fd563cf7c0c862ab910cf558b5a123354b616e84902d277edf09f378ff6f9786

Resubmissions

19-12-2024 08:32

241219-kfqvbsxmgl 10

19-12-2024 08:29

19-12-2024 08:22

19-12-2024 08:18

19-12-2024 08:10

19-12-2024 07:51

19-12-2024 07:46

19-12-2024 07:46

Analysis

max time kernel
132s
max time network
133s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
19-12-2024 08:29

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

b28242123ed2cf6000f0aa036844bd29.dll
Size

87KB
MD5

b28242123ed2cf6000f0aa036844bd29
SHA1

915f41a6c59ed743803ea0ddde08927ffd623586
SHA256

fd563cf7c0c862ab910cf558b5a123354b616e84902d277edf09f378ff6f9786
SHA512

08e5966ca90f08c18c582e6c67d71186a6f9c025fc9f78020e1ce202814de094171111b7f3623d81f7371acdf92206446f7c0425e08e8f5f5b6fd969007d9fca
SSDEEP

1536:0A1KsVHBnVJ0T1rFTQHUPx+nVP7ZSRILMZoXyqqEbzPCAdt6rFTc:0A1rVIrFTOUsnVP7sRILgAPCvrFTc

Score

10^/10

discovery evasion exploit persistence trojan

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, wscript.exe \"C:\\Program Files\\MicrosoftWindowsServicesEtc\\xRunReg.vbs\""	wscript.exe

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wscript.exe

Disables RegEdit via registry modification 1 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system\disableregistrytools = "1"	wscript.exe

Disables Task Manager via registry modification
evasion

Possible privilege escalation attempt 4 IoCs

exploit

pid	Process
5192	icacls.exe
5200	takeown.exe
5260	icacls.exe
5288	takeown.exe

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	GetReady.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	MrsMajor2.0.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	MrsMajor2.0.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	wscript.exe

Executes dropped EXE 5 IoCs

pid	Process
3612	MrsMajor2.0.exe
5152	MrsMajor2.0.exe
1436	eula32.exe
3164	GetReady.exe
5620	notmuch.exe

Modifies file permissions 1 TTPs 4 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
5200	takeown.exe
5260	icacls.exe
5288	takeown.exe
5192	icacls.exe

Modifies system executable filetype association 2 TTPs 2 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\DefaultIcon	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\DefaultIcon\ = "C:\\Program Files\\MicrosoftWindowsServicesEtc\\data\\fileico.ico"	wscript.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MajorX = "wscript.exe \"C:\\Users\\Admin\\AppData\\Local\\Temp\\xRun.vbs\""	wscript.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service

T1102

flow	ioc
104	raw.githubusercontent.com
81	camo.githubusercontent.com
83	camo.githubusercontent.com
103	raw.githubusercontent.com

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\taskmgr.exe	cmd.exe
File opened for modification	C:\Windows\System32\sethc.exe	cmd.exe

Drops file in Program Files directory 37 IoCs

description	ioc	Process
File created	C:\program files\MicrosoftWindowsServicesEtc\WinScrew.exe	wscript.exe
File created	C:\program files\MicrosoftWindowsServicesEtc\data\runner32s.exe	wscript.exe
File created	C:\program files\MicrosoftWindowsServicesEtc\data\thetruth.jpg	wscript.exe
File created	C:\program files\MicrosoftWindowsServicesEtc\majordared.exe	wscript.exe
File created	C:\program files\MicrosoftWindowsServicesEtc\weird\breakrule.vbs	wscript.exe
File created	C:\program files\MicrosoftWindowsServicesEtc\weird\cmd.vbs	wscript.exe
File created	C:\program files\MicrosoftWindowsServicesEtc\weird\GetReady.bat	wscript.exe
File created	C:\program files\MicrosoftWindowsServicesEtc\weird\RuntimeChecker.vbs	wscript.exe
File created	C:\program files\MicrosoftWindowsServicesEtc\majorsod.exe	wscript.exe
File created	C:\program files\MicrosoftWindowsServicesEtc\weird\bsod.bat	wscript.exe
File created	C:\program files\MicrosoftWindowsServicesEtc\weird\Major.vbs	wscript.exe
File created	C:\program files\MicrosoftWindowsServicesEtc\weird\majorlist.bat	wscript.exe
File created	C:\program files\MicrosoftWindowsServicesEtc\bsod.exe	wscript.exe
File created	C:\program files\MicrosoftWindowsServicesEtc\checker.bat	wscript.exe
File created	C:\program files\MicrosoftWindowsServicesEtc\data\fileico.ico	wscript.exe
File created	C:\program files\MicrosoftWindowsServicesEtc\example.txt	wscript.exe
File created	C:\program files\MicrosoftWindowsServicesEtc\RuntimeChecker.exe	wscript.exe
File created	C:\program files\MicrosoftWindowsServicesEtc\weird\runner32s.vbs	wscript.exe
File created	C:\program files\MicrosoftWindowsServicesEtc\data\eula32.exe	wscript.exe
File created	C:\program files\MicrosoftWindowsServicesEtc\DgzRun.vbs	wscript.exe
File created	C:\program files\MicrosoftWindowsServicesEtc\Major.exe	wscript.exe
File created	C:\program files\MicrosoftWindowsServicesEtc\AppKill.bat	wscript.exe
File opened for modification	C:\program files\MicrosoftWindowsServicesEtc\AppKill.bat	wscript.exe
File created	C:\program files\MicrosoftWindowsServicesEtc\data\excursor.ani	wscript.exe
File created	C:\program files\MicrosoftWindowsServicesEtc\weird\majorsod.vbs	wscript.exe
File created	C:\program files\MicrosoftWindowsServicesEtc\clingclang.wav	wscript.exe
File created	C:\program files\MicrosoftWindowsServicesEtc\majorlist.exe	wscript.exe
File created	C:\program files\MicrosoftWindowsServicesEtc\NotMuch.exe	wscript.exe
File created	C:\program files\MicrosoftWindowsServicesEtc\weird\WinScrew.bat	wscript.exe
File created	C:\program files\MicrosoftWindowsServicesEtc\xRunReg.vbs	wscript.exe
File created	C:\program files\MicrosoftWindowsServicesEtc\breakrule.exe	wscript.exe
File created	C:\program files\MicrosoftWindowsServicesEtc\GetReady.exe	wscript.exe
File created	C:\program files\MicrosoftWindowsServicesEtc\healgen.vbs	wscript.exe
File created	C:\program files\MicrosoftWindowsServicesEtc\xRun.vbs	wscript.exe
File created	C:\program files\MicrosoftWindowsServicesEtc\CallFunc.vbs	wscript.exe
File created	C:\program files\MicrosoftWindowsServicesEtc\fexec.vbs	wscript.exe
File created	C:\program files\MicrosoftWindowsServicesEtc\rsod.exe	wscript.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4692	1612	WerFault.exe	83

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MrsMajor2.0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MrsMajor2.0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eula32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GetReady.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notmuch.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Control Panel 4 IoCs

evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\Cursors\Arrow = "C:\\Program Files\\MicrosoftWindowsServicesEtc\\data\\excursor.ani"	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\Cursors\AppStarting = "C:\\Program Files\\MicrosoftWindowsServicesEtc\\data\\excursor.ani"	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\Cursors\Hand = "C:\\Program Files\\MicrosoftWindowsServicesEtc\\data\\excursor.ani"	wscript.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\Cursors	wscript.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "232"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe

Modifies registry class 12 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\DefaultIcon	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\DefaultIcon\ = "C:\\Program Files\\MicrosoftWindowsServicesEtc\\data\\fileico.ico"	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\DefaultIcon\ = "C:\\Program Files\\MicrosoftWindowsServicesEtc\\data\\fileico.ico"	wscript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inifile\DefaultIcon	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\inifile\DefaultIcon\ = "C:\\Program Files\\MicrosoftWindowsServicesEtc\\data\\fileico.ico"	wscript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\DefaultIcon	wscript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mp3file\DefaultIcon	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mp3file\DefaultIcon\ = "C:\\Program Files\\MicrosoftWindowsServicesEtc\\data\\fileico.ico"	wscript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mp4file\DefaultIcon	wscript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mp4file	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mp4file\DefaultIcon\ = "C:\\Program Files\\MicrosoftWindowsServicesEtc\\data\\fileico.ico"	wscript.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4808	msedge.exe
4808	msedge.exe
1040	msedge.exe
1040	msedge.exe
1120	identity_helper.exe
1120	identity_helper.exe
4296	msedge.exe
4296	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 20 IoCs

pid	Process
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeRestorePrivilege	1676	7zG.exe
Token: 35	1676	7zG.exe
Token: SeSecurityPrivilege	1676	7zG.exe
Token: SeSecurityPrivilege	1676	7zG.exe
Token: SeTakeOwnershipPrivilege	5200	takeown.exe
Token: SeTakeOwnershipPrivilege	5288	takeown.exe
Token: SeShutdownPrivilege	5640	shutdown.exe
Token: SeRemoteShutdownPrivilege	5640	shutdown.exe

Suspicious use of FindShellTrayWindow 40 IoCs

pid	Process
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1676	7zG.exe
1040	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5804	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1676 wrote to memory of 1612	1676	regsvr32.exe	83
PID 1676 wrote to memory of 1612	1676	regsvr32.exe	83
PID 1676 wrote to memory of 1612	1676	regsvr32.exe	83
PID 1040 wrote to memory of 3908	1040	msedge.exe	92
PID 1040 wrote to memory of 3908	1040	msedge.exe	92
PID 1040 wrote to memory of 1388	1040	msedge.exe	93
PID 1040 wrote to memory of 1388	1040	msedge.exe	93
PID 1040 wrote to memory of 1388	1040	msedge.exe	93
PID 1040 wrote to memory of 1388	1040	msedge.exe	93
PID 1040 wrote to memory of 1388	1040	msedge.exe	93
PID 1040 wrote to memory of 1388	1040	msedge.exe	93
PID 1040 wrote to memory of 1388	1040	msedge.exe	93
PID 1040 wrote to memory of 1388	1040	msedge.exe	93
PID 1040 wrote to memory of 1388	1040	msedge.exe	93
PID 1040 wrote to memory of 1388	1040	msedge.exe	93
PID 1040 wrote to memory of 1388	1040	msedge.exe	93
PID 1040 wrote to memory of 1388	1040	msedge.exe	93
PID 1040 wrote to memory of 1388	1040	msedge.exe	93
PID 1040 wrote to memory of 1388	1040	msedge.exe	93
PID 1040 wrote to memory of 1388	1040	msedge.exe	93
PID 1040 wrote to memory of 1388	1040	msedge.exe	93
PID 1040 wrote to memory of 1388	1040	msedge.exe	93
PID 1040 wrote to memory of 1388	1040	msedge.exe	93
PID 1040 wrote to memory of 1388	1040	msedge.exe	93
PID 1040 wrote to memory of 1388	1040	msedge.exe	93
PID 1040 wrote to memory of 1388	1040	msedge.exe	93
PID 1040 wrote to memory of 1388	1040	msedge.exe	93
PID 1040 wrote to memory of 1388	1040	msedge.exe	93
PID 1040 wrote to memory of 1388	1040	msedge.exe	93
PID 1040 wrote to memory of 1388	1040	msedge.exe	93
PID 1040 wrote to memory of 1388	1040	msedge.exe	93
PID 1040 wrote to memory of 1388	1040	msedge.exe	93
PID 1040 wrote to memory of 1388	1040	msedge.exe	93
PID 1040 wrote to memory of 1388	1040	msedge.exe	93
PID 1040 wrote to memory of 1388	1040	msedge.exe	93
PID 1040 wrote to memory of 1388	1040	msedge.exe	93
PID 1040 wrote to memory of 1388	1040	msedge.exe	93
PID 1040 wrote to memory of 1388	1040	msedge.exe	93
PID 1040 wrote to memory of 1388	1040	msedge.exe	93
PID 1040 wrote to memory of 1388	1040	msedge.exe	93
PID 1040 wrote to memory of 1388	1040	msedge.exe	93
PID 1040 wrote to memory of 1388	1040	msedge.exe	93
PID 1040 wrote to memory of 1388	1040	msedge.exe	93
PID 1040 wrote to memory of 1388	1040	msedge.exe	93
PID 1040 wrote to memory of 1388	1040	msedge.exe	93
PID 1040 wrote to memory of 4808	1040	msedge.exe	94
PID 1040 wrote to memory of 4808	1040	msedge.exe	94
PID 1040 wrote to memory of 2420	1040	msedge.exe	95
PID 1040 wrote to memory of 2420	1040	msedge.exe	95
PID 1040 wrote to memory of 2420	1040	msedge.exe	95
PID 1040 wrote to memory of 2420	1040	msedge.exe	95
PID 1040 wrote to memory of 2420	1040	msedge.exe	95
PID 1040 wrote to memory of 2420	1040	msedge.exe	95
PID 1040 wrote to memory of 2420	1040	msedge.exe	95
PID 1040 wrote to memory of 2420	1040	msedge.exe	95
PID 1040 wrote to memory of 2420	1040	msedge.exe	95
PID 1040 wrote to memory of 2420	1040	msedge.exe	95
PID 1040 wrote to memory of 2420	1040	msedge.exe	95
PID 1040 wrote to memory of 2420	1040	msedge.exe	95
PID 1040 wrote to memory of 2420	1040	msedge.exe	95
PID 1040 wrote to memory of 2420	1040	msedge.exe	95
PID 1040 wrote to memory of 2420	1040	msedge.exe	95
PID 1040 wrote to memory of 2420	1040	msedge.exe	95
PID 1040 wrote to memory of 2420	1040	msedge.exe	95

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wscript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system	wscript.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\b28242123ed2cf6000f0aa036844bd29.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1676
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\b28242123ed2cf6000f0aa036844bd29.dll
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1612
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1612 -s 596
    3⤵
    - Program crash
    PID:4692

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1612 -ip 1612
1⤵
PID:1500

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffc8b0346f8,0x7ffc8b034708,0x7ffc8b034718
  2⤵
  PID:3908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1980,14468245217556620165,16094256213334589841,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1992 /prefetch:2
  2⤵
  PID:1388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1980,14468245217556620165,16094256213334589841,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1980,14468245217556620165,16094256213334589841,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2888 /prefetch:8
  2⤵
  PID:2420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,14468245217556620165,16094256213334589841,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3408 /prefetch:1
  2⤵
  PID:964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,14468245217556620165,16094256213334589841,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3420 /prefetch:1
  2⤵
  PID:3832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,14468245217556620165,16094256213334589841,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5100 /prefetch:1
  2⤵
  PID:4408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,14468245217556620165,16094256213334589841,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5060 /prefetch:1
  2⤵
  PID:3068
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1980,14468245217556620165,16094256213334589841,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4780 /prefetch:8
  2⤵
  PID:4196
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1980,14468245217556620165,16094256213334589841,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4780 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,14468245217556620165,16094256213334589841,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3556 /prefetch:1
  2⤵
  PID:4428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,14468245217556620165,16094256213334589841,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3620 /prefetch:1
  2⤵
  PID:4716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,14468245217556620165,16094256213334589841,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5548 /prefetch:1
  2⤵
  PID:964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,14468245217556620165,16094256213334589841,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5432 /prefetch:1
  2⤵
  PID:1136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,14468245217556620165,16094256213334589841,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4144 /prefetch:1
  2⤵
  PID:3968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,14468245217556620165,16094256213334589841,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4004 /prefetch:1
  2⤵
  PID:4816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,14468245217556620165,16094256213334589841,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5068 /prefetch:1
  2⤵
  PID:5060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,14468245217556620165,16094256213334589841,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3620 /prefetch:1
  2⤵
  PID:2992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,14468245217556620165,16094256213334589841,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5484 /prefetch:1
  2⤵
  PID:4120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,14468245217556620165,16094256213334589841,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5860 /prefetch:1
  2⤵
  PID:3076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,14468245217556620165,16094256213334589841,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5684 /prefetch:1
  2⤵
  PID:448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,14468245217556620165,16094256213334589841,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1656 /prefetch:1
  2⤵
  PID:3184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,14468245217556620165,16094256213334589841,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1812 /prefetch:1
  2⤵
  PID:2672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,14468245217556620165,16094256213334589841,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5200 /prefetch:1
  2⤵
  PID:1932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,14468245217556620165,16094256213334589841,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5176 /prefetch:1
  2⤵
  PID:4692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=1980,14468245217556620165,16094256213334589841,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=4756 /prefetch:8
  2⤵
  PID:1540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,14468245217556620165,16094256213334589841,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6472 /prefetch:1
  2⤵
  PID:3472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1980,14468245217556620165,16094256213334589841,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6152 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4296

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3636

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2392

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2220

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\MrsMajor2.0\" -ad -an -ai#7zMap29034:82:7zEvent25023
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1676

C:\Users\Admin\Downloads\MrsMajor2.0\MrsMajor2.0.exe
"C:\Users\Admin\Downloads\MrsMajor2.0\MrsMajor2.0.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3612
- C:\Windows\system32\wscript.exe
  "C:\Windows\sysnative\wscript.exe" C:\Users\Admin\AppData\Local\Temp\194B.tmp\194C.vbs
  2⤵
  - Modifies WinLogon for persistence
  - UAC bypass
  - Disables RegEdit via registry modification
  - Checks computer location settings
  - Modifies system executable filetype association
  - Adds Run key to start application
  - Drops file in Program Files directory
  - Modifies Control Panel
  - Modifies registry class
  - System policy modification
  PID:1420
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c cd\&cd "C:\Users\Admin\AppData\Local\Temp" & eula32.exe
    3⤵
    PID:4296
  - - C:\Users\Admin\AppData\Local\Temp\eula32.exe
      eula32.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1436
- - C:\Program Files\MicrosoftWindowsServicesEtc\GetReady.exe
    "C:\Program Files\MicrosoftWindowsServicesEtc\GetReady.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3164
  - - C:\Windows\system32\cmd.exe
      "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\1\76BD.bat "C:\Program Files\MicrosoftWindowsServicesEtc\GetReady.exe""
      4⤵
      Drops file in System32 directory
      PID:5180
    - - C:\Windows\System32\takeown.exe
        
        takeown /f taskmgr.exe
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        Suspicious use of AdjustPrivilegeToken
        
        PID:5200
    - - C:\Windows\System32\icacls.exe
        
        icacls taskmgr.exe /granted "Admin":F
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:5260
    - - C:\Windows\System32\takeown.exe
        
        takeown /f sethc.exe
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        Suspicious use of AdjustPrivilegeToken
        
        PID:5288
    - - C:\Windows\System32\icacls.exe
        
        icacls sethc.exe /granted "Admin":F
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:5192
- - C:\Program Files\MicrosoftWindowsServicesEtc\notmuch.exe
    "C:\Program Files\MicrosoftWindowsServicesEtc\notmuch.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5620
- - C:\Windows\System32\shutdown.exe
    "C:\Windows\System32\shutdown.exe" -r -t 5
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5640

C:\Users\Admin\Downloads\MrsMajor2.0\MrsMajor2.0.exe
"C:\Users\Admin\Downloads\MrsMajor2.0\MrsMajor2.0.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5152
- C:\Windows\system32\wscript.exe
  "C:\Windows\sysnative\wscript.exe" C:\Users\Admin\AppData\Local\Temp\26F7.tmp\26F8.vbs
  2⤵
  PID:5488

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa38fb855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:5804

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

File and Directory Permissions Modification

T1222

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\MicrosoftWindowsServicesEtc\GetReady.exe

Filesize
52KB

MD5
57f3795953dafa8b5e2b24ba5bfad87f

SHA1
47719bd600e7527c355dbdb053e3936379d1b405

SHA256
5319958efc38ea81f61854eb9f6c8aee32394d4389e52fe5c1f7f7ef6b261725

SHA512
172006e8deed2766e7fa71e34182b5539309ec8c2ac5f63285724ef8f59864e1159c618c0914eb05692df721794eb4726757b2ccf576f0c78a6567d807cbfb98

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
bffcefacce25cd03f3d5c9446ddb903d

SHA1
8923f84aa86db316d2f5c122fe3874bbe26f3bab

SHA256
23e7cbbf64c81122c3cb30a0933c10a320e254447771737a326ce37a0694d405

SHA512
761dae5315b35ec0b2fe68019881397f5d2eadba3963aba79a89f8953a0cd705012d7faf3a204a5f36008926b9f614980e333351596b06ce7058d744345ce2e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d22073dea53e79d9b824f27ac5e9813e

SHA1
6d8a7281241248431a1571e6ddc55798b01fa961

SHA256
86713962c3bb287964678b148ee08ea83fb83483dff8be91c8a6085ca560b2a6

SHA512
97152091ee24b6e713b8ec8123cb62511f8a7e8a6c6c3f2f6727d0a60497be28814613b476009b853575d4931e5df950e28a41afbf6707cb672206f1219c4413

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\07a0d7cd-c9b2-4b61-89ba-f4964e54be84.tmp

Filesize
6KB

MD5
65eaa89568982834548b4fa279e11ecd

SHA1
1ce48b71a43ef74e66aa233f3cd1b777da10b279

SHA256
d82e1308c9119722d85871841f66777cc4f2b39884f8106c2ae6514c8c7003a7

SHA512
da819766e283599b508a4c0ebcf95c2985fc6f5d68d625c98aa0a6257eca27277910ffea53d971acaf3191a4891f67c048b1479a8321eb59ba432cf53d656e5f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
62KB

MD5
c813a1b87f1651d642cdcad5fca7a7d8

SHA1
0e6628997674a7dfbeb321b59a6e829d0c2f4478

SHA256
df670e09f278fea1d0684afdcd0392a83d7041585ba5996f7b527974d7d98ec3

SHA512
af0d024ba1faafbd6f950c67977ed126827180a47cea9758ee51a95d13436f753eb5a7aa12a9090048a70328f6e779634c612aebde89b06740ffd770751e1c5b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

Filesize
63KB

MD5
226541550a51911c375216f718493f65

SHA1
f6e608468401f9384cabdef45ca19e2afacc84bd

SHA256
caecff4179910ce0ff470f9fa9eb4349e8fb717fa1432cf19987450a4e1ef4a5

SHA512
2947b309f15e0e321beb9506861883fde8391c6f6140178c7e6ee7750d6418266360c335477cae0b067a6a6d86935ec5f7acdfdacc9edffa8b04ec71be210516

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

Filesize
67KB

MD5
69df804d05f8b29a88278b7d582dd279

SHA1
d9560905612cf656d5dd0e741172fb4cd9c60688

SHA256
b885987a52236f56ce7a5ca18b18533e64f62ab64eb14050ede93c93b5bd5608

SHA512
0ef49eeeeb463da832f7d5b11f6418baa65963de62c00e71d847183e0035be03e63c097103d30329582fe806d246e3c0e3ecab8b2498799abbb21d8b7febdc0e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

Filesize
19KB

MD5
2e86a72f4e82614cd4842950d2e0a716

SHA1
d7b4ee0c9af735d098bff474632fc2c0113e0b9c

SHA256
c1334e604dbbffdf38e9e2f359938569afe25f7150d1c39c293469c1ee4f7b6f

SHA512
7a5fd3e3e89c5f8afca33b2d02e5440934e5186b9fa6367436e8d20ad42b211579225e73e3a685e5e763fa3f907fc4632b9425e8bd6d6f07c5c986b6556d47b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
f12da650bfaea7c6140abb565266a6d0

SHA1
7e7b08c059c2bbed2fe8414796c8321d07a21355

SHA256
3d8e1c04033777a9e2a42d17961682f3c5cdfdc2e95b477d118e855e7a12de37

SHA512
94483e581189aea2b9ac2c6f3032cbf69c421e8f487cca4675be9a1818ad898f169b56408f591f832f2e8c0877463bc5a5b6bf2e374e39ea19b304db585b16ab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
955B

MD5
97b1140b84a668f2557f976e50874c0f

SHA1
53780749c094854c038c3c984cb84224a792444e

SHA256
79a4290783b549df0116c243ad38f5e0b2e0f07610423c0f9887a2083bd1a6ae

SHA512
5f980943e3234e01ff7091656b6c8e02b9bdce5587c9a67042b4453374d7d35a92cf6680856eee0fae85cdccf6e851aa5679782598cf161988e15b8060ccf33c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
3386079948701fc41650794377700360

SHA1
2e8c509d5b162456cc780d8268f2f63521098959

SHA256
5ba68f2929cf3c0aa3e5b6aa75189149210e1465b54577e68945e44f3af509c9

SHA512
43b9a53a7c5df84fb379ed6d287067f7fa23cdba686c6d5e3de3e216fc29bcb0dd32682d276a4964c44a03ad04878fd90ce3553b341514ec896212224c8636ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
796848f9093a3ac0864b96076ea4cd05

SHA1
4b4c8e8f1a0b9c166f7759b6091543508cdd5583

SHA256
4059db9272b6fab0ad041706885c1114f1e4b4fd7a3d16ab16117263d76b8fa1

SHA512
9ca61968638d4de8939b887c719f5559db0ccb87c1839c351e3d483f6b6547f2b0f7fee01810f1e648f7125037eb207ad132bb4f24534bfa6d97d53a08a09fcb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
5c48d6de1a0af05d0ab9eda17c9548c1

SHA1
28be073ab30f5a21aca89fe55cce352683969de8

SHA256
f92715f3a94a502ddc61006c315a6b7f3d8fb401bed44ed920b63361edc96fee

SHA512
05fed98cba8f3cbdcc42278adc0d926977e811513c10f3f8e943fac565444341b4490c6d5d902185a8d281561769b8e803df88bde9a024306a12f494ab4f6aeb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
af8c6e60a166766727d3571ca8f40947

SHA1
eee2b0841b94378ed59f58b6a4219e78a43277f8

SHA256
793adc9b1c8ae67ccee440a004a2c8e9c8e565a22f56748f0b46d01e49a1ad07

SHA512
eacdebd42ec9d0cb098c1c7c5455384144109d7f9265e56603958af48f1bdbdbecfba4c02d6862aa360710088432140693fd8a8290953dd6baa703f29cb1b894

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
102ba022a9e285aa525b8432ba99d044

SHA1
a2018448ec1e9db6cf050ad9ef0fc2953149612b

SHA256
cbe36aae6e2c59b6edd8f9cceea68a55a7dce9e278a3aaa018ce44ba9e78b2e2

SHA512
0fa182c200a68a4ec17ced17e8bc659aa7c26d79ef7c7d9f2b22e22356670756ce1ac343694de4c6eb256adcf3d83284dffe04821564bd257b640b443b351aa6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
761ebbc9c2ced77c3aff81926ad90620

SHA1
884f9050c6b83b7b6b25e36997240a7351a8c766

SHA256
1990c3cd71a8fb69d45646143092e5b1f8d62fca03d9652c90b97be9a6d34597

SHA512
aa4dec0398031a5e1b70bb5fc283a35e57b83eb662841b7708e6cf8986addcc9df5d12089069221e6373cc73b4fa235e7664743a567f872618e8f987791a17c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
a496360c0ff52c1a82d656bd335362d3

SHA1
3d0f2637566ceedd5b0b5044151cf3a3db361e0c

SHA256
9d62bebfd320e56d502e8305f2e143f9ee60aeee2c8b6a1efa8dbcf35443f170

SHA512
787e14c62eb1fe87764a74e7b29f922b00f0352b44eb0aaf7ceb9d10299b65f44dc8fe8e3df39139568674ee9b5730e2deee41089939f593f58e38df8457b631

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
817f9afa3bb92f69f5fe42e876db17f6

SHA1
ad8ea2f6568f98d22405925f7e8bbac7064406a5

SHA256
5c38bfdda2b73f8486d7c2b522aef307dc5c36d7cc6beca89fa7345d9454b996

SHA512
266790517124b64fc36377a71fcf25ef29263102fd7d4f67c7738a287f6781e09835d12a5eef38d7cb43998b929310b5e16c69df2138be2cee5069647ca3519d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe589594.TMP

Filesize
1KB

MD5
3807d948d62508ea48b9ab102abea395

SHA1
80e6c61b43349ef2a72b67acb2414a226e3371cc

SHA256
f49b8c0e6359afdae5b20a52aae9325ad5a0abd0974498f5909019c3b76a2290

SHA512
8d3a3e6475a6d8304293ac29ced014dc330aca1fb8760c1cae4294228db0d76ef7f1b4e8e3a448c06be7eaab5e8c5b1d421fcf403a162f791e5696afa20b80f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
14ec81b72b689b187c63bfc90e9df23d

SHA1
06398d2a753075ff0ba1865671c7f9ac4210747f

SHA256
ffcc7362c4d9c1964155ea79ac23111751862fd6a518803df0cecd9f3ac2f5e9

SHA512
3305c640cd2cf788e69de4c5343441e43fb61ecbd3e95a0a6d9f96d654da12163060ed70869e1d69a4503b6f24ae04e6756b116d5e73d98fb68c2e6bf1bad777

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
77a8c6135d3fc07380cedf93ac5c2353

SHA1
b3e426b43129beb29ef4592aa3faff1da999fd99

SHA256
3764dcdee6441e25e6b9e3cccdaa29da16b82a0cba54876b441c353f15fb4437

SHA512
0583ca4a1bb02c0b5c98fcb7f0e471b1040c587b66be8cb272456af4a130a15fb54181ade73b9ae58581cca421862509f95df268dbb23a10875cc66882d5b7b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
63ab23a9780bd08d87879578533fdb62

SHA1
541572880fb06330a0bba4479330db885286e611

SHA256
af54a6674f3b73f98e9567a61f912c18b8d5abaed2c4b21a32d4334bb3de5141

SHA512
7c8a3590736c48cb5c518cd58a776f6d6ba0e7b2c3731c8b960289a8873aaa819513dae06f4ba0ac2ea70af905a485fe94174466237baf1d471b25e24997a6db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
2736ef2349cf64fc5fc8b3312981b28b

SHA1
a09bf51ece7b054027c7a04553d859a649170bee

SHA256
76f60bcdfb64ad65cbaa06760b8dac467db0ce22c7868a1c4d32af6f05f95501

SHA512
f61cd9fda630e01fb33f7ba0fb5debc758e7b7257bf70c4e03d64b9a267adfa34f1a52c5c0f2d3543b8185a48a1f0b8b127759bfed9e7af4c5a6ea1413d0eab6

Download Submit
C:\Users\Admin\AppData\Local\Temp\194B.tmp\194C.vbs

Filesize
2KB

MD5
fd76266c8088a4dca45414c36c7e9523

SHA1
6b19bf2904a0e3b479032e101476b49ed3ae144a

SHA256
f853dddb0f9f1b74b72bccdb5191c28e18d466b5dbc205f7741a24391375cd6f

SHA512
3cd49395368e279ac9a63315583d3804aa89ec8bb6112754973451a7ea7b68140598699b30eef1b0e94c3286d1e6254e2063188282f7e6a18f1349877adeb072

Download Submit
C:\Users\Admin\AppData\Local\Temp\194B.tmp\MicrosoftWindowsServicesEtc\AppKill.bat

Filesize
671B

MD5
d4e987817d2e5d6ed2c12633d6f11101

SHA1
3f38430a028f9e3cb66c152e302b3586512dd9c4

SHA256
5549670ef8837c6e3c4e496c1ea2063670618249d4151dea4d07d48ab456690c

SHA512
b84fef88f0128b46f1e2f9c5dff2cb620ee885bed6c90dcf4a5dc51c77bea492c92b8084d8dc8b4277b47b2493a2d9d3f348c6e229bf3da9041ef90e0fd8b6c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\194B.tmp\MicrosoftWindowsServicesEtc\CallFunc.vbs

Filesize
388B

MD5
5f9737f03289963a6d7a71efab0813c4

SHA1
ba22dfae8d365cbf8014a630f23f1d8574b5cf85

SHA256
a767894a68ebc490cb5ab2b7b04dd12b7465553ce7ba7e41e1ea45f1eaef5275

SHA512
5f4fb691e6da90e8e0872378a7b78cbd1acbf2bd75d19d65f17bf5b1cea95047d66b79fd1173703fcfef42cfc116ca629b9b37e355e44155e8f3b98f2d916a2a

Download Submit
C:\Users\Admin\AppData\Local\Temp\194B.tmp\MicrosoftWindowsServicesEtc\DgzRun.vbs

Filesize
341B

MD5
a91417f7c55510155771f1f644dd6c7e

SHA1
41bdb69c5baca73f49231d5b5f77975b79e55bdf

SHA256
729f7540887cf32a5d4e1968a284c46cf904752821c734bd970ecd30a848477a

SHA512
f786699c1ab9d7c74dd9eb9d76a76728980b29e84999a166a47b7ee102d8e545901ed0fcb30331712490a36de2d726115b661ad3900cdc2bfcfc601d00b76b07

Download Submit
C:\Users\Admin\AppData\Local\Temp\194B.tmp\MicrosoftWindowsServicesEtc\Major.exe

Filesize
60KB

MD5
d604c29940864c64b4752d31e2deb465

SHA1
c1698ea4e5d1ba1c9b78973556f97e8f6dbbdef3

SHA256
da0233f5e5e9a34e8dd4f6911444ca1f3e29bb9cbd958a9f4508ac7d72ccd55d

SHA512
89a4a14574ba19fe319c766add0111feeb4320c08bf75f55a898d9acc783d5a862a6433758a413cc719b9179dcf873f1c850d1084851b8fc37aa1e3deabfcf54

Download Submit
C:\Users\Admin\AppData\Local\Temp\194B.tmp\MicrosoftWindowsServicesEtc\NotMuch.exe

Filesize
122KB

MD5
87a43b15969dc083a0d7e2ef73ee4dd1

SHA1
657c7ff7e3f325bcbc88db9499b12c636d564a5f

SHA256
cf830a2d66d3ffe51341de9e62c939b2bb68583afbc926ddc7818c3a71e80ebb

SHA512
8a02d24f5dab33cdaf768bca0d7a1e3ea75ad515747ccca8ee9f7ffc6f93e8f392ab377f7c2efa5d79cc0b599750fd591358a557f074f3ce9170283ab5b786a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\194B.tmp\MicrosoftWindowsServicesEtc\RuntimeChecker.exe

Filesize
58KB

MD5
cd58990b1b7f6c68f56244c41ab91665

SHA1
7ccca9958d6aebbe3883b55f115b041b827bd2e7

SHA256
51f59e877a1c2a1c2760c677def7395ef2868c2ee3e56ffdc3ace570afa50428

SHA512
011bdd417ec3bf72daa2b32d3816b696be8b87423740dc2a0182e23515651deeb870a94f3415a73480145f9f5e36c1a3a492410b77ca95d7fab8b9826e9198cc

Download Submit
C:\Users\Admin\AppData\Local\Temp\194B.tmp\MicrosoftWindowsServicesEtc\WinScrew.exe

Filesize
52KB

MD5
1aaafedd9f259acca75708f4af10b5be

SHA1
f6b4ea28d304e1f9205c1c0b970d60ee989402f2

SHA256
429e01b0e06b02a55bafb1527629f8d4c5f64d9b21ac9f81484a3928fdce6dc9

SHA512
a995ebf4d142452aabb419f0cacfa5412d03532840cb08c37dd7c00001dee521bf9d0da66ac4346b07dffd91fe01fa3115fa05811acbd43d380320dca1be4aa8

Download Submit
C:\Users\Admin\AppData\Local\Temp\194B.tmp\MicrosoftWindowsServicesEtc\breakrule.exe

Filesize
58KB

MD5
bcb0ac4822de8aeb86ea8a83cd74d7ca

SHA1
8e2b702450f91dde3c085d902c09dd265368112e

SHA256
5eafebd52fbf6d0e8abd0cc9bf42d36e5b6e4d85b8ebe59f61c9f2d6dccc65e4

SHA512
b73647a59eeb92f95c4d7519432ce40ce9014b292b9eb1ed6a809cca30864527c2c827fe49c285bb69984f33469704424edca526f9dff05a6244b33424df01d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\194B.tmp\MicrosoftWindowsServicesEtc\bsod.exe

Filesize
1.2MB

MD5
8f6a3b2b1af3a4aacd8df1734d250cfe

SHA1
505b3bd8e936cb5d8999c1b319951ffebab335c9

SHA256
6581eeab9fd116662b4ca73f6ef00fb96e0505d01cfb446ee4b32bbdeefe1361

SHA512
c1b5f845c005a1a586080e9da9744e30c7f3eda1e3aaba9c351768f7dea802e9f39d0227772413756ab63914ae4a2514e6ce52c494a91e92c3a1f08badb40264

Download Submit
C:\Users\Admin\AppData\Local\Temp\194B.tmp\MicrosoftWindowsServicesEtc\checker.bat

Filesize
151B

MD5
f59801d5c49713770bdb2f14eff34e2f

SHA1
91090652460c3a197cfad74d2d3c16947d023d63

SHA256
3382484b5a6a04d05500e7622da37c1ffaef3a1343395942bc7802bf2a19b53f

SHA512
c1c3a78f86e7938afbe391f0e03065b04375207704e419fe77bf0810d1e740c3ef8926c878884ad81b429ec41e126813a68844f600e124f5fa8d28ef17b4b7bc

Download Submit
C:\Users\Admin\AppData\Local\Temp\194B.tmp\MicrosoftWindowsServicesEtc\clingclang.wav

Filesize
13.1MB

MD5
1c723b3b9420e04cb8845af8b62a37fa

SHA1
3331a0f04c851194405eb9a9ff49c76bfa3d4db0

SHA256
6831f471ee3363e981e6a1eb0d722f092b33c9b73c91f9f2a9aafa5cb4c56b29

SHA512
41f4005ec2a7e0ee8e0e5f52b9d97f25a64a25bb0f00c85c07c643e4e63ea361b4d86733a0cf719b30ea6af225c4fcaca494f22e8e2f73cda9db906c5a0f12ae

Download Submit
C:\Users\Admin\AppData\Local\Temp\194B.tmp\MicrosoftWindowsServicesEtc\data\eula32.exe

Filesize
1.2MB

MD5
cbc127fb8db087485068044b966c76e8

SHA1
d02451bd20b77664ce27d39313e218ab9a9fdbf9

SHA256
c5704419b3eec34fb133cf2509d12492febdcb8831efa1ab014edeac83f538d9

SHA512
200ee39287f056b504cc23beb1b301a88b183a3806b023d936a2d44a31bbfd08854f6776082d4f7e2232c3d2f606cd5d8229591ecdc86a2bbcfd970a1ee33d41

Download Submit
C:\Users\Admin\AppData\Local\Temp\194B.tmp\MicrosoftWindowsServicesEtc\data\excursor.ani

Filesize
17KB

MD5
289624a46bb7ec6d91d5b099343b7f24

SHA1
2b0aab828ddb252baf4ed99994f716d136cd7948

SHA256
b93b0cb2bb965f5758cb0c699fbc827a64712d6f248aaf810cde5fa5ef3227eb

SHA512
8c77696fe1c897f56ea3afdecf67ad1128274815942cd4c73d30bf0a44dd1a690d8c2f4b0be08e604853084e5515020c2e913d6e044f9801b6223c1912eec8f8

Download Submit
C:\Users\Admin\AppData\Local\Temp\194B.tmp\MicrosoftWindowsServicesEtc\data\fileico.ico

Filesize
38KB

MD5
a62eeca905717738a4355dc5009d0fc6

SHA1
dd4cc0d3f203d395dfdc26834fc890e181d33382

SHA256
d13f7fd44f38136dae1cdf147ba9b673e698f77c0a644ccd3c12e3a71818a0cd

SHA512
47ffac6dc37dac4276579cd668fd2524ab1591b594032adbeb609d442f3a28235a2d185c66d8b78b6827ac51d62d97bdc3dffc3ffbaa70cf13d4d5f1dc5f16c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\194B.tmp\MicrosoftWindowsServicesEtc\data\runner32s.exe

Filesize
58KB

MD5
87815289b110cf33af8af1decf9ff2e9

SHA1
09024f9ec9464f56b7e6c61bdd31d7044bdf4795

SHA256
a97ea879e2b51972aa0ba46a19ad4363d876ac035502a2ed2df27db522bc6ac4

SHA512
8d9024507fa83f578b375c86f38970177313ec3dd9fae794b6e7f739e84fa047a9ef56bf190f6f131d0c7c5e280e729208848b152b3ca492a54af2b18e70f5dc

Download Submit
C:\Users\Admin\AppData\Local\Temp\194B.tmp\MicrosoftWindowsServicesEtc\data\thetruth.jpg

Filesize
483KB

MD5
7907845316bdbd32200b82944d752d9c

SHA1
1e5c37db25964c5dd05f4dce392533a838a722a9

SHA256
4e3baea3d98c479951f9ea02e588a3b98b1975055c1dfdf67af4de6e7b41e476

SHA512
72a64fab025928d60174d067990c35caa3bb6dadacf9c66e5629ee466016bc8495e71bed218e502f6bde61623e0819485459f25f3f82836e632a52727335c0a0

Download Submit
C:\Users\Admin\AppData\Local\Temp\194B.tmp\MicrosoftWindowsServicesEtc\healgen.vbs

Filesize
302B

MD5
8837818893ce61b6730dd8a83d625890

SHA1
a9d71d6d6d0c262d41a60b6733fb23cd7b8c7614

SHA256
cc6d0f847fde710096b01abf905c037594ff4afae6e68a8b6af0cc59543e29bb

SHA512
6f17d46098e3c56070ced4171d4c3a0785463d92db5f703b56b250ab8615bcb6e504d4c5a74d05308a62ea36ae31bc29850187943b54add2b50422fb03125516

Download Submit
C:\Users\Admin\AppData\Local\Temp\194B.tmp\MicrosoftWindowsServicesEtc\majordared.exe

Filesize
8.8MB

MD5
570d35aabee1887f7f6ab3f0a1e76984

SHA1
ae989563c3be21ee9043690dcaac3a426859d083

SHA256
fa24bc7bc366f2ad579d57a691fb0d10d868e501221df0c32a98e705d2d61e43

SHA512
9b68a8acacba451bbf028656c181fae29c5bcaed6a7ff4c1fc26ab708b62ca4be7bba9c777c598926d23331570617d20a0ce439f014461eccd8c3f595d21a54f

Download Submit
C:\Users\Admin\AppData\Local\Temp\194B.tmp\MicrosoftWindowsServicesEtc\majorlist.exe

Filesize
51KB

MD5
230970ec5286b34a6b2cda9afdd28368

SHA1
e3198d3d3b51d245a62a0dc955f2b1449608a295

SHA256
3cdafc944b48d45a0d5dc068652486a970124ebe1379a7a04e5cf1dcf05c37c8

SHA512
52912b6b2ba55c540316fcfc6f45d68771d1c22ddf4eb09c2cc15fb8ddd214812c18fd75cd61b561c29f660e2bf20290a101b85da1e0bbf8dfbf90b791892b57

Download Submit
C:\Users\Admin\AppData\Local\Temp\194B.tmp\MicrosoftWindowsServicesEtc\majorsod.exe

Filesize
58KB

MD5
b561c360c46744f55be79a25e1844e3c

SHA1
ed0f7eb00b4f1ae6cf92ad75e5701014f3d03d56

SHA256
d1094e91960ded15444c6f50756adc451a7c0b495b2ea28319b7184ba96236f7

SHA512
0a3a75d08f1d7afcd7a476fc71157983e04b0c26b00ace4d505aa644e5da3e242dd0f6afdb3c93f29ba0b08d2702d0e96b49acba4ed260330068b13f93973e9f

Download Submit
C:\Users\Admin\AppData\Local\Temp\194B.tmp\MicrosoftWindowsServicesEtc\rsod.exe

Filesize
74KB

MD5
91a0740cfb043e1f4d8461f8cbe2ff19

SHA1
92e1ad31c34c4102e5cb2cc69f3793b2a1d5304e

SHA256
dcaabfd6955d3fec26a86217d1b1ab7e979c301d498473e4d885145ce031fc3b

SHA512
c60067655e5f191708af9b25382869e3ce65cd3ea2d6cac70f8cae4132942cfd6a8aa9dde1e2b7f3f12997d6d7411e21dc73ab4cd83ec555d74b82b86778a613

Download Submit
C:\Users\Admin\AppData\Local\Temp\194B.tmp\MicrosoftWindowsServicesEtc\weird\GetReady.bat

Filesize
345B

MD5
3dbccaadafb7f0227c1839be5ca07015

SHA1
bd636f73235d52d172ad8932a8e4a6a8b17389a0

SHA256
33a0c62f3f66bce3fc1beb37aca8ad731bfa5590177d933d9d4eae016019242a

SHA512
d981670f9d492d97931ab260a7d7d27d4f97621a1ef3e20246d4be2a9b4cfc01e01174a1d46432b4a3d937ad135c97eec9ef7bbc7da46034388843887df4637e

Download Submit
C:\Users\Admin\AppData\Local\Temp\194B.tmp\MicrosoftWindowsServicesEtc\weird\Major.vbs

Filesize
2KB

MD5
9192fd494155eab424110765c751559e

SHA1
b54fcc1e29617b3eee1c7bb215c048498881b641

SHA256
cbd3b0f294e8f11592a3ad80d1070d81746f806a48183b93c345251422ccbf0d

SHA512
b8c48916535f3721e7f47be6af671765c3befefcd407c6ea5fabcf9ada119747408d662f61fb436f98a7c33050b6674da54dddf25e683429204a96555ec6e801

Download Submit
C:\Users\Admin\AppData\Local\Temp\194B.tmp\MicrosoftWindowsServicesEtc\weird\RuntimeChecker.vbs

Filesize
440B

MD5
fe44b78a465853c0ac0744c6ab05ea40

SHA1
f32dacd91b9547fce9a8a2846a4e17c33295aab3

SHA256
989d947c51c878bcefecb53d867a3c182c2d67129a87a5f6773eb6ef2bbf9b2e

SHA512
6b945e16786833c2e2e9867315b8859c413687fc72d4c8576b9c0a1aed2dc65249468317dd49f2ecf777e27c9969b7a7abc72b4d9b7c182dc7999051377515db

Download Submit
C:\Users\Admin\AppData\Local\Temp\194B.tmp\MicrosoftWindowsServicesEtc\weird\WinScrew.bat

Filesize
336B

MD5
04067ca733ee8b2ab2f068edc8b75a0f

SHA1
973cb577f6ab2463040918c3661333553a3132c8

SHA256
3aef33c03777abe62feef0a840ac6a087caafc05adfe801464fd1c52eac656a0

SHA512
5423a1e668211f269a3d787548e11d18de7365d6c2525c2de61014854f1ab5a51b5de9eda70fb21d6ebe356cb52e93b3f406c71ed7fbcaedd2b023b6fa9c13f8

Download Submit
C:\Users\Admin\AppData\Local\Temp\194B.tmp\MicrosoftWindowsServicesEtc\weird\breakrule.vbs

Filesize
108B

MD5
2609fde7a9604c73be5083e4bcfa0e20

SHA1
068c89f703fb11663143b9927f2a0c9f9f59c0e3

SHA256
17d014cb4abbaced3acce9b6d7a1b595cd6e2dd814e41f06ceddcdc08e93eebe

SHA512
439fee7cc198cb3fef4ef14693141e52c305579a4ff2da0842323f57dcffade03f3b01ac288080fed423511937a4c1e2080f5a79f967a963fe34253f541824cb

Download Submit
C:\Users\Admin\AppData\Local\Temp\194B.tmp\MicrosoftWindowsServicesEtc\weird\bsod.bat

Filesize
133B

MD5
c94bb8d71863b05b95891389bed6365e

SHA1
07bb402d67f8b1fc601687f1df2622369413db3b

SHA256
3900e3b60b4691311e050c4cf8fac82ff178a06e3d04d5d6b2d7ea12cf5d53d1

SHA512
00e7ab3a91862faaf5ac5ca3de6dbf2cbb8aac4aba277e1e14b2ecf4650eea2e68134e0df549dca35ab715ed46e36fa9cfee1ba7bb3520511723bf567566682d

Download Submit
C:\Users\Admin\AppData\Local\Temp\194B.tmp\MicrosoftWindowsServicesEtc\weird\cmd.vbs

Filesize
11B

MD5
b181d5a4055b4a620dd7c44c5065bbe7

SHA1
36320f257026b923b923ad2c0e7fa93a257806e0

SHA256
4d2639e890d6d5988eb9cb6f8cb50647048bbfeeb83fc604c52567e7381c876c

SHA512
0bec0cf2e5b93065701c5458c1d7e047312971d7bbed3ce5444db710654fa0d84eabb7d7c243130e3cb2dae38eb05874929b5b08547174a6065f8accd4e0433d

Download Submit
C:\Users\Admin\AppData\Local\Temp\194B.tmp\MicrosoftWindowsServicesEtc\weird\majorlist.bat

Filesize
105B

MD5
4cc606c63f423fda5324c962db709562

SHA1
091250ffc64db9bea451885350abed2b7748014c

SHA256
839301ef07178c100e7f4d47874faf995ae5d11dfd527dda096a284c8114671b

SHA512
f29ef2bc694f497499545d1fa4e14ca93c06049fff582af3a6caf3885153491a1cd9e96ab5a6746051aa972421f876c008e5d5b671bd34c3922b61c84151097f

Download Submit
C:\Users\Admin\AppData\Local\Temp\194B.tmp\MicrosoftWindowsServicesEtc\weird\majorsod.vbs

Filesize
126B

MD5
fecb9e50c1f01d9d6101f273cb860260

SHA1
18c413f577c289004db6156bd133e5db70258044

SHA256
8863b595563e92d73b29090ff83191b2fa1297507be588aa7e1cf910e77c7feb

SHA512
2c30641b099d5b6c3af40cb41e70160c1f4294bb30dc3162b018e9552b48fc899d1a63d3e366bfb71fcf6803bcc518cf8d504ce60684ce221028a9bf2bc07f9d

Download Submit
C:\Users\Admin\AppData\Local\Temp\194B.tmp\MicrosoftWindowsServicesEtc\weird\runner32s.vbs

Filesize
383B

MD5
5f427dc44f33906509423d24fa0590c0

SHA1
b896f7667381a594d3751e05f258925b81c231c0

SHA256
9aae0707b1d5d3b7ed3bf5cc8fbb530aebd195e3e2f18312f3f7f1aa43e031b4

SHA512
bd28c386772062ef945f24c8ad7a25f158856af36e31d2c9b14674cedfd34b4f48ed531cd40a7eb291384d83665ffe154f0786c1a7ee1616256cf30125120961

Download Submit
C:\Users\Admin\AppData\Local\Temp\194B.tmp\MicrosoftWindowsServicesEtc\xRun.vbs

Filesize
93B

MD5
26ec8d73e3f6c1e196cc6e3713b9a89f

SHA1
cb2266f3ecfef4d59bd12d7f117c2327eb9c55fa

SHA256
ed588fa361979f7f9c6dbb4e6a1ae6e075f2db8d79ea6ca2007ba8e3423671b0

SHA512
2b3ad279f1cdc2a5b05073116c71d79e190bfa407da09d8268d56ac2a0c4cc0c31161a251686ac67468d0ba329c302a301c542c22744d9e3a3f5e7ffd2b51195

Download Submit
C:\Users\Admin\AppData\Local\Temp\26F7.tmp\MicrosoftWindowsServicesEtc\xRunReg.vbs

Filesize
134B

MD5
8267192f547f8914ff36eff80ca3f402

SHA1
23bdeb19fb37059e1293dd80d8be69480c957c73

SHA256
cdd4f356ca256c707960bc42b97649111a830e6f951ca6a3cf80853e3c342947

SHA512
cd684cb73496ca925fd8604fbbf286b842e2b02ce18b19d63618e8355dcec02bce700fb09b25da932545845b01a7f8d9986fa486db504b92a42d7c0ace21e9e2

Download Submit
C:\Users\Admin\Downloads\MrsMajor2.0\MrsMajor2.0.exe

Filesize
25.6MB

MD5
247a35851fdee53a1696715d67bd0905

SHA1
d2e86020e1d48e527e81e550f06c651328bd58a4

SHA256
5dd4ea169cabf9226f54bb53e63ea6a1b5880a0d1222242aee378efb6255b57d

SHA512
a173801aaef4fab608d99b52223b5b2400d69b91edcbf33c21fcb47bd832eef9d771dfd36da350a502a371ed1739c869a7c2b4dca456c93f2feed9ac9c647c7c

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 827915.crdownload

Filesize
22.4MB

MD5
81041a562190fe49c0fac248638b2d04

SHA1
755d8426f18e3f0ad8e28d4655468d8cfdac67bf

SHA256
0d64e4fe519291c901b67944d9215f6254552c7ea5d12cc4fc930ab58c7ca268

SHA512
e482702b08e401de88c67a703cb1612831f0cbc9365eb2e634602712bed6ad6cfae30dd820d96001c49100420bc457af083e7c09d79d825e87fe231cc0646eb2

Download Submit
memory/1436-1220-0x0000000000580000-0x00000000006BC000-memory.dmp

Filesize
1.2MB

Download
memory/1436-1221-0x0000000005580000-0x0000000005B24000-memory.dmp

Filesize
5.6MB

Download
memory/1436-1222-0x0000000004FD0000-0x0000000005062000-memory.dmp

Filesize
584KB

Download
memory/1436-1223-0x0000000004F80000-0x0000000004F8A000-memory.dmp

Filesize
40KB

Download
memory/1612-0-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/5620-1243-0x0000000000FE0000-0x0000000001004000-memory.dmp

Filesize
144KB

Download

Resubmissions

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads