lumma | hxxps://facelessb[.]com/

Analysis

max time kernel
318s
max time network
320s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20250113-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20250113-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
26/01/2025, 09:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://facelessb.com/

Score

10^/10

lumma discovery stealer

Malware Config

Extracted

Family

lumma

https://sheayingero.shop/api

https://toppyneedus.biz/api

Signatures

Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Lumma family
lumma

Executes dropped EXE 6 IoCs

pid	Process
4876	Flows.com
2884	Flows.com
1584	Flows.com
2740	Flows.com
2972	Flows.com
3932	Flows.com

Enumerates processes with tasklist 1 TTPs 12 IoCs

discovery

Process Discovery

T1057

pid	Process
4424	tasklist.exe
1676	tasklist.exe
4568	tasklist.exe
2752	tasklist.exe
3000	tasklist.exe
2484	tasklist.exe
3332	tasklist.exe
2976	tasklist.exe
1324	tasklist.exe
2512	tasklist.exe
4420	tasklist.exe
2852	tasklist.exe

Drops file in Windows directory 43 IoCs

description	ioc	Process
File opened for modification	C:\Windows\TablesThou	Bootstrapper.exe
File opened for modification	C:\Windows\FacingOccasion	Bootstrapper.exe
File opened for modification	C:\Windows\AlloyDj	Bootstrapper.exe
File opened for modification	C:\Windows\AlloyDj	Bootstrapper.exe
File opened for modification	C:\Windows\ElementFrost	Bootstrapper.exe
File opened for modification	C:\Windows\TablesThou	Bootstrapper.exe
File opened for modification	C:\Windows\ElementFrost	Bootstrapper.exe
File opened for modification	C:\Windows\FacingOccasion	Bootstrapper.exe
File opened for modification	C:\Windows\ElementFrost	Bootstrapper.exe
File opened for modification	C:\Windows\BirthdayBirds	Bootstrapper.exe
File opened for modification	C:\Windows\TablesThou	Bootstrapper.exe
File opened for modification	C:\Windows\AlloyDj	Bootstrapper.exe
File opened for modification	C:\Windows\BirthdayBirds	Bootstrapper.exe
File opened for modification	C:\Windows\AlloyDj	Bootstrapper.exe
File opened for modification	C:\Windows\SituationYr	Bootstrapper.exe
File opened for modification	C:\Windows\ElementFrost	Bootstrapper.exe
File opened for modification	C:\Windows\SituationYr	Bootstrapper.exe
File opened for modification	C:\Windows\ElementFrost	Bootstrapper.exe
File opened for modification	C:\Windows\TablesThou	Bootstrapper.exe
File opened for modification	C:\Windows\BirthdayBirds	Bootstrapper.exe
File opened for modification	C:\Windows\ElementFrost	Bootstrapper.exe
File opened for modification	C:\Windows\SituationYr	Bootstrapper.exe
File opened for modification	C:\Windows\FacingOccasion	Bootstrapper.exe
File opened for modification	C:\Windows\TablesThou	Bootstrapper.exe
File opened for modification	C:\Windows\BirthdayBirds	Bootstrapper.exe
File opened for modification	C:\Windows\TablesThou	Bootstrapper.exe
File opened for modification	C:\Windows\SituationYr	Bootstrapper.exe
File opened for modification	C:\Windows\ElementFrost	Bootstrapper.exe
File opened for modification	C:\Windows\BirthdayBirds	Bootstrapper.exe
File opened for modification	C:\Windows\FacingOccasion	Bootstrapper.exe
File opened for modification	C:\Windows\TablesThou	Bootstrapper.exe
File opened for modification	C:\Windows\SituationYr	Bootstrapper.exe
File opened for modification	C:\Windows\SituationYr	Bootstrapper.exe
File opened for modification	C:\Windows\FacingOccasion	Bootstrapper.exe
File opened for modification	C:\Windows\FacingOccasion	Bootstrapper.exe
File opened for modification	C:\Windows\AlloyDj	Bootstrapper.exe
File opened for modification	C:\Windows\BirthdayBirds	Bootstrapper.exe
File opened for modification	C:\Windows\AlloyDj	Bootstrapper.exe
File opened for modification	C:\Windows\AlloyDj	Bootstrapper.exe
File opened for modification	C:\Windows\FacingOccasion	Bootstrapper.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\BirthdayBirds	Bootstrapper.exe
File opened for modification	C:\Windows\SituationYr	Bootstrapper.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	extrac32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bootstrapper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	extrac32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Flows.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	extrac32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bootstrapper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	extrac32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bootstrapper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bootstrapper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bootstrapper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	extrac32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	extrac32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Flows.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Flows.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133823567891678435"	chrome.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2449540194-3226363261-2578591490-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2449540194-3226363261-2578591490-1000_Classes\Local Settings	OpenWith.exe

Suspicious behavior: EnumeratesProcesses 42 IoCs

pid	Process
1116	chrome.exe
1116	chrome.exe
4876	Flows.com
4876	Flows.com
4876	Flows.com
4876	Flows.com
4876	Flows.com
4876	Flows.com
4760	chrome.exe
4760	chrome.exe
4760	chrome.exe
4760	chrome.exe
2884	Flows.com
2884	Flows.com
2884	Flows.com
2884	Flows.com
2884	Flows.com
2884	Flows.com
1584	Flows.com
1584	Flows.com
1584	Flows.com
1584	Flows.com
1584	Flows.com
1584	Flows.com
2740	Flows.com
2740	Flows.com
2740	Flows.com
2740	Flows.com
2740	Flows.com
2740	Flows.com
2972	Flows.com
2972	Flows.com
2972	Flows.com
2972	Flows.com
2972	Flows.com
2972	Flows.com
3932	Flows.com
3932	Flows.com
3932	Flows.com
3932	Flows.com
3932	Flows.com
3932	Flows.com

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4080	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1116	chrome.exe
Token: SeCreatePagefilePrivilege	1116	chrome.exe
Token: SeShutdownPrivilege	1116	chrome.exe
Token: SeCreatePagefilePrivilege	1116	chrome.exe
Token: SeShutdownPrivilege	1116	chrome.exe
Token: SeCreatePagefilePrivilege	1116	chrome.exe
Token: SeShutdownPrivilege	1116	chrome.exe
Token: SeCreatePagefilePrivilege	1116	chrome.exe
Token: SeShutdownPrivilege	1116	chrome.exe
Token: SeCreatePagefilePrivilege	1116	chrome.exe
Token: SeShutdownPrivilege	1116	chrome.exe
Token: SeCreatePagefilePrivilege	1116	chrome.exe
Token: SeShutdownPrivilege	1116	chrome.exe
Token: SeCreatePagefilePrivilege	1116	chrome.exe
Token: SeShutdownPrivilege	1116	chrome.exe
Token: SeCreatePagefilePrivilege	1116	chrome.exe
Token: SeShutdownPrivilege	1116	chrome.exe
Token: SeCreatePagefilePrivilege	1116	chrome.exe
Token: SeShutdownPrivilege	1116	chrome.exe
Token: SeCreatePagefilePrivilege	1116	chrome.exe
Token: SeShutdownPrivilege	1116	chrome.exe
Token: SeCreatePagefilePrivilege	1116	chrome.exe
Token: SeShutdownPrivilege	1116	chrome.exe
Token: SeCreatePagefilePrivilege	1116	chrome.exe
Token: SeShutdownPrivilege	1116	chrome.exe
Token: SeCreatePagefilePrivilege	1116	chrome.exe
Token: SeShutdownPrivilege	1116	chrome.exe
Token: SeCreatePagefilePrivilege	1116	chrome.exe
Token: SeShutdownPrivilege	1116	chrome.exe
Token: SeCreatePagefilePrivilege	1116	chrome.exe
Token: SeShutdownPrivilege	1116	chrome.exe
Token: SeCreatePagefilePrivilege	1116	chrome.exe
Token: SeShutdownPrivilege	1116	chrome.exe
Token: SeCreatePagefilePrivilege	1116	chrome.exe
Token: SeShutdownPrivilege	1116	chrome.exe
Token: SeCreatePagefilePrivilege	1116	chrome.exe
Token: SeShutdownPrivilege	1116	chrome.exe
Token: SeCreatePagefilePrivilege	1116	chrome.exe
Token: SeShutdownPrivilege	1116	chrome.exe
Token: SeCreatePagefilePrivilege	1116	chrome.exe
Token: SeShutdownPrivilege	1116	chrome.exe
Token: SeCreatePagefilePrivilege	1116	chrome.exe
Token: SeShutdownPrivilege	1116	chrome.exe
Token: SeCreatePagefilePrivilege	1116	chrome.exe
Token: SeShutdownPrivilege	1116	chrome.exe
Token: SeCreatePagefilePrivilege	1116	chrome.exe
Token: SeShutdownPrivilege	1116	chrome.exe
Token: SeCreatePagefilePrivilege	1116	chrome.exe
Token: SeShutdownPrivilege	1116	chrome.exe
Token: SeCreatePagefilePrivilege	1116	chrome.exe
Token: SeShutdownPrivilege	1116	chrome.exe
Token: SeCreatePagefilePrivilege	1116	chrome.exe
Token: SeShutdownPrivilege	1116	chrome.exe
Token: SeCreatePagefilePrivilege	1116	chrome.exe
Token: SeShutdownPrivilege	1116	chrome.exe
Token: SeCreatePagefilePrivilege	1116	chrome.exe
Token: SeShutdownPrivilege	1116	chrome.exe
Token: SeCreatePagefilePrivilege	1116	chrome.exe
Token: SeShutdownPrivilege	1116	chrome.exe
Token: SeCreatePagefilePrivilege	1116	chrome.exe
Token: SeShutdownPrivilege	1116	chrome.exe
Token: SeCreatePagefilePrivilege	1116	chrome.exe
Token: SeShutdownPrivilege	1116	chrome.exe
Token: SeCreatePagefilePrivilege	1116	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe

Suspicious use of SendNotifyMessage 42 IoCs

pid	Process
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
4876	Flows.com
4876	Flows.com
4876	Flows.com
2884	Flows.com
2884	Flows.com
2884	Flows.com
1584	Flows.com
1584	Flows.com
1584	Flows.com
2740	Flows.com
2740	Flows.com
2740	Flows.com
2972	Flows.com
2972	Flows.com
2972	Flows.com
3932	Flows.com
3932	Flows.com
3932	Flows.com

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
4080	OpenWith.exe
4080	OpenWith.exe
4080	OpenWith.exe
4080	OpenWith.exe
4080	OpenWith.exe
4080	OpenWith.exe
4080	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1116 wrote to memory of 2504	1116	chrome.exe	81
PID 1116 wrote to memory of 2504	1116	chrome.exe	81
PID 1116 wrote to memory of 1976	1116	chrome.exe	82
PID 1116 wrote to memory of 1976	1116	chrome.exe	82
PID 1116 wrote to memory of 1976	1116	chrome.exe	82
PID 1116 wrote to memory of 1976	1116	chrome.exe	82
PID 1116 wrote to memory of 1976	1116	chrome.exe	82
PID 1116 wrote to memory of 1976	1116	chrome.exe	82
PID 1116 wrote to memory of 1976	1116	chrome.exe	82
PID 1116 wrote to memory of 1976	1116	chrome.exe	82
PID 1116 wrote to memory of 1976	1116	chrome.exe	82
PID 1116 wrote to memory of 1976	1116	chrome.exe	82
PID 1116 wrote to memory of 1976	1116	chrome.exe	82
PID 1116 wrote to memory of 1976	1116	chrome.exe	82
PID 1116 wrote to memory of 1976	1116	chrome.exe	82
PID 1116 wrote to memory of 1976	1116	chrome.exe	82
PID 1116 wrote to memory of 1976	1116	chrome.exe	82
PID 1116 wrote to memory of 1976	1116	chrome.exe	82
PID 1116 wrote to memory of 1976	1116	chrome.exe	82
PID 1116 wrote to memory of 1976	1116	chrome.exe	82
PID 1116 wrote to memory of 1976	1116	chrome.exe	82
PID 1116 wrote to memory of 1976	1116	chrome.exe	82
PID 1116 wrote to memory of 1976	1116	chrome.exe	82
PID 1116 wrote to memory of 1976	1116	chrome.exe	82
PID 1116 wrote to memory of 1976	1116	chrome.exe	82
PID 1116 wrote to memory of 1976	1116	chrome.exe	82
PID 1116 wrote to memory of 1976	1116	chrome.exe	82
PID 1116 wrote to memory of 1976	1116	chrome.exe	82
PID 1116 wrote to memory of 1976	1116	chrome.exe	82
PID 1116 wrote to memory of 1976	1116	chrome.exe	82
PID 1116 wrote to memory of 1976	1116	chrome.exe	82
PID 1116 wrote to memory of 1976	1116	chrome.exe	82
PID 1116 wrote to memory of 4516	1116	chrome.exe	83
PID 1116 wrote to memory of 4516	1116	chrome.exe	83
PID 1116 wrote to memory of 2724	1116	chrome.exe	84
PID 1116 wrote to memory of 2724	1116	chrome.exe	84
PID 1116 wrote to memory of 2724	1116	chrome.exe	84
PID 1116 wrote to memory of 2724	1116	chrome.exe	84
PID 1116 wrote to memory of 2724	1116	chrome.exe	84
PID 1116 wrote to memory of 2724	1116	chrome.exe	84
PID 1116 wrote to memory of 2724	1116	chrome.exe	84
PID 1116 wrote to memory of 2724	1116	chrome.exe	84
PID 1116 wrote to memory of 2724	1116	chrome.exe	84
PID 1116 wrote to memory of 2724	1116	chrome.exe	84
PID 1116 wrote to memory of 2724	1116	chrome.exe	84
PID 1116 wrote to memory of 2724	1116	chrome.exe	84
PID 1116 wrote to memory of 2724	1116	chrome.exe	84
PID 1116 wrote to memory of 2724	1116	chrome.exe	84
PID 1116 wrote to memory of 2724	1116	chrome.exe	84
PID 1116 wrote to memory of 2724	1116	chrome.exe	84
PID 1116 wrote to memory of 2724	1116	chrome.exe	84
PID 1116 wrote to memory of 2724	1116	chrome.exe	84
PID 1116 wrote to memory of 2724	1116	chrome.exe	84
PID 1116 wrote to memory of 2724	1116	chrome.exe	84
PID 1116 wrote to memory of 2724	1116	chrome.exe	84
PID 1116 wrote to memory of 2724	1116	chrome.exe	84
PID 1116 wrote to memory of 2724	1116	chrome.exe	84
PID 1116 wrote to memory of 2724	1116	chrome.exe	84
PID 1116 wrote to memory of 2724	1116	chrome.exe	84
PID 1116 wrote to memory of 2724	1116	chrome.exe	84
PID 1116 wrote to memory of 2724	1116	chrome.exe	84
PID 1116 wrote to memory of 2724	1116	chrome.exe	84
PID 1116 wrote to memory of 2724	1116	chrome.exe	84
PID 1116 wrote to memory of 2724	1116	chrome.exe	84

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://facelessb.com/
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x21c,0x220,0x224,0x1f8,0x228,0x7fff11edcc40,0x7fff11edcc4c,0x7fff11edcc58
  2⤵
  PID:2504
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1940,i,17237889471912684830,223951488011309405,262144 --variations-seed-version=20250112-180253.846000 --mojo-platform-channel-handle=1928 /prefetch:2
  2⤵
  PID:1976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2128,i,17237889471912684830,223951488011309405,262144 --variations-seed-version=20250112-180253.846000 --mojo-platform-channel-handle=2164 /prefetch:3
  2⤵
  PID:4516
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2240,i,17237889471912684830,223951488011309405,262144 --variations-seed-version=20250112-180253.846000 --mojo-platform-channel-handle=2452 /prefetch:8
  2⤵
  PID:2724
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3132,i,17237889471912684830,223951488011309405,262144 --variations-seed-version=20250112-180253.846000 --mojo-platform-channel-handle=3148 /prefetch:1
  2⤵
  PID:1600
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3136,i,17237889471912684830,223951488011309405,262144 --variations-seed-version=20250112-180253.846000 --mojo-platform-channel-handle=3160 /prefetch:1
  2⤵
  PID:1756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4948,i,17237889471912684830,223951488011309405,262144 --variations-seed-version=20250112-180253.846000 --mojo-platform-channel-handle=4912 /prefetch:8
  2⤵
  PID:3624
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=5024,i,17237889471912684830,223951488011309405,262144 --variations-seed-version=20250112-180253.846000 --mojo-platform-channel-handle=4944 /prefetch:1
  2⤵
  PID:4828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=4024,i,17237889471912684830,223951488011309405,262144 --variations-seed-version=20250112-180253.846000 --mojo-platform-channel-handle=5036 /prefetch:1
  2⤵
  PID:2888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=3264,i,17237889471912684830,223951488011309405,262144 --variations-seed-version=20250112-180253.846000 --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:1188
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=5148,i,17237889471912684830,223951488011309405,262144 --variations-seed-version=20250112-180253.846000 --mojo-platform-channel-handle=5200 /prefetch:1
  2⤵
  PID:2756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=3192,i,17237889471912684830,223951488011309405,262144 --variations-seed-version=20250112-180253.846000 --mojo-platform-channel-handle=5348 /prefetch:1
  2⤵
  PID:2436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=5068,i,17237889471912684830,223951488011309405,262144 --variations-seed-version=20250112-180253.846000 --mojo-platform-channel-handle=4576 /prefetch:1
  2⤵
  PID:3628
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4584,i,17237889471912684830,223951488011309405,262144 --variations-seed-version=20250112-180253.846000 --mojo-platform-channel-handle=3180 /prefetch:8
  2⤵
  PID:4580
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=5540,i,17237889471912684830,223951488011309405,262144 --variations-seed-version=20250112-180253.846000 --mojo-platform-channel-handle=5636 /prefetch:1
  2⤵
  PID:3380
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1096,i,17237889471912684830,223951488011309405,262144 --variations-seed-version=20250112-180253.846000 --mojo-platform-channel-handle=5852 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4760

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:4616

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4168

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3348

C:\Users\Admin\AppData\Local\Temp\9809a3dc-bab5-4684-8c98-1daf2fcc239b_r--e--l--e--a--s--e-x64.zip.39b\Release\Bootstrapper.exe
"C:\Users\Admin\AppData\Local\Temp\9809a3dc-bab5-4684-8c98-1daf2fcc239b_r--e--l--e--a--s--e-x64.zip.39b\Release\Bootstrapper.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:344
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c copy Peak Peak.cmd & Peak.cmd
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2972
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    PID:3332
- - C:\Windows\SysWOW64\findstr.exe
    findstr /I "opssvc wrsa"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1528
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    PID:2976
- - C:\Windows\SysWOW64\findstr.exe
    findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2420
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c md 177979
    3⤵
    - System Location Discovery: System Language Discovery
    PID:896
- - C:\Windows\SysWOW64\extrac32.exe
    extrac32 /Y /E Flyer
    3⤵
    - System Location Discovery: System Language Discovery
    PID:776
- - C:\Windows\SysWOW64\findstr.exe
    findstr /V "tone" Intensity
    3⤵
    PID:2372
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c copy /b 177979\Flows.com + Baby + Monday + Franklin + Keyword + Native + Box + Indeed + On + Mutual 177979\Flows.com
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4396
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c copy /b ..\Scheduled + ..\Metadata + ..\Columns + ..\Challenges + ..\Age + ..\Burner + ..\Ideas + ..\Three I
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1068
- - C:\Users\Admin\AppData\Local\Temp\177979\Flows.com
    Flows.com I
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SendNotifyMessage
    PID:4876
- - C:\Windows\SysWOW64\choice.exe
    choice /d y /t 5
    3⤵
    PID:3332

C:\Users\Admin\Downloads\Release\Bootstrapper.exe
"C:\Users\Admin\Downloads\Release\Bootstrapper.exe"
1⤵
- Drops file in Windows directory
PID:4612
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c copy Peak Peak.cmd & Peak.cmd
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2524
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    PID:4424
- - C:\Windows\SysWOW64\findstr.exe
    findstr /I "opssvc wrsa"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3932
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    PID:1676
- - C:\Windows\SysWOW64\findstr.exe
    findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5016
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c md 177979
    3⤵
    - System Location Discovery: System Language Discovery
    PID:924
- - C:\Windows\SysWOW64\extrac32.exe
    extrac32 /Y /E Flyer
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1584
- - C:\Windows\SysWOW64\findstr.exe
    findstr /V "tone" Intensity
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1316
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c copy /b 177979\Flows.com + Baby + Monday + Franklin + Keyword + Native + Box + Indeed + On + Mutual 177979\Flows.com
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3220
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c copy /b ..\Scheduled + ..\Metadata + ..\Columns + ..\Challenges + ..\Age + ..\Burner + ..\Ideas + ..\Three I
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2776
- - C:\Users\Admin\AppData\Local\Temp\177979\Flows.com
    Flows.com I
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SendNotifyMessage
    PID:2884
- - C:\Windows\SysWOW64\choice.exe
    choice /d y /t 5
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2604

C:\Users\Admin\Downloads\Release\Bootstrapper.exe
"C:\Users\Admin\Downloads\Release\Bootstrapper.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4612
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c copy Peak Peak.cmd & Peak.cmd
  2⤵
  - System Location Discovery: System Language Discovery
  PID:916
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    PID:4420
- - C:\Windows\SysWOW64\findstr.exe
    findstr /I "opssvc wrsa"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1268
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    PID:4568
- - C:\Windows\SysWOW64\findstr.exe
    findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
    3⤵
    PID:3536
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c md 177979
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2676
- - C:\Windows\SysWOW64\extrac32.exe
    extrac32 /Y /E Flyer
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1532
- - C:\Windows\SysWOW64\findstr.exe
    findstr /V "tone" Intensity
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2632
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c copy /b 177979\Flows.com + Baby + Monday + Franklin + Keyword + Native + Box + Indeed + On + Mutual 177979\Flows.com
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1324
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c copy /b ..\Scheduled + ..\Metadata + ..\Columns + ..\Challenges + ..\Age + ..\Burner + ..\Ideas + ..\Three I
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2852
- - C:\Users\Admin\AppData\Local\Temp\177979\Flows.com
    Flows.com I
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SendNotifyMessage
    PID:1584
- - C:\Windows\SysWOW64\choice.exe
    choice /d y /t 5
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2084

C:\Users\Admin\Downloads\Release\Bootstrapper.exe
"C:\Users\Admin\Downloads\Release\Bootstrapper.exe"
1⤵
- Drops file in Windows directory
PID:4780
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c copy Peak Peak.cmd & Peak.cmd
  2⤵
  PID:4316
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    PID:2752
- - C:\Windows\SysWOW64\findstr.exe
    findstr /I "opssvc wrsa"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4768
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    PID:3000
- - C:\Windows\SysWOW64\findstr.exe
    findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
    3⤵
    PID:344
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c md 177979
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5040
- - C:\Windows\SysWOW64\extrac32.exe
    extrac32 /Y /E Flyer
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5000
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c copy /b 177979\Flows.com + Baby + Monday + Franklin + Keyword + Native + Box + Indeed + On + Mutual 177979\Flows.com
    3⤵
    PID:4680
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c copy /b ..\Scheduled + ..\Metadata + ..\Columns + ..\Challenges + ..\Age + ..\Burner + ..\Ideas + ..\Three I
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3064
- - C:\Users\Admin\AppData\Local\Temp\177979\Flows.com
    Flows.com I
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SendNotifyMessage
    PID:2740
- - C:\Windows\SysWOW64\choice.exe
    choice /d y /t 5
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1860

C:\Users\Admin\Downloads\Release\Bootstrapper.exe
"C:\Users\Admin\Downloads\Release\Bootstrapper.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3340
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c copy Peak Peak.cmd & Peak.cmd
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1300

C:\Users\Admin\Downloads\Release\Bootstrapper.exe
"C:\Users\Admin\Downloads\Release\Bootstrapper.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4760
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c copy Peak Peak.cmd & Peak.cmd
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1200
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    PID:2852
- - C:\Windows\SysWOW64\findstr.exe
    findstr /I "opssvc wrsa"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:896
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    PID:2512
- - C:\Windows\SysWOW64\findstr.exe
    findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1820
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c md 177979
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1152
- - C:\Windows\SysWOW64\extrac32.exe
    extrac32 /Y /E Flyer
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1548
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c copy /b 177979\Flows.com + Baby + Monday + Franklin + Keyword + Native + Box + Indeed + On + Mutual 177979\Flows.com
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3536
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c copy /b ..\Scheduled + ..\Metadata + ..\Columns + ..\Challenges + ..\Age + ..\Burner + ..\Ideas + ..\Three I
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2060
- - C:\Users\Admin\AppData\Local\Temp\177979\Flows.com
    Flows.com I
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SendNotifyMessage
    PID:2972
- - C:\Windows\SysWOW64\choice.exe
    choice /d y /t 5
    3⤵
    - System Location Discovery: System Language Discovery
    PID:568

C:\Users\Admin\Downloads\Release\Bootstrapper.exe
"C:\Users\Admin\Downloads\Release\Bootstrapper.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2216
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c copy Peak Peak.cmd & Peak.cmd
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1624
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    PID:2484
- - C:\Windows\SysWOW64\findstr.exe
    findstr /I "opssvc wrsa"
    3⤵
    PID:1368
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    PID:1324
- - C:\Windows\SysWOW64\findstr.exe
    findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
    3⤵
    PID:1532
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c md 177979
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1824
- - C:\Windows\SysWOW64\extrac32.exe
    extrac32 /Y /E Flyer
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4892
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c copy /b 177979\Flows.com + Baby + Monday + Franklin + Keyword + Native + Box + Indeed + On + Mutual 177979\Flows.com
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3172
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c copy /b ..\Scheduled + ..\Metadata + ..\Columns + ..\Challenges + ..\Age + ..\Burner + ..\Ideas + ..\Three I
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2360
- - C:\Users\Admin\AppData\Local\Temp\177979\Flows.com
    Flows.com I
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SendNotifyMessage
    PID:3932
- - C:\Windows\SysWOW64\choice.exe
    choice /d y /t 5
    3⤵
    - System Location Discovery: System Language Discovery
    PID:948

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4080

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\081d48b3-91c3-4fe5-a633-8e55b0300035.tmp

Filesize
11KB

MD5
cfe7bb58d4a779a1b968338afc8bcb9e

SHA1
7fc5784fedfc64077ec51992f5a7f497ca191883

SHA256
f0a018f788256b0807b1ad6bccb76f00d4136e5a4914ed2f2ad7673de267f6f0

SHA512
ee442bfe0c1eeb284369a70788949420f1e7b05e244ac67305e2ecaa7e7a069fdd387a41205407415aef698110ca1bb7e568479d6c7818ad59f3ffe593676e35

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
e44350c108cbcbeb0a6e99d36191d777

SHA1
318c8a635ba9d0284b968acdfe8cf9353a225267

SHA256
dc668606df76e3007936fa97ec1deff693c1024fe93ed4d2e0995be666c2536c

SHA512
ef0f286574723f20c2b13521415e52f8d959e7b970f5b86b3cb36576917c4fbd9f0435d8057d667b217f19f17aa57575981c3b52e76b3d4d8f2a0279e28061de

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000d

Filesize
215KB

MD5
7b49e7ed72d5c3ab75ea4aa12182314a

SHA1
1338fc8f099438e5465615ace45c245450f98c84

SHA256
747c584047f6a46912d5c5354b6186e04ea24cf61246a89c57077faf96679db6

SHA512
6edf4594e2b850f3ede5a68738e6482dd6e9a5312bffa61b053312aa383df787641f6747ac91fa71bb80c51ed52a0c23cc911f063cd6e322d9a1210aea64e985

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
6d061c084d076b190a009c7668394f9a

SHA1
a38813ead1c2b048ecbb5dd5fc8ee9f38ff73b0e

SHA256
c994116acc6efc3e7e62247259a0522fa2dc300b3019ce63ae3fc847224e2a4f

SHA512
691a0bbb9d0ad058c4f7ba619a1ed82a70fb603201aac2afc395c33be1659b034d3a02db89a82dc12b55e4ffb46bb85d4e73fd78a85494d8110d48f156eff796

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
b49cfff9f7784cffd392048ec136eb30

SHA1
2de48b1928dabc04e1c7d2cd736fcac7daa1c67c

SHA256
91b7ed119ff0dad0d4f1b1546c0a3575cfba7c4902823e1b6f15283292d91a71

SHA512
33227bd5cdc24d49a156dc1bf76bfd6f137e126700df238db562b7e7a0e144b0b89e80144f87a46ac5399a30099804b1b8d38f086bfa114322da6cfdeb0c1b50

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\2d50046f-0192-4b74-90da-c2c0c65a179b.tmp

Filesize
7KB

MD5
b796b7ce94e3745a002dccc1bbc4bacf

SHA1
be2df1e921513d929bf406b1f92dd780521706b9

SHA256
1ee51c807fc31ba9be7ee4566bc1f5c40b37b6a6b39480fb51449828c8194522

SHA512
80f0ea06aa96566c0f41060e9e6a072bcf8465c01bd28bcedb7d016fb3fc275cdde12f0c7f69b8f54c8e92c942a6f93747ed1d810197373a478e1975a566feca

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
6KB

MD5
cd5841de85aa720df53ab66951c4854f

SHA1
9894b757049d1453637f9e39eda3de8ff45f2c9a

SHA256
52a9bcbbb8f2496119e28298696f475c6524071ec0c5d505a1112629b80a11fd

SHA512
73cb6ce77529a337781b6aa1bfe06d40649fcda91802416b5ab46d39f9b4bddc281cd0995e076a4f93d992fc63f6840c3cdc3ba08a26d684c83ef15e6acab116

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
7KB

MD5
90829023907b57caa74b2cdea7088ba6

SHA1
ac74e83ddd2ad243a9f71d0a62bcbfa92b3d28d5

SHA256
491f9e48ae414e1cb696474cc1134b9f6be3f38269c08fc709c14abab9f10f4e

SHA512
108b1d736de9da3f85b9831dcb9a9e422c4804b1f0611904b8d5385c21e55c9ddd8fdc5c1ff3348ad0607c5bf7f0ac4585f8e1966a99613520e5c8c40e8aa585

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
4b090845a08822d1f0c24625b3a09bbe

SHA1
ca4dd5eeae61568d2dbd6dd44057930a1b420ee1

SHA256
50d96a6211fcfd6a434712ee67ba3c3bfc4a43dadefc85382188f654aa20e910

SHA512
89225b61ded19b38af350bfe71f241eb25d0d32260f395fd11273c9b561812b74623bff56f16a0c91ba320e6fd3387a406646ae34f0bc5253a2d3efba7e8d9b2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
7ac26f661a4561d6045fd12e9de5b5ad

SHA1
80f7ca4e8e08f3c32fd643b753c4ad9624c9fd31

SHA256
aa492d7b09b44e66bfe96cc6f5e90c38c8e70541242ec7852aec265af1fff4c3

SHA512
24c2e3f1bab014e0fc43771e51d41cc86ccc7948ca28c6ad9e7827f70c910cf6fc8ea001275835e296f169719bc7bb01c14d6e05e9c171189368e31d20657f9a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
72c28d053266b795b4dcaf46062ed8a3

SHA1
06dba1e8bf462371267bdc9b661463b06f6412d6

SHA256
ce911dd06a5589d738af42eb5c9fc70446b00f5fd9bdc8529478d167d51f057f

SHA512
05fa5d9b0c51d2e270ae3aa11357b7d937e810d2a8ebbf92f88418ef56c19e4b021a7922c63aab4a8abde0334ce1bc8d6bb2fcf393846fad4e80e0815b2fe174

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
aa632121bcf9f53cba44465c67fa872e

SHA1
1efb2822243f0da25923e02f1183973af9611755

SHA256
753b01fd7cc0136332b09a281af9f9a0b5d5171ab371136c8b473c335e3ab127

SHA512
8fe7a2f87a0b6d4019fabca2d0fe65ff346cc79c92df29774ab9d9f7d85ea13c83939a5d93b70d455f6709eeb1400420d6f157bf0398606b4b9979028ffd60a2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
2372485538efa3dfd40c88e3d48217f0

SHA1
03c2ee3e24b6dc81b1d5663e9dbae8a52679cd27

SHA256
8d63f15471d4aa1da5842c3d37cbf3ec760f17f03890262161739d8e55cfc6c4

SHA512
996633e9ba6017694de06ec31739760497dceb41ab6cd4c0dceeb907cdf25c9af8f92a3daddb65091e16032995d673957ad6546444b34de5f3c3f2250ef2f98b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
af3d40ca91867564fef05a12a7c3faaa

SHA1
299c40dcb0055d5808951f65066cb9c1951da670

SHA256
ca4a2985bdb26bba8945362e91bcda79868a7abe63d91a49eec2352e4ef86fcf

SHA512
a86da8162568fa7b13bf24740fe24a94d496632b306bf893f3c8fd756a9605908d4568a13c2d8399bfc343a91ec3aab4df74380fe52bc5deae6c173d003c75a2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
cad67101330d0986fa34247faf0bed6f

SHA1
d284983a2207f665a5f9938741b509cec8d0ad01

SHA256
2cf36b52e0ae8d76c98d089b670a7a4785bdf2742b25c9b075615a7748d8283b

SHA512
3907e1f94bc950ecc0a3e203727fe503fe1728e20b9b4c58c918f9b0e84f8659389258be59b0092ede0ab4dedb9eab208b09481461c0cf0cbdc70c6039787d2f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
2457a32979060e20ce01c7451baefc1b

SHA1
c7f1b8404b803186e4239117982141f39b80e03c

SHA256
20b89c07258bdcb7d8cb3df66dfe30bc9d1477261d3e1f4840f5ec654abba3cb

SHA512
aed71baa5231f16307a4f1a7962d25af1be29607f92385479b6757d35966fd9455c6a9aed8d2a36906b249a8acf6c941d00f580548ba70675b2c0e59fd882e77

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
62ac73b5b8beb297f136cf24286c601c

SHA1
19d67432200a2af76d98b3a97ba72ab393725967

SHA256
f69032e7ae94c46e017912f633c4102728a756d32a20a256d78b469f1027b9f1

SHA512
ee33bf5e778a04d41d0a545a0a8b46b80a995b40d726b2277138ec2582e3cbe9be2b9ef1a5dd10e664127ed44ad2a297dd0b16d211dd42f39db35f8bce1b7ec6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
857B

MD5
9ef5163358d75e59676eaa00be7e75de

SHA1
d7566599f8af11a1224110763f561a292e4b2abd

SHA256
31be8cd0cd9fe9d7825d910574013b8fac1bd8bc1c28bf864cda1568e984a3de

SHA512
d69455851b5693cfa3f84323a475225065ba45737564a54de6cb9a7b77e3878418cc02c5279c1fb7936e91aa8284029b0bd5cae9939d003752438ca1d84aae6d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
1bf66dfa2d9257d9f5ae47cdf9520cf5

SHA1
39a086e4b736d60718d6961ff31e8d02247d1b42

SHA256
890e2e5a87e31f6b06d363ffc17c2a4983b6dbe7b70f7fed137e72639d015fd5

SHA512
670930357af48bca24f553e7de73a6c8ad441079b60801919328f1ea64624cc8f9ee3e1791e6e08c9ea26be8b763ed37510fecd571e0e827c2d36cef67e49726

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
9b014c6754df23dcb2de35fe56a494e3

SHA1
c1c390b3c69135824aabf0b87f24be6fae388697

SHA256
9118c2889772a7c7e374aa6249ac68893e89fa45e7bfb04ec2a94fb321f40830

SHA512
9ffa146481b2e075215369a97c99de9e6031232dc72934306e4c412b19bb0617c80b1bc7e03c1574941f21b47169edc685e4b0748d22fe016acb1825051a8f73

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
0a04479b6e87efb78d929e936e5c6fd6

SHA1
6989c731091a924f01b758970e36ea272563fa26

SHA256
a17d1b1fd002a3f73788bd3008a4d34c1984aca63434d521c9e61b606a829da7

SHA512
723b5bccab32f6d90252ad39f6f9108b26d28614cff136f5ac207a0e7a5c2d2e18d55978179d5a450483bf93b496a543b09998a75828566394c1ad11b7a2512b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
010003afabd8a9b5cbf981d77a0763de

SHA1
40d1633a640eba81e2eb52e7f214f9cba7ddcf7f

SHA256
c98f4f0e745ac110785b54360f3264567c4a00969d1579ad601e0734bf0c9dc0

SHA512
2c1d4bf0fbb51cdac758381ca19dd3834a2e18bf931efb1040dfe1c485821e33aec32adc82c53d27c1f14c1c5d412783989d7456243b455a31ceb649c708e248

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
adf20374299d8624bf0b301cb35d8a6c

SHA1
6b56d33378ce096c7f7439a890deb53f2cdfebd8

SHA256
21f9df659ba44100546b5767455ebff95ff8f330bd0bd3928ddb8fde6070fa6f

SHA512
f281a2eef8ce4bf8214d1d245f8e5ed41c260d5f7f7b95e8220d7ffb04efac4c4b4e97c626e17c489472d07f305886ab5d6a6a337ed27410d7499c7b0cbd15e5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
dbcea6f96dfc7ccbeb65a7e2f5d19001

SHA1
7d9d176bf4481299f2a70fa0fc140d497698d114

SHA256
01fa20c056f1e73148c26b7af8019fd1205a0491a74604e0c5232940fa6dfa3e

SHA512
03af5010e270d95e040158c43c61a481aeb92ea87b517c6578593362631d97cf2811c5f88290051f2712fb18d5f5976e1c44d30d2680a926287c9c1bca7d8eb8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
806408f5853031bbdf71b29b22d450f7

SHA1
7208cc9f93eceb67c51505b2e0b2c1940bdf198a

SHA256
7b93ae65bd56b4155fa3f5a7b7aa155bf88d00a212dd7c5a168e4eb4f7fc0d01

SHA512
cea78ef52db5b038bccc93647a9cd2dada66972c02fc84004d336f125ea5db0bc61d34c9dcd0c7e5f7a433dd520b1863223bed020fc4e54ff626fcdeaea1014d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
655005adfb4543298d8e5ecf94882706

SHA1
2ba5a8c5c1a982a74b729c6bf95e0ce33d2558af

SHA256
7058e91e76a8b67fc090254eadb91ad45f39b327a4cd9820ef15b20c2ddf1ce2

SHA512
4a21a619c1c43959aee5775545098d4f534c9a93416bf1a4262bdd73eb043c85398ca050e6d93e7f09806f1176347ee986b1d90621648b93e013b23e18094c38

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
677765c97dedb2e9ef293e8102579d23

SHA1
d354db67df0592e059884830219dc25f1a79b0f3

SHA256
541c1fad7fa5218ba72e151b109272517c1b224bb898e6b6e7e60efcea56479e

SHA512
f36f912f8001f827d5c22ca28dcca38e874d3041029e28669da3ae9d36078f8192121109c67dc67404d4007a5432709f27ea81bd32b39f96fd8053de2cd9a9dd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
96c6c6a9ebe24383237b93ff3d4f406f

SHA1
1925501fa8ad4d844c8e69e661f4f1ae710d4953

SHA256
ce0d6dedebe3e4fedffe7ba03603301c89e1cabb1bfb8cdec5383bf87ca1d9be

SHA512
ed2c0af0c8b93b274f9181ad737aac470d2a5b054dbe1e9ffddbe80a7acaec888dfefd89be8599f32b0608496088b7fe1460f8ceef741fff0a41c0f8f27fc25a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
69447a4f20818e55da1b8b74360c844a

SHA1
f99828b10660d7bbf6158087bdd067d700253161

SHA256
bfc82beb3cc4436895db0b0db1de6c3280d972828301e77b07705814a08509e7

SHA512
3ede523ae74429fc4912be0b57be35b32d581a645c99e64df07b9b847a92054985f3a636d837c7f5f5f6ca49dc422f95028f7c87e73b7e5409bf6ed2dafcdb6c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
b18f43ba2abda9b036966f9b7db69a63

SHA1
35844ce31bb8f41ac2b65670d82f3476bd15c738

SHA256
11e77144ec80107670ab61dd7a8d5c9f365c666219a028753b235c182eed349b

SHA512
9b16aca84654ef2272b3031ce157fe4120e8a90c5ad3928c581dff567f769536fe508cd3f513abb647417f76d978c26f4eec040e66215462d3bbd8cb242a95f7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
645bdc46046d737db382a2c2c72fce8c

SHA1
84e35f5d4659273ae8e513ab2642602f4864e183

SHA256
4f92cad9b8ae72cb701a7a3b51b0b6467f00fa7504d8a8a17a1f2f4e7f0fc179

SHA512
b554fb9977329a504346ad9e5c89aed0c28c34e5c37dc2e95eaecbb3aa643e2fa66af6bfa6546797864ccdb5ac9cca0299396ff25d585015ef8134d2f07b41ae

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
d90f4ec61a2d21fd5d5060a43a7e6bbe

SHA1
c6f2bbd7f25f91c5186d6e63c792faf3495daefc

SHA256
93c065e4d6b37fabde26d3a4af0107c6302f922f3fb3d92c95ba8636b40be276

SHA512
457dfc723daed7267a6ac42daf616ff6d728489728501b49033ce4f76130becd3cb8b2486dd0f7bfd09df02529ec520b488f0a6677caa4e675eeb587bbabae8a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
59e06153d3e38f692d8b45ac7e594855

SHA1
88ac1a1db48cc75d392dc5b7648b296da1712414

SHA256
e34631cd1041066f776de388fee1beaf01b86f93d8f82eecfcb0a7f171e1d140

SHA512
d63c2acaff113bcc87d9e44458f4a5b97a9e179a1da373c74def8abd6b63062ac61e250e5c2e5b68c55962336417effc0525fb47cbbff3a576e30ec50575daaf

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
85f104d82b19dca8bcf15152f5371978

SHA1
2a174c8cb412c2ec043681dd38ba4237f4d0929b

SHA256
fba2b20ae1554224830c40e8a757d4112de1844e8bbc2ff69fe17962ab579a5a

SHA512
05fbd78f5a092e3b216ecf39aae2c724356ddfbc23623f0510f385b77c94e1e4b1fd39f8b01780cca66c0938d3b973cd11b49fa80356dc4d2c16e128dfbbfcb8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
230d3264f8cae92a17faf13ab3e8c4ca

SHA1
c5ff3146895b6b86780e7860ffeffc3e97aab419

SHA256
8852d95e8ec7444dadceebb9a5567ec7836ad2b3f876f29b095f8c18c03c31a9

SHA512
a1fea0d5f7527cf2654e2b645e0b75b87db80b4b1bbbe5f9150647b1afa07e4e5221eae7e285d822e0957065f753e35daa0751dbc96aa4857c48b471ce2231ef

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
67239dc878e7fa627f759e3bc87cb358

SHA1
0bfa61f16d470117774ef982abb44e229f0e4976

SHA256
af8c75b16a98021b5cc127129849bb190d59f8cc30cb831a79efaccf2bd11ed9

SHA512
930b2dd7b0e1dec81f319e5ad070752023a263545da726d563752e4f18e9cf73ed7185c04be29d8be0ea8a6ef343216785a44826549d02b666f5016895de7c8e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
1a9b6531bdcc2b7b1c8166d7653d002d

SHA1
475f81d893a1b5e0e1309ee506b1c6c282f63572

SHA256
303db6167ec884e2363861e9382f359a196e4279bb5f60f2f4297bdd5fdcf03e

SHA512
087d349c7d792ef85da18fea334c70a8f4f4ac37e092c32664849d4deefcb367d82a60978dda80c9fb9290daba8a2de12d91d3f849ccc68f069c48aa05e23837

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
1602061e536a1a4c5c27d15ef89f80f9

SHA1
d57a6945bef4a34e570e8fa5371935d1ff922510

SHA256
8d67ef12da2787fb6f2644c1a44599875244f736a7112bbf0c6dd7b4ad7d531f

SHA512
04e4913dc899e4c9a2940f91aa73f873f20d156baaba25eee7036f5dac09822507292381657daf380c45b0bbee7a2a0a318678dfc1c99f3bdef3bc5a625a4a7a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
24d73c425e390e33dbedb4c5ccc42eb3

SHA1
89b75dedcdeb69388d51dda878f350858f5bb841

SHA256
68ab9aa0b0cb13809be0b4fca04d97692955ea8a7b3d5030302bc917a33a2c0e

SHA512
a29cc9494b3c8fb89d014ce3e925820fdf6264fb88fdd5dd470533bce43ea5efea536e1dcb4adfac327d491f0fec39779782152e8726664191eefd5ae2e93003

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
f54384affde285690b4b41a8dc7bd8ec

SHA1
e22457e1c890dbcfd0b39d842140e982b11a4845

SHA256
f9da555a8a06ba938095b948d7c48649755c9b3fd6dbbcc511a2448efbbdec34

SHA512
fc707f3d1d1d650d1a6c9add84c166cce642e879acb995c23d419269c66f02498c40f9da200f99ef448c5c4d6c445b01a6dfd14c52ab1c9192190750b537e6a0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
118KB

MD5
4b6b361582c2c08cb51fab110d91a7bf

SHA1
4608be974f0913e66c9a26569535c18d3fa2f871

SHA256
c441b4bf31c668761883ad8355068670ac94da2c8cb5f54207308b041d01fca7

SHA512
9b27623364af5d8aee29f6feeee7b0945e13d28695c40515697f4be411139d0fe7ff0efc6437cb8270c0a9db6b7cc3cb8626e743f50397cc4f1ff2cdca6ffb03

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
118KB

MD5
a4c30f17e36d8e84484a3c622753874f

SHA1
5c54c786a8a398ff666f18c8d97af7e4eab7a9ce

SHA256
7860bb03443282fc083d741d3a361c1352f95b207188a21834fda6e26717c8cf

SHA512
4019b1817c21e5853386800e2ab850d96d8990f240f7211c4b45509a5126f6b026591cb9c31f0139bef0e47aad895ad4dcf1c0a1d0aabf0271b3f9c9b3268f5f

Download Submit
C:\Users\Admin\AppData\Local\Temp\177979\Flows.com

Filesize
134KB

MD5
68fad415dfb15962df3683d5ce6b1a07

SHA1
86166cd7138d8f43e0e7051e5a1f9d62ce134c2c

SHA256
006e519499df5669b89f4f0262cb449b493ccbf207cd4807ce03ffac9712e756

SHA512
c8c40c2e242b8f5e9e776a078f8c33c570fbef4cc4fdc4070d68769532c6ff000fd898c9ba02cab91202fdc00f0caf1347d2a98fc666092c28956e1edf9836ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\177979\Flows.com

Filesize
925KB

MD5
62d09f076e6e0240548c2f837536a46a

SHA1
26bdbc63af8abae9a8fb6ec0913a307ef6614cf2

SHA256
1300262a9d6bb6fcbefc0d299cce194435790e70b9c7b4a651e202e90a32fd49

SHA512
32de0d8bb57f3d3eb01d16950b07176866c7fb2e737d9811f61f7be6606a6a38a5fc5d4d2ae54a190636409b2a7943abca292d6cefaa89df1fc474a1312c695f

Download Submit
C:\Users\Admin\AppData\Local\Temp\177979\Flows.com

Filesize
1KB

MD5
8f9d821f8d7a79581a2ab3a0986a78f1

SHA1
b7bf35a298f8c440c28957e54f636dd91e35e31c

SHA256
a22de98030a228592c7d75a2c6fae0a637d7b4e8a2c52da61fef50f88478a86c

SHA512
0989650bd42270d5dc15bc77f8ee01e37b8dcbb3043a623cc5c1e8fff9bba8970b149cbc57281f4facb41509455f5af684a03cf96fadaedcb50d1e0f856ab9d6

Download Submit
C:\Users\Admin\AppData\Local\Temp\177979\I

Filesize
477KB

MD5
8ce37257e647eafc2b435f2b56f2b33e

SHA1
beb990946ba7aa30d7f3f0c5242c5ff74ad2290d

SHA256
7385853f9d1e0473cffea742bdc89c69eabae19750402f7644c5e9c7274685db

SHA512
9e43b761faee231f440d405a429cdd4c45e155602988929ace1f34946951d18fd08a6b833e866642001a58b42971cee678667e5490adfb80f004a025f377e7d6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Age

Filesize
60KB

MD5
84692b422690f4852cb88836dbb1e0b0

SHA1
931fd3f161113cb84407455b7786dd63bba3c15a

SHA256
cc2f5e9bac8af1aaf86d2c004f1b2234261b6722c1b821c2153d1835372ee875

SHA512
74f5610074976dc96c6e387e9719f789b4a2c4ec0cb1cafd20452df7b268a9468672a38169c447d534261ab7b085c135828bc0c84dc5831d5c82e3cd36161fa7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Baby

Filesize
133KB

MD5
a86c655555e2e198272d833d78eb743b

SHA1
0f6bb609d65d8ae521f15f2306162e69469c57c8

SHA256
d6108619ca2f1670ef01ec58fd62d98c84877c7d6cec6075f27e7b926d71de12

SHA512
26b4319d1fd657f3e66395fd8db2b229358d487c685a4d6ac42d61c7604eb9920b2da6c16fcfd6e81ed512edc715630122fd8b9a6066ee3e96c0155ea1273eb5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Box

Filesize
71KB

MD5
1b2da465247a01a3b76472249a3d0deb

SHA1
616f32ade9272c6d240506b8a74bdcccea9304ae

SHA256
94d5c530034c5ec9506c5e3b52def91b4e79b9222d7da2b712d00fe6f002d35b

SHA512
dfe9da0f3b449c24c751d4c0cda6a0377d1070461c4f25b1900057a02108c5768e350f0c0e217716cec77001a4f629e14f64d55894ff19f73f36c3e24abbeef4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Burner

Filesize
64KB

MD5
878f18ed4b302e6c94d0a190d145f697

SHA1
c67320a66d6148485dec9075081db6957ef50e3c

SHA256
96e0e15abacaa99c9120b398a4d0c9eecfb08d789666940b74759ce913979713

SHA512
8545bcf1a979bae7c1de2aa34a5198ec772161d021e3fb302de4bb631a6796dddc9093f91b7ba14e4d41327c463bb61d2ff0b1fa8bb48c7cdc9808d5cc2f652f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Challenges

Filesize
94KB

MD5
0fd905bd29e18e664e3d3d9a6bb06ae6

SHA1
f532f1ba93228a60a483b40e4cd9c41e08877a27

SHA256
958643e7eba918e3867e1813480038d19716f39740d882755b7030ad8ac3bffc

SHA512
22416b891d9cb11adb5a5483e7eda868df6e5439ccfc635c077206c030d1814070c52718dedd3307983982d92a57b9644afd66f8e4936905da04ad4a3837f7a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Columns

Filesize
56KB

MD5
1c070e2cfeee36acf2fc7eb8c940ea66

SHA1
bb0e3d8db79e93bc732227bf3b5328c34e2dc254

SHA256
9a34487568789c5baff8a4fc46f0759d8d7cc06189ccbff928c3f6f2a0cb3cbd

SHA512
d58a8eaa563a6f092d062f5d31b16195c48b9ac5a657c8e2dbcf658c000b24bbc092d2526a4976f820318a0586037b9e707b1b2f06b8c972e34b7f767c5024c7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Flyer

Filesize
476KB

MD5
0338ef5a811b1886bc1c34f368cb2ffa

SHA1
d4c5d8a923c3271e1fd283ec1d8163b67db4dbbf

SHA256
3ddd2fe9b650e01e2f8b8940c47d5fc5039962a2f5315646c0baad6a2fdb0fa2

SHA512
8b0596bc09da58e88a959d3d73128e1db6c3095b283ee2e96be7048d055988c27b45f4a256ccaa22d489082262722900b8d01afd511efb8187153265266aced8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Franklin

Filesize
93KB

MD5
56e4414823fd2b7142284ed6d5a363b7

SHA1
64ee8eff5dc6de329ca71d2bdc8280a55dde95ba

SHA256
c5a5cfbf1ad6b80af7b467a232a5c016f8e077e5e33a84c306bea7fd3c5b319b

SHA512
6e8f863ac5473e528a6eef96c07a56bdf2cd5572f2df68cf6745d5819c367160edcb098a378ef4d7de4814aa4a09705d1d11be2aa949c44b7d56f201952881bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Ideas

Filesize
60KB

MD5
7b55e663410315b46b7c6cf9694f2608

SHA1
052f23cbbb5534826753018adc62f29cc7ae94d9

SHA256
37e34e0e46968b68e412ea504b05c5156252dae0b70e0687ba90271f04bb45d1

SHA512
dc4c6c0b7b3d633aa7d07bac7ee093867c043086bab2d0a450a726f9eef7a75f9b6406b567a1dcfbbc6d4fe87b89dfbb772f41e4aa2a90e0464edde3ea6a1479

Download Submit
C:\Users\Admin\AppData\Local\Temp\Indeed

Filesize
147KB

MD5
09c30eb57d7b8d5b6d2bed9172d72dba

SHA1
fc927ce49b240a9074d7cebc24ca184edbd8a1bf

SHA256
b321aaeea6b3b59d803228074d3d92a1f3c708c6b7ea46147c95511215cc105b

SHA512
fc34121fbbef228a8b250142cc10d47de6969f13d22d539c5e4411fe0af2c1117636413092e8fd756354b634a42f47bd6e584700ca79f8ab3113ad64f6ad2fd4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Intensity

Filesize
1KB

MD5
f61e65c8b5e558627396ed8261aee6a4

SHA1
9a35551af1d6bf2ffa97d15ec9c5b39d0f6d505a

SHA256
86d914001ade248c24ebdc8e38e39565c4f5bc2bd05deb357cae22d805707d72

SHA512
65be47472dca6c4eb8e099d54dedb8169486449832ff29ed563d632954d48789731b16fb442717efed0b5742e7a672c11e032fd4ccfde6b6e0cd77a32e8c9b92

Download Submit
C:\Users\Admin\AppData\Local\Temp\Keyword

Filesize
124KB

MD5
6349c17c75b1138329f07491744a9ed4

SHA1
840c353b3f6a3dfc0b75bb389e2d9903c98890d2

SHA256
15c91f0da6a7118a864f230d59149f8d56bf3d50404fd5b5c2b610a5dab0d293

SHA512
bea4e290e2b7a246e42facd5a987894b267881f26154d67f56b179168b1da9c9338d41f9808f63e1d0de8995c50e321e44d228d1cef761ea8faf9f159904b787

Download Submit
C:\Users\Admin\AppData\Local\Temp\Metadata

Filesize
68KB

MD5
2a0bf741f448dd30696be8f465b5b833

SHA1
b4a2c57793378236bf3c50c1fb45fcc1920fbbca

SHA256
3a3a09f732bb2b46fd1ef87e67088be5614dffe9fa661afa8acf2d7764ab7496

SHA512
269a5e255b674017086e2bc74ef8c6f7f14176e923283cbf8113ebcd5d585b485f5b43f9aec6ae9ffcdb6e8d5248c8bb70e65b3647ff7f10409938313ec96c5e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Monday

Filesize
84KB

MD5
b8eac858c394e989430167327a8ae7cf

SHA1
c7226e8012f0888b7bec48d0afade50534db1fdc

SHA256
45dd80aa6a648289f7f13b413884b6e288018c8178bce3df58c53b49e51f68fc

SHA512
5f6005be3db377c0050189d8ddab64f1e43e61f0471a6239d03af705f51cdb3d64ba3011fdb8c9c7d569cf4321f0abb13a0fcf1f088397fae390d5bcc4aaf802

Download Submit
C:\Users\Admin\AppData\Local\Temp\Mutual

Filesize
67KB

MD5
07d393f56efd3b9326606b437b71f1d4

SHA1
bd63b40e51e2e6c68a266e9f06f20b94e29c882c

SHA256
f0ef7a9e9dce3aebcf8e05805ba9c1c912c4faae9e01b9ca3efd2ec83f528414

SHA512
ad6471df9322535eb862d86cbd342ddf3e744932889972d310412b06c0a66af807f708c115232f29278c074ec9611896e91876a99ba468494bd4304a1378f559

Download Submit
C:\Users\Admin\AppData\Local\Temp\Native

Filesize
90KB

MD5
b09fe66fe9ba0c96d5f09e3cceaf61a8

SHA1
04e173e7bc1d3c632d206b2f38bdd2bac4b40a21

SHA256
b5f56cd6ac094dec19e7b1ff1ed162dc07d4ca3af7579adca5ac9c43a44640dd

SHA512
746a22266eb2c8d8d89de5dd3c605ead29d2bf0b172bdedcd6d298126dcc02522707e488c3400cd2edb7cd0265a7e12212b16ff336f148a39a252055c653a959

Download Submit
C:\Users\Admin\AppData\Local\Temp\On

Filesize
114KB

MD5
6c1c4f39f2bb55057641898e3d376930

SHA1
b43b16c85687517d3dd83f82b6b421304f7e628d

SHA256
48e5d116dc1494dbd8905eec10832aa7ce19f4f812d91514ab6fce5ce6f57cf7

SHA512
ff4ee5c654f50bea1fb92ace656c952ef573759f08ce072468d5029e6c38d77609a200de54f49c68c9fecf6ed515dd2864ba3acb1a5ce523d6a3efae9745a3f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Peak

Filesize
30KB

MD5
20718b8b13d6d0de153980d6759d39e5

SHA1
d3ac2a4ea8dcbe0f74f4ac148c4567aeb6f707ad

SHA256
abaa9a49fce5f6ee29eb407c9aa85961ab8f256a322e3309cf7c874ef7a56e9b

SHA512
2864b793a479410ea6ba152490ff313e40a6357444245fb4935777d9ebf854918bc5ddbf8d4b3d348a94b5931501664cc1d41b5617b10e62bdd24efba60fd0fc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Scheduled

Filesize
56KB

MD5
99b09fb9fba65c428078b8ccd89f90ea

SHA1
c1ec375fa1c9ac8323fa156596ff7694b4b18dc4

SHA256
86bc96aaf2de8304b80d0ee08ea403686c2dca2c5c623eb7692ab85b41217910

SHA512
8fe7a7ed45a52ce4b6b0b0a325349d14598953f056f331d4aba128c11dbcf06f6b1f1ee58e92dcc7f7569e60fc97561118841dba8a77b0c32e2ee95dde964e24

Download Submit
C:\Users\Admin\AppData\Local\Temp\Three

Filesize
19KB

MD5
2e94c6d5accc6a1afec513fc9bffce73

SHA1
f58f072d322645b8160adf57e4de7383dd5668c6

SHA256
6f8378f9fbde1d7f59f5ff455f8aab61eea7fa7c591f05bf88f761be2cbaeb65

SHA512
c62b03e9320333c174b04988d33af71dfbd9a37aaa8518847a2bf14a29a1c761481c6869d59b7f089a775cc06f023fc93c5924da47f2ca25fb696e4fccfd4ffe

Download Submit
memory/4876-544-0x0000000004F80000-0x0000000004FDB000-memory.dmp

Filesize
364KB

Download
memory/4876-541-0x0000000004F80000-0x0000000004FDB000-memory.dmp

Filesize
364KB

Download
memory/4876-543-0x0000000004F80000-0x0000000004FDB000-memory.dmp

Filesize
364KB

Download
memory/4876-542-0x0000000004F80000-0x0000000004FDB000-memory.dmp

Filesize
364KB

Download
memory/4876-545-0x0000000004F80000-0x0000000004FDB000-memory.dmp

Filesize
364KB

Download