lumma | hxxps://facelessb[.]com

Analysis

max time kernel
105s
max time network
107s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
28/01/2025, 11:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://facelessb.com

Score

10^/10

lumma discovery stealer

Malware Config

Extracted

Family

lumma

https://toppyneedus.biz/api

Signatures

Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Lumma family
lumma

Executes dropped EXE 1 IoCs

pid	Process
3284	Entity.com

Enumerates processes with tasklist 1 TTPs 6 IoCs

discovery

Process Discovery

T1057

pid	Process
1916	tasklist.exe
2040	tasklist.exe
2368	tasklist.exe
4848	tasklist.exe
3704	tasklist.exe
3308	tasklist.exe

Drops file in Windows directory 35 IoCs

description	ioc	Process
File opened for modification	C:\Windows\EarSegments	Bootstrapper.exe
File opened for modification	C:\Windows\AhStrength	Bootstrapper.exe
File opened for modification	C:\Windows\ConsortiumCarriers	Bootstrapper.exe
File opened for modification	C:\Windows\SpDover	Bootstrapper.exe
File opened for modification	C:\Windows\ConsortiumCarriers	Bootstrapper.exe
File opened for modification	C:\Windows\AhStrength	Bootstrapper.exe
File opened for modification	C:\Windows\DeeplyNet	Bootstrapper.exe
File opened for modification	C:\Windows\AhStrength	Bootstrapper.exe
File opened for modification	C:\Windows\ConsortiumCarriers	Bootstrapper.exe
File opened for modification	C:\Windows\ConsortiumCarriers	Bootstrapper.exe
File opened for modification	C:\Windows\SpDover	Bootstrapper.exe
File opened for modification	C:\Windows\DeeplyNet	Bootstrapper.exe
File opened for modification	C:\Windows\DeeplyNet	Bootstrapper.exe
File opened for modification	C:\Windows\AhStrength	Bootstrapper.exe
File opened for modification	C:\Windows\SpDover	Bootstrapper.exe
File opened for modification	C:\Windows\EarSegments	Bootstrapper.exe
File opened for modification	C:\Windows\SpDover	Bootstrapper.exe
File opened for modification	C:\Windows\SpDover	Bootstrapper.exe
File opened for modification	C:\Windows\SpDover	Bootstrapper.exe
File opened for modification	C:\Windows\ConsortiumCarriers	Bootstrapper.exe
File opened for modification	C:\Windows\AhStrength	Bootstrapper.exe
File opened for modification	C:\Windows\DeeplyNet	Bootstrapper.exe
File opened for modification	C:\Windows\EarSegments	Bootstrapper.exe
File opened for modification	C:\Windows\EarSegments	Bootstrapper.exe
File opened for modification	C:\Windows\EarSegments	Bootstrapper.exe
File opened for modification	C:\Windows\AhStrength	Bootstrapper.exe
File opened for modification	C:\Windows\DeeplyNet	Bootstrapper.exe
File opened for modification	C:\Windows\DeeplyNet	Bootstrapper.exe
File opened for modification	C:\Windows\SpDover	Bootstrapper.exe
File opened for modification	C:\Windows\AhStrength	Bootstrapper.exe
File opened for modification	C:\Windows\DeeplyNet	Bootstrapper.exe
File opened for modification	C:\Windows\ConsortiumCarriers	Bootstrapper.exe
File opened for modification	C:\Windows\EarSegments	Bootstrapper.exe
File opened for modification	C:\Windows\ConsortiumCarriers	Bootstrapper.exe
File opened for modification	C:\Windows\EarSegments	Bootstrapper.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 37 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bootstrapper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bootstrapper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	extrac32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bootstrapper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bootstrapper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	extrac32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Entity.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bootstrapper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bootstrapper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	extrac32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bootstrapper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
3908	msedge.exe
3908	msedge.exe
4976	msedge.exe
4976	msedge.exe
4992	identity_helper.exe
4992	identity_helper.exe
4748	msedge.exe
4748	msedge.exe
3284	Entity.com
3284	Entity.com
3284	Entity.com
3284	Entity.com
3284	Entity.com
3284	Entity.com

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	2040	tasklist.exe
Token: SeDebugPrivilege	2368	tasklist.exe
Token: SeDebugPrivilege	4848	tasklist.exe
Token: SeDebugPrivilege	3704	tasklist.exe
Token: SeDebugPrivilege	3308	tasklist.exe
Token: SeDebugPrivilege	1916	tasklist.exe

Suspicious use of FindShellTrayWindow 47 IoCs

pid	Process
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
3284	Entity.com
3284	Entity.com
3284	Entity.com

Suspicious use of SendNotifyMessage 27 IoCs

pid	Process
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
3284	Entity.com
3284	Entity.com
3284	Entity.com

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4976 wrote to memory of 3480	4976	msedge.exe	84
PID 4976 wrote to memory of 3480	4976	msedge.exe	84
PID 4976 wrote to memory of 3132	4976	msedge.exe	85
PID 4976 wrote to memory of 3132	4976	msedge.exe	85
PID 4976 wrote to memory of 3132	4976	msedge.exe	85
PID 4976 wrote to memory of 3132	4976	msedge.exe	85
PID 4976 wrote to memory of 3132	4976	msedge.exe	85
PID 4976 wrote to memory of 3132	4976	msedge.exe	85
PID 4976 wrote to memory of 3132	4976	msedge.exe	85
PID 4976 wrote to memory of 3132	4976	msedge.exe	85
PID 4976 wrote to memory of 3132	4976	msedge.exe	85
PID 4976 wrote to memory of 3132	4976	msedge.exe	85
PID 4976 wrote to memory of 3132	4976	msedge.exe	85
PID 4976 wrote to memory of 3132	4976	msedge.exe	85
PID 4976 wrote to memory of 3132	4976	msedge.exe	85
PID 4976 wrote to memory of 3132	4976	msedge.exe	85
PID 4976 wrote to memory of 3132	4976	msedge.exe	85
PID 4976 wrote to memory of 3132	4976	msedge.exe	85
PID 4976 wrote to memory of 3132	4976	msedge.exe	85
PID 4976 wrote to memory of 3132	4976	msedge.exe	85
PID 4976 wrote to memory of 3132	4976	msedge.exe	85
PID 4976 wrote to memory of 3132	4976	msedge.exe	85
PID 4976 wrote to memory of 3132	4976	msedge.exe	85
PID 4976 wrote to memory of 3132	4976	msedge.exe	85
PID 4976 wrote to memory of 3132	4976	msedge.exe	85
PID 4976 wrote to memory of 3132	4976	msedge.exe	85
PID 4976 wrote to memory of 3132	4976	msedge.exe	85
PID 4976 wrote to memory of 3132	4976	msedge.exe	85
PID 4976 wrote to memory of 3132	4976	msedge.exe	85
PID 4976 wrote to memory of 3132	4976	msedge.exe	85
PID 4976 wrote to memory of 3132	4976	msedge.exe	85
PID 4976 wrote to memory of 3132	4976	msedge.exe	85
PID 4976 wrote to memory of 3132	4976	msedge.exe	85
PID 4976 wrote to memory of 3132	4976	msedge.exe	85
PID 4976 wrote to memory of 3132	4976	msedge.exe	85
PID 4976 wrote to memory of 3132	4976	msedge.exe	85
PID 4976 wrote to memory of 3132	4976	msedge.exe	85
PID 4976 wrote to memory of 3132	4976	msedge.exe	85
PID 4976 wrote to memory of 3132	4976	msedge.exe	85
PID 4976 wrote to memory of 3132	4976	msedge.exe	85
PID 4976 wrote to memory of 3132	4976	msedge.exe	85
PID 4976 wrote to memory of 3132	4976	msedge.exe	85
PID 4976 wrote to memory of 3908	4976	msedge.exe	86
PID 4976 wrote to memory of 3908	4976	msedge.exe	86
PID 4976 wrote to memory of 2388	4976	msedge.exe	87
PID 4976 wrote to memory of 2388	4976	msedge.exe	87
PID 4976 wrote to memory of 2388	4976	msedge.exe	87
PID 4976 wrote to memory of 2388	4976	msedge.exe	87
PID 4976 wrote to memory of 2388	4976	msedge.exe	87
PID 4976 wrote to memory of 2388	4976	msedge.exe	87
PID 4976 wrote to memory of 2388	4976	msedge.exe	87
PID 4976 wrote to memory of 2388	4976	msedge.exe	87
PID 4976 wrote to memory of 2388	4976	msedge.exe	87
PID 4976 wrote to memory of 2388	4976	msedge.exe	87
PID 4976 wrote to memory of 2388	4976	msedge.exe	87
PID 4976 wrote to memory of 2388	4976	msedge.exe	87
PID 4976 wrote to memory of 2388	4976	msedge.exe	87
PID 4976 wrote to memory of 2388	4976	msedge.exe	87
PID 4976 wrote to memory of 2388	4976	msedge.exe	87
PID 4976 wrote to memory of 2388	4976	msedge.exe	87
PID 4976 wrote to memory of 2388	4976	msedge.exe	87
PID 4976 wrote to memory of 2388	4976	msedge.exe	87
PID 4976 wrote to memory of 2388	4976	msedge.exe	87
PID 4976 wrote to memory of 2388	4976	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://facelessb.com
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9ed1c46f8,0x7ff9ed1c4708,0x7ff9ed1c4718
  2⤵
  PID:3480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,8383620255027895851,5533642885873461589,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:2
  2⤵
  PID:3132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2068,8383620255027895851,5533642885873461589,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2068,8383620255027895851,5533642885873461589,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2664 /prefetch:8
  2⤵
  PID:2388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,8383620255027895851,5533642885873461589,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:1176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,8383620255027895851,5533642885873461589,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:4632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,8383620255027895851,5533642885873461589,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4160 /prefetch:1
  2⤵
  PID:2816
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,8383620255027895851,5533642885873461589,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5272 /prefetch:8
  2⤵
  PID:4384
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,8383620255027895851,5533642885873461589,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5272 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,8383620255027895851,5533642885873461589,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5484 /prefetch:1
  2⤵
  PID:2848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,8383620255027895851,5533642885873461589,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5480 /prefetch:1
  2⤵
  PID:2244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,8383620255027895851,5533642885873461589,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5316 /prefetch:1
  2⤵
  PID:4748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,8383620255027895851,5533642885873461589,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4700 /prefetch:1
  2⤵
  PID:3188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,8383620255027895851,5533642885873461589,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5424 /prefetch:1
  2⤵
  PID:2836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,8383620255027895851,5533642885873461589,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5688 /prefetch:1
  2⤵
  PID:4244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2068,8383620255027895851,5533642885873461589,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=4812 /prefetch:8
  2⤵
  PID:4708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2068,8383620255027895851,5533642885873461589,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6312 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4748

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4916

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2648

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2060

C:\Users\Admin\Documents\Release\Bootstrapper.exe
"C:\Users\Admin\Documents\Release\Bootstrapper.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2648
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c copy Soldier Soldier.cmd & Soldier.cmd
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4340
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2040
- - C:\Windows\SysWOW64\findstr.exe
    findstr /I "opssvc wrsa"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1376
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2368
- - C:\Windows\SysWOW64\findstr.exe
    findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2232
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c md 18197
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1712
- - C:\Windows\SysWOW64\extrac32.exe
    extrac32 /Y /E Marriott
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2856
- - C:\Windows\SysWOW64\findstr.exe
    findstr /V "Ata" Provisions
    3⤵
    - System Location Discovery: System Language Discovery
    PID:316
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c copy /b 18197\Entity.com + Happens + Hull + Bare + Months + Tions + Yourself + Costumes + Particles + Collaboration 18197\Entity.com
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3704
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c copy /b ..\Grass + ..\Mcdonald + ..\Blue + ..\All + ..\Achieve + ..\Rape + ..\Relative P
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2688
- - C:\Users\Admin\AppData\Local\Temp\18197\Entity.com
    Entity.com P
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:3284
- - C:\Windows\SysWOW64\choice.exe
    choice /d y /t 5
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2856

C:\Users\Admin\Documents\Release\Bootstrapper.exe
"C:\Users\Admin\Documents\Release\Bootstrapper.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2976
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c copy Soldier Soldier.cmd & Soldier.cmd
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1544
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4848
- - C:\Windows\SysWOW64\findstr.exe
    findstr /I "opssvc wrsa"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3484
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3704
- - C:\Windows\SysWOW64\findstr.exe
    findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4836
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c md 18197
    3⤵
    - System Location Discovery: System Language Discovery
    PID:920
- - C:\Windows\SysWOW64\extrac32.exe
    extrac32 /Y /E Marriott
    3⤵
    - System Location Discovery: System Language Discovery
    PID:848

C:\Users\Admin\Documents\Release\Bootstrapper.exe
"C:\Users\Admin\Documents\Release\Bootstrapper.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4420
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c copy Soldier Soldier.cmd & Soldier.cmd
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3556
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3308
- - C:\Windows\SysWOW64\findstr.exe
    findstr /I "opssvc wrsa"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3624
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1916
- - C:\Windows\SysWOW64\findstr.exe
    findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:652
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c md 18197
    3⤵
    - System Location Discovery: System Language Discovery
    PID:456
- - C:\Windows\SysWOW64\extrac32.exe
    extrac32 /Y /E Marriott
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3632
- - C:\Windows\SysWOW64\findstr.exe
    findstr /V "Ata" Provisions
    3⤵
    PID:4664
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c copy /b 18197\Entity.com + Happens + Hull + Bare + Months + Tions + Yourself + Costumes + Particles + Collaboration 18197\Entity.com
    3⤵
    PID:3864

C:\Users\Admin\Documents\Release\Bootstrapper.exe
"C:\Users\Admin\Documents\Release\Bootstrapper.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3744
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c copy Soldier Soldier.cmd & Soldier.cmd
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4556

C:\Users\Admin\Documents\Release\Bootstrapper.exe
"C:\Users\Admin\Documents\Release\Bootstrapper.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4368
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c copy Soldier Soldier.cmd & Soldier.cmd
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3892

C:\Users\Admin\Documents\Release\Bootstrapper.exe
"C:\Users\Admin\Documents\Release\Bootstrapper.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4876
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c copy Soldier Soldier.cmd & Soldier.cmd
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4340

C:\Users\Admin\Documents\Release\Bootstrapper.exe
"C:\Users\Admin\Documents\Release\Bootstrapper.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4264
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c copy Soldier Soldier.cmd & Soldier.cmd
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4316

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8749e21d9d0a17dac32d5aa2027f7a75

SHA1
a5d555f8b035c7938a4a864e89218c0402ab7cde

SHA256
915193bd331ee9ea7c750398a37fbb552b8c5a1d90edec6293688296bda6f304

SHA512
c645a41180ed01e854f197868283f9b40620dbbc813a1c122f6870db574ebc1c4917da4d320bdfd1cc67f23303a2c6d74e4f36dd9d3ffcfa92d3dfca3b7ca31a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
34d2c4f40f47672ecdf6f66fea242f4a

SHA1
4bcad62542aeb44cae38a907d8b5a8604115ada2

SHA256
b214e3affb02a2ea4469a8bbdfa8a179e7cc57cababd83b4bafae9cdbe23fa33

SHA512
50fba54ec95d694211a005d0e3e6cf5b5677efa16989cbf854207a1a67e3a139f32b757c6f2ce824a48f621440b93fde60ad1dc790fcec4b76edddd0d92a75d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
288B

MD5
edcec1f795d78959394bf5fb6fb44a45

SHA1
3dbc7363f517c300690548af048d407f2569ab20

SHA256
70a3247ca264536df72602935dee2699ddda95be0cb5043fe7aa817c9a8cbf50

SHA512
86194073e8b5cbe76d174f21d02383a265aa5ac22ec02725224e02221fb6211ba10d1a3adb514463c443d5e0711a353bd52f891b8847515e95f5308e2f6340e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
500fa9825a029b2077189f663459418c

SHA1
60c478ec9c5ce97d4291d2ea0c287b6717525828

SHA256
6ee899cb93b5a0870fd261debf66f9dc8a0fe5a5eb68ded27db127a041f3b267

SHA512
d186d2a09b5d6e41b4ef37c69210c71331652336cbd6fe3bd4f47293bcb8262ccd6ceaaba1f54bf47fa2211bdc65d5d7141af7f09e2faa01990972fd4d9cd77f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
39250133900c7b56281b800817511e64

SHA1
bbf9e8ce9605a631d077f705feac2b1bd69f0ceb

SHA256
a8fd11543b0ae37c01280b438412aad9b0f1e035144b3487a1e4f7af1aa7d5d9

SHA512
9db1a157499b7237ecba44e069bc112aea46dd1b90b8a3edf5aeff6e8f31e355b127bb437f1c2574f7d9f2ac630dabb3cb389a1ff39a5ffda12976810500ecdd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
68bf6ae62b5c3ad1d105851359c493c1

