lumma | hxxps://app[.]mediafire[.]com/lwu3tilsok3mw

Analysis

max time kernel
122s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
04/01/2025, 17:21

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

https://app.mediafire.com/lwu3tilsok3mw

Score

10^/10

lumma discovery stealer

Malware Config

Extracted

Family

lumma

https://cloudewahsj.shop/api

https://rabidcowse.shop/api

https://noisycuttej.shop/api

https://tirepublicerj.shop/api

https://framekgirus.shop/api

https://wholersorie.shop/api

https://abruptyopsn.shop/api

https://nearycrepso.shop/api

Extracted

Family

lumma

https://abruptyopsn.shop/api

https://wholersorie.shop/api

https://framekgirus.shop/api

https://tirepublicerj.shop/api

https://noisycuttej.shop/api

https://rabidcowse.shop/api

https://cloudewahsj.shop/api

Signatures

Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Lumma family
lumma

Executes dropped EXE 2 IoCs

pid	Process
2840	Origin.com
5720	Origin.com

Enumerates processes with tasklist 1 TTPs 4 IoCs

discovery

Process Discovery

T1057

pid	Process
5096	tasklist.exe
996	tasklist.exe
5544	tasklist.exe
5900	tasklist.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\DefineReviewer	Loader.exe
File opened for modification	C:\Windows\InstantHelped	Loader.exe
File opened for modification	C:\Windows\DefineReviewer	Loader.exe
File opened for modification	C:\Windows\InstantHelped	Loader.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 25 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Origin.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	extrac32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	extrac32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Origin.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "64"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings	msedge.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
5428	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 32 IoCs

pid	Process
3128	msedge.exe
3128	msedge.exe
4272	msedge.exe
4272	msedge.exe
2460	identity_helper.exe
2460	identity_helper.exe
5540	msedge.exe
5540	msedge.exe
2840	Origin.com
2840	Origin.com
2840	Origin.com
2840	Origin.com
2840	Origin.com
2840	Origin.com
2840	Origin.com
2840	Origin.com
2840	Origin.com
2840	Origin.com
2840	Origin.com
2840	Origin.com
5720	Origin.com
5720	Origin.com
5720	Origin.com
5720	Origin.com
5720	Origin.com
5720	Origin.com
5720	Origin.com
5720	Origin.com
5720	Origin.com
5720	Origin.com
5720	Origin.com
5720	Origin.com

Suspicious behavior: LoadsDriver 6 IoCs

pid	Process
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
656	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	5900	tasklist.exe
Token: SeDebugPrivilege	5096	tasklist.exe
Token: SeDebugPrivilege	996	tasklist.exe
Token: SeDebugPrivilege	5544	tasklist.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe

Suspicious use of SendNotifyMessage 54 IoCs

pid	Process
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
2840	Origin.com
2840	Origin.com
2840	Origin.com
5720	Origin.com
5720	Origin.com
5720	Origin.com
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5632	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4272 wrote to memory of 1268	4272	msedge.exe	83
PID 4272 wrote to memory of 1268	4272	msedge.exe	83
PID 4272 wrote to memory of 4692	4272	msedge.exe	85
PID 4272 wrote to memory of 4692	4272	msedge.exe	85
PID 4272 wrote to memory of 4692	4272	msedge.exe	85
PID 4272 wrote to memory of 4692	4272	msedge.exe	85
PID 4272 wrote to memory of 4692	4272	msedge.exe	85
PID 4272 wrote to memory of 4692	4272	msedge.exe	85
PID 4272 wrote to memory of 4692	4272	msedge.exe	85
PID 4272 wrote to memory of 4692	4272	msedge.exe	85
PID 4272 wrote to memory of 4692	4272	msedge.exe	85
PID 4272 wrote to memory of 4692	4272	msedge.exe	85
PID 4272 wrote to memory of 4692	4272	msedge.exe	85
PID 4272 wrote to memory of 4692	4272	msedge.exe	85
PID 4272 wrote to memory of 4692	4272	msedge.exe	85
PID 4272 wrote to memory of 4692	4272	msedge.exe	85
PID 4272 wrote to memory of 4692	4272	msedge.exe	85
PID 4272 wrote to memory of 4692	4272	msedge.exe	85
PID 4272 wrote to memory of 4692	4272	msedge.exe	85
PID 4272 wrote to memory of 4692	4272	msedge.exe	85
PID 4272 wrote to memory of 4692	4272	msedge.exe	85
PID 4272 wrote to memory of 4692	4272	msedge.exe	85
PID 4272 wrote to memory of 4692	4272	msedge.exe	85
PID 4272 wrote to memory of 4692	4272	msedge.exe	85
PID 4272 wrote to memory of 4692	4272	msedge.exe	85
PID 4272 wrote to memory of 4692	4272	msedge.exe	85
PID 4272 wrote to memory of 4692	4272	msedge.exe	85
PID 4272 wrote to memory of 4692	4272	msedge.exe	85
PID 4272 wrote to memory of 4692	4272	msedge.exe	85
PID 4272 wrote to memory of 4692	4272	msedge.exe	85
PID 4272 wrote to memory of 4692	4272	msedge.exe	85
PID 4272 wrote to memory of 4692	4272	msedge.exe	85
PID 4272 wrote to memory of 4692	4272	msedge.exe	85
PID 4272 wrote to memory of 4692	4272	msedge.exe	85
PID 4272 wrote to memory of 4692	4272	msedge.exe	85
PID 4272 wrote to memory of 4692	4272	msedge.exe	85
PID 4272 wrote to memory of 4692	4272	msedge.exe	85
PID 4272 wrote to memory of 4692	4272	msedge.exe	85
PID 4272 wrote to memory of 4692	4272	msedge.exe	85
PID 4272 wrote to memory of 4692	4272	msedge.exe	85
PID 4272 wrote to memory of 4692	4272	msedge.exe	85
PID 4272 wrote to memory of 4692	4272	msedge.exe	85
PID 4272 wrote to memory of 3128	4272	msedge.exe	86
PID 4272 wrote to memory of 3128	4272	msedge.exe	86
PID 4272 wrote to memory of 5048	4272	msedge.exe	87
PID 4272 wrote to memory of 5048	4272	msedge.exe	87
PID 4272 wrote to memory of 5048	4272	msedge.exe	87
PID 4272 wrote to memory of 5048	4272	msedge.exe	87
PID 4272 wrote to memory of 5048	4272	msedge.exe	87
PID 4272 wrote to memory of 5048	4272	msedge.exe	87
PID 4272 wrote to memory of 5048	4272	msedge.exe	87
PID 4272 wrote to memory of 5048	4272	msedge.exe	87
PID 4272 wrote to memory of 5048	4272	msedge.exe	87
PID 4272 wrote to memory of 5048	4272	msedge.exe	87
PID 4272 wrote to memory of 5048	4272	msedge.exe	87
PID 4272 wrote to memory of 5048	4272	msedge.exe	87
PID 4272 wrote to memory of 5048	4272	msedge.exe	87
PID 4272 wrote to memory of 5048	4272	msedge.exe	87
PID 4272 wrote to memory of 5048	4272	msedge.exe	87
PID 4272 wrote to memory of 5048	4272	msedge.exe	87
PID 4272 wrote to memory of 5048	4272	msedge.exe	87
PID 4272 wrote to memory of 5048	4272	msedge.exe	87
PID 4272 wrote to memory of 5048	4272	msedge.exe	87
PID 4272 wrote to memory of 5048	4272	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://app.mediafire.com/lwu3tilsok3mw
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8bb5446f8,0x7ff8bb544708,0x7ff8bb544718
  2⤵
  PID:1268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,17564800342311910739,5179266491551824837,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2188 /prefetch:2
  2⤵
  PID:4692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,17564800342311910739,5179266491551824837,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2240 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2148,17564800342311910739,5179266491551824837,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2660 /prefetch:8
  2⤵
  PID:5048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,17564800342311910739,5179266491551824837,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:4020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,17564800342311910739,5179266491551824837,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:3132
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,17564800342311910739,5179266491551824837,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5736 /prefetch:8
  2⤵
  PID:3628
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,17564800342311910739,5179266491551824837,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5736 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,17564800342311910739,5179266491551824837,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5796 /prefetch:1
  2⤵
  PID:4800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,17564800342311910739,5179266491551824837,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5096 /prefetch:1
  2⤵
  PID:3528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,17564800342311910739,5179266491551824837,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5292 /prefetch:1
  2⤵
  PID:324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,17564800342311910739,5179266491551824837,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6244 /prefetch:1
  2⤵
  PID:4092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,17564800342311910739,5179266491551824837,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5080 /prefetch:1
  2⤵
  PID:2008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2148,17564800342311910739,5179266491551824837,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5416 /prefetch:8
  2⤵
  PID:4516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,17564800342311910739,5179266491551824837,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5588 /prefetch:1
  2⤵
  PID:4832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,17564800342311910739,5179266491551824837,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6004 /prefetch:1
  2⤵
  PID:2372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,17564800342311910739,5179266491551824837,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5136 /prefetch:1
  2⤵
  PID:4476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,17564800342311910739,5179266491551824837,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6504 /prefetch:1
  2⤵
  PID:4744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,17564800342311910739,5179266491551824837,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6572 /prefetch:1
  2⤵
  PID:5308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,17564800342311910739,5179266491551824837,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7068 /prefetch:1
  2⤵
  PID:5192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2148,17564800342311910739,5179266491551824837,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5936 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5540

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2044

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2424

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:6096

C:\Users\Admin\Documents\GalaxyPr00j33ct2.53v\GalaxyPr00j33ct2.53v\Loader.exe
"C:\Users\Admin\Documents\GalaxyPr00j33ct2.53v\GalaxyPr00j33ct2.53v\Loader.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6052
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c move Excessive Excessive.cmd & Excessive.cmd
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5476
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5900
- - C:\Windows\SysWOW64\findstr.exe
    findstr /I "opssvc wrsa"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4832
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5096
- - C:\Windows\SysWOW64\findstr.exe
    findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4516
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c md 536613
    3⤵
    - System Location Discovery: System Language Discovery
    PID:640
- - C:\Windows\SysWOW64\extrac32.exe
    extrac32 /Y /E Consumer
    3⤵
    - System Location Discovery: System Language Discovery
    PID:232
- - C:\Windows\SysWOW64\findstr.exe
    findstr /V "Invitations" Reliance
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6132
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c copy /b 536613\Origin.com + Abc + Broad + Sun + Fence + Churches + Justin + Kinds + Tape + Impacts 536613\Origin.com
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2368
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c copy /b ..\Sr + ..\Programmes + ..\Harmony + ..\Comfortable + ..\Dual + ..\Booking + ..\Prevent o
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5956
- - C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\536613\Origin.com
    Origin.com o
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SendNotifyMessage
    PID:2840
- - C:\Windows\SysWOW64\choice.exe
    choice /d y /t 5
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1496

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Documents\GalaxyPr00j33ct2.53v\GalaxyPr00j33ct2.53v\key.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:5428

C:\Users\Admin\Documents\GalaxyPr00j33ct2.53v\GalaxyPr00j33ct2.53v\Loader.exe
"C:\Users\Admin\Documents\GalaxyPr00j33ct2.53v\GalaxyPr00j33ct2.53v\Loader.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3680
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c move Excessive Excessive.cmd & Excessive.cmd
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1080
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:996
- - C:\Windows\SysWOW64\findstr.exe
    findstr /I "opssvc wrsa"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5072
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5544
- - C:\Windows\SysWOW64\findstr.exe
    findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:688
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c md 536613
    3⤵
    - System Location Discovery: System Language Discovery
    PID:556
- - C:\Windows\SysWOW64\extrac32.exe
    extrac32 /Y /E Consumer
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5244
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c copy /b 536613\Origin.com + Abc + Broad + Sun + Fence + Churches + Justin + Kinds + Tape + Impacts 536613\Origin.com
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5632
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c copy /b ..\Sr + ..\Programmes + ..\Harmony + ..\Comfortable + ..\Dual + ..\Booking + ..\Prevent o
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5396
- - C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\536613\Origin.com
    Origin.com o
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SendNotifyMessage
    PID:5720
- - C:\Windows\SysWOW64\choice.exe
    choice /d y /t 5
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4200

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3898055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:5632

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
99afa4934d1e3c56bbce114b356e8a99

SHA1
3f0e7a1a28d9d9c06b6663df5d83a65c84d52581

SHA256
08e098bb97fd91d815469cdfd5568607a3feca61f18b6b5b9c11b531fde206c8

SHA512
76686f30ed68144cf943b80ac10b52c74eee84f197cee3c24ef7845ef44bdb5586b6e530824543deeed59417205ac0e2559808bcb46450504106ac8f4c95b9da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
443a627d539ca4eab732bad0cbe7332b

SHA1
86b18b906a1acd2a22f4b2c78ac3564c394a9569

SHA256
1e1ad9dce141f5f17ea07c7e9c2a65e707c9943f172b9134b0daf9eef25f0dc9

SHA512
923b86d75a565c91250110162ce13dd3ef3f6bdde1a83f7af235ed302d4a96b8c9ed722e2152781e699dfcb26bb98afc73f5adb298f8fd673f14c9f28b5f764d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
e91c1d579f8a21811db0263b303c5d9f

SHA1
9c9e29f2d7cef9a22dc0cf3edc1f7abe1f19a041

SHA256
69121a14932799f1e4d54f4c0e92419eead20f796267529eb432ea78b0081809

SHA512
0bdeb3f3ccae55774ed1d79ab9fceb90f28b0ab996c834a94db29281333444a5f14e8e197ce233573e1ea0e44e177be179cabc148f866115a701bdd3e20a97cc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
244cab90aa1bf5d5e2cea6a692dae086

SHA1
341c244d247e78e8befdd04116dc117b4678e66e

SHA256
45de4fea61a73e3eec45749753c1db056eadd5b3465dd38a8cfda2a4a4d07533

SHA512
a929c6cfe9cfd3fd8238848be83475d216f82c015c331d006b3d8ccde98832a32fdf3f6591088711d7fef6a315b82d008264aeeb369d67567784486d7b9d6280

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
cd2106e86df7fdc6e70098ea3b60557f

SHA1
f9f97b8ab4f1324c87186e9420f5395bf8c90fdc

SHA256
e0d6ba9aa18afc0253b7026c269c2036317754cafbb7184d067a81ca17da0ad7

SHA512
4441bcd963a4eeb574fac1655931b02c31895bd4420ad0a53907bf446322fdb0c1fa4da2080c6c446ce7e9b0baae1e69620e1403d9d94c1d7560a88d8df5e3d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
a711c69587566f5fbfcafee2313a7a03

SHA1
8ca62736ea15ac395cf25c6ffe0a3b3ebaf4491a

SHA256
1aa3b5be7315f322f2b4bda812ba97814b5fe107ba7e4039a7bf1944a1e7255e

SHA512
186c9dee86688dd900c2166c6eecb649afe1bc969f14064f7573889559ef2396df7b6f05f0c64a8bc3b622962fc28ca5e456789eeca1cf2a3992f8063d7bdca7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
5KB

MD5
a2f7e3f02c2ee062a57da24cb18bf328

SHA1
875230434bcb0019547f070526fb6d08b504bcb0

SHA256
b8aa94a3d702c6abc45d2e8fad3a55cdc77d070676c86aecde2ebf9dddb35600

SHA512
d7e807f5cf9c4102b5d6020e5cd263555af996c1d1f729ebec5cc19acd809ccef24e3f2a8519722f9acdf0dd96579ff63a5c42336b9632d3031957d2d40f5eee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
5KB

MD5
835e4afcf180ed8a347c1fec5b9f7e34

SHA1
23ab6bfe7f7716f09df8377fd8e39030465bed58

SHA256
268a256bbfe59c1184fd278433b662806006b81040f3005a88f7aa061ab0cd26

SHA512
75ac83991f66542be9fb123f2f2d771659330d2d566affb790cd6aa11de416751291eb1d0061ebbfd844ed4adacb03c870e10393e6879e97876cb9a548beced5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
5cfe341d32230f9e8723a9c9ba9dcd34

SHA1
17685dd4ed1149beeae62705ac0b1d22256c1146

SHA256
d217cef28bf42cfbe0b7606a08bc48ae11b2d40ac766165854406227e23f3e45

SHA512
54aa0783e9b9f70432dec39b10454e81fdce82e0b23731c81c7429aad33c126a55c7536760f83cd73a0193628ff5bfd9239926f809459275e2d2b85bbfdc9be7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
fabc898f27f763525e450709c85696a4

SHA1
57a777477daba848240c7a164e4fcee3ba0c06f6

SHA256
152fef9012ceace17c753b119cd6e018937d31532a4efc78c27db8587028fd06

SHA512
05436532a10cf5c3859dd8d98ec481da06950d2e35d745ae8fd12a1519684b859f753ac86bbd70c98d378d238e9b19e20226269d4160498b12e4a0782e2ecaca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
d7191444bec4bc238919a163fc323e3a

SHA1
a172278644badc2a86a045046cfb0640ac9775a0

SHA256
e3f7ef674bdf88666e905c881b7f047a5ab9a3bc72f9d464fc7f9092b7f37bff

SHA512
e768a1bb0deb6548cafbec694372bedf81ad47fdacf8b2b2f210d1d93ad966d32be54dcb9ffd771a88118e62ca9929352a02f628df713134ac8b85352fda833d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
d39e9b70490b85b9be0bf55f8eea8ff0

SHA1
72576f68f9bdc92f84e4f07fe48a3d96e5aad3c0

SHA256
c4d9edf8a1dfad3555219eda54d698c5dc01ae7ce3b1ab8528e23544348d2190

SHA512
988901c530ccba29eff6c336f44ae7802516dc5710dfb643d4148b0ed3076f53ddc51d9713ae00c10e966273f395514992f4d4ea6109cd5b147a3d6cb3bffa18

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
ed357bad753a3611fbb41efb8dbba5a1

SHA1
2690f6a0991fcbbe3f992e82b83b6dd065f09cc6

SHA256
d87ae5267f357ff814afa41023d8aa16e5fa4fc8db582cb12c0bfaaa0408ccc9

SHA512
ff51d4afa5e479469c93dbcc95bb54e69589a940a80d04eb1b52b8370b8019d6633a654420a9a9d5f61cdf4251c6e8caaa4f180b0ac3ee879106f209bb4577d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
141d7666c72723e6dcdde756c33b9c08

SHA1
88ee8cb6d182d60732e242bd5ba95b163d8fdeb5

SHA256
aeea7b5c8fd19ffb0898f493cfa71f9e041d57f604a4ac01671067c99579ff23

SHA512
214a5b3f0ec89a056d6c335db3646c829cd29afd37a20354bf87036af093e3c40985bdb79a1ea3ca8d8f408b51d768de00f6bc863614bf77aecf69b22299cffe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe586acb.TMP

Filesize
874B

MD5
5601d7ae94b1649ed6e23855150217ee

SHA1
da9144d0c06b21e0efa19cab21dba6e249d229bd

SHA256
af80b25459476fde095d52541829f454f56f7839e445e658ace925df4e0f78a9

SHA512
c337c10b7de3c24d5fa1c217d76fb05718739839d5a201ac96e0b7e68303b7706afa7ccecf1dc63367e3a100c8657b00d6a390fa858a9f47e21e16c53e948d73

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
7fb0d2f2a0fddceb218fc0d1167ebd62

SHA1
1065fc213a27d6e418e7cbbdc7affa3608d16182

SHA256
2b2a9a176d8f31f91a46750a19c583ada683dc2c795f485d8919a5fc048e1897

SHA512
fb4c3450e799f853ee54085a46eafdf36a638949fb3e8c040c97ce8c663a7543198b3cdf91a67a41cf32bccdb0bed1729a580c386e6b9538d4d48b0933a4452f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
f5492de7a482eb5f006da0ad8b48c001

SHA1
eca46a83f7a96b6b18f3b2cb22ebd6154c4bdfcb

SHA256
4b96cb71a50aab25ad67af9a88135fbe5d62e2bcf0010dd4df7d0ccc2f670f9a

SHA512
2d4f31bc70b5a31ea4ef462e0b10cbea84e3dc1623f0441c9f3ba037f6767c743da994c33dadabc910189bee34b83487801faffcf1f42459af1d9ae8793d6c6e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
fbfb7a3e13601500d2ee30215edb0b31

SHA1
df4312f4c55d199ea5e97b9c9fce288e0959a3f6

SHA256
89eafd10fef7384da8148d06c617f76490d65a2e1d95b8a2c6bae10e0a6a4ba9

SHA512
35deeb8078cd7109bf69cc216cef77f40205e6aeed7ba54ab9f563c40da5a59d3059e75010cda28ad3e50e983284c20caafa1dc1ccb5ac7dd956c461874de458

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\536613\Origin.com

Filesize
1KB

MD5
aaffe3f4e15c248fb866f4348fd11baf

SHA1
a287986c360ea8e621a75b8c3ba92b328b4b8cdb

SHA256
133339215b66f223bc26dcca7c7bb39ba2100b4b24d9740f8c81a69150aa640d

SHA512
7ccd6bfdf1efe6f2e5c2bab93b49b79328458424264f96113dd7fb367713614680c9ccd54d3aad48a5b2b3381784c8e3d37299c2b61f07aac518b89411f1bcf6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\536613\Origin.com

Filesize
925KB

MD5
62d09f076e6e0240548c2f837536a46a

SHA1
26bdbc63af8abae9a8fb6ec0913a307ef6614cf2

SHA256
1300262a9d6bb6fcbefc0d299cce194435790e70b9c7b4a651e202e90a32fd49

SHA512
32de0d8bb57f3d3eb01d16950b07176866c7fb2e737d9811f61f7be6606a6a38a5fc5d4d2ae54a190636409b2a7943abca292d6cefaa89df1fc474a1312c695f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\536613\o

Filesize
467KB

MD5
3ab95a62fa2555689fdd5f7bcc77e544

SHA1
935fb654207af4e593f7df125ebe611a53c4784e

SHA256
4d3a1e5e129f57ef8f642a936553c76927c0892b3c0e95fbffba6a15552da03c

SHA512
654007095e3cc44248b7c33d7835a3560809dad3c74e46b8fa6702a6bcb5c978810070ce6f4eb1594993e92e77be981992fc975071405cfb66e8d5188fcd6c88

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Abc

Filesize
113KB

MD5
1e3d63b343db5c5cfcd9c1e2675314d8

SHA1
dcb6443c6da3e93037b43f9276ea83fdd38fb9a9

SHA256
77a3e6474e4bb2ee73b6ad298b30e012766f3324ca8feb7a6ce533f03f09eea1

SHA512
8fb6ca90bf83a1850c726b5e06715c075f8d2d9cf386273c184d427ef74f696c20def8954baf0078e4a1230d58f378be520f617ff80a8daa6bbc115d57e06175

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Booking

Filesize
73KB

MD5
fdb615baa30a1cf6f81d21741bdae0b0

SHA1
48e0db500d09d5cfb51444d55863f795ee72c8a9

SHA256
d5ad22d6a1486be4c737517cbbf92e76cc6625e7f6bd3d94a8a45882d3aa9bbc

SHA512
8f241bdf06b87a2e32fc5f68352423f712b99a84344eaee45d64122562794552854e7cc6d0dff8c908769b4caaf77e0020c76ab2036d72e57d187a1687fedac1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Broad

Filesize
96KB

MD5
3e8b85e2a8d30199aed2005fddfaf4bd

SHA1
6a97178dc8408b393e2cbc75c788540dd65bcd97

SHA256
e713e2793ac0da65a67a63941b17db5e238d9c0ded12c0e260827173d1a371a6

SHA512
fc7fd3c51f1a8ee3add3cb17d3ffcfc6068f38dd88fe3bd9fab8ff1f97ca4735aaca2506efd9471651fa8eb76000f31bc7f0d6f016a9b7cbaa3e15c6a09f02f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Churches

Filesize
140KB

MD5
a58b097d26b381175f8db6c986ecf653

SHA1
94af3ef703655fb1f449a893fe7d03022f1af298

SHA256
b9fc709366de2ee9896a1a65ac7e93e12b8b37910f238cc51feae1549686f25a

SHA512
0244e2bb9f2d693e43998c66fa21b7d4119cbc375ad4a4cbe561f33de330ffe7d4b60710af166dc1a62636896cdb64ff61c71ccd655451d5756c6b504633f4e0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Comfortable

Filesize
67KB

MD5
b4dcee7107712522669155bcd330386c

SHA1
0e127515396c8c37c63b021f105b3f5cece2b441

SHA256
c273a1007d935c71b5f99669c1e7625510797a37e5e306c006eac1d1a1751bbc

SHA512
9ceca28846482129f954be0d828d2acdf3f830c10116432e5fea2b028e29f9c026eeb9404ede5ddbc03bedef0370ce3c9cb5e6bb0638b83217531438519ae009

