umbral | hxxps://gofile[.]io/d/cTww9O

Analysis

max time kernel
207s
max time network
203s
platform
windows11-21h2_x64
resource
win11-20241023-en
resource tags

arch:x64arch:x86image:win11-20241023-enlocale:en-usos:windows11-21h2-x64system
submitted
26-01-2025 02:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://gofile.io/d/cTww9O

Score

10^/10

umbral defense_evasion discovery execution spyware stealer

Malware Config

Signatures

Detect Umbral payload 2 IoCs

resource	yara_rule
behavioral1/files/0x001b00000002ab01-57.dat	family_umbral
behavioral1/memory/3812-132-0x000002A4CBB30000-0x000002A4CBB70000-memory.dmp	family_umbral

Umbral
Umbral stealer is an opensource moduler stealer written in C#.
stealer umbral
Umbral family
umbral

Command and Scripting Interpreter: PowerShell 1 TTPs 24 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2432	powershell.exe
2532	powershell.exe
4644	powershell.exe
1416	powershell.exe
3592	powershell.exe
4384	powershell.exe
2432	powershell.exe
2832	powershell.exe
248	powershell.exe
1964	powershell.exe
1040	powershell.exe
1096	powershell.exe
1680	powershell.exe
1936	powershell.exe
3752	powershell.exe
860	powershell.exe
3964	powershell.exe
3416	powershell.exe
3148	powershell.exe
3852	powershell.exe
2100	powershell.exe
4040	powershell.exe
1632	powershell.exe
648	powershell.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
26	5024	msedge.exe

Executes dropped EXE 8 IoCs

pid	Process
3812	mapleC2.exe
4072	mapleC2.exe
4640	mapleC2.exe
3860	mapleC2.exe
2232	mapleC2.exe
2028	mapleC2.exe
3388	mapleC2.exe
1496	mapleC2.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Legitimate hosting services abused for malware hosting/C2 1 TTPs 7 IoCs

Web Service

T1102

flow	ioc
76	discord.com
80	discord.com
10	discord.com
30	discord.com
34	discord.com
52	discord.com
56	discord.com

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
12	ip-api.com
73	ip-api.com
11	ip-api.com

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\mapleC2.exe:Zone.Identifier	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Detects videocard installed 1 TTPs 6 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
4236	wmic.exe
4752	wmic.exe
3456	wmic.exe
2700	wmic.exe
1884	wmic.exe
2000	wmic.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings\MuiCache	MiniSearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	BackgroundTransferHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	BackgroundTransferHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	BackgroundTransferHost.exe
Key created	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings\MuiCache	BackgroundTransferHost.exe

NTFS ADS 9 IoCs

description	ioc	Process
File created	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\SJtob.scr\:SmartScreen:$DATA	mapleC2.exe
File created	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\1l09l.scr\:SmartScreen:$DATA	mapleC2.exe
File created	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\DD5YM.scr\:SmartScreen:$DATA	mapleC2.exe
File created	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\89xBB.scr\:SmartScreen:$DATA	mapleC2.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 850422.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\mapleC2.exe:Zone.Identifier	msedge.exe
File created	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\SJtob.scr\:Zone.Identifier:$DATA	mapleC2.exe
File created	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\BvSsH.scr\:SmartScreen:$DATA	mapleC2.exe
File created	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\UYnVA.scr\:SmartScreen:$DATA	mapleC2.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5024	msedge.exe
5024	msedge.exe
2968	msedge.exe
2968	msedge.exe
3720	identity_helper.exe
3720	identity_helper.exe
884	msedge.exe
884	msedge.exe
4228	msedge.exe
4228	msedge.exe
3812	mapleC2.exe
3812	mapleC2.exe
1416	powershell.exe
1416	powershell.exe
1416	powershell.exe
3964	powershell.exe
3964	powershell.exe
3964	powershell.exe
248	powershell.exe
248	powershell.exe
248	powershell.exe
3468	powershell.exe
3468	powershell.exe
3468	powershell.exe
3416	powershell.exe
3416	powershell.exe
3416	powershell.exe
4072	mapleC2.exe
3592	powershell.exe
3592	powershell.exe
3592	powershell.exe
1096	powershell.exe
1096	powershell.exe
1096	powershell.exe
1964	powershell.exe
1964	powershell.exe
1964	powershell.exe
4040	powershell.exe
4040	powershell.exe
4040	powershell.exe
1040	powershell.exe
1040	powershell.exe
1040	powershell.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
3860	mapleC2.exe
3860	mapleC2.exe
4384	powershell.exe
4384	powershell.exe
4384	powershell.exe
4040	powershell.exe
4040	powershell.exe
4040	powershell.exe
3148	powershell.exe
3148	powershell.exe
3148	powershell.exe
2544	powershell.exe
2544	powershell.exe
2544	powershell.exe
1936	powershell.exe
1936	powershell.exe
1936	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3812	mapleC2.exe
Token: SeIncreaseQuotaPrivilege	1512	wmic.exe
Token: SeSecurityPrivilege	1512	wmic.exe
Token: SeTakeOwnershipPrivilege	1512	wmic.exe
Token: SeLoadDriverPrivilege	1512	wmic.exe
Token: SeSystemProfilePrivilege	1512	wmic.exe
Token: SeSystemtimePrivilege	1512	wmic.exe
Token: SeProfSingleProcessPrivilege	1512	wmic.exe
Token: SeIncBasePriorityPrivilege	1512	wmic.exe
Token: SeCreatePagefilePrivilege	1512	wmic.exe
Token: SeBackupPrivilege	1512	wmic.exe
Token: SeRestorePrivilege	1512	wmic.exe
Token: SeShutdownPrivilege	1512	wmic.exe
Token: SeDebugPrivilege	1512	wmic.exe
Token: SeSystemEnvironmentPrivilege	1512	wmic.exe
Token: SeRemoteShutdownPrivilege	1512	wmic.exe
Token: SeUndockPrivilege	1512	wmic.exe
Token: SeManageVolumePrivilege	1512	wmic.exe
Token: 33	1512	wmic.exe
Token: 34	1512	wmic.exe
Token: 35	1512	wmic.exe
Token: 36	1512	wmic.exe
Token: SeIncreaseQuotaPrivilege	1512	wmic.exe
Token: SeSecurityPrivilege	1512	wmic.exe
Token: SeTakeOwnershipPrivilege	1512	wmic.exe
Token: SeLoadDriverPrivilege	1512	wmic.exe
Token: SeSystemProfilePrivilege	1512	wmic.exe
Token: SeSystemtimePrivilege	1512	wmic.exe
Token: SeProfSingleProcessPrivilege	1512	wmic.exe
Token: SeIncBasePriorityPrivilege	1512	wmic.exe
Token: SeCreatePagefilePrivilege	1512	wmic.exe
Token: SeBackupPrivilege	1512	wmic.exe
Token: SeRestorePrivilege	1512	wmic.exe
Token: SeShutdownPrivilege	1512	wmic.exe
Token: SeDebugPrivilege	1512	wmic.exe
Token: SeSystemEnvironmentPrivilege	1512	wmic.exe
Token: SeRemoteShutdownPrivilege	1512	wmic.exe
Token: SeUndockPrivilege	1512	wmic.exe
Token: SeManageVolumePrivilege	1512	wmic.exe
Token: 33	1512	wmic.exe
Token: 34	1512	wmic.exe
Token: 35	1512	wmic.exe
Token: 36	1512	wmic.exe
Token: SeDebugPrivilege	1416	powershell.exe
Token: SeDebugPrivilege	3964	powershell.exe
Token: SeDebugPrivilege	248	powershell.exe
Token: SeDebugPrivilege	3468	powershell.exe
Token: SeIncreaseQuotaPrivilege	2524	wmic.exe
Token: SeSecurityPrivilege	2524	wmic.exe
Token: SeTakeOwnershipPrivilege	2524	wmic.exe
Token: SeLoadDriverPrivilege	2524	wmic.exe
Token: SeSystemProfilePrivilege	2524	wmic.exe
Token: SeSystemtimePrivilege	2524	wmic.exe
Token: SeProfSingleProcessPrivilege	2524	wmic.exe
Token: SeIncBasePriorityPrivilege	2524	wmic.exe
Token: SeCreatePagefilePrivilege	2524	wmic.exe
Token: SeBackupPrivilege	2524	wmic.exe
Token: SeRestorePrivilege	2524	wmic.exe
Token: SeShutdownPrivilege	2524	wmic.exe
Token: SeDebugPrivilege	2524	wmic.exe
Token: SeSystemEnvironmentPrivilege	2524	wmic.exe
Token: SeRemoteShutdownPrivilege	2524	wmic.exe
Token: SeUndockPrivilege	2524	wmic.exe
Token: SeManageVolumePrivilege	2524	wmic.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3428	MiniSearchHost.exe
4100	OpenWith.exe
2428	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2968 wrote to memory of 3236	2968	msedge.exe	77
PID 2968 wrote to memory of 3236	2968	msedge.exe	77
PID 2968 wrote to memory of 4844	2968	msedge.exe	78
PID 2968 wrote to memory of 4844	2968	msedge.exe	78
PID 2968 wrote to memory of 4844	2968	msedge.exe	78
PID 2968 wrote to memory of 4844	2968	msedge.exe	78
PID 2968 wrote to memory of 4844	2968	msedge.exe	78
PID 2968 wrote to memory of 4844	2968	msedge.exe	78
PID 2968 wrote to memory of 4844	2968	msedge.exe	78
PID 2968 wrote to memory of 4844	2968	msedge.exe	78
PID 2968 wrote to memory of 4844	2968	msedge.exe	78
PID 2968 wrote to memory of 4844	2968	msedge.exe	78
PID 2968 wrote to memory of 4844	2968	msedge.exe	78
PID 2968 wrote to memory of 4844	2968	msedge.exe	78
PID 2968 wrote to memory of 4844	2968	msedge.exe	78
PID 2968 wrote to memory of 4844	2968	msedge.exe	78
PID 2968 wrote to memory of 4844	2968	msedge.exe	78
PID 2968 wrote to memory of 4844	2968	msedge.exe	78
PID 2968 wrote to memory of 4844	2968	msedge.exe	78
PID 2968 wrote to memory of 4844	2968	msedge.exe	78
PID 2968 wrote to memory of 4844	2968	msedge.exe	78
PID 2968 wrote to memory of 4844	2968	msedge.exe	78
PID 2968 wrote to memory of 4844	2968	msedge.exe	78
PID 2968 wrote to memory of 4844	2968	msedge.exe	78
PID 2968 wrote to memory of 4844	2968	msedge.exe	78
PID 2968 wrote to memory of 4844	2968	msedge.exe	78
PID 2968 wrote to memory of 4844	2968	msedge.exe	78
PID 2968 wrote to memory of 4844	2968	msedge.exe	78
PID 2968 wrote to memory of 4844	2968	msedge.exe	78
PID 2968 wrote to memory of 4844	2968	msedge.exe	78
PID 2968 wrote to memory of 4844	2968	msedge.exe	78
PID 2968 wrote to memory of 4844	2968	msedge.exe	78
PID 2968 wrote to memory of 4844	2968	msedge.exe	78
PID 2968 wrote to memory of 4844	2968	msedge.exe	78
PID 2968 wrote to memory of 4844	2968	msedge.exe	78
PID 2968 wrote to memory of 4844	2968	msedge.exe	78
PID 2968 wrote to memory of 4844	2968	msedge.exe	78
PID 2968 wrote to memory of 4844	2968	msedge.exe	78
PID 2968 wrote to memory of 4844	2968	msedge.exe	78
PID 2968 wrote to memory of 4844	2968	msedge.exe	78
PID 2968 wrote to memory of 4844	2968	msedge.exe	78
PID 2968 wrote to memory of 4844	2968	msedge.exe	78
PID 2968 wrote to memory of 5024	2968	msedge.exe	79
PID 2968 wrote to memory of 5024	2968	msedge.exe	79
PID 2968 wrote to memory of 3820	2968	msedge.exe	80
PID 2968 wrote to memory of 3820	2968	msedge.exe	80
PID 2968 wrote to memory of 3820	2968	msedge.exe	80
PID 2968 wrote to memory of 3820	2968	msedge.exe	80
PID 2968 wrote to memory of 3820	2968	msedge.exe	80
PID 2968 wrote to memory of 3820	2968	msedge.exe	80
PID 2968 wrote to memory of 3820	2968	msedge.exe	80
PID 2968 wrote to memory of 3820	2968	msedge.exe	80
PID 2968 wrote to memory of 3820	2968	msedge.exe	80
PID 2968 wrote to memory of 3820	2968	msedge.exe	80
PID 2968 wrote to memory of 3820	2968	msedge.exe	80
PID 2968 wrote to memory of 3820	2968	msedge.exe	80
PID 2968 wrote to memory of 3820	2968	msedge.exe	80
PID 2968 wrote to memory of 3820	2968	msedge.exe	80
PID 2968 wrote to memory of 3820	2968	msedge.exe	80
PID 2968 wrote to memory of 3820	2968	msedge.exe	80
PID 2968 wrote to memory of 3820	2968	msedge.exe	80
PID 2968 wrote to memory of 3820	2968	msedge.exe	80
PID 2968 wrote to memory of 3820	2968	msedge.exe	80
PID 2968 wrote to memory of 3820	2968	msedge.exe	80

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://gofile.io/d/cTww9O
1⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0xdc,0x104,0x108,0xe8,0x10c,0x7ffc89f83cb8,0x7ffc89f83cc8,0x7ffc89f83cd8
  2⤵
  PID:3236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1816,6300333861943302595,3529719250079892594,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1908 /prefetch:2
  2⤵
  PID:4844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1816,6300333861943302595,3529719250079892594,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2008 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - Suspicious behavior: EnumeratesProcesses
  PID:5024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1816,6300333861943302595,3529719250079892594,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2608 /prefetch:8
  2⤵
  PID:3820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1816,6300333861943302595,3529719250079892594,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3164 /prefetch:1
  2⤵
  PID:2748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1816,6300333861943302595,3529719250079892594,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3172 /prefetch:1
  2⤵
  PID:4240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1816,6300333861943302595,3529719250079892594,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3684 /prefetch:1
  2⤵
  PID:1120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1816,6300333861943302595,3529719250079892594,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5384 /prefetch:1
  2⤵
  PID:1456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1816,6300333861943302595,3529719250079892594,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5404 /prefetch:1
  2⤵
  PID:1096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1816,6300333861943302595,3529719250079892594,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5768 /prefetch:1
  2⤵
  PID:3456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1816,6300333861943302595,3529719250079892594,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5876 /prefetch:1
  2⤵
  PID:4452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1816,6300333861943302595,3529719250079892594,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6056 /prefetch:1
  2⤵
  PID:1912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1816,6300333861943302595,3529719250079892594,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5868 /prefetch:1
  2⤵
  PID:3584
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1816,6300333861943302595,3529719250079892594,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5748 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1816,6300333861943302595,3529719250079892594,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5288 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1816,6300333861943302595,3529719250079892594,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5300 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:4228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1816,6300333861943302595,3529719250079892594,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5160 /prefetch:8
  2⤵
  PID:4316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1816,6300333861943302595,3529719250079892594,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5544 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1120

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3480

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:276

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3856

C:\Users\Admin\Downloads\mapleC2.exe
"C:\Users\Admin\Downloads\mapleC2.exe"
1⤵
- Executes dropped EXE
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3812
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" csproduct get uuid
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1512
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\Downloads\mapleC2.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1416
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3964
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:248
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3468
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" os get Caption
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2524
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" computersystem get totalphysicalmemory
  2⤵
  PID:4924
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" csproduct get uuid
  2⤵
  PID:4180
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:3416
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" path win32_VideoController get name
  2⤵
  - Detects videocard installed
  PID:2000

C:\Users\Admin\Downloads\mapleC2.exe
"C:\Users\Admin\Downloads\mapleC2.exe"
1⤵
- Executes dropped EXE
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
PID:4072
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" csproduct get uuid
  2⤵
  PID:2252
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\Downloads\mapleC2.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:3592
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:1096
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:1964
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4040
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" os get Caption
  2⤵
  PID:4912
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" computersystem get totalphysicalmemory
  2⤵
  PID:1936
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" csproduct get uuid
  2⤵
  PID:1084
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:1040
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" path win32_VideoController get name
  2⤵
  - Detects videocard installed
  PID:4236

C:\Users\Admin\Downloads\mapleC2.exe
"C:\Users\Admin\Downloads\mapleC2.exe"
1⤵
- Executes dropped EXE
PID:4640

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3428

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:4936

C:\Windows\system32\BackgroundTransferHost.exe
"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.13
1⤵
- Modifies registry class
PID:2828

C:\Users\Admin\Downloads\mapleC2.exe
"C:\Users\Admin\Downloads\mapleC2.exe"
1⤵
- Executes dropped EXE
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
PID:3860
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" csproduct get uuid
  2⤵
  PID:5008
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\Downloads\mapleC2.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:4384
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:4040
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:3148
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2544
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" os get Caption
  2⤵
  PID:4384
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" computersystem get totalphysicalmemory
  2⤵
  PID:2028
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" csproduct get uuid
  2⤵
  PID:2920
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:1936
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" path win32_VideoController get name
  2⤵
  - Detects videocard installed
  PID:4752

C:\Users\Admin\Downloads\mapleC2.exe
"C:\Users\Admin\Downloads\mapleC2.exe"
1⤵
- Executes dropped EXE
- NTFS ADS
PID:2232
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" csproduct get uuid
  2⤵
  PID:2992
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\Downloads\mapleC2.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2432
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1632
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2432
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
  2⤵
  PID:3684
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" os get Caption
  2⤵
  PID:1096
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" computersystem get totalphysicalmemory
  2⤵
  PID:2916
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" csproduct get uuid
  2⤵
  PID:4124
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2832
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" path win32_VideoController get name
  2⤵
  - Detects videocard installed
  PID:3456

C:\Users\Admin\Downloads\mapleC2.exe
"C:\Users\Admin\Downloads\mapleC2.exe"
1⤵
- Executes dropped EXE
PID:2028

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4100

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:2428

C:\Users\Admin\Downloads\mapleC2.exe
"C:\Users\Admin\Downloads\mapleC2.exe"
1⤵
- Executes dropped EXE
- NTFS ADS
PID:3388
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" csproduct get uuid
  2⤵
  PID:3188
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\Downloads\mapleC2.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2532
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3752
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:648
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
  2⤵
  PID:1936
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" os get Caption
  2⤵
  PID:1328
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" computersystem get totalphysicalmemory
  2⤵
  PID:2136
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" csproduct get uuid
  2⤵
  PID:1584
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3852
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" path win32_VideoController get name
  2⤵
  - Detects videocard installed
  PID:2700

C:\Users\Admin\Downloads\mapleC2.exe
"C:\Users\Admin\Downloads\mapleC2.exe"
1⤵
- Executes dropped EXE
- NTFS ADS
PID:1496
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" csproduct get uuid
  2⤵
  PID:4128
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\Downloads\mapleC2.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4644
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:860
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1680
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
  2⤵
  PID:236
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" os get Caption
  2⤵
  PID:4736
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" computersystem get totalphysicalmemory
  2⤵
  PID:2396
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" csproduct get uuid
  2⤵
  PID:552
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2100
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" path win32_VideoController get name
  2⤵
  - Detects videocard installed
  PID:1884

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\DD5YM.scr:SmartScreen

Filesize
7B

MD5
4047530ecbc0170039e76fe1657bdb01

SHA1
32db7d5e662ebccdd1d71de285f907e3a1c68ac5

SHA256
82254025d1b98d60044d3aeb7c56eed7c61c07c3e30534d6e05dab9d6c326750

SHA512
8f002af3f4ed2b3dfb4ed8273318d160152da50ee4842c9f5d9915f50a3e643952494699c4258e6af993dc6e1695d0dc3db6d23f4d93c26b0bc6a20f4b4f336e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\mapleC2.exe.log

Filesize
1KB

MD5
5f36c205799cb2f8966c7d5130cea05c

SHA1
614993e3437ff9363c3eb698d7dba379a453dd6e

SHA256
8eaaf40fe7570c8fa593702f38fee2f54538ba6a77d7c54005e8d1f150f5180c

SHA512
7053cac09d2e71675771bae4ac25f1a47f96be662f6bb2aab24668ed4c1809fb1261b2d6465202c09bd0310bf875361a815db6dda6006dcfbbb5fb3c50c5927b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
627073ee3ca9676911bee35548eff2b8

SHA1
4c4b68c65e2cab9864b51167d710aa29ebdcff2e

SHA256
85b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c

SHA512
3c5f6c03e253b83c57e8d6f0334187dbdcdf4fa549eecd36cbc1322dca6d3ca891dc6a019c49ec2eafb88f82d0434299c31e4dfaab123acb42e0546218f311fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
5431d6602455a6db6e087223dd47f600

SHA1
27255756dfecd4e0afe4f1185e7708a3d07dea6e

SHA256
7502d9453168c86631fb40ec90567bf80404615d387afc7ec2beb7a075bcc763

SHA512
868f6dcf32ef80459f3ea122b0d2c79191193b5885c86934a97bfec7e64250e10c23e4d00f34c6c2387a04a15f3f266af96e571bbe37077fb374d6d30f35b829

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7bed1eca5620a49f52232fd55246d09a

SHA1
e429d9d401099a1917a6fb31ab2cf65fcee22030

SHA256
49c484f08c5e22ee6bec6d23681b26b0426ee37b54020f823a2908ab7d0d805e

SHA512
afc8f0b5b95d593f863ad32186d1af4ca333710bcfba86416800e79528616e7b15f8813a20c2cfa9d13688c151bf8c85db454a9eb5c956d6e49db84b4b222ee8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
11f97ae9fbd34c26a7a6cd4ff6941f78

SHA1
a2bfa370e0534ed419b2149543c2620ef176dfa2

SHA256
7f7557577de8185c432b2d2c3080154fed03db0721bb7f7ba927943d369b816a

SHA512
50bba48bd50cb07d9be722c2536ee677e65dc1461bf177049cc6435a6a17231e892ebaea1edcbb683c9b2b647e0ea153c352b0f26e3d9318222b35fc640e6867

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies

Filesize
20KB

MD5
226d4c0173b94073486ae9f789c82ddb

SHA1
360f5371c11a83aadffadbe9004d75b4695a4fd7

SHA256
3177bab382ba3c5955205bd02d9f276cda9c76cff90e92f977fe2219416e5ba1

SHA512
4853c8ed0298e2a0d119c01d9d4196fc0d385971618601bb145779e592684b9231b8b6b8c558b10081c6729acb9c0522b0a277679637e3126e628c1dcd1105a9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log

Filesize
1KB

MD5
2573c0ca0c7e5583c90e9d0813a38544

SHA1
719ad68e85ac947a75e1add3b5e0771779ce767f

SHA256
bf807816ed1fe8ea5ef37e5a1d0394185914a2fa03b3d8c3937d560e985209f8

SHA512
093ec63c5928f3293201736f91ac11cfee7c0917b94e61be703248368d508d75c98966675f15d670f5949e7444d70038cff27145710f759cb0edb57a63274c43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
390B

MD5
7374c572aa82049074cd94a78b24d554

SHA1
495ec515127bf15520c6ecee99712d5ecd361813

SHA256
0097a70562ecf0202423e220a41752be50c791efcab3e5c7f64a218e4d7bad9c

SHA512
6163479d69c369caae0613efa0bd3580b442e0b61d2056e58e705c31355100e0ab104bcf3bbaea8c01d07ac62b0baa65477daeb84bf1ea5e922cfe6df4c85ac8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
3b8003021fd11d68a2eb8c873f8b1870

SHA1
2018e70dba3823fd5726ffe7f766c84cbf061034

SHA256
9646fa5707f6d4e743d8574c5cb3a38e39ecbb36d8654a8319e909624356759d

SHA512
4742daf6c9550ea5774b0ca3b5b2d8192fa22ac9670c836388b4d4b183858d2d6ae6aefc96ea833c1651913f44d2469aeac25d01cccba7bc013f22a0c21d3781

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
10b678f99173e1969e6b0e43d6cb82b8

SHA1
f8e56f1d98b26e88227a7be091eb0bcdffec09c0

SHA256
8e37f8234932df1ca36ac1b1a30a1ae6abfecc259d86fb1e9d8433953429ab85

SHA512
215b171f36ebf9152fe30b33ecac394151b4ab69f3209d98fa4478d01443a1353f3a49987e6ac483ddb9145aa50a3cde01afea29d1806582556efdf8efc2e76d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e0a0f9aa74c2e7283c8312bc06dbc731

SHA1
d10d7ad3371bb012dbbf7ced12c50da92c3c8aec

SHA256
efaca551682b3772805ddb5d08286ce18de540e94ccd943aaf06d8fea8658787

SHA512
8e8e259be4dfab4aff6b5dde5f2ab5565ed795aa25acc0b733253966302a70271792cf7eb03b4aea07b99ef28f64e2ced8ad5141f9486d0f7d9cf308cd0603c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
265fde735a63d7850737346a3b6c799b

SHA1
8b0461f419d2912144f37d9c3b21333ad0c836e7

SHA256
7221712f18580bfea4abd5387f63a4d2c39fec48cdaeb7a2d92497f3c6e4de8b

SHA512
f191056328a65f747ebcf4817f4812e7bd58699378556653eb42bf8406ba37fa2392672eb102bc12411471f0ae8fbfc843d943719496d2d16bd36c740e3d1454

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
bd7abf746794d8a5a4a6c6e35de50e18

SHA1
e2cc97dec753c7d76dc8f69b3f3a975daac2b8ea

SHA256
5359f4fbbff9ca82ab9b2bc16807f7d0aa9428c3205e2613cb62b45bdb1f7c5f

SHA512
f4a0788b0e747e08220701f5b8d46017c13c2a70f4557616a8a0a619ddfeec8d386ddd3ba1563377afa676f81206f741f3d636af7618fd85b3d93576885c0f2c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
3b141c97d08d110acaf568663e48c0a2

SHA1
8064c6617fc96a4c5d04860873d1bb639a389a22

SHA256
60ee5fcf2a727fa545479c9b576229a7e42fccbb5e3c80fc96afcc3384914c0b

SHA512
37616fd8d317e178537b191239a1e660757f90e79d3aceeb3d76db66c4b2e9099688a078e10b71c4400ee3477af88113c10ad2b8bc519b5f26bfacc023715ff6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
365a530417369cbe38e512023d610c08

SHA1
7909aba2d0950e743f42f85ede89d0cb3d8a4407

SHA256
3fab7e8a688e6ae164cf9571d8a8cfe4dfb1c70a2bda79ed116948ab8b32cbe6

SHA512
c0574a515cd9a688a1dcf2c047271cc679631743b56bc0513433f8c1d90eba82adb8b260af244f183dbf5abdb8cc29d77fc0c15db24ca963e0adafd602229142

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
8740a2b9963880309ab387d56cc6ac1b

SHA1
93fe2e9867570ece14344148c5eb83367f83361f

SHA256
7a368a0c0ecf2c4f3f7d30db9e13173315a8e58d22c73c76b573eb91e0603d5e

SHA512
f191bc806ddbffa2a19afcaa68c8e8e6d04f8537de9ca7457d2a230ef08df529b33f593c1028de4086c14764a82c3ae4367bd4031412794b0f33fc25eafe19cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
2e8eb51096d6f6781456fef7df731d97

SHA1
ec2aaf851a618fb43c3d040a13a71997c25bda43

SHA256
96bfd9dd5883329927fe8c08b8956355a1a6ceb30ceeb5d4252b346df32bc864

SHA512
0a73dc9a49f92d9dd556c2ca2e36761890b3538f355ee1f013e7cf648d8c4d065f28046cd4a167db3dea304d1fbcbcea68d11ce6e12a3f20f8b6c018a60422d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
948B

MD5
4b92d741d003e8d1f0394874017a6fe9

SHA1
1a4bebc2637bce160dae38d4d0bfdeb6b398059d

SHA256
8c8532230d71f0818daebff0d2ab496b02c25bdaa7156701f663b5474ad876fc

SHA512
5c2e84b072314aaae414f98f7dbeb13e030561b53270803d0cf7a8c6ed59368dcfdc4666e69abef39fcac5b75968a1174aca501023297a276a219ed0464612c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
7332074ae2b01262736b6fbd9e100dac

SHA1
22f992165065107cc9417fa4117240d84414a13c

SHA256
baea84fda6c1f13090b8cbd91c920848946f10ce155ef31a1df4cd453ee7e4aa

SHA512
4ae6f0e012c31ac1fc2ff4a8877ce2b4667c45b6e651de798318a39a2b6fd39a6f72dffa8b0b89b7a045a27d724d195656faa25a9fec79b22f37ddebb5d22da2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
1a018d77fa061b166e41f2212aae09d5

SHA1
834e4797e219bed200f935aa98f206603a4ae13d

SHA256
d9fed06e8653433c4f0d80fa1cef298fbf9a66b6e8c9279fac8b6c2e0db67ac7

SHA512
3fba4202dd929b7196d93c7b78b7e024080761fa27ff14f476e1169e32006a3ff45086c0af30356349a5083fe104ca0516a32f1468dacb3134f1be1ec8304a65

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
64B

MD5
5b27d0f2e7023b0cb214f2d6320b5387

SHA1
2e5eeea0e9e6fc2162ad375aecddff7ed953d3e4

SHA256
6404e3da4c87b9969bc2ed0fd2a6377b61a7c10dfd70f7141b1d7ce4417cda23

SHA512
6794951bd4520340176063857917bc6f77d88d1acc26956b1af87c8d44393fc31094860b3811b2082765fec238877d2d5684bff9a11eb6efc2d8b8c5703456b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
fcbfea2bed3d0d2533fe957f0f83e35c

SHA1
70ca46e89e31d8918c482848cd566090aaffd910

SHA256
e97f54e5237ffeca4c9a6454f73690b98ac33e03c201f9f7e465394ecbc3ea38

SHA512
d382453207d961f63624ba4c5a0dea874e6b942f5cad731c262a44371fb25b309eacf608156e0234169e52337796128312e72edb0290c48f56104fe5e52509a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
948B

MD5
6bddc96a32b9ed8fc70b141ccf4a39b2

SHA1
0f33c0699da40a5eadcec646791cf21cdb0dd7c6

SHA256
cb3853abe77eb0da8a1caccb49e97a573b6f35570722eb759116a645d724c132

SHA512
e41f1597b4129b759e4199db195df1c24e47cc47dc9850fab2d48e44bc3d37dc3658fbfbb62332a0b93c552587d7fab09de1634f605faa2209b8470c2a6eaca6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
de1cbc191bee1d162d00561785ff3e3f

SHA1
e65c6208aaeb730c3242fec9afbfe797fb464f66

SHA256
7eda0e7287adda6d5511bb314988c270a1ec05a6bd7fcbfab698ed7b4b195434

SHA512
af507d8a805f43842e87414b43c1a0f8973f3d663d2efeb0556b9d212741d159e2f0d0e0528588d9dba1278cca1efd37ab4d28c118c4424345191d0b016d2013

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
c321dfee531730b7e0b81470b947da3f

SHA1
0488401f4fc03bcdab19eeff194ff12f4439e1cb

SHA256
6d7da148fe930cf085b5369427eb24e66844d7f00fcc197f056e0763c7a76117

SHA512
eee78a9529b1d89631ac8dbaef716eba95166d8c465a2c075bf89d28fab4c25a48c4d29d7f19ab0249b245bf45fac63214b092aaef9b3a09b4f8e6cfa85a076a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
64B

MD5
c41224ab6e2a713aff7b0128890716be

SHA1
b3525f9c3f583284b084fb88ae14a803fad84e04

SHA256
ee0f2a4ee399ef57c54d83bd611d11fb22ce2edc405db819a2a371b8a5192fd2

SHA512
25c71ac3f2ee6b0ccadd7549b7d8a42a964d0305d8758dfae53ce78eeaf52432380715ff545d95645e0e00d3b3b6c678f17eb16b2e9606d64988ffde82dfbc4c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
948B

MD5
fa21dd50b4e64421076f843031c8ccf7

SHA1
2c56e94f130c0d8d77116e939ffee4e37cf982bd

SHA256
e4f21aca1e12aafa8de7af24b79a75526e902c7d4b3fea5bdb6e723976997be3

SHA512
b8de2bfeb7af06c587dd1f424d410cf83471f31a55a3ea4c4481ce07ffd9bf66ddc1f7775ecd6ac65ac33baaec90ba5a208a9aefc84f31125a50dfb919982687

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
53ef9acfc26aff9844788c061b9a82a4

SHA1
694630c1928e41ce2404c5fcc47f46edf736c799

SHA256
8e4d63bc44923666849081897470e38ef342d019d6f9db09bda31733723d2285

SHA512
1748fd690c383716f4fb8117b25ed9b5d39ba951c80296490f01b34a51f04a2712ccb9ad827063351276e6d5c304b6e015a8a8240a4bb4baa2b3086e7e28f9d1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
64B

MD5
fd1ae1e67649a1088ae320398bef2296

SHA1
b0dc5c2827a70feea4fd78d7ecbc09e240bfde00

SHA256
c9d8a9bb515350542ef7f9177db1928c13f88f35e309f2e6c88fdcc30bcb2097

SHA512
5c7653fde743046d2843f1cd7d1e2462b47439cab2b36e35e141a8b1d18de05b378f2c42f946e00d41699638eefc7cd244b7f1ee45afc1dfa5fba981182d95d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
948B

MD5
87ebe221d639e66210ef10c93e5f83c3

SHA1
483a666b82f7b59e2d569f6f331fa3989fe0f526

SHA256
9a41c90023823aa68dc48f5d8592910dc2ad1116bf54870a0832aba787990380

SHA512
2a1e22894388a79526f39db4fa7c65db92626719337f865eaac39d0bb28dc95726fba62c1f0d659864843a2804bd803fe3dfbc0840421c80ff735192928efcce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
cd5b2555a0e703bc746e242654a09c2f

SHA1
4021bfba22c0fce16709bfa6140d11272b7bd8b4

SHA256
73679042b477828c6c8400590ca1434f5f6b7379aede1442f80bb9ede3bc7811

SHA512
404a94bbc1cbcf98dba90160ab65a8acc5a1660d801bf7425ab1fe641599bda1b6494d4d6b65c6584e4ca6c1dea4b1acfde88e4a6d216194dca3b6ae6ca605f1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
1c0173315684736a04b0f5fe42957c12

SHA1
4f807eb7f4203987160503fc2144d4b3059d903c

SHA256
9200d881990608a02f4ea689d65c4c89893f08e209fed664442e18e6038283b8

SHA512
24f6ebc6cda60bfea224afc54d73fae5259f11d82b9ea47b3fb548214149036eef95279161eba28db0d74a4d397f7394c4c14adebe59dbd8da54ddf2dae242fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
64B

MD5
9b38462ee4bdaa78dbf2889560d42663

SHA1
8fd56f24536ac62a71d11c680f5f7958670c75ba

SHA256
7b47fa83d9fccd4f3e4f95eaf211f2927ca258f04d6f7c2f7352f6f3b917f132

SHA512
2aa16887020204b1d827bf944031396424ffdc81978fe7bd9ab82243e79919824d0b373ad6330cb7a65451428dead325bb416a2bf0bf1f99562c4bd82074ec45

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
948B

MD5
67be01283feaf2b9abb9417d79a86ea2

SHA1
93fbeadd9a16e33c2c99dff045cb2badf5d11b65

SHA256
d09d1a07afe2c2ad8dde99cf2ce1070a4156793666796de63a44e726edfce9ac

SHA512
5f98a092ca53465dc683e5413378fd7ddccf352bde12a48e8d2aec912454be680bbfa503f3af1cfa9647a4308098584a308c19083664ed676427d66a392e9ff1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
433201a90c20790fe0b7751e09544fb5

SHA1
f3226c2f6c1b4aadbbb4eb9268c91044db4a00d2

SHA256
6f4ab44eee16301ab143f0dc41579e7c0a4d7f2ac7772363735f3da9cf1d4fc5

SHA512
590f5c00678568da9344bcffb2e88740c701b55bfcba9979d6b2b0aba7c41e694f5bf82fcd242bdf6af0d7a41f1453b5a44785b0b42e9e5d5343d8248cb1519f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
64B

MD5
e79b9a0937d9ca85dd2014446529d905

SHA1
63db9494fbe6901ab453d34053b685725d1f705d

SHA256
9fed633f3763c0292fc8e8458ad32c7461d9925a61b6b99081d27fb41bc68250

SHA512
0d49c74aa2cf3b024e3f2be5b181e451a78f86293db96fd729f671824ab97ab9eb1184fb2d7b4c8f5cc4ecca6f6868fd4fcd260611319d21492746ff65346440

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
948B

MD5
dbe8aaf09f6cde47d3de472928e91b81

SHA1
6df44595116952659c5108298aaad1ef5a406185

SHA256
753bc0016cef15de2815a529d72575166e6cf961514fb52e25db0004a76d4261

SHA512
7a9e2d2b08b9a74203b7eaa6af46115e16e3005fce1193dc010d7e435ac90742619773f3d8d25fbea5bd2ce15e60b477ebdcbd4c66f9959a742b5cf5c3380cf1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
bba9ea7c99c1fd86321857e47f0ac572

SHA1
b0fffe4859757cfae6756672f798d9ba0f016d1d

SHA256
c39db37470bdf127a7ef93a93030a7f49510c5185c799a326e96ed566643328e

SHA512
9780165221bf45562efbc2ff5a572cfcecb7b2b89bca5b9238fc74b442cafcb4e0affc84e09877ec734ea406660104de028474b7d2f648c8e2bf2a8ac15d3a1c

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\BackgroundTransferApi\2f5951a4-e5c8-4ed5-8b07-d33263a4e2e8.down_data

Filesize
555KB

MD5
5683c0028832cae4ef93ca39c8ac5029

SHA1
248755e4e1db552e0b6f8651b04ca6d1b31a86fb

SHA256
855abd360d8a8d6974eba92b70cbd09ce519bc8773439993f9ab37cb6847309e

SHA512
aba434bd29be191c823b02ea9b639beb10647bbe7759bbffdaa790dfb1ec2c58d74c525ef11aacda209e4effe322d1d3a07b115446c8914b07a3bce4d8a0e2c3

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat

Filesize
10KB

MD5
1301a13a0b62ba61652cdbf2d61f80fa

SHA1
1911d1f0d097e8f5275a29e17b0bcef305df1d9e

SHA256
7e75ad955706d05f5934810aebbd3b5a7742d5e5766efd9c4fc17ee492b2f716

SHA512
66aa4261628bb31ee416af70f4159c02e5bbfbe2f7645e87d70bb35b1f20fa915d62b25d99cd72c59580d1f64e6c6b5ad36ace6600d3bcdb67f45036d768ed8b

Download Submit
C:\Users\Admin\AppData\Local\Temp\BucXrbUWmrxnKlG

Filesize
20KB

MD5
99066774dd089f4bad4fcefa144d1f0d

SHA1
dbd5d737149a32f89e8cee2a5f13444a523d6614

SHA256
62a079e4e6498812c89bd386d115285ddd5a939231637312cee75e0775c33694

SHA512
43f13005e8d88b448b5b05f02a3e74d239f28e7cc59a739f07bb7db870e4862dad927bd1fa1ce2ba3ba0a7339d4d84e85b0421f67b7f188bbcb95a0bf18205ec

Download Submit
C:\Users\Admin\AppData\Local\Temp\LV8L5UlzvKt50xl

Filesize
40KB

MD5
a182561a527f929489bf4b8f74f65cd7

SHA1
8cd6866594759711ea1836e86a5b7ca64ee8911f

SHA256
42aad7886965428a941508b776a666a4450eb658cb90e80fae1e7457fc71f914

SHA512
9bc3bf5a82f6f057e873adebd5b7a4c64adef966537ab9c565fe7c4bb3582e2e485ff993d5ab8a6002363231958fabd0933b48811371b8c155eaa74592b66558

Download Submit
C:\Users\Admin\AppData\Local\Temp\NSCZz2ZY1EvQ9ZZ\Browsers\Cookies\Chrome Cookies.txt

Filesize
260B

MD5
2156d8911751343df3ed3dbb348750f8

SHA1
c9ec2ab84c3538206cd7ad422aaabde828b62244

SHA256
7cd69e2ab31cdb402f521ba709b61f2103e5426946c5423f4a0b2603b3469a4a

SHA512
c9472e4f34905386369163eb883d8c23c10fbf1150456ae394631a997a0ccd732deabea2b8733934aa6b8bd0f8dfcfb1687e04a067fc95dc6e05cfcee0afeb8a

Download Submit
C:\Users\Admin\AppData\Local\Temp\ZuGya6GjRtILDCW\Browsers\Cookies\Edge Cookies.txt

Filesize
74B

MD5
ce2ca020763f194d5d3834885521a7fa

SHA1
865e2983b5d6599af31fc4387d63ee8511b28255

SHA256
c2586815967ea5899fe20107bbdbb94b3acbb860b0b55f3d3c148777ac5c8947

SHA512
1d5242992731a218880affd080afafedb80032c3e3ae1d1ddd83ca243d4416c1a2da2383e6714ca861b1dcfde3d4217e901190118cc32bfb68ebe16b387d1fb5

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_qg1vjyqm.qyx.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\qYK1deYqweqxE4s\Display\Display.png

Filesize
251KB

MD5
46f71766f4bfc2a5f70e9c83341302c6

SHA1
dec7ea3548de75c9d4e41e9334e51a89e9a9209d

SHA256
cad95bbac94105ff5d2456367d5a9649d6a147c9d51288fe5c46994239d35df5

SHA512
b47720d0193cb76ebf2f3ff74c06e020fd23ca634a74e649f84b1bbff110d4edbb2153e59ab0be9cae53d39e41c19ddfa62f6fbc83f6363c8866e2fe2409e67f

Download Submit
C:\Users\Admin\AppData\Local\Temp\zowvrVaywQ7b1dZ

Filesize
46KB

MD5
14ccc9293153deacbb9a20ee8f6ff1b7

SHA1
46b4d7b004ff4f1f40ad9f107fe7c7e3abc9a9f3

SHA256
3195ce0f7aa2eae2b21c447f264e2bd4e1dc5208353ac72d964a750de9a83511

SHA512
916f2178be05dc329461d2739271972238b22052b5935883da31e6c98d2697bd2435c9f6a2d1fcafb4811a1d867c761055532669aac2ea1a3a78c346cdeba765

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 850422.crdownload

Filesize
229KB

MD5
8fdc5324c6283723749bec8199a6078e

SHA1
d9480e0b5d4dffbc82f542c66d3f0efc0f18c95c

SHA256
10fc7787e75df4375d177ade5d874691e815204bba4034b54a2b053ad26a1f0d

SHA512
f375bec52dfd7f6f86db525a734c9331152975ad43633b77fc2fb0df31c4e3e408410ab14262fc9f6af650f8ae6c1fa15583c7828cdf0b1ade1c9be6548ae3f4

Download Submit
C:\Users\Admin\Downloads\mapleC2.exe:Zone.Identifier

Filesize
153B

MD5
a2398857f283c1b19ce647d476091ede

SHA1
bb6b1f2dd59f27444fa7893893b1608400c8a606

SHA256
ee1e95ef44aed31df5e1dde30514e73ef19cb57301747602244a8506e5f2f7a8

SHA512
9a2c0eedc887082579a251dfb4d259ccd03bfaa10a7838be1d6b95cf2c262e61867e67162f701c62d4304c6e570e29b3a15c3e65d1d291023160b297a00d1bb8

Download Submit
memory/1416-133-0x0000024991920000-0x0000024991942000-memory.dmp

Filesize
136KB

Download
memory/3812-132-0x000002A4CBB30000-0x000002A4CBB70000-memory.dmp

Filesize
256KB

Download
memory/3812-198-0x000002A4E64E0000-0x000002A4E64F2000-memory.dmp

Filesize
72KB

Download
memory/3812-158-0x000002A4E6460000-0x000002A4E64D6000-memory.dmp

Filesize
472KB

Download
memory/3812-162-0x000002A4E6110000-0x000002A4E612E000-memory.dmp

Filesize
120KB

Download
memory/3812-160-0x000002A4E63E0000-0x000002A4E6430000-memory.dmp

Filesize
320KB

Download
memory/3812-197-0x000002A4E6160000-0x000002A4E616A000-memory.dmp

Filesize
40KB

Download
memory/3812-217-0x000002A4E6180000-0x000002A4E628A000-memory.dmp

Filesize
1.0MB

Download