umbral | hxxps://www[.]mediafire[.]com/file/eskqg5emsxe5ubo/nurik[.]zip/file

Analysis

max time kernel
83s
max time network
88s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
15-01-2025 12:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.mediafire.com/file/eskqg5emsxe5ubo/nurik.zip/file

Score

10^/10

umbral discovery execution stealer

Malware Config

Signatures

Detect Umbral payload 1 IoCs

resource	yara_rule
behavioral1/memory/4388-297-0x000001929E650000-0x000001929E690000-memory.dmp	family_umbral

Umbral
Umbral stealer is an opensource moduler stealer written in C#.
stealer umbral
Umbral family
umbral

Command and Scripting Interpreter: PowerShell 1 TTPs 8 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
5580	powershell.exe
5016	powershell.exe
2408	powershell.exe
5648	powershell.exe
1168	powershell.exe
5656	powershell.exe
5188	powershell.exe
5380	powershell.exe

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	NurikAlphaCrackexe.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	NurikAlphaCrackexe.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service

T1102

flow	ioc
221	discord.com
222	discord.com
205	discord.com
206	discord.com

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
70	ip-api.com
210	ip-api.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 4 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
5104	cmd.exe
5984	PING.EXE
4384	cmd.exe
5628	PING.EXE

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Detects videocard installed 1 TTPs 2 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
5952	wmic.exe
5812	wmic.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	msedge.exe

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
5984	PING.EXE
5628	PING.EXE

