hxxp://roblox[.]xom

Resubmissions

29/02/2024, 11:03

240229-m5q8hafd861

29/02/2024, 11:00

240229-m335aaeh416

29/02/2024, 10:39

240229-mqdnvsec8110

Analysis

max time kernel
147s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
29/02/2024, 10:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
http://roblox.xom
Sample240229-mqdnvsec81

Score

10^/10

discovery evasion exploit persistence trojan

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, wscript.exe \"C:\\Program Files\\MicrosoftWindowsServicesEtc\\xRunReg.vbs\""	wscript.exe

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wscript.exe

Disables RegEdit via registry modification 1 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4181651180-3163410697-3990547336-1000\Software\Microsoft\Windows\CurrentVersion\Policies\system\disableregistrytools = "1"	wscript.exe

Disables Task Manager via registry modification
evasion

Possible privilege escalation attempt 4 IoCs

exploit

pid	Process
1796	icacls.exe
4968	takeown.exe
1320	icacls.exe
1512	takeown.exe

Executes dropped EXE 4 IoCs

pid	Process
3512	MrsMajor2.0.exe
3896	eula32.exe
3332	GetReady.exe
4556	notmuch.exe

Modifies file permissions 1 TTPs 4 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1512	takeown.exe
1796	icacls.exe
4968	takeown.exe
1320	icacls.exe

Modifies system executable filetype association 2 TTPs 2 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\DefaultIcon	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\DefaultIcon\ = "C:\\Program Files\\MicrosoftWindowsServicesEtc\\data\\fileico.ico"	wscript.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4181651180-3163410697-3990547336-1000\Software\Microsoft\Windows\CurrentVersion\Run\MajorX = "wscript.exe \"C:\\Users\\Admin\\AppData\\Local\\Temp\\xRun.vbs\""	wscript.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\taskmgr.exe	cmd.exe
File opened for modification	C:\Windows\System32\sethc.exe	cmd.exe

Drops file in Program Files directory 37 IoCs

description	ioc	Process
File created	C:\program files\MicrosoftWindowsServicesEtc\data\eula32.exe	wscript.exe
File created	C:\program files\MicrosoftWindowsServicesEtc\healgen.vbs	wscript.exe
File created	C:\program files\MicrosoftWindowsServicesEtc\NotMuch.exe	wscript.exe
File created	C:\program files\MicrosoftWindowsServicesEtc\rsod.exe	wscript.exe
File created	C:\program files\MicrosoftWindowsServicesEtc\weird\RuntimeChecker.vbs	wscript.exe
File created	C:\program files\MicrosoftWindowsServicesEtc\AppKill.bat	wscript.exe
File created	C:\program files\MicrosoftWindowsServicesEtc\DgzRun.vbs	wscript.exe
File created	C:\program files\MicrosoftWindowsServicesEtc\majorsod.exe	wscript.exe
File created	C:\program files\MicrosoftWindowsServicesEtc\RuntimeChecker.exe	wscript.exe
File created	C:\program files\MicrosoftWindowsServicesEtc\weird\breakrule.vbs	wscript.exe
File created	C:\program files\MicrosoftWindowsServicesEtc\breakrule.exe	wscript.exe
File created	C:\program files\MicrosoftWindowsServicesEtc\bsod.exe	wscript.exe
File created	C:\program files\MicrosoftWindowsServicesEtc\data\thetruth.jpg	wscript.exe
File created	C:\program files\MicrosoftWindowsServicesEtc\GetReady.exe	wscript.exe
File created	C:\program files\MicrosoftWindowsServicesEtc\weird\bsod.bat	wscript.exe
File opened for modification	C:\program files\MicrosoftWindowsServicesEtc\AppKill.bat	wscript.exe
File created	C:\program files\MicrosoftWindowsServicesEtc\CallFunc.vbs	wscript.exe
File created	C:\program files\MicrosoftWindowsServicesEtc\Major.exe	wscript.exe
File created	C:\program files\MicrosoftWindowsServicesEtc\xRun.vbs	wscript.exe
File created	C:\program files\MicrosoftWindowsServicesEtc\clingclang.wav	wscript.exe
File created	C:\program files\MicrosoftWindowsServicesEtc\data\excursor.ani	wscript.exe
File created	C:\program files\MicrosoftWindowsServicesEtc\data\fileico.ico	wscript.exe
File created	C:\program files\MicrosoftWindowsServicesEtc\weird\Major.vbs	wscript.exe
File created	C:\program files\MicrosoftWindowsServicesEtc\weird\majorsod.vbs	wscript.exe
File created	C:\program files\MicrosoftWindowsServicesEtc\weird\WinScrew.bat	wscript.exe
File created	C:\program files\MicrosoftWindowsServicesEtc\checker.bat	wscript.exe
File created	C:\program files\MicrosoftWindowsServicesEtc\majorlist.exe	wscript.exe
File created	C:\program files\MicrosoftWindowsServicesEtc\WinScrew.exe	wscript.exe
File created	C:\program files\MicrosoftWindowsServicesEtc\data\runner32s.exe	wscript.exe
File created	C:\program files\MicrosoftWindowsServicesEtc\fexec.vbs	wscript.exe
File created	C:\program files\MicrosoftWindowsServicesEtc\majordared.exe	wscript.exe
File created	C:\program files\MicrosoftWindowsServicesEtc\xRunReg.vbs	wscript.exe
File created	C:\program files\MicrosoftWindowsServicesEtc\example.txt	wscript.exe
File created	C:\program files\MicrosoftWindowsServicesEtc\weird\cmd.vbs	wscript.exe
File created	C:\program files\MicrosoftWindowsServicesEtc\weird\GetReady.bat	wscript.exe
File created	C:\program files\MicrosoftWindowsServicesEtc\weird\majorlist.bat	wscript.exe
File created	C:\program files\MicrosoftWindowsServicesEtc\weird\runner32s.vbs	wscript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Control Panel 4 IoCs

evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4181651180-3163410697-3990547336-1000\Control Panel\Cursors\AppStarting = "C:\\Program Files\\MicrosoftWindowsServicesEtc\\data\\excursor.ani"	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4181651180-3163410697-3990547336-1000\Control Panel\Cursors\Hand = "C:\\Program Files\\MicrosoftWindowsServicesEtc\\data\\excursor.ani"	wscript.exe
Key created	\REGISTRY\USER\S-1-5-21-4181651180-3163410697-3990547336-1000\Control Panel\Cursors	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4181651180-3163410697-3990547336-1000\Control Panel\Cursors\Arrow = "C:\\Program Files\\MicrosoftWindowsServicesEtc\\data\\excursor.ani"	wscript.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292114432"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365268"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4290799360"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292114432"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "238"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365268"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe

Modifies registry class 15 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4181651180-3163410697-3990547336-1000\{8E52AED5-5446-4422-9CBF-96B972BC15E1}	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\DefaultIcon\ = "C:\\Program Files\\MicrosoftWindowsServicesEtc\\data\\fileico.ico"	wscript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mp3file\DefaultIcon	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mp4file\DefaultIcon\ = "C:\\Program Files\\MicrosoftWindowsServicesEtc\\data\\fileico.ico"	wscript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\DefaultIcon	wscript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mp4file\DefaultIcon	wscript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inifile\DefaultIcon	wscript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inifile	wscript.exe
Key created	\REGISTRY\USER\S-1-5-21-4181651180-3163410697-3990547336-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\DefaultIcon	wscript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\DefaultIcon\ = "C:\\Program Files\\MicrosoftWindowsServicesEtc\\data\\fileico.ico"	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mp3file\DefaultIcon\ = "C:\\Program Files\\MicrosoftWindowsServicesEtc\\data\\fileico.ico"	wscript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mp4file	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\inifile\DefaultIcon\ = "C:\\Program Files\\MicrosoftWindowsServicesEtc\\data\\fileico.ico"	wscript.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\MrsMajor2.0-main.zip:Zone.Identifier	msedge.exe
File created	C:\Users\Admin\AppData\Local\Temp\7zO88922469\MrsMajor2.0.exe:Zone.Identifier	7zFM.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
2724	msedge.exe
2724	msedge.exe
3924	msedge.exe
3924	msedge.exe
3592	msedge.exe
3592	msedge.exe
1804	identity_helper.exe
1804	identity_helper.exe
3392	msedge.exe
3392	msedge.exe
2728	msedge.exe
2728	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
2440	7zFM.exe
2440	7zFM.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
4700	7zFM.exe
2440	7zFM.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

pid	Process
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeRestorePrivilege	4700	7zFM.exe
Token: 35	4700	7zFM.exe
Token: SeSecurityPrivilege	4700	7zFM.exe
Token: SeRestorePrivilege	2440	7zFM.exe
Token: 35	2440	7zFM.exe
Token: SeSecurityPrivilege	2440	7zFM.exe
Token: SeSecurityPrivilege	2440	7zFM.exe
Token: SeTakeOwnershipPrivilege	1512	takeown.exe
Token: SeTakeOwnershipPrivilege	4968	takeown.exe
Token: SeShutdownPrivilege	3420	shutdown.exe
Token: SeRemoteShutdownPrivilege	3420	shutdown.exe

Suspicious use of FindShellTrayWindow 51 IoCs

pid	Process
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
4700	7zFM.exe
4700	7zFM.exe
2440	7zFM.exe
2440	7zFM.exe
2440	7zFM.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2796	PickerHost.exe
3948	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3924 wrote to memory of 1952	3924	msedge.exe	78
PID 3924 wrote to memory of 1952	3924	msedge.exe	78
PID 3924 wrote to memory of 1300	3924	msedge.exe	79
PID 3924 wrote to memory of 1300	3924	msedge.exe	79
PID 3924 wrote to memory of 1300	3924	msedge.exe	79
PID 3924 wrote to memory of 1300	3924	msedge.exe	79
PID 3924 wrote to memory of 1300	3924	msedge.exe	79
PID 3924 wrote to memory of 1300	3924	msedge.exe	79
PID 3924 wrote to memory of 1300	3924	msedge.exe	79
PID 3924 wrote to memory of 1300	3924	msedge.exe	79
PID 3924 wrote to memory of 1300	3924	msedge.exe	79
PID 3924 wrote to memory of 1300	3924	msedge.exe	79
PID 3924 wrote to memory of 1300	3924	msedge.exe	79
PID 3924 wrote to memory of 1300	3924	msedge.exe	79
PID 3924 wrote to memory of 1300	3924	msedge.exe	79
PID 3924 wrote to memory of 1300	3924	msedge.exe	79
PID 3924 wrote to memory of 1300	3924	msedge.exe	79
PID 3924 wrote to memory of 1300	3924	msedge.exe	79
PID 3924 wrote to memory of 1300	3924	msedge.exe	79
PID 3924 wrote to memory of 1300	3924	msedge.exe	79
PID 3924 wrote to memory of 1300	3924	msedge.exe	79
PID 3924 wrote to memory of 1300	3924	msedge.exe	79
PID 3924 wrote to memory of 1300	3924	msedge.exe	79
PID 3924 wrote to memory of 1300	3924	msedge.exe	79
PID 3924 wrote to memory of 1300	3924	msedge.exe	79
PID 3924 wrote to memory of 1300	3924	msedge.exe	79
PID 3924 wrote to memory of 1300	3924	msedge.exe	79
PID 3924 wrote to memory of 1300	3924	msedge.exe	79
PID 3924 wrote to memory of 1300	3924	msedge.exe	79
PID 3924 wrote to memory of 1300	3924	msedge.exe	79
PID 3924 wrote to memory of 1300	3924	msedge.exe	79
PID 3924 wrote to memory of 1300	3924	msedge.exe	79
PID 3924 wrote to memory of 1300	3924	msedge.exe	79
PID 3924 wrote to memory of 1300	3924	msedge.exe	79
PID 3924 wrote to memory of 1300	3924	msedge.exe	79
PID 3924 wrote to memory of 1300	3924	msedge.exe	79
PID 3924 wrote to memory of 1300	3924	msedge.exe	79
PID 3924 wrote to memory of 1300	3924	msedge.exe	79
PID 3924 wrote to memory of 1300	3924	msedge.exe	79
PID 3924 wrote to memory of 1300	3924	msedge.exe	79
PID 3924 wrote to memory of 1300	3924	msedge.exe	79
PID 3924 wrote to memory of 1300	3924	msedge.exe	79
PID 3924 wrote to memory of 2724	3924	msedge.exe	81
PID 3924 wrote to memory of 2724	3924	msedge.exe	81
PID 3924 wrote to memory of 4684	3924	msedge.exe	80
PID 3924 wrote to memory of 4684	3924	msedge.exe	80
PID 3924 wrote to memory of 4684	3924	msedge.exe	80
PID 3924 wrote to memory of 4684	3924	msedge.exe	80
PID 3924 wrote to memory of 4684	3924	msedge.exe	80
PID 3924 wrote to memory of 4684	3924	msedge.exe	80
PID 3924 wrote to memory of 4684	3924	msedge.exe	80
PID 3924 wrote to memory of 4684	3924	msedge.exe	80
PID 3924 wrote to memory of 4684	3924	msedge.exe	80
PID 3924 wrote to memory of 4684	3924	msedge.exe	80
PID 3924 wrote to memory of 4684	3924	msedge.exe	80
PID 3924 wrote to memory of 4684	3924	msedge.exe	80
PID 3924 wrote to memory of 4684	3924	msedge.exe	80
PID 3924 wrote to memory of 4684	3924	msedge.exe	80
PID 3924 wrote to memory of 4684	3924	msedge.exe	80
PID 3924 wrote to memory of 4684	3924	msedge.exe	80
PID 3924 wrote to memory of 4684	3924	msedge.exe	80
PID 3924 wrote to memory of 4684	3924	msedge.exe	80
PID 3924 wrote to memory of 4684	3924	msedge.exe	80
PID 3924 wrote to memory of 4684	3924	msedge.exe	80

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system	wscript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wscript.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://roblox.xom
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffd60d13cb8,0x7ffd60d13cc8,0x7ffd60d13cd8
  2⤵
  PID:1952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1892,4194941091865917083,2974645663264092629,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1912 /prefetch:2
  2⤵
  PID:1300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1892,4194941091865917083,2974645663264092629,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2700 /prefetch:8
  2⤵
  PID:4684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1892,4194941091865917083,2974645663264092629,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,4194941091865917083,2974645663264092629,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:1628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,4194941091865917083,2974645663264092629,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:3084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,4194941091865917083,2974645663264092629,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3948 /prefetch:1
  2⤵
  PID:3416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,4194941091865917083,2974645663264092629,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4976 /prefetch:1
  2⤵
  PID:2420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,4194941091865917083,2974645663264092629,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4788 /prefetch:1
  2⤵
  PID:3312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,4194941091865917083,2974645663264092629,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5224 /prefetch:1
  2⤵
  PID:4512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,4194941091865917083,2974645663264092629,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4024 /prefetch:1
  2⤵
  PID:2440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,4194941091865917083,2974645663264092629,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4796 /prefetch:1
  2⤵
  PID:4868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1892,4194941091865917083,2974645663264092629,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3140 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3592
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1892,4194941091865917083,2974645663264092629,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5096 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,4194941091865917083,2974645663264092629,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5320 /prefetch:1
  2⤵
  PID:3364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,4194941091865917083,2974645663264092629,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5712 /prefetch:1
  2⤵
  PID:2192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1892,4194941091865917083,2974645663264092629,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5456 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:3392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1892,4194941091865917083,2974645663264092629,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5032 /prefetch:8
  2⤵
  PID:3068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,4194941091865917083,2974645663264092629,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5568 /prefetch:1
  2⤵
  PID:4920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,4194941091865917083,2974645663264092629,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3100 /prefetch:1
  2⤵
  PID:2552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,4194941091865917083,2974645663264092629,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5712 /prefetch:1
  2⤵
  PID:1364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,4194941091865917083,2974645663264092629,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1732 /prefetch:1
  2⤵
  PID:4860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,4194941091865917083,2974645663264092629,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5568 /prefetch:1
  2⤵
  PID:1872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,4194941091865917083,2974645663264092629,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6816 /prefetch:1
  2⤵
  PID:4208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1892,4194941091865917083,2974645663264092629,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6616 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:2728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1892,4194941091865917083,2974645663264092629,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=4872 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4564

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2368

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2844

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:660

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Temp1_MrsMajor2.0-main.zip\MrsMajor2.0-main\MrsMajor2.0.rar"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4700

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Temp2_MrsMajor2.0-main.zip\MrsMajor2.0-main\MrsMajor2.0.rar"
1⤵
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2440
- C:\Users\Admin\AppData\Local\Temp\7zO88922469\MrsMajor2.0.exe
  "C:\Users\Admin\AppData\Local\Temp\7zO88922469\MrsMajor2.0.exe"
  2⤵
  - Executes dropped EXE
  PID:3512
- - C:\Windows\system32\wscript.exe
    "C:\Windows\sysnative\wscript.exe" C:\Users\Admin\AppData\Local\Temp\32CE.tmp\32CF.vbs
    3⤵
    - Modifies WinLogon for persistence
    - UAC bypass
    - Disables RegEdit via registry modification
    - Modifies system executable filetype association
    - Adds Run key to start application
    - Drops file in Program Files directory
    - Modifies Control Panel
    - Modifies registry class
    - System policy modification
    PID:4284
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c cd\&cd "C:\Users\Admin\AppData\Local\Temp" & eula32.exe
      4⤵
      PID:4060
    - - C:\Users\Admin\AppData\Local\Temp\eula32.exe
        
        eula32.exe
        5⤵
        Executes dropped EXE
        
        PID:3896
  - - C:\Program Files\MicrosoftWindowsServicesEtc\GetReady.exe
      "C:\Program Files\MicrosoftWindowsServicesEtc\GetReady.exe"
      4⤵
      Executes dropped EXE
      PID:3332
    - - C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\1\6586.bat "C:\Program Files\MicrosoftWindowsServicesEtc\GetReady.exe""
        5⤵
        Drops file in System32 directory
        
        PID:3376
      - C:\Windows\System32\takeown.exe
        
        takeown /f taskmgr.exe
        6⤵
        Possible privilege escalation attempt
        Modifies file permissions
        Suspicious use of AdjustPrivilegeToken
        
        PID:1512
      - C:\Windows\System32\icacls.exe
        
        icacls taskmgr.exe /granted "Admin":F
        6⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:1796
      - C:\Windows\System32\takeown.exe
        
        takeown /f sethc.exe
        6⤵
        Possible privilege escalation attempt
        Modifies file permissions
        Suspicious use of AdjustPrivilegeToken
        
        PID:4968
      - C:\Windows\System32\icacls.exe
        
        icacls sethc.exe /granted "Admin":F
        6⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:1320
  - - C:\Program Files\MicrosoftWindowsServicesEtc\notmuch.exe
      "C:\Program Files\MicrosoftWindowsServicesEtc\notmuch.exe"
      4⤵
      Executes dropped EXE
      PID:4556
  - - C:\Windows\System32\shutdown.exe
      "C:\Windows\System32\shutdown.exe" -r -t 5
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3420

C:\Windows\System32\PickerHost.exe
C:\Windows\System32\PickerHost.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:2796

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3a2c055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:3948

