umbral | 8e95865efd39220dfc4abebc27141d9eae288a11981e43f09cbee6bf90347fe0

Analysis

max time kernel
637s
max time network
645s
platform
windows10-2004_x64
resource
win10v2004-20240319-en
resource tags

arch:x64arch:x86image:win10v2004-20240319-enlocale:en-usos:windows10-2004-x64system
submitted
20-03-2024 18:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Bunifu.Licensing.dll
Size

1.3MB
MD5

2b2740e0c34a46de31cf9da8a75d77cf
SHA1

242324f1112e6387cda41686291b6e9a415eeb8c
SHA256

a9be91cae167702885a5ca74273db779e3e391e2e604cc03779ed403c53ebe43
SHA512

605eb300b159e6ed2ee872b6ee378eed7dde6541000221fcd94d52057be91cb3c7dd65c7203f05e0718303b157b6fb941498b5e653501f97f0417d459da6bc40
SSDEEP

24576:ebkurkdR5uuMeiPUf2lHmdpjrcbYdwcqMw5LTvBrq/WGs1xGUfGUCco:a1roD9MeiUDDjrW4bqD5LDBrqWG0GUfX

Score

10^/10

umbral agilenet stealer

Malware Config

Extracted

Family

umbral

https://discord.com/api/webhooks/1220069539069563050/zxN4Ew3bBFIRZqePrUxrfkpmDDY33Gr-evzJR44SuGBJ33mnvW2lhPf61k1Eo_Z2Cy1C

Signatures

Detect Umbral payload 5 IoCs

resource	yara_rule
behavioral1/files/0x0007000000023ac0-2394.dat	family_umbral
behavioral1/memory/5272-2396-0x00000203A88B0000-0x00000203A88F0000-memory.dmp	family_umbral
behavioral1/files/0x000b000000023347-2424.dat	family_umbral
behavioral1/files/0x00090000000233e6-2434.dat	family_umbral
behavioral1/files/0x0009000000023abf-2449.dat	family_umbral

Umbral
Umbral stealer is an opensource moduler stealer written in C#.
stealer umbral

Executes dropped EXE 1 IoCs

pid	Process
5272	Umbral.exe

Obfuscated with Agile.Net obfuscator 9 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

resource	yara_rule
behavioral1/memory/5468-999-0x0000023682D00000-0x0000023682D20000-memory.dmp	agile_net
behavioral1/memory/5468-1001-0x0000023682D20000-0x0000023682D40000-memory.dmp	agile_net
behavioral1/memory/5468-1002-0x000002369CFD0000-0x000002369D03E000-memory.dmp	agile_net
behavioral1/memory/5468-1003-0x0000023682CF0000-0x0000023682CFE000-memory.dmp	agile_net
behavioral1/memory/5468-1005-0x000002369D080000-0x000002369D0DA000-memory.dmp	agile_net
behavioral1/memory/5468-1006-0x0000023682D40000-0x0000023682D50000-memory.dmp	agile_net
behavioral1/memory/5468-1011-0x0000023682D80000-0x0000023682D9E000-memory.dmp	agile_net
behavioral1/memory/5468-1016-0x000002369D230000-0x000002369D37A000-memory.dmp	agile_net
behavioral1/memory/2636-2317-0x00000294BC0F0000-0x00000294BC100000-memory.dmp	agile_net

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
138	discord.com
139	discord.com

Checks processor information in registry 2 TTPs 13 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg\{94D6DDCC-4A68-4175-A374-BD584A510B78}	Umbral.builder.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg\{94D6DDCC-4A68-4175-A374-BD584A510B78}\IconSize = "16"	Umbral.builder.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg\{94D6DDCC-4A68-4175-A374-BD584A510B78}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	Umbral.builder.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	Umbral.builder.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\3 = 14002e80922b16d365937a46956b92703aca08af0000	Umbral.builder.exe
Key created	\REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}	Umbral.builder.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4"	Umbral.builder.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16"	Umbral.builder.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\11\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\FFlags = "1092616257"	Umbral.builder.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\6 = 3a002e8096f2fd3decdbb44f81d16a3438bcf4de260001002600efbe11000000d9ce939b297ada019318e732327ada019318e732327ada0114000000	Umbral.builder.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	Umbral.builder.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg\{94D6DDCC-4A68-4175-A374-BD584A510B78}\GroupView = "0"	Umbral.builder.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\4\MRUListEx = 00000000ffffffff	Umbral.builder.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\4\MRUListEx = ffffffff	Umbral.builder.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\FFlags = "1092616257"	Umbral.builder.exe
Key created	\REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}	Umbral.builder.exe
Key created	\REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell	Umbral.builder.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	Umbral.builder.exe
Key created	\REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\5	Umbral.builder.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{5FA96407-7E77-483C-AC93-691D05850DE8}\FFlags = "1092616257"	Umbral.builder.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\GroupByDirection = "1"	Umbral.builder.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg\{94D6DDCC-4A68-4175-A374-BD584A510B78}\GroupByDirection = "1"	Umbral.builder.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000050000001800000030f125b7ef471a10a5f102608c9eebac0a000000a0000000b474dbf787420341afbaf1b13dcd75cf64000000a000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000e0859ff2f94f6810ab9108002b27b3d90500000058000000	Umbral.builder.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\SniffedFolderType = "Generic"	Umbral.builder.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	Umbral.builder.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16"	Umbral.builder.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg\{94D6DDCC-4A68-4175-A374-BD584A510B78}\FFlags = "1092616257"	Umbral.builder.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\3\MRUListEx = ffffffff	Umbral.builder.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295"	Umbral.builder.exe
Key created	\REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{5FA96407-7E77-483C-AC93-691D05850DE8}	Umbral.builder.exe
Key created	\REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\4\0	Umbral.builder.exe
Key created	\REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell	Umbral.builder.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4"	Umbral.builder.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	Umbral.builder.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	Umbral.builder.exe
Key created	\REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell	Umbral.builder.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\5\NodeSlot = "8"	Umbral.builder.exe
Key created	\REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9	Umbral.builder.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\6\NodeSlot = "9"	Umbral.builder.exe
Key created	\REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1	Umbral.builder.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\Shell\SniffedFolderType = "Documents"	Umbral.builder.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1"	Umbral.builder.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\4\0\MRUListEx = ffffffff	Umbral.builder.exe
Key created	\REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	Umbral.builder.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	Umbral.builder.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\12\ComDlg\{94D6DDCC-4A68-4175-A374-BD584A510B78}\Mode = "4"	Umbral.builder.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4"	Umbral.builder.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0"	Umbral.builder.exe
Key created	\REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg	Umbral.builder.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616257"	Umbral.builder.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg\{94D6DDCC-4A68-4175-A374-BD584A510B78}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000050000001800000030f125b7ef471a10a5f102608c9eebac0a000000a00000002e37a3569cced2119f0e006097c686f60700000028000000e0859ff2f94f6810ab9108002b27b3d902000000a00000002e37a3569cced2119f0e006097c686f602000000780000002e37a3569cced2119f0e006097c686f60400000088000000	Umbral.builder.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Version = "1"	Umbral.builder.exe
Key created	\REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{5FA96407-7E77-483C-AC93-691D05850DE8}	Umbral.builder.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg\{94D6DDCC-4A68-4175-A374-BD584A510B78}\GroupByKey:PID = "0"	Umbral.builder.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 01000000040000000600000005000000030000000200000000000000ffffffff	Umbral.builder.exe
Key created	\REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\Shell	Umbral.builder.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{5FA96407-7E77-483C-AC93-691D05850DE8}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	Umbral.builder.exe
Key created	\REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000_Classes\Local Settings	Umbral.builder.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1"	Umbral.builder.exe
Key created	\REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg\{94D6DDCC-4A68-4175-A374-BD584A510B78}	Umbral.builder.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\12\ComDlg\{94D6DDCC-4A68-4175-A374-BD584A510B78}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000050000001800000030f125b7ef471a10a5f102608c9eebac0a000000a00000002e37a3569cced2119f0e006097c686f60700000028000000e0859ff2f94f6810ab9108002b27b3d902000000a00000002e37a3569cced2119f0e006097c686f602000000780000002e37a3569cced2119f0e006097c686f60400000088000000	Umbral.builder.exe
Key created	\REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3	Umbral.builder.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202020202020202	Umbral.builder.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	Umbral.builder.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\Umbral.Stealer.zip:Zone.Identifier	firefox.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
3324	WINWORD.EXE
3324	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5468	Umbral.builder.exe
5468	Umbral.builder.exe
5468	Umbral.builder.exe
5468	Umbral.builder.exe
5468	Umbral.builder.exe
5468	Umbral.builder.exe
5468	Umbral.builder.exe
5468	Umbral.builder.exe
5468	Umbral.builder.exe
5468	Umbral.builder.exe
5468	Umbral.builder.exe
5468	Umbral.builder.exe
5468	Umbral.builder.exe
5468	Umbral.builder.exe
5468	Umbral.builder.exe
5468	Umbral.builder.exe
5468	Umbral.builder.exe
5468	Umbral.builder.exe
5468	Umbral.builder.exe
5468	Umbral.builder.exe
5468	Umbral.builder.exe
5468	Umbral.builder.exe
5468	Umbral.builder.exe
5468	Umbral.builder.exe
5468	Umbral.builder.exe
5468	Umbral.builder.exe
5468	Umbral.builder.exe
5468	Umbral.builder.exe
5468	Umbral.builder.exe
5468	Umbral.builder.exe
5468	Umbral.builder.exe
5468	Umbral.builder.exe
5468	Umbral.builder.exe
5468	Umbral.builder.exe
5468	Umbral.builder.exe
5468	Umbral.builder.exe
5468	Umbral.builder.exe
5468	Umbral.builder.exe
5468	Umbral.builder.exe
5468	Umbral.builder.exe
5468	Umbral.builder.exe
5468	Umbral.builder.exe
5468	Umbral.builder.exe
5468	Umbral.builder.exe
5468	Umbral.builder.exe
5468	Umbral.builder.exe
5468	Umbral.builder.exe
5468	Umbral.builder.exe
5468	Umbral.builder.exe
5468	Umbral.builder.exe
5468	Umbral.builder.exe
5468	Umbral.builder.exe
5468	Umbral.builder.exe
5468	Umbral.builder.exe
5468	Umbral.builder.exe
5468	Umbral.builder.exe
5468	Umbral.builder.exe
5468	Umbral.builder.exe
5468	Umbral.builder.exe
5468	Umbral.builder.exe
5468	Umbral.builder.exe
5468	Umbral.builder.exe
5468	Umbral.builder.exe
5468	Umbral.builder.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
4968	Umbral.builder.exe
6116	Umbral.builder.exe

