lumma | a22d583c9cccac570226f4dabe0eef59e3473581fd71ba11eb3e400f58a2be91

Analysis

max time kernel
149s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/06/2026, 16:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
tmpo6e_mb76.exe
Size 2.0MB
Sample260601-vas3lsax2x
SHA256 a22d583c9cccac570226f4dabe0eef59e3473581fd71ba11eb3e400f58a2be91
MD5 e9fc1ee38cdf7d001ce6d1888c607dc2
SHA1 fede9f2eac6db1c49b2ef00ac3ccc925b0ad63e2
SHA512 7a68fc7d558adfc63650b67ca1ff787b4e23823fbeccaed20c2e6f44db595c21a478b336b21d10bc8afbbe076bf54201eb8e50615edbb999db43992452b94932
SSDEEP 24576:inmbjhFiKK7g/L4/96r6P2q5jbb2oz1/AnIdEHOJT5UlAVBsYS7y1gjJb3gHEfHe:im3m669EHEyv7y1gjJbQHz84
TLSH
T124A56C51EDC784F2E601063124AEB3BB673459458F3ADB87EA917EBCF8373911863249
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery lumma spyware stealer

Malware Config

Extracted

Family

lumma

https://diospfj.cyou
https://decrnoj.club/xxx
https://pomflgf.vu/help
https://carytui.vu/caccc
https://mushxhb.best/info
https://genugsq.best/main
https://ulmudhw.shop/create
https://strikql.shop/owner
https://longmbx.click/manifest

Attributes

build_id
158c8d8911be33d61951b83d8fed45aa067228730b

Signatures

Family: Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpo6e_mb76.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5520	chrome.exe
2940	msedge.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134248060668461795"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{7DBA92B5-D537-4B98-901B-1AAB29EA0DA3}	msedge.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
5440	tmpo6e_mb76.exe
5440	tmpo6e_mb76.exe
5440	tmpo6e_mb76.exe
5440	tmpo6e_mb76.exe
1528	chrome.exe
1528	chrome.exe
5440	tmpo6e_mb76.exe
5440	tmpo6e_mb76.exe
5440	tmpo6e_mb76.exe
5440	tmpo6e_mb76.exe
5440	tmpo6e_mb76.exe
5440	tmpo6e_mb76.exe
5440	tmpo6e_mb76.exe
5440	tmpo6e_mb76.exe
5440	tmpo6e_mb76.exe
5440	tmpo6e_mb76.exe
5440	tmpo6e_mb76.exe
5440	tmpo6e_mb76.exe
5440	tmpo6e_mb76.exe
5440	tmpo6e_mb76.exe
5440	tmpo6e_mb76.exe
5440	tmpo6e_mb76.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1528	chrome.exe
1528	chrome.exe
1528	chrome.exe
612	msedge.exe
612	msedge.exe

Suspicious use of AdjustPrivilegeToken 16 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1528	chrome.exe
Token: SeCreatePagefilePrivilege	1528	chrome.exe
Token: SeShutdownPrivilege	1528	chrome.exe
Token: SeCreatePagefilePrivilege	1528	chrome.exe
Token: SeShutdownPrivilege	1528	chrome.exe
Token: SeCreatePagefilePrivilege	1528	chrome.exe
Token: SeShutdownPrivilege	1528	chrome.exe
Token: SeCreatePagefilePrivilege	1528	chrome.exe
Token: SeShutdownPrivilege	1528	chrome.exe
Token: SeCreatePagefilePrivilege	1528	chrome.exe
Token: SeShutdownPrivilege	1528	chrome.exe
Token: SeCreatePagefilePrivilege	1528	chrome.exe
Token: SeShutdownPrivilege	1528	chrome.exe
Token: SeCreatePagefilePrivilege	1528	chrome.exe
Token: SeShutdownPrivilege	1528	chrome.exe
Token: SeCreatePagefilePrivilege	1528	chrome.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
1528	chrome.exe
1528	chrome.exe
1528	chrome.exe
1528	chrome.exe
1528	chrome.exe
1528	chrome.exe
1528	chrome.exe
1528	chrome.exe
1528	chrome.exe
1528	chrome.exe
1528	chrome.exe
1528	chrome.exe
1528	chrome.exe
1528	chrome.exe
1528	chrome.exe
1528	chrome.exe
1528	chrome.exe
1528	chrome.exe
1528	chrome.exe
1528	chrome.exe
1528	chrome.exe
1528	chrome.exe
1528	chrome.exe
1528	chrome.exe
1528	chrome.exe
1528	chrome.exe
1528	chrome.exe
1528	chrome.exe
1528	chrome.exe
1528	chrome.exe
1528	chrome.exe
1528	chrome.exe
1528	chrome.exe
1528	chrome.exe
612	msedge.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 5440 wrote to memory of 1528	5440	tmpo6e_mb76.exe	89
PID 1528 wrote to memory of 1432	1528	chrome.exe	90
PID 1528 wrote to memory of 2808	1528	chrome.exe	92
PID 1528 wrote to memory of 2808	1528	chrome.exe	92
PID 1528 wrote to memory of 5520	1528	chrome.exe	93
PID 1528 wrote to memory of 4908	1528	chrome.exe	94
PID 1528 wrote to memory of 4908	1528	chrome.exe	94
PID 1528 wrote to memory of 1100	1528	chrome.exe	96
PID 1528 wrote to memory of 3228	1528	chrome.exe	97
PID 1528 wrote to memory of 1100	1528	chrome.exe	96
PID 1528 wrote to memory of 3228	1528	chrome.exe	97
PID 1528 wrote to memory of 5772	1528	chrome.exe	98
PID 1528 wrote to memory of 5772	1528	chrome.exe	98
PID 1528 wrote to memory of 3236	1528	chrome.exe	99
PID 5440 wrote to memory of 612	5440	tmpo6e_mb76.exe	114
PID 612 wrote to memory of 5352	612	msedge.exe	115
PID 612 wrote to memory of 4656	612	msedge.exe	117
PID 612 wrote to memory of 2940	612	msedge.exe	116
PID 612 wrote to memory of 4656	612	msedge.exe	117
PID 612 wrote to memory of 4656	612	msedge.exe	117
PID 612 wrote to memory of 4308	612	msedge.exe	118
PID 612 wrote to memory of 4308	612	msedge.exe	118
PID 612 wrote to memory of 5612	612	msedge.exe	119
PID 612 wrote to memory of 3312	612	msedge.exe	120
PID 612 wrote to memory of 5612	612	msedge.exe	119
PID 612 wrote to memory of 5612	612	msedge.exe	119
PID 612 wrote to memory of 3312	612	msedge.exe	120
PID 612 wrote to memory of 3312	612	msedge.exe	120
PID 612 wrote to memory of 740	612	msedge.exe	124
PID 612 wrote to memory of 5932	612	msedge.exe	125
PID 612 wrote to memory of 740	612	msedge.exe	124
PID 612 wrote to memory of 5932	612	msedge.exe	125
PID 612 wrote to memory of 5108	612	msedge.exe	127

C:\Users\Admin\AppData\Local\Temp\tmpo6e_mb76.exe
"C:\Users\Admin\AppData\Local\Temp\tmpo6e_mb76.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" diospfj.cyou/api/set_agent?id=CE2A5BD5BD24956701AEC7B30ADF174C&token=158c8d8911be33d61951b83d8fed45aa067228730b&description=&agent=Chrome
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1528
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffdcaffc728,0x7ffdcaffc734,0x7ffdcaffc740
    3⤵
    PID:1432
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1688,i,14831957031047490861,11734455893637181047,262144 --field-trial-handle=1948,i,9046817700822257720,7997700779660233491,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1944 /prefetch:2
    3⤵
    PID:2808
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2248,i,14140334919686135635,11424197431108420005,524288 --field-trial-handle=1948,i,9046817700822257720,7997700779660233491,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2244 /prefetch:3
    3⤵
    - System Time Discovery
    PID:5520
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2372,i,10072270894566815951,13894650090004104531,524288 --field-trial-handle=1948,i,9046817700822257720,7997700779660233491,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2532 /prefetch:8
    3⤵
    PID:4908
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3108,i,8850421432836168469,7344454188653216314,2097152 --field-trial-handle=1948,i,9046817700822257720,7997700779660233491,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3144 /prefetch:1
    3⤵
    PID:1100
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3124,i,17932047310508939222,8403259324930920768,2097152 --field-trial-handle=1948,i,9046817700822257720,7997700779660233491,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3164 /prefetch:1
    3⤵
    PID:3228
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4228,i,6248475196038139918,14749302733582792808,2097152 --field-trial-handle=1948,i,9046817700822257720,7997700779660233491,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4236 /prefetch:2
    3⤵
    PID:5772
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5272,i,5313343279520862965,5266712934986663836,524288 --field-trial-handle=1948,i,9046817700822257720,7997700779660233491,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5196 /prefetch:8
    3⤵
    PID:3236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" diospfj.cyou/api/set_agent?id=CE2A5BD5BD24956701AEC7B30ADF174C&token=158c8d8911be33d61951b83d8fed45aa067228730b&description=&agent=Edge
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:612
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x340,0x7ffdc857c188,0x7ffdc857c194,0x7ffdc857c1a0
    3⤵
    PID:5352
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1904,i,1146485777049858641,14281252429207756245,524288 --field-trial-handle=2312,i,12365448654666853127,17872733521633552892,262144 --variations-seed-version --mojo-platform-channel-handle=2348 /prefetch:3
    3⤵
    - System Time Discovery
    PID:2940
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1796,i,7015207659599138924,492532781087154148,262144 --field-trial-handle=2312,i,12365448654666853127,17872733521633552892,262144 --variations-seed-version --mojo-platform-channel-handle=2308 /prefetch:2
    3⤵
    PID:4656
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2588,i,5983161547468107001,17304822814607725369,524288 --field-trial-handle=2312,i,12365448654666853127,17872733521633552892,262144 --variations-seed-version --mojo-platform-channel-handle=2756 /prefetch:8
    3⤵
    PID:4308
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3456,i,9421517754028023072,4791059481883285376,2097152 --field-trial-handle=2312,i,12365448654666853127,17872733521633552892,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
    3⤵
    PID:5612
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3460,i,4314202189500004958,16629436849484436347,2097152 --field-trial-handle=2312,i,12365448654666853127,17872733521633552892,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
    3⤵
    PID:3312
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4880,i,12347275150576906584,7116854586254336227,524288 --field-trial-handle=2312,i,12365448654666853127,17872733521633552892,262144 --variations-seed-version --mojo-platform-channel-handle=4940 /prefetch:8
    3⤵
    PID:740
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4892,i,10880413691074112136,6350039741137372773,524288 --field-trial-handle=2312,i,12365448654666853127,17872733521633552892,262144 --variations-seed-version --mojo-platform-channel-handle=4956 /prefetch:8
    3⤵
    PID:5932
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5736,i,999162302777729484,1908941948054689956,524288 --field-trial-handle=2312,i,12365448654666853127,17872733521633552892,262144 --variations-seed-version --mojo-platform-channel-handle=5752 /prefetch:8
    3⤵
    PID:5152
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5736,i,999162302777729484,1908941948054689956,524288 --field-trial-handle=2312,i,12365448654666853127,17872733521633552892,262144 --variations-seed-version --mojo-platform-channel-handle=5752 /prefetch:8
    3⤵
    PID:5108

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:6032

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5148

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:368

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1364

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 4555ce8b6231c998e3a03eafaa0a2dc27412da9f0f06e1d6cfe9a25c07721296
MD5 40e3f3e9a06883554651f9ad2fb676ee
SHA1 54cbbd89094c2e31bf3d942fc0b2cdc5bb30a04e
SHA512 67ecf184b802fc0704b88a44dae04f5f5adaf36ce4d8922627b6135670ddf9617564aa9a8cc47daca3c5612e4911d84db5714795f69daafdcfce65fb0ed87644
TLSH
T1E1F044AACA21EC3718FC1B2970510B0AF750135B3B90888B3B3C9A0C4FB523B864681C
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data
Size 138KB
SHA256 cd0d39d3be77cb2f05d9c489ec8a9aff26f2846815b197ae4397845fa12f2af4
MD5 a77c700f737cedae5e03fc1bca064868
SHA1 15fc11241c19edd9bf7a760fe324300ee365e194
SHA512 57239c356d89f72f3b48f493e4a84ffb2685236308fe67f9942a959962ea2160d02780a44b2ca5a434c20233bf50ff2d50b55d786a7e1fd3069e89996b72c55c
SSDEEP 192:tB+XuvBnl3JsueMEGvIW1/rcP2OlDpX6Pq+UVumLvmwkc:jeuvBnhJsueMEGvIW1DcP2OjnVumqnc
TLSH
T1D1D3874B3A743002EDE59A722CE050BB5E3CB16D4F55A5D428B620688EF2953B23D4FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Version
Size 13B
SHA256 e5efa9eb104cd0b25149c2e789bec8d9aa4ba95678831b657eef7780a281c391
MD5 43ef949d3c6e9956545979ace65d0085
SHA1 63f2b2de8727854597e49a1216e8e74c68117c07
SHA512 313a5ab7ac9b5efd955beba4615784bdc2a9058ddaa804d85fb2d0c651dd3de07e382d61a1bb482499520a80e0b64c004ff2af03459cbc1daef47f540f0a6905
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 08cf8b208ccc5091d476a7eadb0658682fae51dfaaa542d8021cb7f1f70f2128
MD5 91d2ec211454ae3ae0c425a7cfc11260
SHA1 fe56be417e5cb7024f0e53450524dbbd3c847743
SHA512 77ebc9f2bd0c4e8c374af46c050385ae1e22de898c16212189ab4d515b2b61cbcbeeca72730dd400a7efa5982cb26bff6e557a508acbc070958b7ee9c46d64f7
SSDEEP 3072:KGm7D5Lk17ox1tIpud63U8BehbCBi9fTrM3:Nm7Rkm1tYpBeh2BAo3
TLSH
T185C3122B5E71A9375D79BB4EB08E0B1F1EF14AA6C930DE92C8D85B0437E97CC1A05934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9300dc4b11c647d4484e20f994dffbbd9939379d590fc7dedf9875372c431ce1
MD5 b031933009b03b3dcfc6f363760f83dd
SHA1 a9d3126d19c73dafd7e12a688bb3a802627790ee
SHA512 f606a12a9a0879bb3f7d6c9bcb6e3754434b9f0d8f1d351e8104aef087c326f689af5174eddcb6a3cd1f1d07864ff544fc76e73f8b76bf6d4330e19666cb7b28
TLSH
T18FD012BA2A4E7010F26D4A31B416CB00776D15A12852A705E22D944C99A90A562C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8da58a9b03c676d64167caf3657c5315a0b78038e3ae23bfef432a40d8d22290
MD5 81f1d957977f2d73471366011b7128bf
SHA1 c3403bfa34ee45b494966cf8be9bed08da2c5168
SHA512 171afd7f20b750bc0bdc1fc9fd4cf14984e63031e562c60a7b1bab3112c84572ebc63669b744e0e5399b2f5453039fb86937cf7ab417a72da7f1ad931c88f0c5
TLSH
T152D012B62A4A7010F2694A31B456CB00776D15A12852A705E26D945C99A90A566C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 51904b0417ef673e5ae1d25bd5d0d04b2616ba9515286f8e4477d9807982ca58
MD5 ee4fda864a67941b9bdce229f2fb29a1
SHA1 d5345d1e2bbc201eca02e9830b80089dc9eebfe7
SHA512 7a58b361a23b1c142084a4ebcd4b074e7bdb494f3497e55c6ac8d0a31c46a2fa26c23bb1dae40d3a3675df5317a615fdce3fd1d91e33afe3518ae67e147422fd
SSDEEP 96:Ko7iKcsW23iKoM7LKKc026WEKjKkAAK9Gq+xGKqkJ7yKkc++dmKWI94gK966GbGL:05ppxnY753RNBvRJJdt7p5J9DTth
TLSH
T195B26B5A703E0212397E2988B3A596364F4135A37058E4AF7FB814A54F27E225CFD8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 224KB
SHA256 49ac5539f6c1f8028b9f90e5b9f2059a628a9fd3c6ce8502588e512fcb320fdd
MD5 c469d4c36ab9af5575f08a4a76fe2831
SHA1 53e3c5235b91851ebc363e7ffb4909dd63d8ee4f
SHA512 2a6dc9860feb7534f623e86846d08c597a37dc5df94eb555a3eff99147973acb5e35657c1b8b681d6da74b798548d69f16671f33ac2b5c8031f065b4bfc9ea16
SSDEEP 192:P+xWsF5fT8w0QQnG2IMW1hPJubRd6vPtcdCewdbsc7V1VJ:mxTfQ9QQn7IMW1hPJuVd6vPkxW
TLSH
T18E24740A7B747001EDE6D9721CB080771A3CB16DCF22A6916DB654698DB3853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 292494131fbffbe952ce16220c2edd3e9808e25459585ce04f00d3f6ce85a248
MD5 05943474f554b299f29d230b28fe427a
SHA1 e900a2092297cf89d29ddbc86d54ec672aeebb07
SHA512 562d82e2b302afa167256b072c89cba508e8b170cd82b5262744d6f351c6638cd485aa0d3b8374b7364baaa26c059ab7655a3c2e07cf78504bac23ff2ace70cb
SSDEEP 384:npHiF9CcmyWCs3sN78TUNTUlIm2QckCr9laKphiftGUf7qEqvIM7p2le4KV8p0rs:pCFccps3ywgbkUYkoGs7qpwMmI8p0rs
TLSH
T146B26D36EC54DABBEDE64FC8B74A7A07DFE0512785DC5AD4DAD81E0C008719D130B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 29fff410a82d284d6c35951f17fa389f4f4baa2a823eff3b3aae2a0b4a0400ac
MD5 f23c5d9b9f718da2ab7a29ade5712c50
SHA1 812d802d5a33c93406d025ee6f5501752d999289
SHA512 a7a151642ba100583ce4c1b28ead6e81b8eac38b063850492fd858083c6329e4b776e7cdf73e6b69c3c84da08560cceb2da5904b6d27a06b48bd5301dc68f997
TLSH
T14C414A48AAF91148B3B76F166BF6A46E087ABD732F06D45E40010E8F0676B40C871737
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5440-53-0x0000000023F60000-0x0000000023F61000-memory.dmp

Download

memory/5440-49-0x0000000023F60000-0x0000000023F61000-memory.dmp

Download

memory/5440-42-0x0000000023F60000-0x0000000023F61000-memory.dmp

Download

memory/5440-41-0x0000000000400000-0x000000000045C000-memory.dmp

Download

memory/5440-40-0x0000000023F60000-0x0000000023F61000-memory.dmp

Download

memory/5440-39-0x0000000023F60000-0x0000000023F61000-memory.dmp

Download

memory/5440-38-0x0000000023F60000-0x0000000023F61000-memory.dmp

Download

memory/5440-37-0x0000000023F60000-0x0000000023F61000-memory.dmp

Download

memory/5440-44-0x0000000023F60000-0x0000000023F61000-memory.dmp

Download

memory/5440-45-0x0000000023F60000-0x0000000023F61000-memory.dmp

Download

memory/5440-48-0x0000000023F60000-0x0000000023F61000-memory.dmp

Download

memory/5440-43-0x0000000023F60000-0x0000000023F61000-memory.dmp

Download

memory/5440-50-0x0000000023F60000-0x0000000023F61000-memory.dmp

Download

memory/5440-51-0x0000000023F60000-0x0000000023F61000-memory.dmp

Download

memory/5440-52-0x0000000023F60000-0x0000000023F61000-memory.dmp

Download

memory/5440-0-0x0000000000400000-0x000000000045C000-memory.dmp

Download

memory/5440-54-0x0000000023F60000-0x0000000023F61000-memory.dmp

Download

memory/5440-55-0x0000000023F60000-0x0000000023F61000-memory.dmp

Download

memory/5440-47-0x0000000023F60000-0x0000000023F61000-memory.dmp

Download

memory/5440-46-0x0000000023F60000-0x0000000023F61000-memory.dmp

Download

memory/5440-232-0x0000000023DD0000-0x0000000023DD6000-memory.dmp

Download

memory/5440-231-0x0000000023DD0000-0x0000000023DD6000-memory.dmp

Download