lumma | hxxps://darknessonyx[.]com/ryos

Analysis

max time kernel
153s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
13-01-2025 01:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://darknessonyx.com/ryos

Score

10^/10

lumma discovery stealer

Malware Config

Extracted

Family

lumma

https://jubbenjusk.biz/api

Signatures

Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Lumma family
lumma

Executes dropped EXE 3 IoCs

pid	Process
1808	Collection.com
2536	Collection.com
844	Collection.com

Enumerates processes with tasklist 1 TTPs 6 IoCs

discovery

Process Discovery

T1057

pid	Process
2388	tasklist.exe
3712	tasklist.exe
4028	tasklist.exe
2196	tasklist.exe
4200	tasklist.exe
3932	tasklist.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Windows\WvEstablished	BootstrapperV2.exe
File opened for modification	C:\Windows\PublishedSs	BootstrapperV2.exe
File opened for modification	C:\Windows\MorganPass	BootstrapperV2.exe
File opened for modification	C:\Windows\CoinConverter	BootstrapperV2.exe
File opened for modification	C:\Windows\MorganPass	BootstrapperV2.exe
File opened for modification	C:\Windows\WvEstablished	BootstrapperV2.exe
File opened for modification	C:\Windows\CoinConverter	BootstrapperV2.exe
File opened for modification	C:\Windows\MorganPass	BootstrapperV2.exe
File opened for modification	C:\Windows\CoinConverter	BootstrapperV2.exe
File opened for modification	C:\Windows\WvEstablished	BootstrapperV2.exe
File opened for modification	C:\Windows\PublishedSs	BootstrapperV2.exe
File opened for modification	C:\Windows\PublishedSs	BootstrapperV2.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 37 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Collection.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BootstrapperV2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BootstrapperV2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	extrac32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Collection.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Collection.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	extrac32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	extrac32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BootstrapperV2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	msedge.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
4504	NOTEPAD.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
4440	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 30 IoCs

pid	Process
3140	msedge.exe
3140	msedge.exe
4228	msedge.exe
4228	msedge.exe
3728	identity_helper.exe
3728	identity_helper.exe
3820	msedge.exe
3820	msedge.exe
1808	Collection.com
1808	Collection.com
1808	Collection.com
1808	Collection.com
1808	Collection.com
1808	Collection.com
2536	Collection.com
2536	Collection.com
2536	Collection.com
2536	Collection.com
2536	Collection.com
2536	Collection.com
844	Collection.com
844	Collection.com
844	Collection.com
844	Collection.com
844	Collection.com
844	Collection.com
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	4028	tasklist.exe
Token: SeDebugPrivilege	2196	tasklist.exe
Token: SeDebugPrivilege	4200	tasklist.exe
Token: SeDebugPrivilege	3932	tasklist.exe
Token: SeDebugPrivilege	2388	tasklist.exe
Token: SeDebugPrivilege	3712	tasklist.exe

Suspicious use of FindShellTrayWindow 43 IoCs

pid	Process
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
1808	Collection.com
1808	Collection.com
1808	Collection.com
2536	Collection.com
2536	Collection.com
2536	Collection.com
844	Collection.com
844	Collection.com
844	Collection.com

Suspicious use of SendNotifyMessage 33 IoCs

pid	Process
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
1808	Collection.com
1808	Collection.com
1808	Collection.com
2536	Collection.com
2536	Collection.com
2536	Collection.com
844	Collection.com
844	Collection.com
844	Collection.com

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
4440	EXCEL.EXE
4440	EXCEL.EXE
4440	EXCEL.EXE
4440	EXCEL.EXE
4440	EXCEL.EXE
4440	EXCEL.EXE
4440	EXCEL.EXE
4440	EXCEL.EXE
4440	EXCEL.EXE
4440	EXCEL.EXE
4440	EXCEL.EXE
4440	EXCEL.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4228 wrote to memory of 520	4228	msedge.exe	82
PID 4228 wrote to memory of 520	4228	msedge.exe	82
PID 4228 wrote to memory of 3060	4228	msedge.exe	83
PID 4228 wrote to memory of 3060	4228	msedge.exe	83
PID 4228 wrote to memory of 3060	4228	msedge.exe	83
PID 4228 wrote to memory of 3060	4228	msedge.exe	83
PID 4228 wrote to memory of 3060	4228	msedge.exe	83
PID 4228 wrote to memory of 3060	4228	msedge.exe	83
PID 4228 wrote to memory of 3060	4228	msedge.exe	83
PID 4228 wrote to memory of 3060	4228	msedge.exe	83
PID 4228 wrote to memory of 3060	4228	msedge.exe	83
PID 4228 wrote to memory of 3060	4228	msedge.exe	83
PID 4228 wrote to memory of 3060	4228	msedge.exe	83
PID 4228 wrote to memory of 3060	4228	msedge.exe	83
PID 4228 wrote to memory of 3060	4228	msedge.exe	83
PID 4228 wrote to memory of 3060	4228	msedge.exe	83
PID 4228 wrote to memory of 3060	4228	msedge.exe	83
PID 4228 wrote to memory of 3060	4228	msedge.exe	83
PID 4228 wrote to memory of 3060	4228	msedge.exe	83
PID 4228 wrote to memory of 3060	4228	msedge.exe	83
PID 4228 wrote to memory of 3060	4228	msedge.exe	83
PID 4228 wrote to memory of 3060	4228	msedge.exe	83
PID 4228 wrote to memory of 3060	4228	msedge.exe	83
PID 4228 wrote to memory of 3060	4228	msedge.exe	83
PID 4228 wrote to memory of 3060	4228	msedge.exe	83
PID 4228 wrote to memory of 3060	4228	msedge.exe	83
PID 4228 wrote to memory of 3060	4228	msedge.exe	83
PID 4228 wrote to memory of 3060	4228	msedge.exe	83
PID 4228 wrote to memory of 3060	4228	msedge.exe	83
PID 4228 wrote to memory of 3060	4228	msedge.exe	83
PID 4228 wrote to memory of 3060	4228	msedge.exe	83
PID 4228 wrote to memory of 3060	4228	msedge.exe	83
PID 4228 wrote to memory of 3060	4228	msedge.exe	83
PID 4228 wrote to memory of 3060	4228	msedge.exe	83
PID 4228 wrote to memory of 3060	4228	msedge.exe	83
PID 4228 wrote to memory of 3060	4228	msedge.exe	83
PID 4228 wrote to memory of 3060	4228	msedge.exe	83
PID 4228 wrote to memory of 3060	4228	msedge.exe	83
PID 4228 wrote to memory of 3060	4228	msedge.exe	83
PID 4228 wrote to memory of 3060	4228	msedge.exe	83
PID 4228 wrote to memory of 3060	4228	msedge.exe	83
PID 4228 wrote to memory of 3060	4228	msedge.exe	83
PID 4228 wrote to memory of 3140	4228	msedge.exe	84
PID 4228 wrote to memory of 3140	4228	msedge.exe	84
PID 4228 wrote to memory of 1612	4228	msedge.exe	85
PID 4228 wrote to memory of 1612	4228	msedge.exe	85
PID 4228 wrote to memory of 1612	4228	msedge.exe	85
PID 4228 wrote to memory of 1612	4228	msedge.exe	85
PID 4228 wrote to memory of 1612	4228	msedge.exe	85
PID 4228 wrote to memory of 1612	4228	msedge.exe	85
PID 4228 wrote to memory of 1612	4228	msedge.exe	85
PID 4228 wrote to memory of 1612	4228	msedge.exe	85
PID 4228 wrote to memory of 1612	4228	msedge.exe	85
PID 4228 wrote to memory of 1612	4228	msedge.exe	85
PID 4228 wrote to memory of 1612	4228	msedge.exe	85
PID 4228 wrote to memory of 1612	4228	msedge.exe	85
PID 4228 wrote to memory of 1612	4228	msedge.exe	85
PID 4228 wrote to memory of 1612	4228	msedge.exe	85
PID 4228 wrote to memory of 1612	4228	msedge.exe	85
PID 4228 wrote to memory of 1612	4228	msedge.exe	85
PID 4228 wrote to memory of 1612	4228	msedge.exe	85
PID 4228 wrote to memory of 1612	4228	msedge.exe	85
PID 4228 wrote to memory of 1612	4228	msedge.exe	85
PID 4228 wrote to memory of 1612	4228	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://darknessonyx.com/ryos
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8d0cb46f8,0x7ff8d0cb4708,0x7ff8d0cb4718
  2⤵
  PID:520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,8060030743191708245,12803947964917766941,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
  2⤵
  PID:3060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,8060030743191708245,12803947964917766941,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,8060030743191708245,12803947964917766941,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2868 /prefetch:8
  2⤵
  PID:1612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,8060030743191708245,12803947964917766941,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:2912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,8060030743191708245,12803947964917766941,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:64
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,8060030743191708245,12803947964917766941,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4684 /prefetch:1
  2⤵
  PID:4932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,8060030743191708245,12803947964917766941,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5100 /prefetch:1
  2⤵
  PID:1388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,8060030743191708245,12803947964917766941,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4584 /prefetch:1
  2⤵
  PID:4216
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,8060030743191708245,12803947964917766941,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5040 /prefetch:8
  2⤵
  PID:1444
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,8060030743191708245,12803947964917766941,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5040 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,8060030743191708245,12803947964917766941,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5640 /prefetch:1
  2⤵
  PID:3148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,8060030743191708245,12803947964917766941,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6140 /prefetch:1
  2⤵
  PID:3352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2116,8060030743191708245,12803947964917766941,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5252 /prefetch:8
  2⤵
  PID:1068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,8060030743191708245,12803947964917766941,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5424 /prefetch:1
  2⤵
  PID:4952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2116,8060030743191708245,12803947964917766941,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5364 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,8060030743191708245,12803947964917766941,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6292 /prefetch:1
  2⤵
  PID:4140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,8060030743191708245,12803947964917766941,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6468 /prefetch:1
  2⤵
  PID:4984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,8060030743191708245,12803947964917766941,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2924 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4932

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:964

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3988

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3872

C:\Users\Admin\Downloads\0P3NME\BootstrapperV2.exe
"C:\Users\Admin\Downloads\0P3NME\BootstrapperV2.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4356
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c move Twist Twist.cmd & Twist.cmd
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3340
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4028
- - C:\Windows\SysWOW64\findstr.exe
    findstr /I "opssvc wrsa"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3280
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2196
- - C:\Windows\SysWOW64\findstr.exe
    findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3052
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c md 637575
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3116
- - C:\Windows\SysWOW64\extrac32.exe
    extrac32 /Y /E According
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1964
- - C:\Windows\SysWOW64\findstr.exe
    findstr /V "Corporation" Coastal
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1100
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c copy /b 637575\Collection.com + Innovation + Trinity + Walks + Cleveland + Followed + Britain + Told + Executed + Zinc 637575\Collection.com
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2372
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c copy /b ..\Campaigns + ..\App + ..\Minister + ..\Timeline + ..\Journalists + ..\Attachments + ..\Complement y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4752
- - C:\Users\Admin\AppData\Local\Temp\637575\Collection.com
    Collection.com y
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:1808
- - C:\Windows\SysWOW64\choice.exe
    choice /d y /t 5
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3116

C:\Users\Admin\Downloads\0P3NME\BootstrapperV2.exe
"C:\Users\Admin\Downloads\0P3NME\BootstrapperV2.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:636
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c move Twist Twist.cmd & Twist.cmd
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3780
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4200
- - C:\Windows\SysWOW64\findstr.exe
    findstr /I "opssvc wrsa"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1960
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3932
- - C:\Windows\SysWOW64\findstr.exe
    findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3424
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c md 637575
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4244
- - C:\Windows\SysWOW64\extrac32.exe
    extrac32 /Y /E According
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4212
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c copy /b 637575\Collection.com + Innovation + Trinity + Walks + Cleveland + Followed + Britain + Told + Executed + Zinc 637575\Collection.com
    3⤵
    - System Location Discovery: System Language Discovery
    PID:820
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c copy /b ..\Campaigns + ..\App + ..\Minister + ..\Timeline + ..\Journalists + ..\Attachments + ..\Complement y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3696
- - C:\Users\Admin\AppData\Local\Temp\637575\Collection.com
    Collection.com y
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:2536
- - C:\Windows\SysWOW64\choice.exe
    choice /d y /t 5
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2372

C:\Users\Admin\Downloads\0P3NME\BootstrapperV2.exe
"C:\Users\Admin\Downloads\0P3NME\BootstrapperV2.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4344
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c move Twist Twist.cmd & Twist.cmd
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3820
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2388
- - C:\Windows\SysWOW64\findstr.exe
    findstr /I "opssvc wrsa"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4856
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3712
- - C:\Windows\SysWOW64\findstr.exe
    findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1972
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c md 637575
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1960
- - C:\Windows\SysWOW64\extrac32.exe
    extrac32 /Y /E According
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3132
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c copy /b 637575\Collection.com + Innovation + Trinity + Walks + Cleveland + Followed + Britain + Told + Executed + Zinc 637575\Collection.com
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3172
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c copy /b ..\Campaigns + ..\App + ..\Minister + ..\Timeline + ..\Journalists + ..\Attachments + ..\Complement y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:316
- - C:\Users\Admin\AppData\Local\Temp\637575\Collection.com
    Collection.com y
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:844
- - C:\Windows\SysWOW64\choice.exe
    choice /d y /t 5
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4440

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\0P3NME\README.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:4504

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\Desktop\ExitAdd.xlsx"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4440

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
56a4f78e21616a6e19da57228569489b

SHA1
21bfabbfc294d5f2aa1da825c5590d760483bc76

SHA256
d036661e765ee8fd18978a2b5501e8df6b220e4bca531d9860407555294c96fb

SHA512
c2c3cd1152bb486028fe75ab3ce0d0bc9d64c4ca7eb8860ddd934b2f6e0140d2c913af4fa082b88e92a6a6d20fd483a1cb9813209f371a0f56374bc97d7f863b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e443ee4336fcf13c698b8ab5f3c173d0

SHA1
9bf70b16f03820cbe3158e1f1396b07b8ac9d75a

SHA256
79e277da2074f9467e0518f0f26ca2ba74914bee82553f935a0ccf64a0119e8b

SHA512
cbf6f6aa0ea69b47f51592296da2b7be1180e7b483c61b4d17ba9ee1a2d3345cbe0987b96f4e25de1438b553db358f330aad8a26e8522601f055c3d5a8313cdd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
744B

MD5
eb9b557c1de97ff6506b25683d9311ed

SHA1
e7b78f39f5a8a982e8a974081c9ea97a418ba2fa

SHA256
8b0da882bf167b161e7391a97eed20d8ed127d2edb7e408d2ca01baae25ffa22

SHA512
4f562abe151c3e393e48a8d6a82f4c64fe6a6fd34c5ab6569d3af11d4592d89091800be5033bbf076bb48f4c007b7b7090dd0f63a92b70ff5f13eac57f97559f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
a4f289011daa3c251df4709795292b13

SHA1
43be813f28dd0098818f760d2ad4bba53a6ffec8

SHA256
d4bd61e2f0557655b0188186a4402323427584c499a48045f958b6f5acd53dc0

SHA512
f664609f3768445e334ec70609ceb4b19825b6825cc226ee0a424e8a1fca55c13b1ff27ef8bff5e2457a91e738a98b342293e2efee91d7a5faab4ca246e7e5d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
e0ecbd9eff191dbf3825d250829fe92e

SHA1
9f4271ade7f402cd6eb7dbc22cd88633e4ce95a7

SHA256
41820bd553095113aa3f1fa0c547ab953877e7eb3d8aadf4b0061f3267881948

SHA512
8213c80c7a277e09af2634d3be745819c7906e0faa0ccbffbcebab7f214d6dde23940f411e7f432d79d9470b52ca27e4b726e9c0a8a09c5cba2a3e92c6c1daad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
035b5de5a6b932e7c2e1b8fb36dd0acb

SHA1
30778dfbc684f77f873372630d678617e0346672

SHA256
a58556c15b39426f0b1d5b237d4362d6e3147132c34995ba53e5bb4c6d60f441

SHA512
5f63ed3b975fcbcfc2124a11d529bcf8fd24a628c3df3139ed1c512af8f3c503adde4b9f888f14422bfec3731d35b36b5908090687532cac9708da3e5f8f52a0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
4c5a97b4a1b6c76a72c9167fd369e39b

SHA1
1eeb90d3d3c01b0509e9b4f31efe29414f0ee7a8

SHA256
4da1468de4dd98cb1664e555fcedde7c164c06dc2724c87b29ae6f4079bfea5e

SHA512
430979a58a90d2a6c9b1a5bbab161ca8e488975dafd983c6bed93d685a2b6d8eee8be2bad004699028ea53876d88fce1346f70ba1ea64018f2065d9eb97d7736

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
3f1e2c2a8269cbdd7292e68e0042dd2e

SHA1
f2576b4c27a751692c946e1e1fb179afc440532d

SHA256
f6f5c92d454c3ccda712d2c1b4f167687650b23a7b834a965bc307a9c0cc4064

SHA512
e286472b8c5fa8bc739044573ccc0051198ddda0749a73458b5b2f4a0191979582984a84b2c5b0368d7da2d691eec67b8c56472290057d7d7d186623d618ddeb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
59b7e3e83f82d2cde88387b28bc5a472

SHA1
3c21850ab1fb7755eddd7f48f879ac9d361c06de

SHA256
bcf83d01bacd91489a23ca0d281ad0a31349eafc18e9921121c7759c1e0c4286

SHA512
75e60b6f72cec5ffe690fcb4b843370ec2d94b86baf37c8f58126c682c8978af42ac7d91c26c93b8f4268af1f125b1039ed99acb963b8dde9d47d87320ccd5fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
d61e48925d876a81068bc4e233a01692

SHA1
2c568117b80efcc18171107d4a505debfc30ee80

SHA256
9419860391856aef5cb7cf2280354803678d0af4fecb52eee7d2095860e2a098

SHA512
e3f3949987a0aa82f18808d96bdbc6f4aac56b264a95bc32c29b3639113d88ff439a757a2e91adf1b408bfe5f6ac097b12b80a3d62689810acd05f1080aa4a42

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe580172.TMP

Filesize
1KB

MD5
c19b08c4dcec4f0e9d201f4dd90334a0

SHA1
c84b8473df754e3b487e1a02d7305892e87481c2

SHA256
e990065da569e207036556727626146d931ca9ec7673575cdea6865fa5f17e10

SHA512
45927c2797161da222293d2bf38b856d23424506637115491c13befc8a9680e9fa2236b0eb2036decebcf63745771573c5ee3257bc0e37e637ca18975971e88c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
cd09ab3b9b908aa996f438fa31ae24f4

SHA1
8d2a5fe98921495ea88981cebbc5429fd2d6d38f

SHA256
d2b748c70800d9e9016e247b6e744967ea26e581c838987c90794abb2fd0498d

SHA512
6b5c4dedeb6f7ef23b28419546cd56f291ba848b5d0d2b5d52e59e8964bac0cfb7d130d254fa0ba12bc1fe15e1e46f8641c89ced4af66bbfddd8caaaa1f54a60

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
cbf567ccd5b8790efd18f652d585a5cb

SHA1
826401d1ff92fdc496b1b1f460cd4b3000bd85a1

SHA256
1ce859d2f38a8b636d1d456a41c7dcd3d109dc323d38ddf9379aecd83ed768f7

SHA512
0b915deed1133cd8cc53cbcc13248b421a2d57e3e71ce7fa3872ef422ab792b35a7d76590ab2302aa7ad389c0e95688ce4db48aeb9f1a81dbda6890a8217cb3d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
01b63c96dca2d9a3784f5c80b9c51f46

SHA1
007c17d4671dcc46079f59142b6a21b520128660

SHA256
d41d79a67ea9de883bf3288a89fc994a37a96b334140145c8c17913c228ee010

SHA512
a23c05b4cdb32fa0c53af99991b790b2132c7a63ee154499e2b663636a7dee38bf8c9d7fae83c649a949502b6bf6d872a18096b5cce206f45c2c4e9025c7be73

Download Submit
C:\Users\Admin\AppData\Local\Temp\637575\Collection.com

Filesize
383B

MD5
ae367865f0be0758371b71120a86c6d1

SHA1
d4f37284dbf667bac9cc16f551f7cc573fd2f641

SHA256
39c02827133e674e5425ca11186ade42c493b4107694c0eaf2301d855b84686d

SHA512
4e17fd8c69926dd7712123826b71deae408ece5e033e4703bf75e39379f1b904ec7ce4d7e4370b94dad9e3428184f66b43028ff1179d201cb5399f816db105e1

Download Submit
C:\Users\Admin\AppData\Local\Temp\637575\Collection.com

Filesize
925KB

MD5
62d09f076e6e0240548c2f837536a46a

SHA1
26bdbc63af8abae9a8fb6ec0913a307ef6614cf2

SHA256
1300262a9d6bb6fcbefc0d299cce194435790e70b9c7b4a651e202e90a32fd49

SHA512
32de0d8bb57f3d3eb01d16950b07176866c7fb2e737d9811f61f7be6606a6a38a5fc5d4d2ae54a190636409b2a7943abca292d6cefaa89df1fc474a1312c695f

Download Submit
C:\Users\Admin\AppData\Local\Temp\637575\y

Filesize
473KB

MD5
509388799038828408168e8936c1006e

SHA1
3d64f0b9f7ef995f9dccbead2a5a633fbaebad67

SHA256
d1153d48c90ed43ea397d0502c8fb6963a8d47883bebf8d63d539c35465d755b

SHA512
6aa34ff63de9817e4b778511236554d8d18664dda67d76aba8fef6db69a267c5bb00eb8878ac7098bdc1828faab9d2a769a8af9ce268f622f3619df6fb912a21

Download Submit
C:\Users\Admin\AppData\Local\Temp\According

Filesize
477KB

MD5
c6da22e953f5d6e194c182ef9d398214

SHA1
05b020ab430337d34fcf010581bcf0a01658decf

SHA256
aad8f066433c5ddb5ce40ad640bf8d2ddc96abbc09eb1a8d815e1c59218144ce

SHA512
d51bd0bf6dc62baa9000dd6634292667d864044d8eed1d6680207496c493a9a5b17d98e4aa08027716932bd94b04b35b166c7d7ac7542b43d3184f70c5e962b1

Download Submit
C:\Users\Admin\AppData\Local\Temp\App

Filesize
69KB

MD5
30dfb5b3f6e74fbc6b8393854dffa8fc

SHA1
018c9219f53d44182b4a4565d4ea9515af53690e

SHA256
f2e5a15a9e755df57d44737ed14d6589a0e8293c4c205b2e1c922cc3cb8489bd

SHA512
54431bc6958eda2b45e633e7427886d5d447b99d0f0a24a5186fb7fe2fbc71c7f4df6246b224b3a7b71c396e440312f235f9ce643cf42522511a22d754b5f824

Download Submit
C:\Users\Admin\AppData\Local\Temp\Attachments

Filesize
73KB

MD5
4ddaaf7c1b3447594ea19331cec96e8c

SHA1
3989b67d528dc9ce5ed840daa5f5ff946f943b0c

SHA256
fe8c010b699cf73b4d828d3d86509ccf1d822bddda115de390eca8c59cf1b564

SHA512
befc9523812d616f07dda8862291b316694163b5ec43ac3be6a48c551778259ce48efbd42dcdcb50053643266b4cd2954db4a273d6e3ce6a7577f6eefd358201

Download Submit
C:\Users\Admin\AppData\Local\Temp\Attachments

Filesize
63KB

MD5
f0c2282cd753857f7bfe30853ca316e2

SHA1
48b9a19a5427cba72be0dadc3b86e716014d7471

SHA256
6092f129e0872acedb489b2cb27a2147d96105924b9a7a8f2de46ea4ec4b5975

SHA512
7bf28a89b801f12ffa275bb0747a45b148b997f8eafafe539c3ea93a72d9c64dfa76f1766339ffd1d04775110add315468f5fb247fce67af3e87760fcff843eb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Britain

Filesize
101KB

MD5
97f8c42016f1ff671e108ba556a185d3

SHA1
13d6ae5a3102fa4d6b1c4897f37a6c1b0e843cc5

SHA256
8e99918a8e44917b13546d33cdaa371e43f9ef8f0ee5d9fa17aa5b359606317b

SHA512
b787cab551c976eed623827e90d57659f0baac3fd36d09cb9a642068db475094ffdd6a73a308b3c5beab888666917235cb4163fd838444f8043c1f46e457fc6e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Campaigns

Filesize
67KB

MD5
98319c11c8c1cd78a529fadc5998020c

SHA1
a79a10708d3e11c73365aebf5c5ca00fa4a4f9a9

SHA256
b4a6242b27a6711e575fbd88b300c0086debdd962973ce82c5f8d273cbaf457a

SHA512
f9eb3c5776665d2e593b3bc754c4cbb641f2658cc80c33d937296c042c03989153bcda71bbaf6f4ba0004889138e79c24d035497d567cdd66bf6f0fb11798c15

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cleveland

Filesize
100KB

MD5
d1e90dff5e9e0afad50831e58de8aa9c

SHA1
31e4159a95a708b024cb9219aa600c61dedf8cc5

SHA256
c30264610f3e8f40381b984d0c9e74505e006f0fd284bd7b1fb695225f547d67

SHA512
661c0a7b17cae9a27f2ca2a71e153482bd20cc0bedde9c9a964fce61d66bb4c8a53c7723ab6db0d6894f0351448ecbe74806a3bc977adcd9cc3f8252764d6895

Download Submit
C:\Users\Admin\AppData\Local\Temp\Coastal

Filesize
394B

MD5
4083b97b69cdb6a691cb6bb78eac8170

SHA1
a53bd406f388ffc16fa9b11ed23e1f5c48e1145c

SHA256
c25a5c19747a6aaeb00e8a97800d630485a01867199e0ae7d10af6c5b409cebb

SHA512
f8c10aeb63fd7b8fe3ebe0db23505c1b518bfb54db569ffc25390e4f1502fdd8500e0d86fba4bbecda081aaa1eac488ba0d396c3fcb6aa1da1fee9df1a9a9698

Download Submit
C:\Users\Admin\AppData\Local\Temp\Complement

Filesize
27KB

MD5
d9896a432eae409d87fd0bd3407c9cb5

SHA1
b396ed85d3907d3e4edee98c9576c9a3873ad8ca

SHA256
b93e2ae91147e8a634e26bfe792ce7f93c48a89c6a674d9b746090fe7c1163e2

SHA512
e756f79cd46348c55df07c8fd2a4ccddd4dd1dae2fa8b846e461c8f5e1b9d207a1a98aac110c4d970c6f4ac0d97aa5eb97bb016f085cee3b17d38e0ad3723672

Download Submit
C:\Users\Admin\AppData\Local\Temp\Complement

Filesize
15KB

MD5
829e457622bc5fd84a9e22ae4ab3d7d4

SHA1
d33878b51ab29e10768696dcbfa530a3d0e904ca

SHA256
6928fb0f8dc101dc30d9a0d3fc26446a16e279d5a09d0497e8ed44122b8d90ce

SHA512
915794e52ae93b882c5188e7e6f3e146a8e0d3c6f8b9e962c12411d4ca3c20df0d388d037244871a91de0be83ec17e5a9cec2c4aabd4e85d3805166444f29371

Download Submit
C:\Users\Admin\AppData\Local\Temp\Executed

Filesize
82KB

MD5
f608b9cbea2cac45955ada1b58ddae70

SHA1
6f13fc21cd80c3145bf9dbc8a062f4a2e8d2d04d

SHA256
25915c752cf9504a08245ea20e9a7bfa8094bf725a7bf60f527ef9f13549148f

SHA512
f0daac5912ba8177ac19ab7b06a3f2a208289a8976448435b188205905aeddf12f3b5ee8ce35f283a685b849ad4d357868c044144f4eb5cee2dbdc78a26273e7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Followed

Filesize
134KB

MD5
29934db735f8f100d167a2b004a3d1e2

SHA1
8821e1ee70e4aa54505a1ae980898d6aad6d6dae

SHA256
f1a0e5e38e828d53c23d6dd2a557ee91b5d0cc3afb04eeadea9ea55bec42455c

SHA512
bd9baf1fbecec4a7fbd32f86fe4c90b8bb95dc65b943f5c84fbc043f4f04733be23bd36c9969ad68d8e89d65f6c70f47b672b86765e83e4138885a66542aa1c0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Innovation

Filesize
137KB

MD5
3c3988fa795265441ad9390d4ee171a6

SHA1
ca5cbcb893fb7b0dc82e09d2a5b41d0c933bcaac

SHA256
00c97189910776c057ca5b15fbc90c1a9afc168592df9fb1b472cda863df6a70

SHA512
784f11254633f2201423f7b3e89b300bf0b7a6fc057792f089b5a89b71b61ac209e0380d5f6e0d180b7e0156b72372f3481b0c37beb73fd7697aeb5f6a574c8c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Journalists

Filesize
87KB

MD5
c9fec4408155f6006827eba35af1f384

SHA1
73d30e220475271881c71911cb283ad24bf26363

SHA256
fb679686cc2f1c6f4e8ebfc53402567efaa2e2a82cb0efed8966f50db80d9644

SHA512
46bbcd49292d2a56a644d2b15deb4c907ca2112b118df2eacc4df168285ea4eb72343aabe2e72db0a7fe0d354623e6dad6431770431fd67d5c47b2f50e3767dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Minister

Filesize
91KB

MD5
ff290a5754c961c72f2f625a900fa12b

SHA1
b2545c332bf50e20ece97cc99e6f9b7ec808b48e

SHA256
7f2ff05067b45bf807b79f9ce0015891b43e95c528824345e69ec378c27c9013

SHA512
a03b2ec0c2476982b6f990a4463d3e9ad50caae66ef811cce832a4efda2403d6be5dcf26b5bba4d32420aff642b924a91086331cb6e1f3cea659b8026ea76c1e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Timeline

Filesize
59KB

MD5
b865fc7d2fa5620441067d180b445037

SHA1
2b73153e445d233a21c43d55694947cfcbfa2b04

SHA256
c8e76d4e23dc79939ea46fb4a88409458d78fa05cb86420f57d41132dba1b33f

SHA512
53d44273255b6c7e377b3d7ba5f64283bfd3d4fbf2db90997de5740d3704ce4ffe27cfa6494c0ebc62036f9770b8ca8b23a3bd086b74e322bcc38c9bf9627539

Download Submit
C:\Users\Admin\AppData\Local\Temp\Told

Filesize
109KB

MD5
acd623793bacd5cc52a489f80cad0309

SHA1
d18e0976805d510c368521c62e70a56d56e623e0

SHA256
8015a23ab93c815d7a215cc412974b09f1315062848a66582c9f311609d62b97

SHA512
19dde7ba632334a450bacd8f63b2ab310406881a9e2db202eb1dc76671dff52bf4f228cf19d1a952a41390c6bbc169b790cb1b017a648c454b3fa7d2774430b2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Trinity

Filesize
120KB

MD5
a34fec3e5094608cfae0d656d0f67a99

SHA1
eaf36199a41e3ca14295e00c27730a7551ce7662

SHA256
9f38e5a64b0de0826b1139b20f703412e49d9184cb1056b318a2ab9877922185

SHA512
899f93ce7f8d4e3e3dabae7cdc45f6f79ba64621e9e2997b4db2acd55438ccb675b181d9a467fd81984c4a42bde3bfb1b6370ffeda8b38e528107f0e0bb359e8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Twist

Filesize
20KB

MD5
de3bf90712e3dfb0e23bda22153b0fdd

SHA1
34be286fbb26b021f5fd8cf2594c6a5e87d2a507

SHA256
1a323e91936ee0dd4d48dbbf8231f84c34b0fdb4dc310d1495736b986852501d

SHA512
24880e1394650cc878a50d744bc240c8c27fc5b21f12c43ab53090b459be8acdf532acf8eebba24b1e79ce367884651add527f1b62c8ab6cf12eb5bf6b91d46b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Walks

Filesize
79KB

MD5
751e192a63079f6a7bcab8899f0265d6

SHA1
970b793e09161bde610b2b084dca98cede20aaf9

SHA256
a2b91e0e35acf3ea5273c148699ee29b8f1a03a3f1481aa183125ab8ee1aac27

SHA512
13a57ec35e1acef2f8da2ae611c7cec176fbdac3367dfb60f7ae8cff61d834d220eaf8047eefbd5243daa29dec384381cc572701493aab602c64d32dfc8f704d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Zinc

Filesize
62KB

MD5
d301984e153779482174711095453c4d

SHA1
4ba42b2a34f0c2d46e85706cbd1b442c65869962

SHA256
b9da2398a39e17358eb02b823799cab55c33504584224ee29fe29a409ee66ca5

SHA512
2e628a7864056eb316b56d8a78f84968d7d6c774913c657d312bd0d2e1d0275dd2667d1cbe7121b988118c3e9a0cdf090802a1fcae919f4e7ded7e5bfac668a6

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat

Filesize
264B

MD5
2558dbc69acc6b1b3ac2ab93e7ce343d

SHA1
39451e6d77f3c42ac194eaeb8b84bab360bf4045

SHA256
e59924aebd3baf97cde6c7e5c90099b829a49a0a186fafa0f2b682563c197dcc

SHA512
c3728a091dfb01545a1d608fb5826dc8c65bda4a677339cf601a634b5f8303628a4c1ef7e23b063b73173bb68d442779eabbe185c2e1e7ac08ed960a1429912d

Download Submit
C:\Users\Admin\Downloads\0P3NME.zip

Filesize
1.5MB

MD5
777f43112f44c0b8868f2a6de75140ef

SHA1
97cde13751c61b0c2be09119c821b8a00d398141

SHA256
c219fe6b87a36c8a3ecff7483d4bbed7a3f6a9fbd3a06eaa69ce143288267210

SHA512
5d40dc30860ed2b2c575278057b3bd29835ce40f342d77a35eb302daa8dac8b8b1dbc7a8de6a03a11fb4795ac36f503b1bfebdf00ff688a6dd0ab1b136abe8aa

Download Submit
memory/1808-435-0x0000000003C30000-0x0000000003C88000-memory.dmp

Filesize
352KB

Download
memory/1808-437-0x0000000003C30000-0x0000000003C88000-memory.dmp

Filesize
352KB

Download
memory/1808-436-0x0000000003C30000-0x0000000003C88000-memory.dmp

Filesize
352KB

Download
memory/1808-434-0x0000000003C30000-0x0000000003C88000-memory.dmp

Filesize
352KB

Download
memory/1808-433-0x0000000003C30000-0x0000000003C88000-memory.dmp

Filesize
352KB

Download
memory/4440-503-0x00007FF89F430000-0x00007FF89F440000-memory.dmp

Filesize
64KB

Download
memory/4440-501-0x00007FF89F430000-0x00007FF89F440000-memory.dmp

Filesize
64KB

Download
memory/4440-502-0x00007FF89F430000-0x00007FF89F440000-memory.dmp

Filesize
64KB

Download
memory/4440-504-0x00007FF89F430000-0x00007FF89F440000-memory.dmp

Filesize
64KB

Download
memory/4440-505-0x00007FF89CEB0000-0x00007FF89CEC0000-memory.dmp

Filesize
64KB

Download
memory/4440-506-0x00007FF89CEB0000-0x00007FF89CEC0000-memory.dmp

Filesize
64KB

Download
memory/4440-500-0x00007FF89F430000-0x00007FF89F440000-memory.dmp

Filesize
64KB

Download
memory/4440-542-0x00007FF89F430000-0x00007FF89F440000-memory.dmp

Filesize
64KB

Download
memory/4440-543-0x00007FF89F430000-0x00007FF89F440000-memory.dmp

Filesize
64KB

Download
memory/4440-545-0x00007FF89F430000-0x00007FF89F440000-memory.dmp

Filesize
64KB

Download
memory/4440-544-0x00007FF89F430000-0x00007FF89F440000-memory.dmp

Filesize
64KB

Download