hxxps://github[.]com/Blank-c/Umbral-Stealer

Resubmissions

28-04-2024 10:07

240428-l52hssde21 10

28-04-2024 10:07

240428-l5nlyade2t 1

28-04-2024 09:45

240428-lq7fhadb5t 7

Analysis

max time kernel
96s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
28-04-2024 09:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/Blank-c/Umbral-Stealer

Score

7^/10

agilenet

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2224	Umbral.builder.exe

Obfuscated with Agile.Net obfuscator 16 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

resource	yara_rule
behavioral1/files/0x00070000000234ed-321.dat	agile_net
behavioral1/memory/2224-322-0x000002B762230000-0x000002B762250000-memory.dmp	agile_net
behavioral1/files/0x0007000000023506-323.dat	agile_net
behavioral1/memory/2224-324-0x000002B762250000-0x000002B762270000-memory.dmp	agile_net
behavioral1/files/0x00070000000234f9-325.dat	agile_net
behavioral1/memory/2224-326-0x000002B77C300000-0x000002B77C36E000-memory.dmp	agile_net
behavioral1/files/0x00070000000234f0-327.dat	agile_net
behavioral1/memory/2224-332-0x000002B762290000-0x000002B7622A0000-memory.dmp	agile_net
behavioral1/memory/2224-334-0x000002B7622C0000-0x000002B7622DE000-memory.dmp	agile_net
behavioral1/files/0x00070000000234ee-333.dat	agile_net
behavioral1/files/0x0007000000023502-331.dat	agile_net
behavioral1/memory/2224-330-0x000002B77C490000-0x000002B77C4EA000-memory.dmp	agile_net
behavioral1/files/0x00070000000234ec-329.dat	agile_net
behavioral1/memory/2224-328-0x000002B762280000-0x000002B76228E000-memory.dmp	agile_net
behavioral1/files/0x00070000000234eb-335.dat	agile_net
behavioral1/memory/2224-336-0x000002B77C780000-0x000002B77C8CA000-memory.dmp	agile_net

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
24	camo.githubusercontent.com
26	camo.githubusercontent.com

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2308	msedge.exe
2308	msedge.exe
3368	msedge.exe
3368	msedge.exe
2440	identity_helper.exe
2440	identity_helper.exe
4536	msedge.exe
4536	msedge.exe
2224	Umbral.builder.exe
2224	Umbral.builder.exe
2224	Umbral.builder.exe
2224	Umbral.builder.exe
2224	Umbral.builder.exe
2224	Umbral.builder.exe
2224	Umbral.builder.exe
2224	Umbral.builder.exe
2224	Umbral.builder.exe
2224	Umbral.builder.exe
2224	Umbral.builder.exe
2224	Umbral.builder.exe
2224	Umbral.builder.exe
2224	Umbral.builder.exe
2224	Umbral.builder.exe
2224	Umbral.builder.exe
2224	Umbral.builder.exe
2224	Umbral.builder.exe
2224	Umbral.builder.exe
2224	Umbral.builder.exe
2224	Umbral.builder.exe
2224	Umbral.builder.exe
2224	Umbral.builder.exe
2224	Umbral.builder.exe
2224	Umbral.builder.exe
2224	Umbral.builder.exe
2224	Umbral.builder.exe
2224	Umbral.builder.exe
2224	Umbral.builder.exe
2224	Umbral.builder.exe
2224	Umbral.builder.exe
2224	Umbral.builder.exe
2224	Umbral.builder.exe
2224	Umbral.builder.exe
2224	Umbral.builder.exe
2224	Umbral.builder.exe
2224	Umbral.builder.exe
2224	Umbral.builder.exe
2224	Umbral.builder.exe
2224	Umbral.builder.exe
2224	Umbral.builder.exe
2224	Umbral.builder.exe
2224	Umbral.builder.exe
2224	Umbral.builder.exe
2224	Umbral.builder.exe
2224	Umbral.builder.exe
2224	Umbral.builder.exe
2224	Umbral.builder.exe
2224	Umbral.builder.exe
2224	Umbral.builder.exe
2224	Umbral.builder.exe
2224	Umbral.builder.exe
2224	Umbral.builder.exe
2224	Umbral.builder.exe
2224	Umbral.builder.exe
2224	Umbral.builder.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeRestorePrivilege	3780	7zG.exe
Token: 35	3780	7zG.exe
Token: SeSecurityPrivilege	3780	7zG.exe
Token: SeSecurityPrivilege	3780	7zG.exe
Token: SeDebugPrivilege	2224	Umbral.builder.exe

Suspicious use of FindShellTrayWindow 47 IoCs

pid	Process
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3780	7zG.exe
2224	Umbral.builder.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3368 wrote to memory of 4580	3368	msedge.exe	82
PID 3368 wrote to memory of 4580	3368	msedge.exe	82
PID 3368 wrote to memory of 2796	3368	msedge.exe	83
PID 3368 wrote to memory of 2796	3368	msedge.exe	83
PID 3368 wrote to memory of 2796	3368	msedge.exe	83
PID 3368 wrote to memory of 2796	3368	msedge.exe	83
PID 3368 wrote to memory of 2796	3368	msedge.exe	83
PID 3368 wrote to memory of 2796	3368	msedge.exe	83
PID 3368 wrote to memory of 2796	3368	msedge.exe	83
PID 3368 wrote to memory of 2796	3368	msedge.exe	83
PID 3368 wrote to memory of 2796	3368	msedge.exe	83
PID 3368 wrote to memory of 2796	3368	msedge.exe	83
PID 3368 wrote to memory of 2796	3368	msedge.exe	83
PID 3368 wrote to memory of 2796	3368	msedge.exe	83
PID 3368 wrote to memory of 2796	3368	msedge.exe	83
PID 3368 wrote to memory of 2796	3368	msedge.exe	83
PID 3368 wrote to memory of 2796	3368	msedge.exe	83
PID 3368 wrote to memory of 2796	3368	msedge.exe	83
PID 3368 wrote to memory of 2796	3368	msedge.exe	83
PID 3368 wrote to memory of 2796	3368	msedge.exe	83
PID 3368 wrote to memory of 2796	3368	msedge.exe	83
PID 3368 wrote to memory of 2796	3368	msedge.exe	83
PID 3368 wrote to memory of 2796	3368	msedge.exe	83
PID 3368 wrote to memory of 2796	3368	msedge.exe	83
PID 3368 wrote to memory of 2796	3368	msedge.exe	83
PID 3368 wrote to memory of 2796	3368	msedge.exe	83
PID 3368 wrote to memory of 2796	3368	msedge.exe	83
PID 3368 wrote to memory of 2796	3368	msedge.exe	83
PID 3368 wrote to memory of 2796	3368	msedge.exe	83
PID 3368 wrote to memory of 2796	3368	msedge.exe	83
PID 3368 wrote to memory of 2796	3368	msedge.exe	83
PID 3368 wrote to memory of 2796	3368	msedge.exe	83
PID 3368 wrote to memory of 2796	3368	msedge.exe	83
PID 3368 wrote to memory of 2796	3368	msedge.exe	83
PID 3368 wrote to memory of 2796	3368	msedge.exe	83
PID 3368 wrote to memory of 2796	3368	msedge.exe	83
PID 3368 wrote to memory of 2796	3368	msedge.exe	83
PID 3368 wrote to memory of 2796	3368	msedge.exe	83
PID 3368 wrote to memory of 2796	3368	msedge.exe	83
PID 3368 wrote to memory of 2796	3368	msedge.exe	83
PID 3368 wrote to memory of 2796	3368	msedge.exe	83
PID 3368 wrote to memory of 2796	3368	msedge.exe	83
PID 3368 wrote to memory of 2308	3368	msedge.exe	84
PID 3368 wrote to memory of 2308	3368	msedge.exe	84
PID 3368 wrote to memory of 3692	3368	msedge.exe	85
PID 3368 wrote to memory of 3692	3368	msedge.exe	85
PID 3368 wrote to memory of 3692	3368	msedge.exe	85
PID 3368 wrote to memory of 3692	3368	msedge.exe	85
PID 3368 wrote to memory of 3692	3368	msedge.exe	85
PID 3368 wrote to memory of 3692	3368	msedge.exe	85
PID 3368 wrote to memory of 3692	3368	msedge.exe	85
PID 3368 wrote to memory of 3692	3368	msedge.exe	85
PID 3368 wrote to memory of 3692	3368	msedge.exe	85
PID 3368 wrote to memory of 3692	3368	msedge.exe	85
PID 3368 wrote to memory of 3692	3368	msedge.exe	85
PID 3368 wrote to memory of 3692	3368	msedge.exe	85
PID 3368 wrote to memory of 3692	3368	msedge.exe	85
PID 3368 wrote to memory of 3692	3368	msedge.exe	85
PID 3368 wrote to memory of 3692	3368	msedge.exe	85
PID 3368 wrote to memory of 3692	3368	msedge.exe	85
PID 3368 wrote to memory of 3692	3368	msedge.exe	85
PID 3368 wrote to memory of 3692	3368	msedge.exe	85
PID 3368 wrote to memory of 3692	3368	msedge.exe	85
PID 3368 wrote to memory of 3692	3368	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/Blank-c/Umbral-Stealer
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe344246f8,0x7ffe34424708,0x7ffe34424718
  2⤵
  PID:4580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,5602192866269660035,4648565379039365721,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
  2⤵
  PID:2796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,5602192866269660035,4648565379039365721,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,5602192866269660035,4648565379039365721,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2736 /prefetch:8
  2⤵
  PID:3692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,5602192866269660035,4648565379039365721,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:3460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,5602192866269660035,4648565379039365721,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:3408
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,5602192866269660035,4648565379039365721,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5192 /prefetch:8
  2⤵
  PID:2044
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,5602192866269660035,4648565379039365721,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5192 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2104,5602192866269660035,4648565379039365721,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5352 /prefetch:8
  2⤵
  PID:5008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,5602192866269660035,4648565379039365721,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5408 /prefetch:1
  2⤵
  PID:4556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2104,5602192866269660035,4648565379039365721,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5760 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,5602192866269660035,4648565379039365721,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5984 /prefetch:1
  2⤵
  PID:4352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,5602192866269660035,4648565379039365721,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5784 /prefetch:1
  2⤵
  PID:2856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,5602192866269660035,4648565379039365721,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5640 /prefetch:1
  2⤵
  PID:4516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,5602192866269660035,4648565379039365721,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6264 /prefetch:1
  2⤵
  PID:2484

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2804

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3212

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4832

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Umbral.Stealer\" -ad -an -ai#7zMap21255:90:7zEvent12
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3780

C:\Users\Admin\Downloads\Umbral.Stealer\Umbral.builder.exe
"C:\Users\Admin\Downloads\Umbral.Stealer\Umbral.builder.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2224

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
537815e7cc5c694912ac0308147852e4

SHA1
2ccdd9d9dc637db5462fe8119c0df261146c363c

SHA256
b4b69d099507d88abdeff4835e06cc6711e1c47464c963d013cef0a278e52d4f

SHA512
63969a69af057235dbdecddc483ef5ce0058673179a3580c5aa12938c9501513cdb72dd703a06fa7d4fc08d074f17528283338c795334398497c771ecbd1350a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8b167567021ccb1a9fdf073fa9112ef0

SHA1
3baf293fbfaa7c1e7cdacb5f2975737f4ef69898

SHA256
26764cedf35f118b55f30b3a36e0693f9f38290a5b2b6b8b83a00e990ae18513

SHA512
726098001ef1acf1dd154a658752fa27dea32bca8fbb66395c142cb666102e71632adbad1b7e2f717071cd3e3af3867471932a71707f2ae97b989f4be468ab54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
1f40a6fcffb0b50a8df50026d51a1123

SHA1
d956433d7d85d8c908eb5751eb5e4dd1dd1fc0ff

SHA256
e6ddb55700bed4d770eb2620292415a480ab3a1ad0be0db128a34c28283f09f9

SHA512
459c3aba7c9062f98564e0f17187b20e9a67628b0cdd2fc3bffd45a3a40bdd263898b5a5d2766bb20a4a586e5933d1f355d7caa991ce5248dbfca6e94f29c71f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
580B

MD5
23d0f3e132a021688040356991b1c978

SHA1
5373ecd8851a6a149de983c543e1ae6c9b150b0d

SHA256
b25aa78ea2d1f16a49f6a788a43ca2c79953d4ad0f0f5414fcfeaba62ce03e53

SHA512
9bc5484415ac42f051daf38f5c8e57df54d3b72a90f99233d76c5d0f0ad6325bd04c0c5e6ccf4b2c6141ddd1123cc137bea8fc2597951708e96461929dc9758e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a4cac1158de6c0a4660a7a6e3ac21d8c

SHA1
93e0a31b5d1e4ec2975356eb1063404fc36e03ee

SHA256
0b26fa09ca8c0dfd1fa35cfacfca08a5c2efe4d15ac8b49e29eb0521d3d63bf5

SHA512
aaa444eceae9ee23d8842b26be4fe382809230a751ef566b26dc7583bea83e5c677bcd38cd0015c2de07549042edf68baab3df1270a50b701762f0eb61211cb7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d4bb7c8513878a7bb0aa3a9e4d2b358e

SHA1
4ee33b24bbab5228af092281e92e57f348de4058

SHA256
4ff9ee9e9fbbee2ba370764951c5f68170e6c1874d8f869d4727107c39891967

SHA512
753180640d149deabc71cc11a78fa686d0e6fb6fa3fd92f3f0604fb79910b2162d064314e755859a1efac2143fcef83611bf0420fbdd073752903936535e8d63

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
29543ea7d884b4ec3ae8b1f9779c705a

SHA1
aee1c844c38261091be5666180ef8068e9cd9c4b

SHA256
dcdebf2d5e6a8005f9720fd0fe7023bf01567f5de51d43552093f2d72f3a23dd

SHA512
60f96b3ecdaa1a2f85497618fe1b62b00f836489ac647bc4b5aeeee194b7383d406de28f5f00db8109fa2690deb16a232ea8bc6e6c4842052f91891ed90c86f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
50045d7dc2e45f049a2df2ce2d927428

SHA1
d83866943837f36520e3d67272e9b9898da0f7e1

SHA256
a343036b1e649089dcc5edf0731af0dafa2f482c3ca11703e794a5927743f733

SHA512
8909cad98b41087589e8cac3998ba20b5de897a52aa820d25f0e51573bc6c88f0f3333bb002dca55fd882bcb71c6bf4c4578240128bf449f526ff2a8fd5e5cf9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe579c40.TMP

Filesize
1KB

MD5
fdbe95f7afab1a5f45e4773862c2d22d

SHA1
6450faefe07d657df8c406914792139426e90c14

SHA256
b0dc4bd162aa8797e3049ac4dc90e29d1f0a665e99fc71f9776275466df817c5

SHA512
81fc4dbcf3f99a43b4f067d370b6d81977f1ae9619acd969ae4bec6d7e3e227c2b10cdf7e4446a2a3351edcbd2c52b46e3d691519aa3f44682f8820af0c8ddb7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
d0187fe54fbd49fbacfed2dd41c771d4

SHA1
353b6e70d816e9c23761ff78da03386dc62449b9

SHA256
a8c471aaf9e857dbdbf4c2ce05d478219b832ff74c600c2501f4b70c14b71b26

SHA512
e0ede0b08a8185d4b07c760bc01eac2ac6c31f11767f2b835b6482b88ed52cf94d8e2117594ace72152dc94f83a60573b56c17294661fbd378300b47a275f04e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
cf89fde3ad837c98bd43b83a202dc736

SHA1
bba15641ebd9494bfb41d89f6df33d77a4488016

SHA256
b1b4817ea2c64ef5326fce12b25ab08bd5d8b47293303284e0ccb02be83d8b83

SHA512
a672d251a068da0651604cdaaa2b4cca62a337a6df61b91e7e3c19a35627b71f8a3b62ee7e649b4f0fcf6a1c3e57324b9dc79569838a2ec9a72debe7a22d7255

Download Submit
C:\Users\Admin\Downloads\Umbral.Stealer\Bunifu.Licensing.dll

Filesize
1.3MB

MD5
2b2740e0c34a46de31cf9da8a75d77cf

SHA1
242324f1112e6387cda41686291b6e9a415eeb8c

SHA256
a9be91cae167702885a5ca74273db779e3e391e2e604cc03779ed403c53ebe43

SHA512
605eb300b159e6ed2ee872b6ee378eed7dde6541000221fcd94d52057be91cb3c7dd65c7203f05e0718303b157b6fb941498b5e653501f97f0417d459da6bc40

Download Submit
C:\Users\Admin\Downloads\Umbral.Stealer\Bunifu.UI.WinForms.1.5.3.dll

Filesize
342KB

MD5
41c216d27c71a227774e680e95e99f31

SHA1
0a2a93d4ecbf4bbec2faf110066c6b4472b0dbf5

SHA256
012d717b4ac00c3686a772757f49c1908e223624e3974314cdb9fc9291073305

SHA512
e355ba11e41b668e4459f709e87c3e212c8986ea894791d9155791ea9d7315372fb51531eb69204ed2ee38e242de7629e4a2f090c05bf9deeea9ea965ffaf651

Download Submit
C:\Users\Admin\Downloads\Umbral.Stealer\Bunifu.UI.WinForms.BunifuButton.dll

Filesize
107KB

MD5
21f999e5ac72a16077511d41590822de

SHA1
d8bb1a8a291f73cdf2b5658b2b65736c87db19dd

SHA256
2a62c78f1f0db2e3258135b50f7885e6734c31c74a8f2f5782f285aa268c2f71

SHA512
e04fe31870f266d772829053a6bb210a9513ff5c8c0f9a3a267ddbe1875125496caa602baf44a4e241ef84d933bd55b79af43d5871ed10c81711adecee78b8e3

Download Submit
C:\Users\Admin\Downloads\Umbral.Stealer\Bunifu.UI.WinForms.BunifuCheckBox.dll

Filesize
102KB

MD5
ef11f59a9381df17d7ab94434f79f260

SHA1
ec11e46a636fe3927fd5fa7c30be65b958853ef0

SHA256
390252aeb6fd76a954a03853c3d883e0360dc8b3f2cf8cfed5ba94e4e5a24da4

SHA512
612b1b0f9204c605ff5e9b91816e674cdaea71fa69f81a5a7f475bf1cc8d5e12687deb1b0118b07b3d7e4764adede0576f8fc799f8155a65a70e5dafff50f73d

Download Submit
C:\Users\Admin\Downloads\Umbral.Stealer\Bunifu.UI.WinForms.BunifuColorTransition.dll

Filesize
38KB

MD5
539d803013c0b1592d0e17a740d72687

SHA1
b0ce15e0f096d027b1d1482afa9d93bafd160f7a

SHA256
500adece1fba76dfb2fa628de9886a2661ed1a4e58a7717a5fee607206bb1d81

SHA512
77d8ab7a949db41a79371cf2ebd5d67bd4a38dd040de0073c878f50b2a6409fae2dc5db7cbf375fbc1bc571838b0a6d4848bdecc1420d91633b878585c94b9dd

Download Submit
C:\Users\Admin\Downloads\Umbral.Stealer\Bunifu.UI.WinForms.BunifuLabel.dll

Filesize
420KB

MD5
73ca0338c9c3b7901d3621b346c76a7a

SHA1
79d26ee6e1bf0beb2ee0593562592de8ff01935b

SHA256
a505193910f7b8fd6123c00bb437bff3d2a4f28c970e24207d395554765e6ad4

SHA512
53e0b84dffbec8e465955bc91f1207ba56a55543ba3c00c66997b3ee3d4cb904e027915a12f7a9dc79ffef4cde633c9b7543436c4ab97785ca2169bc3d4aeede

Download Submit
C:\Users\Admin\Downloads\Umbral.Stealer\Bunifu.UI.WinForms.BunifuShadowPanel.dll