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

File and Directory Permissions Modification

T1222

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

GetReady.exe

Path C:\Program Files\MicrosoftWindowsServicesEtc\GetReady.exe
Size 52KB
SHA256 5319958efc38ea81f61854eb9f6c8aee32394d4389e52fe5c1f7f7ef6b261725
MD5 57f3795953dafa8b5e2b24ba5bfad87f
SHA1 47719bd600e7527c355dbdb053e3936379d1b405
SHA512 172006e8deed2766e7fa71e34182b5539309ec8c2ac5f63285724ef8f59864e1159c618c0914eb05692df721794eb4726757b2ccf576f0c78a6567d807cbfb98
SSDEEP 1536:Sn1KqRJ9x3jnIbslu8JFNDfIDIO40nToIfqqjw0:Sn1KUhrIbsTIl4YTBfqQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 7fccd8c81f41a2684315ad9c86ef0861ecf1f2bf5d13050f760f52aef9b4a263
MD5 3b1e59e67b947d63336fe9c8a1a5cebc
SHA1 5dc7146555c05d8eb1c9680b1b5c98537dd19b91
SHA512 2d9b8f574f7f669c109f7e0d9714b84798e07966341a0200baac01ed5939b611c7ff75bf1978fe06e37e813df277b092ba68051fae9ba997fd529962e2e5d7b0
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 5694744f7e6c49068383af6569df880eed386f56062933708c8716f4221cac61
MD5 0e10a8550dceecf34b33a98b85d5fa0b
SHA1 357ed761cbff74e7f3f75cd15074b4f7f3bcdce0
SHA512 fe6815e41c7643ddb7755cc542d478814f47acea5339df0b5265d9969d02c59ece6fc61150c6c75de3f4f59b052bc2a4f58a14caa3675daeb67955b4dc416d3a
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 8d10671e366b2db661b24256a218f5b833840d7c71e412e1018f680a6b85e213
MD5 8ef0032dcd302a18c286bba431e8b05e
SHA1 dc1716b2cc7ac3587400a134eadb7115b64600f0
SHA512 e7be67715eddb9b5bcc95917339fb7f0fbd7b725b107d535dd3c08736c1b9197e6e267597aabd17f39fd11568b34340dc375b6074ae88547614bf88550913a0e
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 930B
SHA256 aef38743be9f5587fcd8155f68863b79777abbd3af74191e528b40f7939b023b
MD5 3210349a8156169355ac723578dd08e8
SHA1 9ebd7b535720339e3aaf5438a7281706f46c262a
SHA512 c3962d730a685891fb423e1bb9498c56c02c71951fda9e18bb978605c7796d303d8d9f85f8dd29fdead1afe8a780404bb653f48bd782547c17132d03ffd0746b
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 9f641ce10fef154ae204acd52756632aa4547862e80846c5eff0fad390a95b48
MD5 9f42597eb07b06fe57fc05781fa964d6
SHA1 6dc4040aa662dc1614c9fd2b73f4e3fff122d16d
SHA512 bf4d48677bff9faf41c28971886c2b82d3d9b105434f3ff4ba48cb669afb68cd1cca8ebffa7c0227ffa57d699c36339f300c9572e06069d8eb8b8a3acf01f55b
SSDEEP 96:nlk3D5FYQkSGwSv0MoiVmdHI1VJJuTC0WQyV+VpziX3wI3:nlk3DDYQk5v0MAI1vJuTCLx93
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 314d7aef0102a8284a114921fad6f069bcf7badd26fb67d10e7d8692197f2677
MD5 fad1ffcc0ae5e32d02f935cf0dba855d
SHA1 51ab956811959140546da5c6589c688e6318da39
SHA512 9da3c32f5349e3c596d5943d55f7b260709ffe243d3e65a1a5544af0a022ec65862b34161fb0d67b23e5497e5f0504316b26ab06413012c2760e55fdfca94a67
SSDEEP 96:nlk3DeFYQkeGwSFk0MoiVmdVug1jI1rJJuTC0WQyV+VpAiX3wI3:nlk3DEYQktFk0MYughI1FJuTCLe93
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 d0f098c169b47b1d9d9318b7e296a003588a249740b9567f119e6f6279fbada1
MD5 6df4c73b70a29a8fd4bff45f1a2a68b6
SHA1 f307bb4200fe18ff236358e07a45ae02b6a38e51
SHA512 b0ea1c50efb7b5cceafeba223fae238f536fd14107b4901852406f430a123da8d579212bae62008fcb75bda7bc6a1d37345c83da11b8ebab8689764475cec8d2
SSDEEP 96:nlk3DeFYQkvGwSJj0MoiVmdVug1jI1rJJuTC0WQyV+VpAiX3wI3:nlk3DEYQkuJj0MYughI1FJuTCLe93
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 ba5ec705d06cc80419f583e8a62d326c2d5b6f99e8b40cf9f17e194c269161f3
MD5 fd59f6b31ae95230c7f25adb559b9aa9
SHA1 a244f99efb17b6c73428ea85bdf6ab6b3fa5e13e
SHA512 fb76ac9a22be76d1f20daa69e475159e12aed06f8e8e2bbc15daa1a77adb1b4ad553855fe5ac26f36969a5bd48981a8790376ad278d28e83b9609a92808d7c37
SSDEEP 96:nlk3HdFYQkSGwSv0MoiVmdHI1VJJuTC0WQyV+VpAiX3wI3:nlk3HXYQk5v0MAI1vJuTCLe93
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 9f9f5c8d41fc373c32dc3e44983d5ff2665ed55fb7d2e07cbe359081106a8bff
MD5 e6de2bc24c74ea0cec6200cea0febc5c
SHA1 c8769f2a381ce2efacc2345082ad09da3c713636
SHA512 49ac218183ab2839651ea2615d645ff64154f5c31b7f34e757ed26f479ad52037437cc82913bf9de12f9175b9c755c2098acdfc5140a238ef2d675ada96225f8
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 698b3190aadfa1ccac0ba22e4af60f9482f41097939fc6b8c6e1cd3450626b8f
MD5 2a44069bfb35d8355af1907f985b5673
SHA1 1b3c0206bf76a193aba41cab2910c202a9db538f
SHA512 19c08e6ad497896d13b156f64765fafb778c52cfb68bab0ef4ee32e64b880cbf9ca58f16af4b8dbd77acc27c00fde2d0e6d6087d8a30730ace50a5ea0f3df55f
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe57e60a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57e60a.TMP
Size 1KB
SHA256 eff228d40a8a2417485bb8596e7261d7732c47d2a271f623c127ea7afa5abe0a
MD5 456051402f032d2b1b4056c01ce586e4
SHA1 39fc89ba0bf3a6c3702ba1e82945269be3a1e57c
SHA512 957d0a100ee81c7b51a98bed54a9f79394db1e9b0d2c055d4b6c279638ee7922c1942aa0dc0c86dd09c6034d8e9067bbca41f1c8c2c3ed9794ea9c0efe3e35f6
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 7f2194056bd57bd6e465eb68a0c0358511e8397ab635982ebca0807d62c8775f
MD5 b69117777dc9ec01aad9635c05415349
SHA1 17e291ae2d1d7e5243cc0f18996912c6d0625f4d
SHA512 2caf358998abbbff12ced16923e425d6e16cb4f2045dabaac7a21e43e12f4e0f10dd70a79f41ceb3f633ed71b89626608974c0d96e32296fb5e36fe42afa04b8
SSDEEP 192:coCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxASG6G0Q1e2RUIFtSOxhePuE7Euk:M9iIxuERzA83h09RZxASG/tFtLheuE7a
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 59b04b007f65e3ad2be5ceaf8653e65666cfd293daa6d9ff3328439e098959f0
MD5 dc80776cb171c7dd46796fb356f6d994
SHA1 14b03c08c57f4251e59ddaae8b807a8eca9f3d04
SHA512 5af79d860c2afc7dcf98c0af598685c55b730cd8d87ab1a707cde4c3bc7af0818aaa588e0051fb9381fa566ed04c54efcc6561b20ed6230e383eb0abf9d1fcd5
SSDEEP 384:e9iIxuERzA83h09RZxASG6mtF+ZI4yE7ZPIMrChr23Qj:NIxuERzA83h09RZxbGzY64yE7ZPVWhyY
MD5 SHA1 SHA512 SSDEEP

Submit Download

32CF.vbs

Path C:\Users\Admin\AppData\Local\Temp\32CE.tmp\32CF.vbs
Size 2KB
SHA256 f853dddb0f9f1b74b72bccdb5191c28e18d466b5dbc205f7741a24391375cd6f
MD5 fd76266c8088a4dca45414c36c7e9523
SHA1 6b19bf2904a0e3b479032e101476b49ed3ae144a
SHA512 3cd49395368e279ac9a63315583d3804aa89ec8bb6112754973451a7ea7b68140598699b30eef1b0e94c3286d1e6254e2063188282f7e6a18f1349877adeb072
MD5 SHA1 SHA512

Submit Download

AppKill.bat

Path C:\Users\Admin\AppData\Local\Temp\32CE.tmp\MicrosoftWindowsServicesEtc\AppKill.bat
Size 671B
SHA256 5549670ef8837c6e3c4e496c1ea2063670618249d4151dea4d07d48ab456690c
MD5 d4e987817d2e5d6ed2c12633d6f11101
SHA1 3f38430a028f9e3cb66c152e302b3586512dd9c4
SHA512 b84fef88f0128b46f1e2f9c5dff2cb620ee885bed6c90dcf4a5dc51c77bea492c92b8084d8dc8b4277b47b2493a2d9d3f348c6e229bf3da9041ef90e0fd8b6c4
MD5 SHA1 SHA512

Submit Download

CallFunc.vbs

Path C:\Users\Admin\AppData\Local\Temp\32CE.tmp\MicrosoftWindowsServicesEtc\CallFunc.vbs
Size 388B
SHA256 a767894a68ebc490cb5ab2b7b04dd12b7465553ce7ba7e41e1ea45f1eaef5275
MD5 5f9737f03289963a6d7a71efab0813c4
SHA1 ba22dfae8d365cbf8014a630f23f1d8574b5cf85
SHA512 5f4fb691e6da90e8e0872378a7b78cbd1acbf2bd75d19d65f17bf5b1cea95047d66b79fd1173703fcfef42cfc116ca629b9b37e355e44155e8f3b98f2d916a2a
MD5 SHA1 SHA512

Submit Download

DgzRun.vbs

Path C:\Users\Admin\AppData\Local\Temp\32CE.tmp\MicrosoftWindowsServicesEtc\DgzRun.vbs
Size 341B
SHA256 729f7540887cf32a5d4e1968a284c46cf904752821c734bd970ecd30a848477a
MD5 a91417f7c55510155771f1f644dd6c7e
SHA1 41bdb69c5baca73f49231d5b5f77975b79e55bdf
SHA512 f786699c1ab9d7c74dd9eb9d76a76728980b29e84999a166a47b7ee102d8e545901ed0fcb30331712490a36de2d726115b661ad3900cdc2bfcfc601d00b76b07
MD5 SHA1 SHA512

Submit Download

Major.exe

Path C:\Users\Admin\AppData\Local\Temp\32CE.tmp\MicrosoftWindowsServicesEtc\Major.exe
Size 60KB
SHA256 da0233f5e5e9a34e8dd4f6911444ca1f3e29bb9cbd958a9f4508ac7d72ccd55d
MD5 d604c29940864c64b4752d31e2deb465
SHA1 c1698ea4e5d1ba1c9b78973556f97e8f6dbbdef3
SHA512 89a4a14574ba19fe319c766add0111feeb4320c08bf75f55a898d9acc783d5a862a6433758a413cc719b9179dcf873f1c850d1084851b8fc37aa1e3deabfcf54
SSDEEP 768:jfiNar/0i5A9lquoNvU4n7oDBXhVa+3Y/v2pPLo6Gyfu7q3YKdX3jj60dhfp0nQ/:4IxKWLvFn43bovQtu7qo43jjRDf4h/q
MD5 SHA1 SHA512 SSDEEP

Submit Download

NotMuch.exe

Path C:\Users\Admin\AppData\Local\Temp\32CE.tmp\MicrosoftWindowsServicesEtc\NotMuch.exe
Size 122KB
SHA256 cf830a2d66d3ffe51341de9e62c939b2bb68583afbc926ddc7818c3a71e80ebb
MD5 87a43b15969dc083a0d7e2ef73ee4dd1
SHA1 657c7ff7e3f325bcbc88db9499b12c636d564a5f
SHA512 8a02d24f5dab33cdaf768bca0d7a1e3ea75ad515747ccca8ee9f7ffc6f93e8f392ab377f7c2efa5d79cc0b599750fd591358a557f074f3ce9170283ab5b786a1
SSDEEP 3072:V/mYyX16rSVvl/zCQXMdUQLK21J/mYyX16rSVvl/zCQXMdUQLK211:0j6mvLCQXM1L/wj6mvLCQXM1L/
MD5 SHA1 SHA512 SSDEEP

Submit Download

RuntimeChecker.exe

Path C:\Users\Admin\AppData\Local\Temp\32CE.tmp\MicrosoftWindowsServicesEtc\RuntimeChecker.exe
Size 58KB
SHA256 51f59e877a1c2a1c2760c677def7395ef2868c2ee3e56ffdc3ace570afa50428
MD5 cd58990b1b7f6c68f56244c41ab91665
SHA1 7ccca9958d6aebbe3883b55f115b041b827bd2e7
SHA512 011bdd417ec3bf72daa2b32d3816b696be8b87423740dc2a0182e23515651deeb870a94f3415a73480145f9f5e36c1a3a492410b77ca95d7fab8b9826e9198cc
SSDEEP 768:HfiNar/0i5A9lquoNvU4n7oDBXhVa+3Y/v2pPLo6Gyfu7q3YKdX3jj60dhfp0nQB:8IxKWLvFn43bovQtu7qo43jjRDf4e
MD5 SHA1 SHA512 SSDEEP

Submit Download

WinScrew.exe

Path C:\Users\Admin\AppData\Local\Temp\32CE.tmp\MicrosoftWindowsServicesEtc\WinScrew.exe
Size 52KB
SHA256 429e01b0e06b02a55bafb1527629f8d4c5f64d9b21ac9f81484a3928fdce6dc9
MD5 1aaafedd9f259acca75708f4af10b5be
SHA1 f6b4ea28d304e1f9205c1c0b970d60ee989402f2
SHA512 a995ebf4d142452aabb419f0cacfa5412d03532840cb08c37dd7c00001dee521bf9d0da66ac4346b07dffd91fe01fa3115fa05811acbd43d380320dca1be4aa8
SSDEEP 1536:Sn1KqRJ9x3jnIbslu8JFNDfIDIO40nToIfqFwr:Sn1KUhrIbsTIl4YTBfqa
MD5 SHA1 SHA512 SSDEEP

Submit Download

breakrule.exe

Path C:\Users\Admin\AppData\Local\Temp\32CE.tmp\MicrosoftWindowsServicesEtc\breakrule.exe
Size 58KB
SHA256 5eafebd52fbf6d0e8abd0cc9bf42d36e5b6e4d85b8ebe59f61c9f2d6dccc65e4
MD5 bcb0ac4822de8aeb86ea8a83cd74d7ca
SHA1 8e2b702450f91dde3c085d902c09dd265368112e
SHA512 b73647a59eeb92f95c4d7519432ce40ce9014b292b9eb1ed6a809cca30864527c2c827fe49c285bb69984f33469704424edca526f9dff05a6244b33424df01d1
SSDEEP 768:TfiNar/0i5A9lquoNvU4n7oDBXhVa+3Y/v2pPLo6Gyfu7q3YKdX3jj60dhfp0nQ5:oIxKWLvFn43bovQtu7qo43jjRDf45OP
MD5 SHA1 SHA512 SSDEEP

Submit Download

bsod.exe

Path C:\Users\Admin\AppData\Local\Temp\32CE.tmp\MicrosoftWindowsServicesEtc\bsod.exe
Size 1.2MB
SHA256 6581eeab9fd116662b4ca73f6ef00fb96e0505d01cfb446ee4b32bbdeefe1361
MD5 8f6a3b2b1af3a4aacd8df1734d250cfe
SHA1 505b3bd8e936cb5d8999c1b319951ffebab335c9
SHA512 c1b5f845c005a1a586080e9da9744e30c7f3eda1e3aaba9c351768f7dea802e9f39d0227772413756ab63914ae4a2514e6ce52c494a91e92c3a1f08badb40264
SSDEEP 24576:Zo4RxLUqi0cq0wQvNuPmLanpxJML1m2rVF9VoEzdWcKgl7xAYKTj6fi6QkGC3BQ:WopPL0bMmLYpxJTWxVoSoLglla6fiFc
MD5 SHA1 SHA512 SSDEEP

Submit Download

checker.bat

Path C:\Users\Admin\AppData\Local\Temp\32CE.tmp\MicrosoftWindowsServicesEtc\checker.bat
Size 151B
SHA256 3382484b5a6a04d05500e7622da37c1ffaef3a1343395942bc7802bf2a19b53f
MD5 f59801d5c49713770bdb2f14eff34e2f
SHA1 91090652460c3a197cfad74d2d3c16947d023d63
SHA512 c1c3a78f86e7938afbe391f0e03065b04375207704e419fe77bf0810d1e740c3ef8926c878884ad81b429ec41e126813a68844f600e124f5fa8d28ef17b4b7bc
MD5 SHA1 SHA512

Submit Download

clingclang.wav

Path C:\Users\Admin\AppData\Local\Temp\32CE.tmp\MicrosoftWindowsServicesEtc\clingclang.wav
Size 1.2MB
SHA256 8b6aeca8ff8019618fc266968537f1481c8f73459a40fb569bb343bb8f02dc8a
MD5 b97bc9baa13a0c5b82ea1bb412564462
SHA1 1190ed91a3990400aa509a8e9c3b9e28607546bf
SHA512 7d52f93d3151afe5bcc059eaa22b34256c0b6bd3dd3fe39e060b6c1f162051bceeac27103b0be9e827ad94a59c87e7718d0d4344fb969aa9c2deb8da5d8aed46
SSDEEP 24576:IbzM7343EMCru0tJk/vKvz3rGhVRF+BJc+69PTledXq712Voi92MSmf:Ib4M3BIuLKvL42JX0B71Ji92Uf
MD5 SHA1 SHA512 SSDEEP

Submit Download

eula32.exe

Path C:\Users\Admin\AppData\Local\Temp\32CE.tmp\MicrosoftWindowsServicesEtc\data\eula32.exe
Size 1.2MB
SHA256 c5704419b3eec34fb133cf2509d12492febdcb8831efa1ab014edeac83f538d9
MD5 cbc127fb8db087485068044b966c76e8
SHA1 d02451bd20b77664ce27d39313e218ab9a9fdbf9
SHA512 200ee39287f056b504cc23beb1b301a88b183a3806b023d936a2d44a31bbfd08854f6776082d4f7e2232c3d2f606cd5d8229591ecdc86a2bbcfd970a1ee33d41
SSDEEP 24576:ltxcvBKhCBmx66TPABwaktzXYjg6lks6TMHeAKHDZlwtH8eQ2d:2v0hC5ePtakt70gS1tBKHDZloH8eb
MD5 SHA1 SHA512 SSDEEP

Submit Download

excursor.ani

Path C:\Users\Admin\AppData\Local\Temp\32CE.tmp\MicrosoftWindowsServicesEtc\data\excursor.ani
Size 17KB
SHA256 b93b0cb2bb965f5758cb0c699fbc827a64712d6f248aaf810cde5fa5ef3227eb
MD5 289624a46bb7ec6d91d5b099343b7f24
SHA1 2b0aab828ddb252baf4ed99994f716d136cd7948
SHA512 8c77696fe1c897f56ea3afdecf67ad1128274815942cd4c73d30bf0a44dd1a690d8c2f4b0be08e604853084e5515020c2e913d6e044f9801b6223c1912eec8f8
SSDEEP 96:TpjTq5589uVBc4VXdpQiMklaLHrmsqmggRdW/K26dpuMMK92Vqzjj/aJVO/A:djuK9uVBPjQcEaQPNuOzXaJVO/A
MD5 SHA1 SHA512 SSDEEP

Submit Download

fileico.ico

Path C:\Users\Admin\AppData\Local\Temp\32CE.tmp\MicrosoftWindowsServicesEtc\data\fileico.ico
Size 38KB
SHA256 d13f7fd44f38136dae1cdf147ba9b673e698f77c0a644ccd3c12e3a71818a0cd
MD5 a62eeca905717738a4355dc5009d0fc6
SHA1 dd4cc0d3f203d395dfdc26834fc890e181d33382
SHA512 47ffac6dc37dac4276579cd668fd2524ab1591b594032adbeb609d442f3a28235a2d185c66d8b78b6827ac51d62d97bdc3dffc3ffbaa70cf13d4d5f1dc5f16c2
SSDEEP 768:NT3jpF8btdcP0pdsNhEGxz+e4HGiFULFkqr+vxYmCTTp5E3QbS8lC4pTqX:NT3j0tjsNmde4HGb2WHmQbvlxpa
MD5 SHA1 SHA512 SSDEEP

Submit Download

runner32s.exe

Path C:\Users\Admin\AppData\Local\Temp\32CE.tmp\MicrosoftWindowsServicesEtc\data\runner32s.exe
Size 58KB
SHA256 a97ea879e2b51972aa0ba46a19ad4363d876ac035502a2ed2df27db522bc6ac4
MD5 87815289b110cf33af8af1decf9ff2e9
SHA1 09024f9ec9464f56b7e6c61bdd31d7044bdf4795
SHA512 8d9024507fa83f578b375c86f38970177313ec3dd9fae794b6e7f739e84fa047a9ef56bf190f6f131d0c7c5e280e729208848b152b3ca492a54af2b18e70f5dc
SSDEEP 768:nfiNar/0i5A9lquoNvU4n7oDBXhVa+3Y/v2pPLo6Gyfu7q3YKdX3jj60dhfp0nQR:cIxKWLvFn43bovQtu7qo43jjRDf4e
MD5 SHA1 SHA512 SSDEEP

Submit Download

thetruth.jpg

Path C:\Users\Admin\AppData\Local\Temp\32CE.tmp\MicrosoftWindowsServicesEtc\data\thetruth.jpg
Size 483KB
SHA256 4e3baea3d98c479951f9ea02e588a3b98b1975055c1dfdf67af4de6e7b41e476
MD5 7907845316bdbd32200b82944d752d9c
SHA1 1e5c37db25964c5dd05f4dce392533a838a722a9
SHA512 72a64fab025928d60174d067990c35caa3bb6dadacf9c66e5629ee466016bc8495e71bed218e502f6bde61623e0819485459f25f3f82836e632a52727335c0a0
SSDEEP 12288:hoHqZocqog5yrfBbCfgN2ZJ9c5E6Cfq+IJ6gSJ4zFSGj:/qovtynZfc5KrIcJ8rj
MD5 SHA1 SHA512 SSDEEP

Submit Download

healgen.vbs

Path C:\Users\Admin\AppData\Local\Temp\32CE.tmp\MicrosoftWindowsServicesEtc\healgen.vbs
Size 302B
SHA256 cc6d0f847fde710096b01abf905c037594ff4afae6e68a8b6af0cc59543e29bb
MD5 8837818893ce61b6730dd8a83d625890
SHA1 a9d71d6d6d0c262d41a60b6733fb23cd7b8c7614
SHA512 6f17d46098e3c56070ced4171d4c3a0785463d92db5f703b56b250ab8615bcb6e504d4c5a74d05308a62ea36ae31bc29850187943b54add2b50422fb03125516
MD5 SHA1 SHA512

Submit Download

majordared.exe

Path C:\Users\Admin\AppData\Local\Temp\32CE.tmp\MicrosoftWindowsServicesEtc\majordared.exe
Size 751KB
SHA256 e7c911eb2883eddeaded5ad9d59390a1e3887fcbe09f42d958b0491d3570db2d
MD5 500c33e3e83631c47b3d95e9367828e1
SHA1 f79655633cdbc9f19c329ac8a8956fc81be4aca6
SHA512 2fd86ff19fb81810877c532cb94e40bdf85812c684511d4c8540d816b7a517324c90c783cdc6bb3df37d8a61ee96af61d11cf49734b4a9e6db728ffa72341abe
SSDEEP 12288:41E0Rh6Ib4xqOarj7qMCeqEAdwGjfI2qXlnhqnuMirnjPdvTjCC+xjIKZ2pxCGd1:l0/Sq7r/g2cgbyZkjPdhejpUCGr
MD5 SHA1 SHA512 SSDEEP

Submit Download

majorlist.exe

Path C:\Users\Admin\AppData\Local\Temp\32CE.tmp\MicrosoftWindowsServicesEtc\majorlist.exe
Size 51KB
SHA256 3cdafc944b48d45a0d5dc068652486a970124ebe1379a7a04e5cf1dcf05c37c8
MD5 230970ec5286b34a6b2cda9afdd28368
SHA1 e3198d3d3b51d245a62a0dc955f2b1449608a295
SHA512 52912b6b2ba55c540316fcfc6f45d68771d1c22ddf4eb09c2cc15fb8ddd214812c18fd75cd61b561c29f660e2bf20290a101b85da1e0bbf8dfbf90b791892b57
SSDEEP 1536:bn1KqRJ9x3jnIbslu8JFNDfIDIO40nToIfqX:bn1KUhrIbsTIl4YTBfqX
MD5 SHA1 SHA512 SSDEEP

Submit Download

majorsod.exe

Path C:\Users\Admin\AppData\Local\Temp\32CE.tmp\MicrosoftWindowsServicesEtc\majorsod.exe
Size 58KB
SHA256 d1094e91960ded15444c6f50756adc451a7c0b495b2ea28319b7184ba96236f7
MD5 b561c360c46744f55be79a25e1844e3c
SHA1 ed0f7eb00b4f1ae6cf92ad75e5701014f3d03d56
SHA512 0a3a75d08f1d7afcd7a476fc71157983e04b0c26b00ace4d505aa644e5da3e242dd0f6afdb3c93f29ba0b08d2702d0e96b49acba4ed260330068b13f93973e9f
SSDEEP 768:jfiNar/0i5A9lquoNvU4n7oDBXhVa+3Y/v2pPLo6Gyfu7q3YKdX3jj60dhfp0nQY:4IxKWLvFn43bovQtu7qo43jjRDf4DOg
MD5 SHA1 SHA512 SSDEEP

Submit Download

rsod.exe

Path C:\Users\Admin\AppData\Local\Temp\32CE.tmp\MicrosoftWindowsServicesEtc\rsod.exe
Size 74KB
SHA256 dcaabfd6955d3fec26a86217d1b1ab7e979c301d498473e4d885145ce031fc3b
MD5 91a0740cfb043e1f4d8461f8cbe2ff19
SHA1 92e1ad31c34c4102e5cb2cc69f3793b2a1d5304e
SHA512 c60067655e5f191708af9b25382869e3ce65cd3ea2d6cac70f8cae4132942cfd6a8aa9dde1e2b7f3f12997d6d7411e21dc73ab4cd83ec555d74b82b86778a613
SSDEEP 1536:UtmYDV2S8sigWZs1M4N2WNlA3V2bFUOSzm:UtmYDwPsigWO1M4gWNa3cuHm
MD5 SHA1 SHA512 SSDEEP

Submit Download

GetReady.bat

Path C:\Users\Admin\AppData\Local\Temp\32CE.tmp\MicrosoftWindowsServicesEtc\weird\GetReady.bat
Size 345B
SHA256 33a0c62f3f66bce3fc1beb37aca8ad731bfa5590177d933d9d4eae016019242a
MD5 3dbccaadafb7f0227c1839be5ca07015
SHA1 bd636f73235d52d172ad8932a8e4a6a8b17389a0
SHA512 d981670f9d492d97931ab260a7d7d27d4f97621a1ef3e20246d4be2a9b4cfc01e01174a1d46432b4a3d937ad135c97eec9ef7bbc7da46034388843887df4637e
MD5 SHA1 SHA512

Submit Download

Major.vbs

Path C:\Users\Admin\AppData\Local\Temp\32CE.tmp\MicrosoftWindowsServicesEtc\weird\Major.vbs
Size 2KB
SHA256 cbd3b0f294e8f11592a3ad80d1070d81746f806a48183b93c345251422ccbf0d
MD5 9192fd494155eab424110765c751559e
SHA1 b54fcc1e29617b3eee1c7bb215c048498881b641
SHA512 b8c48916535f3721e7f47be6af671765c3befefcd407c6ea5fabcf9ada119747408d662f61fb436f98a7c33050b6674da54dddf25e683429204a96555ec6e801
MD5 SHA1 SHA512

Submit Download

RuntimeChecker.vbs

Path C:\Users\Admin\AppData\Local\Temp\32CE.tmp\MicrosoftWindowsServicesEtc\weird\RuntimeChecker.vbs
Size 440B
SHA256 989d947c51c878bcefecb53d867a3c182c2d67129a87a5f6773eb6ef2bbf9b2e
MD5 fe44b78a465853c0ac0744c6ab05ea40
SHA1 f32dacd91b9547fce9a8a2846a4e17c33295aab3
SHA512 6b945e16786833c2e2e9867315b8859c413687fc72d4c8576b9c0a1aed2dc65249468317dd49f2ecf777e27c9969b7a7abc72b4d9b7c182dc7999051377515db
MD5 SHA1 SHA512

Submit Download

WinScrew.bat

Path C:\Users\Admin\AppData\Local\Temp\32CE.tmp\MicrosoftWindowsServicesEtc\weird\WinScrew.bat
Size 336B
SHA256 3aef33c03777abe62feef0a840ac6a087caafc05adfe801464fd1c52eac656a0
MD5 04067ca733ee8b2ab2f068edc8b75a0f
SHA1 973cb577f6ab2463040918c3661333553a3132c8
SHA512 5423a1e668211f269a3d787548e11d18de7365d6c2525c2de61014854f1ab5a51b5de9eda70fb21d6ebe356cb52e93b3f406c71ed7fbcaedd2b023b6fa9c13f8
MD5 SHA1 SHA512

Submit Download

breakrule.vbs

Path C:\Users\Admin\AppData\Local\Temp\32CE.tmp\MicrosoftWindowsServicesEtc\weird\breakrule.vbs
Size 108B
SHA256 17d014cb4abbaced3acce9b6d7a1b595cd6e2dd814e41f06ceddcdc08e93eebe
MD5 2609fde7a9604c73be5083e4bcfa0e20
SHA1 068c89f703fb11663143b9927f2a0c9f9f59c0e3
SHA512 439fee7cc198cb3fef4ef14693141e52c305579a4ff2da0842323f57dcffade03f3b01ac288080fed423511937a4c1e2080f5a79f967a963fe34253f541824cb
MD5 SHA1 SHA512

Submit Download

bsod.bat

Path C:\Users\Admin\AppData\Local\Temp\32CE.tmp\MicrosoftWindowsServicesEtc\weird\bsod.bat
Size 133B
SHA256 3900e3b60b4691311e050c4cf8fac82ff178a06e3d04d5d6b2d7ea12cf5d53d1
MD5 c94bb8d71863b05b95891389bed6365e
SHA1 07bb402d67f8b1fc601687f1df2622369413db3b
SHA512 00e7ab3a91862faaf5ac5ca3de6dbf2cbb8aac4aba277e1e14b2ecf4650eea2e68134e0df549dca35ab715ed46e36fa9cfee1ba7bb3520511723bf567566682d
MD5 SHA1 SHA512

Submit Download

cmd.vbs

Path C:\Users\Admin\AppData\Local\Temp\32CE.tmp\MicrosoftWindowsServicesEtc\weird\cmd.vbs
Size 11B
SHA256 4d2639e890d6d5988eb9cb6f8cb50647048bbfeeb83fc604c52567e7381c876c
MD5 b181d5a4055b4a620dd7c44c5065bbe7
SHA1 36320f257026b923b923ad2c0e7fa93a257806e0
SHA512 0bec0cf2e5b93065701c5458c1d7e047312971d7bbed3ce5444db710654fa0d84eabb7d7c243130e3cb2dae38eb05874929b5b08547174a6065f8accd4e0433d
MD5 SHA1 SHA512

Submit Download

majorlist.bat

Path C:\Users\Admin\AppData\Local\Temp\32CE.tmp\MicrosoftWindowsServicesEtc\weird\majorlist.bat
Size 105B
SHA256 839301ef07178c100e7f4d47874faf995ae5d11dfd527dda096a284c8114671b
MD5 4cc606c63f423fda5324c962db709562
SHA1 091250ffc64db9bea451885350abed2b7748014c
SHA512 f29ef2bc694f497499545d1fa4e14ca93c06049fff582af3a6caf3885153491a1cd9e96ab5a6746051aa972421f876c008e5d5b671bd34c3922b61c84151097f
MD5 SHA1 SHA512

Submit Download

majorsod.vbs

Path C:\Users\Admin\AppData\Local\Temp\32CE.tmp\MicrosoftWindowsServicesEtc\weird\majorsod.vbs
Size 126B
SHA256 8863b595563e92d73b29090ff83191b2fa1297507be588aa7e1cf910e77c7feb
MD5 fecb9e50c1f01d9d6101f273cb860260
SHA1 18c413f577c289004db6156bd133e5db70258044
SHA512 2c30641b099d5b6c3af40cb41e70160c1f4294bb30dc3162b018e9552b48fc899d1a63d3e366bfb71fcf6803bcc518cf8d504ce60684ce221028a9bf2bc07f9d
MD5 SHA1 SHA512

Submit Download

runner32s.vbs

Path C:\Users\Admin\AppData\Local\Temp\32CE.tmp\MicrosoftWindowsServicesEtc\weird\runner32s.vbs
Size 383B
SHA256 9aae0707b1d5d3b7ed3bf5cc8fbb530aebd195e3e2f18312f3f7f1aa43e031b4
MD5 5f427dc44f33906509423d24fa0590c0
SHA1 b896f7667381a594d3751e05f258925b81c231c0
SHA512 bd28c386772062ef945f24c8ad7a25f158856af36e31d2c9b14674cedfd34b4f48ed531cd40a7eb291384d83665ffe154f0786c1a7ee1616256cf30125120961
MD5 SHA1 SHA512

Submit Download

xRun.vbs

Path C:\Users\Admin\AppData\Local\Temp\32CE.tmp\MicrosoftWindowsServicesEtc\xRun.vbs
Size 93B
SHA256 ed588fa361979f7f9c6dbb4e6a1ae6e075f2db8d79ea6ca2007ba8e3423671b0
MD5 26ec8d73e3f6c1e196cc6e3713b9a89f
SHA1 cb2266f3ecfef4d59bd12d7f117c2327eb9c55fa
SHA512 2b3ad279f1cdc2a5b05073116c71d79e190bfa407da09d8268d56ac2a0c4cc0c31161a251686ac67468d0ba329c302a301c542c22744d9e3a3f5e7ffd2b51195
MD5 SHA1 SHA512

Submit Download

MrsMajor2.0.exe

Path C:\Users\Admin\AppData\Local\Temp\7zO88922469\MrsMajor2.0.exe
Size 25.6MB
SHA256 5dd4ea169cabf9226f54bb53e63ea6a1b5880a0d1222242aee378efb6255b57d
MD5 247a35851fdee53a1696715d67bd0905
SHA1 d2e86020e1d48e527e81e550f06c651328bd58a4
SHA512 a173801aaef4fab608d99b52223b5b2400d69b91edcbf33c21fcb47bd832eef9d771dfd36da350a502a371ed1739c869a7c2b4dca456c93f2feed9ac9c647c7c
SSDEEP 786432:7VQ4fX8siQIZwastE9oGH5UcnaAVBmn163+L2:7ywXwdwRQo2O1L2
MD5 SHA1 SHA512 SSDEEP

Submit Download

MrsMajor2.0.exe

Path C:\Users\Admin\AppData\Local\Temp\7zO88922469\MrsMajor2.0.exe
Size 8.1MB
SHA256 5fe707bac0332be2a83ba988af30d71c1350f9cd47fe433ee89d62ae521e6176
MD5 239841cf32c1594b1c0bc6b89f889bb5
SHA1 f47b09b92b4b0b960cade2dfe587216d1f0ba0a6
SHA512 f5df403906b989d7de0e57f8a8cb948e826b9e6cdb938b45b6f55b546c6324ce1431cf01424bcb5c8f023023fbfb637fa80d6c219865ae3c187d34f6bcc88ac0
SSDEEP 196608:jnVLaH4KqTXi9s7+92ztuRW6ycbE7NP6QmdyQZsCXP:7VQ4fXi9si92zItrbEpi9Zss
MD5 SHA1 SHA512 SSDEEP

Submit Download

MrsMajor2.0.exe

Path C:\Users\Admin\AppData\Local\Temp\7zO88922469\MrsMajor2.0.exe
Size 7.5MB
SHA256 878f6df40d3e97f7ee6344b9b3cb26d86e54d97169fd0647625d6520efe36ac9
MD5 2b3b44f0c914eaf21a86e49cd6d2ee02
SHA1 26a693885aaedd7d6bbc6041201c00595a9f9fbe
SHA512 8740136026583c49a81680de224b45bf2dc5e6025f4421583fa24c81468c3afa19970b3f8822e76ebf882a063f6f8f5bd982e1845a118b090ce8fc843025a425
SSDEEP 196608:jnVLaH4KqTXi9s7+92ztuRW6ycbE7NP6QmdyQZsH:7VQ4fXi9si92zItrbEpi9ZsH
MD5 SHA1 SHA512 SSDEEP

Submit Download

MrsMajor2.0.exe:Zone.Identifier

Path C:\Users\Admin\AppData\Local\Temp\7zO88922469\MrsMajor2.0.exe:Zone.Identifier
Size 85B
SHA256 dbbdc5a8f1b0c6237bd85887d879564c5664ee4167e9cb78b17f9e21920eb3c1
MD5 68863b6ebfc53960b1af3b06aacddd4e
SHA1 32f0111ccf96e245b4f2b674823ffd1ba46b3298
SHA512 08b9927180ee44317eb1414203ed4a0d4be8d250975c5eda01204fd775af4b2236929260fef7da8d057e32b0ed9757864a9e88430ebb2ee41ee669572bb0ab67
MD5 SHA1 SHA512

Submit Download

MrsMajor2.0-main.zip

Path C:\Users\Admin\Downloads\MrsMajor2.0-main.zip
Size 19.4MB
SHA256 8ad8042bf2af867c9cbef40e2a0317e9bafb894697d43829a7635b4cc76b70a0
MD5 1aa0ebbddc2fea09466a9ffb449f7c24
SHA1 12f5606558998fc937578df869ad548017df06c3
SHA512 8a3889fc81c0ec68fc92868153f909b3025ff6f405ab1f941ce07c083752527a20575df367bbe82f37805d784069859b63c63c721a0093ab7fc030bb5e91ce45
SSDEEP 393216:pObYcuKh1Qg75KUy2ZVQbUHmoYPDWFesJ0CMPIjpmUv4GTMeG6jHvSCeEWHtGvnc:kuKhCg7sjIC0PKWFesax8uGQeHjHvSzv
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unconfirmed 870302.crdownload

Path C:\Users\Admin\Downloads\Unconfirmed 870302.crdownload
Size 19.7MB
SHA256 c859e7b6801f5b595b0aa77b3e03476888f0242044514af63c50f8fd8cb4eb26
MD5 89aa6864c707f6f807714ab587c6557b
SHA1 c7ab8a280c95b45fedb236eaa7f83bd844be118e
SHA512 092e52498e19b844e7d877c5795c3e2d1a2e2f72e97f9b5978abcb3da7299308108de896f130c5dba6c382df31ecf14b3fc798d26fca3b9ee05d73fe42fbf139
SSDEEP 393216:pObYcuKh1Qg75KUy2ZVQbUHmoYPDWFesJ0CMPIjpmUv4GTMeG6jHvSCeEWHtGvnY:kuKhCg7sjIC0PKWFesax8uGQeHjHvSzR
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3896-791-0x0000000005450000-0x00000000059F6000-memory.dmp

Download

memory/3896-803-0x0000000072EC0000-0x0000000073671000-memory.dmp

Download

memory/3896-789-0x00000000001E0000-0x000000000031C000-memory.dmp

Download

memory/3896-792-0x0000000004EA0000-0x0000000004F32000-memory.dmp

Download

memory/3896-793-0x0000000005110000-0x0000000005120000-memory.dmp

Download

memory/3896-794-0x0000000004F60000-0x0000000004F6A000-memory.dmp

Download

memory/3896-795-0x0000000005110000-0x0000000005120000-memory.dmp

Download

memory/3896-790-0x0000000072EC0000-0x0000000073671000-memory.dmp

Download

memory/4556-818-0x0000000072EC0000-0x0000000073671000-memory.dmp

Download

memory/4556-819-0x0000000000DC0000-0x0000000000DE4000-memory.dmp

Download

memory/4556-820-0x00000000057A0000-0x00000000057B0000-memory.dmp

Download

memory/4556-821-0x00000000057A0000-0x00000000057B0000-memory.dmp

Download

memory/4556-822-0x00000000057A0000-0x00000000057B0000-memory.dmp

Download

memory/4556-841-0x0000000072EC0000-0x0000000073671000-memory.dmp

Download

Resubmissions

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads