umbral | hxxps://gofile[.]io/d/2qq6Da

Analysis

max time kernel
1800s
max time network
1686s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
04-03-2024 16:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://gofile.io/d/2qq6Da

Score

10^/10

umbral spyware stealer

Malware Config

Extracted

Family

umbral

https://discord.com/api/webhooks/1196551286892535848/BI-4wJMe0VqcV998bhbMUu_wWa9MHqKDsvG2bhmZuynbA6FvVmQpf3BApw4_YqBZ6TZ5

Signatures

Detect Umbral payload 2 IoCs

resource	yara_rule
behavioral1/files/0x000700000002323a-121.dat	family_umbral
behavioral1/memory/3392-123-0x000001EB2BCE0000-0x000001EB2BD20000-memory.dmp	family_umbral

Umbral
Umbral stealer is an opensource moduler stealer written in C#.
stealer umbral

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	Promo link generator.exe

Executes dropped EXE 1 IoCs

pid	Process
3392	Promo link generator.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
101	discord.com
100	discord.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
97	ip-api.com

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	taskmgr.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
5536	wmic.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Extensions\ContractId\Windows.Protocol\PackageId	CastSrv.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
5580	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2280	msedge.exe
2280	msedge.exe
4008	msedge.exe
4008	msedge.exe
1376	identity_helper.exe
1376	identity_helper.exe
3308	msedge.exe
3308	msedge.exe
5212	powershell.exe
5212	powershell.exe
5212	powershell.exe
5388	powershell.exe
5388	powershell.exe
5388	powershell.exe
5604	powershell.exe
5604	powershell.exe
5604	powershell.exe
5828	powershell.exe
5828	powershell.exe
5828	powershell.exe
5472	powershell.exe
5472	powershell.exe
5472	powershell.exe
3828	msedge.exe
3828	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
5796	msedge.exe
5796	msedge.exe
4892	msedge.exe
4892	msedge.exe
5848	taskmgr.exe
5848	taskmgr.exe
5848	taskmgr.exe
5848	taskmgr.exe
5848	taskmgr.exe
5848	taskmgr.exe
5848	taskmgr.exe
5848	taskmgr.exe
5848	taskmgr.exe
5848	taskmgr.exe
5848	taskmgr.exe
5848	taskmgr.exe
5848	taskmgr.exe
5848	taskmgr.exe
5848	taskmgr.exe
5848	taskmgr.exe
5848	taskmgr.exe
5848	taskmgr.exe
5848	taskmgr.exe
5848	taskmgr.exe
5848	taskmgr.exe
5848	taskmgr.exe
5848	taskmgr.exe
5848	taskmgr.exe
5848	taskmgr.exe
5848	taskmgr.exe
5848	taskmgr.exe
5848	taskmgr.exe
5848	taskmgr.exe
5848	taskmgr.exe
5848	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5848	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeRestorePrivilege	2792	7zG.exe
Token: 35	2792	7zG.exe
Token: SeSecurityPrivilege	2792	7zG.exe
Token: SeSecurityPrivilege	2792	7zG.exe
Token: SeDebugPrivilege	3392	Promo link generator.exe
Token: SeDebugPrivilege	5212	powershell.exe
Token: SeDebugPrivilege	5388	powershell.exe
Token: SeDebugPrivilege	5604	powershell.exe
Token: SeDebugPrivilege	5828	powershell.exe
Token: SeIncreaseQuotaPrivilege	5228	wmic.exe
Token: SeSecurityPrivilege	5228	wmic.exe
Token: SeTakeOwnershipPrivilege	5228	wmic.exe
Token: SeLoadDriverPrivilege	5228	wmic.exe
Token: SeSystemProfilePrivilege	5228	wmic.exe
Token: SeSystemtimePrivilege	5228	wmic.exe
Token: SeProfSingleProcessPrivilege	5228	wmic.exe
Token: SeIncBasePriorityPrivilege	5228	wmic.exe
Token: SeCreatePagefilePrivilege	5228	wmic.exe
Token: SeBackupPrivilege	5228	wmic.exe
Token: SeRestorePrivilege	5228	wmic.exe
Token: SeShutdownPrivilege	5228	wmic.exe
Token: SeDebugPrivilege	5228	wmic.exe
Token: SeSystemEnvironmentPrivilege	5228	wmic.exe
Token: SeRemoteShutdownPrivilege	5228	wmic.exe
Token: SeUndockPrivilege	5228	wmic.exe
Token: SeManageVolumePrivilege	5228	wmic.exe
Token: 33	5228	wmic.exe
Token: 34	5228	wmic.exe
Token: 35	5228	wmic.exe
Token: 36	5228	wmic.exe
Token: SeIncreaseQuotaPrivilege	5228	wmic.exe
Token: SeSecurityPrivilege	5228	wmic.exe
Token: SeTakeOwnershipPrivilege	5228	wmic.exe
Token: SeLoadDriverPrivilege	5228	wmic.exe
Token: SeSystemProfilePrivilege	5228	wmic.exe
Token: SeSystemtimePrivilege	5228	wmic.exe
Token: SeProfSingleProcessPrivilege	5228	wmic.exe
Token: SeIncBasePriorityPrivilege	5228	wmic.exe
Token: SeCreatePagefilePrivilege	5228	wmic.exe
Token: SeBackupPrivilege	5228	wmic.exe
Token: SeRestorePrivilege	5228	wmic.exe
Token: SeShutdownPrivilege	5228	wmic.exe
Token: SeDebugPrivilege	5228	wmic.exe
Token: SeSystemEnvironmentPrivilege	5228	wmic.exe
Token: SeRemoteShutdownPrivilege	5228	wmic.exe
Token: SeUndockPrivilege	5228	wmic.exe
Token: SeManageVolumePrivilege	5228	wmic.exe
Token: 33	5228	wmic.exe
Token: 34	5228	wmic.exe
Token: 35	5228	wmic.exe
Token: 36	5228	wmic.exe
Token: SeIncreaseQuotaPrivilege	5352	wmic.exe
Token: SeSecurityPrivilege	5352	wmic.exe
Token: SeTakeOwnershipPrivilege	5352	wmic.exe
Token: SeLoadDriverPrivilege	5352	wmic.exe
Token: SeSystemProfilePrivilege	5352	wmic.exe
Token: SeSystemtimePrivilege	5352	wmic.exe
Token: SeProfSingleProcessPrivilege	5352	wmic.exe
Token: SeIncBasePriorityPrivilege	5352	wmic.exe
Token: SeCreatePagefilePrivilege	5352	wmic.exe
Token: SeBackupPrivilege	5352	wmic.exe
Token: SeRestorePrivilege	5352	wmic.exe
Token: SeShutdownPrivilege	5352	wmic.exe
Token: SeDebugPrivilege	5352	wmic.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
2792	7zG.exe
5700	7zG.exe
5640	7zG.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
5848	taskmgr.exe
5848	taskmgr.exe
5848	taskmgr.exe
5848	taskmgr.exe
5848	taskmgr.exe
5848	taskmgr.exe
5848	taskmgr.exe
5848	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4008 wrote to memory of 512	4008	msedge.exe	87
PID 4008 wrote to memory of 512	4008	msedge.exe	87
PID 4008 wrote to memory of 4012	4008	msedge.exe	88
PID 4008 wrote to memory of 4012	4008	msedge.exe	88
PID 4008 wrote to memory of 4012	4008	msedge.exe	88
PID 4008 wrote to memory of 4012	4008	msedge.exe	88
PID 4008 wrote to memory of 4012	4008	msedge.exe	88
PID 4008 wrote to memory of 4012	4008	msedge.exe	88
PID 4008 wrote to memory of 4012	4008	msedge.exe	88
PID 4008 wrote to memory of 4012	4008	msedge.exe	88
PID 4008 wrote to memory of 4012	4008	msedge.exe	88
PID 4008 wrote to memory of 4012	4008	msedge.exe	88
PID 4008 wrote to memory of 4012	4008	msedge.exe	88
PID 4008 wrote to memory of 4012	4008	msedge.exe	88
PID 4008 wrote to memory of 4012	4008	msedge.exe	88
PID 4008 wrote to memory of 4012	4008	msedge.exe	88
PID 4008 wrote to memory of 4012	4008	msedge.exe	88
PID 4008 wrote to memory of 4012	4008	msedge.exe	88
PID 4008 wrote to memory of 4012	4008	msedge.exe	88
PID 4008 wrote to memory of 4012	4008	msedge.exe	88
PID 4008 wrote to memory of 4012	4008	msedge.exe	88
PID 4008 wrote to memory of 4012	4008	msedge.exe	88
PID 4008 wrote to memory of 4012	4008	msedge.exe	88
PID 4008 wrote to memory of 4012	4008	msedge.exe	88
PID 4008 wrote to memory of 4012	4008	msedge.exe	88
PID 4008 wrote to memory of 4012	4008	msedge.exe	88
PID 4008 wrote to memory of 4012	4008	msedge.exe	88
PID 4008 wrote to memory of 4012	4008	msedge.exe	88
PID 4008 wrote to memory of 4012	4008	msedge.exe	88
PID 4008 wrote to memory of 4012	4008	msedge.exe	88
PID 4008 wrote to memory of 4012	4008	msedge.exe	88
PID 4008 wrote to memory of 4012	4008	msedge.exe	88
PID 4008 wrote to memory of 4012	4008	msedge.exe	88
PID 4008 wrote to memory of 4012	4008	msedge.exe	88
PID 4008 wrote to memory of 4012	4008	msedge.exe	88
PID 4008 wrote to memory of 4012	4008	msedge.exe	88
PID 4008 wrote to memory of 4012	4008	msedge.exe	88
PID 4008 wrote to memory of 4012	4008	msedge.exe	88
PID 4008 wrote to memory of 4012	4008	msedge.exe	88
PID 4008 wrote to memory of 4012	4008	msedge.exe	88
PID 4008 wrote to memory of 4012	4008	msedge.exe	88
PID 4008 wrote to memory of 4012	4008	msedge.exe	88
PID 4008 wrote to memory of 2280	4008	msedge.exe	89
PID 4008 wrote to memory of 2280	4008	msedge.exe	89
PID 4008 wrote to memory of 2184	4008	msedge.exe	90
PID 4008 wrote to memory of 2184	4008	msedge.exe	90
PID 4008 wrote to memory of 2184	4008	msedge.exe	90
PID 4008 wrote to memory of 2184	4008	msedge.exe	90
PID 4008 wrote to memory of 2184	4008	msedge.exe	90
PID 4008 wrote to memory of 2184	4008	msedge.exe	90
PID 4008 wrote to memory of 2184	4008	msedge.exe	90
PID 4008 wrote to memory of 2184	4008	msedge.exe	90
PID 4008 wrote to memory of 2184	4008	msedge.exe	90
PID 4008 wrote to memory of 2184	4008	msedge.exe	90
PID 4008 wrote to memory of 2184	4008	msedge.exe	90
PID 4008 wrote to memory of 2184	4008	msedge.exe	90
PID 4008 wrote to memory of 2184	4008	msedge.exe	90
PID 4008 wrote to memory of 2184	4008	msedge.exe	90
PID 4008 wrote to memory of 2184	4008	msedge.exe	90
PID 4008 wrote to memory of 2184	4008	msedge.exe	90
PID 4008 wrote to memory of 2184	4008	msedge.exe	90
PID 4008 wrote to memory of 2184	4008	msedge.exe	90
PID 4008 wrote to memory of 2184	4008	msedge.exe	90
PID 4008 wrote to memory of 2184	4008	msedge.exe	90

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
5160	attrib.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://gofile.io/d/2qq6Da
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9fef846f8,0x7ff9fef84708,0x7ff9fef84718
  2⤵
  PID:512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,6373197965133089786,6880849093159974216,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
  2⤵
  PID:4012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,6373197965133089786,6880849093159974216,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2420 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,6373197965133089786,6880849093159974216,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2800 /prefetch:8
  2⤵
  PID:2184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,6373197965133089786,6880849093159974216,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:1
  2⤵
  PID:3608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,6373197965133089786,6880849093159974216,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3396 /prefetch:1
  2⤵
  PID:3412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,6373197965133089786,6880849093159974216,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4724 /prefetch:1
  2⤵
  PID:1728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,6373197965133089786,6880849093159974216,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4036 /prefetch:1
  2⤵
  PID:5108
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,6373197965133089786,6880849093159974216,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5480 /prefetch:8
  2⤵
  PID:4960
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,6373197965133089786,6880849093159974216,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5480 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,6373197965133089786,6880849093159974216,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5268 /prefetch:1
  2⤵
  PID:3692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,6373197965133089786,6880849093159974216,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5736 /prefetch:1
  2⤵
  PID:3992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,6373197965133089786,6880849093159974216,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5236 /prefetch:1
  2⤵
  PID:2652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2100,6373197965133089786,6880849093159974216,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5280 /prefetch:8
  2⤵
  PID:3044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,6373197965133089786,6880849093159974216,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3588 /prefetch:1
  2⤵
  PID:964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2100,6373197965133089786,6880849093159974216,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6200 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,6373197965133089786,6880849093159974216,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6248 /prefetch:1
  2⤵
  PID:4616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,6373197965133089786,6880849093159974216,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6276 /prefetch:1
  2⤵
  PID:1484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,6373197965133089786,6880849093159974216,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5044 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1676

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3300

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5060

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3304

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Amruus promo link generator\" -spe -an -ai#7zMap4365:116:7zEvent16550
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2792

C:\Users\Admin\Downloads\Amruus promo link generator\Promo link generator.exe
"C:\Users\Admin\Downloads\Amruus promo link generator\Promo link generator.exe"
1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3392
- C:\Windows\SYSTEM32\attrib.exe
  "attrib.exe" +h +s "C:\Users\Admin\Downloads\Amruus promo link generator\Promo link generator.exe"
  2⤵
  - Views/modifies file attributes
  PID:5160
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\Downloads\Amruus promo link generator\Promo link generator.exe'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5212
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5388
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5604
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5828
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" os get Caption
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5228
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" computersystem get totalphysicalmemory
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5352
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" csproduct get uuid
  2⤵
  PID:5356
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5472
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" path win32_VideoController get name
  2⤵
  - Detects videocard installed
  PID:5536
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\Downloads\Amruus promo link generator\Promo link generator.exe" && pause
  2⤵
  PID:5388
- - C:\Windows\system32\PING.EXE
    ping localhost
    3⤵
    - Runs ping.exe
    PID:5580

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\Amruus promo link generator\links.txt
1⤵
PID:6128

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Amruus promo link generator\" -spe -an -ai#7zMap32715:116:7zEvent30994
1⤵
- Suspicious use of FindShellTrayWindow
PID:5700

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Amruus promo link generator\Promo link generator\" -ad -an -ai#7zMap21930:158:7zEvent14776
1⤵
- Suspicious use of FindShellTrayWindow
PID:5640

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault6fbcc7d7h6867h4e36h9ba6h984dea750b12
1⤵
PID:3564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ff9fef846f8,0x7ff9fef84708,0x7ff9fef84718
  2⤵
  PID:1460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2196,7590056804811129546,6333916828766604885,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2216 /prefetch:2
  2⤵
  PID:5640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2196,7590056804811129546,6333916828766604885,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2380 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3828

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault272f3c80h9272h41afhb264h37c35bcbf94f
1⤵
PID:4908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff9fef846f8,0x7ff9fef84708,0x7ff9fef84718
  2⤵
  PID:6000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1488,15316051298022642633,2287546900288647619,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2180 /prefetch:2
  2⤵
  PID:5968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1488,15316051298022642633,2287546900288647619,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2248 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5796

C:\Windows\system32\SystemSettingsAdminFlows.exe
"C:\Windows\system32\SystemSettingsAdminFlows.exe" TurnOffDevicePortal
1⤵
PID:672

C:\Windows\system32\SystemSettingsAdminFlows.exe
"C:\Windows\system32\SystemSettingsAdminFlows.exe" TurnOffDevicePortal
1⤵
PID:2380

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault4a3d30a0hce23h4b50hb673h0276438cbde3
1⤵
PID:2324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff9fef846f8,0x7ff9fef84708,0x7ff9fef84718
  2⤵
  PID:1828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,14837334499727492883,17489026912755649324,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
  2⤵
  PID:5936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,14837334499727492883,17489026912755649324,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2356 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4892

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService
1⤵
PID:3348

C:\Windows\System32\CastSrv.exe
C:\Windows\System32\CastSrv.exe CCastServerControlInteractiveUser -Embedding
1⤵
- Modifies registry class
PID:1592

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault73374cc4h1749h4f83h8184h3c32196024c0
1⤵
PID:5176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff9fef846f8,0x7ff9fef84708,0x7ff9fef84718
  2⤵
  PID:5208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2040,6739381959016083492,4505045231657394912,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2076 /prefetch:2
  2⤵
  PID:180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2040,6739381959016083492,4505045231657394912,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:3
  2⤵
  PID:4980

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SendNotifyMessage
PID:5848

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7740a919423ddc469647f8fdd981324d

SHA1
c1bc3f834507e4940a0b7594e34c4b83bbea7cda

SHA256
bdd4adaa418d40558ab033ac0005fd6c2312d5f1f7fdf8b0e186fe1d65d78221

SHA512
7ad98d5d089808d9a707d577e76e809a223d3007778a672734d0a607c2c3ac5f93bc72adb6e6c7f878a577d3a1e69a16d0cd871eb6f58b8d88e2ea25f77d87b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4a4642516bc6372d8579b9c3705ec3ef

SHA1
4353ec5ea33952ad03b1058dc5d1b39489695058

SHA256
d8e0273e0138799bc98ec2fab75cb21379f1ec7d9426b570fe0d7da120ba18c9

SHA512
528ea3d3d02d6c0b861bb2b8400fbc27af54524dee25e4ca12d713e1ac52722ceac32ebcdb429509d85e66adde29efe4cfbd314629c6c20ab13f778b4d0fae30

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
296ca2fc16f1322c385592699f153ac7

SHA1
523b919cc32bf4e081cf2a6e9dda64d22b4a8efe

SHA256
2041e8d6c1da8aec31875b5349f8a310e0b95aa5d9cc2479a2b680e528ab7f8c

SHA512
b3bcc4fcb8108ff265c4e25ba3743e76cf729f027f016c04c5f9603a0bbd792887bcc0c4aedef4e634a1544822796edfc94df69d0afe774437774aa1e215bf7c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
00ed3d8b19978c7ade9bf7b5cebc895d

SHA1
ce73caa4a10904c8dc838ca6e343a0e532a766dc

SHA256
e75cf411c0dd8478fe0b4e5cf5140ec6853145d28116dfb3654b11bc3ed95086

SHA512
2de8b64b604ae98e09ae1c54d4b9526d89620d4c3e8fbf0260535f79b624b582675380c695bf0bc11da6fc6741dba0d0e08fb014a725d176ba36cb97aa006cab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9f44d6f922f830d04d7463189045a5a3

SHA1
2e9ae7188ab8f88078e83ba7f42a11a2c421cb1c

SHA256
0ae5cf8b49bc34fafe9f86734c8121b631bad52a1424c1dd2caa05781032334a

SHA512
7c1825eaefcc7b97bae31eeff031899300b175222de14000283e296e9b44680c8b3885a4ed5d78fd8dfee93333cd7289347b95a62bf11f751c4ca47772cf987d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
288B

MD5
eb9ad7324fa52f16722d60532e45978a

SHA1
330a89888d18066f41478a9b71570112031c8911

SHA256
3957e326291cdbb7267525adeab06310f58a49c4266886676df2c7715ff07544

SHA512
4169a1460817132df784912283ce22dfb2ab33c8d63c61733b74c018a073c771297e1bd893f428f59ed1c4f9b50008a05c2c90af2b9c81067badb4a00bedb2d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies

Filesize
20KB

MD5
de5cec302abf468bdb27d7156f6bc20d

SHA1
21ab94def99d7ff5d1e7637f0382e3d3eda25a25

SHA256
29f09789e82ae4a239fd65dc94e1837cb34f834fbb7ddf811b628aa04effe0aa

SHA512
3fd9e242c8092dd482aa0c07f0b16dffd8513da5714ac13e393618101b03b7e5245a59351ac27c3965dd962ceec27ac4b3e5c6d2fb90625691fa8ad0b2026d16

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log

Filesize
575B

MD5
de220018f802165aabb12128a922382c

SHA1
0ceffe7f544872b5afca9acf27e4f0c444374949

SHA256
14d7d94974bbc0c089e7ab4a291978ce221448ef3e92256ac6c2fc617f7e0b6a

SHA512
734366338e21eb1027268a1721356d5a4a8ad15186927d1f1efed2f4add5288764c23c9fcc71089b94b760b2781298155374d4161eb8dcd34137a18e3f3b8064

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
782B

MD5
d078b180407f798f1bb93ad48330ad5f

SHA1
a0c85d62b7092f4ed9dd03573733fd0987068f2a

SHA256
a6a0ab9e1e8fd7f307c3599c3d7d9f8e6c7a07003cc8b3e8ddd2415f08f5cc5a

SHA512
3ef46243e59fc20c29a104ba9d86f01fd1d4c5080fb0fdc1a6f6c2b4f7c10248441468d196ff0d80fd1a3b014263ba9f0f9e1774befbce4aa5ec5d5990d6fe66

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
575423cc71e60affa8c879678ccc8b0a

SHA1
25aa081a2a6916f94b6692f049b2f989ee4faf11

SHA256
dbf4574ae0acecefd5afd787c5cfea18b2dbe0acbf6dd146f0634e97cbb4e323

SHA512
c11c1a52a362759514ad29e37d51f2a507d65e2004fc279af8c6c3058c2e14ccf1116b23d8be6d773e2a5be78abbd76b29abbc79c79359fb2e9579edc8dc1a37

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4c4e7812a644ac7b7799d4ab5b4cddd2

SHA1
3d2fcfb31b40bec9a51c6fc2f15612106ea63b26

SHA256
12849a5231200e8b3244546e51e5aaa3fd74dd171ad0b44ab822747891876a61

SHA512
f45b2296f4cc2929753fb93ce359c995f726478243c78481374226929e2b48f13978aee4079aaffa66dc0a69192894f0083c1caeda1ac6b290635ea93e347c80

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
bf65e78d94d002352256ad22b40a5c8b

SHA1
f5dfeaba1754a327171a8eafdbf9d384fc5054ed

SHA256
39ef129b4b69224ca92ac5a1f4dd0a8a33f53d5d5d5805e68afb748c8c8c5b03

SHA512
19c8266bc2809f300581601fd6813a3a18a1a7547f636111e627ededf12776204e017966dc0e51682265471225582c237c141909bd3b1a33e2b94d5990e1f9a9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
113bad7dfbb725aa85ddc1985480f2f4

SHA1
d840aa581b1ca94ee449635d0341da72d43747df

SHA256
44952cad62cbafcc8dbeadaad4107db28cba719cee3966b65e5697ebd7fab9f5

SHA512
92e5f91172b2f8b632b3a936778db135408ca880746134f641edc789a4a60e857ad3759cb7a30ef7c86e2c6a3c1721f65db68f1e2a78afaaa7266791c338efa5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
e6022f57bae50a0a6ced891ec7d55be9

SHA1
4b40c3f88bd1fb22be52961af89c495ab42ee43c

SHA256
d99043eade93a6e9a142594ee028b299a8aa1ecc50c46c20645450e43076a295

SHA512
32174e1fd58cfb74b7bb1029915c301cf4f1fc331e1af2a21e9abc0234124bfba65b1d79c9e60b7d05c91c1e6033af76478309963ee3b4111da1108a02d6ccf0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
f1a7f46bde1354306c20897a2fd30c83

SHA1
5f0afbb8836e536fb3c3823817c95585c24789ce

SHA256
b32d55564fc6c00a2050d7e0428765a08a223027d2dc714ea0adff5bad53ef9f

SHA512
515c270fbdcfe3f10b944b1f6a7db7a25d1c376a599537743327223ed84ae3c143d42b86c82dbf88f4e4f0b1a29249d687a44c4f113625b1c500a218e85642d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
9bfce9b9bbcd78920463cf2087440f5b

SHA1
5295cf598e62c823c42f1993dfe6bc817b05ff83

SHA256
d50375d7b57fd7777160c4277565f756e35d69379760d317dd3223c25b38e1e1

SHA512
4268971f12b1c212385cec609c40554d3310a33ce7af88d4ca48b74a4d4c61179d03ad34dbb3655cd41a0a032fc6382efc1338c46af908fc1481c47d7dccc38b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
e69c25feae343dd8e7d99952d1985213

SHA1
efc314e04c5c342ac388058e3ced3fb76a5dbc5c

SHA256
de8151801ce1879a60f9e7199322544175279d5f7f80ae6fb1354743e342ae94

SHA512
69a27818d1a50c1902779999e7ec02ee22922e67a51d148c2e006d6ebe457da54520eec3679b6855675cb8975e6bde5fec3105b1944510eee5bd13f991180ef8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
f558cb7706151057f6bf52551114c661

SHA1
476d2fbe5855e3711754e6ddf3790207c93133d4

SHA256
ade719dc5e9859519ec8786eef2744556bd4b9081095bc724b108d296d718993

SHA512
6e97de8d5c1b048a10b0e520997c6aec25da067f756fd487abbd8fc872273fd142234342617a14159ab3f2b079f1176983b2d03fd0b31289093e4bea3c2ebf59

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
a9976404b13e194af11c3fa15672e3f0

SHA1
1294e52fc98e2505b0d53df9bd97c692936a9b5e

SHA256
19b7d3d6e2805b38c677e8c8a599bf38061afd1049855576246f94eb6c7545ae

SHA512
7c514d3ed0f56c135e3d7f9be9fc287eae610324bf57dd1122098d7ed89c32926cd40d86e68a08dd1dceebac8e3aded6f9a6f3f719b7093e4f33d03c5cacee9d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
ec322f1e8b16b90143d58d6326e88c7f

SHA1
fc6ab3f26e82dcb252f574bb35e14d7ba0a9848d

SHA256
219cf93aaabc6b3d0336d3138675510e48e8d25ce6fcd9671c60b9c0c1ea75fd

SHA512
d4f72b1718e8d3d6a237e390cb8e3f3d8818de986d7306f68dda57db72b6fb185747a075bab718accf11f9ac12d5f8218776ec6e035912919270962fca542535

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
6d3e9c29fe44e90aae6ed30ccf799ca8

SHA1
c7974ef72264bbdf13a2793ccf1aed11bc565dce

SHA256
2360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d

SHA512
60c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
948B

MD5
1aefe566d0c19c9e3ddaf9ea005f71c0

SHA1
8d8cfb0d2192706100eb241f38a32b31f03329f1

SHA256
dc85b671f8ebac6cfa68897b1826019925c95a5ec36676fe18ba0085f437905a

SHA512
f22782b33f7990a0783154fbe6d49e03f16c873a3b4c91f1fc5ed76d0e7b88f0df876ccdf007828ba4d9a5f97cb2362f922cbacad03de5804bc8abeb36cb2d09

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
88be3bc8a7f90e3953298c0fdbec4d72

SHA1
f4969784ad421cc80ef45608727aacd0f6bf2e4b

SHA256
533c8470b41084e40c5660569ebbdb7496520d449629a235e8053e84025f348a

SHA512
4fce64e2dacddbc03314048fef1ce356ee2647c14733da121c23c65507eeb8d721d6b690ad5463319b364dc4fa95904ad6ab096907f32918e3406ef438a6ef7c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
107102102e02e48f37f5318c7e113c43

SHA1
7fb10fc65c85fb4c050309f0872bc9389dcccc0d

SHA256
3c3f49948c1e832c86b959c32bc288ddedb500534b74df082f8967fc7f9976f7

SHA512
b108a47d7c3dd154cad44362b6cd557b7064096383d100e6cd64bfb19c4e2ad878ed4ee800776322ad3cc4bb721fb675b0ecab8f5661024188fa3aa19561841b

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5ic2ybmi.h0v.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\Downloads\Amruus promo link generator.rar

Filesize
79KB

MD5
0b25d0cf701d9c68ae40085c1afe2e3d

SHA1
0266c00fdcddc3e2f835cfb4109dffe1e7cf32c7

SHA256
8f0352553ab0acb32642074579db93344be53f54c700ee70bef3335db09c6529

SHA512
cb797620225ab96d36f58dd50570e00a71909ad68d5080ce5d85e0e0b8b85ea38aba4487b434973d8c28b61c5a3914f8e7779c488a67f4b3a9d80bd95fcf0b6a

Download Submit
C:\Users\Admin\Downloads\Amruus promo link generator\Promo link generator.exe

Filesize
228KB

MD5
4e711e7231a67ebf4278a6ba9e2a1f98

SHA1
9bc200a14d089e0fe869674ee5f4219e86dc3009

SHA256
cfb4919168697ab5bfaa045cbf2c647aa55c1ffc8f5109acf90f2e90af14f40a

SHA512
38ac5f01c19304431f1b862172fd0ed7b67fd8926c94e289a7a9b06a6772b02c7708f9ebeb3263269721d379dede458bd29d16fd6eb81eb500d85b202707ec0f

Download Submit
C:\Users\Admin\Downloads\Amruus promo link generator\links.txt

Filesize
1B

MD5
68b329da9893e34099c7d8ad5cb9c940

SHA1
adc83b19e793491b1c6ea0fd8b46cd9f32e592fc

SHA256
01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b

SHA512
be688838ca8686e5c90689bf2ab585cef1137c999b48c70b92f67a5c34dc15697b5d11c982ed6d71be1e1e7f7b4e0733884aa97c3f7a339a8ed03577cf74be09

Download Submit
C:\Windows\system32\drivers\etc\hosts

Filesize
2KB

MD5
4028457913f9d08b06137643fe3e01bc

SHA1
a5cb3f12beaea8194a2d3d83a62bdb8d558f5f14

SHA256
289d433902418aaf62e7b96b215ece04fcbcef2457daf90f46837a4d5090da58

SHA512
c8e1eef90618341bbde885fd126ece2b1911ca99d20d82f62985869ba457553b4c2bf1e841fd06dacbf27275b3b0940e5a794e1b1db0fd56440a96592362c28b

Download Submit
memory/3392-165-0x000001EB463D0000-0x000001EB463EE000-memory.dmp

Filesize
120KB

Download
memory/3392-161-0x000001EB46410000-0x000001EB46486000-memory.dmp

Filesize
472KB

Download
memory/3392-125-0x000001EB46280000-0x000001EB46290000-memory.dmp

Filesize
64KB

Download
memory/3392-242-0x00007FF9EBD60000-0x00007FF9EC821000-memory.dmp

Filesize
10.8MB

Download
memory/3392-124-0x00007FF9EBD60000-0x00007FF9EC821000-memory.dmp

Filesize
10.8MB

Download
memory/3392-123-0x000001EB2BCE0000-0x000001EB2BD20000-memory.dmp

Filesize
256KB

Download
memory/3392-211-0x000001EB46280000-0x000001EB46290000-memory.dmp

Filesize
64KB

Download
memory/3392-163-0x000001EB46490000-0x000001EB464E0000-memory.dmp

Filesize
320KB

Download
memory/3392-195-0x00007FF9EBD60000-0x00007FF9EC821000-memory.dmp

Filesize
10.8MB

Download
memory/3392-215-0x000001EB46630000-0x000001EB46642000-memory.dmp

Filesize
72KB

Download
memory/3392-214-0x000001EB464E0000-0x000001EB464EA000-memory.dmp

Filesize
40KB

Download
memory/5212-131-0x0000020BB3D80000-0x0000020BB3DA2000-memory.dmp

Filesize
136KB

Download
memory/5212-136-0x00007FF9EBD60000-0x00007FF9EC821000-memory.dmp

Filesize
10.8MB

Download
memory/5212-137-0x0000020BB3D20000-0x0000020BB3D30000-memory.dmp

Filesize
64KB

Download
memory/5212-138-0x0000020BB3D20000-0x0000020BB3D30000-memory.dmp

Filesize
64KB

Download
memory/5212-141-0x00007FF9EBD60000-0x00007FF9EC821000-memory.dmp

Filesize
10.8MB

Download
memory/5388-158-0x00007FF9EBD60000-0x00007FF9EC821000-memory.dmp

Filesize
10.8MB

Download
memory/5388-143-0x00007FF9EBD60000-0x00007FF9EC821000-memory.dmp

Filesize
10.8MB

Download
memory/5388-144-0x00000265503A0000-0x00000265503B0000-memory.dmp

Filesize
64KB

Download
memory/5388-145-0x00000265503A0000-0x00000265503B0000-memory.dmp

Filesize
64KB

Download
memory/5388-157-0x00000265503A0000-0x00000265503B0000-memory.dmp

Filesize
64KB

Download
memory/5472-232-0x000001B6E6A70000-0x000001B6E6A80000-memory.dmp

Filesize
64KB

Download
memory/5472-234-0x00007FF9EBD60000-0x00007FF9EC821000-memory.dmp

Filesize
10.8MB

Download
memory/5472-231-0x000001B6E6A70000-0x000001B6E6A80000-memory.dmp

Filesize
64KB

Download
memory/5472-230-0x00007FF9EBD60000-0x00007FF9EC821000-memory.dmp

Filesize
10.8MB

Download
memory/5604-167-0x0000017F80100000-0x0000017F80110000-memory.dmp

Filesize
64KB

Download
memory/5604-166-0x00007FF9EBD60000-0x00007FF9EC821000-memory.dmp

Filesize
10.8MB

Download
memory/5604-192-0x0000017F80100000-0x0000017F80110000-memory.dmp

Filesize
64KB

Download
memory/5604-194-0x00007FF9EBD60000-0x00007FF9EC821000-memory.dmp

Filesize
10.8MB

Download
memory/5604-168-0x0000017F80100000-0x0000017F80110000-memory.dmp

Filesize
64KB

Download
memory/5828-196-0x00007FF9EBD60000-0x00007FF9EC821000-memory.dmp

Filesize
10.8MB

Download
memory/5828-210-0x00007FF9EBD60000-0x00007FF9EC821000-memory.dmp

Filesize
10.8MB

Download
memory/5828-206-0x000001C3A3560000-0x000001C3A3570000-memory.dmp

Filesize
64KB

Download
memory/5828-208-0x000001C3A3560000-0x000001C3A3570000-memory.dmp

Filesize
64KB

Download
memory/5848-438-0x000001F2599B0000-0x000001F2599B1000-memory.dmp

Filesize
4KB

Download
memory/5848-444-0x000001F2599B0000-0x000001F2599B1000-memory.dmp

Filesize
4KB

Download
memory/5848-445-0x000001F2599B0000-0x000001F2599B1000-memory.dmp

Filesize
4KB

Download
memory/5848-446-0x000001F2599B0000-0x000001F2599B1000-memory.dmp

Filesize
4KB

Download
memory/5848-447-0x000001F2599B0000-0x000001F2599B1000-memory.dmp

Filesize
4KB

Download
memory/5848-448-0x000001F2599B0000-0x000001F2599B1000-memory.dmp

Filesize
4KB

Download
memory/5848-449-0x000001F2599B0000-0x000001F2599B1000-memory.dmp

Filesize
4KB

Download
memory/5848-443-0x000001F2599B0000-0x000001F2599B1000-memory.dmp

Filesize
4KB

Download
memory/5848-439-0x000001F2599B0000-0x000001F2599B1000-memory.dmp

Filesize
4KB

Download
memory/5848-437-0x000001F2599B0000-0x000001F2599B1000-memory.dmp

Filesize
4KB

Download