Suspicious use of AdjustPrivilegeToken 47 IoCs

description	pid	Process
Token: SeDebugPrivilege	5468	Umbral.builder.exe
Token: SeDebugPrivilege	2636	Umbral.builder.exe
Token: SeDebugPrivilege	5272	Umbral.exe
Token: SeIncreaseQuotaPrivilege	4584	wmic.exe
Token: SeSecurityPrivilege	4584	wmic.exe
Token: SeTakeOwnershipPrivilege	4584	wmic.exe
Token: SeLoadDriverPrivilege	4584	wmic.exe
Token: SeSystemProfilePrivilege	4584	wmic.exe
Token: SeSystemtimePrivilege	4584	wmic.exe
Token: SeProfSingleProcessPrivilege	4584	wmic.exe
Token: SeIncBasePriorityPrivilege	4584	wmic.exe
Token: SeCreatePagefilePrivilege	4584	wmic.exe
Token: SeBackupPrivilege	4584	wmic.exe
Token: SeRestorePrivilege	4584	wmic.exe
Token: SeShutdownPrivilege	4584	wmic.exe
Token: SeDebugPrivilege	4584	wmic.exe
Token: SeSystemEnvironmentPrivilege	4584	wmic.exe
Token: SeRemoteShutdownPrivilege	4584	wmic.exe
Token: SeUndockPrivilege	4584	wmic.exe
Token: SeManageVolumePrivilege	4584	wmic.exe
Token: 33	4584	wmic.exe
Token: 34	4584	wmic.exe
Token: 35	4584	wmic.exe
Token: 36	4584	wmic.exe
Token: SeIncreaseQuotaPrivilege	4584	wmic.exe
Token: SeSecurityPrivilege	4584	wmic.exe
Token: SeTakeOwnershipPrivilege	4584	wmic.exe
Token: SeLoadDriverPrivilege	4584	wmic.exe
Token: SeSystemProfilePrivilege	4584	wmic.exe
Token: SeSystemtimePrivilege	4584	wmic.exe
Token: SeProfSingleProcessPrivilege	4584	wmic.exe
Token: SeIncBasePriorityPrivilege	4584	wmic.exe
Token: SeCreatePagefilePrivilege	4584	wmic.exe
Token: SeBackupPrivilege	4584	wmic.exe
Token: SeRestorePrivilege	4584	wmic.exe
Token: SeShutdownPrivilege	4584	wmic.exe
Token: SeDebugPrivilege	4584	wmic.exe
Token: SeSystemEnvironmentPrivilege	4584	wmic.exe
Token: SeRemoteShutdownPrivilege	4584	wmic.exe
Token: SeUndockPrivilege	4584	wmic.exe
Token: SeManageVolumePrivilege	4584	wmic.exe
Token: 33	4584	wmic.exe
Token: 34	4584	wmic.exe
Token: 35	4584	wmic.exe
Token: 36	4584	wmic.exe
Token: SeDebugPrivilege	4968	Umbral.builder.exe
Token: SeDebugPrivilege	6116	Umbral.builder.exe

Suspicious use of FindShellTrayWindow 7 IoCs

pid	Process
1424	firefox.exe
1424	firefox.exe
1424	firefox.exe
1424	firefox.exe
1424	firefox.exe
1424	firefox.exe
1424	firefox.exe

Suspicious use of SendNotifyMessage 6 IoCs

pid	Process
1424	firefox.exe
1424	firefox.exe
1424	firefox.exe
1424	firefox.exe
1424	firefox.exe
1424	firefox.exe

Suspicious use of SetWindowsHookEx 25 IoCs

pid	Process
1424	firefox.exe
1424	firefox.exe
1424	firefox.exe
1424	firefox.exe
5468	Umbral.builder.exe
5468	Umbral.builder.exe
5468	Umbral.builder.exe
2636	Umbral.builder.exe
2636	Umbral.builder.exe
3324	WINWORD.EXE
3324	WINWORD.EXE
3324	WINWORD.EXE
3324	WINWORD.EXE
3324	WINWORD.EXE
3324	WINWORD.EXE
3324	WINWORD.EXE
4968	Umbral.builder.exe
4968	Umbral.builder.exe
4968	Umbral.builder.exe
4968	Umbral.builder.exe
4968	Umbral.builder.exe
4968	Umbral.builder.exe
6116	Umbral.builder.exe
6116	Umbral.builder.exe
6116	Umbral.builder.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2300 wrote to memory of 2184	2300	firefox.exe	100
PID 2300 wrote to memory of 2184	2300	firefox.exe	100
PID 2300 wrote to memory of 2184	2300	firefox.exe	100
PID 2300 wrote to memory of 2184	2300	firefox.exe	100
PID 2300 wrote to memory of 2184	2300	firefox.exe	100
PID 2300 wrote to memory of 2184	2300	firefox.exe	100
PID 2300 wrote to memory of 2184	2300	firefox.exe	100
PID 2300 wrote to memory of 2184	2300	firefox.exe	100
PID 2300 wrote to memory of 2184	2300	firefox.exe	100
PID 2300 wrote to memory of 2184	2300	firefox.exe	100
PID 2300 wrote to memory of 2184	2300	firefox.exe	100
PID 1424 wrote to memory of 4276	1424	firefox.exe	101
PID 1424 wrote to memory of 4276	1424	firefox.exe	101
PID 1424 wrote to memory of 1320	1424	firefox.exe	102
PID 1424 wrote to memory of 1320	1424	firefox.exe	102
PID 1424 wrote to memory of 1320	1424	firefox.exe	102
PID 1424 wrote to memory of 1320	1424	firefox.exe	102
PID 1424 wrote to memory of 1320	1424	firefox.exe	102
PID 1424 wrote to memory of 1320	1424	firefox.exe	102
PID 1424 wrote to memory of 1320	1424	firefox.exe	102
PID 1424 wrote to memory of 1320	1424	firefox.exe	102
PID 1424 wrote to memory of 1320	1424	firefox.exe	102
PID 1424 wrote to memory of 1320	1424	firefox.exe	102
PID 1424 wrote to memory of 1320	1424	firefox.exe	102
PID 1424 wrote to memory of 1320	1424	firefox.exe	102
PID 1424 wrote to memory of 1320	1424	firefox.exe	102
PID 1424 wrote to memory of 1320	1424	firefox.exe	102
PID 1424 wrote to memory of 1320	1424	firefox.exe	102
PID 1424 wrote to memory of 1320	1424	firefox.exe	102
PID 1424 wrote to memory of 1320	1424	firefox.exe	102
PID 1424 wrote to memory of 1320	1424	firefox.exe	102
PID 1424 wrote to memory of 1320	1424	firefox.exe	102
PID 1424 wrote to memory of 1320	1424	firefox.exe	102
PID 1424 wrote to memory of 1320	1424	firefox.exe	102
PID 1424 wrote to memory of 1320	1424	firefox.exe	102
PID 1424 wrote to memory of 1320	1424	firefox.exe	102
PID 1424 wrote to memory of 1320	1424	firefox.exe	102
PID 1424 wrote to memory of 1320	1424	firefox.exe	102
PID 1424 wrote to memory of 1320	1424	firefox.exe	102
PID 1424 wrote to memory of 1320	1424	firefox.exe	102
PID 1424 wrote to memory of 1320	1424	firefox.exe	102
PID 1424 wrote to memory of 1320	1424	firefox.exe	102
PID 1424 wrote to memory of 1320	1424	firefox.exe	102
PID 1424 wrote to memory of 1320	1424	firefox.exe	102
PID 1424 wrote to memory of 1320	1424	firefox.exe	102
PID 1424 wrote to memory of 1320	1424	firefox.exe	102
PID 1424 wrote to memory of 1320	1424	firefox.exe	102
PID 1424 wrote to memory of 1320	1424	firefox.exe	102
PID 1424 wrote to memory of 1320	1424	firefox.exe	102
PID 1424 wrote to memory of 1320	1424	firefox.exe	102
PID 1424 wrote to memory of 1320	1424	firefox.exe	102
PID 1424 wrote to memory of 1320	1424	firefox.exe	102
PID 1424 wrote to memory of 1320	1424	firefox.exe	102
PID 1424 wrote to memory of 1320	1424	firefox.exe	102
PID 1424 wrote to memory of 4908	1424	firefox.exe	103
PID 1424 wrote to memory of 4908	1424	firefox.exe	103
PID 1424 wrote to memory of 4908	1424	firefox.exe	103
PID 1424 wrote to memory of 4908	1424	firefox.exe	103
PID 1424 wrote to memory of 4908	1424	firefox.exe	103
PID 1424 wrote to memory of 4908	1424	firefox.exe	103
PID 1424 wrote to memory of 4908	1424	firefox.exe	103
PID 1424 wrote to memory of 4908	1424	firefox.exe	103
PID 1424 wrote to memory of 4908	1424	firefox.exe	103
PID 1424 wrote to memory of 4908	1424	firefox.exe	103

