hxxps://github[.]com/Da2dalus/The-MALWARE-Repo

max time kernel
129s
max time network
145s
platform
windows11-21h2_x64
resource
win11-20250314-en
resource tags

arch:x64arch:x86image:win11-20250314-enlocale:en-usos:windows11-21h2-x64system
submitted
23/03/2025, 00:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/Da2dalus/The-MALWARE-Repo

Score

10^/10

agilenet defense_evasion discovery trojan

Malware Config

Signatures

UAC bypass 3 TTPs 1 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wscript.exe

Downloads MZ/PE file 2 IoCs

flow	pid	Process
84	5196	msedge.exe
84	5196	msedge.exe

Executes dropped EXE 4 IoCs

pid	Process
4872	MeltingScreen.exe
2372	MeltingScreen.exe
5288	MrsMajor3.0.exe
1232	eulascr.exe

Loads dropped DLL 1 IoCs

pid	Process
1232	eulascr.exe

Obfuscated with Agile.Net obfuscator 2 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

resource	yara_rule
behavioral1/files/0x001a00000002b4b8-782.dat	agile_net
behavioral1/memory/1232-784-0x0000000000E70000-0x0000000000E9A000-memory.dmp	agile_net

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service

T1102

flow	ioc
83	raw.githubusercontent.com
84	raw.githubusercontent.com
81	raw.githubusercontent.com
82	raw.githubusercontent.com

Drops file in Windows directory 14 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6072_1295255235\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6072_1295255235\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6072_547453308\data.txt	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6072_783969155\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6072_783969155\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6072_783969155\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6072_1295255235\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6072_547453308\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6072_547453308\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6072_783969155\sets.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6072_783969155\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6072_1295255235\keys.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6072_1295255235\manifest.json	msedge.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 2 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\MeltingScreen.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\MrsMajor3.0.exe:Zone.Identifier	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MeltingScreen.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133871617867047434"	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\MuiCache	MiniSearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3920535620-1286624088-2946613906-1000\{797739ED-5E1B-451B-A26B-C67D7BFEA182}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings	OpenWith.exe

NTFS ADS 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\90b61cc77bb2d726219fd00ae2d0ecdf6f0fe7078529e87b7ec8e603008232d5:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\MeltingScreen.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\MrsMajor3.0.exe:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3604	msedge.exe
3604	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3324	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
6072	msedge.exe
6072	msedge.exe
6072	msedge.exe
6072	msedge.exe
6072	msedge.exe
6072	msedge.exe

Suspicious use of FindShellTrayWindow 49 IoCs

pid	Process
6072	msedge.exe
6072	msedge.exe
6072	msedge.exe
6072	msedge.exe
6072	msedge.exe
6072	msedge.exe
6072	msedge.exe
6072	msedge.exe
6072	msedge.exe
6072	msedge.exe
6072	msedge.exe
6072	msedge.exe
6072	msedge.exe
6072	msedge.exe
6072	msedge.exe
6072	msedge.exe
6072	msedge.exe
6072	msedge.exe
6072	msedge.exe
6072	msedge.exe
6072	msedge.exe
6072	msedge.exe
6072	msedge.exe
6072	msedge.exe
6072	msedge.exe
6072	msedge.exe
6072	msedge.exe
6072	msedge.exe
6072	msedge.exe
6072	msedge.exe
6072	msedge.exe
6072	msedge.exe
6072	msedge.exe
6072	msedge.exe
6072	msedge.exe
6072	msedge.exe
6072	msedge.exe
6072	msedge.exe
6072	msedge.exe
6072	msedge.exe
6072	msedge.exe
6072	msedge.exe
6072	msedge.exe
6072	msedge.exe
6072	msedge.exe
6072	msedge.exe
6072	msedge.exe
6072	msedge.exe
6072	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
6072	msedge.exe
6072	msedge.exe
6072	msedge.exe
6072	msedge.exe
6072	msedge.exe
6072	msedge.exe
6072	msedge.exe
6072	msedge.exe
6072	msedge.exe
6072	msedge.exe
6072	msedge.exe
6072	msedge.exe

Suspicious use of SetWindowsHookEx 13 IoCs

pid	Process
3324	OpenWith.exe
3324	OpenWith.exe
3324	OpenWith.exe
3324	OpenWith.exe
3324	OpenWith.exe
3324	OpenWith.exe
3324	OpenWith.exe
3324	OpenWith.exe
3324	OpenWith.exe
3324	OpenWith.exe
3324	OpenWith.exe
5920	MiniSearchHost.exe
5288	MrsMajor3.0.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 6072 wrote to memory of 2940	6072	msedge.exe	78
PID 6072 wrote to memory of 2940	6072	msedge.exe	78
PID 6072 wrote to memory of 5196	6072	msedge.exe	79
PID 6072 wrote to memory of 5196	6072	msedge.exe	79
PID 6072 wrote to memory of 4624	6072	msedge.exe	80
PID 6072 wrote to memory of 4624	6072	msedge.exe	80
PID 6072 wrote to memory of 4624	6072	msedge.exe	80
PID 6072 wrote to memory of 4624	6072	msedge.exe	80
PID 6072 wrote to memory of 4624	6072	msedge.exe	80
PID 6072 wrote to memory of 4624	6072	msedge.exe	80
PID 6072 wrote to memory of 4624	6072	msedge.exe	80
PID 6072 wrote to memory of 4624	6072	msedge.exe	80
PID 6072 wrote to memory of 4624	6072	msedge.exe	80
PID 6072 wrote to memory of 4624	6072	msedge.exe	80
PID 6072 wrote to memory of 4624	6072	msedge.exe	80
PID 6072 wrote to memory of 4624	6072	msedge.exe	80
PID 6072 wrote to memory of 5008	6072	msedge.exe	81
PID 6072 wrote to memory of 5008	6072	msedge.exe	81
PID 6072 wrote to memory of 4624	6072	msedge.exe	80
PID 6072 wrote to memory of 4624	6072	msedge.exe	80
PID 6072 wrote to memory of 4624	6072	msedge.exe	80
PID 6072 wrote to memory of 4624	6072	msedge.exe	80
PID 6072 wrote to memory of 4624	6072	msedge.exe	80
PID 6072 wrote to memory of 4624	6072	msedge.exe	80
PID 6072 wrote to memory of 4624	6072	msedge.exe	80
PID 6072 wrote to memory of 4624	6072	msedge.exe	80
PID 6072 wrote to memory of 4624	6072	msedge.exe	80
PID 6072 wrote to memory of 4624	6072	msedge.exe	80
PID 6072 wrote to memory of 4624	6072	msedge.exe	80
PID 6072 wrote to memory of 4624	6072	msedge.exe	80
PID 6072 wrote to memory of 4624	6072	msedge.exe	80
PID 6072 wrote to memory of 4624	6072	msedge.exe	80
PID 6072 wrote to memory of 4624	6072	msedge.exe	80
PID 6072 wrote to memory of 4624	6072	msedge.exe	80
PID 6072 wrote to memory of 4624	6072	msedge.exe	80
PID 6072 wrote to memory of 4624	6072	msedge.exe	80
PID 6072 wrote to memory of 4624	6072	msedge.exe	80
PID 6072 wrote to memory of 4624	6072	msedge.exe	80
PID 6072 wrote to memory of 4624	6072	msedge.exe	80
PID 6072 wrote to memory of 4624	6072	msedge.exe	80
PID 6072 wrote to memory of 4624	6072	msedge.exe	80
PID 6072 wrote to memory of 4624	6072	msedge.exe	80
PID 6072 wrote to memory of 4624	6072	msedge.exe	80
PID 6072 wrote to memory of 4624	6072	msedge.exe	80
PID 6072 wrote to memory of 4624	6072	msedge.exe	80
PID 6072 wrote to memory of 4624	6072	msedge.exe	80
PID 6072 wrote to memory of 4624	6072	msedge.exe	80
PID 6072 wrote to memory of 4624	6072	msedge.exe	80
PID 6072 wrote to memory of 4624	6072	msedge.exe	80
PID 6072 wrote to memory of 4624	6072	msedge.exe	80
PID 6072 wrote to memory of 4624	6072	msedge.exe	80
PID 6072 wrote to memory of 4624	6072	msedge.exe	80
PID 6072 wrote to memory of 4624	6072	msedge.exe	80
PID 6072 wrote to memory of 4624	6072	msedge.exe	80
PID 6072 wrote to memory of 4624	6072	msedge.exe	80
PID 6072 wrote to memory of 4624	6072	msedge.exe	80
PID 6072 wrote to memory of 4624	6072	msedge.exe	80
PID 6072 wrote to memory of 5008	6072	msedge.exe	81
PID 6072 wrote to memory of 5008	6072	msedge.exe	81
PID 6072 wrote to memory of 5008	6072	msedge.exe	81
PID 6072 wrote to memory of 5008	6072	msedge.exe	81
PID 6072 wrote to memory of 5008	6072	msedge.exe	81
PID 6072 wrote to memory of 5008	6072	msedge.exe	81
PID 6072 wrote to memory of 5008	6072	msedge.exe	81

System policy modification 1 TTPs 2 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System	wscript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wscript.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://github.com/Da2dalus/The-MALWARE-Repo
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:6072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x240,0x244,0x248,0x23c,0x25c,0x7ffa1891f208,0x7ffa1891f214,0x7ffa1891f220
  2⤵
  PID:2940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1936,i,646361047740032195,5550729720126327955,262144 --variations-seed-version --mojo-platform-channel-handle=2700 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  PID:5196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2196,i,646361047740032195,5550729720126327955,262144 --variations-seed-version --mojo-platform-channel-handle=2192 /prefetch:2
  2⤵
  PID:4624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2096,i,646361047740032195,5550729720126327955,262144 --variations-seed-version --mojo-platform-channel-handle=2716 /prefetch:13
  2⤵
  PID:5008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3452,i,646361047740032195,5550729720126327955,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:5068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3388,i,646361047740032195,5550729720126327955,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
  2⤵
  PID:3288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3456,i,646361047740032195,5550729720126327955,262144 --variations-seed-version --mojo-platform-channel-handle=4080 /prefetch:14
  2⤵
  PID:4088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5224,i,646361047740032195,5550729720126327955,262144 --variations-seed-version --mojo-platform-channel-handle=5072 /prefetch:14
  2⤵
  PID:4304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5144,i,646361047740032195,5550729720126327955,262144 --variations-seed-version --mojo-platform-channel-handle=5304 /prefetch:14
  2⤵
  PID:4148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5060,i,646361047740032195,5550729720126327955,262144 --variations-seed-version --mojo-platform-channel-handle=5544 /prefetch:14
  2⤵
  PID:6020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5988,i,646361047740032195,5550729720126327955,262144 --variations-seed-version --mojo-platform-channel-handle=5724 /prefetch:14
  2⤵
  PID:4996
- - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1140
    3⤵
    PID:2676
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5688,i,646361047740032195,5550729720126327955,262144 --variations-seed-version --mojo-platform-channel-handle=5672 /prefetch:14
  2⤵
  PID:5572
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5688,i,646361047740032195,5550729720126327955,262144 --variations-seed-version --mojo-platform-channel-handle=5672 /prefetch:14
  2⤵
  PID:3144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6304,i,646361047740032195,5550729720126327955,262144 --variations-seed-version --mojo-platform-channel-handle=6100 /prefetch:14
  2⤵
  PID:1368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --field-trial-handle=6044,i,646361047740032195,5550729720126327955,262144 --variations-seed-version --mojo-platform-channel-handle=6300 /prefetch:1
  2⤵
  PID:5440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6560,i,646361047740032195,5550729720126327955,262144 --variations-seed-version --mojo-platform-channel-handle=6624 /prefetch:14
  2⤵
  - NTFS ADS
  PID:3568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=568,i,646361047740032195,5550729720126327955,262144 --variations-seed-version --mojo-platform-channel-handle=6876 /prefetch:14
  2⤵
  PID:5276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6868,i,646361047740032195,5550729720126327955,262144 --variations-seed-version --mojo-platform-channel-handle=5676 /prefetch:14
  2⤵
  PID:4200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6624,i,646361047740032195,5550729720126327955,262144 --variations-seed-version --mojo-platform-channel-handle=6740 /prefetch:14
  2⤵
  PID:2372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5420,i,646361047740032195,5550729720126327955,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:14
  2⤵
  PID:4244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --field-trial-handle=6960,i,646361047740032195,5550729720126327955,262144 --variations-seed-version --mojo-platform-channel-handle=6992 /prefetch:1
  2⤵
  PID:5852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7020,i,646361047740032195,5550729720126327955,262144 --variations-seed-version --mojo-platform-channel-handle=7164 /prefetch:14
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:5832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7036,i,646361047740032195,5550729720126327955,262144 --variations-seed-version --mojo-platform-channel-handle=6384 /prefetch:14
  2⤵
  PID:4664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6940,i,646361047740032195,5550729720126327955,262144 --variations-seed-version --mojo-platform-channel-handle=6972 /prefetch:14
  2⤵
  PID:3748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --field-trial-handle=6596,i,646361047740032195,5550729720126327955,262144 --variations-seed-version --mojo-platform-channel-handle=6424 /prefetch:1
  2⤵
  PID:1464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6952,i,646361047740032195,5550729720126327955,262144 --variations-seed-version --mojo-platform-channel-handle=6280 /prefetch:14
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:6052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=6968,i,646361047740032195,5550729720126327955,262144 --variations-seed-version --mojo-platform-channel-handle=5108 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6652,i,646361047740032195,5550729720126327955,262144 --variations-seed-version --mojo-platform-channel-handle=6556 /prefetch:14
  2⤵
  PID:2352

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:4868

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5544

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3324

C:\Users\Admin\Downloads\MeltingScreen.exe
"C:\Users\Admin\Downloads\MeltingScreen.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4872

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5920

C:\Users\Admin\Downloads\MeltingScreen.exe
"C:\Users\Admin\Downloads\MeltingScreen.exe"
1⤵
- Executes dropped EXE
PID:2372

C:\Users\Admin\Downloads\MrsMajor3.0.exe
"C:\Users\Admin\Downloads\MrsMajor3.0.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5288
- C:\Windows\system32\wscript.exe
  "C:\Windows\system32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\5EC0.tmp\5EC1.tmp\5EC2.vbs //Nologo
  2⤵
  - UAC bypass
  - System policy modification
  PID:4556
- - C:\Users\Admin\AppData\Local\Temp\5EC0.tmp\eulascr.exe
    "C:\Users\Admin\AppData\Local\Temp\5EC0.tmp\eulascr.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1232

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\109c3f1d-3663-495a-ad8e-89352efe48b9.tmp

Filesize
50KB

MD5
7c55e552ceb1f99fd529906bf11910e4

SHA1
d007efcfeacd7c479a8b3ac24d3ddb5ed9888922

SHA256
8e9d02f5bf2802727d4055b79688ed9fe9d6558e77b618f9103be77278a0b80d

SHA512
2735ffc9b9b4c3141b8fa4af056da1d5b270b752500ea798a0eb730600029965dad37c1f65c619fda5e806b427e019d1ce8a9c1162f7b515454e1d49f298fe01

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
509e630f2aea0919b6158790ecedff06

SHA1
ba9a6adff6f624a938f6ac99ece90fdeadcb47e7

SHA256
067308f8a68703d3069336cb4231478addc400f1b5cbb95a5948e87d9dc4f78b

SHA512
1cb2680d3b8ddef287547c26f32be407feae3346a8664288de38fe6157fb4aeceb72f780fd21522417298e1639b721b96846d381da34a5eb1f3695e8e6ef7264

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
5KB

MD5
efe941ba70ed19ab8a4b47f84478cfc4

SHA1
f1017598ec17438437694f9da12524998b83eb2d

SHA256
85270abe55d607a7a418d4e7dd471a867ee6efcaf3564f5aff6bb30afd5208b6

SHA512
ecb63941fceb0b162d30146bc28ac76a94bf642310c97bade14eb92366082245063ad3f36da42d5346363829677a5780e42586e11420e3b630088a0c3d0caee8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe57e7ef.TMP

Filesize
3KB

MD5
26a8e4a129e3185bed360adaa9e62525

SHA1
fe31599b3d3a22118b08afa7e46ac38bba70ecdf

SHA256
1c9a92c966b55e7b98f42a4519f81becceff5505f2877c09dfa57da504069fd6

SHA512
2aac285182842f9617f1428ef1dd7d1151f8f907606f8d16e9052ab696e8851500c45559126b013fc019563a11a9530b2626ef11feffaac40e0ff2bb4a59712d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps

Filesize
107KB

MD5
40e2018187b61af5be8caf035fb72882

SHA1
72a0b7bcb454b6b727bf90da35879b3e9a70621e

SHA256
b3efd9d75856016510dd0bdb5e22359925cee7f2056b3cde6411c55ae8ae8ee5

SHA512
a21b8f3f7d646909d6aed605ad5823269f52fda1255aa9bb4d4643e165a7b11935572bf9e0a6a324874f99c20a6f3b6d1e457c7ccd30adcac83c15febc063d12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
88fc9d4f4319655b6b0a284ae5e1a756

SHA1
6a2eb66c452414e05f6909f441d4250838d31b5d

SHA256
9150753f4e6771d5b6dcec1148be275b10770ffa43819e7cc8bf27676c88ec2a

SHA512
6a3a679897d4aa6c7cbfb31947b220d6cd5353dc2b1d2d63fe3c5db947df785ea7f5b6a6188950a7a3d4fb2ddd08ca3c85f28e7190673a44bbd2ec11af15bae6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
40B

MD5
20d4b8fa017a12a108c87f540836e250

SHA1
1ac617fac131262b6d3ce1f52f5907e31d5f6f00

SHA256
6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

SHA512
507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
411KB

MD5
04d5849e9005d12812472f0f51864c3c

SHA1
2d9bcb8c3ceb4294d76cb34d80b3c42df185862d

SHA256
87d39f2544f5d46539f406ad4d8d37dc7a52860bca9476506744fdefca143901

SHA512
d0ea5e3f5d51964c3b6cce401327de27871cc8c0aba51c2a65820db176579fd8fec0763cdd71d6b835812670a3e5153ff2d1733ef6ef79823fc6fe4b38486a20

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
412KB

MD5
9a1e0cb4b79b80539e46915c13c253dc

SHA1
0d7637613df188dd598358da2256b0e3616a5b83

SHA256
461b071b3af55216493aa4a025d4267c149bb0048876297dc76cd08952470b18

SHA512
d419f004ac3b7986120e39e4db91568997413c38c995741c68a7af4b468cb77e44e71e87544f2a512e8852384c8f30ab66b5c62248d86d57aba4693dbf7b9f7c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
411KB

MD5
f6749a93b161f51078b29334fdfab6bb

SHA1
fbef60882a8c3b9f4c886fe4e03eacbff6d8ae5c

SHA256
6cab1f8cd2a9a5a178e14f167e2aa1b6baba489adf1e0108db318aed09ff6db3

SHA512
e93c9414d808c34f9209c2588f8c83d40c050ca0e29d71497c66a5aa1c3e0816f701045aa341e4a00cb86799d6004866bbb36792953481e7c04c39829a4aa23d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
37KB

MD5
8baa00a06b631e9289d6bfe3487118d7

SHA1
f423fc12f20ccc6e212b28faff27a8554f73339e

SHA256
d4cdc1d3622a9468501980bce26c9e0120ea59c4a2511071855059c2d068075c

SHA512
d8b65f070ac769afec085d355da7e28cba4b0f2bdc156df2c3236653ac3055918cd22c3a66eb685c1cb2dc6c7c1ede58f4ee1cbbaeda273ceb015ab0ae1e8d99

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

Filesize
22KB

MD5
8f253f6a6b376cf8c2a6a3e90febb20f

SHA1
4a9064f27e67ce95ebd404bbd4963331fe3b3cf7

SHA256
cfe4aace7f975d64afedf7663115cb60699af0d63fef938f573f5776ab86c2ad

SHA512
8c39188e1fddff91d27b60b1a38e15075578c2886a60bfcb23d114d065f472770c1ccb792cc7d49b4a4d75f74dcc6fd84ed7f3c2d355a721c1a5be544c774744

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\EADPData Component\4.0.3.10\data.txt

Filesize
113KB

MD5
60beb7140ed66301648ef420cbaad02d

SHA1
7fac669b6758bb7b8e96e92a53569cf4360ab1aa

SHA256
95276c09f44b28100c0a21c161766eda784a983f019fc471290b1381e7ed9985

SHA512
6dfa4eca42aea86fba18bc4a3ab0eed87948ea1831e33d43426b3aca1816070ecb7fd024856ad571ca2734214a98cc55e413502b3deef2c4a101228a7377e9d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
463B

MD5
9188556b01f2fd27600643f80937a4a5

SHA1
d250ba020a05698545e36384075b5c4d69f001ab

SHA256
a3a4b12424b77fa9adcace5aee00ce5c664519f80d20bd6bd9d87e989b3eb03a

SHA512
421f76b47d34ef64ef35c076e27af72fbbd2fda4608562324dbe8928eb70bacdfe0fce60047e60b6b623e688d1ea0e121da4b41d7ff697bcfa09ff7fb03d3a47

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
22KB

MD5
81e7627df9c504b4edadf086062a02d1

SHA1
028097a376c4feb5042d90d801a415389a1af80f

SHA256
3e1718b52f005a316073631df6ffe9e8d6e59f0db330e30117ca1f31b2a3f72a

SHA512
88f17924e15ee846af7aa256a4bd0bfe9be115ca01348862229a8c0251d99fef3a5630e93b2d5f025877a2db2cc55ced4fa611396e230fa4117797671f8783fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
892B

MD5
fcd9933dffbe0bb6a6276d2c452df6fe

SHA1
d9e607b0a1a6ff4e72abc22d85548dec031f18b5

SHA256
1bc285a8b3cc12491f3d31e9c94283c613c4ef75347a5548f75ac02292e878ce

SHA512
f1147613b326e79f536176bfcc70858b38f37b6f532801785684bdced472f39bc7d45777b8da293e62b133212e524de0b47c9e38e0adf63bc0f31f7f6e533b61

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig

Filesize
19KB

MD5
41c1930548d8b99ff1dbb64ba7fecb3d

SHA1
d8acfeaf7c74e2b289be37687f886f50c01d4f2f

SHA256
16cee17a989167242dd7ee2755721e357dd23bcfcb61f5789cc19deafe7ca502

SHA512
a684d61324c71ac15f3a907788ab2150f61e7e2b2bf13ca08c14e9822b22336d0d45d9ff2a2a145aa7321d28d6b71408f9515131f8a1bd9f4927b105e6471b75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
50KB

MD5
e661e69fa28b1224183aa57f993d80df

SHA1
ecb2ac257a58d51dc9f9214eac3dacf27e3e5f4a

SHA256
8367cd4354c142915fdd2132581dc7ec1bd6557b87a2193b29ac47544f4b563e

SHA512
6d3488163bae393b4ce8192d0d625063fe289f4bd393a1a80fb20b984b16bdbdd894abe004e7fa77c65ca651c661f092062613c66f46ac577b2b03b4c7d5029f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
55KB

MD5
db2d741c4ce167381c4df89c4635d767

SHA1
e4e8a19fc0e462d315426a5c0e7689ae0dead73c

SHA256
86996dc405961ff783710c671afed0f2cd4da04ab323cd7b5cd7ed53a1a538f2

SHA512
fe3f14d31b06a9c95b60fb1b5d6eb8377954ddf9bc7e83932aabac653d42f2b056ea55944dd0acf03e4af754b0a39d9d9571f480d3b16ce499d4afbe78c4af81

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
41KB

MD5
b2d06a4188f862082b1c539da27bc313

SHA1
10a233c578eeb6ad3dc14c935650d1c01b55299b

SHA256
ccf351621b19711a7f34f6b444491e65e518799155fcfb630a30e5a2668b8570

SHA512
7fb1153e157dfddba1c9fc7e0ccd755db5cff02aef9b310978a973a46b218ed345f3833e1c8a3193cf9666c69804e95584031fe83a5594cedc9c4db4ee2fea54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
55KB

MD5
c782f9d3cbd63f7d6b54b70680d93f2c

SHA1
7ad05efa2d3289dc5ceba09d8800eda58eb227fe

SHA256
c188d2b5bfce50d49dc735b9aed3f8bbbb7a9ddd0406b3bcc79d3c4a0f3acf15

SHA512
7633ffaed53867071ab2fa388e8244a33d2644706e2073d80d29982f4ac9466e57444e89c5734cfe00e8d1490cd87e22017474491de297444d1584e5c8f59838

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
50KB

MD5
20867b87f00185b8cfd3bad9dc414513

SHA1
aa363791d5b5d3fdf2d6dbd3994e08c2b5b0f959

SHA256
f4454554e2e9bd814dcb52bc4ce149cd25ac211498721491a02b8f6de2ebf776

SHA512
65ce5c23d0f6ed5d7188477f4e5d9f58c79f83c5874285df34e727d726ed29ca1ed24f17e7a9f308176e468d610a55c45d45f944bd6fb68fd061bccc6edf0241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
55KB

MD5
ba0c9e67d52ae14ae7e7727bde868f95

SHA1
781c603169e26f44cc335f5178a4efe4b97c3218

SHA256
bb884b91d6c04acf55796ab34b721fce17269c0968d7953c660aa8aeeb08466c

SHA512
cce1492541e0009001bec855915eb34eed74cdaaa45f16ea66d1d3a9c13f6cff1fb5d4baff9b8ef437592e3e3414e98731163d81cb313c13a6f4eddeac662d12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter

Filesize
392B

MD5
edb2ed6a87d69fb161f5b094468f9e1a

SHA1
b5939ef57e39e907669b721235bebced7a7e5826

SHA256
c7e6cf6b46424c9831445abc2c2f062361f4da3ad648ffd5059e6feb980893b0

SHA512
7f89382d0cea153dde16922d233a3281e40f73ff31e498297c598d40bb94f7f9cc95af6699e54c97718743bbb7fc1fd6bf095e822ac9b95d4fb99ee3de2e95c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter

Filesize
392B

MD5
335d16734288bd9f38937510418fcdf7

SHA1
2dbc286c9f27f38627c398be0597200f9a68640a

SHA256
d72d689751c22c2a0955e347e2531f12061187f1dcd83df140743b48e038d6b2

SHA512
2832dbb78e3890ad31c117eaed9ede2864d778dcdadbe2d9a1817ef0fd86cd6c1c990ac4b4df61046904209955033747ad6f3e0c39fdee39ff86a5e31f795ccf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter

Filesize
392B

MD5
f2ea7452533e1324439ba3992ee58614

SHA1
1fa0bf9b8b563e01d39590ab366f58fd8ee2df54

SHA256
f350f08c29bdbe8a02d0a8a396574f065dee210b2b963dcbcd7bab16f2d32b99

SHA512
e4e0679f3421ebaac36c19aae13b9da640859da7945f448c5f55bc213e8bcec61bdc690c907a4fdc48b5f6cc7c9ebd43421323f2171f2f3d93c8d6eda20424d0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter

Filesize
392B

MD5
d3f8b6659ec61d248474008c837a6ed2

SHA1
8a9a3b6d2089cc42a6f218ff0139e24a37639a90

SHA256
72485b9784f01b851aff0041d2e489110b4e632ddc919a2828a867a92aac7ce8

SHA512
adc412a82c0cc09535e9e7758a2f03f62133a6757a22d17f4af2976ce5e4dbf3848cdb4159d187b5f4a35dd3ec6365a755bf8f9b298d75826036c0c5c5e86808

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe58583d.TMP

Filesize
392B

MD5
0989d56062a443e14be12a66d9a850d3

SHA1
10ca8a10c957851e2fd7d8f64865c693ee4e90be

SHA256
15b92272e4a90608b7f51844b9ea6f30921de291e098f9846b90dc30beb477e6

SHA512
37ad46a43273e7b84a8c87353a95dcf89d400501b5eca3ad8e623acdc3ba8628ddf8c61432cfe51e49ac4ecf3cadb36e70c1bfc05930de85acea50830d9c1690

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat

Filesize
23KB

MD5
e4502e12eddb65147ccb0c39021d5c54

SHA1
e0c340c26168e569ed1b09955e386922b9c76fc0

SHA256
ca1d08100dade9a95b1f93a37ac07587d9dca6866a8cb87436aadd5d29c86d6c

SHA512
9619f8745eaa0f18f6372258d3e7e068c0347fb1effa578bff7d173d6ee49507610316036c712834f8e336a01e95ba8d6ba8270ae1a439481877cc37b51405fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\5EC0.tmp\5EC1.tmp\5EC2.vbs

Filesize
352B

MD5
3b8696ecbb737aad2a763c4eaf62c247

SHA1
4a2d7a2d61d3f4c414b4e5d2933cd404b8f126e5

SHA256
ce95f7eea8b303bc23cfd6e41748ad4e7b5e0f0f1d3bdf390eadb1e354915569

SHA512
713d9697b892b9dd892537e8a01eab8d0265ebf64867c8beecf7a744321257c2a5c11d4de18fcb486bb69f199422ce3cab8b6afdbe880481c47b06ba8f335beb

Download Submit
C:\Users\Admin\AppData\Local\Temp\5EC0.tmp\eulascr.exe

Filesize
143KB

MD5
8b1c352450e480d9320fce5e6f2c8713

SHA1
d6bd88bf33de7c5d4e68b233c37cc1540c97bd3a

SHA256
2c343174231b55e463ca044d19d47bd5842793c15954583eb340bfd95628516e

SHA512
2d8e43b1021da08ed1bf5aff110159e6bc10478102c024371302ccfce595e77fd76794658617b5b52f9a50190db250c1ba486d247d9cd69e4732a768edbb4cbc

Download Submit
C:\Users\Admin\AppData\Local\Temp\5a530dfd-bc51-4992-a05d-f09d41a331d4\AgileDotNetRT64.dll

Filesize
75KB

MD5
42b2c266e49a3acd346b91e3b0e638c0

SHA1
2bc52134f03fcc51cb4e0f6c7cf70646b4df7dd1

SHA256
adeed015f06efa363d504a18acb671b1db4b20b23664a55c9bc28aef3283ca29

SHA512
770822fd681a1d98afe03f6fbe5f116321b54c8e2989fb07491811fd29fca5b666f1adf4c6900823af1271e342cacc9293e9db307c4eef852d1a253b00347a81

Download Submit
C:\Users\Admin\Downloads\90b61cc77bb2d726219fd00ae2d0ecdf6f0fe7078529e87b7ec8e603008232d5.crdownload

Filesize
8.7MB

MD5
100bff2f4ee4d88b005bb016daa04fe6

SHA1
36e5f8f70890601aa2adaffb203afd06516097f0

SHA256
90b61cc77bb2d726219fd00ae2d0ecdf6f0fe7078529e87b7ec8e603008232d5

SHA512
a1cb52bc6edaa7f8bb216d2a5f3deb0b8468c64b43931ef570c05e6a9872c63f00aff50d69686fdc2ea25d3d83da4bf9d78f5e6910643163570d0bd6279c6e16

Download Submit
C:\Users\Admin\Downloads\90b61cc77bb2d726219fd00ae2d0ecdf6f0fe7078529e87b7ec8e603008232d5:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
C:\Users\Admin\Downloads\MeltingScreen.exe

Filesize
17KB

MD5
4784e42c3b15d1a141a5e0c8abc1205c

SHA1
48c958deba25a4763ef244ac87e87983c6534179

SHA256
9d355e4f9a51536b05269f696b304859155985957ba95eb575f3f38c599d913c

SHA512
d63d20a38602d4d228367b6596454a0f5b2884c831e3a95237d23b882abd624de59ea47835636b06a96e216f1decf8c468caacd45e5d3b16a5eb9e87bc69eb97

Download Submit
C:\Users\Admin\Downloads\MeltingScreen.exe:Zone.Identifier

Filesize
55B

MD5
0f98a5550abe0fb880568b1480c96a1c

SHA1
d2ce9f7057b201d31f79f3aee2225d89f36be07d

SHA256
2dfb5f4b33e4cf8237b732c02b1f2b1192ffe4b83114bcf821f489bbf48c6aa1

SHA512
dbc1150d831950684ab37407defac0177b7583da0fe13ee8f8eeb65e8b05d23b357722246888189b4681b97507a4262ece96a1c458c4427a9a41d8ea8d11a2f6

Download Submit
C:\Users\Admin\Downloads\MrsMajor3.0.exe

Filesize
381KB

MD5
35a27d088cd5be278629fae37d464182

SHA1
d5a291fadead1f2a0cf35082012fe6f4bf22a3ab

SHA256
4a75f2db1dbd3c1218bb9994b7e1c690c4edd4e0c1a675de8d2a127611173e69

SHA512
eb0be3026321864bd5bcf53b88dc951711d8c0b4bcbd46800b90ca5116a56dba22452530e29f3ccbbcc43d943bdefc8ed8ca2d31ba2e7e5f0e594f74adba4ab5

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6072_1295255235\LICENSE

Filesize
1KB

MD5
ee002cb9e51bb8dfa89640a406a1090a

SHA1
49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2

SHA256
3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b

SHA512
d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6072_1295255235\keys.json

Filesize
6KB

MD5
bef4f9f856321c6dccb47a61f605e823

SHA1
8e60af5b17ed70db0505d7e1647a8bc9f7612939

SHA256
fd1847df25032c4eef34e045ba0333f9bd3cb38c14344f1c01b48f61f0cfd5c5

SHA512
bdec3e243a6f39bfea4130c85b162ea00a4974c6057cd06a05348ac54517201bbf595fcc7c22a4ab2c16212c6009f58df7445c40c82722ab4fa1c8d49d39755c

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6072_1295255235\manifest.json

Filesize
79B

MD5
7f4b594a35d631af0e37fea02df71e72

SHA1
f7bc71621ea0c176ca1ab0a3c9fe52dbca116f57

SHA256
530882d7f535ae57a4906ca735b119c9e36480cbb780c7e8ad37c9c8fdf3d9b1

SHA512
bf3f92f5023f0fbad88526d919252a98db6d167e9ca3e15b94f7d71ded38a2cfb0409f57ef24708284ddd965bda2d3207cd99c008b1c9c8c93705fd66ac86360

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6072_547453308\manifest.json

Filesize
53B

MD5
22b68a088a69906d96dc6d47246880d2

SHA1
06491f3fd9c4903ac64980f8d655b79082545f82

SHA256
94be212fe6bcf42d4b13fabd22da97d6a7ef8fdf28739989aba90a7cf181ac88

SHA512
8c755fdc617fa3a196e048e222a2562622f43362b8ef60c047e540e997153a446a448e55e062b14ed4d0adce7230df643a1bd0b06a702dc1e6f78e2553aadfff

Download Submit
memory/1232-784-0x0000000000E70000-0x0000000000E9A000-memory.dmp

Filesize
168KB

Download
memory/1232-791-0x00007FF9F1590000-0x00007FF9F16DF000-memory.dmp

Filesize
1.3MB

Download
memory/1232-792-0x000000001D7A0000-0x000000001D962000-memory.dmp

Filesize
1.8MB

Download
memory/1232-793-0x000000001DEA0000-0x000000001E3C8000-memory.dmp

Filesize
5.2MB

Download