umbral | hxxps://anonym[.]ninja/download/7jECGFQlnCgLrRA

Analysis

max time kernel
161s
max time network
162s
platform
windows11-21h2_x64
resource
win11-20240508-en
resource tags

arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
submitted
14-05-2024 18:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://anonym.ninja/download/7jECGFQlnCgLrRA

Score

10^/10

umbral discovery execution persistence spyware stealer

Malware Config

Signatures

Detect Umbral payload 2 IoCs

resource	yara_rule
behavioral1/files/0x000100000002aa9a-642.dat	family_umbral
behavioral1/memory/4124-650-0x0000024B9FEF0000-0x0000024B9FF30000-memory.dmp	family_umbral

Umbral
Umbral stealer is an opensource moduler stealer written in C#.
stealer umbral

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2228	powershell.exe
3820	powershell.exe

Executes dropped EXE 8 IoCs

pid	Process
4580	7z2404-x64.exe
1644	7zG.exe
1644	crackeddx.exe
2696	Loader.exe
4124	loaderrr.exe
4876	crackeddx.exe
4400	Loader.exe
4968	loaderrr.exe

Loads dropped DLL 1 IoCs

pid	Process
1644	7zG.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Registers COM server for autorun 1 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32	7z2404-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip\\7-zip.dll"	7z2404-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment"	7z2404-x64.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
11	discord.com
59	discord.com
65	discord.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
21	ip-api.com

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
1644	crackeddx.exe
4876	crackeddx.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\Lang\af.txt	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mng.txt	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\History.txt	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ga.txt	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ko.txt	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ca.txt	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kk.txt	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uz-cyrl.txt	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\va.txt	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\7zCon.sfx	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\en.ttt	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uz.txt	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\gl.txt	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\de.txt	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ne.txt	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\co.txt	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\eu.txt	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hy.txt	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nn.txt	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sr-spc.txt	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tr.txt	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\7-zip.chm	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pt.txt	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sw.txt	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\readme.txt	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uk.txt	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ba.txt	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\he.txt	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nl.txt	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\zh-cn.txt	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\7-zip.dll.tmp	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\descript.ion	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\el.txt	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hi.txt	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hu.txt	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ps.txt	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\th.txt	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ast.txt	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fr.txt	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mk.txt	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nb.txt	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tt.txt	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\cy.txt	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fi.txt	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fur.txt	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\an.txt	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\bn.txt	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mn.txt	7z2404-x64.exe
File created	C:\Program Files\7-Zip\7-zip.dll.tmp	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\bg.txt	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fy.txt	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\it.txt	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mr.txt	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sk.txt	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ta.txt	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ja.txt	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kab.txt	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lt.txt	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ar.txt	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ka.txt	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ku-ckb.txt	7z2404-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lij.txt	7z2404-x64.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Medusav0.2.dll	Loader.exe
File opened for modification	C:\Windows\Medusav0.2.dll	Loader.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Detects videocard installed 1 TTPs 2 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
3456	wmic.exe
4924	wmic.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 22 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip\\7-zip.dll"	7z2404-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment"	7z2404-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2404-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\7-Zip	7z2404-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\ = "7-Zip Shell Extension"	7z2404-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip\\7-zip32.dll"	7z2404-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment"	7z2404-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}	7z2404-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\7-Zip	7z2404-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2404-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\7-Zip	7z2404-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\ShellEx\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2404-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}	7z2404-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2404-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2404-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\7-Zip	7z2404-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\7-Zip	7z2404-x64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1672260578-815027929-964132517-1000\{D8475010-743B-411C-AF4A-C09BBC5B3591}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32	7z2404-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\ = "7-Zip Shell Extension"	7z2404-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32	7z2404-x64.exe
Key created	\REGISTRY\USER\S-1-5-21-1672260578-815027929-964132517-1000_Classes\Local Settings	OpenWith.exe

NTFS ADS 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\14-05-2024_7jECGFQlnCgLrRA.rar:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 781334.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\7z2404-x64.exe:Zone.Identifier	msedge.exe

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
4652	PING.EXE
1816	PING.EXE

Suspicious behavior: EnumeratesProcesses 61 IoCs

pid	Process
748	msedge.exe
748	msedge.exe
4804	msedge.exe
4804	msedge.exe
4136	msedge.exe
4136	msedge.exe
2792	identity_helper.exe
2792	identity_helper.exe
4892	msedge.exe
4892	msedge.exe
2172	msedge.exe
2172	msedge.exe
2544	msedge.exe
2544	msedge.exe
4124	loaderrr.exe
4124	loaderrr.exe
2228	powershell.exe
2228	powershell.exe
2228	powershell.exe
4816	powershell.exe
4816	powershell.exe
4816	powershell.exe
1428	powershell.exe
1428	powershell.exe
1428	powershell.exe
2260	powershell.exe
2260	powershell.exe
2260	powershell.exe
1140	powershell.exe
1140	powershell.exe
1140	powershell.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
4968	loaderrr.exe
4968	loaderrr.exe
3820	powershell.exe
3820	powershell.exe
3820	powershell.exe
2980	powershell.exe
2980	powershell.exe
2980	powershell.exe
432	powershell.exe
432	powershell.exe
432	powershell.exe
640	powershell.exe
640	powershell.exe
640	powershell.exe
5076	powershell.exe
5076	powershell.exe
5076	powershell.exe
4400	Loader.exe
4400	Loader.exe
4400	Loader.exe
4400	Loader.exe
4400	Loader.exe
4400	Loader.exe
4400	Loader.exe
4400	Loader.exe
4400	Loader.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2464	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 20 IoCs

pid	Process
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeRestorePrivilege	1644	7zG.exe
Token: 35	1644	7zG.exe
Token: SeSecurityPrivilege	1644	7zG.exe
Token: SeSecurityPrivilege	1644	7zG.exe
Token: SeBackupPrivilege	3796	svchost.exe
Token: SeRestorePrivilege	3796	svchost.exe
Token: SeSecurityPrivilege	3796	svchost.exe
Token: SeTakeOwnershipPrivilege	3796	svchost.exe
Token: 35	3796	svchost.exe
Token: SeDebugPrivilege	4124	loaderrr.exe
Token: SeIncreaseQuotaPrivilege	4152	wmic.exe
Token: SeSecurityPrivilege	4152	wmic.exe
Token: SeTakeOwnershipPrivilege	4152	wmic.exe
Token: SeLoadDriverPrivilege	4152	wmic.exe
Token: SeSystemProfilePrivilege	4152	wmic.exe
Token: SeSystemtimePrivilege	4152	wmic.exe
Token: SeProfSingleProcessPrivilege	4152	wmic.exe
Token: SeIncBasePriorityPrivilege	4152	wmic.exe
Token: SeCreatePagefilePrivilege	4152	wmic.exe
Token: SeBackupPrivilege	4152	wmic.exe
Token: SeRestorePrivilege	4152	wmic.exe
Token: SeShutdownPrivilege	4152	wmic.exe
Token: SeDebugPrivilege	4152	wmic.exe
Token: SeSystemEnvironmentPrivilege	4152	wmic.exe
Token: SeRemoteShutdownPrivilege	4152	wmic.exe
Token: SeUndockPrivilege	4152	wmic.exe
Token: SeManageVolumePrivilege	4152	wmic.exe
Token: 33	4152	wmic.exe
Token: 34	4152	wmic.exe
Token: 35	4152	wmic.exe
Token: 36	4152	wmic.exe
Token: SeIncreaseQuotaPrivilege	4152	wmic.exe
Token: SeSecurityPrivilege	4152	wmic.exe
Token: SeTakeOwnershipPrivilege	4152	wmic.exe
Token: SeLoadDriverPrivilege	4152	wmic.exe
Token: SeSystemProfilePrivilege	4152	wmic.exe
Token: SeSystemtimePrivilege	4152	wmic.exe
Token: SeProfSingleProcessPrivilege	4152	wmic.exe
Token: SeIncBasePriorityPrivilege	4152	wmic.exe
Token: SeCreatePagefilePrivilege	4152	wmic.exe
Token: SeBackupPrivilege	4152	wmic.exe
Token: SeRestorePrivilege	4152	wmic.exe
Token: SeShutdownPrivilege	4152	wmic.exe
Token: SeDebugPrivilege	4152	wmic.exe
Token: SeSystemEnvironmentPrivilege	4152	wmic.exe
Token: SeRemoteShutdownPrivilege	4152	wmic.exe
Token: SeUndockPrivilege	4152	wmic.exe
Token: SeManageVolumePrivilege	4152	wmic.exe
Token: 33	4152	wmic.exe
Token: 34	4152	wmic.exe
Token: 35	4152	wmic.exe
Token: 36	4152	wmic.exe
Token: SeDebugPrivilege	2228	powershell.exe
Token: SeDebugPrivilege	2696	Loader.exe
Token: SeDebugPrivilege	4816	powershell.exe
Token: SeDebugPrivilege	1428	powershell.exe
Token: SeDebugPrivilege	2260	powershell.exe
Token: SeIncreaseQuotaPrivilege	2188	wmic.exe
Token: SeSecurityPrivilege	2188	wmic.exe
Token: SeTakeOwnershipPrivilege	2188	wmic.exe
Token: SeLoadDriverPrivilege	2188	wmic.exe
Token: SeSystemProfilePrivilege	2188	wmic.exe
Token: SeSystemtimePrivilege	2188	wmic.exe
Token: SeProfSingleProcessPrivilege	2188	wmic.exe

Suspicious use of FindShellTrayWindow 47 IoCs

pid	Process
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
1644	7zG.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2464	OpenWith.exe
2464	OpenWith.exe
2464	OpenWith.exe
4580	7z2404-x64.exe
1644	crackeddx.exe
4876	crackeddx.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4804 wrote to memory of 2336	4804	msedge.exe	79
PID 4804 wrote to memory of 2336	4804	msedge.exe	79
PID 4804 wrote to memory of 2700	4804	msedge.exe	80
PID 4804 wrote to memory of 2700	4804	msedge.exe	80
PID 4804 wrote to memory of 2700	4804	msedge.exe	80
PID 4804 wrote to memory of 2700	4804	msedge.exe	80
PID 4804 wrote to memory of 2700	4804	msedge.exe	80
PID 4804 wrote to memory of 2700	4804	msedge.exe	80
PID 4804 wrote to memory of 2700	4804	msedge.exe	80
PID 4804 wrote to memory of 2700	4804	msedge.exe	80
PID 4804 wrote to memory of 2700	4804	msedge.exe	80
PID 4804 wrote to memory of 2700	4804	msedge.exe	80
PID 4804 wrote to memory of 2700	4804	msedge.exe	80
PID 4804 wrote to memory of 2700	4804	msedge.exe	80
PID 4804 wrote to memory of 2700	4804	msedge.exe	80
PID 4804 wrote to memory of 2700	4804	msedge.exe	80
PID 4804 wrote to memory of 2700	4804	msedge.exe	80
PID 4804 wrote to memory of 2700	4804	msedge.exe	80
PID 4804 wrote to memory of 2700	4804	msedge.exe	80
PID 4804 wrote to memory of 2700	4804	msedge.exe	80
PID 4804 wrote to memory of 2700	4804	msedge.exe	80
PID 4804 wrote to memory of 2700	4804	msedge.exe	80
PID 4804 wrote to memory of 2700	4804	msedge.exe	80
PID 4804 wrote to memory of 2700	4804	msedge.exe	80
PID 4804 wrote to memory of 2700	4804	msedge.exe	80
PID 4804 wrote to memory of 2700	4804	msedge.exe	80
PID 4804 wrote to memory of 2700	4804	msedge.exe	80
PID 4804 wrote to memory of 2700	4804	msedge.exe	80
PID 4804 wrote to memory of 2700	4804	msedge.exe	80
PID 4804 wrote to memory of 2700	4804	msedge.exe	80
PID 4804 wrote to memory of 2700	4804	msedge.exe	80
PID 4804 wrote to memory of 2700	4804	msedge.exe	80
PID 4804 wrote to memory of 2700	4804	msedge.exe	80
PID 4804 wrote to memory of 2700	4804	msedge.exe	80
PID 4804 wrote to memory of 2700	4804	msedge.exe	80
PID 4804 wrote to memory of 2700	4804	msedge.exe	80
PID 4804 wrote to memory of 2700	4804	msedge.exe	80
PID 4804 wrote to memory of 2700	4804	msedge.exe	80
PID 4804 wrote to memory of 2700	4804	msedge.exe	80
PID 4804 wrote to memory of 2700	4804	msedge.exe	80
PID 4804 wrote to memory of 2700	4804	msedge.exe	80
PID 4804 wrote to memory of 2700	4804	msedge.exe	80
PID 4804 wrote to memory of 748	4804	msedge.exe	81
PID 4804 wrote to memory of 748	4804	msedge.exe	81
PID 4804 wrote to memory of 712	4804	msedge.exe	82
PID 4804 wrote to memory of 712	4804	msedge.exe	82
PID 4804 wrote to memory of 712	4804	msedge.exe	82
PID 4804 wrote to memory of 712	4804	msedge.exe	82
PID 4804 wrote to memory of 712	4804	msedge.exe	82
PID 4804 wrote to memory of 712	4804	msedge.exe	82
PID 4804 wrote to memory of 712	4804	msedge.exe	82
PID 4804 wrote to memory of 712	4804	msedge.exe	82
PID 4804 wrote to memory of 712	4804	msedge.exe	82
PID 4804 wrote to memory of 712	4804	msedge.exe	82
PID 4804 wrote to memory of 712	4804	msedge.exe	82
PID 4804 wrote to memory of 712	4804	msedge.exe	82
PID 4804 wrote to memory of 712	4804	msedge.exe	82
PID 4804 wrote to memory of 712	4804	msedge.exe	82
PID 4804 wrote to memory of 712	4804	msedge.exe	82
PID 4804 wrote to memory of 712	4804	msedge.exe	82
PID 4804 wrote to memory of 712	4804	msedge.exe	82
PID 4804 wrote to memory of 712	4804	msedge.exe	82
PID 4804 wrote to memory of 712	4804	msedge.exe	82
PID 4804 wrote to memory of 712	4804	msedge.exe	82

Views/modifies file attributes 1 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
1140	attrib.exe
1976	attrib.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://anonym.ninja/download/7jECGFQlnCgLrRA
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffcbd513cb8,0x7ffcbd513cc8,0x7ffcbd513cd8
  2⤵
  PID:2336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1848,955609509330209707,9790122027115895014,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1936 /prefetch:2
  2⤵
  PID:2700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1848,955609509330209707,9790122027115895014,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2324 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1848,955609509330209707,9790122027115895014,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2520 /prefetch:8
  2⤵
  PID:712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,955609509330209707,9790122027115895014,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,955609509330209707,9790122027115895014,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:3156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1848,955609509330209707,9790122027115895014,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5076 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,955609509330209707,9790122027115895014,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4724 /prefetch:1
  2⤵
  PID:4540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,955609509330209707,9790122027115895014,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3976 /prefetch:1
  2⤵
  PID:3268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,955609509330209707,9790122027115895014,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5076 /prefetch:1
  2⤵
  PID:4848
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1848,955609509330209707,9790122027115895014,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6080 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,955609509330209707,9790122027115895014,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5752 /prefetch:1
  2⤵
  PID:1344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1848,955609509330209707,9790122027115895014,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4848 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:4892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,955609509330209707,9790122027115895014,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4660 /prefetch:1
  2⤵
  PID:4136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,955609509330209707,9790122027115895014,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5524 /prefetch:1
  2⤵
  PID:2380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,955609509330209707,9790122027115895014,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6404 /prefetch:1
  2⤵
  PID:2256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,955609509330209707,9790122027115895014,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6272 /prefetch:1
  2⤵
  PID:3932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,955609509330209707,9790122027115895014,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6692 /prefetch:1
  2⤵
  PID:1968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,955609509330209707,9790122027115895014,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5488 /prefetch:1
  2⤵
  PID:3528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1848,955609509330209707,9790122027115895014,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6180 /prefetch:8
  2⤵
  PID:2464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1848,955609509330209707,9790122027115895014,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=6192 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:2172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,955609509330209707,9790122027115895014,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6040 /prefetch:1
  2⤵
  PID:4484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,955609509330209707,9790122027115895014,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6704 /prefetch:1
  2⤵
  PID:4792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,955609509330209707,9790122027115895014,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6856 /prefetch:1
  2⤵
  PID:2380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,955609509330209707,9790122027115895014,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4688 /prefetch:1
  2⤵
  PID:3456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,955609509330209707,9790122027115895014,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1400 /prefetch:1
  2⤵
  PID:3756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,955609509330209707,9790122027115895014,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6904 /prefetch:1
  2⤵
  PID:1636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,955609509330209707,9790122027115895014,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7120 /prefetch:1
  2⤵
  PID:4852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,955609509330209707,9790122027115895014,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6964 /prefetch:1
  2⤵
  PID:4868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1848,955609509330209707,9790122027115895014,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=1928 /prefetch:8
  2⤵
  PID:2188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1848,955609509330209707,9790122027115895014,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6440 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:2544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1848,955609509330209707,9790122027115895014,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=7248 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3108

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1908

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3876

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:900

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2464

C:\Users\Admin\Downloads\7z2404-x64.exe
"C:\Users\Admin\Downloads\7z2404-x64.exe"
1⤵
- Executes dropped EXE
- Registers COM server for autorun
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4580

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\14-05-2024_7jECGFQlnCgLrRA\" -spe -an -ai#7zMap23551:114:7zEvent25571
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1644

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k SDRSVC
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3796

C:\Users\Admin\Downloads\14-05-2024_7jECGFQlnCgLrRA\crackeddx.exe
"C:\Users\Admin\Downloads\14-05-2024_7jECGFQlnCgLrRA\crackeddx.exe"
1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
PID:1644
- C:\Users\Admin\AppData\Local\Temp\Loader.exe
  "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2696
- C:\Users\Admin\AppData\Local\Temp\loaderrr.exe
  "C:\Users\Admin\AppData\Local\Temp\loaderrr.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4124
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" csproduct get uuid
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4152
- - C:\Windows\SYSTEM32\attrib.exe
    "attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\loaderrr.exe"
    3⤵
    - Views/modifies file attributes
    PID:1140
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\loaderrr.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2228
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4816
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1428
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2260
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" os get Caption
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2188
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" computersystem get totalphysicalmemory
    3⤵
    PID:1816
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" csproduct get uuid
    3⤵
    PID:2076
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1140
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" path win32_VideoController get name
    3⤵
    - Detects videocard installed
    PID:3456
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\loaderrr.exe" && pause
    3⤵
    PID:4152
  - - C:\Windows\system32\PING.EXE
      ping localhost
      4⤵
      Runs ping.exe
      PID:4652

C:\Users\Admin\Downloads\14-05-2024_7jECGFQlnCgLrRA\crackeddx.exe
"C:\Users\Admin\Downloads\14-05-2024_7jECGFQlnCgLrRA\crackeddx.exe"
1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
PID:4876
- C:\Users\Admin\AppData\Local\Temp\Loader.exe
  "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  PID:4400
- C:\Users\Admin\AppData\Local\Temp\loaderrr.exe
  "C:\Users\Admin\AppData\Local\Temp\loaderrr.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:4968
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" csproduct get uuid
    3⤵
    PID:1568
- - C:\Windows\SYSTEM32\attrib.exe
    "attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\loaderrr.exe"
    3⤵
    - Views/modifies file attributes
    PID:1976
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\loaderrr.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:3820
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2980
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:432
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:640
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" os get Caption
    3⤵
    PID:1756
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" computersystem get totalphysicalmemory
    3⤵
    PID:1428
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" csproduct get uuid
    3⤵
    PID:4532
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5076
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" path win32_VideoController get name
    3⤵
    - Detects videocard installed
    PID:4924
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\loaderrr.exe" && pause
    3⤵
    PID:3308
  - - C:\Windows\system32\PING.EXE
      ping localhost
      4⤵
      Runs ping.exe
      PID:1816

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\7-Zip\7z.dll

Filesize
1.8MB

MD5
29f6d49053de1408586f48681864ca5f

SHA1
1071e887849cb92776f4a6d4cb6d0dd1ec264b65

SHA256
84d2bcf774aba77e938d3f36bfe020e0d49cfb3074ad9de69b5af78054602b7e

SHA512
dcdb5252e660b0d186c8db508db3fdaab22d33bc20dcaca2b41d5d5e64d5780b25f2242389227ddefff96978f373f89942389673c737b3102778982b91ca6f32

Download Submit
C:\Program Files\7-Zip\7zG.exe

Filesize
691KB

MD5
4a8614832d2512e1b1cf73051f083185

SHA1
da8b5fbc538cfc186dde7292dc17f4580b789c4a

SHA256
2f4f3768ca8f50f9a8882a7ac99aa95513f26fda7a41ce8c7971735d9b7ce920

SHA512
4846340d1726f14b9a932e032d914e15d7122dc5b24c12f63ac4b9b04ada46fe7a83551870509720be39e67abc6e7d27499fb853b4df5871253b26901c2d6e55

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\loaderrr.exe.log

Filesize
1KB

MD5
5f36c205799cb2f8966c7d5130cea05c

SHA1
614993e3437ff9363c3eb698d7dba379a453dd6e

SHA256
8eaaf40fe7570c8fa593702f38fee2f54538ba6a77d7c54005e8d1f150f5180c

SHA512
7053cac09d2e71675771bae4ac25f1a47f96be662f6bb2aab24668ed4c1809fb1261b2d6465202c09bd0310bf875361a815db6dda6006dcfbbb5fb3c50c5927b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
627073ee3ca9676911bee35548eff2b8

SHA1
4c4b68c65e2cab9864b51167d710aa29ebdcff2e

SHA256
85b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c

SHA512
3c5f6c03e253b83c57e8d6f0334187dbdcdf4fa549eecd36cbc1322dca6d3ca891dc6a019c49ec2eafb88f82d0434299c31e4dfaab123acb42e0546218f311fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Loader.exe.log

Filesize
1KB

MD5
ac45cc773216001c355992d869450b47

SHA1
1f19c3839b521e1bf1ec7928f32f45234f38ea40

SHA256
c9c03abe98c496376975747c9b617f5f6e1b50aec09aa8be31aa24e81254901f

SHA512
3d73620a59089bc05d60ae07f0811ddacd1661599eca096cd9927813f86dc9cebac1de221691373601c743250694de43e408a9e607e813fb28260b1509f84574

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d56e8f308a28ac4183257a7950ab5c89

SHA1
044969c58cef041a073c2d132fa66ccc1ee553fe

SHA256
0bc24451c65457abc1e4e340be2f8faceae6b6ec7768a21d44bcd14636543bae

SHA512
fd5798559f4025ec3408f5550b8671d394b1ec83b85fdac8c005b0cc3e183272bdd07db15a156a572c9c5e5798badf235dc10aae62a052efa8dd9dfdbdca8189

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8f2eb94e31cadfb6eb07e6bbe61ef7ae

SHA1
3f42b0d5a90408689e7f7941f8db72a67d5a2eab

SHA256
d222c8e3b19cda2657629a486faf32962e016fc66561ce0d17010afdb283c9de

SHA512
9f7f84149885b851e0bf7173c540e466a2b2eb9907d8b608f60360933328cc75d9d1b63640ea4ecc1e64ecc5dd7ee74d82903f96a8b4418ca56296641a8c0703

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
432B

MD5
fa24c90a3cad97d4a99764276cff5c8e

SHA1
b9fd411b56f0d6919feecc74f7042c4cd318ad83

SHA256
dbdf46fc337687ecf21ee291903925db6440c288419199adfe906ab7a314a601

SHA512
73758db4b5d24455607ead11f4be0a4cbccac196ef6753f4c8984c102972daa777391bedfcafc0122d63fcc5e6ae6fa071abbbd465a61be66813e148c85c2e70

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
f577422e12433905e1d4d77852e3959a

SHA1
41dd522053ad61e00f391b48c1cda2dd2a24894a

SHA256
e055410d7eb9ae3e059aa0262deb0ca016a2299530ceb57f8924e72046e7c21d

SHA512
b5a47e2b41c9a619fb8face5b4bd16ddff8c76ba93ceae5b064654ac410e89847e0cf33c0867b6b1f5a5ec827dca13bc52aedb07095bde4cdc599573f7860e38

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies

Filesize
28KB

MD5
0539a51ada2b185f7341a06e52d3410f

SHA1
207a44f93fdd90ab367235183b79c40762d1e971

SHA256
992585e588c54ec0d0bd7b85e1f56ba0965f6cfbc3cf6bf6d7b1ff40a507791c

SHA512
7313bb7f1e9c08220559bd630a81e63a4658abc9376538b28bf4775447594495daae3afff582e0012e57eaa7a385be2dc0badd7a9b201fbe30ae642c7780e210

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log

Filesize
2KB

MD5
a67c93771771fd6675accbcc20e8b4c5

SHA1
f4c5a4ad2560c2417e64b441429b2cadc9e08be3

SHA256
eee792e6754663d23063f229087024ab5d12cfdedc5750e54d5fb8e3ec250218

SHA512
5dbb181444136cce3220877ca1a5f6483525e459b2af5826975ae58766da8971824002e6127d46b2260cde8386db3951f401d0157e51047827f3608b704ee063

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
6366f679d30e81461299583455dc3403

SHA1
247db8fdc1effd7e97cdd50f34f28e83a4edccaa

SHA256
a4dc701beb8a6f2f5155821e960d747a13b73681a8a946eaf21c35c3f6fedb86

SHA512
17038f67089f80a883c4f87c36365b9a2e9691befcd529f8f22750ee28b670cbedb054327855233dc61c203080a0e6f5377df6b2a3ceec260667931e3a0624fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
edecf0da2b661a7fc741877cf3a8610c

SHA1
4c74a53e8743e8ce3ba4608924068d4778a462ac

SHA256
927877156a820ce5d5ec8e4dadd2ba1c206e57c109a72633c7583546d081e034

SHA512
62e5c9f4cb1e812821abb75be2fea2ca6c68154436d44797b27f881d8a5b26c50cffa5978b8cf728aebb7d0f9fa6a69fc52b46c62062cf6d3e3c873067094624

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
fd563457ec2298ded1059afe03127196

SHA1
179969965d59b4dd03e1d81f536c973509531eea

SHA256
ad3022146af9909cc83641abcf2a9a424df160f25844f9d059c9d4f40c62879a

SHA512
a3b4828475b999173a24bc6055ccdd54802488fe6d560cc48bc8654dea868198bfefca7405818d1681f41069cf0e1b9b9141af41320b9e08e1375575994c8cce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
5a449da1a8ff6382f4220df648568039

SHA1
46d0fa2e2080a5fc72237e0d177c563c2b48b499

SHA256
0dc65d1f87d1e989f03ff68d7ff988f64d5fb83ca845c9b9cc3c1a846f9758aa

SHA512
267deb305230d40ba5de9aced02a0b73d42dc7510848560cefbbf2ae7a5fe214ebf2c18b5d16b1b6bcab0058b3c6af0860777f2c5c9fe6f99372761bc79e0268

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
873B

MD5
4b520b2016a613eb2866f8989f2c4aa0

SHA1
1e271e9ae6e95b23155b59aa4f5a594ec9e7bcce

SHA256
64634e955b3eddf85b44d18a372384baba8f773ff03f5bd1a84db673a08f5a4b

SHA512
43e8dbd3e4ff5fdf00e3df3db9e0d37a05a903f1e458f8f7e6914030a9d92c5a454b163ebc3869a6fb2dde864b455840f6f80c847935c844f9ad1956a9349468

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe581519.TMP

Filesize
371B

MD5
2a233456477f9d64dd902d0f9ab7aa84

SHA1
acd8fe9d87000d3e22137c4b28256c9eba07d6eb

SHA256
dc4c360a3fb70bdefc4f3054407aaf3276dde5e48eddfabddb61f194403d7836

SHA512
3045e41a258cbd48f581b909250ce1c955aed750290a4b1acd7409cbde22d586e456b42957dfe330d4dca1e26146cd9cc6ecd644338b386e05467681c50fd6df

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
f0e4991404521c64b82a685cdbd4fa5e

SHA1
06982e35001a967de3300c83a8cf538d99d17a0b

SHA256
de40a79b6c907dddafb8a225b35e7684112c92862a2bd438969f3d77b1eaa2cd

SHA512
e1f40708be2f00fad1b12e946591ca8e02472be5e71b65ceff982a95e150298db9c91c67543ded0eb0de557652ac57ab356ba13d9a7e547b89cac40c62757507

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
cc8664ef118a7012051843059b679b21

SHA1
1d610771f53e17357fea721a2c8a2ae1e8d54846

SHA256
67cee6ae330e66412294505510d68195819f9c0d6c1a9b74d022ab3ef2130dbe

SHA512
8e888e92cc1dd8d3d92b068c731d9b5200e0c781d36cbfb378eb3133f1448dd8d7b588fc94101bed6dcc2944b460bf3efd2ac3fb8e2f74b74068506bbec90ec9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
76a781b3425a2b0cfb6cbc0df0c30db9

SHA1
187af40a48519d34b0342fd3a0e056e8eac49b2c

SHA256
5ac50a7ae7f8ca369ffcbee1bf6dd9816fc1fff0f5b86c5ce0e21946db7477eb

SHA512
9c0e5a89c3ac516338ecc8df6b581726eddf0c8b89969d4a7b0d36565bb6edfbea3246499a733aacb907dbd86d905eac42dee7651f6575c7c81b97deff23fc46

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
356d21a7624a36200ab78be37797420b

SHA1
26171504295ff5292dd5cddfbd40f58183514fb6

SHA256
ecd4ae8361ca4d5637297a7f3448f6460bfd5f6809e005c82ab308cad29c24a6

SHA512
693040af686040b49ab82bde829329bb659dd94a72960bca790a4e664e35042bf5b63699ec35c7884ffe4e67840f40d6490220ef83a8c6164f3bd706c3722a6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
41cedec0ba32ec5a4e87063a866a1298

SHA1
98cb9c102721a93356fa321a01bb5e3698977ef3

SHA256
3a6792fc75ea8e30ed7c50b5e2d317af7d0652955481944a36613ef67203e5c4

SHA512
5c548a1e5de96ca05570675e14ff3111db7cc7c5f79d5d58de6e1d1ca4d59e07fb7ca48762853b0ea606403185eac30bddb319e07647d0e25dba098691ca2a5d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
1a9fa92a4f2e2ec9e244d43a6a4f8fb9

