umbral | hxxps://krampus[.]pages[.]dev/

Analysis

max time kernel
376s
max time network
377s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
17-09-2024 18:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://krampus.pages.dev/

Score

10^/10

umbral credential_access defense_evasion discovery execution persistence privilege_escalation spyware stealer

Malware Config

Extracted

Family

umbral

https://discord.com/api/webhooks/1225264880039235738/46bNxRt60w9YjuGcjqkvDLT2Saa0gXhoe7P2-CbuUHwdxfwONEkNG92CHxRK6S67a3Bd

Signatures

Detect Umbral payload 2 IoCs

resource	yara_rule
behavioral1/files/0x0003000000025c63-998.dat	family_umbral
behavioral1/memory/1224-1000-0x000002454E310000-0x000002454E350000-memory.dmp	family_umbral

Umbral
Umbral stealer is an opensource moduler stealer written in C#.
stealer umbral
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4692	powershell.exe
4628	powershell.exe
2868	powershell.exe
968	powershell.exe

Downloads MZ/PE file

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	b5uEJHZB6Rl.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 5 IoCs

pid	Process
4992	winrar-x64-701.exe
1792	winrar-x64-701.exe
1780	7z2408-x64.exe
3768	7zG.exe
1224	b5uEJHZB6Rl.exe

Loads dropped DLL 2 IoCs

pid	Process
3172	Process not Found
3768	7zG.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
67	discord.com
68	discord.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
59	ip-api.com

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\Lang\hr.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\is.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ka.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ko.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\si.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ms.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ru.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hi.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\id.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lv.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sq.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\readme.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\7-zip.chm	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\da.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hy.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nn.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pt.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\7z.sfx	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fur.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mk.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mng.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sl.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tt.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\License.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\et.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pa-in.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sr-spc.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\descript.ion	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ku-ckb.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mn.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\cs.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ga.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ja.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sk.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\zh-cn.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\zh-tw.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\bn.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fa.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mr.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\be.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\he.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\it.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\an.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pl.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sa.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\History.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\co.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\7-zip32.dll	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ar.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\bg.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lij.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lt.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tg.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nb.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nl.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tk.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ro.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\br.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sv.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\af.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\de.txt	7z2408-x64.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setupact.log	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	UserOOBEBroker.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 2 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\winrar-x64-701.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\7z2408-x64.exe:Zone.Identifier	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7z2408-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FileCoAuth.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
452	cmd.exe
1628	PING.EXE

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
2856	wmic.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies registry class 23 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip\\7-zip.dll"	7z2408-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2408-x64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4272559161-3282441186-401869126-1000\{9D25A3E1-1359-42ED-BFEB-46BFA0B0A406}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4272559161-3282441186-401869126-1000_Classes\Local Settings\MuiCache	MiniSearchHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\ = "7-Zip Shell Extension"	7z2408-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32	7z2408-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip\\7-zip32.dll"	7z2408-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\ = "7-Zip Shell Extension"	7z2408-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment"	7z2408-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2408-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}	7z2408-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\7-Zip	7z2408-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\7-Zip	7z2408-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\7-Zip	7z2408-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\7-Zip	7z2408-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2408-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment"	7z2408-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}	7z2408-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32	7z2408-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\7-Zip	7z2408-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2408-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\ShellEx\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2408-x64.exe
Key created	\REGISTRY\USER\S-1-5-21-4272559161-3282441186-401869126-1000_Classes\Local Settings	OpenWith.exe

NTFS ADS 5 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 756100.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\7z2408-x64.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Krampus.rar:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 160034.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\winrar-x64-701.exe:Zone.Identifier	msedge.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1628	PING.EXE

Suspicious behavior: EnumeratesProcesses 39 IoCs

pid	Process
2068	msedge.exe
2068	msedge.exe
2124	msedge.exe
2124	msedge.exe
788	identity_helper.exe
788	identity_helper.exe
1976	msedge.exe
1976	msedge.exe
1136	msedge.exe
1136	msedge.exe
2832	msedge.exe
2832	msedge.exe
2852	msedge.exe
2852	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
3420	msedge.exe
3420	msedge.exe
1224	b5uEJHZB6Rl.exe
1224	b5uEJHZB6Rl.exe
4692	powershell.exe
4692	powershell.exe
4692	powershell.exe
4628	powershell.exe
4628	powershell.exe
4628	powershell.exe
2868	powershell.exe
2868	powershell.exe
2868	powershell.exe
4912	powershell.exe
4912	powershell.exe
4912	powershell.exe
968	powershell.exe
968	powershell.exe
968	powershell.exe
2424	chrome.exe
2424	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
640	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 24 IoCs

pid	Process
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2424	chrome.exe
2424	chrome.exe
2424	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeRestorePrivilege	3768	7zG.exe
Token: 35	3768	7zG.exe
Token: SeSecurityPrivilege	3768	7zG.exe
Token: SeSecurityPrivilege	3768	7zG.exe
Token: SeDebugPrivilege	1224	b5uEJHZB6Rl.exe
Token: SeIncreaseQuotaPrivilege	5116	wmic.exe
Token: SeSecurityPrivilege	5116	wmic.exe
Token: SeTakeOwnershipPrivilege	5116	wmic.exe
Token: SeLoadDriverPrivilege	5116	wmic.exe
Token: SeSystemProfilePrivilege	5116	wmic.exe
Token: SeSystemtimePrivilege	5116	wmic.exe
Token: SeProfSingleProcessPrivilege	5116	wmic.exe
Token: SeIncBasePriorityPrivilege	5116	wmic.exe
Token: SeCreatePagefilePrivilege	5116	wmic.exe
Token: SeBackupPrivilege	5116	wmic.exe
Token: SeRestorePrivilege	5116	wmic.exe
Token: SeShutdownPrivilege	5116	wmic.exe
Token: SeDebugPrivilege	5116	wmic.exe
Token: SeSystemEnvironmentPrivilege	5116	wmic.exe
Token: SeRemoteShutdownPrivilege	5116	wmic.exe
Token: SeUndockPrivilege	5116	wmic.exe
Token: SeManageVolumePrivilege	5116	wmic.exe
Token: 33	5116	wmic.exe
Token: 34	5116	wmic.exe
Token: 35	5116	wmic.exe
Token: 36	5116	wmic.exe
Token: SeIncreaseQuotaPrivilege	5116	wmic.exe
Token: SeSecurityPrivilege	5116	wmic.exe
Token: SeTakeOwnershipPrivilege	5116	wmic.exe
Token: SeLoadDriverPrivilege	5116	wmic.exe
Token: SeSystemProfilePrivilege	5116	wmic.exe
Token: SeSystemtimePrivilege	5116	wmic.exe
Token: SeProfSingleProcessPrivilege	5116	wmic.exe
Token: SeIncBasePriorityPrivilege	5116	wmic.exe
Token: SeCreatePagefilePrivilege	5116	wmic.exe
Token: SeBackupPrivilege	5116	wmic.exe
Token: SeRestorePrivilege	5116	wmic.exe
Token: SeShutdownPrivilege	5116	wmic.exe
Token: SeDebugPrivilege	5116	wmic.exe
Token: SeSystemEnvironmentPrivilege	5116	wmic.exe
Token: SeRemoteShutdownPrivilege	5116	wmic.exe
Token: SeUndockPrivilege	5116	wmic.exe
Token: SeManageVolumePrivilege	5116	wmic.exe
Token: 33	5116	wmic.exe
Token: 34	5116	wmic.exe
Token: 35	5116	wmic.exe
Token: 36	5116	wmic.exe
Token: SeDebugPrivilege	4692	powershell.exe
Token: SeDebugPrivilege	4628	powershell.exe
Token: SeDebugPrivilege	2868	powershell.exe
Token: SeDebugPrivilege	4912	powershell.exe
Token: SeIncreaseQuotaPrivilege	3820	wmic.exe
Token: SeSecurityPrivilege	3820	wmic.exe
Token: SeTakeOwnershipPrivilege	3820	wmic.exe
Token: SeLoadDriverPrivilege	3820	wmic.exe
Token: SeSystemProfilePrivilege	3820	wmic.exe
Token: SeSystemtimePrivilege	3820	wmic.exe
Token: SeProfSingleProcessPrivilege	3820	wmic.exe
Token: SeIncBasePriorityPrivilege	3820	wmic.exe
Token: SeCreatePagefilePrivilege	3820	wmic.exe
Token: SeBackupPrivilege	3820	wmic.exe
Token: SeRestorePrivilege	3820	wmic.exe
Token: SeShutdownPrivilege	3820	wmic.exe
Token: SeDebugPrivilege	3820	wmic.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
3768	7zG.exe
2424	chrome.exe
2424	chrome.exe
2424	chrome.exe
2424	chrome.exe
2424	chrome.exe
2424	chrome.exe

Suspicious use of SendNotifyMessage 30 IoCs

pid	Process
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2424	chrome.exe
2424	chrome.exe
2424	chrome.exe
2424	chrome.exe
2424	chrome.exe
2424	chrome.exe
2424	chrome.exe
2424	chrome.exe
2424	chrome.exe
2424	chrome.exe
2424	chrome.exe
2424	chrome.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe

Suspicious use of SetWindowsHookEx 16 IoCs

pid	Process
4992	winrar-x64-701.exe
4992	winrar-x64-701.exe
4992	winrar-x64-701.exe
4800	MiniSearchHost.exe
1792	winrar-x64-701.exe
1792	winrar-x64-701.exe
1792	winrar-x64-701.exe
1780	7z2408-x64.exe
640	OpenWith.exe
640	OpenWith.exe
640	OpenWith.exe
640	OpenWith.exe
640	OpenWith.exe
640	OpenWith.exe
640	OpenWith.exe
5456	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2124 wrote to memory of 1932	2124	msedge.exe	80
PID 2124 wrote to memory of 1932	2124	msedge.exe	80
PID 2124 wrote to memory of 4968	2124	msedge.exe	81
PID 2124 wrote to memory of 4968	2124	msedge.exe	81
PID 2124 wrote to memory of 4968	2124	msedge.exe	81
PID 2124 wrote to memory of 4968	2124	msedge.exe	81
PID 2124 wrote to memory of 4968	2124	msedge.exe	81
PID 2124 wrote to memory of 4968	2124	msedge.exe	81
PID 2124 wrote to memory of 4968	2124	msedge.exe	81
PID 2124 wrote to memory of 4968	2124	msedge.exe	81
PID 2124 wrote to memory of 4968	2124	msedge.exe	81
PID 2124 wrote to memory of 4968	2124	msedge.exe	81
PID 2124 wrote to memory of 4968	2124	msedge.exe	81
PID 2124 wrote to memory of 4968	2124	msedge.exe	81
PID 2124 wrote to memory of 4968	2124	msedge.exe	81
PID 2124 wrote to memory of 4968	2124	msedge.exe	81
PID 2124 wrote to memory of 4968	2124	msedge.exe	81
PID 2124 wrote to memory of 4968	2124	msedge.exe	81
PID 2124 wrote to memory of 4968	2124	msedge.exe	81
PID 2124 wrote to memory of 4968	2124	msedge.exe	81
PID 2124 wrote to memory of 4968	2124	msedge.exe	81
PID 2124 wrote to memory of 4968	2124	msedge.exe	81
PID 2124 wrote to memory of 4968	2124	msedge.exe	81
PID 2124 wrote to memory of 4968	2124	msedge.exe	81
PID 2124 wrote to memory of 4968	2124	msedge.exe	81
PID 2124 wrote to memory of 4968	2124	msedge.exe	81
PID 2124 wrote to memory of 4968	2124	msedge.exe	81
PID 2124 wrote to memory of 4968	2124	msedge.exe	81
PID 2124 wrote to memory of 4968	2124	msedge.exe	81
PID 2124 wrote to memory of 4968	2124	msedge.exe	81
PID 2124 wrote to memory of 4968	2124	msedge.exe	81
PID 2124 wrote to memory of 4968	2124	msedge.exe	81
PID 2124 wrote to memory of 4968	2124	msedge.exe	81
PID 2124 wrote to memory of 4968	2124	msedge.exe	81
PID 2124 wrote to memory of 4968	2124	msedge.exe	81
PID 2124 wrote to memory of 4968	2124	msedge.exe	81
PID 2124 wrote to memory of 4968	2124	msedge.exe	81
PID 2124 wrote to memory of 4968	2124	msedge.exe	81
PID 2124 wrote to memory of 4968	2124	msedge.exe	81
PID 2124 wrote to memory of 4968	2124	msedge.exe	81
PID 2124 wrote to memory of 4968	2124	msedge.exe	81
PID 2124 wrote to memory of 4968	2124	msedge.exe	81
PID 2124 wrote to memory of 2068	2124	msedge.exe	82
PID 2124 wrote to memory of 2068	2124	msedge.exe	82
PID 2124 wrote to memory of 4764	2124	msedge.exe	83
PID 2124 wrote to memory of 4764	2124	msedge.exe	83
PID 2124 wrote to memory of 4764	2124	msedge.exe	83
PID 2124 wrote to memory of 4764	2124	msedge.exe	83
PID 2124 wrote to memory of 4764	2124	msedge.exe	83
PID 2124 wrote to memory of 4764	2124	msedge.exe	83
PID 2124 wrote to memory of 4764	2124	msedge.exe	83
PID 2124 wrote to memory of 4764	2124	msedge.exe	83
PID 2124 wrote to memory of 4764	2124	msedge.exe	83
PID 2124 wrote to memory of 4764	2124	msedge.exe	83
PID 2124 wrote to memory of 4764	2124	msedge.exe	83
PID 2124 wrote to memory of 4764	2124	msedge.exe	83
PID 2124 wrote to memory of 4764	2124	msedge.exe	83
PID 2124 wrote to memory of 4764	2124	msedge.exe	83
PID 2124 wrote to memory of 4764	2124	msedge.exe	83
PID 2124 wrote to memory of 4764	2124	msedge.exe	83
PID 2124 wrote to memory of 4764	2124	msedge.exe	83
PID 2124 wrote to memory of 4764	2124	msedge.exe	83
PID 2124 wrote to memory of 4764	2124	msedge.exe	83
PID 2124 wrote to memory of 4764	2124	msedge.exe	83

