b0ad758e516a1b0074713c6

SHA512
889fd11369f38e30b2dc0a3fe42420ec2e6ce3a997c3e90c48e2a4b4b60e39a501571911667d22075f39ea980cb131a72b096081a518205c0ad97f4fe1a06aed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
20a772f8409c4ed40868a8c4e5a32b63

SHA1
60780d7c7d6f6a4ea8752e2e44c3111767db979e

SHA256
552d28d918cf368d85382b003eed44f83ddf20adb52fb58bfc1bc0d97db364de

SHA512
4488036cd3f9b769889bc4a74c9712aeb056e369a7337d51e4c7694b8b4fd9bbd8b963628907daba9dc7c4357e7fc38434397e1569d594dfb93e8f5fe5bca35e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
9bf7da0c628f20129961e2f1a7f46a62

SHA1
95df6345bf556dda4e5cb61038bf466d7dab3fb7

SHA256
ffc0c451965bd3c64b0eb1e5f92453a560a2b75ad5095e56941a6f5f3a88186c

SHA512
db17c379662b23f015cbd2d8199e54f412bb57ce369040eb8a3436e31d673ac521794e83f752e5eafcd150e961bbb9ca5935915871a06242ffd604e06d34f783

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1

Filesize
264KB

MD5
66978870f82e0ed49c61d622d76e7c37

SHA1
d3c0394364472adb873ea3c9ff31b311d70f8c71

SHA256
570431203d328e9fb70a7efda88d022adb47d8daf3e9ba667a97d070bfdb1f28

SHA512
4364a3674cbe7e820b7a34edb2eec2bca8ab1dbd0515dd1cb4d4437616001b6482d368120da7e2cc8804f866f83bc0af33eb9028e7b738daac2395d95aab423c

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{d81a575e-0a23-4f4c-ae13-c214fd376b3e}\0.0.filtertrie.intermediate.txt

Filesize
28KB

MD5
ab6db363a3fc9e4af2864079fd88032d

SHA1
aa52099313fd6290cd6e57d37551d63cd96dbe45

SHA256
373bb433c2908af2e3de58ede2087642814564560d007e61748cdb48d4e9da3f

SHA512
d3d13d17df96705d0de119ad0f8380bfe6b7bc44c618e2fcd0233061a0ab15beae44d38c48a880121b35f90f56c1529e5f4cf1a19acb9e2cbba5d1c402c749c0

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{d81a575e-0a23-4f4c-ae13-c214fd376b3e}\0.1.filtertrie.intermediate.txt

Filesize
5B

MD5
34bd1dfb9f72cf4f86e6df6da0a9e49a

SHA1
5f96d66f33c81c0b10df2128d3860e3cb7e89563

SHA256
8e1e6a3d56796a245d0c7b0849548932fee803bbdb03f6e289495830e017f14c

SHA512
e3787de7c4bc70ca62234d9a4cdc6bd665bffa66debe3851ee3e8e49e7498b9f1cbc01294bf5e9f75de13fb78d05879e82fa4b89ee45623fe5bf7ac7e48eda96

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{d81a575e-0a23-4f4c-ae13-c214fd376b3e}\0.2.filtertrie.intermediate.txt

Filesize
5B

MD5
c204e9faaf8565ad333828beff2d786e

SHA1
7d23864f5e2a12c1a5f93b555d2d3e7c8f78eec1

SHA256
d65b6a3bf11a27a1ced1f7e98082246e40cf01289fd47fe4a5ed46c221f2f73f

SHA512
e72f4f79a4ae2e5e40a41b322bc0408a6dec282f90e01e0a8aaedf9fb9d6f04a60f45a844595727539c1643328e9c1b989b90785271cc30a6550bbda6b1909f8

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{d81a575e-0a23-4f4c-ae13-c214fd376b3e}\Apps.ft

Filesize
38KB

MD5
84ac0c242b77b8fc326db0a5926b089e

SHA1
cc6b367ae8eb38561de01813b7d542067fb2318f

SHA256
b1557167a6df424f8b28aabd31d1b7e8a469dd50d2ae4cbbd43afd8f9c62cf92

SHA512
8f63084bd5a270b7b05e80454d26127b69bcb98ec93d9fad58d77203934f46b677a3aaf20f29e73dcd7035deb61f4c0aa3b10acbc4c0fc210632c1d74f705d2f

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{d81a575e-0a23-4f4c-ae13-c214fd376b3e}\Apps.index

Filesize
1.0MB

MD5
bf528a4141f45599f6b9579a231a7352

SHA1
2ad1452a5277891599a0f10a4a74e0d10beab6f5

SHA256
8c09b89597c808c41006bef545e24bf54451839d482aa077296da69080ade439

SHA512
be060acd176cb867248ce6521ef39f4f06e458b582140bde062cfa77ef7751d9db49222baa802470283d68e07815fe18788b82476880606fbd3b04bac31149cc

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133764265282340521.txt

Filesize
77KB

MD5
17a6e7c7bc90915a84872440a1479ad2

SHA1
33ec9010d6c5df210f1d75da34ba83c7ec8ad8d3

SHA256
d3c8f42a23a6254bad65f0516fd71e86fbf57cb0406c18b5255bd95f570329af

SHA512
12223b61e199bbbf3c914d73c08fcadd3dcb349afbb3fff3c887195475093b103e9bd3f41c1294b0296431ee6c1cec7cfc09ed1dc72d0f3d97c9a85df694e5f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp_30b27822.bat

Filesize
290B

MD5
45dfded3fb766146823ead2b654c4898

SHA1
f88b3e6f915df97844c8adb4e1a27003892aee0b

SHA256
d23acd871cdc65bd577a208eca25403c74b9c0ac0288028f86482cf0d558b1c1

SHA512
c0c172409e5b1170743e2268ec556e656631cbe6da0033599fe2d3a71428e9984ddb75b63959800ee8af7af59ceb086688f56a93d6ebcb37f25c571c3e02a14a

Download Submit
C:\Users\Admin\AppData\Roaming\Ysaq\hiar.exe

Filesize
67KB

MD5
c728fa6ce642e9b90be93e5124b9c2a2

SHA1
9da525a1ca56fbe973b71ce0becf5f56263c3759

SHA256
2d705716d7485c50915a1bf442987b1f76e58942f05008264707fc7508cf37b3

SHA512
512460efb8da1315e367faf671911cdac6043bc476f27282dc805a1b95e7c16c5da62d6ad7164d1d4d6de1b4084b31395108fcb097f4a8e0f92a36cd5434ad6c

Download Submit
C:\Users\Admin\DOWNLO~1\THE-MA~1\THE-MA~1\BANKIN~1\DanaBot.dll

Filesize
2.4MB

MD5
7e76f7a5c55a5bc5f5e2d7a9e886782b

SHA1
fc500153dba682e53776bef53123086f00c0e041

SHA256
abd75572f897cdda88cec22922d15b509ee8c840fa5894b0aecbef6de23908a3

SHA512
0318e0040f4dbf954f27fb10a69bce2248e785a31d855615a1eaf303a772ad51d47906a113605d7bfd3c2b2265bf83c61538f78b071f85ee3c4948f5cde3fb24

Download Submit
C:\Users\Admin\Desktop\$uckyLocker.exe.RedEye - Shortcut.lnk

Filesize
1KB

MD5
e5f3e7d8a42780ec2d0438e1a63923be

SHA1
a56d518c7e814b770df07311b638f84e9323ceaf

SHA256
6919a04d857e2b4efd25d6c17d3410158a32c2a5e742595c17d8f435ac00bf90

SHA512
0c3529c5d5510b0c0a1a3bd4f22b2e5585151664df1dd45c4d44b3f8910807672aa9197b9f0c2026ec4cf99148882b6f7637a2286fa9bf65adca865ee25439eb

Download Submit
C:\Users\Admin\Desktop\7ev3n.exe.RedEye - Shortcut.lnk

Filesize
1KB

MD5
360acf235b32d8bc2901f8a4a5b4cb5b

SHA1
389d3c129fdaf3417c30073e304551d5d81f06db

SHA256
6404f59c74fb1286df97533d9b10475bb23d29463c81d4204c287182b7efcf49

SHA512
911a65744b3196aa828f3a31f5b9c331719407247bb7cbb5ffd639ead691e7413419bad8c078730c23605e45cfaf73e9571ca91e0c96f29547ce8f88c663076c

Download Submit
C:\Users\Admin\Desktop\Annabelle.exe.RedEye - Shortcut.lnk

Filesize
1KB

MD5
f28e2f6d8397b248f1fee8fdeba3f459

SHA1
1c4106449a2ac58672582c8269d6f8b1ee0368e1

SHA256
91daedf060b2980807e307ae7a2029ef104d68103b486e88b60e65e67d1a9bda

SHA512
82c8858577523fb31ea1b99907e117b71c47f08ad632b8ef7558b2230382d485e9dd0d6ca6aad1267ad8d72d3b6f03277302d378e0baf78bd2325e0b424b48c6

Download Submit
C:\Users\Admin\Desktop\CryptoLocker.exe.RedEye - Shortcut.lnk

Filesize
1KB

MD5
914a665572042ae742ad5ddbdd2e965d

SHA1
cfd44e18d0e065b037a9a8d976e2c7295bb6535f

SHA256
202705e7a373d9dc23a66a601cb0b6b4829f35dc4e6920f9a237067935a2b54d

SHA512
0c40e9a701f9491d3139e128aeeedd872b9f93b0999570ceedece830ad06dee5201a8666008d64f17f993baaaf6ae2f69a57a727c9cef25d13bca92e6a5ae044

Download Submit
C:\Users\Admin\Desktop\CryptoWall.exe.RedEye - Shortcut.lnk

Filesize
1KB

MD5
7734eb044a628f31b95eba46706e08cd

SHA1
0d6f71e66277ac56874aa697efe6b359d0a22777

SHA256
0988ae8e66bb5528008fd9d01a798e3cd3d0732d0806ea38f660d02a4ec74707

SHA512
4831bb47e7812164c0e2654f72c339b81f0174a649a50427d73fd160e6183a2c989b0659f30dc795b2b7ddc032f6cf54a49b9a4b6d7904c0415b68b0076d3af2

Download Submit
C:\Users\Admin\Desktop\DeriaLock.exe.RedEye - Shortcut.lnk

Filesize
1KB

MD5
c2183c86fc523a7520bc0f50f5fed62b

SHA1
7f479237e95c1dc175fa074c1f549dcc4b89889b

SHA256
0cc5ed5ecc1ed826aab6defecf8430b9ec524cb49c982fe6c3e87caf75ad30e3

SHA512
2df3d8763e1705acc371c0ffffdd4cbfd783cf5bdb63e4048f26169775b5bae6198d0ac2bcf589f0a8cce1c5f794a02ef8f6e3bf9a0fa08f547b3ed2f153ce23

Download Submit
C:\Users\Admin\Desktop\Dharma.exe.RedEye - Shortcut.lnk

Filesize
1KB

MD5
d8c6f6bd8f397e3731c3d7b73e84c4cf

SHA1
b730b20cd267df4120539ee70530659e38962350

SHA256
47b26a2fd794e15260b3e6905d647196a10716f7420ef9e380760047b3550f94

SHA512
f64cdf3e339997cbc44a4e54cd1d2902c1fdd64b43db7e2a6e8331ab0cc083209c4f5db7886397dd8853fa0f2069185872198ae83195d7a51de68019421dea60

Download Submit
C:\Users\Admin\Desktop\Fantom.exe.RedEye - Shortcut.lnk

Filesize
1KB

MD5
0e1ae7547432e093782f0f3d23c04c68

SHA1
081759ac1a585d02a1eb62de8637a3d8cb394340

SHA256
238504658d9a428628478211eae2c0116fcd02056d43c98834c05cf25337afae

SHA512
2bbdb0a0d3d90e7d62175e89d3a58de7726aa19dc7815fdc3df9093c0b488eb50e3342cecffc15bdeb9d34f3dac88a3a8adbbdbb81a86beb015820234de4ab2f

Download Submit
C:\Users\Admin\Desktop\GandCrab.exe.RedEye - Shortcut.lnk

Filesize
1KB

MD5
8171f0656b485e17b9211ad662cb8f8a

SHA1
938a98bd3ac62e63b96adc6db74c839adc62eff5

SHA256
23f80c5b9464a7c8a59fdfea1c09c393a45d143730bc4dee986b4267596739d3

SHA512
af54d52f878e86035b36a84544581695be5ffb54e512c235ac36817a78e7c1506d02da3e6856791b522b7869544613e9e5f3f9e76e31afa4a7cecf8083bea3ad

Download Submit
C:\Users\Admin\Desktop\InfinityCrypt.exe.RedEye - Shortcut.lnk

Filesize
1KB

MD5
5d00dc2702cc4317059d3d56725b6128

SHA1
9ac72b42c8bee5ed9fc702dae768a1d860f5cd3d

SHA256
069dae8d28f77d3297883b5908e45b27a5049a09b24f675967b4fa617756d23c

SHA512
44a7394421d91c81b7100687e9327e5d1b17e999e317507425cd1aad396f9ff3ccbd7d3d175c88ff8833463954b5f83c3a45083325e5669f544256fe6d938855

Download Submit
C:\Users\Admin\Desktop\Krotten.exe.RedEye - Shortcut.lnk

Filesize
1KB

MD5
bd6dc5619ecb70d6a6364e377976545a

SHA1
685cbef7f957f552655ff610dec66f7679ac6eae

SHA256
7b7c8831400f2ab5ddc0bb28c97e1a5b93ab43d929cbd826273d8a2fa9006f10

SHA512
ff69646ab8fd5746cae54d8ffc616d93377f26d5547ad376e015bdb798e3452da379b268f93990b46de1424189a55641e59c8f910fdc0f4d6a6dea6ba161cfeb

Download Submit
C:\Users\Admin\Desktop\Locky.AZ.exe.RedEye - Shortcut.lnk

Filesize
1KB

MD5
061f67459c577ac8084a2bf9fff7746f

SHA1
a0f2f0476b497d9abecd2ff31fbbe447cc23db5a

SHA256
8a5c224b18e2209651a0bdfb4fafe8f73f83ade14a4e2c43e557fcbd989e2434

SHA512
fe1421d6d1f81bfd5ba1250647803c7491e9f0e38d99b1adf20093836a14035e6f4b216a90afd31252ac6cb5854e39fcc81686a00140f657f357ce8ae8050f95

Download Submit
C:\Users\Admin\Desktop\NotPetya.exe.RedEye - Shortcut.lnk

Filesize
1KB

MD5
ffcec071963a8b4b4a4a405fc2a16ce3

SHA1
46f00c5bf09c4465eb3570d39afb84f8a98a89c9

SHA256
43a93350146a8a5435fb6f49162ea3e6d6ca3deb1a3041289c23087f0c3e65b3

SHA512
ca82ee4960648beea16cbbbe65b3079b6d9a715d8240401a80756676c37eb2f3a3cfcbcff928a52f3e0e36dbd91b05af69b99e0d173553fc1e27301ad68c7d21

Download Submit
C:\Users\Admin\Desktop\PetrWrap.RedEye - Shortcut.lnk

Filesize
1KB

MD5
aef663b5d814c31e0886504d6b87584f

SHA1
f9d734c9381792e4b108e20b796be1f1524ed499

SHA256
11556bfd204c40611ea5da919a68f9fc65a28d08595776c4908d50c5c51af4eb

SHA512
fcc62dd281acd597d2d5a8c277e0710859c4344db23737e689dbf222b490681998db2ed0895d40d3c52b8702c490d41690780c51e38270cc620338f8e2da1cbb

Download Submit
C:\Users\Admin\Desktop\Petya.A.exe.RedEye - Shortcut.lnk

Filesize
1KB

MD5
4aa636ea5e62c07bfb1f397b2be5fb17

SHA1
06985afde79ccedbf33e4fce4abf7cba05e45e5d

SHA256
17bbe1e6ddf66bab952190566c6a96c6a573c93ef74b865eb25d47e4b24e9f68

SHA512
fbb788e6c679b52bf51e90af6baa157aeef7c6a9077b7bea674d4f71d469f0957643ef60347e8dca769d313c1e9f4b26dc941f217e2651cedd41e38578598569

Download Submit
C:\Users\Admin\Desktop\PolyRansom.exe.RedEye - Shortcut.lnk

Filesize
1KB

MD5
17085a7ebbc54d56a51999705c14ca78

SHA1
3cef375cce2f57e8b856f69ed617867c2183568a

SHA256
e72c81828093a9d39d412d93d566bfde11e944c0618bb9151447b3197b9a1089

SHA512
84c1d8f519735a2bd443403cfc4565d45d1874ef5fdfcf8ef4658c60dcc559367d5199f6fbe65f19880ed2d59b490b8c0b811008c0816f592dc97c4186a8cefd

Download Submit
C:\Users\Admin\Desktop\PowerPoint.exe.RedEye - Shortcut.lnk

Filesize
1KB

MD5
597567e589f3571360811527269017fc

SHA1
deaef072242a3577ae94b32559b2b3d53aa8d4e1

SHA256
0dd132b6694fee797f8d2431c101a8cab0f36679f23d255ddcd8b4234219b9b5

SHA512
ddcfbf4d39a6582f3eae981618af078aeb25836be81a06d27be0d42c0117ab0268a18bbc60103d66a97f10961f619c655d54dd58a3fdeee1e62f7305d89108ce

Download Submit
C:\Users\Admin\Desktop\RedBoot.exe.RedEye - Shortcut.lnk

Filesize
1KB

MD5
641b285f45f424dcf7bc40b078bc0e5d

SHA1
88e147b28e1f39975555f73ad02bd2c150c252cf

SHA256
ae68ed6d75ea16e5d874af8f86192663c2ed221a2ffbf2a666c992f48e2eb4fa

SHA512
841b5c7015b7d4f5180542382b0d60266e8747c354897277a05a1ad1fa3672c12bfb659e4b84b57c1643a1eab093663890fd2d295d8803181277e5651086a226

Download Submit
C:\Users\Admin\Desktop\RedEye.exe - Shortcut.lnk

Filesize
1KB

MD5
5e993c6341953e1a23915ce3fae7c6de

SHA1
90b5f26ef73d28b5b4bbd2600bba3540057e4a3a

SHA256
36d2230e9fb137e3e78d12b737a3b75d00b4124c02840076ece3f1851f8166c3

SHA512
051e6fafa8646140ab6b3acfbacb8cdc985cbc05ac54b423750d883f6c5f0d09c259b1fea12ee2a0815fc490eec279bcd585aed5765fe21d319656eea88d6e8c

Download Submit
C:\Users\Admin\Desktop\RedEye.exe - Shortcut.lnk

Filesize
1KB

MD5
f2605317649897828dafd4cc3b42c8f9

SHA1
8dbf57b1c80b657c97d9f417ed8639f3dfba16a4

SHA256
a3340a430d190676060a038f735ccd27b1d9af40168e3c0ccd2bcc8a07598447

SHA512
7a9107bada466335cf0f978e374064ed3fd1062db49effaa940945ac3da61fc772df00f2f837b46aec21bceed0dd90611ff42ce140b2bbcbaf799bad04dc3995

Download Submit
C:\Users\Admin\Desktop\RedEye.exe.RedEye - Shortcut.lnk

Filesize
1KB

MD5
fa2a28215b1204d23d6f0a72554368c0

SHA1
a6c67dcaa81a43c43bba19da971a6e1369482c43

SHA256
1bc8d5d7205a53b554b6ad22087cffbd48dce306d44bf65fde7b8db8beb9bbf1

SHA512
e8f7c09356311d1d92e6d26b793d5faedd00f3769a5e19578a82352234da1f0b12015a63b333e539ffb7e06620550d636db375eed11d577368602aa329dd71ea

Download Submit
C:\Users\Admin\Desktop\Rensenware.exe.RedEye - Shortcut.lnk

Filesize
1KB

MD5
8e0668db9d951830bf622e8f0fed7f79

SHA1
12ba8a2b18c1b2f7da5d5ea7a03f93b694bc8bd0

SHA256
43d123db268ec1f3a2adc9627a58143d8f25180a138e767eadb9944e3a1fba8e

SHA512
008064a7178da6a9268b18a4f4cead0b1afe04387f94faffd65404c7afe55fdb94013bf1f0c9c131b62971aca5b47bf1096c49c7f6814993dee6c6e393e9386c

Download Submit
C:\Users\Admin\Desktop\Rokku.exe.RedEye - Shortcut.lnk

Filesize
1KB

MD5
74e575ec7451c634a1d14a9dd4674c51

SHA1
1d3272d2ed97fbbb73434511a41815deab56a583

SHA256
6f06a1f684ce5c90150e54101480dc043e5e0bb7b38d94ba6b8a68031b9b8454

SHA512
8f8f60d2d9705ff5a18d4780ee0d6e2654bdd8e98e4d9f8aad861b6dc95df89975b79173679035ef9810e5858eb4eb23eb6af97c345dff5f0bee582b4ebd851a

Download Submit
C:\Users\Admin\Desktop\Rokku.exe.RedEye - Shortcut.lnk

Filesize
1KB

MD5
13e5b32e3e7d8e2db21f5fe5343c979f

SHA1
36c5ce6a3e388c79ad0e1baf4911b3a0072717df

SHA256
5a18494e5be96be260dde08159dffc7f0ce026af5a195648e07016644ad4f502

SHA512
27e24e8ca16ade3f2449d09ef3824d1e4a424e6adef659eef4dba971021bb99855ddfe9b91caa4503890475bcfa60780754b20b399b13ee917cb18ddb35ad7e4

Download Submit
C:\Users\Admin\Desktop\Satana.exe.RedEye - Shortcut.lnk

Filesize
1KB

MD5
134621039d3f715b30bbcb232e201706

SHA1
8f62d1c0dd67331b6b16c4eafa2d9e8b9b160482

SHA256
ae9e03eac51fc31369e012af5c1d6ba580b34c008c7577b13a27d5cfc3498234

SHA512
5f64182c2ffa893e79b49796bb334c0dc0d855d4f26d9ed48e32be374f7a1bbc2f01c069b57ae01b8b8081610c21bb5e7e6aaa1a7957b493b26417d694fa80cf

Download Submit
C:\Users\Admin\Desktop\Seftad.exe.RedEye - Shortcut.lnk

Filesize
1KB

MD5
a1843cc99d316af5d5238f9ccc406047

SHA1
d027497872eee4ecf9becf53ec800a2233c2c5be

SHA256
86b47604625e1ddd69b969b38a8eb4eb0caccc776e00b244900accc3154ef583

SHA512
1e89d3c4f5e48d79a2e9a62e08e8b7be55b230173e39d2687ad0d02d6db69163d4c0db9995881c7c4a3dfed7b72091c64e9b5fb5333a2fba11334165633be3d8

Download Submit
C:\Users\Admin\Desktop\SporaRansomware.exe.RedEye - Shortcut.lnk

Filesize
1KB

MD5
1d500b25ff8d4fbf5886fc8a6693e454

SHA1
b45da958640efadfd8b383957f49db29a1ed83fd

SHA256
1d1df7b43e53346b7c12a9c94b997f1de01786e2a19cc70bd8a85cca55bde82e

SHA512
3d83acb3b05a522b5b188b031986f2fa4bd8418e2f2c44e52f35cc32af0689d490c7f0917fd350de7e48c4b47e006af71b7404e7216e09e0a5a8371be4f1e3c1

Download Submit
C:\Users\Admin\Desktop\UIWIX.exe.RedEye - Shortcut.lnk

Filesize
1KB

MD5
e6c8c17b8c876ec9a5e16ea7ea4a0925

SHA1
422aafa8fc42db01c4aa714743761878a02509e7

SHA256
9d192e9ca308dfcd2e5a1af8be66d9d4af53638907413fde59b4ea0daa32a37b

SHA512
c610563db32ab8e1d0349aac2d52a11cf3240f10160e8de268220b153be0517cc61a18b623cecf29cd910ea4ae7c54226d4c48e4da170b2d75918c8d718e7737

Download Submit
C:\Users\Admin\Desktop\ViraLock.exe.RedEye - Shortcut.lnk

Filesize
1KB

MD5
af7ec6948dcee683a6d2b76e3c1173b8

SHA1
324a6c2a04c557a997603de689ba69931fd37d4d

SHA256
220422cda2e91a459e055650dd7fbd39c46a718be7f88371c4908f77e47c91e5

SHA512
f29e199236e6f9e2a6aca994b9b97da007ad9587c602ad62ae8ad23fe44eded1ee9d26a55977bf7d45ecdcb04ce20892ae51d43a8160c5fde14a23156e7eb276

Download Submit
C:\Users\Admin\Desktop\WannaCry.exe.RedEye - Shortcut.lnk

Filesize
1KB

MD5
ab651aee5a53b55e6f14834bfb4acf9a

SHA1
12f577e0fc0a6d7f240d18bafc6c0baaece3f338

SHA256
9b4937ab8ffcfd92de145454cca532d2329fec9542c2ba2efc953d8a4d2cee73

SHA512
79c283dd50d9fad3f4870f0d2ca7ef5058ad4267db223efa0bb1b3adadeb0d279878d6aff32c027418a45c8e212298f5f9c0daf18f1d1065c259a8b9c1f0d3a4

Download Submit
C:\Users\Admin\Desktop\WannaCrypt0r.exe.RedEye - Shortcut.lnk

Filesize
1KB

MD5
123a22522bb30541c1ee5778933f0e06

SHA1
c45341f9abbc1e905c8214cfece476aae1f5f82f

SHA256
17db9a7a4b0cf7c42f50b5cfb86695ac1707dc9c597f70397f24fcaea7284eec

SHA512
94d07a183485acd598fae14be7532bec6663731a566b6c65fb93a94d0393a8915a6608cf182e3b21275b5aef96a4b3be11c1be02a3b1c722eb1d126e706e10bf

Download Submit
C:\Users\Admin\Desktop\WinlockerVB6Blacksod.exe.RedEye - Shortcut.lnk

Filesize
1KB

MD5
acb3480c835c29888b8e58fe4dc5e8c5

SHA1
521868c70d5fa09baf1bc0eea21c5063957942e9

SHA256
a7e47f0aef0a050961e2d8e4203ffe2662e8c064bc50c49a7f4693d2e767e8a1

SHA512
64fc083ea870d9e6051febd5b8d6bee7e123758f0911c09a47017110d6294156bf9c54ce272886363fd07f2ad09513a5b95948b0d82a3bb9369a852bc29c1f7c

Download Submit
C:\Users\Admin\Desktop\Xyeta.exe.RedEye - Shortcut.lnk

Filesize
1KB

MD5
0319c3a810ca14ae9d6f9794ccb648da

SHA1
9597d37bcb69fe33176bbd452fc5b5b34127efdd

SHA256
6c5ac6f2fb621b987187705153069e63a228adc6e07a4a5d52d28ffe216ab6d7

SHA512
be41d77a55c122ce638dd28308da107cd1d60462ef33f4d73dcdf6f7b5bf528496c6a7fc977c2dd89624cbe357a0e6eb9e112047386fd102416fd5d287578a67

Download Submit
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\BadRabbit.exe.RedEye - Shortcut.lnk

Filesize
1KB

MD5
778833386991218fdb307072f5d2b207

SHA1
c2cb58a1b5046a6ba1c51a8dda3882e66c510d52

SHA256
8c9063be00b9b64cdf0457843220324699b4898e917508988c56935c59994e89

SHA512
4d8ddacb30f08103ba962913a224e456ef172f2010f91b0937c62c38086fa53813bc49972cc6d7f91573f2f287aad73d27b9a885ad1ca6faedfdcf92cc78a46b

Download Submit
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\Birele.exe.RedEye - Shortcut.lnk

Filesize
1KB

MD5
31aa79bd7937191aed4d9c131cf56e72

SHA1
6a29bf7edfded40b83e41bf9ac041455abc8e41f

SHA256
1b317badafcad97fd31e05fd5d0edaf6ec9687f8768118aede8db3b8eb8477c2

SHA512
e43dbb856af59a6356c0df7358ed057efa1959ff182ae4cbd5a5cf086f549c3dd6ffb646804eb0aa574ea97f7c717fd6166d2962894c2905b2dc9038d7a3ffc5

Download Submit
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\Cerber5.exe.RedEye - Shortcut.lnk

Filesize
1KB

MD5
725acee69623e3d61f1699146ceb36e5

SHA1
28c9084534cff5ef370f83c6c632761f62e6932b

SHA256
cad0e26975dd33828b8d8a3a9e442941bb4f1befb671a6c4d83480777389b9a5

SHA512
3b65083bf279832d5d04d981328a6cdcb316036bd903f04d7a21f25dd35831320b53596ab76640a222c413927467cc51d226679b49c3dbac4f90d2ca3039eaa9

Download Submit
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\CoronaVirus.exe.RedEye - Shortcut.lnk

Filesize
1KB

MD5
57b76d2dc834eadaa0de3fa5801dd936

SHA1
2bb6e8fa4c1652e97d453239ae8859fdeb8c11fa

SHA256
673b26bd021398f0faad582512e61575a530b8cc92328cf42a298d7278322c9f

SHA512
e3d5b6130309438e32f838aa02e7a2e3e0de32dd0af74601f67eada7620371128e8bc500df58de8d8aacb5109c7ce51757834315072848961260a403e0282ca1

Download Submit
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\NoMoreRansom.exe.RedEye - Shortcut.lnk

Filesize
1KB

MD5
f2e42973307194335f0ddad705f51fbf

SHA1
1b89ecbbe7e99a01e20c702e18159dbc89c5f34b

SHA256
b59c6ebfe72878db7ad004f68854e5c5324bd83c4199dfbc86ee4c9e28303f4b

SHA512
48f28e02b60330f497269b63f7e2e1de0c6ca408d4d097f895b4bffd534b852107c3f76274f275874a82859bd46871ee0882394f04fadadd80dbe97ed167c74e

Download Submit
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\Seftad.exe - Shortcut.lnk

Filesize
1KB

MD5
85de07940067b745e31de300d2a471d8

SHA1
09222ee91e4891ef934c149abacb7d2f43b50899

SHA256
67371b679ca8c1662375103ba3791e85b42cca54a912efa9a66396d5b106c239

SHA512
08dcb757ac33213651c7081acbc6da2f69b63354ec85d0a7cd5ee43b0a21f02051c39f8a801943d74010237e00662ec3bb5846a98a56cdbab72fd231d49ba331

Download Submit
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\SporaRansomware.exe - Shortcut.lnk

Filesize
1KB

MD5
ecd501cfda879fe3990abdb4f8eb1bbb

SHA1
29934e84743059d38cbe1ccbe796e94f2fbd9e03

SHA256
1af354b66c01cca35e1755a5ee4d903bd4312326414d74a13ed9ddad195310cb

SHA512
4c59ed45e28fd78bd2e3db1dbe41b93a418f40ecf6517f0d91a1c8202e2bce907503ec5f26c29dc9596c8b75df5d5047e3f87e54d044ef351c4a06ffb8f27af3

Download Submit
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\UIWIX.exe - Shortcut.lnk

Filesize
1KB

MD5
440fadbfd8a49ab38261d5349afd3ae9

SHA1
4defc6be795a22aac066fc759c2a727486be3a6e

SHA256
679d4c43f6fead1bd3a9ac970d740a2b8a824e21b55a6853973c4d1237649911

SHA512
dbcab796d8831312e8dcf0a923f926a1da283efeecdc183cd513ad414a369063553ff6df5391e6dccf971527149bb7420940ff6f0df0ea3151c82a96170217c5

Download Submit
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\ViraLock.exe - Shortcut.lnk

Filesize
1KB

MD5
498e1248974b010e38fc0ca343c5f6f6

SHA1
e11e1933a741ace84fe303fffea56ba2eae4d867

SHA256
ed580ff40ced6aedf720baf4d1fc06618ca1a9cbdd35da85db609ac00556ec41

SHA512
48971bae92b0f3b6b8c8ba8912b9cd3789e57dedd6143620f67c84d85e5204b75b25518f76f6173f264e32098a349f0ddb964e609fc8a49bc932f0d2eec5d65e

Download Submit
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\WannaCry.exe - Shortcut (2).lnk

Filesize
1KB

MD5
cf6d14ce6e9d1dc1039928d34f4c539a

SHA1
bd77e79f1f5b0c0f9e5f815bc6e41933ce1c6d99

SHA256
30907f9a2f3e63d12434490bae9487df6b22f3325fca59e109ae734f1f6f86d6

SHA512
cdedcc504d5b787f7db81884441e89a0a5632294bea28e605ba8912ad5c31e39a2505fc9bf7f5254da3270b6f2e909602543797c7a32e5a3cf0d532fb33abbdc

Download Submit
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\WannaCrypt0r.exe - Shortcut.lnk

Filesize
1KB

MD5
36d3e2115cf283213363a984aa634a1a

SHA1
517e1db15d5f00f53ad55ae8ee22e540100bc55f

SHA256
62d9336e1b196e8b14af90ce54b01f726d3062b098231d62d8e2c80fea23d44b

SHA512
5393b4d18ddf26dd3cc69d8374695da596f5bfa82290eeb90f6d6cbc0f384417fc355b766397d13ac6e176cb0e0d4ad71d6824992508db32ac2b56cb906b882f

Download Submit
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\WinlockerVB6Blacksod.exe - Shortcut.lnk

Filesize
1KB

MD5
5603d6e0bc635aed99ca4a9c5471e4f6

SHA1
0ade70e350af723ea4bd9b7ab4e816fa0264227b

SHA256
967d9c9e021750a2ac7b12dd7cd8a2b3b0fc93db46e8800498630ace231303a1

SHA512
0f409157b0f19615e26d51c3dc65f448fd8940d6f7ad998218dbee72f1d8424775fc794bc1fa4672cefcfe48ac620382c63f64c46a67738639d15ccea4415199

Download Submit
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\Xyeta.exe - Shortcut (2).lnk

Filesize
1KB

MD5
7b3d75ff2d32fdf98ed4bae3470b4d24

SHA1
e995beb322714cf5fdffbfdb00e44d71e94b9e94

SHA256
e8b6d1893df2bfe64744945b3c6073fd191dbc0589cb4ce94d04571e7154ba17

SHA512
ffdb041158ad88faab98e559e30e1abe72d3025be2867cda6dcc9e79b9bf11c3b3bff9a1a6423329dc62b228c3174af1960fd7a8bfb1252b26973f445f873c10

Download Submit
C:\redeyebmp.bmp

Filesize
5.9MB

MD5
965bd010fc75b00a030778a393166f44

SHA1
2aaad5c668320896b6be56599371ac1b873bf436

SHA256
5c9892e38a598c9a69300dd500b60257726dafd0b85ca2f93e4fef06cf2d7516

SHA512
be9c79639b06e0c4b6d1c82570419a4b2bfb066051a8aeca3d4762fd47a95b0f756e443b7e62ee5893f196b5857a560b72a0005f21580906921c4120f46b00f9

Download Submit
\??\pipe\crashpad_2892_HAYOHESIQSOOCJKV

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/1204-821-0x000001A8DB2D0000-0x000001A8DB2E7000-memory.dmp

Filesize
92KB

Download
memory/1204-797-0x000001A8DB2D0000-0x000001A8DB2E7000-memory.dmp

Filesize
92KB

Download
memory/1300-768-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1300-775-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1300-769-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1372-936-0x0000028F7CFA0000-0x0000028F7DFB6000-memory.dmp

Filesize
16.1MB

Download
memory/1372-957-0x0000028F62D20000-0x0000028F62D26000-memory.dmp

Filesize
24KB

Download
memory/1372-859-0x0000028F61E90000-0x0000028F6292C000-memory.dmp

Filesize
10.6MB

Download
memory/1460-794-0x00000130A8580000-0x00000130A8597000-memory.dmp

Filesize
92KB

Download
memory/1460-818-0x00000130A8580000-0x00000130A8597000-memory.dmp

Filesize
92KB

Download
memory/1828-760-0x0000000000400000-0x0000000000AAD000-memory.dmp

Filesize
6.7MB

Download
memory/2528-804-0x000001FE12EF0000-0x000001FE12F07000-memory.dmp

Filesize
92KB

Download
memory/2528-783-0x000001FE12EF0000-0x000001FE12F07000-memory.dmp

Filesize
92KB

Download
memory/2684-820-0x0000022F6DB70000-0x0000022F6DB87000-memory.dmp

Filesize
92KB

Download
memory/2684-796-0x0000022F6DB70000-0x0000022F6DB87000-memory.dmp

Filesize
92KB

Download
memory/3040-803-0x0000022802AF0000-0x0000022802B07000-memory.dmp

Filesize
92KB

Download
memory/3040-782-0x0000022802AF0000-0x0000022802B07000-memory.dmp

Filesize
92KB

Download
memory/3124-805-0x0000022E552E0000-0x0000022E552F7000-memory.dmp

Filesize
92KB

Download
memory/3124-784-0x0000022E552E0000-0x0000022E552F7000-memory.dmp

Filesize
92KB

Download
memory/3288-780-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/3288-777-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/3360-779-0x00000000005C0000-0x000000000067E000-memory.dmp

Filesize
760KB

Download
memory/3360-816-0x0000000001100000-0x000000000119D000-memory.dmp

Filesize
628KB

Download
memory/3360-810-0x0000000000D80000-0x0000000000E1E000-memory.dmp

Filesize
632KB

Download
memory/3360-809-0x0000000000480000-0x00000000004AB000-memory.dmp

Filesize
172KB

Download
memory/3360-828-0x0000000002D40000-0x0000000002D67000-memory.dmp

Filesize
156KB

Download
memory/3360-827-0x0000000002CF0000-0x0000000002D24000-memory.dmp

Filesize
208KB

Download
memory/3360-826-0x0000000002C10000-0x0000000002C28000-memory.dmp

Filesize
96KB

Download
memory/3360-825-0x0000000002BD0000-0x0000000002C01000-memory.dmp

Filesize
196KB

Download
memory/3360-808-0x0000000000450000-0x0000000000472000-memory.dmp

Filesize
136KB

Download
memory/3360-824-0x00000000014A0000-0x00000000014D0000-memory.dmp

Filesize
192KB

Download
memory/3360-823-0x00000000011A0000-0x00000000012A0000-memory.dmp

Filesize
1024KB

Download
memory/3360-811-0x0000000000E20000-0x0000000000EBB000-memory.dmp

Filesize
620KB

Download
memory/3360-814-0x0000000000FF0000-0x00000000010FB000-memory.dmp

Filesize
1.0MB

Download
memory/3360-812-0x0000000000EC0000-0x0000000000FEA000-memory.dmp

Filesize
1.2MB

Download
memory/3360-806-0x0000000000BD0000-0x0000000000C7C000-memory.dmp

Filesize
688KB

Download
memory/3360-802-0x0000000000A20000-0x0000000000BC1000-memory.dmp

Filesize
1.6MB

Download
memory/3360-801-0x0000000000170000-0x0000000000200000-memory.dmp

Filesize
576KB

Download
memory/3360-781-0x0000000000680000-0x0000000000949000-memory.dmp

Filesize
2.8MB

Download
memory/3452-799-0x0000000007CD0000-0x0000000007CE7000-memory.dmp

Filesize
92KB

Download
memory/3452-785-0x0000000007CD0000-0x0000000007CE7000-memory.dmp

Filesize
92KB

Download
memory/3452-798-0x0000000007CD0000-0x0000000007CE7000-memory.dmp

Filesize
92KB

Download
memory/3452-791-0x0000000007CD0000-0x0000000007CE7000-memory.dmp

Filesize
92KB

Download
memory/3452-800-0x0000000007CD0000-0x0000000007CE7000-memory.dmp

Filesize
92KB

Download
memory/3452-788-0x0000000007CD0000-0x0000000007CE7000-memory.dmp

Filesize
92KB

Download
memory/3584-807-0x0000017DE0DA0000-0x0000017DE0DB7000-memory.dmp

Filesize
92KB

Download
memory/3584-786-0x0000017DE0DA0000-0x0000017DE0DB7000-memory.dmp

Filesize
92KB

Download
memory/3612-817-0x000001945A960000-0x000001945A977000-memory.dmp

Filesize
92KB

Download
memory/3612-793-0x000001945A960000-0x000001945A977000-memory.dmp

Filesize
92KB

Download
memory/3628-819-0x0000022EF32A0000-0x0000022EF32B7000-memory.dmp

Filesize
92KB

Download
memory/3628-795-0x0000022EF32A0000-0x0000022EF32B7000-memory.dmp

Filesize
92KB

Download
memory/3788-822-0x00000167426C0000-0x00000167426D7000-memory.dmp

Filesize
92KB

Download
memory/3788-787-0x00000167426C0000-0x00000167426D7000-memory.dmp

Filesize
92KB

Download
memory/3872-813-0x000002139D120000-0x000002139D137000-memory.dmp

Filesize
92KB

Download
memory/3872-789-0x000002139D120000-0x000002139D137000-memory.dmp

Filesize
92KB

Download
memory/3936-790-0x000001E0FA7B0000-0x000001E0FA7C7000-memory.dmp

Filesize
92KB

Download
memory/3936-815-0x000001E0FA7B0000-0x000001E0FA7C7000-memory.dmp

Filesize
92KB

Download
memory/4020-792-0x000001D8E5C00000-0x000001D8E5C17000-memory.dmp

Filesize
92KB

Download
memory/5036-763-0x0000000002170000-0x00000000023DB000-memory.dmp

Filesize
2.4MB

Download
memory/5036-761-0x0000000002170000-0x00000000023DB000-memory.dmp

Filesize
2.4MB

Download
memory/5036-759-0x0000000002170000-0x00000000023DB000-memory.dmp

Filesize
2.4MB

Download

Analysis

Sharing

Errors

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads