umbral | hxxps://cdn[.]discordapp[.]com/attachments/1228830370326249553/1228830718818517103/KrampusCrk-ByAnt4c[.]rar?ex=662d78c9&is=661b03c9&hm=356a4c85bed61285b3230317537cc823ce0d2f891d20b00421d416b0cda0b87e&

Analysis

max time kernel
327s
max time network
330s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
13-04-2024 22:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://cdn.discordapp.com/attachments/1228830370326249553/1228830718818517103/KrampusCrk-ByAnt4c.rar?ex=662d78c9&is=661b03c9&hm=356a4c85bed61285b3230317537cc823ce0d2f891d20b00421d416b0cda0b87e&

Score

10^/10

umbral spyware stealer

Malware Config

Extracted

Family

umbral

https://discord.com/api/webhooks/1227683059114049609/J-NRozb82rWMygV4-7Yy0RMllueaLQzhGa-3Da0fHcUN49PnTuKYn0Czl7gR_VfWxkpx

Signatures

Detect Umbral payload 2 IoCs

resource	yara_rule
behavioral1/files/0x0009000000023407-163.dat	family_umbral
behavioral1/memory/3836-165-0x0000020086C10000-0x0000020086C50000-memory.dmp	family_umbral

Umbral
Umbral stealer is an opensource moduler stealer written in C#.
stealer umbral

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	CrackedBy-Ant4c.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	CrackedBy-Ant4c.exe

Executes dropped EXE 2 IoCs

pid	Process
3836	CrackedBy-Ant4c.exe
812	CrackedBy-Ant4c.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service

T1102

flow	ioc
69	discord.com
76	discord.com
77	discord.com
68	discord.com

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
64	ip-api.com
73	ip-api.com

Checks SCSI registry key(s) 3 TTPs 7 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	vds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	vds.exe

Detects videocard installed 1 TTPs 2 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
4788	wmic.exe
1564	wmic.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000_Classes\Local Settings	OpenWith.exe

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
4928	PING.EXE
180	PING.EXE

Suspicious behavior: EnumeratesProcesses 47 IoCs

pid	Process
1976	msedge.exe
1976	msedge.exe
3992	msedge.exe
3992	msedge.exe
3928	identity_helper.exe
3928	identity_helper.exe
4184	msedge.exe
4184	msedge.exe
3836	CrackedBy-Ant4c.exe
1400	powershell.exe
1400	powershell.exe
4900	powershell.exe
4900	powershell.exe
3632	powershell.exe
3632	powershell.exe
812	CrackedBy-Ant4c.exe
3340	powershell.exe
3340	powershell.exe
4532	powershell.exe
4532	powershell.exe
3396	powershell.exe
3396	powershell.exe
3016	taskmgr.exe
3016	taskmgr.exe
3016	taskmgr.exe
3016	taskmgr.exe
3016	taskmgr.exe
3016	taskmgr.exe
3016	taskmgr.exe
3016	taskmgr.exe
3016	taskmgr.exe
3016	taskmgr.exe
3016	taskmgr.exe
3016	taskmgr.exe
3016	taskmgr.exe
3016	taskmgr.exe
3016	taskmgr.exe
3016	taskmgr.exe
3016	taskmgr.exe
3016	taskmgr.exe
3016	taskmgr.exe
3016	taskmgr.exe
3016	taskmgr.exe
3016	taskmgr.exe
3016	taskmgr.exe
3320	msedge.exe
3320	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3688	7zFM.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeRestorePrivilege	3700	7zG.exe
Token: 35	3700	7zG.exe
Token: SeSecurityPrivilege	3700	7zG.exe
Token: SeSecurityPrivilege	3700	7zG.exe
Token: SeDebugPrivilege	3836	CrackedBy-Ant4c.exe
Token: SeIncreaseQuotaPrivilege	1164	wmic.exe
Token: SeSecurityPrivilege	1164	wmic.exe
Token: SeTakeOwnershipPrivilege	1164	wmic.exe
Token: SeLoadDriverPrivilege	1164	wmic.exe
Token: SeSystemProfilePrivilege	1164	wmic.exe
Token: SeSystemtimePrivilege	1164	wmic.exe
Token: SeProfSingleProcessPrivilege	1164	wmic.exe
Token: SeIncBasePriorityPrivilege	1164	wmic.exe
Token: SeCreatePagefilePrivilege	1164	wmic.exe
Token: SeBackupPrivilege	1164	wmic.exe
Token: SeRestorePrivilege	1164	wmic.exe
Token: SeShutdownPrivilege	1164	wmic.exe
Token: SeDebugPrivilege	1164	wmic.exe
Token: SeSystemEnvironmentPrivilege	1164	wmic.exe
Token: SeRemoteShutdownPrivilege	1164	wmic.exe
Token: SeUndockPrivilege	1164	wmic.exe
Token: SeManageVolumePrivilege	1164	wmic.exe
Token: 33	1164	wmic.exe
Token: 34	1164	wmic.exe
Token: 35	1164	wmic.exe
Token: 36	1164	wmic.exe
Token: SeIncreaseQuotaPrivilege	1164	wmic.exe
Token: SeSecurityPrivilege	1164	wmic.exe
Token: SeTakeOwnershipPrivilege	1164	wmic.exe
Token: SeLoadDriverPrivilege	1164	wmic.exe
Token: SeSystemProfilePrivilege	1164	wmic.exe
Token: SeSystemtimePrivilege	1164	wmic.exe
Token: SeProfSingleProcessPrivilege	1164	wmic.exe
Token: SeIncBasePriorityPrivilege	1164	wmic.exe
Token: SeCreatePagefilePrivilege	1164	wmic.exe
Token: SeBackupPrivilege	1164	wmic.exe
Token: SeRestorePrivilege	1164	wmic.exe
Token: SeShutdownPrivilege	1164	wmic.exe
Token: SeDebugPrivilege	1164	wmic.exe
Token: SeSystemEnvironmentPrivilege	1164	wmic.exe
Token: SeRemoteShutdownPrivilege	1164	wmic.exe
Token: SeUndockPrivilege	1164	wmic.exe
Token: SeManageVolumePrivilege	1164	wmic.exe
Token: 33	1164	wmic.exe
Token: 34	1164	wmic.exe
Token: 35	1164	wmic.exe
Token: 36	1164	wmic.exe
Token: SeDebugPrivilege	1400	powershell.exe
Token: SeDebugPrivilege	4900	powershell.exe
Token: SeIncreaseQuotaPrivilege	460	wmic.exe
Token: SeSecurityPrivilege	460	wmic.exe
Token: SeTakeOwnershipPrivilege	460	wmic.exe
Token: SeLoadDriverPrivilege	460	wmic.exe
Token: SeSystemProfilePrivilege	460	wmic.exe
Token: SeSystemtimePrivilege	460	wmic.exe
Token: SeProfSingleProcessPrivilege	460	wmic.exe
Token: SeIncBasePriorityPrivilege	460	wmic.exe
Token: SeCreatePagefilePrivilege	460	wmic.exe
Token: SeBackupPrivilege	460	wmic.exe
Token: SeRestorePrivilege	460	wmic.exe
Token: SeShutdownPrivilege	460	wmic.exe
Token: SeDebugPrivilege	460	wmic.exe
Token: SeSystemEnvironmentPrivilege	460	wmic.exe
Token: SeRemoteShutdownPrivilege	460	wmic.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3700	7zG.exe
3688	7zFM.exe
3688	7zFM.exe
3016	taskmgr.exe
3016	taskmgr.exe
3016	taskmgr.exe
3016	taskmgr.exe
3016	taskmgr.exe
3016	taskmgr.exe
3016	taskmgr.exe
3016	taskmgr.exe
3016	taskmgr.exe
3016	taskmgr.exe
3016	taskmgr.exe
3016	taskmgr.exe
3016	taskmgr.exe
3016	taskmgr.exe
3016	taskmgr.exe
3016	taskmgr.exe
3016	taskmgr.exe
3016	taskmgr.exe
3016	taskmgr.exe
3016	taskmgr.exe
3016	taskmgr.exe
3016	taskmgr.exe
3016	taskmgr.exe
3016	taskmgr.exe
3016	taskmgr.exe
3016	taskmgr.exe
3016	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3016	taskmgr.exe
3016	taskmgr.exe
3016	taskmgr.exe
3016	taskmgr.exe
3016	taskmgr.exe
3016	taskmgr.exe
3016	taskmgr.exe
3016	taskmgr.exe
3016	taskmgr.exe
3016	taskmgr.exe
3016	taskmgr.exe
3016	taskmgr.exe
3016	taskmgr.exe
3016	taskmgr.exe
3016	taskmgr.exe
3016	taskmgr.exe
3016	taskmgr.exe
3016	taskmgr.exe
3016	taskmgr.exe
3016	taskmgr.exe
3016	taskmgr.exe
3016	taskmgr.exe
3016	taskmgr.exe
3016	taskmgr.exe
3016	taskmgr.exe
3016	taskmgr.exe
3016	taskmgr.exe
3016	taskmgr.exe
3016	taskmgr.exe
3016	taskmgr.exe
3016	taskmgr.exe
3016	taskmgr.exe
3016	taskmgr.exe
3016	taskmgr.exe
3016	taskmgr.exe
3016	taskmgr.exe
3016	taskmgr.exe
3016	taskmgr.exe
3016	taskmgr.exe
3016	taskmgr.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2092	OpenWith.exe
3728	SystemSettingsAdminFlows.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3992 wrote to memory of 2944	3992	msedge.exe	83
PID 3992 wrote to memory of 2944	3992	msedge.exe	83
PID 3992 wrote to memory of 2880	3992	msedge.exe	84
PID 3992 wrote to memory of 2880	3992	msedge.exe	84
PID 3992 wrote to memory of 2880	3992	msedge.exe	84
PID 3992 wrote to memory of 2880	3992	msedge.exe	84
PID 3992 wrote to memory of 2880	3992	msedge.exe	84
PID 3992 wrote to memory of 2880	3992	msedge.exe	84
PID 3992 wrote to memory of 2880	3992	msedge.exe	84
PID 3992 wrote to memory of 2880	3992	msedge.exe	84
PID 3992 wrote to memory of 2880	3992	msedge.exe	84
PID 3992 wrote to memory of 2880	3992	msedge.exe	84
PID 3992 wrote to memory of 2880	3992	msedge.exe	84
PID 3992 wrote to memory of 2880	3992	msedge.exe	84
PID 3992 wrote to memory of 2880	3992	msedge.exe	84
PID 3992 wrote to memory of 2880	3992	msedge.exe	84
PID 3992 wrote to memory of 2880	3992	msedge.exe	84
PID 3992 wrote to memory of 2880	3992	msedge.exe	84
PID 3992 wrote to memory of 2880	3992	msedge.exe	84
PID 3992 wrote to memory of 2880	3992	msedge.exe	84
PID 3992 wrote to memory of 2880	3992	msedge.exe	84
PID 3992 wrote to memory of 2880	3992	msedge.exe	84
PID 3992 wrote to memory of 2880	3992	msedge.exe	84
PID 3992 wrote to memory of 2880	3992	msedge.exe	84
PID 3992 wrote to memory of 2880	3992	msedge.exe	84
PID 3992 wrote to memory of 2880	3992	msedge.exe	84
PID 3992 wrote to memory of 2880	3992	msedge.exe	84
PID 3992 wrote to memory of 2880	3992	msedge.exe	84
PID 3992 wrote to memory of 2880	3992	msedge.exe	84
PID 3992 wrote to memory of 2880	3992	msedge.exe	84
PID 3992 wrote to memory of 2880	3992	msedge.exe	84
PID 3992 wrote to memory of 2880	3992	msedge.exe	84
PID 3992 wrote to memory of 2880	3992	msedge.exe	84
PID 3992 wrote to memory of 2880	3992	msedge.exe	84
PID 3992 wrote to memory of 2880	3992	msedge.exe	84
PID 3992 wrote to memory of 2880	3992	msedge.exe	84
PID 3992 wrote to memory of 2880	3992	msedge.exe	84
PID 3992 wrote to memory of 2880	3992	msedge.exe	84
PID 3992 wrote to memory of 2880	3992	msedge.exe	84
PID 3992 wrote to memory of 2880	3992	msedge.exe	84
PID 3992 wrote to memory of 2880	3992	msedge.exe	84
PID 3992 wrote to memory of 2880	3992	msedge.exe	84
PID 3992 wrote to memory of 1976	3992	msedge.exe	85
PID 3992 wrote to memory of 1976	3992	msedge.exe	85
PID 3992 wrote to memory of 2796	3992	msedge.exe	86
PID 3992 wrote to memory of 2796	3992	msedge.exe	86
PID 3992 wrote to memory of 2796	3992	msedge.exe	86
PID 3992 wrote to memory of 2796	3992	msedge.exe	86
PID 3992 wrote to memory of 2796	3992	msedge.exe	86
PID 3992 wrote to memory of 2796	3992	msedge.exe	86
PID 3992 wrote to memory of 2796	3992	msedge.exe	86
PID 3992 wrote to memory of 2796	3992	msedge.exe	86
PID 3992 wrote to memory of 2796	3992	msedge.exe	86
PID 3992 wrote to memory of 2796	3992	msedge.exe	86
PID 3992 wrote to memory of 2796	3992	msedge.exe	86
PID 3992 wrote to memory of 2796	3992	msedge.exe	86
PID 3992 wrote to memory of 2796	3992	msedge.exe	86
PID 3992 wrote to memory of 2796	3992	msedge.exe	86
PID 3992 wrote to memory of 2796	3992	msedge.exe	86
PID 3992 wrote to memory of 2796	3992	msedge.exe	86
PID 3992 wrote to memory of 2796	3992	msedge.exe	86
PID 3992 wrote to memory of 2796	3992	msedge.exe	86
PID 3992 wrote to memory of 2796	3992	msedge.exe	86
PID 3992 wrote to memory of 2796	3992	msedge.exe	86

