lumma | 5d0c67b62e2401b4ce98c54702beb487dbbe1591c6dde89a8448937d2ef227dc

Analysis

max time kernel
81s
max time network
86s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
08-01-2025 15:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

[2.0]Beyond_Repair-2.74/[UPD]Intel_Unit.2.1.exe
Size

1.1MB
MD5

25b4bac0866214df0bcb32a8dc280555
SHA1

58513411b725c0f264013acacaba7fe069208aa7
SHA256

17e8ebdf1c3303f6c9538e9998e533962aa732a1356434d6cf78ab353f3a9f06
SHA512

4f63a60288d8e15eb01843d1ecc61344606a4e3bf0933cf8bd02892dbb7d2167b7b35d4ff17c5207b25057520d7147bfa4bed38d75b6429f0c9ebe6458de592d
SSDEEP

24576:setHGMwy9WuUSPl/hw6z89q1zfaaJ+1DPVhPQLc3nVQMd:j7zMU+0pJQ9hPQcQu

Score

10^/10

lumma discovery stealer

Malware Config

Extracted

Family

lumma

https://cloudewahsj.shop/api

https://rabidcowse.shop/api

https://noisycuttej.shop/api

https://tirepublicerj.shop/api

https://framekgirus.shop/api

https://wholersorie.shop/api

https://abruptyopsn.shop/api

https://nearycrepso.shop/api

Signatures

Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Lumma family
lumma

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	[UPD]Intel_Unit.2.1.exe

Executes dropped EXE 1 IoCs

pid	Process
1000	Hugo.com

Enumerates processes with tasklist 1 TTPs 2 IoCs

discovery

Process Discovery

T1057

pid	Process
3432	tasklist.exe
1852	tasklist.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\FranchiseReed	[UPD]Intel_Unit.2.1.exe
File opened for modification	C:\Windows\ChristineSnapshot	[UPD]Intel_Unit.2.1.exe
File opened for modification	C:\Windows\BmAccurate	[UPD]Intel_Unit.2.1.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hugo.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	extrac32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	[UPD]Intel_Unit.2.1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1000	Hugo.com
1000	Hugo.com
1000	Hugo.com
1000	Hugo.com
1000	Hugo.com
1000	Hugo.com
4340	msedge.exe
4340	msedge.exe
1824	msedge.exe
1824	msedge.exe
2548	identity_helper.exe
2548	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3432	tasklist.exe
Token: SeDebugPrivilege	1852	tasklist.exe

Suspicious use of FindShellTrayWindow 28 IoCs

pid	Process
1000	Hugo.com
1000	Hugo.com
1000	Hugo.com
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe

Suspicious use of SendNotifyMessage 27 IoCs

pid	Process
1000	Hugo.com
1000	Hugo.com
1000	Hugo.com
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3880 wrote to memory of 1404	3880	[UPD]Intel_Unit.2.1.exe	84
PID 3880 wrote to memory of 1404	3880	[UPD]Intel_Unit.2.1.exe	84
PID 3880 wrote to memory of 1404	3880	[UPD]Intel_Unit.2.1.exe	84
PID 1404 wrote to memory of 3432	1404	cmd.exe	86
PID 1404 wrote to memory of 3432	1404	cmd.exe	86
PID 1404 wrote to memory of 3432	1404	cmd.exe	86
PID 1404 wrote to memory of 2216	1404	cmd.exe	87
PID 1404 wrote to memory of 2216	1404	cmd.exe	87
PID 1404 wrote to memory of 2216	1404	cmd.exe	87
PID 1404 wrote to memory of 1852	1404	cmd.exe	89
PID 1404 wrote to memory of 1852	1404	cmd.exe	89
PID 1404 wrote to memory of 1852	1404	cmd.exe	89
PID 1404 wrote to memory of 2848	1404	cmd.exe	90
PID 1404 wrote to memory of 2848	1404	cmd.exe	90
PID 1404 wrote to memory of 2848	1404	cmd.exe	90
PID 1404 wrote to memory of 2560	1404	cmd.exe	91
PID 1404 wrote to memory of 2560	1404	cmd.exe	91
PID 1404 wrote to memory of 2560	1404	cmd.exe	91
PID 1404 wrote to memory of 4776	1404	cmd.exe	92
PID 1404 wrote to memory of 4776	1404	cmd.exe	92
PID 1404 wrote to memory of 4776	1404	cmd.exe	92
PID 1404 wrote to memory of 2900	1404	cmd.exe	93
PID 1404 wrote to memory of 2900	1404	cmd.exe	93
PID 1404 wrote to memory of 2900	1404	cmd.exe	93
PID 1404 wrote to memory of 4904	1404	cmd.exe	94
PID 1404 wrote to memory of 4904	1404	cmd.exe	94
PID 1404 wrote to memory of 4904	1404	cmd.exe	94
PID 1404 wrote to memory of 4960	1404	cmd.exe	95
PID 1404 wrote to memory of 4960	1404	cmd.exe	95
PID 1404 wrote to memory of 4960	1404	cmd.exe	95
PID 1404 wrote to memory of 1000	1404	cmd.exe	96
PID 1404 wrote to memory of 1000	1404	cmd.exe	96
PID 1404 wrote to memory of 1000	1404	cmd.exe	96
PID 1404 wrote to memory of 3684	1404	cmd.exe	97
PID 1404 wrote to memory of 3684	1404	cmd.exe	97
PID 1404 wrote to memory of 3684	1404	cmd.exe	97
PID 1824 wrote to memory of 3204	1824	msedge.exe	106
PID 1824 wrote to memory of 3204	1824	msedge.exe	106
PID 1824 wrote to memory of 1972	1824	msedge.exe	107
PID 1824 wrote to memory of 1972	1824	msedge.exe	107
PID 1824 wrote to memory of 1972	1824	msedge.exe	107
PID 1824 wrote to memory of 1972	1824	msedge.exe	107
PID 1824 wrote to memory of 1972	1824	msedge.exe	107
PID 1824 wrote to memory of 1972	1824	msedge.exe	107
PID 1824 wrote to memory of 1972	1824	msedge.exe	107
PID 1824 wrote to memory of 1972	1824	msedge.exe	107
PID 1824 wrote to memory of 1972	1824	msedge.exe	107
PID 1824 wrote to memory of 1972	1824	msedge.exe	107
PID 1824 wrote to memory of 1972	1824	msedge.exe	107
PID 1824 wrote to memory of 1972	1824	msedge.exe	107
PID 1824 wrote to memory of 1972	1824	msedge.exe	107
PID 1824 wrote to memory of 1972	1824	msedge.exe	107
PID 1824 wrote to memory of 1972	1824	msedge.exe	107
PID 1824 wrote to memory of 1972	1824	msedge.exe	107
PID 1824 wrote to memory of 1972	1824	msedge.exe	107
PID 1824 wrote to memory of 1972	1824	msedge.exe	107
PID 1824 wrote to memory of 1972	1824	msedge.exe	107
PID 1824 wrote to memory of 1972	1824	msedge.exe	107
PID 1824 wrote to memory of 1972	1824	msedge.exe	107
PID 1824 wrote to memory of 1972	1824	msedge.exe	107
PID 1824 wrote to memory of 1972	1824	msedge.exe	107
PID 1824 wrote to memory of 1972	1824	msedge.exe	107
PID 1824 wrote to memory of 1972	1824	msedge.exe	107
PID 1824 wrote to memory of 1972	1824	msedge.exe	107

C:\Users\Admin\AppData\Local\Temp\[2.0]Beyond_Repair-2.74\[UPD]Intel_Unit.2.1.exe
"C:\Users\Admin\AppData\Local\Temp\[2.0]Beyond_Repair-2.74\[UPD]Intel_Unit.2.1.exe"
1⤵
- Checks computer location settings
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3880
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c move Cloudy Cloudy.cmd & Cloudy.cmd
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1404
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3432
- - C:\Windows\SysWOW64\findstr.exe
    findstr /I "opssvc wrsa"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2216
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1852
- - C:\Windows\SysWOW64\findstr.exe
    findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2848
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c md 686536
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2560
- - C:\Windows\SysWOW64\extrac32.exe
    extrac32 /Y /E Justify
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4776
- - C:\Windows\SysWOW64\findstr.exe
    findstr /V "Backing" Kelly
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2900
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c copy /b 686536\Hugo.com + Ware + Sanyo + Pg + Folk + Lifetime + Robert + Enlarge + Hence 686536\Hugo.com
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4904
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c copy /b ..\Selection + ..\Suse + ..\Illustrations + ..\Alerts + ..\Smart + ..\Steps + ..\Lovers y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4960
- - C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\686536\Hugo.com
    Hugo.com y
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:1000
- - C:\Windows\SysWOW64\choice.exe
    choice /d y /t 5
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3684

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\ShowConnect.mhtml
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffe0aac46f8,0x7ffe0aac4708,0x7ffe0aac4718
  2⤵
  PID:3204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,14645685061170370006,8670365736280497573,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2244 /prefetch:2
  2⤵
  PID:1972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,14645685061170370006,8670365736280497573,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2296 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2148,14645685061170370006,8670365736280497573,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2836 /prefetch:8
  2⤵
  PID:3832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,14645685061170370006,8670365736280497573,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3180 /prefetch:1
  2⤵
  PID:4328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,14645685061170370006,8670365736280497573,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3196 /prefetch:1
  2⤵
  PID:4320
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,14645685061170370006,8670365736280497573,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5160 /prefetch:8
  2⤵
  PID:208
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,14645685061170370006,8670365736280497573,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5160 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,14645685061170370006,8670365736280497573,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5156 /prefetch:1
  2⤵
  PID:4688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,14645685061170370006,8670365736280497573,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4672 /prefetch:1
  2⤵
  PID:2112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,14645685061170370006,8670365736280497573,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:1100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,14645685061170370006,8670365736280497573,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
  2⤵
  PID:2932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,14645685061170370006,8670365736280497573,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5348 /prefetch:1
  2⤵
  PID:2300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,14645685061170370006,8670365736280497573,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5720 /prefetch:1
  2⤵
  PID:2368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,14645685061170370006,8670365736280497573,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5884 /prefetch:1
  2⤵
  PID:3936

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3948

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f426165d1e5f7df1b7a3758c306cd4ae

SHA1
59ef728fbbb5c4197600f61daec48556fec651c1

SHA256
b68dfc21866d0abe5c75d70acc54670421fa9b26baf98af852768676a901b841

SHA512
8d437fcb85acb0705bf080141e7a021740901248985a76299ea8c43e46ad78fb88c738322cf302f6a550caa5e79d85b36827e9b329b1094521b17cf638c015b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6960857d16aadfa79d36df8ebbf0e423

SHA1
e1db43bd478274366621a8c6497e270d46c6ed4f

SHA256
f40b812ce44e391423eb66602ac0af138a1e948aa8c4116045fef671ef21cd32

SHA512
6deb2a63055a643759dd0ae125fb2f68ec04a443dbf8b066a812b42352bbcfa4517382ed0910c190c986a864559c3453c772e153ee2e9432fb2de2e1e49ca7fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

Filesize
103KB

MD5
8dff9fa1c024d95a15d60ab639395548

SHA1
9a2eb2a8704f481004cfc0e16885a70036d846d0

SHA256
bf97efc6d7605f65d682f61770fbce0a8bd66b68dac2fb084ec5ce28907fbbdb

SHA512
23dd9110887b1a9bbdbcc3ae58a9fe0b97b899ad55d9f517ff2386ea7aac481a718be54e6350f8ba29b391cc7b69808c7a7f18931758acce9fbf13b59cee3811

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002c

Filesize
51KB

MD5
588ee33c26fe83cb97ca65e3c66b2e87

SHA1
842429b803132c3e7827af42fe4dc7a66e736b37

SHA256
bbc4044fe46acd7ab69d8a4e3db46e7e3ca713b05fa8ecb096ebe9e133bba760

SHA512
6f7500b12fc7a9f57c00711af2bc8a7c62973f9a8e37012b88a0726d06063add02077420bc280e7163302d5f3a005ac8796aee97042c40954144d84c26adbd04

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
60129f5b858585ae3d54f4cfe3ad1cbd

SHA1
ee031a559b3e72dc4b7e3d730fd532162fdaff33

SHA256
5d2cbe30a08d047a7bbc5e0b06f9b779a635c1779dc45f5406ee24a7ce6fd1d7

SHA512
adf0d5dc9a62617aab4b20829f7efbf14a7cb9d264d76314ac26c9b5058ddbd6fac21bde4a92eacad6953777089266ab1c11436c28bd43804f9fb222f0264a5f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
700765ed20407094478c579b72d801cb

SHA1
ebe14fb8d516fd7792482c76d25ef13717f12e35

SHA256
2c446116f43370a7c599e3b33993439cc257b729f2875eea4c1f71fa85f638a4

SHA512
5a8d923fbbccc4339786a459705243a392a6d1496ce78999aa8f296dd6af77c5a9fd059ac9f968e07c2ec4d4a56b170668c5e2503eb22e6f92be3e5e1b5eca3f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
10f299b9df33f51d140edb058269f268

SHA1
2b5e06644ef6eef29aa3a4a50819319d35586857

SHA256
1eee00701785bd063860403574296e7114301649675c7fab103722d2ba2e1e66

SHA512
1927742be7b3c334aab0c9322b9c861369fb143ae2f0ac78212dae5553de5f6d7510018a96df8146a3f8d29ef88e6f990b689191a93c4560164e98ec0882839e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
73cc8c7f89c3a21bd6e2e675e75826fa

SHA1
8990cdd0fe06d90910ca837bc839f2deaa0773fd

SHA256
3bfeff6174edbdd1d119dd5d14bd1f6c3667ee2265fe196ce30ebf340aee9afb

SHA512
a28b6976f3fd359b4f14bf6ee067ed4de8f43825865902eb9c058b343d1a708dca13a76951a549dca91b7007a6fa267d23a51f8d79c421d73bb0d9e47f6023d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
04aaa60634de624912c1a495d0eb33a4

SHA1
213e5b74080cdcbc3a1254610de0c7f398eda683

SHA256
1b6987a84bc7c9d665769f6626b7427fddb41c27a5dac0a695167a4cba7daa3b

SHA512
ed6fa945cf07d91945ab34c95c8db340f7fdb94ae09cca417e684bd00388f5bb1354447a20a8456a82bb5ce599e30f56f983717cee75778f3fc744b4ab609ac2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
020f63023196fa5831564af90532c233

SHA1
4bfa92090b007dcf8e0de32de50c5b4be6113152

SHA256
cb8c299bd3c97919927c0ea368fe0dd1d9590bd0c04a3a8e49f35942086d757b

SHA512
28e742c2a587dac7653e237947b53f3e4c823c8816a0b0df7099eaa4a048b986491ac99f3be5e58afd7bc46fa9bf664a43d1d2aa8b2ec10157f174f64ec125ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
c57bc6213b8942b81906e7d868a11add

SHA1
0f6a2507355434ffb46e67ab346a11cc5fcb7584

SHA256
860663fe5defa8eca54c3c190e1c0bbf1321763a27e780ac34f4fde3a508679e

SHA512
96fc105399076b20e8758133169474384410706d59f06ebbcfb8bd9c687a23ec630f4dc51990055a864fb71e16990693090964250ef0362d13b73c3ca9750579

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
44a84b8daf75bc816614af45b280a9a4

SHA1
4419de806a2827159d6104f53eeddbcaf9a3e6cb

SHA256
634eb1a9bb4609318a8dce0f9c5e45581fc2d58266e67665353ef04f7bc33817

SHA512
b7750970b28be25f7c2a3e121c9ec69b5597ab2ee8b45af15fcf4d87fe5df35746787bae490b35195f8463e3a8d69552be7e314e333f713b43b78c4714d551a9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
3c86e548b442482f810b2350f38d2c45

SHA1
76430c3759d7e14e0e15e863af2811841631d389

SHA256
fb08aa1ef566a1cae2254c8e761b498f71adbf79466d60ea47a785fb5d7b8374

SHA512
d0fd4d36c5088dba292cca55d6da999cd40d498ccbe3d0752e96348f80e48bdad42ebf7fe7932687219e87a945d01ca684f9ca3a2368b46e41b69e824ad29512

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe586d0d.TMP

Filesize
1KB

MD5
cb4c8e0be8bf896188a50f3a3e6c12d0

SHA1
fcc035fc9de2994f509498e92c64d33f691bed62

SHA256
266c3fa0b3d2f0fccb92780fc6ebf6379b1670320d772e746420d1a31e0aa0bf

SHA512
133496bd376e11d41762c878c58a963d7eb60abf9ac88c31cfa346541cf64f07d3085a7384c9baaaf053c40823a39d666a43d1dfa007cbea66a58584dc6f3ddb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
4b3bdf8537ff9066580531fffd95bb7d

SHA1
2b6388e3cf31706653eab89565d19c9271901506

SHA256
323768d31974a505defa4e8e18bfe5d9dd72110e83ad803f1d9cbeb14b725f75

SHA512
e54886584d2ef5bd8e35e9a71a45945be5d1f24b8705fa579973d2fa9b25f6f1776c542608e5ed8bac47346d6cb4c4f2bcc8adf0572303923a2612b45d1ca804

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\686536\Hugo.com

Filesize
726B

MD5
a711d925e8138f471bf63340a1d18ed7

SHA1
c8e2dc29c61cda7cc0162cfa8a2ec1b572b392e5

SHA256
91e1c43a78443fe19f91ffb24fedb5ee0e682eaf171333adde2823b7245fe32a

SHA512
d404b2ae98e9ca5874b53a3d43b13bdc228d7dfaa9f253672b40e17b736d65046a58177c6f35d014907ff4e5594bea09c73d0ee80eadf0c1881e36a731f6a893

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\686536\Hugo.com

Filesize
925KB

MD5
62d09f076e6e0240548c2f837536a46a

SHA1
26bdbc63af8abae9a8fb6ec0913a307ef6614cf2

SHA256
1300262a9d6bb6fcbefc0d299cce194435790e70b9c7b4a651e202e90a32fd49

SHA512
32de0d8bb57f3d3eb01d16950b07176866c7fb2e737d9811f61f7be6606a6a38a5fc5d4d2ae54a190636409b2a7943abca292d6cefaa89df1fc474a1312c695f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\686536\y

Filesize
491KB

MD5
ef22d3bb3fee9293e4e5791bee1ab44e

SHA1
740c90a88f6c85851c2e563c14d4aebf063fd329

SHA256
12de133e6f46b487b0fc8fb466c30ae189a62d6b77e17758bef1d78cfe7ca4b5

SHA512
85e58eed3e443296c38af6607069a18ce671e4832252fae1415b4b534b5f888907a2bd41b92607680c2e0392875f346a18c0378aba081d4e45a2a191694d9c71

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Alerts

Filesize
81KB

MD5
510084fbffb3520f7a585509c43359ea

SHA1
18bc385b4cb45dd43048c08fdd9796de5d7ca496

SHA256
81028c1c0254bf3661f66464ff5c32329a07a5f65dd33bfab95f9d20e8d2c25f

SHA512
e4e87c88b6bb4996d26347a76624e2c9f6cb39f02fb12ee7fab0f894b021566cd0bb001a92f0460aeca75241d24a246c8551e061904e82a8060b25f62a8f3cac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Cloudy

Filesize
25KB

MD5
dc3247a74de4c37c027693d52c68b7c8

SHA1
0de55f47e610c7221e41c9c078d7b84c84abb3a6

SHA256
260233a98b15c80a0c13d315497a2576448fe51cbb9bd98ea4fb89a614784a09

SHA512
3f7169fafecee09ee131999a2d47e1e8d64fe54041020030ff0fcbc3d8a7f547b67518439ad9d2f603907db71d8fced989787a91a05a3ce296f89d02af5e594a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Enlarge

Filesize
127KB

MD5
984483c838f29524ae19e3f2e7bb977b

SHA1
c4fb3a6f1323f8c752106f8b668a8441435d94df

SHA256
70e9edc7b1b2b7ec84a2d8679f8e1a3ec53d6f8fa0006cf0abad774949af47cc

SHA512
b83be32e13120181058a53252ab13461dc07ad07823c2115ea98a6c8ef575a5f735f1ab7d8d9f5343a43f428e9507b94f86b85b24846e9d514571099e3eb9462

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Folk

Filesize
120KB

MD5
c8ecca0c247e1a92e140915b9cdbfe17

SHA1
21875091eb1b0d2c0b79b9ae2b754e4ff7986963

SHA256
1e5c8764a4183f950b728763e233f2ea5d966919a803e2cfd5abb8db989b3f79

SHA512
7438b2ea36f8678ded36d70ef904fec66386d440fd4d9f4661cf54b4d04f1ae3e9a6306733245383adfd198af7e6bf1cf36bd2f1fc79a0d479d2fbf6b7098b97

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Hence

Filesize
63KB

MD5
49a649199465ec61134d866da13516af

SHA1
d69e79c87804a3a1068b3d6ef7e50b25635f1467

SHA256
2b1453087de0e47a5575e063bbb2d64dcacb82c51c382d42f624a4729b241aed

SHA512
7c5b1a670da223f411bba9dad8df6802cbb421562c048995a08603ef12ccf0a1d7633c6a8372cb78671b77691789894212122e81b1d6afdeb8cf5573ca9d739b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Illustrations

Filesize
99KB

MD5
74211a093ace2419fddabf68402441eb

SHA1
9cd16d7918aa0fc4a735c55a8b8e5dcbb74ea4cc

SHA256
175e85a1f212bddb8cc6ecb55ba5bb566cbe5ba08685929e0e56834d24acf70f

SHA512
49c84398c911d63d20b6412b3587058544c6d22684c3e2a1d18896fc897756285f1eab24a9c0f6aea34932fe8f28562d97c18d7f30821a380a190aa23fbdcdb2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Justify

Filesize
477KB

MD5
2028cdb5d355ae0ae129ede2856e6af7

SHA1
3a516e498a9c03e71db0eeb7f0ae1c2e121d97d8

SHA256
d1cd829a22a96b6ef923b099edd0a70148e0df7952bce709dfeabdb0821481cb

SHA512
292cc1be4d47fc76b88404ae1e7a801e0ec352766ae3803e711f3082a777bc97933ab2c17ab5852ec6b582bbf6f4bf3f7dffd82aa000ff30c2fcbcb638c7aa70

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Kelly

Filesize
733B

MD5
7a8ce9a909ce0c4c0f9d5a47f16dab6b

SHA1
d04bba85758b2c21a742305d73625e5b35eafb61

SHA256
3c0dca2776c4ff962652481fdc54c593e38c0af50016626a7991bf68003563c0

SHA512
5b636ab0d20417867113ada0dd1ef95bd1abd542e05334bd729d290f090b3d3eb07d1d2b54f8875cd0d0435bad45bf152e8c2c7a10cd331e61c078d917e0babb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Lifetime

Filesize
89KB

MD5
d2cda7cbdd60af9772657b615b472b06

SHA1
c8b89329d2dfab08171c51e446e9156d4e8652d6

SHA256
377142412a126e3ed09f750db4970a696ba3f5a5e042a17fe34e82754c5d145c

SHA512
152faa9becd1de39c1dbd6b074d713b16cb174cbda1124af9e4d2aa7950ff7ac58063ab1e916b19988f8eee2c7602e4e3b4009f2a03ecbf2bcece604ba52c53f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Lovers

Filesize
35KB

MD5
275bb06e411e18b2f2413c99f90b273c

SHA1
b0b56521a5df919287999a6367c9e9db452e15da

SHA256
fccae85d1b45a4a6f6a9bcb369fa7c8a012dc2fcc3e6ad2d93bdddff527ebb6f

SHA512
89936cdde69a00f5501db3ccda1c1a80933e5b36fa60a103bf33c9f6aeeb8d0ce5ef329be445898ab2c5c7c0863909b855b5f913f07d9eb838b8ba71c87b3e71

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Pg

Filesize
137KB

MD5
2b437132a55bfa02a968b7176f510e8a

SHA1
8fd9c04cbfd4b66dadd61a4095fb488d3672f76e

SHA256
b31778d643869e67eefb497906f92bd0605ec0ca0ea0b658d5dfaf99445ad506

SHA512
4b9dc69684afb7f49a5f300692763e8164798e3bed7e14329ce36efbb65642a00ea83cd2cc26606a472a6b5da265ca5273ffe8ff7c06c842229503aa1935c476

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Robert

Filesize
99KB

MD5
5e91d4fd817d0861a7a01118369251c4

SHA1
48c4a668b72c583f8a98e98485135e04cb63bd35

SHA256
c4397deefb0cfddb5c71f93fa5d993b698c88d10c1aa9b550face439f09e6a0e

SHA512
80883d353dc41838ae9f054dda5bd15604361802e3a1c7ef516356c689e3cc6248c47e0f04c1ff9f7de9d3dc92ffe0b3e9739fadb3249599122c307cab6b2c90

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Sanyo

Filesize
143KB

MD5
81a88e12d802c5bc732e0cfea18f022f

SHA1
3b1671df94e6c36429db33cc5d127f2da509a43b

SHA256
8ed1351b297f6ae561d8cbcb860470bf4cda8e9c77cbbae1dd9ec2b5151ae86b

SHA512
ce507ecde5ba3bd54c9b1fc87c78fd0f876df74b5045e73c420a883638301270511dbca8135933eede367636abbefb9845ca54ea78bdced75c57c0f0f3aebdfc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Selection

Filesize
73KB

MD5
779ebb32a40c9a64396eacd3cbdd721c

SHA1
deb9ebdc964bc43ce160edf0e3808a18e3cc89ed

SHA256
bbc2d48f751a6fcbe3a19470be69d77da346f4c87e38a0421fd4ce941ca592de

SHA512
68eb848d8a2dbe411062b2b99a2896bfd67f4915c3e38dff2d2b62ccf9e41fa15906d3170df586aec52faee4c81e1d6537fc95ec961cf4a7becff43c7d59ff01

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Smart

Filesize
76KB

MD5
7bb1c7168444847e64b8d52a19d526a4

SHA1
b0577e3414d38f3a036895e78d0a8beb186622dd

SHA256
8259d660879a9a28012b0d7f4d1a360b8bcfbbcc01cbcd308e04455c5e2766d7

SHA512
70a54ab94335aecf6c6f77a9c2abf8e27131d43d981ec6656b4a5522444a1ef548c968002e3b663c6799e180f07142d4c8dbb33d35427ffd3307839f05234045

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Steps

Filesize
56KB

MD5
0dd5041d2a616872a113d55b19c45a1e

SHA1
b60405e4cddf57920b0ef1929ac47043a1101c2a

SHA256
2257296ba16a378e02d68d82ff9bd280f3ad173e013248d9369ce08f4f900094

SHA512
a8a3f2ee5140103bc7e49c3d1abc838c921cec0616fe13e199dbbd807f73bb839067fb11901d37b5c7edbd2464e94f4bada81b036bea3357979dd7aabbae13da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Suse

Filesize
71KB

MD5
cac74fa897b87e72256e7d176de38b23

SHA1
7ec04d342ade1e868751c07c01bdfd93216bc87e

SHA256
6b6d3f0088a0bfcb9652fdf848ad15cb8e0303de35ddf1f90517991eec557571

SHA512
d1b7aeaea71163c5922ed90f0ecab266299f77bfdf0b4a73042123df5565bac425628fedc552180a083872d74b5a1676423f10b8c90140ebe228f430557cbefa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Ware

Filesize
146KB

MD5
c7024f7ebc1135660d5a31bd4d90182d

SHA1
79cc0ba360e6fcfa44b1d963b677a3b9f1520929

SHA256
68a96df5c94374a988ea3d1222a7931eb24565fb78ea6832d5a6bdc993095ec9

SHA512
fcc61387e7dfd07d90e64978126c7cfbd573dceda02acefb8770d3033345e69928f6db34c72e55547ec4a24547a8655487eea93e912d2e59aafd2affd5b74955

Download Submit
memory/1000-90-0x0000000004A30000-0x0000000004A8B000-memory.dmp

Filesize
364KB

Download
memory/1000-89-0x0000000004A30000-0x0000000004A8B000-memory.dmp

Filesize
364KB

Download
memory/1000-86-0x0000000004A30000-0x0000000004A8B000-memory.dmp

Filesize
364KB

Download
memory/1000-87-0x0000000004A30000-0x0000000004A8B000-memory.dmp

Filesize
364KB

Download
memory/1000-88-0x0000000004A30000-0x0000000004A8B000-memory.dmp

Filesize
364KB

Download