SHA1
9910190edfaccece1dfcc1d92e357772f5dae8f7

SHA256
0ee052d5333fd5fd86bc84856fec98e045f077a7ac8051651bf7c521b9706888

SHA512
5d2361476fa22200e6f83883efe7dcb8c3fe7dae8d56e04e28a36e9ae1270c327b6aa161d92b239593da7661289d002c574446ecfd6bd19928209aae25e3ef64

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
948B

MD5
441a842138038e6385e430a90d7ea608

SHA1
7b3712d2cdd37e10ee9b3994131ee5175e920f01

SHA256
47592f3324179912d3bdba336b9e75568c2c5f1a9fb37c1ba9f0db9df822164c

SHA512
9dbddc3216f2a132ae3961b3aeac2c5b8828dcc9292f6c5bf1171c47453aa8687f92658818d771413492c0ea565e9ede17b9c03e427af9dc2ac21a78369a6666

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
0ac871344dc49ae49f13f0f88acb4868

SHA1
5a073862375c7e79255bb0eab32c635b57a77f98

SHA256
688f15b59a784f6f4c62554f00b5d0840d1489cef989c18126c70dfee0806d37

SHA512
ace5c50303bd27998607cf34ac4322bcf5edfbd19bbb24309acf4d037b6f3f7636c7c14b6ac0b924114e036252d3a1b998951c7068f41548728fa5d92f5f9006

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
cb2537b95d76b36f1110219bde127d2a

SHA1
b32ab5ea919207d25749d8af8b21e954615ddbc8

SHA256
b270e73c312010b0e028879f63897e95e4a1f0d87d4964a18d587160c7c4797c

SHA512
113b0ea81a3af8902a4c441f29a90b43146089688deda301b5e08c2366a297c464c527ffb5fb707a4270bcad8c72331b512a87301365d759036ea2222be8806b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
64B

MD5
a67eee085e8f68aaffbfdb51503d6561

SHA1
29db9b41945c6a5d27d5836a1c780668eded65a0

SHA256
6e155bcc98f4e175a8701f030b73b14d9002b175ef58a19cb9010af3964e36b4

SHA512
7923bc74260e77d62b20cf510b79e0422563469ec3543084a989db154b1e39370f1a6e6c6e73caa7471d0974a693b1beb4fd2ddfb14b0b5c58650b5df3c32d81

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
fcbfea2bed3d0d2533fe957f0f83e35c

SHA1
70ca46e89e31d8918c482848cd566090aaffd910

SHA256
e97f54e5237ffeca4c9a6454f73690b98ac33e03c201f9f7e465394ecbc3ea38

SHA512
d382453207d961f63624ba4c5a0dea874e6b942f5cad731c262a44371fb25b309eacf608156e0234169e52337796128312e72edb0290c48f56104fe5e52509a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
948B

MD5
6bddc96a32b9ed8fc70b141ccf4a39b2

SHA1
0f33c0699da40a5eadcec646791cf21cdb0dd7c6

SHA256
cb3853abe77eb0da8a1caccb49e97a573b6f35570722eb759116a645d724c132

SHA512
e41f1597b4129b759e4199db195df1c24e47cc47dc9850fab2d48e44bc3d37dc3658fbfbb62332a0b93c552587d7fab09de1634f605faa2209b8470c2a6eaca6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
7332074ae2b01262736b6fbd9e100dac

SHA1
22f992165065107cc9417fa4117240d84414a13c

SHA256
baea84fda6c1f13090b8cbd91c920848946f10ce155ef31a1df4cd453ee7e4aa

SHA512
4ae6f0e012c31ac1fc2ff4a8877ce2b4667c45b6e651de798318a39a2b6fd39a6f72dffa8b0b89b7a045a27d724d195656faa25a9fec79b22f37ddebb5d22da2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
9eb38b4ebb12f388a5b9cb5dae48b43f

SHA1
d49464bb5be6e639e8708b8d82a18d17e45b4be5

SHA256
712a406336afd737b058a4fe0ebe7c44d712b531e403e5de47e449fded1b43ab

SHA512
4d7cad60eff1de76ba3a03b7b32703a627e2363f712315c1a744ac1cb6a21718394773f2126909bcc4401e3063380de0d292c95cb1a2fd98619143e522b4d630

Download Submit
C:\Users\Admin\AppData\Local\Temp\Loader.exe

Filesize
737KB

MD5
8c5a4c6651a67ae18e44da8232e148cc

SHA1
9f05929553d6bc972b850056a4f2f91733aa27ec

SHA256
97681ef9ab9818681963a03af8cc696b6f6991fc3e42257b2bdbc668c0fbf838

SHA512
857aab1f3deecc32f94909ac20c603261aaf1e8b68e61215968183db9f73636840c28d032964a89c9b206ed2b15e1413f3ad667cf70442674240abd7172d1cc8

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_rj0wwfef.tfl.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\loaderrr.exe

Filesize
229KB

MD5
36099a5e89a780af9ec25e8aecff6160

SHA1
33bffabba1e6d45ddbcd69fa7a893ecb8a4adda9

SHA256
a5c91f4a469e6d4fad9af3606336862eda756e15679f333fff86770d9c7c8d76

SHA512
f169afa1997d54cbb07f0f566a5defe446aa1b9f8cbb3ba279cdc15a1b21547347165a6fe1f7697cb251e8fcc771cacd0d72f1cc18a1bf3c42e61f3f78c0e55a

Download Submit
C:\Users\Admin\Downloads\14-05-2024_7jECGFQlnCgLrRA.rar

Filesize
1.5MB

MD5
0385d6662da08fcc01a43a53ded99668

SHA1
9253debbb6e587c33c6495303e43a9db9f520ee2

SHA256
51640c88851cb45bfcc1fd454f4439aa6ab6cff98826443e7a00306963d677e7

SHA512
4fa45a53b5b12ab72546c35cf52e88af8977e20d29b93b35050f7b3181553b65d09ae2f70a98492281c9d1b6ec85e355e3eb4829aa68e0836d11ae7e8882d68a

Download Submit
C:\Users\Admin\Downloads\14-05-2024_7jECGFQlnCgLrRA.rar:Zone.Identifier

Filesize
153B

MD5
b32a5ec48d25f7778ec4e25af06fc24b

SHA1
494fcc6a083cba0cf922828c3965244f1d8432df

SHA256
77cf4432ffe319bfe50b7393cec1c4a2bb97d49428a273aef6a50051e0c24364

SHA512
b51c9c041457f5120b6174c8654a1834171d5839cf8f4748c263772eb1396cdc7455f7270f548087792d75269acb87112b8a003f809de263acf1050058eed3ff

Download Submit
C:\Users\Admin\Downloads\14-05-2024_7jECGFQlnCgLrRA\crackeddx.exe

Filesize
1.5MB

MD5
d50ade43e69f1435a25e7812353b7a53

SHA1
d985b378d32863679b91c533d3cf43aeb1d7f0ee

SHA256
540a3eb46b4aff91936e2768a3e765c1a755772eacfc7b9d057330e7a845367f

SHA512
53b3288c1cb009e2f153ff0651ad2e4bb1aef00ed886bcc1c2919f159c2d7c8d67ee8f8aa9082bb250f476e5db400caa7c69ef2d05b17f8414ae63753efd6e28

Download Submit
C:\Users\Admin\Downloads\7z2404-x64.exe:Zone.Identifier

Filesize
123B

MD5
cf4f1f235224c3922d378d2a7f8f0568

SHA1
c9f308f24970f3140b4577e6b70501264c50f1a2

SHA256
4da5e2d0deddede874fbd9ab2814ce0cedc30289400376a2fe6c8fa74cae92b1

SHA512
6d6a661f8efd2ac37e87a29e40b37faa78ffedaeaf1133939c8c1a3a2ba6f717fad5dd1e768eea6e1d73c1db3bdda743e7e59f1f940d194471f6f31b4deb4de2

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 781334.crdownload

Filesize
1.5MB

MD5
61ba723e67d41dd15e134b973f2d7262

SHA1
3282a5b7c20c7123ae6168f0c565d19930ffb6f6

SHA256
4931869d95ffa6f55788e3b5d92088f3fe590e13532b9d8e811a52e2b377bfb6

SHA512
b293d21403e8ac935a0ae8daf27a069b31b3b6c4d078d3966f2411e5df34094f9e0ea50c7fdb118ae7f2e7ca25a3b526f0bc172e769244bd92125858357ce0ff

Download Submit
memory/1644-649-0x0000000000400000-0x0000000000859000-memory.dmp

Filesize
4.3MB

Download
memory/1644-625-0x0000000000400000-0x0000000000859000-memory.dmp

Filesize
4.3MB

Download
memory/2228-663-0x0000022FAA5B0000-0x0000022FAA5D2000-memory.dmp

Filesize
136KB

Download
memory/2696-651-0x00000000005B0000-0x000000000066E000-memory.dmp

Filesize
760KB

Download
memory/2696-652-0x0000000005810000-0x0000000005DB6000-memory.dmp

Filesize
5.6MB

Download
memory/2696-653-0x0000000005140000-0x00000000051D2000-memory.dmp

Filesize
584KB

Download
memory/2696-654-0x0000000005110000-0x000000000511A000-memory.dmp

Filesize
40KB

Download
memory/4124-680-0x0000024BA1D80000-0x0000024BA1DD0000-memory.dmp

Filesize
320KB

Download
memory/4124-719-0x0000024BBA6F0000-0x0000024BBA702000-memory.dmp

Filesize
72KB

Download
memory/4124-650-0x0000024B9FEF0000-0x0000024B9FF30000-memory.dmp

Filesize
256KB

Download
memory/4124-718-0x0000024BA1D30000-0x0000024BA1D3A000-memory.dmp

Filesize
40KB

Download
memory/4124-682-0x0000024BBA720000-0x0000024BBA73E000-memory.dmp

Filesize
120KB

Download
memory/4124-678-0x0000024BBA770000-0x0000024BBA7E6000-memory.dmp

Filesize
472KB

Download
memory/4876-769-0x0000000000400000-0x0000000000859000-memory.dmp

Filesize
4.3MB

Download
memory/4876-742-0x0000000000400000-0x0000000000859000-memory.dmp

Filesize
4.3MB

Download