1c8fc97540852d2967a477d24ba22f271d625edb0bfe4c53fcf927b3fc95094c

Resubmissions

20-08-2024 19:16

240820-xy8jbasfnq 10

20-08-2024 19:13

240820-xxkqvsydrb 10

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
20-08-2024 19:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

MalwareDatabase
Size

331KB
MD5

8caec591082dc00491aea1ef77cffa46
SHA1

65154b9e1f1c6234b90c43b1db3cf06acfa39d96
SHA256

1c8fc97540852d2967a477d24ba22f271d625edb0bfe4c53fcf927b3fc95094c
SHA512

3a87cfa3603b2e811b041426dbb8c0464958dfb366c12525d585c24593430ef993d1f70050e0fb64ef923a81df43c16f941eeb90de7ef8f2e3277da2acbc169e
SSDEEP

6144:gFoYH3uokeOvHS1d1+sNs8wbiWQz9qvZJT3CqbMrhryf65NRPaCieMjAkvCJv1V1:SoYH3uokeOvHS1d1+sNs8wbiWQz9qvZM

Score

10^/10

discovery persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Program Files (x86)\\Windows\\Error file remover\\fatalerror.exe"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Program Files (x86)\\Windows\\Error file remover\\fatalerror.exe"	msiexec.exe

Loads dropped DLL 16 IoCs

pid	Process
5324	[email protected]
5324	[email protected]
3340	MsiExec.exe
3340	MsiExec.exe
3340	MsiExec.exe
3340	MsiExec.exe
3340	MsiExec.exe
3340	MsiExec.exe
3340	MsiExec.exe
3340	MsiExec.exe
3340	MsiExec.exe
3340	MsiExec.exe
5816	MsiExec.exe
3340	MsiExec.exe
5324	[email protected]
3340	MsiExec.exe

Blocklisted process makes network request 1 IoCs

flow	pid	Process
129	3340	MsiExec.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Y:	[email protected]
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\H:	[email protected]
File opened (read-only)	\??\S:	[email protected]
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\E:	[email protected]
File opened (read-only)	\??\L:	[email protected]
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\I:	[email protected]
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\O:	[email protected]
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\R:	[email protected]
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\J:	[email protected]
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Z:	[email protected]
File opened (read-only)	\??\N:	[email protected]
File opened (read-only)	\??\V:	[email protected]
File opened (read-only)	\??\W:	[email protected]
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\M:	[email protected]
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\X:	[email protected]
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	[email protected]
File opened (read-only)	\??\K:	[email protected]
File opened (read-only)	\??\P:	[email protected]
File opened (read-only)	\??\Q:	[email protected]
File opened (read-only)	\??\U:	[email protected]
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\G:	[email protected]
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
115	raw.githubusercontent.com
116	raw.githubusercontent.com

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Windows\Error file remover\fatalerror.exe	msiexec.exe
File created	C:\Program Files (x86)\Windows\Error file remover\Windows Logoff Sound.wav	msiexec.exe

Drops file in Windows directory 21 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSI2B1A.tmp	msiexec.exe
File created	C:\Windows\Installer\e5926a9.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5926a9.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI27E3.tmp	msiexec.exe
File created	C:\Windows\Tasks\sys.job	MsiExec.exe
File opened for modification	C:\Windows\Installer\MSI2706.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2842.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI298E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2A7C.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2775.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2892.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI298F.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI29BF.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{C452D4E2-DE24-48B6-B5C3-ACB240A01606}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI29EF.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2BB7.tmp	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2862.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI28E1.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\26\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-945322488-2060912225-3527527000-1000\{89E73512-5958-43B9-A5EC-E025BD70F8A4}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 53 IoCs

pid	Process
5080	msedge.exe
5080	msedge.exe
3560	msedge.exe
3560	msedge.exe
4172	msedge.exe
4172	msedge.exe
5432	identity_helper.exe
5432	identity_helper.exe
3192	msedge.exe
3192	msedge.exe
3288	msedge.exe
3288	msedge.exe
4964	msiexec.exe
4964	msiexec.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
2020	msedge.exe
2020	msedge.exe
4628	taskmgr.exe
4628	taskmgr.exe
5308	msedge.exe
5308	msedge.exe
5308	msedge.exe
5308	msedge.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5968	OpenWith.exe

Suspicious behavior: LoadsDriver 6 IoCs

pid	Process
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
652	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

pid	Process
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeSecurityPrivilege	4964	msiexec.exe
Token: SeCreateTokenPrivilege	5324	[email protected]
Token: SeAssignPrimaryTokenPrivilege	5324	[email protected]
Token: SeLockMemoryPrivilege	5324	[email protected]
Token: SeIncreaseQuotaPrivilege	5324	[email protected]
Token: SeMachineAccountPrivilege	5324	[email protected]
Token: SeTcbPrivilege	5324	[email protected]
Token: SeSecurityPrivilege	5324	[email protected]
Token: SeTakeOwnershipPrivilege	5324	[email protected]
Token: SeLoadDriverPrivilege	5324	[email protected]
Token: SeSystemProfilePrivilege	5324	[email protected]
Token: SeSystemtimePrivilege	5324	[email protected]
Token: SeProfSingleProcessPrivilege	5324	[email protected]
Token: SeIncBasePriorityPrivilege	5324	[email protected]
Token: SeCreatePagefilePrivilege	5324	[email protected]
Token: SeCreatePermanentPrivilege	5324	[email protected]
Token: SeBackupPrivilege	5324	[email protected]
Token: SeRestorePrivilege	5324	[email protected]
Token: SeShutdownPrivilege	5324	[email protected]
Token: SeDebugPrivilege	5324	[email protected]
Token: SeAuditPrivilege	5324	[email protected]
Token: SeSystemEnvironmentPrivilege	5324	[email protected]
Token: SeChangeNotifyPrivilege	5324	[email protected]
Token: SeRemoteShutdownPrivilege	5324	[email protected]
Token: SeUndockPrivilege	5324	[email protected]
Token: SeSyncAgentPrivilege	5324	[email protected]
Token: SeEnableDelegationPrivilege	5324	[email protected]
Token: SeManageVolumePrivilege	5324	[email protected]
Token: SeImpersonatePrivilege	5324	[email protected]
Token: SeCreateGlobalPrivilege	5324	[email protected]
Token: SeShutdownPrivilege	2104	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2104	msiexec.exe
Token: SeCreateTokenPrivilege	2104	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2104	msiexec.exe
Token: SeLockMemoryPrivilege	2104	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2104	msiexec.exe
Token: SeMachineAccountPrivilege	2104	msiexec.exe
Token: SeTcbPrivilege	2104	msiexec.exe
Token: SeSecurityPrivilege	2104	msiexec.exe
Token: SeTakeOwnershipPrivilege	2104	msiexec.exe
Token: SeLoadDriverPrivilege	2104	msiexec.exe
Token: SeSystemProfilePrivilege	2104	msiexec.exe
Token: SeSystemtimePrivilege	2104	msiexec.exe
Token: SeProfSingleProcessPrivilege	2104	msiexec.exe
Token: SeIncBasePriorityPrivilege	2104	msiexec.exe
Token: SeCreatePagefilePrivilege	2104	msiexec.exe
Token: SeCreatePermanentPrivilege	2104	msiexec.exe
Token: SeBackupPrivilege	2104	msiexec.exe
Token: SeRestorePrivilege	2104	msiexec.exe
Token: SeShutdownPrivilege	2104	msiexec.exe
Token: SeDebugPrivilege	2104	msiexec.exe
Token: SeAuditPrivilege	2104	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2104	msiexec.exe
Token: SeChangeNotifyPrivilege	2104	msiexec.exe
Token: SeRemoteShutdownPrivilege	2104	msiexec.exe
Token: SeUndockPrivilege	2104	msiexec.exe
Token: SeSyncAgentPrivilege	2104	msiexec.exe
Token: SeEnableDelegationPrivilege	2104	msiexec.exe
Token: SeManageVolumePrivilege	2104	msiexec.exe
Token: SeImpersonatePrivilege	2104	msiexec.exe
Token: SeCreateGlobalPrivilege	2104	msiexec.exe
Token: SeRestorePrivilege	4964	msiexec.exe
Token: SeTakeOwnershipPrivilege	4964	msiexec.exe
Token: SeRestorePrivilege	4964	msiexec.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
2104	msiexec.exe
2104	msiexec.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5968	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3560 wrote to memory of 3272	3560	msedge.exe	102
PID 3560 wrote to memory of 3272	3560	msedge.exe	102
PID 3560 wrote to memory of 1148	3560	msedge.exe	104
PID 3560 wrote to memory of 1148	3560	msedge.exe	104
PID 3560 wrote to memory of 1148	3560	msedge.exe	104
PID 3560 wrote to memory of 1148	3560	msedge.exe	104
PID 3560 wrote to memory of 1148	3560	msedge.exe	104
PID 3560 wrote to memory of 1148	3560	msedge.exe	104
PID 3560 wrote to memory of 1148	3560	msedge.exe	104
PID 3560 wrote to memory of 1148	3560	msedge.exe	104
PID 3560 wrote to memory of 1148	3560	msedge.exe	104
PID 3560 wrote to memory of 1148	3560	msedge.exe	104
PID 3560 wrote to memory of 1148	3560	msedge.exe	104
PID 3560 wrote to memory of 1148	3560	msedge.exe	104
PID 3560 wrote to memory of 1148	3560	msedge.exe	104
PID 3560 wrote to memory of 1148	3560	msedge.exe	104
PID 3560 wrote to memory of 1148	3560	msedge.exe	104
PID 3560 wrote to memory of 1148	3560	msedge.exe	104
PID 3560 wrote to memory of 1148	3560	msedge.exe	104
PID 3560 wrote to memory of 1148	3560	msedge.exe	104
PID 3560 wrote to memory of 1148	3560	msedge.exe	104
PID 3560 wrote to memory of 1148	3560	msedge.exe	104
PID 3560 wrote to memory of 1148	3560	msedge.exe	104
PID 3560 wrote to memory of 1148	3560	msedge.exe	104
PID 3560 wrote to memory of 1148	3560	msedge.exe	104
PID 3560 wrote to memory of 1148	3560	msedge.exe	104
PID 3560 wrote to memory of 1148	3560	msedge.exe	104
PID 3560 wrote to memory of 1148	3560	msedge.exe	104
PID 3560 wrote to memory of 1148	3560	msedge.exe	104
PID 3560 wrote to memory of 1148	3560	msedge.exe	104
PID 3560 wrote to memory of 1148	3560	msedge.exe	104
PID 3560 wrote to memory of 1148	3560	msedge.exe	104
PID 3560 wrote to memory of 1148	3560	msedge.exe	104
PID 3560 wrote to memory of 1148	3560	msedge.exe	104
PID 3560 wrote to memory of 1148	3560	msedge.exe	104
PID 3560 wrote to memory of 1148	3560	msedge.exe	104
PID 3560 wrote to memory of 1148	3560	msedge.exe	104
PID 3560 wrote to memory of 1148	3560	msedge.exe	104
PID 3560 wrote to memory of 1148	3560	msedge.exe	104
PID 3560 wrote to memory of 1148	3560	msedge.exe	104
PID 3560 wrote to memory of 1148	3560	msedge.exe	104
PID 3560 wrote to memory of 1148	3560	msedge.exe	104
PID 3560 wrote to memory of 5080	3560	msedge.exe	105
PID 3560 wrote to memory of 5080	3560	msedge.exe	105
PID 3560 wrote to memory of 4956	3560	msedge.exe	106
PID 3560 wrote to memory of 4956	3560	msedge.exe	106
PID 3560 wrote to memory of 4956	3560	msedge.exe	106
PID 3560 wrote to memory of 4956	3560	msedge.exe	106
PID 3560 wrote to memory of 4956	3560	msedge.exe	106
PID 3560 wrote to memory of 4956	3560	msedge.exe	106
PID 3560 wrote to memory of 4956	3560	msedge.exe	106
PID 3560 wrote to memory of 4956	3560	msedge.exe	106
PID 3560 wrote to memory of 4956	3560	msedge.exe	106
PID 3560 wrote to memory of 4956	3560	msedge.exe	106
PID 3560 wrote to memory of 4956	3560	msedge.exe	106
PID 3560 wrote to memory of 4956	3560	msedge.exe	106
PID 3560 wrote to memory of 4956	3560	msedge.exe	106
PID 3560 wrote to memory of 4956	3560	msedge.exe	106
PID 3560 wrote to memory of 4956	3560	msedge.exe	106
PID 3560 wrote to memory of 4956	3560	msedge.exe	106
PID 3560 wrote to memory of 4956	3560	msedge.exe	106
PID 3560 wrote to memory of 4956	3560	msedge.exe	106
PID 3560 wrote to memory of 4956	3560	msedge.exe	106
PID 3560 wrote to memory of 4956	3560	msedge.exe	106

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\MalwareDatabase
1⤵
PID:3456

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3988

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffb993346f8,0x7ffb99334708,0x7ffb99334718
  2⤵
  PID:3272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1992,8282194552674459469,5182218495430932880,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2004 /prefetch:2
  2⤵
  PID:1148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1992,8282194552674459469,5182218495430932880,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2244 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1992,8282194552674459469,5182218495430932880,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2800 /prefetch:8
  2⤵
  PID:4956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,8282194552674459469,5182218495430932880,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:1
  2⤵
  PID:2976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,8282194552674459469,5182218495430932880,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3420 /prefetch:1
  2⤵
  PID:3232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,8282194552674459469,5182218495430932880,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4132 /prefetch:1
  2⤵
  PID:212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,8282194552674459469,5182218495430932880,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2044 /prefetch:1
  2⤵
  PID:972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,8282194552674459469,5182218495430932880,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5300 /prefetch:1
  2⤵
  PID:1604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,8282194552674459469,5182218495430932880,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3720 /prefetch:1
  2⤵
  PID:3516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1992,8282194552674459469,5182218495430932880,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3544 /prefetch:8
  2⤵
  PID:3648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1992,8282194552674459469,5182218495430932880,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=4128 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:4172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,8282194552674459469,5182218495430932880,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4232 /prefetch:1
  2⤵
  PID:5260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,8282194552674459469,5182218495430932880,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4448 /prefetch:1
  2⤵
  PID:5636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,8282194552674459469,5182218495430932880,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3564 /prefetch:1
  2⤵
  PID:5648
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1992,8282194552674459469,5182218495430932880,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6036 /prefetch:8
  2⤵
  PID:5520
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1992,8282194552674459469,5182218495430932880,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6036 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,8282194552674459469,5182218495430932880,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6072 /prefetch:1
  2⤵
  PID:6016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,8282194552674459469,5182218495430932880,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3576 /prefetch:1
  2⤵
  PID:6024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,8282194552674459469,5182218495430932880,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5440 /prefetch:1
  2⤵
  PID:3076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,8282194552674459469,5182218495430932880,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5512 /prefetch:1
  2⤵
  PID:224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=1992,8282194552674459469,5182218495430932880,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6136 /prefetch:8
  2⤵
  PID:5364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,8282194552674459469,5182218495430932880,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5964 /prefetch:1
  2⤵
  PID:2088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1992,8282194552674459469,5182218495430932880,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6336 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,8282194552674459469,5182218495430932880,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6828 /prefetch:1
  2⤵
  PID:5736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1992,8282194552674459469,5182218495430932880,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6920 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,8282194552674459469,5182218495430932880,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4296 /prefetch:1
  2⤵
  PID:5392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1992,8282194552674459469,5182218495430932880,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5184 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1992,8282194552674459469,5182218495430932880,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5996 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5308

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1900

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1232

C:\Users\Admin\AppData\Local\Temp\Temp1_Winlocker.VB6.Blacksod.zip\[email protected]
"C:\Users\Admin\AppData\Local\Temp\Temp1_Winlocker.VB6.Blacksod.zip\[email protected]"
1⤵
- Loads dropped DLL
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:5324
- C:\Windows\SysWOW64\msiexec.exe
  "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\Windows\Error file remover 1.0.0.0\install\0A01606\Error file remover.msi" AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\Temp1_Winlocker.VB6.Blacksod.zip\[email protected] SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\Temp1_Winlocker.VB6.Blacksod.zip\ EXE_CMD_LINE="/exenoupdates /exelang 0 /noprereqs "
  2⤵
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:2104

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Modifies WinLogon for persistence
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4964
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding A49F8A92D88454669B0762BC86D5DC29
  2⤵
  - Loads dropped DLL
  - Blocklisted process makes network request
  - System Location Discovery: System Language Discovery
  PID:3340
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 2C797B1C1C6ED4A654283C1C8F9C5285 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  PID:5816

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:5968

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4628

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e5926ac.rbs

Filesize
100KB

MD5
69ff3ceb9fb62b6c2e6f1b8fd830da5c

SHA1
ee73f5f76742e6500bd4bb63f8da48036b8c96d7

SHA256
6ddeeb4810ed0f532b63630b59f5f3642ce51a8d3075ce1b47d1a27a4d4c2882

SHA512
fbc6282d9c9b3e320819e1324b68847bfbd7d001da0b3b22e5362da2b7eb7e2b24ea1bf9e6818ee4fb75a6445df3dd130356bd235ecebbdf6e60373b76dc2a8b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9b008261dda31857d68792b46af6dd6d

SHA1
e82dc88e2d1da2df7cb19d79a0346b9bb90d52b3

SHA256
9ac598d4f8170f7e475d84103aead9e3c23d5f2d292741a7f56a17bde8b6f7da

SHA512
78853091403a06beeec4998e2e3a4342111895ffd485f7f7cd367741a4883f7a25864cba00a6c86f27dc0c9ce9d04f08011ecc40c8ae9383d33274739ac39f10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0446fcdd21b016db1f468971fb82a488

SHA1
726b91562bb75f80981f381e3c69d7d832c87c9d

SHA256
62c5dc18b25e758f3508582a7c58bb46b734a774d97fc0e8a20614235caa8222

SHA512
1df7c085042266959f1fe0aedc5f6d40ceba485b54159f51f0c38f17bb250b79ea941b735e1b6faf219f23fe8ab65ac4557f545519d52d5416b89ad0f9047a31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
050a24c06c7068da5e460ec2b13199ab

SHA1
52923b42b47768c584758f7503c85bd288b616b9

SHA256
691b7188e2d7eb7b722201c82dfdaa30352b402593c13dd5e7ab0e543ee991af

SHA512
43b0f458ebbb1b6206bc29eae9983cb3ba9a81c869d373f2d0e6e1633118f45e7e4b5c764a5f8d489790b8c90d40131acf7675595ac1aa61772667ffb626e5cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
879B

MD5
37fee8f59cca35db017420b8b79faf00

SHA1
7273b09457b2f2881e1c1835afd35dde916c6e7b

SHA256
93e94cc5790600c2f96a551fdf23eeed4bbef2c82a30d005175f4a4633ddac6a

SHA512
ce5767b56db805f350990f32b2c55e1936ed5ebf58c32885dcea159838e292cd8776d4bfa14e5ca7f5969b02ce44252634bcdf164978e20a77d551b6c49bacac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
78e542c984f96a6a15efa5a70a0ce7c8

SHA1
77bb00dd089d350b7b63c1026ebb41c5bdde10d4

SHA256
9d5f1b7a1bc1dcb08361dbe9e4fb97a8b02fd061b4a9c664ee68f98394e1cd39

SHA512
0ba9869224660cb03df14d004f67ec3c403ec699aef01e97fb4e48d72fa2023908da0145c359376406ab78f30b21ec27062e9df8141b9b82dcac9bc44f99f0a0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
e37d320064e25cb0ba2d6cf20f1c9015

SHA1
7a0d7353bfc4225d54105a9e9c4e374932b37650

SHA256
0e26d46c9b6a8a74b2f3c854163ba342b6f6e48a3ed3804594f8b3aee4d20291

SHA512
779e231db300926e6f4c9f3f40654119b04aaa9439b8f3e5c0dd13f0629cee8e306ceb5432b083eafc5669006b7ff345fe6f400de8bddb899d9ea73f605e3283

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7dc6935c6c98caf053710918be17697f

SHA1
56872c560abc2e8f2e50947c5aecc46344d7eea5

SHA256
efd5d471b42b740ee0981d1bc87d69fb2a0d269dbafe1d5d1bd071a501b8b80a

SHA512
93ca24cd252c99f65b395f90a6bc19f8687a91c66d35bdf1a0a987298d1ae6b8750d99b14f142c14096d0d7dcc63d542996042a7fa56c549d73880586c623343

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9cc24975ef1f68a41734aa74404835b1

SHA1
e3a54a7b6e9b118b0ebfeeb0adee069874c9effe

SHA256
94fc7e01a47cd25f14a275811b42575ec19516c4cf082972f01d5bf0f3076c63

SHA512
6bb3f360302fa875a74adf8f0fe358300f7e3a5238a739b936849799e41f1761256a0c8eadf36d2c24bc470728a2c332e9830b18a672263245e55369a083831a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
5041ce25c4d258b17334c94f047ce3de

SHA1
46f154ac3afa7f44ad7164e8cf495f0773b5a33e

SHA256
b16b03f3e5ee64ab37d3180b9d7d137795c9d14b13eab05b1ea633d3a93865e7

SHA512
5ee4ed7ca1a9bd39ee4e7b31257fbd68b158d6a8cf9b34605a6de63fe311c98d117dbdf6add088ad03cf710202d9ee6a97a54ebe2ae4b2e9427ec3b5216dc0b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
4677b500b63b3a4d031a7b8e540f765b

SHA1
509b6d17e4ce718a8e021e58bceec7709b23f000

SHA256
495b9d1daaeefdefbfabf65fe108fcf081d8239042183647ca9436176ba88d9e

SHA512
18adda1d371fa794d15835a45b94179de75643727c288c7176329ff62c1fd537258154508d87352b9f3dfc2a1045ff3dad8310f0721aa3fe6c55190e5af44a34

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
3ce662083a571dfa55bf7c274f44ac9d

SHA1
ec1cba880e13d1133c0601615185e501eb958844

SHA256
46b5c64c54935a1ffcfdbb4174dc6276cc43e67235eee84de2a3c1606a344007

SHA512
9bd16afb316704ca47cd64975aca055a10964cc77796ee2c406c0ed0129f1660598533f7dd1601ebd1bc9a0e6fb03595e76ed39532b1eebc9aa9b31661428edf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
3fc1adb6900966b0797f8755bb03b232

SHA1
58616a062017e236de1d97c74434fd7a385d1613

SHA256
9c8991249336bb333411e84577bce7a3fb87d714e27d3ecf0e0fe18575600a14

SHA512
6d4ad9365e8f202fead454b38c6825a2833b7453ffc3462e6b6bf9ab6e0a8444aafdcc11bac6bd721d8b7adb7b98da2c6185c29b5f24bb00c0290368ff950d77

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5871d0.TMP

Filesize
1KB

MD5
d6cdc0e2c848197402229f534df2e080

SHA1
fda36750b8465ea08966784a2db6bac619d75283

SHA256
5c1986410f7578ed2909ba006e0b5860a171eff2df71a5b817aa04089dd8c439

SHA512
6b971dda920987480af1a507fee950b167569475a4814db14886c4fe7c2c00cac783f90051f5671e9a59bc4846668b2f474b5ea081ca1d5ca45abdd189fef3ba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\cf7b01fa-ce7b-4a45-9516-9cda5e0586c6.tmp

Filesize
1KB

MD5
a18b6e7f8b97a31efd7a0de87c453eed

SHA1
c35fdcdb1b980a42966c210579220d7c8bf3905b

SHA256
c815c39b195f2fca5dbdd30405d8dc198b2511aa36ecb88506ec212c64504edc

SHA512
181ac53935b805742bab747cdffc69053a67b5015721a0653480b4832a027637b1ce32dfa017d6d2a7bc438c5802c37ef998b9ade7cd604205e5aa82ea698656

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
c1b5aba74936dca41d245f6dbe13a7cb

SHA1
3ea5314af456d0ad157ee5ae02d06e11a266f422

SHA256
aaf2a116e7091457c7742ffdf4c3dabef2d3f838b26de1eb8c70b065ab59bf0a

SHA512
75fe2499d9a5da527e9975b166ccf84cf7ac3484c9d44db33e92826d79a356e353c39a23a8f4b8e09b415340e20b98905a73f8019eb00f9e1601d32d729f88b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
d06ebf094942269655f815a6d23f8626

SHA1
50373f8793eb468d62a563b051c893ea0898d54a

SHA256
6d5838a513646697faf84e97991ad2840e25614301aebc6b8bf76eab6baeebc0

SHA512
0b7a57fd958051389849a796479e5225702d96502cfda6f53e75661f0684a5ec6486e05142db839b55987e6488dcf1715aca0e7e37ee6163c374f604c6862d8f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
ce049ba000373a53bbdad6bf7c42b821

SHA1
68265679c72fcea36e68b3f34f6b5620cf489c68

SHA256
30ed66e7291ba88e67af2621bcb32e93259fe2c9e28e4cd49fd11b25b5b6c53e

SHA512
611bb7df50a43ad7027a2bd3c62eef09bb6690daf43258cb39bac47159b7c21ae4697e49bd12bcfecdf73485eae6e02a879c0e9692f41743d57bb092692bc772

Download Submit
C:\Users\Admin\AppData\Local\Temp\AdvinstAnalytics\Error file remover\1.0.0.0\tracking.ini

Filesize
84B

MD5
79f636733705731c9c67688c4e8ffbc2

SHA1
42f4146c9ad5e95d7bb877d8b465abd10cba2a00

SHA256
16007c38ac174d20b2540ac97279df05be06f886b1751dd0c60285c30efe0329

SHA512
f79060fe487cfe2b07e0d988e70c38d87cdf348d20afa149c2d4b2137e2317cf5cc647fb0c961892b7cbcae476dacdf2fb945d99c1dae76520b6f73934567a15

Download Submit
C:\Users\Admin\AppData\Local\Temp\AdvinstAnalytics\Error file remover\1.0.0.0\tracking.ini

Filesize
84B

MD5
32bcb8c4fc1bd30a437cef0fd2ef2866

SHA1
7b2a8ec7f089e4b5faf4d922b114344d31dd68e4

SHA256
1f82558fe37308e679aed291450c794864773120c8cfbaf562159ca5c5e194c7

SHA512
fcb06e05036b552bee9b361c10386c867aef43cb69ff6982dc58c3639c0b79b8c5562e06121d76bb1800c76b02fd0b6f807427848a2046e96bf4c2367267e7e7

Download Submit
C:\Users\Admin\AppData\Local\Temp\AdvinstAnalytics\Error file remover\1.0.0.0\{FDCFF0C2-154A-475D-A401-26A30E67C77C}.session

Filesize
1KB

MD5
8a245503c067deedf795b1aedaec125b

SHA1
d711e2249a29db89085275843b369a9382692180

SHA256
09ec3cb5e2f2561504865c9068ac761fdd13f9089bce85a36f0fec50d543f44f

SHA512
29f45325c56e1a48d0bed010b4c88ada9c108ef85c825f722efe8531ee70292b690e6dab3aef72be89518d5125a1fdc4104d3d7e08eb43d2f5202f774261bf34

Download Submit
C:\Users\Admin\AppData\Local\Temp\AdvinstAnalytics\Error file remover\1.0.0.0\{FDCFF0C2-154A-475D-A401-26A30E67C77C}.session

Filesize
1KB

MD5
a40d11367675cfa64e3aa8cbe815c7b8

SHA1
80df9dd5b28ea75d20e7dd40075014fcd10c09d3

SHA256
9059c8542877bd2db5e1368408846f52265d62ee8e226cfe50c7aaec85085021

SHA512
143716561de1067423dd1c602cdaacc2be60e47e6c15fcd24ed40ebed2356a29bb2988cf0cb0d34d7a352ecedf49e32f32b05c16f3ecc5a2a655310473f2d2a8

Download Submit
C:\Users\Admin\AppData\Local\Temp\AdvinstAnalytics\Error file remover\1.0.0.0\{FDCFF0C2-154A-475D-A401-26A30E67C77C}.session

Filesize
1KB

MD5
45313eb23cac20e40496fe6b67cffe64

SHA1
b5f2966b6f783a03b216e138bad6ff2737a7618f

SHA256
5ed81d427662878cf609a30b8d41e7e7556580402ae79d7539786e7fe9e9d409

SHA512
b733042dc6cdc9b1b9f4f622e5ae491d2fbb86b4da87f19f38ebeca6c806b68ddec7efab6177af30a2e1323f1d7693412dba34ef287caf8e6af7f3ecc02425a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\AdvinstAnalytics\Error file remover\1.0.0.0\{FDCFF0C2-154A-475D-A401-26A30E67C77C}.session

Filesize
4KB

MD5
6ac3f731042700bff69f015397f351e7

SHA1
28cd5b926ac1ce7cc0594f0aefeea9ab28bc4007

SHA256
258acad52ac52b6e9397c451c26ae0f30d8d92ac3477d5a27b20846af7e1b8eb

SHA512
2d0e586068451d65abb67513e0b39d98894949bb3c258af275544aff84f482f30a26d16acfbffaa249d363cc1b86670c134e0246ecd487c0e27def1f45365c83

Download Submit
C:\Users\Admin\AppData\Roaming\Windows\Error file remover 1.0.0.0\install\0A01606\Error file remover.msi

Filesize
1010KB

MD5
27bc9540828c59e1ca1997cf04f6c467

SHA1
bfa6d1ce9d4df8beba2bedf59f86a698de0215f3

SHA256
05c18698c3dc3b2709afd3355ad5b91a60b2121a52e5fcc474e4e47fb8e95e2a

SHA512
a3ae822116cddb52d859de7ffc958541bb47c355a835c5129aade9cc0e5fba3ff25387061deb5b55b5694a535f09fe8669485282eb6e7c818cc7092eb3392848

Download Submit
C:\Users\Admin\AppData\Roaming\Windows\Error file remover 1.0.0.0\install\0A01606\Windows Logoff Sound.wav

Filesize
724KB

MD5
bab1293f4cf987216af8051acddaf97f

SHA1
00abe5cfb050b4276c3dd2426e883cd9e1cde683

SHA256
bc26b1b97eeb45995bbd5f854db19f994cce1bb9ac9fb625eb207302dccdf344

SHA512
3b44371756f069be4f70113a09761a855d80e96c23c8cd76d0c19a43e93d1a159af079ba5189b88b5ee2c093099a02b00ea4dc20a498c9c0c2df7dc95e5ddd49

Download Submit
C:\Users\Admin\AppData\Roaming\Windows\Error file remover 1.0.0.0\install\0A01606\fatalerror.exe

Filesize
24KB

MD5
e579c5b3c386262e3dd4150eb2b13898

SHA1
5ab7b37956511ea618bf8552abc88f8e652827d3

SHA256
e9573a3041e5a45ed8133576d199eb8d12f8922bbe47d194fef9ac166a96b9e2

SHA512
9cf947bad87a701f0e0ad970681767e64b7588089cd9064c72bf24ba6ca0a922988f95b141b29a68ae0e0097f03a66d9b25b9d52197ff71f6e369cde0438e0bb

Download Submit
C:\Users\Admin\AppData\Roaming\Windows\Error file remover 1.0.0.0\install\decoder.dll

Filesize
126KB

MD5
3531cf7755b16d38d5e9e3c43280e7d2

SHA1
19981b17ae35b6e9a0007551e69d3e50aa1afffe

SHA256
76133e832c15aa5cbc49fb3ba09e0b8dd467c307688be2c9e85e79d3bf62c089

SHA512
7b053ba2cf92ef2431b98b2a06bd56340dad94de36d11e326a80cd61b9acb378ac644ac407cf970f4ef8333b8d3fb4ff40b18bb41ec5aee49d79a6a2adcf28fd

Download Submit
C:\Users\Admin\Downloads\ViraLock.zip

Filesize
132KB

MD5
6a47990541c573d44444f9ad5aa61774

SHA1
f230fff199a57a07a972e2ee7169bc074d9e0cd5

SHA256
b161c762c5894d820cc10d9027f2404a6fec3bc9f8fd84d23ff1daef98493115

SHA512
fe8a4fd268106817efc0222c94cb26ad4ae0a39f99aacaa86880b8a2caa83767ffe8a3dd5b0cdcc38b61f1b4d0196064856bd0191b9c2d7a8d8297c864a7716d

Download Submit
C:\Users\Admin\Downloads\WannaCrypt0r.zip

Filesize
3.3MB

MD5
e58fdd8b0ce47bcb8ffd89f4499d186d

SHA1
b7e2334ac6e1ad75e3744661bb590a2d1da98b03

SHA256
283f40e9d550833bec101a24fd6fd6fbd9937ed32a51392e818ffff662a1d30a

SHA512
95b6567b373efa6aec6a9bfd7af70ded86f8c72d3e8ba75f756024817815b830f54d18143b0be6de335dd0ca0afe722f88a4684663be5a84946bd30343d43a8c

Download Submit
C:\Users\Admin\Downloads\Winlocker.VB6.Blacksod.zip

Filesize
1.6MB

MD5
713f3673049a096ea23787a9bcb63329

SHA1
b6dad889f46dc19ae8a444b93b0a14248404c11d

SHA256
a62c54fefde2762426208c6e6c7f01ef2066fc837f94f5f36d11a36b3ecddd5f

SHA512
810bdf865a25bde85096e95c697ba7c1b79130b5e589c84ab93b21055b7341b5446d4e15905f7aa4cc242127d9ed1cf6f078b43fe452ad2e40695e5ab2bf8a18

Download Submit
C:\Windows\Installer\MSI2706.tmp

Filesize
88KB

MD5
4083cb0f45a747d8e8ab0d3e060616f2

SHA1
dcec8efa7a15fa432af2ea0445c4b346fef2a4d6

SHA256
252b7423b01ff81aea6fe7b40de91abf49f515e9c0c7b95aa982756889f8ac1a

SHA512
26f8949cad02334f9942fda8509579303b81b11bc052a962c5c31a7c6c54a1c96957f30ee241c2206d496d2c519d750d7f6a12b52afdb282fa706f9fee385133

Download Submit
C:\Windows\Installer\MSI2775.tmp

Filesize
180KB

MD5
d552dd4108b5665d306b4a8bd6083dde

SHA1
dae55ccba7adb6690b27fa9623eeeed7a57f8da1

SHA256
a0367875b68b1699d2647a748278ebce64d5be633598580977aa126a81cf57c5

SHA512
e5545a97014b5952e15bb321135f65c0e24414f8dd606fe454fd2d048d3f769b9318df7cfb2a6bf932eb2bf6d79811b93cb2008115deb0f0fa9db07f32a70969

Download Submit
C:\Windows\Installer\MSI298F.tmp

Filesize
96KB

MD5
3cab78d0dc84883be2335788d387601e

SHA1
14745df9595f190008c7e5c190660361f998d824

SHA256
604e79fe970c5ed044517a9a35e4690ea6f7d959d21173ebef45cdd3d3a22bdd

SHA512
df6b49f2b5cddebd7e23e81b0f89e4883fc12d95735a9b3f84d2f402f4996c54b5fdea8adb9eaa98e8c973b089656d18d6b322bd71cb42d7807f7fa8a7348820

Download Submit
C:\Windows\Installer\MSI29BF.tmp

Filesize
128KB

MD5
7e6b88f7bb59ec4573711255f60656b5

SHA1
5e7a159825a2d2cb263a161e247e9db93454d4f6

SHA256
59ff5bc12b155cc2e666bd8bc34195c3750eb742542374fc5e53fb22d11e862f

SHA512
294a379c99403f928d476e04668717cdabc7dc3e33bcf6bcad5c3d93d4268971811ff7303aa5b4b2ed2b59d59c8eba350a9a30888d4b5b3064708521ac21439c

Download Submit
C:\Windows\Installer\MSI29EF.tmp

Filesize
312KB

MD5
aa82345a8f360804ea1d8d935f0377aa

SHA1
c09cf3b1666d9192fa524c801bb2e3542c0840e2

SHA256
9c155d4214cebda186647c035ada552963dcac8f88a6b38a23ea34f9ecd1d437

SHA512
c051a381d87ba933ea7929c899fb01af2207cb2462dcb2b55c28cff65596b27bdb05a48207624eeea40fddb85003133ad7af09ca93cfb2426c155daea5a9a6db

Download Submit
memory/4628-815-0x00000224BCD40000-0x00000224BCD41000-memory.dmp

Filesize
4KB

Download
memory/4628-822-0x00000224BCD40000-0x00000224BCD41000-memory.dmp

Filesize
4KB

Download
memory/4628-826-0x00000224BCD40000-0x00000224BCD41000-memory.dmp

Filesize
4KB

Download
memory/4628-825-0x00000224BCD40000-0x00000224BCD41000-memory.dmp

Filesize
4KB

Download
memory/4628-824-0x00000224BCD40000-0x00000224BCD41000-memory.dmp

Filesize
4KB

Download
memory/4628-823-0x00000224BCD40000-0x00000224BCD41000-memory.dmp

Filesize
4KB

Download
memory/4628-820-0x00000224BCD40000-0x00000224BCD41000-memory.dmp

Filesize
4KB

Download
memory/4628-821-0x00000224BCD40000-0x00000224BCD41000-memory.dmp

Filesize
4KB

Download
memory/4628-816-0x00000224BCD40000-0x00000224BCD41000-memory.dmp

Filesize
4KB

Download
memory/4628-814-0x00000224BCD40000-0x00000224BCD41000-memory.dmp

Filesize
4KB

Download