lumma | hxxps://app[.]mediafire[.]com/lwu3tilsok3mw

Analysis

max time kernel
221s
max time network
227s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
03-01-2025 20:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://app.mediafire.com/lwu3tilsok3mw

Score

10^/10

lumma discovery phishing stealer

Malware Config

Extracted

Family

lumma

https://cloudewahsj.shop/api

https://rabidcowse.shop/api

https://noisycuttej.shop/api

https://tirepublicerj.shop/api

https://framekgirus.shop/api

https://wholersorie.shop/api

https://abruptyopsn.shop/api

https://nearycrepso.shop/api

Extracted

Family

lumma

https://abruptyopsn.shop/api

https://wholersorie.shop/api

https://framekgirus.shop/api

https://tirepublicerj.shop/api

https://noisycuttej.shop/api

https://rabidcowse.shop/api

https://cloudewahsj.shop/api

Signatures

Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Lumma family
lumma
A potential corporate email address has been identified in the URL: [email protected]
phishing
A potential corporate email address has been identified in the URL: [email protected]
phishing
A potential corporate email address has been identified in the URL: [email protected]
phishing
A potential corporate email address has been identified in the URL: [email protected]
phishing

Executes dropped EXE 4 IoCs

pid	Process
5616	Origin.com
4976	Origin.com
5524	Origin.com
2924	Origin.com

Enumerates processes with tasklist 1 TTPs 8 IoCs

discovery

Process Discovery

T1057

pid	Process
3544	tasklist.exe
5796	tasklist.exe
4432	tasklist.exe
2240	tasklist.exe
2656	tasklist.exe
976	tasklist.exe
4992	tasklist.exe
3616	tasklist.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\InstantHelped	Loader.exe
File opened for modification	C:\Windows\DefineReviewer	Loader.exe
File opened for modification	C:\Windows\InstantHelped	Loader.exe
File opened for modification	C:\Windows\DefineReviewer	Loader.exe
File opened for modification	C:\Windows\InstantHelped	Loader.exe
File opened for modification	C:\Windows\DefineReviewer	Loader.exe
File opened for modification	C:\Windows\InstantHelped	Loader.exe
File opened for modification	C:\Windows\DefineReviewer	Loader.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 51 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	extrac32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	extrac32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Origin.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Origin.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	extrac32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Origin.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Origin.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	extrac32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202020202	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 010000000200000000000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	msedge.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
4376	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2500	msedge.exe
2500	msedge.exe
3088	msedge.exe
3088	msedge.exe
4608	identity_helper.exe
4608	identity_helper.exe
5428	msedge.exe
5428	msedge.exe
5616	Origin.com
5616	Origin.com
5616	Origin.com
5616	Origin.com
5616	Origin.com
5616	Origin.com
5616	Origin.com
5616	Origin.com
5616	Origin.com
5616	Origin.com
5616	Origin.com
5616	Origin.com
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4976	Origin.com
4976	Origin.com
4976	Origin.com
4976	Origin.com
4976	Origin.com
4976	Origin.com
4976	Origin.com
4976	Origin.com
4976	Origin.com
4976	Origin.com
4976	Origin.com
4976	Origin.com
4596	taskmgr.exe
4596	taskmgr.exe
4596	taskmgr.exe
4596	taskmgr.exe
4596	taskmgr.exe
4596	taskmgr.exe
4596	taskmgr.exe
4596	taskmgr.exe
4596	taskmgr.exe
4596	taskmgr.exe
4596	taskmgr.exe
4596	taskmgr.exe
4596	taskmgr.exe
4596	taskmgr.exe
4596	taskmgr.exe
4596	taskmgr.exe
4596	taskmgr.exe
4596	taskmgr.exe
4596	taskmgr.exe
4596	taskmgr.exe
4596	taskmgr.exe
5616	msedge.exe
5616	msedge.exe
4596	taskmgr.exe
4596	taskmgr.exe
4596	taskmgr.exe
4596	taskmgr.exe
4596	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4596	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeDebugPrivilege	976	tasklist.exe
Token: SeDebugPrivilege	4992	tasklist.exe
Token: SeDebugPrivilege	3616	tasklist.exe
Token: SeDebugPrivilege	3544	tasklist.exe
Token: SeDebugPrivilege	4596	taskmgr.exe
Token: SeSystemProfilePrivilege	4596	taskmgr.exe
Token: SeCreateGlobalPrivilege	4596	taskmgr.exe
Token: SeDebugPrivilege	5796	tasklist.exe
Token: SeDebugPrivilege	4432	tasklist.exe
Token: SeDebugPrivilege	2240	tasklist.exe
Token: SeDebugPrivilege	2656	tasklist.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
5616	Origin.com
5616	Origin.com

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
5616	Origin.com
5616	Origin.com
5616	Origin.com
4976	Origin.com
4976	Origin.com
4976	Origin.com
4596	taskmgr.exe
4596	taskmgr.exe
4596	taskmgr.exe
4596	taskmgr.exe
4596	taskmgr.exe
4596	taskmgr.exe
4596	taskmgr.exe
4596	taskmgr.exe
4596	taskmgr.exe
4596	taskmgr.exe
4596	taskmgr.exe
4596	taskmgr.exe
4596	taskmgr.exe
4596	taskmgr.exe
4596	taskmgr.exe
4596	taskmgr.exe
4596	taskmgr.exe
4596	taskmgr.exe
4596	taskmgr.exe
4596	taskmgr.exe
4596	taskmgr.exe
4596	taskmgr.exe
4596	taskmgr.exe
4596	taskmgr.exe
4596	taskmgr.exe
4596	taskmgr.exe
4596	taskmgr.exe
4596	taskmgr.exe
4596	taskmgr.exe
4596	taskmgr.exe
4596	taskmgr.exe
4596	taskmgr.exe
4596	taskmgr.exe
4596	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3088 wrote to memory of 3948	3088	msedge.exe	83
PID 3088 wrote to memory of 3948	3088	msedge.exe	83
PID 3088 wrote to memory of 1592	3088	msedge.exe	84
PID 3088 wrote to memory of 1592	3088	msedge.exe	84
PID 3088 wrote to memory of 1592	3088	msedge.exe	84
PID 3088 wrote to memory of 1592	3088	msedge.exe	84
PID 3088 wrote to memory of 1592	3088	msedge.exe	84
PID 3088 wrote to memory of 1592	3088	msedge.exe	84
PID 3088 wrote to memory of 1592	3088	msedge.exe	84
PID 3088 wrote to memory of 1592	3088	msedge.exe	84
PID 3088 wrote to memory of 1592	3088	msedge.exe	84
PID 3088 wrote to memory of 1592	3088	msedge.exe	84
PID 3088 wrote to memory of 1592	3088	msedge.exe	84
PID 3088 wrote to memory of 1592	3088	msedge.exe	84
PID 3088 wrote to memory of 1592	3088	msedge.exe	84
PID 3088 wrote to memory of 1592	3088	msedge.exe	84
PID 3088 wrote to memory of 1592	3088	msedge.exe	84
PID 3088 wrote to memory of 1592	3088	msedge.exe	84
PID 3088 wrote to memory of 1592	3088	msedge.exe	84
PID 3088 wrote to memory of 1592	3088	msedge.exe	84
PID 3088 wrote to memory of 1592	3088	msedge.exe	84
PID 3088 wrote to memory of 1592	3088	msedge.exe	84
PID 3088 wrote to memory of 1592	3088	msedge.exe	84
PID 3088 wrote to memory of 1592	3088	msedge.exe	84
PID 3088 wrote to memory of 1592	3088	msedge.exe	84
PID 3088 wrote to memory of 1592	3088	msedge.exe	84
PID 3088 wrote to memory of 1592	3088	msedge.exe	84
PID 3088 wrote to memory of 1592	3088	msedge.exe	84
PID 3088 wrote to memory of 1592	3088	msedge.exe	84
PID 3088 wrote to memory of 1592	3088	msedge.exe	84
PID 3088 wrote to memory of 1592	3088	msedge.exe	84
PID 3088 wrote to memory of 1592	3088	msedge.exe	84
PID 3088 wrote to memory of 1592	3088	msedge.exe	84
PID 3088 wrote to memory of 1592	3088	msedge.exe	84
PID 3088 wrote to memory of 1592	3088	msedge.exe	84
PID 3088 wrote to memory of 1592	3088	msedge.exe	84
PID 3088 wrote to memory of 1592	3088	msedge.exe	84
PID 3088 wrote to memory of 1592	3088	msedge.exe	84
PID 3088 wrote to memory of 1592	3088	msedge.exe	84
PID 3088 wrote to memory of 1592	3088	msedge.exe	84
PID 3088 wrote to memory of 1592	3088	msedge.exe	84
PID 3088 wrote to memory of 1592	3088	msedge.exe	84
PID 3088 wrote to memory of 2500	3088	msedge.exe	85
PID 3088 wrote to memory of 2500	3088	msedge.exe	85
PID 3088 wrote to memory of 3492	3088	msedge.exe	86
PID 3088 wrote to memory of 3492	3088	msedge.exe	86
PID 3088 wrote to memory of 3492	3088	msedge.exe	86
PID 3088 wrote to memory of 3492	3088	msedge.exe	86
PID 3088 wrote to memory of 3492	3088	msedge.exe	86
PID 3088 wrote to memory of 3492	3088	msedge.exe	86
PID 3088 wrote to memory of 3492	3088	msedge.exe	86
PID 3088 wrote to memory of 3492	3088	msedge.exe	86
PID 3088 wrote to memory of 3492	3088	msedge.exe	86
PID 3088 wrote to memory of 3492	3088	msedge.exe	86
PID 3088 wrote to memory of 3492	3088	msedge.exe	86
PID 3088 wrote to memory of 3492	3088	msedge.exe	86
PID 3088 wrote to memory of 3492	3088	msedge.exe	86
PID 3088 wrote to memory of 3492	3088	msedge.exe	86
PID 3088 wrote to memory of 3492	3088	msedge.exe	86
PID 3088 wrote to memory of 3492	3088	msedge.exe	86
PID 3088 wrote to memory of 3492	3088	msedge.exe	86
PID 3088 wrote to memory of 3492	3088	msedge.exe	86
PID 3088 wrote to memory of 3492	3088	msedge.exe	86
PID 3088 wrote to memory of 3492	3088	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://app.mediafire.com/lwu3tilsok3mw
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe25bf46f8,0x7ffe25bf4708,0x7ffe25bf4718
  2⤵
  PID:3948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,17719811669536342201,17158940836470625866,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2064 /prefetch:2
  2⤵
  PID:1592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2056,17719811669536342201,17158940836470625866,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2056,17719811669536342201,17158940836470625866,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2708 /prefetch:8
  2⤵
  PID:3492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,17719811669536342201,17158940836470625866,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
  2⤵
  PID:4972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,17719811669536342201,17158940836470625866,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:1
  2⤵
  PID:4940
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,17719811669536342201,17158940836470625866,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5360 /prefetch:8
  2⤵
  PID:3768
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,17719811669536342201,17158940836470625866,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5360 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,17719811669536342201,17158940836470625866,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5628 /prefetch:1
  2⤵
  PID:4404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,17719811669536342201,17158940836470625866,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3916 /prefetch:1
  2⤵
  PID:4328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,17719811669536342201,17158940836470625866,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
  2⤵
  PID:4388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,17719811669536342201,17158940836470625866,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:3224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,17719811669536342201,17158940836470625866,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6016 /prefetch:1
  2⤵
  PID:4312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,17719811669536342201,17158940836470625866,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6416 /prefetch:1
  2⤵
  PID:2024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,17719811669536342201,17158940836470625866,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6264 /prefetch:1
  2⤵
  PID:4976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2056,17719811669536342201,17158940836470625866,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5492 /prefetch:8
  2⤵
  PID:4580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,17719811669536342201,17158940836470625866,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6704 /prefetch:1
  2⤵
  PID:4312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,17719811669536342201,17158940836470625866,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6196 /prefetch:1
  2⤵
  PID:5000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,17719811669536342201,17158940836470625866,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7020 /prefetch:1
  2⤵
  PID:5256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2056,17719811669536342201,17158940836470625866,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6512 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,17719811669536342201,17158940836470625866,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6316 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4332

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3008

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4836

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1376

C:\Users\Admin\Documents\GalaxyPr00j33ct2.53v\GalaxyPr00j33ct2.53v\Loader.exe
"C:\Users\Admin\Documents\GalaxyPr00j33ct2.53v\GalaxyPr00j33ct2.53v\Loader.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5160
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c move Excessive Excessive.cmd & Excessive.cmd
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5208
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:976
- - C:\Windows\SysWOW64\findstr.exe
    findstr /I "opssvc wrsa"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3576
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4992
- - C:\Windows\SysWOW64\findstr.exe
    findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1412
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c md 536613
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5360
- - C:\Windows\SysWOW64\extrac32.exe
    extrac32 /Y /E Consumer
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5344
- - C:\Windows\SysWOW64\findstr.exe
    findstr /V "Invitations" Reliance
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5476
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c copy /b 536613\Origin.com + Abc + Broad + Sun + Fence + Churches + Justin + Kinds + Tape + Impacts 536613\Origin.com
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5504
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c copy /b ..\Sr + ..\Programmes + ..\Harmony + ..\Comfortable + ..\Dual + ..\Booking + ..\Prevent o
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5580
- - C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\536613\Origin.com
    Origin.com o
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:5616
- - C:\Windows\SysWOW64\choice.exe
    choice /d y /t 5
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5656

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Documents\GalaxyPr00j33ct2.53v\GalaxyPr00j33ct2.53v\key.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:4376

C:\Users\Admin\Documents\GalaxyPr00j33ct2.53v\GalaxyPr00j33ct2.53v\Loader.exe
"C:\Users\Admin\Documents\GalaxyPr00j33ct2.53v\GalaxyPr00j33ct2.53v\Loader.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4580
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c move Excessive Excessive.cmd & Excessive.cmd
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5860
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3616
- - C:\Windows\SysWOW64\findstr.exe
    findstr /I "opssvc wrsa"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4968
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3544
- - C:\Windows\SysWOW64\findstr.exe
    findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4872
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c md 536613
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5952
- - C:\Windows\SysWOW64\extrac32.exe
    extrac32 /Y /E Consumer
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5968
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c copy /b 536613\Origin.com + Abc + Broad + Sun + Fence + Churches + Justin + Kinds + Tape + Impacts 536613\Origin.com
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3996
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c copy /b ..\Sr + ..\Programmes + ..\Harmony + ..\Comfortable + ..\Dual + ..\Booking + ..\Prevent o
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4988
- - C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\536613\Origin.com
    Origin.com o
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SendNotifyMessage
    PID:4976
- - C:\Windows\SysWOW64\choice.exe
    choice /d y /t 5
    3⤵
    - System Location Discovery: System Language Discovery
    PID:244

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SendNotifyMessage
PID:4596

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault9df988e2hde57h4600ha726h8cedefe67a4b
1⤵
PID:4012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ffe25bf46f8,0x7ffe25bf4708,0x7ffe25bf4718
  2⤵
  PID:1288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1980,5197378663446478217,16630242181140817691,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1988 /prefetch:2
  2⤵
  PID:5412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1980,5197378663446478217,16630242181140817691,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2308 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5616

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5888

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5852

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
- System Location Discovery: System Language Discovery
PID:5520

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{5BD95610-9434-43C2-886C-57852CC8A120} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
PID:748

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefaultac95b630hc6d6h4018hbecch69a48e872564
1⤵
PID:4116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffe25bf46f8,0x7ffe25bf4708,0x7ffe25bf4718
  2⤵
  PID:6032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1416,9870924343738304150,6068394205582728378,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2212 /prefetch:2
  2⤵
  PID:3632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1416,9870924343738304150,6068394205582728378,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 /prefetch:3
  2⤵
  PID:1064

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault4443dd41hf733h437fh9ad3hde7490cf3bfa
1⤵
PID:4260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffe25bf46f8,0x7ffe25bf4708,0x7ffe25bf4718
  2⤵
  PID:4332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,1333699986302697661,12895219717881018833,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2084 /prefetch:2
  2⤵
  PID:5888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2064,1333699986302697661,12895219717881018833,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 /prefetch:3
  2⤵
  PID:5644

C:\Users\Admin\Documents\GalaxyPr00j33ct2.53v\GalaxyPr00j33ct2.53v\Loader.exe
"C:\Users\Admin\Documents\GalaxyPr00j33ct2.53v\GalaxyPr00j33ct2.53v\Loader.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2084
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c move Excessive Excessive.cmd & Excessive.cmd
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2060
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5796
- - C:\Windows\SysWOW64\findstr.exe
    findstr /I "opssvc wrsa"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6068
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4432
- - C:\Windows\SysWOW64\findstr.exe
    findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6084
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c md 536613
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4888
- - C:\Windows\SysWOW64\extrac32.exe
    extrac32 /Y /E Consumer
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5572
- - C:\Windows\SysWOW64\findstr.exe
    findstr /V "Invitations" Reliance
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4216
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c copy /b 536613\Origin.com + Abc + Broad + Sun + Fence + Churches + Justin + Kinds + Tape + Impacts 536613\Origin.com
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5360
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c copy /b ..\Sr + ..\Programmes + ..\Harmony + ..\Comfortable + ..\Dual + ..\Booking + ..\Prevent o
    3⤵
    - System Location Discovery: System Language Discovery
    PID:956
- - C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\536613\Origin.com
    Origin.com o
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5524
- - C:\Windows\SysWOW64\choice.exe
    choice /d y /t 5
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1772

C:\Users\Admin\Documents\GalaxyPr00j33ct2.53v\GalaxyPr00j33ct2.53v\Loader.exe
"C:\Users\Admin\Documents\GalaxyPr00j33ct2.53v\GalaxyPr00j33ct2.53v\Loader.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4036
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c move Excessive Excessive.cmd & Excessive.cmd
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1404
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2240
- - C:\Windows\SysWOW64\findstr.exe
    findstr /I "opssvc wrsa"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1896
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2656
- - C:\Windows\SysWOW64\findstr.exe
    findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3412
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c md 536613
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5700
- - C:\Windows\SysWOW64\extrac32.exe
    extrac32 /Y /E Consumer
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5952
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c copy /b 536613\Origin.com + Abc + Broad + Sun + Fence + Churches + Justin + Kinds + Tape + Impacts 536613\Origin.com
    3⤵
    - System Location Discovery: System Language Discovery
    PID:528
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c copy /b ..\Sr + ..\Programmes + ..\Harmony + ..\Comfortable + ..\Dual + ..\Booking + ..\Prevent o
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5480
- - C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\536613\Origin.com
    Origin.com o
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2924
- - C:\Windows\SysWOW64\choice.exe
    choice /d y /t 5
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4860

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault56f0a5e1h40b4h46bfh9e8bh5f902552d71b
1⤵
PID:5660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffe25bf46f8,0x7ffe25bf4708,0x7ffe25bf4718
  2⤵
  PID:4472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2192,1326346798902677144,10115206689554157504,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:3
  2⤵
  PID:5928

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0a9dc42e4013fc47438e96d24beb8eff

SHA1
806ab26d7eae031a58484188a7eb1adab06457fc

SHA256
58d66151799526b3fa372552cd99b385415d9e9a119302b99aadc34dd51dd151

SHA512
868d6b421ae2501a519595d0c34ddef25b2a98b082c5203da8349035f1f6764ddf183197f1054e7e86a752c71eccbc0649e515b63c55bc18cf5f0592397e258f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
61cef8e38cd95bf003f5fdd1dc37dae1

SHA1
11f2f79ecb349344c143eea9a0fed41891a3467f

SHA256
ae671613623b4477fbd5daf1fd2d148ae2a09ddcc3804b2b6d4ffcb60b317e3e

SHA512
6fb9b333fe0e8fde19fdd0bd01a1990a4e60a87c0a02bc8297da1206e42f8690d06b030308e58c862e9e77714a585eed7cc1627590d99a10aeb77fc0dd3d864d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
bcf9a449e1111b5ad08b98b7c0db69fd

SHA1
5da5f31fcbf6ccbe0aa52a28b088e444c78edebc

SHA256
ed5cda59c3c7c2716cd3b5d7ee70214d9ae2f0553253fe77bbe49aaab01b70c2

SHA512
e4b3f36c27e356b1569cf57e1e11654be2eaf5f074f96b05968bdbfce75555ccf8cec81e7087ccd28bfc2971d3d08bbe30e47c2dd37cc6e72f5f086c816c7d40

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7be399ed0d0992d4882f12e836020f5f

SHA1
ee28dcba32138f9d9eb97f0e1f8258bbe1f58bb7

SHA256
81b3a488d55bcff7c32af744b38e95f2af8386452d3198ea0086f4506b0f9c8c

SHA512
e13ee1dca6107597f8985da78200c322242c63c45447d4596b335044b0d75929c9ae0ec415b10161b975802db9bc58f6857d8dc1318caffc073e146150cbf38c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ec8062f35121259b5a592dadec26b3d7

SHA1
2825f10672be5fbbd569b8230a13963ddee14464

SHA256
532daa0f7b60d2721a3fa252d9c88017a8415e44394db2c5d931a56c4f980fcd

SHA512
63c44005f139ffd2c60f5c0b7a5abda0a496d93b9dde82cc72786ee139c83581960805c98bc06727b9a987f736efb1e5aa550a68d40843c05138a9b48af0225b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1395ca8a-b735-4435-a23e-d7168e36458c.tmp

Filesize
1KB

MD5
56ecc5f5c53cd0230ff8fc9dd411d76c

SHA1
9e95bb52b069dfb9683e55c66590944a68f0ffa7

SHA256
6a90a451d2339be8de29542233ee19bc358110c8dbd1c328ce6a87f284f8b5c8

SHA512
99d7d2e41f4e6e5568eca3764b99376895f9641cba7bb4b6e31873989484f46ff923de30a81c8e17405118b0a77b7342bde8ae04ed8ec624c1be2088bf3c8e72

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000029

Filesize
20KB

MD5
87e8230a9ca3f0c5ccfa56f70276e2f2

SHA1
eb116c8fd20cb2f85b7a942c7dae3b0ed6d27fe7

SHA256
e18d7214e7d3d47d913c0436f5308b9296ca3c6cd34059bf9cbf03126bafafe9

SHA512
37690a81a9e48b157298080746aa94289a4c721c762b826329e70b41ba475bb0261d048f9ab8e7301e43305c5ebf53246c20da8cd001130bf156e8b3bd38b9b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
e6a025a2e4fa08bcd55ee7996f27110b

SHA1
ef539691e10f6cdfb7889e61c003c551b9f23b2c

SHA256
bb01bcec148906c4c0b266ca7d29e8c1855bb85c27b137e82b5864c3c084b4e7

SHA512
c5c64a89aa989ddc0df758e15b56274f567f08067890a9927f15a759fde8974ba0d70167fb7552f4bac29d72fc1b1d274ab9f5b354d78c13de4d3deb77e1c57f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
370b4f18845ea6199ea36f77664c2115

SHA1
c29407b7f60656cffe3e6d2f5e44f834ab7dbb85

SHA256
32390f7edc30a99fe05c07fc40eb4127e9178ad4bbf48ba31be8dc25581fa2ca

SHA512
0c8046125e5e9248f5130b6ee0e740a9e9b69996d89081afc7beb127eb391f930f641b140afb870ee1fbfba8c754443ba77cfd35a22a0d7f1b1de4ca0dc6f5c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
c5f4d4e60161ae38dd1eed7139906f62

SHA1
f96734204b79ff96ec09c5815dd16e4ac6959dcd

SHA256
d3568739cfe299e5d90f9dc9976368dba647011e0ac5bc24e21d89d0f5aafd84

SHA512
70a246f282a58e04e18ed174f816dca91fbc13e6c6d5495f741661b4577aec2a3ffcd251359ce9773fc0efe5d04d782735433ee6f4382b3ea4ab7f1df8a3a6fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
2075b8c1f9d6f5843c8c7cff57532459

SHA1
bd1d485c023f8df3488cc0ce3278f43f1838be85

SHA256
c6b8cb6de1507354276e53ecb8b4b0c758e0fd041abbbb6781e90ad50962feaf

SHA512
63975a98300d66e38250764d94b817ceebb7beaa74117b55cc106c740594ce79a6a1de3d7ca0ac3482b2e39c333a24d3f1a6476c5098fffe3edd8fd54abac6b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
7322c230524c5e887a02cc0d0fa2e2cc

SHA1
3757493688c1967507dbfd5a0ccbbbe12034f67e

SHA256
de1109628d87409e38caa71e8b658983773580a3e2481ba15e64cdbd3624dae4

SHA512
3cadd5e916c5bba94d4565b00cf00d584def9c82d0b9b44a9b1b3fb87fbb258a6eee86ed0d936f9bb050dc66ebda398354435cd19a338625628d0fd76e8afc08

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
cbbca5c65e24d8cb4011e174da4c9f07

SHA1
4fc6ae45c7652938dfda540b6ce56d44e1dde55e

SHA256
27f81110fadb37c1380908645a1acce5df75438ede94afed3d8a1cfaa3df8778

SHA512
cfe97498653371f817b5903d4e088bdc8b551860a7faaa1f69fe1881fb1584ac8d71627536a730ed5b52d95398533ee25cb1ae3c7e7fa29722b33bef1112f198

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
da04f6750f18e002cb0c07a51801f020

SHA1
86c45e6c36f53ffda70deda193e414dec866afd5

SHA256
d0b854a4349b83a114e2b24b7fffa7917e0d4597b69956833877358327e9be2a

SHA512
3cea73e1abbbf7df39c6c6acfefed5fcef78baf9aba2e5e9ff8a304cccd3e129dadc50309f876eaadecd812342090ad9c75cb4b9eb22a681aed9f75f550f6e77

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
5KB

MD5
2171e8b1b5ce2efe0247a688d6187c56

SHA1
440b31ea02cf3141a37949adfbf5661ea0aa9235

SHA256
49e4a347b0bce387b77e618856f1583324048eea28cce1f96f3dec1fa227ca69

SHA512
bdcbd85a714d6f84ab49a0a781c5affcbd8086fa03cc5f3362e41270fa1e8d28b34ef907bea2b746e202f68c508be4ea2ad0854815919a68fe1335a643a5ccbf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
5KB

MD5
0ed3b4f59cde7a52b0645d9b418d9aa3

SHA1
4b7fd50de7c4b3b297399116f2802c403c5c471b

SHA256
01ac2040ca2df733a72077cb88e62d59d77b989aad9133db6db63d49d1bd02aa

SHA512
830cf28abbc5d67413508b237fc8377780bb46cf11ea43042f8d6c6f2a3285abca72d500bd4cbb1dbd7b678d3d9d9b468f369455f83821d27da093ca732c03a3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
175ebb12ad8389136a5d28870df46fdf

SHA1
4c3c9668996441893bf403da810a63a5f2ad4ea8

SHA256
13aed9cc8641b44d7df13c9b9a2b69656dbbf2222b69ca2abb9852218b61ad82

SHA512
f6b3a3aafac44ca9617c7a3ba5506e7c9505bb5ceae373d956a5b58b2510413435a4c17172f85013338bdb7c0abf5bc4d3ecb12d3a7de62fc614bbfdac7de5b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
72d6999fd4ce7e7ebe646a3c8e47bf0b

SHA1
5865390fac6c82b72da792d37f66921bd3660187

SHA256
121b6371b6452e10abd91b935c359faf239e5f6c1a7927370127c7a537cb6392

SHA512
aa83b1e0f0e3ea46585fc4b9ef1c5418072c34e53362378f21f75295a6249f6f6ded510428c840d306ebdaa7723cf598df379e5b756f67b2c62a6bbbd11b51d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
00ad0431e019f94d94cf8c6061af6683

SHA1
7586f1f0a1fb0c4edb5c90d0d96fb4ba96f2da28

SHA256
b2076a71f99102e741d754f3bba037dc676c2c79e0f1a63d288d27a221bfe0e6

SHA512
621c3688e013d1f23e604adce5b5e9b0ed7b45990a00f7a107862be19ff34136a140dafa69b3e01b8c08b9a537981185266296e79761e880c12fedd7cf266cc1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
702B

MD5
52251d6129e3268cacc4b39668b3f811

SHA1
41c19e3e9aeccf1e00d6ad3d58bbae7e48a26af9

SHA256
c242a2336b20aa1e102b0283188c4c3fdd355579966934b72a629ff82ce020a9

SHA512
a1a36e313d068644c17ff1c0347aacf8646d96222aaccd33c3f8b490353d023013dd1d43758c9440d316b2e2d4b3d49bc347fab31819f8e6513393d432195247

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
0adcbb6437d47640e8b643c1e7b60905

SHA1
fa0a1ac93e0ec10b31fed2aebc20586a6065d4b5

SHA256
a4dea93f5dd33e0431471e00b3ea38d30c6b6bf7877ea25de839172b48dd042c

SHA512
4e72e3941ed0f6359d750484b33d42d3ae8760b378b489b45d720de0ded06e114b17e31c4960b839ecd3c593b1fc951885989276057757c909fd216f9c902a27

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
9f4727ef7c935bb1caf5502c901932af

SHA1
360b5ec8b24a89610aeaed1ae35b92912215c986

SHA256
6fe0d4721cb87e3a5c5dc3c14a8d7cc558e872515b3893648bc4508bbd4081df

SHA512
bd7026a0f9b689e6ffab9d29b806adaca90e6b25351c8255ce2ec000129680f14640e7dc657daa606719dcc899c74c3c4fd24038a3b7c9555aefb5718f2831c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
b14e106e064b046b753e0f29fbe4ba96

SHA1
ba922b1def5a3be3bc12541723c222f066b07f39

SHA256
c68f00e008a8d4051010403d45bd57abe91c0428bc5b59cb2e2fb702224fabf9

SHA512
7977abbfeb5d4bf47b57bc0766d2fb9c2f7da685ec8e8c59a53a97e33477e7b844d35810e22277dc83c13f5352a85c22090acabf2f73a909e1566e76e1a251a3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
98424322d4d6f2f52adfbead6fb07402

SHA1
6fcef6ff18f2c9791b2b997d6207e6474e6981a5

SHA256
49abf51667ee2079754cddb234a09f53c3dfcaf20ec23e0794efb6fa488316e3

SHA512
76ab3f273a200a87bf0f5a13e2540d589f24c815b741ce9fee8e3f58a236e2c1601fa33818c87283c1ff5c0395ab6ca6b13b7db82aeb359aee1976a633247a9a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
0f5636e46f7019abf6d8fd0e26a1acb7

SHA1
fb48a1fa119bcd18fbebc7f7da23778e3e2e6b62

SHA256
50f189624916956a258f81ce2afb4ee303f868357d6a48e779562399854fc253

SHA512
885da40f21036c2056ebf83413c0393a0ec7463b088d8e9096b15729863049d7051bdb4b4729f1ce98845614321dd67900965087ae2d19c61d0a42ab6e4214ce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
776692396cffe8c360590934d9244026

SHA1
562d0a8ffd608660b2c9939d045e28e43170fe19

SHA256
2e0b49fc10b3daa46e0426f3c0330731b5f6d896790c2328754745d4cbeedf2a

SHA512
1883063836675c09b16537da82626889f0c6d30d906113f0395127fdbdf7a777645ec641a3be22dfa356415f454d5029523d2c3bbf9789690e67dcd79e4829c7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
a215f79cf460d2e48f4a4764bcbff932

SHA1
f1313f5349620766a8e03e9b1c102d0e23fc66f1

SHA256
c20a00d8c64d5bf5307432141f539567f37c83c139b9d51ef6269c74d3112de5

SHA512
dc2859ded4c43997af59eb73cdef07e5163dd2be8612a599a93b49ea8dddcc0782b03999475aec9f0501475a0864c7cb8f53af011ece01464ed7f91e3b1090d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\536613\Origin.com

Filesize
1KB

MD5
aaffe3f4e15c248fb866f4348fd11baf

SHA1
a287986c360ea8e621a75b8c3ba92b328b4b8cdb

SHA256
133339215b66f223bc26dcca7c7bb39ba2100b4b24d9740f8c81a69150aa640d

SHA512
7ccd6bfdf1efe6f2e5c2bab93b49b79328458424264f96113dd7fb367713614680c9ccd54d3aad48a5b2b3381784c8e3d37299c2b61f07aac518b89411f1bcf6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\536613\Origin.com

Filesize
925KB

MD5
62d09f076e6e0240548c2f837536a46a

SHA1
26bdbc63af8abae9a8fb6ec0913a307ef6614cf2

SHA256
1300262a9d6bb6fcbefc0d299cce194435790e70b9c7b4a651e202e90a32fd49

SHA512
32de0d8bb57f3d3eb01d16950b07176866c7fb2e737d9811f61f7be6606a6a38a5fc5d4d2ae54a190636409b2a7943abca292d6cefaa89df1fc474a1312c695f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\536613\o

Filesize
467KB

MD5
3ab95a62fa2555689fdd5f7bcc77e544

SHA1
935fb654207af4e593f7df125ebe611a53c4784e

SHA256
4d3a1e5e129f57ef8f642a936553c76927c0892b3c0e95fbffba6a15552da03c

SHA512
654007095e3cc44248b7c33d7835a3560809dad3c74e46b8fa6702a6bcb5c978810070ce6f4eb1594993e92e77be981992fc975071405cfb66e8d5188fcd6c88

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Abc

Filesize
113KB

MD5
1e3d63b343db5c5cfcd9c1e2675314d8

SHA1
dcb6443c6da3e93037b43f9276ea83fdd38fb9a9

SHA256
77a3e6474e4bb2ee73b6ad298b30e012766f3324ca8feb7a6ce533f03f09eea1

SHA512
8fb6ca90bf83a1850c726b5e06715c075f8d2d9cf386273c184d427ef74f696c20def8954baf0078e4a1230d58f378be520f617ff80a8daa6bbc115d57e06175

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Booking

Filesize
73KB

MD5
fdb615baa30a1cf6f81d21741bdae0b0

SHA1
48e0db500d09d5cfb51444d55863f795ee72c8a9

SHA256
d5ad22d6a1486be4c737517cbbf92e76cc6625e7f6bd3d94a8a45882d3aa9bbc

SHA512
8f241bdf06b87a2e32fc5f68352423f712b99a84344eaee45d64122562794552854e7cc6d0dff8c908769b4caaf77e0020c76ab2036d72e57d187a1687fedac1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Broad

Filesize
96KB

MD5
3e8b85e2a8d30199aed2005fddfaf4bd

SHA1
6a97178dc8408b393e2cbc75c788540dd65bcd97

SHA256
e713e2793ac0da65a67a63941b17db5e238d9c0ded12c0e260827173d1a371a6

SHA512
fc7fd3c51f1a8ee3add3cb17d3ffcfc6068f38dd88fe3bd9fab8ff1f97ca4735aaca2506efd9471651fa8eb76000f31bc7f0d6f016a9b7cbaa3e15c6a09f02f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Churches

Filesize
140KB

MD5
a58b097d26b381175f8db6c986ecf653

SHA1
94af3ef703655fb1f449a893fe7d03022f1af298

SHA256
b9fc709366de2ee9896a1a65ac7e93e12b8b37910f238cc51feae1549686f25a

SHA512
0244e2bb9f2d693e43998c66fa21b7d4119cbc375ad4a4cbe561f33de330ffe7d4b60710af166dc1a62636896cdb64ff61c71ccd655451d5756c6b504633f4e0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Comfortable

Filesize
67KB

MD5
b4dcee7107712522669155bcd330386c

SHA1
0e127515396c8c37c63b021f105b3f5cece2b441

SHA256
c273a1007d935c71b5f99669c1e7625510797a37e5e306c006eac1d1a1751bbc

SHA512
9ceca28846482129f954be0d828d2acdf3f830c10116432e5fea2b028e29f9c026eeb9404ede5ddbc03bedef0370ce3c9cb5e6bb0638b83217531438519ae009

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Consumer

Filesize
476KB

MD5
132dd6d8bd956b37a52936dafb62368e

SHA1
50e734e12cbc95af5997749d4c2d100b9f11752c

SHA256
b9c49235423cf77add9353221543e94e039290a3a067407cdaebe1ff7f316d94

SHA512
0e357ab5514865084cdee07f558e5ecad66d35540675e1fcaa4666a3c994aff37bb8577ee7b1d3c932e149df5f3477d4e19cecb6a81aec5e6ff002399c693b8b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Dual

Filesize
55KB

MD5
0f36a164a83cd087c795a1c133615746

SHA1
ab2775f385cbfff008aae139da9ac026919f3441

SHA256
a4e53e113ab7d6402d150fdfe5f016cafeb29e1c0376eddeadf593b414ab17c2

SHA512
27b29ce89c68f2378627d72692115b00f073498123d22753c00a726690777a8c833ab35575a26aba1527dcf15586f7a8553f4b488a7a34d8cf50754cdfa0e20a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Excessive

Filesize
14KB

MD5
b3df6de0d91d20d6217494db259404bd

SHA1
f2d5ce88e7ce19f6005ff765561266d8220ead91

SHA256
cee76176445df52b29899d2eeca34687b5a2812594d7be18709679d7ac18770a

SHA512
b283b517fd8a7f87370f76932affecf3ae47cece65c6b19e30c254ec490548e6e0e8b4d09c5a710e90797bf9e5db392c75fe0c254c80db1ae6fa9ec9898242d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Fence

Filesize
102KB

MD5
50d3b805b9a35aadba78ddcc35156a48

SHA1
250a709cfc928f082db6457a418342e254acf5a8

SHA256
1844c002469a355fa2f010d8d817dce8dfd210eec80a13f5b3fecbb6488d4978

SHA512
b0483b671991be66ff104cb642240c1bcc64a6be8d14dfdfa284d3c853c02c1956c3e35f849206138fab769b7bb2aba43277cb0cd8b334105cea4b302175ce48

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Harmony

Filesize
50KB

MD5
cd5639513fb9af6210bc20b6bcf2a5a6

SHA1
03c05cef90baf8b3b18e623df136a4b22c2cf32e

SHA256
533f72ba04f3f5abf0ec86067c24033e918fa465540f53777c2d6f28e4efada8

SHA512
70984fe5db0afdcf76188584a65e95bb2307df0ad1590efad2debe26e6975ffbd1df5892c7c91166e774610703361df6fdefe98fff9a9a71842ac5e7f3220149

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Impacts

Filesize
112KB

MD5
c76b68913fa4d6301ec3d544e4fa7793

SHA1
bd954566fac42514171ab4d26a7aec58578a1692

SHA256
24c0ab685b7bb415b106abd6a8359527c02462484b8ae45b27241fa007d9088b

SHA512
83676bbd13490ed75ccc3027688d1ff62ce562ccde0b1d365fb4c5d981c65427db8c726860afbc30876d0adc43b850b194b7899d8d5650859cff2e90a34638bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Justin

Filesize
50KB

MD5
545ec2b3133ae7cf941b3b9a42e5246f

SHA1
c218a1e9a649b5e43bea9c9fc01a27a90a0369bc

SHA256
08f66e1dfb51dced312c0cf962d933e7a958586d9d155ee3c053b17bef7d4874

SHA512
41474461047a669687be130564202a24f75dfea5d4138657a4414b4474e74ddfe5ba80a82994e9c34c1e659f8d6d9fe392a8a204670c3fdb84d617830e921766

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Kinds

Filesize
61KB

MD5
907c1b6d3ef25f08cac6f0f78adb6a0e

SHA1
29ccfc9ef56c5400dfb7d8dc6b88021edc50b51e

SHA256
737f0136a8624758002b55b83ba4b23ec0a4ebd6a974e36bb8d8d99e9741c5c2

SHA512
393c4e6e2ac547abe74d59ed337adcec0c4b17c5de89057dceb2e1b1ddf12f6b748059e48ec1ec52d2e29d36dd46d5caebfcfa21ebd0c110e547cadbe725ee9e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Prevent

Filesize
75KB

MD5
8053595bd9355b45194591379fc07111

SHA1
46750869d3e2a3bc3a6522caa9c5cf390b235e0f

SHA256
ddb6f2bbb560a31ef1d75f9da72e060883f5a1990819fb678c88e439513d48bd

SHA512
5f01924586835a1b6b17ad96fa7cbfaa18ee93fe5b41d6b1e220dbd0204ffe056756f4371a19713517416135de80d9a494dee7925009d5f3e1b066ad5e71c17c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Programmes

Filesize
61KB

MD5
0ef0a59acba99cada59c3045ebe720ff

SHA1
b88c962857fc1b6291d586d23c71da4cc688d55e

SHA256
1f7df5003eef8924eb15c52f91a182053a0d7ac4679b4674c9148cb058ebcc5d

SHA512
47f1c72541e081d625f4135609e56f9cd598b54e63b31585392670081b18b4ac1abde62b4791d8eeddd59faf5a94e7a9e18f239e1fc484de8f54ecc117af6f29

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Reliance

Filesize
1KB

MD5
18c5d8b0e01519a0f177883f992223cc

SHA1
fa9a2ace542a9d936b72d375d06c58b822439b5d

SHA256
9a63f9c1cc36479aa83699a01af4e3b41f2f28d5b33fd01fcbeece887693688d

SHA512
b7b9223004384fe28bf009eb7c254f0af2f4c53c596ccfd5eb68dd0e5db6651536f0494a84eccd8b56c2ba0f1c4f7f3f4a31f31a7e715cde93b62b524e3e5fab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Sr

Filesize
86KB

MD5
e797962a9cdc70ab4c6ee6fb0943f7ae

SHA1
582123f2c18a7aba3809ac286149e224507058c5

SHA256
7e1441ddf3d7602d860299b0b46e75dd3d32a2384750c9b0e69864768e448165

SHA512
7eb3cdfc0db381c61c40599c463ed63798ed4adb8feb66e6665d0f8918b3b46de153d5687a3f69c221368b891b3e75abeccc8ee4d2b340723657e962ec9c06bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Sun

Filesize
138KB

MD5
dd9144d1b857c62ea5ac32ab5d7a066b

SHA1
702dc4887907873a81b81ecb9182d75162df5dc3

SHA256
210025f7c2132beec0c8f372a94c90bfd6d15337bafb21939613f7bd2a41d49a

SHA512
310c608b556a0207103f8ebda312cdc5b3032f80b8a94abaf1e1974322f9184de282f147f213d25467b56979962efc9943ae0cc84f07d803dda0f29ef4d13b65

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Tape

Filesize
111KB

MD5
c436664cd00495b7f254babd874b3c71

SHA1
e0c7f6103f1b7594a361ae2c74668b957d39c88e

SHA256
143971b2cdefd66aea4e9b9f5713562a2bb2804d255112496e57eaedd9ccb6ad

SHA512
c6a7018c55a138b5f37d641ec315976218f72b4e4872e284fa61a789360b41073a323faf170f83ba747cfc2c03dc94b62a8528886b4418e6ac96fadea5211be6

Download Submit
C:\Users\Admin\Downloads\GalaxyPr00j33ct2.53v.zip

Filesize
15.0MB

MD5
d338360817650dfde3059053ecec2366

SHA1
a03d5857b34cc4f82e252534494f1ab27782c3b3

SHA256
4ff9ee22c081fb3e58e82008af91a62e5500433e9fdbdafc0ae6e587fe709161

SHA512
210967dbbcb570c694d996621631bbcefc51028909590f769cf6682d9826da674c4a791ccdb6082f237057cbc8bc1c6e73048a1b3edb186a57c18e480c79a99d

Download Submit
memory/4596-554-0x000001B5DA060000-0x000001B5DA061000-memory.dmp

Filesize
4KB

Download
memory/4596-547-0x000001B5DA060000-0x000001B5DA061000-memory.dmp

Filesize
4KB

Download
memory/4596-553-0x000001B5DA060000-0x000001B5DA061000-memory.dmp

Filesize
4KB

Download
memory/4596-555-0x000001B5DA060000-0x000001B5DA061000-memory.dmp

Filesize
4KB

Download
memory/4596-556-0x000001B5DA060000-0x000001B5DA061000-memory.dmp

Filesize
4KB

Download
memory/4596-546-0x000001B5DA060000-0x000001B5DA061000-memory.dmp

Filesize
4KB

Download
memory/4596-545-0x000001B5DA060000-0x000001B5DA061000-memory.dmp

Filesize
4KB

Download
memory/4596-552-0x000001B5DA060000-0x000001B5DA061000-memory.dmp

Filesize
4KB

Download
memory/4596-551-0x000001B5DA060000-0x000001B5DA061000-memory.dmp

Filesize
4KB

Download
memory/4596-557-0x000001B5DA060000-0x000001B5DA061000-memory.dmp

Filesize
4KB

Download
memory/5616-501-0x00000000051E0000-0x0000000005236000-memory.dmp

Filesize
344KB

Download
memory/5616-496-0x00000000051E0000-0x0000000005236000-memory.dmp

Filesize
344KB

Download
memory/5616-497-0x00000000051E0000-0x0000000005236000-memory.dmp

Filesize
344KB

Download
memory/5616-499-0x00000000051E0000-0x0000000005236000-memory.dmp

Filesize
344KB

Download
memory/5616-500-0x00000000051E0000-0x0000000005236000-memory.dmp

Filesize
344KB

Download