SHA1
a6ee8b2ddb764ca1bf0138ada1911d1d5c2c9bad

SHA256
7d869017ab5a929237cee995b42109bd2c53ce64a2d53939030c6c3dcb8cf00f

SHA512
82459c9c11583a69caf0c1185b5827f47f552ab55d1864d8d4f70fced8df1821bec94e1d3a3cb25ef367d5cb990d1260081026ff058a9662e2afb92ca2b1fb38

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f1a6e73b5f0b8ce5c19d32e2cb530239

SHA1
1df07cbe7759a8b0cfd82eaf915675ebb193dad6

SHA256
2679e67bf93a4cbcd96ab3760d7c0425dbf369191ad7b1b173f302c120d564ef

SHA512
6344ed29329de5a073e8331d004964f438110ef514b117c40a555b2fb848c7a9a53cc9f50512c334d9c94464850d51f7109741e0b10f64321398e70c1273d4e0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57da24.TMP

Filesize
707B

MD5
e46b13786df6a3fef3c85c8a6c6b8da6

SHA1
bbac5ad845b7594ce2c3347d4f0582c2787b0b96

SHA256
37173146d716e5cf015beed552e397aef101c1af5c39eb0caed418aba94892c9

SHA512
2314ba791da144164cf5f5057f45e56ff5386326db5b01ac5cdb328f8130e577f5470493b96cf11725b87dbdd660adf1ec7afc750a3b6c4c276750e988771e23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b5b51cdd-6f75-414c-9fc3-643f08091f53.tmp

Filesize
1KB

MD5
62f9c5ececb632b5156f8e55d021bd59

SHA1
c8473b9b4e5b7173066c45a96a409d4907e8fb49

SHA256
5548beefbbefbd9ffd66a2cbd694f760c039b8d18ea26c866b1d46328aefe112

SHA512
c412304bfa585c53ee59f8fb181dea9f3585930190b16a6ce97551379dc127c1c91553c1ca5854267b2b202f80ec862d42679aa9df5ad6e896950ab443c4881b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
43ca751369f64b79364448b31d1daa40

SHA1
d453f0a8cb940f778e48d653e226806cb046ca5d

SHA256
210ed9612129fa530173f2d5320b0cdd8fe3dea97a107e0e28ac127e90186f5a

SHA512
6a48ed8834a88abe87b77d3c2bb574583ca8c0eea0e62718ffc0d8e0718d7b6abb3e39acd4108771235039583079f0a2d70e2ca9f9563c6ae2a44f4c15051e85

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
0ba4cdb725ef1a9ae845ab70df0d2ac4

SHA1
19e1877e703b8fff15cf047008cebf7024701dd3

SHA256
a08d62392c2df57d6593680241bbb0f66aec87afb9317a37ad6d96356bc50768

SHA512
3b033e768b09a5810fef3ff1a8fd02347120bba4048e03b945e74fa9ad5c57a9eddeb7f938c934480a62bef7c87ff5529747ce5b630bcbffc25882fb11265171

Download Submit
C:\Users\Admin\AppData\Local\Temp\18197\Entity.com

Filesize
1KB

MD5
97f3d19121998df330656f74ace15fa0

SHA1
e4f3e6a33aaf592555af926162d2849dfcffbfc4

SHA256
928df740c612c380f3bc7b9be4e45ace86886fd7636cfc1062e9cf4942e6c001

SHA512
72264f9f1bf689c1211020e3fa592899cdb22b8bbcab43c7308ed03d0158da86bf831b497b4713aa8c396c42cd28b85ebb04d7adee7822dc18466cba1661a6ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\18197\Entity.com

Filesize
925KB

MD5
62d09f076e6e0240548c2f837536a46a

SHA1
26bdbc63af8abae9a8fb6ec0913a307ef6614cf2

SHA256
1300262a9d6bb6fcbefc0d299cce194435790e70b9c7b4a651e202e90a32fd49

SHA512
32de0d8bb57f3d3eb01d16950b07176866c7fb2e737d9811f61f7be6606a6a38a5fc5d4d2ae54a190636409b2a7943abca292d6cefaa89df1fc474a1312c695f

Download Submit
C:\Users\Admin\AppData\Local\Temp\18197\P

Filesize
510KB

MD5
f54b58971255cd8bb39ac18ff2ef023c

SHA1
baae7a9c556141100c5c4ec7a58c4bd5107af00c

SHA256
3dd7212a8d4123a619aad6cd2ac66f23860a9b398ce5543cfa60937796b717d1

SHA512
51f7d10a3833ce810a8aab40c29971e9e0df36737080904952e2ac2f2c999677018524d92d79044b5e699c1561ffd23970642c2de3aad6f6df7959392d2a9022

