lumma | hxxps://cdn[.]discordapp[.]com/attachments/1227351994591613008/1310999393071267881/Loader[.]exe?ex=674742d4&is=6745f154&hm=fafc592571dfb0f7c8bc9e4edd774508cfe4b8318efc2ebb60b0428e9ff01989&

Resubmissions

26-11-2024 16:07

241126-tk1d1aykcz 10

26-11-2024 16:03

241126-thn8ysvkgn 8

Analysis

max time kernel
111s
max time network
112s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
26-11-2024 16:07

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

https://cdn.discordapp.com/attachments/1227351994591613008/1310999393071267881/Loader.exe?ex=674742d4&is=6745f154&hm=fafc592571dfb0f7c8bc9e4edd774508cfe4b8318efc2ebb60b0428e9ff01989&

Score

10^/10

lumma discovery stealer

Malware Config

Extracted

Family

lumma

https://powerful-avoids.sbs

https://motion-treesz.sbs

https://disobey-curly.sbs

https://leg-sate-boat.sbs

https://story-tense-faz.sbs

https://blade-govern.sbs

https://occupy-blushi.sbs

https://frogs-severz.sbs

https://fumblingactor.cyou

Extracted

Family

lumma

https://blade-govern.sbs/api

https://story-tense-faz.sbs/api

https://disobey-curly.sbs/api

https://motion-treesz.sbs/api

https://powerful-avoids.sbs/api

Signatures

Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Lumma family
lumma
Downloads MZ/PE file

Executes dropped EXE 28 IoCs

Processes:

Loader.exeLoader.exeLoader.exeLoader.exeLoader.exeLoader.exeLoader.exeLoader.exeLoader.exeLoader.exeLoader.exeLoader.exeLoader.exeLoader.exeLoader.exeLoader.exeLoader.exeLoader.exeLoader.exeLoader.exeLoader.exeLoader.exeLoader.exeLoader.exeLoader.exeLoader.exeLoader.exeLoader.exe

pid	Process
4100	Loader.exe
3960	Loader.exe
4908	Loader.exe
3960	Loader.exe
5128	Loader.exe
5196	Loader.exe
5260	Loader.exe
5320	Loader.exe
5380	Loader.exe
5620	Loader.exe
5680	Loader.exe
5736	Loader.exe
5788	Loader.exe
6008	Loader.exe
6068	Loader.exe
6080	Loader.exe
4908	Loader.exe
1844	Loader.exe
4808	Loader.exe
5084	Loader.exe
2548	Loader.exe
4488	Loader.exe
5792	Loader.exe
3296	Loader.exe
4320	Loader.exe
5856	Loader.exe
3820	Loader.exe
6052	Loader.exe

Suspicious use of SetThreadContext 12 IoCs

Processes:

Loader.exeLoader.exeLoader.exeLoader.exeLoader.exeLoader.exeLoader.exeLoader.exeLoader.exeLoader.exeLoader.exeLoader.exe

description	pid	Process	procid_target
PID 4100 set thread context of 3960	4100	Loader.exe	113
PID 4908 set thread context of 5128	4908	Loader.exe	120
PID 5196 set thread context of 5260	5196	Loader.exe	123
PID 5320 set thread context of 5380	5320	Loader.exe	126
PID 5620 set thread context of 5680	5620	Loader.exe	134
PID 5736 set thread context of 5788	5736	Loader.exe	137
PID 6008 set thread context of 6080	6008	Loader.exe	143
PID 4908 set thread context of 1844	4908	Loader.exe	146
PID 4808 set thread context of 4488	4808	Loader.exe	155
PID 5792 set thread context of 3296	5792	Loader.exe	158
PID 4320 set thread context of 5856	4320	Loader.exe	161
PID 3820 set thread context of 6052	3820	Loader.exe	164

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid	pid_target	Process	procid_target
5528	5380	WerFault.exe	126
5548	5380	WerFault.exe	126

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

Loader.exeLoader.exeLoader.exeLoader.exeLoader.exeLoader.exeLoader.exeLoader.exeLoader.exeLoader.exeLoader.exeLoader.exeLoader.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Loader.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

taskmgr.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 15 IoCs

Processes:

LogonUI.exe

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "157"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe

Modifies registry class 1 IoCs

Processes:

msedge.exe

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings	msedge.exe

NTFS ADS 1 IoCs

Processes:

msedge.exe

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 303516.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 29 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exetaskmgr.exe

pid	Process
3112	msedge.exe
3112	msedge.exe
4068	msedge.exe
4068	msedge.exe
3984	identity_helper.exe
3984	identity_helper.exe
4796	msedge.exe
4796	msedge.exe
460	taskmgr.exe
460	taskmgr.exe
460	taskmgr.exe
460	taskmgr.exe
460	taskmgr.exe
460	taskmgr.exe
460	taskmgr.exe
460	taskmgr.exe
460	taskmgr.exe
460	taskmgr.exe
460	taskmgr.exe
460	taskmgr.exe
460	taskmgr.exe
460	taskmgr.exe
460	taskmgr.exe
460	taskmgr.exe
460	taskmgr.exe
460	taskmgr.exe
460	taskmgr.exe
460	taskmgr.exe
460	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

Processes:

msedge.exe

pid	Process
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

taskmgr.exe

description	pid	Process
Token: SeDebugPrivilege	460	taskmgr.exe
Token: SeSystemProfilePrivilege	460	taskmgr.exe
Token: SeCreateGlobalPrivilege	460	taskmgr.exe
Token: 33	460	taskmgr.exe
Token: SeIncBasePriorityPrivilege	460	taskmgr.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

msedge.exetaskmgr.exe

pid	Process
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
460	taskmgr.exe
460	taskmgr.exe
460	taskmgr.exe
460	taskmgr.exe
460	taskmgr.exe
460	taskmgr.exe
460	taskmgr.exe
460	taskmgr.exe
460	taskmgr.exe
460	taskmgr.exe
460	taskmgr.exe
460	taskmgr.exe
460	taskmgr.exe
460	taskmgr.exe
460	taskmgr.exe
460	taskmgr.exe
460	taskmgr.exe
460	taskmgr.exe
460	taskmgr.exe
460	taskmgr.exe
460	taskmgr.exe
460	taskmgr.exe
460	taskmgr.exe
460	taskmgr.exe
460	taskmgr.exe
460	taskmgr.exe
460	taskmgr.exe
460	taskmgr.exe
460	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

Processes:

msedge.exetaskmgr.exe

pid	Process
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
460	taskmgr.exe
460	taskmgr.exe
460	taskmgr.exe
460	taskmgr.exe
460	taskmgr.exe
460	taskmgr.exe
460	taskmgr.exe
460	taskmgr.exe
460	taskmgr.exe
460	taskmgr.exe
460	taskmgr.exe
460	taskmgr.exe
460	taskmgr.exe
460	taskmgr.exe
460	taskmgr.exe
460	taskmgr.exe
460	taskmgr.exe
460	taskmgr.exe
460	taskmgr.exe
460	taskmgr.exe
460	taskmgr.exe
460	taskmgr.exe
460	taskmgr.exe
460	taskmgr.exe
460	taskmgr.exe
460	taskmgr.exe
460	taskmgr.exe
460	taskmgr.exe
460	taskmgr.exe
460	taskmgr.exe
460	taskmgr.exe
460	taskmgr.exe
460	taskmgr.exe
460	taskmgr.exe
460	taskmgr.exe
460	taskmgr.exe
460	taskmgr.exe
460	taskmgr.exe
460	taskmgr.exe
460	taskmgr.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

LogonUI.exe

pid	Process
4556	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	Process	procid_target
PID 4068 wrote to memory of 4304	4068	msedge.exe	82
PID 4068 wrote to memory of 4304	4068	msedge.exe	82
PID 4068 wrote to memory of 1120	4068	msedge.exe	83
PID 4068 wrote to memory of 1120	4068	msedge.exe	83
PID 4068 wrote to memory of 1120	4068	msedge.exe	83
PID 4068 wrote to memory of 1120	4068	msedge.exe	83
PID 4068 wrote to memory of 1120	4068	msedge.exe	83
PID 4068 wrote to memory of 1120	4068	msedge.exe	83
PID 4068 wrote to memory of 1120	4068	msedge.exe	83
PID 4068 wrote to memory of 1120	4068	msedge.exe	83
PID 4068 wrote to memory of 1120	4068	msedge.exe	83
PID 4068 wrote to memory of 1120	4068	msedge.exe	83
PID 4068 wrote to memory of 1120	4068	msedge.exe	83
PID 4068 wrote to memory of 1120	4068	msedge.exe	83
PID 4068 wrote to memory of 1120	4068	msedge.exe	83
PID 4068 wrote to memory of 1120	4068	msedge.exe	83
PID 4068 wrote to memory of 1120	4068	msedge.exe	83
PID 4068 wrote to memory of 1120	4068	msedge.exe	83
PID 4068 wrote to memory of 1120	4068	msedge.exe	83
PID 4068 wrote to memory of 1120	4068	msedge.exe	83
PID 4068 wrote to memory of 1120	4068	msedge.exe	83
PID 4068 wrote to memory of 1120	4068	msedge.exe	83
PID 4068 wrote to memory of 1120	4068	msedge.exe	83
PID 4068 wrote to memory of 1120	4068	msedge.exe	83
PID 4068 wrote to memory of 1120	4068	msedge.exe	83
PID 4068 wrote to memory of 1120	4068	msedge.exe	83
PID 4068 wrote to memory of 1120	4068	msedge.exe	83
PID 4068 wrote to memory of 1120	4068	msedge.exe	83
PID 4068 wrote to memory of 1120	4068	msedge.exe	83
PID 4068 wrote to memory of 1120	4068	msedge.exe	83
PID 4068 wrote to memory of 1120	4068	msedge.exe	83
PID 4068 wrote to memory of 1120	4068	msedge.exe	83
PID 4068 wrote to memory of 1120	4068	msedge.exe	83
PID 4068 wrote to memory of 1120	4068	msedge.exe	83
PID 4068 wrote to memory of 1120	4068	msedge.exe	83
PID 4068 wrote to memory of 1120	4068	msedge.exe	83
PID 4068 wrote to memory of 1120	4068	msedge.exe	83
PID 4068 wrote to memory of 1120	4068	msedge.exe	83
PID 4068 wrote to memory of 1120	4068	msedge.exe	83
PID 4068 wrote to memory of 1120	4068	msedge.exe	83
PID 4068 wrote to memory of 1120	4068	msedge.exe	83
PID 4068 wrote to memory of 1120	4068	msedge.exe	83
PID 4068 wrote to memory of 3112	4068	msedge.exe	84
PID 4068 wrote to memory of 3112	4068	msedge.exe	84
PID 4068 wrote to memory of 952	4068	msedge.exe	85
PID 4068 wrote to memory of 952	4068	msedge.exe	85
PID 4068 wrote to memory of 952	4068	msedge.exe	85
PID 4068 wrote to memory of 952	4068	msedge.exe	85
PID 4068 wrote to memory of 952	4068	msedge.exe	85
PID 4068 wrote to memory of 952	4068	msedge.exe	85
PID 4068 wrote to memory of 952	4068	msedge.exe	85
PID 4068 wrote to memory of 952	4068	msedge.exe	85
PID 4068 wrote to memory of 952	4068	msedge.exe	85
PID 4068 wrote to memory of 952	4068	msedge.exe	85
PID 4068 wrote to memory of 952	4068	msedge.exe	85
PID 4068 wrote to memory of 952	4068	msedge.exe	85
PID 4068 wrote to memory of 952	4068	msedge.exe	85
PID 4068 wrote to memory of 952	4068	msedge.exe	85
PID 4068 wrote to memory of 952	4068	msedge.exe	85
PID 4068 wrote to memory of 952	4068	msedge.exe	85
PID 4068 wrote to memory of 952	4068	msedge.exe	85
PID 4068 wrote to memory of 952	4068	msedge.exe	85
PID 4068 wrote to memory of 952	4068	msedge.exe	85
PID 4068 wrote to memory of 952	4068	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://cdn.discordapp.com/attachments/1227351994591613008/1310999393071267881/Loader.exe?ex=674742d4&is=6745f154&hm=fafc592571dfb0f7c8bc9e4edd774508cfe4b8318efc2ebb60b0428e9ff01989&
1⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc061546f8,0x7ffc06154708,0x7ffc06154718
  2⤵
  PID:4304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1992,15514253463844679785,12221076799775636876,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2004 /prefetch:2
  2⤵
  PID:1120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1992,15514253463844679785,12221076799775636876,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1992,15514253463844679785,12221076799775636876,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2856 /prefetch:8
  2⤵
  PID:952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,15514253463844679785,12221076799775636876,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:4552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,15514253463844679785,12221076799775636876,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
  2⤵
  PID:4696
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1992,15514253463844679785,12221076799775636876,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5028 /prefetch:8
  2⤵
  PID:3120
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1992,15514253463844679785,12221076799775636876,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5028 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,15514253463844679785,12221076799775636876,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5400 /prefetch:1
  2⤵
  PID:5088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,15514253463844679785,12221076799775636876,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5368 /prefetch:1
  2⤵
  PID:2060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,15514253463844679785,12221076799775636876,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4240 /prefetch:1
  2⤵
  PID:1152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,15514253463844679785,12221076799775636876,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5228 /prefetch:1
  2⤵
  PID:756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=1992,15514253463844679785,12221076799775636876,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5788 /prefetch:8
  2⤵
  PID:932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,15514253463844679785,12221076799775636876,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5824 /prefetch:1
  2⤵
  PID:2080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1992,15514253463844679785,12221076799775636876,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6424 /prefetch:8
  2⤵
  PID:2888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1992,15514253463844679785,12221076799775636876,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3452 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4796
- C:\Users\Admin\Downloads\Loader.exe
  "C:\Users\Admin\Downloads\Loader.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  PID:4100
- - C:\Users\Admin\Downloads\Loader.exe
    "C:\Users\Admin\Downloads\Loader.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,15514253463844679785,12221076799775636876,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4228 /prefetch:1
  2⤵
  PID:5336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,15514253463844679785,12221076799775636876,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6140 /prefetch:1
  2⤵
  PID:5556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,15514253463844679785,12221076799775636876,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5548 /prefetch:1
  2⤵
  PID:4328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,15514253463844679785,12221076799775636876,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3048 /prefetch:1
  2⤵
  PID:5600

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:464

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2684

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4908

C:\Users\Admin\Downloads\Loader.exe
"C:\Users\Admin\Downloads\Loader.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4908
- C:\Users\Admin\Downloads\Loader.exe
  "C:\Users\Admin\Downloads\Loader.exe"
  2⤵
  - Executes dropped EXE
  PID:3960
- C:\Users\Admin\Downloads\Loader.exe
  "C:\Users\Admin\Downloads\Loader.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5128

C:\Users\Admin\Downloads\Loader.exe
"C:\Users\Admin\Downloads\Loader.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5196
- C:\Users\Admin\Downloads\Loader.exe
  "C:\Users\Admin\Downloads\Loader.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5260

C:\Users\Admin\Downloads\Loader.exe
"C:\Users\Admin\Downloads\Loader.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5320
- C:\Users\Admin\Downloads\Loader.exe
  "C:\Users\Admin\Downloads\Loader.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5380
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5380 -s 1228
    3⤵
    - Program crash
    PID:5528
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5380 -s 1408
    3⤵
    - Program crash
    PID:5548

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 5380 -ip 5380
1⤵
PID:5488

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 5380 -ip 5380
1⤵
PID:5508

C:\Users\Admin\Downloads\Loader.exe
"C:\Users\Admin\Downloads\Loader.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5620
- C:\Users\Admin\Downloads\Loader.exe
  "C:\Users\Admin\Downloads\Loader.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5680

C:\Users\Admin\Downloads\Loader.exe
"C:\Users\Admin\Downloads\Loader.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5736
- C:\Users\Admin\Downloads\Loader.exe
  "C:\Users\Admin\Downloads\Loader.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5788

C:\Users\Admin\Downloads\Loader.exe
"C:\Users\Admin\Downloads\Loader.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:6008
- C:\Users\Admin\Downloads\Loader.exe
  "C:\Users\Admin\Downloads\Loader.exe"
  2⤵
  - Executes dropped EXE
  PID:6068
- C:\Users\Admin\Downloads\Loader.exe
  "C:\Users\Admin\Downloads\Loader.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:6080

C:\Users\Admin\Downloads\Loader.exe
"C:\Users\Admin\Downloads\Loader.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4908
- C:\Users\Admin\Downloads\Loader.exe
  "C:\Users\Admin\Downloads\Loader.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1844

C:\Users\Admin\Downloads\Loader.exe
"C:\Users\Admin\Downloads\Loader.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4808
- C:\Users\Admin\Downloads\Loader.exe
  "C:\Users\Admin\Downloads\Loader.exe"
  2⤵
  - Executes dropped EXE
  PID:5084
- C:\Users\Admin\Downloads\Loader.exe
  "C:\Users\Admin\Downloads\Loader.exe"
  2⤵
  - Executes dropped EXE
  PID:2548
- C:\Users\Admin\Downloads\Loader.exe
  "C:\Users\Admin\Downloads\Loader.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4488

C:\Users\Admin\Downloads\Loader.exe
"C:\Users\Admin\Downloads\Loader.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5792
- C:\Users\Admin\Downloads\Loader.exe
  "C:\Users\Admin\Downloads\Loader.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3296

C:\Users\Admin\Downloads\Loader.exe
"C:\Users\Admin\Downloads\Loader.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4320
- C:\Users\Admin\Downloads\Loader.exe
  "C:\Users\Admin\Downloads\Loader.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5856

C:\Users\Admin\Downloads\Loader.exe
"C:\Users\Admin\Downloads\Loader.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3820
- C:\Users\Admin\Downloads\Loader.exe
  "C:\Users\Admin\Downloads\Loader.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:6052

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /0
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:460

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3923855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:4556

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\40263d64-8b8d-45e0-8b3b-0bbe91d32b3b.tmp

Filesize
11KB

MD5
0ff4a1aac051a0ff1ae8061b784fe40c

SHA1
d824622a19c3f8d18b70e23fd9fe1a64e805f496

SHA256
f42e8bd4100aa7d6f420d6804f20ea437cf3c4799cd86fa8083daca502c14724

SHA512
d8a9be3441ed1b89e6ddd8e7a65a2ebbb80e4a0dc0a9d28c410c607957a5e27c0a40a691e13eb2deb44790f89190078b3cc145ff643804e3bfd5878ce21ed590

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
dc058ebc0f8181946a312f0be99ed79c

SHA1
0c6f376ed8f2d4c275336048c7c9ef9edf18bff0

SHA256
378701e87dcff90aa092702bc299859d6ae8f7e313f773bf594f81df6f40bf6a

SHA512
36e0de64a554762b28045baebf9f71930c59d608f8d05c5faf8906d62eaf83f6d856ef1d1b38110e512fbb1a85d3e2310be11a7f679c6b5b3c62313cc7af52aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a0486d6f8406d852dd805b66ff467692

SHA1
77ba1f63142e86b21c951b808f4bc5d8ed89b571

SHA256
c0745fd195f3a51b27e4d35a626378a62935dccebefb94db404166befd68b2be

SHA512
065a62032eb799fade5fe75f390e7ab3c9442d74cb8b520d846662d144433f39b9186b3ef3db3480cd1d1d655d8f0630855ed5d6e85cf157a40c38a19375ed8a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
256B

MD5
5c3eb131e25d5c24fe6a5574ce36463c

SHA1
ab9bcad034ebf1357d309865947585d9442027e4

SHA256
7d625ddb932016d5d016641a2c70e26042477840ea13a793fe52c890416f1417

SHA512
5eee06fcb159f28e6dc3f423a1177158dad6c411231aa011c84a36c82cf8537f78793463728d82df8fb5d26ef96d2b04dfcf2f226f3cb4963061a7e40df136f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f93206f2953de9e957ddee6081f6eb3e

SHA1
8175453e6145321ee87d250b0e9cc7042ae7d34c

SHA256
43dc8c1f9eb3016fc9c29c8bd68cc7e9a56e258d9ef186cf81eb7ac5c16cf991

SHA512
a1e36c34ca8f89cd290b2071298ffc0e16a8d80369ae4f4017f9e5164f47acd4cdd8731fb17482c1c4a71a794ce4e98229736b9171ea87192c015bc45fc634c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
fa228f5a14241e0131496db585cbfe2d

SHA1
173dc2771e7d0a46940952952d0d54168b9c9ac9

SHA256
270c0b7ebdaf39c82f35be8b72627d55f234e6736ae37feeb0810afaac7b5d3f

SHA512
8a078ba537f70867c541db8acdc847aaf09d0ec276df0ce18601343ff74f5ea244bc51289aef73556c4b5e83603f4e912b87a7f36903fa09c69231d38a5e9824

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
4211b26339e8e0ed55ef1105a6c73c3d

SHA1
530ab40d09279c4af44ed6327ba12a0d8f8a7ced

SHA256
e129af40e4c948f8cf036e7c2637bdf9a339013b11ad40ac08f0f99871003817

SHA512
b8a8bb6b5aec7e667893be9238274fbf9539b06b1bbe7b4fe9febeb208d54d19fdff2b60dd6c728c28ffaf284de952b609a1c7f5a5b750b3069d4a333092946b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
66d025d8590894b5806ada1cd9fcdb8a

SHA1
7809cff8caca7f6482893e90994ebb0dedd206d7

SHA256
8db86fbd1e08a92b871e0a23757f25a8f05c268e403b970a415039f2b73ca527

SHA512
4d55c271036415de3851f98de3fbdc0ca5b47720d16bcc5b89a0f30df642977bc2e2b1788641be24ee5bedd0cc53ff032de325a7305c20992fdd750e22072f33

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
d57da2e844a5683a505ffe101dc9e204

SHA1
cb05c43671ccffefd9ecf5c5807304dd2a00882c

SHA256
9c1fd42882457c72f0c4c432540e8fd9a8212b1ffd39f5fa0188c3ae95048514

SHA512
7f1455519b9338f9a34bb83128f9729b86f62219e1528d205fb0ffd58d7dc02a92d1686ac82d107dfbbb17910dd6fab8e8bd7c814bf2417b0368aea7bbf5208f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
edafced5fa7e38de19177674f7440fe4

SHA1
3210fe5cc546f207b20403244f951e2d2384a74c

SHA256
379c44eae8be3dfb7e106233f2b40bb43668dc2c2884f65d1cf657bf8d017ddf

SHA512
77a21f9198785614732e4c0746c80f02bf38ff344370a775e44b351099efbe96bbd1ac4c7f6f5888d509e4fa689257f7a5804b9429d633908ba0e2d6819dbd8b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
9804886ba06db9a0122e737c8743041c

SHA1
d2559f90a949177c541edc9a33787e75179f2205

SHA256
3fc4392d04fae630bc80476b1afc744494ac7de603239e5d5f6def4322afe529

SHA512
ff2a3c74e51ea02b9986890707d2ab8f028586fba16d53b97ce7eb88326784562fe88dbc674ef136add16bdb8749585afcbd6dc1f175324ee35493ee4fd31a46

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 303516.crdownload

Filesize
454KB

MD5
5cf227fa034cb7aa9ba60a5482892bc7

SHA1
ad20e86a5800b50e9d8153a4e97c417aa135fec9

SHA256
4379f092a839e8169f3ba75cd4acab87067bd570a5299a1a04c5086e7aa9d509

SHA512
882b4e08adccef91e2c78b2ae123d8e625b93ce5775be625fd7bf09ffb08d3fcb7b7ece3bf614eae0e23281b00781792447a684c86631360fb1102aaf84a3b62

Download Submit
\??\pipe\LOCAL\crashpad_4068_FKKKNWLPGXKSTOIL

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/460-205-0x00000201A21A0000-0x00000201A21A1000-memory.dmp

Filesize
4KB

Download
memory/460-196-0x00000201A21A0000-0x00000201A21A1000-memory.dmp

Filesize
4KB

Download
memory/460-207-0x00000201A21A0000-0x00000201A21A1000-memory.dmp

Filesize
4KB

Download
memory/460-206-0x00000201A21A0000-0x00000201A21A1000-memory.dmp

Filesize
4KB

Download
memory/460-197-0x00000201A21A0000-0x00000201A21A1000-memory.dmp

Filesize
4KB

Download
memory/460-203-0x00000201A21A0000-0x00000201A21A1000-memory.dmp

Filesize
4KB

Download
memory/460-204-0x00000201A21A0000-0x00000201A21A1000-memory.dmp

Filesize
4KB

Download
memory/460-202-0x00000201A21A0000-0x00000201A21A1000-memory.dmp

Filesize
4KB

Download
memory/460-201-0x00000201A21A0000-0x00000201A21A1000-memory.dmp

Filesize
4KB

Download
memory/460-195-0x00000201A21A0000-0x00000201A21A1000-memory.dmp

Filesize
4KB

Download
memory/3960-60-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/3960-58-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download

Resubmissions

Analysis

Sharing

Errors

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads