lumma | 11202449315d0f2edb567c5f5e3e4bd403ae0985574344ea8ddf474c1b1fb440

Analysis

max time kernel
297s
max time network
301s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
07/06/2024, 21:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Launcher.bat
Size 724B
Sample240607-1jdl6seb55
SHA256 f1ed443faa01092320e04e0231327bd59c6df7344ad0f46ca4885d28aa2afd60
MD5 9edcc8710e562b5daeed73acaa17e2fd
SHA1 a3d7d0a26c3a058ff0b3a25c64d43397f1823d95
SHA512 312fec45d3897ecc67285694a73d4fc7ef044b6f3aa1e6a9d5a8cee0b1b70204396b43fe014a4680c539427c070f199ff91f151fbdc2ae8e0d97f1b3fca3cb4a
MD5 SHA1 SHA512

Score

10^/10

lumma stealer

Malware Config

Extracted

Credentials

Protocol
ftp
Host
146.19.207.14
Port
21
Username
anonymous
Password
anonymous@

Extracted

Family

lumma

https://macabrecondfucews.shop/api
https://distincttangyflippan.shop/api
https://greentastellesqwm.shop/api
https://stickyyummyskiwffe.shop/api
https://sturdyregularrmsnhw.shop/api
https://lamentablegapingkwaq.shop/api
https://innerverdanytiresw.shop/api
https://standingcomperewhitwo.shop/api

Signatures

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma

Blocklisted process makes network request 6 IoCs

flow	pid	Process
44	4832	rundll32.exe
46	4832	rundll32.exe
47	4832	rundll32.exe
58	4832	rundll32.exe
60	4832	rundll32.exe
61	4832	rundll32.exe

Executes dropped EXE 1 IoCs

pid	Process
6044	update.exe

Loads dropped DLL 2 IoCs

pid	Process
116	rundll32.exe
4832	rundll32.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
6	ip-api.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 6044 set thread context of 6040	6044	update.exe	143

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Setup\Scripts\ErrorHandler.cmd	luajit.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
4316	schtasks.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings	firefox.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\7.5.2.zip:Zone.Identifier	firefox.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
920	msedge.exe
920	msedge.exe
2000	msedge.exe
2000	msedge.exe
5872	identity_helper.exe
5872	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2012	firefox.exe
Token: SeDebugPrivilege	2012	firefox.exe
Token: SeDebugPrivilege	2012	firefox.exe

Suspicious use of FindShellTrayWindow 30 IoCs

pid	Process
2012	firefox.exe
2012	firefox.exe
2012	firefox.exe
2012	firefox.exe
4520	Run.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe

Suspicious use of SendNotifyMessage 27 IoCs

pid	Process
2012	firefox.exe
2012	firefox.exe
2012	firefox.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2012	firefox.exe
2012	firefox.exe
2012	firefox.exe
2012	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2008 wrote to memory of 3696	2008	cmd.exe	83
PID 2008 wrote to memory of 3696	2008	cmd.exe	83
PID 2008 wrote to memory of 2248	2008	cmd.exe	84
PID 2008 wrote to memory of 2248	2008	cmd.exe	84
PID 2008 wrote to memory of 2248	2008	cmd.exe	84
PID 2248 wrote to memory of 4316	2248	luajit.exe	96
PID 2248 wrote to memory of 4316	2248	luajit.exe	96
PID 2248 wrote to memory of 4316	2248	luajit.exe	96
PID 2248 wrote to memory of 116	2248	luajit.exe	97
PID 2248 wrote to memory of 116	2248	luajit.exe	97
PID 2248 wrote to memory of 116	2248	luajit.exe	97
PID 116 wrote to memory of 4832	116	rundll32.exe	98
PID 116 wrote to memory of 4832	116	rundll32.exe	98
PID 3188 wrote to memory of 2012	3188	firefox.exe	103
PID 3188 wrote to memory of 2012	3188	firefox.exe	103
PID 3188 wrote to memory of 2012	3188	firefox.exe	103
PID 3188 wrote to memory of 2012	3188	firefox.exe	103
PID 3188 wrote to memory of 2012	3188	firefox.exe	103
PID 3188 wrote to memory of 2012	3188	firefox.exe	103
PID 3188 wrote to memory of 2012	3188	firefox.exe	103
PID 3188 wrote to memory of 2012	3188	firefox.exe	103
PID 3188 wrote to memory of 2012	3188	firefox.exe	103
PID 3188 wrote to memory of 2012	3188	firefox.exe	103
PID 3188 wrote to memory of 2012	3188	firefox.exe	103
PID 2012 wrote to memory of 1204	2012	firefox.exe	104
PID 2012 wrote to memory of 1204	2012	firefox.exe	104
PID 2012 wrote to memory of 1204	2012	firefox.exe	104
PID 2012 wrote to memory of 1204	2012	firefox.exe	104
PID 2012 wrote to memory of 1204	2012	firefox.exe	104
PID 2012 wrote to memory of 1204	2012	firefox.exe	104
PID 2012 wrote to memory of 1204	2012	firefox.exe	104
PID 2012 wrote to memory of 1204	2012	firefox.exe	104
PID 2012 wrote to memory of 1204	2012	firefox.exe	104
PID 2012 wrote to memory of 1204	2012	firefox.exe	104
PID 2012 wrote to memory of 1204	2012	firefox.exe	104
PID 2012 wrote to memory of 1204	2012	firefox.exe	104
PID 2012 wrote to memory of 1204	2012	firefox.exe	104
PID 2012 wrote to memory of 1204	2012	firefox.exe	104
PID 2012 wrote to memory of 1204	2012	firefox.exe	104
PID 2012 wrote to memory of 1204	2012	firefox.exe	104
PID 2012 wrote to memory of 1204	2012	firefox.exe	104
PID 2012 wrote to memory of 1204	2012	firefox.exe	104
PID 2012 wrote to memory of 1204	2012	firefox.exe	104
PID 2012 wrote to memory of 1204	2012	firefox.exe	104
PID 2012 wrote to memory of 1204	2012	firefox.exe	104
PID 2012 wrote to memory of 1204	2012	firefox.exe	104
PID 2012 wrote to memory of 1204	2012	firefox.exe	104
PID 2012 wrote to memory of 1204	2012	firefox.exe	104
PID 2012 wrote to memory of 1204	2012	firefox.exe	104
PID 2012 wrote to memory of 1204	2012	firefox.exe	104
PID 2012 wrote to memory of 1204	2012	firefox.exe	104
PID 2012 wrote to memory of 1204	2012	firefox.exe	104
PID 2012 wrote to memory of 1204	2012	firefox.exe	104
PID 2012 wrote to memory of 1204	2012	firefox.exe	104
PID 2012 wrote to memory of 1204	2012	firefox.exe	104
PID 2012 wrote to memory of 1204	2012	firefox.exe	104
PID 2012 wrote to memory of 1204	2012	firefox.exe	104
PID 2012 wrote to memory of 1204	2012	firefox.exe	104
PID 2012 wrote to memory of 1204	2012	firefox.exe	104
PID 2012 wrote to memory of 1204	2012	firefox.exe	104
PID 2012 wrote to memory of 1204	2012	firefox.exe	104
PID 2012 wrote to memory of 1204	2012	firefox.exe	104
PID 2012 wrote to memory of 1204	2012	firefox.exe	104
PID 2012 wrote to memory of 1204	2012	firefox.exe	104

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Launcher.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2008
- C:\Windows\system32\cacls.exe
  "C:\Windows\system32\cacls.exe" "C:\Windows\system32\config\system"
  2⤵
  PID:3696
- C:\Users\Admin\AppData\Local\Temp\luajit.exe
  luajit.exe conf
  2⤵
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:2248
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc daily /st 13:07 /f /tn WindowsSetup /tr "C:/Windows/System32/oobe/Setup.exe" /rl highest
    3⤵
    - Creates scheduled task(s)
    PID:4316
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32 "C:\Users\Admin\AppData\Roaming\Lua\bin\lua.dll", init
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:116
  - - C:\Windows\system32\rundll32.exe
      rundll32 "C:\Users\Admin\AppData\Roaming\Lua\bin\lua.dll", init
      4⤵
      Blocklisted process makes network request
      Loads dropped DLL
      PID:4832

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3188
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2012
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2012.0.539845865\1420295242" -parentBuildID 20230214051806 -prefsHandle 1792 -prefMapHandle 1784 -prefsLen 22076 -prefMapSize 235121 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4a37307c-9929-4f96-be46-94973fffd068} 2012 "\\.\pipe\gecko-crash-server-pipe.2012" 1884 28de3feeb58 gpu
    3⤵
    PID:1204
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2012.1.787433376\785596871" -parentBuildID 20230214051806 -prefsHandle 2440 -prefMapHandle 2428 -prefsLen 22112 -prefMapSize 235121 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {51bdeb00-0065-411f-8fb8-5af9ad251fe4} 2012 "\\.\pipe\gecko-crash-server-pipe.2012" 2452 28dd828a558 socket
    3⤵
    PID:3912
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2012.2.270719081\646729979" -childID 1 -isForBrowser -prefsHandle 2956 -prefMapHandle 2952 -prefsLen 22150 -prefMapSize 235121 -jsInitHandle 1324 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2b733fba-515b-4aea-8e72-58380cbc0649} 2012 "\\.\pipe\gecko-crash-server-pipe.2012" 2968 28de7adf858 tab
    3⤵
    PID:2636
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2012.3.462294712\1318201463" -childID 2 -isForBrowser -prefsHandle 4236 -prefMapHandle 4228 -prefsLen 27616 -prefMapSize 235121 -jsInitHandle 1324 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8253e213-7825-4cdb-af14-78e3c8bb2f2d} 2012 "\\.\pipe\gecko-crash-server-pipe.2012" 4248 28dea125958 tab
    3⤵
    PID:3740
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2012.4.1574947487\150606505" -childID 3 -isForBrowser -prefsHandle 5100 -prefMapHandle 5060 -prefsLen 27616 -prefMapSize 235121 -jsInitHandle 1324 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {46520547-4b0f-496d-8a94-87c63bf65247} 2012 "\\.\pipe\gecko-crash-server-pipe.2012" 5080 28decc4de58 tab
    3⤵
    PID:3496
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2012.5.968822404\2104282119" -childID 4 -isForBrowser -prefsHandle 5236 -prefMapHandle 5240 -prefsLen 27616 -prefMapSize 235121 -jsInitHandle 1324 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2c5cfd13-feae-4698-bb88-c3e56b092778} 2012 "\\.\pipe\gecko-crash-server-pipe.2012" 5228 28decc4ea58 tab
    3⤵
    PID:2584
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2012.6.358800248\600349607" -childID 5 -isForBrowser -prefsHandle 5432 -prefMapHandle 5436 -prefsLen 27616 -prefMapSize 235121 -jsInitHandle 1324 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8b86d17e-22c1-414e-8d2b-26af16a572c7} 2012 "\\.\pipe\gecko-crash-server-pipe.2012" 5420 28decc4f358 tab
    3⤵
    PID:5096
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2012.7.1495416010\1536000555" -childID 6 -isForBrowser -prefsHandle 5864 -prefMapHandle 5816 -prefsLen 27776 -prefMapSize 235121 -jsInitHandle 1324 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d230289d-f671-440c-89b5-a903ee8a2d2b} 2012 "\\.\pipe\gecko-crash-server-pipe.2012" 5876 28de9a1a458 tab
    3⤵
    PID:2116
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2012.8.1817978781\1056551929" -childID 7 -isForBrowser -prefsHandle 5200 -prefMapHandle 5108 -prefsLen 27776 -prefMapSize 235121 -jsInitHandle 1324 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1d46ca94-9315-4adf-9d53-c93d85fecc5e} 2012 "\\.\pipe\gecko-crash-server-pipe.2012" 5256 28ded555c58 tab
    3⤵
    PID:1868

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3660

C:\Users\Admin\Downloads\7.5.2\7.5.2\Run.exe
"C:\Users\Admin\Downloads\7.5.2\7.5.2\Run.exe"
1⤵
- Suspicious use of FindShellTrayWindow
PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://support.microsoft.com/en-us/windows/turn-off-defender-antivirus-protection-in-windows-security-99e6004f-c54c-8509-773c-a4d776b77960
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:2000
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffb940046f8,0x7ffb94004708,0x7ffb94004718
    3⤵
    PID:3120
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1916,2485537897982804409,7137802533981502655,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2016 /prefetch:2
    3⤵
    PID:3032
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1916,2485537897982804409,7137802533981502655,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2284 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:920
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1916,2485537897982804409,7137802533981502655,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2716 /prefetch:8
    3⤵
    PID:1944
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,2485537897982804409,7137802533981502655,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3416 /prefetch:1
    3⤵
    PID:5288
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,2485537897982804409,7137802533981502655,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3436 /prefetch:1
    3⤵
    PID:5308
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,2485537897982804409,7137802533981502655,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4164 /prefetch:1
    3⤵
    PID:5928
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,2485537897982804409,7137802533981502655,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4160 /prefetch:1
    3⤵
    PID:6012
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,2485537897982804409,7137802533981502655,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3416 /prefetch:1
    3⤵
    PID:6132
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1916,2485537897982804409,7137802533981502655,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3712 /prefetch:8
    3⤵
    PID:5552
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1916,2485537897982804409,7137802533981502655,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3712 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5872
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,2485537897982804409,7137802533981502655,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4788 /prefetch:1
    3⤵
    PID:3012
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,2485537897982804409,7137802533981502655,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5508 /prefetch:1
    3⤵
    PID:2736
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,2485537897982804409,7137802533981502655,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4764 /prefetch:1
    3⤵
    PID:5288
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,2485537897982804409,7137802533981502655,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5112 /prefetch:1
    3⤵
    PID:6140
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\tmps1t95grq\update.exe
  2⤵
  PID:5376
- - C:\Users\Admin\AppData\Local\Temp\tmps1t95grq\update.exe
    C:\Users\Admin\AppData\Local\Temp\tmps1t95grq\update.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    PID:6044
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      4⤵
      PID:6076
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      4⤵
      PID:6084
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      4⤵
      PID:6040

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5244

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5300

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

A66A8DB907BADC9D16AD67B2FBFFDD5C

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A66A8DB907BADC9D16AD67B2FBFFDD5C
Size 282B
SHA256 cbaf0ff61770ff1935ef2c0a20a3ea79334760c357942cc94f503ff6329452c5
MD5 a16c0f1572b01b42a788d32cec1015e0
SHA1 7ba642bd117be75cb469a08e5f8acf1c64db833b
SHA512 8efd8361b187bb1c18f4b98851952ca533c19464ae2f84a1392ec408fa3a718b1047b352421fb6ca333973c906e7bee414fcd951af506189353b581876aadf1a
MD5 SHA1 SHA512

Submit Download

B2FAF7692FD9FFBD64EDE317E42334BA_89854CA6A0F0936A4D2ECA78845CEA25

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_89854CA6A0F0936A4D2ECA78845CEA25
Size 1KB
SHA256 4bc3178956d4a993e8cfcb2876608f65a5230158461cb6e6080ed4082a1ec76d
MD5 6830ad01bce1eb3757c3cda65c2d7d3f
SHA1 3d6aee22855cda6132cb5f48c683dc3941b840cf
SHA512 a8f8b0740d51d19d35a774f3968760223764f466771ffbe606d55c793d6c82c54df9ab16ad45c50eb70c4c88c55191aed430641ed9b9228ee451b2e61fb6e388
MD5 SHA1 SHA512

Submit Download

D0E1C4B6144E7ECAB3F020E4A19EFC29_B5F77004C894173A10E3A199871D2D90

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D0E1C4B6144E7ECAB3F020E4A19EFC29_B5F77004C894173A10E3A199871D2D90
Size 979B
SHA256 cadb802dae927091282db523443aad71fd20499c00f72c89d5ef6931908b8d86
MD5 e4142ea3e40148a571c1b3a66424b41c
SHA1 b32c6ecab2338ddb1ecd64124842add90d3295a7
SHA512 a716b830117ebb82b82babe906201fbc55f45ecdb1380588c18d5d128163321f13e70430bd2fb3a9c7b2455c6cbc41268cc7c32ed584be404b5b4f3086b798dc
MD5 SHA1 SHA512

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04
Size 471B
SHA256 e2a9e890d65b58e628a32e82b9783a33d1b0d59562a108242c4a6b3028705f56
MD5 68e8f05a77afd88a68c88e5169b46479
SHA1 f04c8404d5ea1ef24a58fedb29b283cfeb84dd9a
SHA512 e80d6584facf09b318f99916aece2d64e9d7a03851ea39b2a9e4e2766742e92c0866a026e04d9f9fc7d413cf4557165b4fd244b3219e7b89b5970d12e1ade772
MD5 SHA1 SHA512

Submit Download

A66A8DB907BADC9D16AD67B2FBFFDD5C

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A66A8DB907BADC9D16AD67B2FBFFDD5C
Size 480B
SHA256 0709b82996fae7cfd4fe55d8d3f269be02f9b226584e357c12ff06cd3dee442f
MD5 244c77ebe191ccc699fcfe6d7bd2df0a
SHA1 2c5dde8b6328614ec92ff9a6e2bff3e71036d773
SHA512 fda990fa442c88852103cbf052590537bfbaf60e6a0a23677a550960a7fab553898c20c8275435bc763c3ece05293fe5d13044f2652ebe690af58df3fd2d5171
MD5 SHA1 SHA512

Submit Download

B2FAF7692FD9FFBD64EDE317E42334BA_89854CA6A0F0936A4D2ECA78845CEA25

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_89854CA6A0F0936A4D2ECA78845CEA25
Size 482B
SHA256 62160440ef9531f6cba53937e117136830e87ad7eca7da7cf92e9965619e69a8
MD5 b1a2c8fc5601eaa7366f5cb366d34aa0
SHA1 0c0403d079fa3510ff0728aeaca5df6a6de7ad3a
SHA512 b84f83add3e591a04e67bb2272378c9ee381db40d609c3cefe3d57ed065851b6795a93b7969e46a8283a9bb719d5e311ef8125f8c6a2a17477d843297181ea02
MD5 SHA1 SHA512

Submit Download

D0E1C4B6144E7ECAB3F020E4A19EFC29_B5F77004C894173A10E3A199871D2D90

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D0E1C4B6144E7ECAB3F020E4A19EFC29_B5F77004C894173A10E3A199871D2D90
Size 480B
SHA256 c7ede3ea2a6f9378465cce1a911f0ec36b3abf1ea317e28a5209f0ee21c4d920
MD5 32597664bccb6c949e0fa35961bb006b
SHA1 f1d9481324d87c1a4a8622d169015cfff81d7902
SHA512 8456a5afc398b27698b31e1598b0a2a5e45f2e93e493d58f5c8003860270ced059ee56da05c6f713c8f81de9a39973df76a5422ad2b82a6c73db630649d4b3a9
MD5 SHA1 SHA512

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04
Size 412B
SHA256 6724f8b387468c8ef5f4c7176f5ec10764f23af9d627024144b65bec886647e5
MD5 0db8376dda124b9d4a47256066e94c4d
SHA1 4ebaa746ae07c560745df707951a1b5ddd1674e1
SHA512 d245a2442f2dd5238e2a0f48bffa4b2d0f2d91b61e8f2f0d794d18f9c6b9be4f2623a3bea9b9ddc1f3951bbc517d1ed7a6f2ffc591eed4bf6aea6eab6c683554
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 ef7baeb1b2ab05ff3c5fbb76c2759db49294654548706c7c8e87f0cde855b86b
MD5 eaa3db555ab5bc0cb364826204aad3f0
SHA1 a4cdfaac8de49e6e6e88b335cfeaa7c9e3c563ca
SHA512 e13981da51b52c15261ecabb98af32f9b920651b46b10ce0cc823c5878b22eb1420258c80deef204070d1e0bdd3a64d875ac2522e3713a3cf11657aa55aeccd4
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 d824b742eace197ddc8b6ed5d918f390fde4b0fbf0e371b8e1f2ed40a3b6455c
MD5 4b4f91fa1b362ba5341ecb2836438dea
SHA1 9561f5aabed742404d455da735259a2c6781fa07
SHA512 fef22217dcdd8000bc193e25129699d4b8f7a103ca4fe1613baf73ccf67090d9fbae27eb93e4bb8747455853a0a4326f2d0c38df41c8d42351cdcd4132418dac
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 456B
SHA256 f29e496f809f3781aae2e302533777e135c67d6a3ee549868f63501c99272f7a
MD5 9cc16d57a1bb6cb44ae72cf16dc9682f
SHA1 03e758ca7cbcef3e813eed88cdba6a1fd4f0dcd4
SHA512 4f7c145c1796d517ccab3ad0d45fd0e2207db44995fd79b52e2743952642ff02806fdad6126a060de3b6a0d066275a17811d7619f7c03d300acfb78666b2b77c
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 93378d391b4145eb5a90182ee8380dd0b04d68d3a50ebf1433753a8ddbe6f90e
MD5 b67a70a64351af3e6f964cb98d30f742
SHA1 3b0775d91c10ec78aabc05c6cf96fab74e91cf8a
SHA512 754453ee5b0e5bc2d3aae1eea722ab11593230bf74dfe879576dae541d9d079d81e0f5be6b5a853590c945fcdfb9a1fdea13ad18cb25d5f2f6dd49b626ebda2b
SSDEEP 96:nWkBK1MJaxj0wpvWMoiVmdeHmQI6UWQyV+VDCziEwb:nWkImJaxj0GWMXhro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 ed03130288f6f68d7ca7ff0d89b0d9bc7e648f9ce122afe2a165bc56d6ad9c91
MD5 56133ddae4a155d231fee05f7bf3b16f
SHA1 37581d2f6fbdc8d28fae14c7fcdd8f742d88bf92
SHA512 e36effef151afc78c50ae85678288ed77553ef8144d796d39fe9be606cbee980332006186b88066f43c7848766c6608559a4d9a19e24294928e307a889d69ff0
SSDEEP 96:nWkkK1MJarj0wpvRrWMoiVmdeY4uB1jmQEfUWQyV+VD7AiEwb:nWkbmJarj0IrWM7uBhsrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 dd9ca3f44dff540086756fb4b5b2317ba0031afe57c14f77eb82da8532741658
MD5 ce9989a53beda79da69d831c01d59866
SHA1 adf7259e0fe2d33441c626ed99af6a2b72b1d7d1
SHA512 7dcd0434a89cd45102c6ff99a0ab1fa6f664ea5e4f99840b555d10a14e681e7eddd21f6ed6f9dcbb0060be1b3e6b4972fd759884c02b020e7d951c3f1f9c7e1c
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe5b3313.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5b3313.TMP
Size 1KB
SHA256 58392cdcc31f121f4af6affc45091a2888611fe0a8e0751cdee6a1eeebfc14c9
MD5 c7cd72381499ff31756ad85d05a1f982
SHA1 92bddb756411527037af23f8e7da7a2c5e1413ed
SHA512 4aaed5071688742fc82cb203a2dcc21b0cdc81c0bca12e54824f5bf340bcb05fd7702d3985e51ec4e120b8d2b81c9cddc6a0872599407f99d294d6489c601bd1
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 10132f9fbad731b755378a5441a670b503cdc70c8f4c90ac1d2e6f509e02d52a
MD5 8fbfdf8631b98723b607f85e8b61cedd
SHA1 e6a3714672f4b8a3e2c45218c2393b952a624de8
SHA512 e4db880246e8d334ecec68215b220f54bc7234b50b59412e4408825a3cd42637bdb76a8f3ff717fed77a9b31c138953db3f32112b8e322378b1bb63eb3f1b67f
SSDEEP 192:zoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupWre2RU/IKbWfYOxhZHnqTr:T9iIxuERzA83h09RZxYW74YxTHqTMTPa
MD5 SHA1 SHA512 SSDEEP

Submit Download

json[1].json

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\AKI8W8FH\json[1].json
Size 297B
SHA256 1191fa5928ed7ebf51830c0e601a327fb6480e4f35d9f96962c828b5b45ea260
MD5 be2ba1a8c142b5fa2178396ac67cb7d8
SHA1 b7c3d209d9c95d4b67d7ffb3c777d07f398260a5
SHA512 cca824422ebcc194e96c6af6c66160409b6c4f9e30af387921ad55712fc4316866e7ac3b2806427f7e06e43e99ef56e612738261f8d38fb58ef2758dc13c9204
MD5 SHA1 SHA512

Submit Download

conf[1].log

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\DL7YY2B9\conf[1].log
Size 4.1MB
SHA256 286dca4423a65cbd5d23e9bf002e584ec16a88c0a5edf4cfdc6b639d982593ad
MD5 0ffd3bd05a9281981db2330e5a7291c1
SHA1 fabbfea6c072f68692b81571d38e8eab72de1362
SHA512 54ff1df237207e4fe70808583b96a07d0366887ed7e3389527eaadb6c3e045c19c4ba1621a47e24fa661f52b504274b46af91acd1b562bc15b1e51518846c333
SSDEEP 49152:6TARY1Pk4SLWTdxBDVnLw+Q93wOdiWapjHGwS5QihRI0cqTwnZjMdX+w2M/hRSFa:x
MD5 SHA1 SHA512 SSDEEP

Submit Download

activity-stream.discovery_stream.json.tmp

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\7jyxcjs8.default-release\activity-stream.discovery_stream.json.tmp
Size 25KB
SHA256 d2f5efa2ea87b5e2aa31971e4b099e94102524f3fc10e81fe69c92aded312534
MD5 1f3c294904553a5605448e517ca1ad4b
SHA1 9c76f260d4e3b5d26c0797234b61607611de0dbd
SHA512 f71ab2f675640ece0b4bd57c49e57d194014cfb12d443d8a38bb8b756374cec551a5a056f7093dba25c0ef81260fa956e942cbc992199778895dd3be576fb854
SSDEEP 384:rH4HexSsnJvEjuoocmwDfg7Jkil5WeITyKeiVZd25aDgtOPAWjLepiudTyaa:rHOerSAKg7flKeiVZBD8pFy1
MD5 SHA1 SHA512 SSDEEP

Submit Download

383A97A57B113BD106DE6984E6DBA5F537327263

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\7jyxcjs8.default-release\cache2\entries\383A97A57B113BD106DE6984E6DBA5F537327263
Size 13KB
SHA256 3a4bef5a74a45e5ca584bdeaf3f7f49ac63577b953456d1c32cabf850c8c8e71
MD5 93272d2071eed4593c769af8b4884266
SHA1 5bd3a6466c9432ea384a61e0045024dbd00ef903
SHA512 75e0a5126d7c9b3298556bf2eba35c24fb192606b41161f6a42115a5db6b1875a233486cc1741d13d273d0e5bf62cf0797f0d8e3d06d950a5cecc01e811001eb
SSDEEP 384:H7Ku9fiGLm4pUkuL6eFuFmn/4OgQ2TdlqGPUcP+AWRMACaCmCU:vBi8mCUkVewUn/4dlqkD+hRMFA
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 442KB
SHA256 a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e
MD5 85430baed3398695717b0263807cf97c
SHA1 fffbee923cea216f50fce5d54219a188a5100f41
SHA512 06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1
SSDEEP 12288:tESTeqTI2r4ZbCgUKWKNeRcPMb6qlV7hVZe3:tEsed2Xh9/bdzZe3
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon-1

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
Size 8.0MB
SHA256 345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42
MD5 a01c5ecd6108350ae23d2cddf0e77c17
SHA1 c6ac28a2cd979f1f9a75d56271821d5ff665e2b6
SHA512 b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72
SSDEEP 196608:945hXmP7/cvflwtf0FzVC/5lHevzc8XZbivwEiw3cFTx7z4zV:9tP7/cvflof0FzVgKRF9zw3c9x4zV
MD5 SHA1 SHA512 SSDEEP

Submit Download

update.exe

Path C:\Users\Admin\AppData\Local\Temp\tmps1t95grq\update.exe
Size 540KB
SHA256 a81808810057944530b126dfb6558b362d7c0bd3ad3e2d80ecbcd4720f6fed35
MD5 188766d3c11541238c2f3b363b742154
SHA1 c12faa9f844e633e9e4c28d331b291e35c11946a
SHA512 2bda65ed4d65d38c0a2469f8977491c6400d36a3db462e1b3dbf973a9f5f7ba8ef6f949fa0f32b49be5795a2c323f42e8dd2cc4b2aefb9bc12b89faae95bf245
SSDEEP 12288:RiQ6aJMg2igCzHupaOfB7eV2BSdS9+pwyqoH1JD4oEO:RqaRbzHuppJ7eVE9+p/HT4ot
MD5 SHA1 SHA512 SSDEEP

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7jyxcjs8.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll
Size 997KB
SHA256 1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e
MD5 fe3355639648c417e8307c6d051e3e37
SHA1 f54602d4b4778da21bc97c7238fc66aa68c8ee34
SHA512 8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c
SSDEEP 12288:vYLdTfFKbNSjv92eFN+3wH+NYriA0Iq6lh6VawYIpAvwHN/Uf1h47HAfg1oet:vYLdTZ923NYrjwNpgwef1hzfg1x
MD5 SHA1 SHA512 SSDEEP

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7jyxcjs8.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info
Size 116B
SHA256 f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b
MD5 3d33cdc0b3d281e67dd52e14435dd04f
SHA1 4db88689282fd4f9e9e6ab95fcbb23df6e6485db
SHA512 a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1
MD5 SHA1 SHA512

Submit Download

LICENSE.txt

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7jyxcjs8.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt
Size 479B
SHA256 2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539
MD5 49ddb419d96dceb9069018535fb2e2fc
SHA1 62aa6fea895a8b68d468a015f6e6ab400d7a7ca6
SHA512 48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7jyxcjs8.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json
Size 372B
SHA256 e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd
MD5 8be33af717bb1b67fbd61c3f4b807e9e
SHA1 7cf17656d174d951957ff36810e874a134dd49e0
SHA512 6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7
MD5 SHA1 SHA512

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7jyxcjs8.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll
Size 11.8MB
SHA256 8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e
MD5 33bf7b0439480effb9fb212efce87b13
SHA1 cee50f2745edc6dc291887b6075ca64d716f495a
SHA512 d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275
SSDEEP 196608:lP4/vkvbdjMq4ytbko4qIUcXkhrVp1HSTDsoTn90lcGeFaxJI3qLaLhFT7Uc:lPcvyiXSWxRU/OpZXJFee3qGhFMc
MD5 SHA1 SHA512 SSDEEP

Submit Download

widevinecdm.dll.lib

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7jyxcjs8.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib
Size 1KB
SHA256 33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237
MD5 688bed3676d2104e7f17ae1cd2c59404
SHA1 952b2cdf783ac72fcb98338723e9afd38d47ad8e
SHA512 7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776
MD5 SHA1 SHA512

Submit Download

widevinecdm.dll.sig

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7jyxcjs8.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig
Size 1KB
SHA256 68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81
MD5 937326fead5fd401f6cca9118bd9ade9
SHA1 4526a57d4ae14ed29b37632c72aef3c408189d91
SHA512 b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2
MD5 SHA1 SHA512

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7jyxcjs8.default-release\prefs-1.js
Size 7KB
SHA256 fb571210d0e6630bba4328b22a7e86be39ac098c4ee6f5511f9a7dbd258c8964
MD5 68ec1da8d1275acca0acb0b65c77c5ef
SHA1 da9ea750d34a7baccb6ea93de1ceb0bedb03f3ea
SHA512 bc8ce1b1da56dba116c54909c794679fdbe039f96d55b30c7665eef5fed0323056aaeb31839cddc28e94d814169c347832120d7036eb65cc680727b6f63e5674
SSDEEP 96:xHIpnUTUvPqGqSf1j0LHzS10XlnBOj03I2HAm92e1LBw8Hc0SS1GS:CpnfCRSf1jUc0Xbf3IYAm9FpBw8HczS/
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7jyxcjs8.default-release\prefs-1.js
Size 6KB
SHA256 8decba63c84ab755f65638c127de9a59b09556e7366d0140125726dceb3dc648
MD5 bb908bfcc79404f8c078e5e8605fdfb5
SHA1 63ee516005411f7cd0b1ed0d478e501d61b0c6c6
SHA512 4c16050e87d3b1878b7c4f4f051239547f5103087313ed0b9fa4f1aca4a7e01714dada08e31d80b5255cc453a4b95a60fbc3af645a26cbff2df50e28cf1e0749
SSDEEP 96:xHI5nUTUkqGqSf1j0LHzS10XlnBOj03I2HAm92e1LBw8Hc0ZS1GS:C5nnRSf1jUc0Xbf3IYAm9FpBw8Hc8S/
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7jyxcjs8.default-release\prefs-1.js
Size 9KB
SHA256 847db85428a175463adda3a35d8f8b86ae6c47f136951197c0e7e65d271913f5
MD5 e3fdb1dcb27df28ad59272214c30be4b
SHA1 628a2789271edab579aa922673701ea1e32ca444
SHA512 9068f86a724b3416796cd7a715ba978ea4b7d48bcbbff97c442de30a59017d9a09222cb4a943578dc16d20efb997d9ece0780011725199e44f84a706bd0fff91
SSDEEP 192:UynfCRSf1jUc0Xbf3IYAm9FBeBw8HczAS/:Te/IY390wWQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7jyxcjs8.default-release\sessionstore-backups\recovery.jsonlz4
Size 4KB
SHA256 8848a9ac73924ed55f7fc8b6675e385f94f118cffbec7eedf26e5c218b60e3fb
MD5 5d1bc93dbe4a4a50370d8ffd34b7ec6d
SHA1 f1e817b5a47050b52469ad1f3187295bde538735
SHA512 1542b19c02b6efe3059f95d0d812f1cac2969d341f08e0bf65d855d87935dc9d4075e3916a310a1c54033b9ee04ae11a17d4f1d53bb3aa17598dd798459bd95f
SSDEEP 96:pdUi8EMJF7VbMZk0zf8W8Qge3ZwS2iT0u2:LVRgF5MZkcuemGw
MD5 SHA1 SHA512 SSDEEP

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7jyxcjs8.default-release\sessionstore-backups\recovery.jsonlz4
Size 7KB
SHA256 11c80c5b3bca24e793054616d6bd87162f4ea58630bf3c9ca6a0aabce60d8d30
MD5 0f0511ef3328f9bdcd671aab01c8892c
SHA1 d3684a1c35156b1c5920ceb603954eec48a9cacd
SHA512 9b7ded28f9eabbd39f2e951fcb3b079156c84f4166afca95eb998e3ded93a7ae413150be6c7cc17d835c815224d54e3b84003b69f0f8cd118b0ca47d4cf89dac
SSDEEP 192:TJMYAALJa7mIb98ONl79sUpigFtUgN1nyQX65RXQKbi6:TCYpLWmMWwwUHFegThwQKbi6
MD5 SHA1 SHA512 SSDEEP

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7jyxcjs8.default-release\sessionstore-backups\recovery.jsonlz4
Size 4KB
SHA256 aa1c530f77c2572b919e054d4aa5db8f0905bd2af777e218fbcb3df4b6edb6d6
MD5 33733181f4a44fd28e7bb4e54f18499f
SHA1 fba343753aca8f1907db8b5c4c31b1031ff8fb3e
SHA512 e4bcb782395e3b15aaabe12a6e996343b5c4614268e6b8aade24e62abbc603d4f6b8404ffcbdc152a180c63fb723d083b608a9791a4c06421a68996546361b9f
SSDEEP 96:KVC93MYLC7ALJOF7T6j8b98Ox15v9cfSx2OiINt/uiXQKbRAFq:JJMYAALJa7mIb98ONlcfX6NnXQKbiA
MD5 SHA1 SHA512 SSDEEP

Submit Download

7.gdA__n2R.5.2.zip.part

Path C:\Users\Admin\Downloads\7.gdA__n2R.5.2.zip.part
Size 63KB
SHA256 64343a60bf6591e7426c8df8daf4fe58c031e12d37523ce59b607a1aa429d185
MD5 e3a9ef35d7c14bf05fe56e0e0d99c5e3
SHA1 a329cf0e0914d6ec48786ebe6a9d66db019ec61a
SHA512 097a02b026a4971d976b875d5f002cbc2463ed4436a9198634647d269a868a80b7a5f9921de94a73017205fb5bec05e92836f54eb81f76214d62f4baeb5363be
SSDEEP 1536:fna051+LE4OxiWxe3imX9wtcY+Yz204kwq7a2Q0xzv/zq1h:PL51+LE4OxrAwtcY+YU6bA
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2248-41-0x000000007F860000-0x000000007F870000-memory.dmp

Download

memory/2248-32-0x000000007F860000-0x000000007F870000-memory.dmp

Download

memory/2248-26-0x000000007F860000-0x000000007F870000-memory.dmp

Download

memory/2248-25-0x000000007F860000-0x000000007F870000-memory.dmp

Download

memory/2248-24-0x000000007F860000-0x000000007F870000-memory.dmp

Download

memory/2248-23-0x000000007F860000-0x000000007F870000-memory.dmp

Download

memory/2248-22-0x000000007F860000-0x000000007F870000-memory.dmp

Download

memory/2248-21-0x000000007F860000-0x000000007F870000-memory.dmp

Download

memory/2248-20-0x000000007F860000-0x000000007F870000-memory.dmp

Download

memory/2248-19-0x000000007F860000-0x000000007F870000-memory.dmp

Download

memory/2248-18-0x000000007F860000-0x000000007F870000-memory.dmp

Download

memory/2248-17-0x000000007F860000-0x000000007F870000-memory.dmp

Download

memory/2248-16-0x000000007F860000-0x000000007F870000-memory.dmp

Download

memory/2248-14-0x000000007F860000-0x000000007F870000-memory.dmp

Download

memory/2248-13-0x000000007F860000-0x000000007F870000-memory.dmp

Download

memory/2248-11-0x000000007F860000-0x000000007F870000-memory.dmp

Download

memory/2248-10-0x000000007F860000-0x000000007F870000-memory.dmp

Download

memory/2248-9-0x000000007F860000-0x000000007F870000-memory.dmp

Download

memory/2248-8-0x000000007F860000-0x000000007F870000-memory.dmp

Download

memory/2248-7-0x000000007F860000-0x000000007F870000-memory.dmp

Download

memory/2248-6-0x000000007F860000-0x000000007F870000-memory.dmp

Download

memory/2248-5-0x000000007F860000-0x000000007F870000-memory.dmp

Download

memory/2248-4-0x000000007F860000-0x000000007F870000-memory.dmp

Download

memory/2248-3-0x000000007F860000-0x000000007F870000-memory.dmp

Download

memory/2248-2-0x000000007F860000-0x000000007F870000-memory.dmp

Download

memory/2248-1-0x000000007F860000-0x000000007F870000-memory.dmp

Download

memory/2248-0-0x000000007F860000-0x000000007F870000-memory.dmp

Download

memory/2248-81-0x0000000000830000-0x0000000000831000-memory.dmp

Download

memory/2248-171-0x0000000000830000-0x0000000000831000-memory.dmp

Download

memory/2248-15-0x000000007F860000-0x000000007F870000-memory.dmp

Download

memory/2248-12-0x000000007F860000-0x000000007F870000-memory.dmp

Download

memory/2248-28-0x000000007F860000-0x000000007F870000-memory.dmp

Download

memory/2248-29-0x000000007F860000-0x000000007F870000-memory.dmp

Download

memory/2248-30-0x000000007F860000-0x000000007F870000-memory.dmp

Download

memory/2248-31-0x000000007F860000-0x000000007F870000-memory.dmp

Download

memory/2248-27-0x000000007F860000-0x000000007F870000-memory.dmp

Download

memory/2248-33-0x000000007F860000-0x000000007F870000-memory.dmp

Download

memory/2248-34-0x000000007F860000-0x000000007F870000-memory.dmp

Download

memory/2248-35-0x000000007F860000-0x000000007F870000-memory.dmp

Download

memory/2248-36-0x000000007F860000-0x000000007F870000-memory.dmp

Download

memory/2248-37-0x000000007F860000-0x000000007F870000-memory.dmp

Download

memory/2248-38-0x000000007F860000-0x000000007F870000-memory.dmp

Download

memory/2248-39-0x000000007F860000-0x000000007F870000-memory.dmp

Download

memory/2248-40-0x000000007F860000-0x000000007F870000-memory.dmp

Download

memory/2248-61-0x000000007F860000-0x000000007F870000-memory.dmp

Download

memory/2248-42-0x000000007F860000-0x000000007F870000-memory.dmp

Download

memory/2248-43-0x000000007F860000-0x000000007F870000-memory.dmp

Download

memory/2248-44-0x000000007F860000-0x000000007F870000-memory.dmp

Download

memory/2248-45-0x000000007F860000-0x000000007F870000-memory.dmp

Download

memory/2248-46-0x000000007F860000-0x000000007F870000-memory.dmp

Download

memory/2248-47-0x000000007F860000-0x000000007F870000-memory.dmp

Download

memory/2248-48-0x000000007F860000-0x000000007F870000-memory.dmp

Download

memory/2248-49-0x000000007F860000-0x000000007F870000-memory.dmp

Download

memory/2248-50-0x000000007F860000-0x000000007F870000-memory.dmp

Download

memory/2248-51-0x000000007F860000-0x000000007F870000-memory.dmp

Download

memory/2248-52-0x000000007F860000-0x000000007F870000-memory.dmp

Download

memory/2248-53-0x000000007F860000-0x000000007F870000-memory.dmp

Download

memory/2248-54-0x000000007F860000-0x000000007F870000-memory.dmp

Download

memory/2248-55-0x000000007F860000-0x000000007F870000-memory.dmp

Download

memory/2248-56-0x000000007F860000-0x000000007F870000-memory.dmp

Download

memory/2248-57-0x000000007F860000-0x000000007F870000-memory.dmp

Download

memory/2248-58-0x000000007F860000-0x000000007F870000-memory.dmp

Download

memory/2248-60-0x000000007F860000-0x000000007F870000-memory.dmp

Download

memory/2248-59-0x000000007F860000-0x000000007F870000-memory.dmp

Download

memory/2248-73-0x0000000000830000-0x0000000000831000-memory.dmp

Download

memory/2248-74-0x0000000000830000-0x0000000000831000-memory.dmp

Download

memory/2248-75-0x0000000000830000-0x0000000000831000-memory.dmp

Download

memory/2248-62-0x000000007F860000-0x000000007F870000-memory.dmp

Download

memory/2248-63-0x000000007F860000-0x000000007F870000-memory.dmp

Download

memory/4832-253-0x000001F017150000-0x000001F017151000-memory.dmp

Download

memory/4832-254-0x000001F017150000-0x000001F017151000-memory.dmp

Download