lumma | hxxp://www[.]mediafire[.]com/folder/jzlnprujaj4og/cheat_v2[.]19(update)

Analysis

max time kernel
162s
max time network
162s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
21/09/2024, 16:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://www.mediafire.com/folder/jzlnprujaj4og/cheat_v2.19(update)

Score

10^/10

lumma discovery stealer

Malware Config

Extracted

Family

lumma

https://chickerkuso.shop/api

https://contractowno.shop/api

Signatures

Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma

Executes dropped EXE 12 IoCs

pid	Process
5324	start.exe
5924	install.exe
5636	start.exe
1180	start.exe
2276	install.exe
4884	install.exe
5752	start.exe
5664	start.exe
2076	install.exe
772	install.exe
5724	install.exe
4164	start.exe

Suspicious use of SetThreadContext 12 IoCs

description	pid	Process	procid_target
PID 5324 set thread context of 5480	5324	start.exe	134
PID 5924 set thread context of 840	5924	install.exe	137
PID 5636 set thread context of 3068	5636	start.exe	147
PID 1180 set thread context of 5020	1180	start.exe	154
PID 2276 set thread context of 3976	2276	install.exe	162
PID 4884 set thread context of 1508	4884	install.exe	167
PID 5752 set thread context of 5500	5752	start.exe	177
PID 5664 set thread context of 1648	5664	start.exe	197
PID 2076 set thread context of 5172	2076	install.exe	202
PID 772 set thread context of 3616	772	install.exe	207
PID 5724 set thread context of 5532	5724	install.exe	214
PID 4164 set thread context of 5664	4164	start.exe	220

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\127.0.2651.86\password.txt	msedge.exe

Program crash 21 IoCs

pid	pid_target	Process	procid_target
5304	5480	WerFault.exe	134
2784	5480	WerFault.exe	134
5748	840	WerFault.exe	137
5464	3068	WerFault.exe	147
3484	3068	WerFault.exe	147
5260	5020	WerFault.exe	154
3728	5020	WerFault.exe	154
2404	3976	WerFault.exe	162
368	1508	WerFault.exe	167
5692	1508	WerFault.exe	167
1652	1508	WerFault.exe	167
2220	1508	WerFault.exe	167
3200	5500	WerFault.exe	177
4184	1508	WerFault.exe	167
5500	3976	WerFault.exe	162
5080	840	WerFault.exe	137
5584	1648	WerFault.exe	197
3688	5172	WerFault.exe	202
2940	3616	WerFault.exe	207
5780	5532	WerFault.exe	214
2796	5664	WerFault.exe	220

System Location Discovery: System Language Discovery 1 TTPs 24 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	start.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	install.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	start.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	start.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	install.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	start.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	start.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	install.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	install.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	install.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	start.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	install.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5164	taskmgr.exe
5164	taskmgr.exe
5164	taskmgr.exe
5164	taskmgr.exe
5164	taskmgr.exe
5164	taskmgr.exe
5164	taskmgr.exe
5164	taskmgr.exe
5164	taskmgr.exe
5164	taskmgr.exe
5164	taskmgr.exe
5164	taskmgr.exe
5164	taskmgr.exe
5164	taskmgr.exe
5164	taskmgr.exe
5164	taskmgr.exe
5164	taskmgr.exe
5164	taskmgr.exe
5164	taskmgr.exe
5164	taskmgr.exe
5164	taskmgr.exe
5164	taskmgr.exe
5164	taskmgr.exe
5164	taskmgr.exe
5164	taskmgr.exe
5164	taskmgr.exe
5164	taskmgr.exe
5164	taskmgr.exe
5164	taskmgr.exe
5164	taskmgr.exe
5164	taskmgr.exe
5164	taskmgr.exe
5164	taskmgr.exe
5164	taskmgr.exe
5164	taskmgr.exe
5164	taskmgr.exe
5164	taskmgr.exe
5164	taskmgr.exe
5164	taskmgr.exe
5164	taskmgr.exe
5164	taskmgr.exe
5164	taskmgr.exe
5164	taskmgr.exe
5164	taskmgr.exe
5164	taskmgr.exe
5164	taskmgr.exe
5164	taskmgr.exe
5164	taskmgr.exe
5164	taskmgr.exe
5164	taskmgr.exe
5164	taskmgr.exe
5164	taskmgr.exe
5164	taskmgr.exe
5164	taskmgr.exe
5164	taskmgr.exe
5164	taskmgr.exe
5164	taskmgr.exe
5164	taskmgr.exe
5164	taskmgr.exe
5164	taskmgr.exe
5164	taskmgr.exe
5164	taskmgr.exe
5164	taskmgr.exe
5164	taskmgr.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeRestorePrivilege	5236	7zG.exe
Token: 35	5236	7zG.exe
Token: SeSecurityPrivilege	5236	7zG.exe
Token: SeSecurityPrivilege	5236	7zG.exe
Token: SeDebugPrivilege	5164	taskmgr.exe
Token: SeSystemProfilePrivilege	5164	taskmgr.exe
Token: SeCreateGlobalPrivilege	5164	taskmgr.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
5236	7zG.exe
5164	taskmgr.exe
5164	taskmgr.exe
5164	taskmgr.exe
5164	taskmgr.exe
5164	taskmgr.exe
5164	taskmgr.exe
5164	taskmgr.exe
5164	taskmgr.exe
5164	taskmgr.exe
5164	taskmgr.exe
5164	taskmgr.exe
5164	taskmgr.exe
5164	taskmgr.exe
5164	taskmgr.exe
5164	taskmgr.exe
5164	taskmgr.exe
5164	taskmgr.exe
5164	taskmgr.exe
5164	taskmgr.exe
5164	taskmgr.exe
5164	taskmgr.exe
5164	taskmgr.exe
5164	taskmgr.exe
5164	taskmgr.exe
5164	taskmgr.exe
5164	taskmgr.exe
5164	taskmgr.exe
5164	taskmgr.exe
5164	taskmgr.exe
5164	taskmgr.exe
5164	taskmgr.exe
5164	taskmgr.exe
5164	taskmgr.exe
5164	taskmgr.exe
5164	taskmgr.exe
5164	taskmgr.exe
5164	taskmgr.exe
5164	taskmgr.exe
5164	taskmgr.exe
5164	taskmgr.exe
5164	taskmgr.exe
5164	taskmgr.exe
5164	taskmgr.exe
5164	taskmgr.exe
5164	taskmgr.exe
5164	taskmgr.exe
5164	taskmgr.exe
5164	taskmgr.exe
5164	taskmgr.exe
5164	taskmgr.exe
5164	taskmgr.exe
5164	taskmgr.exe
5164	taskmgr.exe
5164	taskmgr.exe
5164	taskmgr.exe
5164	taskmgr.exe
5164	taskmgr.exe
5164	taskmgr.exe
5164	taskmgr.exe
5164	taskmgr.exe
5164	taskmgr.exe
5164	taskmgr.exe
5164	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
5164	taskmgr.exe
5164	taskmgr.exe
5164	taskmgr.exe
5164	taskmgr.exe
5164	taskmgr.exe
5164	taskmgr.exe
5164	taskmgr.exe
5164	taskmgr.exe
5164	taskmgr.exe
5164	taskmgr.exe
5164	taskmgr.exe
5164	taskmgr.exe
5164	taskmgr.exe
5164	taskmgr.exe
5164	taskmgr.exe
5164	taskmgr.exe
5164	taskmgr.exe
5164	taskmgr.exe
5164	taskmgr.exe
5164	taskmgr.exe
5164	taskmgr.exe
5164	taskmgr.exe
5164	taskmgr.exe
5164	taskmgr.exe
5164	taskmgr.exe
5164	taskmgr.exe
5164	taskmgr.exe
5164	taskmgr.exe
5164	taskmgr.exe
5164	taskmgr.exe
5164	taskmgr.exe
5164	taskmgr.exe
5164	taskmgr.exe
5164	taskmgr.exe
5164	taskmgr.exe
5164	taskmgr.exe
5164	taskmgr.exe
5164	taskmgr.exe
5164	taskmgr.exe
5164	taskmgr.exe
5164	taskmgr.exe
5164	taskmgr.exe
5164	taskmgr.exe
5164	taskmgr.exe
5164	taskmgr.exe
5164	taskmgr.exe
5164	taskmgr.exe
5164	taskmgr.exe
5164	taskmgr.exe
5164	taskmgr.exe
5164	taskmgr.exe
5164	taskmgr.exe
5164	taskmgr.exe
5164	taskmgr.exe
5164	taskmgr.exe
5164	taskmgr.exe
5164	taskmgr.exe
5164	taskmgr.exe
5164	taskmgr.exe
5164	taskmgr.exe
5164	taskmgr.exe
5164	taskmgr.exe
5164	taskmgr.exe
5164	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5324 wrote to memory of 5480	5324	start.exe	134
PID 5324 wrote to memory of 5480	5324	start.exe	134
PID 5324 wrote to memory of 5480	5324	start.exe	134
PID 5324 wrote to memory of 5480	5324	start.exe	134
PID 5324 wrote to memory of 5480	5324	start.exe	134
PID 5324 wrote to memory of 5480	5324	start.exe	134
PID 5324 wrote to memory of 5480	5324	start.exe	134
PID 5324 wrote to memory of 5480	5324	start.exe	134
PID 5324 wrote to memory of 5480	5324	start.exe	134
PID 5924 wrote to memory of 840	5924	install.exe	137
PID 5924 wrote to memory of 840	5924	install.exe	137
PID 5924 wrote to memory of 840	5924	install.exe	137
PID 5924 wrote to memory of 840	5924	install.exe	137
PID 5924 wrote to memory of 840	5924	install.exe	137
PID 5924 wrote to memory of 840	5924	install.exe	137
PID 5924 wrote to memory of 840	5924	install.exe	137
PID 5924 wrote to memory of 840	5924	install.exe	137
PID 5924 wrote to memory of 840	5924	install.exe	137
PID 5636 wrote to memory of 3068	5636	start.exe	147
PID 5636 wrote to memory of 3068	5636	start.exe	147
PID 5636 wrote to memory of 3068	5636	start.exe	147
PID 5636 wrote to memory of 3068	5636	start.exe	147
PID 5636 wrote to memory of 3068	5636	start.exe	147
PID 5636 wrote to memory of 3068	5636	start.exe	147
PID 5636 wrote to memory of 3068	5636	start.exe	147
PID 5636 wrote to memory of 3068	5636	start.exe	147
PID 5636 wrote to memory of 3068	5636	start.exe	147
PID 1180 wrote to memory of 5020	1180	start.exe	154
PID 1180 wrote to memory of 5020	1180	start.exe	154
PID 1180 wrote to memory of 5020	1180	start.exe	154
PID 1180 wrote to memory of 5020	1180	start.exe	154
PID 1180 wrote to memory of 5020	1180	start.exe	154
PID 1180 wrote to memory of 5020	1180	start.exe	154
PID 1180 wrote to memory of 5020	1180	start.exe	154
PID 1180 wrote to memory of 5020	1180	start.exe	154
PID 1180 wrote to memory of 5020	1180	start.exe	154
PID 2276 wrote to memory of 5172	2276	install.exe	161
PID 2276 wrote to memory of 5172	2276	install.exe	161
PID 2276 wrote to memory of 5172	2276	install.exe	161
PID 2276 wrote to memory of 3976	2276	install.exe	162
PID 2276 wrote to memory of 3976	2276	install.exe	162
PID 2276 wrote to memory of 3976	2276	install.exe	162
PID 2276 wrote to memory of 3976	2276	install.exe	162
PID 2276 wrote to memory of 3976	2276	install.exe	162
PID 2276 wrote to memory of 3976	2276	install.exe	162
PID 2276 wrote to memory of 3976	2276	install.exe	162
PID 2276 wrote to memory of 3976	2276	install.exe	162
PID 2276 wrote to memory of 3976	2276	install.exe	162
PID 4884 wrote to memory of 1508	4884	install.exe	167
PID 4884 wrote to memory of 1508	4884	install.exe	167
PID 4884 wrote to memory of 1508	4884	install.exe	167
PID 4884 wrote to memory of 1508	4884	install.exe	167
PID 4884 wrote to memory of 1508	4884	install.exe	167
PID 4884 wrote to memory of 1508	4884	install.exe	167
PID 4884 wrote to memory of 1508	4884	install.exe	167
PID 4884 wrote to memory of 1508	4884	install.exe	167
PID 4884 wrote to memory of 1508	4884	install.exe	167
PID 5752 wrote to memory of 5500	5752	start.exe	177
PID 5752 wrote to memory of 5500	5752	start.exe	177
PID 5752 wrote to memory of 5500	5752	start.exe	177
PID 5752 wrote to memory of 5500	5752	start.exe	177
PID 5752 wrote to memory of 5500	5752	start.exe	177
PID 5752 wrote to memory of 5500	5752	start.exe	177
PID 5752 wrote to memory of 5500	5752	start.exe	177

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.mediafire.com/folder/jzlnprujaj4og/cheat_v2.19(update)
1⤵
PID:5012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=16 --field-trial-handle=4712,i,12198811467968044966,17227406646827438786,262144 --variations-seed-version --mojo-platform-channel-handle=4148 /prefetch:1
1⤵
PID:4480

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --field-trial-handle=4192,i,12198811467968044966,17227406646827438786,262144 --variations-seed-version --mojo-platform-channel-handle=3948 /prefetch:1
1⤵
PID:4136

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --field-trial-handle=5388,i,12198811467968044966,17227406646827438786,262144 --variations-seed-version --mojo-platform-channel-handle=5412 /prefetch:1
1⤵
PID:3248

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=5556,i,12198811467968044966,17227406646827438786,262144 --variations-seed-version --mojo-platform-channel-handle=5568 /prefetch:8
1⤵
PID:1988

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --field-trial-handle=5576,i,12198811467968044966,17227406646827438786,262144 --variations-seed-version --mojo-platform-channel-handle=5628 /prefetch:8
1⤵
PID:4372

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=20 --field-trial-handle=6068,i,12198811467968044966,17227406646827438786,262144 --variations-seed-version --mojo-platform-channel-handle=6100 /prefetch:1
1⤵
PID:2380

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=21 --field-trial-handle=6364,i,12198811467968044966,17227406646827438786,262144 --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:1
1⤵
PID:2448

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=22 --field-trial-handle=5644,i,12198811467968044966,17227406646827438786,262144 --variations-seed-version --mojo-platform-channel-handle=6220 /prefetch:1
1⤵
PID:2784

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --field-trial-handle=6600,i,12198811467968044966,17227406646827438786,262144 --variations-seed-version --mojo-platform-channel-handle=6608 /prefetch:8
1⤵
PID:112

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=24 --field-trial-handle=6796,i,12198811467968044966,17227406646827438786,262144 --variations-seed-version --mojo-platform-channel-handle=120 /prefetch:1
1⤵
PID:4344

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=25 --field-trial-handle=6224,i,12198811467968044966,17227406646827438786,262144 --variations-seed-version --mojo-platform-channel-handle=4672 /prefetch:1
1⤵
PID:2776

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=26 --field-trial-handle=6728,i,12198811467968044966,17227406646827438786,262144 --variations-seed-version --mojo-platform-channel-handle=6680 /prefetch:1
1⤵
PID:4608

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=27 --field-trial-handle=6112,i,12198811467968044966,17227406646827438786,262144 --variations-seed-version --mojo-platform-channel-handle=6708 /prefetch:1
1⤵
PID:3644

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=28 --field-trial-handle=6932,i,12198811467968044966,17227406646827438786,262144 --variations-seed-version --mojo-platform-channel-handle=7056 /prefetch:1
1⤵
PID:1984

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=29 --field-trial-handle=7260,i,12198811467968044966,17227406646827438786,262144 --variations-seed-version --mojo-platform-channel-handle=7280 /prefetch:1
1⤵
PID:1816

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=30 --field-trial-handle=7316,i,12198811467968044966,17227406646827438786,262144 --variations-seed-version --mojo-platform-channel-handle=7284 /prefetch:1
1⤵
PID:1892

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=31 --field-trial-handle=7576,i,12198811467968044966,17227406646827438786,262144 --variations-seed-version --mojo-platform-channel-handle=7588 /prefetch:1
1⤵
PID:2884

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=32 --field-trial-handle=7832,i,12198811467968044966,17227406646827438786,262144 --variations-seed-version --mojo-platform-channel-handle=7848 /prefetch:1
1⤵
PID:3600

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=33 --field-trial-handle=7980,i,12198811467968044966,17227406646827438786,262144 --variations-seed-version --mojo-platform-channel-handle=8008 /prefetch:1
1⤵
PID:2948

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --field-trial-handle=7580,i,12198811467968044966,17227406646827438786,262144 --variations-seed-version --mojo-platform-channel-handle=8368 /prefetch:8
1⤵
PID:1316

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=35 --field-trial-handle=8344,i,12198811467968044966,17227406646827438786,262144 --variations-seed-version --mojo-platform-channel-handle=8500 /prefetch:1
1⤵
PID:2148

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=36 --field-trial-handle=8704,i,12198811467968044966,17227406646827438786,262144 --variations-seed-version --mojo-platform-channel-handle=8772 /prefetch:1
1⤵
PID:4384

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --lang=en-US --service-sandbox-type=service --field-trial-handle=8856,i,12198811467968044966,17227406646827438786,262144 --variations-seed-version --mojo-platform-channel-handle=8860 /prefetch:8
1⤵
- Drops file in Program Files directory
PID:5188

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --field-trial-handle=8840,i,12198811467968044966,17227406646827438786,262144 --variations-seed-version --mojo-platform-channel-handle=8980 /prefetch:8
1⤵
PID:5228

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --field-trial-handle=8536,i,12198811467968044966,17227406646827438786,262144 --variations-seed-version --mojo-platform-channel-handle=8568 /prefetch:8
1⤵
PID:5796

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {c82192ee-6cb5-4bc0-9ef0-fb818773790a} -Embedding
1⤵
PID:5848

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:6096

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\CHEAT 2024 (UPDATE v.2.19)\" -ad -an -ai#7zMap7887:114:7zEvent15599
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5236

C:\Users\Admin\Downloads\CHEAT 2024 (UPDATE v.2.19)\CHEAT 2024 (UPDATE v.2.19)\start.exe
"C:\Users\Admin\Downloads\CHEAT 2024 (UPDATE v.2.19)\CHEAT 2024 (UPDATE v.2.19)\start.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5324
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5480
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5480 -s 1348
    3⤵
    - Program crash
    PID:5304
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5480 -s 1380
    3⤵
    - Program crash
    PID:2784

C:\Users\Admin\Downloads\CHEAT 2024 (UPDATE v.2.19)\CHEAT 2024 (UPDATE v.2.19)\install.exe
"C:\Users\Admin\Downloads\CHEAT 2024 (UPDATE v.2.19)\CHEAT 2024 (UPDATE v.2.19)\install.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5924
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:840
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 840 -s 1368
    3⤵
    - Program crash
    PID:5748
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 840 -s 1368
    3⤵
    - Program crash
    PID:5080

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 5480 -ip 5480
1⤵
PID:6004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 5480 -ip 5480
1⤵
PID:6080

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 840 -ip 840
1⤵
PID:2340

C:\Users\Admin\Downloads\CHEAT 2024 (UPDATE v.2.19)\CHEAT 2024 (UPDATE v.2.19)\start.exe
"C:\Users\Admin\Downloads\CHEAT 2024 (UPDATE v.2.19)\CHEAT 2024 (UPDATE v.2.19)\start.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5636
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3068
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3068 -s 1340
    3⤵
    - Program crash
    PID:5464
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3068 -s 1356
    3⤵
    - Program crash
    PID:3484

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 3068 -ip 3068
1⤵
PID:4432

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 3068 -ip 3068
1⤵
PID:5476

C:\Users\Admin\Downloads\CHEAT 2024 (UPDATE v.2.19)\CHEAT 2024 (UPDATE v.2.19)\start.exe
"C:\Users\Admin\Downloads\CHEAT 2024 (UPDATE v.2.19)\CHEAT 2024 (UPDATE v.2.19)\start.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1180
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5020
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5020 -s 1372
    3⤵
    - Program crash
    PID:5260
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5020 -s 1340
    3⤵
    - Program crash
    PID:3728

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 5020 -ip 5020
1⤵
PID:5924

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 5020 -ip 5020
1⤵
PID:6024

C:\Users\Admin\Downloads\CHEAT 2024 (UPDATE v.2.19)\CHEAT 2024 (UPDATE v.2.19)\install.exe
"C:\Users\Admin\Downloads\CHEAT 2024 (UPDATE v.2.19)\CHEAT 2024 (UPDATE v.2.19)\install.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2276
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:5172
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3976
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3976 -s 1340
    3⤵
    - Program crash
    PID:2404
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3976 -s 1340
    3⤵
    - Program crash
    PID:5500

C:\Users\Admin\Downloads\CHEAT 2024 (UPDATE v.2.19)\CHEAT 2024 (UPDATE v.2.19)\install.exe
"C:\Users\Admin\Downloads\CHEAT 2024 (UPDATE v.2.19)\CHEAT 2024 (UPDATE v.2.19)\install.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4884
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1508
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1508 -s 1364
    3⤵
    - Program crash
    PID:368
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1508 -s 1332
    3⤵
    - Program crash
    PID:5692
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1508 -s 1368
    3⤵
    - Program crash
    PID:1652
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1508 -s 1416
    3⤵
    - Program crash
    PID:2220
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1508 -s 1420
    3⤵
    - Program crash
    PID:4184

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 3976 -ip 3976
1⤵
PID:2148

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 1508 -ip 1508
1⤵
PID:5056

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 1508 -ip 1508
1⤵
PID:4360

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\CHEAT 2024 (UPDATE v.2.19)\CHEAT 2024 (UPDATE v.2.19)\readme.txt
1⤵
PID:3852

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 1508 -ip 1508
1⤵
PID:2948

C:\Users\Admin\Downloads\CHEAT 2024 (UPDATE v.2.19)\CHEAT 2024 (UPDATE v.2.19)\start.exe
"C:\Users\Admin\Downloads\CHEAT 2024 (UPDATE v.2.19)\CHEAT 2024 (UPDATE v.2.19)\start.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5752
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5500
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5500 -s 1360
    3⤵
    - Program crash
    PID:3200

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 1508 -ip 1508
1⤵
PID:5276

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 5500 -ip 5500
1⤵
PID:6004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 1508 -ip 1508
1⤵
PID:2784

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4136,i,12198811467968044966,17227406646827438786,262144 --variations-seed-version --mojo-platform-channel-handle=8580 /prefetch:8
1⤵
PID:5768

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /7
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5164

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 3976 -ip 3976
1⤵
PID:6132

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 840 -ip 840
1⤵
PID:6092

C:\Users\Admin\Downloads\CHEAT 2024 (UPDATE v.2.19)\CHEAT 2024 (UPDATE v.2.19)\start.exe
"C:\Users\Admin\Downloads\CHEAT 2024 (UPDATE v.2.19)\CHEAT 2024 (UPDATE v.2.19)\start.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:5664
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:3920
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1648
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1648 -s 1324
    3⤵
    - Program crash
    PID:5584

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 1648 -ip 1648
1⤵
PID:6024

C:\Users\Admin\Downloads\CHEAT 2024 (UPDATE v.2.19)\CHEAT 2024 (UPDATE v.2.19)\install.exe
"C:\Users\Admin\Downloads\CHEAT 2024 (UPDATE v.2.19)\CHEAT 2024 (UPDATE v.2.19)\install.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:2076
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5172
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5172 -s 1340
    3⤵
    - Program crash
    PID:3688

C:\Users\Admin\Downloads\CHEAT 2024 (UPDATE v.2.19)\CHEAT 2024 (UPDATE v.2.19)\install.exe
"C:\Users\Admin\Downloads\CHEAT 2024 (UPDATE v.2.19)\CHEAT 2024 (UPDATE v.2.19)\install.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:772
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3616
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3616 -s 1352
    3⤵
    - Program crash
    PID:2940

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 5172 -ip 5172
1⤵
PID:2616

C:\Users\Admin\Downloads\CHEAT 2024 (UPDATE v.2.19)\CHEAT 2024 (UPDATE v.2.19)\install.exe
"C:\Users\Admin\Downloads\CHEAT 2024 (UPDATE v.2.19)\CHEAT 2024 (UPDATE v.2.19)\install.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:5724
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:4040
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:1156
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5532
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5532 -s 1364
    3⤵
    - Program crash
    PID:5780

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 3616 -ip 3616
1⤵
PID:1568

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 5532 -ip 5532
1⤵
PID:3948

C:\Users\Admin\Downloads\CHEAT 2024 (UPDATE v.2.19)\CHEAT 2024 (UPDATE v.2.19)\start.exe
"C:\Users\Admin\Downloads\CHEAT 2024 (UPDATE v.2.19)\CHEAT 2024 (UPDATE v.2.19)\start.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:4164
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:3920
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5664
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5664 -s 1348
    3⤵
    - Program crash
    PID:2796

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 5664 -ip 5664
1⤵
PID:3096

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\start.exe.log

Filesize
425B

MD5
4eaca4566b22b01cd3bc115b9b0b2196

SHA1
e743e0792c19f71740416e7b3c061d9f1336bf94

SHA256
34ba0ab8d1850e7825763f413142a333ccbc05fa2b5499a28a7d27b8a1c5b4bb

SHA512
bc2b1bf45203e3bb3009a7d37617b8f0f7ffa613680b32de2b963e39d2cf1650614d7035a0cf78f35a4f5cb17a2a439e2e07deaefd2a4275a62efd0a5c0184a1

Download Submit
C:\Users\Admin\Downloads\CHEAT 2024 (UPDATE v.2.19)\CHEAT 2024 (UPDATE v.2.19)\install.exe

Filesize
345KB

MD5
d5e2b5b693f6f8371801bfbd4aadb717

SHA1
7e59d3471c911a12335e26683fac395fe331fa50

SHA256
3993ef2eb6796955a557f19475912547bb886566fa7e7c01bed9a90c5da1875e

SHA512
3810c5d6333b864237afda82d3fc20f962083df2b4c7983ac9eba845327368a01ca1eea69f5c4ffc90645b2785a6849646f9393167e43f62160d247f3baa3b87

Download Submit
C:\Users\Admin\Downloads\CHEAT 2024 (UPDATE v.2.19)\CHEAT 2024 (UPDATE v.2.19)\readme.txt

Filesize
179B

MD5
5b76f00748c49fb0fefaeb75a5fc83d3

SHA1
0a68613d54ebf89bef18d8d63c592cce3ce6cf54

SHA256
fe59ecb542ba44af7d88149bee8f1c1b128e92d414e24fd6ad815a86c0a85d6e

SHA512
725d6a7e08cf357e03c98cf23d84916c672272bebeca086710bba290bd4eee38e60f392a36269d55ad1462eb0717f26f2b3351e3a10e337a9a851d16fcd7c6cb

Download Submit
C:\Users\Admin\Downloads\CHEAT 2024 (UPDATE v.2.19)\CHEAT 2024 (UPDATE v.2.19)\start.exe

Filesize
342KB

MD5
05b7ee891270fceff8a31047f63d5683

SHA1
fe853166c2e52891b30ed3e2779a199fd48555c4

SHA256
e76e1294404d9e8e763f684a360c44f261257216b43a363ab21cf15a96221327

SHA512
ee5de8cbb6a96acd6b5d337663a668a19b8a60a96c126e632115f9d4bf2be6e09c877e53711c6e7c88207ce41f6752033f2efe90479414ee49ae6f3ca131c020

Download Submit
memory/840-40-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/840-38-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/840-36-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/3068-48-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/5164-83-0x000002149B740000-0x000002149B741000-memory.dmp

Filesize
4KB

Download
memory/5164-75-0x000002149B740000-0x000002149B741000-memory.dmp

Filesize
4KB

Download
memory/5164-85-0x000002149B740000-0x000002149B741000-memory.dmp

Filesize
4KB

Download
memory/5164-82-0x000002149B740000-0x000002149B741000-memory.dmp

Filesize
4KB

Download
memory/5164-86-0x000002149B740000-0x000002149B741000-memory.dmp

Filesize
4KB

Download
memory/5164-81-0x000002149B740000-0x000002149B741000-memory.dmp

Filesize
4KB

Download
memory/5164-84-0x000002149B740000-0x000002149B741000-memory.dmp

Filesize
4KB

Download
memory/5164-87-0x000002149B740000-0x000002149B741000-memory.dmp

Filesize
4KB

Download
memory/5164-76-0x000002149B740000-0x000002149B741000-memory.dmp

Filesize
4KB

Download
memory/5164-77-0x000002149B740000-0x000002149B741000-memory.dmp

Filesize
4KB

Download
memory/5324-24-0x0000000074470000-0x0000000074C20000-memory.dmp

Filesize
7.7MB

Download
memory/5324-20-0x000000007447E000-0x000000007447F000-memory.dmp

Filesize
4KB

Download
memory/5324-21-0x0000000000050000-0x00000000000AA000-memory.dmp

Filesize
360KB

Download
memory/5324-22-0x0000000074470000-0x0000000074C20000-memory.dmp

Filesize
7.7MB

Download
memory/5324-31-0x0000000074470000-0x0000000074C20000-memory.dmp

Filesize
7.7MB

Download
memory/5480-30-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/5480-41-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/5480-28-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/5480-25-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/5924-34-0x00000000009E0000-0x0000000000A3A000-memory.dmp

Filesize
360KB

Download