lumma | hxxps://tinyurl[.]com/geometrymodmenu

Analysis

max time kernel
139s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
10/06/2024, 21:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://tinyurl.com/geometrymodmenu
Sample240610-1b2n2a1cnd

Score

10^/10

lumma execution stealer

Malware Config

Extracted

Family

lumma

https://economilgreattykow.shop/api
https://liabiliytshareodlkv.shop/api
https://notoriousdcellkw.shop/api
https://conferencefreckewl.shop/api
https://flourhishdiscovrw.shop/api
https://landdumpycolorwskfw.shop/api
https://ohfantasyproclaiwlo.shop/api
https://parallelmercywksoffw.shop/api
https://barebrilliancedkoso.shop/api

Signatures

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
1664	powershell.exe
5016	powershell.exe
5016	powershell.exe
1664	powershell.exe

Downloads MZ/PE file

Executes dropped EXE 2 IoCs

pid	Process
3168	driver1.exe
3436	winrar-x64-701.exe

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	Startuрее.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	Startuрее.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
1436	wmic.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery

T1057

pid	Process
3236	tasklist.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

GoLang User-Agent 3 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	120	Go-http-client/1.1
HTTP User-Agent header	122	Go-http-client/1.1
HTTP User-Agent header	123	Go-http-client/1.1

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3571316656-3665257725-2415531812-1000\{CB51A45D-4963-42C2-92BF-D85D21DF43CB}	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 64576.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 29 IoCs

pid	Process
624	msedge.exe
624	msedge.exe
1684	msedge.exe
1684	msedge.exe
4220	identity_helper.exe
4220	identity_helper.exe
1624	msedge.exe
1624	msedge.exe
4784	msedge.exe
4784	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	Startuрее.exe
5016	powershell.exe
5016	powershell.exe
5016	powershell.exe
1664	powershell.exe
1664	powershell.exe
1664	powershell.exe
3168	driver1.exe
3168	driver1.exe
1820	msedge.exe
1820	msedge.exe
1732	msedge.exe
1732	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2848	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 20 IoCs

pid	Process
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	1436	wmic.exe
Token: SeSecurityPrivilege	1436	wmic.exe
Token: SeTakeOwnershipPrivilege	1436	wmic.exe
Token: SeLoadDriverPrivilege	1436	wmic.exe
Token: SeSystemProfilePrivilege	1436	wmic.exe
Token: SeSystemtimePrivilege	1436	wmic.exe
Token: SeProfSingleProcessPrivilege	1436	wmic.exe
Token: SeIncBasePriorityPrivilege	1436	wmic.exe
Token: SeCreatePagefilePrivilege	1436	wmic.exe
Token: SeBackupPrivilege	1436	wmic.exe
Token: SeRestorePrivilege	1436	wmic.exe
Token: SeShutdownPrivilege	1436	wmic.exe
Token: SeDebugPrivilege	1436	wmic.exe
Token: SeSystemEnvironmentPrivilege	1436	wmic.exe
Token: SeRemoteShutdownPrivilege	1436	wmic.exe
Token: SeUndockPrivilege	1436	wmic.exe
Token: SeManageVolumePrivilege	1436	wmic.exe
Token: 33	1436	wmic.exe
Token: 34	1436	wmic.exe
Token: 35	1436	wmic.exe
Token: 36	1436	wmic.exe
Token: SeIncreaseQuotaPrivilege	1436	wmic.exe
Token: SeSecurityPrivilege	1436	wmic.exe
Token: SeTakeOwnershipPrivilege	1436	wmic.exe
Token: SeLoadDriverPrivilege	1436	wmic.exe
Token: SeSystemProfilePrivilege	1436	wmic.exe
Token: SeSystemtimePrivilege	1436	wmic.exe
Token: SeProfSingleProcessPrivilege	1436	wmic.exe
Token: SeIncBasePriorityPrivilege	1436	wmic.exe
Token: SeCreatePagefilePrivilege	1436	wmic.exe
Token: SeBackupPrivilege	1436	wmic.exe
Token: SeRestorePrivilege	1436	wmic.exe
Token: SeShutdownPrivilege	1436	wmic.exe
Token: SeDebugPrivilege	1436	wmic.exe
Token: SeSystemEnvironmentPrivilege	1436	wmic.exe
Token: SeRemoteShutdownPrivilege	1436	wmic.exe
Token: SeUndockPrivilege	1436	wmic.exe
Token: SeManageVolumePrivilege	1436	wmic.exe
Token: 33	1436	wmic.exe
Token: 34	1436	wmic.exe
Token: 35	1436	wmic.exe
Token: 36	1436	wmic.exe
Token: SeDebugPrivilege	3236	tasklist.exe
Token: SeDebugPrivilege	5016	powershell.exe
Token: SeDebugPrivilege	1664	powershell.exe
Token: SeIncreaseQuotaPrivilege	2892	wmic.exe
Token: SeSecurityPrivilege	2892	wmic.exe
Token: SeTakeOwnershipPrivilege	2892	wmic.exe
Token: SeLoadDriverPrivilege	2892	wmic.exe
Token: SeSystemProfilePrivilege	2892	wmic.exe
Token: SeSystemtimePrivilege	2892	wmic.exe
Token: SeProfSingleProcessPrivilege	2892	wmic.exe
Token: SeIncBasePriorityPrivilege	2892	wmic.exe
Token: SeCreatePagefilePrivilege	2892	wmic.exe
Token: SeBackupPrivilege	2892	wmic.exe
Token: SeRestorePrivilege	2892	wmic.exe
Token: SeShutdownPrivilege	2892	wmic.exe
Token: SeDebugPrivilege	2892	wmic.exe
Token: SeSystemEnvironmentPrivilege	2892	wmic.exe
Token: SeRemoteShutdownPrivilege	2892	wmic.exe
Token: SeUndockPrivilege	2892	wmic.exe
Token: SeManageVolumePrivilege	2892	wmic.exe
Token: 33	2892	wmic.exe
Token: 34	2892	wmic.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe

Suspicious use of SendNotifyMessage 26 IoCs

pid	Process
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe

Suspicious use of SetWindowsHookEx 14 IoCs

pid	Process
2848	OpenWith.exe
2848	OpenWith.exe
2848	OpenWith.exe
2848	OpenWith.exe
2848	OpenWith.exe
2848	OpenWith.exe
2848	OpenWith.exe
2848	OpenWith.exe
2848	OpenWith.exe
2848	OpenWith.exe
2848	OpenWith.exe
3436	winrar-x64-701.exe
3436	winrar-x64-701.exe
3436	winrar-x64-701.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1684 wrote to memory of 2812	1684	msedge.exe	80
PID 1684 wrote to memory of 2812	1684	msedge.exe	80
PID 1684 wrote to memory of 1368	1684	msedge.exe	81
PID 1684 wrote to memory of 1368	1684	msedge.exe	81
PID 1684 wrote to memory of 1368	1684	msedge.exe	81
PID 1684 wrote to memory of 1368	1684	msedge.exe	81
PID 1684 wrote to memory of 1368	1684	msedge.exe	81
PID 1684 wrote to memory of 1368	1684	msedge.exe	81
PID 1684 wrote to memory of 1368	1684	msedge.exe	81
PID 1684 wrote to memory of 1368	1684	msedge.exe	81
PID 1684 wrote to memory of 1368	1684	msedge.exe	81
PID 1684 wrote to memory of 1368	1684	msedge.exe	81
PID 1684 wrote to memory of 1368	1684	msedge.exe	81
PID 1684 wrote to memory of 1368	1684	msedge.exe	81
PID 1684 wrote to memory of 1368	1684	msedge.exe	81
PID 1684 wrote to memory of 1368	1684	msedge.exe	81
PID 1684 wrote to memory of 1368	1684	msedge.exe	81
PID 1684 wrote to memory of 1368	1684	msedge.exe	81
PID 1684 wrote to memory of 1368	1684	msedge.exe	81
PID 1684 wrote to memory of 1368	1684	msedge.exe	81
PID 1684 wrote to memory of 1368	1684	msedge.exe	81
PID 1684 wrote to memory of 1368	1684	msedge.exe	81
PID 1684 wrote to memory of 1368	1684	msedge.exe	81
PID 1684 wrote to memory of 1368	1684	msedge.exe	81
PID 1684 wrote to memory of 1368	1684	msedge.exe	81
PID 1684 wrote to memory of 1368	1684	msedge.exe	81
PID 1684 wrote to memory of 1368	1684	msedge.exe	81
PID 1684 wrote to memory of 1368	1684	msedge.exe	81
PID 1684 wrote to memory of 1368	1684	msedge.exe	81
PID 1684 wrote to memory of 1368	1684	msedge.exe	81
PID 1684 wrote to memory of 1368	1684	msedge.exe	81
PID 1684 wrote to memory of 1368	1684	msedge.exe	81
PID 1684 wrote to memory of 1368	1684	msedge.exe	81
PID 1684 wrote to memory of 1368	1684	msedge.exe	81
PID 1684 wrote to memory of 1368	1684	msedge.exe	81
PID 1684 wrote to memory of 1368	1684	msedge.exe	81
PID 1684 wrote to memory of 1368	1684	msedge.exe	81
PID 1684 wrote to memory of 1368	1684	msedge.exe	81
PID 1684 wrote to memory of 1368	1684	msedge.exe	81
PID 1684 wrote to memory of 1368	1684	msedge.exe	81
PID 1684 wrote to memory of 1368	1684	msedge.exe	81
PID 1684 wrote to memory of 1368	1684	msedge.exe	81
PID 1684 wrote to memory of 624	1684	msedge.exe	82
PID 1684 wrote to memory of 624	1684	msedge.exe	82
PID 1684 wrote to memory of 4368	1684	msedge.exe	83
PID 1684 wrote to memory of 4368	1684	msedge.exe	83
PID 1684 wrote to memory of 4368	1684	msedge.exe	83
PID 1684 wrote to memory of 4368	1684	msedge.exe	83
PID 1684 wrote to memory of 4368	1684	msedge.exe	83
PID 1684 wrote to memory of 4368	1684	msedge.exe	83
PID 1684 wrote to memory of 4368	1684	msedge.exe	83
PID 1684 wrote to memory of 4368	1684	msedge.exe	83
PID 1684 wrote to memory of 4368	1684	msedge.exe	83
PID 1684 wrote to memory of 4368	1684	msedge.exe	83
PID 1684 wrote to memory of 4368	1684	msedge.exe	83
PID 1684 wrote to memory of 4368	1684	msedge.exe	83
PID 1684 wrote to memory of 4368	1684	msedge.exe	83
PID 1684 wrote to memory of 4368	1684	msedge.exe	83
PID 1684 wrote to memory of 4368	1684	msedge.exe	83
PID 1684 wrote to memory of 4368	1684	msedge.exe	83
PID 1684 wrote to memory of 4368	1684	msedge.exe	83
PID 1684 wrote to memory of 4368	1684	msedge.exe	83
PID 1684 wrote to memory of 4368	1684	msedge.exe	83
PID 1684 wrote to memory of 4368	1684	msedge.exe	83

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://tinyurl.com/geometrymodmenu
1⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffaf8b746f8,0x7ffaf8b74708,0x7ffaf8b74718
  2⤵
  PID:2812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2200,5871052293744326634,13632614609079221205,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2204 /prefetch:2
  2⤵
  PID:1368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2200,5871052293744326634,13632614609079221205,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2200,5871052293744326634,13632614609079221205,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2836 /prefetch:8
  2⤵
  PID:4368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,5871052293744326634,13632614609079221205,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:1872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,5871052293744326634,13632614609079221205,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:1828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,5871052293744326634,13632614609079221205,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5092 /prefetch:1
  2⤵
  PID:3244
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2200,5871052293744326634,13632614609079221205,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5768 /prefetch:8
  2⤵
  PID:3464
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2200,5871052293744326634,13632614609079221205,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5768 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2200,5871052293744326634,13632614609079221205,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5288 /prefetch:8
  2⤵
  PID:384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,5871052293744326634,13632614609079221205,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5428 /prefetch:1
  2⤵
  PID:4528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,5871052293744326634,13632614609079221205,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6024 /prefetch:1
  2⤵
  PID:3820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,5871052293744326634,13632614609079221205,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5332 /prefetch:1
  2⤵
  PID:3688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,5871052293744326634,13632614609079221205,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5896 /prefetch:1
  2⤵
  PID:3464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,5871052293744326634,13632614609079221205,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6600 /prefetch:1
  2⤵
  PID:4492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2200,5871052293744326634,13632614609079221205,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5332 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,5871052293744326634,13632614609079221205,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6048 /prefetch:1
  2⤵
  PID:508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,5871052293744326634,13632614609079221205,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3736 /prefetch:1
  2⤵
  PID:4632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2200,5871052293744326634,13632614609079221205,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5896 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,5871052293744326634,13632614609079221205,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6340 /prefetch:1
  2⤵
  PID:1652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2200,5871052293744326634,13632614609079221205,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5152 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,5871052293744326634,13632614609079221205,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6816 /prefetch:1
  2⤵
  PID:3448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,5871052293744326634,13632614609079221205,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6232 /prefetch:1
  2⤵
  PID:680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,5871052293744326634,13632614609079221205,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,5871052293744326634,13632614609079221205,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6564 /prefetch:1
  2⤵
  PID:3480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,5871052293744326634,13632614609079221205,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5112 /prefetch:1
  2⤵
  PID:4560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2200,5871052293744326634,13632614609079221205,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5848 /prefetch:8
  2⤵
  PID:3520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2200,5871052293744326634,13632614609079221205,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=6872 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:1820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,5871052293744326634,13632614609079221205,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=180 /prefetch:1
  2⤵
  PID:4636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,5871052293744326634,13632614609079221205,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5028 /prefetch:1
  2⤵
  PID:2896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,5871052293744326634,13632614609079221205,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6960 /prefetch:1
  2⤵
  PID:1904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,5871052293744326634,13632614609079221205,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5796 /prefetch:1
  2⤵
  PID:3184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2200,5871052293744326634,13632614609079221205,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6888 /prefetch:8
  2⤵
  PID:4064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2200,5871052293744326634,13632614609079221205,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6416 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1732
- C:\Users\Admin\Downloads\winrar-x64-701.exe
  "C:\Users\Admin\Downloads\winrar-x64-701.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2200,5871052293744326634,13632614609079221205,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6228 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4496

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1892

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3692

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2528

C:\Users\Admin\Downloads\lnjector\lnjector\Startuрее.exe
"C:\Users\Admin\Downloads\lnjector\lnjector\Startuрее.exe"
1⤵
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
PID:3620
- C:\Windows\System32\Wbem\wmic.exe
  wmic path win32_VideoController get name
  2⤵
  - Detects videocard installed
  - Suspicious use of AdjustPrivilegeToken
  PID:1436
- C:\Windows\system32\tasklist.exe
  tasklist
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:3236
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle hidden -Command "Add-MpPreference -ExclusionPath \"C:\ProgramData\";" powershell -WindowStyle hidden -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\Downloads\lnjector\lnjector\Startuрее.exe\""
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5016
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle hidden -Command Add-MpPreference -ExclusionPath C:\Users\Admin\Downloads\lnjector\lnjector\Startuрее.exe
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1664
- C:\Windows\System32\Wbem\wmic.exe
  wmic csproduct get uuid
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2892
- C:\ProgramData\driver1.exe
  C:\ProgramData\driver1.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:3168

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2848

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

driver1.exe

Path C:\ProgramData\driver1.exe
Size 7.3MB
SHA256 f3fa6f871696db33172aac5efb6426beff6de0b9da332f3ca7a7ada8df37e1e1
MD5 73c46516914f8341fe5aa8fdb3dcdfc2
SHA1 a54fabf99439ce2e75a926b7ad94bb5fd61f582c
SHA512 276bd5b09b99df1153b189f761961dcf047226196cf25964def2cb34265de48f6abd9ae444907f25379a0ac2717816ab01f3a58359cef49566de69694429cc6b
SSDEEP 196608:qwliGtPvtQCKytFZjsH2p3k3vIMGafsDlUUKpcC:qwliYvtBKytsHmCvYnlU1pcC
MD5 SHA1 SHA512 SSDEEP

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 a0ca609205813c307df9122c0c5b0967c5472755700f615b0033129cf7d6b35b
MD5 c9c4c494f8fba32d95ba2125f00586a3
SHA1 8a600205528aef7953144f1cf6f7a5115e3611de
SHA512 9d30cea6cfc259e97b0305f8b5cd19774044fb78feedfcef2014b2947f2e6a101273bc4ad30db9cc1724e62eb441266d7df376e28ac58693f128b9cce2c7d20d
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 a1c5f48659d4b3af960971b3a0f433a95fee5bfafe5680a34110c68b342377d8
MD5 4dc6fc5e708279a3310fe55d9c44743d
SHA1 a42e8bdf9d1c25ef3e223d59f6b1d16b095f46d2
SHA512 5874b2310187f242b852fa6dcded244cc860abb2be4f6f5a6a1db8322e12e1fef8f825edc0aae75adbb7284a2cd64730650d0643b1e2bb7ead9350e50e1d8c13
MD5 SHA1 SHA512

Submit Download

86e26344-0940-4c40-a894-c6fe5282b1ec.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\86e26344-0940-4c40-a894-c6fe5282b1ec.tmp
Size 1KB
SHA256 39a81e468b8a7aa06a5f929b0c104a79e365f3eee120ca6a7eb401e9d49be142
MD5 f5842fe7658b20726ba859c91e2b846a
SHA1 16ac1707c2dd9d017a2cc89c0882d919e825f6cf
SHA512 daa88c68c18e53cfb60e7e2e00785410293ec56d4dd3d344f798bb0265e7bfb64fc903a91983901cd14d9756cf46d22407925725f30014d795d37e7acb03c9d8
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 2KB
SHA256 8a62fa508e51f491aff450ff7f49c9690ad54963eccb8aaefe9b92490cfadf4c
MD5 14ced0ecf52e2dad98bfa5ac1b37af02
SHA1 c8d4a95921e25b1f2ac037fdfa19245b72fcf053
SHA512 f36ec5ce758b2360333df8f7010044c091a15c5fa2c40c99808809d5a174b077d0e32efcbf0dfd6209f45b12c842f9284460dc6270b3502679974c35c5ac38e5
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 432B
SHA256 6504fc4841a7c17b79d866bc83791b077db5c0a9ecb51abbec1162228c11f539
MD5 b49a2d4df11ff682ac3a2455c6d7ed50
SHA1 8f2ff12b4199de439fb6cc430dc4be8af2cf76d7
SHA512 f0981d900f66beea973ed83f8ff41835983658747f1b881a97cf9dbaaf09a296a42b39687bf3a6c6d10fd62b3cb1ed51ae4a4ad838d8bcd9cefcd514a679885a
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 3KB
SHA256 a8c6efacba46af7a5b493a7cd9de4e09c86cd91f804f648233c7f3e0cfa97692
MD5 51631ed7e71d2551b3655073b4901e6a
SHA1 da54b00ec272e91df38d52da29eff7baad64de7a
SHA512 91b6af34a0f3798f1a8dcb4e196cfa3d0ae8e3b19db06f8b6a68dcc6264561f83349a9127e260a15ffd878c146d4341e4cc11363095da63cd15fe59bbed54893
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 a1213eddd37b8788c9a7bcefd27204327c67e1d09989923c06f733cabd5c8bdb
MD5 dc17427a5ba62b9671057b5b5c302736
SHA1 4917e778b8f6b42d4b095152bfcc1298ba59e5e3
SHA512 c72433746196a5979eedff7ccced7e161c7da99dcc2804a7ad5e2b23ee4b422e6c1c07bae3cccc691fa66de97126b390e0941e4cd439d4d0474ca7153e2cbe95
SSDEEP 96:n1kmsQCp1IsBwpvWMoiVmdepwv4jqUzPEV2Gd8GeZr2mzCUWQyV+VD7AiEwb:n1kjhBGWMZwv4NzPEV2GdoZr2trg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 2500539f5601702d46ff98c9674f0a371b5d4ae957991fa0bc0cde50879a4cb9
MD5 fac0f4adb4a5461757f4948f4b4e5e3c
SHA1 e48ab98f0aa7cdac421edff4633db0cf3005b82a
SHA512 ac753c072eda7be40c2bb175973098e3201ba0b8c8f591dd95cb40d82c5f9739919e24f7b46c54c73dee5c71f19fe814a5a7be89f369f1b17094b0e4ac3cf812
SSDEEP 96:n1k8p1IoRwpvWMoiVmdeHm0gUWQyV+VDCziEwb:n1kMBRGWMXkro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 517145297c49a45fb00c2371ca3828d993fefcb3b14e7bec0b4fa5731f1e13e9
MD5 38d78d81b5264946e205c33991b14e43
SHA1 91ff29bb8dd51c17dce440a22e67247a913c191a
SHA512 7731ee55ef3f73cfc73a0a624d0ecb5bf14285de7a6034797f5e570f9e56b512a459eddfeaab328bbb5363e53c6d5b01a89029d06443aafffeef5cd6410a700a
SSDEEP 96:n1kcp1IsBwpvWMoiVmdeAur418UzPEV2Gd8GeZr2mvgUWQyV+VD7AiEwb:n1kshBGWMwuUlzPEV2GdoZr2Xrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 8KB
SHA256 b041e00c0a5878276c9a05d972bff3e7e25502d29e6746a294473a8d708d3a0f
MD5 8f2b7754db84ed6406a56d2684fd88e4
SHA1 c6ecebedade420eb432fb42f667f5be63e2ee40d
SHA512 f139c425d6919ec216be3b19b8ffaa9cfbc9af7c276820cb8314c8f68ff68ef310dbf75266195c840794c0845d230ea51058c150c67668b4464f976957790582
SSDEEP 192:n1k9hzlaWMB3ukzwv4NzPEV2GdoZr2vrg:n1khcWgk4eVG
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 8b6a55b461b918371bbe17e7aa3b22a16785221fc72dc67ee5e36a8894a15a14
MD5 ef7ffb4335b073d1c954edbaef5eab5e
SHA1 589a7512afa3adfe97a53dbcefb6545b7f2533c8
SHA512 c51c2495cd365c0267fe061c4a14737858fd7bcefe74104c63b2ab144673971284e38eca2c5d496bcb4aef7986cca7fae75ca6533d5e0fb82a991adbe862bc05
SSDEEP 96:n1k8sQep1IsBwpvWMoiVmdeAur418UzPEV2Gd8GeZr2mvgUWQyV+VD7AiEwb:n1kfhBGWMwuUlzPEV2GdoZr2Xrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 9a62b1c011bf532bf322fbd3c282f4bb60a742b690ab6e01d04f6d39c4514efc
MD5 b3179f7751719a6b36c4574141b46ae7
SHA1 fdc70bb08cb952973bd87879121c03b730c3ea6e
SHA512 b6661f0b3e921baa60c92c36b0ed471811c2e5cdca29b52b72a93e1fa056c47d9a83a53cc8dc808aac214b7ffb7d5b2f3d1864e0d55d0e1c43df6bb6e18582d5
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 b958f73480b55682650f8c484dc135892c3dc8b81b6e9139bc2a3b21fc5705d3
MD5 f8ff8ee0ec21008541101946b007338b
SHA1 60540e1f10556b62a700bef26bf0142a81a7bfb0
SHA512 684c4a4590898f2b73053241188f86c70c09d09e4dc826f046fec2684bd8f83e041047bac9f8d9fbc69d9f0e76e5bbc2fe74cb4c3fc3092f299fa937d3c7d3a9
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 ca26de085413398a85f36fa4be0bda7fdac970a1f8f35563f4e3f787940e7425
MD5 d956a3ae405110885df77e6fceed0125
SHA1 aaf4e79ce4dbe6c6f448efadd4ebe049c94c3238
SHA512 9c93f847281907ff38169f40687873994bba22fce00f8b3578b7946276e6fa175c3bf2782812c8b859270318fe1247a21f056020ef957dab52a396f32fd71a93
SSDEEP 192:xoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupFAie2RUiSNzl3z2OMDCRHm:t9iIxuERzA83h09RZxYr98laOMWRHqlN
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 045f8dd6044a65a80bc14fdaeb82b0913e30fb689ec2d8690b182878ae6fe717
MD5 5be9f14dc2ed21ebeb6a6f872e9d34e4
SHA1 89bd8fe3d9dcf0aae7507eda94f2a2314f7b6a60
SHA512 74c95017a5a5049fc47afbfa3f6dccc2f4546874b029990bd24d2ed59145347ab9853d6b8f5c045d09da4b0a3a1874270041aeb921ded1589b0a2db34b6e2b63
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupF0e2RUiSNzd3z2OMDCRHqz:A9iIxuERzA83h09RZxY498daOMWRHqlN
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 82297b74974d173f1ba4e51274410b2cf6f4f067bb5803b05ea717427a3cfb12
MD5 f0bfd070077e21be339e066228723976
SHA1 5c89b9afe1ef2db81fdc53922d16ce13c18f7b78
SHA512 663c50fbea5c61b4edb44adae680cba7dba5000f899337a43388c054ee10250ba7188f1c02a3a0081367b2c71a4e3f01c54f14cf2f5c19bc89f3ef07ceadefb2
SSDEEP 384:b9iIxuERzA83h09RZxYlFc+eaOMWRHqlWA:QIxuERzA83h09RZxLFXRKz
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb
MD5 77d622bb1a5b250869a3238b9bc1402b
SHA1 d47f4003c2554b9dfc4c16f22460b331886b191b
SHA512 d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_ozsiotb3.gue.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ozsiotb3.gue.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

182aa96b-1dcc-493a-b7ba-ee162d0f86aa.tmp

Path C:\Users\Admin\Downloads\182aa96b-1dcc-493a-b7ba-ee162d0f86aa.tmp
Size 260KB
SHA256 7f2e063d2ac42a41985490d16991f55279835fac06561aec4a7c0855d50efdf1
MD5 67e7a5dd6465677cd5962f404884f4bd
SHA1 3bb132b0eaa609f112d5f42522dbf6d2993d4ba5
SHA512 aa1ee9404179b3035be156252e4b2610d95926cab3a519ef0d95faa435ccefa65ed64c38db57f336c53b0ccc3e08b6ba515c7ff6dc25fe4f4dd67c1555fda226
SSDEEP 6144:8iRvj5kwRy7EAlmBarPdr6gCblJM8tFLRLennrzt48DS8qjTTroqd:lvj5XJUyarPB6gCTfFd6n148DS8qjHrj
MD5 SHA1 SHA512 SSDEEP

Submit Download

lnjector.zip

Path C:\Users\Admin\Downloads\lnjector.zip
Size 13.6MB
SHA256 d0cfbeb8869ea8c04bfbc93f8c8c9fb00d2bb821acdeba0e82dbab4a680f34ac
MD5 bec8989d36c7c4d5d57cd910fb393227
SHA1 163562faa4828f808974183ad79426c52236a2c0
SHA512 632d045c63d49dd7e91d7a90f170fda640eb472e49cd52e878d09e1e0159e664b0be8dd35aee4fa8d8946744b8119aaa0caafa749547a0d6fa2463af53d6b4c4
SSDEEP 393216:AFqapeCHQgqmxacyMldfrmbgc+CcriBQuH02fm:f1gBocXvCUc+CzmK02e
MD5 SHA1 SHA512 SSDEEP

Submit Download

winrar-x64-701.exe

Path C:\Users\Admin\Downloads\winrar-x64-701.exe
Size 3.7MB
SHA256 31f7ba37180f820313b2d32e76252344598409cb932109dd84a071cd58b64aa6
MD5 3a2f16a044d8f6d2f9443dff6bd1c7d4
SHA1 48c6c0450af803b72a0caa7d5e3863c3f0240ef1
SHA512 61daee2ce82c3b8e79f7598a79d72e337220ced7607e3ed878a3059ac03257542147dbd377e902cc95f04324e2fb7c5e07d1410f0a1815d5a05c5320e5715ef6
SSDEEP 98304:yNdBfKEHyrVcQky3zy1BK1X4Jg+opzZorSeksMURg0l5OOf:ky+GzkezMs1I5oDot8UeEt
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3168-316-0x0000000001350000-0x0000000001351000-memory.dmp

Download

memory/3168-317-0x0000000001360000-0x0000000001361000-memory.dmp

Download

memory/3168-318-0x0000000001370000-0x0000000001371000-memory.dmp

Download

memory/3168-319-0x0000000001380000-0x0000000001381000-memory.dmp

Download

memory/3168-321-0x00000000006A0000-0x000000000123D000-memory.dmp

Download

memory/3168-315-0x0000000001320000-0x0000000001321000-memory.dmp

Download

memory/3168-314-0x0000000001310000-0x0000000001311000-memory.dmp

Download

memory/3620-328-0x0000000000AE0000-0x0000000003664000-memory.dmp

Download

memory/3620-266-0x0000000000AE0000-0x0000000003664000-memory.dmp

Download

memory/3620-298-0x0000000000AE0000-0x0000000003664000-memory.dmp

Download

memory/5016-272-0x000001F0AF0C0000-0x000001F0AF0E2000-memory.dmp

Download