umbral | hxxps://github[.]com/the335king/BLOXFLIP-PREDICTOR/blob/main/BloxPredictor[.]zip

Analysis

max time kernel
145s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
25-11-2024 11:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/the335king/BLOXFLIP-PREDICTOR/blob/main/BloxPredictor.zip

Score

10^/10

umbral discovery execution stealer

Malware Config

Signatures

Detect Umbral payload 1 IoCs

resource	yara_rule
behavioral1/memory/4576-175-0x0000019C0DD90000-0x0000019C0DDD0000-memory.dmp	family_umbral

Umbral
Umbral stealer is an opensource moduler stealer written in C#.
stealer umbral
Umbral family
umbral

Command and Scripting Interpreter: PowerShell 1 TTPs 8 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
5228	powershell.exe
6040	powershell.exe
5180	powershell.exe
4736	powershell.exe
5388	powershell.exe
2940	powershell.exe
5396	powershell.exe
5600	powershell.exe

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	BloxPredictor.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	BloxPredictor.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 6 IoCs

Web Service

T1102

flow	ioc
97	discord.com
50	raw.githubusercontent.com
51	raw.githubusercontent.com
68	discord.com
69	discord.com
96	discord.com

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
60	ip-api.com
93	ip-api.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 4 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
5404	PING.EXE
5704	cmd.exe
3768	PING.EXE
5480	cmd.exe

Detects videocard installed 1 TTPs 2 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
5500	wmic.exe
3632	wmic.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings	msedge.exe

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
5404	PING.EXE
3768	PING.EXE

Suspicious behavior: EnumeratesProcesses 46 IoCs

pid	Process
4052	msedge.exe
4052	msedge.exe
2548	msedge.exe
2548	msedge.exe
1608	identity_helper.exe
1608	identity_helper.exe
4880	msedge.exe
4880	msedge.exe
4576	BloxPredictor.exe
4576	BloxPredictor.exe
5228	powershell.exe
5228	powershell.exe
5228	powershell.exe
5396	powershell.exe
5396	powershell.exe
5396	powershell.exe
5600	powershell.exe
5600	powershell.exe
5600	powershell.exe
5824	powershell.exe
5824	powershell.exe
5824	powershell.exe
5180	powershell.exe
5180	powershell.exe
5180	powershell.exe
5860	BloxPredictor.exe
5860	BloxPredictor.exe
6040	powershell.exe
6040	powershell.exe
6040	powershell.exe
4736	powershell.exe
4736	powershell.exe
4736	powershell.exe
5388	powershell.exe
5388	powershell.exe
5388	powershell.exe
4340	powershell.exe
4340	powershell.exe
4340	powershell.exe
2940	powershell.exe
2940	powershell.exe
2940	powershell.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4576	BloxPredictor.exe
Token: SeIncreaseQuotaPrivilege	4404	wmic.exe
Token: SeSecurityPrivilege	4404	wmic.exe
Token: SeTakeOwnershipPrivilege	4404	wmic.exe
Token: SeLoadDriverPrivilege	4404	wmic.exe
Token: SeSystemProfilePrivilege	4404	wmic.exe
Token: SeSystemtimePrivilege	4404	wmic.exe
Token: SeProfSingleProcessPrivilege	4404	wmic.exe
Token: SeIncBasePriorityPrivilege	4404	wmic.exe
Token: SeCreatePagefilePrivilege	4404	wmic.exe
Token: SeBackupPrivilege	4404	wmic.exe
Token: SeRestorePrivilege	4404	wmic.exe
Token: SeShutdownPrivilege	4404	wmic.exe
Token: SeDebugPrivilege	4404	wmic.exe
Token: SeSystemEnvironmentPrivilege	4404	wmic.exe
Token: SeRemoteShutdownPrivilege	4404	wmic.exe
Token: SeUndockPrivilege	4404	wmic.exe
Token: SeManageVolumePrivilege	4404	wmic.exe
Token: 33	4404	wmic.exe
Token: 34	4404	wmic.exe
Token: 35	4404	wmic.exe
Token: 36	4404	wmic.exe
Token: SeIncreaseQuotaPrivilege	4404	wmic.exe
Token: SeSecurityPrivilege	4404	wmic.exe
Token: SeTakeOwnershipPrivilege	4404	wmic.exe
Token: SeLoadDriverPrivilege	4404	wmic.exe
Token: SeSystemProfilePrivilege	4404	wmic.exe
Token: SeSystemtimePrivilege	4404	wmic.exe
Token: SeProfSingleProcessPrivilege	4404	wmic.exe
Token: SeIncBasePriorityPrivilege	4404	wmic.exe
Token: SeCreatePagefilePrivilege	4404	wmic.exe
Token: SeBackupPrivilege	4404	wmic.exe
Token: SeRestorePrivilege	4404	wmic.exe
Token: SeShutdownPrivilege	4404	wmic.exe
Token: SeDebugPrivilege	4404	wmic.exe
Token: SeSystemEnvironmentPrivilege	4404	wmic.exe
Token: SeRemoteShutdownPrivilege	4404	wmic.exe
Token: SeUndockPrivilege	4404	wmic.exe
Token: SeManageVolumePrivilege	4404	wmic.exe
Token: 33	4404	wmic.exe
Token: 34	4404	wmic.exe
Token: 35	4404	wmic.exe
Token: 36	4404	wmic.exe
Token: SeDebugPrivilege	5228	powershell.exe
Token: SeDebugPrivilege	5396	powershell.exe
Token: SeDebugPrivilege	5600	powershell.exe
Token: SeDebugPrivilege	5824	powershell.exe
Token: SeIncreaseQuotaPrivilege	6048	wmic.exe
Token: SeSecurityPrivilege	6048	wmic.exe
Token: SeTakeOwnershipPrivilege	6048	wmic.exe
Token: SeLoadDriverPrivilege	6048	wmic.exe
Token: SeSystemProfilePrivilege	6048	wmic.exe
Token: SeSystemtimePrivilege	6048	wmic.exe
Token: SeProfSingleProcessPrivilege	6048	wmic.exe
Token: SeIncBasePriorityPrivilege	6048	wmic.exe
Token: SeCreatePagefilePrivilege	6048	wmic.exe
Token: SeBackupPrivilege	6048	wmic.exe
Token: SeRestorePrivilege	6048	wmic.exe
Token: SeShutdownPrivilege	6048	wmic.exe
Token: SeDebugPrivilege	6048	wmic.exe
Token: SeSystemEnvironmentPrivilege	6048	wmic.exe
Token: SeRemoteShutdownPrivilege	6048	wmic.exe
Token: SeUndockPrivilege	6048	wmic.exe
Token: SeManageVolumePrivilege	6048	wmic.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2548 wrote to memory of 972	2548	msedge.exe	82
PID 2548 wrote to memory of 972	2548	msedge.exe	82
PID 2548 wrote to memory of 3516	2548	msedge.exe	83
PID 2548 wrote to memory of 3516	2548	msedge.exe	83
PID 2548 wrote to memory of 3516	2548	msedge.exe	83
PID 2548 wrote to memory of 3516	2548	msedge.exe	83
PID 2548 wrote to memory of 3516	2548	msedge.exe	83
PID 2548 wrote to memory of 3516	2548	msedge.exe	83
PID 2548 wrote to memory of 3516	2548	msedge.exe	83
PID 2548 wrote to memory of 3516	2548	msedge.exe	83
PID 2548 wrote to memory of 3516	2548	msedge.exe	83
PID 2548 wrote to memory of 3516	2548	msedge.exe	83
PID 2548 wrote to memory of 3516	2548	msedge.exe	83
PID 2548 wrote to memory of 3516	2548	msedge.exe	83
PID 2548 wrote to memory of 3516	2548	msedge.exe	83
PID 2548 wrote to memory of 3516	2548	msedge.exe	83
PID 2548 wrote to memory of 3516	2548	msedge.exe	83
PID 2548 wrote to memory of 3516	2548	msedge.exe	83
PID 2548 wrote to memory of 3516	2548	msedge.exe	83
PID 2548 wrote to memory of 3516	2548	msedge.exe	83
PID 2548 wrote to memory of 3516	2548	msedge.exe	83
PID 2548 wrote to memory of 3516	2548	msedge.exe	83
PID 2548 wrote to memory of 3516	2548	msedge.exe	83
PID 2548 wrote to memory of 3516	2548	msedge.exe	83
PID 2548 wrote to memory of 3516	2548	msedge.exe	83
PID 2548 wrote to memory of 3516	2548	msedge.exe	83
PID 2548 wrote to memory of 3516	2548	msedge.exe	83
PID 2548 wrote to memory of 3516	2548	msedge.exe	83
PID 2548 wrote to memory of 3516	2548	msedge.exe	83
PID 2548 wrote to memory of 3516	2548	msedge.exe	83
PID 2548 wrote to memory of 3516	2548	msedge.exe	83
PID 2548 wrote to memory of 3516	2548	msedge.exe	83
PID 2548 wrote to memory of 3516	2548	msedge.exe	83
PID 2548 wrote to memory of 3516	2548	msedge.exe	83
PID 2548 wrote to memory of 3516	2548	msedge.exe	83
PID 2548 wrote to memory of 3516	2548	msedge.exe	83
PID 2548 wrote to memory of 3516	2548	msedge.exe	83
PID 2548 wrote to memory of 3516	2548	msedge.exe	83
PID 2548 wrote to memory of 3516	2548	msedge.exe	83
PID 2548 wrote to memory of 3516	2548	msedge.exe	83
PID 2548 wrote to memory of 3516	2548	msedge.exe	83
PID 2548 wrote to memory of 3516	2548	msedge.exe	83
PID 2548 wrote to memory of 4052	2548	msedge.exe	84
PID 2548 wrote to memory of 4052	2548	msedge.exe	84
PID 2548 wrote to memory of 1940	2548	msedge.exe	85
PID 2548 wrote to memory of 1940	2548	msedge.exe	85
PID 2548 wrote to memory of 1940	2548	msedge.exe	85
PID 2548 wrote to memory of 1940	2548	msedge.exe	85
PID 2548 wrote to memory of 1940	2548	msedge.exe	85
PID 2548 wrote to memory of 1940	2548	msedge.exe	85
PID 2548 wrote to memory of 1940	2548	msedge.exe	85
PID 2548 wrote to memory of 1940	2548	msedge.exe	85
PID 2548 wrote to memory of 1940	2548	msedge.exe	85
PID 2548 wrote to memory of 1940	2548	msedge.exe	85
PID 2548 wrote to memory of 1940	2548	msedge.exe	85
PID 2548 wrote to memory of 1940	2548	msedge.exe	85
PID 2548 wrote to memory of 1940	2548	msedge.exe	85
PID 2548 wrote to memory of 1940	2548	msedge.exe	85
PID 2548 wrote to memory of 1940	2548	msedge.exe	85
PID 2548 wrote to memory of 1940	2548	msedge.exe	85
PID 2548 wrote to memory of 1940	2548	msedge.exe	85
PID 2548 wrote to memory of 1940	2548	msedge.exe	85
PID 2548 wrote to memory of 1940	2548	msedge.exe	85
PID 2548 wrote to memory of 1940	2548	msedge.exe	85

Views/modifies file attributes 1 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
5832	attrib.exe
5180	attrib.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://github.com/the335king/BLOXFLIP-PREDICTOR/blob/main/BloxPredictor.zip
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff7fd646f8,0x7fff7fd64708,0x7fff7fd64718
  2⤵
  PID:972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,6800167459006629529,17708615182546468410,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:2
  2⤵
  PID:3516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2152,6800167459006629529,17708615182546468410,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2552 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2152,6800167459006629529,17708615182546468410,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2940 /prefetch:8
  2⤵
  PID:1940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,6800167459006629529,17708615182546468410,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3404 /prefetch:1
  2⤵
  PID:2672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,6800167459006629529,17708615182546468410,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3548 /prefetch:1
  2⤵
  PID:4968
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,6800167459006629529,17708615182546468410,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5240 /prefetch:8
  2⤵
  PID:1872
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,6800167459006629529,17708615182546468410,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5240 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,6800167459006629529,17708615182546468410,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5544 /prefetch:1
  2⤵
  PID:4420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,6800167459006629529,17708615182546468410,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5368 /prefetch:1
  2⤵
  PID:4736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2152,6800167459006629529,17708615182546468410,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=3480 /prefetch:8
  2⤵
  PID:4844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,6800167459006629529,17708615182546468410,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:2276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2152,6800167459006629529,17708615182546468410,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3440 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,6800167459006629529,17708615182546468410,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6056 /prefetch:1
  2⤵
  PID:5032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,6800167459006629529,17708615182546468410,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6324 /prefetch:1
  2⤵
  PID:2512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,6800167459006629529,17708615182546468410,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1800 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4464

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2124

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1436

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1100

C:\Users\Admin\AppData\Local\Temp\Temp1_BloxPredictor.zip\BloxPredictor\BloxPredictor.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_BloxPredictor.zip\BloxPredictor\BloxPredictor.exe"
1⤵
- Drops file in Drivers directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4576
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" csproduct get uuid
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4404
- C:\Windows\system32\attrib.exe
  "attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\Temp1_BloxPredictor.zip\BloxPredictor\BloxPredictor.exe"
  2⤵
  - Views/modifies file attributes
  PID:5180
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Temp1_BloxPredictor.zip\BloxPredictor\BloxPredictor.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5228
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5396
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5600
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5824
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" os get Caption
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:6048
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" computersystem get totalphysicalmemory
  2⤵
  PID:6112
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" csproduct get uuid
  2⤵
  PID:5160
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:5180
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" path win32_VideoController get name
  2⤵
  - Detects videocard installed
  PID:5500
- C:\Windows\system32\cmd.exe
  "cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\Temp1_BloxPredictor.zip\BloxPredictor\BloxPredictor.exe" && pause
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:5480
- - C:\Windows\system32\PING.EXE
    ping localhost
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:5404

C:\Users\Admin\AppData\Local\Temp\Temp1_BloxPredictor.zip\BloxPredictor\BloxPredictor.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_BloxPredictor.zip\BloxPredictor\BloxPredictor.exe"
1⤵
- Drops file in Drivers directory
- Suspicious behavior: EnumeratesProcesses
PID:5860
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" csproduct get uuid
  2⤵
  PID:5900
- C:\Windows\system32\attrib.exe
  "attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\Temp1_BloxPredictor.zip\BloxPredictor\BloxPredictor.exe"
  2⤵
  - Views/modifies file attributes
  PID:5832
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Temp1_BloxPredictor.zip\BloxPredictor\BloxPredictor.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:6040
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:4736
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:5388
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4340
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" os get Caption
  2⤵
  PID:2168
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" computersystem get totalphysicalmemory
  2⤵
  PID:3228
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" csproduct get uuid
  2⤵
  PID:2056
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:2940
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" path win32_VideoController get name
  2⤵
  - Detects videocard installed
  PID:3632
- C:\Windows\system32\cmd.exe
  "cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\Temp1_BloxPredictor.zip\BloxPredictor\BloxPredictor.exe" && pause
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:5704
- - C:\Windows\system32\PING.EXE
    ping localhost
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:3768

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\BloxPredictor.exe.log

Filesize
1KB

MD5
547df619456b0e94d1b7663cf2f93ccb

SHA1
8807c99005eaf2cc44b0b5ec4fc6eac289bfb4e3

SHA256
8b7130cc966f3f78e236b4e51eb12e1c82b0bd3f0773275d619b5c545168797a

SHA512
01b4e32fdf6c7f2347075c8153bc75a2f32fe3cec19e1a777e263ec4f607b54e046f0e4c7c0bc22581d44cbbdbb076a63eaa50a742f381faad06c86c2b10f67f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b8880802fc2bb880a7a869faa01315b0

SHA1
51d1a3fa2c272f094515675d82150bfce08ee8d3

SHA256
467b8cd4aacac66557712f9843023dcedefcc26efc746f3e44157bc8dac73812

SHA512
e1c6dba2579357ba70de58968b167d2c529534d24bff70568144270c48ac18a48ee2af2d58d78ae741e5a36958fa78a57955bd2456f1df00b781fc1002e123d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ba6ef346187b40694d493da98d5da979

SHA1
643c15bec043f8673943885199bb06cd1652ee37

SHA256
d86eec91f295dfda8ed1c5fa99de426f2fe359282c7ebf67e3a40be739475d73

SHA512
2e6cc97330be8868d4b9c53be7e12c558f6eb1ac2c4080a611ba6c43561d0c5bb4791b8a11a8c2371599f0ba73ed1d9a7a2ea6dee2ae6a080f1912e0cb1f656c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
d206df59a4ab384f77db859d07003d07

SHA1
e17fc3e14dfcfb60d859fa6c0f6c16bae402ca4f

SHA256
b8f63b97103264ea75342249c38fcca38a73b7af28eedf307402441ce02f40a1

SHA512
e08cb1faa75fc96709b38678164e28537dd3fdc5fc7e28a156e5277a046698a0e9fa2ee4a304466ac06c19d90b541f4e8be0cb516c8092d78064393250c8d8b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies

Filesize
20KB

MD5
cdef4ef6995faa341ee7fbf9d2d3bcac

SHA1
5f207a4e06e9369829d345160f0e9d0d44a75285

SHA256
a42225dbee041c948649fb4e6423a88713ba7e6090a1501e7419acf1f3929185

SHA512
e98e516dc24896c5696dd4a3cc1ef1c820fcc627f543ba3c67a811713a86ad51074d569b1c5d18fb26f689ce2e075d41cba60c8ea8c324e632cf1dede542c283

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log

Filesize
11KB

MD5
285444e755ae46eff1d897b18d6fc2a6

SHA1
feabd9ee8036ad0c7fcd871f65829a6f612f3d5a

SHA256
014628fb76b4678ada1bf05e82d94abc31f7498bdacb424dc3747591b11cfd9f

SHA512
d3978d4cbf03c33718f2664f0a8bad2cb980c252864f88c856c5e5d1f605cdcba24f6d6db2815167bddca07ffcf4fda3d04d9bc83114196a54dd63467f091f8a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
579B

MD5
0a8a7c3dafeb4ad3d8cb846fc95b8f1c

SHA1
69e2b994e6882e1e783410dae53181984050fa13

SHA256
a88495f2c1c26c6c1d5690a29289467c8bb8a94bf6f4801d2c14da1456773f90

SHA512
2e59b4cd4cf6f86537aae4ae88e56e21abcff5070c5c1d1d2105a8e863523c80740438cc36b2b57672bc7bb7fb9387896135afcce534edfd4697fecf61031a5c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
1995c51a0b35d7bfa041809c1481971f

SHA1
1ebdde61643b81ed69a9dd47a75aba906c36c98d

SHA256
5241ef3012f5d85b307b765ba4dbc7838bcdbcf688a9df42e3319eec2629196d

SHA512
9fdb8ed61f8cb93b055f8c87bedfc5c94f75aee2d460a9363659947727baf4710085508587e8140689ca3c37b6a5b512be5a0d252cb6b241a798fc3b6480c687

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
0fcd999305e2a0b86f4e6b6f08f59a56

SHA1
d12e1e728cd69e81032a1a6ce65923ab4d064005

SHA256
edb70bd10c7f0c6926cff9dcea7a6ec2834372cc410758540ca85bc91328d7ba

SHA512
26d68284ae22ae9d613c666db9e1093ed97feb00e899be10203599bf08dd90a9db7ae524a06599999e5c294a142625d79724bcd40417191542fb5e22be6eca8d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57d457.TMP

Filesize
1KB

MD5
690db2f1055071643f37f01d2e3d49a0

SHA1
748f808674e8a1905d87dad6f431d7a43ca7863d

SHA256
3046853eafa0033e731a16fade8b0d388faa6148bde6af908e4e8afe913aed97

SHA512
8b508f8352022954952c39c2f39fc0ca876e83d65555c5354a3e4cfa6217a55ae4073e4893303635efb885300a226f79a77d10b743046678eeb32b0ed0535a19

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f01f2669-b65d-4661-9b64-db2c6dd3ed9e.tmp

Filesize
6KB

MD5
744b6d5c6605706bd779eaad6dd36025

SHA1
fa23a883178e78e6ae5bedd9a1367fa0ca3cf4ea

SHA256
c1a2161b215850c0b496a3fed2243b8e6cb9d393ccae5515c69a7863ffdaccdc

SHA512
8cf406db075b709ea29116322f4810ff9c394b8ba10cff5c71c6e0b1e36061b56e6172a0fa63871344fb9d88cce4a802716a63b8b6c754fa64b256624e3689aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f4227c7d-ecb7-406d-a2c2-6745201d1191.tmp

Filesize
6KB

MD5
cd44086f27981e1b6adb5cb7a4f6922b

SHA1
2b3cc66428a6e1ba9f6a56570e5468a8a23f180c

SHA256
fa23c859ba1fe689823d19059a7531e2e3606d397d877b0dc4cd139f99ff01d1

SHA512
9653d2ddd6bad4f865648380f4236d99afa714b03f191888f05aca75675cacfe47d3f7326ab4abeb7325ee3de1f655f995fe558748e3d385b7861191a4fd7eb8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
ff0b13647561616132c21fe7094bf6c1

SHA1
39ad4dfb544218ec61ab2d550617dd73f84fc583

SHA256
b538a3b7618d3e21b2f87f84eb52190faefddb5c78249fb6ed6937413a0cf407

SHA512
5d14698be97038cdd0d8c55a373aec97d8cf98c1d33cbaca93eb989db9627475af8358e40bb397b28ccce740cb2dc02652a279f32132197a2c41d3d464a382da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
8d042b12d3ec1637f9631fa32f266e8a

SHA1
d02b895d563c750cc616b9ddce4cbe4953d59c0c

SHA256
000d72f48a075ca99e30b57df379cf18f58bca96e5c8057a04a0eeeb1b7547cf

SHA512
138821155ed25b44a6a815780894cd1b1cc00455d5a5b39b44380fd4bbaae5d25c63e21779e57163c7a4acfc437fc287d80fff40afacd43063a85edfc2981ef7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\cc095d5b-d620-4209-b681-a71455bd95d0.tmp

Filesize
10KB

MD5
78a0a3505bfa6d1294678aa6c75adc4c

SHA1
dd41d6dc161b723704ab486685077c62041b45de

SHA256
3a44eb13c57b8365450219c642ba31a178eef89ee6c183cd2649b3cf2f435761

SHA512
45e2fb5bf34e9b9f52a4e3b4be6e7ed4a17b2a1b1ef687edcfbc93db874fb5c7a643e9d9d2d2f119a5ee6f644a979c2d472ec34fa5123eb698ed92697439eb23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
35967cf5ed9a95ec4fe527dd96567a02

SHA1
6a7439c241a30ec540d5d204e02a4cbb2a464737

SHA256
4394552922777081d43fb523126cf176d5a676602a5435713320942034f6b3cf

SHA512
419b3c336a67ef964bc166d1267cea146ed5878f98304d6e39fb9a3c0394d75693810a9ddc101cdda5e3196ad7d603df01a3260705cf9ef7cf8d4b252df01f45

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
948B

MD5
76f90bd5860edec429e968314257b5b3

SHA1
9b8601452c212e62c14d9eccd87ae4e72937b5c6

SHA256
c1ee841b4adb8c8ddaadc622b01fd12a95d17312d19f023b86f1fda581d55d67

SHA512
6231a9c42d63643c3ade9dbf5cbba3038e628bc152b7b72d88fea2ed952831c90400c114d802b42a0a5cb13d0962ca654ef0d46aeb9aec06f684b970df5df2f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
88be3bc8a7f90e3953298c0fdbec4d72

SHA1
f4969784ad421cc80ef45608727aacd0f6bf2e4b

SHA256
533c8470b41084e40c5660569ebbdb7496520d449629a235e8053e84025f348a

SHA512
4fce64e2dacddbc03314048fef1ce356ee2647c14733da121c23c65507eeb8d721d6b690ad5463319b364dc4fa95904ad6ab096907f32918e3406ef438a6ef7c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
de09198e65b2beb7874838918be86c01

SHA1
d5efe8a89b71ae64d9a8f372639eed868174bbd1

SHA256
b10ac648364708b5defd6489b9fcf443030e662fd3d2aa47178dece88099dd6c

SHA512
c195fdb5fa61351a66f346bafcb4001bb8c5074c34525f672b87ba8b6d2fa468edb1c4cbe8e20fa0380775c5a80e93785d39feb4a38a9cd5b50506d405855a9f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
64B

MD5
6f9d41d367f8d4f968a32f7daeea27dd

SHA1
f9512c484027bb94e43417b0e0292618d4b8e3cf

SHA256
4c4a7e4fdd7a22f3d9758f8e31e329584b4f69db2a3a715f5916b6b4b77b061f

SHA512
e801d47f473a033451c77ccf1b64684d4ccd5620f79e0267edea1b172abb326b6846c87ff4d29307dcffadadf7acf5ac35f17006c7aee1f71661f8d38b4756cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
96ff1ee586a153b4e7ce8661cabc0442

SHA1
140d4ff1840cb40601489f3826954386af612136

SHA256
0673399a2f37c89d455e8658c4d30b9248bff1ea47ba40957588e2bc862976e8

SHA512
3404370d0edb4ead4874ce68525dc9bcbc6008003682646e331bf43a06a24a467ace7eff5be701a822d74c7e065d0f6a0ba0e3d6bc505d34d0189373dcacb569

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
948B

MD5
04dba2e0763acb9b83dcb94ca0f4c2bd

SHA1
626394aea6be984d4817a88a591fea246bf4a362

SHA256
6590267fae391a722c4b8c759c88d9e694daac163148aad7e69faebe045b75e5

SHA512
1f0dff8f0a7d51ba949d994a6194eeb6d376da60769c0ea99d13c39242327a6bb5d4241b890ff0d29b17e39243b4ba1d9aa00ca952c54bbf13ea2abd95d1eb12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
b0a78e60bfb279d18fd3d6e7a67411f5

SHA1
9344fe3654a14bc66afb9dc6ea215fabfbe5c906

SHA256
a28890c82033d3deaf5770ecd1b0239c77321acc93704b1d4b1e167b91e30aeb

SHA512
9548be23bec645cd705482f78d43b63659e38cf879c34f7071f42fd86ee02039379a5e92fbe0f1c74c12aaebabdd8002f57eba111d3e855cbd0c89a110e346f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
b5e2fd95470c50743ba121fd6bd03a7b

SHA1
75545ed499d9dde51a1fc1cf535eb4f50ec79250

SHA256
d9c961aaf784b9ce81b0a3aac7a39bd41e9f2702d9c28deb20e786d385b88288

SHA512
76bdc793f8b38f603b5ad0957474660bb09e963a2496564b8ceac6591d532fc9498214b81c3908bafc13ff0b07028457c6c997998adfd2203304cb1c82899423

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1tvc0vgh.ond.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\Downloads\BloxPredictor.zip

Filesize
88KB

MD5
059469674bbed4389f6cb8a66b811f12

SHA1
3f1b76815d81e28ac58dd687e9df663174a4c6f0

SHA256
80c5aab8d64ed6e67b4f20314ace48550e2e4216172f341cce0603b897b53406

SHA512
b605e155f35b99ca02993098e08f9c49d9f925e58cee23907317d897792e72f64ac313191976bda880870dd6529bb414a40d039b6af20dc8fb98b7a4af57137b

Download Submit
C:\Windows\system32\drivers\etc\hosts

Filesize
2KB

MD5
4028457913f9d08b06137643fe3e01bc

SHA1
a5cb3f12beaea8194a2d3d83a62bdb8d558f5f14

SHA256
289d433902418aaf62e7b96b215ece04fcbcef2457daf90f46837a4d5090da58

SHA512
c8e1eef90618341bbde885fd126ece2b1911ca99d20d82f62985869ba457553b4c2bf1e841fd06dacbf27275b3b0940e5a794e1b1db0fd56440a96592362c28b

Download Submit
memory/4576-262-0x0000019C0FAA0000-0x0000019C0FAB2000-memory.dmp

Filesize
72KB

Download
memory/4576-175-0x0000019C0DD90000-0x0000019C0DDD0000-memory.dmp

Filesize
256KB

Download
memory/4576-203-0x0000019C28590000-0x0000019C28606000-memory.dmp

Filesize
472KB

Download
memory/4576-209-0x0000019C0FA00000-0x0000019C0FA1E000-memory.dmp

Filesize
120KB

Download
memory/4576-261-0x0000019C0FA50000-0x0000019C0FA5A000-memory.dmp

Filesize
40KB

Download
memory/4576-205-0x0000019C28610000-0x0000019C28660000-memory.dmp

Filesize
320KB

Download
memory/5228-176-0x00000159AB3A0000-0x00000159AB3C2000-memory.dmp

Filesize
136KB

Download