Suspicious behavior: EnumeratesProcesses 55 IoCs

pid	Process
2240	msedge.exe
2240	msedge.exe
3736	msedge.exe
3736	msedge.exe
4952	identity_helper.exe
4952	identity_helper.exe
5820	msedge.exe
5820	msedge.exe
4388	NurikAlphaCrackexe.exe
4388	NurikAlphaCrackexe.exe
5580	powershell.exe
5580	powershell.exe
5580	powershell.exe
5648	powershell.exe
5648	powershell.exe
5648	powershell.exe
1168	powershell.exe
1168	powershell.exe
1168	powershell.exe
5520	powershell.exe
5520	powershell.exe
5520	powershell.exe
5656	powershell.exe
5656	powershell.exe
5656	powershell.exe
3200	NurikAlphaCrackexe.exe
3200	NurikAlphaCrackexe.exe
5016	powershell.exe
5016	powershell.exe
5016	powershell.exe
5188	powershell.exe
5188	powershell.exe
5188	powershell.exe
5380	powershell.exe
5380	powershell.exe
5380	powershell.exe
5568	powershell.exe
5568	powershell.exe
5568	powershell.exe
2408	powershell.exe
2408	powershell.exe
2408	powershell.exe
5932	taskmgr.exe
5932	taskmgr.exe
5932	taskmgr.exe
5932	taskmgr.exe
5932	taskmgr.exe
5932	taskmgr.exe
5932	taskmgr.exe
5932	taskmgr.exe
5932	taskmgr.exe
5932	taskmgr.exe
5932	taskmgr.exe
5932	taskmgr.exe
5932	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4388	NurikAlphaCrackexe.exe
Token: SeIncreaseQuotaPrivilege	4436	wmic.exe
Token: SeSecurityPrivilege	4436	wmic.exe
Token: SeTakeOwnershipPrivilege	4436	wmic.exe
Token: SeLoadDriverPrivilege	4436	wmic.exe
Token: SeSystemProfilePrivilege	4436	wmic.exe
Token: SeSystemtimePrivilege	4436	wmic.exe
Token: SeProfSingleProcessPrivilege	4436	wmic.exe
Token: SeIncBasePriorityPrivilege	4436	wmic.exe
Token: SeCreatePagefilePrivilege	4436	wmic.exe
Token: SeBackupPrivilege	4436	wmic.exe
Token: SeRestorePrivilege	4436	wmic.exe
Token: SeShutdownPrivilege	4436	wmic.exe
Token: SeDebugPrivilege	4436	wmic.exe
Token: SeSystemEnvironmentPrivilege	4436	wmic.exe
Token: SeRemoteShutdownPrivilege	4436	wmic.exe
Token: SeUndockPrivilege	4436	wmic.exe
Token: SeManageVolumePrivilege	4436	wmic.exe
Token: 33	4436	wmic.exe
Token: 34	4436	wmic.exe
Token: 35	4436	wmic.exe
Token: 36	4436	wmic.exe
Token: SeIncreaseQuotaPrivilege	4436	wmic.exe
Token: SeSecurityPrivilege	4436	wmic.exe
Token: SeTakeOwnershipPrivilege	4436	wmic.exe
Token: SeLoadDriverPrivilege	4436	wmic.exe
Token: SeSystemProfilePrivilege	4436	wmic.exe
Token: SeSystemtimePrivilege	4436	wmic.exe
Token: SeProfSingleProcessPrivilege	4436	wmic.exe
Token: SeIncBasePriorityPrivilege	4436	wmic.exe
Token: SeCreatePagefilePrivilege	4436	wmic.exe
Token: SeBackupPrivilege	4436	wmic.exe
Token: SeRestorePrivilege	4436	wmic.exe
Token: SeShutdownPrivilege	4436	wmic.exe
Token: SeDebugPrivilege	4436	wmic.exe
Token: SeSystemEnvironmentPrivilege	4436	wmic.exe
Token: SeRemoteShutdownPrivilege	4436	wmic.exe
Token: SeUndockPrivilege	4436	wmic.exe
Token: SeManageVolumePrivilege	4436	wmic.exe
Token: 33	4436	wmic.exe
Token: 34	4436	wmic.exe
Token: 35	4436	wmic.exe
Token: 36	4436	wmic.exe
Token: SeDebugPrivilege	5580	powershell.exe
Token: SeDebugPrivilege	5648	powershell.exe
Token: SeDebugPrivilege	1168	powershell.exe
Token: SeDebugPrivilege	5520	powershell.exe
Token: SeIncreaseQuotaPrivilege	5376	wmic.exe
Token: SeSecurityPrivilege	5376	wmic.exe
Token: SeTakeOwnershipPrivilege	5376	wmic.exe
Token: SeLoadDriverPrivilege	5376	wmic.exe
Token: SeSystemProfilePrivilege	5376	wmic.exe
Token: SeSystemtimePrivilege	5376	wmic.exe
Token: SeProfSingleProcessPrivilege	5376	wmic.exe
Token: SeIncBasePriorityPrivilege	5376	wmic.exe
Token: SeCreatePagefilePrivilege	5376	wmic.exe
Token: SeBackupPrivilege	5376	wmic.exe
Token: SeRestorePrivilege	5376	wmic.exe
Token: SeShutdownPrivilege	5376	wmic.exe
Token: SeDebugPrivilege	5376	wmic.exe
Token: SeSystemEnvironmentPrivilege	5376	wmic.exe
Token: SeRemoteShutdownPrivilege	5376	wmic.exe
Token: SeUndockPrivilege	5376	wmic.exe
Token: SeManageVolumePrivilege	5376	wmic.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
5932	taskmgr.exe
5932	taskmgr.exe
5932	taskmgr.exe
5932	taskmgr.exe
5932	taskmgr.exe
5932	taskmgr.exe
5932	taskmgr.exe
5932	taskmgr.exe
5932	taskmgr.exe
5932	taskmgr.exe
5932	taskmgr.exe
5932	taskmgr.exe
5932	taskmgr.exe
5932	taskmgr.exe
5932	taskmgr.exe
5932	taskmgr.exe
5932	taskmgr.exe
5932	taskmgr.exe
5932	taskmgr.exe
5932	taskmgr.exe
5932	taskmgr.exe
5932	taskmgr.exe
5932	taskmgr.exe

Suspicious use of SendNotifyMessage 63 IoCs

pid	Process
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
5932	taskmgr.exe
5932	taskmgr.exe
5932	taskmgr.exe
5932	taskmgr.exe
5932	taskmgr.exe
5932	taskmgr.exe
5932	taskmgr.exe
5932	taskmgr.exe
5932	taskmgr.exe
5932	taskmgr.exe
5932	taskmgr.exe
5932	taskmgr.exe
5932	taskmgr.exe
5932	taskmgr.exe
5932	taskmgr.exe
5932	taskmgr.exe
5932	taskmgr.exe
5932	taskmgr.exe
5932	taskmgr.exe
5932	taskmgr.exe
5932	taskmgr.exe
5932	taskmgr.exe
5932	taskmgr.exe
5932	taskmgr.exe
5932	taskmgr.exe
5932	taskmgr.exe
5932	taskmgr.exe
5932	taskmgr.exe
5932	taskmgr.exe
5932	taskmgr.exe
5932	taskmgr.exe
5932	taskmgr.exe
5932	taskmgr.exe
5932	taskmgr.exe
5932	taskmgr.exe
5932	taskmgr.exe
5932	taskmgr.exe
5932	taskmgr.exe
5932	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3736 wrote to memory of 1552	3736	msedge.exe	83
PID 3736 wrote to memory of 1552	3736	msedge.exe	83
PID 3736 wrote to memory of 3580	3736	msedge.exe	84
PID 3736 wrote to memory of 3580	3736	msedge.exe	84
PID 3736 wrote to memory of 3580	3736	msedge.exe	84
PID 3736 wrote to memory of 3580	3736	msedge.exe	84
PID 3736 wrote to memory of 3580	3736	msedge.exe	84
PID 3736 wrote to memory of 3580	3736	msedge.exe	84
PID 3736 wrote to memory of 3580	3736	msedge.exe	84
PID 3736 wrote to memory of 3580	3736	msedge.exe	84
PID 3736 wrote to memory of 3580	3736	msedge.exe	84
PID 3736 wrote to memory of 3580	3736	msedge.exe	84
PID 3736 wrote to memory of 3580	3736	msedge.exe	84
PID 3736 wrote to memory of 3580	3736	msedge.exe	84
PID 3736 wrote to memory of 3580	3736	msedge.exe	84
PID 3736 wrote to memory of 3580	3736	msedge.exe	84
PID 3736 wrote to memory of 3580	3736	msedge.exe	84
PID 3736 wrote to memory of 3580	3736	msedge.exe	84
PID 3736 wrote to memory of 3580	3736	msedge.exe	84
PID 3736 wrote to memory of 3580	3736	msedge.exe	84
PID 3736 wrote to memory of 3580	3736	msedge.exe	84
PID 3736 wrote to memory of 3580	3736	msedge.exe	84
PID 3736 wrote to memory of 3580	3736	msedge.exe	84
PID 3736 wrote to memory of 3580	3736	msedge.exe	84
PID 3736 wrote to memory of 3580	3736	msedge.exe	84
PID 3736 wrote to memory of 3580	3736	msedge.exe	84
PID 3736 wrote to memory of 3580	3736	msedge.exe	84
PID 3736 wrote to memory of 3580	3736	msedge.exe	84
PID 3736 wrote to memory of 3580	3736	msedge.exe	84
PID 3736 wrote to memory of 3580	3736	msedge.exe	84
PID 3736 wrote to memory of 3580	3736	msedge.exe	84
PID 3736 wrote to memory of 3580	3736	msedge.exe	84
PID 3736 wrote to memory of 3580	3736	msedge.exe	84
PID 3736 wrote to memory of 3580	3736	msedge.exe	84
PID 3736 wrote to memory of 3580	3736	msedge.exe	84
PID 3736 wrote to memory of 3580	3736	msedge.exe	84
PID 3736 wrote to memory of 3580	3736	msedge.exe	84
PID 3736 wrote to memory of 3580	3736	msedge.exe	84
PID 3736 wrote to memory of 3580	3736	msedge.exe	84
PID 3736 wrote to memory of 3580	3736	msedge.exe	84
PID 3736 wrote to memory of 3580	3736	msedge.exe	84
PID 3736 wrote to memory of 3580	3736	msedge.exe	84
PID 3736 wrote to memory of 2240	3736	msedge.exe	85
PID 3736 wrote to memory of 2240	3736	msedge.exe	85
PID 3736 wrote to memory of 980	3736	msedge.exe	86
PID 3736 wrote to memory of 980	3736	msedge.exe	86
PID 3736 wrote to memory of 980	3736	msedge.exe	86
PID 3736 wrote to memory of 980	3736	msedge.exe	86
PID 3736 wrote to memory of 980	3736	msedge.exe	86
PID 3736 wrote to memory of 980	3736	msedge.exe	86
PID 3736 wrote to memory of 980	3736	msedge.exe	86
PID 3736 wrote to memory of 980	3736	msedge.exe	86
PID 3736 wrote to memory of 980	3736	msedge.exe	86
PID 3736 wrote to memory of 980	3736	msedge.exe	86
PID 3736 wrote to memory of 980	3736	msedge.exe	86
PID 3736 wrote to memory of 980	3736	msedge.exe	86
PID 3736 wrote to memory of 980	3736	msedge.exe	86
PID 3736 wrote to memory of 980	3736	msedge.exe	86
PID 3736 wrote to memory of 980	3736	msedge.exe	86
PID 3736 wrote to memory of 980	3736	msedge.exe	86
PID 3736 wrote to memory of 980	3736	msedge.exe	86
PID 3736 wrote to memory of 980	3736	msedge.exe	86
PID 3736 wrote to memory of 980	3736	msedge.exe	86
PID 3736 wrote to memory of 980	3736	msedge.exe	86

Views/modifies file attributes 1 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
5816	attrib.exe
1140	attrib.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://www.mediafire.com/file/eskqg5emsxe5ubo/nurik.zip/file
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff98b4246f8,0x7ff98b424708,0x7ff98b424718
  2⤵
  PID:1552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,2631192829062715008,5919820027189932178,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:2
  2⤵
  PID:3580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,2631192829062715008,5919820027189932178,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2148,2631192829062715008,5919820027189932178,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2880 /prefetch:8
  2⤵
  PID:980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,2631192829062715008,5919820027189932178,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:4364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,2631192829062715008,5919820027189932178,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
  2⤵
  PID:3008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,2631192829062715008,5919820027189932178,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5568 /prefetch:1
  2⤵
  PID:2212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,2631192829062715008,5919820027189932178,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5740 /prefetch:1
  2⤵
  PID:1488
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,2631192829062715008,5919820027189932178,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6776 /prefetch:8
  2⤵
  PID:4524
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,2631192829062715008,5919820027189932178,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6776 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,2631192829062715008,5919820027189932178,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6488 /prefetch:1
  2⤵
  PID:2480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,2631192829062715008,5919820027189932178,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5924 /prefetch:1
  2⤵
  PID:736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,2631192829062715008,5919820027189932178,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4164 /prefetch:1
  2⤵
  PID:3136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,2631192829062715008,5919820027189932178,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5168 /prefetch:1
  2⤵
  PID:656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,2631192829062715008,5919820027189932178,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6808 /prefetch:1
  2⤵
  PID:5412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,2631192829062715008,5919820027189932178,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7080 /prefetch:1
  2⤵
  PID:5512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2148,2631192829062715008,5919820027189932178,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6236 /prefetch:8
  2⤵
  PID:5792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,2631192829062715008,5919820027189932178,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7120 /prefetch:1
  2⤵
  PID:5800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2148,2631192829062715008,5919820027189932178,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6176 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,2631192829062715008,5919820027189932178,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6980 /prefetch:1
  2⤵
  PID:6024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,2631192829062715008,5919820027189932178,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1988 /prefetch:1
  2⤵
  PID:5700

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4572

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3176

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5940

C:\Users\Admin\AppData\Local\Temp\Temp1_nurik.zip\NurikAlphaCrackexe.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_nurik.zip\NurikAlphaCrackexe.exe"
1⤵
- Drops file in Drivers directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4388
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" csproduct get uuid
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4436
- C:\Windows\system32\attrib.exe
  "attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\Temp1_nurik.zip\NurikAlphaCrackexe.exe"
  2⤵
  - Views/modifies file attributes
  PID:5816
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Temp1_nurik.zip\NurikAlphaCrackexe.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5580
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5648
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1168
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5520
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" os get Caption
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5376
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" computersystem get totalphysicalmemory
  2⤵
  PID:2408
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" csproduct get uuid
  2⤵
  PID:5660
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:5656
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" path win32_VideoController get name
  2⤵
  - Detects videocard installed
  PID:5952
- C:\Windows\system32\cmd.exe
  "cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\Temp1_nurik.zip\NurikAlphaCrackexe.exe" && pause
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:5104
- - C:\Windows\system32\PING.EXE
    ping localhost
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:5984

C:\Users\Admin\AppData\Local\Temp\Temp1_nurik.zip\NurikAlphaCrackexe.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_nurik.zip\NurikAlphaCrackexe.exe"
1⤵
- Drops file in Drivers directory
- Suspicious behavior: EnumeratesProcesses
PID:3200
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" csproduct get uuid
  2⤵
  PID:5664
- C:\Windows\system32\attrib.exe
  "attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\Temp1_nurik.zip\NurikAlphaCrackexe.exe"
  2⤵
  - Views/modifies file attributes
  PID:1140
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Temp1_nurik.zip\NurikAlphaCrackexe.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:5016
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:5188
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:5380
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5568
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" os get Caption
  2⤵
  PID:1776
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" computersystem get totalphysicalmemory
  2⤵
  PID:1940
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" csproduct get uuid
  2⤵
  PID:5992
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:2408
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" path win32_VideoController get name
  2⤵
  - Detects videocard installed
  PID:5812
- C:\Windows\system32\cmd.exe
  "cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\Temp1_nurik.zip\NurikAlphaCrackexe.exe" && pause
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:4384
- - C:\Windows\system32\PING.EXE
    ping localhost
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:5628

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /0
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5932

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\NurikAlphaCrackexe.exe.log

Filesize
1KB

MD5
547df619456b0e94d1b7663cf2f93ccb

SHA1
8807c99005eaf2cc44b0b5ec4fc6eac289bfb4e3

SHA256
8b7130cc966f3f78e236b4e51eb12e1c82b0bd3f0773275d619b5c545168797a

SHA512
01b4e32fdf6c7f2347075c8153bc75a2f32fe3cec19e1a777e263ec4f607b54e046f0e4c7c0bc22581d44cbbdbb076a63eaa50a742f381faad06c86c2b10f67f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
85ba073d7015b6ce7da19235a275f6da

SHA1
a23c8c2125e45a0788bac14423ae1f3eab92cf00

SHA256
5ad04b8c19bf43b550ad725202f79086168ecccabe791100fba203d9aa27e617

SHA512
eb4fd72d7030ea1a25af2b59769b671a5760735fb95d18145f036a8d9e6f42c903b34a7e606046c740c644fab0bb9f5b7335c1869b098f121579e71f10f5a9c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7de1bbdc1f9cf1a58ae1de4951ce8cb9

SHA1
010da169e15457c25bd80ef02d76a940c1210301

SHA256
6e390bbc0d03a652516705775e8e9a7b7936312a8a5bea407f9d7d9fa99d957e

SHA512
e4a33f2128883e71ab41e803e8b55d0ac17cbc51be3bde42bed157df24f10f34ad264f74ef3254dbe30d253aca03158fde21518c2b78aaa05dae8308b1c5f30c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index

Filesize
1KB

MD5
bf7b79ff5d927c6afa2c8b1aa0607e3a

SHA1
f5f8ed8ca2c6a8ede88532e7f36ad135d0c47c78

SHA256
8cfb615760175f733ef3a518ba5dabf73a8de50bc4bcab11d669a06ba1ae1512

SHA512
bfa4d9be344e1ddd8dd09629114334965e44fc66a64aeddd8aee22ea22c96c034c3622d0db8baacad3e8ee911ad46e809d995de843db09a287214bb0c6a95b6a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
744B

MD5
7a53548688602d0cb437cc837e24ada1

SHA1
cc7ff65c2e2e98c76a99f58b569af61c5e844233

SHA256
d5ea6b40dec230e3d3effe2e5ce9949f562a95ef02fd8733bcd5cf90d98c66fd

SHA512
6661c9ecbf02c7ed3a11d25c81e5de970510da4edeb32db52cdcc03be3f3959604501f25bbc5410bb78a0280865ad58632f6a8dcc2c28610c8f437e5c5aa4e59

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
67ee48e40df9ffc7c7ec086ae585aaa2

SHA1
426168576d6e954d208ee28e1abf270b1fc6cd68

SHA256
c1d79cfadbf4b43ef1ec8548bfaa6a5789e49ed4d8f67ae0800635c7e4efea68

SHA512
114878156e8c0e34a30c14355a7aa6070c8dbb27316606d585025434682da267f9c3bfc7bd200e32bfec31813b1b49068179a077b672003fad44b0fe9b566307

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies

Filesize
36KB

MD5
ca58400e52a555e5b156a2de50e8129a

SHA1
5f4a94a7c49e7bfa5a2b1b531759d1b3336e79ee

SHA256
5c8366470b3b34bc5edbcb55d5d97f7e02bddf3626dcb1643e967cc4e4ee2206

SHA512
6a084cbdce38292cff48e885089da8ef9e23b2b4c6488d11098992a6755c283d8cf58ad10803c31a456d02b35206a7647d24fad45012c14ac8555bea95510cfe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log

Filesize
1KB

MD5
9a614f067e43f9e0bb37ea6f30c304a3

SHA1
0c53fe6bc5f3184c948b73acd60225a760926c20

SHA256
f163c3fd91788c8f4d5bd06808883281de4472ff54bce59762195a9f6b64f05f

SHA512
9abe094902f91baec208fd2425827a6898e401318454e504a7b2a6a68b234134d830ef88cd100316e044314001dea3ea0711829cf71f72ded4a7ce61550d4876

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log

Filesize
1KB

MD5
7b5adf99cc680771ba90a56dc4c8324e

SHA1
12fc2e1277f9dfc6785aad1761296b95aeabe5fa

SHA256
eb2e528f31551e4b80cc771a72901183229a57ff8ef5c5c5269f56ce4dfc83e7

SHA512
c09e29f1708c60dc7d22e222b9d5674ae8739389cb023623d132d69e6fc414a6cc817b645f7874eb69fdc03411c2665819a5062997bf4c6632d3c68ccf293ec9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
5KB

MD5
4c9988b4626f0513248ae10a9371d9ad

SHA1
7bcf3561f8a3b4e3f50c27b9e993e4192e5e1006

SHA256
ee1b761e5237e81f81bdfd08105c13512c1e3e5d655fd877608fa0cdffb6c549

SHA512
e28dd9dad5ff4116337cdbf2e646b7b88b07f17279db33a61fb5408f21f07b7d93f823885a688d8881b500406c8bc841a7bb4ba74d9ac82023145a24adee7d4d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
99852bc2eadc37b2df845fe0cf3b05a0

SHA1
ae7874f56bba74227a4880897a3e8d9064ae5851

SHA256
f66b6d7c1f7a97e5fb32c5986c18707fcb126e7e668dcba714517e7fbbf1543d

SHA512
bc67bb75ddeeb0b84aee797afa1b0d916d46de7bc0a6ce19257b25b27282692df8823539ad2c5e3c407c08d2c7b5ef13bd28a37316ab3a1e31913da562c8eb01

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
cf35c8261ab4e73d286ebe1bb2ae58ed

SHA1
244763bc2f7851ba258baec50e27bb2ccdaef610

SHA256
edd66b5e4630a8784bf1aa92cdb4c1c41d50106f99c2938dd3e8f9f06650912e

SHA512
728cb71b128722ba1ddc3164197527b96db64ada2548d0541d3b521521eea1db67103f5e0be47f4bf9946eb958fd83e28972fde5c0921af12914c558fac9e25b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
d1c12367f282951f52b3b42bff49edf6

SHA1
5921837ef480e2b501e80a899621f69201d81579

SHA256
e6465f57826f733f0b41c08ac744cc983271dff9151c8143bd42e95d307b6524

SHA512
73b3dc1a926bbb582db5c637957e4c82ee159016334f4ec7d55465a3fcad1326662338faf9a51d1b0db5c77d830569a9cf53b88ead04bafc4e77728e8bb4c6e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
4f1f293613e74c7bd6826d4884a1ee17

SHA1
e0401cbfff62ffc349c274219dca83bd65cd71c0

SHA256
2428ad3d2c8397fd5d891fdfc6f37c8ebcccdfb8dc4b82a2cb4c6fecb8e9caa8

SHA512
a3f43dc599ed8b838f0b9596b1bcd646edf55d221bffb30baea735621c2b788fe595b5f818e09111e12255d55d1ebcfa676bbf7a49e8d4e7a06986fb36dc65ab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
89be9584b776551089a1f239fead056e

SHA1
3a3774a6799afdb0191da7a122f4e006b8de7115

SHA256
f6a95e94afa4116d963996ff65d4a75ee05418cefe60d2df50b42877ec68673f

SHA512
8a839e0d16806f472168092c8712063e408f09a19f47d479e9349cd831b6969d608056d5a88e8e02c44d2a9972aea1dba0e7e0ae3db2d97ac0820bb517b3c2ea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5849e5.TMP

Filesize
48B

MD5
30e473e6bee0f6f16fa8e54f2cf3a0e7

SHA1
e4afa9b9dd703ce38e6bc11153319deac258c178

SHA256
870a62485348ecf01657e9955eeab21e0c59050a13337cb55dc645a83173fe88

SHA512
587b786f45947dfb785c79cab7487588a33eca17f3c53f38befef7ecc62ac4aa74f788ed53e8320240a68bfe478c5f756f95795770e0547742d79334863e173b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
c45457a7b93513bfe5519a5f346be22e

SHA1
f2937b55b4b330ccca5b99c5580660366c40759c

SHA256
879ffcfaf0517584abab6c1c15f307781f778d59366b8bd4b908bbd272f00e31

SHA512
61e4c4527d744a472c5ac02469578cd1e6fb1875158f57604e069fdcff8ab9af1759f35b2e4ae8846242117078d77821175facc171edba6a83e7ef507fe1a6e6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe581b34.TMP

Filesize
702B

MD5
af2b7ee5c2991d34f3882c72faa8be66

SHA1
7b3500d8beaf9bbb524bb85fe01c926f855df59e

SHA256
cdac691b69ea987c2bc6522a5bf0c27c94e352457f5ff96a74a214db530c8774

SHA512
3ea0d64010d03d1f06b84ca46e13dd71174c3e97f11783628abc3238c3cf8f255804c6d4d3a4a8e4e6fc6d2cef6636fa4e4c5003434d74c6c53f63a617b0c33e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
04d48ea7152d2bfbedd214cb9831b0f4

SHA1
0bd8ef5653c7e475adf2f117ee01a367cfa957d1

SHA256
e3c5851fe0831cb7464800b59c66941ce20276a8e016139c15d0d9c6348c45ca

SHA512
b02c44e80a06776f297bba9190c2af1be78f9a36889394d23e09943008ec6aa7ddca2fc2decf10ed0bc797a413ba7fa6740b7312ac964a27e3f2970ddf8871f9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
45d2d25b37104de65797ef0153e752c1

SHA1
aed7c58d77307a1504e4c8fa7b0d5471c6964516

SHA256
48cd32f0337e6477e469155698b88452567c9891ad6d7104ad1cb5ad167a387d

SHA512
2313ef6587804bac567a25f31b0483c82fb5fe0ce53907fc1e6884cea0694ae4db7ae8663c8c25eb50fb1cf928d37260fb23ea43736606bce1f2b0d1317c4347

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
0468c4b95affd2b1b487a23187a7b7c3

SHA1
d4b5ff131f6099e166ac9e0dfe0894c83394458e

SHA256
cf7dfffbdb5092322d75af71b54cbc6b241109e8986bd02e727f30b999ed5960

SHA512
2609d5fd1083e08ce5e1d06d1aa0a1cea0c96544749c5a96f8e7ea7bbed187c185560747b8d286d5f8f3f7f820b05c93081797d7dcf74badc51f87151ecedf23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
58f479eeab44bf860ce3b5a49a0f9eb4

SHA1
304090445f12921d85d4806e4f11bb365402d731

SHA256
e97af70a08f3c9517777a63882a79db813f9cfd9c8c687e0a1ebdd059e5db059

SHA512
e1916bcb7e9206470a68ef684acb601d74cc03bbb2b2e4828070799afd3bebcc5c8b6cb37a13762fa4a56354526536f4f24cee67192076bdac483f47ee5484d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
f0a9cabcc33477a90a6615f2ef8f9c7e

SHA1
8201f707bfb9d5fd7a129f115af3346207948af4

SHA256
5fa60a5ae78956c687fb5c8cba508f83b680aaa0c225e9e2df972a0dc32d94f4

SHA512
4dbc70feaec464b5f195c2bd977ef9e64a33f1cc38ec652ea4b661b2e0fba7380a3ea1fab975f218b192529ef47b9a74615bdbb1b6590fceba12a6a831d5b118

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
77d622bb1a5b250869a3238b9bc1402b

SHA1
d47f4003c2554b9dfc4c16f22460b331886b191b

SHA256
f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb

SHA512
d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
948B

MD5
5824a6037c081fda5d46de274b6e2799

SHA1
526367a09300cbde430e8fb44e41cbe7a0937aac

SHA256
4d610d9cd32a20279c7133a726ff61820d6930e5aa18253ee1422f3a6f54953f

SHA512
a109b150f730cda78d5bee106bd232f9dca7500dfb7899c6919de2bd542e345ca271aa11809a24ea0a27dca158067ab3a2d5688ac0a2325185143245f1665582

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
276798eeb29a49dc6e199768bc9c2e71

SHA1
5fdc8ccb897ac2df7476fbb07517aca5b7a6205b

SHA256
cd0a1056e8f1b6cb5cb328532239d802f4e2aa8f8fcdc0fcb487684bd68e0dcc

SHA512
0d34fce64bbefc57d64fa6e03ca886952263d5f24df9c1c4cce6a1e8f5a47a9a21e9820f8d38caa7f7b43a52336ce00b738ea18419aaa7c788b72e04ce19e4f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
93cc6eec8dea64ae8438a01c62891700

SHA1
2f0d90d0dd6ec52c059d9ab762e808993b2e21f8

SHA256
d1fd2836c256db6061297b626f5d528225743a3c16ec8df2db4ef61415ff1110

SHA512
87be23a99476d72124ffce88f26f5d1b09bdb37135fdd916a9eee614b0edcd653167313bfb7081d315a81c670c8d84f6956d113f90708707837e8154e92d43af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
64B

MD5
c6aae9fb57ebd2ae201e8d174d820246

SHA1
58140d968de47bcf9c78938988a99369bbdb1f51

SHA256
bbc39a8da61fd8ec0d64e708e1ab4986f7fdf580581e464629bf040c595f7c08

SHA512
5959f7dab47bc4bad03635f497ca48f2e0740375528afddfc50964e54983e56df5970b25b8d8b28f1aa73cd6233fac83c634a311e759c58a365570e4862c3e3c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
96ff1ee586a153b4e7ce8661cabc0442

SHA1
140d4ff1840cb40601489f3826954386af612136

SHA256
0673399a2f37c89d455e8658c4d30b9248bff1ea47ba40957588e2bc862976e8

SHA512
3404370d0edb4ead4874ce68525dc9bcbc6008003682646e331bf43a06a24a467ace7eff5be701a822d74c7e065d0f6a0ba0e3d6bc505d34d0189373dcacb569

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
948B

MD5
07d142044fb78e359c794180a9c6fdff

SHA1
8a7155f93a53ff1b7f382a4ccb3f58ff2f88808e

SHA256
2af8c3ca529953085ca25f69d9142964e2ce5508665c14f3533a47d254fed3ea

SHA512
356edd3598c09b765c3de325bc47c5c8ae7fcfd87e8c58e12e8bb6437f1d7ce58310e06c4d64336815833e280f2e61c288edb09508c4f29876d28b0d602aeb78

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
45ad40f012b09e141955482368549640

SHA1
3f9cd15875c1e397c3b2b5592805577ae88a96cb

SHA256
ea3b59172f1a33677f9cb3843fb4d6093b806d3a7cf2f3c6d4692f5421f656ce

SHA512
3de08f8affca1c1450088f560776cf3d65146cadac43c06eb922c7b3cea436e519966cf38458303ffeb1a58c53f8952cffda6c34216fda7594e014b516e83b33

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4vqwgooi.pev.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\Downloads\nurik.zip

Filesize
93KB

MD5
bc06a3a16adb6071eb0f004b63394769

SHA1
27750fb054279354d63c5854b82b9ee8f7dfc241

SHA256
b9bdac7696f1b60ff2919048370f9ad1796368682911bac761b2e03cc0a05544

SHA512
686c0f0dd5423875dfb74f7c3f6a459a5a9880b3599fe87cd01a910a88a74c22e3239fecad16c651c51b1296cf75ad761a43db28f3522c49ee8cfd9225f99bb8

Download Submit
C:\Windows\system32\drivers\etc\hosts

Filesize
2KB

MD5
4028457913f9d08b06137643fe3e01bc

SHA1
a5cb3f12beaea8194a2d3d83a62bdb8d558f5f14

SHA256
289d433902418aaf62e7b96b215ece04fcbcef2457daf90f46837a4d5090da58

SHA512
c8e1eef90618341bbde885fd126ece2b1911ca99d20d82f62985869ba457553b4c2bf1e841fd06dacbf27275b3b0940e5a794e1b1db0fd56440a96592362c28b

Download Submit
memory/4388-326-0x00000192A0550000-0x00000192A05A0000-memory.dmp

Filesize
320KB

Download
memory/4388-325-0x00000192B8D70000-0x00000192B8DE6000-memory.dmp

Filesize
472KB

Download
memory/4388-297-0x000001929E650000-0x000001929E690000-memory.dmp

Filesize
256KB

Download
memory/4388-329-0x00000192A0520000-0x00000192A053E000-memory.dmp

Filesize
120KB

Download
memory/4388-378-0x00000192B8E30000-0x00000192B8E42000-memory.dmp

Filesize
72KB

Download
memory/4388-377-0x00000192B8E00000-0x00000192B8E0A000-memory.dmp

Filesize
40KB

Download
memory/5580-298-0x00000145C7CD0000-0x00000145C7CF2000-memory.dmp

Filesize
136KB

Download
memory/5932-538-0x000001D062550000-0x000001D062551000-memory.dmp

Filesize
4KB

Download
memory/5932-543-0x000001D062550000-0x000001D062551000-memory.dmp

Filesize
4KB

Download
memory/5932-542-0x000001D062550000-0x000001D062551000-memory.dmp

Filesize
4KB

Download
memory/5932-541-0x000001D062550000-0x000001D062551000-memory.dmp

Filesize
4KB

Download
memory/5932-540-0x000001D062550000-0x000001D062551000-memory.dmp

Filesize
4KB

Download
memory/5932-539-0x000001D062550000-0x000001D062551000-memory.dmp

Filesize
4KB

Download
memory/5932-537-0x000001D062550000-0x000001D062551000-memory.dmp

Filesize
4KB

Download
memory/5932-532-0x000001D062550000-0x000001D062551000-memory.dmp

Filesize
4KB

Download
memory/5932-533-0x000001D062550000-0x000001D062551000-memory.dmp

Filesize
4KB

Download
memory/5932-531-0x000001D062550000-0x000001D062551000-memory.dmp

Filesize
4KB

Download