umbral | hxxps://gofile[.]io/d/S0Gn3I

Analysis

max time kernel
1049s
max time network
1041s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
22-01-2025 22:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://gofile.io/d/S0Gn3I

Score

10^/10

umbral defense_evasion discovery execution spyware stealer

Malware Config

Signatures

Detect Umbral payload 2 IoCs

resource	yara_rule
behavioral1/files/0x001900000002aaf6-107.dat	family_umbral
behavioral1/memory/3240-395-0x0000022E074D0000-0x0000022E07552000-memory.dmp	family_umbral

Umbral
Umbral stealer is an opensource moduler stealer written in C#.
stealer umbral
Umbral family
umbral

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2952	powershell.exe
1048	powershell.exe
3888	powershell.exe
3628	powershell.exe

Downloads MZ/PE file

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	CorruptX 1.3.exe

Executes dropped EXE 1 IoCs

pid	Process
3240	CorruptX 1.3.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
4	discord.com
77	discord.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
2	ip-api.com

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\CorruptX 1.3.exe:Zone.Identifier	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4244	cmd.exe
776	PING.EXE

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
3496	wmic.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 56 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = ffffffff	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616193"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a000000a000000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Downloads"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 3a001f44471a0359723fa74489c55595fe6b30ee260001002600efbe10000000a7150e1bb218db01a4fff9b5ba18db0121ee7e161b6ddb0114000000	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByDirection = "1"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1"	msedge.exe
Key created	\Registry\User\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\NotificationData	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Mode = "1"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupView = "0"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1092616193"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\KnownFolderDerivedFolderType = "{885A186E-A440-4ADA-812B-DB871B942259}"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\NodeSlot = "2"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e8005398e082303024b98265d99428e115f0000	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\IconSize = "48"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\LogicalViewMode = "3"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:PID = "0"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0000000001000000ffffffff	msedge.exe

NTFS ADS 5 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\CorruptX 1.3.exe:Zone.Identifier	msedge.exe
File created	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\zdw3a.scr\:SmartScreen:$DATA	CorruptX 1.3.exe
File created	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\zdw3a.scr\:Zone.Identifier:$DATA	CorruptX 1.3.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 303735.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 505258.crdownload:SmartScreen	msedge.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
776	PING.EXE

Suspicious behavior: EnumeratesProcesses 33 IoCs

pid	Process
3616	msedge.exe
3616	msedge.exe
4248	msedge.exe
4248	msedge.exe
1472	identity_helper.exe
1472	identity_helper.exe
3604	msedge.exe
3604	msedge.exe
2776	msedge.exe
2776	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4720	msedge.exe
4720	msedge.exe
3240	CorruptX 1.3.exe
3240	CorruptX 1.3.exe
2952	powershell.exe
2952	powershell.exe
2952	powershell.exe
1048	powershell.exe
1048	powershell.exe
1048	powershell.exe
3888	powershell.exe
3888	powershell.exe
3888	powershell.exe
4424	powershell.exe
4424	powershell.exe
4424	powershell.exe
3628	powershell.exe
3628	powershell.exe
3628	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4720	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 21 IoCs

pid	Process
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3240	CorruptX 1.3.exe
Token: SeIncreaseQuotaPrivilege	2984	wmic.exe
Token: SeSecurityPrivilege	2984	wmic.exe
Token: SeTakeOwnershipPrivilege	2984	wmic.exe
Token: SeLoadDriverPrivilege	2984	wmic.exe
Token: SeSystemProfilePrivilege	2984	wmic.exe
Token: SeSystemtimePrivilege	2984	wmic.exe
Token: SeProfSingleProcessPrivilege	2984	wmic.exe
Token: SeIncBasePriorityPrivilege	2984	wmic.exe
Token: SeCreatePagefilePrivilege	2984	wmic.exe
Token: SeBackupPrivilege	2984	wmic.exe
Token: SeRestorePrivilege	2984	wmic.exe
Token: SeShutdownPrivilege	2984	wmic.exe
Token: SeDebugPrivilege	2984	wmic.exe
Token: SeSystemEnvironmentPrivilege	2984	wmic.exe
Token: SeRemoteShutdownPrivilege	2984	wmic.exe
Token: SeUndockPrivilege	2984	wmic.exe
Token: SeManageVolumePrivilege	2984	wmic.exe
Token: 33	2984	wmic.exe
Token: 34	2984	wmic.exe
Token: 35	2984	wmic.exe
Token: 36	2984	wmic.exe
Token: SeIncreaseQuotaPrivilege	2984	wmic.exe
Token: SeSecurityPrivilege	2984	wmic.exe
Token: SeTakeOwnershipPrivilege	2984	wmic.exe
Token: SeLoadDriverPrivilege	2984	wmic.exe
Token: SeSystemProfilePrivilege	2984	wmic.exe
Token: SeSystemtimePrivilege	2984	wmic.exe
Token: SeProfSingleProcessPrivilege	2984	wmic.exe
Token: SeIncBasePriorityPrivilege	2984	wmic.exe
Token: SeCreatePagefilePrivilege	2984	wmic.exe
Token: SeBackupPrivilege	2984	wmic.exe
Token: SeRestorePrivilege	2984	wmic.exe
Token: SeShutdownPrivilege	2984	wmic.exe
Token: SeDebugPrivilege	2984	wmic.exe
Token: SeSystemEnvironmentPrivilege	2984	wmic.exe
Token: SeRemoteShutdownPrivilege	2984	wmic.exe
Token: SeUndockPrivilege	2984	wmic.exe
Token: SeManageVolumePrivilege	2984	wmic.exe
Token: 33	2984	wmic.exe
Token: 34	2984	wmic.exe
Token: 35	2984	wmic.exe
Token: 36	2984	wmic.exe
Token: SeDebugPrivilege	2952	powershell.exe
Token: SeDebugPrivilege	1048	powershell.exe
Token: SeDebugPrivilege	3888	powershell.exe
Token: SeDebugPrivilege	4424	powershell.exe
Token: SeIncreaseQuotaPrivilege	1096	wmic.exe
Token: SeSecurityPrivilege	1096	wmic.exe
Token: SeTakeOwnershipPrivilege	1096	wmic.exe
Token: SeLoadDriverPrivilege	1096	wmic.exe
Token: SeSystemProfilePrivilege	1096	wmic.exe
Token: SeSystemtimePrivilege	1096	wmic.exe
Token: SeProfSingleProcessPrivilege	1096	wmic.exe
Token: SeIncBasePriorityPrivilege	1096	wmic.exe
Token: SeCreatePagefilePrivilege	1096	wmic.exe
Token: SeBackupPrivilege	1096	wmic.exe
Token: SeRestorePrivilege	1096	wmic.exe
Token: SeShutdownPrivilege	1096	wmic.exe
Token: SeDebugPrivilege	1096	wmic.exe
Token: SeSystemEnvironmentPrivilege	1096	wmic.exe
Token: SeRemoteShutdownPrivilege	1096	wmic.exe
Token: SeUndockPrivilege	1096	wmic.exe
Token: SeManageVolumePrivilege	1096	wmic.exe

