e1a6ac0e4c61d70372f38c077d418638c1cb92bf673b703fd1faf7da1fefa119

Resubmissions

12/07/2024, 02:41

240712-c6geksvgjj8

12/07/2024, 02:37

240712-c381esvfln10

12/07/2024, 00:22

240712-anxmqstbjc4

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
12/07/2024, 02:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
evw_free_easeus.exe
Size 100.3MB
Sample240712-c381esvfln
SHA256 e1a6ac0e4c61d70372f38c077d418638c1cb92bf673b703fd1faf7da1fefa119
MD5 b56d44cf11a1ffe76a113ffc4b4b141e
SHA1 2f81cb92ad17eeb6553277d6592b1196bddcb5d7
SHA512 cf94fb94ff91613e7d8d629596f32e4c5e8368f184b516e97673019da887bdb6a6c0e38461c3c143f645a0740b7e4297ad5ced5c211afb3eaa500c990256c8fa
SSDEEP 1572864:DKPx2SvzVU9oXaea3UNAo9Ugem0rI374AQEkB0J6vm5FCtYmn4I8gK2Xia:uuOackxrI7t6vOwbnp8g3XD
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

agilenet evasion trojan

Malware Config

Signatures

UAC bypass 3 TTPs 2 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wscript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wscript.exe

Obfuscated with Agile.Net obfuscator 2 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

resource	yara_rule
behavioral2/files/0x000700000002360c-20787.dat	agile_net
behavioral2/memory/17756-20790-0x00000000004A0000-0x00000000004CA000-memory.dmp	agile_net

Downloads MZ/PE file

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service

T1102

flow	ioc
108	raw.githubusercontent.com
109	raw.githubusercontent.com
122	drive.google.com
123	drive.google.com

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\Control Panel\International\Geo\Nation	wscript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\Control Panel\International\Geo\Nation	MrsMajor3.0.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\Control Panel\International\Geo\Nation	MrsMajor3.0.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\Control Panel\International\Geo\Nation	wscript.exe

Executes dropped EXE 10 IoCs

pid	Process
4404	evw_free_easeus.tmp
3116	InfoForSetup.exe
4368	AliyunWrapExe.Exe
2540	InfoForSetup.exe
3444	AliyunWrapExe.Exe
3516	InfoForSetup.exe
17528	MrsMajor3.0.exe
17608	MrsMajor3.0.exe
17756	eulascr.exe
16724	eulascr.exe

Loads dropped DLL 7 IoCs

pid	Process
3116	InfoForSetup.exe
2540	InfoForSetup.exe
4368	AliyunWrapExe.Exe
3444	AliyunWrapExe.Exe
3516	InfoForSetup.exe
17756	eulascr.exe
16724	eulascr.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1176886754-713327781-2233697964-1000\{F0EDF8F3-95DF-475F-9718-1EA71EECA552}	msedge.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 205556.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 686498.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
11528	msedge.exe
11528	msedge.exe
10168	msedge.exe
10168	msedge.exe
784	identity_helper.exe
784	identity_helper.exe
12652	msedge.exe
12652	msedge.exe
17368	msedge.exe
17368	msedge.exe
6676	msedge.exe
6676	msedge.exe
24732	msedge.exe
24732	msedge.exe
24732	msedge.exe
24732	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

pid	Process
10168	msedge.exe
10168	msedge.exe
10168	msedge.exe
10168	msedge.exe
10168	msedge.exe
10168	msedge.exe
10168	msedge.exe
10168	msedge.exe
10168	msedge.exe
10168	msedge.exe
10168	msedge.exe
10168	msedge.exe
10168	msedge.exe
10168	msedge.exe
10168	msedge.exe
10168	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	16724	eulascr.exe

Suspicious use of FindShellTrayWindow 50 IoCs

pid	Process
10168	msedge.exe
10168	msedge.exe
10168	msedge.exe
10168	msedge.exe
10168	msedge.exe
10168	msedge.exe
10168	msedge.exe
10168	msedge.exe
10168	msedge.exe
10168	msedge.exe
10168	msedge.exe
10168	msedge.exe
10168	msedge.exe
10168	msedge.exe
10168	msedge.exe
10168	msedge.exe
10168	msedge.exe
10168	msedge.exe
10168	msedge.exe
10168	msedge.exe
10168	msedge.exe
10168	msedge.exe
10168	msedge.exe
10168	msedge.exe
10168	msedge.exe
10168	msedge.exe
10168	msedge.exe
10168	msedge.exe
10168	msedge.exe
10168	msedge.exe
10168	msedge.exe
10168	msedge.exe
10168	msedge.exe
10168	msedge.exe
10168	msedge.exe
10168	msedge.exe
10168	msedge.exe
10168	msedge.exe
10168	msedge.exe
10168	msedge.exe
10168	msedge.exe
10168	msedge.exe
10168	msedge.exe
10168	msedge.exe
10168	msedge.exe
10168	msedge.exe
10168	msedge.exe
10168	msedge.exe
10168	msedge.exe
10168	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
10168	msedge.exe
10168	msedge.exe
10168	msedge.exe
10168	msedge.exe
10168	msedge.exe
10168	msedge.exe
10168	msedge.exe
10168	msedge.exe
10168	msedge.exe
10168	msedge.exe
10168	msedge.exe
10168	msedge.exe
10168	msedge.exe
10168	msedge.exe
10168	msedge.exe
10168	msedge.exe
10168	msedge.exe
10168	msedge.exe
10168	msedge.exe
10168	msedge.exe
10168	msedge.exe
10168	msedge.exe
10168	msedge.exe
10168	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3216 wrote to memory of 4404	3216	evw_free_easeus.exe	86
PID 3216 wrote to memory of 4404	3216	evw_free_easeus.exe	86
PID 3216 wrote to memory of 4404	3216	evw_free_easeus.exe	86
PID 4404 wrote to memory of 3116	4404	evw_free_easeus.tmp	88
PID 4404 wrote to memory of 3116	4404	evw_free_easeus.tmp	88
PID 4404 wrote to memory of 3116	4404	evw_free_easeus.tmp	88
PID 3116 wrote to memory of 4368	3116	InfoForSetup.exe	89
PID 3116 wrote to memory of 4368	3116	InfoForSetup.exe	89
PID 3116 wrote to memory of 4368	3116	InfoForSetup.exe	89
PID 4404 wrote to memory of 2540	4404	evw_free_easeus.tmp	90
PID 4404 wrote to memory of 2540	4404	evw_free_easeus.tmp	90
PID 4404 wrote to memory of 2540	4404	evw_free_easeus.tmp	90
PID 2540 wrote to memory of 3444	2540	InfoForSetup.exe	91
PID 2540 wrote to memory of 3444	2540	InfoForSetup.exe	91
PID 2540 wrote to memory of 3444	2540	InfoForSetup.exe	91
PID 4404 wrote to memory of 3516	4404	evw_free_easeus.tmp	92
PID 4404 wrote to memory of 3516	4404	evw_free_easeus.tmp	92
PID 4404 wrote to memory of 3516	4404	evw_free_easeus.tmp	92
PID 10168 wrote to memory of 5564	10168	msedge.exe	95
PID 10168 wrote to memory of 5564	10168	msedge.exe	95
PID 10168 wrote to memory of 11520	10168	msedge.exe	97
PID 10168 wrote to memory of 11520	10168	msedge.exe	97
PID 10168 wrote to memory of 11520	10168	msedge.exe	97
PID 10168 wrote to memory of 11520	10168	msedge.exe	97
PID 10168 wrote to memory of 11520	10168	msedge.exe	97
PID 10168 wrote to memory of 11520	10168	msedge.exe	97
PID 10168 wrote to memory of 11520	10168	msedge.exe	97
PID 10168 wrote to memory of 11520	10168	msedge.exe	97
PID 10168 wrote to memory of 11520	10168	msedge.exe	97
PID 10168 wrote to memory of 11520	10168	msedge.exe	97
PID 10168 wrote to memory of 11520	10168	msedge.exe	97
PID 10168 wrote to memory of 11520	10168	msedge.exe	97
PID 10168 wrote to memory of 11520	10168	msedge.exe	97
PID 10168 wrote to memory of 11520	10168	msedge.exe	97
PID 10168 wrote to memory of 11520	10168	msedge.exe	97
PID 10168 wrote to memory of 11520	10168	msedge.exe	97
PID 10168 wrote to memory of 11520	10168	msedge.exe	97
PID 10168 wrote to memory of 11520	10168	msedge.exe	97
PID 10168 wrote to memory of 11520	10168	msedge.exe	97
PID 10168 wrote to memory of 11520	10168	msedge.exe	97
PID 10168 wrote to memory of 11520	10168	msedge.exe	97
PID 10168 wrote to memory of 11520	10168	msedge.exe	97
PID 10168 wrote to memory of 11520	10168	msedge.exe	97
PID 10168 wrote to memory of 11520	10168	msedge.exe	97
PID 10168 wrote to memory of 11520	10168	msedge.exe	97
PID 10168 wrote to memory of 11520	10168	msedge.exe	97
PID 10168 wrote to memory of 11520	10168	msedge.exe	97
PID 10168 wrote to memory of 11520	10168	msedge.exe	97
PID 10168 wrote to memory of 11520	10168	msedge.exe	97
PID 10168 wrote to memory of 11520	10168	msedge.exe	97
PID 10168 wrote to memory of 11520	10168	msedge.exe	97
PID 10168 wrote to memory of 11520	10168	msedge.exe	97
PID 10168 wrote to memory of 11520	10168	msedge.exe	97
PID 10168 wrote to memory of 11520	10168	msedge.exe	97
PID 10168 wrote to memory of 11520	10168	msedge.exe	97
PID 10168 wrote to memory of 11520	10168	msedge.exe	97
PID 10168 wrote to memory of 11520	10168	msedge.exe	97
PID 10168 wrote to memory of 11520	10168	msedge.exe	97
PID 10168 wrote to memory of 11520	10168	msedge.exe	97
PID 10168 wrote to memory of 11520	10168	msedge.exe	97
PID 10168 wrote to memory of 11528	10168	msedge.exe	98
PID 10168 wrote to memory of 11528	10168	msedge.exe	98
PID 10168 wrote to memory of 11596	10168	msedge.exe	99
PID 10168 wrote to memory of 11596	10168	msedge.exe	99

System policy modification 1 TTPs 4 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System	wscript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wscript.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System	wscript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wscript.exe

C:\Users\Admin\AppData\Local\Temp\evw_free_easeus.exe
"C:\Users\Admin\AppData\Local\Temp\evw_free_easeus.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3216
- C:\Users\Admin\AppData\Local\Temp\is-ELR0L.tmp\evw_free_easeus.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-ELR0L.tmp\evw_free_easeus.tmp" /SL5="$401CC,104171621,1181184,C:\Users\Admin\AppData\Local\Temp\evw_free_easeus.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4404
- - C:\Users\Admin\AppData\Local\Temp\is-J7RUV.tmp\InfoForSetup.exe
    "C:\Users\Admin\AppData\Local\Temp\is-J7RUV.tmp\InfoForSetup.exe" /UninstallStart "C:\Users\Admin\AppData\Local\Temp\is-J7RUV.tmp"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:3116
  - - C:\Users\Admin\AppData\Local\Temp\is-J7RUV.tmp\AliyunWrapExe.Exe
      C:\Users\Admin\AppData\Local\Temp\is-J7RUV.tmp\AliyunWrapExe.Exe /RunInTemp
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:4368
- - C:\Users\Admin\AppData\Local\Temp\is-J7RUV.tmp\InfoForSetup.exe
    "C:\Users\Admin\AppData\Local\Temp\is-J7RUV.tmp\InfoForSetup.exe" /SendInfo "Window" "" "Source" "Install" "Activity" "Click_Cancel"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2540
  - - C:\Users\Admin\AppData\Local\Temp\is-J7RUV.tmp\AliyunWrapExe.Exe
      C:\Users\Admin\AppData\Local\Temp\is-J7RUV.tmp\AliyunWrapExe.Exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:3444
- - C:\Users\Admin\AppData\Local\Temp\is-J7RUV.tmp\InfoForSetup.exe
    "C:\Users\Admin\AppData\Local\Temp\is-J7RUV.tmp\InfoForSetup.exe" /UninstallEnd
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:3516

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:10168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffb6f5846f8,0x7ffb6f584708,0x7ffb6f584718
  2⤵
  PID:5564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1992,13570313972772666039,14059732662728908563,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2060 /prefetch:2
  2⤵
  PID:11520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1992,13570313972772666039,14059732662728908563,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:11528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1992,13570313972772666039,14059732662728908563,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2696 /prefetch:8
  2⤵
  PID:11596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,13570313972772666039,14059732662728908563,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:1
  2⤵
  PID:11720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,13570313972772666039,14059732662728908563,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3396 /prefetch:1
  2⤵
  PID:11728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,13570313972772666039,14059732662728908563,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4208 /prefetch:1
  2⤵
  PID:12280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,13570313972772666039,14059732662728908563,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4992 /prefetch:1
  2⤵
  PID:12292
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1992,13570313972772666039,14059732662728908563,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3500 /prefetch:8
  2⤵
  PID:12516
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1992,13570313972772666039,14059732662728908563,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3500 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,13570313972772666039,14059732662728908563,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5280 /prefetch:1
  2⤵
  PID:1296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,13570313972772666039,14059732662728908563,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5264 /prefetch:1
  2⤵
  PID:13164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1992,13570313972772666039,14059732662728908563,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5424 /prefetch:8
  2⤵
  PID:12656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1992,13570313972772666039,14059732662728908563,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5624 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:12652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,13570313972772666039,14059732662728908563,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5736 /prefetch:1
  2⤵
  PID:12996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,13570313972772666039,14059732662728908563,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5136 /prefetch:1
  2⤵
  PID:23776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,13570313972772666039,14059732662728908563,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5500 /prefetch:1
  2⤵
  PID:23764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=1992,13570313972772666039,14059732662728908563,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5332 /prefetch:8
  2⤵
  PID:17348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,13570313972772666039,14059732662728908563,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5644 /prefetch:1
  2⤵
  PID:17356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1992,13570313972772666039,14059732662728908563,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5736 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:17368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,13570313972772666039,14059732662728908563,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4460 /prefetch:1
  2⤵
  PID:6480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1992,13570313972772666039,14059732662728908563,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6312 /prefetch:8
  2⤵
  PID:6576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1992,13570313972772666039,14059732662728908563,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6432 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6676
- C:\Users\Admin\Downloads\MrsMajor3.0.exe
  "C:\Users\Admin\Downloads\MrsMajor3.0.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:17528
- - C:\Windows\system32\wscript.exe
    "C:\Windows\system32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\4164.tmp\4175.tmp\4176.vbs //Nologo
    3⤵
    - UAC bypass
    - Checks computer location settings
    - System policy modification
    PID:17616
  - - C:\Users\Admin\AppData\Local\Temp\4164.tmp\eulascr.exe
      "C:\Users\Admin\AppData\Local\Temp\4164.tmp\eulascr.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:17756
- C:\Users\Admin\Downloads\MrsMajor3.0.exe
  "C:\Users\Admin\Downloads\MrsMajor3.0.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:17608
- - C:\Windows\system32\wscript.exe
    "C:\Windows\system32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\422F.tmp\4230.tmp\4231.vbs //Nologo
    3⤵
    - UAC bypass
    - Checks computer location settings
    - System policy modification
    PID:17724
  - - C:\Users\Admin\AppData\Local\Temp\422F.tmp\eulascr.exe
      "C:\Users\Admin\AppData\Local\Temp\422F.tmp\eulascr.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of AdjustPrivilegeToken
      PID:16724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,13570313972772666039,14059732662728908563,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5816 /prefetch:1
  2⤵
  PID:6816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1992,13570313972772666039,14059732662728908563,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6080 /prefetch:8
  2⤵
  PID:6924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,13570313972772666039,14059732662728908563,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6224 /prefetch:1
  2⤵
  PID:6984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,13570313972772666039,14059732662728908563,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3008 /prefetch:1
  2⤵
  PID:24580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1992,13570313972772666039,14059732662728908563,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5816 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:24732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,13570313972772666039,14059732662728908563,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6724 /prefetch:1
  2⤵
  PID:24752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,13570313972772666039,14059732662728908563,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6748 /prefetch:1
  2⤵
  PID:24760

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:11792

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:11972

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

eulascr.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\eulascr.exe.log
Size 1KB
SHA256 c18709d3ab63bebbbeba0791cd188db4121be8007c896a655d7f68535026cadf
MD5 8b325485d0cc4762f87c0857e27c0e35
SHA1 1514778327d7c7b705dbf14f22ff9d8bdfdca581
SHA512 9bf9da14e50301d68246dc9f3a21319a8fbfc866d5b57ee44cd9ed96c1a6dfecabcec06b66be5ec5625ff708d460e23d00849c581957ab84c4f2941cee07ff33
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 c3b5deb970d0f06a05c8111da90330ffe25da195aafa4e182211669484d1964b
MD5 10fa19df148444a77ceec60cabd2ce21
SHA1 685b599c497668166ede4945d8885d204fd8d70f
SHA512 3518ce16fef66c59e0bdb772db51aeaa9042c44ca399be61ca3d9979351f93655393236711cf2b1988d5f90a5b9318a7569a8cef3374fc745a8f9aa8323691ef
MD5 SHA1 SHA512

Submit Download

f_000002

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002
Size 64KB
SHA256 34013d7f3f0186a612bef84f2984e2767b32c9e1940df54b01d5bd6789f59e92
MD5 d6b36c7d4b06f140f860ddc91a4c659c
SHA1 ccf16571637b8d3e4c9423688c5bd06167bfb9e9
SHA512 2a9dd9352298ec7d1b439033b57ee9a390c373eeb8502f7f36d6826e6dd3e447b8ffd4be4f275d51481ef9a6ac2c2d97ef98f3f9d36a5a971275bf6cee48e487
SSDEEP 1536:Lm4AGqOak9IP5qOYV7SofryJiRB3xVcVXsIBGCrmQR:LITk4qOq2oDwuhpDCaQR
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000003

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003
Size 67KB
SHA256 33a84dec02c65acb6918a1ae82afa05664ee27ad2f07760e8b008636510fd5bf
MD5 9e3f75f0eac6a6d237054f7b98301754
SHA1 80a6cb454163c3c11449e3988ad04d6ad6d2b432
SHA512 5cea53f27a4fdbd32355235c90ce3d9b39f550a1b070574cbc4ea892e9901ab0acace0f8eeb5814515ca6ff2970bc3cc0559a0c87075ac4bb3251bc8eaee6236
SSDEEP 1536:fEi8zXSHK4iUHJJeQUzFPM2q/fvK6kqPy4Y1RZzQMPGmrrelJlHTNd:fEqH0U/LUJ8fvRkq64Y1/zzOMrelJJv
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000004

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004
Size 41KB
SHA256 615520069a22132aa4e2e822eaffa71859512f2df84f7eaf34a4f31852f41b5c
MD5 6d3c25de294d27958fe9151879026fe1
SHA1 d26788a3d86a71397fa2dfbcd8f66264f8071507
SHA512 6600537c5e08845f35cea335077d4321a77fc1c1c7d270202e4f15a6cc3521beff35b033097134dc5fc3d171abf4fba9f55cde0b8fb93ff4b9995be3b847d3b7
SSDEEP 768:MiwWchp3I7Eas/jQEUHuBojqQKOwV2XYRFyJmhlDjkOIgEvQta1:M7WkY7SjQPHOR/V5R0JADQgE441
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000005

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005
Size 63KB
SHA256 c0997474b99524325dfedb5c020436e7ea9f9c9a1a759ed6daf7bdd4890bdc2b
MD5 710d7637cc7e21b62fd3efe6aba1fd27
SHA1 8645d6b137064c7b38e10c736724e17787db6cf3
SHA512 19aa77bed3c441228789cf8f931ca6194cc8d4bc7bb85d892faf5eaeda67d22c8c3b066f8ceda8169177da95a1fe111bd3436ceeaf4c784bd2bf96617f4d0c44
SSDEEP 1536:ZNIPgrq59wJU9Czk2BFfKoUwOGeoDfEge1gS+UYSdU6D+sNZnwbo2Fa:TI4S67kEfU11yqlYS1/NZyo2Q
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000006

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006
Size 19KB
SHA256 381396157ed5e8021dd8e660142b35eb71a63aecd33062a1103ce9c709c7632c
MD5 76a3f1e9a452564e0f8dce6c0ee111e8
SHA1 11c3d925cbc1a52d53584fd8606f8f713aa59114
SHA512 a1156a907649d6f2c3f7256405d9d5c62a626b8d4cd717fa2f29d2fbe91092a2b3fdd0716f8f31e59708fe12274bc2dea6c9ae6a413ea290e70ddf921fe7f274
SSDEEP 384:OdEDMO3OT070pXDaeGj7ZDghRm9nyj4uIttWEDh2dvFBbUDfgAU:OiDM8OTE0pTal3Bg+9n2pItt7d2dLbgy
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000007

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007
Size 88KB
SHA256 b18b9eb934a5b3b81b16c66ec3ec8e8fecdb3d43550ce050eb2523aabc08b9cd
MD5 b38fbbd0b5c8e8b4452b33d6f85df7dc
SHA1 386ba241790252df01a6a028b3238de2f995a559
SHA512 546ca9fb302bf28e3a178e798dd6b80c91cba71d0467257b8ed42e4f845aa6ecb858f718aac1e0865b791d4ecf41f1239081847c75c6fb3e9afd242d3704ad16
SSDEEP 1536:WwVbiMNFmJrBrbhiWu0FKK9fLRXT+FjhwTn1sH5J3iotwUB4xzjIRB9h:zVOiFWwg3Rjm1wRW5JSywbo9h
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000009

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009
Size 1.2MB
SHA256 b2be2096fe98a9b55d92512ae7859e8ba6a54be03afd7eb454b220f9ed888ec8
MD5 32f58aaf5a515bdbb3d13f72879d2bf0
SHA1 1742585148dcce5d9a85464fdc5b25f394e4736b
SHA512 28c693e9a85da7cd7441209c60c4da4b9b6b7da7555c86c2039387b470c453a474a07597069959cccc2840360f76dbb307f88a77e52248adcf8de71ab99cbe19
SSDEEP 24576:cXWOGliZIXC4UItxga20Gn8mSYvfsmVzxiU75LgyqqlzYa02aD4yxSXp:cGOzIXC4VtbhyhvkmbiGEOzYd21yx8p
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 c786a1055a7ac702011c092866daf18daa53f0b72bfcde49eb604147fe6db1bc
MD5 2a855dad5ceea61793aab6326e789f7f
SHA1 7d1e2877906aa7aaab257bad6738c5c79982048a
SHA512 ba2414e35e97043340ffce658f7d010aa725cec0b6849bb246741d800850fff63d350c7f8a94c778ea4c11082e66dcb15f7372adfa7db33efcae5135dce636bd
SSDEEP 96:JsYRog4LmEdZoxvtZ8gPr87B4T4HNrIHDcNE3rBcfI9Fl+LRmM3v984CVYPLRLvR:Jskgms07dKYXAR0IpxZeqN
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 111B
SHA256 aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
MD5 807419ca9a4734feaf8d8563a003b048
SHA1 a723c7d60a65886ffa068711f1e900ccc85922a6
SHA512 f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 862B
SHA256 9353874d55cc17c4295f114088e7d9617d92357b292f909e882015f920b23497
MD5 50bea261d8deb68238615c57e92fada7
SHA1 1b5845c22df6914e8406d775459e3897ef5581bf
SHA512 76e4c8ff50f7b5fc9615550c835c6145a61c9b1eb19b6b3a4a3f10389b09c1b5ccd0842a81ccc563c2530170e773b227c3f1b41c34e9bc7c26e6aca61c866725
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 e489027eb0d281f00bf92c8ea165d63f853d32df657c79fbf81f814faeb71e97
MD5 dc6336678409520767e65973577b4625
SHA1 5d06b2612d6eb97adaeb81a0379017d0cacf8fb6
SHA512 7dbb33ebcecd0cdca4dd14e9f4254a1341ded8dc53c9daafe3b4f606ca42ecdbe8afaaf93006b99a26158fe76324877910318534945ab52d310456705e9dea96
SSDEEP 96:nTk3xm/vQYmqr1vPwpvWMoiVmdeHjsFKZe9UWQyV+VDCziEwb:nTkckYJPGWMXQh9ro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 1bae89398e3d66c5f3e8e87790d1ee5d86e75b0d430e3b803722d922e3129f3b
MD5 37529d14738a743d0214d940f0d29fb9
SHA1 16f1663b448129338bf2b226a80d7f35352bc8ad
SHA512 13f88d4eef2a87a97fc501ec49bdc4d29eab82b96370a1bcfdbbaa39e66b03778153103c10e4ae72391d7ab40a871e5340e1d29c9f9cadfd1c4f8fbe33cc73a7
SSDEEP 96:nTkBxm/vDmqr1DnwpwmWMoiVmdeNu11jjsFKPe9UWQyV+VD7AiEwb:nTk6iYZnXmWM9u1hQl9rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 6f45f48372505d589ac73cbfaaa47a26d3de07ddd73339d2c6cb2f973c112b5a
MD5 9cab3c694b2489aec0305d834da3ebda
SHA1 9e21054b9e4f4aaa2fe793b7b6f036e4c9afef18
SHA512 df72cc4f78e1a42b0ed420a7824df3472b26861a13951be0f5e233476087ef960b1a20ff4e457b50a11a09df47fd5a0c83be9f32ed6736e34e1a822d0fcc4af2
SSDEEP 96:nTkBxm/vamqr1DNwpVJWMoiVmdeNu11jjsFKPe9UWQyV+VD7AiEwb:nTk6RYZNWJWM9u1hQl9rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 1bf1ca6ed74fc045246a82dd201fd2dc96313c3a384e487c7cfb4270c6214aa3
MD5 2a405d3dc2c618b5f342950f674395c5
SHA1 4f67e6676cbfe4d114cbb1e948aef06bd886225a
SHA512 ef56bdec8093b980a4609cf53e23a95a28390db57f23d216d1f380d0fbf3ffd781481bb11a0c2bda71a69db12144475d71bf59b963268d3b24d5e844aea6ca28
SSDEEP 96:nTk8sQDxm/vamqr1DNwpVJWMoiVmdeUlswd/u11jjsFKJe9UWQyV+VD7AiEwb:nTk/RYZNWJWMElswJu1hQb9rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 a3643357e5020360f74da4da60eeec622fed3098884ef463cc80165cba96d665
MD5 65b758454f81590a0dcd29b8f30ea715
SHA1 f2de8e31dd359b8a868a0a80107a6770b9830491
SHA512 9abead3c1877b30bce2e7edf1694747576a633c9d09f0749a0a59a8ea7e902a58469f19ec330301cd4135d99a841f27b416b16f9eeb346a0fb4aa932014b24a9
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 e2d0320ab9dd7d23cd7496cf28870a484a6d03a6f2fe4f3d6e8fca7e57fc19f8
MD5 5c43830230b42f3de1fa0d5c52046be7
SHA1 8a556fcea6abff071cc30e542551a1f1a35e49bc
SHA512 37302a886b85f5381d272b6af5b94a25e36818119187831beb1e94602f5c888d52f18de37f89d40a1ca549d9369ab056a25f7fd9c8eb1623acfa54e54b1e666d
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 f3931f5a10169d392bb513290df1abff05695e1fc7e7a84cef400337fc58b7c7
MD5 7ceeb434a236b2cd31bf6b0d7fa5ea1d
SHA1 2b484e3c82492473ee22b9160807897d7c2f058b
SHA512 b8d6ad6638a0ae1884ef32a6e12f550282a44229c2b5f7a5d6d126216f8aae2da41b697e9037fbd6ef127e39154d3e7f7cc6901f0d16ca470091cfba1dfe5a2f
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 c4b184e3bae060544671996962e41d3453feacc0b93361ca2a4c76fd633643c9
MD5 a53154ed3997df5ec386a99399b575dd
SHA1 e20126a48f16d10510952ad044ddde47c1b12e44
SHA512 82e71a9ea0fd5d746de4553bf827229eb133122908f9efc93370df50be3c7dc6374ca021a45cdd044fe5af40d1e720340f97e3679bbc72b6b49803ec1a99534e
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 50953b2d32e1733f443136c4df8e69f0b56a960f9fd97c10d11a61b0af467c9d
MD5 9f68727dd56cc6ff67e066393014667c
SHA1 612876331067485179022eaa0a4db8e78a58d998
SHA512 afe20fd9dbeb3315798575a6643d61324315f369e2f57d82bad357144b524a31cd10ba0727855ba9a69cc114b4b1a00b47c47b44882a4747b5b96f85743c7836
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 3b36e79f78e09eabd86a2e9cbbc78d720b7ff7a1399f4b15425a7634284253c7
MD5 23a339d4575a3c792a15c41636533c91
SHA1 2da0e262d19e046006ec3b4c8f317d46434c072e
SHA512 8f2b3c7be5fe9deca00aa666c3054c1037f3d2b18d84662657adde6d92fbe7a690f61b5b909a4532c70aaae9e71a2a1c37177facaf809d0cd2ac686add600edd
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 897a330b7fc81fff0183941d86540971fe25fb3f9c1030dc2ae067d6524de83b
MD5 852f12b875cf3b26bf49ee8e186ec85e
SHA1 d3b2d08ea9f83380a3ddd3a709396d9a1c3b040e
SHA512 4037a61df45593390ef95e9343a7983768fbcb8bbfdb0f25dc0a80ff953aef2c2df4162f0c3e95144b2b0c79479bbd47ac1dd28b6442d42fe5b8fe6f205a8c4f
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe588299.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe588299.TMP
Size 538B
SHA256 1103bf672a63d641b06e3de936e1608a5300247d878ce2faf330dd65ef27fdc0
MD5 3346545fe8d852b1983e02a93d797810
SHA1 c0d1e4aebfc3de301e1f25661eb16371641e0561
SHA512 89d1e07e523d62b243d1377e96d15b5b41d017b2b220a790e29f66df121022f3244c61de0129ab218f3ee26b5c054c7e153351be46868d3de5b6a85306787f32
MD5 SHA1 SHA512

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\blob_storage\830b68d7-b5da-44fc-8b66-328db4fc7e3c\0
Size 17.4MB
SHA256 2b2fbdc7cec2c59c3e7c512a76e827e6121bdea176488d44a9783d90d0d444de
MD5 1073e757fc71b26db6ab725bb7d2498c
SHA1 caec5dfc64b5826042bdedba20adc228bfa5b657
SHA512 cd2e5868004a7aa44b202104face31910a0629d89146b779826957e716775e638defcdb2da21ed3fd2a83b88f08d8db28086888f97388f969c11b27fe972f69f
SSDEEP 393216:0s1y9Zku3tDLBu73kT9KVlJnw+5OGSXXjHyjptZoaV+5YsckLt:0sM9iUtDLBUkTgt5OGSXXjmeWt3kLt
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 1b3227688d8cf71a124e1eab6f295d2fcc8f45d82a32d243b0deaebd84966ed8
MD5 428f626d5a574ad4fc0368240d03346c
SHA1 206a35e2e35701a002259d9c4253202e7a032d96
SHA512 d4ab1aa22096a4ad62e084126ecd9b5f83e483b7b0d7d6ec4dc8b5a888061cfc4bfc5188434d3c2d8afdb0b50f6c148c9ca41f0a22012b5e4153b531ccc88d10
SSDEEP 192:1oCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupDET5lui2RU6S6n5o+DLgcp:59iIxuERzA83h09RZxY4lE9HLDEhk5x
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 6d14ffdae33a01e697c2b29804f3b75e7c42268d3f3e9daf3b19ba60aec9bad3
MD5 ad8ea8fac63c6585a1ef712f1688bada
SHA1 9c601c264395b4e708f5d2c6b1311dad6e2f83be
SHA512 1f2ba8d53a6e10c18235eb998e9bd6bce6ed0c38494a07ad10f5dfba88dc7e4b94f07851cda24fdfc8d06e68a92c08953bab5fc5f72184df454c893ecd5b2815
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupDET5lni2RUwH+MLgcTzwxW:A9iIxuERzA83h09RZxY4lV4MEhk5x
MD5 SHA1 SHA512 SSDEEP

Submit Download

4176.vbs

Path C:\Users\Admin\AppData\Local\Temp\4164.tmp\4175.tmp\4176.vbs
Size 352B
SHA256 ce95f7eea8b303bc23cfd6e41748ad4e7b5e0f0f1d3bdf390eadb1e354915569
MD5 3b8696ecbb737aad2a763c4eaf62c247
SHA1 4a2d7a2d61d3f4c414b4e5d2933cd404b8f126e5
SHA512 713d9697b892b9dd892537e8a01eab8d0265ebf64867c8beecf7a744321257c2a5c11d4de18fcb486bb69f199422ce3cab8b6afdbe880481c47b06ba8f335beb
MD5 SHA1 SHA512

Submit Download

eulascr.exe

Path C:\Users\Admin\AppData\Local\Temp\4164.tmp\eulascr.exe
Size 143KB
SHA256 2c343174231b55e463ca044d19d47bd5842793c15954583eb340bfd95628516e
MD5 8b1c352450e480d9320fce5e6f2c8713
SHA1 d6bd88bf33de7c5d4e68b233c37cc1540c97bd3a
SHA512 2d8e43b1021da08ed1bf5aff110159e6bc10478102c024371302ccfce595e77fd76794658617b5b52f9a50190db250c1ba486d247d9cd69e4732a768edbb4cbc
SSDEEP 3072:BYAyVvCBHAzfuYLfoG0yBH1UbGsQT5nhAcvLiHiD0QEX5wzDNAMYFNx:BnyVeALvfoLkVUbGso5nhniTP5IAlN
MD5 SHA1 SHA512 SSDEEP

Submit Download

AgileDotNetRT64.dll

Path C:\Users\Admin\AppData\Local\Temp\5a530dfd-bc51-4992-a05d-f09d41a331d4\AgileDotNetRT64.dll
Size 75KB
SHA256 adeed015f06efa363d504a18acb671b1db4b20b23664a55c9bc28aef3283ca29
MD5 42b2c266e49a3acd346b91e3b0e638c0
SHA1 2bc52134f03fcc51cb4e0f6c7cf70646b4df7dd1
SHA512 770822fd681a1d98afe03f6fbe5f116321b54c8e2989fb07491811fd29fca5b666f1adf4c6900823af1271e342cacc9293e9db307c4eef852d1a253b00347a81
SSDEEP 1536:mXvHWEbJMwk3HwGTc/1dbJ5xUSns9Ymi5j:ovHsTTI1xUSns9YmEj
MD5 SHA1 SHA512 SSDEEP

Submit Download

evw_free_easeus.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-ELR0L.tmp\evw_free_easeus.tmp
Size 3.3MB
SHA256 b43edd602df2228ade0d16a4613460d5c63871e2babd2948d02e2b2bd11a9650
MD5 2ebd137405a503b495919dc93f1b6597
SHA1 05fe5c96ad72e6304158d74cf43469cc77409b82
SHA512 81d4974439232f86e9ed142edc4f90144fc09bc137d3e2b9f39a7de9f3a37ea984eefb2e89d54e55651b2f9a9f1ec18be0b0c54374a584f55cc529db7b5c9499
SSDEEP 49152:KLJwSihjOb6GLb4SKEs3DyOMC2DlUt0+yO3A32ASNTvV98YYq9A/QgRV3:WwSi0b67zeCzt0+yO3kSr98Y9iBRF
MD5 SHA1 SHA512 SSDEEP

Submit Download

AliyunConfig.ini

Path C:\Users\Admin\AppData\Local\Temp\is-J7RUV.tmp\AliyunConfig.ini
Size 1KB
SHA256 2aba45defbc61b736803d3e1ab2b3395e5cd9113c9153aef95b0b8a46b77cdbc
MD5 038065f7d9f2a740ac2b39fdef6fb2f3
SHA1 c4422da1578055605b4077c54828c44a94dc8959
SHA512 5ca48f6697fab61a6be006bb8dc7fd1765c5f475e2cfdb1d30c8dd7430058c1263a45ee3b68f8a02708effab35542975286e7579bbf22ef58d2947b741acff31
MD5 SHA1 SHA512

Submit Download

AliyunConfig.ini

Path C:\Users\Admin\AppData\Local\Temp\is-J7RUV.tmp\AliyunConfig.ini
Size 1KB
SHA256 27583b70b7907897fa366eaa49eb5c1490dbab6327c4c7f6ff4c077bef314d0c
MD5 98aa0233e7d946b53281f29bd38c6275
SHA1 c953b229f56205c4ef23bc1afdd8d9ab8e673ce6
SHA512 cd14e514262625c7867a7b44a19adc4449bb6859ef75dff206f6a52d3f968d2d6b01691e1f45cf52c21fd5a00876e6ab44fbf030a4ba441d2a6315bdcd3346bd
MD5 SHA1 SHA512

Submit Download

AliyunWrap.DLL

Path C:\Users\Admin\AppData\Local\Temp\is-J7RUV.tmp\AliyunWrap.DLL
Size 496KB
SHA256 60063b9744d1087b248018ce8ba281dde5e487bde387d335a5db81b3a34b40ad
MD5 feb90de7026629223d9022358ecfb779
SHA1 1084ee97e043a6851179b2260d77e59b29b1ec28
SHA512 a9130d3cdb3c79960aa91acb6ff6c6c87de47bd9e0a4bc1373d8265630c3d5f524573837e7f2c78bf1ca3ec064729d395a3dbd72d0917bfcf5de4d9dabff8731
SSDEEP 12288:2w/1l2eOOZ/Ql5ZWIvHdHl7EX0JbRoFO1fSBidWqYyCnwaXqHSniJ:2akdHldbXfSIWq8nwYqHtJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

AliyunWrapExe.exe

Path C:\Users\Admin\AppData\Local\Temp\is-J7RUV.tmp\AliyunWrapExe.exe
Size 113KB
SHA256 c3993933be4005aebcca5ec76a22f551ceb4173c50b212bcca0bad4ae2abb241
MD5 04e3eff9820c528d15e30bf8cd8c2749
SHA1 959706e5e6b392ed665f72b05d6f804fc6475167
SHA512 95630141a2dfb03934ff23d2affc1e9e94ffa677226076ca5d9a30aaa85c768783ef7724cbe75a12fab7e093b7be5f695189749e2a989e8161f3e51638e60070
SSDEEP 1536:1zi6uC/vfbQMj7MS3tMzm61BV5IWULiPnfBTRhLx2Wg0KzPAw6TyewvkNY5cKOE2:YSnsst4BVYLiRDfIc2ekkNY5cKBdc
MD5 SHA1 SHA512 SSDEEP

Submit Download

DataFile.ini

Path C:\Users\Admin\AppData\Local\Temp\is-J7RUV.tmp\DataFile.ini
Size 348B
SHA256 7b8ec41c0fa9cd2e9cc092e5bb2c520b4d9ab2378fe628ad7d1d1859a020bac4
MD5 95ad86b1ef79837c20c89e6a74b306a3
SHA1 5d683003001815ddd118de3a351ed360c0c89fca
SHA512 674756a8156246f94b8c758b740449ef4148c3f15eacdc4f18d427386c61b4f9ba24556160b1d31f8e4bdb451bc1c1afbb8a802480830348c22481eac4b210ae
MD5 SHA1 SHA512

Submit Download

DataFile.ini

Path C:\Users\Admin\AppData\Local\Temp\is-J7RUV.tmp\DataFile.ini
Size 88B
SHA256 ae89726af2bd0c0218fbf63af20d4464f44dced5156364d817b6e73afc8e9f87
MD5 7f411750d07619f38537e7fd612b8b44
SHA1 cda241a1ce5141288582c8f0ac4850992b427bdc
SHA512 35dad46325060004a66e01e10af6a3ebfd94b6751347b6ec64840c4ec03d81480fc324494ea39dded03bf2f1a1ce352b15ab518d14214c15567af17fb32f16b8
MD5 SHA1 SHA512

Submit Download

InfoForSetup.exe

Path C:\Users\Admin\AppData\Local\Temp\is-J7RUV.tmp\InfoForSetup.exe
Size 70KB
SHA256 0590fb0cd8d0231838543e026eb8d96084318e9d7615adaf1f68cd8b520d0ba7
MD5 b6fd7f1c6d261b15624f224eeb861693
SHA1 6c7a6163f5f359583ae50fa80e3a04ac2289d031
SHA512 438de8bdfcc647e0254caae0accccc5711cd3464ccf0a111e1673af40c1664d69c9ed4ca28a53b0cd4be42e08fa8acd8af2fe39f16969242a44a28ebfb4a17db
SSDEEP 1536:LRyA5klRkXXLaQkk9hLJ3zr4i54NDIpicx7Bvp8:LBKknLFLNr4i54NDIpiadR8
MD5 SHA1 SHA512 SSDEEP

Submit Download

tempInfo.web

Path C:\Users\Admin\AppData\Local\Temp\is-J7RUV.tmp\tempInfo.web
Size 1B
SHA256 5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9
MD5 cfcd208495d565ef66e7dff9f98764da
SHA1 b6589fc6ab0dc82cf12099d1c2d40ab994e8410c
SHA512 31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99
MD5 SHA1 SHA512

Submit Download

MrsMajor2.0.7z

Path C:\Users\Admin\Downloads\MrsMajor2.0.7z
Size 22.4MB
SHA256 0d64e4fe519291c901b67944d9215f6254552c7ea5d12cc4fc930ab58c7ca268
MD5 81041a562190fe49c0fac248638b2d04
SHA1 755d8426f18e3f0ad8e28d4655468d8cfdac67bf
SHA512 e482702b08e401de88c67a703cb1612831f0cbc9365eb2e634602712bed6ad6cfae30dd820d96001c49100420bc457af083e7c09d79d825e87fe231cc0646eb2
SSDEEP 393216:WtKthE9yk1doAs1y9Zku3tDLBu73kT9KVlJnw+5OGSXXjHyjptZoaV+5YsckLt:9nED1doAsM9iUtDLBUkTgt5OGSXXjmeJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unconfirmed 205556.crdownload

Path C:\Users\Admin\Downloads\Unconfirmed 205556.crdownload
Size 381KB
SHA256 4a75f2db1dbd3c1218bb9994b7e1c690c4edd4e0c1a675de8d2a127611173e69
MD5 35a27d088cd5be278629fae37d464182
SHA1 d5a291fadead1f2a0cf35082012fe6f4bf22a3ab
SHA512 eb0be3026321864bd5bcf53b88dc951711d8c0b4bcbd46800b90ca5116a56dba22452530e29f3ccbbcc43d943bdefc8ed8ca2d31ba2e7e5f0e594f74adba4ab5
SSDEEP 6144:Th3idhONY259BH1DzJ5PzVNtGgc+F9TBd096cTKAsLEbqqbd+VWM8AHiKn9SlXNA:Th3iXPw9Tc6kVXMHHLEf8l7
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unconfirmed 686498.crdownload

Path C:\Users\Admin\Downloads\Unconfirmed 686498.crdownload
Size 6.7MB
SHA256 4ea1f2ecf7eb12896f2cbf8683dae8546d2b8dc43cf7710d68ce99e127c0a966
MD5 f2b7074e1543720a9a98fda660e02688
SHA1 1029492c1a12789d8af78d54adcb921e24b9e5ca
SHA512 73f9548633bc38bab64b1dd5a01401ef7f5b139163bdf291cc475dbd2613510c4c5e4d7702ecdfa74b49f3c9eaed37ed23b9d8f0064c66123eb0769c8671c6ff
SSDEEP 3072:eaLA1++iCeFj0im6X/AXpT8vVMCcHVcdhghUuz1o9Y:fLJlC6j0CX4XmvWHVcd62uO9
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3216-8-0x0000000000400000-0x000000000052E000-memory.dmp

Download

memory/3216-2-0x0000000000401000-0x00000000004B7000-memory.dmp

Download

memory/3216-1-0x0000000000400000-0x000000000052E000-memory.dmp

Download

memory/3216-112-0x0000000000400000-0x000000000052E000-memory.dmp

Download

memory/4404-6-0x0000000000400000-0x0000000000750000-memory.dmp

Download

memory/4404-9-0x0000000000400000-0x0000000000750000-memory.dmp

Download

memory/4404-49-0x0000000000400000-0x0000000000750000-memory.dmp

Download

memory/4404-57-0x0000000000400000-0x0000000000750000-memory.dmp

Download

memory/16724-20802-0x00007FFB6F7A0000-0x00007FFB6F8EE000-memory.dmp

Download

memory/17756-20790-0x00000000004A0000-0x00000000004CA000-memory.dmp

Download

memory/17756-20799-0x00007FFB6F7A0000-0x00007FFB6F8EE000-memory.dmp

Download

memory/17756-20803-0x000000001D4E0000-0x000000001D6A2000-memory.dmp

Download

memory/17756-20804-0x000000001DBE0000-0x000000001E108000-memory.dmp

Download