lumma | hxxps://facelessb[.]com

Analysis

max time kernel
110s
max time network
110s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
23-01-2025 21:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://facelessb.com

Score

10^/10

lumma discovery stealer

Malware Config

Extracted

Family

lumma

https://sheayingero.shop/api

https://toppyneedus.biz/api

https://suggestyuoz.biz/api

Signatures

Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Lumma family
lumma

Executes dropped EXE 2 IoCs

pid	Process
2872	Flows.com
2632	Flows.com

Enumerates processes with tasklist 1 TTPs 8 IoCs

discovery

Process Discovery

T1057

pid	Process
2768	tasklist.exe
3876	tasklist.exe
5012	tasklist.exe
4164	tasklist.exe
3796	tasklist.exe
3560	tasklist.exe
3480	tasklist.exe
860	tasklist.exe

Drops file in Windows directory 36 IoCs

description	ioc	Process
File opened for modification	C:\Windows\AlloyDj	Bootstrapper.exe
File opened for modification	C:\Windows\TablesThou	Bootstrapper.exe
File opened for modification	C:\Windows\TablesThou	Bootstrapper.exe
File opened for modification	C:\Windows\BirthdayBirds	Bootstrapper.exe
File opened for modification	C:\Windows\SituationYr	Bootstrapper.exe
File opened for modification	C:\Windows\ElementFrost	Bootstrapper.exe
File opened for modification	C:\Windows\FacingOccasion	Bootstrapper.exe
File opened for modification	C:\Windows\BirthdayBirds	Bootstrapper.exe
File opened for modification	C:\Windows\ElementFrost	Bootstrapper.exe
File opened for modification	C:\Windows\ElementFrost	Bootstrapper.exe
File opened for modification	C:\Windows\AlloyDj	Bootstrapper.exe
File opened for modification	C:\Windows\ElementFrost	Bootstrapper.exe
File opened for modification	C:\Windows\BirthdayBirds	Bootstrapper.exe
File opened for modification	C:\Windows\SituationYr	Bootstrapper.exe
File opened for modification	C:\Windows\AlloyDj	Bootstrapper.exe
File opened for modification	C:\Windows\ElementFrost	Bootstrapper.exe
File opened for modification	C:\Windows\TablesThou	Bootstrapper.exe
File opened for modification	C:\Windows\ElementFrost	Bootstrapper.exe
File opened for modification	C:\Windows\AlloyDj	Bootstrapper.exe
File opened for modification	C:\Windows\SituationYr	Bootstrapper.exe
File opened for modification	C:\Windows\FacingOccasion	Bootstrapper.exe
File opened for modification	C:\Windows\SituationYr	Bootstrapper.exe
File opened for modification	C:\Windows\FacingOccasion	Bootstrapper.exe
File opened for modification	C:\Windows\SituationYr	Bootstrapper.exe
File opened for modification	C:\Windows\BirthdayBirds	Bootstrapper.exe
File opened for modification	C:\Windows\BirthdayBirds	Bootstrapper.exe
File opened for modification	C:\Windows\TablesThou	Bootstrapper.exe
File opened for modification	C:\Windows\AlloyDj	Bootstrapper.exe
File opened for modification	C:\Windows\FacingOccasion	Bootstrapper.exe
File opened for modification	C:\Windows\TablesThou	Bootstrapper.exe
File opened for modification	C:\Windows\TablesThou	Bootstrapper.exe
File opened for modification	C:\Windows\SituationYr	Bootstrapper.exe
File opened for modification	C:\Windows\AlloyDj	Bootstrapper.exe
File opened for modification	C:\Windows\BirthdayBirds	Bootstrapper.exe
File opened for modification	C:\Windows\FacingOccasion	Bootstrapper.exe
File opened for modification	C:\Windows\FacingOccasion	Bootstrapper.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 41 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bootstrapper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	extrac32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bootstrapper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	extrac32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Flows.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Flows.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bootstrapper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bootstrapper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bootstrapper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bootstrapper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
1676	msedge.exe
1676	msedge.exe
5116	msedge.exe
5116	msedge.exe
3792	identity_helper.exe
3792	identity_helper.exe
2184	msedge.exe
2184	msedge.exe
2872	Flows.com
2872	Flows.com
2872	Flows.com
2872	Flows.com
2872	Flows.com
2872	Flows.com
2632	Flows.com
2632	Flows.com
2632	Flows.com
2632	Flows.com
2632	Flows.com
2632	Flows.com

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	3480	tasklist.exe
Token: SeDebugPrivilege	860	tasklist.exe
Token: SeDebugPrivilege	2768	tasklist.exe
Token: SeDebugPrivilege	3876	tasklist.exe
Token: SeDebugPrivilege	5012	tasklist.exe
Token: SeDebugPrivilege	4164	tasklist.exe
Token: SeDebugPrivilege	3796	tasklist.exe
Token: SeDebugPrivilege	3560	tasklist.exe

Suspicious use of FindShellTrayWindow 58 IoCs

pid	Process
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
2872	Flows.com
2872	Flows.com
2872	Flows.com
2632	Flows.com
2632	Flows.com
2632	Flows.com

Suspicious use of SendNotifyMessage 30 IoCs

pid	Process
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
2872	Flows.com
2872	Flows.com
2872	Flows.com
2632	Flows.com
2632	Flows.com
2632	Flows.com

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5116 wrote to memory of 4424	5116	msedge.exe	82
PID 5116 wrote to memory of 4424	5116	msedge.exe	82
PID 5116 wrote to memory of 2156	5116	msedge.exe	83
PID 5116 wrote to memory of 2156	5116	msedge.exe	83
PID 5116 wrote to memory of 2156	5116	msedge.exe	83
PID 5116 wrote to memory of 2156	5116	msedge.exe	83
PID 5116 wrote to memory of 2156	5116	msedge.exe	83
PID 5116 wrote to memory of 2156	5116	msedge.exe	83
PID 5116 wrote to memory of 2156	5116	msedge.exe	83
PID 5116 wrote to memory of 2156	5116	msedge.exe	83
PID 5116 wrote to memory of 2156	5116	msedge.exe	83
PID 5116 wrote to memory of 2156	5116	msedge.exe	83
PID 5116 wrote to memory of 2156	5116	msedge.exe	83
PID 5116 wrote to memory of 2156	5116	msedge.exe	83
PID 5116 wrote to memory of 2156	5116	msedge.exe	83
PID 5116 wrote to memory of 2156	5116	msedge.exe	83
PID 5116 wrote to memory of 2156	5116	msedge.exe	83
PID 5116 wrote to memory of 2156	5116	msedge.exe	83
PID 5116 wrote to memory of 2156	5116	msedge.exe	83
PID 5116 wrote to memory of 2156	5116	msedge.exe	83
PID 5116 wrote to memory of 2156	5116	msedge.exe	83
PID 5116 wrote to memory of 2156	5116	msedge.exe	83
PID 5116 wrote to memory of 2156	5116	msedge.exe	83
PID 5116 wrote to memory of 2156	5116	msedge.exe	83
PID 5116 wrote to memory of 2156	5116	msedge.exe	83
PID 5116 wrote to memory of 2156	5116	msedge.exe	83
PID 5116 wrote to memory of 2156	5116	msedge.exe	83
PID 5116 wrote to memory of 2156	5116	msedge.exe	83
PID 5116 wrote to memory of 2156	5116	msedge.exe	83
PID 5116 wrote to memory of 2156	5116	msedge.exe	83
PID 5116 wrote to memory of 2156	5116	msedge.exe	83
PID 5116 wrote to memory of 2156	5116	msedge.exe	83
PID 5116 wrote to memory of 2156	5116	msedge.exe	83
PID 5116 wrote to memory of 2156	5116	msedge.exe	83
PID 5116 wrote to memory of 2156	5116	msedge.exe	83
PID 5116 wrote to memory of 2156	5116	msedge.exe	83
PID 5116 wrote to memory of 2156	5116	msedge.exe	83
PID 5116 wrote to memory of 2156	5116	msedge.exe	83
PID 5116 wrote to memory of 2156	5116	msedge.exe	83
PID 5116 wrote to memory of 2156	5116	msedge.exe	83
PID 5116 wrote to memory of 2156	5116	msedge.exe	83
PID 5116 wrote to memory of 2156	5116	msedge.exe	83
PID 5116 wrote to memory of 1676	5116	msedge.exe	84
PID 5116 wrote to memory of 1676	5116	msedge.exe	84
PID 5116 wrote to memory of 1532	5116	msedge.exe	85
PID 5116 wrote to memory of 1532	5116	msedge.exe	85
PID 5116 wrote to memory of 1532	5116	msedge.exe	85
PID 5116 wrote to memory of 1532	5116	msedge.exe	85
PID 5116 wrote to memory of 1532	5116	msedge.exe	85
PID 5116 wrote to memory of 1532	5116	msedge.exe	85
PID 5116 wrote to memory of 1532	5116	msedge.exe	85
PID 5116 wrote to memory of 1532	5116	msedge.exe	85
PID 5116 wrote to memory of 1532	5116	msedge.exe	85
PID 5116 wrote to memory of 1532	5116	msedge.exe	85
PID 5116 wrote to memory of 1532	5116	msedge.exe	85
PID 5116 wrote to memory of 1532	5116	msedge.exe	85
PID 5116 wrote to memory of 1532	5116	msedge.exe	85
PID 5116 wrote to memory of 1532	5116	msedge.exe	85
PID 5116 wrote to memory of 1532	5116	msedge.exe	85
PID 5116 wrote to memory of 1532	5116	msedge.exe	85
PID 5116 wrote to memory of 1532	5116	msedge.exe	85
PID 5116 wrote to memory of 1532	5116	msedge.exe	85
PID 5116 wrote to memory of 1532	5116	msedge.exe	85
PID 5116 wrote to memory of 1532	5116	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://facelessb.com
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffa5c046f8,0x7fffa5c04708,0x7fffa5c04718
  2⤵
  PID:4424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,3447097755757956814,1269226957796886399,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:2
  2⤵
  PID:2156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,3447097755757956814,1269226957796886399,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,3447097755757956814,1269226957796886399,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2812 /prefetch:8
  2⤵
  PID:1532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,3447097755757956814,1269226957796886399,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:3660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,3447097755757956814,1269226957796886399,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:3312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,3447097755757956814,1269226957796886399,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4140 /prefetch:1
  2⤵
  PID:3696
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,3447097755757956814,1269226957796886399,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4916 /prefetch:8
  2⤵
  PID:3044
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,3447097755757956814,1269226957796886399,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4916 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,3447097755757956814,1269226957796886399,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5320 /prefetch:1
  2⤵
  PID:1680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,3447097755757956814,1269226957796886399,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5500 /prefetch:1
  2⤵
  PID:1896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,3447097755757956814,1269226957796886399,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3560 /prefetch:1
  2⤵
  PID:1764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,3447097755757956814,1269226957796886399,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5128 /prefetch:1
  2⤵
  PID:1868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,3447097755757956814,1269226957796886399,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5624 /prefetch:1
  2⤵
  PID:4984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2092,3447097755757956814,1269226957796886399,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5264 /prefetch:8
  2⤵
  PID:712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,3447097755757956814,1269226957796886399,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5332 /prefetch:1
  2⤵
  PID:3104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2092,3447097755757956814,1269226957796886399,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6168 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2184

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:376

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2828

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4436

C:\Users\Admin\AppData\Local\Temp\Temp1_ReleaseOp.zip\Bootstrapper.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_ReleaseOp.zip\Bootstrapper.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2908
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c copy Peak Peak.cmd & Peak.cmd
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2144
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3480
- - C:\Windows\SysWOW64\findstr.exe
    findstr /I "opssvc wrsa"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4900
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:860
- - C:\Windows\SysWOW64\findstr.exe
    findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5084
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c md 177979
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3560
- - C:\Windows\SysWOW64\extrac32.exe
    extrac32 /Y /E Flyer
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4884
- - C:\Windows\SysWOW64\findstr.exe
    findstr /V "tone" Intensity
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4732
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c copy /b 177979\Flows.com + Baby + Monday + Franklin + Keyword + Native + Box + Indeed + On + Mutual 177979\Flows.com
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4156
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c copy /b ..\Scheduled + ..\Metadata + ..\Columns + ..\Challenges + ..\Age + ..\Burner + ..\Ideas + ..\Three I
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4428
- - C:\Users\Admin\AppData\Local\Temp\177979\Flows.com
    Flows.com I
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:2872
- - C:\Windows\SysWOW64\choice.exe
    choice /d y /t 5
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4348

C:\Users\Admin\AppData\Local\Temp\Temp1_ReleaseOp.zip\Bootstrapper.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_ReleaseOp.zip\Bootstrapper.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1852
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c copy Peak Peak.cmd & Peak.cmd
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2608
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2768
- - C:\Windows\SysWOW64\findstr.exe
    findstr /I "opssvc wrsa"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4348
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3876
- - C:\Windows\SysWOW64\findstr.exe
    findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3384
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c md 177979
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4252
- - C:\Windows\SysWOW64\extrac32.exe
    extrac32 /Y /E Flyer
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2328
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c copy /b 177979\Flows.com + Baby + Monday + Franklin + Keyword + Native + Box + Indeed + On + Mutual 177979\Flows.com
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4428
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c copy /b ..\Scheduled + ..\Metadata + ..\Columns + ..\Challenges + ..\Age + ..\Burner + ..\Ideas + ..\Three I
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1184
- - C:\Users\Admin\AppData\Local\Temp\177979\Flows.com
    Flows.com I
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:2632
- - C:\Windows\SysWOW64\choice.exe
    choice /d y /t 5
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3668

C:\Users\Admin\Documents\ReleaseOp\Bootstrapper.exe
"C:\Users\Admin\Documents\ReleaseOp\Bootstrapper.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3384
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c copy Peak Peak.cmd & Peak.cmd
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2096
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5012
- - C:\Windows\SysWOW64\findstr.exe
    findstr /I "opssvc wrsa"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2900
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3560
- - C:\Windows\SysWOW64\findstr.exe
    findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1188
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c md 177979
    3⤵
    PID:4172
- - C:\Windows\SysWOW64\extrac32.exe
    extrac32 /Y /E Flyer
    3⤵
    PID:1596
- - C:\Windows\SysWOW64\findstr.exe
    findstr /V "tone" Intensity
    3⤵
    PID:4884
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c copy /b 177979\Flows.com + Baby + Monday + Franklin + Keyword + Native + Box + Indeed + On + Mutual 177979\Flows.com
    3⤵
    PID:5008
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c copy /b ..\Scheduled + ..\Metadata + ..\Columns + ..\Challenges + ..\Age + ..\Burner + ..\Ideas + ..\Three I
    3⤵
    PID:3012

C:\Users\Admin\Documents\ReleaseOp\Bootstrapper.exe
"C:\Users\Admin\Documents\ReleaseOp\Bootstrapper.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1320
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c copy Peak Peak.cmd & Peak.cmd
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4772
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4164
- - C:\Windows\SysWOW64\findstr.exe
    findstr /I "opssvc wrsa"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2884
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3796
- - C:\Windows\SysWOW64\findstr.exe
    findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3416
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c md 177979
    3⤵
    PID:924
- - C:\Windows\SysWOW64\extrac32.exe
    extrac32 /Y /E Flyer
    3⤵
    PID:2968
- - C:\Windows\SysWOW64\findstr.exe
    findstr /V "tone" Intensity
    3⤵
    PID:4676
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c copy /b 177979\Flows.com + Baby + Monday + Franklin + Keyword + Native + Box + Indeed + On + Mutual 177979\Flows.com
    3⤵
    PID:1588
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c copy /b ..\Scheduled + ..\Metadata + ..\Columns + ..\Challenges + ..\Age + ..\Burner + ..\Ideas + ..\Three I
    3⤵
    PID:4004

C:\Users\Admin\Documents\ReleaseOp\Bootstrapper.exe
"C:\Users\Admin\Documents\ReleaseOp\Bootstrapper.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1848
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c copy Peak Peak.cmd & Peak.cmd
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2148

C:\Users\Admin\Documents\ReleaseOp\Bootstrapper.exe
"C:\Users\Admin\Documents\ReleaseOp\Bootstrapper.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1996
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c copy Peak Peak.cmd & Peak.cmd
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4812

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6960857d16aadfa79d36df8ebbf0e423

SHA1
e1db43bd478274366621a8c6497e270d46c6ed4f

SHA256
f40b812ce44e391423eb66602ac0af138a1e948aa8c4116045fef671ef21cd32

SHA512
6deb2a63055a643759dd0ae125fb2f68ec04a443dbf8b066a812b42352bbcfa4517382ed0910c190c986a864559c3453c772e153ee2e9432fb2de2e1e49ca7fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f426165d1e5f7df1b7a3758c306cd4ae

SHA1
59ef728fbbb5c4197600f61daec48556fec651c1

SHA256
b68dfc21866d0abe5c75d70acc54670421fa9b26baf98af852768676a901b841

SHA512
8d437fcb85acb0705bf080141e7a021740901248985a76299ea8c43e46ad78fb88c738322cf302f6a550caa5e79d85b36827e9b329b1094521b17cf638c015b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
b7389288605261cfccc3948d643ff7b2

SHA1
49d68980dbe98405eb41cf6c7a5ff741089e57e1

SHA256
a2d67f0fe5567eb7019f2ba6b302c8c6300024de399f7dea129b2d39a790d0ec

SHA512
a997dbc86afc36312260c9cf0fe74050482d7600acc439ffe2e0660f0cc96889424824dbc2302e520f2b2c8e39966031081cfb6b63221f8d31bb58ed51fcff75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
288B

MD5
4a2cbcf99c3e5142d3e8369633433da3

SHA1
8a4cac9702e7fa5946cef7195367d08a79596bc3

SHA256
3b6a01e9b0ac14c924b48734782130edac629eee76ecfb04a0cf954ce9a74021

SHA512
d44adf109bd6cc8df1e7e2629255ab115bffc3fae5ba557e0c3f1a6f6ef7dd5e52851f098431a0196937630856b6f1108dca5b1f3a5fa37d7409c8b94710d996

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
bfa762922761ee5ca718f00ccc9d841a

SHA1
017fbbef3e6a93f55e53ea7647de840779e612cc

SHA256
53ccb521a84fd0d55f4623f3f2f6b91872db8356b47da3c6b5dac4c0162d216a

SHA512
99a9134d4caa651869a18f5a5fd89f872fb55db4557d7639ad79bc321422aac07e4bf7f43dc53c09c2fef115e643beec34496901adfb2a1c834cbd2f5048ee42

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
f678e89ef1067e52ef405b180005144d

SHA1
efa36754c9385648db06f4dfefe4898b081bb7f8

SHA256
6daa48f2b2dc1a5deae4cffa78d12b4d1d57acbe9da74d224796a892301de1e1

SHA512
6a6130d6bab560466f86ce0a30e06d8b419c9eaa94789453aa65e8bc33710c1232a3dad7eb1652af775e7f015fc372713e646951484b600ee5c08971bce0b50e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f87dbdbd760009f157ce6e58b57085c0

SHA1
98d1c709fd46b7d7bad75f80b827cee0602c9b86

SHA256
8d1fed651bd9bbe0d629d2c5a3add5708721fa1472c4972910cdf7110c16a94d

SHA512
57297194412b407a2ab1c4cc3c8c6498bff220be6589a6e06c15c7a3f716d1f1368bfb14885fa496cf2158c58d51cd8cad0a308d147afbcf54fc21e1023494ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
308e85b83c502615b70056af9ca8ac8b

SHA1
b3b90951ed751bae2464f53c814b370655ea6d58

SHA256
2611adfb006c3b604922e600e8d7fc0755d431527746cab43d7dd5e4c23c1687

SHA512
999c6f8f0edb6c1b678134198926711917cde89ad51b889fff8f691eb7cdc1b884a39800c68cabcb334ae9b126b32a35dbf7ecd0cc0558c00df0fef62b67dc68

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
04a9b159bf773ae08b5dc2454bc8fc75

SHA1
f1fc7909dc8af9ae9ce763f30326376b79fb70aa

SHA256
03ec94f9fd334bd4214b86019fac7c4f0fee1fa8171c8716284c122c843cc132

SHA512
4c09db1ac56c456bcde729535c0dc186f775969ba106ebf4edf6e0fb05645707cbcded6f6c939a6ef80de2230080bc69db46c6b279168bae7889b5e4464ff4da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
a6a2ee051b9c7f90be728c673072e601

SHA1
2e2289ade34a9461b593ae518496bd0f48b78f58

SHA256
f16f4425ab89ff87268ea430869b1e64b2b2a1bc8a778cdf7a7e527fb65864ef

SHA512
2d0ad471bb0f46788f1f292eddd425ed527d7964593ef4b82394e0784f6d4c6135b3ead35201c2cf6d7ffd940a2454dede00a5536142159a4b0154cdb9211d16

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
a07785b2807ae559f41732363e79c748

SHA1
84538a0727635a6b05f5f41a16239a9d86b44f73

SHA256
6fae2f44add3241b87cfd9cb4c583cf0399c1f35050d4ff5c60cd95f319a52c6

SHA512
14910ba9607fcf7f08c27781c23fc318bd0bab46d440fa94a0ae3a292f67322a992421cff1042dfeee4d06f49614f8c944f552962d80096378cd923f7b3b6ae5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ac3541fa-6723-48d8-b470-2170b33e24a5.tmp

Filesize
707B

MD5
a3008c3598c5063ea55f6b0598062c33

SHA1
4206afba9017c3e85b2f7340b1b08e0e74bde321

SHA256
7dffe151c0fda796894925d96b5ca51f7881788333f722c77763e3411df4c45d

SHA512
c2b3886c5101d7c30e64de4dfe73ef0f51412c365b00ef5d23240fc83576cd48a21b74cdd84ccfc225a86fb15fd2346e1911355f44d2b0342d4aa3b32bd66983

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
4c23494d6880c0b2e3573378944bccf2

SHA1
914616c056d675496105b9456724c37bde4c7d86

SHA256
8ae1f9d6923912f451b3b3360b6869c3f24f6ef0a92ebe88d171957ec26b02f9

SHA512
1c39b49938a6135c82ce1a2616ec798138fb41171ba2910f4e6596ece918f3c022505f98797c0de04fff6c08cb84ac83ba73e5b78ca8a15825d8f2239dcd5530

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
b7a5c82cf40bd414ade6c9838049b374

SHA1
746f68946fda9e505e242ccb47cbedfbb16baf7c

SHA256
7590e7e3d4e6fad5e2f3e39c870a5483a1790893bacb9d7033b5d13067454e67

SHA512
c60b3d001bf21c8f6215bae58471bb5b5eb62b967ff0d2e385947361cd2f181281f70f4b08c37b3c59b3319768990d0cb440c8bfb7acec87ad8b2a73bf3bf7c7

Download Submit
C:\Users\Admin\AppData\Local\Temp\177979\Flows.com

Filesize
1KB

MD5
8f9d821f8d7a79581a2ab3a0986a78f1

SHA1
b7bf35a298f8c440c28957e54f636dd91e35e31c

SHA256
a22de98030a228592c7d75a2c6fae0a637d7b4e8a2c52da61fef50f88478a86c

SHA512
0989650bd42270d5dc15bc77f8ee01e37b8dcbb3043a623cc5c1e8fff9bba8970b149cbc57281f4facb41509455f5af684a03cf96fadaedcb50d1e0f856ab9d6

Download Submit
C:\Users\Admin\AppData\Local\Temp\177979\Flows.com

Filesize
925KB

MD5
62d09f076e6e0240548c2f837536a46a

SHA1
26bdbc63af8abae9a8fb6ec0913a307ef6614cf2

SHA256
1300262a9d6bb6fcbefc0d299cce194435790e70b9c7b4a651e202e90a32fd49

SHA512
32de0d8bb57f3d3eb01d16950b07176866c7fb2e737d9811f61f7be6606a6a38a5fc5d4d2ae54a190636409b2a7943abca292d6cefaa89df1fc474a1312c695f

Download Submit
C:\Users\Admin\AppData\Local\Temp\177979\I

Filesize
477KB

MD5
8ce37257e647eafc2b435f2b56f2b33e

SHA1
beb990946ba7aa30d7f3f0c5242c5ff74ad2290d

SHA256
7385853f9d1e0473cffea742bdc89c69eabae19750402f7644c5e9c7274685db

SHA512
9e43b761faee231f440d405a429cdd4c45e155602988929ace1f34946951d18fd08a6b833e866642001a58b42971cee678667e5490adfb80f004a025f377e7d6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Age

Filesize
60KB

MD5
84692b422690f4852cb88836dbb1e0b0

SHA1
931fd3f161113cb84407455b7786dd63bba3c15a

SHA256
cc2f5e9bac8af1aaf86d2c004f1b2234261b6722c1b821c2153d1835372ee875

SHA512
74f5610074976dc96c6e387e9719f789b4a2c4ec0cb1cafd20452df7b268a9468672a38169c447d534261ab7b085c135828bc0c84dc5831d5c82e3cd36161fa7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Baby

Filesize
133KB

MD5
a86c655555e2e198272d833d78eb743b

SHA1
0f6bb609d65d8ae521f15f2306162e69469c57c8

SHA256
d6108619ca2f1670ef01ec58fd62d98c84877c7d6cec6075f27e7b926d71de12

SHA512
26b4319d1fd657f3e66395fd8db2b229358d487c685a4d6ac42d61c7604eb9920b2da6c16fcfd6e81ed512edc715630122fd8b9a6066ee3e96c0155ea1273eb5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Box

Filesize
71KB

MD5
1b2da465247a01a3b76472249a3d0deb

SHA1
616f32ade9272c6d240506b8a74bdcccea9304ae

SHA256
94d5c530034c5ec9506c5e3b52def91b4e79b9222d7da2b712d00fe6f002d35b

SHA512
dfe9da0f3b449c24c751d4c0cda6a0377d1070461c4f25b1900057a02108c5768e350f0c0e217716cec77001a4f629e14f64d55894ff19f73f36c3e24abbeef4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Burner

Filesize
64KB

MD5
878f18ed4b302e6c94d0a190d145f697

SHA1
c67320a66d6148485dec9075081db6957ef50e3c

SHA256
96e0e15abacaa99c9120b398a4d0c9eecfb08d789666940b74759ce913979713

SHA512
8545bcf1a979bae7c1de2aa34a5198ec772161d021e3fb302de4bb631a6796dddc9093f91b7ba14e4d41327c463bb61d2ff0b1fa8bb48c7cdc9808d5cc2f652f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Challenges

Filesize
94KB

MD5
0fd905bd29e18e664e3d3d9a6bb06ae6

SHA1
f532f1ba93228a60a483b40e4cd9c41e08877a27

SHA256
958643e7eba918e3867e1813480038d19716f39740d882755b7030ad8ac3bffc

SHA512
22416b891d9cb11adb5a5483e7eda868df6e5439ccfc635c077206c030d1814070c52718dedd3307983982d92a57b9644afd66f8e4936905da04ad4a3837f7a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Columns

Filesize
56KB

MD5
1c070e2cfeee36acf2fc7eb8c940ea66

SHA1
bb0e3d8db79e93bc732227bf3b5328c34e2dc254

SHA256
9a34487568789c5baff8a4fc46f0759d8d7cc06189ccbff928c3f6f2a0cb3cbd

SHA512
d58a8eaa563a6f092d062f5d31b16195c48b9ac5a657c8e2dbcf658c000b24bbc092d2526a4976f820318a0586037b9e707b1b2f06b8c972e34b7f767c5024c7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Flyer

Filesize
476KB

MD5
0338ef5a811b1886bc1c34f368cb2ffa

SHA1
d4c5d8a923c3271e1fd283ec1d8163b67db4dbbf

SHA256
3ddd2fe9b650e01e2f8b8940c47d5fc5039962a2f5315646c0baad6a2fdb0fa2

SHA512
8b0596bc09da58e88a959d3d73128e1db6c3095b283ee2e96be7048d055988c27b45f4a256ccaa22d489082262722900b8d01afd511efb8187153265266aced8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Franklin

Filesize
93KB

MD5
56e4414823fd2b7142284ed6d5a363b7

SHA1
64ee8eff5dc6de329ca71d2bdc8280a55dde95ba

SHA256
c5a5cfbf1ad6b80af7b467a232a5c016f8e077e5e33a84c306bea7fd3c5b319b

SHA512
6e8f863ac5473e528a6eef96c07a56bdf2cd5572f2df68cf6745d5819c367160edcb098a378ef4d7de4814aa4a09705d1d11be2aa949c44b7d56f201952881bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Ideas

Filesize
60KB

MD5
7b55e663410315b46b7c6cf9694f2608

SHA1
052f23cbbb5534826753018adc62f29cc7ae94d9

SHA256
37e34e0e46968b68e412ea504b05c5156252dae0b70e0687ba90271f04bb45d1

SHA512
dc4c6c0b7b3d633aa7d07bac7ee093867c043086bab2d0a450a726f9eef7a75f9b6406b567a1dcfbbc6d4fe87b89dfbb772f41e4aa2a90e0464edde3ea6a1479

Download Submit
C:\Users\Admin\AppData\Local\Temp\Indeed

Filesize
147KB

MD5
09c30eb57d7b8d5b6d2bed9172d72dba

SHA1
fc927ce49b240a9074d7cebc24ca184edbd8a1bf

SHA256
b321aaeea6b3b59d803228074d3d92a1f3c708c6b7ea46147c95511215cc105b

SHA512
fc34121fbbef228a8b250142cc10d47de6969f13d22d539c5e4411fe0af2c1117636413092e8fd756354b634a42f47bd6e584700ca79f8ab3113ad64f6ad2fd4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Intensity

Filesize
1KB

MD5
f61e65c8b5e558627396ed8261aee6a4

SHA1
9a35551af1d6bf2ffa97d15ec9c5b39d0f6d505a

SHA256
86d914001ade248c24ebdc8e38e39565c4f5bc2bd05deb357cae22d805707d72

SHA512
65be47472dca6c4eb8e099d54dedb8169486449832ff29ed563d632954d48789731b16fb442717efed0b5742e7a672c11e032fd4ccfde6b6e0cd77a32e8c9b92

Download Submit
C:\Users\Admin\AppData\Local\Temp\Keyword

Filesize
124KB

MD5
6349c17c75b1138329f07491744a9ed4

SHA1
840c353b3f6a3dfc0b75bb389e2d9903c98890d2

SHA256
15c91f0da6a7118a864f230d59149f8d56bf3d50404fd5b5c2b610a5dab0d293

SHA512
bea4e290e2b7a246e42facd5a987894b267881f26154d67f56b179168b1da9c9338d41f9808f63e1d0de8995c50e321e44d228d1cef761ea8faf9f159904b787

Download Submit
C:\Users\Admin\AppData\Local\Temp\Metadata

Filesize
68KB

MD5
2a0bf741f448dd30696be8f465b5b833

SHA1
b4a2c57793378236bf3c50c1fb45fcc1920fbbca

SHA256
3a3a09f732bb2b46fd1ef87e67088be5614dffe9fa661afa8acf2d7764ab7496

SHA512
269a5e255b674017086e2bc74ef8c6f7f14176e923283cbf8113ebcd5d585b485f5b43f9aec6ae9ffcdb6e8d5248c8bb70e65b3647ff7f10409938313ec96c5e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Monday

Filesize
84KB

MD5
b8eac858c394e989430167327a8ae7cf

SHA1
c7226e8012f0888b7bec48d0afade50534db1fdc

SHA256
45dd80aa6a648289f7f13b413884b6e288018c8178bce3df58c53b49e51f68fc

SHA512
5f6005be3db377c0050189d8ddab64f1e43e61f0471a6239d03af705f51cdb3d64ba3011fdb8c9c7d569cf4321f0abb13a0fcf1f088397fae390d5bcc4aaf802

Download Submit
C:\Users\Admin\AppData\Local\Temp\Mutual

Filesize
67KB

MD5
07d393f56efd3b9326606b437b71f1d4

SHA1
bd63b40e51e2e6c68a266e9f06f20b94e29c882c

SHA256
f0ef7a9e9dce3aebcf8e05805ba9c1c912c4faae9e01b9ca3efd2ec83f528414

SHA512
ad6471df9322535eb862d86cbd342ddf3e744932889972d310412b06c0a66af807f708c115232f29278c074ec9611896e91876a99ba468494bd4304a1378f559

Download Submit
C:\Users\Admin\AppData\Local\Temp\Native

Filesize
90KB

MD5
b09fe66fe9ba0c96d5f09e3cceaf61a8

SHA1
04e173e7bc1d3c632d206b2f38bdd2bac4b40a21

SHA256
b5f56cd6ac094dec19e7b1ff1ed162dc07d4ca3af7579adca5ac9c43a44640dd

SHA512
746a22266eb2c8d8d89de5dd3c605ead29d2bf0b172bdedcd6d298126dcc02522707e488c3400cd2edb7cd0265a7e12212b16ff336f148a39a252055c653a959

Download Submit
C:\Users\Admin\AppData\Local\Temp\On

Filesize
114KB

MD5
6c1c4f39f2bb55057641898e3d376930

SHA1
b43b16c85687517d3dd83f82b6b421304f7e628d

SHA256
48e5d116dc1494dbd8905eec10832aa7ce19f4f812d91514ab6fce5ce6f57cf7

SHA512
ff4ee5c654f50bea1fb92ace656c952ef573759f08ce072468d5029e6c38d77609a200de54f49c68c9fecf6ed515dd2864ba3acb1a5ce523d6a3efae9745a3f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Peak

Filesize
30KB

MD5
20718b8b13d6d0de153980d6759d39e5

SHA1
d3ac2a4ea8dcbe0f74f4ac148c4567aeb6f707ad

SHA256
abaa9a49fce5f6ee29eb407c9aa85961ab8f256a322e3309cf7c874ef7a56e9b

SHA512
2864b793a479410ea6ba152490ff313e40a6357444245fb4935777d9ebf854918bc5ddbf8d4b3d348a94b5931501664cc1d41b5617b10e62bdd24efba60fd0fc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Scheduled

Filesize
47KB

MD5
a8604f700dd7ffbe19119ec28893e1d3

SHA1
248f63551f973a3dba50e818042d943fa1350bc1

SHA256
b995f46010553cd6c92b93a406389448c7396080be90f3f0366ebfbecb01d9ec

SHA512
4bdf33124bd0e6b3929dc789e1ee0767b9df467857f0e1df933992c585178cbe0a47f5f0759475acfd07f00b4e52fe19fefc1513eb8b9d87847e5c07cc9efe75

Download Submit
C:\Users\Admin\AppData\Local\Temp\Scheduled

Filesize
56KB

MD5
99b09fb9fba65c428078b8ccd89f90ea

SHA1
c1ec375fa1c9ac8323fa156596ff7694b4b18dc4

SHA256
86bc96aaf2de8304b80d0ee08ea403686c2dca2c5c623eb7692ab85b41217910

SHA512
8fe7a7ed45a52ce4b6b0b0a325349d14598953f056f331d4aba128c11dbcf06f6b1f1ee58e92dcc7f7569e60fc97561118841dba8a77b0c32e2ee95dde964e24

Download Submit
C:\Users\Admin\AppData\Local\Temp\Three

Filesize
19KB

MD5
2e94c6d5accc6a1afec513fc9bffce73

SHA1
f58f072d322645b8160adf57e4de7383dd5668c6

SHA256
6f8378f9fbde1d7f59f5ff455f8aab61eea7fa7c591f05bf88f761be2cbaeb65

SHA512
c62b03e9320333c174b04988d33af71dfbd9a37aaa8518847a2bf14a29a1c761481c6869d59b7f089a775cc06f023fc93c5924da47f2ca25fb696e4fccfd4ffe

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 813030.crdownload

Filesize
12.4MB

MD5
a895db3a348ae2e3f4bcc25639221f4d

SHA1
cca7000f4b6ccf0cd28ebbf5ca0ea2a3e6209a95

SHA256
6d40f096c6a65cccc1c796a6f8d0e73e9a44899fe751327216d8cdd39849cd2a

SHA512
853f3a356fef5bd573a7789ef43aa0cc208aaffb43ccb12df679dba150d0618c4632ab1260de66fc43e2293ee10c3366d0c6e182371387d1f97886e4b6ce0595

Download Submit
memory/2872-1598-0x0000000004050000-0x00000000040AB000-memory.dmp

Filesize
364KB

Download
memory/2872-1599-0x0000000004050000-0x00000000040AB000-memory.dmp

Filesize
364KB

Download
memory/2872-1600-0x0000000004050000-0x00000000040AB000-memory.dmp

Filesize
364KB

Download
memory/2872-1601-0x0000000004050000-0x00000000040AB000-memory.dmp

Filesize
364KB

Download
memory/2872-1602-0x0000000004050000-0x00000000040AB000-memory.dmp

Filesize
364KB

Download