Suspicious use of FindShellTrayWindow 43 IoCs

pid	Process
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4720	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4248 wrote to memory of 4480	4248	msedge.exe	77
PID 4248 wrote to memory of 4480	4248	msedge.exe	77
PID 4248 wrote to memory of 3540	4248	msedge.exe	78
PID 4248 wrote to memory of 3540	4248	msedge.exe	78
PID 4248 wrote to memory of 3540	4248	msedge.exe	78
PID 4248 wrote to memory of 3540	4248	msedge.exe	78
PID 4248 wrote to memory of 3540	4248	msedge.exe	78
PID 4248 wrote to memory of 3540	4248	msedge.exe	78
PID 4248 wrote to memory of 3540	4248	msedge.exe	78
PID 4248 wrote to memory of 3540	4248	msedge.exe	78
PID 4248 wrote to memory of 3540	4248	msedge.exe	78
PID 4248 wrote to memory of 3540	4248	msedge.exe	78
PID 4248 wrote to memory of 3540	4248	msedge.exe	78
PID 4248 wrote to memory of 3540	4248	msedge.exe	78
PID 4248 wrote to memory of 3540	4248	msedge.exe	78
PID 4248 wrote to memory of 3540	4248	msedge.exe	78
PID 4248 wrote to memory of 3540	4248	msedge.exe	78
PID 4248 wrote to memory of 3540	4248	msedge.exe	78
PID 4248 wrote to memory of 3540	4248	msedge.exe	78
PID 4248 wrote to memory of 3540	4248	msedge.exe	78
PID 4248 wrote to memory of 3540	4248	msedge.exe	78
PID 4248 wrote to memory of 3540	4248	msedge.exe	78
PID 4248 wrote to memory of 3540	4248	msedge.exe	78
PID 4248 wrote to memory of 3540	4248	msedge.exe	78
PID 4248 wrote to memory of 3540	4248	msedge.exe	78
PID 4248 wrote to memory of 3540	4248	msedge.exe	78
PID 4248 wrote to memory of 3540	4248	msedge.exe	78
PID 4248 wrote to memory of 3540	4248	msedge.exe	78
PID 4248 wrote to memory of 3540	4248	msedge.exe	78
PID 4248 wrote to memory of 3540	4248	msedge.exe	78
PID 4248 wrote to memory of 3540	4248	msedge.exe	78
PID 4248 wrote to memory of 3540	4248	msedge.exe	78
PID 4248 wrote to memory of 3540	4248	msedge.exe	78
PID 4248 wrote to memory of 3540	4248	msedge.exe	78
PID 4248 wrote to memory of 3540	4248	msedge.exe	78
PID 4248 wrote to memory of 3540	4248	msedge.exe	78
PID 4248 wrote to memory of 3540	4248	msedge.exe	78
PID 4248 wrote to memory of 3540	4248	msedge.exe	78
PID 4248 wrote to memory of 3540	4248	msedge.exe	78
PID 4248 wrote to memory of 3540	4248	msedge.exe	78
PID 4248 wrote to memory of 3540	4248	msedge.exe	78
PID 4248 wrote to memory of 3540	4248	msedge.exe	78
PID 4248 wrote to memory of 3616	4248	msedge.exe	79
PID 4248 wrote to memory of 3616	4248	msedge.exe	79
PID 4248 wrote to memory of 2132	4248	msedge.exe	80
PID 4248 wrote to memory of 2132	4248	msedge.exe	80
PID 4248 wrote to memory of 2132	4248	msedge.exe	80
PID 4248 wrote to memory of 2132	4248	msedge.exe	80
PID 4248 wrote to memory of 2132	4248	msedge.exe	80
PID 4248 wrote to memory of 2132	4248	msedge.exe	80
PID 4248 wrote to memory of 2132	4248	msedge.exe	80
PID 4248 wrote to memory of 2132	4248	msedge.exe	80
PID 4248 wrote to memory of 2132	4248	msedge.exe	80
PID 4248 wrote to memory of 2132	4248	msedge.exe	80
PID 4248 wrote to memory of 2132	4248	msedge.exe	80
PID 4248 wrote to memory of 2132	4248	msedge.exe	80
PID 4248 wrote to memory of 2132	4248	msedge.exe	80
PID 4248 wrote to memory of 2132	4248	msedge.exe	80
PID 4248 wrote to memory of 2132	4248	msedge.exe	80
PID 4248 wrote to memory of 2132	4248	msedge.exe	80
PID 4248 wrote to memory of 2132	4248	msedge.exe	80
PID 4248 wrote to memory of 2132	4248	msedge.exe	80
PID 4248 wrote to memory of 2132	4248	msedge.exe	80
PID 4248 wrote to memory of 2132	4248	msedge.exe	80

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
3872	attrib.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://gofile.io/d/S0Gn3I
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff8feab3cb8,0x7ff8feab3cc8,0x7ff8feab3cd8
  2⤵
  PID:4480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1868,873086940474382066,8538751664818631973,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1864 /prefetch:2
  2⤵
  PID:3540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1868,873086940474382066,8538751664818631973,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2384 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1868,873086940474382066,8538751664818631973,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2784 /prefetch:8
  2⤵
  PID:2132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,873086940474382066,8538751664818631973,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:4688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,873086940474382066,8538751664818631973,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:2356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,873086940474382066,8538751664818631973,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4276 /prefetch:1
  2⤵
  PID:852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,873086940474382066,8538751664818631973,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4904 /prefetch:1
  2⤵
  PID:996
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1868,873086940474382066,8538751664818631973,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5456 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1868,873086940474382066,8538751664818631973,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3904 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,873086940474382066,8538751664818631973,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2752 /prefetch:1
  2⤵
  PID:3312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,873086940474382066,8538751664818631973,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5732 /prefetch:1
  2⤵
  PID:400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,873086940474382066,8538751664818631973,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5520 /prefetch:1
  2⤵
  PID:4708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1868,873086940474382066,8538751664818631973,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6108 /prefetch:8
  2⤵
  PID:2884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1868,873086940474382066,8538751664818631973,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6128 /prefetch:8
  2⤵
  PID:4612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1868,873086940474382066,8538751664818631973,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4556 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:2776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,873086940474382066,8538751664818631973,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5628 /prefetch:1
  2⤵
  PID:1856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,873086940474382066,8538751664818631973,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6092 /prefetch:1
  2⤵
  PID:4820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,873086940474382066,8538751664818631973,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5264 /prefetch:1
  2⤵
  PID:3360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,873086940474382066,8538751664818631973,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5260 /prefetch:1
  2⤵
  PID:4056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,873086940474382066,8538751664818631973,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4944 /prefetch:1
  2⤵
  PID:4280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,873086940474382066,8538751664818631973,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6492 /prefetch:1
  2⤵
  PID:5104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,873086940474382066,8538751664818631973,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4948 /prefetch:1
  2⤵
  PID:4932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,873086940474382066,8538751664818631973,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5584 /prefetch:1
  2⤵
  PID:4292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,873086940474382066,8538751664818631973,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6500 /prefetch:1
  2⤵
  PID:1988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,873086940474382066,8538751664818631973,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5900 /prefetch:1
  2⤵
  PID:1864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,873086940474382066,8538751664818631973,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4868 /prefetch:1
  2⤵
  PID:480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,873086940474382066,8538751664818631973,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6632 /prefetch:1
  2⤵
  PID:4804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,873086940474382066,8538751664818631973,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6568 /prefetch:1
  2⤵
  PID:800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,873086940474382066,8538751664818631973,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5556 /prefetch:1
  2⤵
  PID:3236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1868,873086940474382066,8538751664818631973,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5092 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1868,873086940474382066,8538751664818631973,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5020 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:4720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=1868,873086940474382066,8538751664818631973,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5176 /prefetch:8
  2⤵
  PID:4744

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4504

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2700

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4948

C:\Users\Admin\Downloads\CorruptX 1.3.exe
"C:\Users\Admin\Downloads\CorruptX 1.3.exe"
1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3240
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" csproduct get uuid
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2984
- C:\Windows\SYSTEM32\attrib.exe
  "attrib.exe" +h +s "C:\Users\Admin\Downloads\CorruptX 1.3.exe"
  2⤵
  - Views/modifies file attributes
  PID:3872
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\Downloads\CorruptX 1.3.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2952
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1048
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3888
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4424
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" os get Caption
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1096
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" computersystem get totalphysicalmemory
  2⤵
  PID:772
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" csproduct get uuid
  2⤵
  PID:1232
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:3628
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" path win32_VideoController get name
  2⤵
  - Detects videocard installed
  PID:3496
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\Downloads\CorruptX 1.3.exe" && pause
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:4244
- - C:\Windows\system32\PING.EXE
    ping localhost
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:776

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
627073ee3ca9676911bee35548eff2b8

SHA1
4c4b68c65e2cab9864b51167d710aa29ebdcff2e

SHA256
85b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c

SHA512
3c5f6c03e253b83c57e8d6f0334187dbdcdf4fa549eecd36cbc1322dca6d3ca891dc6a019c49ec2eafb88f82d0434299c31e4dfaab123acb42e0546218f311fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d7145ec3fa29a4f2df900d1418974538

SHA1
1368d579635ba1a53d7af0ed89bf0b001f149f9d

SHA256
efc56eb46cf3352bf706c0309d5d740bca6ac06142f9bdc5e8344b81d4d83d59

SHA512
5bb663ede88f8b7c96b09c1214aac68eda99bc09525ac383baa96914ff7d553ea1aed09e3c9d16893d791c81ddb164c682dfbb4759ac0bc751221f3e36558a91

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d91478312beae099b8ed57e547611ba2

SHA1
4b927559aedbde267a6193e3e480fb18e75c43d7

SHA256
df43cd7779d9fc91fd0416155d6771bc81565e98be38689cb17caece256bf043

SHA512
4086c4ebe410a37d0124fc8bd00c58775e70ab2b7b5a39b4e49b332ce5b4866c6775707436395467aff9596507c96fb4896f3bf0249c5b9c99a927f31dcc1a96

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
db045baf64311ec66fe41dc30bc28f93

SHA1
92b9dde67c574dd18f1994006405df0e5b570d77

SHA256
a369dbb09d26de3d345e5b7491498f31c5d6b2340fc50565f7a8faa0f4c974ee

SHA512
bc739679dd4b67ef009d49a52188281989c99ec0a0f55b6c6861a16ebb1b124cf86aa306c9bbed0fe2f84051187592e693175081d14fbfb20c772ca5bc737c7b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
11bc37bbfd9427ef9b6ce3e61f63b55d

SHA1
c6d45d441e6a22225402646fd1e1a0258fb35831

SHA256
c88cdf4eaf60f3e584c855713881b717b1d93d986c4e70970a3ca73a0e829d7b

SHA512
f8cfa7b8705408ff589ca0f4819b703992c374c1174676bb5de7986e305ced12f2f05b887f64b83799ace8aa9d193cd28869831eb9e617e60ed0cd1af4313847

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies

Filesize
28KB

MD5
def0abb8bffb9a60bd12591c965ff38a

SHA1
8a7e5ab0b6a315e7df7d12e8751a268565409848

SHA256
bf99bd0d5f1827e5e8593f2936b90924ca815bebc229d35be5991ec457c4ff2d

SHA512
0a1d6182f50d85f7f23826021ccfa6b8c70fe26344f2e0d1b6da56319e2b5b04951d32fdd5c8ebb5973d950a65d4f12a6a2a4ed79d870797b46bdf16c24a879a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log

Filesize
1KB

MD5
d5bde528504e0f7e9d93455e2900dfe9

SHA1
6a542a3dda1948a95be908341271b81ee59b4882

SHA256
b312fcfe15482996cb38a67877f110ed28431e1c3222e6e9136df78c9fd11bb6

SHA512
f4c00f1b92c841923cfa54c32389de5b44791cd09eb034ba25e044ea9eee900a487fcc4208f238b9abaf4c7267832c307016553ae9997c907086be1b5df86db9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
6f3e3d636f121a4c60bf2cf49d31da04

SHA1
8ba87cb894aac6873d9986d59b885e998bfe4e48

SHA256
83aaa7c3f5e14503630d82c806e3e5674861b93b9f56d92f257aac1880c8e5a7

SHA512
1fb477c5acbceb988e5dc9bcc3396e353387b6dfe563de4dba367578e28b55c2fd8445b15d379e0b3213833c7161891cf569637237bfb34c17b22eb26da1466a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
93509145e75c86e5a920da17cc6b6a67

SHA1
122cd7e6322eb3e1e071fd2da34e944660f2bdab

SHA256
30433ef31d330be61c82a78722b5f6db794fb4ddc16b5bb80b9a552b14d25bfb

SHA512
b76b5c09f9e5ff75b11a5a954aa1efafffc10d86db8183104666c170e952968839d47783876ca2f039de82799e709698b2da6f605260fc265939fdeadd7b696f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
c54572a811ab5409cf9e0074861afb2d

SHA1
d586fa441fc7015d9fd2c51b138cc7d0c25fb395

SHA256
71c5c5364749e448a8661d15cb07279e8150091cda6c1c1ec5133173b33b20ea

SHA512
479900eae36651671789f6eca23cd57f05edc902729d750400ffd7f0df37fcc08096c9094c1d737b440b43b824d1aba8aa18040d5f4d3d828e8d48287f691281

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
57503d87129c1113dd1843d9fbbe749d

SHA1
052d6b839c08da5ff44d14b3272a3879784c3cd8

SHA256
93a51577965e5f293d111d08c8f19f1e669d030cba3bed150d9a7c810fae3a53

SHA512
6246106c10c2a307befcc5fcfd0747970959a62838a60afc34c0eb56895cce0aa5b31d8bac2ce7bcdec3159038154d330c42c35331fa121e6fa831068ea9d52b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
aab50328e781e228967e6ff6265a6fbf

SHA1
a7fe2cbbf801cb0eeedb35e1af6f7838cf73a086

SHA256
5c15bd68112fc9f860d58857c97d7337d2ff1fb78ec318eb6a280f7d666ba192

SHA512
24730996717f3cea4c2b713f705a6d01abb936edea21a721e26e0a7da16ddf0f95764e58ae3b8e57db80324eeae0a903cb6d9b21bace95949935bd0a2cda1bf5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
a883d15049e3bc399110bdfd4cc83a7f

SHA1
b261b72b71990a9cea18c99f2392cf26f6e540ef

SHA256
3c88824b2247c4c31d9dcb78b931c2601735579c9f7ce02eb9c5f13524ad8e85

SHA512
53e1990ae32c77e0ae338748c22956337adbc0c235c92aee20d125c7910991a273705d56acf111baa01723c56a232aca00af83350827ce63c4cc425b74f56a01

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
ea2d735178cbeceb449a1bfea03cf054

SHA1
8e920947b5352ac7ba28f065529224f3247f6c6c

SHA256
83fa764400459052a2cf9101d6bcff5883b64a1632150e5d332f8458d9a91c07

SHA512
4d8ed4edacc0304537a8f17c5c149466dddfa74b44e07174396ac768716f80805c3866c5a52438440e36cefed9f01c04ef7084255520261bfe02770ec45a1257

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
f7be638cc9219876875174167a3dbbad

SHA1
3189994e2cfb25bdb6ab03f9d97727b7be7edea8

SHA256
8a23549e8294fc6b3878ff0b8110a07b9a516a47411a492859e8394cece782bb

SHA512
413bd1131b9bba0baa7a3cc88207424173a8eb3a2eba117b8075c6e08a016a559b4453cd88192a63568d7fbd6623a97b058237afd8f8f5f40eb6df8e33c00fd3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
46c6f434ed37387e45c927741b7fc57a

SHA1
924e32cfa1212aa0eaaaf25e267fa7a51a61f0b7

SHA256
c2a0ef6847e3edc1999997787113a9a45b3d1cd0919b72a4ea195cc38e69e1f9

SHA512
83196d645c439c6fd7842da79f2b60042962a0e9606f06ee1f9c6a46e70423f55b88483bcc6970b05592b1c6d2c949fb5da6b7f40c16d046f71f5fef3da24273

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5ca5c03ee2d46f4344ef48b87e41ddad

SHA1
868eb2a4199ae7b553a5be2566bb3d9b4645f51a

SHA256
e721feb3686cd5480a6c347236a4d7d642b4efb91100d82d69c9f2b32c97942d

SHA512
7a7d282578ffd9b323b4635c0b9c5813473d012f330cf2f30b96a808072113fc9ba0533f26a58dd6a51a3e5ad31e38aa1876cbd348f0a5a6747557b544dcb874

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
c72ef06766ae7cc57b43d3d9fbbe6efb

SHA1
85ba4fbcb35a190f100bcd5bd38abc4a6589610a

SHA256
bb4b8c9511c863ce6202a5f5d6def0d00f24f83eaba6b16ef6b0e4f689f6fe94

SHA512
004df370a40301ddae1837f2c45cf9da54dc0aeb2bdb94690937828fd1d607dfd4976b9522b92d5e656497b020c82100e69c4bef48b590b215abe93a40aeb2eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
538B

MD5
ee5c8525ca3a5c452f2b5d9541dbba53

SHA1
27ba68a71941187dd4ef2c0b9b8ec2dacaca7512

SHA256
a8092879116b713e60751605f75c0e90fb10f29909189aeacc0c1c33227181d9

SHA512
ee9fdb5675f72fd4175ee669cdf4c19b5dc5f4a012ca0125b6be5e81b02d811e907f5064a5d1bc5a48e108f73aba07951a8b4916261f5747b3f6aab82b1d81b5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
fe62d6b565920407c4394672d298c315

SHA1
9355690a61c3e0d21954ccaebc520a671f15c94f

SHA256
8d240f652554abb2e99071b780992cf1f205bc39a6fcedd1a02cfd020cc5d403

SHA512
20018265f117c93341b936cfcd3fae8b1871b57badab4fea279d65cea9bab9cc11547a62862c885067ec15097b2671066cfe439f44caa0f5f0034b688f09db1d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe582248.TMP

Filesize
538B

MD5
560a9cd9690a59b629192d41f8fdbcb3

SHA1
8c0b0595c7b95e9bcbcc049e368cc78c704ee418

SHA256
85a3e14ef2284089e2e23296e74a9022a1500326d610639bff6d0f2d2fdfb291

SHA512
d21c74c3e01b357980da4be8d74d97a2c596561dbf355c71729a47cdc6bad267c84a813280adce84158cfaf664af0d036cb0aeae48e44d191008e50bc0ad0f22

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ae1cdf4e-3ebf-4868-9329-81236d3ec6e2.tmp

Filesize
6KB

MD5
2889b64ae151d17435d3186b158fe471

SHA1
76e238b4deb7faf3c551a0980f035f393efe4874

SHA256
ff710cb87ea8cb715f0fd27d545fc2da8e0f9f229b2ab86ce8a22bd89e429acd

SHA512
c8f9fc7858cccf34b3fe8b3b92b261bc1f703b7a82fb87468cf1c4b5796c75259c78d420af5217cff7c117505d8e6b316fdb4b6895b45bf46c7e8ddf4bcdcf1a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
80d08124e049427e72d945e68208e797

SHA1
e6bde09491e4dacbcbbbfbd4fc378e9eb3c2c71b

SHA256
b2ccc53fcb6d6c59c62d043d35c612972dea86704885a34a37b25886d14dad6e

SHA512
54ed146de307e7738d8c1911293c9cd2eba5940f9d1b1f45fbcdd911932876cbf01f08a27f616724dd76f37bb6a13226e1fcded3d9289ae475cc5cfce06293b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
ea31b5177fb3c9245f163fe59c2dfc46

SHA1
60965c9c45b9523d0ae816f9d9a722dfd7a68af0

SHA256
fc33fdc909f40a629399aac036c3769ce049931f5b1b1176ef4d51deb0244d7a

SHA512
2f3ff5007ad3ffce4086cbffaf7f0c0b226bd39f15a70d284e27142f25430d7b235e7c4871ef113ce451714eb344d753a327debeb707c4e80384ffa8b4345909

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
ad7425fc8ffefd33c55bdecffed60f34

SHA1
ca92fdd2e8209994264b5d593b871ac0b90db7dc

SHA256
cf172bf5cdd67691812aca38437561eb0f1a7e00dc0623e4d8bbcb0e16120103

SHA512
381666979e9cd0957ab60a15bc2f77b07638dba3af86472a197823aafd881bb102d0fe60df72c25e2ed56038344afe42467fddd68f395c7b245e5154a20c70f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
d0a4a3b9a52b8fe3b019f6cd0ef3dad6

SHA1
fed70ce7834c3b97edbd078eccda1e5effa527cd

SHA256
21942e513f223fdad778348fbb20617dd29f986bccd87824c0ae7f15649f3f31

SHA512
1a66f837b4e7fb6346d0500aeacb44902fb8a239bce23416271263eba46fddae58a17075e188ae43eb516c841e02c87e32ebd73256c7cc2c0713d00c35f1761b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
948B

MD5
2558af65fa0e0fdff802046cb4d87e66

SHA1
a90d8668d426b2f552f27543bfc2b444c1511d0f

SHA256
76832b70fd9ab098e34e086fb3b0ae3b88fd1c39814918057afd8cde1dc84fd0

SHA512
a6c5a20e0fab4eb6cb4ea31ab24282cc056e3ace878af4fee5c20d17244657b2285a7e7ca93b2ae7c25e498294b9cdee519fe9709373cfb62be527015830b356

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
cd5b2555a0e703bc746e242654a09c2f

SHA1
4021bfba22c0fce16709bfa6140d11272b7bd8b4

SHA256
73679042b477828c6c8400590ca1434f5f6b7379aede1442f80bb9ede3bc7811

SHA512
404a94bbc1cbcf98dba90160ab65a8acc5a1660d801bf7425ab1fe641599bda1b6494d4d6b65c6584e4ca6c1dea4b1acfde88e4a6d216194dca3b6ae6ca605f1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
61c0e30b727bbcebbee142c90b189c6e

SHA1
951c0ad5a6b08e8c9f0352c66e645be44861ff02

SHA256
eb18ed7301baabd4f177e641ebb75bbdb6eb751e2a4888157aba9ed52968a8e9

SHA512
a9a0f8eba02ca2d56b1a916d135d8b4acd411e0ef17186f9d24fc227a4a99cc3fc4067c990b0b94c13a99f161a8e24c15e3037d1a42b538279031272f9336438

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ce5u3dga.mof.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\Downloads\CorruptX 1.3.exe:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 303735.crdownload

Filesize
581KB

MD5
3d9465d5161ac2ab5a83265935514349

SHA1
5d40047faf2a166e6c25f106c244b5826bd0aad9

SHA256
24d1f432632c971456e6db676f609772b98d0cf3d3a5450c78d3dbb75744399e

SHA512
8d84de25fcb88ad6786de9f077612d356eed8726a50e9b6c44a3dff456ca8a160e0707cd1902b52e4890f97f4a5a72466ac149e71d1e790267141a6710ecc70d

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 505258.crdownload

Filesize
495KB

MD5
c57206c732c6cfaa8a4de6495732c8de

SHA1
eb4127b4a20b05a3db766b3c953f0e12eb3070e9

SHA256
0465cfcd8ec390d5d4e321ca1609ee70be881b906754cb5e783201114d922fcf

SHA512
f1205d7c5daaa6b38ec121200875c8355857252ad4d474ce629c8584e73933e050e4f74c968617908044b9e819bc099dab8866e4f065acd4aa0b203001d1a6c9

Download Submit
C:\Windows\system32\drivers\etc\hosts

Filesize
2KB

MD5
4028457913f9d08b06137643fe3e01bc

SHA1
a5cb3f12beaea8194a2d3d83a62bdb8d558f5f14

SHA256
289d433902418aaf62e7b96b215ece04fcbcef2457daf90f46837a4d5090da58

SHA512
c8e1eef90618341bbde885fd126ece2b1911ca99d20d82f62985869ba457553b4c2bf1e841fd06dacbf27275b3b0940e5a794e1b1db0fd56440a96592362c28b

Download Submit
memory/2952-398-0x0000014E6B780000-0x0000014E6B7A2000-memory.dmp

Filesize
136KB

Download
memory/3240-395-0x0000022E074D0000-0x0000022E07552000-memory.dmp

Filesize
520KB

Download
memory/3240-467-0x0000022E09280000-0x0000022E09292000-memory.dmp

Filesize
72KB

Download
memory/3240-466-0x0000022E07A50000-0x0000022E07A5A000-memory.dmp

Filesize
40KB

Download
memory/3240-425-0x0000022E21D30000-0x0000022E21DA6000-memory.dmp

Filesize
472KB

Download
memory/3240-426-0x0000022E092B0000-0x0000022E09300000-memory.dmp

Filesize
320KB

Download
memory/3240-429-0x0000022E21DB0000-0x0000022E21DCE000-memory.dmp

Filesize
120KB

Download