lumma | hxxps://www[.]mediafire[.]com/file/iqczau3ajkd2ir3/#Pa$$w0rD__5567--0pe?_Set-Up#$[.]zip/file

Analysis

max time kernel
97s
max time network
100s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
10-01-2025 03:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.mediafire.com/file/iqczau3ajkd2ir3/#Pa$$w0rD__5567--0pe?_Set-Up#$.zip/file

Score

10^/10

lumma discovery stealer

Malware Config

Extracted

Family

lumma

https://fraggielek.biz/api

https://grandiouseziu.biz/api

https://littlenotii.biz/api

https://marketlumpe.biz/api

https://nuttyshopr.biz/api

https://punishzement.biz/api

https://spookycappy.biz/api

https://truculengisau.biz/api

Signatures

Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Lumma family
lumma

Checks computer location settings 2 TTPs 6 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	Set-up.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	Set-up.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	Set-up.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	Set-up.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	Set-up.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	Set-up.exe

Executes dropped EXE 11 IoCs

pid	Process
1440	Set-up.exe
1872	Translator.com
2924	Set-up.exe
4912	Translator.com
3248	Set-up.exe
2436	Set-up.exe
1816	Translator.com
2000	Set-up.exe
4916	Translator.com
3724	Set-up.exe
2624	Translator.com

Enumerates processes with tasklist 1 TTPs 10 IoCs

discovery

Process Discovery

T1057

pid	Process
2200	tasklist.exe
3124	tasklist.exe
1872	tasklist.exe
608	tasklist.exe
1300	tasklist.exe
5068	tasklist.exe
4896	tasklist.exe
1780	tasklist.exe
4424	tasklist.exe
2088	tasklist.exe

Drops file in Windows directory 42 IoCs

description	ioc	Process
File opened for modification	C:\Windows\WhaleAbsence	Set-up.exe
File opened for modification	C:\Windows\WinningLf	Set-up.exe
File opened for modification	C:\Windows\HockeyShaw	Set-up.exe
File opened for modification	C:\Windows\ImpressiveEnabled	Set-up.exe
File opened for modification	C:\Windows\ExplosionVariance	Set-up.exe
File opened for modification	C:\Windows\AnalystsGourmet	Set-up.exe
File opened for modification	C:\Windows\AnalystsGourmet	Set-up.exe
File opened for modification	C:\Windows\ScholarshipsCookbook	Set-up.exe
File opened for modification	C:\Windows\WhaleAbsence	Set-up.exe
File opened for modification	C:\Windows\WhaleAbsence	Set-up.exe
File opened for modification	C:\Windows\WinningLf	Set-up.exe
File opened for modification	C:\Windows\HockeyShaw	Set-up.exe
File opened for modification	C:\Windows\AnalystsGourmet	Set-up.exe
File opened for modification	C:\Windows\WhaleAbsence	Set-up.exe
File opened for modification	C:\Windows\ImpressiveEnabled	Set-up.exe
File opened for modification	C:\Windows\AnalystsGourmet	Set-up.exe
File opened for modification	C:\Windows\WinningLf	Set-up.exe
File opened for modification	C:\Windows\ScholarshipsCookbook	Set-up.exe
File opened for modification	C:\Windows\HockeyShaw	Set-up.exe
File opened for modification	C:\Windows\WinningLf	Set-up.exe
File opened for modification	C:\Windows\HockeyShaw	Set-up.exe
File opened for modification	C:\Windows\AnalystsGourmet	Set-up.exe
File opened for modification	C:\Windows\ExplosionVariance	Set-up.exe
File opened for modification	C:\Windows\ScholarshipsCookbook	Set-up.exe
File opened for modification	C:\Windows\ExplosionVariance	Set-up.exe
File opened for modification	C:\Windows\HockeyShaw	Set-up.exe
File opened for modification	C:\Windows\ExplosionVariance	Set-up.exe
File opened for modification	C:\Windows\WhaleAbsence	Set-up.exe
File opened for modification	C:\Windows\ScholarshipsCookbook	Set-up.exe
File opened for modification	C:\Windows\HockeyShaw	Set-up.exe
File opened for modification	C:\Windows\ImpressiveEnabled	Set-up.exe
File opened for modification	C:\Windows\ScholarshipsCookbook	Set-up.exe
File opened for modification	C:\Windows\ImpressiveEnabled	Set-up.exe
File opened for modification	C:\Windows\ImpressiveEnabled	Set-up.exe
File opened for modification	C:\Windows\WinningLf	Set-up.exe
File opened for modification	C:\Windows\ExplosionVariance	Set-up.exe
File opened for modification	C:\Windows\AnalystsGourmet	Set-up.exe
File opened for modification	C:\Windows\ScholarshipsCookbook	Set-up.exe
File opened for modification	C:\Windows\ExplosionVariance	Set-up.exe
File opened for modification	C:\Windows\WinningLf	Set-up.exe
File opened for modification	C:\Windows\ImpressiveEnabled	Set-up.exe
File opened for modification	C:\Windows\WhaleAbsence	Set-up.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 63 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	extrac32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Set-up.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Translator.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Set-up.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Set-up.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	extrac32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	extrac32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Translator.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Set-up.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Set-up.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Translator.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Translator.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	extrac32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Translator.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	extrac32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Set-up.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133809517995882403"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	chrome.exe

Suspicious behavior: EnumeratesProcesses 32 IoCs

pid	Process
3980	chrome.exe
3980	chrome.exe
1872	Translator.com
1872	Translator.com
1872	Translator.com
1872	Translator.com
1872	Translator.com
1872	Translator.com
4912	Translator.com
4912	Translator.com
4912	Translator.com
4912	Translator.com
4912	Translator.com
4912	Translator.com
1816	Translator.com
1816	Translator.com
1816	Translator.com
1816	Translator.com
1816	Translator.com
1816	Translator.com
4916	Translator.com
4916	Translator.com
4916	Translator.com
4916	Translator.com
4916	Translator.com
4916	Translator.com
2624	Translator.com
2624	Translator.com
2624	Translator.com
2624	Translator.com
2624	Translator.com
2624	Translator.com

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
3980	chrome.exe
3980	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3980	chrome.exe
Token: SeCreatePagefilePrivilege	3980	chrome.exe
Token: SeShutdownPrivilege	3980	chrome.exe
Token: SeCreatePagefilePrivilege	3980	chrome.exe
Token: SeShutdownPrivilege	3980	chrome.exe
Token: SeCreatePagefilePrivilege	3980	chrome.exe
Token: SeShutdownPrivilege	3980	chrome.exe
Token: SeCreatePagefilePrivilege	3980	chrome.exe
Token: SeShutdownPrivilege	3980	chrome.exe
Token: SeCreatePagefilePrivilege	3980	chrome.exe
Token: SeShutdownPrivilege	3980	chrome.exe
Token: SeCreatePagefilePrivilege	3980	chrome.exe
Token: SeShutdownPrivilege	3980	chrome.exe
Token: SeCreatePagefilePrivilege	3980	chrome.exe
Token: SeShutdownPrivilege	3980	chrome.exe
Token: SeCreatePagefilePrivilege	3980	chrome.exe
Token: SeShutdownPrivilege	3980	chrome.exe
Token: SeCreatePagefilePrivilege	3980	chrome.exe
Token: SeShutdownPrivilege	3980	chrome.exe
Token: SeCreatePagefilePrivilege	3980	chrome.exe
Token: SeShutdownPrivilege	3980	chrome.exe
Token: SeCreatePagefilePrivilege	3980	chrome.exe
Token: SeShutdownPrivilege	3980	chrome.exe
Token: SeCreatePagefilePrivilege	3980	chrome.exe
Token: SeShutdownPrivilege	3980	chrome.exe
Token: SeCreatePagefilePrivilege	3980	chrome.exe
Token: SeShutdownPrivilege	3980	chrome.exe
Token: SeCreatePagefilePrivilege	3980	chrome.exe
Token: SeShutdownPrivilege	3980	chrome.exe
Token: SeCreatePagefilePrivilege	3980	chrome.exe
Token: SeShutdownPrivilege	3980	chrome.exe
Token: SeCreatePagefilePrivilege	3980	chrome.exe
Token: SeShutdownPrivilege	3980	chrome.exe
Token: SeCreatePagefilePrivilege	3980	chrome.exe
Token: SeShutdownPrivilege	3980	chrome.exe
Token: SeCreatePagefilePrivilege	3980	chrome.exe
Token: SeShutdownPrivilege	3980	chrome.exe
Token: SeCreatePagefilePrivilege	3980	chrome.exe
Token: SeShutdownPrivilege	3980	chrome.exe
Token: SeCreatePagefilePrivilege	3980	chrome.exe
Token: SeShutdownPrivilege	3980	chrome.exe
Token: SeCreatePagefilePrivilege	3980	chrome.exe
Token: SeShutdownPrivilege	3980	chrome.exe
Token: SeCreatePagefilePrivilege	3980	chrome.exe
Token: SeShutdownPrivilege	3980	chrome.exe
Token: SeCreatePagefilePrivilege	3980	chrome.exe
Token: SeShutdownPrivilege	3980	chrome.exe
Token: SeCreatePagefilePrivilege	3980	chrome.exe
Token: SeShutdownPrivilege	3980	chrome.exe
Token: SeCreatePagefilePrivilege	3980	chrome.exe
Token: SeShutdownPrivilege	3980	chrome.exe
Token: SeCreatePagefilePrivilege	3980	chrome.exe
Token: SeRestorePrivilege	4760	7zG.exe
Token: 35	4760	7zG.exe
Token: SeSecurityPrivilege	4760	7zG.exe
Token: SeSecurityPrivilege	4760	7zG.exe
Token: SeShutdownPrivilege	3980	chrome.exe
Token: SeCreatePagefilePrivilege	3980	chrome.exe
Token: SeShutdownPrivilege	3980	chrome.exe
Token: SeCreatePagefilePrivilege	3980	chrome.exe
Token: SeShutdownPrivilege	3980	chrome.exe
Token: SeCreatePagefilePrivilege	3980	chrome.exe
Token: SeShutdownPrivilege	3980	chrome.exe
Token: SeCreatePagefilePrivilege	3980	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
4760	7zG.exe
4492	7zG.exe
1872	Translator.com
1872	Translator.com
1872	Translator.com
4912	Translator.com
4912	Translator.com
4912	Translator.com
1816	Translator.com
1816	Translator.com
1816	Translator.com
4916	Translator.com
4916	Translator.com
4916	Translator.com

Suspicious use of SendNotifyMessage 39 IoCs

pid	Process
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
1872	Translator.com
1872	Translator.com
1872	Translator.com
4912	Translator.com
4912	Translator.com
4912	Translator.com
1816	Translator.com
1816	Translator.com
1816	Translator.com
4916	Translator.com
4916	Translator.com
4916	Translator.com
2624	Translator.com
2624	Translator.com
2624	Translator.com

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3980 wrote to memory of 4872	3980	chrome.exe	82
PID 3980 wrote to memory of 4872	3980	chrome.exe	82
PID 3980 wrote to memory of 3704	3980	chrome.exe	83
PID 3980 wrote to memory of 3704	3980	chrome.exe	83
PID 3980 wrote to memory of 3704	3980	chrome.exe	83
PID 3980 wrote to memory of 3704	3980	chrome.exe	83
PID 3980 wrote to memory of 3704	3980	chrome.exe	83
PID 3980 wrote to memory of 3704	3980	chrome.exe	83
PID 3980 wrote to memory of 3704	3980	chrome.exe	83
PID 3980 wrote to memory of 3704	3980	chrome.exe	83
PID 3980 wrote to memory of 3704	3980	chrome.exe	83
PID 3980 wrote to memory of 3704	3980	chrome.exe	83
PID 3980 wrote to memory of 3704	3980	chrome.exe	83
PID 3980 wrote to memory of 3704	3980	chrome.exe	83
PID 3980 wrote to memory of 3704	3980	chrome.exe	83
PID 3980 wrote to memory of 3704	3980	chrome.exe	83
PID 3980 wrote to memory of 3704	3980	chrome.exe	83
PID 3980 wrote to memory of 3704	3980	chrome.exe	83
PID 3980 wrote to memory of 3704	3980	chrome.exe	83
PID 3980 wrote to memory of 3704	3980	chrome.exe	83
PID 3980 wrote to memory of 3704	3980	chrome.exe	83
PID 3980 wrote to memory of 3704	3980	chrome.exe	83
PID 3980 wrote to memory of 3704	3980	chrome.exe	83
PID 3980 wrote to memory of 3704	3980	chrome.exe	83
PID 3980 wrote to memory of 3704	3980	chrome.exe	83
PID 3980 wrote to memory of 3704	3980	chrome.exe	83
PID 3980 wrote to memory of 3704	3980	chrome.exe	83
PID 3980 wrote to memory of 3704	3980	chrome.exe	83
PID 3980 wrote to memory of 3704	3980	chrome.exe	83
PID 3980 wrote to memory of 3704	3980	chrome.exe	83
PID 3980 wrote to memory of 3704	3980	chrome.exe	83
PID 3980 wrote to memory of 3704	3980	chrome.exe	83
PID 3980 wrote to memory of 1600	3980	chrome.exe	84
PID 3980 wrote to memory of 1600	3980	chrome.exe	84
PID 3980 wrote to memory of 2140	3980	chrome.exe	85
PID 3980 wrote to memory of 2140	3980	chrome.exe	85
PID 3980 wrote to memory of 2140	3980	chrome.exe	85
PID 3980 wrote to memory of 2140	3980	chrome.exe	85
PID 3980 wrote to memory of 2140	3980	chrome.exe	85
PID 3980 wrote to memory of 2140	3980	chrome.exe	85
PID 3980 wrote to memory of 2140	3980	chrome.exe	85
PID 3980 wrote to memory of 2140	3980	chrome.exe	85
PID 3980 wrote to memory of 2140	3980	chrome.exe	85
PID 3980 wrote to memory of 2140	3980	chrome.exe	85
PID 3980 wrote to memory of 2140	3980	chrome.exe	85
PID 3980 wrote to memory of 2140	3980	chrome.exe	85
PID 3980 wrote to memory of 2140	3980	chrome.exe	85
PID 3980 wrote to memory of 2140	3980	chrome.exe	85
PID 3980 wrote to memory of 2140	3980	chrome.exe	85
PID 3980 wrote to memory of 2140	3980	chrome.exe	85
PID 3980 wrote to memory of 2140	3980	chrome.exe	85
PID 3980 wrote to memory of 2140	3980	chrome.exe	85
PID 3980 wrote to memory of 2140	3980	chrome.exe	85
PID 3980 wrote to memory of 2140	3980	chrome.exe	85
PID 3980 wrote to memory of 2140	3980	chrome.exe	85
PID 3980 wrote to memory of 2140	3980	chrome.exe	85
PID 3980 wrote to memory of 2140	3980	chrome.exe	85
PID 3980 wrote to memory of 2140	3980	chrome.exe	85
PID 3980 wrote to memory of 2140	3980	chrome.exe	85
PID 3980 wrote to memory of 2140	3980	chrome.exe	85
PID 3980 wrote to memory of 2140	3980	chrome.exe	85
PID 3980 wrote to memory of 2140	3980	chrome.exe	85
PID 3980 wrote to memory of 2140	3980	chrome.exe	85
PID 3980 wrote to memory of 2140	3980	chrome.exe	85

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.mediafire.com/file/iqczau3ajkd2ir3/#Pa$$w0rD__5567--0pe?_Set-Up#$.zip/file
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff93b02cc40,0x7ff93b02cc4c,0x7ff93b02cc58
  2⤵
  PID:4872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1888,i,15680381638741003248,2447092594670132802,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1884 /prefetch:2
  2⤵
  PID:3704
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2124,i,15680381638741003248,2447092594670132802,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2156 /prefetch:3
  2⤵
  PID:1600
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2220,i,15680381638741003248,2447092594670132802,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2420 /prefetch:8
  2⤵
  PID:2140
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3116,i,15680381638741003248,2447092594670132802,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3136 /prefetch:1
  2⤵
  PID:440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3140,i,15680381638741003248,2447092594670132802,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3188 /prefetch:1
  2⤵
  PID:1376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4888,i,15680381638741003248,2447092594670132802,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4896 /prefetch:8
  2⤵
  PID:3768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4840,i,15680381638741003248,2447092594670132802,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5248 /prefetch:8
  2⤵
  PID:4752

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:2204

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2976

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4740

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\#Pa$$w0rD__5567--0peɴ_Set-Up#$\" -spe -an -ai#7zMap12571:122:7zEvent3717
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4760

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\#Pa$$w0rD__5567--0peɴ_Set-Up#$\" -an -ai#7zMap1542:182:7zEvent23315
1⤵
- Suspicious use of FindShellTrayWindow
PID:4492

C:\Users\Admin\Downloads\#Pa$$w0rD__5567--0peɴ_Set-Up#$\Set-up.exe
"C:\Users\Admin\Downloads\#Pa$$w0rD__5567--0peɴ_Set-Up#$\Set-up.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1440
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c move Brian Brian.cmd & Brian.cmd
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4088
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    PID:1300
- - C:\Windows\SysWOW64\findstr.exe
    findstr /I "opssvc wrsa"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1772
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    PID:2200
- - C:\Windows\SysWOW64\findstr.exe
    findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5068
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c md 404509
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4860
- - C:\Windows\SysWOW64\extrac32.exe
    extrac32 /Y /E Desire
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4752
- - C:\Windows\SysWOW64\findstr.exe
    findstr /V "Refurbished" Swiss
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3756
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c copy /b 404509\Translator.com + Decor + Queries + Digest + Martha + Efficiency + Idle + Elevation + Weapons + Football 404509\Translator.com
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4732
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c copy /b ..\Hats + ..\Event + ..\Visual + ..\Netscape + ..\Mobiles + ..\Liquid E
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3520
- - C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\404509\Translator.com
    Translator.com E
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:1872
- - C:\Windows\SysWOW64\choice.exe
    choice /d y /t 5
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5112

C:\Users\Admin\Downloads\#Pa$$w0rD__5567--0peɴ_Set-Up#$\Set-up.exe
"C:\Users\Admin\Downloads\#Pa$$w0rD__5567--0peɴ_Set-Up#$\Set-up.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2924
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c move Brian Brian.cmd & Brian.cmd
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2068
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    PID:5068
- - C:\Windows\SysWOW64\findstr.exe
    findstr /I "opssvc wrsa"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2056
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    PID:3124
- - C:\Windows\SysWOW64\findstr.exe
    findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4216
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c md 404509
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1956
- - C:\Windows\SysWOW64\extrac32.exe
    extrac32 /Y /E Desire
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2972
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c copy /b 404509\Translator.com + Decor + Queries + Digest + Martha + Efficiency + Idle + Elevation + Weapons + Football 404509\Translator.com
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4396
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c copy /b ..\Hats + ..\Event + ..\Visual + ..\Netscape + ..\Mobiles + ..\Liquid E
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1668
- - C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\404509\Translator.com
    Translator.com E
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:4912
- - C:\Windows\SysWOW64\choice.exe
    choice /d y /t 5
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3724

C:\Users\Admin\Downloads\#Pa$$w0rD__5567--0peɴ_Set-Up#$\Set-up.exe
"C:\Users\Admin\Downloads\#Pa$$w0rD__5567--0peɴ_Set-Up#$\Set-up.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3248
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c move Brian Brian.cmd & Brian.cmd
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2816

C:\Users\Admin\Downloads\#Pa$$w0rD__5567--0peɴ_Set-Up#$\Set-up.exe
"C:\Users\Admin\Downloads\#Pa$$w0rD__5567--0peɴ_Set-Up#$\Set-up.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2436
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c move Brian Brian.cmd & Brian.cmd
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4740
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    PID:4896
- - C:\Windows\SysWOW64\findstr.exe
    findstr /I "opssvc wrsa"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4064
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    PID:1780
- - C:\Windows\SysWOW64\findstr.exe
    findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2700
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c md 404509
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3920
- - C:\Windows\SysWOW64\extrac32.exe
    extrac32 /Y /E Desire
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1668
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c copy /b 404509\Translator.com + Decor + Queries + Digest + Martha + Efficiency + Idle + Elevation + Weapons + Football 404509\Translator.com
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1696
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c copy /b ..\Hats + ..\Event + ..\Visual + ..\Netscape + ..\Mobiles + ..\Liquid E
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2228
- - C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\404509\Translator.com
    Translator.com E
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:1816
- - C:\Windows\SysWOW64\choice.exe
    choice /d y /t 5
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4504

C:\Users\Admin\Downloads\#Pa$$w0rD__5567--0peɴ_Set-Up#$\Set-up.exe
"C:\Users\Admin\Downloads\#Pa$$w0rD__5567--0peɴ_Set-Up#$\Set-up.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2000
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c move Brian Brian.cmd & Brian.cmd
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2744
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    PID:1872
- - C:\Windows\SysWOW64\findstr.exe
    findstr /I "opssvc wrsa"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4616
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    PID:4424
- - C:\Windows\SysWOW64\findstr.exe
    findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4440
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c md 404509
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4800
- - C:\Windows\SysWOW64\extrac32.exe
    extrac32 /Y /E Desire
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4420
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c copy /b 404509\Translator.com + Decor + Queries + Digest + Martha + Efficiency + Idle + Elevation + Weapons + Football 404509\Translator.com
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5048
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c copy /b ..\Hats + ..\Event + ..\Visual + ..\Netscape + ..\Mobiles + ..\Liquid E
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4392
- - C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\404509\Translator.com
    Translator.com E
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:4916
- - C:\Windows\SysWOW64\choice.exe
    choice /d y /t 5
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4628

C:\Users\Admin\Downloads\#Pa$$w0rD__5567--0peɴ_Set-Up#$\Set-up.exe
"C:\Users\Admin\Downloads\#Pa$$w0rD__5567--0peɴ_Set-Up#$\Set-up.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3724
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c move Brian Brian.cmd & Brian.cmd
  2⤵
  - System Location Discovery: System Language Discovery
  PID:768
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    PID:2088
- - C:\Windows\SysWOW64\findstr.exe
    findstr /I "opssvc wrsa"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3976
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    PID:608
- - C:\Windows\SysWOW64\findstr.exe
    findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1940
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c md 404509
    3⤵
    - System Location Discovery: System Language Discovery
    PID:708
- - C:\Windows\SysWOW64\extrac32.exe
    extrac32 /Y /E Desire
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4504
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c copy /b 404509\Translator.com + Decor + Queries + Digest + Martha + Efficiency + Idle + Elevation + Weapons + Football 404509\Translator.com
    3⤵
    - System Location Discovery: System Language Discovery
    PID:380
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c copy /b ..\Hats + ..\Event + ..\Visual + ..\Netscape + ..\Mobiles + ..\Liquid E
    3⤵
    - System Location Discovery: System Language Discovery
    PID:400
- - C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\404509\Translator.com
    Translator.com E
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SendNotifyMessage
    PID:2624
- - C:\Windows\SysWOW64\choice.exe
    choice /d y /t 5
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2204

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
c46f77685ba4985d64b03a7542b8a25a

SHA1
aad01eae98e0dbc57a98a88c95d67c4a90d6afca

SHA256
5fe4a345f6a10a239ee99b411e67d605fbaa945d27f9f2c072cd5a594568371b

SHA512
cb58e7f45893992f3ad28a8df800469b36c4fedc3fa8eb7a145c71d2135c5a29b8198ca20c4d5dc5677498e11cc6de38042f0eab645e9273949db6661bdb2626

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
336B

MD5
3cc6bac2d1e2c13c6606108f5075436c

SHA1
5ab7961f422d30d84a6094fa8aa9e420031729eb

SHA256
31fe0e0ba9d2d855cd36f7990bc270a3d6546724c76a6c8dc1ec5cf3cb2c6fa9

SHA512
e1a3691bbcd0d37a34636266455168c94aa90a2cd2b3cee219436d12c389c56874d0eda239c774b8f438f5e10513eb1ccb53c34ea821406d93204b7fbab21c83

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
5KB

MD5
33ce314727c7ffd3f9b02b3b478f5f27

SHA1
a7799cc656fc6581f037d6a2e2bbc5697fba5674

SHA256
7cc7383b11446af3b033018d49eea662e40d8eceaadc66d68f96c19029c19bba

SHA512
e83fee9bc6b052e857c33e99ec005d67741e722d5d4da073649e89ab404982def2218c5e222b644a1878a5edb69154a42973e22c8eea7cfdd441ec80aa51deba

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
858B

MD5
050144f635315906da8a28a4e1a38040

SHA1
7e52bc5814162e6b7ff51e99afc20ee61bfab3e0

SHA256
f3f042769701270e87bda5743d415e492316bc95c3183951a343c63111ed220e

SHA512
1809e8b3446697c65d19b4f01fa1a99a5fd21b1f7086a6ae26f41db4f638aa43658cbff9b4bfd82f215bbaf5e0a60d29093f2760745dcdaab17409cc2f5cbb0e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
d4ee3aedd135914a658780bedc496763

SHA1
84b32426c51f0bd00070449330a0483835513b1d

SHA256
bed97c9dc2f6404ed1beea343318641a45dd092558666d06d7bafae158ba1468

SHA512
319b691e9bbbeb91bdafd2f79b1211a6b8f77a5496d4a79471252787780aec598901ffb22ad24853a39866acac99c145a9c619569612225c5e7604f04dcabba0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
db8267a16b906eafb9fa70ab38c7144d

SHA1
52904f55bb3e9bc0ff6b4352c366ca80a851a660

SHA256
2885fcc24f413c79c00f61dafad596d7659b95939b14a377fde94101789c14fe

SHA512
8c9bce6673c82998ec6ded06f7a5de9ebfc55ea9f8c9fe70d4822fc3bc3dac23adc3ba97cf7151fd549e57dd77058bbc3ab31db0865b7a4f5a563859a2530b8c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
032afe8daa59a8c60c24a0c7a0342529

SHA1
569d4bf702408c510a4e1009ed90618031e31025

SHA256
041ac301b079d20e68b5b0b608a86883b931d8c783488226e0230af23cd24845

SHA512
bb5256eb9ddb94991d6326f27f47fc2bd24e66f0b93b37ad3b276943354ef635768374ff9dfb51bc461f353e0eaf3304e201cf937c992ec39432228562671029

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
fbf96b83ab60e50fae07099568956a29

SHA1
58e4b86965a3a71262b1d772d6f699bf7e6c4358

SHA256
37f910a41758ff65731471684417de6d27c561094311c1a16392913d2c177136

SHA512
b936d1be13bde4d04fe35095009b42682223c6926fcda57ecb940585f26e9b607f06e791b297dd56d719157bc065dad48843ddced158ed8ea1e2cd3bb13037cf

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
135aa73cb2eca8f0f2da5e11906187a8

SHA1
55c34d7866f506cfb1a9a746e2ca594ac9f8cfd2

SHA256
01710d32acbc4383a87df4cc8886ae70cfd99929baba9dcccecdd2d74a67e1af

SHA512
cbb22f5d5dc67cf8dd1a5508ad0838b3b8ce0bbdba49f288c319a7477d1242be6fe85a90dc65ee27e3c127830e17b634038420315c7495c784f4571fbad5ed79

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
0c4ef248f2cc9cab5bf64dd09b14bdb3

SHA1
49044a1a9133c75aed75bd5689db8882ade053a3

SHA256
1e7f9ff6a214f064c25fff03ed609ddce85492fbd777e5f7f7f198bfe247fb22

SHA512
0456dbb95388c669a34d6fac59372638ecd53025937a9be863843998bf4d48f3c8519a185bf3bf0a4bf766d15ad573079cbd03f701942ac5d6e00e3222532854

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
116KB

MD5
e53b8bafc445b954aba53665c822edc2

SHA1
49adcde44e512920467e565a955802e2b15831e3

SHA256
5280f16894c36ff9e9eaf034357fb4e6174905898d111360c2b89a00abdfb069

SHA512
8b155e46184ce72d5b6dd10b438bf34e5b0aa18f88d55d1dc7c94c3d86b63f149a49f69481bf6d3a6fb56a48ca58f35f71a898f9ba9ecf578df90ce7e99ab4fd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
116KB

MD5
105c726e8bbc30a9d61fcee6afeb8cec

SHA1
10633e282cdc1c7635d602912548268e39dfff08

SHA256
eae9a866bce22c9a5f6dbdc730f0d73ffb16b662659c0d88c3efcc2000ffdd09

SHA512
dcfc7b3e0840ff17be1c6f34f47b77a144902f96b52e978f10e518d2b6a4e3fd188312e9a9fca8abdf20c29ee1c1d4bd2615a5fbb563ac18281177098b1e2cbb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\404509\E

Filesize
462KB

MD5
79588addc5128deb617b1f889fefe8b2

SHA1
efeb5223f56c4e495d8a1a3a11dab0be91b365fe

SHA256
9faa428fe1aacf631f1192238785396c8981622c921f40a317536d3dd182aa50

SHA512
a2067788ebbe7f10618b85071f35d0ceb935505cca670541bbd19332ae64b15d97300ffbe450bf9b89176cd4da143ef9dabd750f4372c1e4e1ee51814cd9ff09

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\404509\Translator.com

Filesize
1018B

MD5
0cb261d381dd68437789b998e36d8906

SHA1
612c974e1ffdf5a9ec282e08744cd76d0d83d16d

SHA256
41ccbbff1567253d1ad6889af57c4c06154abf82b00202217078eaa903f699df

SHA512
db67aea369f7c16d0c3b5dbc30a661143ebe6e753de6359dacb5ceafbed44490dd2dbfaf9a7aabcaf7d4cdcc273dc0fb984ff15ad45c1a352d2c1e36d2dddcce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\404509\Translator.com

Filesize
925KB

MD5
62d09f076e6e0240548c2f837536a46a

SHA1
26bdbc63af8abae9a8fb6ec0913a307ef6614cf2

SHA256
1300262a9d6bb6fcbefc0d299cce194435790e70b9c7b4a651e202e90a32fd49

SHA512
32de0d8bb57f3d3eb01d16950b07176866c7fb2e737d9811f61f7be6606a6a38a5fc5d4d2ae54a190636409b2a7943abca292d6cefaa89df1fc474a1312c695f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Brian

Filesize
27KB

MD5
a7fccf307e38310f716ba8a35c8a82ad

SHA1
c103a0d017a6363fe2fbc21d7dd15a5814502bd2

SHA256
9a8d90d16ddd7653b1852c0893a4c8aea211fc1d9bd6dde0944a59bbeedee183

SHA512
35f943f7302e991d504ecb9ae0a1c762c23e00f07b4c71c1d52e6dc6c56f223d58e5e7df055b2ec7ce1efa22d406a5211305942420ecfbac2e19264693e52068

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Decor

Filesize
107KB

MD5
7827216349188dbf7fb1b2e3c888bae6

SHA1
a12411c1d75b0bcf19ed2355b71e8c6d62f06a67

SHA256
de8acf3bed8ecf1ed2d53b2fde4a6a57424653b50574a32b1d41e48b7058ecb4

SHA512
c5eb4c58e81cf51b09caa57357d14302df0a454bb383bb2d3482610ae7d82a2d013b06c52ea1f0907fa1b8f1dadbd1ff1ed4990fe791611605272b94bddf3a61

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Desire

Filesize
477KB

MD5
1fbd6bd4136b345738c4784045161df8

SHA1
11c6aade2a5c84f8d28d9638f035e5362561b2b2

SHA256
7043083447dba2bb524d7ce76851a6fabcb74ed12470c8e9e29eb547b4441e64

SHA512
dcee35c89a9fdb87b6e3bfe76b812bb47ed38043e7ac57849b3a2cc9a3a89a73dc95806c1e3f62dcb29f2390ab4526df78cb5f2388e9c6c9a2aade75655d4ae3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Digest

Filesize
106KB

MD5
b2e3052cc8fe496e126f49f3cbb8a257

SHA1
3757a1a05f61b4e2e1777ac604e5b040a9df9bb8

SHA256
79304051303a690b4914053da1eeb786d3c2892cacc29a2a0406ad5703dfc7ce

SHA512
0ebd2f659f9a0c5fd3109c2aac2ef623cccd0b27d65d6fce3af3f17346b05acd96fc244206983baef9be400fb48f8af872de7495c5edf39300d3d0a30acbf819

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Efficiency

Filesize
84KB

MD5
37d674246a7ca8560813c2c7087313ea

SHA1
f8d0f04fc33e5b5e72249cd0626b7a03d2a33bb2

SHA256
702602bc7056cb47032e887e8b19b6cfc8fd9f7028f6e82045528e0c5595de16

SHA512
e648103b2f20ab3236df76a3868c820a8697c52971638f364213360c97d08b082cba1dbd25f8b91cf61565bcc8db5a9654fdda4270c6a992b06f7468d84d32b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Elevation

Filesize
137KB

MD5
64c4acf2a95867013106dc5abd7ef333

SHA1
afd6d7574b79746067b5f5cd569378137bb488de

SHA256
24aa8b4a63864b74ba33a605906f48aa0ba39420e7dfbdcea2c5be01319cda8c

SHA512
a356b40a2fc6d96c08f3c3da6f30525cff00280a92de23631f8353f7796087739eceee23595ce77f8c908947a07be2400b61028c45752a05df3a4e211f390f19

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Event

Filesize
82KB

MD5
3e2239269b4db40065d3d5bf926779b5

SHA1
2587c6abf99849311875a043314d09ceca9f662d

SHA256
4c0ed494d9c831e3d8a6558121424cd6a3e6089721c8a858e25b47e33e61dac2

SHA512
8fcca04ed7a1782f2d5fe6f823bb47da01a54d5633fcc9982e137fad8d765a819b68986c12ebb98719be288d4de8092bc50835c1ee394ef0a7f20fa4fcf1ef9a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Football

Filesize
11KB

MD5
dbddd47959afa7707ad2d1b3f83db5dc

SHA1
8f2d601427cc446bfff9be0d901de680bb83e5da

SHA256
4556188f412333742141584f7103801dcb5175eda77bd9ecc9c8a6871fb3f5b6

SHA512
4fe8cdc18414d4a33156256c17974a44620b968a570a8baaf7c8165552251a6fc7b243aeeb82199507fdded551570af31a108f7bf0187896beae31733f198f4e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Hats

Filesize
76KB

MD5
6b83aa0e964fdda8338b75026f9a7e08

SHA1
881d197069b72a89f51c21848bc9215fdaa6a214

SHA256
1189963c9635d189b9176ec0ca8330ee8b0578efa67028aaed868c401b75fd71

SHA512
37871a016cde6915b349300f677a727a7eea48d347c51a25cfbceb9b6da213b4d305e71a5bb5fe849c6b8e87aee74c6f1bb19d6ee913f9b9d5542505ef341ebb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Idle

Filesize
142KB

MD5
99b24b01ec31c7bd37dc08593c182609

SHA1
d26c614142d7d8955e7e470a210b3678deb79228

SHA256
e6984efe643ec7ff390948d37c649c399d604ab53c538930734d480e05e3cfb3

SHA512
55e0e9b6e936cc1076e26b0cd5acb1c0234ca994a3d4513b236ee7585f6a0f0c2f3f6ac91818646fc52f4f1462b6342e20d8adb9e933aba00c13174cfad2ba2d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Liquid

Filesize
59KB

MD5
c2523b948015b0dd9b8b6f5cc982ad31

SHA1
a52f147d0d8be39532023dc43cab0650b24c6ace

SHA256
72f1b4626eb624452bf4ceacb7b2eb7327c0490ad0c50346f38760c3f945e40f

SHA512
883baf667941076ea81220ac055b6d9b4aef3e24722d422780620012f6ea31e1758b97a76686aaf276cfa1ba103629d992035b9c8d1ed0e794d0a7bba8b2f439

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Liquid

Filesize
47KB

MD5
7dbdc510c5126ed04fe00e8ab215a76b

SHA1
5bd800eb0439c551353deb54633e3d6ba7e19af3

SHA256
e561f70a64c72a1adeb2e3d8d9eeacb53838ff2589bd259ad864d86c0ebcb887

SHA512
0b9a5e4b5a1bf770acf2cd3229a6a3ad4545f75dede4bdd184f026085534524f902523184e9f8b5ca9a336d4d3900a4fb616e1789f0028560ec2cb26a8ffe1f1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Martha

Filesize
124KB

MD5
ea3a27579c81718f7f781fd5c3c1e377

SHA1
db85c8a6ce8a2ede7f2c6fa3d58c513f0a0c8513

SHA256
d525fd6ed35b9fe4c3490143c1f2d36fbbf65f732a7292dabfd08678fdef55aa

SHA512
2da79aaca0b2549ca86e7a82a0113127b78f226b9cf539ee739cc23e29221b579e6b8b91a4e8ef662d59e603113bb97ae263c61c296be537802aafdf031c0294

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Mobiles

Filesize
53KB

MD5
a7bbb7e1ed3911ddf0593ffce65ebe15

SHA1
1e3fb8d990ceacf1e6e7d820b1c614d7e3890e35

SHA256
4e55469c9849ad35413ee66b4a9d3b8c73f860cacaecb8b968758829e96f4c98

SHA512
8f4d1b632d927582aa81056fa5fcfdbfe2707196c9677b7cf6aec482551467e8ef01a010c9ffb11d77c45c3fca40cba838d173c66cc30c7d024082c8f49e77fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Netscape

Filesize
93KB

MD5
923d6f48a82b5c41e2d0ebed3f00a096

SHA1
d409ba939b0f8bb7493505815ce7e819435ad1c5

SHA256
9a7201dcbf8b4a4a07bed1d4c10f2ba7ecfe262b1016a7f926ee665a6cf96fda

SHA512
6f9b8018089985bb4a5b2d7db891761a85b8a50069149bdf917525953527a7f7cd6a7299711dcdbfceebff532411e4bc0d7e8ab705913c32f2f111a2b15ad7f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Queries

Filesize
136KB

MD5
11cc4fe6b2bf7dfe8b5111606ced8a74

SHA1
8311f063a7a36b5b8057a759bafbdac6593dae4e

SHA256
d4eab4d82b13eaca2e96153ed9b2d4bca693b0e01f9157ec03b3c83041577bb1

SHA512
f164cecb9e13b204aa037b5f4656c5ad713ba9517f46f979c3ea3da943d4ae5b3e08b83ecb43f774aba9cbd0ffbb7843e6f17ff0d7e0e78b8bb1a654cf68e7c7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Swiss

Filesize
1KB

MD5
6df5196d2c3e3f49d177b918fc2dd844

SHA1
7366e1f33de4546b539d49142343d9857edbcc40

SHA256
a4b958bffd538d69a501fc254e33b4d7cca22c74fda9fbd043198397c9df0e6f

SHA512
98a0fe4893e653d11baa6b9dd4489d385714ea25bcc40143f9570e95a6cc329d2d1eb43a7a8450aa6c16b3c0c649afc7ad5159f392a1bc17a1f6ec0e4f778efc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Visual

Filesize
99KB

MD5
4ff7928bda0a639a019141cb65055b05

SHA1
e86fe2e3f2ea59ec726ebe46204d57f70cedde6e

SHA256
39d5a573a9023424d4f6a6d6cb36e2995330f19791f4a53050af20bb08b22a36

SHA512
67737687e6132268fe5d81dbe22bfceffa6e444a19a98baf43b93b7fdfba6bf150576ce42fb2aba9dab643fb09ee32e10b7a3297dbf14d07feb9b710e67ee6e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Weapons

Filesize
77KB

MD5
663d2811fd15873765d597f576399955

SHA1
a03226eb5b7f697a20756a36d73cd3128a6a8271

SHA256
e4bb6cf5608737068978f6dd883493d453c697d0192f26b0e044244c1219b011

SHA512
ac5053a20f03edb2769bd24be35bb0c4fb6cb9bc7c01e6b191add6dfca3e512f81d036fdf6a971dcd5d7375d3b10fdc75412098f713a83124ea7e2edf425f4de

Download Submit
C:\Users\Admin\Downloads\#Pa$$w0rD__5567--0peɴ_Set-Up#$.zip

Filesize
14.6MB

MD5
031fc50c4f76b9bcdceb31d7a34e7d89

SHA1
d985d8f056bd28069b43f27e88472ace1d7f2867

SHA256
56704f7cc295f766f2c8021540fe950d745c270e36a39ed630f1d5b17f514836

SHA512
f1709778d0a4bb3f671c867916064454476c9ff522b08099d80b07eadd9a722a53fb258f597ce8df5a804151738b2286c8e03bc32904c5635982b8d3096b5827

Download Submit
C:\Users\Admin\Downloads\#Pa$$w0rD__5567--0peɴ_Set-Up#$\#Pa$$w0rD__5567--0peɴ_Set-Up#$.7z

Filesize
14.6MB

MD5
29464b03edb9c31b65f2f4bf62e51bef

SHA1
d9daaf74554a992876edb2b9348245668c3bb1b4

SHA256
c15696d93dca4d6530dccf04076a4f283fa61522c4c4a4b137592b87e508bb23

SHA512
b6376e3bd7273171a9fe5623ea1f91ff71a4be052171dc3813960249e726045f8f28146a552e62b070b9e3436fe2f8c03586ed8978edf1c4524c57f9ca12aea0

Download Submit
memory/1872-394-0x00000000043F0000-0x0000000004449000-memory.dmp

Filesize
356KB

Download
memory/1872-393-0x00000000043F0000-0x0000000004449000-memory.dmp

Filesize
356KB

Download
memory/1872-392-0x00000000043F0000-0x0000000004449000-memory.dmp

Filesize
356KB

Download
memory/1872-391-0x00000000043F0000-0x0000000004449000-memory.dmp

Filesize
356KB

Download
memory/1872-390-0x00000000043F0000-0x0000000004449000-memory.dmp

Filesize
356KB

Download