Views/modifies file attributes 1 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
1632	attrib.exe
4948	attrib.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://cdn.discordapp.com/attachments/1228830370326249553/1228830718818517103/KrampusCrk-ByAnt4c.rar?ex=662d78c9&is=661b03c9&hm=356a4c85bed61285b3230317537cc823ce0d2f891d20b00421d416b0cda0b87e&
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb058246f8,0x7ffb05824708,0x7ffb05824718
  2⤵
  PID:2944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2036,11178124582313465899,17263518133470698747,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2052 /prefetch:2
  2⤵
  PID:2880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2036,11178124582313465899,17263518133470698747,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2384 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2036,11178124582313465899,17263518133470698747,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2792 /prefetch:8
  2⤵
  PID:2796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,11178124582313465899,17263518133470698747,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:1628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,11178124582313465899,17263518133470698747,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:3272
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2036,11178124582313465899,17263518133470698747,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5392 /prefetch:8
  2⤵
  PID:4144
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2036,11178124582313465899,17263518133470698747,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5392 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,11178124582313465899,17263518133470698747,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5456 /prefetch:1
  2⤵
  PID:3192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,11178124582313465899,17263518133470698747,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5472 /prefetch:1
  2⤵
  PID:3708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2036,11178124582313465899,17263518133470698747,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5696 /prefetch:8
  2⤵
  PID:432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,11178124582313465899,17263518133470698747,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4068 /prefetch:1
  2⤵
  PID:1744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2036,11178124582313465899,17263518133470698747,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5964 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,11178124582313465899,17263518133470698747,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6040 /prefetch:1
  2⤵
  PID:4556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,11178124582313465899,17263518133470698747,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5668 /prefetch:1
  2⤵
  PID:4072

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3280

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4960

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2092

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1472

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\KrampusCrk-ByAnt4c\" -spe -an -ai#7zMap24592:98:7zEvent9580
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3700

C:\Users\Admin\Downloads\KrampusCrk-ByAnt4c\CrackedBy-Ant4c.exe
"C:\Users\Admin\Downloads\KrampusCrk-ByAnt4c\CrackedBy-Ant4c.exe"
1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3836
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" csproduct get uuid
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1164
- C:\Windows\SYSTEM32\attrib.exe
  "attrib.exe" +h +s "C:\Users\Admin\Downloads\KrampusCrk-ByAnt4c\CrackedBy-Ant4c.exe"
  2⤵
  - Views/modifies file attributes
  PID:1632
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\Downloads\KrampusCrk-ByAnt4c\CrackedBy-Ant4c.exe'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1400
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4900
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" os get Caption
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:460
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" computersystem get totalphysicalmemory
  2⤵
  PID:3112
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" csproduct get uuid
  2⤵
  PID:2108
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3632
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" path win32_VideoController get name
  2⤵
  - Detects videocard installed
  PID:4788
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\Downloads\KrampusCrk-ByAnt4c\CrackedBy-Ant4c.exe" && pause
  2⤵
  PID:2504
- - C:\Windows\system32\PING.EXE
    ping localhost
    3⤵
    - Runs ping.exe
    PID:4928

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\KrampusCrk-ByAnt4c.rar"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
PID:3688
- C:\Users\Admin\AppData\Local\Temp\7zO86E4525A\CrackedBy-Ant4c.exe
  "C:\Users\Admin\AppData\Local\Temp\7zO86E4525A\CrackedBy-Ant4c.exe"
  2⤵
  - Drops file in Drivers directory
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:812
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" csproduct get uuid
    3⤵
    PID:388
- - C:\Windows\SYSTEM32\attrib.exe
    "attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\7zO86E4525A\CrackedBy-Ant4c.exe"
    3⤵
    - Views/modifies file attributes
    PID:4948
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\7zO86E4525A\CrackedBy-Ant4c.exe'
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3340
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4532
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" os get Caption
    3⤵
    PID:4824
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" computersystem get totalphysicalmemory
    3⤵
    PID:2976
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" csproduct get uuid
    3⤵
    PID:3892
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3396
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" path win32_VideoController get name
    3⤵
    - Detects videocard installed
    PID:1564
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\7zO86E4525A\CrackedBy-Ant4c.exe" && pause
    3⤵
    PID:968
  - - C:\Windows\system32\PING.EXE
      ping localhost
      4⤵
      Runs ping.exe
      PID:180

