njrat | hxxps://drive[.]google[.]com/file/d/1lXMp7IT8jIPJC94TnpCscPzFkJjO1vY_/view?usp=drive_link

Analysis

max time kernel
150s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
13-04-2024 16:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/file/d/1lXMp7IT8jIPJC94TnpCscPzFkJjO1vY_/view?usp=drive_link

Score

10^/10

njrat umbral hacked evasion persistence spyware stealer trojan

Malware Config

Extracted

Family

njrat

Version

im523

Botnet

HacKed

having-jackson.gl.at.ply.gg:56522

Mutex

7c148ac38012fc3caa04b1bbe75feba0

Attributes

reg_key
7c148ac38012fc3caa04b1bbe75feba0
splitter
|'|'|

Signatures

Detect Umbral payload 2 IoCs

resource	yara_rule
behavioral1/files/0x000700000002359f-826.dat	family_umbral
behavioral1/memory/5776-833-0x000001EDEB8B0000-0x000001EDEB8F0000-memory.dmp	family_umbral

Umbral
Umbral stealer is an opensource moduler stealer written in C#.
stealer umbral
njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	tmp7692.tmp.exe

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
5220	netsh.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\Control Panel\International\Geo\Nation	Wawe.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7c148ac38012fc3caa04b1bbe75feba0.exe	Wawe.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7c148ac38012fc3caa04b1bbe75feba0.exe	Wawe.exe

Executes dropped EXE 3 IoCs

pid	Process
6060	Wawe.exe
5776	tmp7692.tmp.exe
5416	tmp2801.tmp.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\7c148ac38012fc3caa04b1bbe75feba0 = "\"C:\\Users\\Admin\\Downloads\\WAWE(ROBLOX)\\WaveTrial\\Wawe.exe\" .."	Wawe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\7c148ac38012fc3caa04b1bbe75feba0 = "\"C:\\Users\\Admin\\Downloads\\WAWE(ROBLOX)\\WaveTrial\\Wawe.exe\" .."	Wawe.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service

T1102

flow	ioc
13	drive.google.com
139	discord.com
140	discord.com
7	drive.google.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
126	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
5756	wmic.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
5848	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3600	msedge.exe
3600	msedge.exe
608	msedge.exe
608	msedge.exe
1564	identity_helper.exe
1564	identity_helper.exe
5252	msedge.exe
5252	msedge.exe
4100	taskmgr.exe
4100	taskmgr.exe
4100	taskmgr.exe
4100	taskmgr.exe
4100	taskmgr.exe
4100	taskmgr.exe
4100	taskmgr.exe
4100	taskmgr.exe
4100	taskmgr.exe
4100	taskmgr.exe
4100	taskmgr.exe
4100	taskmgr.exe
4100	taskmgr.exe
4100	taskmgr.exe
4100	taskmgr.exe
4100	taskmgr.exe
5776	tmp7692.tmp.exe
5776	tmp7692.tmp.exe
5968	powershell.exe
5968	powershell.exe
5968	powershell.exe
4700	powershell.exe
4700	powershell.exe
4700	powershell.exe
972	powershell.exe
972	powershell.exe
972	powershell.exe
3644	powershell.exe
3644	powershell.exe
3644	powershell.exe
5532	powershell.exe
5532	powershell.exe
5532	powershell.exe
6060	Wawe.exe
6060	Wawe.exe
6060	Wawe.exe
6060	Wawe.exe
6060	Wawe.exe
6060	Wawe.exe
6060	Wawe.exe
6060	Wawe.exe
6060	Wawe.exe
6060	Wawe.exe
6060	Wawe.exe
6060	Wawe.exe
6060	Wawe.exe
6060	Wawe.exe
6060	Wawe.exe
6060	Wawe.exe
6060	Wawe.exe
6060	Wawe.exe
6060	Wawe.exe
6060	Wawe.exe
6060	Wawe.exe
6060	Wawe.exe
6060	Wawe.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
6060	Wawe.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeRestorePrivilege	5496	7zG.exe
Token: 35	5496	7zG.exe
Token: SeSecurityPrivilege	5496	7zG.exe
Token: SeSecurityPrivilege	5496	7zG.exe
Token: SeDebugPrivilege	6060	Wawe.exe
Token: 33	6060	Wawe.exe
Token: SeIncBasePriorityPrivilege	6060	Wawe.exe
Token: SeDebugPrivilege	4100	taskmgr.exe
Token: SeSystemProfilePrivilege	4100	taskmgr.exe
Token: SeCreateGlobalPrivilege	4100	taskmgr.exe
Token: 33	6060	Wawe.exe
Token: SeIncBasePriorityPrivilege	6060	Wawe.exe
Token: 33	6060	Wawe.exe
Token: SeIncBasePriorityPrivilege	6060	Wawe.exe
Token: SeDebugPrivilege	5776	tmp7692.tmp.exe
Token: SeIncreaseQuotaPrivilege	5848	wmic.exe
Token: SeSecurityPrivilege	5848	wmic.exe
Token: SeTakeOwnershipPrivilege	5848	wmic.exe
Token: SeLoadDriverPrivilege	5848	wmic.exe
Token: SeSystemProfilePrivilege	5848	wmic.exe
Token: SeSystemtimePrivilege	5848	wmic.exe
Token: SeProfSingleProcessPrivilege	5848	wmic.exe
Token: SeIncBasePriorityPrivilege	5848	wmic.exe
Token: SeCreatePagefilePrivilege	5848	wmic.exe
Token: SeBackupPrivilege	5848	wmic.exe
Token: SeRestorePrivilege	5848	wmic.exe
Token: SeShutdownPrivilege	5848	wmic.exe
Token: SeDebugPrivilege	5848	wmic.exe
Token: SeSystemEnvironmentPrivilege	5848	wmic.exe
Token: SeRemoteShutdownPrivilege	5848	wmic.exe
Token: SeUndockPrivilege	5848	wmic.exe
Token: SeManageVolumePrivilege	5848	wmic.exe
Token: 33	5848	wmic.exe
Token: 34	5848	wmic.exe
Token: 35	5848	wmic.exe
Token: 36	5848	wmic.exe
Token: SeIncreaseQuotaPrivilege	5848	wmic.exe
Token: SeSecurityPrivilege	5848	wmic.exe
Token: SeTakeOwnershipPrivilege	5848	wmic.exe
Token: SeLoadDriverPrivilege	5848	wmic.exe
Token: SeSystemProfilePrivilege	5848	wmic.exe
Token: SeSystemtimePrivilege	5848	wmic.exe
Token: SeProfSingleProcessPrivilege	5848	wmic.exe
Token: SeIncBasePriorityPrivilege	5848	wmic.exe
Token: SeCreatePagefilePrivilege	5848	wmic.exe
Token: SeBackupPrivilege	5848	wmic.exe
Token: SeRestorePrivilege	5848	wmic.exe
Token: SeShutdownPrivilege	5848	wmic.exe
Token: SeDebugPrivilege	5848	wmic.exe
Token: SeSystemEnvironmentPrivilege	5848	wmic.exe
Token: SeRemoteShutdownPrivilege	5848	wmic.exe
Token: SeUndockPrivilege	5848	wmic.exe
Token: SeManageVolumePrivilege	5848	wmic.exe
Token: 33	5848	wmic.exe
Token: 34	5848	wmic.exe
Token: 35	5848	wmic.exe
Token: 36	5848	wmic.exe
Token: SeDebugPrivilege	5968	powershell.exe
Token: SeDebugPrivilege	4700	powershell.exe
Token: SeDebugPrivilege	972	powershell.exe
Token: SeDebugPrivilege	3644	powershell.exe
Token: SeIncreaseQuotaPrivilege	1788	wmic.exe
Token: SeSecurityPrivilege	1788	wmic.exe
Token: SeTakeOwnershipPrivilege	1788	wmic.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
5496	7zG.exe
4100	taskmgr.exe
4100	taskmgr.exe
4100	taskmgr.exe
4100	taskmgr.exe
4100	taskmgr.exe
4100	taskmgr.exe
4100	taskmgr.exe
4100	taskmgr.exe
4100	taskmgr.exe
4100	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
4100	taskmgr.exe
4100	taskmgr.exe
4100	taskmgr.exe
4100	taskmgr.exe
4100	taskmgr.exe
4100	taskmgr.exe
4100	taskmgr.exe
4100	taskmgr.exe
4100	taskmgr.exe
4100	taskmgr.exe
4100	taskmgr.exe
4100	taskmgr.exe
4100	taskmgr.exe
4100	taskmgr.exe
4100	taskmgr.exe
4100	taskmgr.exe
4100	taskmgr.exe
4100	taskmgr.exe
4100	taskmgr.exe
4100	taskmgr.exe
4100	taskmgr.exe
4100	taskmgr.exe
4100	taskmgr.exe
4100	taskmgr.exe
4100	taskmgr.exe
4100	taskmgr.exe
4100	taskmgr.exe
436	taskmgr.exe
436	taskmgr.exe
436	taskmgr.exe
436	taskmgr.exe
436	taskmgr.exe
436	taskmgr.exe
436	taskmgr.exe
436	taskmgr.exe
436	taskmgr.exe
436	taskmgr.exe
436	taskmgr.exe
436	taskmgr.exe
436	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 608 wrote to memory of 4848	608	msedge.exe	82
PID 608 wrote to memory of 4848	608	msedge.exe	82
PID 608 wrote to memory of 3732	608	msedge.exe	83
PID 608 wrote to memory of 3732	608	msedge.exe	83
PID 608 wrote to memory of 3732	608	msedge.exe	83
PID 608 wrote to memory of 3732	608	msedge.exe	83
PID 608 wrote to memory of 3732	608	msedge.exe	83
PID 608 wrote to memory of 3732	608	msedge.exe	83
PID 608 wrote to memory of 3732	608	msedge.exe	83
PID 608 wrote to memory of 3732	608	msedge.exe	83
PID 608 wrote to memory of 3732	608	msedge.exe	83
PID 608 wrote to memory of 3732	608	msedge.exe	83
PID 608 wrote to memory of 3732	608	msedge.exe	83
PID 608 wrote to memory of 3732	608	msedge.exe	83
PID 608 wrote to memory of 3732	608	msedge.exe	83
PID 608 wrote to memory of 3732	608	msedge.exe	83
PID 608 wrote to memory of 3732	608	msedge.exe	83
PID 608 wrote to memory of 3732	608	msedge.exe	83
PID 608 wrote to memory of 3732	608	msedge.exe	83
PID 608 wrote to memory of 3732	608	msedge.exe	83
PID 608 wrote to memory of 3732	608	msedge.exe	83
PID 608 wrote to memory of 3732	608	msedge.exe	83
PID 608 wrote to memory of 3732	608	msedge.exe	83
PID 608 wrote to memory of 3732	608	msedge.exe	83
PID 608 wrote to memory of 3732	608	msedge.exe	83
PID 608 wrote to memory of 3732	608	msedge.exe	83
PID 608 wrote to memory of 3732	608	msedge.exe	83
PID 608 wrote to memory of 3732	608	msedge.exe	83
PID 608 wrote to memory of 3732	608	msedge.exe	83
PID 608 wrote to memory of 3732	608	msedge.exe	83
PID 608 wrote to memory of 3732	608	msedge.exe	83
PID 608 wrote to memory of 3732	608	msedge.exe	83
PID 608 wrote to memory of 3732	608	msedge.exe	83
PID 608 wrote to memory of 3732	608	msedge.exe	83
PID 608 wrote to memory of 3732	608	msedge.exe	83
PID 608 wrote to memory of 3732	608	msedge.exe	83
PID 608 wrote to memory of 3732	608	msedge.exe	83
PID 608 wrote to memory of 3732	608	msedge.exe	83
PID 608 wrote to memory of 3732	608	msedge.exe	83
PID 608 wrote to memory of 3732	608	msedge.exe	83
PID 608 wrote to memory of 3732	608	msedge.exe	83
PID 608 wrote to memory of 3732	608	msedge.exe	83
PID 608 wrote to memory of 3600	608	msedge.exe	84
PID 608 wrote to memory of 3600	608	msedge.exe	84
PID 608 wrote to memory of 948	608	msedge.exe	85
PID 608 wrote to memory of 948	608	msedge.exe	85
PID 608 wrote to memory of 948	608	msedge.exe	85
PID 608 wrote to memory of 948	608	msedge.exe	85
PID 608 wrote to memory of 948	608	msedge.exe	85
PID 608 wrote to memory of 948	608	msedge.exe	85
PID 608 wrote to memory of 948	608	msedge.exe	85
PID 608 wrote to memory of 948	608	msedge.exe	85
PID 608 wrote to memory of 948	608	msedge.exe	85
PID 608 wrote to memory of 948	608	msedge.exe	85
PID 608 wrote to memory of 948	608	msedge.exe	85
PID 608 wrote to memory of 948	608	msedge.exe	85
PID 608 wrote to memory of 948	608	msedge.exe	85
PID 608 wrote to memory of 948	608	msedge.exe	85
PID 608 wrote to memory of 948	608	msedge.exe	85
PID 608 wrote to memory of 948	608	msedge.exe	85
PID 608 wrote to memory of 948	608	msedge.exe	85
PID 608 wrote to memory of 948	608	msedge.exe	85
PID 608 wrote to memory of 948	608	msedge.exe	85
PID 608 wrote to memory of 948	608	msedge.exe	85

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
5920	attrib.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://drive.google.com/file/d/1lXMp7IT8jIPJC94TnpCscPzFkJjO1vY_/view?usp=drive_link
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe3e6246f8,0x7ffe3e624708,0x7ffe3e624718
  2⤵
  PID:4848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,4035849879055140008,10500911241100963783,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
  2⤵
  PID:3732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,4035849879055140008,10500911241100963783,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2148,4035849879055140008,10500911241100963783,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2836 /prefetch:8
  2⤵
  PID:948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,4035849879055140008,10500911241100963783,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
  2⤵
  PID:3268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,4035849879055140008,10500911241100963783,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
  2⤵
  PID:1916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,4035849879055140008,10500911241100963783,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4980 /prefetch:1
  2⤵
  PID:2632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,4035849879055140008,10500911241100963783,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5192 /prefetch:1
  2⤵
  PID:4664
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,4035849879055140008,10500911241100963783,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5764 /prefetch:8
  2⤵
  PID:2856
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,4035849879055140008,10500911241100963783,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5764 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,4035849879055140008,10500911241100963783,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5532 /prefetch:1
  2⤵
  PID:3712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,4035849879055140008,10500911241100963783,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5508 /prefetch:1
  2⤵
  PID:4228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,4035849879055140008,10500911241100963783,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5184 /prefetch:1
  2⤵
  PID:2548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,4035849879055140008,10500911241100963783,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5824 /prefetch:1
  2⤵
  PID:4020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2148,4035849879055140008,10500911241100963783,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5300 /prefetch:8
  2⤵
  PID:3980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,4035849879055140008,10500911241100963783,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6092 /prefetch:1
  2⤵
  PID:384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2148,4035849879055140008,10500911241100963783,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6368 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,4035849879055140008,10500911241100963783,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1788 /prefetch:2
  2⤵
  PID:3644

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4368

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4516

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5212

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\WAWE(ROBLOX)\" -ad -an -ai#7zMap2837:86:7zEvent32568
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5496

C:\Users\Admin\Downloads\WAWE(ROBLOX)\WaveTrial\Wawe.exe
"C:\Users\Admin\Downloads\WAWE(ROBLOX)\WaveTrial\Wawe.exe"
1⤵
- Checks computer location settings
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:6060
- C:\Windows\SysWOW64\netsh.exe
  netsh firewall add allowedprogram "C:\Users\Admin\Downloads\WAWE(ROBLOX)\WaveTrial\Wawe.exe" "Wawe.exe" ENABLE
  2⤵
  - Modifies Windows Firewall
  PID:5220
- C:\Users\Admin\AppData\Local\Temp\tmp7692.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmp7692.tmp.exe"
  2⤵
  - Drops file in Drivers directory
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5776
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" csproduct get uuid
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5848
- - C:\Windows\SYSTEM32\attrib.exe
    "attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\tmp7692.tmp.exe"
    3⤵
    - Views/modifies file attributes
    PID:5920
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\tmp7692.tmp.exe'
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5968
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4700
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:972
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3644
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" os get Caption
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1788
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" computersystem get totalphysicalmemory
    3⤵
    PID:3512
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" csproduct get uuid
    3⤵
    PID:5992
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5532
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" path win32_VideoController get name
    3⤵
    - Detects videocard installed
    PID:5756
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\tmp7692.tmp.exe" && pause
    3⤵
    PID:4820
  - - C:\Windows\system32\PING.EXE
      ping localhost
      4⤵
      Runs ping.exe
      PID:5848
- C:\Users\Admin\AppData\Local\Temp\tmp2801.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmp2801.tmp.exe"
  2⤵
  - Executes dropped EXE
  PID:5416

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4100

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
PID:4360

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious use of SendNotifyMessage
PID:436

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx

Filesize
64KB

MD5
d2fb266b97caff2086bf0fa74eddb6b2

SHA1
2f0061ce9c51b5b4fbab76b37fc6a540be7f805d

SHA256
b09f68b61d9ff5a7c7c8b10eee9447d4813ee0e866346e629e788cd4adecb66a

SHA512
c3ba95a538c1d266beb83334af755c34ce642a4178ab0f2e5f7822fd6821d3b68862a8b58f167a9294e6d913b08c1054a69b5d7aec2efdb3cf9796ed84de21a8

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock

Filesize
4B

MD5
f49655f856acb8884cc0ace29216f511

SHA1
cb0f1f87ec0455ec349aaa950c600475ac7b7b6b

SHA256
7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba

SHA512
599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val

Filesize
944B

MD5
6bd369f7c74a28194c991ed1404da30f

SHA1
0f8e3f8ab822c9374409fe399b6bfe5d68cbd643

SHA256
878947d0ec814fe7c343cdebc05eebf00eb14f3023bdb3809a559e17f399fe5d

SHA512
8fc5f073dc9fa1e1ae47c60a5f06e0a48709fd6a4302dffaa721858409e7bde64bc6856d3fb28891090516d1a7afc542579de287778b5755eafe75cc67d45d93

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
120a75f233314ba1fe34e9d6c09f30b9

SHA1
a9f92f2d3f111eaadd9bcf8fceb3c9553753539c

SHA256
e04101215c3534dbc77c0b5df2e1d1ff74c277d2946f391f939c9a7948a22dd0

SHA512
3c4eb93e425b50e8bcc1712f4cc2be11888a0273c3a619fc6bf72ccab876a427158f661bfc80d0c1e47ef4116febf76a3aaa31a60ec662eae0e51c7f1d3d89b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
bc2edd0741d97ae237e9f00bf3244144

SHA1
7c1e5d324f5c7137a3c4ec85146659f026c11782

SHA256
dbce3287c7ae69ccbd1d780c39f3ffa3c98bd4609a939fff8ee9c99f14265041

SHA512
00f505a0b4ea0df626175bf9d39a205f18f9754b62e4dba6fbb5b4a716b3539e7809723e1596bcfe1ba3041e22342e3a9cbaad88e84ce9c8c6531331bbc25093

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
408B

MD5
dc0036ef4a2cec0fbc20e03660968937

SHA1
888ff751beb87438da6986aed7da2b9fae2a716d

SHA256
fa92a2e980ff239280ee1e017a93e0852184e5f56915fc5ffe11ce757174d53a

SHA512
ca0c405408f4831936fb1c24d583bf63fdd9febe8cdc3f97bb3c38f8bb4166be39751245ee8326cab6e05cb1f097c3f6d7e69065ba84231b33ab278d27195e40

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies

Filesize
20KB

MD5
b9470875ae0e64534c0a0c9819c20472

SHA1
f417b481e5794dc0365f28714556a74c459d4bc9

SHA256
af7252f57bb38782560af520368d84614d435c2fb937032ea1b2ae150d7a03d9

SHA512
919b4ac4e920832375e94c8b5207baacb2f5b542f3f6ee26fce2b624af1f54ae88254e2934a850146470e6faa5ea352cd385c1b1a82648d297f83216ca798c41

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log

Filesize
95B

MD5
e747f00bc750c8b5438d17c626546063

SHA1
42fdc138eb2e3f5b19b21426a0cf9aa08fc2578b

SHA256
eb8ea32b91057259f2cb40d6f8fc63367a39685486fa045bd0d4cd57b4613b06

SHA512
40ac77e5937d6a79f104bd309e7e6e5593bf3c03f02efdbda375df04a7cd26afa3a7f677e7184919e25673a53663bcf36364b5e277d499d97046837fccbdf4a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
1fd64596e233dbc03e44f722261c8355

SHA1
12bd48bba2650d8e4abb7f318e377bc3695c4f63

SHA256
66a8d5de5ebcc2872f40169ffb698cb1de5269229daf2fed314b79cd69085822

SHA512
040550953d24d489a200688e3e5ee272d2887bfdb103b78a98582bd6c232aaf218ccd820aaf2159cc1a21276c0249eecc99a9e424bacf663b816f065055a3992

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
df21f53a5a474e5bf57fd88deb0d966a

SHA1
961fbe5f62359dccfba308aafaaf810486ca3e01

SHA256
406e6c2265cd79e67b6d8f4b9263182f5299de1d306a1cce1d5ecd28fbcca68d

SHA512
4444ce94b48d9b2cfc8c46292c1a51effab76c451dc83809e46da89ecd4fc43ebb079025014d7cc2f5e8755c4d3c18fd9cdae26347b7c7d176afac367cf3cbc6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
33fd17965d6e8a7df4773789c4143c15

SHA1
62540baedde288dd166cd6203ba1fd526021cb54

SHA256
ae125671e79b495abd8e08be1e1998123de5c8060c3482d1b90efad7a10dc368

SHA512
8ff13b5e47387be2b6a12f5706a90cfb9b43fb781b97b42cac7d757cb4c4a8c283a6bcf60e13b8a1b29b5282c33724008aba36c73942acd6b169d1bca1907cf9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ddd4b86120e8e27f6ef550dbe7b1c740

SHA1
7c84968fc23ff769eee2f0524c1f6110fd9d921d

SHA256
a3c51d526854c6732660bc267c38038c3428152fa114183d5bdb2bb01ab24808

SHA512
d07d7a834108590ae26d28df05b563d8b91c9e6232923cd236ed7dfe057a08de66b0b2178707f0b2270d99e917279f55313ba4242c4d17d0a039de4ec1e0e10d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c811b713f032e1e94559dcd9641fc281

SHA1
2fc1f2e3c1ce4cb3ad317d6f13ee0135b3af04ce

SHA256
0f70a90de7d13abf2c61b83f7a18fb25b2de58826e3729593c9e912075af3dce

SHA512
a741296683c1a0b9593e61808dca956ebec943433a7682c97f4843c5bbd5c3a0061eaea61b3a021dd911338cd495a5cafa1049f057ba923fff8f0571f487318f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
bb2966a22220c4045bd7b3b402f5c424

SHA1
99feea1c4778f4960d7ae8db2fdeb6a72ff344e4

SHA256
3d1200243caea5865db0a9177df0187d52ab2c81c7be001be3287162058fe0e0

SHA512
c90c4012dfbf845928947c99a4cb0744097da6e6d9f8e23b9cdf7691f775c674d5a6f17dd377195651d61ed35e0fcbdc7c63b5cf7effc15394a4b9d615bfa2b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
a1d96f268a9c1776c8944885a2698f14

SHA1
07a5e2cfb7283083ce8026745e4bf51c014f6153

SHA256
f65b4e4f582e70956fff258cf83f1649fcaf223496e7400ed7c249b006bcd062

SHA512
e9a84b29276a2c6e543f1d5b9beac6485875b77402d70a1cb7b1ddbdd609318686848f6c8fadf6e44aaeccc97279327ca8d318738e08353003adc877f1bc238c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
75c53e4aee35848cf573208419c33208

SHA1
5449af350e50f31d0b228358ecfc48c505d0d1f6

SHA256
bfe83ff14de0b1e8920c7b4f06f615e17c56a65f15b3ccefc7ca803c476d7f17

SHA512
5a7cda1ddfbb54c7961018fb4076402456739c504f29a93cff52a929c9c94f60fb02723095937f485edee7448098bff6209e88d2645fbaa580cb0dc27ceefa1c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
2e907f77659a6601fcc408274894da2e

SHA1
9f5b72abef1cd7145bf37547cdb1b9254b4efe9d

SHA256
385da35673330e21ac02545220552fe301fe54dedefbdafc097ac4342a295233

SHA512
34fa0fff24f6550f55f828541aaefe5d75c86f8f0842d54b50065e9746f9662bb7209c74c9a9571540b9855bb3851f01db613190024e89b198d485bb5dc07721

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
948B

MD5
c9b6705519e1eef08f86c4ba5f4286f3

SHA1
6c6b179e452ecee2673a1d4fe128f1c06f70577f

SHA256
0f9cad44a79126871580e19b01dc3f880c5173b1faaf8b9018d5d1f829714705

SHA512
6d8f85a7a8b0b124530f36a157cd0441b5c1eacdc35e274af9fbf0569d03d1d5e468651a5b2425f0215c282ecfa7b1ffeaeeaf18612822f00bd14306d30640c7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
276798eeb29a49dc6e199768bc9c2e71

SHA1
5fdc8ccb897ac2df7476fbb07517aca5b7a6205b

SHA256
cd0a1056e8f1b6cb5cb328532239d802f4e2aa8f8fcdc0fcb487684bd68e0dcc

SHA512
0d34fce64bbefc57d64fa6e03ca886952263d5f24df9c1c4cce6a1e8f5a47a9a21e9820f8d38caa7f7b43a52336ce00b738ea18419aaa7c788b72e04ce19e4f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
a04fa55ccc3a400d64bd9e9c8fae7121

SHA1
94a6cc57112b3467914e50e0e229abe9f0aba757

SHA256
bfd25686ddae9394f2060e05462bbb4b94cf576b258bdbe5ddb0b0638b19bc09

SHA512
d86e9b3a0a6dd3ef17984137a6814f8aabeb930a72b4cd29d7a9a3995ce094d8fccdbe9399f38614148e4d15f729d91f91c0ce99d8ef6e16f5e65ec9e690bc89

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_iqs3qocc.3v4.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp2801.tmp.exe

Filesize
294KB

MD5
10fc8b2915c43aa16b6a2e2b4529adc5

SHA1
0c15286457963eb86d61d83642870a3473ef38fe

SHA256
feb09cc39b1520d228e9e9274500b8c229016d6fc8018a2bf19aa9d3601492c5

SHA512
421631c06408c3be522953459228d2e1d45eeeafce29dba7746c8485a105b59c3a2c0d9e2ffc6d89126cd825ffd09ebe7eb82223a69d1f5caf441feb01e57897

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp7692.tmp.exe

Filesize
231KB

MD5
211994ee8cb49643fd5204d606029e53

SHA1
1fb2d311f596e283b519606a233195b7ef2d78c3

SHA256
01c07b796ebd9ccc2acc467ff44f9a4d7e33473d0b3c69e23b3b89608b8e59dc

SHA512
0cf8ba8420e8f337b06b89a257a62563d86124ee4a30160f9815f244594159df44a957eca7cfd6a8443dd8dd371636d4972faa9cf1180fee9eafc87ddf2cf853

Download Submit
C:\Users\Admin\Downloads\WAWE(ROBLOX).rar

Filesize
149.2MB

MD5
09c7f01096985bf09b2d4917e21ed146

SHA1
306288966a26e745391892607aef7ee315e7ad5a

SHA256
c0246d4f920c4f08fb821819c7aeb1c8b1fbcb83a53b2176e0911700cb0e4c0b

SHA512
2a46a4fce5b758a085206ce1e1d08e30e1368ea5f58f47b3381064c016eb27e8fe8da9cca87834cc41b19a13bfbc1a1d7100238f4cdf106e897741cd4c9a11a6

Download Submit
C:\Users\Admin\Downloads\WAWE(ROBLOX)\WaveTrial\Wawe.exe

Filesize
37KB

MD5
ad8378c96a922dcfe813935d1eec9ae4

SHA1
0e7ee31880298190258f5282f6cc2797fccdc134

SHA256
9a7b8171f8c6bd4bb61b7d8baf7dab921983ab7767705c3f1e1265704599ab98

SHA512
d38a7581ef5c3dcc8752fc2465ad698605bbd38bf380201623265e5ef121510d3f34116438727e60b3832e867e2ed4fd52081d58690690ff98b28cde80f6af5f

Download Submit
C:\Users\Admin\Downloads\WAWE(ROBLOX)\WaveTrial\dist\client\assets\index-daab.js

Filesize
3.4MB

MD5
a19bf5e804004e0397a4547f9a8568fe

SHA1
daad35851be0986f1a99f5563976309c2f7fc800

SHA256
66909b895c0b86eb1edaf95c0d728939a4986f01bf5112023bf52a6afc021155

SHA512
2e98dedf48e2f16543ef28cdfad832f77a6250f6e71cadd2245e58aa4872a91934f390ad8552a1c59b035ead123904b95c31a1fb3d7ba3dbf49968b018755c5a

Download Submit
C:\Windows\system32\drivers\etc\hosts

Filesize
2KB

MD5
4028457913f9d08b06137643fe3e01bc

SHA1
a5cb3f12beaea8194a2d3d83a62bdb8d558f5f14

SHA256
289d433902418aaf62e7b96b215ece04fcbcef2457daf90f46837a4d5090da58

SHA512
c8e1eef90618341bbde885fd126ece2b1911ca99d20d82f62985869ba457553b4c2bf1e841fd06dacbf27275b3b0940e5a794e1b1db0fd56440a96592362c28b

Download Submit
memory/436-963-0x00000186760C0000-0x00000186760C1000-memory.dmp

Filesize
4KB

Download
memory/436-954-0x00000186760C0000-0x00000186760C1000-memory.dmp

Filesize
4KB

Download
memory/436-962-0x00000186760C0000-0x00000186760C1000-memory.dmp

Filesize
4KB

Download
memory/436-966-0x00000186760C0000-0x00000186760C1000-memory.dmp

Filesize
4KB

Download
memory/436-964-0x00000186760C0000-0x00000186760C1000-memory.dmp

Filesize
4KB

Download
memory/436-961-0x00000186760C0000-0x00000186760C1000-memory.dmp

Filesize
4KB

Download
memory/436-956-0x00000186760C0000-0x00000186760C1000-memory.dmp

Filesize
4KB

Download
memory/436-955-0x00000186760C0000-0x00000186760C1000-memory.dmp

Filesize
4KB

Download
memory/436-965-0x00000186760C0000-0x00000186760C1000-memory.dmp

Filesize
4KB

Download
memory/972-879-0x000002BC9A6D0000-0x000002BC9A6E0000-memory.dmp

Filesize
64KB

Download
memory/972-880-0x000002BC9A6D0000-0x000002BC9A6E0000-memory.dmp

Filesize
64KB

Download
memory/972-878-0x00007FFE29AF0000-0x00007FFE2A5B1000-memory.dmp

Filesize
10.8MB

Download
memory/972-904-0x000002BC9A6D0000-0x000002BC9A6E0000-memory.dmp

Filesize
64KB

Download
memory/972-906-0x00007FFE29AF0000-0x00007FFE2A5B1000-memory.dmp

Filesize
10.8MB

Download
memory/3644-909-0x0000020C310E0000-0x0000020C310F0000-memory.dmp

Filesize
64KB

Download
memory/3644-923-0x00007FFE29AF0000-0x00007FFE2A5B1000-memory.dmp

Filesize
10.8MB

Download
memory/3644-921-0x0000020C310E0000-0x0000020C310F0000-memory.dmp

Filesize
64KB

Download
memory/3644-919-0x0000020C310E0000-0x0000020C310F0000-memory.dmp

Filesize
64KB

Download
memory/3644-907-0x00007FFE29AF0000-0x00007FFE2A5B1000-memory.dmp

Filesize
10.8MB

Download
memory/4100-814-0x0000022CF9790000-0x0000022CF9791000-memory.dmp

Filesize
4KB

Download
memory/4100-808-0x0000022CF9790000-0x0000022CF9791000-memory.dmp

Filesize
4KB

Download
memory/4100-809-0x0000022CF9790000-0x0000022CF9791000-memory.dmp

Filesize
4KB

Download
memory/4100-807-0x0000022CF9790000-0x0000022CF9791000-memory.dmp

Filesize
4KB

Download
memory/4100-813-0x0000022CF9790000-0x0000022CF9791000-memory.dmp

Filesize
4KB

Download
memory/4100-815-0x0000022CF9790000-0x0000022CF9791000-memory.dmp

Filesize
4KB

Download
memory/4100-816-0x0000022CF9790000-0x0000022CF9791000-memory.dmp

Filesize
4KB

Download
memory/4100-817-0x0000022CF9790000-0x0000022CF9791000-memory.dmp

Filesize
4KB

Download
memory/4100-818-0x0000022CF9790000-0x0000022CF9791000-memory.dmp

Filesize
4KB

Download
memory/4100-819-0x0000022CF9790000-0x0000022CF9791000-memory.dmp

Filesize
4KB

Download
memory/4700-867-0x000001D16ACE0000-0x000001D16ACF0000-memory.dmp

Filesize
64KB

Download
memory/4700-869-0x00007FFE29AF0000-0x00007FFE2A5B1000-memory.dmp

Filesize
10.8MB

Download
memory/4700-855-0x000001D16ACE0000-0x000001D16ACF0000-memory.dmp

Filesize
64KB

Download
memory/4700-856-0x000001D16ACE0000-0x000001D16ACF0000-memory.dmp

Filesize
64KB

Download
memory/4700-854-0x00007FFE29AF0000-0x00007FFE2A5B1000-memory.dmp

Filesize
10.8MB

Download
memory/5532-931-0x00007FFE29AF0000-0x00007FFE2A5B1000-memory.dmp

Filesize
10.8MB

Download
memory/5532-946-0x00007FFE29AF0000-0x00007FFE2A5B1000-memory.dmp

Filesize
10.8MB

Download
memory/5532-934-0x0000020E2EF80000-0x0000020E2EF90000-memory.dmp

Filesize
64KB

Download
memory/5532-933-0x0000020E2EF80000-0x0000020E2EF90000-memory.dmp

Filesize
64KB

Download
memory/5776-952-0x00007FFE29AF0000-0x00007FFE2A5B1000-memory.dmp

Filesize
10.8MB

Download
memory/5776-927-0x000001EDEDFD0000-0x000001EDEDFE2000-memory.dmp

Filesize
72KB

Download
memory/5776-926-0x000001EDEDFA0000-0x000001EDEDFAA000-memory.dmp

Filesize
40KB

Download
memory/5776-932-0x000001EDEDE70000-0x000001EDEDE80000-memory.dmp

Filesize
64KB

Download
memory/5776-873-0x000001EDEE000000-0x000001EDEE076000-memory.dmp

Filesize
472KB

Download
memory/5776-908-0x00007FFE29AF0000-0x00007FFE2A5B1000-memory.dmp

Filesize
10.8MB

Download
memory/5776-833-0x000001EDEB8B0000-0x000001EDEB8F0000-memory.dmp

Filesize
256KB

Download
memory/5776-874-0x000001EDEE080000-0x000001EDEE0D0000-memory.dmp

Filesize
320KB

Download
memory/5776-877-0x000001EDEDF80000-0x000001EDEDF9E000-memory.dmp

Filesize
120KB

Download
memory/5776-834-0x00007FFE29AF0000-0x00007FFE2A5B1000-memory.dmp

Filesize
10.8MB

Download
memory/5776-835-0x000001EDEDE70000-0x000001EDEDE80000-memory.dmp

Filesize
64KB

Download
memory/5968-837-0x0000020225AE0000-0x0000020225AF0000-memory.dmp

Filesize
64KB

Download
memory/5968-838-0x0000020225AE0000-0x0000020225AF0000-memory.dmp

Filesize
64KB

Download
memory/5968-844-0x0000020225A00000-0x0000020225A22000-memory.dmp

Filesize
136KB

Download
memory/5968-836-0x00007FFE29AF0000-0x00007FFE2A5B1000-memory.dmp

Filesize
10.8MB

Download
memory/5968-851-0x00007FFE29AF0000-0x00007FFE2A5B1000-memory.dmp

Filesize
10.8MB

Download
memory/6060-821-0x0000000001310000-0x0000000001320000-memory.dmp

Filesize
64KB

Download
memory/6060-853-0x0000000001310000-0x0000000001320000-memory.dmp

Filesize
64KB

Download
memory/6060-953-0x0000000001310000-0x0000000001320000-memory.dmp

Filesize
64KB

Download
memory/6060-820-0x0000000074E20000-0x00000000753D1000-memory.dmp

Filesize
5.7MB

Download
memory/6060-806-0x0000000001310000-0x0000000001320000-memory.dmp

Filesize
64KB

Download
memory/6060-773-0x0000000074E20000-0x00000000753D1000-memory.dmp

Filesize
5.7MB

Download
memory/6060-970-0x0000000001310000-0x0000000001320000-memory.dmp

Filesize
64KB

Download
memory/6060-772-0x0000000001310000-0x0000000001320000-memory.dmp

Filesize
64KB

Download
memory/6060-771-0x0000000074E20000-0x00000000753D1000-memory.dmp

Filesize
5.7MB

Download
memory/6060-990-0x0000000074E20000-0x00000000753D1000-memory.dmp

Filesize
5.7MB

Download