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
2796	attrib.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://krampus.pages.dev/
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffa985c3cb8,0x7ffa985c3cc8,0x7ffa985c3cd8
  2⤵
  PID:1932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1896,6598288220539608171,10534638229388366347,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1900 /prefetch:2
  2⤵
  PID:4968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1896,6598288220539608171,10534638229388366347,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2404 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1896,6598288220539608171,10534638229388366347,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2652 /prefetch:8
  2⤵
  PID:4764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,6598288220539608171,10534638229388366347,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:4928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,6598288220539608171,10534638229388366347,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:4560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,6598288220539608171,10534638229388366347,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4984 /prefetch:1
  2⤵
  PID:2232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,6598288220539608171,10534638229388366347,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5008 /prefetch:1
  2⤵
  PID:4132
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1896,6598288220539608171,10534638229388366347,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5360 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,6598288220539608171,10534638229388366347,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4600 /prefetch:1
  2⤵
  PID:2192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,6598288220539608171,10534638229388366347,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5376 /prefetch:1
  2⤵
  PID:2060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1896,6598288220539608171,10534638229388366347,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5004 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,6598288220539608171,10534638229388366347,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5892 /prefetch:1
  2⤵
  PID:3736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1896,6598288220539608171,10534638229388366347,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5820 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:1136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,6598288220539608171,10534638229388366347,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5640 /prefetch:1
  2⤵
  PID:4104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,6598288220539608171,10534638229388366347,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5928 /prefetch:1
  2⤵
  PID:3020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1896,6598288220539608171,10534638229388366347,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5492 /prefetch:8
  2⤵
  PID:1080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1896,6598288220539608171,10534638229388366347,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5008 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:2832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,6598288220539608171,10534638229388366347,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4684 /prefetch:1
  2⤵
  PID:2292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,6598288220539608171,10534638229388366347,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6076 /prefetch:1
  2⤵
  PID:4660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,6598288220539608171,10534638229388366347,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5608 /prefetch:1
  2⤵
  PID:2112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,6598288220539608171,10534638229388366347,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6192 /prefetch:1
  2⤵
  PID:3764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1896,6598288220539608171,10534638229388366347,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6740 /prefetch:8
  2⤵
  PID:476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1896,6598288220539608171,10534638229388366347,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6688 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:2852
- C:\Users\Admin\Downloads\winrar-x64-701.exe
  "C:\Users\Admin\Downloads\winrar-x64-701.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,6598288220539608171,10534638229388366347,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6952 /prefetch:1
  2⤵
  PID:3368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,6598288220539608171,10534638229388366347,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6868 /prefetch:1
  2⤵
  PID:1792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,6598288220539608171,10534638229388366347,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6516 /prefetch:1
  2⤵
  PID:2408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,6598288220539608171,10534638229388366347,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6904 /prefetch:1
  2⤵
  PID:3508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1896,6598288220539608171,10534638229388366347,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=6628 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4780
- C:\Users\Admin\Downloads\winrar-x64-701.exe
  "C:\Users\Admin\Downloads\winrar-x64-701.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,6598288220539608171,10534638229388366347,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5412 /prefetch:1
  2⤵
  PID:3400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,6598288220539608171,10534638229388366347,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6968 /prefetch:1
  2⤵
  PID:4404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,6598288220539608171,10534638229388366347,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6512 /prefetch:1
  2⤵
  PID:1088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1896,6598288220539608171,10534638229388366347,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7216 /prefetch:8
  2⤵
  PID:468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,6598288220539608171,10534638229388366347,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7160 /prefetch:1
  2⤵
  PID:3392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1896,6598288220539608171,10534638229388366347,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7352 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:3420
- C:\Users\Admin\Downloads\7z2408-x64.exe
  "C:\Users\Admin\Downloads\7z2408-x64.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:1780

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1388

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2292

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\1d57999273a245708ceddfc765dc2ac0 /t 3864 /p 4992
1⤵
PID:1976

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4800

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\558b6360fafa42b98ab19dc2ee0420e0 /t 1432 /p 1792
1⤵
PID:952

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1156

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:640

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Krampus\" -spe -an -ai#7zMap15267:76:7zEvent31393
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3768

C:\Users\Admin\Downloads\Krampus\b5uEJHZB6Rl.exe
"C:\Users\Admin\Downloads\Krampus\b5uEJHZB6Rl.exe"
1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1224
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" csproduct get uuid
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5116
- C:\Windows\SYSTEM32\attrib.exe
  "attrib.exe" +h +s "C:\Users\Admin\Downloads\Krampus\b5uEJHZB6Rl.exe"
  2⤵
  - Views/modifies file attributes
  PID:2796
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\Downloads\Krampus\b5uEJHZB6Rl.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4692
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4628
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2868
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4912
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" os get Caption
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3820
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" computersystem get totalphysicalmemory
  2⤵
  PID:5084
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" csproduct get uuid
  2⤵
  PID:4716
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:968
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" path win32_VideoController get name
  2⤵
  - Detects videocard installed
  PID:2856
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\Downloads\Krampus\b5uEJHZB6Rl.exe" && pause
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:452
- - C:\Windows\system32\PING.EXE
    ping localhost
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:1628

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\Krampus\krampusexec-65cafadfc556c.txt
1⤵
PID:1036

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2424
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa97aecc40,0x7ffa97aecc4c,0x7ffa97aecc58
  2⤵
  PID:2024
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1736,i,15364910539256404630,3623559179933541459,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=1564 /prefetch:2
  2⤵
  PID:1676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2092,i,15364910539256404630,3623559179933541459,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=2112 /prefetch:3
  2⤵
  PID:2944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2184,i,15364910539256404630,3623559179933541459,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=2200 /prefetch:8
  2⤵
  PID:1452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3084,i,15364910539256404630,3623559179933541459,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=3160 /prefetch:1
  2⤵
  PID:3184
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3092,i,15364910539256404630,3623559179933541459,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:2972
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4404,i,15364910539256404630,3623559179933541459,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:5228

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:2580

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:5940

C:\Windows\System32\oobe\UserOOBEBroker.exe
C:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding
1⤵
- Drops file in Windows directory
PID:5136

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
1⤵
- System Location Discovery: System Language Discovery
PID:2072

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:5456

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\7-Zip\7-zip.dll

Filesize
99KB

MD5
d346530e648e15887ae88ea34c82efc9

SHA1
5644d95910852e50a4b42375bddfef05f6b3490f

SHA256
f972b164d9a90821be0ea2f46da84dd65f85cd0f29cd1abba0c8e9a7d0140902

SHA512
62db21717f79702cbdd805109f30f51a7f7ff5f751dc115f4c95d052c5405eb34d5e8c5a83f426d73875591b7d463f00f686c182ef3850db2e25989ae2d83673

Download Submit
C:\Program Files\7-Zip\7z.dll

Filesize
1.8MB

MD5
1143c4905bba16d8cc02c6ba8f37f365

SHA1
db38ac221275acd087cf87ebad393ef7f6e04656

SHA256
e79ddfb6319dbf9bac6382035d23597dad979db5e71a605d81a61ee817c1e812

SHA512
b918ae107c179d0b96c8fb14c2d5f019cad381ba4dcdc760c918dfcd5429d1c9fb6ce23f4648823a0449cb8a842af47f25ede425a4e37a7b67eb291ce8cce894

Download Submit
C:\Program Files\7-Zip\7zG.exe

Filesize
692KB

MD5
4159ff3f09b72e504e25a5f3c7ed3a5b

SHA1
b79ab2c83803e1d6da1dcd902f41e45d6cd26346

SHA256
0163ec83208b4902a2846de998a915de1b9e72aba33d98d5c8a14a8fbf0f6101

SHA512
48f54f0ab96be620db392b4c459a49a0fa8fbe95b1c1b7df932de565cf5f77adfaae98ef1e5998f326172b5ae4ffa9896aeac0f7b98568fcde6f7b1480df4e2d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
551bd20950f596ac0008733c3ce3e510

SHA1
4c54a256888ac828f7a844f25ff155e4185d9bdc

SHA256
06f24665dda93c5c1f521f9cd446b402d893fbaca4766e2efb688b8896bca0a6

SHA512
8eca5b283e57322ea794e40b6772ba013173cbc10869f1d9498d7e55627977af602ccc5277864fbd75759d6ccd4ff13f4a00a7aba6d5179ff8cdc671872e9bed

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
356B

MD5
3df9b1ba1fb08fddef140fa6fead8e57

SHA1
f3ea40980a782cd8c14fd64b7174b14a015fa401

SHA256
2fa5997c1fd12b9534ca0917778e9ede259b044de8e5fe58e723603b193804e3

SHA512
f6435c3a39a628e96c617279095f215e89d7c535da22d49a652082ea35e0823cd6770fc4a0db08dda17ba27942d8f234b7ea628b0b896a3a0f7800f4f47fe4fa

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
50889f692f8cb49412125e1c6fe255e6

SHA1
ab12309e5efd680c399f1582650980d00f8d92b2

SHA256
5a644b4658626e49a56b2c3a85edf0e416a167a2025806e1d49c01391ad60f7d

SHA512
36513a99509353581ba813220d33f5a2dd4d57d6fce881d505e15e700921d364fbc5f22d2a7745baf08339400086b4049a41200796ff30d0732bee23cbcc7c8c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
99KB

MD5
b26b8ea200bfc15010ad226636271f49

SHA1
b0d642d584cf78d36fe4ba40abedcc8fa858a2b1

SHA256
f1967dde77227a66cea86700d1d12dfcba640671aa0f0465c426da2eba1c5397

SHA512
d84387f67d5afbab5f31d97ba45e7c45fa1fed12872793c83b402a4783550d4de6cce64fd0143ac081112a00fb3a3e84d0d8124a90ffb5004a7b860d3bc57b0f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
627073ee3ca9676911bee35548eff2b8

SHA1
4c4b68c65e2cab9864b51167d710aa29ebdcff2e

SHA256
85b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c

SHA512
3c5f6c03e253b83c57e8d6f0334187dbdcdf4fa549eecd36cbc1322dca6d3ca891dc6a019c49ec2eafb88f82d0434299c31e4dfaab123acb42e0546218f311fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\8897c4d9-2bed-4ae6-b91a-ec11fd2f75de.tmp

Filesize
10KB

MD5
58cee604d0e63460f7d38ed2aeb65ef7

SHA1
96b2d22341714ca7aba8af4d676946d40de0c82b

SHA256
e5bb577ffb1a2d99067090c12c040984aa5f1c068511f3c6edf341a6f94dacd5

SHA512
8db1e5c6b329a2b7abb0307a4b8d8ceca785dfcdc7cf29ca8b1bcc8ba4282d9217733fe907b7a408ead25a06fc79ade2a3a4d6a35a064bd144438f81fc462597

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0487ced0fdfd8d7a8e717211fcd7d709

SHA1
598605311b8ef24b0a2ba2ccfedeecabe7fec901

SHA256
76693c580fd4aadce2419a1b80795bb4ff78d70c1fd4330e777e04159023f571

SHA512
16e1c6e9373b6d5155310f64bb71979601852f18ee3081385c17ffb943ab078ce27cd665fb8d6f3bcc6b98c8325b33403571449fad044e22aa50a3bf52366993

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
5578283903c07cc737a43625e2cbb093

SHA1
f438ad2bef7125e928fcde43082a20457f5df159

SHA256
7268c7d8375d50096fd5f773a0685ac724c6c2aece7dc273c7eb96b28e2935b2

SHA512
3b29531c0bcc70bfc0b1af147fe64ce0a7c4d3cbadd2dbc58d8937a8291daae320206deb0eb2046c3ffad27e01af5aceca4708539389da102bff4680afaa1601

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\25ce432a-fd81-44e0-9bd3-1b4a4313705e.tmp

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009

Filesize
62KB

MD5
c3c0eb5e044497577bec91b5970f6d30

SHA1
d833f81cf21f68d43ba64a6c28892945adc317a6

SHA256
eb48be34490ec9c4f9402b882166cd82cd317b51b2a49aae75cdf9ee035035eb

SHA512
83d3545a4ed9eed2d25f98c4c9f100ae0ac5e4bc8828dccadee38553b7633bb63222132df8ec09d32eb37d960accb76e7aab5719fc08cc0a4ef07b053f30cf38

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000a

Filesize
70KB

MD5
4308671e9d218f479c8810d2c04ea6c6

SHA1
dd3686818bc62f93c6ab0190ed611031f97fdfcf

SHA256
5addbdd4fe74ff8afc4ca92f35eb60778af623e4f8b5911323ab58a9beed6a9a

SHA512
5936b6465140968acb7ad7f7486c50980081482766002c35d493f0bdd1cc648712eebf30225b6b7e29f6f3123458451d71e62d9328f7e0d9889028bff66e2ad2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b

Filesize
19KB

MD5
76a3f1e9a452564e0f8dce6c0ee111e8

SHA1
11c3d925cbc1a52d53584fd8606f8f713aa59114

SHA256
381396157ed5e8021dd8e660142b35eb71a63aecd33062a1103ce9c709c7632c

SHA512
a1156a907649d6f2c3f7256405d9d5c62a626b8d4cd717fa2f29d2fbe91092a2b3fdd0716f8f31e59708fe12274bc2dea6c9ae6a413ea290e70ddf921fe7f274

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000c

Filesize
41KB

MD5
58756d99d2376dcfbede6057dd25a745

SHA1
76f81b96664cd8863210bb03cc75012eaae96320

SHA256
f5d0da7b010b28a7fe2c314724a966c44068a8c8fa7e9a495e1284aa501067fa

SHA512
476e35c3da0cf223e773c2d26403c12f8c8d034273cca9e3c4cba9359f8506159c2a5267793c8bd9982b636191ddda62e9119593f5599053894c7027a58acc10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000d

Filesize
65KB

MD5
56d57bc655526551f217536f19195495

SHA1
28b430886d1220855a805d78dc5d6414aeee6995

SHA256
f12de7e272171cda36389813df4ba68eb2b8b23c58e515391614284e7b03c4d4

SHA512
7814c60dc377e400bbbcc2000e48b617e577a21045a0f5c79af163faa0087c6203d9f667e531bbb049c9bd8fb296678e6a5cdcad149498d7f22ffa11236b51cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000e

Filesize
88KB

MD5
b38fbbd0b5c8e8b4452b33d6f85df7dc

SHA1
386ba241790252df01a6a028b3238de2f995a559

SHA256
b18b9eb934a5b3b81b16c66ec3ec8e8fecdb3d43550ce050eb2523aabc08b9cd

SHA512
546ca9fb302bf28e3a178e798dd6b80c91cba71d0467257b8ed42e4f845aa6ecb858f718aac1e0865b791d4ecf41f1239081847c75c6fb3e9afd242d3704ad16

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000f

Filesize
1.3MB

MD5
a308d42822b1bcc72e63270f012430a1

SHA1
39120041244fea9d757d253232fd14835e70c555

SHA256
e7958fa25cceb843a031a4d8744515180b4aceeb2db00f42e9c0c78cf1991a11

SHA512
fb9825a6febb7b54d2bb6bd21c02cd1eec103cc44cc525eebabdebbb726c241d223b734e751669f18f5762f6418917cd892850e4d99222f5998027a144ffb366

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
f2925824c65675ff8324220d2f3a462b

SHA1
2215a939322e40e0d323f5b2eee80dccf40286ea

SHA256
6c70bb394ee2fac1769c14c7fc2dcb3a9f3b7e3de2a49380adb301d531b636c7

SHA512
1fe7171fda30316f19f7fd684b1b7da24223261de9a5dd75de931ea2231fbc6116e0066b89d9fb53862045b1076bc3b66a122e151aa8812a962d51c3efd8fd01

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
ce010dadc52d43cd9e2fa46ec40e9b3a

SHA1
b53017cc69835232adacb40fedd0c4ea6e9c8e35

SHA256
48969822bc47ee91fe94316ade03e86b14e4f75b0db760d9aafa403557c8591a

SHA512
a3e3845ac15c98adb718616f26b79a4e32fd12e99a7fb2692030fb4c77870b0819d3036519bc18de7ceb3082f249fe0b3109dcb2e078a927e3d003cd389f3078

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
d84557be2b1b60d70925421345262606

SHA1
69f9e6bd8abd33a4fdcad78483725db16918fd3e

SHA256
bad2d10c0edefca243bba9bdaa47de39d7886486019e73557933052681b66531

SHA512
2fc3471b34d121d13ff37baf8062458e106969497d5826ef00fcbfde6717cbac939524fe4220bc03b3c848480119c62a5cace4a6f2f2ae2e93fc5b3beb6a01e6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies

Filesize
28KB

MD5
37818aba1afb14a6421c98ad0868c962

SHA1
8af9813e771021c0a37ba55ae423b34d04324693

SHA256
33ea680acf0ffc41599b7c2b46ae75ea1b90476ddd3470755f8d917985d507cd

SHA512
900e92369548abba61a7ac468f9afeaf0ca878da1c5014d73f5f8814569b3a433afb3ae9de720e608b58a3b33e1554059a77574e86fd57fa97bfe842a9b5bcbe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log

Filesize
307B

MD5
8e66173fbcae9b39e8ce15679347c5b3

SHA1
22bb266bdeb50d914dc7cd26da1af23f99856b39

SHA256
5e02986d5cae6bacafafa772b40b7093633ceb64690fa48d5d2b1d3cc9dc99da

SHA512
878a41de07fd0e33379a140c4bad735376a6b10cc66ea5304af3d5c2f2b9ff7ec109a5281626ce2c190a2f16dfef96fb220c27e8fa6981e8e871ca69378e8a4c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
7dc7d511aeb69a4c83d5f47fd9e68359

SHA1
b486e6fb9a476c39779f11b02a056f5f68aa5457

SHA256
caeb6d1ec0fd435e1129b6db3ce983bb5a212f055a8a4a005daf6c6168924df3

SHA512
4546203d1807809b72bbc6a9dfe9e47df412dede8d0024184a55a60154399fcca7045f91b11a49d44302e34fb98a9bde53c2b212bff25d12609e21bd703d0746

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
e83b4a6a40a02fbaca005b52285bae91

SHA1
3dfe9e45977b35f9ca7ad5bdca69e308ea2fd09a

SHA256
81c4de9d591c06890187ddcafef8b678f8a51044cc0efb66c4d3574ac0557c3a

SHA512
6b8828271d5d14290fd3daded9de832c803d95cda8f508d4d1d64ea5f4873511d2d0338e1d33f6f77aac73eace7101940f3fc831418719ae46c93e96fef8b32a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
974B

MD5
9c35870f966d3a832f28e25b52e4c286

SHA1
f81b801164a8d418f96ed4cefaf1514beb5b5b3e

SHA256
768e2d80ca7ce362cf2b2de64d091dcd6a5ce1b2f968823f0c95a3334c0afc23

SHA512
aca2e061b07d362d770dfb7c9ae9513d633e17f840e182061c71233fb86b32b7b39705496057c59d5c6aca4f4b601d9c961621370efa2af497d819674126ccfb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
974B

MD5
e820fd00ae37f8414410cd28d437ab93

SHA1
335c3389511d18be596d050c0863db7b189b2168

SHA256
8d041ecc1e17e6ead72592d2f6557e35b42c5f8688d4ab070c247bc903b03b7a

SHA512
0ea1eb374dd985dbdb489123039232d45b2de771a96c05d00478f70d4198acce9b88a388a5d86806fecb2d270536d4bb76f5d3805af6edce274cae99b0e85c36

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
762252c4848cd3e62254d51a2e91b856

SHA1
f8b534b8bd239afc103b3a27b723f5b745295827

SHA256
287c83e2ea1135213d3aba67ca3544b5b23c8bd9c9e730a91e05ec357e51ff2f

SHA512
609b76000aebc25d879155810597cad7869796883960156a00c526de7b9499992887c89e2ed7b87b1532fe3d5364318912ff552a0ef9919f24979e0c4adcb146

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0c3d28a52baa73110448e22277c68f44

SHA1
ad0212ad0e4a3399b8c005c0e1332590738d5dd8

SHA256
c5c1dd67ce142dad38a04b2e60b2945a0052c5134f5b8eb576b4a14f7f756b5a

SHA512
6f256033e5b6bef2a9df000eff48b5794e64251ef9dabc6b45be8185fe0e0b2e60703026aea2e3a2529f6f4466c54ee7db3123e5d9edbe2952242023da040ba6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
bfcff04aeead11244624857ce89916e3

SHA1
06256477280d9b44954719eec50c13f55dc071d8

SHA256
3c184ab18e55ebf0defd7d553e0c3cfc20670c16fdf64820f4fb78a582bcc09f

SHA512
6940e257498c43ffb6c92e0e9c72dffe14d42fa0aa8bbdfd67092a63c5398d2881a47fe794c05c1d237f8260ec51008081871d00b522d368c5dd2866af449f9b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
88bd803229624d2aabb5b6c4665cd932

SHA1
4eb71b2561a17ad350e64187c2762f4aec166f15

SHA256
b009291b7715247aab2cd5bccbf7cd308465165fd422796f3b3a8ac0cdb40961

SHA512
55a4c5b3e0d5337c64294fef541cb02b469868ac18a60b22587d9ec1160a4d90436864e99ac9b046f44d68362a0c0bea7516438be53f489b7829edc01076995d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3db5207ca4345346043a650a738bc6b4

SHA1
2d76816441f10706fb1e0358391a1a2dd629d0d5

SHA256
cc269f51321cd97b5dead770ff06f868481dddcb3015d9a076814f62c0557e0c

SHA512
dd4b34fb4e6c9e183604e14357da001d8dfcd32bacd1223dab9f4fe6100b630e886e48024e208f0d53cdbedda7ee75dc7d5b3144864aad525484d911c520c45e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
d38e6c38f04062494b1145292dc18c2a

SHA1
43cca29e1e6a4ae0d921a62f24e1e8aa5915155f

SHA256
076ba047f1abfac856c6d3e050ebfd4d245a4a45264e2afe5362b7236f3d2d21

SHA512
e4b39f12e2f6ee84b676c5b8c9c98309d65d52aa7117213dd7958cab1c0a94e417ab12fcb887579792312faefa8d0056f6e9bca2adadd31c250c56a65cdc7d2e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
3be7d7d7e4837eb6e910b26eae221ef4

SHA1
dd187548f33b089fdbbb22b4d0368952b6deeb48

SHA256
783c28a59339b7a91c0e5ec0ef0a6214ca834d62680dc2676bf4715f52aefd55

SHA512
42a17dfbd9d5c21aa468bebab5a396326356afc4790d4298f3c0ea98192af585ed4898230e1bc9142358cd0e4df489d8c698e7700556f60487ad0cc1c088e083

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
61e12925e8a399b36842a4646175df93

SHA1
02addf8031110e95ba3060ba9dfdcbb4790d937e

SHA256
59f21c1e3ff80065c89f2f47b5461d588490370bd144496dfaab18f524566b9d

SHA512
e034a8c254c08fa43b7d15cd873204d58c39227ea1b14b44abb1636ce9b84a132a04023593dc76264acb6b2ce35a8f2c43ee55c649619f02af693f2b1de82472

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
703B

MD5
35e74c107356c2285807a12ea67a64a8

SHA1
d7f70bae364b22641f873821d59f27ac1529aad1

SHA256
53d0077bedcba40c4a451d3855fd4082d96fc597ab8e42e31995f9de1d704168

SHA512
4c153d97e75fd418ef86b5354754aeee5cbb63d7985b8c458b1852c594ce3c0cabc31411be18f5e5e44689ac7918e52fbcde970ef564c71338ad4984bc12385a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
703B

MD5
5ab8e9c74379ff5896a244f83dcbeab0

SHA1
315f410483d6a113677f0ba379c026e03f78750f

SHA256
549633097b65af867277189b1b76e82e55a06f1ca43b91e26a3b7be846376803

SHA512
81574910d97aed31ac0eb665da938fd9d3c575d2245c485c3df7e213ad9202868ae089a644615034df509dfa5dccae8e2c822d557c6140715ba8449268a25dab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
703B

MD5
a1d35cd004c8017108aa92d26d2a48d9

SHA1
a9a9f08723a61d41a5700beae298b3c4e1e94961

SHA256
97d598d20cc30119399ad8600eeb9537dba8b3f6f7993431990d21c1a84a99de

SHA512
bb086401b6bbbd20711e23d8b05c08767995fa8ef05cf9b34773c11a6811cd4ce64045e4c32b7c11baf25a8c61f7d4e333e8daea217e3053520c314fd0567d24

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
870B

MD5
c4b784dd584c48d66cca2d0ace6d40e1

SHA1
31c136264d1810d1fe40cb6ec85a2b6735917b1c

SHA256
7d87c978ea121cb1e0859a7a77c4571840cf2b628c8c70fc63d8739e1ac252ed

SHA512
eab67d9180d1ed1a104bb21593f9e809f9ca2a2e628d37b8fd157ecddecad22420e4c4014086b2fb281471eb6f73984605026fdcd54db3ed7b4d996861ce53fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe586d4b.TMP

Filesize
703B

MD5
c9254c1e59dcc8dac6395f8af0f772dc

SHA1
31bb2c0e7263c55b15c179e768b7314675aeca78

SHA256
7a693c897f5c71e72be5960ca1c306d8c4492bed5d90d82c2091c13bd3043040

SHA512
60468e903f16f601edd44afb373906387315c4f8ba997987574dcb039d80d86f1a89dcb27085d901c24a3fd46218fadfc360a1ba9e718436fe42e6fcdb30ccb4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
76c557a802b3cfcb5b388e44c0dee71d

SHA1
d140904785a954d71808f4c222515aa52dad7fa2

SHA256
3b055c619fd08a3003c56425435798e7eac9c6da2d628b85b2e68450e27cac4d

SHA512
677198fafc066e04e6b17683e5554aef2f0f88c8f889433530362e32cf5cc7f1892611ff90e73773afda2940191e74663eec78750d4fc00527f8309fa8018092

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
12c9f68fa76af1589eb0d939a1b56c2d

SHA1
ed88521ae88dffc9233525edd80adc6efb78d307

SHA256
28a5c1a115da2663a6b6df9032e97acc7e525f4e76254cbd9c59b0d3a8a77269

SHA512
c1e0051d90fc496627e596774a0cbdde1a354940019190079a20576157652ea5ac0ee20f8a74d3ab56d5064db3079c3de5ff33c365049bc8f9edfa007ce61f93

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
43e9f535ed1bd4832b907f099c4e5577

SHA1
ed6b1c2ce391b84eba791cee8f26f3d418a04777

SHA256
6765da645119560ea91773db98a357e6f1a44991179755d65e15a62e60eabbdd

SHA512
2b500b701de4d36e7739e8f44f2990896aec63143af5779a7666cbbc29de600b4c59997185e39833adbb25a32b0c8bad2088b48a01ad7bee6492388dbffde56b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
2fad01b164a9539efe7b3e4ca60eab20

SHA1
ece9cd8dc57c87e5caf1fdae74be4c98f2228d79

SHA256
fbd0a9a0abc4995a7f23c72bf62b556cdbf55657b919458a4cbb2a30068db730

SHA512
1f5dba030d1bd52ae48026a20ef026c8d92525e96986d17bce928c5819fb0d3c1c3d6057f01e265256b400a9194cd08cb0a3d6b11c15c5f1cc6b4cd4cf2eee3c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
aa4f31835d07347297d35862c9045f4a

SHA1
83e728008935d30f98e5480fba4fbccf10cefb05

SHA256
99c83bc5c531e49d4240700142f3425aba74e18ebcc23556be32238ffde9cce0

SHA512
ec3a4bee8335007b8753ae8ac42287f2b3bcbb258f7fc3fb15c9f8d3e611cb9bf6ae2d3034953286a34f753e9ec33f7495e064bab0e8c7fcedd75d6e5eb66629

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
948B

MD5
27a83c8adf4cc6407e703e557496d1f4

SHA1
08bba745cb54806554095c3630bb8fe0f992f9d6

SHA256
26d568d812d24be0202aa0e4c68ba118951218d75bb04eea85c0e9b09661e8f1

SHA512
63a0af3b88ef839b84ff3e72436b2249fc7dcb06894a0bfe68402cc68404a95226f16d91b40dd5ce755339266c1ce544ce537e66c9bd12bd4be9f2fb2925f9c7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
f29ff8b1e0f396a194a6782749830b8e

SHA1
2f8999b0eb2a20e591cf9a638c9fa84ddf4a1f69

SHA256
5bfd4968395fefaac3941c08fa11e86dfde1072137d9290aee3888f2a5d92d3f

SHA512
0689d665f2a7c9007c5dc4c14a53d5566d315d05d476bee82d64d02d40e3ffddca2b36419c76a8f7b7979958a62a7a93c939d1ed72fa7a844841ed06741b9e19

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
a2e520b7c549596eb8a1e0778b15db17

SHA1
db093488a4eaf40138f2c3d550db14e6a0bdd055

SHA256
00bc2521e1a98687dcc4be3dc5a9f5faf553f46a605d5226fa5ea98c7d4cfc86

SHA512
399470227a097913d125cfafd75dcb6a1872e3a1c10d952beb878ab8ae34ff63188316a975491583510427447c72e764aa18d17408479126b125153fa43463ee

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat

Filesize
10KB

MD5
06f54da138064bcb87a50ea5796be0bc

SHA1
149614dcc0cc8a15d12e042639d53d364b692f5a

SHA256
fd00cc98658581a6d166ce94e14f68079c4a2948db69e5ac60755ac8c50c1f50

SHA512
530073a003f19a93945cc2d663cd395744c98b3d8377ed6fbc237be0b42b7ec23544fe149435e3d5d47b8d385c2a9bd1e2605222bbe2df0d3233edf10550202d

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_mv24wzqz.wna.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\Downloads\9f39ce4c-0ddd-42f9-9ada-26cbcc4e2181.tmp

Filesize
79KB

MD5
75feae218b03a45d1be3f932f353db7b

SHA1
2eef6e858b38c3c5fece824be164debe55e66f2c

SHA256
ed5fe58c45c8b0e48c4c9405ba8065234090e19e145465117e0d2342f43fd872

SHA512
f13949102f6d6117af5f976cd60dc95315b2be20379d2f7bf4606feffa795a69238d1a84f30288d7e1b45fb407dca583bd17cc9cae3bf129feeb4c2526a0a831

Download Submit
C:\Users\Admin\Downloads\Krampus.rar:Zone.Identifier

Filesize
113B

MD5
6e93b35adff249faa2ecdf21dcf0b557

SHA1
f20e351b3542be9e7475a86ed1ec08995cbe0fa8

SHA256
aaf09600293f8ab758c061dd8add98747624464d45d2bc7be913ed7413eb05ea

SHA512
17a50e49f2bd665fbb1e237feb76dc2f8f3e919635e98b319e6359f6bae88aa57f2aae2e20275ffa85177292545e4095fa32e72c70b58058fc122c07f3af915b

Download Submit
C:\Users\Admin\Downloads\Krampus\b5uEJHZB6Rl.exe

Filesize
231KB

MD5
438289fb9c72ed39bf5497f9af21ec7a

SHA1
8120391ecb41ed6a4c6ef0b259776e59311d6997

SHA256
ea4cb7c7b4cfb2fcc04d1c3f96b20c26638e69a97b15cae14659f0d6afb78f85

SHA512
3647907fa2d503a242ef07cb20b081444b75e0c618a91232c8e77903b4b6aa823b8a7cbe07a45e02591fe48fdd23b5eae88565006b85863c0a5f6e42d7589fe0

Download Submit
C:\Users\Admin\Downloads\Krampus\krampusexec-65cafadfc556c.txt

Filesize
398B

MD5
a1a8eeadd309b1167d848222712ad8fe

SHA1
70267e1f57a5c60919ca8014a160b0815f771707

SHA256
e78865cb4a3c803ff4d54491e6f38505bfcb13450b5ec053f09e07bc77a73ce5

SHA512
310833ec3d56979bfcabc5b41963671df0815ae2efd1dff9983e97246810e795a2938dbeb2793a15ffd6a35255564cd4adbda97dd3e36d7ecf30b61b558d2475

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 160034.crdownload

Filesize
3.8MB

MD5
46c17c999744470b689331f41eab7df1

SHA1
b8a63127df6a87d333061c622220d6d70ed80f7c

SHA256
c5b5def1c8882b702b6b25cbd94461c737bc151366d2d9eba5006c04886bfc9a

SHA512
4b02a3e85b699f62df1b4fe752c4dee08cfabc9b8bb316bc39b854bd5187fc602943a95788ec680c7d3dc2c26ad882e69c0740294bd6cb3b32cdcd165a9441b6

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 756100.crdownload

Filesize
1.5MB

MD5
0330d0bd7341a9afe5b6d161b1ff4aa1

SHA1
86918e72f2e43c9c664c246e62b41452d662fbf3

SHA256
67cb9d3452c9dd974b04f4a5fd842dbcba8184f2344ff72e3662d7cdb68b099b

SHA512
850382414d9d33eab134f8bd89dc99759f8d0459b7ad48bd9588405a3705aeb2cd727898529e3f71d9776a42e141c717e844e0b5c358818bbeac01d096907ad1

Download Submit
C:\Users\Admin\Downloads\winrar-x64-701.exe:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
C:\Windows\system32\drivers\etc\hosts

Filesize
2KB

MD5
4028457913f9d08b06137643fe3e01bc

SHA1
a5cb3f12beaea8194a2d3d83a62bdb8d558f5f14

SHA256
289d433902418aaf62e7b96b215ece04fcbcef2457daf90f46837a4d5090da58

SHA512
c8e1eef90618341bbde885fd126ece2b1911ca99d20d82f62985869ba457553b4c2bf1e841fd06dacbf27275b3b0940e5a794e1b1db0fd56440a96592362c28b

Download Submit
memory/1224-1067-0x0000024568B50000-0x0000024568B62000-memory.dmp

Filesize
72KB

Download
memory/1224-1026-0x0000024568AD0000-0x0000024568B46000-memory.dmp

Filesize
472KB

Download
memory/1224-1066-0x0000024568AA0000-0x0000024568AAA000-memory.dmp

Filesize
40KB

Download
memory/1224-1030-0x0000024568A50000-0x0000024568A6E000-memory.dmp

Filesize
120KB

Download
memory/1224-1000-0x000002454E310000-0x000002454E350000-memory.dmp

Filesize
256KB

Download
memory/1224-1028-0x0000024568BF0000-0x0000024568C40000-memory.dmp

Filesize
320KB

Download
memory/4692-1001-0x0000017E71090000-0x0000017E710B2000-memory.dmp

Filesize
136KB

Download