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3016

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault39d704c7h434eh4c70h869fha504cd047142
1⤵
PID:4720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ffb058246f8,0x7ffb05824708,0x7ffb05824718
  2⤵
  PID:1040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1984,14573754674637975313,14060385322262685265,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1996 /prefetch:2
  2⤵
  PID:1400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1984,14573754674637975313,14060385322262685265,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1984,14573754674637975313,14060385322262685265,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2724 /prefetch:8
  2⤵
  PID:4500

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4000

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4060

C:\Windows\system32\SystemSettingsAdminFlows.exe
"C:\Windows\system32\SystemSettingsAdminFlows.exe" FeaturedResetPC
1⤵
- Suspicious use of SetWindowsHookEx
PID:3728

C:\Windows\System32\vdsldr.exe
C:\Windows\System32\vdsldr.exe -Embedding
1⤵
PID:4128

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Checks SCSI registry key(s)
PID:3652

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\CrackedBy-Ant4c.exe.log

Filesize
1KB

MD5
547df619456b0e94d1b7663cf2f93ccb

SHA1
8807c99005eaf2cc44b0b5ec4fc6eac289bfb4e3

SHA256
8b7130cc966f3f78e236b4e51eb12e1c82b0bd3f0773275d619b5c545168797a

SHA512
01b4e32fdf6c7f2347075c8153bc75a2f32fe3cec19e1a777e263ec4f607b54e046f0e4c7c0bc22581d44cbbdbb076a63eaa50a742f381faad06c86c2b10f67f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e36b219dcae7d32ec82cec3245512f80

SHA1
6b2bd46e4f6628d66f7ec4b5c399b8c9115a9466

SHA256
16bc6f47bbfbd4e54c3163dafe784486b72d0b78e6ea3593122edb338448a27b

SHA512
fc539c461d87141a180cf71bb6a636c75517e5e7226e76b71fd64e834dcacc88fcaaa92a9a00999bc0afc4fb93b7304b068000f14653c05ff03dd7baef3f225c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1adeb1fbb137d2444566b45082abf8ba

SHA1
4a481ac871c473cf48d25b884985ae050bcf632d

SHA256
419796b04fa44202d34f236343ea667f4a7c677e7670b75bd4edd4f7ac1f5850

SHA512
5497c14c2e89e4a9506fcc7c7647a402d05048c380134b4aff3618dbb31bf0635cee5581d75b53782d84d66cdea74a6010ceaeb81430aace222fc2d07b72483f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
559ff144c30d6a7102ec298fb7c261c4

SHA1
badecb08f9a6c849ce5b30c348156b45ac9120b9

SHA256
5444032cb994b90287c0262f2fba16f38e339073fd89aa3ab2592dfebc3e6f10

SHA512
3a45661fc29e312aa643a12447bffdab83128fe5124077a870090081af6aaa4cf0bd021889ab1df5cd40f44adb055b1394b31313515c2929f714824c89fd0f04

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies

Filesize
20KB

MD5
05b30dcc098971d254c8effc99017ddd

SHA1
e5f94b9a4202f6875b7e351ec187af9821f5f542

SHA256
885b26e77524589924ddd2b181a24e30db56b62c4a1b1ff4cd9e9ef675e6a65a

SHA512
29dda05cc558df49013f05196040c6e0940b69621f2ee93eea7c677b4a0385753dc85acc5951ebbb3b405c9b3f3a93b9f46d247a958641fb2a70b5506b863b4d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History

Filesize
124KB

MD5
cce45f81082ffc5ce4594e5089e04639

SHA1
56d978b30071a7008922894c33e41edc35413531

SHA256
ccb72aba9d92faa1d47bcbf3975079e8cab7ca9accded00300a053b3928ce195

SHA512
47c800f5910694a2c4dac82f2157a285cdfef7536f35f565b7a1f9598f646e306c3e2cc27d194203919d665c28a39f5d84c837aa7c535a05436c7d763ac89697

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
186B

MD5
094ab275342c45551894b7940ae9ad0d

SHA1
2e7ce26fe2eb9be641ae929d0c9cc0dfa26c018e

SHA256
ef1739b833a1048ee1bd55dcbac5b1397396faca1ad771f4d6c2fe58899495a3

SHA512
19d0c688dc1121569247111e45de732b2ab86c71aecdde34b157cfd1b25c53473ed3ade49a97f8cb2ddc4711be78fa26c9330887094e031e9a71bb5c29080b0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
61B

MD5
4df4574bfbb7e0b0bc56c2c9b12b6c47

SHA1
81efcbd3e3da8221444a21f45305af6fa4b71907

SHA256
e1b77550222c2451772c958e44026abe518a2c8766862f331765788ddd196377

SHA512
78b14f60f2d80400fe50360cf303a961685396b7697775d078825a29b717081442d357c2039ad0984d4b622976b0314ede8f478cde320daec118da546cb0682a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
da116005a66af01911c91725ef909e97

SHA1
98b259db6b00dbb8adfc4e5fffc29d38f9dcb513

SHA256
3ae74a07ba8482da8f7cf3811dce08d89277a29ac41e1e98173005b99c8cd02b

SHA512
781b9fd57495c123957425525b79c332ef5bcac542219aad9f1382b242ecd5abd779ec59759c95032085f8a13e4d41f9146d0b7077a378e6a695237d368ef7f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3223785bce21a0a6db6548d0d3586af5

SHA1
65a422a0c031ed9da4750aca8d6de689ddc94d3d

SHA256
8eb8884823e4a2cf51765d95b6b43b0c7f2a7dd1a770522c8cf4605009e626f3

SHA512
e873708ac00cae1a6fb64eb1ad9ea2712f2d4ff7a16652ff159ba7c29d118c8e33a86469e051c6376092542afa2d9144f1979a9aeb26ba9bb782f4056bc4e392

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d87b99048c56cf4847f7195374d996c5

SHA1
a74a3c68455b9c05b807a9110cffc220c38bce39

SHA256
c81afff250288b20f4c7ac6934d1376aedec5282a923e157884856180fc27d72

SHA512
64c584c9484c786a948cdeb1e51e382b7bea0290df8772d4f252e3a2c3667913b9b4076a18bdd2a07dad6f9e7fdddb743dc79120d6ac75b8bfb0b0bdf207123e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Filesize
347B

MD5
934c5ce16843bdc744e063e638d21a70

SHA1
d4dcb4870ae5b5b42335573b4535539c665a1c3c

SHA256
a34b56d06a2bfd910db9b96fb4bfe977e0b294fb149a0e81445fa3bf47d5d503

SHA512
7ed09d99bde6592e84a7c90b5d287f8d1dd8e324f4a5daedfe8ea9467bfeeef6ae146d0f10029765670d8a22525991b9403232c6f3267a29d631cd4451dac663

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Filesize
323B

MD5
7a9dc135b7da9579557970e00307994d

SHA1
8819d02b2cbd9a4c096b00a86744f2a7ea34f6a2

SHA256
071ff8544136d632fe52350bfad4eab06dd33a41b978566158d612de28831e6c

SHA512
8ab9913174d6925521d294696d85acd9a7be800afc93d8822c0ccde1da79ec5a813d6a79f08381425dae3117d6217763285ca1483694f8cf96d41ff3d023d799

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version

Filesize
11B

MD5
838a7b32aefb618130392bc7d006aa2e

SHA1
5159e0f18c9e68f0e75e2239875aa994847b8290

SHA256
ac3dd2221d90b09b795f1f72e72e4860342a4508fe336c4b822476eb25a55eaa

SHA512
9e350f0565cc726f66146838f9cebaaa38dd01892ffab9a45fe4f72e5be5459c0442e99107293a7c6f2412c71f668242c5e5a502124bc57cbf3b6ad8940cb3e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
5a9683160bb316f5842a09f572680fdd

SHA1
b9e3559f84c9f3c7048f7dae9f15c3cfd2a38e0a

SHA256
0b63983f0966a1c3159707dff1d8096db2fdde413b5c183916dcf61875e0060e

SHA512
8736480f7032257bad7461ad4c65b44f8391b67c45325dce286a105951cb52c8eeb1668087692cf1d7e5a86539a5fa737afe560c04e3cf00b73e86e98ba90d65

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
55309fdc46322c69a2c22d8978158ec3

SHA1
6b0368482e1a155e3721b15d6c4ff11b7070dcf8

SHA256
299a0709e383293582d76c95390e5f115dac432d5e5032795c2336f4c3a5b9c3

SHA512
763ce5d64743ce9d92f7e58afbe7be81914014cd90399ea0ddcb63c9c8ed4941f2004044096e33a0740562bd0c6bfa2e3d610f916c67440fde152ea4d1df9f4d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\edge_shutdown_ms.txt

Filesize
4B

MD5
41d9ba76e04ad6a81f8b91fe21a46265

SHA1
bbfdba6bc68e3cdb83447fc6e1c80a09077d29cb

SHA256
821ea49987c50b4d3a550e4696ca7a9299dcb3412a7591d81c4cd70ed286d6b0

SHA512
029bd5f67d0e8f3919c6640157ac0e1ebfc6b03e619cfcc675e7d84122ccc14a178fb915a079413b32cf638c25bd1794710cc7575fff066b061fea24c5ab2099

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
77d622bb1a5b250869a3238b9bc1402b

SHA1
d47f4003c2554b9dfc4c16f22460b331886b191b

SHA256
f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb

SHA512
d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
948B

MD5
5824a6037c081fda5d46de274b6e2799

SHA1
526367a09300cbde430e8fb44e41cbe7a0937aac

SHA256
4d610d9cd32a20279c7133a726ff61820d6930e5aa18253ee1422f3a6f54953f

SHA512
a109b150f730cda78d5bee106bd232f9dca7500dfb7899c6919de2bd542e345ca271aa11809a24ea0a27dca158067ab3a2d5688ac0a2325185143245f1665582

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
64B

MD5
d8b9a260789a22d72263ef3bb119108c

SHA1
376a9bd48726f422679f2cd65003442c0b6f6dd5

SHA256
d69d47e428298f194850d14c3ce375e7926128a0bfb62c1e75940ab206f8fddc

SHA512
550314fab1e363851a7543c989996a440d95f7c9db9695cce5abaad64523f377f48790aa091d66368f50f941179440b1fa94448289ee514d5b5a2f4fe6225e9b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
96ff1ee586a153b4e7ce8661cabc0442

SHA1
140d4ff1840cb40601489f3826954386af612136

SHA256
0673399a2f37c89d455e8658c4d30b9248bff1ea47ba40957588e2bc862976e8

SHA512
3404370d0edb4ead4874ce68525dc9bcbc6008003682646e331bf43a06a24a467ace7eff5be701a822d74c7e065d0f6a0ba0e3d6bc505d34d0189373dcacb569

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
948B

MD5
595c6abf3eaa6bb5adb796aab2c14970

SHA1
fe035b9ace5863f2ea1150f46997bf4b9857f120

SHA256
a39ff6d4cb3490060c271ea775ce8db27a06f19ba9c0d2c74ae0203db64c784f

SHA512
b99cb77cfe8136bed6debfc6bb1369a20cc783f4a41ea7a6f66f227036f0c9a6ce9bd21cef0ef6da5e9bad3460be3727922ee09aae59df52edcbbb05f44a1b87

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ttbdmi0y.vev.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\Downloads\KrampusCrk-ByAnt4c.rar

Filesize
76KB

MD5
66ea4b855a7a50f044d6727a4cd2539d

SHA1
66c7bda7aefc84450f0965b7c9af793b63637fce

SHA256
4a28cf749942fb27fa04e45b37d8cbdf3333e197f52007d5a56a6024f5645f0d

SHA512
edd663e1cc41d889e4586077a04a82985dc639dcad811e31ced0077d683efa8c264a3863518d4e6774ee1cfd09adb526e8579aeb6da4d9968dd979ec9140f4e0

Download Submit
C:\Users\Admin\Downloads\KrampusCrk-ByAnt4c\CrackedBy-Ant4c.exe

Filesize
227KB

MD5
8ed3f43c5540e5beb0b213dba788963e

SHA1
265046f1d25a6d7148fd0df740cc87274426dd7d

SHA256
632338a1ccc3922d205fd562b431485cb8ac102413d5338aaedad593e2f8f2dc

SHA512
4602e56ebd2add7e90405554d7e0e46be51a640d45d81484cfb82fbbf0a7cfc63906d8bb8c5dec36daf19d12c56e0bc3a23eb7f10800840cfeaaec36c6e0d72d

Download Submit
C:\Windows\System32\drivers\etc\hosts

Filesize
2KB

MD5
4028457913f9d08b06137643fe3e01bc

SHA1
a5cb3f12beaea8194a2d3d83a62bdb8d558f5f14

SHA256
289d433902418aaf62e7b96b215ece04fcbcef2457daf90f46837a4d5090da58

SHA512
c8e1eef90618341bbde885fd126ece2b1911ca99d20d82f62985869ba457553b4c2bf1e841fd06dacbf27275b3b0940e5a794e1b1db0fd56440a96592362c28b

Download Submit
memory/812-323-0x00007FFAF5970000-0x00007FFAF6431000-memory.dmp

Filesize
10.8MB

Download
memory/812-258-0x000001A6C6720000-0x000001A6C6730000-memory.dmp

Filesize
64KB

Download
memory/812-257-0x00007FFAF5970000-0x00007FFAF6431000-memory.dmp

Filesize
10.8MB

Download
memory/1400-182-0x00007FFAF5D00000-0x00007FFAF67C1000-memory.dmp

Filesize
10.8MB

Download
memory/1400-173-0x00007FFAF5D00000-0x00007FFAF67C1000-memory.dmp

Filesize
10.8MB

Download
memory/1400-174-0x00000157FFFD0000-0x00000157FFFF2000-memory.dmp

Filesize
136KB

Download
memory/1400-175-0x0000015780110000-0x0000015780120000-memory.dmp

Filesize
64KB

Download
memory/3016-333-0x000001C7E8900000-0x000001C7E8901000-memory.dmp

Filesize
4KB

Download
memory/3016-332-0x000001C7E8900000-0x000001C7E8901000-memory.dmp

Filesize
4KB

Download
memory/3016-325-0x000001C7E8900000-0x000001C7E8901000-memory.dmp

Filesize
4KB

Download
memory/3016-326-0x000001C7E8900000-0x000001C7E8901000-memory.dmp

Filesize
4KB

Download
memory/3016-330-0x000001C7E8900000-0x000001C7E8901000-memory.dmp

Filesize
4KB

Download
memory/3016-334-0x000001C7E8900000-0x000001C7E8901000-memory.dmp

Filesize
4KB

Download
memory/3016-335-0x000001C7E8900000-0x000001C7E8901000-memory.dmp

Filesize
4KB

Download
memory/3016-336-0x000001C7E8900000-0x000001C7E8901000-memory.dmp

Filesize
4KB

Download
memory/3016-331-0x000001C7E8900000-0x000001C7E8901000-memory.dmp

Filesize
4KB

Download
memory/3016-324-0x000001C7E8900000-0x000001C7E8901000-memory.dmp

Filesize
4KB

Download
memory/3340-273-0x00007FFAF5970000-0x00007FFAF6431000-memory.dmp

Filesize
10.8MB

Download
memory/3340-270-0x0000013C15BC0000-0x0000013C15BD0000-memory.dmp

Filesize
64KB

Download
memory/3340-268-0x00007FFAF5970000-0x00007FFAF6431000-memory.dmp

Filesize
10.8MB

Download
memory/3340-269-0x0000013C15BC0000-0x0000013C15BD0000-memory.dmp

Filesize
64KB

Download
memory/3396-316-0x00007FFAF5970000-0x00007FFAF6431000-memory.dmp

Filesize
10.8MB

Download
memory/3396-319-0x00007FFAF5970000-0x00007FFAF6431000-memory.dmp

Filesize
10.8MB

Download
memory/3632-238-0x00007FFAF5D00000-0x00007FFAF67C1000-memory.dmp

Filesize
10.8MB

Download
memory/3632-234-0x00007FFAF5D00000-0x00007FFAF67C1000-memory.dmp

Filesize
10.8MB

Download
memory/3632-235-0x0000021F7F9D0000-0x0000021F7F9E0000-memory.dmp

Filesize
64KB

Download
memory/3632-236-0x0000021F7F9D0000-0x0000021F7F9E0000-memory.dmp

Filesize
64KB

Download
memory/3836-221-0x0000020088B10000-0x0000020088B22000-memory.dmp

Filesize
72KB

Download
memory/3836-202-0x00000200A13D0000-0x00000200A1446000-memory.dmp

Filesize
472KB

Download
memory/3836-165-0x0000020086C10000-0x0000020086C50000-memory.dmp

Filesize
256KB

Download
memory/3836-166-0x00007FFAF5D00000-0x00007FFAF67C1000-memory.dmp

Filesize
10.8MB

Download
memory/3836-167-0x00000200A13C0000-0x00000200A13D0000-memory.dmp

Filesize
64KB

Download
memory/3836-243-0x00007FFAF5D00000-0x00007FFAF67C1000-memory.dmp

Filesize
10.8MB

Download
memory/3836-220-0x0000020088AE0000-0x0000020088AEA000-memory.dmp

Filesize
40KB

Download
memory/3836-205-0x0000020088AC0000-0x0000020088ADE000-memory.dmp

Filesize
120KB

Download
memory/3836-203-0x00000200A1360000-0x00000200A13B0000-memory.dmp

Filesize
320KB

Download
memory/4532-288-0x00007FFAF5970000-0x00007FFAF6431000-memory.dmp

Filesize
10.8MB

Download
memory/4532-287-0x000001A470720000-0x000001A470730000-memory.dmp

Filesize
64KB

Download
memory/4532-275-0x000001A470720000-0x000001A470730000-memory.dmp

Filesize
64KB

Download
memory/4532-274-0x00007FFAF5970000-0x00007FFAF6431000-memory.dmp

Filesize
10.8MB

Download
memory/4900-199-0x00007FFAF5D00000-0x00007FFAF67C1000-memory.dmp

Filesize
10.8MB

Download
memory/4900-197-0x00000288449C0000-0x00000288449D0000-memory.dmp

Filesize
64KB

Download
memory/4900-186-0x00000288449C0000-0x00000288449D0000-memory.dmp

Filesize
64KB

Download
memory/4900-185-0x00000288449C0000-0x00000288449D0000-memory.dmp

Filesize
64KB

Download
memory/4900-184-0x00007FFAF5D00000-0x00007FFAF67C1000-memory.dmp

Filesize
10.8MB

Download