Filesize
45KB

MD5
ebaf1a6efa8c7a04d174be7e0df602a7

SHA1
ce08c80e52b6cf3f62ba82408d8f32ae6bcef0d8

SHA256
1858b16074d7f9b73f462e3adcc77309800594fa96f2e0904c810eda4eaf5e86

SHA512
4ffd5dcb59a4a03273c4e88047c7d398f098302b9485d07cf5549ca0d72467102aafa69298e248250df154a8b09f7560e634cca9cb1af2838baf3965aa645b31

Download Submit
C:\Users\Admin\Downloads\Umbral.Stealer\Bunifu.UI.WinForms.BunifuTextBox.dll

Filesize
112KB

MD5
fd2042c49df3e74e096b8cee8cc9fe43

SHA1
4ccdb0e13c24fb71f502d50e34f00c39bcacf307

SHA256
4569393e1aad7498c6a7c8a84f79d0cd7a1d0656e912d0ddb607b61163673976

SHA512
c93ad9cb411c311b0feeefdf2089c0c13098c7d2bab56345f4e9a7fc515965a3893c613d494adbbb066801eeb3dc32237a8322f7a5f876284a06b447efdad641

Download Submit
C:\Users\Admin\Downloads\Umbral.Stealer\Umbral.builder.exe

Filesize
114KB

MD5
d91fb6867df7e4303d98b5e90faae73c

SHA1
496f53ad8cd9381f1c1b577a73e978081002c1db

SHA256
bb19b002df31e1196b4e6530cf54c449e9cf1383d3adc5334a0442fa96b36344

SHA512
5dbcfe9bf567c6f1e18027950726af1835ab8b363ba8b040fd379b4cfe94b0894bc969b3c04fa4f1964b441a7b894bd4d37f3aabe3ea31396687a6ca093cfdc9

Download Submit
C:\Users\Admin\Downloads\Umbral.Stealer\Umbral.builder.exe.config

Filesize
163B

MD5
dccd44fb11b8e4ebdfb822e809a54b6f

SHA1
1889d5ae8c7c70c051cbde104af6e0f31f8c1b63

SHA256
6862b25736259f7bfd344e43eea10a703885be381eee2a745ceb12916b01a158

SHA512
dadffe41bdadfc3a79cb34369c9a8b37ce4833aee18058b02dcb13d64007f022b80b63ab404572c60278937cf83b06b00712ff9ee302e725b9d5c7fe14bd5f50

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 701800.crdownload

Filesize
3.3MB

MD5
f355889db3ff6bae624f80f41a52e619

SHA1
47f7916272a81d313e70808270c3c351207b890f

SHA256
8e95865efd39220dfc4abebc27141d9eae288a11981e43f09cbee6bf90347fe0

SHA512
bff7636f6cc0fadfd6f027e2ebda9e80fd5c64d551b2c666929b2d990509af73b082d739f14bb1497be292eafe703ebd5d7188493e2cc34b73d249fe901820eb

Download Submit
memory/2224-332-0x000002B762290000-0x000002B7622A0000-memory.dmp

Filesize
64KB

Download
memory/2224-334-0x000002B7622C0000-0x000002B7622DE000-memory.dmp

Filesize
120KB

Download
memory/2224-322-0x000002B762230000-0x000002B762250000-memory.dmp

Filesize
128KB

Download
memory/2224-326-0x000002B77C300000-0x000002B77C36E000-memory.dmp

Filesize
440KB

Download
memory/2224-330-0x000002B77C490000-0x000002B77C4EA000-memory.dmp

Filesize
360KB

Download
memory/2224-320-0x000002B761DC0000-0x000002B761DE2000-memory.dmp

Filesize
136KB

Download
memory/2224-328-0x000002B762280000-0x000002B76228E000-memory.dmp

Filesize
56KB

Download
memory/2224-324-0x000002B762250000-0x000002B762270000-memory.dmp

Filesize
128KB

Download
memory/2224-336-0x000002B77C780000-0x000002B77C8CA000-memory.dmp

Filesize
1.3MB

Download
memory/2224-337-0x000002B77C630000-0x000002B77C746000-memory.dmp

Filesize
1.1MB

Download
memory/2224-338-0x000002B77C4F0000-0x000002B77C520000-memory.dmp

Filesize
192KB

Download