Download Submit
C:\Users\Admin\AppData\Local\Temp\Achieve

Filesize
87KB

MD5
6b4b3d1f08334eb101b77825c2e69a0f

SHA1
5ed3cd04f8c243329e0c1df244b5557e13b9a195

SHA256
0cc867c5cc3820b661715316fc7f9cc81a3aa0633636591ad625976a7546cbd4

SHA512
c1603a50fb6967af91407a849d57d0f4816f330b6f822c85bc77a84c1a18a7197c19ce490d236bafede117c26d72a8c6144c142ddfb9661d546a596ab3bb982c

Download Submit
C:\Users\Admin\AppData\Local\Temp\All

Filesize
93KB

MD5
6c8bc112df167396aebb49ea6e22f7b4

SHA1
747ae9e043ac1c383a54053f4035231ed233d040

SHA256
2c1fc99f7b576b4882e4f01d22acdf1bda4dbccb91f3fdd8c09cf39c2f2af54b

SHA512
376fd2b86b2a1729d8150e2dbb040d2ca84a4619b75944d10749a3c1df089e565ec4cc5021785c34baa243ff2a8b57cd63967d3c414ec08552e33032bfe22ccd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Bare

Filesize
107KB

MD5
e764237ece1583e546938d1f422e80fa

SHA1
b8cf83ade7e9a4c6bdbde6d87bcc5c81b861ad67

SHA256
c8366f16c835d58d9ef9b923c1f7654ba366605803080ba4a31e6d964403f163

SHA512
62a3d679507ea306ddd3965008c7a685198f057a6ec4def4c28e6aafe610901f5acaa14b86ba00f2c51e31eed8f8c18db168cb9a8f4fddc968f738b62c475b80

Download Submit
C:\Users\Admin\AppData\Local\Temp\Blue

Filesize
77KB

MD5
69cef765fd888bf92d8fe00d5939503f

SHA1
3a3b162245f0b6e145a33056b753f365c0d2f962

SHA256
62c493a3f99320021b2c243c1031b4f544fd839dcc5779f75127b8c718468292

SHA512
2a1308618c299fe16e9818b0e37843321ba8979844b22f5cfec2d7a5b4abf22b5e4e706db100e35c7ff61c32b0d9650caf5c5caa7a89869d8be14d062177ee14

Download Submit
C:\Users\Admin\AppData\Local\Temp\Collaboration

Filesize
99KB

MD5
75c9533f649fc53f15fe66ad1e660837

SHA1
230640e4a5f5d11e34f93ab9268c5f2f434cf904

SHA256
7ebaf5353216d2b73bd4f9a6051a6bf6be84dadee78d99f116fa3b5ca50e9be6

SHA512
0895875b762795ece7c6682cf4055b67860c5464d56221db5754c67a2d29d7061f624e86613cb253a2f07bb5405e9454679a30f27b0a0859550d587a65cce6ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\Costumes

Filesize
135KB

MD5
3e6ac35562b5e256ac96255b65d73dc8

SHA1
7b75834345ab18fc06238425422081659f609dc2

SHA256
763d432416f8fa79a907904f2a118b4dd13b6b20d173564398bc430d4c3ae15e

SHA512
4fd0deb65ef349496432ed3b95f1ceeae41e10880a283b63a01eca62cac406afc496cdf17b60b0c8915f010149906f4aa5eeb89dd3aea0ace1fe15c8001d8f0e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Grass

Filesize
71KB

MD5
ada59761b1e7e24fc5d82a8d86b2c0fb

SHA1
2ff93f9c77edf53a994876a1526c8c042c24cdae

SHA256
bb4ec0fbe1f5e92e4d1b389119685d766c89722304525aa554bafdc2d04da778

SHA512
429d928fc8336c7e38767b2cd336cf3b493c43b89ee9f39ceacb617490e00a730e0c9acf5340d940a6d02f5579c785df4c6001009527ab85183041154430fba6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Happens

Filesize
65KB

MD5
0dde3c7228dba2b77766f9a8fa8c3b8e

SHA1
8538a5646283374c9249048033227f5e78d13496

SHA256
341acf8c01839083d72f47bea36d026a8ba2e2cf73703582d1c7dc1918e89e9b

SHA512
5f6abf298608321e493d14ba320140e0f43f96dd338877f10717c869deddef6b02d00d3929db5ba7637a3cc37cac9904032c685ac325ae7db413c8d9177e6e5d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Hull

Filesize
67KB

MD5
52bf5b80ff9b4153ddc294a6d7ea7ea9

SHA1
0d49562bbf835317350d2c5e1e3992d4c7963c1e

SHA256
c7c0fcf2a92b4da6aa9b1a9cf47792982858b1e59d317a6a4e1fec821ad346ca

SHA512
020cab9b98389ffe0da1b129d82b075d0198bab6554cc61756a8da6f3ff11fd5fdbf2cb5bf55ba12eeae4a977858beebc16bf8c2d90f102ba84663a250e2666a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Marriott

Filesize
477KB

MD5
52c85a3d9b4754d17283c58a62ee8e3e

SHA1
aac7f37b3ecced2acacfdf40b1a1e47e0b45183b

SHA256
38ff935f856d0f54ccaf8c01d5419dbc01239f5bc237b6e67c5eace70b766feb

SHA512
3e2fe806494844f9e53a0f1d5d4b777ca159a35e7c79612aea33661ef5049a35c13e904ea8710f904e3381e13022dc9b07ba47d223279dde671ee97570361dbb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Mcdonald

Filesize
77KB

MD5
ca700ead25ff1da0f3d15b3d4f03d625

SHA1
81ea4585cfafb905c4651019e3dbff36cfb775d2

SHA256
8cb81f9d5f389af49c624740ecf5bd523b9ec52fd95f4d1969f27355ffe616d2

SHA512
27086627d9ecf16e3c5e42c510fe0906d54d7c306abba6a89f1f97bc7f2f12f8d1e6b3cff2e869d672495ba4cd76e00bebac44179e74a406157e9d4ff36bf533

Download Submit
C:\Users\Admin\AppData\Local\Temp\Months

Filesize
136KB

MD5
4cdf3e57d3d57e973cca232bacb9a4b7

SHA1
20daf5a36abe40beafbf17a974754413331095d1

SHA256
59fd8c96ea34e60c3ba49b9912748f8106625858bbfdbcf68d0943153a54cc7d

SHA512
08fd4833009f0f76e6c7173861743c81c57e86c54369e428d89d776c7eb843c52e854270acdfe3bb61afe2d6b5bbb8a32af5487c72a346cddb727267e6cfc4b1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Particles

Filesize
80KB

MD5
9332a8e5d5a1f8fe99ac9de9b71546b0

SHA1
5799e7b5424f4768c18ba72319886f64f4836ad6

SHA256
11de444a146e62366fd2864722a3af8e8a62359c2428925dfefd12f363112803

SHA512
7a801916d043547c333111181cdd6e7da46bd64716bd19bc97e550106aa11eb10f7ed1e46701ae0b1e60fa4747875b3d615e8201705100ec941af12988f54380

Download Submit
C:\Users\Admin\AppData\Local\Temp\Provisions

Filesize
1KB

MD5
a0fc1422e0cf1a4cd14ed9f114d885e6

SHA1
dfd7573bf9dd59a0e257d2723c81346f4016a150

SHA256
d1fb7899c63cc1360d05b21982b9623b9657193a0e8324f1704112836e438f26

SHA512
a6e28ace7c60c1f632aa1734fc3558ac86a56d061f0e84985c3e4b5881a595151601330a47dcffe691874530448af9f82368ea6a2a3d4d62c233b22924411ba5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Rape

Filesize
79KB

MD5
6e5a79d066f430b2f930a37e9901edd0

SHA1
a1b559e638abeb712ee9327c539feacc4c6d0733

SHA256
b9b99475630ed98e97a79a4bd9606b7a528fc1dec7a6fe043c3f0ff346b0b97b

SHA512
b125a9241cf88d9bed5245d8987ec07c586882b06bb082d0bd4daa57d745322ed0c905e5e65eecda2f7364bf79acda55435106d4608b648d0d4e09e3900f1b91

Download Submit
C:\Users\Admin\AppData\Local\Temp\Rape

Filesize
80KB

MD5
da60afd0e7846475eb467a411c9d93e3

SHA1
30b04a96b1af7da59e37ae1a0be7438c8593259d

SHA256
7676d619230abd2a2ec536953ef7e14a659fa053fe84edc2e15cc65620f0c8c4

SHA512
0081a63e70ed1f268468ea0ff48e051c9777b8666d9c401d028d248940ab1e1bba6142a844afbbb4325d76757ba10f7ddf802c06e84eece1773a35553280b432

Download Submit
C:\Users\Admin\AppData\Local\Temp\Relative

Filesize
15KB

MD5
2579792b1bb97a77e0f7f44b52956a7a

SHA1
6991d328554df7a83059c6e9f921172aae280853

SHA256
88da3370920548a4e13c3c2832c76cf4a74ac4290309edb9598e7060645a4cbd

SHA512
5bb94bc03fb926201d29a960f6b037e41c5308e7380d29232d9ffec185da782ce5dc6826f4ec394bd897f7983f6c3bf47252b4e0226c8e02d769768a9ef53413

Download Submit
C:\Users\Admin\AppData\Local\Temp\Relative

Filesize
25KB

MD5
0fdde19700b205ff67a80f76e415599c

SHA1
de247cb1f2e6ad764154d147aa4bb12697135e0d

SHA256
5bdb5ed74359d61db52dc3e7d3cc20860537c4a26d0128342f56ef604e314140

SHA512
e182dd2582d6ddb983fa0c2ba3e2b224f21d4de8097501d120214eeb811575d622f4783bf77a8282fe34e081bae3037fd1803416ba24976143e91bcfeeb24cab

Download Submit
C:\Users\Admin\AppData\Local\Temp\Soldier

Filesize
30KB

MD5
9b93917559bc9b0c222e0786dafbf76f

SHA1
2b3f3278e3444988c2332a4af4d2ddb9991aee5e

SHA256
d0e7e1b0847f8ecbedfa44d1536b1499e5c80df10c3c83e216c0475445e34572

SHA512
e7b3fbf3103ce0e0440f85b6fc90e3f8c14a71cc4b20357c91c1fde5d9197005a9235ed1bf51a1f2d72f594d6d4594e3e859b25a650012de9c66ee6f15ceae7c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tions

Filesize
109KB

MD5
30ef3a43367b3fe394ebb6a225a362d9

SHA1
bc4b81ea0bfa71bd59980dfddc199fe35a2a8325

SHA256
16f534c2c196a0d78a61d099d034257dd41fcf9d07d422738c3079b85165918c

SHA512
12748e178776bb1fdee515f0c0ca6f81494c08b2e9bd9ffa1e4acb751b956dc91af3d6861b04c13d6ccf1448483a7d5c67913975f2165a19bbe16a6532bc38bf

Download Submit
C:\Users\Admin\AppData\Local\Temp\Yourself

Filesize
125KB

MD5
0aae4fc7f27d4e7aa26a26c6845e4c73

SHA1
fe66162004af2f417114d864694159168b14e403

SHA256
446845e5b7b23d1d2364e1ce022a9b55737305cf5ac03f15d040271ef2033ff5

SHA512
9fc10812f441721aee3ea1b661a3621db7b71ac55edab0bae9ca81c38c0305fd26be1d54629fadc219d165ef2b63b782653e5baa0226d06be79fcdb901d984c0

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 409521.crdownload

Filesize
12.4MB

MD5
ba6be4ee39ca787a2fdbe122b1cc9c72

SHA1
bb8e3811299b35105b0d54ec3a83df351ace9f74

SHA256
a2b80cd39677cd1b145c8836cb5103165807a721d6eaab188047a2660afe524d

SHA512
1c8663e5d5864602783871df8a484fd4d7088e6f6e4fe6b4e15f49aa007ab496f682d4112840f9e42605c0049661c5704d109f7646e164d688c3b8ca60eece28

Download Submit
memory/3284-975-0x00000000042D0000-0x000000000432D000-memory.dmp

Filesize
372KB

Download
memory/3284-977-0x00000000042D0000-0x000000000432D000-memory.dmp

Filesize
372KB

Download
memory/3284-976-0x00000000042D0000-0x000000000432D000-memory.dmp

Filesize
372KB

Download
memory/3284-978-0x00000000042D0000-0x000000000432D000-memory.dmp

Filesize
372KB

Download
memory/3284-979-0x00000000042D0000-0x000000000432D000-memory.dmp

Filesize
372KB

Download