Analysis

  • max time kernel
    909s
  • max time network
    852s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240221-en
  • resource tags

    arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    08-04-2024 03:31

General

  • Target

    https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Trojan/MrsMajors/MrsMajor3.0.exe

Score
10/10

Malware Config

Signatures

  • UAC bypass 3 TTPs 1 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 1 IoCs
  • Obfuscated with Agile.Net obfuscator 2 IoCs

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • NTFS ADS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 15 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 35 IoCs
  • Suspicious use of SendNotifyMessage 12 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 2 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Trojan/MrsMajors/MrsMajor3.0.exe
    1⤵
    • Enumerates system info in registry
    • NTFS ADS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2552
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffde6643cb8,0x7ffde6643cc8,0x7ffde6643cd8
      2⤵
        PID:1948
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1940,11747388820637073806,5138918148196656809,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2068 /prefetch:2
        2⤵
          PID:1440
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1940,11747388820637073806,5138918148196656809,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:3808
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1940,11747388820637073806,5138918148196656809,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2756 /prefetch:8
          2⤵
            PID:4092
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,11747388820637073806,5138918148196656809,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3192 /prefetch:1
            2⤵
              PID:3056
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,11747388820637073806,5138918148196656809,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
              2⤵
                PID:3340
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1940,11747388820637073806,5138918148196656809,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5244 /prefetch:8
                2⤵
                • Suspicious behavior: EnumeratesProcesses
                PID:1288
              • C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1940,11747388820637073806,5138918148196656809,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5504 /prefetch:8
                2⤵
                • Suspicious behavior: EnumeratesProcesses
                PID:2912
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,11747388820637073806,5138918148196656809,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4948 /prefetch:1
                2⤵
                  PID:4076
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,11747388820637073806,5138918148196656809,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5212 /prefetch:1
                  2⤵
                    PID:4068
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,11747388820637073806,5138918148196656809,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
                    2⤵
                      PID:2288
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,11747388820637073806,5138918148196656809,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
                      2⤵
                        PID:2988
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,11747388820637073806,5138918148196656809,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5796 /prefetch:1
                        2⤵
                          PID:4368
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1940,11747388820637073806,5138918148196656809,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5988 /prefetch:8
                          2⤵
                            PID:3012
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1940,11747388820637073806,5138918148196656809,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5092 /prefetch:8
                            2⤵
                            • NTFS ADS
                            • Suspicious behavior: EnumeratesProcesses
                            PID:3712
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1940,11747388820637073806,5138918148196656809,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5568 /prefetch:2
                            2⤵
                            • Suspicious behavior: EnumeratesProcesses
                            PID:1432
                        • C:\Windows\System32\CompPkgSrv.exe
                          C:\Windows\System32\CompPkgSrv.exe -Embedding
                          1⤵
                            PID:2336
                          • C:\Windows\System32\CompPkgSrv.exe
                            C:\Windows\System32\CompPkgSrv.exe -Embedding
                            1⤵
                              PID:3544
                            • C:\Windows\System32\rundll32.exe
                              C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                              1⤵
                                PID:2548
                              • C:\Users\Admin\Downloads\MrsMajor3.0.exe
                                "C:\Users\Admin\Downloads\MrsMajor3.0.exe"
                                1⤵
                                • Executes dropped EXE
                                • Suspicious use of SetWindowsHookEx
                                PID:456
                                • C:\Windows\system32\wscript.exe
                                  "C:\Windows\system32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\7168.tmp\7169.tmp\716A.vbs //Nologo
                                  2⤵
                                  • UAC bypass
                                  • System policy modification
                                  PID:4640
                                  • C:\Users\Admin\AppData\Local\Temp\7168.tmp\eulascr.exe
                                    "C:\Users\Admin\AppData\Local\Temp\7168.tmp\eulascr.exe"
                                    3⤵
                                    • Executes dropped EXE
                                    • Loads dropped DLL
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:3176

                              Network

                              MITRE ATT&CK Enterprise v15

                              Replay Monitor

                              Loading Replay Monitor...

                              Downloads

                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                Filesize

                                152B

                                MD5

                                12b71c4e45a845b5f29a54abb695e302

                                SHA1

                                8699ca2c717839c385f13fb26d111e57a9e61d6f

                                SHA256

                                c353020621fa6cea80eaa45215934d5f44f181ffa1a673cdb7880f20a4e898e0

                                SHA512

                                09f0d1a739102816c5a29106343d3b5bb54a31d67ddbfcfa21306b1a6d87eaa35a9a2f0358e56cc0f78be15eeb481a7cc2038ce54d552b9b791e7bee78145241

                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                Filesize

                                152B

                                MD5

                                ce319bd3ed3c89069337a6292042bbe0

                                SHA1

                                7e058bce90e1940293044abffe993adf67d8d888

                                SHA256

                                34070e3eea41c0e180cb5541de76cea15ef6f9e5c641e922d82a2d97bdce3aa3

                                SHA512

                                d42f7fc32a337ecd3a24bcbf6cd6155852646cae5fb499003356f713b791881fc2e46825c4ff61d09db2289f25c0992c10d6fadb560a9bea33284bd5acc449f7

                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                Filesize

                                1KB

                                MD5

                                d38148a61f16e491a95888989166e138

                                SHA1

                                c77a16d85ffb0a33d7762c847d3912cbddaf29b1

                                SHA256

                                ffa56f6eec9c3d536ba81623d93a8a20e775ae7dc41dd9853542a83441ff75fd

                                SHA512

                                c8cd32f08faadfe738b845054b1cb787d6dc7dfd018f46feedec5687d7ee4f259caa7c3e2151dbd05acd233c28dbd336de49b3626bd297ec2bd540b2913b189d

                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                Filesize

                                579B

                                MD5

                                a7d1701142cca705f833d70023ef4e1e

                                SHA1

                                1b76853132abfcddb4fefac42bf9df5d013c9815

                                SHA256

                                6c92f51e7f056e73c407228fc280cb7ca4d00ab02674d1dda4eafd7dc9f070f7

                                SHA512

                                806b7ccb375cc6116e64a9fa15229d783615d13b54cf40251561d9b664f0925915c5375ad88f5ca8d061e01367de239c29da79adf693559af53eeb7d9b1ba1a0

                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                Filesize

                                5KB

                                MD5

                                298cbca18f935e0a05978982802ac376

                                SHA1

                                5e1403e402ba0dabecf0b64c5ea1c5b548dc8e08

                                SHA256

                                bfdd42aec4f14ebeeb261a922d0c39a9b9fcf127d6e3f9e7b84b09111f231fd4

                                SHA512

                                af830f4dc60f6fcbdbb567186e1a60ecd5a93388d4621556d6286c1413ee871bc942917a526997c92af6df80a414a021d0c926eb449a2aaaf31ab3ecbf0f57cb

                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                Filesize

                                6KB

                                MD5

                                397be2b72fffbf71e04f6421fac6803f

                                SHA1

                                3a4bf725a273d0f22f91f7fa30a95dda7bc4419c

                                SHA256

                                c9e54f830df69a3a32b8c40fc8cb455b2a6614a159af7ffa30039d43875f231e

                                SHA512

                                1aa3b3f5573140a20e1694cc1e35120e17eacd4e021e46aef0fb454e5239e8de4ef71e629a0d0dad3bd4e4e7e6eeb0e3c7b08e9f0941b77329b2d47faed458aa

                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                Filesize

                                6KB

                                MD5

                                e0b2a1ecdc4719d749b26ea7d1dda95f

                                SHA1

                                ae7eb6caf60a42e4d5fd5bc2160c24d3bb5f4c98

                                SHA256

                                2d2197dcd9a9db91f8e4b9d0f119c6fb67f49f22b3ec91d5d46918fabcc8ddd8

                                SHA512

                                fed0f9be549a246f3fad65184960f3e8b25e312434324a14998e970ebb03da5e4a18a8ba217d488922d3bddeefb8ec94037102cb6c473a5ecf77e7af080cf503

                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                Filesize

                                1KB

                                MD5

                                f5e6052297f4b5e54d52ccfab63b7c99

                                SHA1

                                d34d5729e897384afff9f30924b450e0d6952999

                                SHA256

                                73081a30ae403430da93b6c18f06504beed563ce06b93160ed0d58a20f247cb3

                                SHA512

                                be226f1d77f1cbabcc6d8c4979b65014e35408e09cba953b48ecd809e44cce0529c7b53622892dce72e28b637e54a9e768cb4664cf87cb1ee00c67180e36525e

                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                Filesize

                                1KB

                                MD5

                                243c35ad706d5174e1b8338cdf27241f

                                SHA1

                                f19a93b055b8612438c19b477b69875f2eb7743e

                                SHA256

                                38b43f480fcfa985ba9f8d6eb0646965c9c2feb5cfb083f9e3ccffc281fe7dbd

                                SHA512

                                ef49a71aeb20e51eaadbd0bf98088ebe2644496b6677b5864f407c02d83e04a79a56b98f6116a5dd6a1f011d45118f502b0ea7a6a449ede8d6137a856a99f2e9

                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe585724.TMP

                                Filesize

                                874B

                                MD5

                                54f27931251ab9413834aa0df9ffbdce

                                SHA1

                                fbdfd74b97a6aca3659b4b8fd3adebe03eea7a57

                                SHA256

                                5de4acd5c03dee98b72f827cf8979c7d29a2d67643b5a5723e54ec886fca9b23

                                SHA512

                                489615ef6b64b3e2751db29223c1097f9756bbd9d2178c6331092a1cc94e5e2665eedb09cc2c9c3d0c7ac94fb9ce17032aff30e0197625e8b54a19822bfe80fd

                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                Filesize

                                16B

                                MD5

                                6752a1d65b201c13b62ea44016eb221f

                                SHA1

                                58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                SHA256

                                0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                SHA512

                                9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                Filesize

                                11KB

                                MD5

                                f011fe3e79610f5fa37904dbb46a3ade

                                SHA1

                                74e6607f355871f9daab0fbbe2042689774e1f9c

                                SHA256

                                34f78201391346b36c913a9562826bc38c7276514a9a7d075ebc7ef741ba85c9

                                SHA512

                                88c03dfcd8dd4251e1aabba5a512c7d0917238ecc23fba694d60e194e25e0735c6999e6df3bdf4e1ac49afa8f6be0331f9bfdf2ea2341d07a26cf62475050da1

                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                Filesize

                                11KB

                                MD5

                                ea9142ae7cff623d6d119b4ace03e103

                                SHA1

                                c6bad69c7963ac8981227b6cf790d1bb2a8b5fad

                                SHA256

                                aba75227158dead17c82ed9de7db5aa85c9f33d87abbdebbef61a12dd553ecc5

                                SHA512

                                22f4b70edfe31eb477e1444dc716efaa4067ee0eda6f6e3ec1afff352800474608616c5507266c3e11fae5f41cf0a4769bdcdd9b63f521a659bb66af122b21e1

                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                Filesize

                                11KB

                                MD5

                                2960e90a2f063cc0288bff03e3009e90

                                SHA1

                                9c316b0d157dcb39882b84be0c1030970ad63e72

                                SHA256

                                06e02930f62563d7fd645849e590e88a68c2d92bdc74c8705a66df05722d8b90

                                SHA512

                                41a6c6d05d3e49510b5d2ac295ae827f36ea7806725fef3ea529fcb5459ca5bc3f3d2c1b864dec31ee8d0acb66e6ac4dd43c89888d1dff2dfd02f163445807b1

                              • C:\Users\Admin\AppData\Local\Temp\5a530dfd-bc51-4992-a05d-f09d41a331d4\AgileDotNetRT64.dll

                                Filesize

                                75KB

                                MD5

                                42b2c266e49a3acd346b91e3b0e638c0

                                SHA1

                                2bc52134f03fcc51cb4e0f6c7cf70646b4df7dd1

                                SHA256

                                adeed015f06efa363d504a18acb671b1db4b20b23664a55c9bc28aef3283ca29

                                SHA512

                                770822fd681a1d98afe03f6fbe5f116321b54c8e2989fb07491811fd29fca5b666f1adf4c6900823af1271e342cacc9293e9db307c4eef852d1a253b00347a81

                              • C:\Users\Admin\AppData\Local\Temp\7168.tmp\7169.tmp\716A.vbs

                                Filesize

                                352B

                                MD5

                                3b8696ecbb737aad2a763c4eaf62c247

                                SHA1

                                4a2d7a2d61d3f4c414b4e5d2933cd404b8f126e5

                                SHA256

                                ce95f7eea8b303bc23cfd6e41748ad4e7b5e0f0f1d3bdf390eadb1e354915569

                                SHA512

                                713d9697b892b9dd892537e8a01eab8d0265ebf64867c8beecf7a744321257c2a5c11d4de18fcb486bb69f199422ce3cab8b6afdbe880481c47b06ba8f335beb

                              • C:\Users\Admin\AppData\Local\Temp\7168.tmp\eulascr.exe

                                Filesize

                                143KB

                                MD5

                                8b1c352450e480d9320fce5e6f2c8713

                                SHA1

                                d6bd88bf33de7c5d4e68b233c37cc1540c97bd3a

                                SHA256

                                2c343174231b55e463ca044d19d47bd5842793c15954583eb340bfd95628516e

                                SHA512

                                2d8e43b1021da08ed1bf5aff110159e6bc10478102c024371302ccfce595e77fd76794658617b5b52f9a50190db250c1ba486d247d9cd69e4732a768edbb4cbc

                              • C:\Users\Admin\Downloads\MrsMajor3.0.exe:Zone.Identifier

                                Filesize

                                238B

                                MD5

                                b7145cef3f0c759438b5547a3a56619c

                                SHA1

                                fd6d7d0b90e4085ec8bc1bfe659485e1a2864374

                                SHA256

                                725f1be64505447622ba3b487a2cf59e17bc8e908407d1c22113138093fed832

                                SHA512

                                8839326e8e11fe3d7ba64c6cad5e578b782e73265c514459d06470310135e99eb854c3610660f7181ec4454781d61d9be1d4ced3f8614c23f44cab081432de02

                              • C:\Users\Admin\Downloads\Unconfirmed 584737.crdownload

                                Filesize

                                381KB

                                MD5

                                35a27d088cd5be278629fae37d464182

                                SHA1

                                d5a291fadead1f2a0cf35082012fe6f4bf22a3ab

                                SHA256

                                4a75f2db1dbd3c1218bb9994b7e1c690c4edd4e0c1a675de8d2a127611173e69

                                SHA512

                                eb0be3026321864bd5bcf53b88dc951711d8c0b4bcbd46800b90ca5116a56dba22452530e29f3ccbbcc43d943bdefc8ed8ca2d31ba2e7e5f0e594f74adba4ab5

                              • \??\pipe\LOCAL\crashpad_2552_AFTVLLKRRJMWDMNF

                                MD5

                                d41d8cd98f00b204e9800998ecf8427e

                                SHA1

                                da39a3ee5e6b4b0d3255bfef95601890afd80709

                                SHA256

                                e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                SHA512

                                cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                              • memory/3176-313-0x00007FFDD1F70000-0x00007FFDD2A32000-memory.dmp

                                Filesize

                                10.8MB

                              • memory/3176-306-0x0000000000CB0000-0x0000000000CDA000-memory.dmp

                                Filesize

                                168KB

                              • memory/3176-314-0x00007FFDD2B10000-0x00007FFDD2C5F000-memory.dmp

                                Filesize

                                1.3MB

                              • memory/3176-315-0x000000001B8F0000-0x000000001B900000-memory.dmp

                                Filesize

                                64KB

                              • memory/3176-316-0x000000001B8F0000-0x000000001B900000-memory.dmp

                                Filesize

                                64KB

                              • memory/3176-317-0x000000001D610000-0x000000001D7D2000-memory.dmp

                                Filesize

                                1.8MB

                              • memory/3176-318-0x000000001DD10000-0x000000001E238000-memory.dmp

                                Filesize

                                5.2MB

                              • memory/3176-319-0x00007FFDD1F70000-0x00007FFDD2A32000-memory.dmp

                                Filesize

                                10.8MB

                              • memory/3176-321-0x00007FFDD1F70000-0x00007FFDD2A32000-memory.dmp

                                Filesize

                                10.8MB