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Bunifu.Licensing.dll,#1
1⤵
PID:2772

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Checks processor information in registry
- NTFS ADS
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1424
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1424.0.1099835702\1227687680" -parentBuildID 20221007134813 -prefsHandle 1912 -prefMapHandle 1904 -prefsLen 20749 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {7f97fb2f-0c45-41a7-be60-447e49fc93cb} 1424 "\\.\pipe\gecko-crash-server-pipe.1424" 1992 2b5db1ede58 gpu
  2⤵
  PID:4276
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1424.1.1777232279\1345692594" -parentBuildID 20221007134813 -prefsHandle 2364 -prefMapHandle 2352 -prefsLen 20785 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2825f09e-6d32-4c93-844c-d1890d733a8f} 1424 "\\.\pipe\gecko-crash-server-pipe.1424" 2392 2b5c736fe58 socket
  2⤵
  PID:1320
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1424.2.730797855\2000354342" -childID 1 -isForBrowser -prefsHandle 3236 -prefMapHandle 3232 -prefsLen 20823 -prefMapSize 233444 -jsInitHandle 1412 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {69bc6ec4-3435-4bd0-998a-8f8d47364a9c} 1424 "\\.\pipe\gecko-crash-server-pipe.1424" 3280 2b5df286a58 tab
  2⤵
  PID:4908
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1424.3.1042585082\1567133427" -childID 2 -isForBrowser -prefsHandle 3608 -prefMapHandle 3604 -prefsLen 26066 -prefMapSize 233444 -jsInitHandle 1412 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {191c7fde-9579-4995-98f3-92b509d3decd} 1424 "\\.\pipe\gecko-crash-server-pipe.1424" 3620 2b5c7367558 tab
  2⤵
  PID:4120
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1424.4.1128192426\936483025" -childID 3 -isForBrowser -prefsHandle 4196 -prefMapHandle 4224 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1412 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e4ca1658-850c-4156-816b-065c9a37a88d} 1424 "\\.\pipe\gecko-crash-server-pipe.1424" 3948 2b5e0d39858 tab
  2⤵
  PID:1392
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1424.5.305050164\822904263" -childID 4 -isForBrowser -prefsHandle 5048 -prefMapHandle 5016 -prefsLen 26206 -prefMapSize 233444 -jsInitHandle 1412 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1f7f809d-b270-4c0a-aaa2-4d6ddddf2c7b} 1424 "\\.\pipe\gecko-crash-server-pipe.1424" 4984 2b5e0d3a758 tab
  2⤵
  PID:5360
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1424.6.1011770601\287999267" -childID 5 -isForBrowser -prefsHandle 5184 -prefMapHandle 5188 -prefsLen 26206 -prefMapSize 233444 -jsInitHandle 1412 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {590322d2-ba1f-4410-a5d7-357b9bc790c6} 1424 "\\.\pipe\gecko-crash-server-pipe.1424" 5176 2b5e18b8758 tab
  2⤵
  PID:5368
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1424.7.885317681\1161483235" -childID 6 -isForBrowser -prefsHandle 5388 -prefMapHandle 5392 -prefsLen 26206 -prefMapSize 233444 -jsInitHandle 1412 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {77fdf5a6-afc2-4613-9eb2-aa49d1ae12da} 1424 "\\.\pipe\gecko-crash-server-pipe.1424" 5160 2b5e18b9358 tab
  2⤵
  PID:5376

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2300
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  PID:2184

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=2712 --field-trial-handle=2264,i,1475924722205134884,16549311107360026087,262144 --variations-seed-version /prefetch:8
1⤵
PID:6080

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:720

C:\Users\Admin\Downloads\Umbral.Stealer\Umbral.builder.exe
"C:\Users\Admin\Downloads\Umbral.Stealer\Umbral.builder.exe"
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:5468

C:\Users\Admin\Downloads\Umbral.Stealer\Umbral.builder.exe
"C:\Users\Admin\Downloads\Umbral.Stealer\Umbral.builder.exe"
1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2636

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Documents\These.docx" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:3324

C:\Users\Admin\Documents\Umbral.exe
"C:\Users\Admin\Documents\Umbral.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5272
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" csproduct get uuid
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4584

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=2184 --field-trial-handle=2264,i,1475924722205134884,16549311107360026087,262144 --variations-seed-version /prefetch:8
1⤵
PID:2724

C:\Users\Admin\Downloads\Umbral.Stealer\Umbral.builder.exe
"C:\Users\Admin\Downloads\Umbral.Stealer\Umbral.builder.exe"
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4968

C:\Users\Admin\Downloads\Umbral.Stealer\Umbral.builder.exe
"C:\Users\Admin\Downloads\Umbral.Stealer\Umbral.builder.exe"
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:6116

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\RCX5484.tmp

Filesize
227KB

MD5
33e10d5e588855a67b0d482191cb33d2

SHA1
019e6340f89c23cde9597c919313d3ff76e5d4c4

SHA256
f84a93613f55e5883b06f086d9b719c2355a235f6b67c0ad7dcbf7d9372b32b3

SHA512
1b52b74a1c50b14a6f0e732c6e71fae7668a6518be6ff708e8e9f87b6da4ddf32f512931467d8ee84a984066b966ce651c5ccccff34673ee5820be9d1509e679

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Umbral.builder.exe.log

Filesize
1KB

MD5
638ba0507fa15cd4462cdd879c2114fa

SHA1
f23dfc22ea05f6abb8f9aa11a855ef8f3c51d7f2

SHA256
f91ebecc8963ff1840636f0c2a8f5350beb6eebab8b7d99068ad0b19bcccb478

SHA512
23d440dc8ecfa6c43e89895de038c564bb5e09174a6818a5952d5d589296a6ae77e71a4fc5de3773a6bf27aebb69bdb670f2a2609cf8658668759b50dffc8520

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\s7sufels.default-release\cache2\entries\A72798DEF4F924983D5A0DB82D383C613B515FF2

Filesize
13KB

MD5
998d314c54f54311337a42213caabb3d

SHA1
681ae20dd35624861d1a7ef10cc58e9288fceaae

SHA256
4aa53a59bc34f0f89aa0503c94bc4cad1a8294857f569161aec4dc1a884d8d71

SHA512
2c4fb07732b6a5953e0ef28b37ad621c495ce24b3e440e33bd9fb5f8cdcadb8c205e510b29da41b9fe449154075ca8fa578dc833b2cc599d53b02318595c8cb6

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
442KB

MD5
85430baed3398695717b0263807cf97c

SHA1
fffbee923cea216f50fce5d54219a188a5100f41

SHA256
a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e

SHA512
06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
5.3MB

MD5
30732460eacab4822c3aa61e490e6138

SHA1
25687cf26340eeb61b0ff35deb17a3e045835f64

SHA256
756688c6789d51657f16fc43403baa659e26dc196e3773a8ceb330edde91947e

SHA512
0a9f04ef6dcf31fcdad60b7a0e8eb10f88fd3f1ee8303b6dcad854eff6ed35786769b1e4f1467dc841e785f4e96b3edbe9b659499136fd6334e24bc0c9c5f84f

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat

Filesize
202B

MD5
4566d1d70073cd75fe35acb78ff9d082

SHA1
f602ecc057a3c19aa07671b34b4fdd662aa033cc

SHA256
fe33f57205e2ebb981c4744d5a4ddc231f587a9a0589e6565c52e1051eadb0c0

SHA512
b9584ebfdd25cc588162dd6525a399c72ac03bf0c61709b96a19feba7217d840ae2c60d7b0d3b43307a2776f497a388e79ef8a646c12ae59a7f5cc4789bbf3c8

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

Filesize
8KB

MD5
1560f5e66ec924eb2454dce69d137ccd

SHA1
a7c6c736e2db40a078af159dffaede7fe939fb73

SHA256
93a5933645fbb81eb274c7610ac6ba2e816d037abb692eedb40b55330fc7ba55

SHA512
5fa4ede3cef8b40643b5f0a6385269f2aeaee953a952c2e4f95eba7c1fe53b852694bb38fbf4ae06dafc10adbd3a0290f4b378599c923fef4d1c295370212861

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\s7sufels.default-release\datareporting\glean\db\data.safe.bin

Filesize
2KB

MD5
dfaba7ef8c6d7afff51498883e241ab6

SHA1
ce48661060d9e79eb3b188f924fe0e22ce8957d3

SHA256
bb955c4e4527bc7d52e9def1106aac34c937c6be4ebb746719c79caa5b0146cc

SHA512
b3af7bf64509c17f04764597637bfbf5d236e2a042edf6444efa667837bfd204308d39e0ff9060b4c3513beb6c8d940e9490de1284ee1ccdc76a4d1fc01a541b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\s7sufels.default-release\datareporting\glean\pending_pings\85ed73b2-f1a5-481b-9957-8c43c4c785e6

Filesize
746B

MD5
95c0b13f310995a314136da58ad017f9

SHA1
2f521e41a60bcf53b045481e77b9156412fd5fb4

SHA256
4d9ffdcf01a7c76f2a62e0b1ae712a684b66e7223206d7a427886b3e2012bced

SHA512
5f112c761adae81e60c7cd5a99b10b89be4ab337f265436273ebb2d879f7141323abc08bc207978338f9ff64d4efdf3d0c9d147e4703b2f86c127e2f25cef0cf

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\s7sufels.default-release\datareporting\glean\pending_pings\dbaa08c1-d9ff-425b-a0b5-2a0544d1a478

Filesize
11KB

MD5
c4eaac7606dc5adea268f94d9df01496

SHA1
d05848b73d822484032f50ec1b5aaa4de416f130

SHA256
54d6e33ffa0a6ae819e002ef489c491adcc8ba3844940e7817c89f8f0dbd3708

SHA512
4b7d7bfafcbcf8c0dc1397e0999a70e95cec867af6778cc91267e5894b2cf6d85921fc0def8e7ffc99700dcd1268a77819d8690986b285e499a43d23ea8a09c2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\s7sufels.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll

Filesize
997KB

MD5
fe3355639648c417e8307c6d051e3e37

SHA1
f54602d4b4778da21bc97c7238fc66aa68c8ee34

SHA256
1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e

SHA512
8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\s7sufels.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info

Filesize
116B

MD5
3d33cdc0b3d281e67dd52e14435dd04f

SHA1
4db88689282fd4f9e9e6ab95fcbb23df6e6485db

SHA256
f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b

SHA512
a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\s7sufels.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt

Filesize
479B

MD5
49ddb419d96dceb9069018535fb2e2fc

SHA1
62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

SHA256
2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

SHA512
48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\s7sufels.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json

Filesize
372B

MD5
8be33af717bb1b67fbd61c3f4b807e9e

SHA1
7cf17656d174d951957ff36810e874a134dd49e0

SHA256
e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd

SHA512
6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\s7sufels.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll

Filesize
5.1MB

MD5
d842c5ad13912beedae4cff917240376

SHA1
41e62bc9a8bb0c3beeeeb19ac189448f02dd980f

SHA256
d9a8f54bedb59fa9314624f5e19a9a47a27e1b414c7bf5b996e360d722fa0914

SHA512
34d3cf395aefa7dac3016781c7da4146ff503a8e71c82dd472418d3d2b28c6589e54ef0a2fdd439de770fef5c11f6ef0a0556426ae669fecdebd3e57d04195c1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\s7sufels.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib

Filesize
1KB

MD5
688bed3676d2104e7f17ae1cd2c59404

SHA1
952b2cdf783ac72fcb98338723e9afd38d47ad8e

SHA256
33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

SHA512
7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\s7sufels.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig

Filesize
1KB

MD5
937326fead5fd401f6cca9118bd9ade9

SHA1
4526a57d4ae14ed29b37632c72aef3c408189d91

SHA256
68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81

SHA512
b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\s7sufels.default-release\prefs-1.js

Filesize
7KB

MD5
5ff54978a08a62f1001453e108770f05

SHA1
ce5191938e254687f7aff864075da53dc685b3ca

SHA256
2b92221035f047ea2d802c47cdd29c4f46905309cb9d374c7450839a967e9fdf

SHA512
409623fe1ca1d829019b7b8254feb11e4b5cd9a674f71307b40ba5803a5dd2ee687db86c25f39ccff593f8ad3938c6dc3e0def81b58ee8fe6725895d0f8d7f8f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\s7sufels.default-release\prefs-1.js

Filesize
10KB

MD5
6a53daa107f05111d913efec68ac29a5

SHA1
5ae2e703eeb83de58ece4ae0ec85965d64b20e79

SHA256
6ebce91ca1a96392e6ab23ea6650e68ab207f57c869b5b2f8200d167419b09cb

SHA512
3c0ff81fbe4a1d7b7e8e3b428f7959f94e48b6411293511e3b60a55a0893dcb0bec926aa10fd6748cd9cdaeabd3115c10d50c70662638f505a934118374cd16b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\s7sufels.default-release\prefs-1.js

Filesize
6KB

MD5
045afd08ba4c8aa0fa4ff16b696f2ea5

SHA1
45863b18b2f69f103513fc6a3bb454c93e726cbf

SHA256
121fef669ce137314f6b81c60ed1a2e2c8ae19bb634f1efe46434b2844719b5b

SHA512
771e01d5d83e617e9549fe8f91ac680e034e18734ec618a126cffc197e06c54c2b9774c5a53b0c7f51f7c0ddda3ed7cc0fb293a01db4a62805699d4b352a5e71

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\s7sufels.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
f595d78bdd9d3dd9908ebdf61753d37c

SHA1
0cbf48ba6c0bcfe27a99c3f33df747d243244cde

SHA256
806c8f27f5539fd6c9e83ec640f115d7fefa6b807bb9aeb7b4c1c7f08144bd61

SHA512
decedaf2ab3b8f3a000c5b3006fd278ccb4b53b67096fe1834f249bfabc280f16d109d799c8a8b750be18c830019e0a22d713c65087e0e1df85ab8ca6c6a3765

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\s7sufels.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
9c89077210bd1f3f1fe9b600ec66e1ad

SHA1
fb7049655b450a5f8707fb227d380c1cb2fa729f

SHA256
5fac34e34402acbce8c11baa37723cb107054e688287cba89e6d87b7e123004e

SHA512
50a0828bf017f0ff51f93ed140781fbf695339e006c01b3a6153e414720c12d793c62c4a65ec793b2b61760ec3c39edc1e87ca36d7305a3b7b37cf4b8e20aacc

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\s7sufels.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
e96161258dadb8b8940542caf0c593b7

SHA1
6747c5982f3f69bf499bf2ee007bbc6a004baa48

SHA256
5efa037b4c279f350d15709336a14fc43836fd330925ab47bb8cbfcebb05acc7

SHA512
0743f79c68a74bbf4e40da230a6cabc24f0600c476ff62886c20969107c130ac580784f18e7f9e7b6cfd59f9f91734cad9d8b9a01fb92154468830f5e05fca9e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\s7sufels.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
753436de5feb14c82a1ea4f2e604d09d

SHA1
ff2eb177404282f6375d48d622e8599ad31c5f03

SHA256
a00af3c5922ae83059640406298e83c37df6c678ef1b385729236c465b47a2f5

SHA512
58cb0380adfe2e759bd69384fbd2b82dbe3ebd228829dff89749e8e23266f25eb16f8e4e7057bebb2faee295278fbd33a5775ca7f782aa8d70bb042bcd523d9c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\s7sufels.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
c5f1da9e742d52da25c1e323a3c22729

SHA1
841f326284cdf1cdd5b167f72a7c25a300e107cf

SHA256
536cfc1894c866428b4e08e70d9bbe067c9ea9a0cbf104e9e51db6f6f47c2c6e

SHA512
106f57332f50b01c9f236b189e750505309bf1ea3b10bf4542d5fbc2200c06695f043f157be6981ff51645e80639d5dd2b17029e0ab150df013cdc3981ec0531

Download Submit
C:\Users\Admin\Documents\Umbral.exe

Filesize
227KB

MD5
7badec0d24311ae7695becdcff98cf08

SHA1
770bb4fc6a8997359c880d605268ff5ef1646bf9

SHA256
d8963cff7da487a93a858afb6158d869f840881040cbd0783a892e754e1dc820

SHA512
0102003f465753cefac6d32af660ee73593138eb8dd1c5066ac3ef9ea09ef52dbc920e4ced11b7a0e076513fc1117b7da34484c5ac114ce3b855b942edc98c89

Download Submit
C:\Users\Admin\Downloads\Umbral.Stealer\bdekpMsc2a.tmp

Filesize
227KB

MD5
9e6bd83a5ae59bcca7aa169e8548187b

SHA1
ed4e7692626e7e662655efe5a636e96d0b7a6d4a

SHA256
9ba6c947eafc0cb38032b3a7aa198a2c96cf8d6f1727e2f241571c45efb824f9

SHA512
c83725c6fc15fa43760a1b91c0171e1f0791268c5fa8a37ced61ed8d55c83c91ddbe466427598bd929d5850afaa5ff85e319d3d6b4e8045c496072fbdc1af806

Download Submit
C:\Users\Admin\Downloads\Umbral.Stealer\ns7Vyjn7VZ.tmp

Filesize
227KB

MD5
3f504ebc73890dde227af2f523a2548e

SHA1
501e4b078c20dc36d5f9d0be6dab758427cf59d0

SHA256
60257c66fd27fdd77b8f2f23ca527952e1eeb61e6f3800379f7ce13ae167b272

SHA512
13f904670197eaa5e86e8b6ce7cb20ee1c79b0b53003aedc29507a1f08e1ae4c76c60bc97b1516d0d293b53d3f89d33e10a0fbee0b02c34a2ae0d044e8ab579f

Download Submit
C:\Users\Admin\Downloads\Umbral.VC4PTWJg.Stealer.zip.part

Filesize
37KB

MD5
d99ce370a8d953dfbe2efbf077c1e0db

SHA1
07c449b14a9574ba47d5db9f5d0534a3dffb14fb

SHA256
eee085948e47a0ec61a00e498b2de5f8aab97f4d74b67b3cbccb8ab81ca1f7f3

SHA512
4f596744d78a788a6e6ac07423dca506a30e46ba39c671c69ccba5bdacaf3698c347bbec9bb391b38a82f71b240a08c35f02159ad9f33aacbaa1cbcf3097ccde

Download Submit
memory/2636-2335-0x00007FFABE7E0000-0x00007FFABF2A1000-memory.dmp

Filesize
10.8MB

Download
memory/2636-2320-0x00000294BC0F0000-0x00000294BC100000-memory.dmp

Filesize
64KB

Download
memory/2636-2318-0x00000294BC0F0000-0x00000294BC100000-memory.dmp

Filesize
64KB

Download
memory/2636-2317-0x00000294BC0F0000-0x00000294BC100000-memory.dmp

Filesize
64KB

Download
memory/2636-2299-0x00007FFABE7E0000-0x00007FFABF2A1000-memory.dmp

Filesize
10.8MB

Download
memory/2636-2298-0x00000294BC0F0000-0x00000294BC100000-memory.dmp

Filesize
64KB

Download
memory/2636-2297-0x00000294BC0F0000-0x00000294BC100000-memory.dmp

Filesize
64KB

Download
memory/2636-2296-0x00000294BC0F0000-0x00000294BC100000-memory.dmp

Filesize
64KB

Download
memory/2636-2295-0x00007FFABE7E0000-0x00007FFABF2A1000-memory.dmp

Filesize
10.8MB

Download
memory/3324-2391-0x00007FFAA0A10000-0x00007FFAA0A20000-memory.dmp

Filesize
64KB

Download
memory/3324-2352-0x00007FFAE0990000-0x00007FFAE0B85000-memory.dmp

Filesize
2.0MB

Download
memory/3324-2393-0x00007FFAE0990000-0x00007FFAE0B85000-memory.dmp

Filesize
2.0MB

Download
memory/3324-2389-0x00007FFAA0A10000-0x00007FFAA0A20000-memory.dmp

Filesize
64KB

Download
memory/3324-2390-0x00007FFAA0A10000-0x00007FFAA0A20000-memory.dmp

Filesize
64KB

Download
memory/3324-2392-0x00007FFAA0A10000-0x00007FFAA0A20000-memory.dmp

Filesize
64KB

Download
memory/3324-2355-0x00007FFA9E9B0000-0x00007FFA9E9C0000-memory.dmp

Filesize
64KB

Download
memory/3324-2354-0x00007FFA9E9B0000-0x00007FFA9E9C0000-memory.dmp

Filesize
64KB

Download
memory/3324-2353-0x00007FFAE0990000-0x00007FFAE0B85000-memory.dmp

Filesize
2.0MB

Download
memory/3324-2350-0x00007FFAE0990000-0x00007FFAE0B85000-memory.dmp

Filesize
2.0MB

Download
memory/3324-2351-0x00007FFAE0990000-0x00007FFAE0B85000-memory.dmp

Filesize
2.0MB

Download
memory/3324-2337-0x00007FFAA0A10000-0x00007FFAA0A20000-memory.dmp

Filesize
64KB

Download
memory/3324-2349-0x00007FFAE0990000-0x00007FFAE0B85000-memory.dmp

Filesize
2.0MB

Download
memory/3324-2341-0x00007FFAA0A10000-0x00007FFAA0A20000-memory.dmp

Filesize
64KB

Download
memory/3324-2347-0x00007FFAE0990000-0x00007FFAE0B85000-memory.dmp

Filesize
2.0MB

Download
memory/3324-2348-0x00007FFAE0990000-0x00007FFAE0B85000-memory.dmp

Filesize
2.0MB

Download
memory/3324-2338-0x00007FFAA0A10000-0x00007FFAA0A20000-memory.dmp

Filesize
64KB

Download
memory/3324-2340-0x00007FFAE0990000-0x00007FFAE0B85000-memory.dmp

Filesize
2.0MB

Download
memory/3324-2339-0x00007FFAA0A10000-0x00007FFAA0A20000-memory.dmp

Filesize
64KB

Download
memory/3324-2343-0x00007FFAE0990000-0x00007FFAE0B85000-memory.dmp

Filesize
2.0MB

Download
memory/3324-2345-0x00007FFAE0990000-0x00007FFAE0B85000-memory.dmp

Filesize
2.0MB

Download
memory/3324-2344-0x00007FFAA0A10000-0x00007FFAA0A20000-memory.dmp

Filesize
64KB

Download
memory/3324-2346-0x00007FFAE0990000-0x00007FFAE0B85000-memory.dmp

Filesize
2.0MB

Download
memory/3324-2342-0x00007FFAE0990000-0x00007FFAE0B85000-memory.dmp

Filesize
2.0MB

Download
memory/4968-2464-0x00007FFABE7E0000-0x00007FFABF2A1000-memory.dmp

Filesize
10.8MB

Download
memory/4968-2423-0x000002DF786C0000-0x000002DF786D0000-memory.dmp

Filesize
64KB

Download
memory/4968-2405-0x000002DF786C0000-0x000002DF786D0000-memory.dmp

Filesize
64KB

Download
memory/4968-2404-0x00007FFABE7E0000-0x00007FFABF2A1000-memory.dmp

Filesize
10.8MB

Download
memory/4968-2403-0x000002DF786C0000-0x000002DF786D0000-memory.dmp

Filesize
64KB

Download
memory/4968-2402-0x000002DF786C0000-0x000002DF786D0000-memory.dmp

Filesize
64KB

Download
memory/4968-2401-0x00007FFABE7E0000-0x00007FFABF2A1000-memory.dmp

Filesize
10.8MB

Download
memory/5272-2396-0x00000203A88B0000-0x00000203A88F0000-memory.dmp

Filesize
256KB

Download
memory/5272-2400-0x00007FFABE7E0000-0x00007FFABF2A1000-memory.dmp

Filesize
10.8MB

Download
memory/5272-2397-0x00007FFABE7E0000-0x00007FFABF2A1000-memory.dmp

Filesize
10.8MB

Download
memory/5272-2398-0x00000203C2F90000-0x00000203C2FA0000-memory.dmp

Filesize
64KB

Download
memory/5468-1741-0x0000023682CD0000-0x0000023682CE0000-memory.dmp

Filesize
64KB

Download
memory/5468-1034-0x0000023682DA0000-0x0000023682DD0000-memory.dmp

Filesize
192KB

Download
memory/5468-1005-0x000002369D080000-0x000002369D0DA000-memory.dmp

Filesize
360KB

Download
memory/5468-2269-0x00000236A34D0000-0x00000236A34EA000-memory.dmp

Filesize
104KB

Download
memory/5468-2268-0x00000236A5770000-0x00000236A578A000-memory.dmp

Filesize
104KB

Download
memory/5468-2267-0x00000236A3380000-0x00000236A338E000-memory.dmp

Filesize
56KB

Download
memory/5468-1003-0x0000023682CF0000-0x0000023682CFE000-memory.dmp

Filesize
56KB

Download
memory/5468-1006-0x0000023682D40000-0x0000023682D50000-memory.dmp

Filesize
64KB

Download
memory/5468-1011-0x0000023682D80000-0x0000023682D9E000-memory.dmp

Filesize
120KB

Download
memory/5468-2266-0x00000236A57D0000-0x00000236A582E000-memory.dmp

Filesize
376KB

Download
memory/5468-1697-0x0000023682CD0000-0x0000023682CE0000-memory.dmp

Filesize
64KB

Download
memory/5468-1600-0x0000023682CD0000-0x0000023682CE0000-memory.dmp

Filesize
64KB

Download
memory/5468-1521-0x00007FFABE440000-0x00007FFABEF01000-memory.dmp

Filesize
10.8MB

Download
memory/5468-1156-0x0000023682CD0000-0x0000023682CE0000-memory.dmp

Filesize
64KB

Download
memory/5468-1067-0x0000023682CD0000-0x0000023682CE0000-memory.dmp

Filesize
64KB

Download
memory/5468-2293-0x00007FFABE440000-0x00007FFABEF01000-memory.dmp

Filesize
10.8MB

Download
memory/5468-1025-0x000002369D380000-0x000002369D496000-memory.dmp

Filesize
1.1MB

Download
memory/5468-1002-0x000002369CFD0000-0x000002369D03E000-memory.dmp

Filesize
440KB

Download
memory/5468-1001-0x0000023682D20000-0x0000023682D40000-memory.dmp

Filesize
128KB

Download
memory/5468-999-0x0000023682D00000-0x0000023682D20000-memory.dmp

Filesize
128KB

Download
memory/5468-1016-0x000002369D230000-0x000002369D37A000-memory.dmp

Filesize
1.3MB

Download
memory/5468-990-0x0000023682870000-0x0000023682892000-memory.dmp

Filesize
136KB

Download
memory/5468-998-0x00007FFABE440000-0x00007FFABEF01000-memory.dmp

Filesize
10.8MB

Download
memory/5468-1000-0x0000023682CD0000-0x0000023682CE0000-memory.dmp

Filesize
64KB

Download
memory/6116-2468-0x0000022F3B160000-0x0000022F3B170000-memory.dmp

Filesize
64KB

Download
memory/6116-2476-0x0000022F3B160000-0x0000022F3B170000-memory.dmp

Filesize
64KB

Download
memory/6116-2486-0x00007FFABE7E0000-0x00007FFABF2A1000-memory.dmp

Filesize
10.8MB

Download
memory/6116-2467-0x00007FFABE7E0000-0x00007FFABF2A1000-memory.dmp

Filesize
10.8MB

Download
memory/6116-2466-0x0000022F3B160000-0x0000022F3B170000-memory.dmp

Filesize
64KB

Download
memory/6116-2465-0x00007FFABE7E0000-0x00007FFABF2A1000-memory.dmp

Filesize
10.8MB

Download