lumma | hxxps://ryosw[.]ws/

Resubmissions

13-01-2025 02:57

250113-dfkjzssncv 10

13-01-2025 02:49

250113-dbfegasldw 10

Analysis

max time kernel
135s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
13-01-2025 02:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://ryosw.ws/

Score

10^/10

lumma discovery stealer

Malware Config

Extracted

Family

lumma

https://jubbenjusk.biz/api

Signatures

Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Lumma family
lumma

Executes dropped EXE 2 IoCs

pid	Process
2404	Collection.com
1312	Collection.com

Enumerates processes with tasklist 1 TTPs 4 IoCs

discovery

Process Discovery

T1057

pid	Process
2892	tasklist.exe
624	tasklist.exe
5040	tasklist.exe
4192	tasklist.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\WvEstablished	BootstrapperV2.exe
File opened for modification	C:\Windows\PublishedSs	BootstrapperV2.exe
File opened for modification	C:\Windows\CoinConverter	BootstrapperV2.exe
File opened for modification	C:\Windows\MorganPass	BootstrapperV2.exe
File opened for modification	C:\Windows\WvEstablished	BootstrapperV2.exe
File opened for modification	C:\Windows\PublishedSs	BootstrapperV2.exe
File opened for modification	C:\Windows\CoinConverter	BootstrapperV2.exe
File opened for modification	C:\Windows\MorganPass	BootstrapperV2.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 26 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Collection.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Collection.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BootstrapperV2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BootstrapperV2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	extrac32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	extrac32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings	msedge.exe

Opens file in notepad (likely ransom note) 3 IoCs

ransomware

pid	Process
4988	NOTEPAD.EXE
4008	NOTEPAD.EXE
3032	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
3128	msedge.exe
3128	msedge.exe
1080	msedge.exe
1080	msedge.exe
2792	identity_helper.exe
2792	identity_helper.exe
1420	msedge.exe
1420	msedge.exe
2404	Collection.com
2404	Collection.com
2404	Collection.com
2404	Collection.com
2404	Collection.com
2404	Collection.com
1312	Collection.com
1312	Collection.com
1312	Collection.com
1312	Collection.com
1312	Collection.com
1312	Collection.com
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2892	tasklist.exe
Token: SeDebugPrivilege	624	tasklist.exe
Token: SeDebugPrivilege	5040	tasklist.exe
Token: SeDebugPrivilege	4192	tasklist.exe

Suspicious use of FindShellTrayWindow 40 IoCs

pid	Process
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
2404	Collection.com
2404	Collection.com
2404	Collection.com
1312	Collection.com
1312	Collection.com
1312	Collection.com

Suspicious use of SendNotifyMessage 30 IoCs

pid	Process
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
2404	Collection.com
2404	Collection.com
2404	Collection.com
1312	Collection.com
1312	Collection.com
1312	Collection.com

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1080 wrote to memory of 4944	1080	msedge.exe	83
PID 1080 wrote to memory of 4944	1080	msedge.exe	83
PID 1080 wrote to memory of 1580	1080	msedge.exe	84
PID 1080 wrote to memory of 1580	1080	msedge.exe	84
PID 1080 wrote to memory of 1580	1080	msedge.exe	84
PID 1080 wrote to memory of 1580	1080	msedge.exe	84
PID 1080 wrote to memory of 1580	1080	msedge.exe	84
PID 1080 wrote to memory of 1580	1080	msedge.exe	84
PID 1080 wrote to memory of 1580	1080	msedge.exe	84
PID 1080 wrote to memory of 1580	1080	msedge.exe	84
PID 1080 wrote to memory of 1580	1080	msedge.exe	84
PID 1080 wrote to memory of 1580	1080	msedge.exe	84
PID 1080 wrote to memory of 1580	1080	msedge.exe	84
PID 1080 wrote to memory of 1580	1080	msedge.exe	84
PID 1080 wrote to memory of 1580	1080	msedge.exe	84
PID 1080 wrote to memory of 1580	1080	msedge.exe	84
PID 1080 wrote to memory of 1580	1080	msedge.exe	84
PID 1080 wrote to memory of 1580	1080	msedge.exe	84
PID 1080 wrote to memory of 1580	1080	msedge.exe	84
PID 1080 wrote to memory of 1580	1080	msedge.exe	84
PID 1080 wrote to memory of 1580	1080	msedge.exe	84
PID 1080 wrote to memory of 1580	1080	msedge.exe	84
PID 1080 wrote to memory of 1580	1080	msedge.exe	84
PID 1080 wrote to memory of 1580	1080	msedge.exe	84
PID 1080 wrote to memory of 1580	1080	msedge.exe	84
PID 1080 wrote to memory of 1580	1080	msedge.exe	84
PID 1080 wrote to memory of 1580	1080	msedge.exe	84
PID 1080 wrote to memory of 1580	1080	msedge.exe	84
PID 1080 wrote to memory of 1580	1080	msedge.exe	84
PID 1080 wrote to memory of 1580	1080	msedge.exe	84
PID 1080 wrote to memory of 1580	1080	msedge.exe	84
PID 1080 wrote to memory of 1580	1080	msedge.exe	84
PID 1080 wrote to memory of 1580	1080	msedge.exe	84
PID 1080 wrote to memory of 1580	1080	msedge.exe	84
PID 1080 wrote to memory of 1580	1080	msedge.exe	84
PID 1080 wrote to memory of 1580	1080	msedge.exe	84
PID 1080 wrote to memory of 1580	1080	msedge.exe	84
PID 1080 wrote to memory of 1580	1080	msedge.exe	84
PID 1080 wrote to memory of 1580	1080	msedge.exe	84
PID 1080 wrote to memory of 1580	1080	msedge.exe	84
PID 1080 wrote to memory of 1580	1080	msedge.exe	84
PID 1080 wrote to memory of 1580	1080	msedge.exe	84
PID 1080 wrote to memory of 3128	1080	msedge.exe	85
PID 1080 wrote to memory of 3128	1080	msedge.exe	85
PID 1080 wrote to memory of 2908	1080	msedge.exe	86
PID 1080 wrote to memory of 2908	1080	msedge.exe	86
PID 1080 wrote to memory of 2908	1080	msedge.exe	86
PID 1080 wrote to memory of 2908	1080	msedge.exe	86
PID 1080 wrote to memory of 2908	1080	msedge.exe	86
PID 1080 wrote to memory of 2908	1080	msedge.exe	86
PID 1080 wrote to memory of 2908	1080	msedge.exe	86
PID 1080 wrote to memory of 2908	1080	msedge.exe	86
PID 1080 wrote to memory of 2908	1080	msedge.exe	86
PID 1080 wrote to memory of 2908	1080	msedge.exe	86
PID 1080 wrote to memory of 2908	1080	msedge.exe	86
PID 1080 wrote to memory of 2908	1080	msedge.exe	86
PID 1080 wrote to memory of 2908	1080	msedge.exe	86
PID 1080 wrote to memory of 2908	1080	msedge.exe	86
PID 1080 wrote to memory of 2908	1080	msedge.exe	86
PID 1080 wrote to memory of 2908	1080	msedge.exe	86
PID 1080 wrote to memory of 2908	1080	msedge.exe	86
PID 1080 wrote to memory of 2908	1080	msedge.exe	86
PID 1080 wrote to memory of 2908	1080	msedge.exe	86
PID 1080 wrote to memory of 2908	1080	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://ryosw.ws/
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff963ee46f8,0x7ff963ee4708,0x7ff963ee4718
  2⤵
  PID:4944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2200,13735863950108074523,4802343126260040192,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2216 /prefetch:2
  2⤵
  PID:1580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2200,13735863950108074523,4802343126260040192,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2288 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2200,13735863950108074523,4802343126260040192,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2920 /prefetch:8
  2⤵
  PID:2908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,13735863950108074523,4802343126260040192,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3408 /prefetch:1
  2⤵
  PID:1600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,13735863950108074523,4802343126260040192,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3420 /prefetch:1
  2⤵
  PID:3584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,13735863950108074523,4802343126260040192,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4108 /prefetch:1
  2⤵
  PID:2408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,13735863950108074523,4802343126260040192,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5812 /prefetch:1
  2⤵
  PID:1576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,13735863950108074523,4802343126260040192,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5736 /prefetch:1
  2⤵
  PID:4472
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2200,13735863950108074523,4802343126260040192,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4784 /prefetch:8
  2⤵
  PID:3040
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2200,13735863950108074523,4802343126260040192,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4784 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,13735863950108074523,4802343126260040192,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5372 /prefetch:1
  2⤵
  PID:3384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,13735863950108074523,4802343126260040192,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5364 /prefetch:1
  2⤵
  PID:3092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2200,13735863950108074523,4802343126260040192,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5728 /prefetch:8
  2⤵
  PID:3720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,13735863950108074523,4802343126260040192,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2176 /prefetch:1
  2⤵
  PID:4272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2200,13735863950108074523,4802343126260040192,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4152 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2200,13735863950108074523,4802343126260040192,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4932 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4080

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5084

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4460

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1576

C:\Users\Admin\AppData\Local\Temp\Temp1_0P3NME.zip\BootstrapperV2.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_0P3NME.zip\BootstrapperV2.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2696
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c move Twist Twist.cmd & Twist.cmd
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1576
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2892
- - C:\Windows\SysWOW64\findstr.exe
    findstr /I "opssvc wrsa"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1504
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:624
- - C:\Windows\SysWOW64\findstr.exe
    findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4320
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c md 637575
    3⤵
    - System Location Discovery: System Language Discovery
    PID:516
- - C:\Windows\SysWOW64\extrac32.exe
    extrac32 /Y /E According
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4472
- - C:\Windows\SysWOW64\findstr.exe
    findstr /V "Corporation" Coastal
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4748
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c copy /b 637575\Collection.com + Innovation + Trinity + Walks + Cleveland + Followed + Britain + Told + Executed + Zinc 637575\Collection.com
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1288
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c copy /b ..\Campaigns + ..\App + ..\Minister + ..\Timeline + ..\Journalists + ..\Attachments + ..\Complement y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1632
- - C:\Users\Admin\AppData\Local\Temp\637575\Collection.com
    Collection.com y
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:2404
- - C:\Windows\SysWOW64\choice.exe
    choice /d y /t 5
    3⤵
    - System Location Discovery: System Language Discovery
    PID:264

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Temp1_0P3NME.zip\README.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:3032

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\0P3NME\README.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:4988

C:\Users\Admin\Downloads\0P3NME\BootstrapperV2.exe
"C:\Users\Admin\Downloads\0P3NME\BootstrapperV2.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3948
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c move Twist Twist.cmd & Twist.cmd
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4576
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5040
- - C:\Windows\SysWOW64\findstr.exe
    findstr /I "opssvc wrsa"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3572
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4192
- - C:\Windows\SysWOW64\findstr.exe
    findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:472
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c md 637575
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2756
- - C:\Windows\SysWOW64\extrac32.exe
    extrac32 /Y /E According
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3164
- - C:\Windows\SysWOW64\findstr.exe
    findstr /V "Corporation" Coastal
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1184
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c copy /b 637575\Collection.com + Innovation + Trinity + Walks + Cleveland + Followed + Britain + Told + Executed + Zinc 637575\Collection.com
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4592
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c copy /b ..\Campaigns + ..\App + ..\Minister + ..\Timeline + ..\Journalists + ..\Attachments + ..\Complement y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2780
- - C:\Users\Admin\AppData\Local\Temp\637575\Collection.com
    Collection.com y
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:1312
- - C:\Windows\SysWOW64\choice.exe
    choice /d y /t 5
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1112

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\0P3NME\BootstrapperV2.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:4008

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
99afa4934d1e3c56bbce114b356e8a99

SHA1
3f0e7a1a28d9d9c06b6663df5d83a65c84d52581

SHA256
08e098bb97fd91d815469cdfd5568607a3feca61f18b6b5b9c11b531fde206c8

SHA512
76686f30ed68144cf943b80ac10b52c74eee84f197cee3c24ef7845ef44bdb5586b6e530824543deeed59417205ac0e2559808bcb46450504106ac8f4c95b9da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
443a627d539ca4eab732bad0cbe7332b

SHA1
86b18b906a1acd2a22f4b2c78ac3564c394a9569

SHA256
1e1ad9dce141f5f17ea07c7e9c2a65e707c9943f172b9134b0daf9eef25f0dc9

SHA512
923b86d75a565c91250110162ce13dd3ef3f6bdde1a83f7af235ed302d4a96b8c9ed722e2152781e699dfcb26bb98afc73f5adb298f8fd673f14c9f28b5f764d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\84475adf-d93d-4d41-9133-ae01141d8e7b.tmp

Filesize
5KB

MD5
afdb01784fc88d3de1fee89d4482dd0f

SHA1
f37c57066906923b6239e08f48d6ae692a7c2d7f

SHA256
5230fa011ebd10e150f4f94bb852e4785ddffed43750897202ecd6477e403857

SHA512
70ad06ba39134c7826dd18a1670cb2fb7433a2d0572b33d1807da2326781d943c8b14ba0347310992bbfb632ea66803279ae43bccd4e97f3156a8693d29840df

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
744B

MD5
fecf7b21de059bbf1bdf22a17f331199

SHA1
2d4f8baeab0767592d520e1d69509559688a82aa

SHA256
ea41f845d10a5751b4495ddfb15da17d1b94ee6eadb2f3a7bca51f7cdf3cc942

SHA512
46b50058c282a72fdab69da8717c6f6c6b57e9202bec87ad74736e4cc7ad2b37dcd55803460395e6e2595af4c41ad66582765064f9af92d84d51568ef5c2b4ec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
2dd66340e88963a2ebc4d3e434ebd035

SHA1
57cfe50aa7bbd1d0e12e3eca1063b81b3cc9fff1

SHA256
d3dad805f294dc6d71861dd5a3e87864ef684cd2ac6b125c5c8b41303250a85d

SHA512
e8ec9fb786f22744e5a17bd20112e90b547ce9972945f3f03c581cd37d166e35cdad885923f46912e4549df288bb2973f9595e07d1247665f4d533a43db17557

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
a246b37f2e772cf3c108d50c08b859a5

SHA1
568ddd32a54d9a9bf98bcdcb47ebaf18de585d7c

SHA256
59edef6b0881a26c007b53f99577bfada63fc054f5db26bbcde1bc1b2a9d7c1d

SHA512
ce4b08755a95bbebb3d7db1ed5d1454339b8cc87be7ae6e31a9839ef8bc11a5f0ab86cd7b6aadf13b706814df2809d8e48f2958627ea518c82d200503a9a87fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2de5e45c6ce105dac318e9bc89872ea8

SHA1
f0ce36108a3c57d052214c7a779e348bdfa2e92e

SHA256
1e8d060ab56e8cdecd6258131b4245f2c09536cc97310f1f7d0cc04c14261314

SHA512
7e8cbae2dce330daf20b5d9cfaf79e2cb302a797eb8ee8a6d98177989d54d4fb13d92a4873f21fc45d2c68d1dccc9a94cd8af6ff710e46d1e71f9dce598289a3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
20992210b9473f06d593d8be51d29ba0

SHA1
ae2ed1c7bc2d3aa62d6a290b6f03f04cae71b7f8

SHA256
384df70c3b077cec6bf3973d7ad2166760a23d694a370148645a6b072a7d1ca4

SHA512
6f8bdb8a5a53696ba8184c4652b663dcba846e639a61cf652944c57938e18bcbbf3f994e7ad84cbc2847d463cc84df45c45621bc222080f15f46b27de23256a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
32eba72cd9c6ddd056f6ca70e05307d6

SHA1
9069fcbdfb2e873bed1fd64d653be28572ea173c

SHA256
8d668638ca8d7b30950dadc57cbf65808a9c81b96a849ef25ff76e86c7029c11

SHA512
75a6df44d95e2dd1411455042c14475302eaaa20c7674419f2d428b1454d140cbf6fbe00d857e0f74e5b8d0f5bf7381e2bacffbc0157b481de8eb47c4d72b819

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57e9d3.TMP

Filesize
1KB

MD5
d3577bfbe392d4018ac7319387420e87

SHA1
c64aafeb347a3c12f9f383b9d1fa0dfe1e9369a7

SHA256
38c2557468e67149d44da2795581bc4cbbd4d54c0a64c806eb62dfc7a75bb3ee

SHA512
d3ace5502f544e8398e7d94cf2de55232013b8848d5af30d25c5cec3679d9c96df89ae91a991afaf12ed405b2601254820c092ac1f5f355593047703f0b5ddcb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
1068f3dbbf110bc13a87e252b0aa31e8

SHA1
58ac6b5ef1d3c5b96e66595538e3c62b784a6e4c

SHA256
9b87fa6e2eddbcd4a1f9353743f190357bad5be2e43f24b51ac2f95bcd291370

SHA512
0270a7cac3c269b33c74dcdc4b479a23d46074cd89c58f264b01cf277165d799000c7846e9822d9319b911e7090ddb91c4c92f405bab684d9d2a3a70455e96cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
5658852381e11df5c895ee72d302786b

SHA1
c1de39c8f98e8ae328d548afbdcda1daaef0a539

SHA256
d498861ad8fa9b9aae92134466061c7b6323e56e0a468f13d959e0215aedbfc0

SHA512
9467f8f16712a566a7b6eb64a9fbfcc405221603633fb5e55ce897796e739d42357999bb4ba3b93096f086af1f8ba87bec3f47fdf5cee5017344d0d917aa7046

Download Submit
C:\Users\Admin\AppData\Local\Temp\637575\Collection.com

Filesize
137KB

MD5
b2e461772da08c940f4e32f3be45f884

SHA1
337db3d528a4970f636c6442fc87c71a80bb5a91

SHA256
9ecbd9153d99b0b4f357901f391063440109a5a1c01911fc584bc469046d65fe

SHA512
802e92f42a865c967f5515c3bccdc97588e7a7884a42a80d829ce778e90689294aad6f106ba256e52786cd79d699513afc73088d277b3b5f7a6577a230a32597

Download Submit
C:\Users\Admin\AppData\Local\Temp\637575\Collection.com

Filesize
925KB

MD5
62d09f076e6e0240548c2f837536a46a

SHA1
26bdbc63af8abae9a8fb6ec0913a307ef6614cf2

SHA256
1300262a9d6bb6fcbefc0d299cce194435790e70b9c7b4a651e202e90a32fd49

SHA512
32de0d8bb57f3d3eb01d16950b07176866c7fb2e737d9811f61f7be6606a6a38a5fc5d4d2ae54a190636409b2a7943abca292d6cefaa89df1fc474a1312c695f

Download Submit
C:\Users\Admin\AppData\Local\Temp\637575\Collection.com

Filesize
383B

MD5
ae367865f0be0758371b71120a86c6d1

SHA1
d4f37284dbf667bac9cc16f551f7cc573fd2f641

SHA256
39c02827133e674e5425ca11186ade42c493b4107694c0eaf2301d855b84686d

SHA512
4e17fd8c69926dd7712123826b71deae408ece5e033e4703bf75e39379f1b904ec7ce4d7e4370b94dad9e3428184f66b43028ff1179d201cb5399f816db105e1

Download Submit
C:\Users\Admin\AppData\Local\Temp\637575\y

Filesize
473KB

MD5
509388799038828408168e8936c1006e

SHA1
3d64f0b9f7ef995f9dccbead2a5a633fbaebad67

SHA256
d1153d48c90ed43ea397d0502c8fb6963a8d47883bebf8d63d539c35465d755b

SHA512
6aa34ff63de9817e4b778511236554d8d18664dda67d76aba8fef6db69a267c5bb00eb8878ac7098bdc1828faab9d2a769a8af9ce268f622f3619df6fb912a21

Download Submit
C:\Users\Admin\AppData\Local\Temp\According

Filesize
477KB

MD5
c6da22e953f5d6e194c182ef9d398214

SHA1
05b020ab430337d34fcf010581bcf0a01658decf

SHA256
aad8f066433c5ddb5ce40ad640bf8d2ddc96abbc09eb1a8d815e1c59218144ce

SHA512
d51bd0bf6dc62baa9000dd6634292667d864044d8eed1d6680207496c493a9a5b17d98e4aa08027716932bd94b04b35b166c7d7ac7542b43d3184f70c5e962b1

Download Submit
C:\Users\Admin\AppData\Local\Temp\App

Filesize
69KB

MD5
30dfb5b3f6e74fbc6b8393854dffa8fc

SHA1
018c9219f53d44182b4a4565d4ea9515af53690e

SHA256
f2e5a15a9e755df57d44737ed14d6589a0e8293c4c205b2e1c922cc3cb8489bd

SHA512
54431bc6958eda2b45e633e7427886d5d447b99d0f0a24a5186fb7fe2fbc71c7f4df6246b224b3a7b71c396e440312f235f9ce643cf42522511a22d754b5f824

Download Submit
C:\Users\Admin\AppData\Local\Temp\Attachments

Filesize
73KB

MD5
4ddaaf7c1b3447594ea19331cec96e8c

SHA1
3989b67d528dc9ce5ed840daa5f5ff946f943b0c

SHA256
fe8c010b699cf73b4d828d3d86509ccf1d822bddda115de390eca8c59cf1b564

SHA512
befc9523812d616f07dda8862291b316694163b5ec43ac3be6a48c551778259ce48efbd42dcdcb50053643266b4cd2954db4a273d6e3ce6a7577f6eefd358201

Download Submit
C:\Users\Admin\AppData\Local\Temp\Britain

Filesize
101KB

MD5
97f8c42016f1ff671e108ba556a185d3

SHA1
13d6ae5a3102fa4d6b1c4897f37a6c1b0e843cc5

SHA256
8e99918a8e44917b13546d33cdaa371e43f9ef8f0ee5d9fa17aa5b359606317b

SHA512
b787cab551c976eed623827e90d57659f0baac3fd36d09cb9a642068db475094ffdd6a73a308b3c5beab888666917235cb4163fd838444f8043c1f46e457fc6e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Campaigns

Filesize
67KB

MD5
98319c11c8c1cd78a529fadc5998020c

SHA1
a79a10708d3e11c73365aebf5c5ca00fa4a4f9a9

SHA256
b4a6242b27a6711e575fbd88b300c0086debdd962973ce82c5f8d273cbaf457a

SHA512
f9eb3c5776665d2e593b3bc754c4cbb641f2658cc80c33d937296c042c03989153bcda71bbaf6f4ba0004889138e79c24d035497d567cdd66bf6f0fb11798c15

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cleveland

Filesize
100KB

MD5
d1e90dff5e9e0afad50831e58de8aa9c

SHA1
31e4159a95a708b024cb9219aa600c61dedf8cc5

SHA256
c30264610f3e8f40381b984d0c9e74505e006f0fd284bd7b1fb695225f547d67

SHA512
661c0a7b17cae9a27f2ca2a71e153482bd20cc0bedde9c9a964fce61d66bb4c8a53c7723ab6db0d6894f0351448ecbe74806a3bc977adcd9cc3f8252764d6895

Download Submit
C:\Users\Admin\AppData\Local\Temp\Coastal

Filesize
394B

MD5
4083b97b69cdb6a691cb6bb78eac8170

SHA1
a53bd406f388ffc16fa9b11ed23e1f5c48e1145c

SHA256
c25a5c19747a6aaeb00e8a97800d630485a01867199e0ae7d10af6c5b409cebb

SHA512
f8c10aeb63fd7b8fe3ebe0db23505c1b518bfb54db569ffc25390e4f1502fdd8500e0d86fba4bbecda081aaa1eac488ba0d396c3fcb6aa1da1fee9df1a9a9698

Download Submit
C:\Users\Admin\AppData\Local\Temp\Complement

Filesize
27KB

MD5
d9896a432eae409d87fd0bd3407c9cb5

SHA1
b396ed85d3907d3e4edee98c9576c9a3873ad8ca

SHA256
b93e2ae91147e8a634e26bfe792ce7f93c48a89c6a674d9b746090fe7c1163e2

SHA512
e756f79cd46348c55df07c8fd2a4ccddd4dd1dae2fa8b846e461c8f5e1b9d207a1a98aac110c4d970c6f4ac0d97aa5eb97bb016f085cee3b17d38e0ad3723672

Download Submit
C:\Users\Admin\AppData\Local\Temp\Executed

Filesize
82KB

MD5
f608b9cbea2cac45955ada1b58ddae70

SHA1
6f13fc21cd80c3145bf9dbc8a062f4a2e8d2d04d

SHA256
25915c752cf9504a08245ea20e9a7bfa8094bf725a7bf60f527ef9f13549148f

SHA512
f0daac5912ba8177ac19ab7b06a3f2a208289a8976448435b188205905aeddf12f3b5ee8ce35f283a685b849ad4d357868c044144f4eb5cee2dbdc78a26273e7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Followed

Filesize
134KB

MD5
29934db735f8f100d167a2b004a3d1e2

SHA1
8821e1ee70e4aa54505a1ae980898d6aad6d6dae

SHA256
f1a0e5e38e828d53c23d6dd2a557ee91b5d0cc3afb04eeadea9ea55bec42455c

SHA512
bd9baf1fbecec4a7fbd32f86fe4c90b8bb95dc65b943f5c84fbc043f4f04733be23bd36c9969ad68d8e89d65f6c70f47b672b86765e83e4138885a66542aa1c0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Innovation

Filesize
137KB

MD5
3c3988fa795265441ad9390d4ee171a6

SHA1
ca5cbcb893fb7b0dc82e09d2a5b41d0c933bcaac

SHA256
00c97189910776c057ca5b15fbc90c1a9afc168592df9fb1b472cda863df6a70

SHA512
784f11254633f2201423f7b3e89b300bf0b7a6fc057792f089b5a89b71b61ac209e0380d5f6e0d180b7e0156b72372f3481b0c37beb73fd7697aeb5f6a574c8c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Journalists

Filesize
87KB

MD5
c9fec4408155f6006827eba35af1f384

SHA1
73d30e220475271881c71911cb283ad24bf26363

SHA256
fb679686cc2f1c6f4e8ebfc53402567efaa2e2a82cb0efed8966f50db80d9644

SHA512
46bbcd49292d2a56a644d2b15deb4c907ca2112b118df2eacc4df168285ea4eb72343aabe2e72db0a7fe0d354623e6dad6431770431fd67d5c47b2f50e3767dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Minister

Filesize
91KB

MD5
ff290a5754c961c72f2f625a900fa12b

SHA1
b2545c332bf50e20ece97cc99e6f9b7ec808b48e

SHA256
7f2ff05067b45bf807b79f9ce0015891b43e95c528824345e69ec378c27c9013

SHA512
a03b2ec0c2476982b6f990a4463d3e9ad50caae66ef811cce832a4efda2403d6be5dcf26b5bba4d32420aff642b924a91086331cb6e1f3cea659b8026ea76c1e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Timeline

Filesize
59KB

MD5
b865fc7d2fa5620441067d180b445037

SHA1
2b73153e445d233a21c43d55694947cfcbfa2b04

SHA256
c8e76d4e23dc79939ea46fb4a88409458d78fa05cb86420f57d41132dba1b33f

SHA512
53d44273255b6c7e377b3d7ba5f64283bfd3d4fbf2db90997de5740d3704ce4ffe27cfa6494c0ebc62036f9770b8ca8b23a3bd086b74e322bcc38c9bf9627539

Download Submit
C:\Users\Admin\AppData\Local\Temp\Told

Filesize
109KB

MD5
acd623793bacd5cc52a489f80cad0309

SHA1
d18e0976805d510c368521c62e70a56d56e623e0

SHA256
8015a23ab93c815d7a215cc412974b09f1315062848a66582c9f311609d62b97

SHA512
19dde7ba632334a450bacd8f63b2ab310406881a9e2db202eb1dc76671dff52bf4f228cf19d1a952a41390c6bbc169b790cb1b017a648c454b3fa7d2774430b2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Trinity

Filesize
120KB

MD5
a34fec3e5094608cfae0d656d0f67a99

SHA1
eaf36199a41e3ca14295e00c27730a7551ce7662

SHA256
9f38e5a64b0de0826b1139b20f703412e49d9184cb1056b318a2ab9877922185

SHA512
899f93ce7f8d4e3e3dabae7cdc45f6f79ba64621e9e2997b4db2acd55438ccb675b181d9a467fd81984c4a42bde3bfb1b6370ffeda8b38e528107f0e0bb359e8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Twist

Filesize
20KB

MD5
de3bf90712e3dfb0e23bda22153b0fdd

SHA1
34be286fbb26b021f5fd8cf2594c6a5e87d2a507

SHA256
1a323e91936ee0dd4d48dbbf8231f84c34b0fdb4dc310d1495736b986852501d

SHA512
24880e1394650cc878a50d744bc240c8c27fc5b21f12c43ab53090b459be8acdf532acf8eebba24b1e79ce367884651add527f1b62c8ab6cf12eb5bf6b91d46b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Walks

Filesize
79KB

MD5
751e192a63079f6a7bcab8899f0265d6

SHA1
970b793e09161bde610b2b084dca98cede20aaf9

SHA256
a2b91e0e35acf3ea5273c148699ee29b8f1a03a3f1481aa183125ab8ee1aac27

SHA512
13a57ec35e1acef2f8da2ae611c7cec176fbdac3367dfb60f7ae8cff61d834d220eaf8047eefbd5243daa29dec384381cc572701493aab602c64d32dfc8f704d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Zinc

Filesize
62KB

MD5
d301984e153779482174711095453c4d

SHA1
4ba42b2a34f0c2d46e85706cbd1b442c65869962

SHA256
b9da2398a39e17358eb02b823799cab55c33504584224ee29fe29a409ee66ca5

SHA512
2e628a7864056eb316b56d8a78f84968d7d6c774913c657d312bd0d2e1d0275dd2667d1cbe7121b988118c3e9a0cdf090802a1fcae919f4e7ded7e5bfac668a6

Download Submit
C:\Users\Admin\Downloads\0P3NME.zip

Filesize
1.5MB

MD5
777f43112f44c0b8868f2a6de75140ef

SHA1
97cde13751c61b0c2be09119c821b8a00d398141

SHA256
c219fe6b87a36c8a3ecff7483d4bbed7a3f6a9fbd3a06eaa69ce143288267210

SHA512
5d40dc30860ed2b2c575278057b3bd29835ce40f342d77a35eb302daa8dac8b8b1dbc7a8de6a03a11fb4795ac36f503b1bfebdf00ff688a6dd0ab1b136abe8aa

Download Submit
memory/2404-336-0x0000000004200000-0x0000000004258000-memory.dmp

Filesize
352KB

Download
memory/2404-337-0x0000000004200000-0x0000000004258000-memory.dmp

Filesize
352KB

Download
memory/2404-338-0x0000000004200000-0x0000000004258000-memory.dmp

Filesize
352KB

Download
memory/2404-340-0x0000000004200000-0x0000000004258000-memory.dmp

Filesize
352KB

Download
memory/2404-339-0x0000000004200000-0x0000000004258000-memory.dmp

Filesize
352KB

Download