███▄ ▄███▓ ▒█████ ██▀███ ▄▄▄█████▓ ▒█████ ██▀███ ██▓ ██▓███ ▓██▒▀█▀ ██▒▒██▒ ██▒▓██ ▒ ██▒▓ ██▒ ▓▒▒██▒ ██▒ ▓██ ▒ ██▒▓██▒▓██░ ██▒ morto.rip ▓██ ▓██░▒██░ ██▒▓██ ░▄█ ▒▒ ▓██░ ▒░▒██░ ██▒ ▓██ ░▄█ ▒▒██▒▓██░ ██▓▒ morto.rip ▒██ ▒██ ▒██ ██░▒██▀▀█▄ ░ ▓██▓ ░ ▒██ ██░ ▒██▀▀█▄ ░██░▒██▄█▓▒ ▒ morto.rip ▒██▒ ░██▒░ ████▓▒░░██▓ ▒██▒ ▒██▒ ░ ░ ████▓▒░ ██▓ ░██▓ ▒██▒░██░▒██▒ ░ ░ morto.rip ░ ▒░ ░ ░░ ▒░▒░▒░ ░ ▒▓ ░▒▓░ ▒ ░░ ░ ▒░▒░▒░ ▒▓▒ ░ ▒▓ ░▒▓░░▓ ▒▓▒░ ░ ░ morto.rip ░ ░ ░ ░ ▒ ▒░ ░▒ ░ ▒░ ░ ░ ▒ ▒░ ░▒ ░▒ ░ ▒░ ▒ ░░▒ ░ ░ ░ ░ ░ ░ ▒ ░░ ░ ░ ░ ░ ░ ▒ ░ ░░ ░ ▒ ░░░ ░ ░ ░ ░ ░ ░ ░ ░ ░ ░ +---------------------------+-------------------------------------------------------------------+ | FIELD | VALUE | +---------------------------+-------------------------------------------------------------------+ | Stealer Type | LummaC2 Nov 30 2024 | +---------------------------+-------------------------------------------------------------------+ | LID | HpOoIh--73f82eed6521 | +---------------------------+-------------------------------------------------------------------+ | Configuration | b9abc76ce53b6fc3a03566f8f764f5ea | +---------------------------+-------------------------------------------------------------------+ | Malware Path | C:\Users\starp\AppData\Local\Temp\565724\Upon.com | +---------------------------+-------------------------------------------------------------------+ | OS Version | Windows 10 Home (10.0.19045) x64 | +---------------------------+-------------------------------------------------------------------+ | Local Date | 04.12.2024 14:57:09 | +---------------------------+-------------------------------------------------------------------+ | Time Zone | UTC-8 | +---------------------------+-------------------------------------------------------------------+ | Install Date | 17.07.2024 21:10:27 | +---------------------------+-------------------------------------------------------------------+ | Elevated | false | +---------------------------+-------------------------------------------------------------------+ | Computer Name | DESKTOP-GJJR5QM | +---------------------------+-------------------------------------------------------------------+ | Username | starp | +---------------------------+-------------------------------------------------------------------+ | Hostname | DESKTOP-GJJR5QM | +---------------------------+-------------------------------------------------------------------+ | NetBIOS | DESKTOP-GJJR5QM | +---------------------------+-------------------------------------------------------------------+ | Language | en-US | +---------------------------+-------------------------------------------------------------------+ | Antivirus | Windows Defender | +---------------------------+-------------------------------------------------------------------+ | HWID | 4690D9E0B469FD9C836D7512B459CF33 | +---------------------------+-------------------------------------------------------------------+ | RAM Size | 65536 MB (64 GB) | +---------------------------+-------------------------------------------------------------------+ | CPU Vendor | GenuineIntel | +---------------------------+-------------------------------------------------------------------+ | CPU Name | 13th Gen Intel(R) Core(TM) i9-13900K | +---------------------------+-------------------------------------------------------------------+ | CPU Threads | 32 | +---------------------------+-------------------------------------------------------------------+ | CPU Cores | 32 | +---------------------------+-------------------------------------------------------------------+ | GPU | NVIDIA GeForce RTX 4090 | +---------------------------+-------------------------------------------------------------------+ | Display Resolution | 1920x1080 | +---------------------------+-------------------------------------------------------------------+ | IP Address | 104.32.37.62 | +---------------------------+-------------------------------------------------------------------+ | Secondary IP (log) | 108.236.149.45 | +---------------------------+-------------------------------------------------------------------+ | ISP | Charter Communications / Spectrum | +---------------------------+-------------------------------------------------------------------+ | Country | United States (US) | +---------------------------+-------------------------------------------------------------------+ | Time (log) | 05.12.2024 01:57:12 (sig:1733353032.c41d9e836233f8c2d9c1bc50c9f8f9a2) | +---------------------------+-------------------------------------------------------------------+ -------------------------------------------------------------------- GEOGRAPHIC LOCATIONS -------------------------------------------------------------------- +---------------------------+-------------------------------------------------------------------+ | Geolocation (IP) | Lawndale, California, 90260, United States | +---------------------------+-------------------------------------------------------------------+ | City (cookies) | Lawndale, Gardena, Torrance, California | +---------------------------+-------------------------------------------------------------------+ | City (cookies) | Prosper, Aubrey, Frisco, Texas | +---------------------------+-------------------------------------------------------------------+ -------------------------------------------------------------------- EMAIL ADDRESSES -------------------------------------------------------------------- +---------------------------+-------------------------------------------------------------------+ | EMAIL | SOURCE / ASSOCIATION | +---------------------------+-------------------------------------------------------------------+ | starpyro42@yahoo.com | Primary email, Google, Spotify, Pixiv, Funimation, breaches | +---------------------------+-------------------------------------------------------------------+ | starpyro42@outlook.com | Microsoft, Live, Outlook, login_hint | +---------------------------+-------------------------------------------------------------------+ | 22starpyro42@outlook.com | Stealer provider log | +---------------------------+-------------------------------------------------------------------+ | pybro99@yahoo.com | PayPal | +---------------------------+-------------------------------------------------------------------+ | mannygomezluna53@gmail.com| Microsoft signup, Gmail, HudsonRock breach | +---------------------------+-------------------------------------------------------------------+ | egomezlunajr@gmail.com | Personal email, confirmed, recipient | +---------------------------+-------------------------------------------------------------------+ | angie_loves_blue@yahoo.com| Hulu, DoorDash, Uber, Microsoft, MGM Resorts breach | +---------------------------+-------------------------------------------------------------------+ | skarkyscary@gmail.com | Recipient email, stealer log | +---------------------------+-------------------------------------------------------------------+ -------------------------------------------------------------------- PERSONAL NAMES -------------------------------------------------------------------- +---------------------------+-------------------------------------------------------------------+ | NAME | ASSOCIATION | +---------------------------+-------------------------------------------------------------------+ | Eduardo Gomez Luna | Full legal name, autofill, cookies | +---------------------------+-------------------------------------------------------------------+ | Eduardo Gomez Luna Jr | Billing name | +---------------------------+-------------------------------------------------------------------+ | Eduardo | First name (autofill) | +---------------------------+-------------------------------------------------------------------+ | Edaurdo | Typo first name (autofill) | +---------------------------+-------------------------------------------------------------------+ | Gomez Luna | Last name | +---------------------------+-------------------------------------------------------------------+ | Gomez | Last name (HTC Vive login) | +---------------------------+-------------------------------------------------------------------+ | Angelina Gomez Luna | Family member (MGM Resorts breach, Snusbase) | +---------------------------+-------------------------------------------------------------------+ | Starpyro | Discord username, exaroton, general username | +---------------------------+-------------------------------------------------------------------+ | starpyro_ | Twitter, Twitch, Instagram | +---------------------------+-------------------------------------------------------------------+ | starpyro42 | Riot Games, Pixiv, VRChat, Google | +---------------------------+-------------------------------------------------------------------+ | Starpyro42 | VRChat | +---------------------------+-------------------------------------------------------------------+ | FunniStarpy | Discord global name | +---------------------------+-------------------------------------------------------------------+ | butterblok | Roblox | +---------------------------+-------------------------------------------------------------------+ | FunniStarp | Roblox | +---------------------------+-------------------------------------------------------------------+ | fooshfartman | Roblox | +---------------------------+-------------------------------------------------------------------+ | HeavyGuy01 | Roblox | +---------------------------+-------------------------------------------------------------------+ | Mannygolu | Roblox | +---------------------------+-------------------------------------------------------------------+ | yeetyeet23 | ripper.store | +---------------------------+-------------------------------------------------------------------+ | Danna__ | VRChat | +---------------------------+-------------------------------------------------------------------+ | MutieCutie_ | VRChat | +---------------------------+-------------------------------------------------------------------+ | Hevy1 | VRChat | +---------------------------+-------------------------------------------------------------------+ | egomezluna | Costco login, bireport | +---------------------------+-------------------------------------------------------------------+ | Eggo | Alias (autofill) | +---------------------------+-------------------------------------------------------------------+ | Real Goober | Alias (autofill) | +---------------------------+-------------------------------------------------------------------+ | Goober | Recipient name | +---------------------------+-------------------------------------------------------------------+ | Star | Sender name | +---------------------------+-------------------------------------------------------------------+ | malayko | First name (autofill) | +---------------------------+-------------------------------------------------------------------+ | quinonas | Last name (autofill) | +---------------------------+-------------------------------------------------------------------+ | star_42 | Username (autofill) | +---------------------------+-------------------------------------------------------------------+ | Starpy2 | Username (autofill) | +---------------------------+-------------------------------------------------------------------+ | AshCr4ft | Creator name (autofill) | +---------------------------+-------------------------------------------------------------------+ | YepImFloriz | Creator name (autofill) | +---------------------------+-------------------------------------------------------------------+ | Catalog Avatar Creat | Creator name (autofill) | +---------------------------+-------------------------------------------------------------------+ -------------------------------------------------------------------- PHYSICAL ADDRESSES -------------------------------------------------------------------- +---------------------------+-----------------------------------------------+ | ADDRESS | TYPE | +-----------------------------------------------------------+---------------+ | 1363 Tomah Dr, Frisco/Aubrey, Texas (ZIP: 75033, 76227) | Home/Shipping | +-----------------------------------------------------------+---------------+ | 4225 153rd Street, Lawndale, California (ZIP: 90260) | Home/Shipping | +-----------------------------------------------------------+---------------+ | 3208 Webb Ave, Aubrey, Texas (ZIP: 76227) | Billing | +-----------------------------------------------------------+---------------+ | Lawndale, California (ZIP: 90260) | Angelina | +-----------------------------------------------------------+---------------+ -------------------------------------------------------------------- PHONE NUMBERS -------------------------------------------------------------------- +---------------------------+-------------------------------------------------------------------+ | PHONE NUMBER | ASSOCIATION | +---------------------------+-------------------------------------------------------------------+ | (310) 529-0583 | Eduardo Gomez Luna (autofill) | +---------------------------+-------------------------------------------------------------------+ | 3108015268 | Angelina Gomez Luna (MGM Resorts breach, Snusbase) | +---------------------------+-------------------------------------------------------------------+ | ***-***-**83 | DoorDash (Eduardo) | +---------------------------+-------------------------------------------------------------------+ | ********30 | Microsoft (Eduardo) | +---------------------------+-------------------------------------------------------------------+ | ********83 | Uber (Eduardo) | +---------------------------+-------------------------------------------------------------------+ | ***-***-**50 | DoorDash (Angelina) | +---------------------------+-------------------------------------------------------------------+ | ********50 | Microsoft (Angelina), Uber (Angelina) | +---------------------------+-------------------------------------------------------------------+ -------------------------------------------------------------------- PASSWORDS LIST -------------------------------------------------------------------- +---------------------------+-------------------------------------------------------------------+ | PASSWORD | NOTES | +---------------------------+-------------------------------------------------------------------+ | eddieG03 | Primary password, Google, Spotify, Yahoo breaches | +---------------------------+-------------------------------------------------------------------+ | eddieG03* | VRChat, Funimation, Pixiv, Riot Games, HTC Vive | +---------------------------+-------------------------------------------------------------------+ | eddieG03** | Costco (login + bireport) | +---------------------------+-------------------------------------------------------------------+ | eddieG03*yeet | Twitch | +---------------------------+-------------------------------------------------------------------+ | eddieg03* | Yahoo breach (lowercase) | +---------------------------+-------------------------------------------------------------------+ | 12345cool | Roblox (butterblok) | +---------------------------+-------------------------------------------------------------------+ | 123456cool | Roblox (FunniStarp), ripper.store | +---------------------------+-------------------------------------------------------------------+ | danna48303 | VRChat (Danna__) | +---------------------------+-------------------------------------------------------------------+ | farthaha | Roblox (fooshfartman) | +---------------------------+-------------------------------------------------------------------+ | nagolu06 | Roblox (HeavyGuy01) | +---------------------------+-------------------------------------------------------------------+ | nathanok* | VRChat (Hevy1) | +---------------------------+-------------------------------------------------------------------+ | MannyGolu | Microsoft signup (mannygomezluna53@gmail.com) | +---------------------------+-------------------------------------------------------------------+ | Angie2222 | Hulu (angie_loves_blue@yahoo.com), Yahoo breach | +---------------------------+-------------------------------------------------------------------+ | magolu09 | Roblox (Mannygolu) | +---------------------------+-------------------------------------------------------------------+ | Pumpkin21992 | Username value (Edge autofill) | +---------------------------+-------------------------------------------------------------------+ | 075238 | TFA code (conversations_email_tfa_required_form) | +---------------------------+-------------------------------------------------------------------+ | 384875, 936311, 231945 | Challenge codes (autofill) | +---------------------------+-------------------------------------------------------------------+ | 696345, 8 | Verification codes (autofill) | +---------------------------+-------------------------------------------------------------------+ | 401k | Subject line (compose-subject-input) | +---------------------------+-------------------------------------------------------------------+ | mute, 800, 100%, 1280 | Settings values (Opera autofill) | +---------------------------+-------------------------------------------------------------------+ | 720, 72, 4096 | Settings values (Opera autofill) | +---------------------------+-------------------------------------------------------------------+ | Chaos#9 3 3 7 | Input value (autofill) | +---------------------------+-------------------------------------------------------------------+ -------------------------------------------------------------------- PLATFORM CREDENTIALS (COMPLETE LIST) -------------------------------------------------------------------- +---------------------------+-----------------------------+-----------------------------------+ | PLATFORM | USERNAME | PASSWORD | +---------------------------+-----------------------------+-----------------------------------+ | Google | starpyro42@yahoo.com | eddieG03 | +---------------------------+-----------------------------+-----------------------------------+ | Google (breach) | starpyro42@yahoo.com | eddieG03 | +---------------------------+-----------------------------+-----------------------------------+ | Yahoo (breach x4) | starpyro42@yahoo.com | eddieG03 / eddieG03* / eddieg03* | +---------------------------+-----------------------------+-----------------------------------+ | Yahoo (breach) | angie_loves_blue@yahoo.com | Angie2222 | +---------------------------+-----------------------------+-----------------------------------+ | Microsoft / Live | starpyro42@outlook.com | (cookie/session) | +---------------------------+-----------------------------+-----------------------------------+ | Microsoft (signup) | mannygomezluna53@gmail.com | MannyGolu | +---------------------------+-----------------------------+-----------------------------------+ | Microsoft (breach) | mannygomezluna53@gmail.com | MannyGolu | +---------------------------+-----------------------------+-----------------------------------+ | PayPal | pybro99@yahoo.com | eddieG03* | +---------------------------+-----------------------------+-----------------------------------+ | Spotify | starpyro42@yahoo.com | eddieG03 | +---------------------------+-----------------------------+-----------------------------------+ | Twitch | starpyro_ | eddieG03*yeet | +---------------------------+-----------------------------+-----------------------------------+ | Twitter (X) | starpyro_ | eddieG03* | +---------------------------+-----------------------------+-----------------------------------+ | Instagram | starpyro_ | eddieG03* | +---------------------------+-----------------------------+-----------------------------------+ | Roblox | butterblok | 12345cool | +---------------------------+-----------------------------+-----------------------------------+ | Roblox | FunniStarp | 123456cool | +---------------------------+-----------------------------+-----------------------------------+ | Roblox | fooshfartman | farthaha | +---------------------------+-----------------------------+-----------------------------------+ | Roblox | HeavyGuy01 | nagolu06 | +---------------------------+-----------------------------+-----------------------------------+ | Roblox | Mannygolu | magolu09 | +---------------------------+-----------------------------+-----------------------------------+ | VRChat | Danna__ | danna48303 | +---------------------------+-----------------------------+-----------------------------------+ | VRChat | MutieCutie_ | eddieG03* | +---------------------------+-----------------------------+-----------------------------------+ | VRChat | starpyro42 | eddieG03* | +---------------------------+-----------------------------+-----------------------------------+ | VRChat | Starpyro42 | eddieG03* | +---------------------------+-----------------------------+-----------------------------------+ | VRChat | Hevy1 | nathanok* | +---------------------------+-----------------------------+-----------------------------------+ | Funimation | starpyro42@yahoo.com | eddieG03* | +---------------------------+-----------------------------+-----------------------------------+ | Hulu | angie_loves_blue@yahoo.com | Angie2222 | +---------------------------+-----------------------------+-----------------------------------+ | Pixiv | starpyro42@yahoo.com | eddieG03* | +---------------------------+-----------------------------+-----------------------------------+ | Riot Games | starpyro42 | eddieG03* | +---------------------------+-----------------------------+-----------------------------------+ | exaroton | Starpyro | eddieG03* | +---------------------------+-----------------------------+-----------------------------------+ | ripper.store | yeetyeet23 | 123456cool | +---------------------------+-----------------------------+-----------------------------------+ | HTC Vive | Gomez | eddieG03* | +---------------------------+-----------------------------+-----------------------------------+ | Costco (login) | egomezluna | eddieG03** | +---------------------------+-----------------------------+-----------------------------------+ | Costco (bireport) | egomezluna | eddieG03** | +---------------------------+-----------------------------+-----------------------------------+ | Adobe | starpyro42@yahoo.com | (registered - password unknown) | +---------------------------+-----------------------------+-----------------------------------+ | DoorDash (Eduardo) | starpyro42@yahoo.com | (phone: ***-***-**83) | +---------------------------+-----------------------------+-----------------------------------+ | DoorDash (Angelina) | angie_loves_blue@yahoo.com | (phone: ***-***-**50) | +---------------------------+-----------------------------+-----------------------------------+ | Uber (Eduardo) | starpyro42@yahoo.com | (phone: ********83) | +---------------------------+-----------------------------+-----------------------------------+ | Uber (Angelina) | angie_loves_blue@yahoo.com | (phone: ********50) | +---------------------------+-----------------------------+-----------------------------------+ | Chime (Eduardo) | starpyro42@yahoo.com | account_not_found | +---------------------------+-----------------------------+-----------------------------------+ | Chime (Angelina) | angie_loves_blue@yahoo.com | account_not_found | +---------------------------+-----------------------------+-----------------------------------+ | Zoho (both) | Both emails | User does not exists | +---------------------------+-----------------------------+-----------------------------------+ | Apple (both) | Both emails | Input field not found | +---------------------------+-----------------------------+-----------------------------------+ -------------------------------------------------------------------- TOKENS -------------------------------------------------------------------- +---------------------------+-------------------------------------------------------------------+ | TYPE | TOKEN | +---------------------------+-------------------------------------------------------------------+ | Discord | NDg5MjE3MzMzMTMxMjE0ODU4.GH-428.riwso3odKTxJsO1kISYJtQ5i3uxqgZmjVDZlts +---------------------------+-------------------------------------------------------------------+ | Steam | 76561198320320320: eyAidHlwIjogIkpXVCIsICJhbGciOiAiRWREU0EiIH0.eyAiaXNzIjogInN0ZWFtIiwgInN1YiI6ICI3NjU2MTE5ODMyMDMyMDMyMCIsICJhdWQiOiBbICJjbGllbnQiLCAid2ViIiwgInJlbmV3IiwgImRlcml2ZSIgXSwgImV4cCI6IDE3MzkyOTkyODIsICJuYmYiOiAxNzEyNjM2ODg4LCAiaWF0IjogMTcyMTI3Njg4OCwgImp0aSI6ICIwRjkwXzI0QzA5OEEwXzE5NDFBIiwgIm9hdCI6IDE3MjEyNzY4ODgsICJwZXIiOiAxLCAiaXBfc3ViamVjdCI6ICIxMDguMjM2LjE0OS40NSIsICJpcF9jb25maXJtZXIiOiAiMTA3LjExNi4xODUuODYiIH0.myLtyFyU1e2ucYX6ofHOEl7-ahpSyTkgpD-OlTXQ1ZlwzmM9Gh5A2X-8m9kJ9FfI8yregDL7aPetjp2idbf2BQ | +---------------------------+-------------------------------------------------------------------+ -------------------------------------------------------------------- DISCORD INFORMATION -------------------------------------------------------------------- +---------------------------+-------------------------------------------------------------------+ | FIELD | VALUE | +---------------------------+-------------------------------------------------------------------+ | Discord ID | 489217333131214858 | +---------------------------+-------------------------------------------------------------------+ | Username | starpyro | +---------------------------+-------------------------------------------------------------------+ | Global Name | FunniStarpy | +---------------------------+-------------------------------------------------------------------+ | Account Created | 2018-09-11T23:35:01.437000Z | +---------------------------+-------------------------------------------------------------------+ | Avatar Hash | 172e75f71a4453f659d430ff1c342db6 | +---------------------------+-------------------------------------------------------------------+ | Bio | null | +---------------------------+-------------------------------------------------------------------+ | Social Accounts | [] | +---------------------------+-------------------------------------------------------------------+ -------------------------------------------------------------------- CLIPBOARD CONTENT -------------------------------------------------------------------- +---------------------------+-------------------------------------------------------------------+ | Content | 5252 | +---------------------------+-------------------------------------------------------------------+ -------------------------------------------------------------------- INSTALLED SOFTWARE -------------------------------------------------------------------- +---------------------------+-------------------------------------------------------------------+ | SOFTWARE | VERSION / NOTES | +---------------------------+-------------------------------------------------------------------+ | Microsoft Edge | Default browser | +---------------------------+-------------------------------------------------------------------+ | Microsoft Edge WebView2 | Runtime | +---------------------------+-------------------------------------------------------------------+ | Opera GX Stable | Secondary browser | +---------------------------+-------------------------------------------------------------------+ | Steam | Gaming platform | +---------------------------+-------------------------------------------------------------------+ | Rockstar Games Launcher | Gaming | +---------------------------+-------------------------------------------------------------------+ | Epic Games Launcher | Gaming | +---------------------------+-------------------------------------------------------------------+ | OBS Studio | Streaming/recording | +---------------------------+-------------------------------------------------------------------+ | Overwolf | Gaming overlay | +---------------------------+-------------------------------------------------------------------+ | VRCX | VRChat utility | +---------------------------+-------------------------------------------------------------------+ | Modboy | Mod manager (version 3.11) | +---------------------------+-------------------------------------------------------------------+ | Unity 2022.3.22f1 | Game development | +---------------------------+-------------------------------------------------------------------+ | Unity 2022.3.38f1 | Game development | +---------------------------+-------------------------------------------------------------------+ | Microsoft .NET SDK 8.0.404| Development | +---------------------------+-------------------------------------------------------------------+ | Java 8 Update 421 | Runtime | +---------------------------+-------------------------------------------------------------------+ | Java Auto Updater | Java component | +---------------------------+-------------------------------------------------------------------+ | Wondershare Helper Compact| Wondershare component (version 2.6.0) | +---------------------------+-------------------------------------------------------------------+ | Epic Online Services | Epic Games component | +---------------------------+-------------------------------------------------------------------+ | OpenVR-SpaceCalibrator | VR utility | +---------------------------+-------------------------------------------------------------------+ | Microsoft Visual C++ | 2005, 2008, 2010, 2012, 2013, 2015-2022 Redistributables | +---------------------------+-------------------------------------------------------------------+ | Microsoft XNA Framework | 4.0 Refresh | +---------------------------+-------------------------------------------------------------------+ | Launcher Prerequisites | (x64) | +---------------------------+-------------------------------------------------------------------+ -------------------------------------------------------------------- PROCESSES (Running at time of infection) -------------------------------------------------------------------- +---------------------------+--------------------------------------+ | PROCESS | | +---------------------------+--------------------------------------+ | System, Registry, smss.exe, csrss.exe, wininit.exe | | services.exe, lsass.exe, svchost.exe (multiple instances) | | fontdrvhost.exe, WUDFHost.exe, IntelCpHDCPSvc.exe | | NVDisplay.Container.exe, Memory Compression | | wlanext.exe, spoolsv.exe, conhost.exe, OneApp.IGCC.WinService.exe| | nvcontainer.exe, jhi_service.exe, wallpaperservice32.exe | | OVRServiceLauncher.exe, WsNativePushService.exe | | WMIRegistrationService.exe, MpDefenderCoreService.exe | | MsMpEng.exe, gamingservicesnet.exe, gamingservices.exe | | SearchIndexer.exe, AggregatorHost.exe, dllhost.exe | | audiodg.exe, NisSrv.exe, SecurityHealthService.exe | | SgrmBroker.exe, GameInputSvc.exe, MoUsoCoreWorker.exe | | MicrosoftEdgeUpdate.exe, winlogon.exe, dwm.exe | | OVRServer_x64.exe, OVRRedir.exe, taskhostw.exe | | explorer.exe, StartMenuExperienceHost.exe, RuntimeBroker.exe | | UserOOBEBroker.exe, SearchApp.exe, ctfmon.exe | | LockApp.exe, NVIDIA Web Helper.exe, PhoneExperienceHost.exe | | RemoteDesktopCompanion.exe, nvsphelper64.exe, NVIDIA Share.exe | | TextInputHost.exe, SecurityHealthSystray.exe, OneDrive.exe | | ShellExperienceHost.exe, CompPkgSrv.exe | | opera.exe (multiple instances), opera_crashreporter.exe | | Discord.exe (multiple instances) | | steam.exe, steamwebhelper.exe (multiple), steamservice.exe | | VoicemodDesktop.exe, Overwolf.exe, OverwolfBrowser.exe | | Spotify.exe (multiple instances) | | WSHelper.exe, backgroundTaskHost.exe, OverwolfHelper.exe | | OverwolfHelper64.exe, jusched.exe, jucheck.exe | | msedgewebview2.exe (multiple instances) | | EpicGamesLauncher.exe, EpicWebHelper.exe | | WsToastNotification.exe, MusNotifyIcon.exe | | SearchProtocolHost.exe, SearchFilterHost.exe, WmiPrvSE.exe | | smartscreen.exe, FileCoAuth.exe, ApplicationFrameHost.exe | | Upon.com (the stealer itself) | | MortgageTrace.exe, cmd.exe, tasklist.exe, findstr.exe | +---------------------------+--------------------------------------+ -------------------------------------------------------------------- STEALER LOGS - DATAHOUND (starpyro42@yahoo.com) -------------------------------------------------------------------- +---------------------------+-------------------------------------------------------------------+ | Log ID | 5122f95206f5011760c1402d8c82b0f98dde6da9344e0005d1d975f5e9c6a915 | +---------------------------+-------------------------------------------------------------------+ | Machine ID | 675f7132de2d2972a2b270fe | +---------------------------+-------------------------------------------------------------------+ | Machine Name | [US]104.32.37.62_8rpZoWM | +---------------------------+-------------------------------------------------------------------+ | Stealer Family | Lumma | +---------------------------+-------------------------------------------------------------------+ | Compromised Date | 2024-12-04T14:57:09.000Z | +---------------------------+-------------------------------------------------------------------+ | Uploaded Date | 2024-12-16T00:15:45.275Z | +---------------------------+-------------------------------------------------------------------+ | Indexed Date (DataHound) | 2026-02-04T17:52:09Z | +---------------------------+-------------------------------------------------------------------+ | Total Docs | 56 | +---------------------------+-------------------------------------------------------------------+ | Device Users | starp | +---------------------------+-------------------------------------------------------------------+ | HWID | 4690D9E0B469FD9C836D7512B459CF33 | +---------------------------+-------------------------------------------------------------------+ | Device IPs | 1.2.1.1, 104.32.37.62 | +---------------------------+-------------------------------------------------------------------+ | Device Emails | 22starpyro42@outlook.com, egomezlunajr@gmail.com | +---------------------------+-------------------------------------------------------------------+ | Device Emails | skarkyscary@gmail.com, starpyro42@outlook.com | +---------------------------+-------------------------------------------------------------------+ | Discord IDs | 489217333131214858 | +---------------------------+-------------------------------------------------------------------+ | HudsonRock Sites (17) | costco.com, exaroton.com, funimation.com, google.com | +---------------------------+-------------------------------------------------------------------+ | | htcvive.com, hulu.com, instagram.com, live.com | +---------------------------+-------------------------------------------------------------------+ | | paypal.com, pixiv.net, riotgames.com, ripper.store | +---------------------------+-------------------------------------------------------------------+ | | roblox.com, spotify.com, twitch.tv, twitter.com, vrchat.com | +---------------------------+-------------------------------------------------------------------+ -------------------------------------------------------------------- STEALER LOGS - HUDSONROCK API (starpyro42@yahoo.com) -------------------------------------------------------------------- +---------------------------+-----------------------------+-----------------------------------+ | URL | USERNAME | PASSWORD | +---------------------------+-----------------------------+-----------------------------------+ | accounts.google.com | starpyro42@yahoo.com | eddieG03 | +---------------------------+-----------------------------+-----------------------------------+ | accounts.pixiv.net | starpyro42@yahoo.com | eddieG03* | +---------------------------+-----------------------------+-----------------------------------+ | accounts.spotify.com | starpyro42@yahoo.com | eddieG03 | +---------------------------+-----------------------------+-----------------------------------+ | funimation.com | starpyro42@yahoo.com | eddieG03* | +---------------------------+-----------------------------+-----------------------------------+ -------------------------------------------------------------------- STEALER LOGS - HUDSONROCK API (angie_loves_blue@yahoo.com) -------------------------------------------------------------------- +---------------------------+-----------------------------+-----------------------------------+ | URL | USERNAME | PASSWORD | +---------------------------+-----------------------------+-----------------------------------+ | hulu.com/welcome | angie_loves_blue@yahoo.com | Angie2222 | +---------------------------+-----------------------------+-----------------------------------+ -------------------------------------------------------------------- STEALER LOGS - HUDSONROCK API (mannygomezluna53@gmail.com) -------------------------------------------------------------------- +---------------------------+-----------------------------+-----------------------------------+ | URL | USERNAME | PASSWORD | +---------------------------+-----------------------------+-----------------------------------+ | signup.live.com/signup | mannygomezluna53@gmail.com | MannyGolu | +---------------------------+-----------------------------+-----------------------------------+ -------------------------------------------------------------------- DAISY PRIVATE CLOUD LOG -------------------------------------------------------------------- +---------------------------+-------------------------------------------------------------------+ | FIELD | VALUE | +---------------------------+-------------------------------------------------------------------+ | Archive Name | Daisy Private Cloud - 06645 Pcs - 15 Dec - Bonus | +---------------------------+-------------------------------------------------------------------+ | PC Key | Daisy Private Cloud - 06645 Pcs - 15 Dec - Bonus_US41YUFQTDQHTR42U3LPM28YW4W31R56R_2024_12_15T12_47_43_434633 +---------------------------+-------------------------------------------------------------------+ | PC Name | US41YUFQTDQHTR42U3LPM28YW4W31R56R_2024_12_15T12_47_43_434633 | +---------------------------+-------------------------------------------------------------------+ | Ingested At | 2026-03-05T02:35:24.3459512Z | +---------------------------+-------------------------------------------------------------------+ | Malware Family | Lumma (detected), also tagged as Azorult | +---------------------------+-------------------------------------------------------------------+ | Email Count | 8 | +---------------------------+-------------------------------------------------------------------+ | Username Count | 20 | +---------------------------+-------------------------------------------------------------------+ | Password Count | 0 | +---------------------------+-------------------------------------------------------------------+ | Credential Count | 159 | +---------------------------+-------------------------------------------------------------------+ | Phone Count | 0 | +---------------------------+-------------------------------------------------------------------+ | Full Name Count | 0 | +---------------------------+-------------------------------------------------------------------+ | Indicator Count | 1000 | +---------------------------+-------------------------------------------------------------------+ | File Count | 18 | +---------------------------+-------------------------------------------------------------------+ | Sample Domains | yahoo.com, gmail.com, outlook.com, 0.caeseaf, 0.lyqrunkx | +---------------------------+-------------------------------------------------------------------+ | | 0.u.chcey, 06yahoo.com, 0cf.io, 1.utmcsr, 108949970.1730487160.1.1.utmcsr +---------------------------+-------------------------------------------------------------------+ -------------------------------------------------------------------- DAISY CLOUD - CREDENTIAL PAIRS (Exact matches from logs) -------------------------------------------------------------------- +---------------------------+-----------------------------+-----------------------------------+ | USERNAME | PASSWORD | FORMAT | +---------------------------+-----------------------------+-----------------------------------+ | butterblok | 12345cool | normal | +---------------------------+-----------------------------+-----------------------------------+ | starpyro42@yahoo.com | eddieG03 | normal | +---------------------------+-----------------------------+-----------------------------------+ | Danna__ | danna48303 | normal | +---------------------------+-----------------------------+-----------------------------------+ | MutieCutie_ | eddieG03* | normal | +---------------------------+-----------------------------+-----------------------------------+ | FunniStarp | 123456cool | normal | +---------------------------+-----------------------------+-----------------------------------+ | starpyro42 | eddieG03* | normal | +---------------------------+-----------------------------+-----------------------------------+ | fooshfartman | farthaha | normal | +---------------------------+-----------------------------+-----------------------------------+ | HeavyGuy01 | nagolu06 | normal | +---------------------------+-----------------------------+-----------------------------------+ | Gomez | eddieG03* | normal | +---------------------------+-----------------------------+-----------------------------------+ | egomezluna | eddieG03** | normal | +---------------------------+-----------------------------+-----------------------------------+ | starpyro42@yahoo.com | eddieG03* | normal | +---------------------------+-----------------------------+-----------------------------------+ | Hevy1 | nathanok* | normal | +---------------------------+-----------------------------+-----------------------------------+ | mannygomezluna53@gmail.com| MannyGolu | normal | +---------------------------+-----------------------------+-----------------------------------+ | Starpyro | eddieG03* | normal | +---------------------------+-----------------------------+-----------------------------------+ | yeetyeet23 | 123456cool | normal | +---------------------------+-----------------------------+-----------------------------------+ | angie_loves_blue@yahoo.com| Angie2222 | normal | +---------------------------+-----------------------------+-----------------------------------+ | starpyro_ | eddieG03* | normal | +---------------------------+-----------------------------+-----------------------------------+ | starpyro_ | eddieG03*yeet | normal | +---------------------------+-----------------------------+-----------------------------------+ | Mannygolu | magolu09 | normal | +---------------------------+-----------------------------+-----------------------------------+ | pybro99@yahoo.com | eddieG03* | normal | +---------------------------+-----------------------------+-----------------------------------+ | FORM:login-username | VALUE:starpyro42@yahoo.com | autofill | +---------------------------+-----------------------------+-----------------------------------+ | FORM:username | VALUE:Pumpkin21992 | autofill | +---------------------------+-----------------------------+-----------------------------------+ | FORM:345 | VALUE:mute | autofill | +---------------------------+-----------------------------+-----------------------------------+ | FORM:347 | VALUE:800 | autofill | +---------------------------+-----------------------------+-----------------------------------+ | FORM:349 | (no value) | autofill | +---------------------------+-----------------------------+-----------------------------------+ | FORM:360 | VALUE:100% | autofill | +---------------------------+-----------------------------+-----------------------------------+ | FORM:431 | VALUE:-40, 116, 151 | autofill | +---------------------------+-----------------------------+-----------------------------------+ | FORM:432 | VALUE:-100, 23, 74 | autofill | +---------------------------+-----------------------------+-----------------------------------+ | FORM:433 | VALUE:-32, 32, 7 | autofill | +---------------------------+-----------------------------+-----------------------------------+ | FORM:641 | VALUE:Starpy2 | autofill | +---------------------------+-----------------------------+-----------------------------------+ | FORM:643 | VALUE:1280 | autofill | +---------------------------+-----------------------------+-----------------------------------+ | FORM:645 | VALUE:720 | autofill | +---------------------------+-----------------------------+-----------------------------------+ | FORM:646 | VALUE:72 | autofill | +---------------------------+-----------------------------+-----------------------------------+ | FORM:656 | (no value) | autofill | +---------------------------+-----------------------------+-----------------------------------+ | FORM:763 | (no value) | autofill | +---------------------------+-----------------------------+-----------------------------------+ | FORM:766 | VALUE:Orange, Pink_dino, Red_dino | autofill | +---------------------------+-----------------------------+-----------------------------------+ | FORM:768 | VALUE:4096, test, Manuka_faceblueblack | autofill | +---------------------------+-----------------------------+-----------------------------------+ | FORM:770, 771, 781 | (no values) | autofill | +---------------------------+-----------------------------+-----------------------------------+ | FORM::r5: | VALUE:Eduardo | autofill | +---------------------------+-----------------------------+-----------------------------------+ | FORM::r8: | VALUE:Starpyro | autofill | +---------------------------+-----------------------------+-----------------------------------+ | FORM:CAMUsername | VALUE:egomezluna | autofill | +---------------------------+-----------------------------+-----------------------------------+ | FORM:_sUsername | VALUE:star_42 | autofill | +---------------------------+-----------------------------+-----------------------------------+ | FORM:addressLine | (no value) | autofill | +---------------------------+-----------------------------+-----------------------------------+ | FORM:aliasInputBox | VALUE:Eggo | autofill | +---------------------------+-----------------------------+-----------------------------------+ | FORM:billingAddressLine1 | (no value) | autofill | +---------------------------+-----------------------------+-----------------------------------+ | FORM:billingLocality | VALUE:Aubrey | autofill | +---------------------------+-----------------------------+-----------------------------------+ | FORM:billingName | (no value) | autofill | +---------------------------+-----------------------------+-----------------------------------+ | FORM:billingPostalCode | VALUE:76227 | autofill | +---------------------------+-----------------------------+-----------------------------------+ | FORM:cardExpiry | VALUE:08/25 | autofill | +---------------------------+-----------------------------+-----------------------------------+ | FORM:challenge.Code | VALUE:384875, 936311 | autofill | +---------------------------+-----------------------------+-----------------------------------+ | FORM:city | VALUE:Frisco, lawndale | autofill | +---------------------------+-----------------------------+-----------------------------------+ | FORM:code | VALUE:231945, 696345, 8 | autofill | +---------------------------+-----------------------------+-----------------------------------+ | FORM:compose-subject-input| VALUE:401k | autofill | +---------------------------+-----------------------------+-----------------------------------+ | FORM:confirm-email | VALUE:egomezlunajr@gmail.com| autofill | +---------------------------+-----------------------------+-----------------------------------+ | FORM:confirmSenderEmail | VALUE:pybro99@yahoo.com | autofill | +---------------------------+-----------------------------+-----------------------------------+ | FORM:conversations_email_tfa_required_form[code] | VALUE:075238 | autofill | +---------------------------+-----------------------------+-----------------------------------+ | FORM:creatorName | VALUE:AshCr4ft, YepImFloriz | autofill | +---------------------------+-----------------------------+-----------------------------------+ | FORM:email, email_address, guest_email, identifier | VALUE:starpyro42@yahoo.com | autofill | +---------------------------+-----------------------------+-----------------------------------+ | FORM:firstName | VALUE:Edaurdo, malayko | autofill | +---------------------------+-----------------------------+-----------------------------------+ | FORM:first_name | VALUE:Eduardo | autofill | +---------------------------+-----------------------------+-----------------------------------+ | FORM:input | VALUE:Chaos#9 3 3 7 | autofill | +---------------------------+-----------------------------+-----------------------------------+ | FORM:lastName | VALUE:quinonas | autofill | +---------------------------+-----------------------------+-----------------------------------+ | FORM:last_name | VALUE:Gomez, Gomez Luna | autofill | +---------------------------+-----------------------------+-----------------------------------+ | FORM:loginfmt | VALUE:starpyro42@outlook.com| autofill | +---------------------------+-----------------------------+-----------------------------------+ | FORM:missingDigitsParts1 | VALUE:64 | autofill | +---------------------------+-----------------------------+-----------------------------------+ | FORM:nickname | VALUE:stuff | autofill | +---------------------------+-----------------------------+-----------------------------------+ | FORM:payment-widget__checkout__full-name_input | (no value) | autofill | +---------------------------+-----------------------------+-----------------------------------+ | FORM:phoneNumber, phone_number | (no value) | autofill | +---------------------------+-----------------------------+-----------------------------------+ | FORM:private-server-name-text-box | VALUE:e, fight | autofill | +---------------------------+-----------------------------+-----------------------------------+ | FORM:q | (no value) | autofill | +---------------------------+-----------------------------+-----------------------------------+ | FORM:query | VALUE:6005714, horn | autofill | +---------------------------+-----------------------------+-----------------------------------+ | FORM:recipientEmail | VALUE:skarkyscary@gmail.com | autofill | +---------------------------+-----------------------------+-----------------------------------+ | FORM:recipientEmailConfirmation | (no value) | autofill | +---------------------------+-----------------------------+-----------------------------------+ | FORM:recipientName | VALUE:Goober | autofill | +---------------------------+-----------------------------+-----------------------------------+ | FORM:senderEmail | (no value) | autofill | +---------------------------+-----------------------------+-----------------------------------+ | FORM:senderName | VALUE:Star | autofill | +---------------------------+-----------------------------+-----------------------------------+ | FORM:shipping_city, shipping_firstname, shipping_lastname | (no values) | autofill | +---------------------------+-----------------------------+-----------------------------------+ | FORM:shipping_zipcode | VALUE:90260 | autofill | +---------------------------+-----------------------------+-----------------------------------+ | FORM:test | (no value) | autofill | +---------------------------+-----------------------------+-----------------------------------+ | FORM:tl_list-search-box | VALUE:en | autofill | +---------------------------+-----------------------------+-----------------------------------+ | FORM:username_email | VALUE:starpyro42 | autofill | +---------------------------+-----------------------------+-----------------------------------+ | FORM:zipCode | VALUE:75033 | autofill | +---------------------------+-----------------------------+-----------------------------------+ -------------------------------------------------------------------- FILES EXFILTRATED (Daisy Cloud - 18 files) -------------------------------------------------------------------- +---------------------------+-------------------------------------------------------------------+ | FILE PATH | SIZE | CONTENT SUMMARY | +---------------------------+-------------------------------------------------------------------+ | Brute.txt | 132 | 13 passwords (12345cool, eddieG03, danna48303, etc.) | +---------------------------+-------------------------------------------------------------------+ | Processes.txt | 3761 | Full process list at time of infection | +---------------------------+-------------------------------------------------------------------+ | Software.txt | 1338 | Full software list | +---------------------------+-------------------------------------------------------------------+ | System.txt | 1927 | System information, LummaC2 build details | +---------------------------+-------------------------------------------------------------------+ | All Passwords.txt | 4895 | All stolen passwords (Edge + Opera) | +---------------------------+-------------------------------------------------------------------+ | DomainDetect.txt | 36 | paypal.com, instagram.com, twitter.com | +---------------------------+-------------------------------------------------------------------+ | Clipboard.txt | 4 | "5252" | +---------------------------+-------------------------------------------------------------------+ | nefarious.txt | 4029 | Daisy Cloud branding/advertisement | +---------------------------+-------------------------------------------------------------------+ | Edge/Debug.txt | 115 | Edge debug flags | +---------------------------+-------------------------------------------------------------------+ | Cookies_Edge_dev_Default.txt | 15086 | Edge cookies (Microsoft, Bing, LinkedIn, etc.) | +---------------------------+-------------------------------------------------------------------+ | Cookies_Opera_GX_Stable.txt | 524181 | Opera GX cookies (full) | +---------------------------+-------------------------------------------------------------------+ | Steam_Tokens.txt | 518 | Steam token (76561198320320320) | +---------------------------+-------------------------------------------------------------------+ | Edge/Default/Passwords.txt| 2033 | Edge saved passwords | +---------------------------+-------------------------------------------------------------------+ | Edge/Default/Cookies_dev.txt| 15086 | Edge cookies (duplicate) | +---------------------------+-------------------------------------------------------------------+ | Edge/Default/Autofills.txt| 86 | login-username, username values | +---------------------------+-------------------------------------------------------------------+ | Opera/Passwords.txt | 1431 | Opera GX saved passwords | +---------------------------+-------------------------------------------------------------------+ | Opera/Cookies.txt | 524181| Opera GX cookies (duplicate) | +---------------------------+-------------------------------------------------------------------+ | Opera/Autofills.txt | 4315 | Opera GX autofill data | +---------------------------+-------------------------------------------------------------------+ -------------------------------------------------------------------- ACTIVE COOKIE SESSIONS (Partial list) -------------------------------------------------------------------- +---------------------------+-------------------------------------------------------------------+ | DOMAIN | NOTES | +---------------------------+-------------------------------------------------------------------+ | accounts.google.com | Logged in as starpyro42@yahoo.com | +---------------------------+-------------------------------------------------------------------+ | accounts.spotify.com | Session active | +---------------------------+-------------------------------------------------------------------+ | amazon.com | Session active | +---------------------------+-------------------------------------------------------------------+ | apple.com | Lookup performed | +---------------------------+-------------------------------------------------------------------+ | bestbuy.com | Session active, location stored | +---------------------------+-------------------------------------------------------------------+ | bing.com | Session active, logged in as Eduardo | +---------------------------+-------------------------------------------------------------------+ | cashstar.com | Roblox gift card session | +---------------------------+-------------------------------------------------------------------+ | chase.com | Session active (banking) | +---------------------------+-------------------------------------------------------------------+ | chime.com | Lookup performed (account not found) | +---------------------------+-------------------------------------------------------------------+ | copilot.microsoft.com | Session active | +---------------------------+-------------------------------------------------------------------+ | costco.com | Logged in as egomezluna (bireport access) | +---------------------------+-------------------------------------------------------------------+ | discord.com | Session active, token stolen | +---------------------------+-------------------------------------------------------------------+ | doordash.com | Registered (phone: ***-***-**83 / ***-***-**50) | +---------------------------+-------------------------------------------------------------------+ | doubleclick.net | Tracking cookie | +---------------------------+-------------------------------------------------------------------+ | ebay.com | Session active | +---------------------------+-------------------------------------------------------------------+ | epicgames.com | Session active | +---------------------------+-------------------------------------------------------------------+ | etsy.com | Session active | +---------------------------+-------------------------------------------------------------------+ | facebook.com | Session active | +---------------------------+-------------------------------------------------------------------+ | fandom.com | Wiki session | +---------------------------+-------------------------------------------------------------------+ | google.com | Full Google session (Gmail, YouTube, Docs, Lens) | +---------------------------+-------------------------------------------------------------------+ | humblebundle.com | Session active | +---------------------------+-------------------------------------------------------------------+ | hulu.com | Logged in as angie_loves_blue@yahoo.com | +---------------------------+-------------------------------------------------------------------+ | instagram.com | Logged in as starpyro_ | +---------------------------+-------------------------------------------------------------------+ | intelius.com | People search session | +---------------------------+-------------------------------------------------------------------+ | linkedin.com | Session active | +---------------------------+-------------------------------------------------------------------+ | live.com / microsoft.com | Logged in as starpyro42@outlook.com | +---------------------------+-------------------------------------------------------------------+ | makeship.com | Session active | +---------------------------+-------------------------------------------------------------------+ | mercari.com | Session active | +---------------------------+-------------------------------------------------------------------+ | nordvpn.com | Session active | +---------------------------+-------------------------------------------------------------------+ | paypal.com | Logged in as pybro99@yahoo.com | +---------------------------+-------------------------------------------------------------------+ | peoplefinder.com | People search session | +---------------------------+-------------------------------------------------------------------+ | pixiv.net | Logged in as starpyro42@yahoo.com | +---------------------------+-------------------------------------------------------------------+ | reddit.com | Session active | +---------------------------+-------------------------------------------------------------------+ | roblox.com | Logged in (multiple accounts) | +---------------------------+-------------------------------------------------------------------+ | robux.cashstar.com | Gift card session | +---------------------------+-------------------------------------------------------------------+ | schwab.com | Banking session (Charles Schwab) | +---------------------------+-------------------------------------------------------------------+ | spotify.com | Logged in as starpyro42@yahoo.com | +---------------------------+-------------------------------------------------------------------+ | steamcommunity.com | Logged in (Steam token stolen) | +---------------------------+-------------------------------------------------------------------+ | tiktok.com | Session active | +---------------------------+-------------------------------------------------------------------+ | twitch.tv | Logged in as starpyro_ | +---------------------------+-------------------------------------------------------------------+ | twitter.com | Logged in as starpyro_ | +---------------------------+-------------------------------------------------------------------+ | uber.com | Registered (phone: ********83 / ********50) | +---------------------------+-------------------------------------------------------------------+ | vrchat.com | Logged in (multiple accounts) | +---------------------------+-------------------------------------------------------------------+ | whataburger.com | Session active | +---------------------------+-------------------------------------------------------------------+ | yahoo.com | Breach data present (eddieG03, eddieG03*, eddieg03*, Angie2222) | +---------------------------+-------------------------------------------------------------------+ | youtube.com | Session active (via Google) | +---------------------------+-------------------------------------------------------------------+ | zoho.com | Lookup performed (user does not exist) | +---------------------------+-------------------------------------------------------------------+ -------------------------------------------------------------------- OSINT REGISTERED SERVICES (starpyro42@yahoo.com) -------------------------------------------------------------------- +---------------------------+----------------------------------------------------------------------+ | SERVICE | STATUS | DETAILS | +---------------------------+-----------------------------------+----------------------------------+ | Adobe | Account Registered | Avatar URL, Individual account | +---------------------------+-----------------------------------+----------------------------------+ | DoorDash | Account Registered | Masked phone: (***) ***-**83 | +---------------------------+-----------------------------------+----------------------------------+ | HudsonRock | Found in breach | 1 device infected, 17 services | +---------------------------+-----------------------------------+----------------------------------+ | Microsoft | Account Registered | Masked phone: ********30 | +---------------------------+-----------------------------------+----------------------------------+ | Uber | Account Registered | Phone: ********83, OTP methods | +---------------------------+-----------------------------------+----------------------------------+ | Chime | Account Not Found | - | +---------------------------+-----------------------------------+----------------------------------+ | Zoho | User does not exist | - | +---------------------------+-----------------------------------+----------------------------------+ | Apple | Input field not found | - | +---------------------------+-----------------------------------+----------------------------------+ | Recovery | HTTP 504 timeout | - | +---------------------------+-----------------------------------+----------------------------------+ -------------------------------------------------------------------- OSINT REGISTERED SERVICES (angie_loves_blue@yahoo.com) -------------------------------------------------------------------- +---------------------------+-----------------------------------+----------------------------------+ | SERVICE | STATUS | DETAILS | +---------------------------+-----------------------------------+----------------------------------+ | DoorDash | Account Registered | Masked phone: (***) ***-**50 | +---------------------------+-----------------------------------+----------------------------------+ | HudsonRock | Found in breach | Same device as Eduardo | +---------------------------+-----------------------------------+----------------------------------+ | Microsoft | Account Registered | Masked phone: ********50 | +---------------------------+-----------------------------------+----------------------------------+ | Uber | Account Registered | Phone: ********50, OTP methods | +---------------------------+-----------------------------------+----------------------------------+ | Chime | Account Not Found | - | +---------------------------+-----------------------------------+----------------------------------+ | Zoho | User does not exist | - | +---------------------------+-----------------------------------+----------------------------------+ | Apple | Input field not found | - | +---------------------------+-----------------------------------+----------------------------------+ | Recovery | HTTP 504 timeout | - | +---------------------------+-----------------------------------+----------------------------------+ -------------------------------------------------------------------- OSINT REGISTERED SERVICES (mannygomezluna53@gmail.com) -------------------------------------------------------------------- +---------------------------+-----------------------------------+----------------------------------+ | SERVICE | STATUS | DETAILS | +---------------------------+-----------------------------------+----------------------------------+ | HudsonRock | Found in breach | Same device as Eduardo | +---------------------------+-----------------------------------+----------------------------------+ -------------------------------------------------------------------- DATABASE LEAKS (external_intel) -------------------------------------------------------------------- +---------------------------+-----------------------------+-----------------------------------+ | DOMAIN | USERNAME | PASSWORD | +---------------------------+-----------------------------+-----------------------------------+ | accounts.google.com | starpyro42@yahoo.com | eddieG03 | +---------------------------+-----------------------------+-----------------------------------+ | accounts.google.com/signin| starpyro42@yahoo.com | eddieG03 | +---------------------------+-----------------------------+-----------------------------------+ | accounts.pixiv.net | starpyro42@yahoo.com | eddieG03* | +---------------------------+-----------------------------+-----------------------------------+ | yahoo.com | starpyro42@yahoo.com | eddieg03* | +---------------------------+-----------------------------+-----------------------------------+ | yahoo.com | starpyro42@yahoo.com | eddieG03 | +---------------------------+-----------------------------+-----------------------------------+ | yahoo.com | starpyro42@yahoo.com | eddieG03* | +---------------------------+-----------------------------+-----------------------------------+ | yahoo.com | starpyro42@yahoo.com | eddieG03* | +---------------------------+-----------------------------+-----------------------------------+ | yahoo.com | starpyro42@yahoo.com | eddieG03 | +---------------------------+-----------------------------+-----------------------------------+ | hulu.com/welcome | angie_loves_blue@yahoo.com | Angie2222 | +---------------------------+-----------------------------+-----------------------------------+ | yahoo.com | angie_loves_blue@yahoo.com | Angie2222 | +---------------------------+-----------------------------+-----------------------------------+ | gmail.com | mannygomezluna53@gmail.com | MannyGolu | +---------------------------+-----------------------------+-----------------------------------+ | signup.live.com/signup | mannygomezluna53@gmail.com | MannyGolu | +---------------------------+-----------------------------+-----------------------------------+ -------------------------------------------------------------------- BREACH DATABASE - MGM RESORTS (angie_loves_blue@yahoo.com) -------------------------------------------------------------------- +---------------------------+-------------------------------------------------------------------+ | FIELD | VALUE | +---------------------------+-------------------------------------------------------------------+ | Source | 1098_MGMRESORTS_COM_142M_TRAVEL_072019 | +---------------------------+-------------------------------------------------------------------+ | Email | angie_loves_blue@yahoo.com | +---------------------------+-------------------------------------------------------------------+ | Name | Angelina Gomez Luna | +---------------------------+-------------------------------------------------------------------+ | Domain | yahoo.com | +---------------------------+-------------------------------------------------------------------+ | Phone | 3108015268 | +---------------------------+-------------------------------------------------------------------+ | Address | Lawndale CA US 90260 | +---------------------------+-------------------------------------------------------------------+ | Other | 75010748 | +---------------------------+-------------------------------------------------------------------+ -------------------------------------------------------------------- BROWSER HISTORY - SITES VISITED (Sample) -------------------------------------------------------------------- +---------------------------+-------------------------------------------------------------------+ | CATEGORY | SITES | +---------------------------+-------------------------------------------------------------------+ | VRChat / Avatar Modding | vrc-booth.com, booth.pm, gumroad.com, patreon.com | | | vrmodels.store, vrchat.com/home/world | +---------------------------+-------------------------------------------------------------------+ | Gaming | roblox.com, steamcommunity.com, store.steampowered.com | | | fortnite.com, callofduty.com, battle.net | | | epicgames.com, rockstargames.com | +---------------------------+-------------------------------------------------------------------+ | Minecraft / Modding | minecraft.novaskin.me, namemc.com, optifine.net | | | curseforge.com, moddb.com, resourcepack.net | +---------------------------+-------------------------------------------------------------------+ | Social Media | twitter.com, twitch.tv, instagram.com, discord.com | | | reddit.com, tiktok.com, soundcloud.com, spotify.com | +---------------------------+-------------------------------------------------------------------+ | E-commerce / Shopping | amazon.com, bestbuy.com, ebay.com, etsy.com, paypal.com | | | costco.com, makeship.com, merch.devolverdigital.com | | | evike.com (airsoft), digitalstorm.com (gaming PCs) | +---------------------------+-------------------------------------------------------------------+ | File Converters / Tools | onlymp3.net, ythub.cc, ssstik.io, photopea.com | | | mp3cutter.com, remove.bg, unscreen.com, pdfaid.com | +---------------------------+-------------------------------------------------------------------+ | File Hosting | mediafire.com, wetransfer.com | +---------------------------+-------------------------------------------------------------------+ | News / Info / Tech | forbes.com, ign.com, gamespot.com, screenrant.com | | | thegamer.com, cbr.com, si.com, vg247.com, sportingnews.com | | | timesofindia.indiatimes.com, usatoday.com, quora.com | | | stackoverflow.com, github.com, winaero.com | +---------------------------+-------------------------------------------------------------------+ | Productivity / Cloud | google.com, youtube.com, microsoft.com, outlook.live.com | | | dropbox.com, docs.google.com, drive.google.com | +---------------------------+-------------------------------------------------------------------+ | Other | tetr.io, wikipedia.org, humblebundle.com, crunchyroll.com | | | vimm.net, itch.io, steamgifts.com | +---------------------------+-------------------------------------------------------------------+ -------------------------------------------------------------------- DAISY CLOUD ADVERTISEMENT (nefarious.txt) -------------------------------------------------------------------- +---------------------------+-------------------------------------------------------------------+ | CONTENT | | +---------------------------+-------------------------------------------------------------------+ | These logs belong to Daisy Cloud | | Join: https://t.me/+F5lT4yTeIXwxNDc0 | | Join: https://t.me/New_DaisyCloud | | Daisy Private Cloud Pricing: | | 1 Week: $80 | | 2 Week: $120 | | 1 Month: $200 | | 3 Month: $600 | | LifeTime: $5000 | | Monthly: 140k-700k PCS Logs | | Weekly: 35k-175k PCS Logs | | Daily: 5k-25k PCS Logs | | 100+ User reviews, Posts with #REF tags | +---------------------------+-------------------------------------------------------------------+ -------------------------------------------------------------------- MALWARE FAMILY DETECTION -------------------------------------------------------------------- +---------------------------+-------------------------------------------------------------------+ | SOURCE | FAMILY | +---------------------------+-------------------------------------------------------------------+ | System.txt | LummaC2 | +---------------------------+-------------------------------------------------------------------+ | Daisy Cloud JSON | Lumma (also tagged as Azorult) | +---------------------------+-------------------------------------------------------------------+ | DataHound (IP query) | Lumma | +---------------------------+-------------------------------------------------------------------+ | HudsonRock API | Generic Stealer / Lumma | +---------------------------+-------------------------------------------------------------------+ -------------------------------------------------------------------- COMPROMISE PROFILE -------------------------------------------------------------------- +---------------------------+-------------------------------------------------------------------+ | FIELD | VALUE | +---------------------------+-------------------------------------------------------------------+ | Risk Level | medium | +---------------------------+-------------------------------------------------------------------+ | Risk Score | 35 | +---------------------------+-------------------------------------------------------------------+ | Has VPN | false | +---------------------------+-------------------------------------------------------------------+ | Has Cloud | false | +---------------------------+-------------------------------------------------------------------+ | Has Crypto | false | +---------------------------+-------------------------------------------------------------------+ | Has Banking | false (but Chase and Schwab sessions active) | +---------------------------+-------------------------------------------------------------------+ | Has Corporate | false (but Costco bireport access) | +---------------------------+-------------------------------------------------------------------+ | Has Government | false | +---------------------------+-------------------------------------------------------------------+ | Has Healthcare | false | +---------------------------+-------------------------------------------------------------------+ | High Value Count | 0 | +---------------------------+-------------------------------------------------------------------+ | Is Corporate | false | +---------------------------+-------------------------------------------------------------------+ | Work Domains | [] | +---------------------------+-------------------------------------------------------------------+ | Suspected Org | null | +---------------------------+-------------------------------------------------------------------+ | Work Email Count | 0 | +---------------------------+-------------------------------------------------------------------+ | Browser Flags | browser_edge, browser_opera | +---------------------------+-------------------------------------------------------------------+ | Credential Count | 159 | +---------------------------+-------------------------------------------------------------------+ | Avg Password Length | 9 | +---------------------------+-------------------------------------------------------------------+ | Weak Password Count | 147 | +---------------------------+-------------------------------------------------------------------+ | Password Reuse Count | 149 | +---------------------------+-------------------------------------------------------------------+ | Compromise Profile | general | +---------------------------+-------------------------------------------------------------------+ -------------------------------------------------------------------- CORRELATIONS SUMMARY -------------------------------------------------------------------- +---------------------------+-------------------------------------------------------------------+ | All evidence points to a single compromised device: | | Computer Name: DESKTOP-GJJR5QM | | Username: starp | | HWID: 4690D9E0B469FD9C836D7512B459CF33 | | IP: 104.32.37.62 | | Infection Date: 2024-12-04 | | Stealer: LummaC2 | +---------------------------+-------------------------------------------------------------------+ | Three family members identified: | | - Eduardo Gomez Luna (primary victim) | | - Angelina Gomez Luna (family member, same address) | | - Manny Gomez Luna (likely family member, same device) | +---------------------------+-------------------------------------------------------------------+ | Password reuse is extensive: eddieG03 and variants used on | | Google, Spotify, Yahoo, VRChat, Pixiv, Riot Games, HTC Vive, | | Funimation, Twitch, Twitter, Instagram, PayPal, exaroton. | +---------------------------+-------------------------------------------------------------------+ | Active banking/financial sessions: Chase, Schwab, PayPal, Costco | +---------------------------+-------------------------------------------------------------------+ | Active people search sessions: Intelius, PeopleFinder | +---------------------------+-------------------------------------------------------------------+ _ \`*-. ) _`-. . : `. . : _ ' \ ; *` _. `*-._ `-.-' `-. ; ` `. :. . \ . \ . : .-' . ' `+.; ; ' : this paste was made with datavoid.sh only! : ' | ; ;-. https://t.me/datavoidsec ; ' : :`-: _.`* ; [bug] .*' / .*' ; .*`- +' `*' `*-* `*-* `*-*'