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Consumer

Filesize
476KB

MD5
132dd6d8bd956b37a52936dafb62368e

SHA1
50e734e12cbc95af5997749d4c2d100b9f11752c

SHA256
b9c49235423cf77add9353221543e94e039290a3a067407cdaebe1ff7f316d94

SHA512
0e357ab5514865084cdee07f558e5ecad66d35540675e1fcaa4666a3c994aff37bb8577ee7b1d3c932e149df5f3477d4e19cecb6a81aec5e6ff002399c693b8b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Dual

Filesize
55KB

MD5
0f36a164a83cd087c795a1c133615746

SHA1
ab2775f385cbfff008aae139da9ac026919f3441

SHA256
a4e53e113ab7d6402d150fdfe5f016cafeb29e1c0376eddeadf593b414ab17c2

SHA512
27b29ce89c68f2378627d72692115b00f073498123d22753c00a726690777a8c833ab35575a26aba1527dcf15586f7a8553f4b488a7a34d8cf50754cdfa0e20a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Excessive

Filesize
14KB

MD5
b3df6de0d91d20d6217494db259404bd

SHA1
f2d5ce88e7ce19f6005ff765561266d8220ead91

SHA256
cee76176445df52b29899d2eeca34687b5a2812594d7be18709679d7ac18770a

SHA512
b283b517fd8a7f87370f76932affecf3ae47cece65c6b19e30c254ec490548e6e0e8b4d09c5a710e90797bf9e5db392c75fe0c254c80db1ae6fa9ec9898242d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Fence

Filesize
102KB

MD5
50d3b805b9a35aadba78ddcc35156a48

SHA1
250a709cfc928f082db6457a418342e254acf5a8

SHA256
1844c002469a355fa2f010d8d817dce8dfd210eec80a13f5b3fecbb6488d4978

SHA512
b0483b671991be66ff104cb642240c1bcc64a6be8d14dfdfa284d3c853c02c1956c3e35f849206138fab769b7bb2aba43277cb0cd8b334105cea4b302175ce48

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Harmony

Filesize
50KB

MD5
cd5639513fb9af6210bc20b6bcf2a5a6

SHA1
03c05cef90baf8b3b18e623df136a4b22c2cf32e

SHA256
533f72ba04f3f5abf0ec86067c24033e918fa465540f53777c2d6f28e4efada8

SHA512
70984fe5db0afdcf76188584a65e95bb2307df0ad1590efad2debe26e6975ffbd1df5892c7c91166e774610703361df6fdefe98fff9a9a71842ac5e7f3220149

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Impacts

Filesize
112KB

MD5
c76b68913fa4d6301ec3d544e4fa7793

SHA1
bd954566fac42514171ab4d26a7aec58578a1692

SHA256
24c0ab685b7bb415b106abd6a8359527c02462484b8ae45b27241fa007d9088b

SHA512
83676bbd13490ed75ccc3027688d1ff62ce562ccde0b1d365fb4c5d981c65427db8c726860afbc30876d0adc43b850b194b7899d8d5650859cff2e90a34638bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Justin

Filesize
50KB

MD5
545ec2b3133ae7cf941b3b9a42e5246f

SHA1
c218a1e9a649b5e43bea9c9fc01a27a90a0369bc

SHA256
08f66e1dfb51dced312c0cf962d933e7a958586d9d155ee3c053b17bef7d4874

SHA512
41474461047a669687be130564202a24f75dfea5d4138657a4414b4474e74ddfe5ba80a82994e9c34c1e659f8d6d9fe392a8a204670c3fdb84d617830e921766

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Kinds

Filesize
61KB

MD5
907c1b6d3ef25f08cac6f0f78adb6a0e

SHA1
29ccfc9ef56c5400dfb7d8dc6b88021edc50b51e

SHA256
737f0136a8624758002b55b83ba4b23ec0a4ebd6a974e36bb8d8d99e9741c5c2

SHA512
393c4e6e2ac547abe74d59ed337adcec0c4b17c5de89057dceb2e1b1ddf12f6b748059e48ec1ec52d2e29d36dd46d5caebfcfa21ebd0c110e547cadbe725ee9e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Prevent

Filesize
75KB

MD5
8053595bd9355b45194591379fc07111

SHA1
46750869d3e2a3bc3a6522caa9c5cf390b235e0f

SHA256
ddb6f2bbb560a31ef1d75f9da72e060883f5a1990819fb678c88e439513d48bd

SHA512
5f01924586835a1b6b17ad96fa7cbfaa18ee93fe5b41d6b1e220dbd0204ffe056756f4371a19713517416135de80d9a494dee7925009d5f3e1b066ad5e71c17c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Programmes

Filesize
61KB

MD5
0ef0a59acba99cada59c3045ebe720ff

SHA1
b88c962857fc1b6291d586d23c71da4cc688d55e

SHA256
1f7df5003eef8924eb15c52f91a182053a0d7ac4679b4674c9148cb058ebcc5d

SHA512
47f1c72541e081d625f4135609e56f9cd598b54e63b31585392670081b18b4ac1abde62b4791d8eeddd59faf5a94e7a9e18f239e1fc484de8f54ecc117af6f29

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Reliance

Filesize
1KB

MD5
18c5d8b0e01519a0f177883f992223cc

SHA1
fa9a2ace542a9d936b72d375d06c58b822439b5d

SHA256
9a63f9c1cc36479aa83699a01af4e3b41f2f28d5b33fd01fcbeece887693688d

SHA512
b7b9223004384fe28bf009eb7c254f0af2f4c53c596ccfd5eb68dd0e5db6651536f0494a84eccd8b56c2ba0f1c4f7f3f4a31f31a7e715cde93b62b524e3e5fab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Sr

Filesize
86KB

MD5
e797962a9cdc70ab4c6ee6fb0943f7ae

SHA1
582123f2c18a7aba3809ac286149e224507058c5

SHA256
7e1441ddf3d7602d860299b0b46e75dd3d32a2384750c9b0e69864768e448165

SHA512
7eb3cdfc0db381c61c40599c463ed63798ed4adb8feb66e6665d0f8918b3b46de153d5687a3f69c221368b891b3e75abeccc8ee4d2b340723657e962ec9c06bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Sun

Filesize
138KB

MD5
dd9144d1b857c62ea5ac32ab5d7a066b

SHA1
702dc4887907873a81b81ecb9182d75162df5dc3

SHA256
210025f7c2132beec0c8f372a94c90bfd6d15337bafb21939613f7bd2a41d49a

SHA512
310c608b556a0207103f8ebda312cdc5b3032f80b8a94abaf1e1974322f9184de282f147f213d25467b56979962efc9943ae0cc84f07d803dda0f29ef4d13b65

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Tape

Filesize
111KB

MD5
c436664cd00495b7f254babd874b3c71

SHA1
e0c7f6103f1b7594a361ae2c74668b957d39c88e

SHA256
143971b2cdefd66aea4e9b9f5713562a2bb2804d255112496e57eaedd9ccb6ad

SHA512
c6a7018c55a138b5f37d641ec315976218f72b4e4872e284fa61a789360b41073a323faf170f83ba747cfc2c03dc94b62a8528886b4418e6ac96fadea5211be6

Download Submit
C:\Users\Admin\Downloads\GalaxyPr00j33ct2.53v.zip

Filesize
15.0MB

MD5
d338360817650dfde3059053ecec2366

SHA1
a03d5857b34cc4f82e252534494f1ab27782c3b3

SHA256
4ff9ee22c081fb3e58e82008af91a62e5500433e9fdbdafc0ae6e587fe709161

SHA512
210967dbbcb570c694d996621631bbcefc51028909590f769cf6682d9826da674c4a791ccdb6082f237057cbc8bc1c6e73048a1b3edb186a57c18e480c79a99d

Download Submit
memory/2840-644-0x0000000005110000-0x0000000005166000-memory.dmp

Filesize
344KB

Download
memory/2840-646-0x0000000005110000-0x0000000005166000-memory.dmp

Filesize
344KB

Download
memory/2840-648-0x0000000005110000-0x0000000005166000-memory.dmp

Filesize
344KB

Download
memory/2840-647-0x0000000005110000-0x0000000005166000-memory.dmp

Filesize
344KB

Download
memory/2840-645-0x0000000005110000-0x0000000005166000-memory.dmp

Filesize
344KB

Download

Analysis

Sharing

Errors

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads